From b1af7487d532d16f5a814ea3a21d55e024262405 Mon Sep 17 00:00:00 2001
From: "Casper V. Kristensen" <casper@vkristensen.dk>
Date: Wed, 10 Apr 2024 01:52:08 +0200
Subject: [PATCH] alpha: mumble murmur

---
 hosts/alpha/acme.nix    | 11 +++++++++
 hosts/alpha/default.nix |  2 ++
 hosts/alpha/mumble.nix  | 54 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)
 create mode 100644 hosts/alpha/acme.nix
 create mode 100644 hosts/alpha/mumble.nix

diff --git a/hosts/alpha/acme.nix b/hosts/alpha/acme.nix
new file mode 100644
index 0000000..edb35e7
--- /dev/null
+++ b/hosts/alpha/acme.nix
@@ -0,0 +1,11 @@
+{...}: {
+  security.acme.certs."caspervk.net" = {
+    domain = "*.caspervk.net";
+    reloadServices = [
+      "murmur.service"
+    ];
+  };
+  users.groups.acme.members = [
+    "murmur"
+  ];
+}
diff --git a/hosts/alpha/default.nix b/hosts/alpha/default.nix
index 67de664..07c3ec2 100644
--- a/hosts/alpha/default.nix
+++ b/hosts/alpha/default.nix
@@ -3,8 +3,10 @@
     ../../overlays
     ../../modules/base
     ../../modules/server
+    ./acme.nix
     ./hardware.nix
     ./knot-dns.nix
+    ./mumble.nix
     ./network.nix
   ];
 
diff --git a/hosts/alpha/mumble.nix b/hosts/alpha/mumble.nix
new file mode 100644
index 0000000..f20ebce
--- /dev/null
+++ b/hosts/alpha/mumble.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  secrets,
+  ...
+}: {
+  # Mumble is a free, open source, low latency, high quality voice chat
+  # application.
+  # https://www.mumble.info/
+  # https://www.mumble.info/blog/ (changelog)
+  services.murmur = {
+    enable = true;
+    openFirewall = true;
+    # https://wiki.mumble.info/wiki/Murmur.ini
+    welcometext = "<b>Welcome!</b> Feel free to use <i>Temporary Channels</i> to create a password-protected channel.";
+    users = 9001;
+    bandwidth = 320000;
+    # Explicitly bind on addresses to ensure UDP doesn't break with multiple
+    # interfaces.
+    hostName = "116.203.179.206 2a01:4f8:c2c:71c0::";
+    # https://wiki.mumble.info/wiki/Obtaining_a_Let's_Encrypt_Murmur_Certificate
+    sslCert = "${config.security.acme.certs."caspervk.net".directory}/fullchain.pem";
+    sslKey = "${config.security.acme.certs."caspervk.net".directory}/key.pem";
+    # Register server in the public server registry
+    registerName = "Caspervk's Public Mumble";
+    registerPassword = "$REGISTER_PASSWORD";
+    registerUrl = "https://mumble.caspervk.net";
+    registerHostname = "mumble.caspervk.net";
+    extraConfig = ''
+      # Connect clients to the lobby instead of the root channel the first time
+      # they connect.
+      defaultchannel=1
+    '';
+    environmentFile = config.age.secrets.mumble-environment-file.path;
+  };
+
+  # Persist database
+  environment.persistence."/nix/persist" = {
+    directories = [
+      {
+        directory = "/var/lib/murmur/";
+        user = "murmur";
+        group = "murmur";
+        mode = "0700";
+      }
+    ];
+  };
+
+  age.secrets.mumble-environment-file = {
+    file = "${secrets}/secrets/mumble-environment-file.age";
+    mode = "400";
+    owner = "root";
+    group = "root";
+  };
+}