init
This commit is contained in:
Marek Lenczewski
339
SETUP.md
Normal file
339
SETUP.md
Normal file
@@ -0,0 +1,339 @@
|
|||||||
|
# Windrose Dedicated Server auf Hetzner CPX22 — Runbook
|
||||||
|
|
||||||
|
Anleitung für einen Agent zum Aufsetzen eines privaten Windrose-Dedicated-Servers
|
||||||
|
(max. 4 Spieler, Invite-Code-only) auf einem frischen Hetzner CPX22 mit Ubuntu 24.04.
|
||||||
|
|
||||||
|
## Eckdaten
|
||||||
|
|
||||||
|
- **Hardware:** CPX22 = 2 vCPU AMD EPYC, **4 GB RAM**, 80 GB NVMe SSD.
|
||||||
|
- **RAM-Risiko:** Windrose verlangt offiziell min. 8 GB für 2 Spieler. Wir kompensieren mit
|
||||||
|
8 GB Swap und cappen `MaxPlayerCount=4`. Wenn Performance schlecht ist → Hetzner-Console
|
||||||
|
→ Rescale auf CPX31 (8 GB RAM, ~€13/Monat), kein Datenverlust.
|
||||||
|
- **Server ist Windows-only.** Lauf über Wine + Xvfb (headless).
|
||||||
|
- **Setup-Variante:** Bare-Metal mit systemd (geringerer RAM-Footprint als Docker).
|
||||||
|
- **Connectivity:** Spieler joinen per Invite-Code. UDP 7777/7778 müssen aber trotzdem
|
||||||
|
reachable sein (NAT-Punch-Through über die öffentliche IP).
|
||||||
|
- **SteamCMD App-ID:** `4129620` (Windrose Dedicated Server, anonymous).
|
||||||
|
|
||||||
|
## Regeln für den ausführenden Agent
|
||||||
|
|
||||||
|
- Schritte **2, 3, 6 als root**, Schritte **4, 5, 7 als User `windrose`** (`sudo -iu windrose`).
|
||||||
|
- **Idempotent** arbeiten: vor jedem destruktiven Schritt prüfen, ob der Zielzustand schon
|
||||||
|
existiert (Swapfile, WineHQ-Repo, systemd-Unit, …) und ggf. überspringen.
|
||||||
|
- **Nicht-interaktiv**: bei `apt install` immer `-y`. Für `steamcmd` vorher die Lizenz
|
||||||
|
per debconf akzeptieren (siehe Schritt 2.6).
|
||||||
|
- Nach Schritt 5.2 den **InviteCode** aus `ServerDescription.json` extrahieren und im
|
||||||
|
finalen Report zurückmelden — den braucht der User zum Joinen.
|
||||||
|
- **Verifikation (Schritt 8) zwingend** ausführen und Ergebnisse berichten.
|
||||||
|
- **Nicht** ohne Rückfrage den Server neu starten, Snapshots löschen oder die
|
||||||
|
Hetzner-Cloud-Firewall ändern. Bei Fehlschlag: Log + Hypothese melden, nicht stumm
|
||||||
|
reparieren.
|
||||||
|
- Erwartete Dauer: 15–25 Min. (SteamCMD-Download ~3 GB + winetricks vcrun2022).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 1 — Hetzner-Console (manuell durch den User)
|
||||||
|
|
||||||
|
Vor dem Server-Setup in der Hetzner Cloud Console:
|
||||||
|
|
||||||
|
1. **Snapshot** des frischen CPX22 anlegen (Rollback-Punkt).
|
||||||
|
2. **Cloud-Firewall** anhängen mit Inbound-Regeln:
|
||||||
|
- SSH: TCP 22 (am besten nur eigene IP)
|
||||||
|
- Windrose Game: **UDP 7777** (any source)
|
||||||
|
- Windrose Query: **UDP 7778** (any source)
|
||||||
|
3. Outbound: alles erlauben (default). Wichtig für STUN/TURN nach
|
||||||
|
`*.windrose.support:3478` (UDP/TCP).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 2 — System-Vorbereitung (als root)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 2.1 Basis-Update
|
||||||
|
apt update && apt -y full-upgrade
|
||||||
|
|
||||||
|
# 2.2 Server-User
|
||||||
|
id windrose >/dev/null 2>&1 || adduser --disabled-password --gecos "" windrose
|
||||||
|
usermod -aG sudo windrose
|
||||||
|
|
||||||
|
# 2.3 Swap (8 GB)
|
||||||
|
if ! swapon --show | grep -q '/swapfile'; then
|
||||||
|
fallocate -l 8G /swapfile
|
||||||
|
chmod 600 /swapfile
|
||||||
|
mkswap /swapfile
|
||||||
|
swapon /swapfile
|
||||||
|
echo '/swapfile none swap sw 0 0' >> /etc/fstab
|
||||||
|
fi
|
||||||
|
echo 'vm.swappiness=10' > /etc/sysctl.d/99-swappiness.conf
|
||||||
|
sysctl --system
|
||||||
|
|
||||||
|
# 2.4 Multiarch + Repos
|
||||||
|
dpkg --add-architecture i386
|
||||||
|
add-apt-repository -y multiverse
|
||||||
|
add-apt-repository -y universe
|
||||||
|
|
||||||
|
# 2.5 WineHQ-Repo (stable, aktueller als Distro-Wine)
|
||||||
|
mkdir -pm755 /etc/apt/keyrings
|
||||||
|
wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key
|
||||||
|
wget -NP /etc/apt/sources.list.d/ \
|
||||||
|
https://dl.winehq.org/wine-builds/ubuntu/dists/noble/winehq-noble.sources
|
||||||
|
apt update
|
||||||
|
|
||||||
|
# 2.6 SteamCMD-Lizenz vorab akzeptieren (sonst hängt apt interaktiv)
|
||||||
|
echo steam steam/question select "I AGREE" | debconf-set-selections
|
||||||
|
echo steam steam/license note '' | debconf-set-selections
|
||||||
|
|
||||||
|
# 2.7 Pakete
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt install -y --install-recommends winehq-stable
|
||||||
|
DEBIAN_FRONTEND=noninteractive apt install -y \
|
||||||
|
software-properties-common lib32gcc-s1 steamcmd \
|
||||||
|
xvfb cabextract winbind ufw fail2ban unzip jq wget
|
||||||
|
|
||||||
|
# 2.8 winetricks
|
||||||
|
if [ ! -x /usr/local/bin/winetricks ]; then
|
||||||
|
wget -O /usr/local/bin/winetricks \
|
||||||
|
https://raw.githubusercontent.com/Winetricks/winetricks/master/src/winetricks
|
||||||
|
chmod +x /usr/local/bin/winetricks
|
||||||
|
fi
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 3 — Lokale Firewall + SSH-Härtung (als root)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ufw default deny incoming
|
||||||
|
ufw default allow outgoing
|
||||||
|
ufw allow 22/tcp
|
||||||
|
ufw allow 7777/udp
|
||||||
|
ufw allow 7778/udp
|
||||||
|
ufw --force enable
|
||||||
|
|
||||||
|
systemctl enable --now fail2ban
|
||||||
|
```
|
||||||
|
|
||||||
|
In `/etc/ssh/sshd_config` setzen (nur wenn SSH-Key bereits funktioniert):
|
||||||
|
```
|
||||||
|
PasswordAuthentication no
|
||||||
|
PermitRootLogin prohibit-password
|
||||||
|
```
|
||||||
|
Dann `systemctl reload ssh`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 4 — Server-Installation (als User `windrose`)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo -iu windrose bash <<'EOF'
|
||||||
|
mkdir -p ~/steam ~/log ~/backup
|
||||||
|
cd ~/steam
|
||||||
|
|
||||||
|
# 4.1 SteamCMD: Server-Files (forciert Windows-Platform)
|
||||||
|
steamcmd \
|
||||||
|
+@sSteamCmdForcePlatformType windows \
|
||||||
|
+force_install_dir /home/windrose/steam/windrose \
|
||||||
|
+login anonymous \
|
||||||
|
+app_update 4129620 validate \
|
||||||
|
+quit
|
||||||
|
|
||||||
|
# 4.2 Wine-Prefix initialisieren
|
||||||
|
export WINEPREFIX=/home/windrose/steam/windrose/pfx
|
||||||
|
export WINEARCH=win64
|
||||||
|
xvfb-run -a wineboot --init
|
||||||
|
xvfb-run -a winetricks -q win10 vcrun2022
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
> `vcrun2022` verhindert die häufigsten "missing MSVC runtime"-Crashes.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 5 — Server-Config
|
||||||
|
|
||||||
|
### 5.1 Start-Script `/home/windrose/steam/start_windrose.sh`
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -e
|
||||||
|
export WINEPREFIX=/home/windrose/steam/windrose/pfx
|
||||||
|
export WINEARCH=win64
|
||||||
|
export WINEDEBUG=-all
|
||||||
|
export DISPLAY=:99
|
||||||
|
|
||||||
|
if ! pgrep -f "Xvfb :99" >/dev/null; then
|
||||||
|
Xvfb :99 -screen 0 1024x768x16 &
|
||||||
|
sleep 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd /home/windrose/steam/windrose
|
||||||
|
exec wine64 WindroseServer.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
`chmod +x /home/windrose/steam/start_windrose.sh`
|
||||||
|
|
||||||
|
### 5.2 Erst-Start (Config-Generierung)
|
||||||
|
|
||||||
|
Als `windrose`:
|
||||||
|
```bash
|
||||||
|
~/steam/start_windrose.sh &
|
||||||
|
SERVER_PID=$!
