Case Study

IceLegends SMP

A vanilla-first Romanian Minecraft SMP built for clean 3–4 month seasons.

The Problem

Running a community SMP means balancing plugin depth against vanilla feel, managing a world-reset cycle, and keeping operations simple enough for a solo admin. IceLegends SMP solves this with 11 carefully chosen plugins, strict feature gating per a "vanilla-first" principle, and fully automated backups and world resets.

My Role

Designed, configured, and deployed solo — server architecture, 11-plugin selection and configuration, LuckPerms permission model, economy and nation design, Docker infrastructure, and Cloudflare Tunnel ingress for Dynmap.

Join the Server ↗

Highlights

PaperMC 1.21 on Docker with a hard 11-plugin cap — every plugin is justified and none are redundant
Towny nations with seasonal quests (Quests + Citizens NPCs) and a single manually-spawned MythicMobs boss per season
AureliumSkills passive bonuses only — active abilities disabled to preserve vanilla combat (P-01)
DiscordSRV bridge logs every death, join, and chat event to dedicated Discord channels in real time
Daily automated backups with 7-day retention; resource world resets every Monday at 05:00 via cron

Stack

PaperMC 1.21DockerCloudflare TunnelLuckPermsTownyAureliumSkillsMythicMobsDiscordSRVDynmap

Constraints

Solo admin — every operation must complete in under 10 minutes (P-02).
Vanilla-first (P-01): if any plugin disappeared tomorrow, the game must continue unchanged.
11-plugin hard cap — every addition must displace something or prove unique, irreplaceable value.

System Architecture

Edge

Cloudflare Tunnel (Dynmap web map)

TCP :25565 open (Minecraft clients)

Runtime

Docker + docker-compose

itzg/minecraft-server image

Core

PaperMC 1.21

Vault

LuckPerms

EssentialsX

CoreProtect

Gameplay

Towny

AureliumSkills

ShopGUI+

Quests + Citizens

MythicMobs

Multiverse-Core

Ops

DiscordSRV bridge

Daily backup cron (04:00)

Weekly world reset cron (Mon 05:00)

Key Trade-offs

The decisions worth defending — what I chose, what I turned down, and why.

Plugin count cap

Chose

Hard cap at 11 plugins

Rejected

Unlimited plugin stack

Each plugin is a maintenance surface and a potential conflict point. The cap forces prioritisation and keeps the dependency graph legible for a solo admin.

Public ingress for Dynmap

Chose

Cloudflare Tunnel (no open ports)

Rejected

Expose :8123 directly via UFW

No origin IP exposure, free DDoS protection, and zero firewall rule maintenance — the same pattern used by the IceLegends portfolio site.

AureliumSkills scope

Chose

Passive bonuses only, active abilities disabled

Rejected

Full AureliumSkills feature set including active combat abilities

Active abilities alter vanilla combat — a direct violation of P-01. Passive bonuses reward playtime additively without changing the combat model.

Season lifecycle

Chose

Full world reset every 3–4 months

Rejected

Incremental map expansion with no reset

Resets keep the world fresh, prevent terrain exhaustion, and give every new player an equal start — critical for community health in a small SMP.

What I'd Do Differently

An honest retrospective — the stuff I'd change with more time, more users, or a second pass.

1Add a staging compose stack so plugin updates can be tested before touching the live season — one bad update cost several hours of rollback work.
2Move backup storage off-site from day one; local-only archives are a single hardware failure away from a full season loss.
3Wire Dynmap as a named Docker service rather than relying on the host port, so the Cloudflare Tunnel config survives container IP reassignment on restart.

Technical Deep-Dive

Architecture, specifications, and implementation details.

01 — System Architecture

"

Infrastructure, Docker, networking, storage

#High-Level Diagram

┌─────────────────────────────────────────────────────────────────┐
│                        INTERNET (Public)                        │
└────────────────┬─────────────────────────────┬──────────────────┘
                 │ TCP/UDP :25565               │ HTTPS :443
                 ▼                              ▼
    ┌────────────────────┐       ┌──────────────────────────────┐
    │  MINECRAFT CLIENTS │       │  CLOUDFLARE TUNNEL           │
    │  (Mojang accounts) │       │  map.server.ro → :8123       │
    └─────────┬──────────┘       └──────────────┬───────────────┘
              │                                 │
              ▼                                 ▼
┌─────────────────────────────────────────────────────────────────┐
│                   VPS HOST (Ubuntu 22.04)                       │
│   UFW: ALLOW 22/tcp  ALLOW 25565/tcp+udp  DENY all others       │
│                                                                 │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │            DOCKER NETWORK (internal bridge)               │  │
│  │                                                           │  │
│  │  ┌─────────────────────────────────────────────────────┐  │  │
│  │  │  CONTAINER: mc  (itzg/minecraft-server:latest)      │  │  │
│  │  │  PaperMC 1.21    :25565 ← exposed to internet       │  │  │
│  │  │  Dynmap          :8123  ← internal only             │  │  │
│  │  │  RCON            :25575 ← internal only, NEVER open │  │  │
│  │  └─────────────────────────────────────────────────────┘  │  │
│  │                                                           │  │
│  │  ┌──────────────────────┐  ┌──────────────────────────┐   │  │
│  │  │  VOLUME: ./data      │  │  VOLUME: ./data/resurse  │   │  │
│  │  │  main world          │  │  resource world          │   │  │
│  │  │  plugin configs      │  │  (weekly reset via cron) │   │  │
│  │  └──────────────────────┘  └──────────────────────────┘   │  │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                 │
│   /opt/mc-backups/   (daily tar.gz, 7-day retention)            │
└─────────────────────────────────────────────────────────────────┘
              │                                 │
              ▼                                 ▼
    ┌─────────────────┐            ┌────────────────────────┐
    │  DISCORD SERVER │            │  EXTERNAL SERVICES     │
    │  DiscordSRV     │            │  Mojang Auth           │
    │  #chat #deaths  │            │  Cloudflare DNS        │
    │  #events #staff │            │  api.papermc.io        │
    └─────────────────┘            └────────────────────────┘

