mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 12:44:41 +02:00
alkatrazz
bd169e5e1a
- Nouveau rôle satisfactory_server : install steamcmd (login anonyme, app 1690800), service systemd avec update auto en ExecStartPre, MemoryMax=16G + Nice=5 (protège le llama-server), firewalld 7777 tcp+udp - Retries steamcmd (« Missing configuration » rc=8 au premier run) - Fcontext SELinux bin_t sur steamcmd/ et server/ (203/EXEC sinon) - gateway : DNAT 192.168.1.200:7777 → gpu-01:7777 (TCP+UDP) + forward - Doc admin/ops/satisfactory.md (accès, exploitation, pièges rencontrés) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
121 lines
3.6 KiB
YAML
121 lines
3.6 KiB
YAML
---
|
|
# --- Dépendances steamcmd (binaire 32 bits) ---
|
|
|
|
- name: Install steamcmd 32-bit dependencies
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- glibc.i686
|
|
- libstdc++.i686
|
|
- policycoreutils-python-utils # semanage (contexte SELinux, cf. plus bas)
|
|
state: present
|
|
|
|
# --- Utilisateur système ---
|
|
|
|
- name: Create satisfactory system user
|
|
ansible.builtin.user:
|
|
name: "{{ satisfactory_user }}"
|
|
system: true
|
|
shell: /sbin/nologin
|
|
home: "{{ satisfactory_home }}"
|
|
create_home: true
|
|
state: present
|
|
|
|
- name: Create install directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ satisfactory_user }}"
|
|
group: "{{ satisfactory_user }}"
|
|
mode: '0750'
|
|
loop:
|
|
- "{{ satisfactory_steamcmd_dir }}"
|
|
- "{{ satisfactory_install_dir }}"
|
|
|
|
# --- steamcmd ---
|
|
|
|
- name: Download steamcmd
|
|
ansible.builtin.get_url:
|
|
url: "https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz"
|
|
dest: /tmp/steamcmd_linux.tar.gz
|
|
mode: '0644'
|
|
|
|
- name: Extract steamcmd
|
|
ansible.builtin.unarchive:
|
|
src: /tmp/steamcmd_linux.tar.gz
|
|
dest: "{{ satisfactory_steamcmd_dir }}"
|
|
remote_src: true
|
|
owner: "{{ satisfactory_user }}"
|
|
group: "{{ satisfactory_user }}"
|
|
creates: "{{ satisfactory_steamcmd_dir }}/steamcmd.sh"
|
|
|
|
# --- Installation initiale du jeu (~10 Go — long au premier run) ---
|
|
# Les mises à jour suivantes passent par l'ExecStartPre du service
|
|
# (satisfactory_update_on_start), pas par ce task.
|
|
|
|
# Retries : au tout premier run, steamcmd échoue souvent avec « Missing configuration »
|
|
# (rc=8) — l'app info n'est pas encore en cache. Le run suivant passe.
|
|
- name: Install Satisfactory dedicated server via steamcmd (first run only)
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
{{ satisfactory_steamcmd_dir }}/steamcmd.sh
|
|
+force_install_dir {{ satisfactory_install_dir }}
|
|
+login anonymous
|
|
+app_update {{ satisfactory_app_id }} validate
|
|
+quit
|
|
creates: "{{ satisfactory_install_dir }}/FactoryServer.sh"
|
|
become: true
|
|
become_user: "{{ satisfactory_user }}"
|
|
environment:
|
|
HOME: "{{ satisfactory_home }}"
|
|
register: satisfactory_steamcmd_install
|
|
retries: 3
|
|
delay: 10
|
|
until: satisfactory_steamcmd_install.rc | default(0) == 0
|
|
|
|
# --- SELinux ---
|
|
# L'unarchive depuis /tmp laisse steamcmd.sh en user_tmp_t et le jeu hérite de var_t
|
|
# (/srv) : systemd (init_t) refuse d'exécuter ces types → 203/EXEC Permission denied.
|
|
# bin_t sur les deux arborescences exécutables règle le problème.
|
|
|
|
- name: Set bin_t SELinux context on executable trees
|
|
community.general.sefcontext:
|
|
target: "{{ satisfactory_home }}/(steamcmd|server)(/.*)?"
|
|
setype: bin_t
|
|
state: present
|
|
when: ansible_selinux.status | default('disabled') == 'enabled'
|
|
|
|
- name: Apply SELinux contexts
|
|
ansible.builtin.command:
|
|
cmd: restorecon -R {{ satisfactory_home }}
|
|
changed_when: false
|
|
when: ansible_selinux.status | default('disabled') == 'enabled'
|
|
|
|
# --- Service systemd ---
|
|
|
|
- name: Install satisfactory-server systemd unit
|
|
ansible.builtin.template:
|
|
src: satisfactory-server.service.j2
|
|
dest: /etc/systemd/system/satisfactory-server.service
|
|
mode: '0644'
|
|
notify:
|
|
- Reload systemd
|
|
- Restart satisfactory-server
|
|
|
|
- name: Enable satisfactory-server service
|
|
ansible.builtin.systemd:
|
|
name: satisfactory-server
|
|
enabled: true
|
|
daemon_reload: true
|
|
state: started
|
|
|
|
# --- Firewall (7777 TCP+UDP : jeu + API HTTPS) ---
|
|
|
|
- name: Open game port in firewall
|
|
ansible.posix.firewalld:
|
|
port: "{{ satisfactory_port }}/{{ item }}"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
loop:
|
|
- tcp
|
|
- udp
|