GameAP Game Server Control Panel on Ubuntu 24.04 on Azure User Guide

Overview

GameAP is a free, open source control panel for deploying and managing game servers from your browser. From one dashboard you install, start, stop, restart, configure and monitor game servers, stream the live server console, browse and edit server files, schedule tasks and give your team role based access, all without touching the command line. A web panel drives a local daemon that runs the game servers, so a single instance is a complete, self hosted game server host.

The cloudimg image runs GameAP v4.4.1 as an all in one appliance. The panel (a native Go binary) serves on loopback 127.0.0.1:8025, and its companion gameap-daemon manages game servers on the same machine. The panel and daemon talk over a long lived gRPC stream secured with mutual TLS on 127.0.0.1:31718; both endpoints are bound to loopback, and the daemon opens no inbound port. nginx fronts the panel on port 443 over TLS as the only public surface, and it is WebSocket aware so the live console works through the proxy.

Secure by default: the panel and daemon are linked with a certificate generated uniquely on the first boot of every instance, never baked into the image. A gameap-firstboot.service oneshot regenerates the data encryption key, the token signing secret and the daemon enrolment key, seeds a fresh administrator, rotates its password to a per VM random value, re enrolls the local daemon, and writes the admin credentials to a root only file, /root/gameap-credentials.txt, then disables itself.

What is included:

• GameAP v4.4.1 (MIT) installed with the official gameapctl tool, pinned to the v4.4.1 release
• The GameAP web panel (gameap.service) on loopback 127.0.0.1:8025 with an embedded SQLite datastore
• The GameAP daemon (gameap-daemon.service) linked to the panel over per VM mutual TLS gRPC on loopback 127.0.0.1:31718
• A unique random admin password generated at first boot, stored 0600 root:root in /root/gameap-credentials.txt
• nginx TLS reverse proxy on port 443 (80 redirects to 443), WebSocket aware, with a per VM self signed certificate
• gameap-firstboot.service for first boot secret regeneration, admin rotation and daemon mutual TLS enrolment
• SteamCMD (bundled with the daemon) and the open source Minetest/Luanti dedicated server, preinstalled for a redistributable demo game
• Ubuntu 24.04 LTS base, fully patched, unattended security upgrades enabled
• 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet. Recommended VM size: Standard_B2s (2 vCPU, 4 GiB). The panel and daemon are lightweight; size up for the game servers you later run.

Step 1: Deploy from the Azure Portal

Search the Marketplace for GameAP Game Server Control Panel on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 and 443 (the panel) from the networks that need it. To run game servers that players connect to, you will also open the relevant game ports later.

Step 2: Deploy from the Azure CLI

RG="gameap-prod"; LOCATION="eastus"; VM_NAME="gameap-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery2/images/gameap/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name gameap-vnet --address-prefix 10.90.0.0/16 --subnet-name gameap-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name gameap-nsg
az network nsg rule create -g "$RG" --nsg-name gameap-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name gameap-nsg --name allow-panel --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name gameap-vnet --subnet gameap-subnet --nsg gameap-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the services are running

The panel serves on loopback 127.0.0.1:8025, the daemon connects to it over gRPC on loopback 127.0.0.1:31718, and nginx fronts the panel on port 443 over TLS. Only ports 80 and 443 are exposed.

systemctl is-active gameap gameap-daemon nginx
sudo ss -tlnp | grep -E ':(80|443|8025|31718)\b'

All three services report active. nginx is bound to 0.0.0.0:80 and 0.0.0.0:443, while the panel HTTP endpoint (127.0.0.1:8025) and the panel to daemon gRPC endpoint (127.0.0.1:31718) are bound to loopback only, so neither is reachable from the network.

Step 5: Retrieve your unique admin password

No known password ships in the image. GameAP generated a random administrator password for this VM at first boot, and it was written to a root only file.

sudo stat -c '%n perms=%a owner=%U:%G' /root/gameap-credentials.txt
sudo cat /root/gameap-credentials.txt

The file is 600 root:root and holds GAMEAP_ADMIN_USERNAME (admin), a unique GAMEAP_ADMIN_PASSWORD generated for this instance, and the panel URL. Copy the password, then change it after your first login from Admin -> Profile.

Step 6: Log in to the panel

Open https://<vm-ip>/ in your browser. Because the panel uses a per VM self signed certificate, your browser shows a certificate warning the first time; accept it (or install your own certificate, see the HTTPS section). Enter the Username / E-Mail Address (admin) and the Password from /root/gameap-credentials.txt, then click Login.

