feat(murmur): init

modules/nixos/deertopia/umurmur.nix

@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+let cfg = config.sydnix.deertopia.umurmur;
+in {
+  options = {
+    sydnix.deertopia.umurmur = {
+      enable = lib.mkEnableOption "Deertopia's uMurmur, a Mumble server";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    sydnix.impermanence.directories = [
+      "/var/lib/private/umurmur"
+    ];
+
+    # HACK: Allow uMurmur to use Nginx's certs.
+    systemd.services.umurmur.serviceConfig.SupplementaryGroups = [ "nginx" ];
+
+    services.umurmur = {
+      enable = true;
+      openFirewall = true;
+
+      settings = {
+        password = "onlydeer";
+        bindport = 64738; # Use default Murmur port, not uMurmur's.
+        welcometext = "🦌";
+
+        max_bandwidth = 72000;
+
+        # Use files generated by Nix's Nginx module.
+        certificate = "/var/lib/acme/deertopia.net/fullchain.pem";
+        private_key = "/var/lib/acme/deertopia.net/key.pem";
+      };
+    };
+  };
+}