Gaming AWS

Crafty Controller Game Server Control Panel on AWS User Guide

| Product: Crafty Controller

Overview

Crafty Controller is an open source, self-hosted control panel for running and administering Minecraft and other game servers from your browser. Create, start, stop and restart servers, watch a live console, edit configuration and files, schedule automated tasks and backups, set per-server CPU and memory limits, import existing servers, and give your team role-based access, all without touching the command line.

This cloudimg image runs Crafty Controller as the vendor's official crafty-controller/crafty-4 container, pinned by digest, under a single systemd service. The panel binds to the loopback interface only on HTTPS port 8443; a host nginx reverse proxy terminates TLS on port 443 with a per-instance self-signed certificate and proxies WebSocket console and stats traffic through to it, while plain HTTP on port 80 redirects to HTTPS. Docker Engine and its entire data root, including the pre-pulled digest-pinned image and every Crafty volume (the SQLite panel database and configuration, your game-server directories and worlds, backups, logs and imports), live on a dedicated data volume mounted at /var/lib/docker, so your game data survives OS-disk changes and is resizable independently.

Security is enforced from first boot. Crafty generates a fresh, random administrator password on its first database initialisation; this image never bakes a known credential. Before the panel is reachable, that per-instance password is captured to a root-only file, a per-instance TLS certificate is generated, and only then does nginx start. Backed by 24/7 cloudimg support.

What is included:

  • Crafty Controller 4.10.7, the GPL-3.0 licensed game-server control panel, shipped as the vendor's official container pinned by digest, with its GPL-3.0 licence text baked to /opt/crafty-controller/LICENSE
  • Docker Engine with the Crafty panel on the loopback interface behind nginx over TLS on port 443
  • A unique random administrator password generated on first boot and written to a root-only file, never baked into the image
  • A per-instance self-signed TLS certificate generated on first boot
  • The panel database and every managed game server on a dedicated data volume at /var/lib/docker
  • docker.service, crafty.service and nginx.service as systemd units, enabled and active
  • 24/7 cloudimg support

What is not included (by design): no Minecraft or other game server software is bundled, and no end user licence agreement is accepted on your behalf. You choose and download a server through the panel and accept its end user licence agreement yourself at run time, exactly as you would on your own hardware. The panel bundles the Java runtime required to run the servers you create.

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type; size up for busier servers with more players. Security group inbound: allow 22/tcp from your management network for SSH and 443/tcp for the web panel. The game-server port (Minecraft defaults to 25565/tcp) is deliberately not opened by this image; add it to your security group yourself, only for the servers you choose to run.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI into your VPC with the security group described above. Choose the m5.large instance type and attach your EC2 key pair. The image keeps the pre-pulled container image on the dedicated data volume, so the panel comes up within a couple of minutes of first boot with no image re-pull.

Step 2 - Connect to your instance

Connect over SSH as the default login user for the operating system variant you launched. The login user differs per OS, so use the row for your variant:

OS variant SSH login user Example
Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<instance-public-ip> 
ssh -i your-key.pem ubuntu@<public-ip>

Step 3 - Read your unique administrator credential

On first boot the instance captures the random administrator password that Crafty generated on its first database initialisation, along with the resolved panel URL, and writes them to a root-only file. Read it with sudo:

sudo cat /root/crafty-credentials.txt

You will see CRAFTY_ADMIN_USERNAME, CRAFTY_ADMIN_PASSWORD and CRAFTY_URL for this instance. There is no default or shared login anywhere in the image; the password is unique to this instance and differs on every launch. Change it from the Crafty user settings after your first sign-in.

Step 4 - Verify the security model from the command line

Confirm the three services are active:

systemctl is-active docker crafty nginx

active
active
active

Confirm the panel binds only to loopback on 8443, and nginx is the only public listener on 443:

sudo ss -tlnp | grep -E ':(443|8443)\b'

LISTEN 0  511        0.0.0.0:443    0.0.0.0:*
LISTEN 0  4096     127.0.0.1:8443   0.0.0.0:*
LISTEN 0  511          [::]:443       [::]:*

The panel is on 127.0.0.1:8443 (loopback only), so it is never exposed directly; only nginx on 443 faces the network. Confirm the TLS front door answers and that plain HTTP redirects to HTTPS:

curl -sk -o /dev/null -w 'HTTPS /login -> %{http_code}\n' https://127.0.0.1/login
curl -s  -o /dev/null -w 'HTTP  /      -> %{http_code}\n' http://127.0.0.1/

HTTPS /login -> 200
HTTP  /      -> 301

Confirm the baked GPL-3.0 licence is present:

head -2 /opt/crafty-controller/LICENSE

                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007

Step 5 - Sign in to the web panel over TLS

Open the panel in a browser at https://<instance-public-ip>/. The instance uses a per-instance self-signed TLS certificate, so your browser will warn about the certificate the first time; accept it to continue, or front the instance with your own domain and certificate (see Step 8). Sign in with the CRAFTY_ADMIN_USERNAME and CRAFTY_ADMIN_PASSWORD from Step 3.

