Files

Oier Bravo Urtasun 67d1f82e6a refactor!: unify into one compose, drop airgap/mirror/dnsmasq/avahi/blessingskin

Collapse the override-file matrix into a single docker-compose.yml holding the
whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is
now just `docker compose up -d --build`.

Removed features (dead-ends for this deployment):
- airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy,
  caddy local-CA export, /ca.crt)
- dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS;
  DNS is now handled outside this repo (HOST_LAN_IP dropped)
- Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env)
- host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl)
- build-stack.sh and its run modes (online/airgap/core)

Production ingress is the only path now: host nginx terminates TLS (LE certs)
in front of caddy on a localhost-only port; caddy routes every vhost by Host
header. Launcher downloads move mirror/launcher -> launcher/.

Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs
(dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes)
deleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-09 02:14:09 +02:00

2.0 KiB

Raw Blame History

Drasl — self-hosted auth (Yggdrasil + skins)

Summary

Self-hosted, Yggdrasil-compatible auth + skin server. Drop-in Mojang replacement via authlib-injector. Image: unmojang/drasl:latest. Reached only through Caddy at auth.ulicraft.net; no host port.

OIDC/Keycloak is OUT for now — drasl runs in password-login mode (AllowPasswordLogin = true). Admin + guests register with a username/password on the drasl web UI. Re-introducing Keycloak OIDC later is a future task.

Config is TOML only (no env var support). So config.toml is rendered from config.toml.tmpl by tooling/render-config.sh to inject BASE_DOMAIN.

config.toml.tmpl (key fields)

BaseURL       = "http://auth.${BASE_DOMAIN}"
Domain        = "auth.${BASE_DOMAIN}"
ListenAddress = "0.0.0.0:25585"          # internal; Caddy proxies
DefaultAdminUsernames = ["admin"]

AllowPasswordLogin = true

[ApplicationOwner]
# ...

# OIDC block intentionally omitted for now (no Keycloak).
# [[RegistrationOIDC]]  ← future

Critical gotchas (carry-over)

1.21+ secure profile: drasl SignPublicKeys = false MUST pair with server ENFORCE_SECURE_PROFILE=FALSE. Linked — both or neither.
authlib endpoint = BaseURL + /authlib-injector → http://auth.ulicraft.net/authlib-injector. Must match on server and client. Network alias makes this identical inside/outside the stack.
Domain affects skins — if wrong, authlib clients may not see skins.

Tasks

Create drasl/config/config.toml.tmpl (password-login, no OIDC block)
Set BaseURL/Domain to auth.${BASE_DOMAIN}, ListenAddress 0.0.0.0:25585
Set SignPublicKeys = false
Wire render-config.sh → drasl/config/config.toml (gitignored)
Remove drasl host port from compose (internal only)
Update compose: drasl on mcnet, no 25585:25585 publish
Bootstrap admin account on first run; create guest accounts
Verify authlib endpoint responds through Caddy
Future: re-add [[RegistrationOIDC]] Keycloak block + secret file

2.0 KiB Raw Blame History