panel — open-source game server manager (public release)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-14 19:19:43 -07:00
commit 658bda1d24
2160 changed files with 300413 additions and 0 deletions
@@ -0,0 +1,332 @@
+package updater
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	agentmodule "github.com/dbledeez/panel/agent/internal/module"
+	"github.com/dbledeez/panel/agent/internal/runtime"
+	modulepkg "github.com/dbledeez/panel/pkg/module"
+)
+
+// SteamCMDProvider runs `steamcmd +force_install_dir <path> +login
+// anonymous +app_update <appid> [-beta <branch>] validate +quit` in a
+// one-shot sidecar container that mounts the target instance's volumes.
+// The sidecar writes game files into the same Docker volumes the main
+// container reads from, so "update then start" just works.
+//
+// Preconditions:
+//   - Target instance's container must NOT be running (Steam holds file
+//     locks that conflict with a live server). Error clearly otherwise.
+//   - Manifest must declare at least one volume; install_path resolves
+//     to spec.InstallPath → BrowseableRoot → first volume's container path.
+type SteamCMDProvider struct{}
+
+// Name identifies this provider kind in logs / manifest.
+func (SteamCMDProvider) Name() string { return "steamcmd" }
+
+// sidecarImage is the official Valve-maintained SteamCMD image. Its
+// ENTRYPOINT is `steamcmd`, so we pass steamcmd's `+...` flags as Cmd.
+const sidecarImage = "steamcmd/steamcmd:latest"
+
+// redactSteamPassword replaces a password in a cmdline arg slice with
+// "[REDACTED]" so the Console tab never echoes it. Used before logging
+// steamcmd argv.
+func redactSteamPassword(args []string, password string) []string {
+	if password == "" {
+		return args
+	}
+	out := make([]string, len(args))
+	for i, a := range args {
+		if a == password {
+			out[i] = "[REDACTED]"
+			continue
+		}
+		out[i] = a
+	}
+	return out
+}
+
+// redactPasswordLine strips the password substring from a log line if it
+// ever appears (e.g. SteamCMD echoing `+login user PASS` back). Returns
+// the original string when password is empty so anonymous/public flows
+// are zero-cost.
+func redactPasswordLine(line, password string) string {
+	if password == "" || len(password) < 4 {
+		return line
+	}
+	if !strings.Contains(line, password) {
+		return line
+	}
+	return strings.ReplaceAll(line, password, "[REDACTED]")
+}
+
+func (SteamCMDProvider) Update(ctx context.Context, uc *Context, spec *modulepkg.UpdateProvider) error {
+	if spec.AppID == "" {
+		return fmt.Errorf("steamcmd provider: app_id is required")
+	}
+
+	// Refuse if the main container is still running — Steam locks files.
+	mainName := "panel-" + uc.InstanceID
+	if state, err := uc.Runtime.InspectByName(ctx, mainName); err == nil && state.Status == "running" {
+		return fmt.Errorf("stop the instance first — container %q is running; SteamCMD conflicts with a live server", mainName)
+	}
+
+	installPath := spec.InstallPath
+	if installPath == "" {
+		installPath = uc.BrowseableRoot
+	}
+	if installPath == "" {
+		return fmt.Errorf("steamcmd provider: install_path missing and module has no browseable_root/volumes to default from")
+	}
+
+	// Mount the same volumes as the target instance so SteamCMD writes
+	// where the main container will later read.
+	volumes := agentmodule.ResolveVolumes(uc.Manifest, uc.InstanceID, uc.DataPath)
+	if len(volumes) == 0 {
+		return fmt.Errorf("steamcmd provider: module declares no volumes to mount")
+	}
+
+	// Platform override MUST come before +login — SteamCMD evaluates its
+	// forced-platform state at login time, not at app_update time. Used for
+	// apps that ship only a Windows depot (run via Wine on Linux hosts).
+	args := []string{}
+	if spec.Platform != "" {
+		args = append(args, "+@sSteamCmdForcePlatformType", spec.Platform)
+	}
+	args = append(args, "+force_install_dir", installPath)
+
+	// Non-anonymous Steam login for paid apps (DayZ, Arma). If the module
+	// declared requires_steam_login and the controller forwarded creds,
+	// use them. Otherwise fall back to anonymous (most free-to-download
+	// dedicated servers work anonymously).
+	//
+	// CRITICAL for UX: pass ONLY the username when possible. SteamCMD's
+	// `+login <user>` uses the cached refresh token from config.vdf
+	// (persisted in panel-steamcmd-auth) — no Steam Guard push, no
+	// password round-trip. Passing `+login <user> <password>` forces a
+	// fresh password auth every time, which triggers a 2FA push on every
+	// call even when a perfectly valid cached token is already on disk.
+	//
+	// First-ever login ceremony happens in the controller (steamauth.go)
+	// with the full password+guard flow to prime the cache. After that,
+	// this path rides the cache. If the cache is stale/expired, SteamCMD
+	// exits non-zero — the retry loop below re-runs which will hit the
+	// same error; the operator then clicks Update, which the controller
+	// can short-circuit to re-run the login modal (the `steam_login_required`
+	// response path).
+	needsLogin := spec.RequiresSteamLogin && uc.SteamUsername != ""
+	if needsLogin {
+		args = append(args, "+login", uc.SteamUsername)
+	} else {
+		args = append(args, "+login", "anonymous")
+	}
+	updateArgs := []string{"+app_update", spec.AppID}
+	if spec.Beta != "" {
+		updateArgs = append(updateArgs, "-beta", spec.Beta)
+	}
+	if !spec.SkipValidate {
+		updateArgs = append(updateArgs, "validate")
+	}
+	args = append(args, updateArgs...)
+	args = append(args, "+quit")
+
+	uc.Log(fmt.Sprintf("steamcmd: image=%s install_path=%s app_id=%s beta=%s", sidecarImage, installPath, spec.AppID, spec.Beta))
+	uc.Log(fmt.Sprintf("steamcmd argv: %v", redactSteamPassword(args, uc.SteamPassword)))
+
+	// SteamCMD is notoriously flaky on first invocation — exit 8 ("missing
+	// configuration"), exit 2 (generic "retry later"), and Steam auth races
+	// are all recoverable by simply running the same command again. AMP,
+	// LinuxGSM, and Valve's own Steam client all retry on these codes. We
+	// mirror that behaviour so operators don't have to click Update twice.
+	const maxAttempts = 4
+	var lastExit int
+	var ranSuccessfully bool
+	for attempt := 1; attempt <= maxAttempts; attempt++ {
+		exitCode, err := runSteamCMDOnce(ctx, uc, sidecarImage, args, volumes, attempt)
+		lastExit = exitCode
+		if err == nil && exitCode == 0 {
+			uc.Log(fmt.Sprintf("steamcmd: completed successfully (app_id=%s, attempts=%d)", spec.AppID, attempt))
+			ranSuccessfully = true
+			break
+		}
+		// Transient exit codes SteamCMD is known to recover from. Anything
+		// else we surface immediately (missing disk space, bad app id, etc.).
+		transient := err == nil && (exitCode == 2 || exitCode == 5 || exitCode == 8)
+		if err != nil {
+			return err
+		}
+		if !transient || attempt == maxAttempts {
+			break
+		}
+		backoff := time.Duration(attempt*attempt*3) * time.Second // 3s, 12s, 27s
+		uc.Log(fmt.Sprintf("steamcmd: exit %d — transient, retrying in %s (attempt %d/%d)", exitCode, backoff, attempt+1, maxAttempts))
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(backoff):
+		}
+	}
+
+	// Finalize: SteamCMD with `+force_install_dir <p>` stages downloads
+	// at <p>/steamapps/downloading/<appid>/ and atomically renames into
+	// <p>/ on success. When SteamCMD exits with state 0x602 (often after
+	// concurrent runs interrupt finalization, or a `validate` pass races
+	// the move) the bytes are on disk but never get renamed — operator
+	// sees an empty install dir and an exit-8 error from the panel.
+	//
+	// This step runs unconditionally after the retry loop. If the staging
+	// dir is empty or absent (the happy path), it's a cheap no-op. If it
+	// has content, we cp -a it into place and the install completes.
+	finalized, ferr := finalizeStagingDir(ctx, uc, installPath, spec.AppID, volumes)
+	if ferr != nil {
+		uc.Log(fmt.Sprintf("steamcmd: finalize check failed: %s (continuing anyway)", ferr.Error()))
+	} else if finalized {
+		uc.Log("steamcmd: recovered staged install (state 0x602 workaround)")
+		return nil
+	}
+
+	if ranSuccessfully {
+		return nil
+	}
+	return fmt.Errorf("steamcmd exited %d after %d attempt(s)", lastExit, maxAttempts)
+}
+
+// finalizeStagingDir checks for a stranded SteamCMD staging directory
+// at <installPath>/steamapps/downloading/<appid>/ and, if present and
+// non-empty, moves its contents into <installPath>/. Runs as a one-shot
+// alpine sidecar with the same volume mounts as the SteamCMD run so
+// it has access to the install path. Returns true if a recovery move
+// actually happened, false if there was nothing to do.
+//
+// The script is intentionally defensive:
+//   - mv is preferred over cp+rm because it's atomic on the same FS.
+//   - If both source and destination have entries with the same name,
+//     mv -f overwrites (rare; happens when steamcmd partially renamed
+//     before dying).
+//   - We exit 0 on "no staging dir" so this is a no-op for the happy
+//     path.
+func finalizeStagingDir(ctx context.Context, uc *Context, installPath, appID string, volumes []runtime.VolumeSpec) (bool, error) {
+	const stagingMarker = "/__staging__"
+	script := fmt.Sprintf(`set -e
+DL=%q/steamapps/downloading/%s
+DEST=%q
+if [ ! -d "$DL" ] || [ -z "$(ls -A "$DL" 2>/dev/null)" ]; then
+  echo "no-staging"
+  exit 0
+fi
+echo "finalizing $DL -> $DEST"
+mkdir -p "$DEST"
+# mv every top-level entry; -f overwrites partial renames.
+for f in "$DL"/* "$DL"/.[!.]* "$DL"/..?*; do
+  [ -e "$f" ] || continue
+  mv -f "$f" "$DEST/" 2>&1 || cp -a "$f" "$DEST/" && rm -rf "$f"
+done
+rm -rf "$DL"
+touch %q
+echo "finalized"
+`, installPath, appID, installPath, installPath+stagingMarker)
+
+	sidecarSpec := runtime.InstanceSpec{
+		InstanceID:    fmt.Sprintf("%s-steamcmd-finalize", uc.InstanceID),
+		IsSidecar:     true,
+		Image:         "alpine:latest",
+		Command:       []string{"sh", "-c", script},
+		Volumes:       volumes,
+		RestartPolicy: "no",
+	}
+	contID, err := uc.Runtime.Create(ctx, sidecarSpec)
+	if err != nil {
+		return false, fmt.Errorf("create finalize sidecar: %w", err)
+	}
+	defer func() {
+		rmCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		_ = uc.Runtime.Remove(rmCtx, contID)
+	}()
+	if err := uc.Runtime.Start(ctx, contID); err != nil {
+		return false, fmt.Errorf("start finalize sidecar: %w", err)
+	}
+	logCtx, cancelLogs := context.WithCancel(ctx)
+	defer cancelLogs()
+	logDone := make(chan struct{})
+	var lastLine string
+	go func() {
+		defer close(logDone)
+		_ = uc.Runtime.StreamLogs(logCtx, contID, func(_ runtime.LogStream, line string, _ time.Time) {
+			lastLine = strings.TrimSpace(line)
+			uc.Log("finalize: " + lastLine)
+		})
+	}()
+	exitCode, err := uc.Runtime.Wait(ctx, contID)
+	cancelLogs()
+	<-logDone
+	if err != nil {
+		return false, fmt.Errorf("wait finalize sidecar: %w", err)
+	}
+	if exitCode != 0 {
+		return false, fmt.Errorf("finalize sidecar exit %d", exitCode)
+	}
+	return lastLine == "finalized", nil
+}
+
+// runSteamCMDOnce is a single run of the steamcmd sidecar; called in a loop
+// by the retry wrapper. Returns the container's exit code on clean
+// lifecycle (even non-zero) or an error on infrastructure failure.
+func runSteamCMDOnce(ctx context.Context, uc *Context, image string, args []string, volumes []runtime.VolumeSpec, attempt int) (int, error) {
+	sidecarID := fmt.Sprintf("%s-steamcmd-%d", uc.InstanceID, attempt)
+	// Mount the panel-wide SteamCMD auth volume at /root/.local/share/Steam
+	// (the real data dir of the steamcmd:latest image — NOT /root/Steam).
+	// This persists config/config.vdf (login refresh token) + ssfn sentry,
+	// which lets subsequent `+login <user>` runs skip the 2FA push. Anon
+	// logins ignore this dir — no harm.
+	volumesWithAuth := append([]runtime.VolumeSpec(nil), volumes...)
+	volumesWithAuth = append(volumesWithAuth, runtime.VolumeSpec{
+		VolumeName:    "panel-steamcmd-auth",
+		ContainerPath: "/root/.local/share/Steam",
+		Type:          "volume",
+	})
+	sidecarSpec := runtime.InstanceSpec{
+		InstanceID:    sidecarID,
+		IsSidecar:     true,
+		Image:         image,
+		Command:       args,
+		Volumes:       volumesWithAuth,
+		RestartPolicy: "no",
+		// Docker 29.4+ default seccomp ENOSYS's a syscall the 32-bit
+		// Steam runtime needs ("CreateBoundSocket error 38"). Older
+		// Docker (29.1.x on princess/ivy) doesn't filter it. Unconfine
+		// for the sidecar so install/validate works across hosts.
+		SecurityOpts: []string{"seccomp=unconfined"},
+	}
+	contID, err := uc.Runtime.Create(ctx, sidecarSpec)
+	if err != nil {
+		return 0, fmt.Errorf("create sidecar: %w", err)
+	}
+	defer func() {
+		rmCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		_ = uc.Runtime.Remove(rmCtx, contID)
+	}()
+	if err := uc.Runtime.Start(ctx, contID); err != nil {
+		return 0, fmt.Errorf("start sidecar: %w", err)
+	}
+	logCtx, cancelLogs := context.WithCancel(ctx)
+	defer cancelLogs()
+	logDone := make(chan struct{})
+	go func() {
+		defer close(logDone)
+		_ = uc.Runtime.StreamLogs(logCtx, contID, func(_ runtime.LogStream, line string, _ time.Time) {
+			uc.Log(redactPasswordLine(line, uc.SteamPassword))
+		})
+	}()
+	exitCode, err := uc.Runtime.Wait(ctx, contID)
+	cancelLogs()
+	<-logDone
+	if err != nil {
+		return 0, fmt.Errorf("wait sidecar: %w", err)
+	}
+	return exitCode, nil
+}