minecraft-server: adjust for velocity, use template unit, ditch screen and use fifo systemd socket for input

it actually works now, don't know why terminal multiplexers give an error even with pty access but this setup is better overall anyway

modules/nixos/services/gameserver/minecraft-server.nix

@@ -2,11 +2,6 @@
 
 
 {
-  networking.firewall = {
-    allowedTCPPorts = [ 10000 ];
-    allowedUDPPorts = [ 10000 ];
-  };
-
   users = {
     users.minecraft = {
       group = "minecraft";
@@ -18,18 +13,7 @@
     groups.minecraft = {};
   };
 
-  environment.systemPackages = [
+  environment.etc."minecraft/java21_args".text = ''
-    # to control the interactive server console
-    pkgs.screen
-
-    pkgs.graalvmPackages.graalvm-oracle_17
-    inputs.nixpkgs-pin.legacyPackages.${pkgs.stdenv.hostPlatform.system}.graalvm-ce
-  ];
-
-  environment.etc = {
-    "minecraft/java21_args".text = ''
-      -Xmx8G
-      -Xms8G
     --add-modules=jdk.incubator.vector
     -XX:+UseG1GC
     -XX:MaxGCPauseMillis=200
@@ -117,30 +101,62 @@
     -Djdk.graal.LoopRotation=true
     -Djdk.graal.CompilerConfiguration=enterprise
   '';
+
+  systemd = {
+    targets.multi-user.wants = [
+      "minecraft@countries.service"
+      "minecraft@monifactory.service"
+    ];
+
+    sockets."minecraft@" = {
+      partOf = [ "minecraft@%i.service" ];
+      socketConfig = {
+        SocketUser = "minecraft";
+        SocketGroup = "minecraft";
+        SocketMode = "0600";
+
+        ListenFIFO = "%t/minecraft-%i.stdin";
+        RemoveOnStop = true;
+      };
     };
 
-  systemd.services.minecraft = {
+    services."minecraft@" = {
-    description = "Minecraft Java Edition server";
+      description = "Minecraft Java Edition server for %i";
-    wants = [ "network-online.target" ];
+      wants = [ "network-online.target" "velocity.service" ];
-    after = [ "network-online.target" ];
+      after = [ "network-online.target" "velocity.service" ];
 
-    path = [ pkgs.screen ];
+      environment = {
-    script = "screen -dmS minecraft -- ${lib.getExe inputs.nixpkgs-pin.legacyPackages.${pkgs.stdenv.hostPlatform.system}.graalvm-ce} @/etc/minecraft/java21_args -jar server.jar nogui";
+        JAVA_17_PATH = lib.getExe pkgs.graalvmPackages.graalvm-oracle_17;
+        JAVA_21_PATH = lib.getExe inputs.nixpkgs-pin.legacyPackages.${pkgs.stdenv.hostPlatform.system}.graalvm-ce;
+      };
 
       serviceConfig = {
         User = "minecraft";
         Group = "minecraft";
-      WorkingDirectory = "/var/lib/minecraft/vanilla";
+        StateDirectory = "minecraft/%i";
-      Type = "forking";
+        StateDirectoryMode = "0700";
-      Restart = "on-failure";
+        WorkingDirectory = "%S/minecraft/%i";
-      TimerSlackNSec = "5ms";
 
-      # very necessary and sane hardening for a private minecraft server
+        ExecStart = "${lib.getExe pkgs.bash} run.sh";
+
+        Type = "exec";
+        Restart = "always";
+        # minecraft responds to SIGINT to stop the server
+        KillSignal = "SIGINT";
+        # minecraft sends exit code 130 when stopped
+        SuccessExitStatus = 130;
+
+        # use socket for stdin to send commands
+        Sockets = "minecraft@%i.socket";
+        StandardInput = "socket";
+        StandardOutput = "journal";
+        StandardError = "journal";
+
+        # hardening
         CapabilityBoundingSet = [ "" ];
         DeviceAllow = [ "" ];
         DevicePolicy = "strict";
         LockPersonality = true;
-      MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateTmp = true;
@@ -166,7 +182,8 @@
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [ "@system-service" ];
-      UMask = "0027";
+        UMask = "0077";
+      };
     };
   };
 }