add cs2 server

2026-06-12 21:53:24 -05:00
parent 3283cac3e8
commit c37ff5dd4c
2 changed files with 166 additions and 2 deletions
@@ -0,0 +1,160 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "cs2";
+  cfg = config.gameservers.${service};
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "Counter Strike 2 server";
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/cs2";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 27015;
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "recoil.pro CS2";
+    };
+    map = lib.mkOption {
+      type = lib.types.str;
+      default = "de_dust2";
+    };
+    maxPlayers = lib.mkOption {
+      type = lib.types.int;
+      default = 10;
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/gameservers/cs2";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.cs2 = {
+      isSystemUser = true;
+      group = "cs2";
+      home = cfg.data_dir;
+      createHome = true;
+    };
+
+    users.groups.cs2 = {};
+
+    environment.systemPackages = with pkgs; [
+      steamcmd
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.data_dir} 0770 cs2 cs2 -"
+      "d ${cfg.data_dir}/server 0770 cs2 cs2 -"
+    ];
+
+    environment.etc."cs2/server.cfg".text = ''
+      hostname "${cfg.hostname}"
+      sv_lan 0
+      sv_visiblemaxplayers ${toString cfg.maxPlayers}
+      rcon_password "$(<${config.sops.secrets.cs2-rcon.path})"
+      mp_autoteambalance 1
+      mp_limitteams 2
+    '';
+
+    systemd.services.cs2-update = {
+      description = "Update CS2 server";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "cs2";
+      };
+      script = ''
+        ${pkgs.steamcmd}/bin/steamcmd \
+          +force_install_dir ${cfg.data_dir}/server \
+          +login anonymous \
+          +app_update 730 validate \
+          +quit
+      '';
+    };
+
+    systemd.services.cs2-server = {
+      description = "Counter Strike 2 Dedicated Server";
+      after = [
+        "network.target"
+        "cs2-update.service"
+      ];
+      requires = [
+        "cs2-update.service"
+      ];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        User = "cs2";
+        Group = "cs2";
+        WorkingDirectory = "${cfg.data_dir}/server/game/bin/linuxsteamrt64";
+        Restart = "always";
+        ExecStart = pkgs.writeShellScript "cs2-start" ''
+          export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
+          exec ./cs2.sh \
+            -dedicated \
+            -usercon \
+            +map ${cfg.map} \
+            +sv_setsteamaccount "$GSLT" \
+            +exec server.cfg
+        '';
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [cfg.port];
+
+    # backups cs2 server with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+
+    sops.secrets = {
+      cs2-gslt = {
+        owner = "cs2";
+        group = "cs2";
+      };
+      cs2-rcon = {
+        owner = "cs2";
+        group = "cs2";
+      };
+    };
+
+    # manage secrets with sops
+    sops.secrets = {
+      "${service}/gslt" = {
+        owner = service;
+        group = service;
+      };
+      "${service}/rcon" = {
+        owner = service;
+        group = service;
+      };
+    };
+  };
+}