feat: add minecraft server VM

hosts/sire/default.nix

@@ -135,8 +135,8 @@
         enableStorageDataset = true;
       }
       // mkMicrovm "ai" {}
-      #// mkMicrovm "minecraft"
+      // mkMicrovm "minecraft" {}
-      #// mkMicrovm "firefly"
+      #// mkMicrovm "firefly" {}
-      #// mkMicrovm "fasten-health"
+      #// mkMicrovm "fasten-health" {}
     );
 }

hosts/sire/guests/minecraft.nix

@@ -0,0 +1,548 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  inherit (lib) getExe;
+
+  minecraftDomain = "mc.${config.repo.secrets.global.domains.me}";
+  dataDir = "/var/lib/minecraft";
+
+  minecraft-attach = pkgs.writeShellApplication {
+    name = "minecraft-attach";
+    runtimeInputs = [pkgs.tmux];
+    text = ''
+      shopt -s nullglob
+
+      [[ $EUID == 0 ]] || { echo "You have to be root (or use sudo) to attach to the console." >&2; exit 1; }
+
+      SERVER_NAME="''${1-none}"
+      TMUX_SOCKET="/run/minecraft-$1/tmux"
+
+      if [[ ! -e "$TMUX_SOCKET" ]]; then
+        echo "error: Unknown server name '$SERVER_NAME', or service not started." >&2
+        AVAILABLE=("/run/minecraft-"*"/tmux")
+        if [[ "''${#AVAILABLE[@]}" == 0 ]]; then
+          echo "There are currently no servers available. Check your system services." >&2
+        else
+          avail=("''${AVAILABLE[@]#"/run/minecraft-"}")
+          avail=("''${avail[@]%"/tmux"}")
+          echo "Available servers: ''${avail[*]}" >&2
+        fi
+        exit 1
+      fi
+
+      exec runuser -u minecraft -- tmux -S "$TMUX_SOCKET" attach-session
+    '';
+  };
+
+  helper-functions =
+    /*
+    bash
+    */
+    ''
+      ################################################################
+      # General helper functions
+
+      function print_error() { echo "error: $*" >&2; }
+      function die() { print_error "$@"; exit 1; }
+
+      function substatus() { echo "$*"; }
+      function datetime() { date "+%Y-%m-%d %H:%M:%S"; }
+      function status_time() { echo "[$(datetime)] $*"; }
+
+      function flush_stdin() {
+        local empty_stdin
+        # Unused variable is intentional.
+        # shellcheck disable=SC2034
+        while read -r -t 0.01 empty_stdin; do true; done
+      }
+
+      function ask() {
+        local response
+        while true; do
+          flush_stdin
+          read -r -p "$* (Y/n) " response || die "Error in read"
+          case "''${response,,}" in
+            "") return 0 ;;
+            y|yes) return 0 ;;
+            n|no) return 1 ;;
+            *) continue ;;
+          esac
+        done
+      }
+
+      ################################################################
+      # Download helper functions
+
+      # $@: command to run as minecraft if user was changed.
+      #     You want to pass path/to/curent/script.sh "$@".
+      function become_minecaft() {
+        if [[ $(id -un) != "minecraft" ]]; then
+          if [[ $EUID == 0 ]] && ask "This script must be executed as the minecraft user. Change user and continue?"; then
+            # shellcheck disable=SC2093
+            exec runuser -u minecraft "$@"
+            die "Could not change user!"
+          else
+            die "This script must be executed as the minecraft user!"
+          fi
+        fi
+      }
+
+      # $1: output file name
+      function download_paper() {
+        local paper_version
+        local paper_build
+        local paper_download
+        paper_version="$(curl -s -o - "https://papermc.io/api/v2/projects/paper" | jq -r ".versions[-1]")" \
+          || die "Error while retrieving paper version"
+        paper_build="$(curl -s -o - "https://papermc.io/api/v2/projects/paper/versions/$paper_version" | jq -r ".builds[-1]")" \
+          || die "Error while retrieving paper builds"
+        paper_download="$(curl -s -o - "https://papermc.io/api/v2/projects/paper/versions/$paper_version/builds/$paper_build" | jq -r ".downloads.application.name")" \
+          || die "Error while retrieving paper download name"
+
+        substatus "Downloading paper version $paper_version build $paper_build ($paper_download)"
+        wget -q --show-progress "https://papermc.io/api/v2/projects/paper/versions/$paper_version/builds/$paper_build/downloads/$paper_download" \
+          -O "$1" \
+          || die "Could not download paper"
+      }
+
+      # $1: output file name
+      function download_velocity() {
+        local velocity_version
+        local velocity_build
+        local velocity_download
+        velocity_version="$(curl -s -o - "https://papermc.io/api/v2/projects/velocity" | jq -r ".versions[-1]")" \
+          || die "Error while retrieving velocity version"
+        velocity_build="$(curl -s -o - "https://papermc.io/api/v2/projects/velocity/versions/$velocity_version" | jq -r ".builds[-1]")" \
+          || die "Error while retrieving velocity builds"
+        velocity_download="$(curl -s -o - "https://papermc.io/api/v2/projects/velocity/versions/$velocity_version/builds/$velocity_build" | jq -r ".downloads.application.name")" \
+          || die "Error while retrieving velocity download name"
+
+        substatus "Downloading velocity version $velocity_version build $velocity_build ($velocity_download)"
+        wget -q --show-progress "https://papermc.io/api/v2/projects/velocity/versions/$velocity_version/builds/$velocity_build/downloads/$velocity_download" \
+          -O "$1" \
+          || die "Could not download velocity"
+      }
+
+      # $1: repo, e.g. "oddlama/vane"
+      declare -A LATEST_GITHUB_RELEASE_TAG_CACHE
+      function latest_github_release_tag() {
+        local repo=$1
+        if [[ ! -v "LATEST_GITHUB_RELEASE_TAG_CACHE[$repo]" ]]; then
+          local tmp
+          tmp=$(curl -s "https://api.github.com/repos/$repo/releases/latest" | jq -r .tag_name) \
+            || die "Error while retrieving latest github release tag of $repo"
+          LATEST_GITHUB_RELEASE_TAG_CACHE[$repo]="$tmp"
+        fi
+        echo "''${LATEST_GITHUB_RELEASE_TAG_CACHE[$repo]}"
+      }
+
+      # $1: repo, e.g. "oddlama/vane"
+      # $2: remote file name.
+      #     {TAG} will be replaced with the release tag
+      #     {VERSION} will be replaced with release tag excluding a leading v, if present
+      # $3: output file name
+      function download_latest_github_release() {
+        local repo=$1
+        local remote_file=$2
+        local output=$3
+
+        local tag
+        tag=$(latest_github_release_tag "$repo")
+        local version="''${tag#v}" # Always strip leading v in version.
+
+        remote_file="''${remote_file//"{TAG}"/"$tag"}"
+        remote_file="''${remote_file//"{VERSION}"/"$version"}"
+
+        wget -q --show-progress "https://github.com/$repo/releases/download/$tag/$remote_file" -O "$output" \
+          || die "Could not download $remote_file from github repo $repo"
+      }
+
+      # $1: url
+      # $2: output file name
+      function download_file() {
+        wget -q --show-progress "$1" -O "$2" || die "Could not download $1"
+      }
+    '';
+
+  server-backup-script = pkgs.writeShellApplication {
+    name = "minecraft-backup";
+    runtimeInputs = [pkgs.rdiff-backup];
+    text = ''
+      BACKUP_LOG_FILE="logs/backup.log"
+      BACKUP_TO="backups"
+      BACKUP_DIRS=(
+      	'plugins'
+      	'world'
+      	'world_nether'
+      	'world_the_end'
+      )
+
+      cd ${dataDir}/server || exit 1
+      ${helper-functions}
+
+      status_time "Starting backup"
+
+      mkdir -p "$BACKUP_TO" &>/dev/null
+      for i in "''${!BACKUP_DIRS[@]}"; do
+      	status_time "Backing up ''${BACKUP_DIRS[$i]}" | tee -a "$BACKUP_LOG_FILE"
+      	rdiff-backup "''${BACKUP_DIRS[$i]}" "$BACKUP_TO/''${BACKUP_DIRS[$i]}" &>> "$BACKUP_LOG_FILE"
+      done
+
+      status_time "Backup finished" | tee -a "$BACKUP_LOG_FILE"
+    '';
+  };
+
+  server-start-script = pkgs.writeShellApplication {
+    name = "minecraft-server-start";
+    runtimeInputs = [pkgs.procps pkgs.gnugrep];
+    text = ''
+      cd ${dataDir}/server
+
+      # Update velocity secret
+      VELOCITY_SECRET="$(cat ../proxy/forwarding.secret)" \
+        ${getExe pkgs.yq-go} -i '.proxies.velocity.secret = strenv(VELOCITY_SECRET)' \
+        config/paper-global.yml
+
+      # Use 80% of RAM, but not more than 12GiB and not less than 1GiB
+      total_ram_gibi=$(free -g | grep -oP '\d+' | head -n1)
+      ram="$((total_ram_gibi * 8 / 10))"
+      [[ "$ram" -le 8 ]] || ram=8
+      [[ "$ram" -ge 1 ]] || ram=1
+
+      echo "Executing server using ''${ram}GiB of RAM"
+      exec ${getExe pkgs.temurin-jre-bin} -Xms''${ram}G -Xmx''${ram}G \
+      	-XX:+UseG1GC \
+      	-XX:+ParallelRefProcEnabled \
+      	-XX:MaxGCPauseMillis=200 \
+      	-XX:+UnlockExperimentalVMOptions \
+      	-XX:+DisableExplicitGC \
+      	-XX:+AlwaysPreTouch \
+      	-XX:G1NewSizePercent=30 \
+      	-XX:G1MaxNewSizePercent=40 \
+      	-XX:G1HeapRegionSize=8M \
+      	-XX:G1ReservePercent=20 \
+      	-XX:G1HeapWastePercent=5 \
+      	-XX:G1MixedGCCountTarget=4 \
+      	-XX:InitiatingHeapOccupancyPercent=15 \
+      	-XX:G1MixedGCLiveThresholdPercent=90 \
+      	-XX:G1RSetUpdatingPauseTimePercent=5 \
+      	-XX:SurvivorRatio=32 \
+      	-XX:+PerfDisableSharedMem \
+      	-XX:MaxTenuringThreshold=1 \
+      	-Dusing.aikars.flags=https://mcflags.emc.gs \
+      	-Daikars.new.flags=true \
+      	-jar paper.jar nogui
+    '';
+  };
+
+  proxy-start-script = pkgs.writeShellApplication {
+    name = "minecraft-proxy-start";
+    text = ''
+      cd ${dataDir}/proxy
+
+      echo "Executing proxy server"
+      exec ${getExe pkgs.temurin-jre-bin} -Xms1G -Xmx1G -XX:+UseG1GC -XX:G1HeapRegionSize=4M -XX:+UnlockExperimentalVMOptions -XX:+ParallelRefProcEnabled -XX:+AlwaysPreTouch -XX:MaxInlineLevel=15 -jar velocity.jar
+    '';
+  };
+
+  server-update-script = pkgs.writeShellApplication {
+    name = "minecraft-server-update";
+    runtimeInputs = [pkgs.wget pkgs.curl pkgs.jq];
+    text = ''
+      cd ${dataDir}/server || exit 1
+      ${helper-functions}
+      become_minecaft "./update.sh"
+
+      ################################################################
+      # Download paper and prepare plugins
+
+      download_paper paper.jar
+
+      # Create plugins directory
+      mkdir -p plugins \
+      	|| die "Could not create directory 'plugins'"
+      # Create optional plugins directory
+      mkdir -p plugins/optional \
+      	|| die "Could not create directory 'plugins/optional'"
+
+      ################################################################
+      # Download plugins
+
+      substatus "Downloading plugins"
+      for module in admin bedtime core enchantments permissions portals regions trifles; do
+      	download_latest_github_release "oddlama/vane" "vane-$module-{VERSION}.jar" "plugins/vane-$module.jar"
+      done
+
+      download_file "https://ci.dmulloy2.net/job/ProtocolLib/lastSuccessfulBuild/artifact/build/libs/ProtocolLib.jar" plugins/ProtocolLib.jar
+      download_latest_github_release "BlueMap-Minecraft/BlueMap" "BlueMap-{VERSION}-spigot.jar" plugins/bluemap.jar
+    '';
+  };
+
+  proxy-update-script = pkgs.writeShellApplication {
+    name = "minecraft-proxy-update";
+    runtimeInputs = [pkgs.wget pkgs.curl pkgs.jq];
+    text = ''
+      cd ${dataDir}/proxy || exit 1
+      ${helper-functions}
+      become_minecaft "./update.sh"
+
+      ################################################################
+      # Download velocity and prepare plugins
+
+      download_velocity velocity.jar
+
+      # Create plugins directory
+      mkdir -p plugins \
+      	|| die "Could not create directory 'plugins'"
+
+      ################################################################
+      # Download plugins
+
+      substatus "Downloading plugins"
+      download_latest_github_release "oddlama/vane" "vane-velocity-{VERSION}.jar" "plugins/vane-velocity.jar"
+    '';
+  };
+
+  commonServiceConfig = {
+    Restart = "on-failure";
+    User = "minecraft";
+
+    # Hardening
+    AmbientCapabilities = ["CAP_KILL"];
+    CapabilityBoundingSet = ["CAP_KILL"];
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    UMask = "0027";
+  };
+in {
+  microvm.mem = 1024 * 24;
+  microvm.vcpu = 16;
+
+  wireguard.proxy-sentinel = {
+    client.via = "sentinel";
+    firewallRuleForNode.sentinel.allowedTCPPorts = [80 25565 25566];
+  };
+
+  users.groups.minecraft.members = ["nginx"];
+  users.users.minecraft = {
+    description = "Minecraft server service user";
+    home = dataDir;
+    isSystemUser = true;
+    group = "minecraft";
+  };
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = dataDir;
