This commit is contained in:
@@ -0,0 +1,312 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkOption types;
|
||||
|
||||
cfg = config.services.minecraft-world-imports;
|
||||
enabledImports = lib.filterAttrs (_: import: import.enable) cfg;
|
||||
dataDir = config.services.minecraft-servers.dataDir;
|
||||
minecraftServers = config.services.minecraft-servers.servers;
|
||||
targetPairs = lib.mapAttrsToList (_: import:
|
||||
"${import.serverName}:${import.worldName}") enabledImports;
|
||||
|
||||
importerUser = name: let
|
||||
descriptiveName = "minecraft-map-import-${name}";
|
||||
in
|
||||
if builtins.stringLength descriptiveName <= 31
|
||||
then descriptiveName
|
||||
else "mc-import-${builtins.substring 0 12 (builtins.hashString "sha256" name)}";
|
||||
|
||||
stateDirectory = cacheDir:
|
||||
if lib.hasPrefix "/var/lib/" cacheDir
|
||||
then lib.removePrefix "/var/lib/" cacheDir
|
||||
else null;
|
||||
|
||||
stateDirectoryCompatible = cacheDir: let
|
||||
relative = stateDirectory cacheDir;
|
||||
components = lib.splitString "/" (if relative == null then "" else relative);
|
||||
in
|
||||
relative != null
|
||||
&& relative != ""
|
||||
&& lib.all (component: component != "" && component != "." && component != "..") components;
|
||||
|
||||
escapeSftp = value:
|
||||
"\"${lib.replaceStrings ["\\" "\""] ["\\\\" "\\\""] value}\"";
|
||||
|
||||
escapeTmpfiles = value:
|
||||
lib.replaceStrings ["%" " " "\t"] ["%%" "\\x20" "\\x09"] value;
|
||||
|
||||
importerServices = lib.mkMerge (lib.mapAttrsToList (name: import: let
|
||||
user = importerUser name;
|
||||
unitName = "minecraft-world-import-${name}";
|
||||
serverUnit = "minecraft-server-${import.serverName}.service";
|
||||
cacheStateDirectory = stateDirectory import.cacheDir;
|
||||
serverDir = "${dataDir}/${import.serverName}";
|
||||
worldDir = "${serverDir}/${import.worldName}";
|
||||
in {
|
||||
${unitName} = {
|
||||
description = "Import Minecraft world ${name}";
|
||||
before = [ serverUnit ];
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
path = [ pkgs.coreutils pkgs.findutils pkgs.openssh pkgs.unar ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = user;
|
||||
Group = user;
|
||||
RemainAfterExit = true;
|
||||
TimeoutStartSec = import.timeoutStartSec;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
NoNewPrivileges = true;
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
ReadWritePaths = [ import.cacheDir dataDir ];
|
||||
UMask = "0077";
|
||||
} // lib.optionalAttrs (stateDirectoryCompatible import.cacheDir) {
|
||||
StateDirectory = cacheStateDirectory;
|
||||
};
|
||||
script = ''
|
||||
set -eu
|
||||
umask 077
|
||||
|
||||
cache_dir=${lib.escapeShellArg import.cacheDir}
|
||||
server_dir=${lib.escapeShellArg serverDir}
|
||||
world_dir=${lib.escapeShellArg worldDir}
|
||||
archive_name=${lib.escapeShellArg import.archiveName}
|
||||
world_name=${lib.escapeShellArg import.worldName}
|
||||
archive="$cache_dir/$archive_name"
|
||||
temporary_archive="$cache_dir/.$archive_name.$$"
|
||||
extraction_dir="$cache_dir/.minecraft-world-import-${name}.$$"
|
||||
staged_world="$server_dir/.$world_name.import.$$"
|
||||
key=${lib.escapeShellArg import.sshKeyFile}
|
||||
|
||||
cleanup() {
|
||||
rm -f "$temporary_archive"
|
||||
rm -rf "$extraction_dir" "$staged_world"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
mkdir -p "$cache_dir" "$server_dir"
|
||||
chmod 0700 "$cache_dir"
|
||||
chgrp minecraft "$server_dir"
|
||||
chmod 0770 "$server_dir"
|
||||
|
||||
if [ -d "$world_dir" ]; then
|
||||
if [ -f "$world_dir/level.dat" ]; then
|
||||
exit 0
|
||||
fi
|
||||
