From ca3d21b3ad843784903546859a27971e6b9a9168 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tristan=20Dani=C3=ABl=20Maat?= <tm@tlater.net> Date: Thu, 7 Nov 2024 20:26:43 +0100 Subject: [PATCH 1/4] WIP: feat: Add minecraft server --- configuration/default.nix | 6 +- configuration/services/minecraft.nix | 83 ++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+), 5 deletions(-) create mode 100644 configuration/services/minecraft.nix diff --git a/configuration/default.nix b/configuration/default.nix index c9c71ec..d4c422f 100644 --- a/configuration/default.nix +++ b/configuration/default.nix @@ -22,6 +22,7 @@ ./services/foundryvtt.nix ./services/gitea.nix ./services/metrics + ./services/minecraft.nix ./services/nextcloud.nix ./services/webserver.nix ./services/wireguard.nix @@ -70,8 +71,6 @@ 8448 # starbound 21025 - # Minecraft - 25565 config.services.coturn.listening-port config.services.coturn.tls-listening-port @@ -80,9 +79,6 @@ ]; allowedUDPPorts = [ - # More minecraft - 25565 - config.services.coturn.listening-port config.services.coturn.tls-listening-port config.services.coturn.alt-listening-port diff --git a/configuration/services/minecraft.nix b/configuration/services/minecraft.nix new file mode 100644 index 0000000..0477f44 --- /dev/null +++ b/configuration/services/minecraft.nix @@ -0,0 +1,83 @@ +{ + pkgs, + lib, + config, + ... +}: +{ + services.minecraft-server = { + enable = true; + eula = true; + # jvmOpts are set using a file for forge + # jvmOpts = "-Xmx8G -Xms8G"; + openFirewall = true; + + declarative = true; + + whitelist = { + tlater = "140d177a-966f-41b8-a4c0-e305babd291b"; + romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c"; + lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4"; + }; + + serverProperties = { + allow-flight = true; + difficulty = "hard"; + motd = "tlater.net"; + spawn-protection = 1; + white-list = true; + enable-query = true; + enable-status = true; + + # Allows the server to write chunks without hogging the main + # thread... + sync-chunk-writes = false; + # Disables chat reporting, because we don't need any of that + # drama on a lil' friends-only server. + enforce-secure-profile = false; + }; + + package = pkgs.writeShellApplication { + name = "minecraft-server"; + runtimeInputs = with pkgs; [ jdk17_headless ]; + + text = '' + exec /var/lib/minecraft/run.sh $@ + ''; + }; + }; + + systemd.services.minecraft-server = { + path = with pkgs; [ jdk17_headless ]; + + # Since we read from our own HTTP server, we need to wait for it + # to be up + after = [ "nginx.service" ]; + + serviceConfig = { + # Use packwiz to install mods + ExecStartPre = [ + "${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'" + ]; + # Forge requires some bonus JVM options, which they include in a + # little `run.sh` script + ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui"; + }; + }; + + systemd.tmpfiles.settings."10-minecraft" = { + "/srv/minecraft".d = { + user = "nginx"; + group = "minecraft"; + mode = "0775"; + }; + }; + + services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = { + forceSSL = true; + useACMEHost = "tlater.net"; + enableHSTS = true; + + root = "/srv/minecraft"; + }; +} From f5b1acda4f0e552955a42c29da8d76845124e7cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tristan=20Dani=C3=ABl=20Maat?= <tm@tlater.net> Date: Fri, 7 Feb 2025 01:39:57 +0800 Subject: [PATCH 2/4] feat(crowdsec): Switch to whitelisting wireguard IP My IP address is not static, and grafana seems to comfortably produce enough traffic to get me IP banned. --- configuration/services/crowdsec.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configuration/services/crowdsec.nix b/configuration/services/crowdsec.nix index 4891cad..ab0dd01 100644 --- a/configuration/services/crowdsec.nix +++ b/configuration/services/crowdsec.nix @@ -4,7 +4,7 @@ enable = true; parserWhitelist = [ - "1.64.239.213" + "10.45.249.2" ]; extraGroups = [ From e9a9a5bc261e591ce951b112cf1cc01b7169391a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tristan=20Dani=C3=ABl=20Maat?