pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6 cfg = config.services.murmur;
7 forking = cfg.logFile != null;
8 configFile = pkgs.writeText "murmurd.ini" ''
9 database=/var/lib/murmur/murmur.sqlite
10 dbDriver=QSQLITE
11
12 autobanAttempts=${toString cfg.autobanAttempts}
13 autobanTimeframe=${toString cfg.autobanTimeframe}
14 autobanTime=${toString cfg.autobanTime}
15
16 logfile=${optionalString (cfg.logFile != null) cfg.logFile}
17 ${optionalString forking "pidfile=/run/murmur/murmurd.pid"}
18
19 welcometext="${cfg.welcometext}"
20 port=${toString cfg.port}
21
22 ${if cfg.hostName == "" then "" else "host="+cfg.hostName}
23 ${if cfg.password == "" then "" else "serverpassword="+cfg.password}
24
25 bandwidth=${toString cfg.bandwidth}
26 users=${toString cfg.users}
27
28 textmessagelength=${toString cfg.textMsgLength}
29 imagemessagelength=${toString cfg.imgMsgLength}
30 allowhtml=${boolToString cfg.allowHtml}
31 logdays=${toString cfg.logDays}
32 bonjour=${boolToString cfg.bonjour}
33 sendversion=${boolToString cfg.sendVersion}
34
35 ${if cfg.registerName == "" then "" else "registerName="+cfg.registerName}
36 ${if cfg.registerPassword == "" then "" else "registerPassword="+cfg.registerPassword}
37 ${if cfg.registerUrl == "" then "" else "registerUrl="+cfg.registerUrl}
38 ${if cfg.registerHostname == "" then "" else "registerHostname="+cfg.registerHostname}
39
40 certrequired=${boolToString cfg.clientCertRequired}
41 ${if cfg.sslCert == "" then "" else "sslCert="+cfg.sslCert}
42 ${if cfg.sslKey == "" then "" else "sslKey="+cfg.sslKey}
43 ${if cfg.sslCa == "" then "" else "sslCA="+cfg.sslCa}
44
45 ${cfg.extraConfig}
46 '';
47in
48{
49 imports = [
50 (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
51 (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
52 ];
53
54 options = {
55 services.murmur = {
56 enable = mkOption {
57 type = types.bool;
58 default = false;
59 description = lib.mdDoc "If enabled, start the Murmur Mumble server.";
60 };
61
62 openFirewall = mkOption {
63 type = types.bool;
64 default = false;
65 description = lib.mdDoc ''
66 Open ports in the firewall for the Murmur Mumble server.
67 '';
68 };
69
70 autobanAttempts = mkOption {
71 type = types.int;
72 default = 10;
73 description = lib.mdDoc ''
74 Number of attempts a client is allowed to make in
75 `autobanTimeframe` seconds, before being
76 banned for `autobanTime`.
77 '';
78 };
79
80 autobanTimeframe = mkOption {
81 type = types.int;
82 default = 120;
83 description = lib.mdDoc ''
84 Timeframe in which a client can connect without being banned
85 for repeated attempts (in seconds).
86 '';
87 };
88
89 autobanTime = mkOption {
90 type = types.int;
91 default = 300;
92 description = lib.mdDoc "The amount of time an IP ban lasts (in seconds).";
93 };
94
95 logFile = mkOption {
96 type = types.nullOr types.path;
97 default = null;
98 example = "/var/log/murmur/murmurd.log";
99 description = lib.mdDoc "Path to the log file for Murmur daemon. Empty means log to journald.";
100 };
101
102 welcometext = mkOption {
103 type = types.str;
104 default = "";
105 description = lib.mdDoc "Welcome message for connected clients.";
106 };
107
108 port = mkOption {
109 type = types.port;
110 default = 64738;
111 description = lib.mdDoc "Ports to bind to (UDP and TCP).";
112 };
113
114 hostName = mkOption {
115 type = types.str;
116 default = "";
117 description = lib.mdDoc "Host to bind to. Defaults binding on all addresses.";
118 };
119
120 package = mkOption {
121 type = types.package;
122 default = pkgs.murmur;
123 defaultText = literalExpression "pkgs.murmur";
124 description = lib.mdDoc "Overridable attribute of the murmur package to use.";
125 };
126
127 password = mkOption {
128 type = types.str;
129 default = "";
130 description = lib.mdDoc "Required password to join server, if specified.";
131 };
132
133 bandwidth = mkOption {
134 type = types.int;
135 default = 72000;
136 description = lib.mdDoc ''
137 Maximum bandwidth (in bits per second) that clients may send
138 speech at.
