Reference

Changelog

NGCP is pre-1.0. It is built in phases; each phase below is a group of features that was built, tested and (where noted) accepted on test machines running Windows 11 and Ubuntu 24.04. Interfaces can still change between versions. The first installable packages were version 0.6.0.

Phase 7: Tenancy and billing (accepted 2026-11-08)

Packages: products with a game, slot range, CPU / memory / disk limits, allowed datacenters and variable defaults; game servers are placed on a node automatically. See Resellers and packages.
Resellers: their own customers, packages, quotas (accounts, game servers, slots, memory, disk) and branding; nothing outside their tenancy is visible to them.
Sub-users: give someone access to one game server by e-mail, with exactly the permissions you choose.
Billing API and WHMCS module: provision from a package, suspend with a reason, unsuspend, terminate, change package, usage, one-time “Log in to the game panel” links. See Billing and WHMCS.
Any Steam dedicated server: a generic game where an administrator sets the Steam app id and start command, with Workshop mods where the game has them. See shipped games.
Suspend now stops the server gracefully, ends open SFTP sessions and pauses its scheduled tasks; unsuspend starts a server that was running.

0.6.1: Windows setup and Linux appliance (2026-11-07)

NGCP Setup for Windows (NGCP-Setup-X.Y.Z.exe): one installer for the panel, game servers or both, with unattended options; one entry in Programs and Features.
The Linux appliance: Ubuntu 24.04 with NGCP as an installer ISO, a Hyper-V VHDX and a VMware OVA. A first-boot setup on the server’s screen (role, host name, network, time zone, administrator, SSH, firewall), a server menu, unattended seeds. See The Linux appliance.
The panel’s setup can make its own server a game node: This server runs game servers too. The agent on the same machine joins by itself, no token to copy.
Windows agents connect right after starting: the agent’s own firewall rules are now made in the background (the first connection used to take 20 to 50 seconds).
An agent that has not joined a panel yet stops cleanly: the service is no longer reported as failed after a shutdown.

Phase 6: Automation (accepted 2026-11-07)

Backend, web screens and end-to-end tests are complete, and the acceptance run on test machines passed on 7 November 2026: a nightly backup of an ArmA 3 server to MinIO ran and restored, a 06:00 restart fired on a Linux and a Windows node while the controller was stopped, RCON #shutdown stopped ArmA cleanly, and the player count shows on the overview.

Scheduled tasks

Cron schedules (five fields or @hourly / @daily / @weekly / @monthly) in any IANA time zone, per service or global for a game and / or node.
Actions: restart, stop, start, update, backup, RCON command, script (administrators only; bash or PowerShell as the service account) and notify.
Tasks run on the node from the stored spec, so they fire while the controller is down. Results made offline are kept in an on-disk outbox and reported when the link returns.
Only when empty (skip while players are online), player warnings over RCON N minutes ahead, custom messages. Missed runs are not run late (catch-up of at most five minutes). Run history per service.

Backups

Targets: a local folder on the node, SFTP (password or key, host-key pinning) or S3-compatible storage (AWS, MinIO, Backblaze B2, Wasabi). Secrets sealed and sent only to nodes that need them.
Streaming .tar.gz of the install directory with the game’s include / exclude rules, no temporary copy; locked files skipped and reported; before_backup hook.
Retention by count and age per target.
Restore through a staging folder: a failed download leaves the server untouched; files outside the backup rules are kept; the service restarts if it was running.

RCON and status

RCON clients for Source, BattlEye (ArmA, DayZ), Minecraft and TeamSpeak ServerQuery, run by the agent on 127.0.0.1. RCON console endpoint, every command audited.
Graceful stop over RCON (ArmA #shutdown) with the stop timeout as fallback.
Status queries (A2S, Minecraft ping, generic TCP) every few seconds: players, maximum, server name and map on each service and in its metrics.

Mod manager

Mod lists per modlist variable with load order; add by Workshop id or link; collections expand into their items (nested too); per-game mod catalog curated by administrators.

Notifications

Webhooks: generic JSON signed with HMAC-SHA256, Discord, and e-mail through SMTP.
Events: service crashed, install finished / failed, backup and restore completed / failed, scheduled task failed / notify, node offline (after a minute) / online.
Delivery queue with retries and back-off, delivery log, test messages, editable templates.

Database migration 6 adds the tables for all of this; it is applied automatically on start.

