.

TODO

@@ -1 +1,5 @@
 ci/cd to publish images
+forwarding secret (vault(?))
+
+make lobby a service and not a batch cause it needs to restart
+but that wouldn't work with the template...

images/lobby/Containerfile

@@ -0,0 +1,3 @@
+FROM git.lab0x13.site/scrow/papermc:0.2
+
+COPY ./world /data/world

images/lobby/Makefile

@@ -0,0 +1,3 @@
+include ../container.mk
+TAG := lobby
+VERSION := 0.2

images/lobby/world/uid.dat

@@ -0,0 +1 @@
+þ)˜õbÝMΚo%óò{EÏ

images/papermc/Containerfile

@@ -4,23 +4,25 @@ EXPOSE 25565
 ENV MINECRAFT_VERSION=26.2
 
 VOLUME /mnt
-COPY plugins /data/plugins
-COPY --chmod=755 entrypoint.sh /entrypoint.sh
-
 WORKDIR /data
 RUN apk add --no-cache curl jq
 RUN curl -s "https://fill.papermc.io/v3/projects/paper/versions/$MINECRAFT_VERSION/builds/latest" \
 	| jq -r '.downloads."server:default".url' \
 	| xargs curl -o server.jar
 
+RUN mkdir -p /data/plugins
 RUN wget -P /data/plugins \
-    https://git.lab0x13.site/api/packages/scrow/generic/core-bukkit/UNVERSIONED/CoreBukkit.jar \
     https://download.luckperms.net/1652/bukkit/loader/LuckPerms-Bukkit-5.5.65.jar \
     https://hangarcdn.papermc.io/plugins/ViaVersion/ViaVersion/versions/5.11.0/PAPER/ViaVersion-5.11.0.jar \
     https://hangarcdn.papermc.io/plugins/ViaVersion/ViaBackwards/versions/5.11.0/PAPER/ViaBackwards-5.11.0.jar
+COPY ./plugins/LuckPerms /data/plugins
+
+COPY --chmod=755 entrypoint.sh /entrypoint.sh
+COPY ./server.properties /data
+RUN mkdir -p /data/config
+COPY ./paper-global.yml /data/config
 
 RUN printf eula=true > eula.txt
 RUN java -jar server.jar --initSettings
-
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["java", "-jar", "server.jar", "--nogui"]