echo "Minecraft world directory exists but has no level.dat" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$archive" ]; then
|
||||
downloaded=false
|
||||
attempt=1
|
||||
while [ "$attempt" -le ${toString import.downloadRetries} ]; do
|
||||
if sftp \
|
||||
-o BatchMode=yes \
|
||||
-o StrictHostKeyChecking=yes \
|
||||
-o UserKnownHostsFile=/etc/ssh/ssh_known_hosts \
|
||||
-i "$key" \
|
||||
-b - \
|
||||
${lib.escapeShellArg "${import.remoteUser}@${import.remoteHost}"} <<EOF
|
||||
get ${escapeSftp import.remotePath} "$temporary_archive"
|
||||
EOF
|
||||
then
|
||||
downloaded=true
|
||||
break
|
||||
fi
|
||||
rm -f "$temporary_archive"
|
||||
sleep ${toString import.retryDelaySeconds}
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
if [ "$downloaded" != true ]; then
|
||||
echo "Unable to download Minecraft world ${name}" >&2
|
||||
exit 1
|
||||
fi
|
||||
mv "$temporary_archive" "$archive"
|
||||
fi
|
||||
|
||||
if ! printf '%s %s\n' \
|
||||
${lib.escapeShellArg import.archiveSha256} \
|
||||
"$archive" | sha256sum -c -; then
|
||||
rm -f "$archive"
|
||||
echo "Cached Minecraft world ${name} checksum mismatch" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$extraction_dir"
|
||||
unar -quiet -output-directory "$extraction_dir" "$archive"
|
||||
|
||||
find "$extraction_dir" \
|
||||
\( -type l -o -type b -o -type c -o -type p -o -type s \) \
|
||||
-delete
|
||||
|
||||
world_level_dat=$(find "$extraction_dir" -type f -name level.dat -print -quit)
|
||||
if [ -z "$world_level_dat" ]; then
|
||||
echo "Minecraft world archive contains no level.dat" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mv "$(dirname "$world_level_dat")" "$staged_world"
|
||||
chgrp -R minecraft "$staged_world"
|
||||
chmod -R u+rwX,g+rwX,o-rwx "$staged_world"
|
||||
mv "$staged_world" "$world_dir"
|
||||
'';
|
||||
};
|
||||
|
||||
"minecraft-server-${import.serverName}" = {
|
||||
requires = [ "${unitName}.service" ];
|
||||
after = [ "${unitName}.service" ];
|
||||
};
|
||||
}) enabledImports);
|
||||
in {
|
||||
options.services.minecraft-world-imports = mkOption {
|
||||
default = { };
|
||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
||||
options = {
|
||||
enable = lib.mkEnableOption "Minecraft world import ${name}";
|
||||
|
||||
serverName = mkOption {
|
||||
type = types.str;
|
||||
description = "minecraft-servers server receiving imported world";
|
||||
};
|
||||
|
||||
remoteHost = mkOption {
|
||||
type = types.str;
|
||||
description = "SSH host serving world archive";
|
||||
};
|
||||
|
||||
remoteUser = mkOption {
|
||||
type = types.str;
|
||||
description = "SSH user used to download world archive";
|
||||
};
|
||||
|
||||
remotePath = mkOption {
|
||||
type = types.str;
|
||||
description = "Remote path to world archive";
|
||||
};
|
||||
|
||||
archiveName = mkOption {
|
||||
type = types.str;
|
||||
description = "Archive file name inside cache directory";
|
||||
};
|
||||
|
||||
cacheDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/minecraft-world-imports/${name}";
|
||||
description = "Persistent archive cache directory";
|
||||
};
|
||||
|
||||
archiveSha256 = mkOption {
|
||||
type = types.strMatching "[0-9a-fA-F]{64}";
|
||||
description = "Expected SHA-256 digest of world archive";
|
||||
};
|
||||
|
||||
sshKeyFile = mkOption {
|
||||
type = types.str;
|
||||
description = "Runtime path to private SSH key";
|
||||
};
|
||||
|
||||
worldName = mkOption {
|
||||
type = types.str;
|
||||
default = "world";
|
||||
description = "World directory name beneath server directory";
|
||||
};
|
||||
|
||||
hostPublicKey = mkOption {
|
||||
type = types.str;
