add icmp and outbound rules

previously icmp was not on either inbound or outbound. there were also no outbound rules whatsoever. this may have been causing issues when creating a vm in a team with no base-firewall rules.
make machine create use enviroment variables for vm size and region
2025-03-28 20:20:08 +00:00 · 2025-03-28 20:19:01 +00:00 · 2025-03-28 20:18:21 +00:00 · 2025-03-28 20:15:43 +00:00 · 2025-03-27 21:14:42 +00:00 · 2025-03-27 17:39:00 +00:00
3 changed files with 293 additions and 61 deletions
--- a/README.md
+++ b/README.md
@ -1,37 +1,15 @@
-# auto-mc
-automate automation for minecraft servers.
+## ever wanted to:
+- play minecraft but the server was too expensive to host 
+for just a little play session?
+- have a minecraft world you wanted to play with your friends as a 
+one off thing?

-this is an installer for the minecraft server (paper), with a few systemd units and a backup script. the server runs inside a gnu `screen` session controlled by the user `mc`.
-it works best on ubuntu 20.04+ because of java versioning, but any distro with `apt` (and a version of openjdk >=16 for 1.17+ installs, or >=21 for 1.21+) should work fine.
-
-# installation
-to install, do:
-```bash
-sudo apt install git
-git clone https://git.skeh.site/ida/auto-mc ~/auto-mc 
-cd ~/auto-mc && sudo bash automate.sh
-```
-# usage notes
-by default the server tries to allocate 3G of ram, to change this, just edit mc-server.service's ExecStart 
-## structure
-`/srv/minecraft/server`: server files 
-
-`/srv/minecraft/backups`: backups of `../server` (taken daily, retained for 14 days)
-
-`/etc/systemd/system/mc-*`: services and timers
-
-## commands
-### ran as `root`*:
-`systemctl start mc-server`: starts the minecraft server 
-
-`systemctl stop mc-server`: stops the minecraft server 
-
-`systemctl restart mc-server`: restarts the minecraft server 
-
-(* = either by logging into `root`, or prefixing any command with `sudo`)
-
-### ran as `mc`
-`screen -r mc-server`: connects to the server console
-
-`mc-backup`: manually runs a backup 
+## introducing: auto-mc-redux! 

+this is a modified version of the [script](https://git.skeh.site/ida/auto-mc) i maintain for automatically 
+installing minecraft (on `apt` based distrobutions) and intigrating it 
+with systemd. this aims to create a virtual machine, create the 
+appropriate firewall rules, and install minecraft with a world that's 
+kept in an s3 bucket, until you give it the command to un-deploy it, 
+where it'll back up the world to the s3 bucket, and then unprovision the 
+server!
--- a/automate.sh
+++ b/automate.sh
@ -11,32 +11,6 @@ fi
 echo "fetching..."
 apt install -y screen tar xz-utils curl jq #FIXME: this wont probably work on a system that has not run apt update for the first time

-# find the latest version of paper
-LATEST=`curl -s https://papermc.io/api/v2/projects/paper/ | jq -r .versions[-1]`
-printf "\n\n\n"
-function versionprompt {
-	# ask the user which version of minecraft they would like to install
-	echo "which version of minecraft would you like to serve?"
-	echo -n "version [$LATEST]:"
-	if ! read -t 30 VERSION; then  # have a timeout for user input handy for unattented installs
-		VERSION=$LATEST
-		echo "timed out, defaulting to $LATEST..."
-		return 0
-	fi
-	if [ -n "$VERSION" ]; then # check if the user wrote anything
-		echo "probing..."
-		#validate user input
-		if ! curl -s https://papermc.io/api/v2/projects/paper/ | jq -r .versions | grep -q \"$VERSION\"; then
-			echo "we cant find that version! either its not supported or you made an error, trying again..."
-			versionprompt
-		fi
-	else
-		VERSION=$LATEST
-		echo "defaulting to $LATEST..."
-	fi
-}
-versionprompt
-
 # this has to be seperate from the first run of apt since java versions before 16 is deprecated for minecraft 1.17 and before 17 for 1.18, and java versions before 21 for 1.21
 echo "installing java..."
 if printf '%s\n' 1.20.6 $VERSION | sort -VC; then # check if $VERSION is above 1.20.6
--- a/deploy.sh
+++ b/deploy.sh
@ -0,0 +1,280 @@
+#!/usr/bin/env bash
+# required for the complex pipes in the machine function
+shopt -s lastpipe
+
+#TODO: add these to config create, probably with a select menu or something
+size="s-2vcpu-4gb"
+reigon="sfo3"
+
+config() {
+	local command="$1"; shift
+
+	case $command in
+		get)
+			echo 'Checking config...'