+      user = "minecraft";
+      group = "minecraft";
+      mode = "0750";
+    }
+  ];
+
+  nodes.sentinel = {
+    # Make sure to masquerade 25565 (wan) -> 25565 (proxy-sentinel)
+    # Make sure to masquerade 25566 (wan) -> 25566 (proxy-sentinel)
+    networking.nftables.chains = {
+      postrouting.to-minecraft = {
+        after = ["hook"];
+        rules = [
+          "iifname wan ip daddr ${config.wireguard.proxy-sentinel.ipv4} tcp dport 25565 masquerade random"
+          "iifname wan ip6 daddr ${config.wireguard.proxy-sentinel.ipv6} tcp dport 25565 masquerade random"
+          "iifname wan ip daddr ${config.wireguard.proxy-sentinel.ipv4} tcp dport 25566 masquerade random"
+          "iifname wan ip6 daddr ${config.wireguard.proxy-sentinel.ipv6} tcp dport 25566 masquerade random"
+        ];
+      };
+      prerouting.to-minecraft = {
+        after = ["hook"];
+        rules = [
+          "iifname wan tcp dport 25565 dnat ip to ${config.wireguard.proxy-sentinel.ipv4}"
+          "iifname wan tcp dport 25565 dnat ip6 to ${config.wireguard.proxy-sentinel.ipv6}"
+          "iifname wan tcp dport 25566 dnat ip to ${config.wireguard.proxy-sentinel.ipv4}"
+          "iifname wan tcp dport 25566 dnat ip6 to ${config.wireguard.proxy-sentinel.ipv6}"
+        ];
+      };
+    };
+
+    networking.providedDomains.minecraft = minecraftDomain;
+
+    services.nginx = {
+      upstreams.minecraft = {
+        servers."${config.wireguard.proxy-sentinel.ipv4}:80" = {};
+        extraConfig = ''
+          zone minecraft 64k;
+          keepalive 2;
+        '';
+      };
+      virtualHosts.${minecraftDomain} = {
+        forceSSL = true;
+        useACMEWildcardHost = true;
+        locations."/" = {
+          proxyPass = "http://minecraft";
+        };
+      };
+    };
+  };
+
+  systemd.services.minecraft-server = {
+    description = "Minecraft Server Service";
+    wantedBy = ["multi-user.target"];
+    after = ["network.target"];
+    path = [pkgs.ncurses]; # for infocmp
+
+    serviceConfig =
+      commonServiceConfig
+      // {
+        Type = "forking";
+        ExecStart = ''${getExe pkgs.tmux} -S /run/minecraft-server/tmux set -g default-shell ${getExe pkgs.bashInteractive} ";" new-session -d "${getExe pkgs.python3} ${./minecraft/server-loop.py} --block control/start.block ./start.sh :POST: ./backup.sh"'';
+        ExecStop = "${getExe pkgs.tmux} -S /run/minecraft-server/tmux kill-server";
+
+        WorkingDirectory = "${dataDir}/server";
+        RuntimeDirectory = "minecraft-server";
+        ReadWritePaths = ["${dataDir}/server" "${dataDir}/web"];
+        ReadOnlyPaths = "${dataDir}/proxy";
+      };
+
+    preStart = ''
+      ln -sfT ${getExe server-start-script} start.sh
+      ln -sfT ${getExe server-backup-script} backup.sh
+      ln -sfT ${getExe server-update-script} update.sh
+
+      function copyFile() {
+        cp "$1" "$2"
+        chmod 600 "$2"
+      }
+
+      copyFile ${./minecraft/server/eula.txt} eula.txt
+      copyFile ${./minecraft/server/server.properties} server.properties
+      copyFile ${./minecraft/server/spigot.yml} spigot.yml
+      copyFile ${./minecraft/server/commands.yml} commands.yml
+      mkdir -p config
+      copyFile ${./minecraft/server/config/paper-global.yml} config/paper-global.yml
+      copyFile ${./minecraft/server/config/paper-world-defaults.yml} config/paper-world-defaults.yml
+
+      if [[ ! -e paper.jar ]]; then
+        ./update.sh
+      fi
+    '';
+  };
+
+  systemd.services.minecraft-proxy = {
+    description = "Minecraft Proxy Service";
+    wantedBy = ["multi-user.target"];
+    after = ["network.target"];
+    path = [pkgs.ncurses]; # for infocmp
+
+    serviceConfig =
+      commonServiceConfig
+      // {
+        Type = "forking";
+        ExecStart = ''${getExe pkgs.tmux} -S /run/minecraft-proxy/tmux set -g default-shell ${getExe pkgs.bashInteractive} ";" new-session -d "${getExe pkgs.python3} ${./minecraft/server-loop.py} ./start.sh"'';
+        ExecStop = "${getExe pkgs.tmux} -S /run/minecraft-proxy/tmux kill-server";
+
+        WorkingDirectory = "${dataDir}/proxy";
+        RuntimeDirectory = "minecraft-proxy";
+        ReadWritePaths = ["${dataDir}/proxy" "${dataDir}/server/control"];
+      };
+
+    preStart = ''
+      ln -sfT ${getExe proxy-start-script} start.sh
+      ln -sfT ${getExe proxy-update-script} update.sh
+
+      function copyFile() {
+        cp "$1" "$2"
+        chmod 600 "$2"
+      }
+
+      copyFile ${./minecraft/proxy/velocity.toml} velocity.toml
+      mkdir -p plugins/vane-velocity
+      copyFile ${./minecraft/proxy/plugins/vane-velocity/config.toml} plugins/vane-velocity/config.toml
+
+      if [[ ! -e velocity.jar ]]; then
+        ./update.sh
+      fi
+    '';
+  };
+
+  systemd.tmpfiles.settings."50-minecraft" = {
+    "${dataDir}".d = {
+      user = "minecraft";
+      mode = "0750";
+    };
+    "${dataDir}/server".d = {
+      user = "minecraft";
+      mode = "0700";
+    };
+    "${dataDir}/server/control".d = {
+      user = "minecraft";
+      mode = "0700";
+    };
+    "${dataDir}/proxy".d = {
+      user = "minecraft";
+      mode = "0700";
+    };
+    "${dataDir}/web".d = {
+      user = "minecraft";
+      mode = "0750";
+    };
+  };
+
+  environment.systemPackages = [
+    minecraft-attach
+  ];
+
+  services.phpfpm.pools.dynmap = {
+    user = "nginx";
+    group = "nginx";
+    phpPackage = pkgs.php82;
+    phpOptions = ''
+      error_log = 'stderr'
+      log_errors = on
+    '';
+    settings = {
+      "listen.owner" = "nginx";
+      "listen.group" = "nginx";
+      "listen.mode" = "0660";
+      "pm" = "dynamic";
+      "pm.max_children" = 75;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 1;
+      "pm.max_spare_servers" = 20;
+      "pm.max_requests" = 500;
+      "catch_workers_output" = true;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedSetup = false;
+    virtualHosts.${minecraftDomain} = {
+      root = "${dataDir}/web/dynmap";
+      locations."~ \\.php$".extraConfig = ''
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:${config.services.phpfpm.pools.dynmap.socket};
+        include ${config.services.nginx.package}/conf/fastcgi.conf;
+        include ${config.services.nginx.package}/conf/fastcgi_params;
+      '';
+    };
+  };
+}

hosts/sire/guests/minecraft/proxy/plugins/vane-velocity/config.toml

@@ -0,0 +1,20 @@
+[auth_multiplex.1]
+port = 25566
+allowed_uuids = [] # anyone may use this multiplexer
+
+[managed_servers.server]
+display_name = "§6◊ §6§lTOHLSTE SERVER§6 ◊"
+
+[managed_servers.server.online]
+favicon = "./server-icon.png"
+motd = "{SERVER_DISPLAY_NAME}\n§a\\(^-^)/§7 | {QUOTE}"
+quotes = ["Shit da ist wer, du verpasst was"]
+
+[managed_servers.server.offline]
+quotes = ["Keiner da, join endlich"]
+motd = "{SERVER_DISPLAY_NAME}\n§c~(°·°)~§7 | {QUOTE}"
+
+[managed_servers.server.start]
+cmd = ["rm", "../{SERVER}/control/start.block"]
+kick_msg = "{SERVER_DISPLAY_NAME} §7wird gestartet.\n§7Jetzt WARTE DOCH EINFACH §b10 Sekunden§7 GRRRR"
+allow_anyone = true

hosts/sire/guests/minecraft/proxy/velocity.toml

@@ -0,0 +1,147 @@
+# Config version. Do not change this
+config-version = "2.7"
+
+# What port should the proxy be bound to?
+bind = "0.0.0.0:25565"
+
+# What should be the MOTD? This gets displayed when the player adds your server to
+# their server list. Only MiniMessage format is accepted.
+motd = "<#09add3>A Velocity Server"
+
+# What should we display for the maximum number of players? (Velocity does not support a cap
+# on the number of players online.)
+show-max-players = 6666
+
+# Should we authenticate players with Mojang? By default, this is on.
+online-mode = true
+
+# Should the proxy enforce the new public key security standard? By default, this is on.
+force-key-authentication = true
+
+# If client's ISP/AS sent from this proxy is different from the one from Mojang's
+# authentication server, the player is kicked. This disallows some VPN and proxy
+# connections but is a weak form of protection.
+prevent-client-proxy-connections = false
+
+# Should we forward IP addresses and other data to backend servers?
+# Available options:
+# - "none":        No forwarding will be done. All players will appear to be connecting
+#                  from the proxy and will have offline-mode UUIDs.
+# - "legacy":      Forward player IPs and UUIDs in a BungeeCord-compatible format. Use this
+#                  if you run servers using Minecraft 1.12 or lower.
+# - "bungeeguard": Forward player IPs and UUIDs in a format supported by the BungeeGuard
+#                  plugin. Use this if you run servers using Minecraft 1.12 or lower, and are
+#                  unable to implement network level firewalling (on a shared host).
+# - "modern":      Forward player IPs and UUIDs as part of the login process using
+#                  Velocity's native forwarding. Only applicable for Minecraft 1.13 or higher.
+player-info-forwarding-mode = "modern"
+
+# If you are using modern or BungeeGuard IP forwarding, configure a file that contains a unique secret here.
+# The file is expected to be UTF-8 encoded and not empty.
+forwarding-secret-file = "forwarding.secret"
+
+# Announce whether or not your server supports Forge. If you run a modded server, we
+# suggest turning this on.
+#
+# If your network runs one modpack consistently, consider using ping-passthrough = "mods"
+# instead for a nicer display in the server list.
+announce-forge = false
+
+# If enabled (default is false) and the proxy is in online mode, Velocity will kick
+# any existing player who is online if a duplicate connection attempt is made.
+kick-existing-players = false
+
+# Should Velocity pass server list ping requests to a backend server?
+# Available options:
+# - "disabled":    No pass-through will be done. The velocity.toml and server-icon.png
+#                  will determine the initial server list ping response.
+# - "mods":        Passes only the mod list from your backend server into the response.
+#                  The first server in your try list (or forced host) with a mod list will be
+#                  used. If no backend servers can be contacted, Velocity won't display any
+#                  mod information.
+# - "description": Uses the description and mod list from the backend server. The first
+#                  server in the try (or forced host) list that responds is used for the
+#                  description and mod list.
+# - "all":         Uses the backend server's response as the proxy response. The Velocity
+#                  configuration is used if no servers could be contacted.
+ping-passthrough = "DISABLED"
+
+# If not enabled (default is true) player IP addresses will be replaced by <ip address withheld> in logs
+enable-player-address-logging = true
+
+[servers]
+# Configure your servers here. Each key represents the server's name, and the value
+# represents the IP address of the server to connect to.
+server = "127.0.0.1:25501"
+
+# In what order we shoulid try servers when a player logs in or is kicked from a server.
+try = [
+    "server"
+]
+
+[forced-hosts]
+
+[advanced]
+# How large a Minecraft packet has to be before we compress it. Setting this to zero will
+# compress all packets, and setting it to -1 will disable compression entirely.
+compression-threshold = 256
+
+# How much compression should be done (from 0-9). The default is -1, which uses the
+# default level of 6.
+compression-level = -1
+
+# How fast (in milliseconds) are clients allowed to connect after the last connection? By
+# default, this is three seconds. Disable this by setting this to 0.
+login-ratelimit = 3000
+
+# Specify a custom timeout for connection timeouts here. The default is five seconds.
+connection-timeout = 5000
+
+# Specify a read timeout for connections here. The default is 30 seconds.
+read-timeout = 30000
+
+# Enables compatibility with HAProxy's PROXY protocol. If you don't know what this is for, then
+# don't enable it.
+haproxy-protocol = false
+
+# Enables TCP fast open support on the proxy. Requires the proxy to run on Linux.
+tcp-fast-open = false
+
+# Enables BungeeCord plugin messaging channel support on Velocity.
+bungee-plugin-message-channel = true
+
+# Shows ping requests to the proxy from clients.
+show-ping-requests = true
+
+# By default, Velocity will attempt to gracefully handle situations where the user unexpectedly
+# loses connection to the server without an explicit disconnect message by attempting to fall the
+# user back, except in the case of read timeouts. BungeeCord will disconnect the user instead. You
+# can disable this setting to use the BungeeCord behavior.
+failover-on-unexpected-server-disconnect = true
+
+# Declares the proxy commands to 1.13+ clients.
+announce-proxy-commands = true
+
+# Enables the logging of commands
+log-command-executions = false
+
+# Enables logging of player connections when connecting to the proxy, switching servers
+# and disconnecting from the proxy.
+log-player-connections = true
+
+# Allows players transferred from other hosts via the
+# Transfer packet (Minecraft 1.20.5) to be received.
+accepts-transfers = false
+
+[query]
+# Whether to enable responding to GameSpy 4 query responses or not.
+enabled = false
+
+# If query is enabled, on what port should the query protocol listen on?
+port = 25577
+
+# This is the map name that is reported to the query services.
+map = "Velocity"
+
+# Whether plugins should be shown in query response by default or not
+show-plugins = false

hosts/sire/guests/minecraft/server-loop.py

@@ -0,0 +1,98 @@
+import os
+import signal
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+def exit_usage():
+    print(f"usage: {sys.argv[0]} [--block blockfile] COMMAND... [:POST: POST_SCRIPT...]")
+    sys.exit(1)
+
+def main():
+    if len(sys.argv) < 2:
+        exit_usage()
+
+    blockfile = None
+    if sys.argv[1] == "--block":
+        if len(sys.argv) < 4:
+            exit_usage()
+
+        blockfile = Path(sys.argv[2])
+        cmd = sys.argv[3:]
+    else:
+        cmd = sys.argv[1:]
+
+    # Split cmd and post-cmd
+    post = None
+    try:
+        separator = cmd.index(":POST:")
+        post = cmd[separator + 1:]
+        cmd = cmd[:separator]
+    except ValueError:
+        pass
+
+    # Global state
+    shared_data = {
+        "stop": False,
+        "process": None,
+    }
+
+    def block_start():
+        if not blockfile:
+            return
+        print(f"Blocking on {blockfile}")
+        blockfile.touch()
+        while blockfile.exists() and not shared_data["stop"]:
+            time.sleep(.5)
+
+    def run_server():
+        if shared_data["stop"]:
+            return
+
+        print(f"Starting process {cmd} ...")
+        start_time = time.time()
+        shared_data["process"] = subprocess.Popen(cmd, preexec_fn=os.setsid)
+        shared_data["process"].wait()
+
+        end_time = time.time()
+        if end_time - start_time < 2:
+            print("Server exited abnormally fast, aborting!")
+            shared_data["stop"] = True
+            return
+
+        shared_data["process"] = None
+
+        # Launch post script
+        if post:
+            print(f"Starting post process {post} ...")
+            subprocess.run(post, preexec_fn=os.setsid)
+
+    def signal_forward(sig, _):
+        if shared_data["process"]:
+            print(f"Passing signal {sig} to child ...")
+            try:
+                shared_data["process"].send_signal(sig)
+            except OSError:
+                pass
+
+    def signal_forward_and_stop(sig, frame):
+        shared_data["stop"] = True
+        signal_forward(sig, frame)
+
+    signal.signal(signal.SIGINT, signal_forward)
+    signal.signal(signal.SIGTERM, signal_forward_and_stop)
+    signal.signal(signal.SIGHUP, signal_forward_and_stop)
+
+    # Run until killed
+    try:
+        while not shared_data["stop"]:
+            block_start()
+            run_server()
+        print("Exiting.")
+    finally:
+        if blockfile and blockfile.exists():
+            blockfile.unlink()
+
+if __name__ == '__main__':
+    main()

hosts/sire/guests/minecraft/server/commands.yml

@@ -0,0 +1,3 @@
+command-block-overrides: []
+ignore-vanilla-permissions: false
+aliases: []

