Getting started

Requirements

Supported platforms

Part	Windows	Linux
Controller	Windows 10/11 or Windows Server, x64 (MSI with a bundled PostgreSQL 16)	Debian / Ubuntu (.deb) or RHEL / Rocky / Alma (.rpm), amd64 or arm64; or Docker
Agent (node)	Windows 10/11 or Windows Server, x64 (MSI)	Debian / Ubuntu (.deb) or RHEL family (.rpm), amd64 or arm64; systemd required

What has actually been tested so far:

Configuration	Status
Controller MSI on Windows 11, built-in database	Tested: install, setup, uninstall, reinstall
Controller .deb on Ubuntu 24.04, built-in (local) database	Tested
Agent on Windows 11 (service, isolation, firewall, SteamCMD, SFTP)	Tested
Agent on Ubuntu 24.04 (systemd, cgroup v2, isolation, SteamCMD, SFTP)	Tested
.rpm packages	Built, not yet installed on a RHEL-family machine
linux/arm64 builds	Built, not yet run
Docker compose for the controller	Written, not yet run on a Docker host

The Windows packages are not code-signed yet; SmartScreen shows a warning when you run them.

Network ports

Port	Direction	Used for	Notes
8080/tcp	Browsers and nodes to the controller	Web UI, REST API, WebSocket, enrollment, agent downloads	Change with `NGCP_LISTEN`. Put it behind HTTPS (see TLS).
8443/tcp	Nodes to the controller	AgentLink (mutual TLS gRPC)	Change with `NGCP_GRPC_LISTEN`. Must reach the controller directly: do not put it behind an HTTP reverse proxy.
2022/tcp	SFTP clients to each node	Built-in SFTP server	`sftp_listen` in `agent.yaml`; `off` disables it.
Game ports	Players to each node	One block per service, from the node’s range (default 27000-29999)	Opened automatically in the Windows firewall, or ufw / firewalld when active.
Optional, e.g. 8444/tcp	Browsers to each node	Direct file transfers	Off unless configured; see Files and SFTP.

Nodes need no inbound port for the panel itself: they open the connection to the controller. RCON and status queries are made by the agent to 127.0.0.1 on the node, so RCON ports do not need to be reachable from outside.

A controller started by hand without configuration listens only on 127.0.0.1. The packages configure it to listen on all interfaces (:8080 and :8443).

Database

Built-in: on Windows the controller MSI includes PostgreSQL 16 and the setup creates a private cluster on 127.0.0.1. On Linux the package depends on the distribution’s PostgreSQL and prepares a local database ngcp with peer authentication (no password).
Existing: any PostgreSQL 14 or newer reachable from the controller.
Docker: the compose file runs PostgreSQL 16 next to the controller.

Sizing

NGCP itself is light; the game servers are what need resources.

Component	Guidance
Controller	1-2 CPU cores and 2 GB RAM is enough for small installs (the database included). Memory stays flat during large file transfers: a 5 GiB upload through the controller peaked at about 160 MB resident.
Agent	About 40-50 MB of memory, little CPU.
Database	Grows mostly with metrics samples and the audit log; plan a few GB.
Node disk	The game files of every service plus backups kept on the node. ArmA 3 is about 5.3 GB per service before mods; Counter-Strike 2 about 60 GB.
Node memory	Per game. An ArmA 3 server with two headless clients wants more than 4 GB (about 6.7 GB was measured).

Every service gets its own copy of the game files; there is no shared install between services. Workshop mods are hard-linked from the download, so they are not stored twice inside one service.

Node prerequisites

Administrator / root. The agent must run as LocalSystem or root to create service accounts, limits and firewall rules. The packages do this for you.
Linux, SteamCMD games (ArmA 3, CS2, Valheim): SteamCMD is a 32-bit program. On Debian or Ubuntu install its libraries once:
```
sudo dpkg --add-architecture i386
sudo apt update
sudo apt install lib32gcc-s1 lib32stdc++6
```
Without them an install fails with a message that says so.
Linux, limits: CPU and memory limits use cgroup v2 with systemd delegation (the shipped unit sets Delegate=yes). Without cgroup v2 the agent falls back to process groups and logs why; accounts and directory isolation still apply.
Linux, firewall: rules are managed through ufw or firewalld when one of them is active; with neither, nothing is changed. Direct nftables / iptables management is not implemented.
git only for game definitions that use a git step.
Java is not needed: the Minecraft definition downloads its own Java runtime per server.
SteamCMD is installed by the agent itself into <services dir>/../steamcmd.

Accounts you will need

A Steam account for games that log in with an account: the ArmA 3 server and its Workshop (the account must own ArmA 3 for Workshop downloads). Use a separate account, not a personal one. Valheim and CS2 download anonymously.
A Game Server Login Token for a public Counter-Strike 2 server.
An SMTP server if you want e-mail notifications.