Mindustry Server 160.7

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Mindustry Server 160.7 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2. Select m5.large, your key pair and a security group as described above.

The server itself is modest. It used about 162 MB of memory with a world hosted and a player connected, and the Java heap is capped at 1024 MB.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --associate-public-ip-address \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mindustry}]'

Create the security group rules with the AWS CLI:

aws ec2 authorize-security-group-ingress --group-id <your-security-group> \
  --ip-permissions 'IpProtocol=tcp,FromPort=6567,ToPort=6567,IpRanges=[{CidrIp=0.0.0.0/0}]' \
  'IpProtocol=udp,FromPort=6567,ToPort=6567,IpRanges=[{CidrIp=0.0.0.0/0}]' \
  'IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges=[{CidrIp=<your-mgmt-cidr>}]'

Version SSH user

Mindustry Server 160.7 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

On first boot, the instance generates its own console token and prepares a clean state directory. It then starts the server, applies the shipped configuration and hosts the Ancient_Caldera map. Before it declares itself ready, it proves that a real Mindustry protocol client can join.

Wait two or three minutes after the instance reports running, then check the services:

systemctl is-active mindustry-firstboot.service mindustry.service mindustry-console.service sac-mindustry-egress.service

All four report active. Then read this instance's credentials:

sudo cat /root/mindustry-credentials.txt

The file is 0600 root:root and was written on your instance. It holds the console token, the instance's addresses (read with IMDSv2) and the address that players connect to:

MINDUSTRY_CONSOLE_TOKEN=<console-token> MINDUSTRY_CONSOLE_ENDPOINT=127.0.0.1:6859 MINDUSTRY_PRIVATE_IP=<private-ip> MINDUSTRY_PUBLIC_IP=<server-ip> MINDUSTRY_GAME_ADDRESS=<server-ip>:6567 MINDUSTRY_VERSION=160.7

Keep the token secret, as you would any other credential. It is not a player password: Mindustry has no player login, and the game port is meant to be public.

If the instance has no public IPv4 address, the public and game addresses show the private address. That address works only inside your VPC or VPN.

Then check that the server is hosting a world:

sudo mindustryctl status

The output shows the map being played, the wave, the time until the next wave and the connected players. If it says server closed, no world is hosted. See Step 6.

• Open Mindustry on your own computer (Steam, itch.io or the official build) at version 160.7.
• Choose Play, Join Game, Add Server.
• Enter MINDUSTRY_GAME_ADDRESS from the credentials file: the public IP with :6567.
• Select the server, which appears with its name, map and player count, to join.

By design, the server refuses clients on a different build, so worlds do not desynchronise. It also refuses modified clients, because allowCustomClients is false in this image.

mindustryctl drives the server's own console through the token-checked bridge. It is root-only (0750 root:root):

sudo mindustryctl help

Everyday commands:

sudo mindustryctl status
# what is hosted, wave, players
sudo mindustryctl players
# who is connected, with their IDs
sudo mindustryctl maps all
# the built in maps you can host
sudo mindustryctl playerlimit
# the current player cap

Grant admin rights by player ID. The players command shows the ID while the player is connected. Take the value after ID: and run the following command. The player should reconnect afterwards to pick up the new status, and admin remove <id> reverses it:

sudo mindustryctl admin add <their-player-id>
sudo mindustryctl admins

To deal with a griefer, kick or ban the player and review the ban list:

sudo mindustryctl kick <player-name>
sudo mindustryctl ban id <their-player-id>
sudo mindustryctl unban <id-or-ip>

sudo mindustryctl bans

Vote kick is on, so your players can remove a griefer themselves. Strict mode corrects positions and rejects duplicate player IDs.

A wrong token is refused with a fixed one-second delay and deliberately no lockout, so a typo never locks you out of your own server.

The game port exists only while a world is hosted. Mindustry opens the listener when you host and closes it when you stop.

sudo mindustryctl maps all
sudo mindustryctl host Ancient_Caldera survival

Loading a large map can take a minute or two. Then confirm it with sudo mindustryctl status.

Other modes are attack, pvp, sandbox and editor. To end the current world, run sudo mindustryctl stop and host another. To start the next wave now, run sudo mindustryctl runwave.

• Autosave runs every 300 seconds and keeps the five most recent saves, so saves cannot fill the disk.
• A reboot resumes the most recent autosave. If there is nothing to resume, it hosts the default map.
• Named saves are yours to make and keep:

sudo mindustryctl save my-world
sudo mindustryctl saves

Saves live in /var/lib/mindustry/config/saves as .msav files. Copy them off the instance with scp for a backup you control. Bring one back with sudo mindustryctl load my-world. To resume the latest autosave by hand, run sudo mindustryctl loadautosave.

