WIP: feat: Add minecraft server

configuration/default.nix

@@ -19,8 +19,8 @@
     ./services/crowdsec.nix
     ./services/foundryvtt.nix
     ./services/gitea.nix
-    ./services/immich.nix
     ./services/metrics
+    ./services/minecraft.nix
     ./services/nextcloud.nix
     ./services/webserver.nix
     ./services/wireguard.nix
@@ -63,8 +63,6 @@
         8448
         # starbound
         21025
-        # Minecraft
-        25565
 
         config.services.coturn.listening-port
         config.services.coturn.tls-listening-port
@@ -73,9 +71,6 @@
       ];
 
       allowedUDPPorts = [
-        # More minecraft
-        25565
-
         config.services.coturn.listening-port
         config.services.coturn.tls-listening-port
         config.services.coturn.alt-listening-port

configuration/services/conduit/default.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  flake-inputs,
   config,
   lib,
   ...
@@ -20,7 +21,7 @@ in
   services = {
     matrix-conduit = {
       enable = true;
-      package = pkgs.matrix-continuwuity;
+      package = flake-inputs.continuwuity.packages.${pkgs.system}.default;
       settings.global = {
         address = "127.0.0.1";
         server_name = domain;

configuration/services/conduit/matrix-hookshot.nix

@@ -29,29 +29,16 @@ let
     };
 
     # Encryption support
-    # TODO(tlater): Enable when
+    extraSettings = {
-    # https://github.com/matrix-org/matrix-hookshot/issues/1060 is
+      "de.sorunome.msc2409.push_ephemeral" = true;
-    # fixed
+      push_ephemeral = true;
-    # extraSettings = {
+      "org.matrix.msc3202" = true;
-    #   "de.sorunome.msc2409.push_ephemeral" = true;
+    };
-    #   push_ephemeral = true;
-    #   "org.matrix.msc3202" = true;
-    # };
 
     runtimeRegistration = "${cfg.registrationFile}";
   };
 in
 {
-  # users = {
-  #   users.matrix-hookshot = {
-  #     home = "/run/matrix-hookshot";
-  #     group = "matrix-hookshot";
-  #     isSystemUser = true;
-  #   };
-
-  #   groups.matrix-hookshot = { };
-  # };
-
   systemd.services.matrix-hookshot = {
     serviceConfig = {
       Type = lib.mkForce "exec";
@@ -62,7 +49,6 @@ in
       # Some library in matrix-hookshot wants a home directory
       Environment = [ "HOME=/run/matrix-hookshot" ];
 
-      # User = "matrix-hookshot";
       DynamicUser = true;
       StateDirectory = "matrix-hookshot";
       RuntimeDirectory = "matrix-hookshot";
@@ -76,11 +62,7 @@ in
       ProtectKernelModules = true;
       ProtectKernelLogs = true;
       ProtectControlGroups = true;
-      RestrictAddressFamilies = [
+      RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
-        # "AF_UNIX"
-        "AF_INET"
-        "AF_INET6"
-      ];
       LockPersonality = true;
       RestrictRealtime = true;
       ProtectProc = "invisible";
@@ -89,11 +71,6 @@ in
     };
   };
 
-  # services.redis.servers.matrix-hookshot = {
-  #   enable = true;
-  #   user = "matrix-hookshot";
-  # };
-
   services.matrix-hookshot = {
     enable = true;
 
@@ -112,8 +89,6 @@ in
 
       bot.displayname = "Hookshot";
 
-      # cache.redisUri = "redis://${config.services.redis.servers.matrix-hookshot.unixSocket}";
-
       generic = {
         enabled = true;
         outbound = false;
@@ -123,10 +98,7 @@ in
         allowJsTransformationFunctions = true;
       };
 
-      # TODO(tlater): Enable when
+      encryption.storagePath = "/var/lib/matrix-hookshot/cryptostore";
-      # https://github.com/matrix-org/matrix-hookshot/issues/1060 is
-      # fixed
-      # encryption.storagePath = "/var/lib/matrix-hookshot/cryptostore";
 
       permissions = [
         {

configuration/services/foundryvtt.nix

@@ -18,7 +18,7 @@ in
       minifyStaticFiles = true;
       proxySSL = true;
       proxyPort = 443;
-      package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_13;
+      package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_11;
     };
 
     nginx.virtualHosts."${domain}" =

configuration/services/immich.nix

@@ -1,67 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  hostName = "immich.${config.services.nginx.domain}";
-in
-{
-  services = {
-    immich = {
-      enable = true;
-      settings.server.externalDomain = "https://${hostName}";
-
-      environment.IMMICH_TELEMETRY_INCLUDE = "all";
-    };
-
-    nginx.virtualHosts.${hostName} =
-      let
-        local = "http://${config.services.immich.host}:${toString config.services.immich.port}";
-      in
-      {
-        forceSSL = true;
-        useACMEHost = "tlater.net";
-        enableHSTS = true;
-
-        locations."/" = {
-          proxyPass = local;
-          proxyWebsockets = true;
-        };
-        locations."/metrics" = {
-          extraConfig = ''
-            access_log off;
-            allow 127.0.0.1;
-            ${lib.optionalString config.networking.enableIPv6 "allow ::1;"}
-            deny all;
-          '';
-        };
-      };
-
-    backups.immich =
-      let
-        db-dump = "${config.services.immich.mediaLocation}/immich-db.sql";
-      in
-      {
-        user = "immich";
-        paths = [ config.services.immich.mediaLocation ];
-
-        preparation = {
-          packages = [ config.services.postgresql.package ];
-          text = ''
-            pg_dump ${config.services.immich.database.name} --clean --if-exists --file=${db-dump}
-          '';
-        };
-
-        cleanup = {
-          packages = [ pkgs.coreutils ];
-          text = "rm ${db-dump}";
-        };
-        pauseServices = [
-          "immich-server.service"
-          "immich-machine-learning.service"
-        ];
-      };
-  };
-}

