Crafty Controller 4.11.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud game server listing on AWS Marketplace, choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose Crafty Controller 4.11.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended) and your key pair.
• Set the security group. The listing's default group opens SSH (22), HTTP (80), HTTPS (443) and the Minecraft port (25565) to anywhere. Restrict SSH to your own IP address, and restrict 80 and 443 to the networks you manage from.
• Choose your VPC and subnet. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run the commands below on your own workstation. They create a security group with the rules above and then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR ranges with your own:

SG=$(aws ec2 create-security-group --group-name crafty \
  --description "Crafty Controller" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 25565 --cidr 0.0.0.0/0
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=crafty}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. To keep the address across a stop and start, associate an Elastic IP.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot takes two to three minutes. It performs these actions in order:

• Sets the name the panel is served on. This is the instance's public IP address until you give it a DNS name.
• Makes the TLS certificate for that name.
• Starts Crafty on loopback.
• Verifies the admin password.
• Writes /root/crafty-credentials.txt.
• Opens nginx.

The commands below show the entries in the credentials file, then the names of every key it holds. The password itself is not shown here:

sudo grep -E '^CRAFTY_(URL|USERNAME)=' /root/crafty-credentials.txt
sudo grep -oE '^[A-Z_]+=' /root/crafty-credentials.txt | tr -d '='
sudo stat -c '%a %U:%G' /root/crafty-credentials.txt

CRAFTY_URL=https://34.201.60.154/ CRAFTY_USERNAME=admin CRAFTY_URL CRAFTY_USERNAME CRAFTY_PASSWORD 600 root:root

The file holds these values:

• CRAFTY_URL: the address of this instance's panel.
• CRAFTY_USERNAME: admin, the superuser account.
• CRAFTY_PASSWORD: the admin password, generated on this instance.

To read the password, run sudo cat /root/crafty-credentials.txt in your own session and store it in your password manager. The file is not updated when you change the password in the panel.

Confirm that Docker, the metadata firewall unit, Crafty and nginx are active. nginx serves ports 80 and 443. The panel itself listens only on loopback port 8443, and the one game port published by default is 25565:

systemctl is-active docker.service sac-docker-imds-deny.service crafty.service nginx.service
sudo docker ps --format '{{.Names}} {{.Image}} {{.Status}}' | sed -E 's/Up [^(]*/Up/'
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u
H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/crafty-host.conf)
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz"
curl -sk -o /dev/null -w 'login page: HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/login"
curl -s -o /dev/null -w 'port 80: HTTP %{http_code}\n' --resolve "$H:80:127.0.0.1" "http://$H/"

active active active active crafty sac/crafty-controller:4.11.0-sac Up 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:25565 users:(("docker-proxy")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:8443 users:(("docker-proxy")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:25565 users:(("docker-proxy")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx")) ok login page: HTTP 200 port 80: HTTP 301

The panel reports its own version. The container's version floor check reads the version of each raised package from the running Python interpreter, from the libraries pip carries inside itself, and from the container's Ubuntu package database.

The container runs the same check at every start. If any line fails, it refuses to start Crafty (exit code 78, logged in sudo journalctl -u crafty). Run the checks:

sudo docker exec crafty cat /crafty/app/config/version.json | tr -d ' \n'; echo
sudo docker exec crafty /crafty/.venv/bin/python3 -I /opt/sac/crafty-version-floor.py

