Add web control panel (console, commands, stop/restart)

.dockerignore

@@ -1,5 +1,4 @@
 *
 !server.jar
 !server.properties
-!index.html
-!docker-entrypoint.sh
+!control.py

Dockerfile

@@ -3,7 +3,6 @@ FROM eclipse-temurin:25-jre-jammy
 ARG PLAYIT_VERSION=v1.0.10
 
 ENV MC_MEM=4G \
-    MC_PORT=25565 \
     STATUS_PORT=7860
 
 RUN apt-get update \
@@ -18,13 +17,11 @@ WORKDIR /data
 
 COPY server.jar /server/minecraft_server.26.3.jar
 COPY server.properties /data/server.properties
-COPY index.html /status/index.html
-COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+COPY control.py /server/control.py
 
 RUN printf 'eula=true\n' > /data/eula.txt \
- && chmod +x /usr/local/bin/docker-entrypoint.sh \
  && useradd --create-home --uid 1000 minecraft \
- && chown -R minecraft:minecraft /data /status /server
+ && chown -R minecraft:minecraft /data /server
 
 USER minecraft
 
@@ -32,4 +29,4 @@ EXPOSE 25565 7860
 
 STOPSIGNAL SIGTERM
 
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+ENTRYPOINT ["python3", "/server/control.py"]

README.md

@@ -11,22 +11,36 @@ pinned: false
 # Minecraft Server (Java Edition 26.3)
 
 Vanilla server bundled with the [playit.gg](https://playit.gg) agent so it can be
-reached from a normal Minecraft client even though the Space has no inbound ports.
+reached from a normal Minecraft client, plus a small web control panel that runs
+in the same container.
 
 ## How the networking works
 
-Hugging Face Spaces only routes HTTPS traffic to `app_port` (7860). A Minecraft
-Java client speaks raw TCP, so it cannot connect to the Space directly.
-
-The playit agent fixes this without any inbound connectivity: it dials **out**
-to playit's relays and they proxy the public address back down that same
-connection. The Space only ever makes outbound requests.
+A Minecraft Java client speaks raw TCP and the Space only routes HTTPS to
+`app_port` (7860), so the two cannot meet directly. The playit agent fixes this
+without any inbound connectivity: it dials **out** to playit's relays and they
+proxy the public address back down that same connection. The Space only ever
+makes outbound requests.
 
 ```
 Minecraft client ──TCP──> playit relay <──outbound──> playitd ──> java server :25565
 ```
 
-Port 7860 serves a small status page so the Space reports itself as running.
+Port 7860 hosts the **control panel** (live console, commands, stop/restart),
+which also keeps the Space reporting as running.
+
+## Control panel
+
+Open the Space URL in a browser (keep it private if you want - accessing the
+panel is separate from joining the game):
+
+- Live server console with auto-scroll
+- Send commands (`say hi`, `list`, `whitelist ...`, `/stop`) via the input or
+  quick buttons
+- **Stop** (graceful, saves the world) and **Restart**
+- Status badges: server state, RAM/uptime, playit tunnel state
+- Reading logs/status is open; commands and stop/restart require a password
+  when one is configured
 
 ## Setup
 
@@ -34,20 +48,23 @@ Port 7860 serves a small status page so the Space reports itself as running.
 2. Generate a playit **secret key** (link in the playit dashboard, "new agent").
 3. Add it in the Space settings under **Variables and secrets** as a **Secret**
    named `PLAYIT_SECRET`. Do not commit it.
-4. In the playit dashboard, create a tunnel of type **Minecraft Java** targeting
+4. (Recommended) Add a second Secret named `CONTROL_PASSWORD` to lock the
+   panel's command/stop/restart actions. Leave it unset only while testing.
+5. In the playit dashboard, create a tunnel of type **Minecraft Java** targeting
    `localhost:25565`, then claim it with this Space's agent.
-5. Copy the assigned address and port into the Minecraft client's
+6. Copy the assigned address and port into the Minecraft client's
    *Direct Connect* / *Add Server*.
 