The Crafty Controller sign-in page served over TLS

After signing in you land on the dashboard, which shows host CPU, memory and storage usage and the status of every server you manage. A fresh instance has no servers yet.

The Crafty Controller dashboard showing host resources and server status

Change the administrator password now: open the user menu (top right) and set your own password, then keep the root-only credentials file only as a record of the original.

Step 6 - Create your first game server

From the dashboard choose Create New Server. Crafty presents a wizard where you select the server type and version, name the server, and set its memory limits and port.

The Crafty Controller create-server wizard

When you create a server, Crafty downloads the server software you selected and you accept that software's end user licence agreement at that point. For Minecraft servers this means accepting Mojang's Minecraft End User Licence Agreement, exactly as you would running the server yourself. This image ships only the Crafty Controller panel; it bundles no game server and accepts no such agreement on your behalf.

The game-server port (Minecraft defaults to 25565) is not open in the instance security group. When you are ready to let players connect, add the specific port for that server to your security group, scoped to the networks you trust. Keeping it closed by default means a freshly launched instance never exposes an unconfigured game server to the internet.

Step 7 - Manage users and roles

Crafty supports multiple users with role-based access, so you can let moderators and helpers operate specific servers without handing out SSH or root on the host. Open Panel Settings to add users, create roles and scope each role to the servers it may control.

The Crafty Controller panel configuration showing users and roles

Step 8 - Data volume and backups

The Docker data root, and therefore the panel database, configuration, and every managed game server, world and backup, lives on a dedicated EBS data volume mounted at /var/lib/docker, separate from the OS disk:

df -hT /var/lib/docker /

Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/nvme1n1   ext4   40G  ...        ...  /var/lib/docker
/dev/root      ext4   19G  ...        ...  /

The volume is mounted by filesystem UUID (see /etc/fstab), so it survives reboots and re-launches. Back it up with EBS snapshots or AWS Backup, and resize it independently of the OS disk as your worlds and backups grow. Crafty's own scheduled-backup feature writes into this same volume, so a single snapshot captures both the panel database and your backup archives.

To front the panel with your own domain and a trusted certificate, point a DNS record at the instance (or an Application Load Balancer), then either terminate TLS at the load balancer with an ACM certificate or replace the per-instance self-signed certificate at /etc/nginx/ssl/ with your own and reload nginx.

Security model

  • No default or shared credentials. The administrator password is generated fresh and at random on every instance's first boot and written only to a root-only file; it is never baked into the image.
  • Per-instance TLS. nginx terminates TLS on port 443 with a per-instance self-signed certificate generated on first boot; plain HTTP on port 80 redirects to HTTPS.
  • Loopback-only panel. The Crafty panel binds exclusively to 127.0.0.1:8443; only the nginx reverse proxy is exposed to the network.
  • Deliberate game-server exposure. The game-server port is never opened by default; you open it in your security group only for the servers you choose to run.
  • Dedicated data volume. The panel database and every managed server live on their own EBS volume, surviving OS-disk changes and resizable independently.

Troubleshooting

  • The panel does not load. Check the services with systemctl status docker crafty nginx and the first-boot log at /var/log/cloudimg-firstboot.log. On a brand-new instance, allow a couple of minutes for first boot to generate the certificate and capture the administrator credential.
  • Certificate warning in the browser. Expected on a fresh instance (per-instance self-signed certificate). Accept it, or install your own certificate as in Step 8.
  • Players cannot connect to a server. Confirm you added that server's port to the instance security group and that the server is started in the panel.
  • Lost the administrator password. Read it again with sudo cat /root/crafty-credentials.txt.

Support

cloudimg provides 24/7 technical support for this product by email and live chat at support@cloudimg.co.uk. We help with deployment, reverse-proxy termination with your own domain and certificate, opening game-server ports safely, sizing instances for your player counts, and scheduling and restoring backups of your game worlds and panel database.