{"major":4,"minor":11,"sub":0} OK py pillow running=13.0.0 floor=13.0.0 OK py tornado running=6.6.1 floor=6.6.1 OK py anyio running=4.14.2 floor=4.14.2 OK py certifi running=2026.10.23 floor=2026.10.23 OK py cryptography running=50.0.2 floor=50.0.2 OK py pyOpenSSL running=26.4.0 floor=26.4.0 OK py orjson running=3.11.9 floor=3.11.9 OK py PyJWT running=2.15.1 floor=2.15.1 OK py requests running=2.34.2 floor=2.34.2 OK py urllib3 running=2.8.0 floor=2.8.0 OK py setuptools running=84.2.1 floor=84.2.1 OK py pip running=26.3 floor=26.3 OK pip-vendored urllib3 running=2.8.0 floor=2.8.0 OK pip-vendored certifi running=2026.10.23 floor=2026.10.23 OK pip-vendored msgpack running=1.2.4 floor=1.2.4 OK deb openssl running=3.0.13-0ubuntu3.16 floor=3.0.13-0ubuntu3.16 OK deb libssl3t64 running=3.0.13-0ubuntu3.16 floor=3.0.13-0ubuntu3.16 OK deb apt running=2.8.4ubuntu0.1 floor=2.8.4ubuntu0.1 OK deb libapt-pkg6.0t64 running=2.8.4ubuntu0.1 floor=2.8.4ubuntu0.1 OK deb libbrotli1 running=1.1.0-2ubuntu0.1 floor=1.1.0-2ubuntu0.1 VERSION_FLOOR PASS failures=0

The container's build recipe, the list of raised packages and the GPL-3.0 license text are on the instance in /usr/share/doc/crafty-controller/.

Open CRAFTY_URL (for example https://34.201.60.154/) in your browser. The certificate is self-signed and made for this instance, so the browser warns you the first time. Accept the warning, or give the instance a DNS name and your own certificate (Step 8).

Sign in as admin with CRAFTY_PASSWORD. Leave the authenticator code empty until you turn on two-factor sign-in for your account.

The dashboard shows the host's CPU and memory use, the space left for backups, and how many servers and players are online. A new instance has no servers yet.

Open your account from the avatar at the top right to change your password and turn on two-factor sign-in.

Choose Create New Server. Pick Minecraft-Java or Minecraft-Bedrock, then the server type (for example Vanilla, Paper or Fabric) and version. Give the server a name, and set the memory and the port under Quick Settings. Keep the port at 25565 for your first server, because that is the port the instance publishes.

Choose Build Server!. Crafty downloads the server files, and the server appears on the dashboard. You can also import an existing server from a zip archive on the right.

Open the server, accept the Minecraft EULA when Crafty asks, and start the server. The Terminal tab shows the live console and accepts commands. The Files, Backups, Schedules and Config tabs manage files, backups, scheduled tasks and settings. Players connect from Minecraft with the instance's address. Port 25565 is the default, so the address alone is enough.

Stop a server before you delete it. Deleting a server that is still stopping can leave Crafty ignoring start, stop and backup actions for every server until the panel restarts. If that happens, run sudo systemctl restart crafty.

Publish more game ports

Only the ports listed in /etc/sac/crafty-game-ports are published from the container to the instance. A fresh instance publishes 25565/tcp. Check the file:

grep -v '^#' /etc/sac/crafty-game-ports
sudo docker port crafty | sort

25565/tcp 25565/tcp -> 0.0.0.0:25565 25565/tcp -> [::]:25565 8443/tcp -> 127.0.0.1:8443

To run a second server, or a Bedrock server (UDP 19132), add one line per port or range. Use PORT/tcp, PORT/udp or FIRST-LAST/tcp, with ports between 1024 and 65535 and at most 101 ports per line. Open the same ports in the instance's security group, then restart Crafty.

Restarting stops the game servers that are running. Crafty starts again on its own, and servers set to auto-start come back with it.

sudo nano /etc/sac/crafty-game-ports
sudo systemctl restart crafty

First, check the container account. It is a locked system account in no group but its own. The container runs as that account with no capabilities and no way to gain privileges. The state directories belong to it, and only those 12 directories are mounted, with no Docker socket:

id crafty
sudo passwd -S crafty | cut -d' ' -f1,2 sudo docker inspect --format 'user={{.Config.User}} cap_drop={{.HostConfig.CapDrop}} security_opt={{.HostConfig.SecurityOpt}} privileged={{.HostConfig.Privileged}}' crafty
P=$(sudo docker inspect --format '{{.State.Pid}}' crafty);
sudo grep -E '^(Uid|CapEff):' /proc/$P/status
sudo stat -c '%a %U:%G %n' /var/lib/crafty/config /var/lib/crafty/servers /var/lib/crafty/backups
sudo docker inspect --format '{{range .Mounts}}{{.Source}}{{println}}{{end}}' crafty | grep -c '^/var/lib/crafty/'
sudo docker inspect --format '{{range .Mounts}}{{.Source}}{{println}}{{end}}' crafty | grep -q docker.sock && echo "docker socket mounted" || echo "no docker socket mounted"