 ## Configuration
 
-| Variable      | Default | Notes                                        |
-| ------------- | ------- | -------------------------------------------- |
-| `PLAYIT_SECRET` | unset  | Required for the tunnel; server still boots without it |
-| `MC_MEM`      | `4G`    | Both `-Xmx` and `-Xms`                        |
-| `STATUS_PORT` | `7860`  | Status page; must match `app_port`            |
+| Variable          | Default | Notes                                        |
+| ----------------- | ------- | -------------------------------------------- |
+| `PLAYIT_SECRET`   | unset   | Required for the tunnel; server still boots without it |
+| `CONTROL_PASSWORD`| unset   | Gives the panel Open Console / Stop / Restart a password. Leave unset = unlocked (testing only) |
+| `MC_MEM`          | `4G`    | Both `-Xmx` and `-Xms`                        |
+| `STATUS_PORT`     | `7860`  | Control panel; must match `app_port`           |
 
-Server tuning lives in `server.properties`.
+Server tuning lives in `server.properties` aboard the container.
 
 ## Caveats worth knowing
 
@@ -57,8 +74,7 @@ Server tuning lives in `server.properties`.
 - **Offline mode is on** (`online-mode=false`), so any username can join and
   nothing is verified with Mojang. Turn it on if you want real authentication.
 - **Java 25 is required.** Minecraft 26.3 ships class file version 69.0, which
-  Java 21 (65.0) rejects outright with `UnsupportedClassVersionError`. The base
-  image is pinned to `eclipse-temurin:25-jre-jammy`; bump it first on any
-  version change.
-- The 4G heap needs the 16 GB hardware tier to stay comfortable alongside
-  Space overhead.
+  Java 21 (65.0) rejects with `UnsupportedClassVersionError`. The base image is
+  pinned to `eclipse-temurin:25-jre-jammy`; bump it first on any version change.
+- The server auto-restarts on crash (3s backoff) and restarts if the container
+  is recreated, so a failed boot loops in the logs - read the newest trace.

