pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8let
9 cfg = config.services.murmur;
10 forking = cfg.logToFile;
11 configFile = pkgs.writeText "murmurd.ini" ''
12 database=${cfg.stateDir}/murmur.sqlite
13 dbDriver=QSQLITE
14
15 autobanAttempts=${toString cfg.autobanAttempts}
16 autobanTimeframe=${toString cfg.autobanTimeframe}
17 autobanTime=${toString cfg.autobanTime}
18
19 logfile=${lib.optionalString cfg.logToFile "/var/log/murmur/murmurd.log"}
20 ${lib.optionalString forking "pidfile=/run/murmur/murmurd.pid"}
21
22 welcometext="${cfg.welcometext}"
23 port=${toString cfg.port}
24
25 ${lib.optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
26 ${lib.optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
27
28 bandwidth=${toString cfg.bandwidth}
29 users=${toString cfg.users}
30
31 textmessagelength=${toString cfg.textMsgLength}
32 imagemessagelength=${toString cfg.imgMsgLength}
33 allowhtml=${lib.boolToString cfg.allowHtml}
34 logdays=${toString cfg.logDays}
35 bonjour=${lib.boolToString cfg.bonjour}
36 sendversion=${lib.boolToString cfg.sendVersion}
37
38 ${lib.optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
39 ${lib.optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
40 ${lib.optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
41 ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
42
43 certrequired=${lib.boolToString cfg.clientCertRequired}
44 ${lib.optionalString (cfg.sslCert != null) "sslCert=${cfg.sslCert}"}
45 ${lib.optionalString (cfg.sslKey != null) "sslKey=${cfg.sslKey}"}
46 ${lib.optionalString (cfg.sslCa != null) "sslCA=${cfg.sslCa}"}
47
48 ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
49
50 ${cfg.extraConfig}
51 '';
52in
53{
54
55 imports = [
56 (lib.mkRemovedOptionModule [
57 "services"
58 "murmur"
59 "logFile"
60 ] "This option has been superseded by services.murmur.logToFile")
61 ];
62
63 options = {
64 services.murmur = {
65 enable = lib.mkEnableOption "Mumble server";
66
67 openFirewall = lib.mkEnableOption "opening ports in the firewall for the Mumble server";
68
69 user = lib.mkOption {
70 type = lib.types.str;
71 default = "murmur";
72 description = ''
73 The name of an existing user to use to run the service.
74 If not specified, the default user will be created.
75 '';
76 };
77
78 group = lib.mkOption {
79 type = lib.types.str;
80 default = "murmur";
81 description = ''
82 The name of an existing group to use to run the service.
83 If not specified, the default group will be created.
84 '';
85 };
86
87 stateDir = lib.mkOption {
88 type = lib.types.path;
89 default = "/var/lib/murmur";
90 description = ''
91 Directory to store data for the server.
92 '';
93 };
94
95 autobanAttempts = lib.mkOption {
96 type = lib.types.int;
97 default = 10;
98 description = ''
99 Number of attempts a client is allowed to make in
100 `autobanTimeframe` seconds, before being
101 banned for `autobanTime`.
102 '';
103 };
104
105 autobanTimeframe = lib.mkOption {
106 type = lib.types.int;
107 default = 120;
108 description = ''
109 Timeframe in which a client can connect without being banned
110 for repeated attempts (in seconds).
111 '';
112 };
113
114 autobanTime = lib.mkOption {
115 type = lib.types.int;
116 default = 300;
117 description = "The amount of time an IP ban lasts (in seconds).";
118 };
119
120 logToFile = lib.mkEnableOption "logging to a file instead of journald, which is stored in /var/log/murmur";
121
122 welcometext = lib.mkOption {
123 type = lib.types.str;
124 default = "";
125 description = "Welcome message for connected clients.";
126 };
127
128 port = lib.mkOption {
129 type = lib.types.port;
130 default = 64738;
131 description = "Ports to bind to (UDP and TCP).";
132 };
133
134 hostName = lib.mkOption {
135 type = lib.types.str;
136 default = "";
137 description = "Host to bind to. Defaults binding on all addresses.";
138 };
139
140 package = lib.mkPackageOption pkgs "murmur" { };
141
142 password = lib.mkOption {
143 type = lib.types.str;
144 default = "";
145 description = "Required password to join server, if specified.";
146 };
147
148 bandwidth = lib.mkOption {
149 type = lib.types.int;
150 default = 72000;
151 description = ''
152 Maximum bandwidth (in bits per second) that clients may send
153 speech at.
