fix caddyfile

Reviewed-on: #2

defaults/main.yml

@@ -1,17 +1,34 @@
-mumble_web_domain: "mumble.example.com"
+mumble_domain: "{{ inventory_hostname }}.local"
+
+acme_enabled: no
+acme_domains:
+  - name: "{{ murmur_domains | first }}"
+    alt_domains: "{{ murmur_domains[1:] }}"
+    hooks:
+      - systemctl restart mumble-server
+acme_directory_url: https://acme-v02.api.letsencrypt.org/directory
+
+mumble_web_enabled: no
+mumble_web_domains:
+  - "{{ mumble_domain }}"
 mumble_web_owner: mumble-web
 mumble_web_group: "{{ mumble_web_owner }}"
-mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/fullchain.pem"
-mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
-mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
-mumble_web_dhparam: "/etc/nginx/ssl/dhparam.pem"
-mumble_web_www_dir: /var/www/mumble-web
+mumble_web_home_dir: /var/www/mumble-web
+mumble_web_code_dir: "{{ mumble_web_home_dir }}/code"
+mumble_web_dist_dir: "{{ mumble_web_code_dir }}/dist"
 mumble_web_version: master
 mumble_web_websockify_port: "64737"
 
-murmur_domain: "{{ mumble_web_domain }}"
-murmur_enabled: yes
-# murmur_superuser_password: "supersecret"
+mumble_web_caddy_enabled: yes
+caddy_config_dir: /etc/caddy/conf.d
+caddy_log_dir: /var/log/caddy
+caddy_owner: caddy
+caddy_group: caddy
+
+murmur_enabled: no
+murmur_domains: 
+  - "{{ mumble_domain }}"
+murmur_superuser_password: supersecret
 murmur_database:
   path: "/var/lib/mumble-server/mumble-server.sqlite"
   # driver: "QMYSQL"
@@ -20,18 +37,23 @@ murmur_database:
   # host: "localhost"
   # port: 3306
   # prefix: "murmur_"
-murmur_ice: "tcp -h 127.0.0.1 -p 6502"
-# murmur_ice_secret_read: "somesecret"
-# murmur_ice_secret_write: "anothersecret"
+murmur_ice_host: "127.0.0.1"
+murmur_ice_port: 6502
+# Give read permission on ICE connection. Empty secret will deny read permission to anybody.
+murmur_ice_secret_read: "{{ lookup('password', '/tmp/murmur-ice-read.secret length=50') }}"
+# Give write permission on ICE connection. Empty secret will deny write permission to anybody.
+murmur_ice_secret_write: "{{ lookup('password', '/tmp/murmur-ice-write.secret length=50') }}"
+
 murmur_autoban_attempts: 10
 murmur_autoban_timeframe: 120
 murmur_autoban_time: 300
 murmur_log_file: "/var/log/mumble-server/mumble-server.log"
 murmur_pid_file: "/var/run/mumble-server/mumble-server.pid"
 murmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
-murmur_port: 64738
 # Leave blank to let Murmur bind to all available addresses
 murmur_host: ""
+murmur_port: 64738
+# Password to join the server
 murmur_server_password: ""
 murmur_max_bandwidth: 72000
 murmur_max_users: 100
@@ -47,40 +69,62 @@ murmur_allow_html: yes
 # Set to 0 to keep logs forever, or -1 to disable logging to the DB.
 murmur_log_days: -1
 # Name for root channel and entry in mumble main server list
-# murmur_register:
-#   name: "MyMumbleServerRegisterName"
-#   password: "password"
-#   url: "https://mymumbleserverurl.org"
-#   hostname: "mymumblehostname.domain.org"
+murmur_register_enabled: no
+murmur_register:
+  name: "MyMumbleServerRegisterName"
+  password: "password"
+  url: "https://mymumbleserverurl.org"
+  hostname: "mymumblehostname.domain.org"
 # Enable Bonjour for dev purpose
 murmur_bonjour_enabled: no
-murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/fullchain.pem"
-murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
-murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem"
+murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domains | first }}.d/fullchain.pem"
+murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domains | first }}.d/chain.pem"
+murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domains | first }}.key"
 murmur_dhparam: "@ffdhe4096"
 murmur_owner: "mumble-server"
 murmur_group: "{{ murmur_owner }}"
 murmur_client_certificate_required: no
 murmur_send_server_version: yes
-murmur_ice_warn_unknown_properties: 1
+murmur_ice_warn_unknown_properties: yes
 murmur_ice_message_size_max: 65536
-
-umurmur_domain: "{{ mumble_web_domain }}"
-umurmur_enabled: yes
-umurmur_max_bandwidth: 48000
-umurmur_server_password: ""
-umurmur_channel_links:
-- source: "{{ umurmur_default_channel }}"
-  destinations: >-
-    {{ umurmur_channels
-      | selectattr('parent', 'defined')
-      | selectattr('parent', '==', umurmur_default_channel)
-      | map(attribute='name')
-      | list
-    }}
-umurmur_ssl_group: "{{ acme_ssl_group }}"
-umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/fullchain.pem"
-umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
-umurmur_version: master
-umurmur_ispublic: yes
-umurmur_port: "64738"
+murmur_channels:
+  - name: Root
+    description: Root channel. No entry.
+    groups:
+      admin:
+        inherit: yes
+        inheritable: yes
+    permissions:
+      - group: all
+        deny:
+          - Enter
+        recursive: no
+        enabled: yes
+      - group: all
+        allow:
+          - RegisterSelf
+          - MakeTempChannel
+      - group: admin
+        allow:
+          - MuteDeafen
+          - Move
+          - Kick
+          - Ban
+          - Register
+  - name: Welcome
+    parent: Root
+    description: Welcome channel
+    position: 0
+    isdefault: yes
+  - name: Silent
+    parent: Root
+    description: Silent channel
+    position: 1
+    permissions:
+      - group: all
+        deny:
+          - Speak
+          - MakeTempChannel
+      - group: admin
+        allow:
+          - MakeTempChannel