control.py

@@ -0,0 +1,580 @@
+#!/usr/bin/env python3
+import hashlib
+import hmac
+import json
+import os
+import signal
+import subprocess
+import sys
+import threading
+import time
+from collections import deque
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import parse_qs, urlparse
+
+DATA_DIR = os.environ.get("MC_DATA", "/data")
+JAR = os.environ.get("MC_JAR", "/server/minecraft_server.26.3.jar")
+MEM = os.environ.get("MC_MEM", "4G")
+HTTP_PORT = int(os.environ.get("STATUS_PORT", "7860"))
+CONTROL_PASSWORD = os.environ.get("CONTROL_PASSWORD", "")
+PLAYIT_SECRET = os.environ.get("PLAYIT_SECRET", "")
+MAX_LOG = 4000
+PLAYIT_TRAIL = 40
+
+
+class MCController:
+    def __init__(self):
+        self.lock = threading.RLock()
+        self.lines = deque(maxlen=MAX_LOG)
+        self.ids = deque(maxlen=MAX_LOG)
+        self.next_id = 0
+        self.playit_trail = deque(maxlen=PLAYIT_TRAIL)
+        self.proc = None
+        self.playit = None
+        self.stopped = False
+        self.pending_restart = False
+        self.crashes = 0
+        self.started_at = None
+        self._kill_timer = None
+
+    def push(self, text, source="mc"):
+        line = str(text)
+        with self.lock:
+            self.lines.append(line)
+            self.ids.append(self.next_id)
+            self.next_id += 1
+        if source == "playit":
+            self.playit_trail.append(line)
+
+    def log_from(self, after, limit=500):
+        with self.lock:
+            pairs = list(zip(self.ids, self.lines))
+        if after < 0:
+            pairs = pairs[-limit:]
+            out = [line for _, line in pairs]
+        else:
+            out = [line for i, line in pairs if i > after][:limit]
+        last = pairs[-1][0] if pairs else after
+        return out, last
+
+    def start_playit(self):
+        if self.playit is not None and self.playit.poll() is None:
+            return
+        if not PLAYIT_SECRET:
+            self.push("[panel] PLAYIT_SECRET unset - tunnel disabled, server is LAN-only", "playit")
+            return
+        self.push("[panel] starting playitd", "playit")
+        env = dict(os.environ)
+        try:
+            self.playit = subprocess.Popen(
+                ["playitd", "--secret", PLAYIT_SECRET, "--platform-docker"],
+                stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                text=True, encoding="utf-8", errors="replace", env=env,
+            )
+        except FileNotFoundError:
+            self.push("[panel] playitd binary missing - tunnel disabled", "playit")
+            self.playit = None
+            return
+        threading.Thread(target=self._playit_reader, args=(self.playit,), daemon=True).start()
+
+    def _playit_reader(self, proc):
+        for line in proc.stdout:
+            self.push(line.rstrip(), "playit")
+        code = proc.wait()
+        self.push(f"[playit] exited with code {code}", "playit")
+
+    def playit_state(self):
+        if not PLAYIT_SECRET:
+            return "disabled"
+        p = self.playit
+        if p is None:
+            return "offline"
+        if p.poll() is not None:
+            return "offline"
+        text = " ".join(self.playit_trail).lower()
+        if "connected" in text:
+            return "connected"
+        if "error" in text or "refused" in text:
+            return "error"
+        return "connecting"
+
+    def start_java(self):
+        with self.lock:
+            if self.proc is not None and self.proc.poll() is None:
+                return
+            self.proc = None
+            if not os.path.exists(os.path.join(DATA_DIR, "eula.txt")):
+                self.ensure_conf()
+            self.push("[panel] starting Minecraft server")
+            env = dict(os.environ)
+            args = ["java", "-Xms" + MEM, "-Xmx" + MEM, "-jar", JAR, "nogui"]
+            self.proc = subprocess.Popen(
+                args, cwd=DATA_DIR,
+                stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                stderr=subprocess.STDOUT,
+                text=True, encoding="utf-8", errors="replace", bufsize=1, env=env,
+            )
+            self.started_at = time.time()
+            self._kill_timer = None
+            threading.Thread(target=self._mc_reader, args=(self.proc,), daemon=True).start()
+
+    def ensure_conf(self):
+        eula_path = os.path.join(DATA_DIR, "eula.txt")
+        props_path = os.path.join(DATA_DIR, "server.properties")
+        if not os.path.exists(eula_path):
+            with open(eula_path, "w") as f:
+                f.write("eula=true\n")
+        if not os.path.exists(props_path):
+            with open(props_path, "w") as f:
+                f.write("server-port=25565\nonline-mode=false\nmax-players=20\nview-distance=4\nsimulation-distance=4\n")
+
+    def _mc_reader(self, proc):
+        for line in proc.stdout:
+            self.push(line.rstrip())
+        code = proc.wait()
+        self._on_mc_exit(code)
+
+    def _on_mc_exit(self, code):
+        with self.lock:
+            self.proc = None
+            if self.stopped:
+                self.push(f"[panel] server stopped (exit {code})")
+                return
+            self.crashes += 1
+            if self.pending_restart:
+                self.pending_restart = False
+                self.push(f"[panel] restarted by panel (exit {code})")
+                restart_delay = 0.0
+            else:
+                self.push(f"[panel] server exited ({code}) - restarting in 3s")
+                restart_delay = 3.0
+        if restart_delay <= 0:
+            self.start_java()
+        else:
+            timer = threading.Timer(restart_delay, self.start_java)
+            timer.daemon = True
+            timer.start()
+
+    def send_command(self, cmd):
+        cmd = str(cmd).strip()
+        if not cmd:
+            return False, "empty command"
+        with self.lock:
+            proc = self.proc
+            if proc is None or proc.poll() is not None:
+                return False, "server is not running"
+            try:
+                proc.stdin.write((cmd + "\n").encode("utf-8"))
+                proc.stdin.flush()
+            except (BrokenPipeError, ValueError) as e:
+                return False, str(e)
+        self.push(f"[panel] > {cmd}")
+        return True, "sent"
+
+    def restart(self):
+        with self.lock:
+            self.stopped = False
+            self.pending_restart = True
+            proc = self.proc if self.proc is not None and self.proc.poll() is None else None
+            if proc is not None:
+                self._arm_kill_timer()
+                self._write_stdin(proc, "stop")
+        if proc is None:
+            self.start_java()
+        return "restart requested"
+
+    def _arm_kill_timer(self):
+        def kill():
+            with self.lock:
+                p = self.proc
+                if p is not None and self.pending_restart and p.poll() is None:
+                    self.push("[panel] force-stopping server")
+                    p.terminate()
+        self._kill_timer = threading.Timer(45.0, kill)
+        self._kill_timer.daemon = True
+        self._kill_timer.start()
+
+    def stop(self):
+        with self.lock:
+            self.stopped = True
+            self.pending_restart = False
+            proc = self.proc if self.proc is not None and self.proc.poll() is None else None
+            if proc is not None:
+                self._write_stdin(proc, "stop")
+        if proc is None:
+            return "server not running"
+        return "server stopping"
+
+    @staticmethod
+    def _write_stdin(proc, cmd):
+        try:
+            proc.stdin.write((cmd + "\n").encode("utf-8"))
+            proc.stdin.flush()
+        except (BrokenPipeError, ValueError):
+            pass
+
+    def status(self):
+        with self.lock:
+            proc = self.proc
+            proc_alive = proc is not None and proc.poll() is None
+            up = int(time.time() - self.started_at) if proc_alive and self.started_at else 0
+            rss = self._rss_kb(proc.pid) if proc_alive else 0
+        return {
+            "mc": "running" if proc_alive else "stopped",
+            "uptime": up,
+            "crashes": self.crashes,
+            "mem_kb": rss,
+            "mem_gb": round(rss / (1024 * 1024), 2),
+            "playit": self.playit_state(),
+            "mem_heap": MEM,
+        }
+
+    @staticmethod
+    def _rss_kb(pid):
+        try:
+            with open(f"/proc/{pid}/status") as f:
+                for line in f:
+                    if line.startswith("VmRSS:"):
+                        return int(line.split()[1])
+        except (OSError, ValueError, IndexError):
+            pass
+        return 0
+
+    def graceful(self):
+        with self.lock:
+            self.stopped = True
+            self.pending_restart = False
+            p = self.proc
+            q = self.playit
+        self.push("[panel] shutting down")
+        for target in (p, q):
+            if target is not None and target.poll() is None:
+                try:
+                    os.kill(target.pid, signal.SIGTERM)
+                except OSError:
+                    pass
+        for target, timeout in ((p, 20), (q, 10)):
+            if target is not None:
+                try:
+                    target.wait(timeout=timeout)
+                except subprocess.TimeoutExpired:
+                    try:
+                        target.kill()
+                    except OSError:
+                        pass
+
+
+controller = MCController()
+
+
+def token_for(password):
+    return hashlib.sha256(("panel-control:" + password).encode("utf-8")).hexdigest()
+
+
+def auth_ok(tok):
+    if not CONTROL_PASSWORD:
+        return True
+    if not tok:
+        return False
+    return hmac.compare_digest(tok, token_for(CONTROL_PASSWORD))
+
+
+class Handler(BaseHTTPRequestHandler):
+    server_version = "MCPanel/1.0"
+
+    def _send(self, code, body, ctype):
+        if isinstance(body, str):
+            body = body.encode("utf-8")
+        self.send_response(code)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _json(self, code, obj):
+        self._send(code, json.dumps(obj, separators=(",", ":")), "application/json")
+
+    def _read_json(self):
+        try:
+            n = int(self.headers.get("Content-Length") or 0)
+            if n <= 0 or n > 1 << 20:
+                return None
+            return json.loads(self.rfile.read(n).decode("utf-8"))
+        except (ValueError, json.JSONDecodeError):