+			if [ -a "${XDG_CONFIG_HOME}/auto-mc-redux/conf" ]; then
+				source "${XDG_CONFIG_HOME}/auto-mc-redux/conf"
+			elif [ -a "$HOME/.config/auto-mc-redux/conf" ]; then
+				source "${HOME}/.config/auto-mc-redux/conf"
+			else
+				echo 'No config found!'
+				config create
+			fi
+		;;
+		create)
+			read -p "Enter your DigialOcean API token: " TOKEN
+			# this parameter expands to nothing if unset, or x if it is.
+			if [ -z ${XDG_CONFIG_HOME+x} ]; then
+				mkdir -p "${HOME}/.config/auto-mc-redux"
+				echo export TOKEN="${TOKEN}" > "${HOME}/.config/auto-mc-redux/conf"
+				chmod 600 "${HOME}/.config/auto-mc-redux/conf"
+			else
+				mkdir -p "${XDG_CONFIG_HOME}/auto-mc-redux"
+				echo export TOKEN="${TOKEN}" > "${XDG_CONFIG_HOME}/auto-mc-redux/conf"
+				chmod 600 "${XDG_CONFIG_HOME}/auto-mc-redux/conf"
+			fi
+		;;
+	esac
+}
+
+firewall(){
+	local command="$1"; shift
+
+	case $command in
+		# exits 0 if firewall with tag auto-mc exists, 1 if it does not
+		check)
+			echo 'Querying firewall rules...'
+			curl -s -X GET \
+				-H "Content-Type: application/json" \
+				-H "Authorization: Bearer $TOKEN" \
+				https://api.digitalocean.com/v2/firewalls |\
+				jq -r .firewalls[].name | grep -q "^auto-mc$"
+		;;
+		create)
+			echo 'Creating firewall rule'
+			curl -s -X POST \
+				-H "Content-Type: application/json" \
+				-H "Authorization: Bearer $TOKEN" \
+				-d @- \
+				"https://api.digitalocean.com/v2/firewalls" <<-json
+			{
+			  "name": "auto-mc",
+			  "tags":["auto-mc"],
+			  "inbound_rules": [
+			    {
+			      "protocol": "icmp",
+			      "ports": "0",
+			      "sources": {
+			        "addresses": [
+			          "0.0.0.0/0",
+			          "::/0"
+			        ]
+			      }
+			    },
+			    {
+			      "protocol": "tcp",
+			      "ports": "25565",
+			      "sources": {
+			        "addresses": [
+			          "0.0.0.0/0",
+			          "::/0"
+			        ]
+			      }
+			    },
+			    {
+			      "protocol": "udp",
+			      "ports": "25565",
+			      "sources": {
+			        "addresses": [
+			          "0.0.0.0/0",
+			          "::/0"
+			        ]
+			      }
+			    }
+			  ]
+			  "outbound_rules": [
+			    {
+			      "protocol": "icmp",
+			      "ports": "0",
+			      "sources": {
+			        "addresses": [
+			          "0.0.0.0/0",
+			          "::/0"
+			        ]
+			      }
+			    },
+			    {
+			      "protocol": "tcp",
+			      "ports": "0",
+			      "sources": {
+			        "addresses": [
+			          "0.0.0.0/0",
+			          "::/0"
+			        ]
+			      }
+			    },
+			    {
+			      "protocol": "udp",
+			      "ports": "0",
+			      "sources": {
+			        "addresses": [
+			          "0.0.0.0/0",
+			          "::/0"
+			        ]
+			      }
+			    }
+			  ]
+			}
+			json
+		;;
+	esac
+}
+
+keys(){
+	local command="$1"; shift
+
+	case $command in
+		check)
+			echo "Checking DigitalOcean's keystore..."
+			curl -s -X GET \
+				-H "Content-Type: application/json"	\
+				-H "Authorization: Bearer $TOKEN"	\
+				"https://api.digitalocean.com/v2/account/keys" |\
+			jq -r .ssh_keys[].public_key |\
+			while read remote_key; do
+				if grep -q "^$remote_key$" "$HOME/.ssh/"*.pub; then
+					authed_key="$remote_key"
+				fi
+			done
+
+			if [ "$authed_key" ]; then
+				echo "Local key already installed..."
+				ssh-keygen -l -E md5 -f <(echo "$authed_key") |\
+				cut -d':' -f 2- | cut -d' ' -f 1 | read fingerprint
+				export fingerprint
+			else
+				keys copy
+			fi
+		;;
+		copy)
+			key_file="$(find "$HOME/.ssh/"*.pub | sort | head -1)"
+			cat "$key_file" | read key
+			key_name=$(echo "$key" | cut --complement -d'@' -f 1)
+			echo "Copying key..."
