Some chores

.envrc

@@ -0,0 +1 @@
+use_flake

.gitignore

@@ -2,3 +2,5 @@
 *.retry
 .vault_pass
 
+.direnv
+result

flake.nix

@@ -0,0 +1,18 @@
+{
+  inputs = {
+    nixpkgs.url="github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+  outputs = { self, nixpkgs, flake-utils }@inputs:
+  flake-utils.lib.eachDefaultSystem (system:
+  let pkgs = import nixpkgs { inherit system; };
+  in {
+    devShells.default = pkgs.mkShell {
+      packages = with pkgs; [
+        ansible
+        ansible-lint
+      ];
+      PASSWORD_STORE_DIR="~/.password-store/chaos/jetzt";
+    };
+  });
+}

group_vars/all/mumble.yml

@@ -1,16 +1,17 @@
 ---
+mumble_domain: "mumble.{{ base_url }}"
 murmur_icesecretread: "secret"
 murmur_welcometext: "Welcome on the {{ base_url }}-mumble server running murmur. Enjoy your stay!"
 murmur_bandwidth: "128000"
-murmur_sslcert: "/etc/ssl/certs/mumble.{{ base_url }}.crt"
-murmur_sslkey: "/etc/ssl/private/mumble.{{ base_url }}.key"
-murmur_registername: no
+murmur_sslcert: "/etc/ssl/certs/{{ mumble_domain }}.crt"
+murmur_sslkey: "/etc/ssl/private/{{ mumble_domain }}.key"
+murmur_registername: false
 murmur_registry_password: "{{ lookup('passwordstore', 'infra/murmur/registry create=true') }}"
 
-mumble_web: yes
+mumble_web: true
 mumble_web_path: "/usr/lib/node_modules/mumble-web"
 mumble_web_config: ""
 mumble_web_supplementary_groups: "ssl-cert"
 mumble_web_listen: "127.0.0.1:84"
-mumble_web_ssl_activated: False
-mumble_web_ssl_target: True
+mumble_web_ssl_activated: false
+mumble_web_ssl_target: true

playbooks/site.yml

@@ -16,6 +16,30 @@
         regexp: "^#SystemMaxUse="
         replace: "SystemMaxUse=50M"
       notify: restart systemd-journald
+    - name: Register if alacritty terminfo is present
+      command: infocmp alacritty
+      ignore_errors: true
+      register: alacritty_present
+      check_mode: false
+    - name: Install alacritty terminfo
+      block:
+        - name: Download terminfo file
+          get_url:
+            url: "https://raw.githubusercontent.com/alacritty/alacritty/master/extra/alacritty.info"
+            dest: "/tmp/alacritty.info"
+            mode: 06440
+        - name: Install terminfo file for alacritty
+          command:
+            argv:
+              - tic
+              - "-xe"
+              - alacritty,alacritty-direct
+              - /tmp/alacritty.info
+        - name: Delete temporary alacritty.info
+          file:
+            path: "/tmp/alacritty.info"
+            state: absent
+      when: alacritty_present.rc == 1
   tags: base
 
 - hosts: web,matrix
@@ -227,6 +251,15 @@
   tags: pretix
 
 - hosts: web
+  handlers:
+    - name: daemon reload
+      systemd:
+        daemon_reload: true
+    - name: restart certificate reload timer
+      systemd:
+        name: mumble-certificate-reloader.timer
+        state: restarted
+        enabled: true
   pre_tasks:
     - name: add mumble repository
       apt_repository:
@@ -269,6 +302,21 @@
         name: "mumble-server"
         groups: "ssl-cert"
         append: yes
+
+    - name: Copy mumble-server-certificate-reloader.sh
+      template:
+        src: mumble/mumble-server-certificate-reloader.sh
+        dest: /usr/local/bin/mumble-server-certificate-reloader
+        mode: 0755
+
+    - name: Template certificate reloader service and timer
+      template:
+        src: "mumble/mumble-server-certificate-reloader.{{ item }}.j2"
+        dest: "/etc/systemd/system/mumble-certificate-reloader.{{ item }}"
+      notify:
+        - daemon reload
+        - restart certificate reload timer
+      with_items: ["service", "timer"]
   tags: mumble
 
 - hosts: web

templates/mumble/mumble-server-certificate-reloader.service.j2

@@ -0,0 +1,8 @@
+[Unit]
+Description=Mumble certificate reloader
+
+[Service]
+Type=oneshot
+SyslogIdentifier=mumble-server-certificate-reloader
+ExecStart=/usr/local/bin/mumble-server-certificate-reloader {{ mumble_domain }} {{ murmur_port }}
+User={{ murmur_username }}

templates/mumble/mumble-server-certificate-reloader.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+if ${DEBUG:-false}; then
+  set -x
+fi
+set -E
+
+hostname=${1:-mumble.chaos.jetzt}
+port=${2:-64738}
+murmur_pid=$(cat /var/run/mumble-server/mumble-server.pid)
+reload_cmd=${3:-"kill -10 $murmur_pid"}
+now=$(date +"%s")
+in_one_week=$((now + 60*60*24*7))
+${DRY_RUN:=false}
+
+# Checking if the certificate will expire in one week or less
+echo | openssl s_client -connect "${hostname}:${port}" -servername "${hostname}" -servername mumble.chaos.jetzt -attime ${in_one_week} -verify_return_error -verify 20 >/dev/null 2>&1
+if [[ $? -ne 0 ]]; then
+  echo "Reloading..."
+  if ! $DRY_RUN; then
+    $reload_cmd
+  fi
+fi

templates/mumble/mumble-server-certificate-reloader.timer.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Mumble certificate reloader
+
+[Timer]
+OnCalendar=*-*-* *:13:37
+Persistent=true
+
+[Install]
+WantedBy=timers.target