images/papermc/paper-global.yml

@@ -0,0 +1,148 @@
+# This is the global configuration file for Paper.
+# As you can see, there's a lot to configure. Some options may impact gameplay, so use
+# with caution, and make sure you know what each option does before configuring.
+# 
+# If you need help with the configuration or have any questions related to Paper,
+# join us in our Discord or check the docs page.
+# 
+# The world configuration options have been moved inside
+# their respective world folder. The files are named paper-world.yml
+# 
+# File Reference: https://docs.papermc.io/paper/reference/global-configuration/
+# Docs: https://docs.papermc.io/
+# Discord: https://discord.gg/papermc
+# Website: https://papermc.io/
+
+_version: 31
+anticheat:
+  obfuscation:
+    items:
+      all-models:
+        also-obfuscate: []
+        dont-obfuscate:
+        - minecraft:lodestone_tracker
+        sanitize-count: true
+      enable-item-obfuscation: false
+      model-overrides:
+        minecraft:elytra:
+          also-obfuscate: []
+          dont-obfuscate:
+          - minecraft:damage
+          sanitize-count: true
+block-updates:
+  disable-chorus-plant-updates: false
+  disable-mushroom-block-updates: false
+  disable-noteblock-updates: false
+  disable-tripwire-updates: false
+chunk-loading-advanced:
+  auto-config-send-distance: true
+  player-max-concurrent-chunk-generates: 0
+  player-max-concurrent-chunk-loads: 0
+chunk-loading-basic:
+  player-max-chunk-generate-rate: -1.0
+  player-max-chunk-load-rate: 100.0
+  player-max-chunk-send-rate: 75.0
+chunk-system:
+  io-threads: -1
+  worker-threads: -1
+collisions:
+  enable-player-collisions: true
+  send-full-pos-for-hard-colliding-entities: true
+commands:
+  ride-command-allow-player-as-vehicle: false
+  suggest-player-names-when-null-tab-completions: true
+console:
+  enable-brigadier-completions: true
+  enable-brigadier-highlighting: true
+  has-all-permissions: false
+item-validation:
+  book:
+    author: 8192
+    page: 16384
+    title: 8192
+  book-size:
+    page-max: 2560
+    total-multiplier: 0.98
+  display-name: 8192
+  lore-line: 8192
+  resolve-selectors-in-books: false
+messages:
+  kick:
+    authentication-servers-down: <lang:multiplayer.disconnect.authservers_down>
+    connection-throttle: Connection throttled! Please wait before reconnecting.
+    flying-player: <lang:multiplayer.disconnect.flying>
+    flying-vehicle: <lang:multiplayer.disconnect.flying>
+  no-permission: <red>I'm sorry, but you do not have permission to perform this command.
+    Please contact the server administrators if you believe that this is in error.
+  use-display-name-in-quit-message: false
+misc:
+  catchup-ticks: default
+  chat-threads:
+    chat-executor-core-size: -1
+    chat-executor-max-size: -1
+  client-interaction-leniency-distance: default
+  compression-level: default
+  enable-nether: true
+  fix-far-end-terrain-generation: true
+  load-permissions-yml-before-plugins: true
+  max-joins-per-tick: 5
+  max-tracking-combat-entries: 10240
+  prevent-negative-villager-demand: false
+  region-file-cache-size: 256
+  send-full-pos-for-item-entities: false
+  strict-advancement-dimension-check: false
+  use-alternative-luck-formula: false
+  use-dimension-type-for-custom-spawners: false
+  xp-orb-groups-per-area: default
+packet-limiter:
+  all-packets:
+    action: KICK
+    interval: 7.0
+    max-packet-rate: 500.0
+  kick-message: <red><lang:disconnect.exceeded_packet_rate>
+  overrides:
+    minecraft:place_recipe:
+      action: DROP
+      interval: 4.0
+      max-packet-rate: 5.0
+player-auto-save:
+  max-per-tick: -1
+  rate: -1
+proxies:
+  bungee-cord:
+    online-mode: true
+  proxy-protocol: false
+  velocity:
+    enabled: true
+    online-mode: true
+    secret: '1234'
+scoreboards:
+  save-empty-scoreboard-teams: true
+  track-plugin-scoreboards: false
+spam-limiter:
+  incoming-packet-threshold: 300
+  recipe-spam-increment: 1
+  recipe-spam-limit: 20
+  tab-spam-increment: 1
+  tab-spam-limit: 500
+spark:
+  enable-immediately: false
+  enabled: true
+time:
+  affects-all-worlds: false
+unsupported-settings:
+  allow-headless-pistons: false
+  allow-permanent-block-break-exploits: false
+  allow-piston-duplication: false
+  allow-unsafe-end-portal-teleportation: false
+  oversized-item-component-sanitizer:
+    dont-sanitize: []
+  perform-username-validation: true
+  skip-tripwire-hook-placement-validation: false
+  skip-vanilla-damage-tick-when-shield-blocked: false
+  update-equipment-on-player-actions: true
+update-checker:
+  enabled: true
+watchdog:
+  early-warning-delay: 10000
+  early-warning-every: 5000

