Linux

Linux notes

Running NGCP on Linux: services, paths, logs, isolated accounts, upgrades, backups, removal and Linux-only problems. The general picture is in Operations and Troubleshooting.

Services

systemctl status ngcp-controller ngcp-agent
sudo systemctl restart ngcp-controller
sudo ngcp-controller setup-url        # setup page address (only before the setup is done)

Restart the controller after changing controller.env, and the agent after changing agent.yaml. See Command line.

Files and folders

Appliance-only files are listed in The Linux appliance.

Logs

journalctl -u ngcp-controller -f
journalctl -u ngcp-agent --since "1 hour ago"

More detail: set NGCP_LOG_LEVEL=debug in controller.env or log_level: debug in the agent’s agent.yaml and restart.

Isolated accounts

The agent runs as root because it creates accounts, limits and firewall rules. Game servers never run as the agent:

• Each service gets a locked system user ngcp_s<id> (no shell, no home).
• The install tree is owned by it with mode 0750.
• Its processes run in their own cgroup v2 (cpu.max, memory.max, pids.max), so stopping a service kills every process it started.
• SteamCMD runs under a separate per-node account, ngcp_steam, so game servers cannot read the cached Steam login.

CPU and memory limits use cgroup v2 with systemd delegation (the shipped unit sets Delegate=yes). Without cgroup v2 the agent falls back to process groups and logs why; accounts and directory isolation still apply. seccomp / landlock sandboxing of game processes is not implemented.

More in Concepts and Security.

SteamCMD 32-bit libraries

SteamCMD is a 32-bit program, so Linux nodes that run SteamCMD games (ArmA 3, CS2, Valheim) need its libraries. On Debian or Ubuntu install them once:

sudo dpkg --add-architecture i386
sudo apt update
sudo apt install lib32gcc-s1 lib32stdc++6

Without them an install fails with a message that says so.

Firewall

Rules are managed through ufw or firewalld when one of them is active; with neither, nothing is changed and you open the ports yourself. Direct nftables / iptables management is not implemented. The controller’s ports (8080 and 8443) are opened as shown in Installing on Linux; the node’s ports are in Adding a Linux node.

Good to know

• Scheduled script tasks and game-definition scripts run with bash.
• ArmA mod files are lower-cased, as the Linux server expects.
• The file manager can change permissions on Linux.
• On a packaged controller with the built-in database, run ngcpctl as the ngcp user so peer authentication works, with the URL from /etc/ngcp/controller.env.
• Certificate files must be readable by the user ngcp.

Upgrading

Install the newer package over the old one. Configuration, keys, the database and game files stay. Back up the database and master key first.

sudo apt install ./ngcp-controller_X.Y.Z_amd64.deb
sudo dnf install ./ngcp-controller-X.Y.Z-1.x86_64.rpm

Migrations, agent updates and what to expect are in Operations. You can also install the newer agent package on the node directly; the enrollment is kept. The appliance has its own update command.

Backing up the built-in database

sudo -u ngcp pg_dump -Fc -d ngcp > /root/ngcp-$(date +%F).dump

Run this on a timer (cron) and copy the dumps off the machine. The Docker command, what else to back up and how to restore: Backing up the panel.

Uninstalling

Controller: sudo apt remove ngcp-controller or sudo dnf remove ngcp-controller. /etc/ngcp and the database stay. A reinstall over kept data comes back in normal mode with everything as it was. For a complete removal:

sudo -u postgres dropdb ngcp
sudo -u postgres dropuser ngcp
sudo rm -rf /etc/ngcp /var/lib/ngcp-controller

Agent: follow the steps for a clean node. Uninstall it with sudo apt remove ngcp-agent, then delete /var/lib/ngcp and /opt/ngcp.

Troubleshooting

More in Troubleshooting.