Step 7: The dashboard

After signing in you land on the dashboard, which summarises how many game servers and nodes are online. On a fresh instance you have no game servers yet, and exactly one node, your local daemon, is shown online, ready to run game servers.

Step 8: The linked daemon (Dedicated servers)

Open Administration -> Dedicated servers. This is the heart of the appliance: it lists the local node with a green Online badge and live CPU and memory usage, which the daemon streams to the panel over the mutual TLS gRPC link. Because the daemon is already enrolled and linked, you can create and run game servers immediately, with no manual node setup.

Step 9: Games and creating a game server

Open Administration -> Games to see the built in catalogue of supported games (Counter-Strike, ARK, Rust, Minecraft, Valheim and many more), and Add Game, Add Mod or Import to extend it. To stand up a server, go to Administration -> Game servers -> Create, pick the node (your local daemon), choose the game, set the IP, port and start parameters, then install and start it from the server's Console tab. Game files are fetched through SteamCMD (bundled) or a direct download, depending on the game.

The image preinstalls the open source Minetest/Luanti dedicated server (/usr/games/minetestserver) as a redistributable example you can wire up as a game without any Steam credentials. Open the game port you choose on your Azure NSG so players can connect.

Step 10: Verify the panel to daemon link from the CLI

You can confirm the mutual TLS gRPC link directly from the API. This logs in with your per VM admin password and reads the daemon status for the local node.

GAMEAP_PASS="$(sudo grep '^GAMEAP_ADMIN_PASSWORD=' /root/gameap-credentials.txt | cut -d= -f2-)"
TOKEN="$(curl -sk -X POST https://127.0.0.1/api/auth/login -H 'Content-Type: application/json' \
  -d "{\"login\":\"admin\",\"password\":\"$GAMEAP_PASS\"}" | jq -r .token)"
curl -sk https://127.0.0.1/api/nodes -H "Authorization: Bearer $TOKEN" | jq -c '.[] | {id, name}'
curl -sk https://127.0.0.1/api/nodes/1/daemon -H "Authorization: Bearer $TOKEN" \
  | jq '{connection_type, daemon_version: .version.version, online_servers: .base_info.online_servers_count}'

The node is listed, and the daemon status reports connection_type: "grpc", which proves the panel and the local daemon are connected over the mutual TLS gRPC stream.

Step 11: Configuration and persistence

The panel configuration and secrets live in /etc/gameap/config.env, the datastore is an embedded SQLite database, and the daemon's mutual TLS certificates live under /etc/gameap-daemon/certs, all on the OS disk and captured into the image.

sudo grep -E '^(HTTP_HOST|GRPC_PORT|DATABASE_DRIVER|AUTH_SERVICE)=' /etc/gameap/config.env
sudo test -f /var/lib/gameap/database.sqlite && echo "SQLite datastore present"
sudo ls /etc/gameap-daemon/certs
systemctl is-enabled gameap gameap-daemon nginx
apt-mark showhold

The panel binds to 127.0.0.1, the gRPC port is 31718, the datastore is SQLite, the daemon holds its per VM ca.crt, server.crt and server.key, the services are enabled for the next boot, and there are no held packages, so the OS security baseline is intact.

Step 12: Install your own TLS certificate

The image ships with a per VM self signed certificate so the panel is encrypted from first boot. To remove the browser warning, point a DNS record at your VM and install a trusted certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot obtains the certificate, rewrites the nginx server block to use it, and sets up automatic renewal. Your panel is then served over HTTPS with a trusted certificate.

Running game servers

The local daemon runs your game servers on this VM. To let players reach a server you create, open the game's port on your Azure NSG (for example UDP 30000 for a default Minetest/Luanti server, or TCP/UDP 27015 for a Source engine game). Create the server under Administration -> Game servers, install it from its Console tab, then start it. Follow the daemon and panel with:

sudo systemctl status gameap-daemon --no-pager | head -n 6
sudo journalctl -u gameap-daemon --no-pager | tail -n 8

Managing the service

Restart the panel with sudo systemctl restart gameap and the daemon with sudo systemctl restart gameap-daemon; nginx logs are under /var/log/nginx/. Back up the instance by snapshotting the OS disk. Change the admin password from Admin -> Profile after your first login, and consider enabling two factor authentication for the admin account when prompted.

Support

cloudimg provides 24/7 support for this image via email and live chat: deployment, nginx TLS termination, upgrades, daemon enrolment, and game server configuration and performance tuning. Email support@cloudimg.co.uk.

This is a repackaged open source software product with additional charges for cloudimg support services. GameAP is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.