From 0ac0a0837698558e4e63a9f7ea31890c99ba5520 Mon Sep 17 00:00:00 2001
From: Alexander Kassouni <alex@kassouni.net>
Date: Sun, 27 Sep 2026 19:14:43 -0700
Subject: dont publish rcon port

---
 minecraft.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'minecraft.nix')

diff --git a/minecraft.nix b/minecraft.nix
index 8146b30..1926923 100644
--- a/minecraft.nix
+++ b/minecraft.nix
@@ -10,11 +10,15 @@ in {
 
   environment.systemPackages = [ pkgs.mcrcon ];
 
+  networking.firewall.allowedTCPPorts = [ 25565 ];
+  networking.firewall.allowedUDPPorts = [ 25565 ];
+
   services.minecraft-server = {
     enable = true;
     package = unstable.minecraft-server;
     eula = true;
-    openFirewall = true; 
+    # openFirewall would also open rcon.port, so open the game port by hand
+    openFirewall = false;
     declarative = true;
     whitelist = {
       mr_5aturn = "2b811fad-e419-401e-9185-70ab279219b5";
-- 
cgit v1.3.1