files/murmur/scripts/mice.py

@@ -0,0 +1,346 @@
+#!/usr/bin/python3
+
+import argparse
+import logging
+import os
+import sys
+from typing import List, Dict
+
+import Ice
+import yaml
+
+import Murmur
+
+
+CONFIG_SEARCH_PATH = [".", "/etc"]
+CONFIG_DEFAULT_NAME = "mice.yml"
+
+ICE_DEFAULT_HOST = "127.0.0.1"
+ICE_DEFAULT_PORT = 6502
+ICE_DEFAULT_TIMEOUT = 1000
+
+
+class Mice:
+    def __init__(self, host: str = ICE_DEFAULT_HOST,
+                 port: int = ICE_DEFAULT_PORT, secret: str = None,
+                 timeout: int = ICE_DEFAULT_TIMEOUT):
+        logging.debug("Initializing ICE connection")
+        properties = Ice.createProperties()
+        properties.setProperty("Ice.ImplicitContext", "Shared")
+        init_data = Ice.InitializationData()
+        init_data.properties = properties
+        self._communicator = Ice.initialize(init_data)
+
+        if secret:
+            logging.debug("Providing ICE secret")
+            self._communicator.getImplicitContext().put("secret", secret)
+
+        logging.debug("Creating meta proxy")
+        proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}"
+        proxy = self._communicator.stringToProxy(proxy_str)
+        self.meta = Murmur.MetaPrx.checkedCast(proxy)
+
+        if not self.meta:
+            self._communicator.destroy()
+            raise RuntimeError(f"Invalid Proxy: {proxy_str}")
+
+        try:
+            logging.debug("Retrieving the list of Mumble servers")
+            servers = self.meta.getAllServers()
+        except Murmur.InvalidSecretException:
+            self._communicator.destroy()
+            raise RuntimeError(f"Failed to connect to {host} "
+                               f"on port {port}: Invalid secret.") from None
+        self.servers = [MurmurServer(server) for server in servers]
+
+        if len(self.servers) == 0:
+            self._communicator.destroy()
+            raise RuntimeError("No Mumble server found")
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        self._communicator.destroy()
+
+
+class ChannelGroup:
+    def __init__(self, name: str, inherit: bool = True,
+                 inheritable: bool = True):
+        self.name = name
+        self.inherit = inherit
+        self.inheritable = inheritable
+
+    def get_state(self) -> Murmur.Group:
+        return Murmur.Group(
+            name=self.name,
+            inherit=self.inherit,
+            inheritable=self.inheritable
+        )
+
+    @staticmethod
+    def from_dict(group_dict: Dict[str, object]) -> "ChannelGroup":
+        return ChannelGroup(
+            name=group_dict["name"],
+            inherit=group_dict.get("inherit", True),
+            inheritable=group_dict.get("inheritable", True)
+        )
+
+
+class ChannelPermission:
+    def __init__(self, group: str = "all", userid: int = -1,
+                 allow: int = 0, deny: int = 0,
+                 recursive: bool = True, enabled: bool = True):
+        self.group = group
+        self.userid = userid
+        self.allow = allow
+        self.deny = deny
+        self.recursive = recursive
+        self.enabled = enabled
+
+    def get_acl(self) -> Murmur.ACL:
+        return Murmur.ACL(
+            applyHere=self.enabled,
+            applySubs=self.recursive,
+            userid=self.userid,
+            group=self.group,
+            allow=self.allow,
+            deny=self.deny)
+
+    @staticmethod
+    def from_dict(permission_dict: Dict[str, object]) -> "ChannelPermission":
+        allow = ChannelPermission._parse_rules(
+            permission_dict.get("allow", []))
+        deny = ChannelPermission._parse_rules(
+            permission_dict.get("deny", []))
+
+        return ChannelPermission(
+            group=permission_dict["group"],
+            allow=allow,
+            deny=deny,
+            recursive=permission_dict.get("recursive", True),
+            enabled=permission_dict.get("enabled", True))
+
+    @staticmethod
+    def _parse_rule(rule: str) -> int:
+        return getattr(Murmur, "Permission" + rule)
+
+    @staticmethod
+    def _parse_rules(rules: List[str]) -> int:
+        result = 0
+        for rule in rules:
+            result |= ChannelPermission._parse_rule(rule)
+        return result
+
+
+class Channel:
+    def __init__(self, name: str, description: str = "", position: int = 0,
+                 groups: List[ChannelGroup] = [],
+                 permissions: List[ChannelPermission] = [],
+                 inherit: bool = True, isdefault: bool = False,
+                 parent: "Channel" = None):
+        self.id = -1
+        self.name = name
+        self.description = description
+        self.position = position
+        self.groups = groups
+        self.permissions = permissions
+        self.inherit = inherit
+        self.isdefault = isdefault
+        self.parent = parent
+        self.children = []
+
+    def __str__(self) -> str:
+        return self.name
+
+    def get_state(self) -> Murmur.Channel:
+        if self.parent is None:
+            parent_id = 0
+        else:
+            parent_id = self.parent.id
+
+        return Murmur.Channel(
+            id=self.id,
+            name=self.name,
+            description=self.description,
+            position=self.position,
+            parent=parent_id)
+
+    def add(self, channel: "Channel") -> None:
+        self.children.append(channel)
+        channel.parent = self
+
+    @staticmethod
+    def from_dict(channel_dict: Dict[str, object]) -> "Channel":
+        if "parent" in channel_dict:
+            parent = Channel(channel_dict["parent"])
+        else:
+            parent = None
+
+        groups = []
+        for group_name, group_dict in channel_dict.get("groups", {}).items():
+            group_dict["name"] = group_name
+            group = ChannelGroup.from_dict(group_dict)
+            groups.append(group)
+
+        permissions = []
+        for permission_dict in channel_dict.get("permissions", []):
+            permission = ChannelPermission.from_dict(permission_dict)
+            permissions.append(permission)
+
+        return Channel(
+            name=channel_dict["name"],
+            description=channel_dict.get("description", ''),
+            position=channel_dict.get("position", 0),
+            groups=groups,
+            permissions=permissions,
+            inherit=channel_dict.get("inherit", True),
+            isdefault=channel_dict.get("isdefault", False),
+            parent=parent)
+
+
+class MurmurServer:
+    def __init__(self, server: Murmur.Server):
+        self._server = server
+
+    def clear_acls(self, channel_id=0):
+        _, groups, inherit = self._server.getACL(0)
+        self._server.setACL(channel_id, [], groups, inherit)
+
+    def clear_channels(self) -> None:
+        for channel_state in self._server.getChannels().values():
+            if channel_state.id != 0 and channel_state.parent == 0:
+                self._server.removeChannel(channel_state.id)
+        self.clear_acls()
+
+    def set_channel_acls(self, channel: Channel) -> None:
+        acls = []
+        for permission in channel.permissions:
+            acl = permission.get_acl()
+            acls.append(acl)
+
+        _, current_groups, _ = self._server.getACL(channel.id)
+        current_group_names = {group.name: group for group in current_groups}
+
+        groups = []
+        for group in channel.groups:
+            group_state = group.get_state()
+            if group.name in current_group_names:
+                current_group_state = current_group_names[group.name]
+                group_state.add = current_group_state.add
+                group_state.remove = current_group_state.remove
+                del current_group_names[group.name]
+            groups.append(group_state)
+        groups.extend(current_group_names.values())
+
+        self._server.setACL(channel.id, acls, groups, channel.inherit)
+
+    def create_channels(self, channel: Channel) -> None:
+        if channel.parent is None:
+            channel.id = 0
+        else:
+            channel.id = self._server.addChannel(
+                channel.name,
+                channel.parent.id)
+
+        self._server.setChannelState(channel.get_state())
+        self.set_channel_acls(channel)
+
+        if channel.isdefault:
+            self._server.setConf("defaultchannel", str(channel.id))
+
+        for child in channel.children:
+            self.create_channels(child)
+
+
+class Config:
+    def __init__(self, filename: str = None):
+        self.filename = filename
+        self._data = {}
+
+        self.load(filename)
+
+    def load(self, filename: str = None):
+        if not filename:
+            for config_path in CONFIG_SEARCH_PATH:
+                filename = os.path.join(config_path, CONFIG_DEFAULT_NAME)
+                if os.path.exists(filename) and os.path.isfile(filename):
+                    break
+
+        with open(filename, 'r') as ifd:
+            self._data = yaml.safe_load(ifd)
+
+    def parse_channels(self) -> Channel:
+        channels = []
+        for channel_dict in self._data:
+            channel = Channel.from_dict(channel_dict)
+            channels.append(channel)
+
+        channel_names = {channel.name: channel for channel in channels}
+        for channel in channels:
+            if channel.parent is None:
+                continue
+            if channel.parent.name not in channel_names:
+                continue
+            channel_names[channel.parent.name].add(channel)
+
+        root_channels = [channel for channel in channels
+                         if channel.parent is None]
+
+        if len(root_channels) == 0:
+            raise RuntimeError("No root channel found.")
+
+        if len(root_channels) > 1:
+            root_names = root_channels.join(', ')
+            raise RuntimeError(f"Multiple root channels found: {root_names}")
+
+        default_channels = [channel for channel in channels
+                            if channel.isdefault]
+
+        if len(default_channels) > 1:
+            default_names = default_channels.join(', ')
+            raise RuntimeError("Multiple default channels found: "
+                               f"{default_names}")
+
+        return root_channels[0]
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Manage Mumble server through ICE connection",
+        formatter_class=argparse.ArgumentDefaultsHelpFormatter
+    )
+    parser.add_argument("--host", "-H", default=ICE_DEFAULT_HOST,
+                        help="ICE host or ip")
+    parser.add_argument("--port", "-p", default=ICE_DEFAULT_PORT,
+                        help="ICE port number")
+    parser.add_argument("--timeout", "-t", default=ICE_DEFAULT_TIMEOUT,
+                        help="Connection timeout in milliseconds")
+    parser.add_argument("--secret", "-s",
+                        default=os.environ.get("MICE_SECRET"),
+                        help="ICE write secret")
+    parser.add_argument("--server-id", "-i", type=int, default=0,
+                        help="Server ID to manage")
+    parser.add_argument("--config", "-c",
+                        help="Path to the config file.")
+    args = parser.parse_args()
+
+    config = Config(args.config)
+    root_channel = config.parse_channels()
+
+    server_id = args.server_id
+    try:
+        with Mice(args.host, args.port, args.secret, args.timeout) as mice:
+            if not 0 <= server_id < len(mice.servers):
+                raise RuntimeError(f"Cannot find server with ID {server_id}")
+            server = mice.servers[server_id]
+
+            server.clear_channels()
+            server.create_channels(root_channel)
+    except RuntimeError as e:
+        logging.error(e, exc_info=e)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