uid=64010(crafty) gid=64010(crafty) groups=64010(crafty) crafty L user=64010:64010 cap_drop=[ALL] security_opt=[no-new-privileges:true] privileged=false Uid: 64010 64010 64010 64010 CapEff: 0000000000000000 2770 crafty:crafty /var/lib/crafty/config 2770 crafty:crafty /var/lib/crafty/servers 2770 crafty:crafty /var/lib/crafty/backups 12 no docker socket mounted

Next, check the network controls:

• The certificate is a plain server certificate made for this instance.
• The firewall drops metadata traffic from every container and rejects private destinations from Crafty's bridge.
• The host units are denied the metadata addresses.
• The Crafty container cannot reach the metadata service.
• The lockout recovery is refused from the network.

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/crafty-host.conf)
openssl s_client -connect 127.0.0.1:443 -servername "$H" </dev/null 2>/dev/null | openssl x509 -noout -subject -enddate -ext basicConstraints,extendedKeyUsage
sudo iptables -S DOCKER-USER
sudo iptables -S SAC-CR-EGRESS | grep -oE '\-d [0-9./]+ -j REJECT' | awk '{print $2}' | paste -sd' ' for u in nginx docker crafty; do echo "$u.service IPAddressDeny=$(systemctl show -p IPAddressDeny --value $u.service)"; done
sudo docker exec crafty /crafty/.venv/bin/python3 -I -c 'import urllib.request as u try: u.urlopen("http://169.254.169.254/latest/meta-data/", timeout=5); print("metadata reachable") except Exception as e: print("metadata from the Crafty container:", type(e).__name__)' curl -sk -o /dev/null -w 'lockout recovery from the network: HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/api/v2/crafty/resetPass"

subject=CN = 34.201.60.154, O = sac notAfter=Feb 13 04:00:30 2029 GMT X509v3 Basic Constraints: critical CA:FALSE X509v3 Extended Key Usage: TLS Web Server Authentication -N DOCKER-USER -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP -A DOCKER-USER -i cr-web0 -j SAC-CR-EGRESS 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 198.18.0.0/15 224.0.0.0/4 240.0.0.0/4 nginx.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 docker.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 crafty.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 metadata from the Crafty container: URLError lockout recovery from the network: HTTP 403

The blocked private ranges include your VPC, so a game server plugin cannot probe other instances. Replies to players are not affected. The VPC's DNS resolver is the one private address the container may use.

Point a DNS record at the instance. An Elastic IP keeps the address stable. Then tell the instance the name with the helper below. The helper does the following:

• Re-issues the self-signed certificate for the name.
• Updates the name nginx accepts, the cross-site guard and Crafty's own base URL.
• Records the name in /etc/sac/crafty-hostname, which is kept across reboots.
• Reloads nginx and updates CRAFTY_URL.

sudo crafty-set-hostname games.example.com

crafty-set-hostname: Crafty Controller is served at https://games.example.com/

Until you set a name, the instance follows its own public IP address. If it comes back from a stop and start with a new address, the certificate and settings are updated at boot.

To use a certificate from your own CA or from Let's Encrypt instead, first set the name with crafty-set-hostname, so that the automatic refresh leaves your certificate alone. Then replace /etc/ssl/crafty/crafty.crt and /etc/ssl/crafty/crafty.key, keeping the key at mode 0600, owner root. Finally, run sudo systemctl reload nginx.

Open Panel Settings. Under Panel Config, choose Add New User to create an account with its own password. Choose Add New Role to create a role that grants chosen permissions (for example console, files, backups or schedules) on chosen servers.

Give each person their own account rather than sharing admin. Only superusers can change panel settings and branding.