+			curl -s -X POST \
+				-H "Content-Type: application/json" \
+				-H "Authorization: Bearer $TOKEN" \
+				-d '{"name":"'"$key_name"'","public_key":"'"$key"'"}' \
+				"https://api.digitalocean.com/v2/account/keys" |
+			jq -r .ssh_key.fingerprint | read fingerprint
+			export fingerprint
+			echo "Key copied!"
+		;;
+	esac
+}
+
+machine(){
+	local command="$1"; shift
+	local arg="$1"; shift
+
+	case $command in
+		create)
+			# read isn't used in these pipelines because of job control shinanigans
+			echo 'Creating Droplet...'
+			curl -s -X POST \
+					-H 'Content-Type: application/json' \
+					-H "Authorization: Bearer $TOKEN" \
+					-d '{"name":"auto-mc",
+			        "size":"'$size'",
+			        "region":"'$reigon'",
+			        "image":"ubuntu-24-10-x64",
+			        "ssh_keys":["'$fingerprint'"],
+			        "tags":["auto-mc"]}' \
+			    "https://api.digitalocean.com/v2/droplets" |\
+					jq .droplet.id | read droplet
+
+			export droplet
+			echo 'Waiting for droplet to be active...'
+			while sleep 5; do
+					machine show status
+					if [ "$status" = 'active' ]; then
+						echo 'Droplet ready!'
+						break
+					fi
+			done
+		;;
+		destroy)
+			curl -s -X DELETE \
+				-H "Content-Type: application/json" \
+				-H "Authorization: Bearer $TOKEN" \
+				"https://api.digitalocean.com/v2/droplets?tag_name=auto-mc"
+		;;
+		show)
+			case $arg in
+				ipv4)
+					curl -s -X GET \
+						-H "Content-Type: application/json" \
+						-H "Authorization: Bearer $TOKEN" \
+						"https://api.digitalocean.com/v2/droplets/$droplet" |\
+						jq '.droplet.networks.v4[] | select(.type == "public")'
+				;;
+				status)
+					curl -s -X GET \
+						-H "Content-Type: application/json" \
+						-H "Authorization: Bearer $TOKEN" \
+						"https://api.digitalocean.com/v2/droplets/$droplet" |\
+						jq -r .droplet.status | read status
+					export status
+				;;
+			esac
+	esac
+}
+
+versionprompt() {
+	# ask the user which version of minecraft they would like to install
+	echo "Which version of minecraft would you like to serve?"
+	echo -n "Version [$latest]:"
+	# have a timeout for user input handy for unattented installs
+	if ! read -t 30 version; then
+		version=$latest
+		echo "Timed out, defaulting to $latest..."
+		return 0
+	fi
+	if [ -n "$version" ]; then # check if the user wrote anything
+		echo "Probing..."
+		#validate user input
+		if ! curl -s https://api.papermc.io/v2/projects/paper/ |\
+				 jq -r .versions | grep -q \"$version\"; then
+			echo "We cant find that version!"
+			echo "Either its not supported yet or you made an error, trying again..."
+			versionprompt
+		fi
+	else
+		version=$latest
+		echo "Defaulting to $latest..."
+	fi
+}
+
+config get
+keys check
+machine create
+machine show ipv4 | jq .ip_address | read ipv4_address
+echo "Machine created at $ipv4_address!"
+if ! firewall check; then
+	firewall create
+else
+	echo "Firewall rule already exists"
+fi
+
+latest=`curl -s https://api.papermc.io/v2/projects/paper/ | jq -r .versions[-1]`
+versionprompt
+echo "Waiting for machine to respond"
+# send pings every second, waiting for 1 second
+until ping -w 1 -c 1 $ip_address >/dev/null 2>&1; do
+	echo -n '.'
+	sleep 1
+done
+
+cat <(cat <(echo VERSION=$version) ./automate.sh)
+
+#machine destroy
Author	SHA1	Message	Date
ida	154aa0359d	add icmp and outbound rules previously icmp was not on either inbound or outbound. there were also no outbound rules whatsoever. this may have been causing issues when creating a vm in a team with no base-firewall rules.	2025-03-28 20:20:08 +00:00
ida	6f8ada2978	make `machine create` use enviroment variables for vm size and region this will allow us to make a prompt for selecting the appropriate size and region for each user when creating a config.	2025-03-28 20:19:01 +00:00
ida	3e7416f71c	minor typographical change the e wasn't capitalized	2025-03-28 20:18:21 +00:00
ida	d54acd2d08	move version prompt to deploy.sh this will allow us to feed automate.sh via ssh's stdin inside of deploy.sh as ssh will not open a virtual terminal when stdin is not is not a terminal.	2025-03-28 20:15:43 +00:00
ida	79226a01ca	add automated key-ing	2025-03-27 21:14:42 +00:00
ida	3fe32c42ba	add droplet deployment	2025-03-27 17:39:00 +00:00
ida	cf64fec4ae	change readme	2025-03-27 12:31:15 +00:00