#VPS Requirements

Resource	Minimum	Recommended	Notes
CPU	2 vCPU	4 vCPU	Clock speed > core count for MC
RAM	4 GB	8 GB	4G JVM heap + 1G OS + buffers
Disk	40 GB SSD	80 GB NVMe	World grows ~500MB/month
Network	100 Mbps	1 Gbps	~5–15 Kbps per player
OS	Ubuntu 22.04 LTS	Ubuntu 22.04 LTS	5yr security support
Swap	2 GB	4 GB	Prevents OOM during GC spikes

"

Recommended providers: Hetzner CX32 (4 vCPU, 8GB, 80GB NVMe, ~€15/mo) or Oracle Cloud A1 Flex (4 ARM vCPU, 24GB, Free Tier)

#Network Security Rules

Rule	Protocol	Port	Source	Action	Reason
UFW-01	TCP+UDP	25565	0.0.0.0/0	ALLOW	Minecraft clients
UFW-02	TCP	22	0.0.0.0/0	ALLOW	SSH (key-based only)
UFW-03	TCP	8123	0.0.0.0/0	DENY	Dynmap via Cloudflare Tunnel only
UFW-04	TCP	25575	0.0.0.0/0	DENY	RCON never internet-accessible
UFW-05	*	*	0.0.0.0/0	DENY	Default deny all inbound

"

⚠️ CRITICAL: RCON (25575) must NEVER be exposed. Compromise = full server control. Access only via: docker exec mc rcon-cli

#Project Directory Structure

minecraft-smp/
├── docker-compose.yml
├── .env                          # NEVER commit — contains secrets
├── .env.example                  # Template — safe to commit
├── .gitignore
├── server.properties
│
├── config/
│   ├── paper-global.yml
│   ├── paper-world-defaults.yml
│   └── spigot.yml
│
├── plugin-configs/               # Pre-filled configs, one folder per plugin
│   ├── luckperms/
│   ├── essentialsx/
│   ├── towny/
│   ├── aureliumskills/
│   ├── discordsrv/
│   ├── shopgui/
│   ├── quests/
│   ├── mythicmobs/
│   └── dynmap/
│
├── plugins/
│   └── DOWNLOAD_LIST.md          # Official URLs — manual download
│
├── worlds/
│   ├── main/                     # Persistent — full season
│   └── resurse/                  # Resets every Monday 05:00
│
└── scripts/
    ├── setup.sh                  # Full VPS setup
    ├── backup.sh                 # Daily backup (cron 04:00)
    ├── reset-resurse.sh          # Weekly world reset (cron Monday 05:00)
    ├── setup-luckperms.sh        # LuckPerms group initialization
    └── update-paper.sh           # PaperMC update

#docker-compose.yml Specification

services:
  mc:
    image: itzg/minecraft-server:latest
    container_name: mc
    restart: unless-stopped
    tty: true
    stdin_open: true
    environment:
      EULA: "TRUE"
      TYPE: PAPER
      VERSION: LATEST
      MEMORY: ${MEMORY:-4G}
      MAX_PLAYERS: ${MAX_PLAYERS:-30}
      MOTD: ${MOTD}
      DIFFICULTY: ${DIFFICULTY:-normal}
      ONLINE_MODE: ${ONLINE_MODE:-true}
      SPAWN_PROTECTION: 16
      VIEW_DISTANCE: 8
      SIMULATION_DISTANCE: 6
      RCON_ENABLED: "true"
      RCON_PASSWORD: ${RCON_PASSWORD}
      TZ: ${TZ:-Europe/Bucharest}
    ports:
      - "25565:25565/tcp"
      - "25565:25565/udp"
      # 8123 and 25575 intentionally NOT exposed
    volumes:
      - ./data:/data
    networks:
      - mc-internal
    healthcheck:
      test: ["CMD", "mc-health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN}
    networks:
      - mc-internal
    depends_on:
      mc:
        condition: service_healthy

networks:
  mc-internal:
    driver: bridge

#Storage Policy

Path	Contents	Backup	Reset Policy
`./data/`	All server data	Daily, 7-day retention	Never
`./data/world/`	Main survival world	Daily	End of season only
`./data/resurse/`	Resource world	NOT backed up	Every Monday 05:00
`./data/plugins/`	Plugin JARs + configs	Daily	On major plugin update
`/opt/mc-backups/`	Backup archives	Off-site recommended	Auto-delete after 7 days

#Related Documents

Plugins → 02_plugin_architecture.md
Security → 12_security.md
Backup → 14_backup_recovery.md

~ End of Document ~