= <tm@tlater.net> Date: Fri, 7 Feb 2025 02:47:16 +0800 Subject: [PATCH 3/4] bump(flake.lock): Update sonnenshift input --- flake.lock | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/flake.lock b/flake.lock index d86b361..7f117e9 100644 --- a/flake.lock +++ b/flake.lock @@ -266,11 +266,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1731205797, - "narHash": "sha256-F7N1mxH1VrkVNHR3JGNMRvp9+98KYO4b832KS8Gl2xI=", + "lastModified": 1738741221, + "narHash": "sha256-UiTOA89yQV5YNlO1ZAp4IqJUGWOnTyBC83netvt8rQE=", "owner": "nix-community", "repo": "poetry2nix", - "rev": "f554d27c1544d9c56e5f1f8e2b8aff399803674e", + "rev": "be1fe795035d3d36359ca9135b26dcc5321b31fb", "type": "github" }, "original": { @@ -381,11 +381,11 @@ "poetry2nixi": "poetry2nixi" }, "locked": { - "lastModified": 1733296058, - "narHash": "sha256-2tYgb4TbvoLk+zsRdCPaglP0s9GCG5HOR9Jm9rsSiHU=", + "lastModified": 1738867540, + "narHash": "sha256-co2Fs1VoWtTzo7IAeRtaNnyofoUWFOv/Aa/+vSorurA=", "ref": "refs/heads/main", - "rev": "5f01c17df4dbe841bb6ccd85993c0d9b7368af72", - "revCount": 13, + "rev": "c6eeff42799c9d4073a241056198004d89bf87df", + "revCount": 15, "type": "git", "url": "ssh://git@github.com/sonnenshift/battery-manager" }, @@ -454,8 +454,9 @@ "type": "github" }, "original": { - "id": "systems", - "type": "indirect" + "owner": "nix-systems", + "repo": "default", + "type": "github" } }, "tlaternet-webserver": { From c6973a36e1aa4ba48c16f02228f05802a0789b31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tristan=20Dani=C3=ABl=20Maat?= <tm@tlater.net> Date: Thu, 7 Nov 2024 20:26:43 +0100 Subject: [PATCH 4/4] WIP: feat: Add minecraft server --- configuration/default.nix | 6 +- configuration/services/minecraft.nix | 83 ++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+), 5 deletions(-) create mode 100644 configuration/services/minecraft.nix diff --git a/configuration/default.nix b/configuration/default.nix index c9c71ec..d4c422f 100644 --- a/configuration/default.nix +++ b/configuration/default.nix @@ -22,6 +22,7 @@ ./services/foundryvtt.nix ./services/gitea.nix ./services/metrics + ./services/minecraft.nix ./services/nextcloud.nix ./services/webserver.nix ./services/wireguard.nix @@ -70,8 +71,6 @@ 8448 # starbound 21025 - # Minecraft - 25565 config.services.coturn.listening-port config.services.coturn.tls-listening-port @@ -80,9 +79,6 @@ ]; allowedUDPPorts = [ - # More minecraft - 25565 - config.services.coturn.listening-port config.services.coturn.tls-listening-port config.services.coturn.alt-listening-port diff --git a/configuration/services/minecraft.nix b/configuration/services/minecraft.nix new file mode 100644 index 0000000..0477f44 --- /dev/null +++ b/configuration/services/minecraft.nix @@ -0,0 +1,83 @@ +{ + pkgs, + lib, + config, + ... +}: +{ + services.minecraft-server = { + enable = true; + eula = true; + # jvmOpts are set using a file for forge + # jvmOpts = "-Xmx8G -Xms8G"; + openFirewall = true; + + declarative = true; + + whitelist = { + tlater = "140d177a-966f-41b8-a4c0-e305babd291b"; + romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c"; + lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4"; + }; + + serverProperties = { + allow-flight = true; + difficulty = "hard"; + motd = "tlater.net"; + spawn-protection = 1; + white-list = true; + enable-query = true; + enable-status = true; + + # Allows the server to write chunks without hogging the main + # thread... + sync-chunk-writes = false; + # Disables chat reporting, because we don't need any of that + # drama on a lil' friends-only server. + enforce-secure-profile = false; + }; + + package = pkgs.writeShellApplication { + name = "minecraft-server"; + runtimeInputs = with pkgs; [ jdk17_headless ]; + + text = '' + exec /var/lib/minecraft/run.sh $@ + ''; + }; + }; + + systemd.services.minecraft-server = { + path = with pkgs; [ jdk17_headless ]; + + # Since we read from our own HTTP server, we need to wait for it + # to be up + after = [ "nginx.service" ]; + + serviceConfig = { + # Use packwiz to install mods + ExecStartPre = [ + "${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'" + ]; + # Forge requires some bonus JVM options, which they include in a + # little `run.sh` script + ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui"; + }; + }; + + systemd.tmpfiles.settings."10-minecraft" = { + "/srv/minecraft".d = { + user = "nginx"; + group = "minecraft"; + mode = "0775"; + }; + }; + + services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = { + forceSSL = true; + useACMEHost = "tlater.net"; + enableHSTS = true; + + root = "/srv/minecraft"; + }; +}