defaults/main.yml

@@ -1,38 +1,27 @@
-mumble_domain: "{{ inventory_hostname }}.local"
-
-acme_enabled: no
+acme_enabled: yes
 acme_domains:
-  - name: "{{ mumble_domain }}"
-    hooks: |
-      {{ (
-        'systemctl reload nginx' if mumble_web_enabled else None,
-        'systemctl restart mumble-server' if murmur_enabled else None
-      ) | reject("none") | list }}
-acme_directory_url: https://acme-v02.api.letsencrypt.org/directory
+  - "{{ umurmur_domain }}"
+  - "{{ mumble_web_domain }}"
 
-mumble_web_enabled: no
-mumble_web_domain: "{{ mumble_domain }}"
+mumble_web_enabled: yes
+mumble_web_domain: "{{ inventory_hostname }}.local"
 mumble_web_owner: mumble-web
 mumble_web_group: "{{ mumble_web_owner }}"
 mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem"
 mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
-mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.key"
+mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.pem"
 mumble_web_www_dir: /var/www/mumble-web
-mumble_web_dist_dir: "{{ mumble_web_www_dir }}/dist"
 mumble_web_version: master
 mumble_web_websockify_port: "64737"
 
 mumble_web_nginx_enabled: yes
-mumble_web_nginx_domains: 
-  - "{{ mumble_web_domain }}"
 mumble_web_nginx_config_dir: /etc/nginx
-mumble_web_nginx_log_dir: /var/log/nginx
 mumble_web_nginx_generate_dhparam: yes
 mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem"
 mumble_web_nginx_dhparam_size: 2048
 
-murmur_enabled: no
-murmur_domain: "{{ mumble_domain }}"
+murmur_enabled: yes
+murmur_domain: "{{ mumble_web_domain }}"
 murmur_superuser_password: supersecret
 murmur_database:
   path: "/var/lib/mumble-server/mumble-server.sqlite"
@@ -84,7 +73,7 @@ murmur_register:
 murmur_bonjour_enabled: no
 murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
 murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
-murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.key"
+murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.pem"
 murmur_dhparam: "@ffdhe4096"
 murmur_owner: "mumble-server"
 murmur_group: "{{ murmur_owner }}"
@@ -92,44 +81,38 @@ murmur_client_certificate_required: no
 murmur_send_server_version: yes
 murmur_ice_warn_unknown_properties: yes
 murmur_ice_message_size_max: 65536
-murmur_channels:
-  - name: Root
-    description: Root channel. No entry.
-    groups:
-      admin:
-        inherit: yes
-        inheritable: yes
-    permissions:
-      - group: all
-        deny:
-          - Enter
-        recursive: no
-        enabled: yes
-      - group: all
-        allow:
-          - RegisterSelf
-          - MakeTempChannel
-      - group: admin
-        allow:
-          - MuteDeafen
-          - Move
-          - Kick
-          - Ban
-          - Register
-  - name: Welcome
-    parent: Root
-    description: Welcome channel
-    position: 0
-    isdefault: yes
-  - name: Silent
-    parent: Root
-    description: Silent channel
-    position: 1
-    permissions:
-      - group: all
-        deny:
-          - Speak
-          - MakeTempChannel
-      - group: admin
-        allow:
-          - MakeTempChannel
+
+umurmur_enabled: yes
+umurmur_domain: "{{ mumble_web_domain }}"
+umurmur_max_bandwidth: 48000
+umurmur_max_users: 100
+umurmur_server_password: ""
+umurmur_channels:
+- name: Root
+  description: Root channel. No entry.
+  noenter: yes
+- name: Welcome
+  parent: Root
+  description: Welcome channel
+  position: 0
+- name: Silent
+  parent: Root
+  description: Silent channel
+  silent: yes
+  position: 1
+umurmur_default_channel: Welcome
+umurmur_welcome_text: "Welcome on the {{ inventory_hostname }} Mumble server!"
+umurmur_channel_links:
+- source: "{{ umurmur_default_channel }}"
+  destinations: >-
+    {{ umurmur_channels
+      | selectattr('parent', 'defined')
+      | selectattr('parent', '==', umurmur_default_channel)
+      | map(attribute='name')
+      | list
+    }}
+umurmur_ssl_group: "{{ acme_ssl_group }}"
+umurmur_certificate: "{{ acme_certs_dir }}/{{ umurmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
+umurmur_private_key: "{{ acme_keys_dir }}/{{ umurmur_domain }}.pem"
+umurmur_version: master
+umurmur_port: 64738