images/papermc/server.properties

@@ -0,0 +1,70 @@
+accepts-transfers=false
+allow-flight=false
+broadcast-console-to-ops=true
+broadcast-rcon-to-ops=true
+bug-report-link=
+chat-spam-threshold-seconds=10
+command-spam-threshold-seconds=10
+debug=false
+difficulty=easy
+enable-code-of-conduct=false
+enable-jmx-monitoring=false
+enable-query=false
+enable-rcon=false
+enable-status=true
+enforce-secure-profile=true
+enforce-whitelist=false
+entity-broadcast-range-percentage=100
+force-gamemode=false
+function-permission-level=2
+gamemode=survival
+generate-structures=true
+generator-settings={}
+hardcore=false
+hide-online-players=false
+initial-disabled-packs=
+initial-enabled-packs=vanilla
+level-name=world
+level-seed=
+level-type=minecraft\:normal
+log-ips=true
+management-server-allowed-origins=
+management-server-enabled=false
+management-server-host=localhost
+management-server-port=0
+management-server-secret=sld5B5JFeqfRwDJ65nGgwbN61z4VeUACqgy5lrWO
+management-server-tls-enabled=true
+management-server-tls-keystore=
+management-server-tls-keystore-password=
+max-chained-neighbor-updates=1000000
+max-players=20
+max-tick-time=60000
+max-world-size=29999984
+motd=A Minecraft Server
+network-compression-threshold=256
+online-mode=false
+op-permission-level=4
+pause-when-empty-seconds=-1
+player-idle-timeout=0
+prevent-proxy-connections=false
+query.port=25565
+rate-limit=0
+rcon.password=
+rcon.port=25575
+region-file-compression=deflate
+require-resource-pack=false
+resource-pack=
+resource-pack-id=
+resource-pack-prompt=
+resource-pack-sha1=
+server-ip=
+server-port=25565
+simulation-distance=10
+spawn-protection=16
+status-heartbeat-interval=0
+sync-chunk-writes=true
+text-filtering-config=
+text-filtering-version=0
+use-native-transport=true
+view-distance=10
+white-list=false

images/velocity/Containerfile

@@ -4,7 +4,6 @@ EXPOSE 25565
 ENV VELOCITY_VERSION="4.1.0-SNAPSHOT"
 
 VOLUME /mnt
-COPY --chmod=755 entrypoint.sh /entrypoint.sh
 WORKDIR /data
 
 RUN apk add --no-cache curl jq
@@ -12,5 +11,8 @@ RUN curl -s "https://fill.papermc.io/v3/projects/velocity/versions/$VELOCITY_VER
   | jq -r '.downloads."server:default".url' \
   | xargs curl -o server.jar
 
+COPY ./velocity.toml /data
+COPY ./forwarding.secret /data
+COPY --chmod=755 entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["java", "-jar", "server.jar"]

images/velocity/Makefile

@@ -1,3 +1,3 @@
 include ../container.mk
 TAG := velocity
-VERSION := 0.1
+VERSION := 0.3

