feat: got minecraft servers sorted

modules/config/instances/config/minecraft0.nix

@@ -7,20 +7,18 @@ let
     ;
   label = "Minecraft";
   name = "minecraft";
-  short = "mine";
-  secrets = "${secretPath}/${name}";
+  world = "world0";
 in
 {
   label = label;
   name = name;
-  short = short;
   ports = {
     port0 = 43000;
   };
   interface = {
-    id = "vm-${short}";
+    id = "vm-${world}";
     mac = "02:00:00:00:51:41";
-    idUser = "vmuser-${short}";
+    idUser = "vmuser-${world}";
     macUser = "02:00:00:00:00:41";
     ip = "192.168.50.141";
     gate = "192.168.50.1";
@@ -30,9 +28,9 @@ in
     path0 = "${varPath}/${name}";
   };
   mntPaths = {
-    path0 = "${mntPath}/${name}";
+    path0 = "${mntPath}/${name}/${world}";
   };
   secretPaths = {
-    path0 = secrets;
+    path0 = "${secretPath}/${name}";
   };
 }

modules/config/instances/config/minecraft1.nix

@@ -0,0 +1,36 @@
+{ moduleFunctions }:
+let
+  inherit (moduleFunctions.instancesFunctions)
+    varPath
+    mntPath
+    secretPath
+    ;
+  label = "Minecraft";
+  name = "minecraft";
+  world = "world1";
+in
+{
+  label = label;
+  name = name;
+  ports = {
+    port0 = 43001;
+  };
+  interface = {
+    id = "vm-${world}";
+    mac = "02:00:00:00:51:42";
+    idUser = "vmuser-${world}";
+    macUser = "02:00:00:00:00:42";
+    ip = "192.168.50.142";
+    gate = "192.168.50.1";
+    ssh = 2402;
+  };
+  varPaths = {
+    path0 = "${varPath}/${name}";
+  };
+  mntPaths = {
+    path0 = "${mntPath}/${name}/${world}";
+  };
+  secretPaths = {
+    path0 = "${secretPath}/${name}";
+  };
+}

modules/home/default.nix

@@ -57,6 +57,7 @@ in
             opencloud
             printManager
             prismLauncher
+            proton
             puddleTag
             scrcpy
             sharing
@@ -103,6 +104,7 @@ in
             okular
             printManager
             prismLauncher
+            proton
             scrcpy
             sharing
             signal

modules/home/gui/apps/tools/proton/default.nix

@@ -0,0 +1,11 @@
+{
+  pkgs,
+  ...
+}:
+{
+  home.packages = builtins.attrValues {
+    inherit (pkgs)
+      protonvpn-gui
+      ;
+  };
+}

modules/nixos/guests/minecraft/default.nix

@@ -7,5 +7,12 @@ let
     map (name: ./. + "/${name}") dirContent;
 in
 {
+
+  systemd = {
+    tmpfiles.rules = [
+      "d /mnt/storage/minecraft 0751 microvm wheel - -"
+    ];
+  };
+
   imports = importList;
 }

modules/nixos/guests/minecraft/world0/default.nix

@@ -5,7 +5,7 @@
 let
   inherit (flake.config.people) user0;
   inherit (flake.config.services) instances;
-  serviceCfg = instances.minecraft;
+  serviceCfg = instances.minecraft0;
   hostCfg = instances.web;
   world = "world0";
 in
@@ -154,15 +154,15 @@ in
               tag = "read_only_nix_store";
             }
             {
-              mountPoint = "/var/lib/${serviceCfg.name}";
+              mountPoint = serviceCfg.varPaths.path0;
               proto = "virtiofs";
               source = serviceCfg.mntPaths.path0;
-              tag = "${serviceCfg.name}_data";
+              tag = "${serviceCfg.name}-${world}_data";
             }
             {
               mountPoint = "/run/secrets";
               proto = "virtiofs";
-              source = "/run/secrets/${serviceCfg.name}";
+              source = serviceCfg.secretPaths.path0;
               tag = "host_secrets";
             }
           ];
@@ -171,12 +171,6 @@ in
     };
   };
 