+            return None
+
+    def log_message(self, fmt, *args):
+        pass
+
+    def do_GET(self):
+        u = urlparse(self.path)
+        path = u.path
+
+        if path == "/api/status":
+            self._json(200, controller.status())
+        elif path == "/api/log":
+            q = parse_qs(u.query)
+            try:
+                after = int(q.get("after", ["-1"])[0])
+                limit = int(q.get("limit", ["500"])[0])
+            except ValueError:
+                after, limit = -1, 500
+            lines, last = controller.log_from(after, limit)
+            self._json(200, {"lines": lines, "last": last})
+        else:
+            self._send(200, PAGE, "text/html; charset=utf-8")
+
+    def do_POST(self):
+        u = urlparse(self.path)
+        body = self._read_json() or {}
+        if u.path == "/api/login":
+            if CONTROL_PASSWORD and body.get("password") == CONTROL_PASSWORD:
+                self._json(200, {"ok": True, "token": token_for(CONTROL_PASSWORD)})
+            elif CONTROL_PASSWORD:
+                self._json(401, {"ok": False, "error": "wrong password"})
+            else:
+                self._json(200, {"ok": True, "token": ""})
+            return
+
+        if u.path == "/api/command":
+            if not auth_ok(self.headers.get("X-Token", "")):
+                self._json(401, {"ok": False, "error": "auth required"})
+                return
+            ok, msg = controller.send_command(body.get("cmd", ""))
+            self._json(200 if ok else 400, {"ok": ok, "error": msg})
+        elif u.path == "/api/action":
+            if not auth_ok(self.headers.get("X-Token", "")):
+                self._json(401, {"ok": False, "error": "auth required"})
+                return
+            action = body.get("action")
+            if action == "restart":
+                self._json(200, {"ok": True, "error": controller.restart()})
+            elif action == "stop":
+                self._json(200, {"ok": True, "error": controller.stop()})
+            else:
+                self._json(400, {"ok": False, "error": "unknown action"})
+        else:
+            self._json(404, {"ok": False, "error": "not found"})
+
+
+PAGE = r"""<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Minecraft Server Control</title>
+<style>
+  :root{color-scheme:dark}
+  *{box-sizing:border-box}
+  body{margin:0;background:#101318;color:#e8e8e8;font-family:ui-monospace,Consolas,Menlo,monospace;font-size:14px}
+  header{display:flex;align-items:center;gap:14px;padding:10px 16px;border-bottom:1px solid #262c35;background:#171b21;position:sticky;top:0}
+  h1{font-size:15px;margin:0;font-weight:600}
+  .badge{font-size:12px;padding:3px 8px;border-radius:999px;border:1px solid #2b313a;color:#9aa4b0}
+  .badge b{color:#e8e8e8}
+  .pill{display:inline-block;width:8px;height:8px;border-radius:50%;margin-right:6px;vertical-align:baseline}
+  .ok{background:#3fb950}
+  .warn{background:#d29922}
+  .err{background:#f85149}
+  .off{background:#595f66}
+  .controls{display:flex;align-items:center;gap:8px;color:#9aa4b0;font-size:12px;margin-left:auto}
+  button{background:#242a33;color:#e8e8e8;border:1px solid #333b47;border-radius:6px;padding:6px 12px;font-family:inherit;font-size:12px;cursor:pointer}
+  button:hover:not(:disabled){background:#2d3540}
+  button[data-danger]{background:#3a1f22;border-color:#6b2a30}
+  button:disabled{opacity:.5;cursor:not-allowed}
+  main{display:flex;flex-direction:column}
+  #logbox{margin:0;padding:12px 16px;white-space:pre-wrap;word-break:break-word;flex:1;font-size:13px;line-height:1.55;max-height:calc(100vh - 150px);overflow-y:auto}
+  .cmdline{display:flex;gap:8px;padding:10px 16px;border-top:1px solid #262c35;background:#171b21}
+  .cmdline input{flex:1;background:#0d0f12;border:1px solid #333b47;color:#e8e8e8;border-radius:6px;padding:9px 12px;font-family:inherit}
+  .quick{display:flex;gap:6px;padding:0 16px 10px;flex-wrap:wrap}
+  .quick button{padding:4px 9px;font-size:11px;color:#9aa4b0}
+  .faint{color:#7d8792}
+  #auth{position:fixed;inset:0;display:none;align-items:center;justify-content:center;background:rgba(5,7,9,.82);z-index:5}
+  #auth .card{background:#171b21;border:1px solid #2b313a;padding:22px;border-radius:10px;display:flex;flex-direction:column;gap:10px}
+  #auth input,#auth button{font-family:inherit;padding:8px 10px;border-radius:6px;border:1px solid #333b47}
+  .row{display:flex;gap:14px;align-items:center;flex-wrap:wrap;padding:8px 16px;border-bottom:1px solid #1c2128;font-size:12px;color:#9aa4b0}
+  .row span b{color:#e8e8e8;font-weight:600}
+</style>
+</head>
+<body>
+<div id="auth"><div class="card">
+  <div style="font-size:14px">Enter control password</div>
+  <input id="pw" type="password" placeholder="password" autocomplete="current-password">
+  <button onclick="doLogin()">Unlock</button>
+  <div id="pw_err" class="err-row" style="font-size:12px">&nbsp;</div>
+</div></div>
+
+<header>
+  <h1>Minecraft Server</h1>
+  <span class="badge">MC <b id="mc_state">?</b></span>
+  <span class="badge">Tunnel <b id="tun_state">?</b></span>
+  <span class="badge">Heap <b id="heap_badge">?</b></span>
+  <span class="badge">RAM <b id="ram_badge">?</b></span>
+  <span class="controls">uptime <b id="uptime"></b> &middot; crashes <b id="crashes"></b></span>