images/velocity/forwarding.secret

@@ -0,0 +1 @@
+1234

images/velocity/velocity.toml

@@ -0,0 +1,191 @@
+# Config version. Do not change this
+config-version = "2.8"
+
+# What port should the proxy be bound to? By default, we'll bind to all addresses on port 25565.
+bind = "0.0.0.0:25565"
+
+# What should be the MOTD? This gets displayed when the player adds your server to
+# their server list. Only MiniMessage format is accepted.
+motd = "<color:#e5377f>scrow</color>"
+
+# What should we display for the maximum number of players? (Velocity does not support a cap
+# on the number of players online.)
+show-max-players = 69
+
+# Should we authenticate players with Mojang? By default, this is on.
+online-mode = true
+
+# Should the proxy enforce the new public key security standard? By default, this is on.
+force-key-authentication = true
+
+# If client's ISP/AS sent from this proxy is different from the one from Mojang's
+# authentication server, the player is kicked. This disallows some VPN and proxy
+# connections but is a weak form of protection.
+prevent-client-proxy-connections = false
+
+# Should we forward IP addresses and other data to backend servers?
+# Available options:
+# - "none":        No forwarding will be done. All players will appear to be connecting
+#                  from the proxy and will have offline-mode UUIDs.
+# - "legacy":      Forward player IPs and UUIDs in a BungeeCord-compatible format. Use this
+#                  if you run servers using Minecraft 1.12 or lower.
+# - "bungeeguard": Forward player IPs and UUIDs in a format supported by the BungeeGuard
+#                  plugin. Use this if you run servers using Minecraft 1.12 or lower, and are
+#                  unable to implement network level firewalling (on a shared host).
+# - "modern":      Forward player IPs and UUIDs as part of the login process using
+#                  Velocity's native forwarding. Only applicable for Minecraft 1.13 or higher.
+player-info-forwarding-mode = "modern"
+
+# If you are using modern or BungeeGuard IP forwarding, configure a file that contains a unique secret here.
+# The file is expected to be UTF-8 encoded and not empty.
+forwarding-secret-file = "forwarding.secret"
+
+# Announce whether or not your server supports Forge. If you run a modded server, we
+# suggest turning this on.
+# 
+# If your network runs one modpack consistently, consider using ping-passthrough = "mods"
+# instead for a nicer display in the server list.
+announce-forge = false
+
+# If enabled (default is false) and the proxy is in online mode, Velocity will kick
+# any existing player who is online if a duplicate connection attempt is made.
+kick-existing-players = false
+
+# Should Velocity pass server list ping requests to a backend server?
+# Available options:
+# - "disabled":    No pass-through will be done. The velocity.toml and server-icon.png
+#                  will determine the initial server list ping response.
+# - "mods":        Passes only the mod list from your backend server into the response.
+#                  The first server in your try list (or forced host) with a mod list will be
+#                  used. If no backend servers can be contacted, Velocity won't display any
+#                  mod information.
+# - "description": Uses the description and mod list from the backend server. The first
+#                  server in the try (or forced host) list that responds is used for the
+#                  description and mod list.
+# - "all":         Uses the backend server's response as the proxy response. The Velocity
+#                  configuration is used if no servers could be contacted.
+ping-passthrough = "DISABLED"
+
+# If enabled (default is false), then a sample of the online players on the proxy will be visible
+# when hovering over the player count in the server list.
+# This doesn't have any effect when ping passthrough is set to either "description" or "all".
+sample-players-in-ping = false
+
+# If not enabled (default is true) player IP addresses will be replaced by <ip address withheld> in logs
+enable-player-address-logging = true
+
+[packet-limiter]
+# Size of the moving time window in seconds used to calculate average rates.
+# A larger window tolerates short bursts while still enforcing the configured limits over time.
+interval = 7
+# Maximum average number of packets per second a client may send. -1 disables this check.
+packets-per-second = -1
