From 89f9196ef0405d2b82a8330a4e00f45c5a8b7e28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tristan=20Dani=C3=ABl=20Maat?= <tm@tlater.net> Date: Fri, 4 Apr 2025 21:35:24 +0800 Subject: [PATCH 1/2] fix(victorialogs): Use new upstream module --- .../services/metrics/victorialogs.nix | 100 +++--------------- 1 file changed, 12 insertions(+), 88 deletions(-) diff --git a/configuration/services/metrics/victorialogs.nix b/configuration/services/metrics/victorialogs.nix index ed74c59..ae47c39 100644 --- a/configuration/services/metrics/victorialogs.nix +++ b/configuration/services/metrics/victorialogs.nix @@ -1,37 +1,26 @@ { config, - pkgs, lib, ... }: let cfg = config.services.victorialogs; - pkg = pkgs.victoriametrics; - dirname = "victorialogs"; in { - options.services.victorialogs = - let - inherit (lib.types) str; - in - { - listenAddress = lib.mkOption { - default = ":9428"; - type = str; - }; - - bindAddress = lib.mkOption { - readOnly = true; - type = str; - description = '' - Final address on which victorialogs listens. - ''; - }; - }; + options.services.victorialogs.bindAddress = lib.mkOption { + readOnly = true; + type = lib.types.str; + description = '' + Final address on which victorialogs listens. + ''; + }; config = { - services.victorialogs.bindAddress = - (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress; + services.victorialogs = { + enable = true; + bindAddress = + (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress; + }; services.journald.upload = { enable = true; @@ -40,71 +29,6 @@ in NetworkTimeoutSec = "20s"; }; }; - systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ]; - - systemd.services.victorialogs = { - description = "VictoriaLogs log database"; - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - startLimitBurst = 5; - - serviceConfig = { - ExecStart = lib.escapeShellArgs [ - "${pkg}/bin/victoria-logs" - "-storageDataPath=/var/lib/${dirname}" - "-httpListenAddr=${cfg.listenAddress}" - ]; - - DynamicUser = true; - RestartSec = 1; - Restart = "on-failure"; - RuntimeDirectory = dirname; - RuntimeDirectoryMode = "0700"; - StateDirectory = dirname; - StateDirectoryMode = "0700"; - - LimitNOFILE = 1048576; - - # Hardening - DeviceAllow = [ "/dev/null rw" ]; - DevicePolicy = "strict"; - LockPersonality = true; - MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - PrivateDevices = true; - PrivateTmp = true; - PrivateUsers = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - ProtectSystem = "full"; - RemoveIPC = true; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_UNIX" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service" - "~@privileged" - ]; - }; - - postStart = lib.mkBefore '' - until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${cfg.bindAddress}/ping; do - sleep 1; - done - ''; - }; }; } From 956c5bd258c58121ac44a454740cdfb3cec78646 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tristan=20Dani=C3=ABl=20Maat?= <tm@tlater.net> Date: Thu, 7 Nov 2024 20:26:43 +0100 Subject: [PATCH 2/2] WIP: feat: Add minecraft server --- configuration/default.nix | 6 +- configuration/services/minecraft.nix | 83 ++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+), 5 deletions(-) create mode 100644 configuration/services/minecraft.nix diff --git a/configuration/default.nix b/configuration/default.nix index 239f9f6..f874733 100644 --- a/configuration/default.nix +++ b/configuration/default.nix @@ -22,6 +22,7 @@ ./services/foundryvtt.nix ./services/gitea.nix ./services/metrics + ./services/minecraft.nix ./services/nextcloud.nix ./services/webserver.nix ./services/wireguard.nix @@ -70,8 +71,6 @@ 8448 # starbound 21025 - # Minecraft - 25565 config.services.coturn.listening-port config.services.coturn.tls-listening-port @@ -80,9 +79,6 @@ ]; allowedUDPPorts = [ - # More minecraft - 25565 - config.services.coturn.listening-port config.services.coturn.tls-listening-port config.services.coturn.alt-listening-port diff --git a/configuration/services/minecraft.nix b/configuration/services/minecraft.nix new file mode 100644 index 0000000..0477f44 --- /dev/null +++ b/configuration/services/minecraft.nix @@ -0,0 +1,83 @@ +{ + pkgs, + lib, + config, + ... +}: +{ + services.minecraft-server = { + enable = true; + eula = true; + # jvmOpts are set using a file for forge + # jvmOpts = "-Xmx8G -Xms8G"; + openFirewall = true; + + declarative = true; + + whitelist = { + tlater = "140d177a-966f-41b8-a4c0-e305babd291b"; + romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c"; + lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4"; + }; + + serverProperties = { + allow-flight = true; + difficulty = "hard"; + motd = "tlater.net"; + spawn-protection = 1; + white-list = true; + enable-query = true; + enable-status = true; + + # Allows the server to write chunks without hogging the main + # thread... + sync-chunk-writes = false; + # Disables chat reporting, because we don't need any of that + # drama on a lil' friends-only server. + enforce-secure-profile = false; + }; + + package = pkgs.writeShellApplication { + name = "minecraft-server"; + runtimeInputs = with pkgs; [ jdk17_headless ]; + + text = '' + exec /var/lib/minecraft/run.sh $@ + ''; + }; + }; + + systemd.services.minecraft-server = { + path = with pkgs; [ jdk17_headless ]; + + # Since we read from our own HTTP server, we need to wait for it + # to be up + after = [ "nginx.service" ]; + + serviceConfig = { + # Use packwiz to install mods + ExecStartPre = [ + "${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'" + ]; + # Forge requires some bonus JVM options, which they include in a + # little `run.sh` script + ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui"; + }; + }; + + systemd.tmpfiles.settings."10-minecraft" = { + "/srv/minecraft".d = { + user = "nginx"; + group = "minecraft"; + mode = "0775"; + }; + }; + + services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = { + forceSSL = true; + useACMEHost = "tlater.net"; + enableHSTS = true; + + root = "/srv/minecraft"; + }; +}