feat(arumi): mumble server

hosts/arumi/configuration.nix

@@ -8,6 +8,7 @@
 
     ./services/sing-box.nix
     ./services/uptime-kuma.nix
+    ./services/mumble.nix
   ];
 
   boot.loader.grub = {

hosts/arumi/services/mumble.nix

@@ -0,0 +1,47 @@
+{ abs, config, ... }:
+
+let 
+  secrets = import (abs "lib/secrets.nix");
+
+  UID = 1101;
+in {
+  imports = [
+    (secrets.declare [{
+      name = "arumi-mumble-env";
+      owner = "mumble";
+    }])
+  ];
+
+  users.users.mumble = {
+    isNormalUser = true;
+    uid = UID;
+  };
+  users.groups.mumble = {};
+
+  virtualisation.oci-containers.containers.mumble = {
+    image = "mumblevoip/mumble-server:v1.5.634-0";
+    volumes = [
+      "/srv/mumble:/data"
+    ];
+    environment = {
+      MUMBLE_CONFIG_WELCOME_TEXT = "";
+      MUMBLE_CONFIG_ALLOW_HTML = "true";
+      MUMBLE_CONFIG_LOG_ACL_CHANGES = "true";
+    };
+    ports = [
+      "64738:64738/tcp"
+      "64738:64738/udp"
+    ];
+    environmentFiles = [
+      (secrets.file config "arumi-mumble-env")
+    ];
+    user = builtins.toString UID;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 64738 ];
+  networking.firewall.allowedUDPPorts = [ 64738 ];
+
+  systemd.tmpfiles.rules = [
+    "d /srv/mumble 0700 ${builtins.toString UID} ${builtins.toString UID} -"
+  ];
+}

secrets/arumi-mumble-env.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 sj88Xw Wp9ozkQMQuLC7B86Xv0AnKPJvLzZkfC29RYFivCU8SM
+y+0TPghrRYrvVenoYyBDA0s852T7Ef4HOc3O5S1cXOg
+--- IQC+Ff7DtWlDRO+DmQAg2AgFhcSvGV41I/Ny3PbmSVs
+wÍé_ž1Uzá1¤eêÓCwðW±˜š°@}-.o°Z&jQ×UL?ÌÜ[2GD5ø[Ql<ÿª13±mƒ÷ÔòÇZIº«l~‡ÓóOâA«2 ­.pñüè~±š&ÒÀŽ]º `<60>6ÑÌ<C391>ü$ý3h¯w«Ú<C2AB>çòðˆ‹£<E280B9>ˆ}‡¿ê
+ŒL
¾§´þ¬’WöÜDÃS°“º©­Y-w$Aè