|
||||||
|
sleep 60 # warten bis Erst-Init durch ist
|
||||||
|
kill $SERVER_PID 2>/dev/null || true
|
||||||
|
sleep 5
|
||||||
|
```
|
||||||
|
|
||||||
|
Damit werden `ServerDescription.json` und der erste Welt-Ordner unter
|
||||||
|
`R5/Saved/SaveProfiles/Default/RocksDB/<version>/Worlds/<world_id>/` erzeugt.
|
||||||
|
|
||||||
|
### 5.3 ServerDescription patchen
|
||||||
|
|
||||||
|
Datei finden + patchen:
|
||||||
|
```bash
|
||||||
|
CFG=$(find /home/windrose/steam/windrose -maxdepth 4 -name ServerDescription.json | head -n1)
|
||||||
|
|
||||||
|
# InviteCode für Report extrahieren
|
||||||
|
INVITE=$(jq -r '.ServerDescription_Persistent.InviteCode' "$CFG")
|
||||||
|
|
||||||
|
# ServerName + MaxPlayer setzen, kein Passwort
|
||||||
|
jq '.ServerDescription_Persistent.ServerName = "Marhas Windrose"
|
||||||
|
| .ServerDescription_Persistent.MaxPlayerCount = 4
|
||||||
|
| .ServerDescription_Persistent.IsPasswordProtected = false
|
||||||
|
| .ServerDescription_Persistent.Password = ""' \
|
||||||
|
"$CFG" > "$CFG.tmp" && mv "$CFG.tmp" "$CFG"
|
||||||
|
|
||||||
|
echo "INVITE_CODE=$INVITE" # !!! Dem User zurückmelden !!!
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 6 — systemd Service (als root)
|
||||||
|
|
||||||
|
`/etc/systemd/system/windrose.service`:
|
||||||
|
```ini
|
||||||
|
[Unit]
|
||||||
|
Description=Windrose Dedicated Server
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=windrose
|
||||||
|
Group=windrose
|
||||||
|
WorkingDirectory=/home/windrose/steam
|
||||||
|
ExecStart=/home/windrose/steam/start_windrose.sh
|
||||||
|
Restart=always
|
||||||
|
RestartSec=10
|
||||||
|
StandardOutput=append:/home/windrose/log/windrose.log
|
||||||
|
StandardError=append:/home/windrose/log/windrose.log
|
||||||
|
MemoryHigh=3G
|
||||||
|
MemoryMax=3500M
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
```
|
||||||
|
|
||||||
|
Aktivieren:
|
||||||
|
```bash
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable --now windrose
|
||||||
|
systemctl status windrose --no-pager
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 7 — Update- & Backup-Helfer (als User `windrose`)
|
||||||
|
|
||||||
|
### 7.1 Update-Script `/home/windrose/steam/update_windrose.sh`
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -e
|
||||||
|
sudo systemctl stop windrose
|
||||||
|
steamcmd \
|
||||||
|
+@sSteamCmdForcePlatformType windows \
|
||||||
|
+force_install_dir /home/windrose/steam/windrose \
|
||||||
|
+login anonymous \
|
||||||
|
+app_update 4129620 validate \
|
||||||
|
+quit
|
||||||
|
sudo systemctl start windrose
|
||||||
|
```
|
||||||
|
|
||||||
|
### 7.2 Backup-Script `/home/windrose/steam/backup_windrose.sh`
|
||||||
|
|
||||||
|
```bash
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -e
|
||||||
|
TS=$(date +%Y%m%d-%H%M%S)
|
||||||
|
SRC=/home/windrose/steam/windrose/R5/Saved
|
||||||
|
DST=/home/windrose/backup/windrose-${TS}.tar.gz
|
||||||
|
tar -czf "$DST" -C "$(dirname "$SRC")" "$(basename "$SRC")"
|
||||||
|
