Stephan Sokolow's Blog

As I mentioned in a recent post, I set up a private Mumble server for the richer set of options for working around a friend’s network problems and, given that Discord continues their steps toward demanding that you share personal information with people who are likely to eventually get hacked , opening you up to identity theft (i.e. age verification), that’s not the only reason I’m happy with my choice.

…so, here’s a quick overview of how you too can set up a private Mumble server with good security for voice (but not video) calls that you control. It’s not the most visually polished set of instructions, but it’s better than they were when I was just taking notes for my own future reference.

(If you’re running a podcast and want to be able to fine-tune the mix or want clean audio for a local transcription model like WhisperX (which apparently has the highest accuracy) when people might be talking over each other, it’s also nice that Mumble has built-in, open-source (i.e. auditable) support for recording each participant to a separate audio track that and doesn’t depend on a third-party server. Craig on the other hand… let’s just say I’m glad I haven’t needed more than OBS can do with a Mic vs. Firefox split yet.)

Instructions for Administrator:

Here are the steps for the most technically competent (or most willing to learn) person in your group to follow. You can run the server on Windows, macOS, or Linux and, since I run Kubuntu Linux LTS, I’ll also be providing more specific instructions that should work on any Debian-based Linux, including Mint.

First, you’re going to set up the server and your client, register an account with your preferred name, and grant it administrator privileges.

1. If you’re running your server off your home PC, sign up with a free Dynamic DNS service so you can have a stable domain name for friends to add to their favourites/bookmarks.
   (I recommend one that’s compatible with the DNS-based version of Let’s Encrypt verification such as Dynu (what I use) or DuckDNS so you can have encryption without self-signed certificates and without having to open port 80 or 443 to passing bots.)
2. Download and install both the mumble client and server. I installed both on my home PC. If you’re running a Debian-lineage distro, the packages to install are mumble and mumble-server and they should come with a ready-made set of systemd sandboxing rules, as can be inspected using systemd-analyze security mumble-server.service. (Overall exposure level for mumble-server.service: 2.1 OK 🙂 if you scroll to the bottom) …or you can run the client through Flatpak if you’re on Linux.
3. If your install method didn’t do it for you, run the mumble server. This happens automatically with the Debian packages and, if you only want it to run some of the time, use sudo systemctl disable mumble-server.service to keep it from running on startup. You can use sudo systemctl start mumble-server.service and sudo systemctl stop mumble-server.service to turn it on and off. (If anyone’s interested, maybe I’ll write a quick guide on how to make double-clickable shell scripts out of them, including sudo prompts, and a tip on how to make those specific commands passwordless with /etc/sudoers)
4. Open the mumble client. It should initially display the dialog from Configure > Audio Wizard... to set up your audio.
5. Click the globe icon in the toolbar if the Mumble Server Connect dialog doesn’t open automatically,
6. Set up a Favorites entry: You should see a single LAN entry for the server running on the same PC you’re on now. To avoid having to enter your username every time, right-click it and choose “Add to Favourites”, then the entry added to Favorites, choose Edit..., and fill out the username field. (If you don’t see it under LAN, click Add New... and fill in the IP address, your preferred username, and a friendly label manually.)
7. Close the connect dialog and use Configure > Certificate Wizard... to create a certificate so you can authenticate without using a password every time.
8. Click the Globe icon to re-open the connect dialog and double-click the entry in Favorites to re-connect to your server with your new certificate.
9. Use Self > Register... to permanently bind your certificate to an entry in the server’s user database. (This will also lock the username associated with your certificate)
10. Open the Mumble server’s log and look for a line that says Password for 'SuperUser' set to '...'. (If using Debian packages, run journalctl --unit mumble-server.service and type /Password followed by pressing Enter.)
11. Login as SuperUser: Click the globe icon again, double-click the entry for the server under LAN (not Favorites) and enter SuperUser as the username and whatever password you got from that line in the log.
12. Grant yourself admin permissions: Right-click Root in the channel/user list and choose Edit.... In the Groups tab, select “admin” from the drop-down box in the top Group section and then look down to the Members section and add yourself to the Members box (the left-most one) using the drop-down below it and the Add button. Then click OK. Your normal user now has admin privileges.
    
    NOTE: This dialog is how you control all permissioning. The Root channel is the server-wide permissions that everything will inherit from and you can create channels inside it with different permissions.
    
    NOTE: If Mumble doesn’t prompt you about the “mute cue”, it’s a sound that plays if you try to talk while muted and can be disabled by going into Configure > Settings..., selecting the Audio Input tab, scrolling down to the Misc section, and unchecking Mute cue.
    
    By default, Mumble will allow all connections. The simplest way to restrict access is to edit mumble-server.ini and restart the server. (/etc/mumble/mumble-server.ini with Debian packages)
    
    My suggestion is to set serverpassword to some easy-to-communicate thing to block port-scanning bots from stumbling into where they can see the list of users and channels, and set certrequired=true so that the authentication flow is “Trusted user uses the certificate wizard and then enters the password the first time, administrator registers them, and then that removes the password requirement and locks them into place in the permissions system”.
    
    You can then set it so, until users are registered, they can’t do anything but see the user and channel list. I suggest this guide for understanding the permissions system. The two details I found either missing or insufficiently clear in the official guide are how permissions are resolved (last/lowest matching entry wins) and what each permission does.

Other lines in the server config file that you may want to change are:

• welcometext= takes a chunk of the dialect of HTML supported by Qt’s rich text controls which you can use to make a pretty/helpful welcome banner with hyperlinks and the like. (Example)
  You can also embed images without needing an external server using a data URI generator.
• port= lets you set a non-default port so port-scanning bots that want to find Mumble servers have to scan all your ports instead of just checking the default one and then moving on to the next IP address. (Don’t worry. Mumble has a built-in mechanism for temp-banning IPs that try to brute-force the password.)
• allowping=false will prevent the current and maximum user count and maximum bandwidth from being exposed to the Connect dialog in users’ clients before they successfully login.
• imagemessagelength=0 will remove the length limit on messages containing embedded images. If you only have a few friends in your server, this shouldn’t hurt anything and improved the visible quality of the resultant images in my testing.
• registerName= without the other register*= parameters allows you to keep your server secret but change the name of the root channel from Root to something else.
• sslCert=/path/to/fullChain.pem, sslKey=/path/to/privkey.pem, (and sslCA=/path/to/fullChain.pem according to Archwiki) are what to set if you have a TLS certificate from Let’s Encrypt.

Beyond that, you can also run a copy of miniserve as a companion file server for exchanging files with your friends without needing “the cloud” and link to it from your Mumble welcome message. (That’s what the script from my previous post is used for.) It can also accept that TLS certificate via --tls-cert=/path/to/fullChain.pem and --tls-key=/path/to/privkey.pem for encrypted connections, and you can restrict access by giving your friends username-password pairs and storing them in a file you feed to --auth-file=.

Don’t forget to forward the ports on your router and set exceptions in your PC’s firewall or none of this will be visible from outside.

Instructions for clients:

