murmur (mumble server) and non-caddy acme client

flake.nix

@@ -132,6 +132,7 @@
           mathesar = "mathesar.${baseName}";
           metrics = "metrics.${baseName}";
           minecraft = "minecraft.${baseName}";
+          mumble = "mumble.${baseName}";
           n8n = "n8n.${baseName}";
           navidrome = "music.${baseName}";
           notifications = "ntfy.${baseName}";

platforms/nixos/modules/nmasur/presets/services/caddy.nix

@@ -58,6 +58,7 @@ in
           {
             handler = "static_response";
             status_code = "403";
+            body = "IP not allowed";
           }
         ];
       }
@@ -109,8 +110,7 @@ in
             apps.tls.automation.policies = cfg.tlsPolicies;
 
             # Setup logging to journal and files
-            logging.logs =
+            logging.logs = {
-              {
               # System logs and catch-all
               # Must be called `default` to override Caddy's built-in default logger
               default = {

platforms/nixos/modules/nmasur/presets/services/cloudflare/cloudflare.nix

@@ -173,5 +173,16 @@ in
     # Enable the home-made service that we created for non-proxied records
     services.cloudflare-dyndns-noproxy.enable = true;
 
+    # Create certs when not using proxy
+    secrets.cloudflare-dns-api-prefixed = {
+      source = ./cloudflare-api.age;
+      dest = "${config.secretsDirectory}/cloudflare-dns-api-prefixed";
+      prefix = "CLOUDFLARE_DNS_API_TOKEN=";
+    };
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "acme@${config.nmasur.presets.programs.msmtp.domain}";
+    };
+
   };
 }

platforms/nixos/modules/nmasur/presets/services/murmur.nix

@@ -0,0 +1,41 @@
+# murmur is a Mumble server for hosting voice chat
+
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.murmur;
+in
+
+{
+
+  options.nmasur.presets.services.murmur.enable =
+    lib.mkEnableOption "murmur (mumble) voice chat service";
+
+  config = lib.mkIf cfg.enable {
+
+    services.murmur = {
+      enable = true;
+      users = 50; # Max concurrent users
+      bonjour = false; # Auto-connect LAN
+      registerUrl = "https://${hostnames.mumble}";
+      registerName = "Mumble";
+      environmentFile = null;
+      sslKey = "${config.security.acme.certs."${hostnames.mumble}".directory}/key.pem";
+      sslCert = "${config.security.acme.certs."${hostnames.mumble}".directory}/fullchain.pem";
+      openFirewall = true;
+    };
+
+    # Configure Cloudflare DNS to point to this machine
+    nmasur.presets.services.cloudflare.noProxyDomains = [ hostnames.mumble ];
+
+    security.acme.certs."${hostnames.mumble}" = {
+      dnsProvider = "cloudflare";
+      credentialsFile = config.secrets.cloudflare-dns-api-prefixed.dest;
+      group = config.services.murmur.group;
+    };
+  };
+}

platforms/nixos/modules/nmasur/profiles/communications.nix

@@ -32,6 +32,7 @@ in
         mathesar.enable = lib.mkDefault true;
         mealie.enable = lib.mkDefault true;
         minecraft-server.enable = lib.mkDefault false;
+        murmur.enable = lib.mkDefault true;
         n8n.enable = lib.mkDefault true;
         nix-autoupgrade.enable = lib.mkDefault true; # On by default for communications
         ntfy-sh.enable = lib.mkDefault true;