initial

Author: Xetera

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.kamal
+.claude
+logs
+tools
+config
+init
+*.md

.gitattributes

@@ -0,0 +1,10 @@
+# LF line endings for every text file, in the repo and in checkouts, whatever each
+# machine's core.autocrlf says. The gateway converts the game files it serves
+# (languagetext.xml, NewConstants.txt) to CRLF itself.
+* text=auto eol=lf
+
+*.dat binary
+*.msi binary
+*.png binary
+*.jpg binary
+*.wav binary

.github/workflows/deploy.yml

@@ -0,0 +1,55 @@
+---
+name: Deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# one deploy at a time; a queued push waits instead of cancelling a deploy halfway
+concurrency:
+  group: deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Cloning repo
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: gateway/go.mod
+          cache-dependency-path: gateway/go.sum
+      - name: Test gateway
+        run: go vet ./... && go test ./...
+        working-directory: gateway
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+      - name: Install Kamal
+        run: gem install kamal --version 2.12.0 --no-document
+
+      - name: Set up SSH
+        uses: webfactory/ssh-agent@v0.10.0
+        with:
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+      # pinned rather than scanned, so a deploy can't be sent to a server impersonating this one
+      - name: Trust the server's host key
+        run: echo "167.235.138.73 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7JAJxXl14Emc4ui2B0lMtcJ/v4B/FlT1SaAn3tdr/" >> ~/.ssh/known_hosts
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      # setup rather than deploy: it also boots the database on the first run and skips it after
+      - name: Deploy
+        run: kamal setup
+        env:
+          MARIADB_ROOT_PASSWORD: ${{ secrets.MARIADB_ROOT_PASSWORD }}
+          C4GW_DB_PASSWORD: ${{ secrets.C4GW_DB_PASSWORD }}
+          C4GW_WEB_SECRET: ${{ secrets.C4GW_WEB_SECRET }}

.gitignore

@@ -0,0 +1,3 @@
+# gateway capture logs and raw packet dumps (include login exchanges)
+logs/
+__pycache__/

.kamal/hooks/pre-app-boot

@@ -0,0 +1,10 @@
+#!/bin/sh
+# The gateway container publishes the game port (config/deploy.yml), and Kamal boots the
+# new container before stopping the old one, so the new one couldn't bind it. Stop the
+# running gateway on each host first. C4_SSH_USER defaults to root, like Kamal's ssh user.
+set -e
+for host in $(echo "$KAMAL_HOSTS" | tr ',' ' '); do
+  echo "Stopping the running $KAMAL_SERVICE gateway on $host to free the game port"
+  ssh "${C4_SSH_USER:-root}@$host" \
+    "docker ps --quiet --filter label=service=$KAMAL_SERVICE --filter label=role=web | xargs -r docker stop"
+done

.kamal/secrets

@@ -0,0 +1,7 @@
+# Read from your shell environment when Kamal runs; no secret is stored in this file.
+# C4GW_DB_PASSWORD goes into a DSN and a SQL string, so use letters and digits only.
+MARIADB_ROOT_PASSWORD=$MARIADB_ROOT_PASSWORD
+C4GW_DB_PASSWORD=$C4GW_DB_PASSWORD
+# signs website sign-in cookies
+C4GW_WEB_SECRET=$C4GW_WEB_SECRET
+C4GW_DB_DSN="c4gateway:$C4GW_DB_PASSWORD@tcp(caesar4-online-db:3306)/caesar4?charset=latin1&interpolateParams=true"

Dockerfile

@@ -0,0 +1,17 @@
+FROM golang:1.23-alpine AS build
+WORKDIR /src
+COPY gateway/go.mod gateway/go.sum ./
+RUN go mod download
+COPY gateway/ ./
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /c4gateway ./cmd/c4gateway
+
+FROM alpine:3.20
+COPY --from=build /c4gateway /usr/local/bin/c4gateway
+# Game files players download after registering (-patch-dir).
+COPY patched/ /patched/
+ENV C4GW_PATCH_DIR=/patched
+# for -capture; a volume mounted here starts out owned by nobody
+RUN mkdir /logs && chown nobody /logs
+USER nobody
+ENTRYPOINT ["c4gateway"]
+CMD ["serve"]