files/murmur/mice.yml

@@ -0,0 +1,42 @@
+channels:
+- name: Root
+  description: Root channel. No entry.
+  groups:
+    admin:
+      inherit: true
+      inheritable: true
+  permissions:
+    - group: all
+      deny:
+        - Enter
+      recursive: false
+      enabled: true
+    - group: all
+      allow:
+        - RegisterSelf
+        - MakeTempChannel
+    - group: admin
+      allow:
+        - MuteDeafen
+        - Move
+        - Kick
+        - Ban
+        - Register
+- name: Welcome
+  parent: Root
+  description: Welcome channel
+  position: 0
+  isdefault: true
+- name: Silent
+  parent: Root
+  description: Silent channel
+  position: 1
+  permissions:
+    - group: all
+      deny:
+        - Speak
+        - MakeTempChannel
+      enabled: true
+    - group: admin
+      allow:
+        - MakeTempChannel

files/murmur/scripts/mice.py

@@ -11,7 +11,6 @@ import yaml
 
 import Murmur
 
-
 CONFIG_SEARCH_PATH = [".", "/etc"]
 CONFIG_DEFAULT_NAME = "mice.yml"
 
@@ -272,7 +271,7 @@ class Config:
 
     def parse_channels(self) -> Channel:
         channels = []
-        for channel_dict in self._data:
+        for channel_dict in self._data["channels"]:
             channel = Channel.from_dict(channel_dict)
             channels.append(channel)
 

handlers/main.yml

@@ -3,6 +3,15 @@
     daemon_reload: yes
   register: systemd_reloaded
 
+# In order to take into account rooms config changes, umurmur must be restarted.
+# A simple reload won't work for rooms positionning, for instance.
+- name: restart umurmur
+  service:
+    name: umurmur
+    state: restarted
+  when:
+  - not (umurmur_started.changed | default(false))
+
 - name: restart murmur
   service:
     name: mumble-server

meta/main.yml

@@ -10,7 +10,7 @@ dependencies:
 galaxy_info:
   role_name: mumble
   author: HgO
-  description: Ansible role to install murmur (mumble server) and mumble-web client.
+  description: Ansible role to install umurmur, the minimalistic Mumble server, and mumble-web client.
   company: PPBe
 
   # If the issue tracker for your role is not on github, uncomment the
@@ -50,7 +50,7 @@ galaxy_info:
     versions:
     - all
 
-  galaxy_tags: [mumble,voip,murmur,mumble-web]
+  galaxy_tags: [mumble,voip,umurmur]
     # List tags for your role here, one per line. A tag is a keyword that describes
     # and categorizes the role. Users find roles by searching for tags. Be sure to
     # remove the '[]' above, if you add tags to this list.

molecule/default/converge.yml

@@ -6,6 +6,8 @@
   vars:
     mumble_web_enabled: yes
     murmur_enabled: yes
+    umurmur_enabled: yes
+    umurmur_port: 64739
     acme_enabled: no
 
   roles:

molecule/default/molecule.yml

@@ -30,6 +30,15 @@ platforms:
         guest: 64738
         host: 14738
         protocol: tcp
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64739
+        host: 14739
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64739
+        host: 14739
+        protocol: tcp
   - name: focal-mumble-molecule
     box: ubuntu/focal64
     <<: *hardware
@@ -50,6 +59,15 @@ platforms:
         guest: 64738
         host: 24738
         protocol: tcp
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64739
+        host: 24739
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64739
+        host: 24739
+        protocol: tcp
 provisioner:
   name: ansible
   config_options:

molecule/mumble-web/converge.yml

@@ -6,6 +6,7 @@
   vars:
     mumble_web_enabled: yes
     murmur_enabled: yes
+    umurmur_enabled: no
     acme_enabled: no
 
   roles:

molecule/murmur/converge.yml

@@ -6,6 +6,8 @@
   vars:
     mumble_web_enabled: no
     murmur_enabled: yes
+    umurmur_enabled: no
+    umurmur_port: 64739
     acme_enabled: no
 
   roles:

molecule/umurmur/INSTALL.rst

@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'

molecule/umurmur/converge.yml

@@ -0,0 +1,13 @@
+---
+- name: Converge
+  hosts: all
+  become: yes
+
+  vars:
+    mumble_web_enabled: no
+    murmur_enabled: no
+    umurmur_enabled: yes
+    acme_enabled: no
+
+  roles:
+    - ansible-role-mumble

molecule/umurmur/molecule.yml

@@ -0,0 +1,47 @@
+---
+.hardware: &hardware
+  memory: 1024
+  cpu: 2
+
+dependency:
+  name: galaxy
+driver:
+  name: vagrant
+  provider:
+    name: virtualbox
+platforms:
+  - name: buster-mumble-molecule
+    box: debian/buster64
+    <<: *hardware
+    interfaces:
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 14738
+        protocol: tcp
+  - name: focal-mumble-molecule
+    box: ubuntu/focal64
+    <<: *hardware
+    interfaces:
+      # Umurmur server
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: udp
+      - network_name: forwarded_port
+        guest: 64738
+        host: 24738
+        protocol: tcp
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+verifier:
+  name: ansible

molecule/umurmur/prepare.yml

@@ -0,0 +1,9 @@
+- name: Prepare
+  hosts: all
+  become: yes
+
+  tasks:
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+        cache_valid_time: 3600

tasks/main.yml

@@ -14,12 +14,20 @@
     - acme
 
 - name: Install Self-Signed certificates
-  import_tasks: self_signed.yml
+  include_tasks: self_signed.yml
+  loop: "{{ acme_domains | unique }}"
+  loop_control:
+    loop_var: domain_name
   when: not acme_enabled
   tags:
     - certificate
     - self_signed
 
+- name: Deploy uMurmur server
+  import_tasks: umurmur.yml
+  when: umurmur_enabled
+  tags: umurmur
+
 - name: Deploy Murmur server
   import_tasks: murmur.yml
   when: murmur_enabled

tasks/mumble_web.yml

@@ -63,7 +63,7 @@
 
 - name: Copy mumble-web config file
   template:
-    src: mumble-web/config.js.j2
+    src: mumble-web.js.j2
     dest: "{{ mumble_web_www_dir }}/dist/config.local.js"
     owner: "{{ mumble_web_owner }}"
     group: "{{ mumble_web_group }}"
@@ -72,7 +72,7 @@
 
 - name: Copy mumble-web systemd service
   template:
-    src: mumble-web/mumble-web.service.j2
+    src: mumble-web.service.j2
     dest: /etc/systemd/system/mumble-web.service
     owner: root
     group: root

tasks/murmur.yml

@@ -27,7 +27,7 @@
 
 - name: Copy Murmur config file
   template:
-    src: murmur/mumble-server.ini.j2
+    src: mumble-server.ini.j2
     dest: /etc/mumble-server.ini
     owner: root
     group: "{{ murmur_group }}"
@@ -84,8 +84,7 @@
 
 - name: Copy mice config
   copy:
-    # See https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#formatting-data-yaml-and-json
-    content: "{{ murmur_channels | to_nice_yaml(indent=2, width=10000) }}"
+    src: murmur/mice.yml
     dest: "{{ murmur_ice_config_path }}"
     owner: root
     group: root

tasks/nginx.yml

@@ -1,6 +1,6 @@
 - name: Copy Nginx config file
   template:
-    src: mumble-web/nginx.conf.j2
+    src: nginx.conf.j2
     dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
     owner: root
     group: www-data

tasks/self_signed.yml

@@ -14,28 +14,51 @@
     path: "{{ config_dir }}"
     state: directory
     owner: root
-    group: root
-    mode: "755"
+    group: "{{ acme_ssl_group }}"
+    mode: "711"
   loop:
-    - "{{ acme_config_dir }}"
-    - "{{ acme_certs_dir }}"
-    - "{{ acme_csr_dir }}"
+  - "{{ acme_config_dir }}"
+  - "{{ acme_keys_dir }}"
+  - "{{ acme_accounts_dir }}"
+  - "{{ acme_csr_dir }}"
   loop_control:
     loop_var: config_dir
   tags: selfsigned_install
 