hosts/sire/guests/minecraft/server/config/paper-global.yml

@@ -0,0 +1,141 @@
+# This is the global configuration file for Paper.
+# As you can see, there's a lot to configure. Some options may impact gameplay, so use
+# with caution, and make sure you know what each option does before configuring.
+#
+# If you need help with the configuration or have any questions related to Paper,
+# join us in our Discord or check the docs page.
+#
+# The world configuration options have been moved inside
+# their respective world folder. The files are named paper-world.yml
+#
+# Docs: https://docs.papermc.io/
+# Discord: https://discord.gg/papermc
+# Website: https://papermc.io/
+
+_version: 29
+block-updates:
+  disable-chorus-plant-updates: false
+  disable-mushroom-block-updates: false
+  disable-noteblock-updates: false
+  disable-tripwire-updates: false
+chunk-loading:
+  autoconfig-send-distance: true
+  enable-frustum-priority: false
+  global-max-chunk-load-rate: -1.0
+  global-max-chunk-send-rate: -1.0
+  global-max-concurrent-loads: 500.0
+  max-concurrent-sends: 2
+  min-load-radius: 2
+  player-max-chunk-load-rate: -1.0
+  player-max-concurrent-loads: 20.0
+  target-player-chunk-send-rate: 100.0
+chunk-loading-advanced:
+  auto-config-send-distance: true
+  player-max-concurrent-chunk-generates: 0
+  player-max-concurrent-chunk-loads: 0
+chunk-loading-basic:
+  player-max-chunk-generate-rate: -1.0
+  player-max-chunk-load-rate: 100.0
+  player-max-chunk-send-rate: 75.0
+chunk-system:
+  gen-parallelism: default
+  io-threads: -1
+  worker-threads: -1
+collisions:
+  enable-player-collisions: true
+  send-full-pos-for-hard-colliding-entities: true
+commands:
+  fix-target-selector-tag-completion: true
+  suggest-player-names-when-null-tab-completions: true
+  time-command-affects-all-worlds: false
+console:
+  enable-brigadier-completions: true
+  enable-brigadier-highlighting: true
+  has-all-permissions: false
+item-validation:
+  book:
+    author: 8192
+    page: 16384
+    title: 8192
+  book-size:
+    page-max: 2560
+    total-multiplier: 0.98
+  display-name: 8192
+  lore-line: 8192
+  resolve-selectors-in-books: false
+logging:
+  deobfuscate-stacktraces: true
+messages:
+  kick:
+    authentication-servers-down: <lang:multiplayer.disconnect.authservers_down>
+    connection-throttle: Connection throttled! Please wait before reconnecting.
+    flying-player: <lang:multiplayer.disconnect.flying>
+    flying-vehicle: <lang:multiplayer.disconnect.flying>
+  no-permission: <red>I'm sorry, but you do not have permission to perform this command.
+    Please contact the server administrators if you believe that this is in error.
+  use-display-name-in-quit-message: false
+misc:
+  chat-threads:
+    chat-executor-core-size: -1
+    chat-executor-max-size: -1
+  compression-level: default
+  fix-entity-position-desync: true
+  lag-compensate-block-breaking: true
+  load-permissions-yml-before-plugins: true
+  max-joins-per-tick: 3
+  region-file-cache-size: 256
+  strict-advancement-dimension-check: false
+  use-alternative-luck-formula: false
+  use-dimension-type-for-custom-spawners: false
+packet-limiter:
+  all-packets:
+    action: KICK
+    interval: 7.0
+    max-packet-rate: 500.0
+  kick-message: <red><lang:disconnect.exceeded_packet_rate>
+  overrides:
+    ServerboundPlaceRecipePacket:
+      action: DROP
+      interval: 4.0
+      max-packet-rate: 5.0
+player-auto-save:
+  max-per-tick: -1
+  rate: -1
+proxies:
+  bungee-cord:
+    online-mode: true
+  proxy-protocol: false
+  velocity:
+    enabled: true
+    online-mode: true
+    secret: ''
+scoreboards:
+  save-empty-scoreboard-teams: false
+  track-plugin-scoreboards: false
+spam-limiter:
+  incoming-packet-threshold: 300
+  recipe-spam-increment: 1
+  recipe-spam-limit: 20
+  tab-spam-increment: 1
+  tab-spam-limit: 500
+timings:
+  enabled: true
+  hidden-config-entries:
+  - database
+  - proxies.velocity.secret
+  history-interval: 300
+  history-length: 3600
+  server-name: Unknown Server
+  server-name-privacy: false
+  url: https://timings.aikar.co/
+  verbose: true
+unsupported-settings:
+  allow-grindstone-overstacking: false
+  allow-headless-pistons: true
+  allow-permanent-block-break-exploits: true
+  allow-piston-duplication: true
+  compression-format: ZLIB
+  perform-username-validation: true
+watchdog:
+  early-warning-delay: 10000
+  early-warning-every: 5000