1. Download the client. Unlike Discord, Mumble has no in-browser option unless the administrator is running a separate web client for you.
2. The first time you open the mumble client, it should open the dialog from Configure > Audio Wizard... to set up your audio. Follow the steps. (See the Transmission and Audio Processing sections in Configure > Settings... > Audio Input for additional options.)
3. If the Mumble Server Connect dialog opens automatically after you finish the audio wizard, close it. Instead, use Configure > Certificate Wizard... with the Create a new certificate option to create a certificate so you can authenticate without using a password every time. (Put whatever nick you want in the name field and leave the e-mail field empty.)
4. Click the globe icon in the toolbar to reopen the Mumble Server Connect field.
5. Click the Add New… button and fill in the details given to you by the friend who is running the server.
6. Double-click the entry that has appeared under Favorite to connect.
7. Mumble’s default layout is a little unusual so you’ll probably want to grab the divider between the narrow chat panel on the left and the wide channel/user list on the right and drag it to produce a more Discord-like Layout. (For more customization, see the “User Interface” tab in Configure > Settings.... I recommend selecting the Hybrid layout so the text chat field will allow longer messages before it starts to scroll.)
8. While you wait for the person running the server to verify your identity and then register your certificate to unlock more access, you’ll probably want to set these options under Configure > Settings...:
   • User Interface > Look and Feel > Show transmit mode dropdown in toolbar
   • Network > Connection > Reconnect to last server on startup
9. Once you’re testing the call quality, the settings to play with are:
   • If your voice is too quiet, Audio Input > Audio Processing > Max. Amplification is the sender-side control to adjust. Recipients also have a local adjustment for themselves only in the context menu for each user in the list.
   • If ambient noise is a problem, try changing the type of Audio Input > Audio Processing > Noise Suppression. I’ve found that the default Speex noise suppression isn’t the best at excluding things like fans, and I use Both.
   • If your audio sound “crunchy” or blown out, double-check that the Quality and Audio per packet settings under Audio Input > Compression didn’t get set too low. I’ve found that none of my friends see any problem with 40.0 kb/s and 20 ms. and, since these values are in kilobits, that’s still a per-user bandwidth load that could fit in an old dial-up Internet connection.

If you experience cut-outs or voices going robotic, that indicates that packet loss is occurring between someone and the server. Identify whose connection is experiencing packet loss by right-clicking usernames and selecting Information and then checking the Lost column in the UDP Network statistics section.

If they have plenty of free bandwidth but are experiencing packet loss nonetheless, that indicates a problem with someone’s network, but a short-term workaround is to have them try Network > Connection > Force TCP mode. (Using TCP will resend lost data, which can increase latency and bandwidth use, but, if congestion isn’t the problem, it should just appear to fix things with no noticeable downsides… I can vouch for this since a friend’s Internet being flaky was why I switched from Discord to Mumble for this feature.)

Here are my 2025 tips too short for anywhere but Mastodon:

