GameAP

Search the Marketplace for GameAP Game Server Control Panel on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 and 443 (the panel) from the networks that need it.

To run game servers that players connect to, open the relevant game ports later.

Create the VM with the Azure CLI:

RG="gameap-prod"; LOCATION="eastus"; VM_NAME="gameap-01" IMAGE_URN="sac1647283583153:gameap:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name gameap-vnet --address-prefix 10.90.0.0/16 --subnet-name gameap-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name gameap-nsg az network nsg rule create -g "$RG" --nsg-name gameap-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name gameap-nsg --name allow-panel --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:gameap:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name gameap-vnet --subnet gameap-subnet --nsg gameap-nsg --public-ip-sku Standard

Connect over SSH:

ssh azureuser@<vm-ip>

The panel serves on loopback 127.0.0.1:8025, the daemon connects to it over gRPC on loopback 127.0.0.1:31718, and nginx fronts the panel on port 443 over TLS. Only ports 80 and 443 are exposed. Check the services and the listeners:

systemctl is-active gameap gameap-daemon nginx
sudo ss -tlnp | grep -E ':(80|443|8025|31718)\b'

All three services report active. nginx is bound to 0.0.0.0:80 and 0.0.0.0:443, while the panel HTTP endpoint (127.0.0.1:8025) and the panel-to-daemon gRPC endpoint (127.0.0.1:31718) are bound to loopback only, so neither is reachable from the network.

No known password ships in the image. GameAP generated a random administrator password for this VM at first boot and wrote it to a root-only file. Read the file:

sudo stat -c '%n perms=%a owner=%U:%G' /root/gameap-credentials.txt
sudo cat /root/gameap-credentials.txt

The file is 600 root:root and holds GAMEAP_ADMIN_USERNAME (admin), a unique GAMEAP_ADMIN_PASSWORD generated for this instance, and the panel URL. Copy the password, then change it after your first login from Admin, then Profile.

Open https://<vm-ip>/ in your browser. The panel uses a per-VM self-signed certificate, so your browser shows a certificate warning the first time. Accept it, or install your own certificate (see Step 12).

Enter the Username / E-Mail Address (admin) and the Password from /root/gameap-credentials.txt, then click Login.

After you sign in, you land on the dashboard, which summarizes how many game servers and nodes are online. A fresh instance has no game servers yet. It shows exactly one node online, your local daemon, ready to run game servers.

Open Administration, then Dedicated servers. This page is the heart of the appliance. It lists the local node with a green Online badge and live CPU and memory usage, which the daemon streams to the panel over the mutual TLS gRPC link.

Because the daemon is already enrolled and linked, you can create and run game servers immediately, with no manual node setup.

Open Administration, then Games, to see the built-in catalog of supported games (Counter-Strike, ARK, Rust, Minecraft, Valheim and many more). Use Add Game, Add Mod or Import to extend it.

To stand up a server, go to Administration, then Game servers, then Create. Pick the node (your local daemon), choose the game, and set the IP, port and start parameters. Then install and start the server from its Console tab. Game files are fetched through SteamCMD (bundled) or a direct download, depending on the game.

The image preinstalls the open source Minetest/Luanti dedicated server (/usr/games/minetestserver) as a redistributable example you can wire up as a game without any Steam credentials. Open the game port you choose on your Azure NSG so players can connect.

Confirm the mutual TLS gRPC link directly from the API. The commands below log in with your per-VM admin password and read the daemon status for the local node.

GAMEAP_PASS="$(sudo grep '^GAMEAP_ADMIN_PASSWORD=' /root/gameap-credentials.txt | cut -d= -f2-)" TOKEN="$(curl -sk -X POST https://127.0.0.1/api/auth/login -H 'Content-Type: application/json' \
  -d "{\"login\":\"admin\",\"password\":\"$GAMEAP_PASS\"}" | jq -r .token)" curl -sk https://127.0.0.1/api/nodes -H "Authorization: Bearer $TOKEN" | jq -c '.[] | {id, name}' curl -sk https://127.0.0.1/api/nodes/1/daemon -H "Authorization: Bearer $TOKEN" \
  | jq '{connection_type, daemon_version: .version.version, online_servers: .base_info.online_servers_count}'

The node is listed, and the daemon status reports connection_type: "grpc". This confirms that the panel and the local daemon are connected over the mutual TLS gRPC stream.

The panel configuration and secrets live in /etc/gameap/config.env, the datastore is an embedded SQLite database, and the daemon's mutual TLS certificates live under /etc/gameap-daemon/certs. All of them are on the OS disk and captured into the image. Inspect them:

sudo grep -E '^(HTTP_HOST|GRPC_PORT|DATABASE_DRIVER|AUTH_SERVICE)=' /etc/gameap/config.env
sudo test -f /var/lib/gameap/database.sqlite && echo "SQLite datastore present"
sudo ls /etc/gameap-daemon/certs systemctl is-enabled gameap gameap-daemon nginx apt-mark showhold

The output shows that the panel binds to 127.0.0.1, the gRPC port is 31718, and the datastore is SQLite. The daemon holds its per-VM ca.crt, server.crt and server.key. The services are enabled for the next boot, and there are no held packages, so the OS security baseline is intact.

The image ships with a per-VM self-signed certificate, so the panel is encrypted from first boot. To remove the browser warning, point a DNS record at your VM and install a trusted certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot obtains the certificate, rewrites the nginx server block to use it, and sets up automatic renewal. Your panel is then served over HTTPS with a trusted certificate.