+# Maximum average number of compressed (on-wire) bytes per second a client may send. -1 disables this check.
+bytes-per-second = -1
+# Maximum average number of decompressed bytes per second a client may send.
+# Protects against compression bomb attacks where small packets expand to excessive sizes after decompression.
+# -1 disables this check.
+decompressed-bytes-per-second = 5242880
+
+[servers]
+# Configure your servers here. Each key represents the server's name, and the value
+# represents the IP address of the server to connect to.
+
+# In what order we should try servers when a player logs in or is kicked from a server.
+try = [
+]
+
+[forced-hosts]
+# Configure your forced hosts here.
+
+[advanced]
+# How large a Minecraft packet has to be before we compress it. Setting this to zero will
+# compress all packets, and setting it to -1 will disable compression entirely.
+compression-threshold = 256
+
+# How much compression should be done (from 0-9). The default is -1, which uses the
+# default level of 6.
+compression-level = -1
+
+# How fast (in milliseconds) are clients allowed to connect after the last connection? By
+# default, this is three seconds. Disable this by setting this to 0.
+login-ratelimit = 3000
+
+# Specify a custom timeout for connection timeouts here. The default is five seconds.
+connection-timeout = 5000
+
+# Specify a read timeout for connections here. The default is 30 seconds.
+read-timeout = 30000
+
+# Enables compatibility with HAProxy's PROXY protocol. If you don't know what this is for, then
+# don't enable it.
+haproxy-protocol = false
+
+# Enables TCP fast open support on the proxy. Requires the proxy to run on Linux.
+tcp-fast-open = false
+
+# Enables BungeeCord plugin messaging channel support on Velocity.
+bungee-plugin-message-channel = true
+
+# Shows ping requests to the proxy from clients.
+show-ping-requests = false
+
+# By default, Velocity will attempt to gracefully handle situations where the user unexpectedly
+# loses connection to the server without an explicit disconnect message by attempting to fall the
+# user back, except in the case of read timeouts. BungeeCord will disconnect the user instead. You
+# can disable this setting to use the BungeeCord behavior.
+failover-on-unexpected-server-disconnect = true
+
+# Declares the proxy commands to 1.13+ clients.
+announce-proxy-commands = true
+
+# Enables the logging of commands
+log-command-executions = false
+
+# Enables logging of player connections when connecting to the proxy, switching servers
+# and disconnecting from the proxy.
+log-player-connections = true
+
+# Allows players transferred from other hosts via the
+# Transfer packet (Minecraft 1.20.5) to be received.
+accepts-transfers = false
+
+# Enables support for SO_REUSEPORT. This may help the proxy scale better on multicore systems
+# with a lot of incoming connections, and provide better CPU utilization than the existing
+# strategy of having a single thread accepting connections and distributing them to worker
+# threads. Disabled by default. Requires Linux or macOS.
+enable-reuse-port = false
+
+# How fast (in milliseconds) are clients allowed to send commands after the last command
+# By default this is 50ms (20 commands per second)
+command-rate-limit = 50
+
+# Should we forward commands to the backend upon being rate limited?
+# This will forward the command to the server instead of processing it on the proxy.
+# Since most server implementations have a rate limit, this will prevent the player
+# from being able to send excessive commands to the server.
+forward-commands-if-rate-limited = true
+
+# How many commands are allowed to be sent after the rate limit is hit before the player is kicked?
+# Setting this to 0 or lower will disable this feature.
+kick-after-rate-limited-commands = 0
+
+# How fast (in milliseconds) are clients allowed to send tab completions after the last tab completion
+tab-complete-rate-limit = 10
+
+# How many tab completions are allowed to be sent after the rate limit is hit before the player is kicked?
+# Setting this to 0 or lower will disable this feature.
+kick-after-rate-limited-tab-completes = 0
+
+[query]
+# Whether to enable responding to GameSpy 4 query responses or not.
+enabled = false
+
+# If query is enabled, on what port should the query protocol listen on?
+port = 25565
+
+# This is the map name that is reported to the query services.
+map = "Velocity"
+
+# Whether plugins should be shown in query response by default or not
+show-plugins = false