|
||||
description = "Pinned SSH host public key";
|
||||
};
|
||||
|
||||
downloadRetries = mkOption {
|
||||
type = types.ints.positive;
|
||||
default = 3;
|
||||
description = "Maximum SFTP download attempts";
|
||||
};
|
||||
|
||||
retryDelaySeconds = mkOption {
|
||||
type = types.ints.unsigned;
|
||||
default = 10;
|
||||
description = "Delay between SFTP download attempts";
|
||||
};
|
||||
|
||||
timeoutStartSec = mkOption {
|
||||
type = types.str;
|
||||
default = "30min";
|
||||
description = "Importer service start timeout";
|
||||
};
|
||||
};
|
||||
}));
|
||||
description = "Minecraft worlds imported before selected servers start";
|
||||
};
|
||||
|
||||
config = lib.mkIf (enabledImports != { }) {
|
||||
assertions = lib.flatten (lib.mapAttrsToList (name: import: [
|
||||
{
|
||||
assertion = builtins.match "[A-Za-z0-9_-]+" name != null;
|
||||
message = "services.minecraft-world-imports.${name}: name must contain only letters, digits, underscores, or hyphens";
|
||||
}
|
||||
{
|
||||
assertion = builtins.stringLength name <= 24;
|
||||
message = "services.minecraft-world-imports.${name}: name must be at most 24 characters";
|
||||
}
|
||||
{
|
||||
assertion = builtins.match "/.*" import.cacheDir != null;
|
||||
message = "services.minecraft-world-imports.${name}.cacheDir must be absolute";
|
||||
}
|
||||
{
|
||||
assertion = builtins.match "[A-Za-z0-9_-]+" import.serverName != null;
|
||||
message = "services.minecraft-world-imports.${name}.serverName must contain only letters, digits, underscores, or hyphens";
|
||||
}
|
||||
{
|
||||
assertion = !lib.hasInfix "\n" import.remotePath && !lib.hasInfix "\r" import.remotePath;
|
||||
message = "services.minecraft-world-imports.${name}.remotePath must not contain newlines";
|
||||
}
|
||||
{
|
||||
assertion = builtins.hasAttr import.serverName minecraftServers
|
||||
&& (builtins.getAttr import.serverName minecraftServers).enable;
|
||||
message = "services.minecraft-world-imports.${name}.serverName must name an enabled Minecraft server";
|
||||
}
|
||||
{
|
||||
assertion = lib.length (lib.unique targetPairs) == lib.length targetPairs;
|
||||
message = "services.minecraft-world-imports: each server/world target must be unique";
|
||||
}
|
||||
{
|
||||
assertion = builtins.match "[^/]+" import.archiveName != null;
|
||||
message = "services.minecraft-world-imports.${name}.archiveName must be a file name";
|
||||
}
|
||||
{
|
||||
assertion = builtins.match "[^/]+" import.worldName != null;
|
||||
message = "services.minecraft-world-imports.${name}.worldName must be a directory name";
|
||||
}
|
||||
]) enabledImports);
|
||||
|
||||
users.groups = lib.mapAttrs' (name: _: lib.nameValuePair (importerUser name) { }) enabledImports;
|
||||
users.users = lib.mapAttrs' (name: _: let
|
||||
user = importerUser name;
|
||||
in lib.nameValuePair user {
|
||||
description = "Minecraft world importer ${name}";
|
||||
isSystemUser = true;
|
||||
group = user;
|
||||
extraGroups = [ "minecraft" ];
|
||||
}) enabledImports;
|
||||
|
||||
programs.ssh.knownHosts = lib.mapAttrs' (name: import:
|
||||
lib.nameValuePair "minecraft-world-import-${name}" {
|
||||
hostNames = [ import.remoteHost ];
|
||||
publicKey = import.hostPublicKey;
|
||||
}) enabledImports;
|
||||
|
||||
systemd.tmpfiles.rules = lib.flatten (lib.mapAttrsToList (name: import:
|
||||
lib.optional (!stateDirectoryCompatible import.cacheDir)
|
||||
"d ${escapeTmpfiles import.cacheDir} 0700 ${importerUser name} ${importerUser name} -") enabledImports);
|
||||
|
||||
systemd.services = importerServices;
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user