@babylonjs-toolkit/server 0.0.0-stage → 9.35.1

package/templates/init/docker-compose.websocket.yml

@@ -0,0 +1,41 @@
+# Babylon Game Server {{version}} behind Caddy: WebSocket (wss://) with HTTPS at Caddy.
+# TLS: edge (Caddy gets the certificate for CADDY_SITE)
+# UDP: not supported on this recipe (Caddy proxies TCP only; use docker-compose.full.yml for HTTP/3)
+# Auth: set GAME_SERVER_AUTH_* to enable
+#
+#   CADDY_SITE=game.example.com docker compose -f docker-compose.websocket.yml up -d
+# Players then use wss://game.example.com. Local check without a domain:
+#   CADDY_SITE=:8080 docker compose -f docker-compose.websocket.yml up -d
+#   curl -s http://localhost:8080/game-server/health
+services:
+  game-server:
+    image: ${GAME_SERVER_IMAGE:-ghcr.io/mackeyk24/babylon-game-server:{{version}}}
+    restart: unless-stopped
+    environment:
+      GAME_SERVER_CONFIG: /app/config/babylon-game-server.config.mjs
+      # Caddy forwards the player's address in x-forwarded-for.
+      GAME_SERVER_TRUST_PROXY: "true"
+      # Admin console data (accounts, bans, audit log) on the game-server-data volume. Back it up.
+      GAME_SERVER_ADMIN_DATA_DIR: /data
+    volumes:
+      - ./babylon-game-server.config.mjs:/app/config/babylon-game-server.config.mjs:ro
+      - game-server-data:/data
+    # No published ports: only Caddy reaches the server, on the compose network.
+
+  caddy:
+    image: caddy:2
+    restart: unless-stopped
+    depends_on:
+      - game-server
+    ports:
+      - "${CADDY_HTTP_PORT:-443}:443"
+      - "8080:8080"
+    environment:
+      - CADDY_SITE
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+
+volumes:
+  caddy-data:
+  game-server-data:

package/templates/init/fly.toml

@@ -0,0 +1,56 @@
+# TLS: edge (Fly's proxy terminates TLS on 443 with a certificate for your app or custom domain)
+# UDP: not supported on this host (see below)
+# Auth: set GAME_SERVER_AUTH_* to enable (fly secrets set GAME_SERVER_AUTH_ENABLED=true ...)
+#
+# Babylon Game Server {{version}} on Fly.io, WebSocket only. Deploy from this folder:
+#   fly launch --copy-config --no-deploy   (pick an app name; it replaces "app" below)
+#   fly deploy
+# Players use wss://<app>.fly.dev (or your custom domain after `fly certs add`).
+#
+# Why no UDP / HTTP/3: Fly delivers UDP only to a socket bound to the special address fly-global-services, while TCP
+# services bind 0.0.0.0. The server's HTTP/3 transport binds one address for TCP and UDP together, so it cannot serve
+# both on Fly (https://docs.fly.io/networking/udp-and-tcp). Players get the WebSocket, which works everywhere.
+app = "babylon-game-server"
+primary_region = "iad"
+# Longer than the 30 s drain, so running sessions finish before the machine is stopped.
+kill_timeout = "45s"
+
+[build]
+  dockerfile = "Dockerfile"
+
+[env]
+  GAME_SERVER_PORT = "2567"
+  # Fly's proxy sends the player's address in x-forwarded-for.
+  GAME_SERVER_TRUST_PROXY = "true"
+  # Admin console data (accounts, bans, audit log) on the volume mounted below.
+  GAME_SERVER_ADMIN_DATA_DIR = "/data"
+
+# The admin console's data volume (fly deploy creates it; one volume per machine, so with more than one machine set
+# GAME_SERVER_REDIS_URL and the console keeps its data in Redis instead). Snapshot it with `fly volumes snapshots`.
+[[mounts]]
+  source = "game_server_data"
+  destination = "/data"
+
+[[services]]
+  internal_port = 2567
+  protocol = "tcp"
+  auto_stop_machines = "off"
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[services.ports]]
+    port = 443
+    handlers = ["tls", "http"]
+
+  [[services.ports]]
+    port = 80
+    handlers = ["http"]
+    force_https = true
+
+  [[services.http_checks]]
+    path = "/game-server/ready"
+    interval = "15s"
+    timeout = "5s"
+    grace_period = "20s"
+    method = "get"
+    protocol = "http"

package/templates/init/heroku.yml

@@ -0,0 +1,11 @@
+# TLS: edge (the Heroku router terminates TLS for <app>.herokuapp.com and your custom domains)
+# UDP: not supported on this host (the Heroku router carries HTTP and WebSocket only: https://devcenter.heroku.com/articles/http-routing)
+# Auth: set GAME_SERVER_AUTH_* to enable (heroku config:set GAME_SERVER_AUTH_ENABLED=true ...)
+#
+# Babylon Game Server {{version}} on Heroku, WebSocket only, built from the Dockerfile in this folder:
+#   heroku create --stack container      (or deploy with the button that app.json describes)
+#   git push heroku main
+# Heroku sets PORT, which the server honours. Players use wss://<app>.herokuapp.com.
+build:
+  docker:
+    web: Dockerfile

package/templates/init/kubernetes/deployment.yaml

@@ -0,0 +1,71 @@
+# TLS: edge (your Ingress or load balancer terminates TLS), or server if you mount a certificate and set GAME_SERVER_TLS_*
+# UDP: not supported on this host by default (it needs server TLS and a LoadBalancer Service that forwards UDP; see DEPLOY.md)
+# Auth: set GAME_SERVER_AUTH_* to enable (from a Secret, with env valueFrom.secretKeyRef)
+#
+# Babylon Game Server {{version}} on Kubernetes:
+#   kubectl apply -f kubernetes/redis.yaml -f kubernetes/deployment.yaml -f kubernetes/service.yaml
+# Each pod advertises its own address for seat reservations (GAME_SERVER_PUBLIC_ADDRESS from the pod IP), and all pods
+# share one Redis, so a session's players always reach the pod that holds it. The pod IP must be reachable by players
+# (flat or routable pod network); otherwise give each pod its own external address (see service.yaml).
+# Admin console data (accounts, bans, audit log) lives in that shared Redis, which keeps it on the
+# babylon-game-server-data volume (redis.yaml). Without Redis, run one replica and mount a PersistentVolumeClaim at /data.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: babylon-game-server
+  labels:
+    app: babylon-game-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: babylon-game-server
+  template:
+    metadata:
+      labels:
+        app: babylon-game-server
+    spec:
+      # Longer than the 30 s drain, so running sessions finish before the pod is killed.
+      terminationGracePeriodSeconds: 45
+      securityContext:
+        runAsNonRoot: true
+        # The image's "node" user.
+        runAsUser: 1000
+      containers:
+        - name: game-server
+          image: ghcr.io/mackeyk24/babylon-game-server:{{version}}
+          ports:
+            - name: game
+              containerPort: 2567
+              protocol: TCP
+          env:
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: GAME_SERVER_PUBLIC_ADDRESS
+              value: "$(POD_IP):2567"
+            - name: GAME_SERVER_REDIS_URL
+              value: redis://babylon-game-server-redis:6379
+            - name: GAME_SERVER_LOG_FORMAT
+              value: json
+            # Used only when GAME_SERVER_REDIS_URL is unset (the image's default; the pod's /data is not kept).
+            - name: GAME_SERVER_ADMIN_DATA_DIR
+              value: /data
+          livenessProbe:
+            httpGet:
+              path: /game-server/health
+              port: game
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /game-server/ready
+              port: game
+            periodSeconds: 5
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              memory: 1Gi

package/templates/init/kubernetes/redis.yaml

@@ -0,0 +1,73 @@
+# TLS: edge (Redis is cluster-internal; it is never exposed to players)
+# UDP: not supported on this host (Redis is TCP only and not player-facing)
+# Auth: set GAME_SERVER_AUTH_* to enable (player auth is configured on the game server, not here)
+#
+# One Redis shared by every game server pod (session listing and seat reservations across pods). It is also the admin
+# console's data store (accounts, bans, audit log), so it keeps an append-only file on the babylon-game-server-data
+# PersistentVolumeClaim (the cluster's default storage class). Use a managed Redis with persistence instead by changing
+# GAME_SERVER_REDIS_URL (then skip this file).
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: babylon-game-server-data
+  labels:
+    app: babylon-game-server-redis
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: babylon-game-server-redis
+  labels:
+    app: babylon-game-server-redis
+spec:
+  replicas: 1
+  # One pod at a time owns the ReadWriteOnce volume.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: babylon-game-server-redis
+  template:
+    metadata:
+      labels:
+        app: babylon-game-server-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7
+          args: ["--save", "", "--appendonly", "yes"]
+          ports:
+            - name: redis
+              containerPort: 6379
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: babylon-game-server-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: babylon-game-server-redis
+  labels:
+    app: babylon-game-server-redis
+spec:
+  type: ClusterIP
+  selector:
+    app: babylon-game-server-redis
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: redis

package/templates/init/kubernetes/service.yaml

@@ -0,0 +1,24 @@
+# TLS: edge (put an Ingress with TLS in front of this Service for wss://)
+# UDP: not supported on this host (a ClusterIP Service behind an HTTP Ingress carries TCP only)
+# Auth: set GAME_SERVER_AUTH_* to enable
+#
+# The cluster-internal address of the game servers, for an Ingress (WebSocket) or other in-cluster clients.
+# When scaled past one replica, this Service alone is not enough: Colyseus seat reservations send each player to the
+# pod that holds the session, so every pod needs its own address players can reach (GAME_SERVER_PUBLIC_ADDRESS in
+# deployment.yaml), such as a routable pod IP, hostNetwork, or one LoadBalancer Service per pod (a StatefulSet).
+# A session never spans pods.
+apiVersion: v1
+kind: Service
+metadata:
+  name: babylon-game-server
+  labels:
+    app: babylon-game-server
+spec:
+  type: ClusterIP
+  selector:
+    app: babylon-game-server
+  ports:
+    - name: game
+      port: 2567
+      targetPort: game
+      protocol: TCP