jobs/minecraft.nomad.hcl

@@ -1,21 +1,14 @@
-variable "mode" {
-  type = string
-  description = "gamemode to advertise as; e.g. lobby or bedwars"
-}
-
-variable "image" {
-  type = string
-  description = "docker image to use"
-}
-
-variable "plugins" {
-  type = list(string)
-  description = "list of URLs to download to the plugins directory"
-  default = []
-}
-
 job "minecraft" {
-  type = "service"
+  type = "batch"
+
+	parameterized {
+	  meta_required = ["mode", "image"]
+    meta_optional = ["plugins"]
+	}
+
+  meta {
+    plugins = ""
+  }
 
   group "lobby" {
     count = 1
@@ -31,10 +24,12 @@ job "minecraft" {
     }
 
     service {
-      name = var.mode
+      name = "minecraft"
       port = "minecraft"
       address_mode = "alloc"
-      tags = ["minecraft", var.mode]
+      meta {
+        mode = "${NOMAD_META_MODE}"
+      }
       check {
         type = "tcp"
         interval = "5s"
@@ -42,22 +37,37 @@ job "minecraft" {
       }
     }
 
-    task "run" {
+    task "download-plugins" {
       driver = "docker"
 
-      dynamic "artifact" {
+      lifecycle {
-        for_each = var.plugins
+        hook = "prestart"
-        content {
+        sidecar = false
-          source      = artifact.value
-          destination = "local/plugins"
-        }
       }
 
       config {
-        image = var.image
+        image = "busybox"
-        force_pull = false
+        command = "sh"
+        volumes = ["../alloc/data:/mnt"]
+        args = [
+          "-cxe",
+          <<-EOF
+          set -eu
+          mkdir /mnt/plugins
+          wget -P /mnt/plugins ${NOMAD_META_PLUGINS}
+          EOF
+        ]
+      }
+    }
+
+    task "run" {
+      driver = "docker"
+
+      config {
+        image = "${NOMAD_META_IMAGE}"
+        force_pull = true
         ports = ["minecraft"]
-        volumes = ["local:/mnt"]
+        volumes = ["../alloc/data:/mnt"]
       }
 
       env {

jobs/velocity.nomad.hcl

@@ -1,10 +1,9 @@
 job "velocity" {
   type = "service"
+  datacenters = ["dc1"]
 
   group "velocity" {
-
     network {
-      mode = "bridge"
       port "ingress" {
         static = 25565
       }
@@ -13,52 +12,19 @@ job "velocity" {
       }
     }
 
-    service {
-      name = "velocity"
-      port = "ingress"
-      address_mode = "host"
-
-      check {
-        type = "tcp"
-        interval = "5s"
-        timeout = "1s"
-      }
-    }
-
-    ephemeral_disk {
-      size = 5000 # 5 gb
-    }
-
-    task "download-plugins" {
-      driver = "docker"
-      
-      lifecycle {
-        hook = "prestart"
-        sidecar = false
-      }
-
-      config {
-        image = "busybox"
-        command = "sh"
-        volumes = ["../alloc/data:/mnt"]
-        args = [
-          "-xec",
-          <<-EOF
-            mkdir -p /mnt/plugins
-            wget -P /mnt/plugins \
-              https://git.lab0x13.site/api/packages/scrow/generic/core-velocity/UNVERSIONED/CoreVelocity.jar
-          EOF
-        ]
-      }
-    }
-
     task "velocity" {
       driver = "docker"
 
+      artifact {
+        source = "https://git.lab0x13.site/api/packages/scrow/generic/core-velocity/UNVERSIONED/CoreVelocity.jar"
+        destination = "local/plugins"
+      }
+
       config {
-        image = "git.lab0x13.site/scrow/velocity:0.1"
+        image = "git.lab0x13.site/scrow/velocity:0.3"
+        force_pull = true
         ports = ["ingress"]
-        volumes = ["../alloc/data:/mnt"]
+        volumes = ["local:/mnt"]
       }
 
       env {

minigame/lobby.varfile.hcl

@@ -1,5 +0,0 @@
-mode = "lobby"
-image = "git.lab0x13.site/scrow/papermc:0.2"
-plugins = [
-  "https://git.lab0x13.site/api/packages/scrow/generic/core-bukkit/UNVERSIONED/CoreBukkit.jar",
-]

minigame/run

@@ -1,9 +0,0 @@
-#!/bin/sh
-set -eu
-varfile="${1:-}"
-test -n "$varfile" || {
-  printf 'usage: %s VARFILE\n' "$0"
-  exit 1
-}
-
-nomad job run -var-file "$varfile" ../jobs/minecraft.nomad.hcl 

minigame/run-lobby

@@ -0,0 +1,6 @@
+#!/command/execlineb
+nomad job dispatch 
+	-meta mode="lobby"
+	-meta image="git.lab0x13.site/scrow/lobby:0.2"
+	-meta plugins="https://git.lab0x13.site/api/packages/scrow/generic/core-bukkit/UNVERSIONED/CoreBukkit.jar"
+	minecraft