files/scripts/mice.py

@@ -1,54 +0,0 @@
-#!/usr/bin/python3
-
-import argparse
-import logging
-import sys
-
-import Ice
-
-import Murmur
-
-
-def init(host, port, timeout):
-    logging.debug("Initializing ICE connection")
-    proxy_str = f"Meta: tcp -h {host} -p {port} -t {timeout}"
-    with Ice.initialize() as communicator:
-        proxy = communicator.stringToProxy(proxy_str)
-        mice = Murmur.MetaPrx.checkedCast(proxy)
-
-        if not mice:
-            raise RuntimeError(f"Invalid Proxy: {proxy_str}")
-
-        servers = mice.getAllServers()
-
-        if len(servers) == 0:
-            raise RuntimeError("No Mumble server found")
-
-        return servers
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Manage Mumble server through ICE connection",
-        formatter_class=argparse.ArgumentDefaultsHelpFormatter
-    )
-    parser.add_argument("--host", "-H", default="127.0.0.1",
-                        help="ICE host or ip")
-    parser.add_argument("--port", "-p", default=6502,
-                        help="ICE port number")
-    parser.add_argument("--timeout", "-t", default=1000,
-                        help="Connection timeout in milliseconds")
-    args = parser.parse_args()
-
-    try:
-        servers = init(args.host, args.port, args.timeout)
-    except RuntimeError as e:
-        logging.error(e, exc_info=e)
-        return 1
-
-    for server in servers:
-        print(server.getChannels())
-
-
-if __name__ == "__main__":
-    sys.exit(main())

handlers/main.yml

@@ -3,15 +3,6 @@
     daemon_reload: yes
   register: systemd_reloaded
 
-# In order to take into account rooms config changes, umurmur must be restarted.
-# A simple reload won't work for rooms positionning, for instance.
-- name: restart umurmur
-  service:
-    name: umurmur
-    state: restarted
-  when:
-  - not (umurmur_started.changed | default(false))
-
 - name: restart murmur
   service:
     name: mumble-server
@@ -26,11 +17,20 @@
   when:
   - not (mumble_web_started.changed | default(false))
 