README.md

@@ -0,0 +1,76 @@
+# Kamal 2: deploys the gateway and its MariaDB to one Docker host. A push to main deploys it
+# from GitHub Actions (.github/workflows/deploy.yml). By hand: kamal setup, with the secrets
+# .kamal/secrets reads set in your shell.
+service: caesar4-online
+image: caesar4-online
+
+servers:
+  web:
+    hosts:
+      - 167.235.138.73
+    options:
+      # The game speaks raw MySQL, which kamal-proxy can't carry, so the container publishes
+      # it. Only one container can hold the port: .kamal/hooks/pre-app-boot stops the running
+      # gateway before each deploy boots the new one, so a deploy has a few seconds of downtime.
+      publish: "3310:3306"
+
+# The website. c4.xetera.dev is a DNS-only record for this server, so kamal-proxy gets a
+# Let's Encrypt certificate for it. Other apps on the server keep their own hosts.
+proxy:
+  host: c4.xetera.dev
+  ssl: true
+  app_port: 8080
+  healthcheck:
+    path: /
+
+# Kamal runs a registry on your machine for the push and tunnels it to the server over SSH.
+registry:
+  server: localhost:5555
+
+builder:
+  arch: amd64
+  # build the working directory (the default is a clean git clone)
+  context: .
+
+env:
+  clear:
+    C4GW_LISTEN: ":3306"
+    C4GW_WEB: ":8080"
+    # debug endpoints, reachable only inside the kamal network
+    C4GW_ADMIN: ":8081"
+    # Written into players' NewConstants.txt. The game connects here on 3310 directly, so the
+    # DNS record must stay DNS-only: Cloudflare's proxy only carries HTTP.
+    C4GW_PUBLIC_SERVER: "c4.xetera.dev"
+    C4GW_PUBLIC_PORT: "3310"
+    C4GW_PUBLIC_URL: "https://c4.xetera.dev"
+    C4GW_CAPTURE: /logs/capture.jsonl
+  secret:
+    - C4GW_DB_DSN
+    - C4GW_WEB_SECRET
+
+volumes:
+  - caesar4-online-logs:/logs
+
+accessories:
+  db:
+    image: mariadb:11.4
+    host: 167.235.138.73
+    cmd: --sql-mode=NO_ENGINE_SUBSTITUTION --character-set-server=latin1
+    env:
+      clear:
+        MARIADB_DATABASE: caesar4
+      secret:
+        - MARIADB_ROOT_PASSWORD
+        # read by 99-production.sh
+        - C4GW_DB_PASSWORD
+    # Run only when the data directory is empty. 0644 so the entrypoint sources the .sh
+    # (it needs the entrypoint's docker_process_sql). init/02-leaderboards.sql is test data.
+    files:
+      - local: init/01-init.sql
+        remote: /docker-entrypoint-initdb.d/01-init.sql
+        mode: "0644"
+      - local: config/mariadb/99-production.sh
+        remote: /docker-entrypoint-initdb.d/99-production.sh
+        mode: "0644"
+    directories:
+      - data:/var/lib/mysql

config/deploy.yml

@@ -0,0 +1,8 @@
+# Runs last when MariaDB initialises an empty volume (sourced by its entrypoint, so
+# docker_process_sql is available). The init SQL is written for local testing: this
+# removes the dev account and replaces the gateway's dev password with the real one.
+docker_process_sql --database=caesar4 <<-EOSQL
+	DELETE FROM users WHERE username = 'tester';
+	ALTER USER 'c4gateway'@'%' IDENTIFIED BY '${C4GW_DB_PASSWORD}';
+	FLUSH PRIVILEGES;
+EOSQL