• Short term fix for rattly GPU fans: If your 3000-series nVidia GPU’s fan has started to develop a rattling/ticking noise and you either can’t afford a replacement fan or can’t wait, try going into nvidia-settings, taking manual control of the fan speed, and ramping it up in 5% increments until you find a speed where it goes away and stays away. Then, leave it for a few hours before turning auto-speed back on. (I left it overnight.)
  That shook the fan on my RTX 3060 back into idling quietly at 30% speed.
  (UPDATE: The proper fix is to either send it in for warranty or order a replacement fan from China (1, 2) or to order an adapter cable from someone like gpuconnect.com and perform a deshroud mod so you can swap in stock fans from someone like Noctua. Depending on your card, it may be possible to swap the fan without taking the heat sink off the GPU, as it is with the ASUS Phoenix RTX 3060 v2 that I have.)
• Windows 9x Network Backups: If you’re using Windows Backup with a network share to backup your Windows 98 SE retro PC, it’ll stop at 4GiB and insist you swap disks and won’t be appeased by moving/renaming the .qic file from the far end. Probably best to partition your drive into volumes of 4GiB or less for simplicity, FAT32 or not. (And leave compression on to ensure there’s enough room in the file for the backup metadata.)
  (UPDATE: …or use a network card with a PXE ROM, like the built-in one in Intel PRO/1000 cards, and netboot into Linux to use rsync to do your backups. FAT’s permission bits are simple enough that rsync can preserve them with the right options.
• Replacement for GTK4 Zenity: For anyone who upgraded their non-GNOME *buntu and discovered that one of their scripts suddenly has a very out-of-place libadwaita-style Zenity dialog popping up, yad is in the package repository and only differs by the --info/--question/--warning/--error arguments according to their compatibility wrapper at https://github.com/v1cont/yad/blob/master/data/misc/zenity.sh
• Support files for old HP consumer machines: Huh. So the fr-ca (eg. Quebecois) listing for support files for this >10-year-old hand-me-down HP Pavilion is still up and in search results, despite the HP site refusing to let me into an English listing because it’s “too far out of support”.
  …the newest UEFI they offer still doesn’t fix the refusal to POST with GeForce cards new enough to be UEFI GOP-native (i.e. 7xx-series and above), but at least now I know.
  (UPDATE: See GPU fix for HP motherboards (IPISB-CH2, IPISB-CH, IPISB-CU, H-Cupertino2) [modified BIOS image] on the Internet Archive for UEFI updates patched to prefer the working VBIOS support over the broken UEFI GOP support.)
• LiveUpdate Crescendo: How many people who were online in the 90s remember the LiveUpdate Crescendo MIDI player plugin? In case anyone wants it, I finally got around to sharing what I have, including the Windows Netscape variant of version 5 from one of my CD-Rs which seems to be missing from the Wayback Machine. → https://archive.org/details/liveupdate
• Opening a Mac Mini G4 gently: I just discovered that the instructions that turn up in searches for opening a Mac Mini G4 are unnecessarily brutal and prone to gouging or cracking plastic. Instead of prying anything, here’s the technique I intuited and used:
  1. Use one hand to apply pressure between the back I/O shield and the outer frame (like tensioning the cylinder, if you watch lockpicking videos)
  2. With a thin metal spudger/pry tool (eg. iFixIt Jimmy), work your way around the edge starting at the back, pressing each clip just enough to release it.
• Generative AI: Turns out I’m not the only one who thought generative AI looks suspiciously like a procedurally generated gacha game: Generative AI runs on gambling addiction — just one more prompt, bro!
• Blue Yeti PipeWire Bug: If your Blue Yeti doesn’t show up in *buntu 24.04 and was working fine in *buntu 22.04, it’s probably a bug related to the switch to Pipewire where the wireplumber state can get messed up.
  Check that it’s present in arecord -L and then run rm -rf ~/.local/state/wireplumber; pkill pipewire to reset things. Once pipewire restarts, the Yeti should pop into your pavucontrol or KDE System Settings Audio panel like normal.
• Blocking Thunderbird Quick Filter Bar from Closing: Since the Thunderbird people just duped bug 1947722 (support for disabling hiding the Quick Filter bar on Esc keypresses) against bug 1922924 (disable Esc when filter settings are pinned), here’s a little python-xlib hack for the actually desired functionality by filtering events.