-- name: Create ACME private keys directory
+- name: Create {{ domain_name }} certificates directory
   file:
-    path: "{{ acme_keys_dir }}"
+    path: "{{ acme_certs_dir }}/{{ domain_name }}.d"
     state: directory
     owner: root
     group: "{{ acme_ssl_group }}"
-    mode: "750"
-  tags: acme_install
+    mode: "755"
+  tags: selfsigned_install
 
-- name: Install Self-Signed certificate for each domain
-  include_tasks: self_signed_domain.yml
-  loop: "{{ acme_domains }}"
-  loop_control:
-    loop_var: domain
-    label: "{{ domain.name }}"
+- name: Generate private key for {{ domain_name }} certificate
+  openssl_privatekey:
+    path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "640"
+    type: RSA
+    size: 4096
+
+- name: Generate CSR for {{ domain_name }} certificate
+  openssl_csr:
+    path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
+    owner: root
+    group: "{{ acme_ssl_group }}"
+    mode: "644"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    common_name: "{{ domain_name }}"
+
+- name: Generate self-signed certificate
+  openssl_certificate:
+    path: "{{ acme_certs_dir }}/{{ domain_name }}.d/cert.pem" 
+    csr_path: "{{ acme_csr_dir }}/{{ domain_name }}.csr"
+    privatekey_path: "{{ acme_keys_dir }}/{{ domain_name }}.pem"
+    provider: selfsigned 
+    state: present
+    owner: root 
+    group: "{{ acme_ssl_group }}" 
+    mode: "644"

tasks/self_signed_domain.yml

@@ -1,41 +0,0 @@
-
-- name: Create {{ domain.name }} certificates directory
-  file:
-    path: "{{ acme_certs_dir }}/{{ domain.name }}.d"
-    state: directory
-    owner: root
-    group: root
-    mode: "755"
-  tags: selfsigned_install
-
-- name: Generate private key for {{ domain.name }} certificate
-  openssl_privatekey:
-    path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
-    owner: root
-    group: "{{ acme_ssl_group }}"
-    mode: "640"
-    type: RSA
-    size: 4096
-  tags: selfsigned_config
-
-- name: Generate CSR for {{ domain.name }} certificate
-  openssl_csr:
-    path: "{{ acme_csr_dir }}/{{ domain.name }}.csr"
-    owner: root
-    group: root
-    mode: "644"
-    privatekey_path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
-    common_name: "{{ domain.name }}"
-    subject_alt_name: "{{ domain.alt_names | default([]) | map('regex_replace', '^', 'DNS:') | list }}"
-  tags: selfsigned_config
-
-- name: Generate self-signed certificate
-  openssl_certificate:
-    path: "{{ acme_certs_dir }}/{{ domain.name }}.d/cert.pem" 
-    csr_path: "{{ acme_csr_dir }}/{{ domain.name }}.csr"
-    privatekey_path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
-    provider: selfsigned 
-    state: present
-    owner: root 
-    group: root
-    mode: "644"

