chore(minecraft): rename new server

2026-02-09 12:29:19 -08:00 · 2024-09-21 16:27:12 -07:00 · 2024-09-21 16:27:12 -07:00 · 22c02adb41
commit 22c02adb41
parent e1382c7e6d
9 changed files with 64 additions and 37 deletions
--- a/modules/nixos/minecraft/java.nix
+++ b/modules/nixos/minecraft/java.nix
@ -0,0 +1,172 @@
+{
+  config,
+  gensokyo-zone,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (gensokyo-zone.lib) mapOptionDefaults;
+  inherit (lib.options) mkOption mkEnableOption mkPackageOption;
+  inherit (lib.modules) mkIf mkMerge mkAfter mkOptionDefault;
+  inherit (lib.strings) escapeShellArgs;
+  inherit (lib.meta) getExe;
+  inherit (config.lib.minecraft) mkAllowPlayerType writeWhiteList writeOps;
+  cfg = config.services.minecraft-java-server;
+in {
+  options.services.minecraft-java-server = with lib.types; {
+    enable = mkEnableOption "minecraft java edition server";
+
+    openFirewall = mkOption {
+      type = bool;
+      default = false;
+    };
+    port = mkOption {
+      type = port;
+      default = 25565;
+    };
+
+    jre.package = mkPackageOption pkgs "jre" {};
+
+    dataDir = mkOption {
+      type = path;
+      default = "/var/lib/minecraft-java";
+      description = ''
+        Directory to store Minecraft database and other state/data files.
+      '';
+    };
+
+    argsFiles = mkOption {
+      type = listOf str;
+      default = ["user_jvm_args.txt"];
+    };
+
+    jvmOpts = mkOption {
+      type = listOf str;
+      default = [];
+      example = ["-Xmx4G"];
+    };
+
+    user = mkOption {
+      type = str;
+      default = "minecraft-bedrock";
+    };
+    group = mkOption {
+      type = str;
+      default = cfg.user;
+    };
+
+    serverProperties = mkOption {
+      type = attrsOf (oneOf [bool int str float]);
+    };
+
+    allowPlayers = mkOption {
+      type = nullOr (attrsOf (mkAllowPlayerType {}));
+      default = null;
+    };
+  };
+
+  config = let
+    confService.services.minecraft-java-server = {
+      serverProperties = mapOptionDefaults {
+      };
+    };
+    conf.users = mkIf (cfg.user == "minecraft-bedrock") {
+      users.${cfg.user} = {
+        inherit (cfg) group;
+        description = "Minecraft server service user";
+        home = cfg.dataDir;
+        createHome = true;
+        isSystemUser = true;
+      };
+      groups.${cfg.group} = {};
+    };
+
+    conf.systemd.services.minecraft-java-server = let
+      execStartArgs =
+        map (argsFile: "@${argsFile}") cfg.argsFiles
+        ++ cfg.jvmOpts;
+      execStop = pkgs.writeShellScriptBin "minecraft-java-stop" ''
+        echo /stop > ${config.systemd.sockets.minecraft-java-server.socketConfig.ListenFIFO}
+
+        # Wait for the PID of the minecraft server to disappear before
+        # returning, so systemd doesn't attempt to SIGKILL it.
+        while kill -0 "$1" 2> /dev/null; do
+          sleep 1s
+        done
+      '';
+    in {
+      description = "Minecraft Kat Kitchen Server";
+      wantedBy = ["multi-user.target"];
+      requires = ["minecraft-java-server.socket"];
+      after = ["network.target" "minecraft-java-server.socket"];
+
+      restartTriggers = [
+        cfg.dataDir
+        cfg.jvmOpts
+        cfg.argsFiles
+      ];
+
+      path = [cfg.jre.package];
+      script = mkAfter ''
+        exec java ${escapeShellArgs execStartArgs}
+      '';
+
+      serviceConfig = {
+        BindReadOnlyPaths = mkIf (cfg.allowPlayers != null) [
+          "${writeWhiteList cfg.allowPlayers}:${cfg.dataDir}/whitelist.json"
+          "${writeOps cfg.allowPlayers}:${cfg.dataDir}/ops.json"
+        ];
+        ExecStop = "${getExe execStop} $MAINPID";
+        Restart = "always";
+        User = cfg.user;
+        WorkingDirectory = cfg.dataDir;
+        RuntimeDirectory = "minecraft-java";
+
+        StandardInput = "socket";
+        StandardOutput = "journal";
+        StandardError = "journal";
+
+        # Hardening
+        CapabilityBoundingSet = [""];
+        DeviceAllow = [""];
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+    };
+    conf.systemd.sockets.minecraft-java-server = {
+      bindsTo = ["minecraft-java-server.service"];
+      socketConfig = {
+        ListenFIFO = "/run/minecraft-java/stdin";
+        SocketMode = "0660";
+        SocketUser = mkOptionDefault cfg.user;
+        SocketGroup = mkOptionDefault cfg.group;
+        RemoveOnStop = true;
+        FlushPending = true;
+      };
+    };
+
+    conf.networking.firewall = mkIf cfg.openFirewall {
+      allowedUDPPorts = cfg.port;
+    };
+  in
+    mkMerge [
+      confService
+      (mkIf cfg.enable conf)
+    ];
+}