The server log is /var/log/mindustry/mindustry.log. It is rotated daily or at 32 MB, keeping seven compressed generations for at most 30 days:

sudo tail -20 /var/log/mindustry/mindustry.log

mindustryctl strips Mindustry's colour codes. The raw log keeps them, and less -R renders them.

Configuration is the plain-text file /etc/mindustry/server-commands.conf. The service replays it into the server console on every start.

Mindustry's own settings.bin is a binary file that also holds the admin list, ban list and player database. The image ships none, so configuration stays readable as text.

sudo cat /etc/mindustry/server-commands.conf

Setting This image Upstream default

playerlimit 30 no limit

messageRateLimit 2 seconds 0 (chat rate limiting off)

messageSpamKick 3 3

allowCustomClients false true on desktop builds

autosave true, 5 kept false

socketInput false false (and unauthenticated when on)

To change a setting, edit the file and restart the service:

sudoedit /etc/mindustry/server-commands.conf
sudo systemctl restart mindustry.service

A setting changed live with sudo mindustryctl config <name> <value> reverts to the file on the next restart.

For an invite-only server, add config whitelist true to the file and have each player connect once. Then run sudo mindustryctl whitelist add <their-player-id>.

The Java heap is capped at 1024 MB in /usr/local/sbin/mindustry-run.sh. If a very large map with many players needs more, raise -Xmx there and move to a larger instance type.

Only SSH (TCP 22) and the game port (TCP and UDP 6567) listen on the network. The console bridge listens on loopback only. Confirm the listeners:

sudo ss -H -tulnp | grep -E ':(22|6567|6859) '

The administration console answers only on 127.0.0.1:6859, and the kernel lets only root open a connection to it. The server account can open new connections only to the instance itself.

sac-mindustry-egress.service loads both rules before the server starts, and the server refuses to start without them. To see the rules, run:

sudo mindustry-egress-apply --print

systemd also denies the server units the instance metadata service and link-local addresses. To see the setting, run:

systemctl show mindustry.service -p User -p NoNewPrivileges -p PrivateTmp -p IPAddressDeny

Java's temporary directory is private to the service (/var/lib/mindustry/.tmp, mode 0700). The console token is never written to the logs or the journal.

ubuntu and root keep normal access to the instance metadata service with IMDSv2, so the AWS CLI and the SSM agent work as usual.

If you add a plugin or mod that needs to reach the internet, for example a chat bridge, the outbound rule refuses it. That is deliberate. Run such integrations as their own service under a different account instead of loosening the game server.

The image carries its own audit. Run it as follows. It takes a few minutes, because it restarts the server and reconnects a client for real:

sudo /usr/local/sbin/mindustry-roundtrip-check.sh

The audit proves, in order, that:

• the console token is required, and a wrong or empty token executes nothing (the real token is proven again straight afterwards, so the refusal is not a lockout)
• the console answers on loopback and not on the instance's private address, while the game port on that same address does
• a real Mindustry protocol client completes the handshake and the server lists the connected player
• malformed clients (wrong build, wrong client type, empty name) are refused
• the world survives a full service restart with the same map and wave
• logrotate really rotates

It ends with MINDUSTRY_ROUNDTRIP_OK. If anything fails, it exits non-zero.

Component Version Location

Mindustry server 160.7 (unmodified upstream server-release.jar) /opt/mindustry/server-release.jar (root owned)

OpenJDK 21 runtime (Ubuntu package, security updates via unattended upgrades) /usr/lib/jvm

State, saves and maps /var/lib/mindustry/

Configuration /etc/mindustry/server-commands.conf

Console token /etc/mindustry/console.token (0640 root:mindustry)

Log /var/log/mindustry/mindustry.log

Admin command /usr/local/sbin/mindustryctl

Self audit /usr/local/sbin/mindustry-roundtrip-check.sh

First boot mindustry-firstboot.service, credentials in /root/mindustry-credentials.txt

Licence and source offer /usr/share/doc/mindustry/

• Allow TCP 22 only from your own networks. Only TCP and UDP 6567 need to be open to players.
• Never open 6859 and never switch socketInput on. The server refuses to start with it on.
• Keep /root/mindustry-credentials.txt and /etc/mindustry/console.token private.
• Use the whitelist (Step 8) if the server is for a known group of players.
• Copy saves off the instance regularly (Step 7).
• Unattended upgrades keep Ubuntu and OpenJDK patched. Update Mindustry when your players move to a new release.