diff --git a/modules/config/instances/config/minecraft.nix b/modules/config/instances/config/minecraft0.nix similarity index 100% rename from modules/config/instances/config/minecraft.nix rename to modules/config/instances/config/minecraft0.nix diff --git a/modules/config/instances/config/minecraft1.nix b/modules/config/instances/config/minecraft1.nix new file mode 100755 index 0000000..b4a4a75 --- /dev/null +++ b/modules/config/instances/config/minecraft1.nix @@ -0,0 +1,38 @@ +{ moduleFunctions }: +let + inherit (moduleFunctions.instancesFunctions) + varPath + mntPath + secretPath + ; + label = "Minecraft"; + name = "minecraft"; + short = "mine"; + secrets = "${secretPath}/${name}"; +in +{ + label = label; + name = name; + short = short; + ports = { + port0 = 43001; + }; + interface = { + id = "vm-${short}"; + mac = "02:00:00:00:51:42"; + idUser = "vmuser-${short}"; + macUser = "02:00:00:00:00:42"; + ip = "192.168.50.142"; + gate = "192.168.50.1"; + ssh = 2402; + }; + varPaths = { + path0 = "${varPath}/${name}"; + }; + mntPaths = { + path0 = "${mntPath}/${name}"; + }; + secretPaths = { + path0 = secrets; + }; +} diff --git a/modules/nixos/guests/minecraft/world0/default.nix b/modules/nixos/guests/minecraft/world0/default.nix index c137de0..34c7d54 100755 --- a/modules/nixos/guests/minecraft/world0/default.nix +++ b/modules/nixos/guests/minecraft/world0/default.nix @@ -5,7 +5,7 @@ let inherit (flake.config.people) user0; inherit (flake.config.services) instances; - serviceCfg = instances.minecraft; + serviceCfg = instances.minecraft0; hostCfg = instances.web; world = "world0"; in diff --git a/modules/nixos/guests/minecraft/world1/default.nix b/modules/nixos/guests/minecraft/world1/default.nix new file mode 100755 index 0000000..ab3f8b1 --- /dev/null +++ b/modules/nixos/guests/minecraft/world1/default.nix @@ -0,0 +1,186 @@ +{ + flake, + ... +}: +let + inherit (flake.config.people) user0; + inherit (flake.config.services) instances; + serviceCfg = instances.minecraft1; + hostCfg = instances.web; + world = "world1"; +in +{ + microvm.vms = { + "${serviceCfg.name}-${world}" = { + autostart = true; + restartIfChanged = true; + config = { + system.stateVersion = "24.05"; + time.timeZone = "America/Winnipeg"; + users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys; + services = { + minecraft-server = { + enable = true; + eula = true; + openFirewall = true; + declarative = true; + serverProperties = { + "rcon.password" = "/etc/${serviceCfg.name}-secrets/${world}"; + allow-flight = false; + allow-nether = true; + difficulty = 2; + enable-command-block = false; + enable-rcon = true; + enable-status = true; + force-gamemode = true; + gamemode = 0; + generate-structures = true; + hardcore = false; + hide-online-players = false; + level-name = "CuddleCubes"; + level-seed = "-2332803749585407299"; + max-players = 2; + max-world-size = 64000000; + motd = "A cool Minecraft server powered by NixOS"; + online-mode = true; + pvp = true; + server-ip = hostCfg.localhost.address1; + server-port = serviceCfg.ports.port0; + spawn-animals = true; + spawn-monsters = true; + spawn-npcs = true; + spawn-protection = 16; + view-distance = 32; + white-list = true; + }; + whitelist = { + Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3"; + Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49"; + }; + }; + + openssh = { + enable = true; + settings = { + PasswordAuthentication = false; + PermitRootLogin = "prohibit-password"; + }; + }; + }; + + networking.firewall.allowedTCPPorts = [ + 22 # SSH + serviceCfg.ports.port0 + ]; + + systemd = { + services = { + "${serviceCfg.name}-copy-secrets" = { + description = "Copy secrets from virtiofs