ls -1t /home/windrose/backup/windrose-*.tar.gz | tail -n +8 | xargs -r rm
|
||||||
|
```
|
||||||
|
|
||||||
|
Beide ausführbar machen: `chmod +x ~/steam/{update,backup}_windrose.sh`
|
||||||
|
|
||||||
|
### 7.3 Cron (täglich 04:00) als `windrose`
|
||||||
|
|
||||||
|
```
|
||||||
|
0 4 * * * /home/windrose/steam/backup_windrose.sh >> /home/windrose/log/backup.log 2>&1
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Schritt 8 — Verifikation (zwingend)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl status windrose --no-pager
|
||||||
|
ss -ulnp | grep -E '7777|7778' || echo "WARN: Ports nicht gebunden"
|
||||||
|
free -h
|
||||||
|
tail -n 50 /home/windrose/log/windrose.log
|
||||||
|
vmstat 5 3 # Swap-Aktivität: si/so sollten ~0 sein im Idle
|
||||||
|
```
|
||||||
|
|
||||||
|
Erwartet:
|
||||||
|
- Service `active (running)`
|
||||||
|
- UDP 7777 + 7778 gebunden
|
||||||
|
- Idle-RAM <2 GB belegt, Swap fast leer
|
||||||
|
- Log zeigt "Server ready" o.ä., keine Wine-Stacktraces
|
||||||
|
|
||||||
|
Im Spiel-Client: "Join via Invite Code" → den im Report ausgegebenen Code eingeben.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Eskalation bei Problemen
|
||||||
|
|
||||||
|
- **OOM / extreme Lags:** Hetzner-Console → Server stoppen → "Rescale" auf CPX31 → starten. ~3 Min., kein Datenverlust.
|
||||||
|
- **Wine-Crashes beim Start:** `journalctl -u windrose -n 200` nach `wine: Unhandled` durchsuchen, ggf. `winetricks -q dotnet48` nachschieben oder `winehq-staging` statt `winehq-stable` testen.
|
||||||
|
- **Clients finden Server nicht:** Hetzner-Cloud-Firewall checken (UDP 7777/7778 wirklich offen?), Outbound zu `*.windrose.support:3478` nicht geblockt.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Kritische Dateien
|
||||||
|
|
||||||
|
| Pfad | Zweck |
|
||||||
|
|---|---|
|
||||||
|
| `/home/windrose/steam/windrose/WindroseServer.exe` | Server-Binary |
|
||||||
|
| `/home/windrose/steam/windrose/ServerDescription.json` | ServerName, InviteCode, MaxPlayer |
|
||||||
|
| `…/R5/Saved/SaveProfiles/Default/RocksDB/<ver>/Worlds/<id>/WorldDescription.json` | Welt-Konfig |
|
||||||
|
| `/home/windrose/steam/windrose/pfx` | Wine-Prefix |
|
||||||
|
| `/home/windrose/steam/start_windrose.sh` | Launcher (Xvfb + wine) |
|
||||||
|
| `/etc/systemd/system/windrose.service` | systemd-Unit |
|
||||||
|
| `/home/windrose/log/windrose.log` | Server-Log |
|
||||||
|
| `/home/windrose/backup/` | tägliche Save-Backups |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Final-Report-Template (vom Agent zurück an User)
|
||||||
|
|
||||||
|
```
|
||||||
|
Status: success | failed
|
||||||
|
Invite-Code: <CODE>
|
||||||
|
Server-Name: Marhas Windrose
|
||||||
|
Max-Spieler: 4
|
||||||
|
Public-IPv4: <hetzner-ip>
|
||||||
|
Service-Status: <output von systemctl status windrose>
|
||||||
|
RAM-Idle: <free -h>
|
||||||
|
Swap-Aktivität: <vmstat>
|
||||||
|
Letzte Log-Zeilen: <tail -n 20 windrose.log>
|
||||||
|
Auffälligkeiten / Warnings: …
|
||||||
|
```
|
||||||
Reference in New Issue
Block a user