+</header>
+
+<div class="row">
+  <span>Command: <b id="cmd_result" class="faint">&nbsp;</b></span>
+</div>
+
+<pre id="logbox"></pre>
+
+<div class="quick">
+  <button onclick="quick('list')">list</button>
+  <button onclick="quick('help')">help</button>
+  <button onclick="quick('save-all')">save-all</button>
+  <button onclick="quick('say test 123')">say hi</button>
+  <button onclick="quick('whitelist list')">whitelist list</button>
+  <button onclick="quick('seed')">seed</button>
+  <button onclick="quick('tps')">tps</button>
+  <button style="margin-left:auto" data-danger onclick="doAction('stop')">Stop</button>
+  <button data-danger onclick="doAction('restart')">Restart</button>
+</div>
+
+<div class="cmdline">
+  <input id="cmd" placeholder="send a server command (e.g. say hello)" autocomplete="off">
+  <button onclick="sendCmd()">Send</button>
+</div>
+
+<script>
+let token = sessionStorage.getItem('tok') || '';
+let lastId = -1;
+const $ = id => document.getElementById(id);
+const state = { shouldAutoScroll: true };
+
+function setBadge(id, text, cls) {
+  const el = $(id);
+  el.innerHTML = '<i class="pill ' + (cls || 'off') + '"></i>' + text;
+}
+
+$('logbox').addEventListener('scroll', () => {
+  const l = $('logbox');
+  state.shouldAutoScroll = (l.scrollTop + l.clientHeight) >= l.scrollHeight - 40;
+});
+
+function doLogin() {
+  fetch('/api/login', {
+    method: 'POST',
+    headers: {'Content-Type': 'application/json'},
+    body: JSON.stringify({password: $('pw').value})
+  }).then(r => {
+    if (r.status === 401) { $('pw_err').textContent = 'wrong password'; throw 0; }
+    return r.json();
+  }).then(d => {
+    token = d.token || '';
+    sessionStorage.setItem('tok', token);
+    if (!token) sessionStorage.setItem('noauth', '1');
+    $('auth').style.display = 'none';
+  }).catch(() => {});
+}
+
+async function refreshStatus() {
+  try {
+    const s = await (await fetch('/api/status?ts=' + Date.now())).json();
+    setBadge('mc_state', s.mc, s.mc === 'running' ? 'ok' : 'err');
+    const cls = s.playit === 'connected' ? 'ok' : (s.playit === 'disabled' || s.playit === 'offline' ? 'off' : 'warn');
+    setBadge('tun_state', s.playit, cls);
+    $('heap_badge').textContent = s.mem_heap;
+    $('ram_badge').textContent = s.mem_gb + ' GB';
+    $('uptime').textContent = fmtUptime(s.uptime);
+    $('crashes').textContent = s.crashes;
+  } catch (e) {}
+}
+function fmtUptime(sec) {
+  const h = Math.floor(sec / 3600), m = Math.floor(sec % 3600 / 60), s = sec % 60;
+  return (h ? h + 'h ' : '') + m + 'm ' + s + 's';
+}
+
+async function refreshLog() {
+  try {
+    const d = await (await fetch('/api/log?after=' + lastId + '&ts=' + Date.now())).json();
+    lastId = d.last;
+    if (d.lines.length) {
+      const l = $('logbox');
+      for (const ln of d.lines) {
+        l.appendChild(renderLine(ln));
+      }
+      if (state.shouldAutoScroll) l.scrollTop = l.scrollHeight;
+    }
+  } catch (e) {}
+}
+
+function renderLine(txt) {
+  const div = document.createElement('div');
+  div.textContent = txt;
+  if (txt.startsWith('[panel] ')) div.style.color = '#7dd3fc';
+  else if (txt.startsWith('[playit')) div.style.color = '#c4b5fd';
+  else if (txt.includes('ERROR') || txt.includes('FATAL')) div.style.color = '#f85149';
+  else if (txt.includes('Done (')) div.style.color = '#3fb950';
+  return div;
+}
+
+function api(url, body) {
+  return fetch(url, {
+    method: 'POST',
+    headers: {'Content-Type': 'application/json', 'X-Token': token},
+    body: JSON.stringify(body || {})
+  }).then(r => r.json().then(d => ({status: r.status, d})));
+}
+
+async function sendCmd() {
+  const v = $('cmd').value.trim();
+  if (!v) return;
+  $('cmd').value = '';
+  return runCommand(v);
+}
+async function quick(c) { return runCommand(c); }
+async function runCommand(c) {
+  const {status, d} = await api('/api/command', {cmd: c});
+  $('cmd_result').textContent = (status === 200 ? 'sent: ' : 'error: ') + (d.error || c);
+  if (status === 401) $('auth').style.display = 'flex';
+}
+async function doAction(a) {
+  const {status, d} = await api('/api/action', {action: a});
+  if (status === 401) { $('auth').style.display = 'flex'; return; }
+  $('cmd_result').textContent = d.error || a;
+}
+
+setInterval(refreshStatus, 3000);
+setInterval(refreshLog, 1200);
+refreshStatus(); refreshLog();
+
+(async () => {
+  if (token || sessionStorage.getItem('noauth')) return;
+  $('auth').style.display = 'flex';
+})();
+
+$('cmd').addEventListener('keydown', e => { if (e.key === 'Enter') sendCmd(); });
+</script>
+</body>
+</html>"""
+
+
+def main():
+    controller.start_playit()
+    controller.start_java()
+
+    httpd = ThreadingHTTPServer(("0.0.0.0", HTTP_PORT), Handler)
+    httpd.daemon_threads = True
+
+    stop = threading.Event()
+
+    def on_signal(signum, frame):
+        stop.set()
+
+    signal.signal(signal.SIGTERM, on_signal)
+    signal.signal(signal.SIGINT, on_signal)
+
+    server_thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+    server_thread.start()
+
+    stop.wait()
+    httpd.shutdown()
+    server_thread.join(timeout=5)
+
+    sys.stderr.write("[panel] shutting down\n")
+    controller.graceful()
+
+
+if __name__ == "__main__":
+    main()