-- name: reload nginx
-  include_tasks: ../handlers/nginx.yml
+- name: reload caddy
+  service:
+    name: caddy
+    state: reloaded
 
 - name: change murmur superuser password
   command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"
   # See https://github.com/mumble-voip/mumble/issues/3911
   # Should be fixed in 1.3.1
   failed_when: no
+
+- name: create murmur channels
+  command:
+    cmd: ./mice.py -c {{ murmur_ice_config_path | quote }}
+    chdir: "{{ murmur_ice_script_dir }}"
+  environment:
+    MICE_SECRET: "{{ murmur_ice_secret_write }}"

handlers/nginx.yml

@@ -1,7 +0,0 @@
-- name: Validate Nginx config
-  command: nginx -t
-
-- name: Reload Nginx server
-  service:
-    name: nginx
-    state: reloaded

meta/main.yml

@@ -1,16 +1,16 @@
 
 dependencies:
 - role: ppbe.acme
-  tags: [acme]
+  tags: [never]
 - role: geerlingguy.nodejs
   vars:
     nodejs_install_npm_user: root
-  tags: [nodejs,mumble_web]
+  tags: [never]
 
 galaxy_info:
   role_name: mumble
   author: HgO
-  description: Ansible role to install umurmur, the minimalistic Mumble server, and mumble-web client.
+  description: Ansible role to install murmur (mumble server) and mumble-web client.
   company: PPBe
 
   # If the issue tracker for your role is not on github, uncomment the
@@ -50,7 +50,7 @@ galaxy_info:
     versions:
     - all
 
-  galaxy_tags: [mumble,voip,umurmur]
+  galaxy_tags: [mumble,voip,murmur,mumble-web]
     # List tags for your role here, one per line. A tag is a keyword that describes
     # and categorizes the role. Users find roles by searching for tags. Be sure to
     # remove the '[]' above, if you add tags to this list.

molecule/default/INSTALL.rst

@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'

molecule/default/converge.yml

@@ -0,0 +1,12 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: yes
+    murmur_enabled: yes
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble

molecule/default/molecule.yml

@@ -0,0 +1,61 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Mumble web client
+      - network_name: forwarded_port
+        guest: 80
+        host: 8080
+      - network_name: forwarded_port
+        guest: 443
+        host: 8443
+      # Murmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: tcp
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Mumble web client
+      - network_name: forwarded_port
+        guest: 80
+        host: 9080
+      - network_name: forwarded_port
+        guest: 443
+        host: 9443
+      # Murmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: tcp
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible

molecule/default/prepare.yml

@@ -0,0 +1,55 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install GPG package
+      package:
+        name: gpg
+        state: present
+
+    - name: Add Caddy2 APT key
+      apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
+        state: present
+
+    - name: Add Caddy2 APT repository
+      apt_repository:
+        repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
+        filename: caddy-stable
+        state: present
+
+    - name: Install caddy package
+      package:
+        name: caddy
+        state: present
+    
+    - name: Create Caddy2 config directory
+      file:
+        path: "/etc/caddy/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    
+    - name: Create Caddy2 log directory
+      file:
+        path: "/var/log/caddy"
+        state: directory
+        owner: caddy
+        group: caddy
+        mode: "0755"
+  
+    - name: Copy Caddy2 config file
+      copy:
+        content:
+          import conf.d/*.conf
+        dest: /etc/caddy/Caddyfile
+        owner: root
+        group: root
+        mode: "0644"

molecule/mumble-web/INSTALL.rst

@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'

molecule/mumble-web/converge.yml

@@ -0,0 +1,12 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: yes
+    murmur_enabled: yes
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble

molecule/mumble-web/molecule.yml

@@ -0,0 +1,43 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Mumble web client
+      - network_name: forwarded_port
+        guest: 80
+        host: 8080
+      - network_name: forwarded_port
+        guest: 443
+        host: 8443
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Mumble web client
+      - network_name: forwarded_port
+        guest: 80
+        host: 9080
+      - network_name: forwarded_port
+        guest: 443
+        host: 9443
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible

molecule/mumble-web/prepare.yml

@@ -0,0 +1,55 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install GPG package
+      package:
+        name: gpg
+        state: present
+
+    - name: Add Caddy2 APT key
+      apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
+        state: present
+
+    - name: Add Caddy2 APT repository
+      apt_repository:
+        repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
+        filename: caddy-stable
+        state: present
+
+    - name: Install caddy package
+      package:
+        name: caddy
+        state: present
+    
+    - name: Create Caddy2 config directory
+      file:
+        path: "/etc/caddy/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    
+    - name: Create Caddy2 log directory
+      file:
+        path: "/var/log/caddy"
+        state: directory
+        owner: caddy
+        group: caddy
+        mode: "0755"
+  
+    - name: Copy Caddy2 config file
+      copy:
+        content:
+          import conf.d/*.conf
+        dest: /etc/caddy/Caddyfile
+        owner: root
+        group: root
+        mode: "0644"

molecule/murmur/INSTALL.rst

@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'

molecule/murmur/converge.yml

@@ -0,0 +1,12 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: no
+    murmur_enabled: yes
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble

molecule/murmur/molecule.yml

@@ -0,0 +1,47 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Murmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: tcp
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Murmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: tcp
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible

molecule/murmur/prepare.yml

@@ -0,0 +1,55 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600
+
+    - name: Install GPG package
+      package:
+        name: gpg
+        state: present
+
+    - name: Add Caddy2 APT key
+      apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
+        state: present
+
+    - name: Add Caddy2 APT repository
+      apt_repository:
+        repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
+        filename: caddy-stable
+        state: present
+
+    - name: Install caddy package
+      package:
+        name: caddy
+        state: present
+    
+    - name: Create Caddy2 config directory
+      file:
+        path: "/etc/caddy/conf.d"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+    
+    - name: Create Caddy2 log directory
+      file:
+        path: "/var/log/caddy"
+        state: directory
+        owner: caddy
+        group: caddy
+        mode: "0755"
+  
+    - name: Copy Caddy2 config file
+      copy:
+        content:
+          import conf.d/*.conf
+        dest: /etc/caddy/Caddyfile
+        owner: root
+        group: root
+        mode: "0644"

tasks/caddy.yml

@@ -0,0 +1,13 @@
+- name: Copy Caddy2 config file
+  template:
+    src: mumble-web/Caddyfile.j2
+    dest: "{{ caddy_config_dir }}/mumble.conf"
+    owner: "{{ caddy_owner }}"
+    group: "{{ caddy_group }}"
+    mode: "0640"
+    validate: caddy validate -adapter caddyfile -config %s
+  notify: reload caddy
+  tags: caddy_config
+
+- name: Trigger Caddy2 handlers
+  meta: flush_handlers

tasks/main.yml

@@ -1,7 +1,17 @@
-- name: Deploy uMurmur server
-  import_tasks: umurmur.yml
-  when: umurmur_enabled
-  tags: umurmur
+- name: Install ACME certificates
+  import_role:
+    name: ppbe.acme
+  when: acme_enabled and murmur_enabled
+  tags:
+    - certificate
+    - acme
+
+- name: Install Self-Signed certificates
+  import_tasks: self_signed.yml
+  when: not acme_enabled and murmur_enabled
+  tags:
+    - certificate
+    - self_signed
 
 - name: Deploy Murmur server
   import_tasks: murmur.yml
@@ -13,7 +23,7 @@
   when: mumble_web_enabled
   tags: mumble_web
 
-- name: Configure Nginx for mumble web client
-  import_tasks: nginx.yml
-  when: mumble_web_enabled
-  tags: nginx
+- name: Configure Caddy2 for mumble web client
+  import_tasks: caddy.yml
+  when: mumble_web_enabled and mumble_web_caddy_enabled
+  tags: caddy

tasks/mumble_web.yml

@@ -1,5 +1,16 @@
+- name: Install NodeJS
+  import_role:
+    name: geerlingguy.nodejs
+  tags: nodejs
+
+- name: Install git package
+  package:
+    name: git
+    state: present
+  tags: mumble_web_install
+
 - name: Install websockify
-  apt:
+  package:
     name: websockify
     state: present
   notify: reload mumble-web
@@ -8,7 +19,7 @@
 - name: Create mumble-web system user
   user:
     name: "{{ mumble_web_owner }}"
-    home: "{{ mumble_web_www_dir }}"
+    home: "{{ mumble_web_home_dir }}"
     groups:
       - www-data
     shell: /sbin/nologin
@@ -16,11 +27,11 @@
     state: present
     system: yes
     append: yes
-    create_home: no
+  tags: mumble_web_install
 
 - name: Change mumble-web home directory's permissions
   file:
-    path: "{{ mumble_web_www_dir }}"
+    path: "{{ mumble_web_home_dir }}"
     owner: "{{ mumble_web_owner }}"
     group: "{{ mumble_web_group }}"
     mode: "755"
@@ -30,33 +41,45 @@
 - name: Clone mumble-web git repository
   git:
     repo: https://github.com/Johni0702/mumble-web.git
-    dest: "{{ mumble_web_www_dir }}"
+    dest: "{{ mumble_web_code_dir }}"
     version: "{{ mumble_web_version }}"
   register: mumble_web_cloned
   become_user: "{{ mumble_web_owner }}"
   tags: mumble_web_install
 
+- name: Check if mumble-web dist directory exists
+  stat:
+    path: "{{ mumble_web_dist_dir }}"
+  register: _mumble_web_dist
+  tags:
+    - mumble_web_install
+    - mumble_web_build
+
 - name: Build mumble-web from sources
-  command: npm clean-install
+  command: npm clean-install {{ mumble_web_dist_dir | quote }}
   args:
-    chdir: "{{ mumble_web_www_dir }}"
+    chdir: "{{ mumble_web_code_dir }}"
   register: _mumble_web_installed
   become_user: "{{ mumble_web_owner }}"
-  when: mumble_web_cloned is changed
-  tags: [mumble_web_install,mumble_web_build]
+  when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists
+  tags:
+    - mumble_web_install
+    - mumble_web_build
 
 - name: Copy mumble-web config file
   template:
-    src: mumble-web.js.j2
-    dest: "{{ mumble_web_www_dir }}/dist/config.local.js"
+    src: mumble-web/config.js.j2
+    dest: "{{ mumble_web_dist_dir }}/config.local.js"
     owner: "{{ mumble_web_owner }}"
     group: "{{ mumble_web_group }}"
     mode: "644"
-  tags: [mumble_web_install,mumble_web_config]
+  tags:
+    - mumble_web_install
+    - mumble_web_config
 
 - name: Copy mumble-web systemd service
   template:
-    src: mumble-web.service.j2
+    src: mumble-web/mumble-web.service.j2
     dest: /etc/systemd/system/mumble-web.service
     owner: root
     group: root
@@ -64,7 +87,9 @@
   notify:
   - reload systemd
   - reload mumble-web
-  tags: [mumble_web_install,mumble_web_config]
+  tags:
+    - mumble_web_install
+    - mumble_web_config
 
 - name: Start mumble-web service
   service:

tasks/murmur.yml

@@ -1,15 +1,18 @@
 - name: Install mumble-server package
-  apt:
-    pkg: mumble-server
+  package:
+    name: mumble-server
     state: present
   register: murmur_installed
+  tags: murmur_install
 
 - name: Install ICE dependencies for Python
-  apt:
-    pkg:
+  package:
+    name:
       - python3-zeroc-ice
+      - python3-yaml
       - zeroc-ice-compilers
     state: present
+  tags: murmur_install
 
 - name: Append ssl-cert group to {{ murmur_owner }} user
   user:
@@ -20,21 +23,26 @@
     append: yes
     system: yes
   notify: restart murmur
+  tags: murmur_install
 
