SecureAnyCloud
Deployment guide

Crafty Controller

Overview

Crafty Controller is an open source, self-hosted control panel for creating, running and administering Minecraft and other game servers from your browser. You can create, start, stop and restart servers, watch a live console and send commands, edit configuration and files, schedule automated tasks and backups, and set per-server CPU and memory limits. Role-based access lets your team share the panel, all without touching the command line.

This SecureAnyCloud image runs Crafty Controller from the vendor's official container (crafty-controller/crafty-4, pinned by digest), published only on loopback 127.0.0.1:8443. nginx fronts it on port 443 over TLS and is WebSocket aware, so the live console and status channels work through the proxy. It is ready for your own certificate. The panel's embedded SQLite datastore lives in Docker volumes captured into the image.

The image is secure by default. Crafty generates a fresh, random administrator password on the first boot of every instance. It is never baked into the image, and SecureAnyCloud writes it to a root-only file, /root/crafty-credentials.txt, for you to retrieve. On first boot, the crafty-firstboot.service oneshot generates a per-VM TLS certificate, starts the stack, captures the per-VM admin password and resolves the instance URL, then disables itself.

What you get:

  • Crafty Controller 4.10.7 (GPL-3.0) from the official crafty-controller/crafty-4 image, pinned by digest
  • Embedded SQLite datastore in Docker volumes (crafty-config, crafty-servers, crafty-backups, crafty-logs, crafty-import)
  • crafty.service running the container, published on 127.0.0.1:8443
  • A unique random admin password generated at first boot, stored 0600 root:root in /root/crafty-credentials.txt
  • An nginx TLS reverse proxy on port 443 (port 80 redirects to 443), WebSocket aware, with a per-VM self-signed certificate
  • crafty-firstboot.service for first-boot certificate generation, admin capture and stack start
  • Bundled Java runtime handling for the game servers Crafty manages
  • Docker Engine runtime
  • Ubuntu 24.04 LTS base, patched at build time
  • 24/7 SecureAnyCloud support, 24h response SLA

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet.

The recommended VM size is Standard_B2s. The panel is lightweight, so size the VM for the game servers you create later.

1

Deploy from the Azure Portal

Search the Marketplace for Crafty Controller on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 443 (the panel) from the networks that need it.

To run game servers that players connect to, you open the relevant game ports later.

2

Deploy from the Azure CLI

RG="crafty-prod"; LOCATION="eastus"; VM_NAME="crafty-01" IMAGE_URN="sac1647283583153:crafty-controller-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name crafty-vnet --address-prefix 10.80.0.0/16 --subnet-name crafty-subnet --subnet-prefix 10.80.1.0/24 az network nsg create -g "$RG" --name crafty-nsg az network nsg rule create -g "$RG" --nsg-name crafty-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name crafty-nsg --name allow-panel --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:crafty-controller-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name crafty-vnet --subnet crafty-subnet --nsg crafty-nsg --public-ip-sku Standard
3

Connect via SSH

ssh azureuser@<vm-ip>
4

Verify the services are running

Crafty runs in a container published on loopback 127.0.0.1:8443. nginx fronts the panel on port 443 over TLS and proxies its WebSocket traffic. Check the services:

systemctl is-active docker crafty nginx crafty-firstboot
sudo ss -tlnp | grep -E ':443 |127.0.0.1:8443'
sudo docker ps --format 'table {{.Names}}\t{{.Status}}'

All services report active, nginx is bound to :443, the container is published only on 127.0.0.1:8443, and the crafty container is Up.

5

Retrieve your unique admin password

No known password ships in the image. Crafty generated a random administrator password for this VM at first boot and wrote it to a root-only file. Check the file's permissions and read it:

sudo stat -c '%n perms=%a owner=%U:%G' /root/crafty-credentials.txt
sudo cat /root/crafty-credentials.txt

The file is 600 root:root and holds CRAFTY_ADMIN_USERNAME (admin) and a unique CRAFTY_ADMIN_PASSWORD generated for this instance. Copy the password, and change it after your first login.

6

Log in to the panel

Open https://<vm-ip>/ in your browser. The panel uses a per-VM self-signed certificate, so your browser shows a certificate warning the first time. Accept it, or install your own certificate (see Step 12).

Enter the Username (admin) and the Password from /root/crafty-credentials.txt, then click Log In.

7

The dashboard

After you sign in, you land on the dashboard. It shows host CPU, memory and storage, how many servers are online and offline, and an All Servers panel. A fresh instance has no servers yet, so the dashboard invites you to create your first one.

8

Create a game server

Click Create New Server on the dashboard or in the Servers menu. Choose the server type (Minecraft Java, Minecraft Bedrock or Hytale), pick the server flavour and version, and give it a name. Under Quick Settings, set the minimum and maximum memory and the server port.

Click Create Server, and Crafty downloads the server files and provisions the server. You can also import an existing server from a zip archive.

9

Users, roles and configuration

Open Panel Settings to reach the Crafty Configuration area. Under Panel Config, add users, assign them to servers, and create roles with fine-grained permissions. Your team then shares access without sharing the admin password.

Your admin account is a super user with access to all servers.

10

The stack

sudo docker inspect --format '{{.Config.Image}}' crafty
sudo docker exec crafty cat /crafty/app/config/version.json | tr -d ' \n' nginx -v curl -sk -o /dev/null -w 'GET / -> HTTP %{http_code}\n' https://127.0.0.1/

The pinned crafty-4 image runs the panel, the Crafty version is 4.10.7, nginx fronts it over TLS, and the panel returns HTTP 200 through nginx.

11

Data and persistence

All Crafty data lives in the embedded SQLite database and the server files inside Docker volumes. The volumes are captured into the image and carried onto every instance.

sudo docker volume ls | grep crafty
sudo docker exec crafty ls -lh /crafty/app/config/db/crafty.sqlite systemctl is-enabled crafty-firstboot.service apt-mark showhold

The volumes are present, the database file is on disk inside crafty-config, and the first-boot service is enabled for the next fresh instance. There are no held packages, so the OS security baseline is intact.

12

Install your own TLS certificate

The image ships with a per-VM self-signed certificate, so the panel is encrypted from first boot. To remove the browser warning, point a DNS record at your VM and install a trusted certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot obtains the certificate, rewrites the nginx server block to use it, and sets up automatic renewal. The panel is then served over HTTPS with a trusted certificate.

Running game servers

Crafty runs your game servers inside its container. To let players reach a server you create, open the game's port on your NSG (for example TCP 25565 for a default Minecraft Java server) and publish it from the container.

The panel image publishes only the management port by design. Adjust the container's published ports for the game servers you run, then restart the service:

sudo systemctl status crafty --no-pager | head -n 6
sudo docker logs --tail 8 crafty

Managing the service

Restart the stack with sudo systemctl restart crafty, and follow the live container logs with sudo docker logs -f crafty. The nginx logs are under /var/log/nginx/.

Back up the instance by snapshotting the OS disk or by using Crafty's built-in scheduled backups. Change the admin password from the Crafty user settings after your first login.

Support

SecureAnyCloud provides 24/7 support for this image by email and live chat. Support covers deployment, nginx TLS termination, upgrades, game server configuration and performance tuning. Email sales@secureanycloud.com.

This is a repackaged open source software product, with additional charges for SecureAnyCloud support services. Crafty Controller is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Crafty Controller on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure