Case Study

IceLegends SMP

A vanilla-first Romanian Minecraft SMP built for clean 3–4 month seasons.

The Problem

Running a community SMP means balancing plugin depth against vanilla feel, managing a world-reset cycle, and keeping operations simple enough for a solo admin. IceLegends SMP solves this with 11 carefully chosen plugins, strict feature gating per a "vanilla-first" principle, and fully automated backups and world resets.

My Role

Designed, configured, and deployed solo — server architecture, 11-plugin selection and configuration, LuckPerms permission model, economy and nation design, Docker infrastructure, and Cloudflare Tunnel ingress for Dynmap.

Join the Server ↗

Highlights

PaperMC 1.21 on Docker with a hard 11-plugin cap — every plugin is justified and none are redundant
Towny nations with seasonal quests (Quests + Citizens NPCs) and a single manually-spawned MythicMobs boss per season
AureliumSkills passive bonuses only — active abilities disabled to preserve vanilla combat (P-01)
DiscordSRV bridge logs every death, join, and chat event to dedicated Discord channels in real time
Daily automated backups with 7-day retention; resource world resets every Monday at 05:00 via cron

Stack

PaperMC 1.21DockerCloudflare TunnelLuckPermsTownyAureliumSkillsMythicMobsDiscordSRVDynmap

Constraints

Solo admin — every operation must complete in under 10 minutes (P-02).
Vanilla-first (P-01): if any plugin disappeared tomorrow, the game must continue unchanged.
11-plugin hard cap — every addition must displace something or prove unique, irreplaceable value.

System Architecture

Edge

Cloudflare Tunnel (Dynmap web map)

TCP :25565 open (Minecraft clients)

Runtime

Docker + docker-compose

itzg/minecraft-server image

Core

PaperMC 1.21

Vault

LuckPerms

EssentialsX

CoreProtect

Gameplay

Towny

AureliumSkills

ShopGUI+

Quests + Citizens

MythicMobs

Multiverse-Core

Ops

DiscordSRV bridge

Daily backup cron (04:00)

Weekly world reset cron (Mon 05:00)

Key Trade-offs

The decisions worth defending — what I chose, what I turned down, and why.

Plugin count cap

Chose

Hard cap at 11 plugins

Rejected

Unlimited plugin stack

Each plugin is a maintenance surface and a potential conflict point. The cap forces prioritisation and keeps the dependency graph legible for a solo admin.

Public ingress for Dynmap

Chose

Cloudflare Tunnel (no open ports)

Rejected

Expose :8123 directly via UFW

No origin IP exposure, free DDoS protection, and zero firewall rule maintenance — the same pattern used by the IceLegends portfolio site.

AureliumSkills scope

Chose

Passive bonuses only, active abilities disabled

Rejected

Full AureliumSkills feature set including active combat abilities

Active abilities alter vanilla combat — a direct violation of P-01. Passive bonuses reward playtime additively without changing the combat model.

Season lifecycle

Chose

Full world reset every 3–4 months

Rejected

Incremental map expansion with no reset

Resets keep the world fresh, prevent terrain exhaustion, and give every new player an equal start — critical for community health in a small SMP.

What I'd Do Differently

An honest retrospective — the stuff I'd change with more time, more users, or a second pass.

1Add a staging compose stack so plugin updates can be tested before touching the live season — one bad update cost several hours of rollback work.
2Move backup storage off-site from day one; local-only archives are a single hardware failure away from a full season loss.
3Wire Dynmap as a named Docker service rather than relying on the host port, so the Cloudflare Tunnel config survives container IP reassignment on restart.

Technical Deep-Dive

Architecture, specifications, and implementation details.

12 — Security

"

Threat model, hardening checklist, incident response

#Threat Model

Threat	Vector	Likelihood	Impact	Mitigation
Griefing	In-game	High	Medium	CoreProtect logging + rollback
RCON brute force	Network	Low	Critical	RCON not exposed — UFW blocks 25575
SSH brute force	Network	High	Critical	Key-based SSH only, password auth disabled
DDoS	UDP flood	Medium	High	Provider upstream mitigation (Hetzner/OCI)
Malicious plugin JAR	Staff action	Low	Critical	Official sources only per DOWNLOAD_LIST.md
Data loss	Disk failure	Low	High	Daily backup, 7-day retention
Chat spam	Automated client	Medium	Low	EssentialsX mute + LuckPerms
Account sharing	Player action	Medium	Low	Online mode — Mojang enforces uniqueness

#Pre-Launch Checklist — MANDATORY

"

Server must not go public until every item below is checked.

##Network

UFW active: ufw status shows ACTIVE
Only ports 22 and 25565 open
Port 25575 (RCON) confirmed BLOCKED: nc -zv localhost 25575 should fail
Port 8123 (Dynmap) confirmed BLOCKED externally

##Docker & Server

ONLINE_MODE=true in .env — verified, not assumed
RCON_PASSWORD is minimum 24 random characters
RCON port NOT in docker-compose.yml ports section
Dynmap port NOT in docker-compose.yml ports section
Healthcheck present and passing: docker inspect mc | grep Health

##Files & Secrets

.env in .gitignore: grep '.env' .gitignore
.env permissions set to 600: ls -la .env shows -rw-------
No secrets hardcoded in docker-compose.yml
All plugin JARs from DOWNLOAD_LIST.md sources only

##Access

SSH password authentication DISABLED: grep PasswordAuthentication /etc/ssh/sshd_config
SSH key pair created and working before disabling password auth
CoreProtect active before first player joins

##Backup

scripts/backup.sh tested: run manually and verify archive created
Crontab configured: crontab -l shows backup at 04:00

#SSH Hardening

# /etc/ssh/sshd_config — required settings
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no          # create non-root sudo user
MaxAuthTries 3

# Apply changes
sudo systemctl restart sshd

# Generate key pair (on YOUR machine, not VPS)
ssh-keygen -t ed25519 -C "minecraft-smp-admin"
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@VPS_IP

#UFW Setup

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 25565/tcp
ufw allow 25565/udp
ufw enable

# Verify
ufw status verbose

"

⚠️ Oracle Cloud extra step: Open port 25565 in Security Lists via OCI console. UFW alone is not sufficient on Oracle Cloud Free Tier. Path: Networking → VCN → Security Lists → Add Ingress Rule (TCP 25565)

#Generate Secure RCON Password

openssl rand -base64 32
# Copy output to RCON_PASSWORD in .env

#Monthly Security Review

Run docker compose pull — update images
Check PaperMC security advisories at papermc.io
Check each plugin's changelog for security fixes
Test backup restore (restore to temp folder, verify world loads)
Review CoreProtect logs for unusual patterns
Check disk usage: df -h — alert if >80%

#Related Documents

Network architecture → 01_system_architecture.md
Staff access → 11_permissions_staff.md
Backup → 14_backup_recovery.md

~ End of Document ~