NGCP Game server control panel
Documentation
Contents

Windows

Windows notes

Running NGCP on Windows: services, paths, logs, isolated accounts, upgrades, backups, removal and Windows-only problems. The general picture is in Operations and Troubleshooting.

Services

Service Name Notes
Controller NGCP Controller (NGCPController) The panel
Built-in database NGCPPostgreSQL Runs as NetworkService, listens on 127.0.0.1 only
Agent NGCP Agent (NGCPAgent) LocalSystem, automatic start, restarts after 5 / 15 / 60 s
Get-Service NGCPController, NGCPAgent, NGCPPostgreSQL
Restart-Service NGCPController
& 'C:\Program Files\NGCP Controller\ngcp-controller.exe' service status

Restart the controller after changing controller.env, and the agent after changing agent.yaml. The agent is managed with ngcp-agent service status|stop|start|uninstall, the controller’s service with the same commands on ngcp-controller.exe; see Command line.

When the panel updates an agent, the agent swaps its binary and restarts through the service manager. The System event log records event 7031 (“terminated unexpectedly”) for this restart; that is expected. The agent’s game servers restart with it.

Files and folders

What Where
Controller program C:\Program Files\NGCP Controller
Controller configuration, master key, self-signed certificate C:\ProgramData\NGCP\Controller (SYSTEM and Administrators only)
Built-in database C:\ProgramData\NGCP\Controller\postgres\data
Setup token (until the setup is done) C:\ProgramData\NGCP\Controller\setup-token.txt
Agent data (agent.yaml, certificate, private key, log, stored specs) C:\ProgramData\NGCP, SYSTEM and Administrators only
Game servers C:\ngcp\services\svc-<id>
SteamCMD C:\ngcp\steamcmd (owned by ngcp_steam)

Logs

Program Where
Controller C:\ProgramData\NGCP\Controller\controller.log (rotated at 20 MB to .1)
Agent C:\ProgramData\NGCP\agent.log (local time; rotated at 10 MB)
Built-in PostgreSQL C:\ProgramData\NGCP\Controller\postgres\
Get-Content C:\ProgramData\NGCP\agent.log -Tail 50 -Wait

More detail: set NGCP_LOG_LEVEL=debug in controller.env or log_level: debug in the agent’s agent.yaml and restart.

Isolated accounts

The agent runs as LocalSystem because it creates accounts, limits and firewall rules. Game servers never run as the agent:

  • Each service gets a local account ngcp_s<id> with a random password (sealed with DPAPI), allowed only to log on as a batch job.
  • Its processes run inside a Job Object with memory, CPU-rate and process-count limits; stopping a service leaves no stray processes.
  • The install directory is readable only by SYSTEM, Administrators and that account.
  • SteamCMD runs under a separate per-node account, ngcp_steam, so game servers cannot read the cached Steam login.
Limit How Windows applies it
CPU (% of one core; 100 = one core, 0 = unlimited) Job Object hard CPU-rate cap
Memory (0 = unlimited) Job Object limit: allocations beyond it fail

More in Concepts and Security.

Runtimes for game servers

A clean Windows lacks files that many game servers need. On a node that runs game servers, NGCP Setup and the panel’s one-line command install these from Microsoft:

  • Visual C++ Redistributable 2015-2022 (x64)
  • Visual C++ Redistributable 2013 (x64)
  • DirectX End-User Runtime (the older DirectX files)

Setup carries them inside its own file. The one-line command downloads them from Microsoft, checks Microsoft’s signature on each one and skips any that are already installed. If one cannot be installed the node still installs, with a warning. DirectX is the slowest of the three and can take several minutes.

The agent MSI and the bare binary install only the agent, so on those nodes install the three runtimes yourself. A game that needs a missing runtime usually exits at once with code -1073741515 (0xC0000135).

Good to know

  • Scheduled script tasks and game-definition scripts run with PowerShell.
  • Deny rules match case-insensitively. Links, junctions and 8.3 short names (BATTLE~1) cannot reach a denied file under another name.
  • A running game often keeps its files locked. Locked files are skipped in a backup, which reports “N files could not be read (in use?) and are not in the backup”. Stop the server for a complete backup, or exclude them.
  • ArmA 3 writes its console to its own window, so the panel console shows the .rpt log tail.

Upgrading

Install the newer package over the old one. Configuration, keys, the database and game files stay. Back up the database and master key first.

msiexec /i ngcp-controller-X.Y.Z-x64.msi /qn

Migrations, agent updates and what to expect are in Operations. You can also install the newer agent package on the node directly; the enrollment is kept.

Backing up the built-in database

In PowerShell as Administrator:

$cfg = 'C:\ProgramData\NGCP\Controller\controller.env'
$url = (Select-String -Path $cfg -Pattern '^NGCP_DATABASE_URL=').Line.Substring(18)
& 'C:\Program Files\NGCP Controller\pgsql\bin\pg_dump.exe' --format=custom --file "D:\Backups\ngcp-$(Get-Date -Format yyyy-MM-dd).dump" --dbname $url
Copy-Item C:\ProgramData\NGCP\Controller\master.key D:\Backups\keys\

Run this as a Windows scheduled task and copy the dumps off the machine. What else to back up, and how to restore: Backing up the panel.

Uninstalling

NGCP Setup: Uninstall in Apps / Programs and Features removes both parts and keeps the panel’s database and settings in C:\ProgramData\NGCP.

Controller: remove NGCP Controller in Settings -> Apps. The services and program folder go; C:\ProgramData\NGCP\Controller (configuration, master key, built-in database data) stays. Delete that folder too for a complete removal. A reinstall over kept data comes back in normal mode with everything as it was.

Agent: follow the steps for a clean node. Uninstall it in Settings -> Apps -> NGCP Agent, then delete C:\ProgramData\NGCP and C:\ngcp.

Troubleshooting

Problem / message Fix
SmartScreen warns about NGCP Setup or an MSI Expected: the packages are not code-signed yet.
The setup page asks for a token You opened it from another computer. The token is in C:\ProgramData\NGCP\Controller\setup-token.txt.
Built-in database fails Check the setup’s message and C:\ProgramData\NGCP\Controller\postgres\. The setup can be repeated; it reuses what it already created.
Windows node takes about 20 s to come online the first time Known; later connections are fast.
The one-line installer fails Run it in an elevated PowerShell (PowerShell as Administrator).
ArmA 3: console shows only log lines Normal: ArmA writes its console to its own window, so the panel tails the .rpt log.
Event 7031 in the System log after an agent update Expected; see Services.

More in Troubleshooting.