hosts/sire/guests/minecraft/server/config/paper-world-defaults.yml

@@ -0,0 +1,301 @@
+# This is the world defaults configuration file for Paper.
+# As you can see, there's a lot to configure. Some options may impact gameplay, so use
+# with caution, and make sure you know what each option does before configuring.
+# 
+# If you need help with the configuration or have any questions related to Paper,
+# join us in our Discord or check the docs page.
+# 
+# Configuration options here apply to all worlds, unless you specify overrides inside
+# the world-specific config file inside each world folder.
+# 
+# Docs: https://docs.papermc.io/
+# Discord: https://discord.gg/papermc
+# Website: https://papermc.io/
+
+_version: 30
+anticheat:
+  anti-xray:
+    enabled: true
+    engine-mode: 1
+    hidden-blocks:
+    - copper_ore
+    - deepslate_copper_ore
+    - gold_ore
+    - deepslate_gold_ore
+    - iron_ore
+    - deepslate_iron_ore
+    - coal_ore
+    - deepslate_coal_ore
+    - lapis_ore
+    - deepslate_lapis_ore
+    - mossy_cobblestone
+    - obsidian
+    - chest
+    - diamond_ore
+    - deepslate_diamond_ore
+    - redstone_ore
+    - deepslate_redstone_ore
+    - clay
+    - emerald_ore
+    - deepslate_emerald_ore
+    - ender_chest
+    lava-obscures: false
+    max-block-height: 64
+    replacement-blocks:
+    - stone
+    - oak_planks
+    - deepslate
+    update-radius: 2
+    use-permission: false
+  obfuscation:
+    items:
+      hide-durability: false
+      hide-itemmeta: false
+      hide-itemmeta-with-visual-effects: false
+chunks:
+  auto-save-interval: default
+  delay-chunk-unloads-by: 10s
+  entity-per-chunk-save-limit:
+    arrow: -1
+    ender_pearl: -1
+    experience_orb: -1
+    fireball: -1
+    small_fireball: -1
+    snowball: -1
+  fixed-chunk-inhabited-time: -1
+  flush-regions-on-save: false
+  max-auto-save-chunks-per-tick: 24
+  prevent-moving-into-unloaded-chunks: false
+collisions:
+  allow-player-cramming-damage: false
+  allow-vehicle-collisions: true
+  fix-climbing-bypassing-cramming-rule: false
+  max-entity-collisions: 8
+  only-players-collide: false
+entities:
+  armor-stands:
+    do-collision-entity-lookups: true
+    tick: true
+  behavior:
+    allow-spider-world-border-climbing: true
+    baby-zombie-movement-modifier: 0.5
+    disable-chest-cat-detection: false
+    disable-creeper-lingering-effect: false
+    disable-player-crits: false
+    door-breaking-difficulty:
+      husk:
+      - HARD
+      vindicator:
+      - NORMAL
+      - HARD
+      zombie:
+      - HARD
+      zombie_villager:
+      - HARD
+      zombified_piglin:
+      - HARD
+    ender-dragons-death-always-places-dragon-egg: false
+    experience-merge-max-value: -1
+    mobs-can-always-pick-up-loot:
+      skeletons: false
+      zombies: false
+    nerf-pigmen-from-nether-portals: false
+    parrots-are-unaffected-by-player-movement: false
+    phantoms-do-not-spawn-on-creative-players: true
+    phantoms-only-attack-insomniacs: true
+    phantoms-spawn-attempt-max-seconds: 119
+    phantoms-spawn-attempt-min-seconds: 60
+    piglins-guard-chests: true
+    pillager-patrols:
+      disable: false
+      spawn-chance: 0.2
+      spawn-delay:
+        per-player: false
+        ticks: 12000
+      start:
+        day: 5
+        per-player: false
+    player-insomnia-start-ticks: 72000
+    should-remove-dragon: false
+    spawner-nerfed-mobs-should-jump: false
+    zombie-villager-infection-chance: default
+    zombies-target-turtle-eggs: true
+  entities-target-with-follow-range: false
+  markers:
+    tick: true
+  mob-effects:
+    immune-to-wither-effect:
+      wither: true
+      wither-skeleton: true
+    spiders-immune-to-poison-effect: true
+    undead-immune-to-certain-effects: true
+  sniffer:
+    boosted-hatch-time: default
+    hatch-time: default
+  spawning:
+    all-chunks-are-slime-chunks: false
+    alt-item-despawn-rate:
+      enabled: false
+      items:
+        cobblestone: 300
+    count-all-mobs-for-spawning: false
+    creative-arrow-despawn-rate: default
+    despawn-ranges:
+      ambient:
+        hard: 128
+        soft: 32
+      axolotls:
+        hard: 128
+        soft: 32
+      creature:
+        hard: 128
+        soft: 32
+      misc:
+        hard: 128
+        soft: 32
+      monster:
+        hard: 128
+        soft: 32
+      underground_water_creature:
+        hard: 128
+        soft: 32
+      water_ambient:
+        hard: 64
+        soft: 32
+      water_creature:
+        hard: 128
+        soft: 32
+    disable-mob-spawner-spawn-egg-transformation: false
+    duplicate-uuid:
+      mode: SAFE_REGEN
+      safe-regen-delete-range: 32
+    filter-bad-tile-entity-nbt-from-falling-blocks: true
+    filtered-entity-tag-nbt-paths:
+    - Pos
+    - Motion
+    - SleepingX
+    - SleepingY
+    - SleepingZ
+    iron-golems-can-spawn-in-air: false
+    monster-spawn-max-light-level: default
+    non-player-arrow-despawn-rate: default
+    per-player-mob-spawns: true
+    scan-for-legacy-ender-dragon: true
+    skeleton-horse-thunder-spawn-chance: default
+    slime-spawn-height:
+      slime-chunk:
+        maximum: 40.0
+      surface-biome:
+        maximum: 70.0
+        minimum: 50.0
+    spawn-limits:
+      ambient: -1
+      axolotls: -1
+      creature: -1
+      monster: -1
+      underground_water_creature: -1
+      water_ambient: -1
+      water_creature: -1
+    wandering-trader:
+      spawn-chance-failure-increment: 25
+      spawn-chance-max: 75
+      spawn-chance-min: 25
+      spawn-day-length: 24000
+      spawn-minute-length: 1200
+    wateranimal-spawn-height:
+      maximum: default
+      minimum: default
+  tracking-range-y:
+    animal: default
+    display: default
+    enabled: false
+    misc: default
+    monster: default
+    other: default
+    player: default
+environment:
+  disable-explosion-knockback: false
+  disable-ice-and-snow: false
+  disable-teleportation-suffocation-check: false
+  disable-thunder: false
+  fire-tick-delay: 30
+  frosted-ice:
+    delay:
+      max: 40
+      min: 20
+    enabled: true
+  generate-flat-bedrock: false
+  nether-ceiling-void-damage-height: disabled
+  optimize-explosions: false
+  portal-create-radius: 16
+  portal-search-radius: 128
+  portal-search-vanilla-dimension-scaling: true
+  treasure-maps:
+    enabled: true
+    find-already-discovered:
+      loot-tables: default
+      villager-trade: false
+  water-over-lava-flow-speed: 5
+feature-seeds:
+  generate-random-seeds-for-all: false
+fishing-time-range:
+  maximum: 600
+  minimum: 100
+fixes:
+  disable-unloaded-chunk-enderpearl-exploit: false
+  falling-block-height-nerf: disabled
+  fix-curing-zombie-villager-discount-exploit: true
+  fix-items-merging-through-walls: false
+  prevent-tnt-from-moving-in-water: false
+  split-overstacked-loot: true
+  tnt-entity-height-nerf: disabled
+hopper:
+  cooldown-when-full: true
+  disable-move-event: true
+  ignore-occluding-blocks: false
+lootables:
+  auto-replenish: true
+  max-refills: -1
+  refresh-max: 2d
+  refresh-min: 12h
+  reset-seed-on-fill: true
+  restrict-player-reloot: true
+  restrict-player-reloot-time: 2d
+maps:
+  item-frame-cursor-limit: 128
+  item-frame-cursor-update-interval: 10
+max-growth-height:
+  bamboo:
+    max: 16
+    min: 11
+  cactus: 3
+  reeds: 3
+misc:
+  disable-end-credits: false
+  disable-relative-projectile-velocity: false
+  disable-sprint-interruption-on-attack: false
+  light-queue-size: 20
+  max-leash-distance: 10.0
+  redstone-implementation: VANILLA
+  shield-blocking-delay: 5
+  show-sign-click-command-failure-msgs-to-player: false
+  update-pathfinding-on-block-update: true
+scoreboards:
+  allow-non-player-entities-on-scoreboards: false
+  use-vanilla-world-scoreboard-name-coloring: false
+spawn:
+  allow-using-signs-inside-spawn-protection: false
+  keep-spawn-loaded: true
+  keep-spawn-loaded-range: 10
+tick-rates:
+  behavior:
+    villager:
+      validatenearbypoi: -1
+  container-update: 1
+  grass-spread: 1
+  mob-spawner: 1
+  sensor:
+    villager:
+      secondarypoisensor: 40
+unsupported-settings:
+  fix-invulnerable-end-crystal-exploit: true

hosts/sire/guests/minecraft/server/eula.txt

@@ -0,0 +1 @@
+eula=true

hosts/sire/guests/minecraft/server/server.properties

@@ -0,0 +1,58 @@
+allow-flight=false
+allow-nether=true
+broadcast-console-to-ops=true
+broadcast-rcon-to-ops=true
+debug=false
+difficulty=hard
+enable-command-block=false
+enable-jmx-monitoring=false
+enable-query=false
+enable-rcon=false
+enable-status=true
+enforce-secure-profile=false
+enforce-whitelist=true
+entity-broadcast-range-percentage=500
+force-gamemode=false
+function-permission-level=2
+gamemode=survival
+generate-structures=true
+generator-settings={}
+hardcore=false
+hide-online-players=false
+initial-disabled-packs=
+initial-enabled-packs=vanilla
+level-name=world
+level-seed=-2875792302555269470
+level-type=minecraft\:normal
+log-ips=true
+max-chained-neighbor-updates=1000000
+max-players=6666
+max-tick-time=60000
+max-world-size=29999984
+motd=
+network-compression-threshold=256
+online-mode=false
+op-permission-level=4
+player-idle-timeout=0
+prevent-proxy-connections=false
+pvp=true
+query.port=25501
+rate-limit=0
+rcon.password=
+rcon.port=25575
+require-resource-pack=false
+resource-pack-prompt=
+resource-pack-sha1=
+resource-pack=
+server-ip=
+server-port=25501
+simulation-distance=10
+spawn-animals=true
+spawn-monsters=true
+spawn-npcs=true
+spawn-protection=0
+sync-chunk-writes=true
+text-filtering-config=
+use-native-transport=true
+view-distance=15
+white-list=false