154 '';
155 };
156
157 users = lib.mkOption {
158 type = lib.types.int;
159 default = 100;
160 description = "Maximum number of concurrent clients allowed.";
161 };
162
163 textMsgLength = lib.mkOption {
164 type = lib.types.int;
165 default = 5000;
166 description = "Max length of text messages. Set 0 for no limit.";
167 };
168
169 imgMsgLength = lib.mkOption {
170 type = lib.types.int;
171 default = 131072;
172 description = "Max length of image messages. Set 0 for no limit.";
173 };
174
175 allowHtml = lib.mkOption {
176 type = lib.types.bool;
177 default = true;
178 description = ''
179 Allow HTML in client messages, comments, and channel
180 descriptions.
181 '';
182 };
183
184 logDays = lib.mkOption {
185 type = lib.types.int;
186 default = 31;
187 description = ''
188 How long to store RPC logs for in the database. Set 0 to
189 keep logs forever, or -1 to disable DB logging.
190 '';
191 };
192
193 bonjour = lib.mkEnableOption "Bonjour auto-discovery, which allows clients over your LAN to automatically discover Mumble servers";
194
195 sendVersion = lib.mkOption {
196 type = lib.types.bool;
197 default = true;
198 description = "Send Murmur version in UDP response.";
199 };
200
201 registerName = lib.mkOption {
202 type = lib.types.str;
203 default = "";
204 description = ''
205 Public server registration name, and also the name of the
206 Root channel. Even if you don't publicly register your
207 server, you probably still want to set this.
208 '';
209 };
210
211 registerPassword = lib.mkOption {
212 type = lib.types.str;
213 default = "";
214 description = ''
215 Public server registry password, used authenticate your
216 server to the registry to prevent impersonation; required for
217 subsequent registry updates.
218 '';
219 };
220
221 registerUrl = lib.mkOption {
222 type = lib.types.str;
223 default = "";
224 description = "URL website for your server.";
225 };
226
227 registerHostname = lib.mkOption {
228 type = lib.types.str;
229 default = "";
230 description = ''
231 DNS hostname where your server can be reached. This is only
232 needed if you want your server to be accessed by its
233 hostname and not IP - but the name *must* resolve on the
234 internet properly.
235 '';
236 };
237
238 clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";
239
240 sslCert = lib.mkOption {
241 type = lib.types.nullOr lib.types.path;
242 default = null;
243 description = "Path to your SSL certificate.";
244 };
245
246 sslKey = lib.mkOption {
247 type = lib.types.nullOr lib.types.path;
248 default = null;
249 description = "Path to your SSL key.";
250 };
251
252 sslCa = lib.mkOption {
253 type = lib.types.nullOr lib.types.path;
254 default = null;
255 description = "Path to your SSL CA certificate.";
256 };
257
258 extraConfig = lib.mkOption {
259 type = lib.types.lines;
260 default = "";
261 description = "Extra configuration to put into murmur.ini.";
262 };
263
264 environmentFile = lib.mkOption {
265 type = lib.types.nullOr lib.types.path;
266 default = null;
267 example = lib.literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
268 description = ''
269 Environment file as defined in {manpage}`systemd.exec(5)`.
270
271 Secrets may be passed to the service without adding them to the world-readable
272 Nix store, by specifying placeholder variables as the option value in Nix and
273 setting these variables accordingly in the environment file.
274
275 ```
276 # snippet of murmur-related config
277 services.murmur.password = "$MURMURD_PASSWORD";
278 ```
279
280 ```
281 # content of the environment file
282 MURMURD_PASSWORD=verysecretpassword
283 ```
284
285 Note that this file needs to be available on the host on which
286 `murmur` is running.
287 '';
288 };
289
290 dbus = lib.mkOption {
291 type = lib.types.enum [
292 null
293 "session"
294 "system"
295 ];
296 default = null;
297 description = "Enable D-Bus remote control. Set to the bus you want Murmur to connect to.";
298 };
299 };
300 };
301
302 config = lib.mkIf cfg.enable {
303 users.users.murmur = lib.mkIf (cfg.user == "murmur") {
304 description = "Murmur Service user";
305 home = cfg.stateDir;
306 createHome = true;
307 uid = config.ids.uids.murmur;
308 group = cfg.group;
309 };
310 users.groups.murmur = lib.mkIf (cfg.group == "murmur") {
311 gid = config.ids.gids.murmur;
312 };
313
314 networking.firewall = lib.mkIf cfg.openFirewall {
315 allowedTCPPorts = [ cfg.port ];
316 allowedUDPPorts = [ cfg.port ];
317 };
318
319 systemd.services.murmur = {
320 description = "Murmur Chat Service";
321 wantedBy = [ "multi-user.target" ];
322 after = [ "network.target" ];
323 preStart = ''
324 ${pkgs.envsubst}/bin/envsubst \
325 -o /run/murmur/murmurd.ini \
326 -i ${configFile}
327 '';
328
329 serviceConfig = {
330 # murmurd doesn't fork when logging to the console.