 - name: Copy Murmur config file
   template:
-    src: mumble-server.ini.j2
+    src: murmur/mumble-server.ini.j2
     dest: /etc/mumble-server.ini
     owner: root
     group: "{{ murmur_group }}"
     mode: "640"
   notify: restart murmur
+  tags:
+    - murmur_install
+    - murmur_config
 
 - name: Start mumble-server service
   service:
     name: mumble-server
     enabled: yes
     state: started
+  tags: murmur_install
 
 - name: Write superuser password to a file
   copy:
@@ -45,23 +53,36 @@
     mode: "600"
   when: murmur_superuser_password is defined
   notify: change murmur superuser password
+  tags:
+    - murmur_install
+    - murmur_config
+
+- name: Trigger Murmur handlers
+  meta: flush_handlers
 
 - name: Create mumble-ice directory
   file:
-    path: /opt/mice/
+    path: "{{ murmur_ice_script_dir }}"
     state: directory
     owner: root
     group: root
     mode: "755"
+  tags: 
+    - murmur_install
+    - murmur_ice
 
 - name: Copy mice Python script
   copy:
-    src: scripts/mice.py
-    dest: /opt/mice/mice.py
+    src: murmur/scripts/mice.py
+    dest: "{{ murmur_ice_script_dir }}/mice.py"
     owner: root
     group: root
     mode: "755"
-  register: _murmur_mice_copied
+  notify: create murmur channels
+  register: _murmur_mice_script_copied
+  tags:
+    - murmur_install
+    - murmur_ice
 
 - name: Compile Murmur.ice slice file
   command: |-
@@ -71,5 +92,25 @@
       -I/usr/share/ice/slice \
       /usr/share/slice/Murmur.ice
   args:
-    chdir: /opt/mice/
-  when: _murmur_mice_copied is changed
+    chdir: "{{ murmur_ice_script_dir }}"
+  when: _murmur_mice_script_copied is changed
+  tags:
+    - murmur_install
+    - murmur_ice
+
+- name: Copy mice config
+  copy:
+    # See https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#formatting-data-yaml-and-json
+    content: "{{ murmur_channels | to_nice_yaml(indent=2, width=10000) }}"
+    dest: "{{ murmur_ice_config_path }}"
+    owner: root
+    group: root
+    mode: "644"
+  notify: create murmur channels
+  tags:
+    - murmur_install
+    - murmur_config
+    - murmur_ice
+
+- name: Trigger Mice handlers
+  meta: flush_handlers

tasks/nginx.yml

@@ -1,18 +0,0 @@
-- name: Copy Nginx config file
-  template:
-    src: nginx.conf.j2
-    dest: /etc/nginx/sites-available/mumble.conf
-    owner: root
-    group: www-data
-    mode: "755"
-  notify: reload nginx
-
-- name: Enable Nginx config file
-  file:
-    src: /etc/nginx/sites-available/mumble.conf
-    path: /etc/nginx/sites-enabled/mumble.conf
-    state: link
-  notify: reload nginx
-
-- name: Trigger Nginx handlers
-  meta: flush_handlers

tasks/self_signed.yml

@@ -0,0 +1,38 @@
+- name: Install SSL dependencies
+  package:
+    name:
+      - ssl-cert
+      - python3-openssl
+    state: present
+  tags: selfsigned_install
+
+- name: Create SSL config directories
+  file:
+    path: "{{ config_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "755"
+  loop:
+    - "{{ acme_config_dir }}"
+    - "{{ acme_certs_dir }}"
+    - "{{ acme_csr_dir }}"
+  loop_control:
+    loop_var: config_dir
+  tags: selfsigned_install
+
+- name: Create ACME private keys directory
+  file:
+    path: "{{ acme_keys_dir }}"
+    state: directory
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "750"
+  tags: acme_install
+
+- name: Install Self-Signed certificate for each domain
+  include_tasks: self_signed_domain.yml
+  loop: "{{ acme_domains }}"
+  loop_control:
+    loop_var: domain
+    label: "{{ domain.name }}"

tasks/self_signed_domain.yml

@@ -0,0 +1,42 @@
+
+- name: Create {{ domain.name }} certificates directory
+  file:
+    path: "{{ acme_certs_dir }}/{{ domain.name }}.d"
+    state: directory
+    owner: root
+    group: root
+    mode: "755"
+  tags: selfsigned_install
+
+- name: Generate private key for {{ domain.name }} certificate
+  openssl_privatekey:
+    path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "640"
+    type: RSA
+    size: 4096
+  tags: selfsigned_config
+
+- name: Generate CSR for {{ domain.name }} certificate
+  openssl_csr:
+    path: "{{ acme_csr_dir }}/{{ domain.name }}.csr"
+    owner: root
+    group: root
+    mode: "644"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
+    common_name: "{{ domain.name }}"
+    subject_alt_name: "{{ domain.alt_names | default([]) | map('regex_replace', '^', 'DNS:') | list }}"
+  tags: selfsigned_config
+
+- name: Generate self-signed certificate
+  openssl_certificate:
+    path: "{{ acme_certs_dir }}/{{ domain.name }}.d/fullchain.pem" 
+    csr_path: "{{ acme_csr_dir }}/{{ domain.name }}.csr"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
+    provider: selfsigned 
+    state: present
+    owner: root 
+    group: root
+    mode: "644"
+  tags: selfsigned_config