tasks/umurmur.yml

@@ -0,0 +1,86 @@
+- name: Install umurmur build dependencies
+  package:
+    name: "{{ package }}"
+    state: present
+  loop:
+  - git
+  - build-essential
+  - cmake
+  - libconfig-dev
+  - libprotobuf-c-dev
+  - libmbedtls-dev
+  - ssl-cert
+  loop_control:
+    loop_var: package
+
+- name: Clone umurmur git repository
+  git:
+    repo: https://github.com/umurmur/umurmur.git
+    dest: /opt/umurmur
+    version: "{{ umurmur_version }}"
+
+- name: Change umurmur git repository's permissions
+  file:
+    path: /opt/umurmur
+    owner: root
+    group: root
+    mode: "775"
+    state: directory
+
+- name: Create the build directory
+  file:
+    path: /opt/umurmur/build
+    owner: root
+    group: root
+    mode: "775"
+    state: directory
+
+- name: Generate the Makefile with cmake
+  shell: cd /opt/umurmur/build && cmake .. -DSSL=mbedtls
+  changed_when: no
+
+- name: Build umurmur from source
+  make:
+    chdir: /opt/umurmur/build
+  changed_when: _umurmur_built.stdout_lines | length > 1
+  register: _umurmur_built
+
+- name: Install umurmur
+  make:
+    chdir: /opt/umurmur/build
+    target: install
+  changed_when: "'Installing' in _umurmur_installed.stdout"
+  register: _umurmur_installed
+  notify: restart umurmur
+
+- name: Copy umurmur config file
+  template:
+    src: umurmur.conf.j2
+    dest: /usr/local/etc/umurmur.conf
+    owner: root
+    group: "{{ umurmur_ssl_group }}"
+    mode: "640"
+    validate: /usr/local/bin/umurmurd -t -c %s
+  notify: restart umurmur
+  tags: umurmur_config
+
+- name: Copy umurmur systemd service
+  template:
+    src: umurmur.service.j2
+    dest: /etc/systemd/system/umurmur.service
+    owner: root
+    group: root
+    mode: "644"
+  notify:
+  - reload systemd
+  - restart umurmur
+
+- name: Start umurmur service
+  service:
+    name: umurmur
+    enabled: yes
+    state: started
+  register: umurmur_started
+
+- name: Trigger umurmur handlers
+  meta: flush_handlers

templates/mumble-server.ini.j2

@@ -140,11 +140,7 @@ pidfile={{ murmur_pid_file | to_json }}
 ; Welcome message sent to clients when they connect.
 ; If the welcome message is set to an empty string,
 ; no welcome message will be sent to clients.
-{% if murmur_welcome_text is string %}
 welcometext={{ murmur_welcome_text | to_json }}
-{% else %}
-welcometext = {{ murmur_welcome_text | join('<br />') | to_json  }};
-{% endif %}
 
 ; Port to bind TCP and UDP sockets to.
 port={{ murmur_port }}

templates/mumble-web.js.j2

@@ -13,7 +13,7 @@ let config = window.mumbleWebConfig // eslint-disable-line no-unused-vars
 config.connectDialog.address = false
 config.connectDialog.port = false
 config.connectDialog.token = false
-config.connectDialog.password = {{ (murmur_server_password != '') | lower }}
+config.connectDialog.password = {{ (umurmur_server_password != '') | lower }}
 
 // Default values for user settings
 // You can see your current value by typing `localStorage.getItem('mumble.$setting')` in the web console.

templates/mumble-web.service.j2

@@ -1,7 +1,7 @@
 [Unit]
 Description=Mumble web client using websockets
-After=network.target murmur.service
-Wants=murmur.service
+After=network.target umurmur.service
+Wants=umurmur.service
 
 [Service]
 Type=simple
@@ -9,7 +9,7 @@ User=nobody
 Group=nogroup
 Restart=always
 RestartSec=3
-ExecStart=/usr/bin/websockify --ssl-target {{ mumble_web_websockify_port }} localhost:{{ murmur_port }}
+ExecStart=/usr/bin/websockify --ssl-target {{ mumble_web_websockify_port }} localhost:{{ umurmur_port }}
 ExecReload=/bin/kill -HUP $MAINPID
 
 [Install]

templates/nginx.conf.j2

@@ -2,29 +2,26 @@
 server {
   listen 80;
   listen [::]:80;
-  server_name {{ mumble_web_nginx_domains | join(' ') }};
+  server_name {{ mumble_web_domain }};
 
   location / {
     return 301 https://$host$request_uri;
   }
   
-{% if acme_enabled %}
+{% if acme_enabled and acme_challenge_dir is defined %}
   location ^~ /.well-known/acme-challenge/ {
 		allow all;
-		root {{ acme_root_dir }};
+		root {{ acme_challenge_dir }};
 		try_files $uri =404;
 	}
 {% endif %}
-
-  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
-  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
 }
 
 server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;
 