to local filesystem"; + before = [ "minecraft-server.service" ]; + requiredBy = [ "minecraft-server.service" ]; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + mkdir -p /etc/${serviceCfg.name}-secrets + cp /run/secrets/${world} /etc/${serviceCfg.name}-secrets/${world} + chmod 755 /etc/${serviceCfg.name}-secrets + chmod 644 /etc/${serviceCfg.name}-secrets/* + ''; + }; + + }; + network = { + enable = true; + networks."20-lan" = { + matchConfig.Name = "enp0s5"; + addresses = [ + { Address = "${serviceCfg.interface.ip}/24"; } + ]; + routes = [ + { + Destination = "${hostCfg.localhost.address1}/0"; + Gateway = serviceCfg.interface.gate; + } + ]; + dns = [ + "1.1.1.1" + "8.8.8.8" + ]; + }; + }; + + tmpfiles.rules = [ + "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -" + ]; + + }; + + systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ]; + + microvm = { + vcpu = 2; + mem = 1024 * 3; + hypervisor = "qemu"; + interfaces = [ + { + type = "tap"; + id = serviceCfg.interface.id; + mac = serviceCfg.interface.mac; + } + { + type = "user"; + id = serviceCfg.interface.idUser; + mac = serviceCfg.interface.macUser; + } + ]; + forwardPorts = [ + { + from = "host"; + host.port = serviceCfg.interface.ssh; + guest.port = 22; + } + ]; + shares = [ + { + mountPoint = "/nix/.ro-store"; + proto = "virtiofs"; + source = "/nix/store"; + tag = "read_only_nix_store"; + } + { + mountPoint = "/var/lib/${serviceCfg.name}"; + proto = "virtiofs"; + source = serviceCfg.mntPaths.path0; + tag = "${serviceCfg.name}_data"; + } + { + mountPoint = "/run/secrets"; + proto = "virtiofs"; + source = "/run/secrets/${serviceCfg.name}"; + tag = "host_secrets"; + } + ]; + }; + }; + }; + }; + + systemd = { + tmpfiles.rules = [ + "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" + ]; + }; + + sops.secrets = { + "${serviceCfg.name}/${world}" = { + owner = "root"; + mode = "0600"; + }; + }; + + networking.firewall.allowedTCPPorts = [ serviceCfg.ports.port0 ]; +} diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 1adc657..5a8f20d 100755 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -24,6 +24,7 @@ zookeeper: env: ENC[AES256_GCM,data:CEEUmzRxvyeXSQfwUkmZq46HQNkv3I+wMzkBoUpAlh3D5O3L5kCeoDksDWuQrVTeQfIwKj18LDeeG+2Bz5XOVPTyXm/Ap+m2Jw==,iv:6eX7ocY5PiQaJ0KBDiKxhx0UguuQWcIbiZSYHY2hHjU=,tag:6vXg2fzRyfuJd5G3yNeUNA==,type:str] minecraft: world0: ENC[AES256_GCM,data:pz7P5g9jRL8KaARfSs2ddmN76ioKSuSv7A==,iv:ZFIhS15BPxHzTW4aPpT7A8R4rxuyNNGjPJXqJXYoBpk=,tag:aymiUs87YR519eZN8Aopyw==,type:str] + world1: ENC[AES256_GCM,data:vvMvvGlyrrufdoeiTWYUcKoYSyMtuOyQ2A2xPB0V81IM,iv:gQWuyxqcSTvrgKbhKlu8dZbBj0zqGImyB+W2ZufRyJc=,tag:ykPgGmRAEZl3M3HrEdE5Aw==,type:str] vaultwarden: env: ENC[AES256_GCM,data:1MzIqnV/PCGNNqKVwhxZfmV92vRQsn3OxuvCXUtKyCmoA2xxD91U3EmMikTqM3EOHYAMHbF66YgQC5JjivbIF06OCeXMMLpGuN8ibCUQq7M6PQ34/LDMZnqynmC3/U0FJglSU7o1KA0=,iv:novSYG6j0l17xogdE5WiS2gNPNAVKeX9lgxe5EohBHk=,tag:w43z7a/MzObvVTQh8AiSTA==,type:str] dns: @@ -72,7 +73,7 @@ sops: bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-27T00:01:26Z" - mac: ENC[AES256_GCM,data:5/dhLmWLdSvpL69dd8/ZyARRvmb9GKv7DDaky0GZjXPf73LKl/tTeBqqMP99TFwXqXY3n9HdxuKwNIrIqMchw/CX1+SO3eBLQSffiS0T8tGwGa1RJf2YGYQupOyTrvBLPS3Qtxuo0JvlvGkxYStqUoM9ZFO2r46ZJPwAEHRPZN4=,iv:Dk1D29Zu5WpeeGXag1EsD1gWKoNchI7mkmOoJIUxf9A=,tag:RYc8f7eU19h4Z1Af9VbLOQ==,type:str] + lastmodified: "2025-11-27T03:39:51Z" + mac: ENC[AES256_GCM,data:EdxVM3/0cvMX5cumM+LDn5/qgOCMB6uySunlvEkPy3GHG3dHULc4MAw7bgI9DZ8Y0R26ipBzTKEoWWIIwCLcT+r6KwCM/HVg7gjuY+YbEnU71jivAKNg902Ue8LWNSKLvw1kAHkgtT/jPuMTuHShBTNTYeTsW5mGsqcXhdWVWC4=,iv:A3xeAtFwn4i7ijOA/vZ+XJ9jUeyt1FrvvKrGg5SeyAM=,tag:C7PuVjmYcjFB/u5Hi22aWg==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0