feat: ATM10-Statistikportal
Statistikportal für den All-the-Mods-10-Server (Minecraft 1.21.1, NeoForge 21.1): - mod/: serverseitige NeoForge-Mod atmstats – Ereignisse, Live-Zähler, Servergesundheit, FTB-Dateien; Outbox auf der Festplatte, signierter gzip-Versand per HTTPS mit Backoff - backend/: Fastify + PostgreSQL – idempotenter Ingest, Projektionen, Parser für SNBT, FTB Quests/Teams, world/stats, world/advancements und latest.log; Ranglisten, Snapshots, Retention, öffentliche API, SSE-Live-Updates, Admin mit argon2/CSRF, SFTP-Worker - web/: Next.js-Dashboard – Übersicht, Ranglisten, Spielerprofile, ATM10, Server, Datenquellen, Verwaltung - shared/: Protokoll v1 und API-Typen; tools/: Simulator, Log-Anonymisierer, RCON-Client - deploy/: Docker Compose hinter Traefik, Backup; docs/: Architektur, Datenquellen, Betrieb Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
lucashahmannandClaude Opus 5.5 committed
1 parent
56d2078e6a
commit
e66f89f49e
214 files changed
+27077
No files matched your search
@@ -0,0 +1,33 @@
|
||||
# ---- Domain & Traefik -------------------------------------------------------
|
||||
DOMAIN=stats.example.de
|
||||
# Name des Docker-Netzes, an dem Traefik hängt
|
||||
TRAEFIK_NETWORK=traefik
|
||||
TRAEFIK_ENTRYPOINT=websecure
|
||||
TRAEFIK_CERTRESOLVER=letsencrypt
|
||||
# Öffentliche IP(s) des Mine-Hoster-Gameservers, kommagetrennt (CIDR). Nur sie dürfen /api/ingest erreichen.
|
||||
INGEST_ALLOWED_IPS=203.0.113.10/32
|
||||
|
||||
# ---- Datenbank -------------------------------------------------------------
|
||||
POSTGRES_PASSWORD=bitte-ein-langes-zufaelliges-passwort
|
||||
BACKUP_KEEP_DAYS=14
|
||||
|
||||
# ---- Backend ---------------------------------------------------------------
|
||||
NODE_ENV=production
|
||||
PUBLIC_ORIGIN=https://stats.example.de
|
||||
# Gemeinsames Geheimnis mit der Mod (hmacSecret in config/atmstats-server.toml), mind. 32 Zeichen:
|
||||
# openssl rand -hex 32
|
||||
INGEST_HMAC_SECRET=
|
||||
SERVER_ID=atm10
|
||||
TRUST_PROXY=true
|
||||
TIMEZONE=Europe/Berlin
|
||||
LOG_LEVEL=info
|
||||
|
||||
# ---- SFTP-Abgleich (optional, Mine-Hoster Gamepanel → Einstellungen → SFTP-Details) ----
|
||||
SFTP_HOST=
|
||||
# Port laut Gamepanel (Einstellungen → SFTP-Details)
|
||||
SFTP_PORT=22
|
||||
SFTP_USER=
|
||||
SFTP_PASSWORD=
|
||||
SFTP_ROOT=/
|
||||
SFTP_WORLD_DIR=world
|
||||
SFTP_INTERVAL_MIN=15
|
||||
@@ -0,0 +1,34 @@
|
||||
#!/bin/sh
|
||||
# PostgreSQL-Backup für ATM10 Stats.
|
||||
# backup.sh once – ein Backup jetzt erstellen
|
||||
# backup.sh loop – täglich ein Backup, ältere als BACKUP_KEEP_DAYS (Standard 14) löschen
|
||||
# Erwartet PGHOST, PGUSER, PGDATABASE, PGPASSWORD (im Compose-Service gesetzt).
|
||||
set -u
|
||||
|
||||
DIR=/backups
|
||||
KEEP="${BACKUP_KEEP_DAYS:-14}"
|
||||
|
||||
# Each step checks its own result: inside "backup_once || …" the shell ignores set -e.
|
||||
backup_once() {
|
||||
file="$DIR/atm-$(date -u +%Y%m%dT%H%M%SZ).dump"
|
||||
if ! pg_dump --format=custom --file="$file.partial"; then
|
||||
rm -f "$file.partial"
|
||||
echo "backup: FAILED (pg_dump)" >&2
|
||||
return 1
|
||||
fi
|
||||
mv "$file.partial" "$file" || { echo "backup: FAILED (mv)" >&2; return 1; }
|
||||
find "$DIR" -name 'atm-*.dump' -mtime +"$KEEP" -delete
|
||||
echo "backup: $file ($(du -h "$file" | cut -f1))"
|
||||
}
|
||||
|
||||
mkdir -p "$DIR"
|
||||
case "${1:-once}" in
|
||||
once) backup_once ;;
|
||||
loop)
|
||||
while true; do
|
||||
backup_once
|
||||
sleep 86400
|
||||
done
|
||||
;;
|
||||
*) echo "usage: backup.sh once|loop" >&2; exit 2 ;;