configuration/services/metrics/grafana.nix

@@ -1,4 +1,9 @@
-{ pkgs, config, ... }:
+{
+  pkgs,
+  config,
+  flake-inputs,
+  ...
+}:
 let
   domain = "metrics.${config.services.nginx.domain}";
 in
@@ -30,7 +35,7 @@ in
 
     declarativePlugins = [
       pkgs.grafanaPlugins.victoriametrics-metrics-datasource
-      pkgs.grafanaPlugins.victoriametrics-logs-datasource
+      flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.grafanaPlugins.victoriametrics-logs-datasource
     ];
 
     provision = {

configuration/services/metrics/victoriametrics.nix

@@ -84,11 +84,6 @@ in
         in
         [ "${address}:${toString port}" ];
 
-      immich.targets = [
-        "127.0.0.1:8081"
-        "127.0.0.1:8082"
-      ];
-
       # Configured in the hookshot listeners, but it's hard to filter
       # the correct values out of that config.
       matrixHookshot.targets = [ "127.0.0.1:9001" ];

configuration/services/minecraft.nix

@@ -0,0 +1,83 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  services.minecraft-server = {
+    enable = true;
+    eula = true;
+    # jvmOpts are set using a file for forge
+    # jvmOpts = "-Xmx8G -Xms8G";
+    openFirewall = true;
+
+    declarative = true;
+
+    whitelist = {
+      tlater = "140d177a-966f-41b8-a4c0-e305babd291b";
+      romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c";
+      lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4";
+    };
+
+    serverProperties = {
+      allow-flight = true;
+      difficulty = "hard";
+      motd = "tlater.net";
+      spawn-protection = 1;
+      white-list = true;
+      enable-query = true;
+      enable-status = true;
+
+      # Allows the server to write chunks without hogging the main
+      # thread...
+      sync-chunk-writes = false;
+      # Disables chat reporting, because we don't need any of that
+      # drama on a lil' friends-only server.
+      enforce-secure-profile = false;
+    };
+
+    package = pkgs.writeShellApplication {
+      name = "minecraft-server";
+      runtimeInputs = with pkgs; [ jdk17_headless ];
+
+      text = ''
+        exec /var/lib/minecraft/run.sh $@
+      '';
+    };
+  };
+
+  systemd.services.minecraft-server = {
+    path = with pkgs; [ jdk17_headless ];
+
+    # Since we read from our own HTTP server, we need to wait for it
+    # to be up
+    after = [ "nginx.service" ];
+
+    serviceConfig = {
+      # Use packwiz to install mods
+      ExecStartPre = [
+        "${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'"
+      ];
+      # Forge requires some bonus JVM options, which they include in a
+      # little `run.sh` script
+      ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui";
+    };
+  };
+
+  systemd.tmpfiles.settings."10-minecraft" = {
+    "/srv/minecraft".d = {
+      user = "nginx";
+      group = "minecraft";
+      mode = "0775";
+    };
+  };
+
+  services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = {
+    forceSSL = true;
+    useACMEHost = "tlater.net";
+    enableHSTS = true;
+
+    root = "/srv/minecraft";
+  };
+}

configuration/services/nextcloud.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  nextcloud = pkgs.nextcloud31;
+  nextcloud = pkgs.nextcloud30;
   hostName = "nextcloud.${config.services.nginx.domain}";
 in
 {
@@ -19,10 +19,10 @@ in
           packageOverrides = _: prev: {
             extensions = prev.extensions // {
               pgsql = prev.extensions.pgsql.overrideAttrs (_: {
-                configureFlags = [ "--with-pgsql=${lib.getDev config.services.postgresql.package.pg_config}" ];
+                configureFlags = [ "--with-pgsql=${lib.getDev config.services.postgresql.package}" ];
               });
               pdo_pgsql = prev.extensions.pdo_pgsql.overrideAttrs (_: {
-                configureFlags = [ "--with-pdo-pgsql=${lib.getDev config.services.postgresql.package.pg_config}" ];
+                configureFlags = [ "--with-pdo-pgsql=${lib.getDev config.services.postgresql.package}" ];
               });
             };
           };

flake.nix

@@ -2,7 +2,12 @@
   description = "tlater.net host configuration";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05-small";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11-small";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    continuwuity = {
+      url = "git+https://forgejo.ellis.link/continuwuation/continuwuity.git?ref=refs/tags/v0.5.0-rc.5";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";

modules/crowdsec/default.nix

@@ -247,7 +247,10 @@ in
             online_client = {
               # By default, we don't let crowdsec phone home, since
               # this is usually within NixOS users' concerns.
-              sharing = lib.mkDefault false;
+              #
+              # TODO: Enable when this option becomes available
+              # (1.6.4, current nixpkgs-unstable)
+              # sharing = lib.mkDefault false;
               credentials_path = cfg.centralApiCredentials;
             };
           };