systemli / ansible-role-mumble

Ansible role to install & maintain mumble-server

ansible-role-mumble

Install and configure a mumble server (murmur). The role can also install mumble-web. Mumble-web requires systemd >= 235 and npm to be installed.

Role Variables

  murmur_database: "/var/lib/mumble-server/mumble-server.sqlite"
  murmur_dbdriver: ""
  murmur_ice: "tcp -h 127.0.0.1 -p 6502"
  murmur_icesecretread: ""
  murmur_icesecretwrite: ""
  murmur_autobanattempts: "10"
  murmur_autobantimeframe: "120"
  murmur_autobantime: "300"
  murmur_logfile: "/var/log/mumble-server/mumble-server.log"
  murmur_pidfile: "/var/run/mumble-server/mumble-server.pid"
  murmur_welcometext: "Welcome on my mumble server!"
  murmur_port: "64738"
  murmur_host: ""
  murmur_serverpassword: ""
  murmur_bandwidth: "72000"
  murmur_users: "100"
  murmur_opusthreshold: "100"
  murmur_channelcountlimit: "1000"
  murmur_channelnestinglimit: "10"
  
  # regexp to validate channel or usernames
  murmur_channelname: ""
  
  murmur_username: ""
  murmur_textmessagelength: "5000"
  murmur_imagemessagelength: "131072"
  murmur_allowhtml: "True"
  
  # murmur_logdays: "-1" to disable logging to db
  murmur_logdays: "-1"
  
  # name for root channel and entry in mumble main server list
  murmur_registername: "MyMumbleServerRegisterName"
  
  murmur_registerpassword: "password"
  
  murmur_registerurl: "https://mymumbleserverurl.org"
  murmur_registerhostname: "mymumblehostname.domain.org"
  
  # for dev
  # murmur_bonjour: "True"
  murmur_bonjour: "False"
  murmur_uname: "mumble-server"
  murmur_certrequired: "False"
  murmur_sendversion: "True"
  murmur_icewarnunknownproperties: "1"
  murmur_icemessagesizemax: "65536"
  
  murmur_sslcert: "/etc/ssl/mumble-server-cert.pem"
  murmur_sslkey: "/etc/ssl/mumble-server-key.pem"
  murmur_sslciphers: "EECDH+AESGCM:EDH+aRSA+AESGCM"
  
  murmur_monitoring_monit_enabled: False
  murmur_monitoring_munin_enabled: False
  murmur_monitoring_munin_packages:
    - python3-zeroc-ice
    - zeroc-ice-slice
  
  # mumble-web settings
  mumble_web: False
  mumble_web_path: /usr/lib/node_modules/mumble-web/
  # to define use yaml multiline string
  mumble_web_config: ""
  # mumble_web_supplementary_groups:
  #   - letsencrypt
  mumble_web_listen: "443"
  mumble_web_ssl_activated: True
  mumble_web_ssl_target: True

Download

Download latest release with ansible-galaxy

ansible-galaxy install systemli.mumble

Example Playbook

- hosts: mumbleservers
  roles:
     - { role: geerlingguy.nodejs }
     - { role: systemli.letsencrypt }
     - { role: systemli.mumble }
  vars:
    letsencrypt_cert:
      name: "{{ murmur_registerhostname }}"
      domains:
        - "{{ murmur_registerhostname }}"
      challenge: dns
      users:
        - "{{ murmur_uname }}"
      services:
        - mumble-server

Testing & Development

Tests

For developing and testing the role we use Github Actions, Molecule, and Vagrant. On the local environment you can easily test the role with

Run local tests with:

molecule test

Requires Molecule, Vagrant and python-vagrant, molecule-goss, molecule-vagrant to be installed.For developing and testing the role we use Travis CI, Molecule and Vagrant. On the local environment you can easily test the role with.

License

GPLv3

Author Information

https://www.systemli.org

ansible-role-mumble's Issues

Is python2 still required?

On newer systems there is no python2.7 available anymore. Is it a hard requirement or just a leftover? I have done a bit of quick searching around and haven't found a definitive answer if mumble web or any of its dependencies require python2.7.

Has anyone tried running it with python3 on a modern system?

ansible-role-mumble/templates/mumble-web.service.j2

Line 6 in 93eb4d3

ExecStart=/usr/bin/python2.7 /usr/bin/python2-websockify \

ansible-role-mumble/tasks/mumble-web.yml

Line 24 in 93eb4d3

path: /usr/bin/python2.7

Public server registration should be disabled by default

The current default behaviour of this role is to configure the Murmur server to attempt to register itself with the public server registry, using the string password as the registration password. This is very insecure and could potentially lead to a lot of public server entries overtaken by spammers and other bad actors. Many people may not be willing to register their server publicly in the first place.

According to the documentation, setting the registerPassword value to be empty will disable the public server registration. I think this is what should be done by default.