139 '';
140 };
141
142 users = mkOption {
143 type = types.int;
144 default = 100;
145 description = lib.mdDoc "Maximum number of concurrent clients allowed.";
146 };
147
148 textMsgLength = mkOption {
149 type = types.int;
150 default = 5000;
151 description = lib.mdDoc "Max length of text messages. Set 0 for no limit.";
152 };
153
154 imgMsgLength = mkOption {
155 type = types.int;
156 default = 131072;
157 description = lib.mdDoc "Max length of image messages. Set 0 for no limit.";
158 };
159
160 allowHtml = mkOption {
161 type = types.bool;
162 default = true;
163 description = lib.mdDoc ''
164 Allow HTML in client messages, comments, and channel
165 descriptions.
166 '';
167 };
168
169 logDays = mkOption {
170 type = types.int;
171 default = 31;
172 description = lib.mdDoc ''
173 How long to store RPC logs for in the database. Set 0 to
174 keep logs forever, or -1 to disable DB logging.
175 '';
176 };
177
178 bonjour = mkOption {
179 type = types.bool;
180 default = false;
181 description = lib.mdDoc ''
182 Enable Bonjour auto-discovery, which allows clients over
183 your LAN to automatically discover Murmur servers.
184 '';
185 };
186
187 sendVersion = mkOption {
188 type = types.bool;
189 default = true;
190 description = lib.mdDoc "Send Murmur version in UDP response.";
191 };
192
193 registerName = mkOption {
194 type = types.str;
195 default = "";
196 description = lib.mdDoc ''
197 Public server registration name, and also the name of the
198 Root channel. Even if you don't publicly register your
199 server, you probably still want to set this.
200 '';
201 };
202
203 registerPassword = mkOption {
204 type = types.str;
205 default = "";
206 description = lib.mdDoc ''
207 Public server registry password, used authenticate your
208 server to the registry to prevent impersonation; required for
209 subsequent registry updates.
210 '';
211 };
212
213 registerUrl = mkOption {
214 type = types.str;
215 default = "";
216 description = lib.mdDoc "URL website for your server.";
217 };
218
219 registerHostname = mkOption {
220 type = types.str;
221 default = "";
222 description = lib.mdDoc ''
223 DNS hostname where your server can be reached. This is only
224 needed if you want your server to be accessed by its
225 hostname and not IP - but the name *must* resolve on the
226 internet properly.
227 '';
228 };
229
230 clientCertRequired = mkOption {
231 type = types.bool;
232 default = false;
233 description = lib.mdDoc "Require clients to authenticate via certificates.";
234 };
235
236 sslCert = mkOption {
237 type = types.str;
238 default = "";
239 description = lib.mdDoc "Path to your SSL certificate.";
240 };
241
242 sslKey = mkOption {
243 type = types.str;
244 default = "";
245 description = lib.mdDoc "Path to your SSL key.";
246 };
247
248 sslCa = mkOption {
249 type = types.str;
250 default = "";
251 description = lib.mdDoc "Path to your SSL CA certificate.";
252 };
253
254 extraConfig = mkOption {
255 type = types.lines;
256 default = "";
257 description = lib.mdDoc "Extra configuration to put into murmur.ini.";
258 };
259
260 environmentFile = mkOption {
261 type = types.nullOr types.path;
262 default = null;
263 example = "/var/lib/murmur/murmurd.env";
264 description = lib.mdDoc ''
265 Environment file as defined in {manpage}`systemd.exec(5)`.
266
267 Secrets may be passed to the service without adding them to the world-readable
268 Nix store, by specifying placeholder variables as the option value in Nix and
269 setting these variables accordingly in the environment file.
270
271 ```
272 # snippet of murmur-related config
273 services.murmur.password = "$MURMURD_PASSWORD";
274 ```
275
276 ```
277 # content of the environment file
278 MURMURD_PASSWORD=verysecretpassword
279 ```
280
281 Note that this file needs to be available on the host on which
282 `murmur` is running.
283 '';
284 };
285 };
286 };
287
288 config = mkIf cfg.enable {
289 users.users.murmur = {
290 description = "Murmur Service user";
291 home = "/var/lib/murmur";
292 createHome = true;
293 uid = config.ids.uids.murmur;
294 group = "murmur";
295 };
296 users.groups.murmur = {
297 gid = config.ids.gids.murmur;
298 };
299
300 networking.firewall = mkIf cfg.openFirewall {
301 allowedTCPPorts = [ cfg.port ];
302 allowedUDPPorts = [ cfg.port ];
303 };
304
305 systemd.services.murmur = {
306 description = "Murmur Chat Service";
307 wantedBy = [ "multi-user.target" ];
308 after = [ "network-online.target" ];
309 preStart = ''
310 ${pkgs.envsubst}/bin/envsubst \
311 -o /run/murmur/murmurd.ini \
312 -i ${configFile}
313 '';
314
315 serviceConfig = {
316 # murmurd doesn't fork when logging to the console.
317 Type = if forking then "forking" else "simple";
318 PIDFile = mkIf forking "/run/murmur/murmurd.pid";
319 EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
320 ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
321 Restart = "always";
322 RuntimeDirectory = "murmur";
323 RuntimeDirectoryMode = "0700";
324 User = "murmur";
325 Group = "murmur";
326 };
327 };
328 };
329}