  https://gist.github.com/ssokolow/74c8bda3dafc133e615e3152b815196f
  Wayland users will have to force their Thunderbird to run as an X11 app via XWayland or Wayland’s security model will prevent this from working.
• Line Boost keeps resetting: If PipeWire/WirePlumber keeps resetting ALSA mixer settings on hotplug (eg. slamming “Line Boost” to 100% whenever you plug/unplug headphones or Ctrl+Alt+# switch virtual consoles), the “Pro Audio” profile (settable via the PulseAudio compatibility layer through KDE’s System Settings → Audio or pavucontrol) will stop it from meddling in the ALSA mixer so you can fix things. #linux #audio #linuxaudio
• Firefox Keyword Search Frustration: If your firefox keyword search has been messing up recently, including your trigger keyword (eg. my wp for Wikipedia) in what’s searched for or copy-pasting the search you just did instead of the retrieved URL, try toggling Settings > Search > Show search terms in the address bar on results pages.
  If you’re running into the same thing as me, the bug is a new feature that leaves the state of the address bar un-reset after you press Enter.
• Alcohol 120% PSA: The installer for Alcohol 52% Free Edition 2.1.1.2201 attempts to install a piece of malware named BrightSDK. If you have a system which is giving you the “Loading Alcohol device drivers failed!” error after a system update, keep your old version and just extract the appropriate SPTDinst.exe or SPTD2inst.exe for your system from it using 7zip.
  (BrightSDK turns your computer into a crawler bot for AI scrapers to get around blocklists intended to stop robots.txt-dodgers.)
• systemd footgun: Accidentally running systemd --user instead of systemctl --user may render your D-Bus session bus unresponsive until you log out, breaking Pipewire, XDG portals, and a lot of other things.
  (It’s probably a good idea to add an alias or function to your bashrc or zshrc to block accidental invocation of it.)
• Force-fixing GTK Open/Save dialogs in Flatpaks: Use this command to batch-set all your installed GNOME Runtime-based Flatpak apps which don’t yet use portallized Open/Save dialogs to default to opening the dialog to $PWD instead of the Recent tab.
  for X in $(flatpak list --app-runtime=org.gnome.Platform --columns=application | tail +1); do flatpak run --command="gsettings" "$X" set org.gtk.Settings.FileChooser startup-mode cwd; done
• Wine Black Texture Bug: If you don’t want to use a Wine/Proton manager like Lutris or Bottles, the black texture bug that the game Born of Bread exhibits under the distro-provided Wine 9.0 on Ubuntu Linux 24.04 can be fixed by installing DXVK. (The last version compatible with Wine versions below 10.0 is DXVK 2.7.1.)
• XInput Wrappers under Wine: If you want to disable controller rumble for the GOG release of Born of Bread under Wine (i.e. not system-wide) and you’re using Durazno as your XInput wrapper, you need to set a native, then builtin DLL override for xinput1_3 in winecfg and the game will look for DLLs under GOG Games/Born of Bread/BornOfBread/Binaries/Win64, but the durazno.ini is created/searched next to the top-level BornOfBread.exe under GOG Games/Born of Bread.
• Making Firefox AI Enhancements Opt-In: Firefox does allow you to configure it so future “AI Enhancements” are opt-in… it just doesn’t pop up the note that you can “unblock specific features” (eg. the on-device counterpart to Chrome’s Google Translate integration) until after you are committed enough to try toggling the global “Block AI enhancements” option. (under Preferences > AI Controls" URL: about:preferences#ai )
• Opening OSTENT Wiimote Pistol Shells: If you want to open up OSTENT wiimote pistol shells to lubricate the trigger mechanism to stop it squeaking, two of the moulded plastic screw heads on the pistol grip are actually decorative plastic covers you’ll need to lever out with a push pin to reveal two more actual crews.
  (UPDATE: This is also useful if your trigger keeps catching/sticking. You can open up the shell and shave a corner off the trigger slide with a utility knife.)
• nVidia and modelines: Modern nVidia drivers refuse manually specified modelines if you disable EDID, and it apparently hard-codes “primary = leftmost” at the xorg.conf level now, making MetaModes useless.
  To lock your resolution, leave KScreen 2 enabled for the “primary != leftmost” fixup and patch your X server or Wayland compositor, write an LD_PRELOAD hook for XRandR APIs, or buy a hardware EDID emulator.
  To prevent hot-unplug from jumbling your outputs, patch your compositor or buy a pass-through HDMI dummy plug.

