From dee44464b46abd5f722e1575dfdf264c3ee61763 Mon Sep 17 00:00:00 2001 From: Gabriel Fontes Date: Sat, 7 Jan 2023 19:34:43 -0300 Subject: [PATCH] hosts/minecraft: couple of changes - add sql - add secret management - use packaged jars - re-add limboapi and limboauth --- flake.lock | 6 +- hosts/electra/secrets.yaml | 5 +- .../minecraft/cfgs/limboauth-strings.nix | 69 ++++++++++ hosts/electra/services/minecraft/default.nix | 121 ++++++++---------- hosts/electra/services/minecraft/lib.nix | 4 +- 5 files changed, 131 insertions(+), 74 deletions(-) create mode 100644 hosts/electra/services/minecraft/cfgs/limboauth-strings.nix diff --git a/flake.lock b/flake.lock index 813616a5..d0268d9c 100644 --- a/flake.lock +++ b/flake.lock @@ -233,11 +233,11 @@ ] }, "locked": { - "lastModified": 1672898703, - "narHash": "sha256-UV4gQGUUbUSGy+CsZthEGpWuveFJpvY3CnvjPBVzg1E=", + "lastModified": 1673124136, + "narHash": "sha256-rl/R9+7vwIk8DOFM1BcsV9XAx4J5MbpODtRp4JuEJU4=", "owner": "misterio77", "repo": "nix-minecraft", - "rev": "357437985626a62388493de3d72c4936c1ff5409", + "rev": "a341c473fbf69b07f7760e33f82156bd63bca1fd", "type": "github" }, "original": { diff --git a/hosts/electra/secrets.yaml b/hosts/electra/secrets.yaml index b3954b56..6720b8ce 100644 --- a/hosts/electra/secrets.yaml +++ b/hosts/electra/secrets.yaml @@ -5,6 +5,7 @@ cache-sig-key: ENC[AES256_GCM,data:IJwl7sY+Re5xftv1a/l3JE2jFqzQS3uLs/BgZANnYm/GK nix-ssh-key: ENC[AES256_GCM,data:+M/XgoSoUrpeHueazyxF7BUYLBiTHnyVyPI1WxXtsrwODj+XAWshgP9H7PGT6BvXAAoh3h2Jz3pUfbs+mlSJuX2Ht0f6Tt3EllE0V1xXgu0k2T2rCuHr9aD9j3nUmL0iVTaoIAbaYWCyGZdAPB/C0uO0P9CLkD30xisuMcS9s5NUtP4KNQAsMeTPZ/BJMMLdC68BjO7eFMGM64BbxEHRTzn6AdPnQjG8eTsmnzNXVB6zMdM47lAfSBdNgAu58XHo1uYHBGqGaSc2n60MeCxCKyYD7FXKp1U7NO9jUn8PcUQN9MEd54T+C7AXp8ADBChjgV8Tlj3Ea8yRD1OCuY8rJhp8/4qk3IDI3uHUV/LZRpDwrnYvo+fJZFjJoydBc8tbzNGSid1FEYrDM4US2wstmtaTReLnnVZnaBfegB6/aUQukkj9LwjVodtyRS85lrXNImeuFK4DwVE3+HAa3YEQqxkrtismBJbRMzzI3gqN4lRSIYOIbIdRm0QJTP6Dg2v9JjS5HjD+ATrIMUwl1Gsp88N4AaceqQUTIYgn,iv:WTLN2PVijg4XgDkWl0eKWEcqp/tCXLYSimMhLC9PhBQ=,tag:KvF633XPCOsqcJGsPdThPA==,type:str] yrmos-secrets: ENC[AES256_GCM,data:x46iqp4sCltYRL81fldP1M+OdFJPbBm8+Th+L69n7JI9yP7RE5Sh47yDNjsemyh1XTvZHB/3sYtRcBeTRXCnicxxYlAwfUD94pvslPklAdc6Xbv4Eb45q/DeV/GVYf9hvrtUB9VeVfIRSg==,iv:vGDt4jUV3UDFEH610k7C7Ue2i/PKCXWglzMPSufVe/g=,tag:jtxbEe8iMd4lFNo4fYhM6g==,type:str] velocity-forwarding-secret: ENC[AES256_GCM,data:kS+Hu8sRVvXXzyQ0,iv:Vn3ST+y4rJAbtDlGPLxm1rKj91LVaxDTtflUrtoy16Q=,tag:xNCVz1lAN+7nog71KF9haQ==,type:str] +minecraft-secrets: ENC[AES256_GCM,data:tdU1isjHFthnfHyeeEk81kfXKRDXqZkxAIi0NaKeJkgJDSsXFlSTOQ==,iv:J2/NWqHeQ49gcXEk9/6byIl5QvlHJXYBw0jW0v4tJ+E=,tag:Y99gUx7lviHPhVp3OKYJqA==,type:str] sops: kms: [] gcp_kms: [] @@ -20,8 +21,8 @@ sops: VXNWcDcwTGVUL2pNTzgrMit0UkN0c0UKWY6XqH0WgJfzwbX4mO3OBIDEcsSktZyq TRqZuGF/6/4o1D0F2wQBpoB7Wja2FLnsrJP060EpX0K870AK3zfWgw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-01-02T16:22:45Z" - mac: ENC[AES256_GCM,data:x++IjmUn7DuT1q6D5t6WGpxta+Dl2MUxOvh+iQYV2OlSnTGP6Vtj0AwgLaf1CNRuh6hORK1pDkXpXv+LzD2ejiB51W0gBHZLEtuWvvWcoV3ldrf2AsBsc3QgAz+h7HL+WcGm9P5lxBHrdh9TXoq24ESirCsUZMlBqpEqjIPEWoM=,iv:NEasck0jBLtMImSyiRH8KGrxeJdIEjyvDHImYHOzOG4=,tag:1RKOumpQ3TBCrsghcUe/Fg==,type:str] + lastmodified: "2023-01-07T22:31:02Z" + mac: ENC[AES256_GCM,data:yXiDCLrSd8pZY9M/XakrE4Vuzqu3Sv2lENclFI4HOEiZ1l5Yo9Jxa1rHIlr1ksm8AkUVO7zfKjCfaZU8rrNWMUwYDlA4Pole9nlLYnISqAvkDriAyXKVck0p1K6eHJMiDpZcJGHZKAeslMofhRuQZh77g9McM/pREb7LQspIFaw=,iv:N+5WbQm/393aJng804PcqiepmsG4MhcVt7xbnzV3FPU=,tag:cu8Cx3LC5QrtncVdSH2UFw==,type:str] pgp: - created_at: "2022-08-18T23:29:03Z" enc: |- diff --git a/hosts/electra/services/minecraft/cfgs/limboauth-strings.nix b/hosts/electra/services/minecraft/cfgs/limboauth-strings.nix new file mode 100644 index 00000000..c4ff773a --- /dev/null +++ b/hosts/electra/services/minecraft/cfgs/limboauth-strings.nix @@ -0,0 +1,69 @@ +{ + reload = "&aRecarregado com sucesso."; + error-occurred = "&cUm erro interno ocorreu."; + database-error-kick = "&cUm erro de base de dados ocorreu."; + not-player = "&cO console não pode executar esse comando."; + not-registered = "&cVocê não esta registrado ou tem uma conta paga."; + cracked-command = "{NL}&aVocê não pode usar este comando, pois tem uma conta paga."; + wrong-password = "&cSenha incorreta."; + nickname-invalid-kick = "{NL}&cSeu nome possui caracteres inválidos. Retire-os, por favor!."; + reconnect-kick = "{NL}&cReconecte para verificar sua conta."; + ip-limit-kick = "{NL}{NL}&cSeu IP chegou ao máximo de registros."; + wrong-nickname-case-kick = "{NL}&cVocẽ deve entrar usando o nickname &6{0}&c ao invés de &6{1}&c."; + bossbar = "Você tem &6{0} &fsegundos para fazer login."; + times-up = "{NL}&cVocê demorou muito para fazer login."; + login-premium = "&2Conta original autenticada automaticamente."; + login-premium-title = ""; + login-premium-subtitle = ""; + login-floodgate = "&2Conta original autenticada automaticamente."; + login-floodgate-title = ""; + login-floodgate-subtitle = ""; + login = "&aPor favor, faça login usando &6/login &a, você tem &6{0} &atentativas."; + login-wrong-password = "&cSenha incorreta, você tem mais &6{0} &ctentativas."; + login-wrong-password-kick = "{NL}&cVocê errou a senha muitas vezes, tente novamente."; + login-successful = "&aAutenticado com sucesso."; + login-title = ""; + login-subtitle = ""; + login-successful-title = ""; + login-successful-subtitle = ""; + register = "Por favor, registre sua conta usando &6/register "; + register-different-passwords = "&cAs senhas inseridas não batem."; + register-password-too-short = "&cEssa senha é muito curta, tente uma maior."; + register-password-too-long = "&cEssa senha é muito longa, tente uma menor."; + register-password-unsafe = "&cEssa senha é muito fácil, tente outra."; + register-successful = "&aRegistrado com sucesso."; + register-title = ""; + register-subtitle = ""; + register-successful-title = ""; + register-successful-subtitle = ""; + unregister-successful = "{NL}&aDesregistrado com sucesso."; + unregister-usage = "Usagem: &6/unregister confirm"; + premium-successful = "{NL}&aConta marcada como &6original&a."; + already-premium = "&cSua conta já está marcada como &6original&c."; + not-premium = "&cSua conta não é &6original&c."; + premium-usage = "Usagem: &6/premium confirm"; + event-cancelled = "Evento de autorização cancelado"; + force-unregister-successful = "&6{0} &aderesgistrado."; + force-unregister-kick = "{NL}&aVocê foi desregistrado pelo admin."; + force-unregister-not-successful = "&cNão foi possível desregistrar &6{0}&c."; + force-unregister-usage = "Usagem: &6/forceunregister "; + registrations-disabled-kick = "Registros estão desabilitados no momento."; + change-password-successful = "&aSenha alterada com sucesso."; + change-password-usage = "Usagem: &6/changepassword "; + force-change-password-successful = "&aSenha de &6{0}&a alterada com sucesso."; + force-change-password-message = "&aSua senha foi alterada para &6{0} &apelo admin."; + force-change-password-not-successful = "&cNão foi possível alterar a senha de &6{0}&c."; + force-change-password-usage = "Usagem: &6/forcechangepassword "; + totp = "Por favor, digita seu código 2FA usando &6/2fa "; + totp-title = ""; + totp-subtitle = ""; + totp-successful = "&a2FA habilitado com sucesso."; + totp-disabled = "&a2FA desabilitado com sucesso."; + totp-usage = "Usagem: &6/2fa enable &f ou &6/2fa disable &f."; + totp-wrong = "&cChave 2FA incorreta!"; + totp-already-enabled = "&c2FA já está habilitado. Você pode desabilitar com &6/2fa disable &c."; + totp-qr = "Clique aqui para abrir o QR Code em seu navegador."; + totp-token = "&aSeu token 2FA &7(clique para copiar)&a: &6{0}"; + totp-recovery = "&aSeus códigos de recuperação&7(clique para copiar)&a: &6{0}"; + destroy-session-successful = "&eSessão removida. Você terá que logar novamente ao reconectar."; +} diff --git a/hosts/electra/services/minecraft/default.nix b/hosts/electra/services/minecraft/default.nix index afb2486c..695b583d 100644 --- a/hosts/electra/services/minecraft/default.nix +++ b/hosts/electra/services/minecraft/default.nix @@ -1,15 +1,7 @@ { inputs, pkgs, outputs, config, lib, ... }: let lib' = import ./lib.nix { inherit pkgs; }; - papermc = lib'.mkMCServer rec { - pname = "papermc"; - version = "1.19.3-367"; - url = "https://api.papermc.io/v2/projects/paper/versions/1.19.3/builds/367/downloads/paper-1.19.3-367.jar"; - sha256 = "sha256-8OhbQFoLsuJJK38a1PEAdwJIZUSEw3l6jTs/5w4EHko="; - }; - # FIXME: Using sops secrets would be the way to go, but not all configs support a "file" secret - # Maybe some way to replace secret strings in nix-minecraft managed files? - velocityForwardingSecret = "PI5rWuj39WTA"; + minecraftPkgs = inputs.nix-minecraft.packages.${pkgs.system}; in { imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ]; @@ -19,24 +11,32 @@ in allowedUDPPorts = [ 25565 19132 ]; }; + services.mysql = { + enable = true; + package = pkgs.mariadb; + ensureDatabases = [ "minecraft" ]; + ensureUsers = [{ + name = "minecraft"; + ensurePermissions = { + "minecraft.*" = "ALL PRIVILEGES"; + }; + }]; + }; + + sops.secrets.minecraft-secrets = { + owner = "minecraft"; + group = "minecraft"; + sopsFile = ../../secrets.yaml; + }; + services.minecraft-servers = { enable = true; eula = true; + environmentFile = config.sops.secrets.minecraft-secrets.path; servers = { - proxy = { enable = true; - package = - let - ver = "3.1.2-SNAPSHOT"; - build = "207"; - in - lib'.mkMCServer { - pname = "velocity"; - version = "${ver}-${build}"; - url = "https://api.papermc.io/v2/projects/velocity/versions/${ver}/builds/${build}/downloads/velocity-${ver}-${build}.jar"; - sha256 = "sha256-gjOTQFQTQT2uH3yDyJhR2+dDnnGcwxeToVuarZUaQxU="; - }; + package = minecraftPkgs.velocity-server; # Latest build jvmOpts = lib'.proxyFlags "512M"; files = { "velocity.toml" = lib'.toTOMLFile { @@ -44,12 +44,12 @@ in bind = "0.0.0.0:25565"; motd = "Server do Misterinho"; player-info-forwarding-mode = "modern"; - forwarding-secret-file = builtins.toFile "secret" velocityForwardingSecret; + forwarding-secret-file = ""; + forwarding-secret = "@VELOCITY_FORWARDING_SECRET@"; online-mode = true; servers = { - limbo = "localhost:25560"; survival = "localhost:25561"; - try = [ "survival" "limbo" ]; + try = [ "survival" ]; }; forced-hosts = { }; query = { @@ -64,6 +64,24 @@ in allow-third-party-capes = true; auth-type = "floodgate"; }; + "plugins/limboapi/config.yml" = lib'.toYAMLFile { + prefix = "Limbo"; + main.check-for-updates = false; + }; + "plugins/limboauth/config.yml" = lib'.toYAMLFile { + prefix = "Auth"; + main = { + auth-time = 0; + enable-bossbar = false; + online-mode-need-auth = false; + floodgate-need-auth = false; + save-premium-accounts = false; + enable-totp = false; + register-need-repeat-password = false; + strings = import ./cfgs/limboauth-strings.nix; + }; + database.storage-type = "sqlite"; + }; }; symlinks = { "plugins/Geyser.jar" = pkgs.fetchurl rec { @@ -78,55 +96,24 @@ in url = "https://ci.opencollab.dev/job/GeyserMC/job/${pname}/job/master/${version}/artifact/velocity/build/libs/${lib.toLower pname}-velocity.jar"; sha256 = "sha256-yFVVtyqhtSRt/r+i0uSu9HleDmAp+xwAAdWmV4W8umU="; }; - }; - }; - - limbo = { - enable = true; - package = lib'.mkMCServer rec { - pname = "nano-limbo"; - version = "1.5"; - url = "https://github.com/Nan1t/NanoLimbo/releases/download/v${version}/NanoLimbo-${version}-all.jar"; - sha256 = "sha256-0zPQNfUEgK0zIdLEUjTGw2N+Nbe8byZfqrkPYBR888Q="; - }; - jvmOpts = ""; - files."settings.yml" = lib'.toYAMLFile { - bind.port = 25560; - maxPlayers = -1; - ping = { - description = "Limbo"; - version = "1.5"; + "plugins/LimboAPI.jar" = pkgs.fetchurl rec { + pname = "LimboAPI"; + version = "1.0.8"; + url = "https://github.com/Elytrium/${pname}/releases/download/1.0.8/${pname}-plugin-${version}-jdk17.jar"; + sha256 = "sha256-qGBBHSEGdUXLDQkCBKn5N28/9Zlazu8/fYrAIvlb0EA="; }; - dimension = "THE_END"; - playerList = { - enable = false; - username = "NanoLimbo"; - }; - headerAndFooter.enable = false; - gameMode = 0; - brandName.enable = false; - joinMessage.enable = false; - bossBar.enable = false; - title.enable = false; - infoForwarding = { - type = "MODERN"; - secret = velocityForwardingSecret; - }; - readTimeout = 30000; - debugLevel = 2; - netty = { - useEpoll = true; - threads = { - bossGroup = 1; - workerGroup = 4; - }; + "plugins/LimboAuth.jar" = pkgs.fetchurl rec { + pname = "LimboAuth"; + version = "1.0.8"; + url = "https://github.com/Elytrium/${pname}/releases/download/1.0.8/${pname}-${version}-jdk17.jar"; + sha256 = "sha256-S1u7QHF0n6EhGq++VF7BlbaJ4Y8xpQWR2BuGQBeW+r8="; }; }; }; survival = { enable = true; - package = papermc; + package = minecraftPkgs.paperServers.paper-1_19_3; # Latest 1.19.3 build jvmOpts = lib'.aikarFlags "1G"; serverProperties = { server-port = 25561; @@ -137,7 +124,7 @@ in proxies.velocity = { enabled = true; online-mode = false; - secret = velocityForwardingSecret; + secret = "@VELOCITY_FORWARDING_SECRET@"; }; }; "bukkit.yml" = lib'.toYAMLFile { diff --git a/hosts/electra/services/minecraft/lib.nix b/hosts/electra/services/minecraft/lib.nix index 560ec6ca..51fbde73 100644 --- a/hosts/electra/services/minecraft/lib.nix +++ b/hosts/electra/services/minecraft/lib.nix @@ -22,11 +22,11 @@ rec { installPhase = '' mkdir -p $out/bin $out/lib/minecraft cp -v $src $out/lib/minecraft/server.jar - cat > $out/bin/minecraft-server << EOF + cat > $out/bin/${pname} << EOF #!/bin/sh exec ${pkgs.jre_headless}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui EOF - chmod +x $out/bin/minecraft-server + chmod +x $out/bin/${pname} ''; };