WIP: feat: Add minecraft server

configuration/default.nix

@@ -22,6 +22,7 @@
     ./services/foundryvtt.nix
     ./services/gitea.nix
     ./services/metrics
+    ./services/minecraft.nix
     ./services/nextcloud.nix
     ./services/webserver.nix
     ./services/wireguard.nix
@@ -70,8 +71,6 @@
         8448
         # starbound
         21025
-        # Minecraft
-        25565
 
         config.services.coturn.listening-port
         config.services.coturn.tls-listening-port
@@ -80,9 +79,6 @@
       ];
 
       allowedUDPPorts = [
-        # More minecraft
-        25565
-
         config.services.coturn.listening-port
         config.services.coturn.tls-listening-port
         config.services.coturn.alt-listening-port

configuration/services/battery-manager.nix

@@ -4,9 +4,13 @@
 
   services.batteryManager = {
     enable = true;
-    battery = "3ca39300-c523-4315-b9a3-d030f85a9373";
 
     emailFile = "${config.sops.secrets."battery-manager/email".path}";
     passwordFile = "${config.sops.secrets."battery-manager/password".path}";
+
+    settings = {
+      battery_id = "3ca39300-c523-4315-b9a3-d030f85a9373";
+      log_level = "DEBUG";
+    };
   };
 }

configuration/services/conduit/default.nix

@@ -59,11 +59,8 @@ in
     relay-ips = [ "116.202.158.55" ];
 
     # SSL config
-    #
-    # TODO(tlater): Switch to letsencrypt once google fix:
-    #  https://github.com/vector-im/element-android/issues/1533
-    pkey = config.sops.secrets."turn/ssl-key".path;
-    cert = config.sops.secrets."turn/ssl-cert".path;
+    pkey = "${config.security.acme.certs."tlater.net".directory}/key.pem";
+    cert = "${config.security.acme.certs."tlater.net".directory}/fullchain.pem";
 
     # Based on suggestions from
     # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md

configuration/services/minecraft.nix

@@ -0,0 +1,83 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  services.minecraft-server = {
+    enable = true;
+    eula = true;
+    # jvmOpts are set using a file for forge
+    # jvmOpts = "-Xmx8G -Xms8G";
+    openFirewall = true;
+
+    declarative = true;
+
+    whitelist = {
+      tlater = "140d177a-966f-41b8-a4c0-e305babd291b";
+      romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c";
+      lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4";
+    };
+
+    serverProperties = {
+      allow-flight = true;
+      difficulty = "hard";
+      motd = "tlater.net";
+      spawn-protection = 1;
+      white-list = true;
+      enable-query = true;
+      enable-status = true;
+
+      # Allows the server to write chunks without hogging the main
+      # thread...
+      sync-chunk-writes = false;
+      # Disables chat reporting, because we don't need any of that
+      # drama on a lil' friends-only server.
+      enforce-secure-profile = false;
+    };
+
+    package = pkgs.writeShellApplication {
+      name = "minecraft-server";
+      runtimeInputs = with pkgs; [ jdk17_headless ];
+
+      text = ''
+        exec /var/lib/minecraft/run.sh $@
+      '';
+    };
+  };
+
+  systemd.services.minecraft-server = {
+    path = with pkgs; [ jdk17_headless ];
+
+    # Since we read from our own HTTP server, we need to wait for it
+    # to be up
+    after = [ "nginx.service" ];
+
+    serviceConfig = {
+      # Use packwiz to install mods
+      ExecStartPre = [
+        "${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'"
+      ];
+      # Forge requires some bonus JVM options, which they include in a
+      # little `run.sh` script
+      ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui";
+    };
+  };
+
+  systemd.tmpfiles.settings."10-minecraft" = {
+    "/srv/minecraft".d = {
+      user = "nginx";
+      group = "minecraft";
+      mode = "0775";
+    };
+  };
+
+  services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = {
+    forceSSL = true;
+    useACMEHost = "tlater.net";
+    enableHSTS = true;
+
+    root = "/srv/minecraft";
+  };
+}

configuration/sops.nix

@@ -1,18 +1,11 @@
-{ config, lib, ... }:
 {
   sops = {
     defaultSopsFile = ../keys/production.yaml;
 
     secrets = {
-      "battery-manager/email" = lib.mkIf config.services.batteryManager.enable {
-        owner = "battery-manager";
-        group = "battery-manager";
-      };
+      "battery-manager/email" = { };
 
-      "battery-manager/password" = lib.mkIf config.services.batteryManager.enable {
-        owner = "battery-manager";
-        group = "battery-manager";
-      };
+      "battery-manager/password" = { };
 
       # Gitea
       "forgejo/metrics-token" = {

flake.nix

@@ -23,11 +23,9 @@
     };
 
     sonnenshift = {
-      url = "git+ssh://git@github.com/sonnenshift/battery-manager";
+      url = "git+ssh://git@github.com/sonnenshift/battery-manager?ref=tlater/rust-rewrite";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    nixpkgs-crowdsec.url = "github:tlater/nixpkgs/tlater/fix-crowdsec";
   };
 
   outputs =
@@ -106,7 +104,6 @@
         in
         {
           default = vm.config.system.build.vm;
-          crowdsec = pkgs.callPackage "${inputs.nixpkgs-crowdsec}/pkgs/by-name/cr/crowdsec/package.nix" { };
           crowdsec-hub = localPkgs.crowdsec.hub;
           crowdsec-firewall-bouncer = localPkgs.crowdsec.firewall-bouncer;
         };

modules/crowdsec/default.nix

@@ -1,5 +1,4 @@
 {
-  flake-inputs,
   pkgs,
   lib,
   config,
@@ -9,8 +8,6 @@ let
   cfg = config.security.crowdsec;
   settingsFormat = pkgs.formats.yaml { };
 
-  crowdsec = flake-inputs.self.packages.${pkgs.system}.crowdsec;
-
   hub = pkgs.fetchFromGitHub {
     owner = "crowdsecurity";
     repo = "hub";
@@ -19,14 +16,14 @@ let
   };
 
   cscli = pkgs.writeShellScriptBin "cscli" ''
-    export PATH="$PATH:${crowdsec}/bin/"
+    export PATH="$PATH:${cfg.package}/bin/"
 
     sudo=exec
     if [ "$USER" != "crowdsec" ]; then
         sudo='exec /run/wrappers/bin/sudo -u crowdsec'
     fi
 
-    $sudo ${crowdsec}/bin/cscli "$@"
+    $sudo ${cfg.package}/bin/cscli "$@"
   '';
 
   acquisitions = ''
@@ -53,7 +50,7 @@ in
 
       package = lib.mkOption {
         type = package;
-        default = crowdsec;
+        default = pkgs.crowdsec;
       };
 
       stateDirectory = lib.mkOption {

pkgs/crowdsec/_sources/generated.json

@@ -21,7 +21,7 @@
     },
     "crowdsec-hub": {
         "cargoLocks": null,
-        "date": "2025-01-30",
+        "date": "2025-02-16",
         "extract": null,
         "name": "crowdsec-hub",
         "passthru": null,
@@ -33,10 +33,10 @@
             "name": null,
             "owner": "crowdsecurity",
             "repo": "hub",
-            "rev": "8f102f5ac79af59d3024ca2771b65ec87411ac02",
-            "sha256": "sha256-8K1HkBg0++Au1dr2KMrl9b2ruqXdo+vqWngOCwL11Mo=",
+            "rev": "f7d7f476f88a4af05e1cfb3994536990adecfb57",
+            "sha256": "sha256-m78uipryHDKixJzrF4K59ioAJ3WJN1JlXEC0DNVMCJ8=",
             "type": "github"
         },
-        "version": "8f102f5ac79af59d3024ca2771b65ec87411ac02"
+        "version": "f7d7f476f88a4af05e1cfb3994536990adecfb57"
     }
 }

pkgs/crowdsec/_sources/generated.nix

@@ -14,14 +14,14 @@
   };
   crowdsec-hub = {
     pname = "crowdsec-hub";
-    version = "8f102f5ac79af59d3024ca2771b65ec87411ac02";
+    version = "f7d7f476f88a4af05e1cfb3994536990adecfb57";
     src = fetchFromGitHub {
       owner = "crowdsecurity";
       repo = "hub";
-      rev = "8f102f5ac79af59d3024ca2771b65ec87411ac02";
+      rev = "f7d7f476f88a4af05e1cfb3994536990adecfb57";
       fetchSubmodules = false;
-      sha256 = "sha256-8K1HkBg0++Au1dr2KMrl9b2ruqXdo+vqWngOCwL11Mo=";
+      sha256 = "sha256-m78uipryHDKixJzrF4K59ioAJ3WJN1JlXEC0DNVMCJ8=";
     };
-    date = "2025-01-30";
+    date = "2025-02-16";
   };
 }