hosts/sire/guests/minecraft/server/spigot.yml

@@ -0,0 +1,177 @@
+# This is the main configuration file for Spigot.
+# As you can see, there's tons to configure. Some options may impact gameplay, so use
+# with caution, and make sure you know what each option does before configuring.
+# For a reference for any variable inside this file, check out the Spigot wiki at
+# http://www.spigotmc.org/wiki/spigot-configuration/
+#
+# If you need help with the configuration or have any questions related to Spigot,
+# join us at the Discord or drop by our forums and leave a post.
+#
+# Discord: https://www.spigotmc.org/go/discord
+# Forums: http://www.spigotmc.org/
+
+messages:
+  whitelist: You are not whitelisted on this server!
+  unknown-command: Unknown command. Type "/help" for help.
+  server-full: The server is full!
+  outdated-client: Outdated client! Please use {0}
+  outdated-server: Outdated server! I'm still on {0}
+  restart: Server is restarting
+commands:
+  spam-exclusions:
+  - /skill
+  silent-commandblock-console: false
+  replace-commands:
+  - setblock
+  - summon
+  - testforblock
+  - tellraw
+  log: true
+  tab-complete: 0
+  send-namespaced: true
+players:
+  disable-saving: false
+advancements:
+  disable-saving: false
+  disabled:
+  - minecraft:story/disabled
+config-version: 12
+settings:
+  debug: false
+  sample-count: 12
+  player-shuffle: 0
+  user-cache-size: 1000
+  save-user-cache-on-stop-only: false
+  netty-threads: 4
+  attribute:
+    maxHealth:
+      max: 2048.0
+    movementSpeed:
+      max: 2048.0
+    attackDamage:
+      max: 2048.0
+  log-villager-deaths: true
+  log-named-deaths: true
+  timeout-time: 60
+  bungeecord: false
+  moved-too-quickly-multiplier: 100.0
+  moved-wrongly-threshold: 1.625
+  restart-on-crash: false
+  restart-script: invalid
+world-settings:
+  default:
+    seed-ancientcity: 20083232
+    seed-trailruins: 83469867
+    seed-buriedtreasure: 10387320
+    seed-mineshaft: default
+    below-zero-generation-in-existing-chunks: true
+    view-distance: default
+    simulation-distance: default
+    thunder-chance: 100000
+    item-despawn-rate: 6000
+    enable-zombie-pigmen-portal-spawns: true
+    hanging-tick-frequency: 100
+    arrow-despawn-rate: 1200
+    trident-despawn-rate: 1200
+    zombie-aggressive-towards-villager: true
+    nerf-spawner-mobs: false
+    mob-spawn-range: 8
+    entity-activation-range:
+      animals: 32
+      monsters: 32
+      raiders: 48
+      misc: 16
+      water: 16
+      villagers: 32
+      flying-monsters: 32
+      wake-up-inactive:
+        animals-max-per-tick: 4
+        animals-every: 1200
+        animals-for: 100
+        monsters-max-per-tick: 8
+        monsters-every: 400
+        monsters-for: 100
+        villagers-max-per-tick: 4
+        villagers-every: 600
+        villagers-for: 100
+        flying-monsters-max-per-tick: 8
+        flying-monsters-every: 200
+        flying-monsters-for: 100
+      villagers-work-immunity-after: 100
+      villagers-work-immunity-for: 20
+      villagers-active-for-panic: true
+      tick-inactive-villagers: true
+      ignore-spectators: false
+    ticks-per:
+      hopper-transfer: 8
+      hopper-check: 1
+    hopper-amount: 1
+    hopper-can-load-chunks: false
+    seed-village: 10387312
+    seed-desert: 14357617
+    seed-igloo: 14357618
+    seed-jungle: 14357619
+    seed-swamp: 14357620
+    seed-monument: 10387313
+    seed-shipwreck: 165745295
+    seed-ocean: 14357621
+    seed-outpost: 165745296
+    seed-endcity: 10387313
+    seed-slime: 987234911
+    seed-nether: 30084232
+    seed-mansion: 10387319
+    seed-fossil: 14357921
+    seed-portal: 34222645
+    seed-stronghold: default
+    hunger:
+      jump-walk-exhaustion: 0.05
+      jump-sprint-exhaustion: 0.2
+      combat-exhaustion: 0.1
+      regen-exhaustion: 6.0
+      swim-multiplier: 0.01
+      sprint-multiplier: 0.1
+      other-multiplier: 0.0
+    max-tnt-per-tick: 100
+    max-tick-time:
+      tile: 50
+      entity: 50
+    growth:
+      torchflower-modifier: 100
+      pitcherplant-modifier: 100
+      cactus-modifier: 100
+      cane-modifier: 100
+      melon-modifier: 100
+      mushroom-modifier: 100
+      pumpkin-modifier: 100
+      sapling-modifier: 100
+      beetroot-modifier: 100
+      carrot-modifier: 100
+      potato-modifier: 100
+      wheat-modifier: 100
+      netherwart-modifier: 100
+      vine-modifier: 100
+      cocoa-modifier: 100
+      bamboo-modifier: 100
+      sweetberry-modifier: 100
+      kelp-modifier: 100
+      twistingvines-modifier: 100
+      weepingvines-modifier: 100
+      cavevines-modifier: 100
+      glowberry-modifier: 100
+    verbose: false
+    dragon-death-sound-radius: 256
+    end-portal-sound-radius: 256
+    entity-tracking-range:
+      display: 128
+      animals: 512
+      misc: 512
+      monsters: 512
+      other: 512
+      players: 512
+    merge-radius:
+      exp: 0.2
+      item: 0.2
+    wither-spawn-sound-radius: 256
+stats:
+  disable-saving: false
+  forced-stats: {}

hosts/sire/secrets/minecraft/host.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJP6UQlWBR5TJdTYX3kKY/xtK+cg5jYGHVGuIQRTljNr

modules/config/users.nix

@@ -31,5 +31,6 @@
     radicale = uidGid 978;
     podman = uidGid 977;
     maddy = uidGid 976;
+    minecraft = uidGid 975;
   };
 }

secrets/generated/sire-minecraft/promtail-loki-basic-auth-password.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 aQjrKYupwdP3ZRQ5CGPjUAKSHMLtORyiuGsaRncR2lM
+OCClqe+ZHtMYfJh9iFRyUqsH2BIlk0j1r7K5fvMXJA0
+-> piv-p256 xqSe8Q AiZpiAPglrnrlNJryl5Ip+9cBptSURYsPSfA5IAVqHCd
+WaVxAp7tawNUPiktBz0aPO9Ll+tghAMDxtgnaNOCtlI
+-> Ub-*?-grease K*@{c0 YxDp0sq] LV
+kfROcHQ/f0n7if1p
+--- aPArSUTgMQ/xJ420wrjn0NtJwJkLJ3kT6+xqJdSSiGw
+U?Þ4âLÿÙsîm·‹îòÐ;,î|ý±/çt|ÙBJ;­ì±¶”£‚ämÑE‚ð;ç¶�Ö$ï6`pÃäÖ:h«`Ä
þäñz0ªÝ;8‰›

secrets/generated/sire-minecraft/telegraf-influxdb-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 x5/bA4HrnKggVAN0K+cfzw6UQy8rB0sl5AOnwzaPRBY
+9rgAVY2kd+VCCgO9szVMRQuP8BMk154FloMzYKKKa74
+-> piv-p256 xqSe8Q AivGC/2AIFT1OSVeK5WxwAPiO0XUwEU7svEN1aTmXb+W
+lUeg0c+Xb5IBNGgnFI86QnWxm8MRMHcf7pI31a9CGAs
+-> jP-1|[-grease gE9e`wh ~e4T
+vOxm1KfYqngWw9tmeefdahx8XZt5az+10l11taSxvTqDvLWV6jNaKYJWee5rdlvs
+Ums
+--- KBHKuTOO72icRzyKfIdNaXJZX+qK0cqx8q7zI3KmJ50
+�JÈç}¨æ¼<\„\Ìût¤¢CK‹“+n„®ú©;JÆA³À©ÒAè‘¡«åî~^­¨Š�™­7½`Ï=‚©ðµe¨QE=Ò”}±§](

