Running game servers

Files and SFTP

Every service has its own directory on its node. You can work with it in the panel’s Files tab or with any SFTP client. Both need the service permission files, and both are held to the same rules: you cannot leave the service directory, denied paths stay hidden, and the disk quota applies.

The Files tab

The Files tab is a folder browser for the service directory. It can:

• create folders, rename, move, copy and delete files and folders;
• change permissions (Linux);
• compress to zip, tar.gz or tar, and extract those formats;
• search by name below a folder (up to 500 results);
• open text files up to 2 MiB in an editor;
• upload files of any size, by dragging them in or choosing them;
• download files;
• show the directory’s size and quota.

New and uploaded files belong to the service’s own account, so the game can always change them.

Editing files

The editor saves atomically (a temporary file, then a rename). If the file changed on disk since you opened it (for example the game rewrote it), saving is refused with a conflict so you do not overwrite the newer version; reload and redo your change. Leaving the editor with unsaved changes asks first.

For config files that have a form, the Configs tab is usually easier and keeps settings in sync with the panel.

Uploads

Uploads are chunked and resumable:

• The browser sends the file in slices (16 MiB by default, at most 64 MiB per request) and adapts the slice size to the connection.
• Failed slices are retried; an interrupted upload can resume where it stopped, and it keeps going while you switch tabs in the panel.
• The bytes are staged inside the service directory (in the hidden .ngcp folder, counted in the quota) and the file appears at its path only when the last slice arrived.
• Upload sessions live in the controller’s memory: if the controller restarts during an upload, start the upload again. Staged data that nobody finishes is deleted by the node after a day.

Through the controller, a 5 GiB upload has been measured at about 63 MB/s and downloads at about 220 MB/s on a LAN, with constant memory use on the controller.

Direct transfers

By default, uploads and downloads are relayed through the controller. For large files you can let browsers talk to the node directly instead. This needs, on each node:

1. A DNS name for the node and a certificate for it that browsers trust (the node’s internal NGCP certificate is not trusted by browsers).

2. In agent.yaml:

   files_listen: ":8444"
   files_public_url: "https://node1.example.com:8444"
   files_cert_file: "/etc/ngcp/node1.crt"
   files_key_file: "/etc/ngcp/node1.key"
   

3. The port open to your users, and a restart of the agent.

The panel then hands out signed links that are valid for one hour and bound to that node, service, operation and file. The browser tries the direct link first and falls back to the controller when the node is not reachable. Direct transfers are implemented and tested in software but have not been tried with a public certificate in the lab yet.

Quotas and deny rules

Administrators set both in the service’s Settings tab.

Disk quota (0 = unlimited) limits what users put into the service directory. It is checked before every write, copy, upload slice and extracted byte, so an archive that unpacks to more than the quota stops at the quota. Files the game writes itself are counted at the next scan of the directory (every five minutes), so the quota is “soft” for the game and “hard” for users.

Deny rules are globs (** for any depth) that hide paths from users and refuse every operation on them, in the file manager and over SFTP:

• The game definition brings its own (for ArmA 3: *.exe, *.dll, *.so, battleye/**, profiles/BattlEye/**).
• Administrators can add more per service.
• Matching is case-insensitive on Windows.
• Administrators are not affected by deny rules.
• The .ngcp folder is always hidden.

The check is made on the file’s real location after opening it, so links, junctions and Windows 8.3 short names (BATTLE~1) cannot reach a denied file under another name.

Note that game config files can contain passwords (for example the join and admin passwords in ArmA’s server.cfg); anyone with the files permission can read them.

SFTP

Each node runs a built-in SFTP server (port 2022 by default) that uses panel accounts. There are no separate FTP accounts.

Connecting

The service’s Overview shows the SFTP card with the host, port, user name and the server’s key fingerprint.

sftp -P 2022 [email protected]

In FileZilla or WinSCP choose the SFTP protocol and enter the values above. On the first connection compare the key fingerprint the client shows with the one in the SFTP card.

Accounts with two-factor sign-in

SFTP cannot ask for a second factor. So an account with two-factor authentication must use an SSH key for SFTP, unless a SuperAdmin allows passwords anyway with the security setting Allow SFTP passwords for accounts with two-step verification in Settings -> Security (sftp_password_with_2fa).

To add a key, open your account page (the menu at your name) and add it under SSH keys for SFTP. Paste one OpenSSH public key, for example the contents of ~/.ssh/id_ed25519.pub. Accepted: Ed25519, ECDSA, RSA (2048 bits or more) and the FIDO sk- variants of Ed25519 and ECDSA.

ssh-keygen -t ed25519 -C "alice laptop"
sftp -P 2022 -i ~/.ssh/id_ed25519 [email protected]

How SFTP logins are checked

• The node asks the controller for every login. The controller applies the same rules as the web sign-in (lockout, inactive accounts, the admin IP allow-list) and checks that the account has the files permission on that service and that the service lives on that node. Logins are recorded in the audit log as sftp.login.
• A successful answer is cached on the node for 60 seconds (clients open several connections), so a disabled account or changed password stops working within a minute.
• Failed logins are limited to 20 per address in 10 minutes on each node.
• Only file transfer is offered: no shell, no command execution, no port forwarding, no links.

To turn SFTP off on a node, set sftp_listen: off in its agent.yaml and restart the agent.