Tools
mumpeer
A small relay for Mumcord's direct connections between users, for screen sharing or full-size images, for example. When two people cannot reach each other directly, behind CGNAT, strict firewalls or in networks without UDP, or don't want to show their IP address, both connect to the relay instead. It only passes the encrypted packets along, like a TURN server.
Next to your Mumble server
A community runs mumpeer next to its Mumble server, together with the relay bot mumbot peer. The bot announces the relay and hands out short-lived tokens. The Mumble server stays unmodified.
Verified users only
A token works only for exactly two certificates, once per side and for 120 seconds by default. The relay never forwards anywhere else and never opens connections itself, so it is not an open proxy.
End-to-end encrypted
What goes through the relay is a separate encrypted connection between the two users, pinned to their Mumble certificates. The relay can neither read nor change it.
Through almost any firewall
QUIC over UDP or, where UDP is blocked, TLS over TCP. Both on port 443 and with TLS 1.3.
Entirely optional
Mumcord works without bot and relay too. In Mumcord you choose: relay off, only when a direct connection fails, or always.
What the operator can see
- The IP addresses of both users of a session
- Which two certificates talk to each other
- How much data flows and when
- Not the contents: they are encrypted end to end. Mumcord tells you this before you use a relay
- Never logged: full IP addresses, full certificate hashes, tokens and packet contents
Run it with Docker
Put a long random secret into .env as PEER_API_SECRET (for example from openssl rand -hex 32). From Mumbot's relay example, save mumpeer.example.toml as mumpeer.toml and set public_host in it, and bot.example.toml as bot.toml. Then start relay and bot together:
services:
mumpeer:
image: ghcr.io/mumcord/mumpeer:0.1.0
restart: unless-stopped
environment:
MUMPEER_API_SECRET: ${PEER_API_SECRET:?set PEER_API_SECRET in .env}
ports: ["443:443/udp", "443:443/tcp"]
volumes:
- ./mumpeer.toml:/config/mumpeer.toml:ro
- mumpeer-data:/var/lib/mumpeer
mumbot:
image: ghcr.io/mumcord/mumbot:0.2.0
command: ["peer"]
restart: unless-stopped
network_mode: "service:mumpeer"
environment:
MUMBOT_CONFIG: /config/bot.toml
MUMBOT_PEER_API_SECRET: ${PEER_API_SECRET:?set PEER_API_SECRET in .env}
volumes:
- ./bot.toml:/config/bot.toml:ro
- mumbot-data:/data
healthcheck:
disable: true
volumes:
mumpeer-data:
mumbot-data:On first start the relay's fingerprint shows in the log. The bot announces it to Mumcord, nothing else needs to be shared. Open UDP and TCP on port 443, the API stays between relay and bot. Mumcord uses the relay from version 0.5.0.