-  systemd = {
-    tmpfiles.rules = [
-      "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
-    ];
-  };
-
   sops.secrets = {
     "${serviceCfg.name}/${world}" = {
       owner = "root";
@@ -185,4 +179,11 @@ in
   };
 
   networking.firewall.allowedTCPPorts = [ serviceCfg.ports.port0 ];
+
+  systemd = {
+    tmpfiles.rules = [
+      "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
+    ];
+  };
+
 }

modules/nixos/guests/minecraft/world1/default.nix

@@ -0,0 +1,187 @@
+{
+  flake,
+  ...
+}:
+let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.services) instances;
+  serviceCfg = instances.minecraft1;
+  hostCfg = instances.web;
+  world = "world1";
+in
+{
+  microvm.vms = {
+    "${serviceCfg.name}-${world}" = {
+      autostart = true;
+      restartIfChanged = true;
+      config = {
+        system.stateVersion = "24.05";
+        time.timeZone = "America/Winnipeg";
+        users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
+        services = {
+          minecraft-server = {
+            enable = true;
+            eula = true;
+            openFirewall = true;
+            declarative = true;
+            serverProperties = {
+              "rcon.password" = "/etc/${serviceCfg.name}-secrets/${world}";
+              allow-flight = false;
+              allow-nether = true;
+              difficulty = 2;
+              enable-command-block = false;
+              enable-rcon = true;
+              enable-status = true;
+              force-gamemode = true;
+              gamemode = 0;
+              generate-structures = true;
+              hardcore = false;
+              hide-online-players = false;
+              level-name = "Cuddle Cubes";
+              level-seed = "-2332803749585407299";
+              max-players = 10;
+              max-world-size = 64000000;
+              motd = "A cool Minecraft server powered by NixOS";
+              online-mode = true;
+              pvp = true;
+              server-ip = hostCfg.localhost.address1;
+              server-port = serviceCfg.ports.port0;
+              spawn-animals = true;
+              spawn-monsters = true;
+              spawn-npcs = true;
+              spawn-protection = 16;
+              view-distance = 32;
+              white-list = true;
+            };
+            whitelist = {
+              Hefty_Chungus = "b75a9816-d408-4c54-b226-385b59ea1cb3";
+              Fallaryn = "d8baa117-ab58-4b07-92a5-48fb1978eb49";
+            };
+          };
+
+          openssh = {
+            enable = true;
+            settings = {
+              PasswordAuthentication = false;
+              PermitRootLogin = "prohibit-password";
+            };
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          22 # SSH
+          serviceCfg.ports.port0
+        ];
+
+        systemd = {
+          services = {
+            "${serviceCfg.name}-copy-secrets" = {
+              description = "Copy secrets from virtiofs to local filesystem";
+              before = [ "minecraft-server.service" ];
+              requiredBy = [ "minecraft-server.service" ];
+
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+              script = ''
+                mkdir -p /etc/${serviceCfg.name}-secrets
+                cp /run/secrets/${world} /etc/${serviceCfg.name}-secrets/${world}
+                chmod 755 /etc/${serviceCfg.name}-secrets
+                chmod 644 /etc/${serviceCfg.name}-secrets/*
+              '';
+            };
+
+          };
+          network = {
+            enable = true;
+            networks."20-lan" = {
+              matchConfig.Name = "enp0s5";
+              addresses = [
+                { Address = "${serviceCfg.interface.ip}/24"; }
+              ];
+              routes = [
+                {
+                  Destination = "${hostCfg.localhost.address1}/0";
+                  Gateway = serviceCfg.interface.gate;
+                }
+              ];
+              dns = [
+                "1.1.1.1"
+                "8.8.8.8"
+              ];
+            };
+          };
+
+          tmpfiles.rules = [
+            "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+          ];
+
+        };
+
+        systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
+
+        microvm = {
+          vcpu = 2;
+          mem = 1024 * 3;
+          hypervisor = "qemu";
+          interfaces = [
+            {
+              type = "tap";
+              id = serviceCfg.interface.id;
+              mac = serviceCfg.interface.mac;
+            }
+            {
+              type = "user";
+              id = serviceCfg.interface.idUser;
+              mac = serviceCfg.interface.macUser;
+            }
+          ];
+          forwardPorts = [
+            {
+              from = "host";
+              host.port = serviceCfg.interface.ssh;
+              guest.port = 22;
+            }
+          ];
+          shares = [
+            {
+              mountPoint = "/nix/.ro-store";
+              proto = "virtiofs";
+              source = "/nix/store";
+              tag = "read_only_nix_store";
+            }
+            {
+              mountPoint = serviceCfg.varPaths.path0;
+              proto = "virtiofs";
+              source = serviceCfg.mntPaths.path0;
+              tag = "${serviceCfg.name}-${world}_data";
+            }
+            {
+              mountPoint = "/run/secrets";
+              proto = "virtiofs";
+              source = serviceCfg.secretPaths.path0;
+              tag = "host_secrets";
+            }
+          ];
+        };
+      };
+    };
+  };
+
+  sops.secrets = {
+    "${serviceCfg.name}/${world}" = {
+      owner = "root";
+      mode = "0600";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ serviceCfg.ports.port0 ];
+
+  systemd = {
+    tmpfiles.rules = [
+      "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
+    ];
+  };
+
+}