tasks/umurmur.yml

@@ -1,91 +0,0 @@
-- name: Install umurmur build dependencies
-  apt:
-    name: "{{ package }}"
-  loop:
-  - git
-  - build-essential
-  - cmake
-  - libconfig-dev
-  - libprotobuf-c-dev
-  - libmbedtls-dev
-  - ssl-cert
-  loop_control:
-    loop_var: package
-
-- name: Clone umurmur git repository
-  git:
-    repo: https://github.com/umurmur/umurmur.git
-    dest: /opt/umurmur
-    version: "{{ umurmur_version }}"
-
-- name: Change umurmur git repository's permissions
-  file:
-    path: /opt/umurmur
-    owner: root
-    group: root
-    mode: "775"
-    state: directory
-
-- name: Create the build directory
-  file:
-    path: /opt/umurmur/build
-    owner: root
-    group: root
-    mode: "775"
-    state: directory
-
-- name: Generate the Makefile with cmake
-  shell: cd /opt/umurmur/build && cmake .. -DSSL=mbedtls
-  changed_when: no
-
-- name: Build umurmur from source
-  make:
-    chdir: /opt/umurmur/build
-  changed_when: _umurmur_built.stdout_lines | length > 1
-  register: _umurmur_built
-
-- name: Install umurmur
-  make:
-    chdir: /opt/umurmur/build
-    target: install
-  changed_when: "'Installing' in _umurmur_installed.stdout"
-  register: _umurmur_installed
-  notify: restart umurmur
-
-- name: Copy umurmur config file
-  template:
-    src: umurmur.conf.j2
-    dest: /usr/local/etc/umurmur.conf
-    owner: root
-    group: "{{ umurmur_ssl_group }}"
-    mode: "640"
-    validate: /usr/local/bin/umurmurd -t -c %s
-  notify: restart umurmur
-  tags: umurmur_config
-
-- name: Copy umurmur systemd service
-  template:
-    src: umurmur.service.j2
-    dest: /etc/systemd/system/umurmur.service
-    owner: root
-    group: root
-    mode: "644"
-  notify:
-  - reload systemd
-  - restart umurmur
-
-- name: Start umurmur service
-  service:
-    name: umurmur
-    enabled: yes
-    state: started
-  register: umurmur_started
-
-- name: Trigger umurmur handlers
-  meta: flush_handlers
-
-- name: Open umurmur port with UFW
-  ufw:
-    rule: allow
-    port: "{{ umurmur_port }}"
-  when: umurmur_ispublic | bool

templates/mumble-web/Caddyfile.j2

@@ -0,0 +1,14 @@
+{{ ansible_managed | comment }}
+
+{{ mumble_web_domains | join(', ') }} {
+    root * {{ mumble_web_dist_dir }}
+    file_server
+{% if not acme_enabled %}
+    tls internal
+{% endif %}
+    reverse_proxy /mumble* http://localhost:{{ mumble_web_websockify_port }}
+
+    log {
+        output file {{ caddy_log_dir }}/{{ mumble_web_domains | first }}.log
+    }
+}

templates/mumble-web/config.js.j2

@@ -13,11 +13,11 @@ let config = window.mumbleWebConfig // eslint-disable-line no-unused-vars
 config.connectDialog.address = false
 config.connectDialog.port = false
 config.connectDialog.token = false
-config.connectDialog.password = {{ (umurmur_server_password != '') | lower }}
+config.connectDialog.password = {{ (murmur_server_password != '') | lower }}
 
 // Default values for user settings
 // You can see your current value by typing `localStorage.getItem('mumble.$setting')` in the web console.
 config.settings.pttKey = 'shift'
 
 // Default values (can be changed by passing a query parameter of the same name)
-config.defaults.address = "{{ mumble_web_domain }}/mumble"
+config.defaults.address = "{{ mumble_web_domains | first }}/mumble"

templates/mumble-web/mumble-web.service.j2

@@ -1,7 +1,7 @@
 [Unit]
 Description=Mumble web client using websockets
-After=network.target umurmur.service
-Wants=umurmur.service
+After=network.target murmur.service
+Wants=murmur.service
 
 [Service]
 Type=simple
@@ -9,7 +9,7 @@ User=nobody
 Group=nogroup
 Restart=always
 RestartSec=3
-ExecStart=/usr/bin/websockify --ssl-target {{ mumble_web_websockify_port }} localhost:{{ umurmur_port }}
+ExecStart=/usr/bin/websockify --ssl-target {{ mumble_web_websockify_port }} localhost:{{ murmur_port }}
 ExecReload=/bin/kill -HUP $MAINPID
 
 [Install]

templates/mumble-web/nginx.conf.j2

@@ -2,26 +2,29 @@
 server {
   listen 80;
   listen [::]:80;
-  server_name {{ mumble_web_domain }};
+  server_name {{ mumble_web_domains | join(' ') }};
 
   location / {
     return 301 https://$host$request_uri;
   }
   
-{% if acme_challenge_dir is defined %}
+{% if acme_enabled %}
   location ^~ /.well-known/acme-challenge/ {
 		allow all;
-		root {{ acme_challenge_dir }};
+		root {{ acme_root_dir }};
 		try_files $uri =404;
 	}
 {% endif %}
+
+  access_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-access.log;
+  error_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-error.log;
 }
 
 server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;
 
-  server_name {{ mumble_web_domain }};
+  server_name {{ mumble_web_domains | join(' ') }};
 
   ssl_certificate {{ mumble_web_certificate }};
   ssl_certificate_key {{ mumble_web_private_key }};
@@ -30,8 +33,8 @@ server {
   ssl_session_cache shared:AnsibleSSL:10m;  # about 40000 sessions
   ssl_session_tickets off;
 
-{% if mumble_web_dhparam is defined and mumble_web_dhparam != '' %}
-  ssl_dhparam {{ mumble_web_dhparam }};
+{% if nginx_dhparam %}
+  ssl_dhparam {{ nginx_dhparam }};
 {% endif %}
 
   ssl_protocols TLSv1.2 TLSv1.3;
@@ -44,19 +47,24 @@ server {
   ssl_stapling on;
   ssl_stapling_verify on;
 
+{% if acme_enabled %}
   # Verify chain of trust of OCSP response using Root CA and Intermediate certs
   ssl_trusted_certificate {{ mumble_web_trusted_certificate }};
+{% endif %}
 
   location / {
-    root /var/www/mumble-web/dist/;
+    root {{ mumble_web_dist_dir }};
   }
 
   location /mumble {
-    proxy_pass http://127.0.0.1:{{ mumble_web_websockify_port }};
+    proxy_pass http://localhost:{{ mumble_web_websockify_port }};
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
   }
+
+  access_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-access.log;
+  error_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-error.log;
 }
 
 map $http_upgrade $connection_upgrade {

templates/murmur/mumble-server.ini.j2

@@ -72,7 +72,7 @@ dbOpts={{ murmur_database.opts | default('') | to_json }}
 ; with ICE, you should only use it if you trust all the users who have
 ; shell access to your machine.
 ; Please see the ICE documentation on how to specify endpoints.
-ice="{{ murmur_ice }}"
+ice="tcp -h {{ murmur_ice_host | quote }} -p {{ murmur_ice_port | int }}"
 