|
||||
esac
|
||||
@@ -0,0 +1,11 @@
|
||||
# Lokaler Testbetrieb ohne Traefik: veröffentlicht web (3000) und api (3001) auf localhost.
|
||||
# docker network create traefik # einmalig, das Basis-Compose erwartet das externe Netz
|
||||
# docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.local.yml --env-file deploy/.env.local up -d --build
|
||||
services:
|
||||
api:
|
||||
ports: ["127.0.0.1:3001:3001"]
|
||||
environment:
|
||||
# Login-Cookie ohne Secure-Flag, da lokal ohne HTTPS
|
||||
NODE_ENV: development
|
||||
web:
|
||||
ports: ["127.0.0.1:3000:3000"]
|
||||
@@ -0,0 +1,11 @@
|
||||
# Test-Datenbank für die Backend-Tests (npm test -w backend)
|
||||
services:
|
||||
db-test:
|
||||
image: postgres:16-alpine
|
||||
environment:
|
||||
POSTGRES_PASSWORD: postgres
|
||||
POSTGRES_DB: atm_test
|
||||
ports:
|
||||
- "127.0.0.1:54329:5432"
|
||||
tmpfs:
|
||||
- /var/lib/postgresql/data
|
||||
@@ -0,0 +1,115 @@
|
||||
# ATM10 Stats – Produktion hinter Traefik (DMZ-Server).
|
||||
# cp deploy/.env.example deploy/.env # Werte eintragen
|
||||
# docker compose -f deploy/docker-compose.yml --env-file deploy/.env up -d --build
|
||||
#
|
||||
# Traefik muss am externen Netz ${TRAEFIK_NETWORK} hängen. Nur web und api sind dort angebunden;
|
||||
# die Datenbank ist ausschließlich im internen Netz erreichbar.
|
||||
|
||||
name: atm10-stats
|
||||
|
||||
x-backend: &backend
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: backend/Dockerfile
|
||||
image: atm10-stats/backend:latest
|
||||
restart: unless-stopped
|
||||
env_file: ${ENV_FILE:-.env}
|
||||
environment:
|
||||
DATABASE_URL: postgres://atm:${POSTGRES_PASSWORD}@db:5432/atm
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
|
||||
services:
|
||||
db:
|
||||
image: postgres:16-alpine
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
POSTGRES_DB: atm
|
||||
POSTGRES_USER: atm
|
||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD fehlt}
|
||||
volumes:
|
||||
- db-data:/var/lib/postgresql/data
|
||||
networks: [internal]
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U atm -d atm"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
|
||||
api:
|
||||
<<: *backend
|
||||
command: ["node", "dist/server.js"]
|
||||
networks: [internal, traefik]
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=${TRAEFIK_NETWORK}
|
||||
# Public API and SSE
|
||||
- traefik.http.routers.atm-api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)
|
||||
- traefik.http.routers.atm-api.priority=100
|
||||
- traefik.http.routers.atm-api.entrypoints=${TRAEFIK_ENTRYPOINT}
|
||||
- traefik.http.routers.atm-api.tls.certresolver=${TRAEFIK_CERTRESOLVER}
|
||||
- traefik.http.routers.atm-api.service=atm-api
|
||||
# Ingest from the game server only (IP allow list, Traefik v3 "ipallowlist")
|
||||
- traefik.http.routers.atm-ingest.rule=Host(`${DOMAIN}`) && PathPrefix(`/api/ingest`)
|
||||
- traefik.http.routers.atm-ingest.priority=200
|
||||
- traefik.http.routers.atm-ingest.entrypoints=${TRAEFIK_ENTRYPOINT}
|
||||
- traefik.http.routers.atm-ingest.tls.certresolver=${TRAEFIK_CERTRESOLVER}
|
||||
- traefik.http.routers.atm-ingest.middlewares=atm-ingest-allow
|
||||
- traefik.http.routers.atm-ingest.service=atm-api
|
||||
- traefik.http.middlewares.atm-ingest-allow.ipallowlist.sourcerange=${INGEST_ALLOWED_IPS}
|
||||
- traefik.http.services.atm-api.loadbalancer.server.port=3001
|
||||
|
||||
worker:
|
||||
<<: *backend
|
||||
command: ["node", "dist/worker.js"]
|
||||
networks: [internal]
|
||||
healthcheck:
|
||||
disable: true
|
||||
|
||||
web:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: web/Dockerfile
|
||||
image: atm10-stats/web:latest
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
API_INTERNAL_URL: http://api:3001
|
||||
depends_on: [api]
|
||||
networks: [internal, traefik]
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
- traefik.docker.network=${TRAEFIK_NETWORK}
|
||||
- traefik.http.routers.atm-web.rule=Host(`${DOMAIN}`)
|
||||
- traefik.http.routers.atm-web.priority=10
|
||||
- traefik.http.routers.atm-web.entrypoints=${TRAEFIK_ENTRYPOINT}
|
||||
- traefik.http.routers.atm-web.tls.certresolver=${TRAEFIK_CERTRESOLVER}
|
||||
- traefik.http.services.atm-web.loadbalancer.server.port=3000
|
||||
|
||||
backup:
|
||||
image: postgres:16-alpine
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
PGHOST: db
|
||||
PGUSER: atm
|
||||
PGDATABASE: atm
|
||||
PGPASSWORD: ${POSTGRES_PASSWORD}
|
||||
BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-14}
|
||||
volumes:
|
||||
- ./backup.sh:/backup.sh:ro
|
||||
- backups:/backups
|
||||
entrypoint: ["/bin/sh", "/backup.sh", "loop"]
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
networks: [internal]
|
||||
|
||||
networks:
|
||||
internal:
|
||||
traefik:
|
||||
external: true
|
||||
name: ${TRAEFIK_NETWORK:?TRAEFIK_NETWORK fehlt}
|
||||
|
||||
volumes:
|
||||
db-data:
|
||||
backups:
|
||||
Reference in new issue
Block a user