add cs2 server

hosts/nixos/lumiose/configuration.nix

@@ -17,6 +17,7 @@
     ../../../modules/system
     ../../../modules/fileshares/holocron_new
     ../../../modules/homelab
+    ../../../modules/gameservers/cs2
     #../../../modules/gameservers/minecraft_recpro
     #../../../modules/gameservers/minecraft_modded
   ];
@@ -82,6 +83,10 @@
     nfs.enable = true;
   };
 
+  gameserver = {
+    cs2.enable = true;
+  };
+
   # boot (systemd is going on me)
   boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
   boot.loader.efi.canTouchEfiVariables = true;

modules/gameservers/cs2/default.nix

@@ -0,0 +1,160 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "cs2";
+  cfg = config.gameservers.${service};
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "Counter Strike 2 server";
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/cs2";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 27015;
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "recoil.pro CS2";
+    };
+    map = lib.mkOption {
+      type = lib.types.str;
+      default = "de_dust2";
+    };
+    maxPlayers = lib.mkOption {
+      type = lib.types.int;
+      default = 10;
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/gameservers/cs2";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.cs2 = {
+      isSystemUser = true;
+      group = "cs2";
+      home = cfg.data_dir;
+      createHome = true;
+    };
+
+    users.groups.cs2 = {};
+
+    environment.systemPackages = with pkgs; [
+      steamcmd
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.data_dir} 0770 cs2 cs2 -"
+      "d ${cfg.data_dir}/server 0770 cs2 cs2 -"
+    ];
+
+    environment.etc."cs2/server.cfg".text = ''
+      hostname "${cfg.hostname}"
+      sv_lan 0
+      sv_visiblemaxplayers ${toString cfg.maxPlayers}
+      rcon_password "$(<${config.sops.secrets.cs2-rcon.path})"
+      mp_autoteambalance 1
+      mp_limitteams 2
+    '';
+
+    systemd.services.cs2-update = {
+      description = "Update CS2 server";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "cs2";
+      };
+      script = ''
+        ${pkgs.steamcmd}/bin/steamcmd \
+          +force_install_dir ${cfg.data_dir}/server \
+          +login anonymous \
+          +app_update 730 validate \
+          +quit
+      '';
+    };
+
+    systemd.services.cs2-server = {
+      description = "Counter Strike 2 Dedicated Server";
+      after = [
+        "network.target"
+        "cs2-update.service"
+      ];
+      requires = [
+        "cs2-update.service"
+      ];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        User = "cs2";
+        Group = "cs2";
+        WorkingDirectory = "${cfg.data_dir}/server/game/bin/linuxsteamrt64";
+        Restart = "always";
+        ExecStart = pkgs.writeShellScript "cs2-start" ''
+          export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
+          exec ./cs2.sh \
+            -dedicated \
+            -usercon \
+            +map ${cfg.map} \
+            +sv_setsteamaccount "$GSLT" \
+            +exec server.cfg
+        '';
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [cfg.port];
+
+    # backups cs2 server with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+
+    sops.secrets = {
+      cs2-gslt = {
+        owner = "cs2";
+        group = "cs2";
+      };
+      cs2-rcon = {
+        owner = "cs2";
+        group = "cs2";
+      };
+    };
+
+    # manage secrets with sops
+    sops.secrets = {
+      "${service}/gslt" = {
+        owner = service;
+        group = service;
+      };
+      "${service}/rcon" = {
+        owner = service;
+        group = service;
+      };
+    };
+  };
+}

