{ config, lib, pkgs, ... }:

{
  services.murmur = {
    enable = true;
    logDays = -1;
    welcometext = "";
    sslKey = "/var/lib/acme/meow.noms.ing/key.pem";
    sslCert = "/var/lib/acme/meow.noms.ing/fullchain.pem";
    bandwidth = 128000;
  };

  # the mumble cert has its own group so that both nginx and murmur can read it
  users.groups.mumblecert = { };
  security.acme.certs."meow.noms.ing" = {
    group = "mumblecert";
    reloadServices = [ "murmur" ];
  };
  users.users.nginx.extraGroups = [ "mumblecert" ];
  users.users.murmur.extraGroups = [ "mumblecert" ];

  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
}