I’ve been playing Stardew Valley with a few friends, with mods, and, when one of them started experiencing intermittent packet loss that messed up the Discord call, I decided to set up a private Mumble server since Mumble has a “Force TCP” checkbox which, as expected, cleared it up.

However, I got a little nerd-sniped and have been incrementally rediscovering the fun of webmastering a 2000s gaming guild website and the most recent thing I got carried away with was a little Python script which will take a zipped up Mods folder from a SMAPI-augmented Stardew Valley install and render a .info.html file alongside it with a pretty summation of the manifest.json files inside.

Here it is in case anyone else wants it.

Here are a few things that I posted on Mastodon because they were too short for a blog post, but which I think should be cross-posted anyway for archival:

• KVM “not compatible with” Linux or Mac OS: If you have a DVI KVM switch that says its “double-tap scroll lock to switch inputs” feature is only compatible with Windows, what they probably mean is “we listen for the scroll lock LED to blink and Windows is the only OS that maps the Scroll Lock keycode to a modifier in this day and age”. Here’s a script I wrote to trigger the switch on X11 and then made a taskbar icon for.
• Two-page CBZ to HTML conversion: If you’re stubborn like me and have a CBZ file containing a bunch of two-page spreads that Calibre splits and orders incorrectly when making an EPUB file, you too can work around the iOS Files app’s refusal to load subresources and turn it into a quick-and-dirty CBZ reader by embedding your pages into an HTML file using data URIs using this script I wrote… it actually performs quite well in my testing. (<2s load time for a 40MiB CBZ file)
• Sandboxing libusb: If you’re setting up systemd sandboxing for a libusb-based daemon, you’ll need to allow AF_NETLINK sockets (eg. RestrictAddressFamilies=AF_NETLINK) if you want it to work… I’m still trying to figure out a working DeviceAllow string for my CM19A so I can go back to the DevicePolicy=closed and PrivateDevices=yes I was using with my CM17A. You can poke at the full systemd unit file at ssokolow/fan_remote on GitHub.
• TekSavvy DSL, IPv6, and OPNSense: If you’re on TekSavvy DSL, following the “IPv6 for generic DSL dialup“ guide then restarting your router and disconnect/reconnect cycling LAN devices will WORK to get you IPv6 (you may need to toggle Firefox’s DoH to get fallback working on https://ipv6-test.com/ )… but it won’t get you ICMPv6. Follow this “How to Configure IPv6 in Your Home Network with ISP such as Comcast Xfinity” guide for that but set “any” as the destination address instead of “WAN address” or it won’t work.
• 86Box and Flatpak: If you’re getting strange read/write errors or “sharing violation”s when running “make boot disk” tools/batch files in 86Box and you’re using the Flatpak version, create your floppy disk images inside ~/.var/app/net._86box._86Box/ or grant a manifest permission. Apparently there’s a bug or incompleteness in the Flatpak documents portal FUSE filesystem.
• Missing CD Audio in Games: If you get an MMSYSTEM262 error from The Incredible Toon Machine and no CD music (or just no CD music from Age of Empires in general) on Windows 9x and you have more than one CD drive (eg. physical and DAEMON Tools or Alcohol 52% Retro Edition), the fix is probably to go into Control Panel → Multimedia → Devices → Media Control Devices → CD Audio Device (Media Control) → Properties → Settings … and change “Default CD-ROM drive for playing CD music”.
  I’m not sure how to do this on Windows XP since the equivalent to that last Settings button does nothing when clicked, so the workaround for newer Windows versions is just to go into the system management console and swap the drive letters of your optical drives. (Though that may make some badly-designed games require a reinstall to get them to look at the new drive letter.)
• Flaky iPhone: If you’ve got a hand-me-down iPhone where the flashlight or rotation lock occasional toggle without being asked, the touch sensor on the back may be too sensitive. Try turning off the “tap on the back of the phone to…” feature and see if that fixes it. (For me, it had become so sensitive it was activating through the Otter Box belt clip I’m using as a lens cap and the air gap below it.)
• YD-RP2040: The YD-RP2040 isn’t 100% compatible with name-brand Raspberry Pi Pico boards. If you need to build something that has it acting as a USB host, prepare for the slightly fiddly job of tacking a piece of resistor leg between the two legs of a BAT54C barrier diode facing the USB C connector to allow current from Vin to flow to the USB connector (I’ve contributed an annotated photo in the ps2x2pico README … also, the (VBUS) and (VSYS) silkscreens on the bottom are wrong. Vout is not VBUS. Follow this schematic.
• Display Alignment in KDE: If snap-to-edge behaviour in KDE Display Settings is preventing you from getting the monitor alignment you want (eg. top-aligned 1280×1024,1920×1080,1280×1024), try changing (but not applying) resolutions, then snapping, then changing them back.
• No route to host: If your client says “No route to host” on some ports but not others, double-check your server’s firewall configuration… for example, if you’re trying to use UFW and something also installed firewalld behind your back, you’re going to get very confusing symptoms that won’t be fixed by asking UFW to flush your iptables and re-create them.
• annoyingasians.mpg: If you ever wondered what the music was from an old ebaumsworld video named annoyingasians.mpg with no other context… searching the filename on YouTube allows Content ID to find the answer. It’s called 중화반점.
• Firefox Smooth Scrolling: If you’re getting smooth scrolling from your scroll wheel in Firefox despite the checkbox still being unchecked and you don’t like your scrolling being slow/laggy, try going into about:config and toggling the general.smoothScroll.mouseWheel pref to also be false.
• WinSCP: If you’re using WinSCP’s synchronize command in a script but you don’t edit your script very often and your new exclusion pattern seems to be getting ignored, check if you’re trying to name a directory without including the trailing slash.
• Occam’s Razor: Put a pin in this for future sharing → https://www.youtube.com/watch?v=mO46CNftRDs
  “Actually, it’s not asteroid bacteria… we discovered that bacteria managed to evolve to eat the cleaning products we use to sterilize clean rooms” is one of the most intuitive examples I’ve seen for why people shouldn’t leap to assuming fantastic answers like UFOs or cryptids.
• Python enums: Because of how Python’s enum.Enum implements nominal typing and how Python imports work, it risks seemingly mundane refactorings causing var == FooEnum.Bar comparisons to start to mysteriously fail when PyQt and Qt Designer’s “Promote…” feature are involved. If you don’t need such strict nominal typing, using enum.IntEnum to relax the equality comparison will avoid that source of footguns.