modules/nixos/guests/torrent/default.nix

@@ -11,7 +11,7 @@ let
   host = instances.torrent.domains.url0;
   dns0 = instances.web.dns.provider0;
   dns0Path = "dns/${dns0}";
-  torrentPort = 2049;
+  torrentPort = 51820;
 in
 {
   microvm.vms.${serviceCfg.name} = {
@@ -23,15 +23,14 @@ in
         wg-quick.interfaces = {
           wg0 = {
             address = [
-              "172.22.116.126/32"
-              "fd00:4956:504e:ffff::ac16:747e/128"
+              "10.2.0.2/32"
             ];
-            dns = [ "172.16.0.1" ];
+            dns = [ "10.2.0.1" ];
             privateKeyFile = "/run/secrets/wireguard-pass";
             peers = [
               {
-                publicKey = "hku9gjamhoii8OvxZgx+TdUDIkOAQYFu39qbav2AyUQ=";
-                endpoint = "89.187.181.116:${builtins.toString torrentPort}";
+                publicKey = "SFesR+3u5/vyQGeaCSREjs4m2WznwFlWAQ9CE3QSnRg=";
+                endpoint = "104.254.95.98:${builtins.toString torrentPort}";
                 allowedIPs = [
                   "0.0.0.0/0"
                   "::/0"
@@ -78,6 +77,9 @@ in
                 MaxConnectionsPerTorrent = -1;
                 MaxUploads = -1;
                 MaxUploadsPerTorrent = -1;
+                MaxActiveDownloads = -1;
+                MaxActiveUploads = -1;
+                MaxActiveTorrents = -1;
               };
             };
 

modules/nixos/guests/website/default.nix

@@ -77,7 +77,4 @@ in
     dnsProvider = instances.web.dns.provider0;
     environmentFile = config.sops.secrets."dns/${instances.web.dns.provider0}".path;
   };
-  systemd.tmpfiles.rules = [
-    "d ${serviceCfg.mntPaths.path0} 0755 microvm wheel - -"
-  ];
 }

modules/nixos/guests/zookeeper/default.nix

@@ -106,12 +106,6 @@ in
     };
   };
 
-  systemd = {
-    tmpfiles.rules = [
-      "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
-    ];
-  };
-
   sops.secrets = {
     "${serviceCfg.name}/env" = {
       owner = "root";

modules/nixos/services/restic/default.nix

@@ -23,18 +23,23 @@ in
           OnCalendar = "0/4:00";
           Persistent = true;
         };
-        paths = [
-          "/home/${user0}/.ssh"
-          instances.firefly-iii.mntPaths.path0
-          instances.forgejo.mntPaths.path0
-          instances.mastodon.mntPaths.path0
-          instances.minecraft.mntPaths.path0
-          instances.opencloud.mntPaths.path0
-          instances.vaultwarden.mntPaths.path0
-          "${instances.jellyfin.mntPaths.path0}/cache"
-          "${instances.jellyfin.mntPaths.path0}/data"
-          "${instances.jellyfin.mntPaths.path0}/media/music"
-        ];
+        paths =
+          let
+            instanceHelper = instance: instances.${instance}.mntPaths.path0;
+          in
+          [
+            "/home/${user0}/.ssh"
+            (instanceHelper "firefly-iii")
+            (instanceHelper "forgejo")
+            (instanceHelper "mastodon")
+            (instanceHelper "opencloud")
+            (instanceHelper "minecraft0")
+            (instanceHelper "minecraft1")
+            (instanceHelper "vaultwarden")
+            ((instanceHelper "jellyfin") + "/cache")
+            ((instanceHelper "jellyfin") + "/data")
+            ((instanceHelper "jellyfin") + "/media/music")
+          ];
       };
     };
   };

secrets/secrets.yaml

@@ -24,6 +24,7 @@ zookeeper:
     env: ENC[AES256_GCM,data:CEEUmzRxvyeXSQfwUkmZq46HQNkv3I+wMzkBoUpAlh3D5O3L5kCeoDksDWuQrVTeQfIwKj18LDeeG+2Bz5XOVPTyXm/Ap+m2Jw==,iv:6eX7ocY5PiQaJ0KBDiKxhx0UguuQWcIbiZSYHY2hHjU=,tag:6vXg2fzRyfuJd5G3yNeUNA==,type:str]
 minecraft:
     world0: ENC[AES256_GCM,data:pz7P5g9jRL8KaARfSs2ddmN76ioKSuSv7A==,iv:ZFIhS15BPxHzTW4aPpT7A8R4rxuyNNGjPJXqJXYoBpk=,tag:aymiUs87YR519eZN8Aopyw==,type:str]
+    world1: ENC[AES256_GCM,data:vvMvvGlyrrufdoeiTWYUcKoYSyMtuOyQ2A2xPB0V81IM,iv:gQWuyxqcSTvrgKbhKlu8dZbBj0zqGImyB+W2ZufRyJc=,tag:ykPgGmRAEZl3M3HrEdE5Aw==,type:str]
 vaultwarden:
     env: ENC[AES256_GCM,data:1MzIqnV/PCGNNqKVwhxZfmV92vRQsn3OxuvCXUtKyCmoA2xxD91U3EmMikTqM3EOHYAMHbF66YgQC5JjivbIF06OCeXMMLpGuN8ibCUQq7M6PQ34/LDMZnqynmC3/U0FJglSU7o1KA0=,iv:novSYG6j0l17xogdE5WiS2gNPNAVKeX9lgxe5EohBHk=,tag:w43z7a/MzObvVTQh8AiSTA==,type:str]
 dns:
@@ -55,7 +56,7 @@ firefly-iii:
     data: ENC[AES256_GCM,data:921LhcRTWVk24eEAQoDMV+RllSP3PbSXCCIDXlQA80Mq,iv:YXEgas77DgdyPTnBZa/ySjcERBIwmdDZJbijeNKNF24=,tag:Wj25wA7tLJ2bZ/faG9DUhg==,type:str]
     smtp: ENC[AES256_GCM,data:+e4MiRZ2WOZyWYpMf+By1Eb45ih4TA+svLI2+00yQk82,iv:+52+kJouMwkOSDEaOCA8V80+wT/VzNxgtCkOO68SCdk=,tag:YrtrJAXIhQpsUTEeYvrVwQ==,type:str]
 proton:
-    wireguard-pass: ENC[AES256_GCM,data:2SuLDMkJsOa/EjoYq0ZYp8A6yAO9KSaMJ35ofMXQDWhPcpL7/2eld83by021,iv:g5zGOdl2pGu3rsQcnwgRCHqDdzYNVkNhhfl3YMieBUY=,tag:FzbkDA4FyHrcC09EFZDoKw==,type:str]
+    wireguard-pass: ENC[AES256_GCM,data:nHks/AYJGEuv8Dk2DWi01dFlaZtB1YWUc6BgJ+hu4BPS5aNK86mQRV31dIGV,iv:ht2W1OaqQ6pVrqqKxvzPml2ShPusNNI0LBjiagWmdo4=,tag:OSzqYqxsHaDy+xNl2j8axQ==,type:str]
 backblaze:
     env: ENC[AES256_GCM,data:cdOYt77KocuGB3aqYz13oBokoLkEIgI1AW+cYC5uutgZYujG3PqoLEh6Gvbpzn3O+0OWg1/4UAYr4f2v7oCsgwFzPWS3HrhqC5+kIBjrPCyAnxDxlu2xaQ9hR+ogFh5UTDo=,iv:6+jx4Dj5CNV72DAss6NNYm44f9gSHco/EUBvL2o2CNI=,tag:6/cx84MgTDqQJxu/zINEeA==,type:str]
     repo: ENC[AES256_GCM,data:sRae9XELIfkWPaXelCdgEXIDbLTHVqGcRO0o+WA9aBfB8MUw92JjRCYgMgGXT0Apy38eszyuEHFB3XPpRmtQ7g==,iv:EilVA9zdHm6B9pTIhNxyj6Th1248nXvh0kpnEqZJ5HI=,tag:q9ASAgx5vgY0IePws4rT5Q==,type:str]
@@ -72,7 +73,7 @@ sops:
             bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD
             aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-26T08:19:12Z"
-    mac: ENC[AES256_GCM,data:eqsiEBdTva+rjC64+n/RhVqWT7q4QUfARAvqZCezVCAvoTFJ+qJO2PWrJ39H/axLcLTwq7xC36UYkN8ckvAUSLx8pZyyuHVeI+4irL16AIpJM8z14kYG6dyw0ujVI+JZpM57FHWXkwX6JtzbqN7sv+u/YnM6ubfmporykvlQOmQ=,iv:eYhCL11iv3B6jsGieJ7nosKcd6MUH1QBWjJptgjBhiQ=,tag:7W+bhwOHM7e0zCP7eP0jxQ==,type:str]
+    lastmodified: "2025-11-27T03:39:51Z"
+    mac: ENC[AES256_GCM,data:EdxVM3/0cvMX5cumM+LDn5/qgOCMB6uySunlvEkPy3GHG3dHULc4MAw7bgI9DZ8Y0R26ipBzTKEoWWIIwCLcT+r6KwCM/HVg7gjuY+YbEnU71jivAKNg902Ue8LWNSKLvw1kAHkgtT/jPuMTuHShBTNTYeTsW5mGsqcXhdWVWC4=,iv:A3xeAtFwn4i7ijOA/vZ+XJ9jUeyt1FrvvKrGg5SeyAM=,tag:C7PuVjmYcjFB/u5Hi22aWg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0