Skip to content

v1.0.0

Choose a tag to compare

View all tags
@posch-dev posch-dev released this 10 Aug 18:41
· 14 commits to main since this release
v1.0.0
301efcb

Minecraft Wake-on-Demand v1.0.0

First release. Your Minecraft server sleeps when nobody plays and wakes up by
itself when someone connects. Players need no extra software, they click Join
and wait a few seconds.

How it works

An always-on watcher, a Raspberry Pi is plenty, listens on the Minecraft port.
While the server sleeps it answers the server list with its own MOTD. On a
login attempt it sends a Wake-on-LAN packet, waits for the PC, starts the
container over SSH and hands the player through.

Features

  • Wake-on-LAN with broadcast or unicast mode
  • Custom MOTD and server icon while the server sleeps
  • Full proxy mode, or transfer mode which redirects players straight to the
    server after waking it
  • Local players are transferred to the server's LAN address, so no router
    loopback is needed
  • DuckDNS updater built in
  • Automatic world backups through itzg/mc-backup
  • Runs on Linux via Docker or systemd, and on Windows

Security

The watcher sits on a port anyone can reach and can power on a PC, so this
release ships the results of a security audit:

  • Reachability probes never block the event loop, a burst of connections can no
    longer stall the proxy
  • The wake sequence is rate limited, with an exponential backoff for attempts
    that fail
  • SSH host key checking is on, defaulting to trust on first use
  • The real config and the RCON password stay out of the repository
  • The watcher container drops all capabilities but NET_RAW, runs with
    no-new-privileges and a read-only root filesystem
  • Image tags and the Minecraft version are pinned
  • Usernames from unauthenticated clients are validated and sanitized

SECURITY.md documents the threat model and what you can tighten
further.

Known limitations

This should work on real hardware. The wake path was verified against a
stand-in server rather than a sleeping PC, and there is no automated test suite
yet, so if something does not come up for you, commit
b6f14a2d87cfbadb0d19e08d80e3df4956d36c1c is a state that ran in practice. It
does not contain the security audit or any of the hardening in this release.

Getting started

See the README. It takes you from BIOS settings to joining the
server.

Assets 2
Loading