If you have a Vorke V1 Plus that doesn’t want to drive its fan under Linux, or which doesn’t want to shut off the fan after the UEFI turns it on at boot, here’s what worked for me:

1. Make sure you’ve got a kernel version that allows you to manually control the fan via one of the /sys/class/thermal/cooling_deviceX/cur_state nodes. Debian bookworm’s default 6.1.0-13 kernel had problems with that while my Ubuntu 22.04 LTS flash drive’s 6.2.0-16 didn’t, so I wound up pulling one of the 6.5.0 kernels from Debian backports.)
2. Make sure thermald is installed. My experience is that, without it, the Vorke V1 Plus will just leave its fan on whatever the UEFI set it to, no matter how high or low the CPU temperature goes.
3. Write this configuration into /etc/thermald/thermal-conf.xml:

   <?xml version="1.0"?>
   <ThermalConfiguration>
     <Platform>
       <Name>Prefer fan over thermal throttling</Name>
       <ProductName>*</ProductName>
       <Preference>PERFORMANCE</Preference>
     </Platform>
   </ThermalConfiguration>

   As far as I can tell, thermald on Debian bookworm defaults to <Preference>QUIET</Preference>, which means “Thermal throttle as much as you need to in order to avoid spinning up the fan”.
   
   (Which is a neat option for things with shrill fans like the Vorke V1 Plus if I can figure out an easy way to toggle it… maybe reassign the power button from “request a clean shutdown” to “toggle cooling between performance and quiet”.)
   
   There’s probably some other way you’re meant to do this, and I welcome comments from people who actually know how this is supposed to work, because I found thermald to be frustratingly under-documented.
4. Run systemctl edit thermald.service and paste in these lines:

   [Service]
   ExecStart=
   ExecStart=/usr/sbin/thermald --no-daemon --dbus-enable --exclusive-control --config-file=/etc/thermald/thermal-conf.xml

   Without --exclusive-control, I found thermald still allowing temperatures to shoot up without enabling the fan.

As for --config-file, the manpage says /etc/thermald/thermal-conf.xml should be in the default search path, but, without specifying it explicitly, I was still getting no effect, despite neither of the higher-priority paths existing.

4. Reboot (instead of just restarting thermald) to make sure all changes will persist as intended and stress-test the CPU with something like stress --cpu 4.

If you still have trouble, try toggling DPTF enable/disable in the UEFI settings. (hold Delete while powering on, and then go into Advanced > Thermal.)

I don’t know if playing around with DPTF is necessary with the Vorke V1 Plus, but I also have a Vorke V1 and I needed to toggle it on that one so I could memtest86 the RAM upgrade I put in without the thing slowly overheating.