331 Type = if forking then "forking" else "simple";
332 PIDFile = lib.mkIf forking "/run/murmur/murmurd.pid";
333 EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
334 ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
335 Restart = "always";
336 LogsDirectory = lib.mkIf cfg.logToFile "murmur";
337 LogsDirectoryMode = "0750";
338 RuntimeDirectory = "murmur";
339 RuntimeDirectoryMode = "0700";
340 User = cfg.user;
341 Group = cfg.group;
342
343 # service hardening
344 AmbientCapabilities = "CAP_NET_BIND_SERVICE";
345 CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
346 LockPersonality = true;
347 MemoryDenyWriteExecute = true;
348 NoNewPrivileges = true;
349 PrivateDevices = true;
350 PrivateTmp = true;
351 ProtectClock = true;
352 ProtectControlGroups = true;
353 ProtectHome = true;
354 ProtectHostname = true;
355 ProtectKernelLogs = true;
356 ProtectKernelModules = true;
357 ProtectKernelTunables = true;
358 ProtectSystem = "strict";
359 ReadWritePaths = [
360 cfg.stateDir
361 ];
362 RestrictAddressFamilies = [
363 "AF_INET"
364 "AF_INET6"
365 ];
366 RestrictNamespaces = true;
367 RestrictSUIDSGID = true;
368 RestrictRealtime = true;
369 SystemCallArchitectures = "native";
370 SystemCallFilter = "@system-service";
371 UMask = 27;
372 };
373 };
374
375 # currently not included in upstream package, addition requested at
376 # https://github.com/mumble-voip/mumble/issues/6078
377 services.dbus.packages = lib.mkIf (cfg.dbus == "system") [
378 (pkgs.writeTextFile {
379 name = "murmur-dbus-policy";
380 text = ''
381 <!DOCTYPE busconfig PUBLIC
382 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
383 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
384 <busconfig>
385 <policy user="${cfg.user}">
386 <allow own="net.sourceforge.mumble.murmur"/>
387 </policy>
388
389 <policy context="default">
390 <allow send_destination="net.sourceforge.mumble.murmur"/>
391 <allow receive_sender="net.sourceforge.mumble.murmur"/>
392 </policy>
393 </busconfig>
394 '';
395 destination = "/share/dbus-1/system.d/murmur.conf";
396 })
397 ];
398
399 security.apparmor.policies."bin.mumble-server".profile = ''
400 include <tunables/global>
401
402 ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
403 include <abstractions/base>
404 include <abstractions/nameservice>
405 include <abstractions/ssl_certs>
406 include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}"
407 pix ${cfg.package}/bin/.mumble-server-wrapped,
408
409 r ${config.environment.etc."os-release".source},
410 r ${config.environment.etc."lsb-release".source},
411 owner rwk ${cfg.stateDir}/murmur.sqlite,
412 owner rw ${cfg.stateDir}/murmur.sqlite-journal,
413 owner r ${cfg.stateDir}/,
414 r /run/murmur/murmurd.pid,
415 r /run/murmur/murmurd.ini,
416 r ${configFile},
417 ''
418 + lib.optionalString cfg.logToFile ''
419 rw /var/log/murmur/murmurd.log,
420 ''
421 + lib.optionalString (cfg.sslCert != null) ''
422 r ${cfg.sslCert},
423 ''
424 + lib.optionalString (cfg.sslKey != null) ''
425 r ${cfg.sslKey},
426 ''
427 + lib.optionalString (cfg.sslCa != null) ''
428 r ${cfg.sslCa},
429 ''
430 + lib.optionalString (cfg.dbus != null) ''
431 dbus bus=${cfg.dbus}
432 ''
433 + ''
434 }
435 '';
436 };
437
438 meta.maintainers = with lib.maintainers; [ felixsinger ];
439}