ulicraft-server-v1/plan/08-tooling.md

Tooling — config rendering, mod sync, ingress, fetch scripts

Summary

Scripts in ./tooling/ turn BASE_DOMAIN + templates into a working stack and handle ingress (nginx vhost, TLS certs) and launcher/font fetches. All are cautious: they halt on unset vars or missing inputs rather than emit half-broken output.

Surviving scripts:

• render-config.sh — render *.tmpl configs (BASE_DOMAIN only)
• classify-mods.py — read each jar's neoforge.mods.toml, seed mods-sides.json (see 04-mods.md)
• sync-server-mods.sh — copy both/server jars from the distribution → ./server-mods (see 04-mods.md)
• build-modlist.py — generate the landing mods.json + extract logos (see 17-mod-shortlist.md)
• export-server-config.sh — seed ./server-config from mc_data:/data/config before the rw bind mount takes over (once per host, see 05-minecraft.md)
• render-nginx.sh — render/install the host nginx vhost (TLS terminator → caddy)
• issue-letsencrypt.sh — issue LE certs via OVH DNS-01 (see 15-letsencrypt.md)
• fetch-launcher.sh — download Fjord launcher release assets (see 06-launcher.md)
• fetch-authlib.sh — vendor the authlib-injector jar → runtime/
• fetch-fonts.sh — vendor the landing page fonts (see 09-landing.md)

render-config.sh

Renders every *.tmpl into its real config by substituting only ${BASE_DOMAIN} (so literal $-syntax belonging to the target file — caddy, toml — is left untouched). Caddy is excluded entirely (it reads {$BASE_DOMAIN} natively).

Targets:

• drasl/config/config.toml.tmpl → drasl/config/config.toml
• nmsr/config.toml.tmpl → nmsr/config.toml

Mods are not rendered — they are synced from the distribution by sync-server-mods.sh (see 04-mods.md), no templating involved.

#!/usr/bin/env bash
set -euo pipefail
cd "$(dirname "$0")/.."
[ -f .env ] && { set -a; . ./.env; set +a; }
: "${BASE_DOMAIN:?BASE_DOMAIN unset (set in .env)}"

render() {  # $1=tmpl  $2=out
  [ -f "$1" ] || { echo "missing template: $1" >&2; exit 1; }
  envsubst '${BASE_DOMAIN}' < "$1" > "$2"
  echo "rendered $2"
}

render drasl/config/config.toml.tmpl drasl/config/config.toml
render nmsr/config.toml.tmpl          nmsr/config.toml

render-nginx.sh

Renders nginx/ulicraft-caddy.conf.tmpl (the host nginx that terminates TLS in front of caddy), substituting $BASE_DOMAIN $APP_DIR $CADDY_HTTP_PORT. Prints to stdout by default; --install writes to sites-available, symlinks sites-enabled, nginx -t, and reloads nginx. See 15-letsencrypt.md.

issue-letsencrypt.sh

Issues a separate cert for the apex and each LE_SUBDOMAINS entry via acme.sh + OVH DNS-01 → certs/<name>/{cert,key}.pem. See 15-letsencrypt.md.

fetch-launcher.sh

Downloads FjordLauncherUnlocked release assets → launcher/<tag>/ and maintains a latest symlink + stable per-OS filename symlinks. Full script in 06-launcher.md.

export-server-config.sh

One-shot, once per host. Copies /data/config out of the mc_data volume into ./server-config so the rw bind mount ./server-config:/data/config does not shadow the mod configs the server already generated. Halts if the target is non-empty, if the minecraft container is still running, or if the mc_data volume name is ambiguous. Chowns the result to MC_UID/MC_GID (default 1000:1000; oxps needs 1002). See 05-minecraft.md.

Generated / gitignored

drasl/config/config.toml      # rendered
nmsr/config.toml              # rendered
launcher/                     # launcher assets
www/                          # landing build output
certs/                        # Let's Encrypt certs
server-mods/                  # synced from the distribution
server-config/                # exported from mc_data, then bind-mounted rw
.env                          # secrets + host-specific

Tasks

• Write tooling/render-config.sh (above), chmod +x
• Write tooling/sync-server-mods.sh (see 04-mods.md)
• Write tooling/render-nginx.sh (see 15)
• Write tooling/issue-letsencrypt.sh (see 15)
• Write tooling/fetch-launcher.sh (see 06)
• Add gettext (envsubst) + jq to host prereqs doc
• Update .gitignore for rendered configs + launcher/ + www/ + certs/