Skip to content

Instantly share code, notes, and snippets.

@chungy
Last active July 31, 2023 19:18
Show Gist options
  • Save chungy/0b2c438c7db90b32701a to your computer and use it in GitHub Desktop.
Save chungy/0b2c438c7db90b32701a to your computer and use it in GitHub Desktop.
minecraft systemd service

Use these files for managing a Minecraft server with systemd.

Place minecraft.service in /etc/systemd/system, and run systemctl daemon-reload. minecraft should go into /etc/conf.d or an equivalent directory (change the path in the service too). /etc/conf.d/minecraft should not have world permissions. chown root:root and chmod 600 the file.

The user and group minecraft should exist. The minecraft user should only be a member of the minecraft group, for system security. The service is set up as such that security exploits of the Minecraft server and/or Java do not severely affect the rest of the system. /home is entirely inaccessible, /tmp and /var/tmp are sandboxed, no real device access is possible, and system directories like /etc cannot be written to. This takes hold even if there are otherwise file modes that would allow it.

mcrcon is used to stop the server, and required to be installed for such. It may also be used to manage the server without having to login with the Minecraft client.

It is recommended to add another user on the system to the minecraft group for backup purposes and other uses, but root would be required for restoration.

# This file is for /etc/conf.d
# RCON_PASSWD needs to be identical rcon.password in server.properties
RCON_PASSWD=example
MINHEAP=2G
MAXHEAP=4G
THREADS=6
[Unit]
Description=Minecraft server
Wants=network.target
After=local-fs.target network.target
[Service]
User=minecraft
Group=minecraft
UMask=0027
EnvironmentFile=/etc/conf.d/minecraft
KillMode=none
SuccessExitStatus=0 1 255
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
WorkingDirectory=~
ExecStart=/usr/bin/java -Xms${MINHEAP} -Xmx${MAXHEAP} -XX:ParallelGCThreads=${THREADS} -jar server.jar --nogui
ExecStop=/usr/bin/mcrcon -H localhost -p ${RCON_PASSWD} stop
[Install]
WantedBy=multi-user.target
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment