Using Caddy to Handle Mumble Server Certificates

If you’re hosting a mumble server, it’s nice to get a server certificate so that your server is trusted by default. This means that people joining your server won’t have to manually accept a self-signed server certificate.

Typically, you might use Let’s Encrypt (or similar) to get a standalone certificate for the mumble server, and then link to those in /etc/mumble-server.ini. If you go this route, you probably have set up certbot or acme.sh just to auto-renew and handle your mumble server certificate.

That’s the set up I used to have. But, in the spirit of reducing the number of tools I’m using and simplifying my server setup, I started using Caddy, which I was already using as a reverse proxy, to also handle renewing my mumble server certificates.

The main challenge with this was tracking down the right location for where the certificates are stored, and making sure mumble-server could access those files.

When run as a system service, caddy the server runs as caddy the user, whose default home directory is in /var/lib/caddy. You can see where your installation’s locations are by running

sudo journalctl -u caddy

And looking at the environment variables.

Next, we need to add the mumble server to the Caddyfile in /etc/caddy/Caddyfile.

...other websites here...

mumble.example.com {
    reverse_proxy localhost:64738
}

Just the existence of the entry in the Caddyfile will cause Caddy to automatically get and renew SSL certificates for the domain.

Finally, we can update /etc/mumble-server.ini with the paths to the certificate and key. It will likely look something like this:

; If you have a proper SSL certificate, you can provide the filenames here.
; Otherwise, Murmur will create its own certificate automatically.
sslCert=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/<example>/<example>.crt
sslKey=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/<example>/<example>.key

Restart the mumble-server and the certificate should be handled.

You can make sure there are not any issues by checking the mumble-server log:

$ sudo tail -f /var/log/mumble-server/mumble-server.log

Note that if you have a long-running mumble server, you will need to restart the server in order to grab new certificates once they expire. Caddy will still get the new certificate, but the mumble server won’t use it if it was changed until a restart.

Posts from blogs I follow

Resilient LL Parsing Tutorial

In this tutorial, I will explain a particular approach to parsing, which gracefully handles syntax errors and is thus suitable for language servers, which, by their nature, have to handle incomplete and invalid code. Explaining the problem and the solution…

via matklad May 21, 2023

🤠 "Where have all the hackers gone?" + a way to discuss programming languages 👨‍🎤

🎵 The song for this post is CHEMICAL LOVE, by "Kaleb James and Chey" for the game Bust-a-Groove. 🎵 I'm talking with friends and coworkers about programming languages (surprise), and I'm landing on a rough shape that these conversations take. I'll share it …

via More Pablo: all May 15, 2023

The Perfect Weekend-Project, or You Should Build a Blog

The latest from atthis.link

via atthis.link May 12, 2023

Generated by openring-rs