temp

flake.nix

···
     } // {
       inherit (pkgs)
         steamworks-sdk-redist
-        systemd-transparent-udp-forwarderd;
+        systemd-transparent-udp-forwarderd
+        force-bind;
     });
 
     apps = eachSystem (system: import ./lib/apps {

lib/pkgs/default.nix

···
   mkSteamPackage = import ./mk-steam-package.nix self super;
   mkSteamWrapper = import ./mk-steam-wrapper.nix self super;
   systemd-transparent-udp-forwarderd = import ./systemd-transparent-udp-forwarderd.nix self super;
+  force-bind = import ./force-bind-seccomp.nix self super;
   steamworks-sdk-redist = import ./steamworks-sdk-redist.nix self super;
   palworld-server = import ./palworld-server.nix self super;
 }

lib/pkgs/force-bind-seccomp.nix

···
+self: pkgs @ {
+  stdenv,
+  autoPatchelfHook,
+  fetchFromGitHub,
+  writeText,
+  ...
+}:
+
+let
+  makefile = writeText "Makefile" ''
+    TARGETS = force-bind target-mkdir target-bind parent-socket-activate
+
+    all: $(TARGETS)
+
+    force-bind: main.c scm_functions.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    parent-socket-activate: parent_soocket_activate.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    target-mkdir: target_mkdir.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    target-bind: target_bind.c
+    	$(CC) $(CFLAGS) -o $@ $^
+
+    .PHONY: all
+  '';
+in stdenv.mkDerivation rec {
+  pname = "force-bind";
+  version = "0.0.1-4867c53";
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = with self; [ stdenv.cc.cc.lib stdenv.cc.libc.linuxHeaders ];
+  buildPhase = "make";
+
+  src = fetchFromGitHub {
+    owner = "kitten";
+    repo = "force-bind-seccomp";
+    rev = "0df29fbbe20f5c191c3b76951af090ab60d533e8";
+    sha256 = "sha256-SWdPacxJ2WmB+8b8uVpxrnlLuH3wAvFIDyfBclh0a/4=";
+  };
+  postPatch = ''
+    cp ${makefile} Makefile;
+  '';
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 force-bind "$out/bin/$pname"
+    install -Dm755 target-bind "$out/bin/$pname-test-target-bind"
+    install -Dm755 parent-socket-activate "$out/bin/$pname-test-socket-activate"
+    runHook postInstall
+  '';
+
+  meta.mainProgram = pname;
+}

lib/pkgs/mk-steam-wrapper.nix

···
       runpaths = libs ++ optionals useBox64 nativeLibs;
       combinedEnv = optionalAttrs useBox64 {
         BOX64_LOG = logLevel;
-        BOX64_DYNAREC_STRONGMEM = 1;
-        BOX64_DYNAREC_BIGBLOCK = 1;
-        BOX64_DYNAREC_SAFEFLAGS = 1;
-        BOX64_DYNAREC_FASTROUND = 1;
-        BOX64_DYNAREC_FASTNAN = 1;
-        BOX64_DYNAREC_X87DOUBLE = 0;
+        BOX64_DYNAREC_STRONGMEM = 0;
       } // env;
     in bin:
       stdenv.mkDerivation rec {

lib/pkgs/systemd-transparent-udp-forwarderd.nix

···
-pkgs @ {
+self: pkgs @ {
   stdenv,
   cmake,
   pkg-config,
···
   ...
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "systemd-transparent-udp-forwarderd";
   version = "0.0.1-add-activity-timeout-shutdown";
   nativeBuildInputs = [ cmake pkg-config ];
···
     install -Dm755 systemd-transparent-udp-forwarderd "$out/bin/$pname"
     runHook postInstall
   '';
+
+  meta.mainProgram = pname;
 }

machines/ramune/configuration.nix

···
           ServerName = "London Boroughs";
           AllowConnectPlatform = "Xbox";
           PalEggDefaultHatchingTime = 1;
+          GuildPlayerMaxNum = 10;
+          bShowPlayerList = true;
+          bEnableNonLoginPenalty = false;
+          bUseAuth = false;
         };
       };
     };

modules/games/palworld/default.nix

···
   isEnabled = config.modules.games.enable && config.modules.games.palworld.enable;
   baseCfg = config.modules.games;
   cfg = config.modules.games.palworld;
+  port = toString cfg.port;
 
   name = "palworld-server";
   scripts = (import ../lib/scripts.nix) args;
···
       description = "Whether to enable Community Server mode";
     };
 
-    autostart = mkOption {
-      default = false;
-      type = types.bool;
-    };
-
     datadir = mkOption {
       type = types.path;
       default = "${baseCfg.datadir}/palworld";
···
 
     threads = mkOption {
       type = types.int;
-      default = 4;
+      default = 5;
     };
 
     maxPlayers = mkOption {
···
       "d ${cfg.datadir} 0755 ${baseCfg.user} ${baseCfg.group} - -"
     ];
 
+    systemd.sockets."${name}" = {
+      wantedBy = [ "sockets.target" ];
+      partOf = [ "${name}.service" ];
+      listenDatagrams = [ "0.0.0.0:${port}" ];
+      socketConfig = {
+        SocketUser = "${baseCfg.user}";
+        SocketGroup = "${baseCfg.group}";
+      };
+    };
+
     systemd.services."${name}" = let
       dirs = {
         Pal = "${cfg.package}/Pal";
···
       script = let
         args = [
           "Pal"
-          "-port=${toString cfg.port}"
+          "-port=${port}"
+          "-publicport=${port}"
           "-useperfthreads"
           "-NoAsyncLoadingThread"
           "-UseMultithreadForDS"
···
           ++ optionals (cfg.ip != null) [ "-publicip=${cfg.ip}" ]
           ++ optionals cfg.public [ "-publiclobby" ];
         bin = getExe (pkgs.mkSteamWrapper "${cfg.datadir}/Pal/Binaries/Linux/PalServer-Linux-Shipping");
-      in "${bin} ${concatStringsSep " " args}";
+        forceBind = "${getExe pkgs.force-bind} -m '0.0.0.0:${port}=sd=0'";
+      in "${forceBind} ${bin} ${concatStringsSep " " args}";
     in {
-      wantedBy = mkIf cfg.autostart [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
       path = with pkgs; [ xdg-user-dirs util-linux ];
 
       inherit script;
···
         Group = "${baseCfg.group}";
         WorkingDirectory = "${cfg.datadir}";
 
-        CPUWeight = 80;
+        CPUWeight = 90;
         CPUQuota = "${toString ((cfg.threads + 1) * 100)}%";
 
+        /*
         PrivateDevices = true;
         PrivateTmp = true;
         PrivateUsers = true;
···
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         RestrictRealtime = true;
-        LockPersonality = true;
+        */
+
+        # force-bind needs to stay unlocked and needs to be able to ptrace
+        LockPersonality = false;
+        CapabilityBoundingSet = [ "CAP_SYS_PTRACE" ];
 
         # Palworld needs namespaces and system calls
         RestrictNamespaces = false;

modules/router/kernel.nix

···
       "kernel.sysrq" = 4;
       "kernel.unprivileged_bpf_disabled" = true;
       "kernel.perf_event_paranoid" = 3;
-      "kernel.yama.ptrace_scope" = 2;
       "kernel.kexec_load_disabled" = true;
       "net.core.bpf_jit_harden" = 2;
       "dev.tty.ldisc_autoload" = false;