0.6.0: Packages and first-run setup (2026-11-07)

Windows MSI installers for the controller (with a bundled PostgreSQL 16 and the Visual C++ runtime) and the agent (with unattended enrollment).
Linux .deb and .rpm packages for amd64 and arm64 with hardened systemd units.
A first-run setup page: built-in or existing database, first administrator, address, TLS (none, certificate files, self-signed).
One-line agent installers served by the panel, with SHA-256 checks.
A Docker image and compose file (not yet run on a Docker host).
Tested: Windows 11 install, setup in 32 seconds, agent installed and enrolled in 9 seconds, uninstall and reinstall keeping data; Ubuntu 24.04 install and setup, agent in 5 seconds.

Known issues: packages are not code-signed; the first connection of a Windows agent takes about 20 seconds (fixed in 0.6.1); the setup page does not remember answers across a reload.

Phase 5: Files, SFTP and config editors (2026-11-06)

Web file manager: browse, edit with conflict detection, rename, move, copy, delete, permissions, zip / tar.gz / tar, search, resumable chunked uploads of any size, downloads.
One jail for all file access: no escape through .., links, junctions or Windows short names; deny rules; disk quotas.
Optional direct transfers between browser and node with signed links.
Built-in SFTP server on every node with panel logins (<user>.<service id>), SSH keys, and the panel’s lockout and allow-list rules.
Config editors: forms generated from the game definition for INI, key=value, env, JSON, YAML, XML, ArmA .cfg and regex files, keeping comments and layout; settings bound to variables, slots and ports.
Accepted: jail tests on both OSes; a 5 GiB upload with flat controller memory; ArmA maxPlayers edited in the form changed server.cfg, the slot count and the server-browser maximum; FileZilla logged in over SFTP.

Phase 4: Game definitions and installers (2026-11-06)

The YAML game-definition format with a JSON Schema, strict validation, templates and conditions; a games admin with an editor, version history and diffs.
Installers: SteamCMD (separate node account, Steam Guard through the console), Workshop mods (hard links, keys), HTTPS downloads with checksums and resolvers for Paper, Mojang and Eclipse Temurin, git, scripts and file steps; update, reinstall (keeping preserved files) and cancel.
Steam account vault.
Shipped games: ArmA 3, Minecraft: Java Edition, Valheim, Counter-Strike 2.
Accepted: ArmA 3 with two headless clients and a Workshop mod on Windows and Linux; Minecraft on Linux; reinstall kept server.properties.

Phase 3: Services and console (2026-11-06)

Services with port blocks, per-service OS accounts, isolation (Job Objects on Windows, cgroup v2 on Linux), CPU / memory / process limits and firewall rules.
Start, stop, restart, kill, suspend, delete; crash restarts with back-off; game servers keep running when the controller restarts.
Live console over one WebSocket (about 30 ms round trip), CPU and memory charts.
Accepted on both OSes: services run as their own account and cannot read each other’s files; stop leaves no processes; crash restarts back off; console within 200 ms.

Phase 2: Nodes and enrollment (2026-11-06)

Node agent for Windows and Linux as a system service; enrollment with one-time tokens and a CA pin; mutual-TLS AgentLink; live CPU, memory, disk and network; signed self-updates.
Nodes UI with datacenters, the Add a node flow and node pages.
Accepted: a Windows and a Linux node online within a second of starting, surviving a controller restart.

Phase 1: Controller core (2026-11-06)

PostgreSQL schema, accounts with roles and permissions, Argon2id passwords, two-step verification with recovery codes, lockout, sessions, API keys with scopes, admin IP allow-list, audit log, settings.
REST API with OpenAPI 3.1 and a built-in API reference; the web panel shell.

Phase 0: Bootstrap (2026-11-06)

Project layout, builds for Windows and Linux (amd64, arm64), tests and linting.

Coming next

Phase 7, tenancy and billing: packages, sub-user grants in the panel, resellers, a billing API and a WHMCS module, suspension on overdue invoices, usage.
Phase 8, monitoring and hardening: metrics retention and charts, alerts, node drain, moving and cloning services between nodes, agent version management, certificate rotation, load tests.
Phase 9, packaging and extras: ACME certificates, an importer for existing panels, more games (TeamSpeak 3, Mumble, Rust, DayZ and others), single sign-on (OIDC), an optional Docker runtime for game servers, code-signed packages.