WiebCraft Minecraft Server¶
Cross-platform Java + Bedrock vanilla server running on Finn, publicly playable.
Operating policy (Justin, 2026-06-09)¶
CT 110 stays OFF unless Justin turns it on to play. onboot: 0 is intentional; the container being stopped is the normal state, not an incident. Do not flag it in audits or auto-start it from monitors.
Where it lives¶
- Proxmox CT: 110 on Finn (
ssh minecraft→ 192.168.86.23) - Stack: Debian 13 unprivileged LXC → Docker (2 services) →
itzg/minecraft-server:latest(Vanilla MC 26.1.2, Java 25) +eclipse-temurin:21-jrerunning Geyser-Standalone (sidecar, onwiebcraftdocker network) - Why this combo: MC 26.1.2 client doesn't talk to Paper (Paper's latest is 1.21.11). Vanilla supports it; Geyser-Standalone sidecar gives us Bedrock/Switch.
online-mode=FALSEbecause Geyser-Standalone in offline mode requires it. Whitelist is the security boundary — keep it on, add friends by username.- Compose file:
/opt/minecraft/docker-compose.yml(inside CT) - World data:
/datain CT ↔/mnt/workspace/minecraft/on Finn (bind-mount) - Resources: 8 GB RAM (6 GB heap), 4 cores, 32 GB disk
- WAN IP: 136.60.22.116 (verify with
curl -s api.ipify.orgif it changes)
Ports¶
| Port | Proto | Use |
|---|---|---|
| 25565 | TCP | Java Edition |
| 19132 | UDP | Bedrock (Geyser) — Win Bedrock + Switch |
Router-side port forwards required for public play: - 25565/tcp → 192.168.86.23:25565 - 19132/udp → 192.168.86.23:19132
How they're maintained: Google Home UI doesn't see the CT in its picker, so port-forwards are punched via UPnP from inside CT 110. Daily cron at 03:00 (/etc/cron.d/upnp-mc-keepalive → /usr/local/sbin/upnp-mc-keepalive.sh) re-adds both forwards so the 7-day IGD lease never lapses. Verify current forwards with ssh minecraft 'upnpc -l | grep -E 19132\|25565'.
How to connect¶
| Platform | How |
|---|---|
| Mac (Java) | Add server: <wan-ip> |
| Win (Java) | Add server: <wan-ip> |
| Win (Bedrock) | Add server: <wan-ip> port 19132 |
| Switch (Bedrock) | Set Switch DNS primary = 104.238.130.180, tap any featured server (Hive etc), lands on BedrockConnect → "+ Add Server" → <wan-ip> port 19132 |
Bedrock players auth via Xbox Live thanks to Floodgate — they don't need a Java account.
Common ops¶
# Console (RCON-style)
ssh minecraft 'docker exec -it minecraft rcon-cli' # only if RCON enabled
ssh minecraft 'docker exec -i minecraft mc-send-to-console <command>'
# Logs
ssh minecraft 'docker logs -f minecraft'
# Restart
ssh minecraft 'cd /opt/minecraft && docker compose restart'
# Stop / start
ssh minecraft 'cd /opt/minecraft && docker compose down|up -d'
# Edit server.properties → /mnt/workspace/minecraft/server.properties on Finn
# Edit Geyser config → /mnt/workspace/minecraft/plugins/Geyser-Spigot/config.yml
Backup¶
- Script:
/home/justinwieb/forge/scripts/integrations/minecraft/backup.sh - Cron: UDev daily 04:00 —
crontab -lto verify - Source:
/mnt/workspace/minecraft/→ Dest:/mnt/storage/minecraft-backups/YYYY-MM-DD/(rsync--link-destagainstlatest, hardlinks unchanged files) - Pauses world saves via
save-off/save-all flush/save-onfor consistency - 30-day retention, log:
/home/justinwieb/forge/logs/minecraft-backup.log
Known caveats¶
- Geyser warns about Java protocol mismatch ("requires 1.21.11"). Old/current Bedrock clients connect fine; if a very new Bedrock client fails, add ViaVersion + ViaBackwards via
PLUGINSenv var. - Whitelist is OFF — anyone with the WAN IP can attempt to join. Online-mode is ON so they need a real Mojang/MS account, but spam joins / grief are possible. Enable whitelist with
whitelist onfrom console + add players viawhitelist add <name>. - No RCON exposed externally — admin commands are via
mc-send-to-consoleover SSH only. - WAN IP from Google Fiber is dynamic-ish; if it changes, friends + Switch need updating. Add DDNS (DuckDNS / Cloudflare) when this becomes a problem.
Mod / plugin upgrades¶
Direct download URLs in PLUGINS: env var of compose; on container restart they auto-redownload to latest. To pin versions, swap to a versioned URL.