secrets/rekeyed/sentinel/f973eacada1ad30cb150ddfa4ad7a103-wireguard-proxy-sentinel-psks-sentinel+sire-minecraft.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA NXYIgippKhPrzMqLWOUPGO5oO4uLE1UqQGpP9DOXI20
+tzVLO2RqfmqYBbcwFQdLlEkDjk6MbyDVuYB+ZiK4/Dg
+-> dL:_2b-grease d]m?$_
+TAE/woDI9wQv3Ua5zHtChHiZI4Cpo9KBfknw4Y31bG93Vx1Ja8cDWtYT4PWEoQ
+--- bbm63a4+OotXMscEG/zCLhezcBC9vMIW8hFBJGNmVG4
+÷Þ·5Éæ±tÏáŸþâjâà‡¡å›ÏoXÀMSoüo£ Qæô»É_×™e.„P5Uû±P	×€æa�H½³®OÑ/‹gD¼­ª°{%¬l

secrets/rekeyed/sire-influxdb/907a5127872f2d5ed17397ae7e5618e9-telegraf-influxdb-token-sire-minecraft.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 1tdZKQ i4zgh2rbHN27RAiYDPfZFlm+RTaim64AnBf2AKfpuVw
+vp6RP8VMfKAWc9rUlP/ep4mKYoLw2nQ9R7OMVBzDo1A
+-> ]-grease <pY`!2 Tfl
+zyk
+--- 3uxINjl1OJz3nbd7KCTxjUF16EPb43rqgb/hgfTqDmk
+*%-laJ‚Ì|_Q
o0±�öpeÜ“~øìÄà‚‰P;õš3ÌÿØ1”P{8“±]oïÝǼ™ªT^@®QeK%ôaÝen°fÕc2

secrets/rekeyed/sire-minecraft/203afde61a5638a595540fbac5388537-telegraf-influxdb-token.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 EHTwGA 06ycNL+Y739oburNHJzo5ywa0V8Ofimhu9iZ7CAKDGE
+dy/PLFFK79V+1u8+wWJtfXWJFetNxvtZDJCX2j2znUs
+-> %8r-grease ez<>. zl:dK }b
+uWiVXwUfxrnSuwrpnAQE92KJq0tGCWzzBV+1EW433+B+wKjByyYytk4
+--- B4qZoqEKJPzegmawmpM2EQWyQCp1jbbuSYSCA71GiNs
+UsMBRãù_5RlÕÍŽ^’y¨É6ÒÓRˆ…öˆhTÚ󑳟b9 ‡�ck@o£�³xb*¹kî>tgÏ�“´gzûèe¸ç‹‚š™2WóZ

secrets/rekeyed/sire-minecraft/39e8d6574c2824dc6c52682655f18883-wireguard-proxy-sentinel-psks-sentinel+sire-minecraft.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 EHTwGA 1thFrqBMJqFLx0rw9esixG2zHYDUrV2aU7bYEplqowU
+4TwJrEQutZtLQwLD8KsNpVjD8xi20Cz9tBaZ4dwemqQ
+-> 1R-grease L=
+EiCjHuBgJOHUwb/uPAgOpG+y//MwEnE9A2eiQEcFKmBrYC67
+--- 2DOGVZ7I5GOYq+oV3SsOoYvxTNz7h8Z85LNsbHB7Jlc
+÷:Î*R�aÓn<êŇÙÊ�;̹~>ûL¯ÜÁEo$c�IB<݆6-o	�³Ìx(9mîÍ}4ÿƒü¾N\MþÆØ~Wø 

secrets/rekeyed/sire-minecraft/3b83e611fe6200989b9a624b8ef1b7aa-promtail-loki-basic-auth-password.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 EHTwGA COUzHGv3rhlJSURpTKSRIHqWNJIS73QB69hU3VaqszQ
+Wf7I9i8ZAI41WwwNynifG8GbUOLpoKijXkKeDQUKkjg
+-> mF[PF\-grease 'Ky1)Zkz
+JzjDcH0GLbxCZblzV7NeUW+MTUaLWQVY92knFxUetfPsnTpARsXYkIL12s+o47dm
+MHHTlB8ExD7RNynV6r/Do6UM9uNwsmwm/US8FvWTagAWbBWkocRZWh93Zw
+--- 822p/9l00Tv4a8veTfbZ2RbE7bnUBFzZVtpkeEa3hsw
+8Ñuµ7[ПȺ3õÅ)xDZ&í}r+Éê=<\•��ëGp7tÍ÷&>嵃ÞÄ|ûEm65k£±¢\\ž}Îí”êÀ’ëåѺG‚D‰Á_£

secrets/rekeyed/sire-minecraft/e1458d710b93b5ca98cba8ce4189e0ce-wireguard-proxy-sentinel-priv-sire-minecraft.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 EHTwGA z6epbutC22AqPSf6A+vImf5qXZMjzB1uNeUBVyYw+QY
+Wi1H1lSv1RMejpAb2A/rzqoiP1UUPVZYcx7Goh11Q1U
+-> \D$V-grease x}66D4G 2p
+s55x54FNeQhwesaZSGC5Og7TjQnwKXcSZGfrdANZF4uH469yPpotSq8HrPJK7JQv
+IbNXdGvVmoCmOwA1GaIXyxdRF8YgfJPcD31eXcDMuMVMbE0dkfbB50JcxR62Zktr
+
+--- 36CMRrlw9MR/jT52W+aqYp+fxw9okj9DYd+M+8eOCkA
+G‘ÜX �2Ò¡A˜d7¦æ½nÅ]É£}à]DÊ´>»¯²xüÜ_ϳñjžˆa©UÓ;:ÌIé�†UUegñÓš

secrets/wireguard/proxy-sentinel/keys/sire-minecraft.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 wD5BhJW5KI5lq37lSsED9RyDQpN3ELX6ZPh5esbVg0o
+r2h5o7gstcKAFUkbeJr6uj7Q7V7rqp87v7cReHxFwYk
+-> piv-p256 xqSe8Q AnymuZMQPqM6bSqYWE2Ju1DfFqs46xMw/lho4dSSYZ0I
+G3HUR7lINgXIhi90rJ8i6fXAhllemz2U8OtVEmS2tkw
+-> c,k.48-grease $j NDwlv8 ~Y5q!7c
+xmG2lEJzTEpc6lIokN34y/Ox
+--- /8ksWoOq9mJr2aMXhE7DZxrvcSY3mxlo/grXt0Ck8Zs
+ã ±mûÒœ“òÚŠÝ^wà—¢¢¶(Z©Xæü€Ù™½;1x¹×ZÏ‚…�ÔPghæk̛ߧÌÒ„β>ã¾»ž¸þ´>

secrets/wireguard/proxy-sentinel/keys/sire-minecraft.pub

@@ -0,0 +1 @@
+yMAdUPnWvTDhvnGJTtZSG+pKT1DiiXWQFRc2iX6MYxI=

secrets/wireguard/proxy-sentinel/psks/sentinel+sire-minecraft.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 Z4+MWhcHpN7ZlcH/zUeIgdsKyuSrwqYv/F3tubuwz1o
+lLonaLVVbwW9nBIzbpiRQk+NzJT8Z3lARLq11btOlrk
+-> piv-p256 xqSe8Q A5/OxbbTKTTwI1+X++UMNtcdQUxWevaXvF3uYz1Q9rK5
++AqIBxSm5t+v3wi3cgxtxIHFIqXR39Bn3HGdaGpD+e4
+-> ,Td.O-grease jebr}f[ lq.5 7Q;f%P s2
++/w
+--- jmueBY0AA9hP0eUaxLCZmIwAdIFFgicIX3vih1hEbso
+Ýyø=¦øן_p¤¬¼jh@âÂïþòÍܤs*¯,‹ä$!õɇ2	ê  K\¨­
z¨q˜Ûq1A¹Dkxç';²DdÛWgjÉ‹