secrets/secrets.yaml

@@ -27,6 +27,10 @@ syncthing:
         cert: ENC[AES256_GCM,data:uvNZYmQnexXTr/Sz7vLQIJK93MmsoiJfCAL8/rLVQH0D+1nVaM472lqR5pP0qhLKuYhFUESxhAotVtqLpOWK1MfAxuk2RHv8mvbtIJkheRmsIWw7dAAABIkmgnelI03P2Tk2129I95vMM1lybu4W6m9VslwJF8X/4rCxshdbuz9mcjwxBpUEDr1V76DO3bgQUuPwizx17ON8gNd+NtRqPPaXlGrfLCFv1Fib3YFd7+WRkERki9ZO7Q0quY75G4Jseb28QaiM2BT7jfECJo4x7rMePMV303sIrF9paaUKTuSiCUsamLsi5Hwr907y2lHB9Gocwio7tnSRSRhHHcWLI8dQktzW7Flqs8+MZGZ1oJBQO7kQDefF1q4mddADimoqD9F1NsOiOmqqZRRB37alLGmRjeYBIlA6q/FgN9BAj9h0cG3oN1MUXPRGzDfggg5TLjBM2FbG/N3xgncZ2AzTPOcLtrtc0I2PYk3FFxgzpHWnjS2t7CQo/JxqdXbdy9nTHIqbrnKIQ/FtS7/p+cgQcU815UMsJm3qP+hPLCyNuziYq3Vt/X7C3eTnrqemXjEeJ/SJxb+Oul5GS1OL14dNsJllFNuj33Zep/hyQvHnf/HW7kXAfDqIP9zn85EFriAZEuaKwbHB2pkvbWKFxrpXJFhjnPFDKxGOjAmsLmil4paFKdt5hK7rp0mmoIMN+mMFbYx333llik0qk27yYTQwOR3eeCGqHODUU+izUT8NuQBezyxsEmEYu/YBcpatcYylwKgIFcC058oltsxlbxRg5Rrdk5FOqj7Uui0qwFXvYesz6Tiq/rGmcOPlcE5xw14=,iv:LePpzWGDTV1ONwt1uHUptMW1dO1SwwUKrtCEerc/DEc=,tag:a5B/7hmIxvLXU90Stcq7zA==,type:str]
 #ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment]
 pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str]
+#ENC[AES256_GCM,data:5F5zgBhqkrxOWOwqOZN3GQ==,iv:TRWqSSGcEBq+3IY0PyYi8SIZH8wKXvNS2VHS5pxlOuY=,tag:tJQgthNyBxu9ebeaxYg/yQ==,type:comment]
+cs2:
+    gslt: ENC[AES256_GCM,data:CJUqox7FRvXhQr4oll4Qex75CEGyUo6cRruvhw9o4wI=,iv:ZQmPd7TWrO6KjLeYbNVIEVtt2DqLMnGZ9LJyo6RWwLI=,tag:XlClJ4tieowiL/bETPMLNA==,type:str]
+    rcon: ENC[AES256_GCM,data:b69rgz71icGSUDXjH5G8DXcA9W2521qRrKcxcONs1NGDjcFyfulPZt8=,iv:DNlujzo4nzIZg6hOxUNDWWDU2o84wZNP6zIJ67Z+xKw=,tag:1MMhWLI8lDuildp++DXc2Q==,type:str]
 #ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
 wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str]
 #ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment]
@@ -77,7 +81,7 @@ sops:
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
-    lastmodified: "2026-06-13T02:00:31Z"
+    lastmodified: "2026-06-13T02:51:58Z"
-    mac: ENC[AES256_GCM,data:CaCB+PP632stufUcEtW8vN3KgikOsMUitofhPIJ6Xhvs85bAfGcUPycVCGuTMR/Seuz4i+Wr4QzD9rZcj7/kOFBH53AUWBjJeY2VzJygJ+6ALNqyvy139a83y8godM7Pzs8FZYYAJACk5M1vP7PRRavdNywIQYfN32NgGJJMB6I=,iv:o5P6IHo8BjM9I3xvELw9qrE5y6bBAivXJkfjQ41KKwA=,tag:7k6t7xn0hrLRIpe8Ysse3A==,type:str]
+    mac: ENC[AES256_GCM,data:0UOZP1Tm52GgZsi7wUowoYKtno6tSTj2AK0lyB4ZzfpFq2RRloAxaMDVtykm/VLtHEm1sQKe7il0oyvPoiQ4ZFcOCX+rr+C0lSTdtw55X029H1dndL+wCeRo9P/qrDlq1scYt/RABspMwB6ZXPRdGD/oaWtAnj9aAOMad0Bz9SI=,iv:QDobOe+JGN5RJpRz1+9z1WEfd1Ph4C19QfR4z611Kn0=,tag:ULYYshFR8MronGNE3wxT0A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1