-  server_name {{ mumble_web_nginx_domains | join(' ') }};
+  server_name {{ mumble_web_domain }};
 
   ssl_certificate {{ mumble_web_certificate }};
   ssl_certificate_key {{ mumble_web_private_key }};
@@ -53,18 +50,15 @@ server {
 {% endif %}
 
   location / {
-    root {{ mumble_web_dist_dir }};
+    root /var/www/mumble-web/dist/;
   }
 
   location /mumble {
-    proxy_pass http://localhost:{{ mumble_web_websockify_port }};
+    proxy_pass http://127.0.0.1:{{ mumble_web_websockify_port }};
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
   }
-
-  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
-  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
 }
 
 map $http_upgrade $connection_upgrade {

templates/umurmur.conf.j2

@@ -0,0 +1,73 @@
+{{ ansible_managed | comment }}
+max_bandwidth = {{ umurmur_max_bandwidth }};
+{% if umurmur_welcome_text is string %}
+welcometext = {{ umurmur_welcome_text | to_json }};
+{% else %}
+welcometext = {{ umurmur_welcome_text | join('<br />') | to_json  }};
+{% endif %}
+certificate = {{ umurmur_certificate | to_json }};
+private_key = {{ umurmur_private_key | to_json }};
+password = {{ umurmur_server_password | to_json }};
+{% if umurmur_admin_password is defined %}
+admin_password = {{ umurmur_admin_password | to_json }};   # Set to enable admin functionality.
+{% endif %}
+# ban_length = 0;            # Length in seconds for a ban. Default is 0. 0 = forever.
+# enable_ban = false;        # Default is false
+# banfile = "banfile.txt";   # File to save bans to. Default is to not save bans to file.
+# sync_banfile = false;      # Keep banfile synced. Default is false, which means it is saved to at shutdown only.
+allow_textmessage = true;  # Default is true
+# opus_threshold = 100;      # Percentage of users supporting Opus codec for it to be chosen. Default is 100.
+# show_addresses = true;     # Whether to show client's IP addresses under user information
+max_users = {{ umurmur_max_users }};
+
+bindport = {{ umurmur_port }};
+# bindaddr = "0.0.0.0";
+
+# username and groupname for privilege dropping.
+# Will attempt to switch user if set. 
+# username = "";
+# If groupname not set the user's default login group will be used
+# groupname = "";
+
+# Log to file option. Default is logging to syslog.
+# umurmurd will close and reopen the logfile if SIGHUP is received.
+logfile = "/var/log/umurmurd.log";
+
+# CA location for CA-signed certificates
+# ca_path = "/path/to/ca/certificates/";
+
+# Channel tree definition:
+# Root channel must always be defined first.
+# If a channel has a parent, the parent must be defined before the child channel(s).
+channels = (
+{% for channel in umurmur_channels %}
+  {
+    name = {{ channel.name | to_json }};
+    description = {{ channel.description | default('') | to_json }};
+    parent = {{ channel.parent | default('') | to_json }};
+    noenter = {{ channel.noenter | default(false) | string | lower }};
+    silent = {{ channel.silent | default(false) | string | lower }};
+{% if channel.position is defined %}
+    position = {{ channel.position }};
+{% endif %}
+{% if channel.password is defined %}
+    password = {{ channel.password | to_json }};
+{% endif %}
+  }{{ loop.last | ternary("", ",") }}
+{% endfor %}
+);
+# Channel links configuration.
+channel_links = (
+{% for channel in umurmur_channel_links %}
+{% for destination in channel.destinations %}
+  {
+    source = {{ channel.source | to_json }};
+    destination = {{ destination | to_json }};
+  }{{ loop.last | ternary('', ',') }}
+{% endfor %}
+{% endfor %}
+);
+
+# The channel in which users will appear in when connecting.
+# Note that default channel can't have 'noenter = true' or password set
+default_channel = {{ umurmur_default_channel | to_json }};

templates/umurmur.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Minimalistic Mumble server
+After=network.target
+
+[Service]
+Type=simple
+User=nobody
+Group={{ umurmur_ssl_group }}
+Restart=always
+RestartSec=3
+ExecStartPre=/usr/local/bin/umurmurd -t -c /usr/local/etc/umurmur.conf
+ExecStart=/usr/local/bin/umurmurd -d -r -c /usr/local/etc/umurmur.conf
+ExecReload=/bin/kill -HUP $MAINPID
+
+[Install]
+WantedBy=multi-user.target