 ; Ice primarily uses local sockets. This means anyone who has a
 ; user account on your machine can connect to the Ice services.
@@ -140,7 +140,11 @@ pidfile={{ murmur_pid_file | to_json }}
 ; Welcome message sent to clients when they connect.
 ; If the welcome message is set to an empty string,
 ; no welcome message will be sent to clients.
+{% if murmur_welcome_text is string %}
 welcometext={{ murmur_welcome_text | to_json }}
+{% else %}
+welcometext = {{ murmur_welcome_text | join('<br />') | to_json  }};
+{% endif %}
 
 ; Port to bind TCP and UDP sockets to.
 port={{ murmur_port }}
@@ -227,7 +231,7 @@ allowhtml={{ murmur_allow_html }}
 ;logdays=31
 logdays={{ murmur_log_days }}
 
-{% if murmur_register.name is defined %}
+{% if murmur_register_enabled %}
 ; To enable public server registration, the serverpassword must be blank, and
 ; this must all be filled out.
 ; The password here is used to create a registry for the server name; subsequent
@@ -256,7 +260,9 @@ bonjour={{ murmur_bonjour_enabled }}
 ;sslKey=
 sslCert={{ murmur_certificate | to_json }}
 sslKey={{ murmur_private_key | to_json }}
+{% if acme_enabled %}
 sslCa={{ murmur_trusted_certificate | to_json }}
+{% endif %}
 
 ; The sslDHParams option allows you to specify a PEM-encoded file with
 ; Diffie-Hellman parameters, which will be used as the default Diffie-
@@ -319,5 +325,5 @@ sendversion={{ murmur_send_server_version }}
 ; Please note that this section has to be last in the configuration file.
 ;
 [Ice]
-Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties }}
+Ice.Warn.UnknownProperties={{ murmur_ice_warn_unknown_properties | int }}
 Ice.MessageSizeMax={{ murmur_ice_message_size_max }}

templates/umurmur.conf.j2

@@ -1,72 +0,0 @@
-{{ ansible_managed | comment }}
-max_bandwidth = {{ umurmur_max_bandwidth }};
-welcometext = {{ umurmur_welcome_text
-    if umurmur_welcome_text is string 
-    else (umurmur_welcome_text | join('<br />')) 
-  | to_json }};
-certificate = {{ umurmur_certificate | to_json }};
-private_key = {{ umurmur_private_key | to_json }};
-password = {{ umurmur_server_password | to_json }};
-{% if umurmur_admin_password is defined %}
-admin_password = {{ umurmur_admin_password | to_json }};   # Set to enable admin functionality.
-{% endif %}
-# ban_length = 0;            # Length in seconds for a ban. Default is 0. 0 = forever.
-# enable_ban = false;        # Default is false
-# banfile = "banfile.txt";   # File to save bans to. Default is to not save bans to file.
-# sync_banfile = false;      # Keep banfile synced. Default is false, which means it is saved to at shutdown only.
-allow_textmessage = true;  # Default is true
-# opus_threshold = 100;      # Percentage of users supporting Opus codec for it to be chosen. Default is 100.
-# show_addresses = true;     # Whether to show client's IP addresses under user information
-max_users = {{ umurmur_max_users }};
-
-bindport = {{ umurmur_port }};
-# bindaddr = "0.0.0.0";
-
-# username and groupname for privilege dropping.
-# Will attempt to switch user if set. 
-# username = "";
-# If groupname not set the user's default login group will be used
-# groupname = "";
-
-# Log to file option. Default is logging to syslog.
-# umurmurd will close and reopen the logfile if SIGHUP is received.
-logfile = "/var/log/umurmurd.log";
-
-# CA location for CA-signed certificates
-# ca_path = "/path/to/ca/certificates/";
-
-# Channel tree definition:
-# Root channel must always be defined first.
-# If a channel has a parent, the parent must be defined before the child channel(s).
-channels = (
-{% for channel in umurmur_channels %}
-  {
-    name = {{ channel.name | to_json }};
-    description = {{ channel.description | default('') | to_json }};
-    parent = {{ channel.parent | default('') | to_json }};
-    noenter = {{ channel.noenter | default(false) | string | lower }};
-    silent = {{ channel.silent | default(false) | string | lower }};
-{% if channel.position is defined %}
-    position = {{ channel.position }};
-{% endif %}
-{% if channel.password is defined %}
-    password = {{ channel.password | to_json }};
-{% endif %}
-  }{{ loop.last | ternary("", ",") }}
-{% endfor %}
-);
-# Channel links configuration.
-channel_links = (
-{% for channel in umurmur_channel_links %}
-{% for destination in channel.destinations %}
-  {
-    source = {{ channel.source | to_json }};
-    destination = {{ destination | to_json }};
-  }{{ loop.last | ternary('', ',') }}
-{% endfor %}
-{% endfor %}
-);
-
-# The channel in which users will appear in when connecting.
-# Note that default channel can't have 'noenter = true' or password set
-default_channel = {{ umurmur_default_channel | to_json }};

templates/umurmur.service.j2

@@ -1,16 +0,0 @@
-[Unit]
-Description=Minimalistic Mumble server
-After=network.target
-
-[Service]
-Type=simple
-User=nobody
-Group={{ umurmur_ssl_group }}
-Restart=always
-RestartSec=3
-ExecStartPre=/usr/local/bin/umurmurd -t -c /usr/local/etc/umurmur.conf
-ExecStart=/usr/local/bin/umurmurd -d -r -c /usr/local/etc/umurmur.conf
-ExecReload=/bin/kill -HUP $MAINPID
-
-[Install]
-WantedBy=multi-user.target

vars/main.yml

@@ -0,0 +1,2 @@
+murmur_ice_script_dir: /opt/mice
+murmur_ice_config_path: /etc/mice.yml