Compare commits
2 commits
90809ec826
...
956c5bd258
Author | SHA1 | Date | |
---|---|---|---|
956c5bd258 | |||
89f9196ef0 |
3 changed files with 96 additions and 93 deletions
configuration
|
@ -22,6 +22,7 @@
|
||||||
./services/foundryvtt.nix
|
./services/foundryvtt.nix
|
||||||
./services/gitea.nix
|
./services/gitea.nix
|
||||||
./services/metrics
|
./services/metrics
|
||||||
|
./services/minecraft.nix
|
||||||
./services/nextcloud.nix
|
./services/nextcloud.nix
|
||||||
./services/webserver.nix
|
./services/webserver.nix
|
||||||
./services/wireguard.nix
|
./services/wireguard.nix
|
||||||
|
@ -70,8 +71,6 @@
|
||||||
8448
|
8448
|
||||||
# starbound
|
# starbound
|
||||||
21025
|
21025
|
||||||
# Minecraft
|
|
||||||
25565
|
|
||||||
|
|
||||||
config.services.coturn.listening-port
|
config.services.coturn.listening-port
|
||||||
config.services.coturn.tls-listening-port
|
config.services.coturn.tls-listening-port
|
||||||
|
@ -80,9 +79,6 @@
|
||||||
];
|
];
|
||||||
|
|
||||||
allowedUDPPorts = [
|
allowedUDPPorts = [
|
||||||
# More minecraft
|
|
||||||
25565
|
|
||||||
|
|
||||||
config.services.coturn.listening-port
|
config.services.coturn.listening-port
|
||||||
config.services.coturn.tls-listening-port
|
config.services.coturn.tls-listening-port
|
||||||
config.services.coturn.alt-listening-port
|
config.services.coturn.alt-listening-port
|
||||||
|
|
|
@ -1,37 +1,26 @@
|
||||||
{
|
{
|
||||||
config,
|
config,
|
||||||
pkgs,
|
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
let
|
let
|
||||||
cfg = config.services.victorialogs;
|
cfg = config.services.victorialogs;
|
||||||
pkg = pkgs.victoriametrics;
|
|
||||||
dirname = "victorialogs";
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.services.victorialogs =
|
options.services.victorialogs.bindAddress = lib.mkOption {
|
||||||
let
|
readOnly = true;
|
||||||
inherit (lib.types) str;
|
type = lib.types.str;
|
||||||
in
|
description = ''
|
||||||
{
|
Final address on which victorialogs listens.
|
||||||
listenAddress = lib.mkOption {
|
'';
|
||||||
default = ":9428";
|
};
|
||||||
type = str;
|
|
||||||
};
|
|
||||||
|
|
||||||
bindAddress = lib.mkOption {
|
|
||||||
readOnly = true;
|
|
||||||
type = str;
|
|
||||||
description = ''
|
|
||||||
Final address on which victorialogs listens.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
services.victorialogs.bindAddress =
|
services.victorialogs = {
|
||||||
(lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
|
enable = true;
|
||||||
|
bindAddress =
|
||||||
|
(lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
|
||||||
|
};
|
||||||
|
|
||||||
services.journald.upload = {
|
services.journald.upload = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -40,71 +29,6 @@ in
|
||||||
NetworkTimeoutSec = "20s";
|
NetworkTimeoutSec = "20s";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
|
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
|
||||||
|
|
||||||
systemd.services.victorialogs = {
|
|
||||||
description = "VictoriaLogs log database";
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
after = [ "network.target" ];
|
|
||||||
startLimitBurst = 5;
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = lib.escapeShellArgs [
|
|
||||||
"${pkg}/bin/victoria-logs"
|
|
||||||
"-storageDataPath=/var/lib/${dirname}"
|
|
||||||
"-httpListenAddr=${cfg.listenAddress}"
|
|
||||||
];
|
|
||||||
|
|
||||||
DynamicUser = true;
|
|
||||||
RestartSec = 1;
|
|
||||||
Restart = "on-failure";
|
|
||||||
RuntimeDirectory = dirname;
|
|
||||||
RuntimeDirectoryMode = "0700";
|
|
||||||
StateDirectory = dirname;
|
|
||||||
StateDirectoryMode = "0700";
|
|
||||||
|
|
||||||
LimitNOFILE = 1048576;
|
|
||||||
|
|
||||||
# Hardening
|
|
||||||
DeviceAllow = [ "/dev/null rw" ];
|
|
||||||
DevicePolicy = "strict";
|
|
||||||
LockPersonality = true;
|
|
||||||
MemoryDenyWriteExecute = true;
|
|
||||||
NoNewPrivileges = true;
|
|
||||||
PrivateDevices = true;
|
|
||||||
PrivateTmp = true;
|
|
||||||
PrivateUsers = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
ProtectHome = true;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
ProtectProc = "invisible";
|
|
||||||
ProtectSystem = "full";
|
|
||||||
RemoveIPC = true;
|
|
||||||
RestrictAddressFamilies = [
|
|
||||||
"AF_INET"
|
|
||||||
"AF_INET6"
|
|
||||||
"AF_UNIX"
|
|
||||||
];
|
|
||||||
RestrictNamespaces = true;
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
SystemCallFilter = [
|
|
||||||
"@system-service"
|
|
||||||
"~@privileged"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
postStart = lib.mkBefore ''
|
|
||||||
until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${cfg.bindAddress}/ping; do
|
|
||||||
sleep 1;
|
|
||||||
done
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
83
configuration/services/minecraft.nix
Normal file
83
configuration/services/minecraft.nix
Normal file
|
@ -0,0 +1,83 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
services.minecraft-server = {
|
||||||
|
enable = true;
|
||||||
|
eula = true;
|
||||||
|
# jvmOpts are set using a file for forge
|
||||||
|
# jvmOpts = "-Xmx8G -Xms8G";
|
||||||
|
openFirewall = true;
|
||||||
|
|
||||||
|
declarative = true;
|
||||||
|
|
||||||
|
whitelist = {
|
||||||
|
tlater = "140d177a-966f-41b8-a4c0-e305babd291b";
|
||||||
|
romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c";
|
||||||
|
lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4";
|
||||||
|
};
|
||||||
|
|
||||||
|
serverProperties = {
|
||||||
|
allow-flight = true;
|
||||||
|
difficulty = "hard";
|
||||||
|
motd = "tlater.net";
|
||||||
|
spawn-protection = 1;
|
||||||
|
white-list = true;
|
||||||
|
enable-query = true;
|
||||||
|
enable-status = true;
|
||||||
|
|
||||||
|
# Allows the server to write chunks without hogging the main
|
||||||
|
# thread...
|
||||||
|
sync-chunk-writes = false;
|
||||||
|
# Disables chat reporting, because we don't need any of that
|
||||||
|
# drama on a lil' friends-only server.
|
||||||
|
enforce-secure-profile = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
package = pkgs.writeShellApplication {
|
||||||
|
name = "minecraft-server";
|
||||||
|
runtimeInputs = with pkgs; [ jdk17_headless ];
|
||||||
|
|
||||||
|
text = ''
|
||||||
|
exec /var/lib/minecraft/run.sh $@
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.minecraft-server = {
|
||||||
|
path = with pkgs; [ jdk17_headless ];
|
||||||
|
|
||||||
|
# Since we read from our own HTTP server, we need to wait for it
|
||||||
|
# to be up
|
||||||
|
after = [ "nginx.service" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
# Use packwiz to install mods
|
||||||
|
ExecStartPre = [
|
||||||
|
"${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'"
|
||||||
|
];
|
||||||
|
# Forge requires some bonus JVM options, which they include in a
|
||||||
|
# little `run.sh` script
|
||||||
|
ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.settings."10-minecraft" = {
|
||||||
|
"/srv/minecraft".d = {
|
||||||
|
user = "nginx";
|
||||||
|
group = "minecraft";
|
||||||
|
mode = "0775";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "tlater.net";
|
||||||
|
enableHSTS = true;
|
||||||
|
|
||||||
|
root = "/srv/minecraft";
|
||||||
|
};
|
||||||
|
}
|
Loading…
Add table
Add a link
Reference in a new issue