docker-entrypoint.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-pids=()
-
-shutdown() {
-	trap - TERM INT
-	for pid in "${pids[@]}"; do
-		kill -TERM "$pid" 2>/dev/null || true
-	done
-	for pid in "${pids[@]}"; do
-		wait "$pid" 2>/dev/null || true
-	done
-}
-
-trap shutdown TERM INT
-
-python3 -m http.server "$STATUS_PORT" --bind 0.0.0.0 --directory /status &
-pids+=("$!")
-
-if [ -n "${PLAYIT_SECRET:-}" ]; then
-	playitd --secret "$PLAYIT_SECRET" --platform-docker &
-	pids+=("$!")
-else
-	echo "PLAYIT_SECRET is unset - tunnel disabled, server is LAN-only" >&2
-fi
-
-java -Xmx"$MC_MEM" -Xms"$MC_MEM" -jar /server/minecraft_server.26.3.jar nogui &
-pids+=("$!")
-
-while true; do
-	for pid in "${pids[@]}"; do
-		if ! kill -0 "$pid" 2>/dev/null; then
-			echo "child $pid exited, tearing down" >&2
-			shutdown
-			exit 1
-		fi
-	done
-	sleep 5
-done

index.html

@@ -1,42 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Minecraft Server</title>
-<style>
-  :root { color-scheme: dark; }
-  body { margin: 0; min-height: 100vh; display: grid; place-items: center;
-         background: #14161a; color: #e6e6e6;
-         font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif; }
-  main { width: min(34rem, 90vw); text-align: center; }
-  h1 { font-size: 1.5rem; margin: 0 0 .25rem; }
-  p.sub { margin: 0 0 2rem; color: #8b949e; font-size: .9rem; }
-  .box { background: #1c2027; border: 1px solid #2b313a; border-radius: .6rem;
-         padding: 1.25rem; text-align: left; }
-  .row { display: flex; justify-content: space-between; gap: 1rem;
-         padding: .45rem 0; font-size: .9rem; }
-  .row + .row { border-top: 1px solid #262c35; }
-  .row span:first-child { color: #8b949e; }
-  code { background: #11141a; padding: .15rem .4rem; border-radius: .3rem;
-         font-size: .85em; word-break: break-all; }
-  .dot { display: inline-block; width: .5rem; height: .5rem; border-radius: 50%;
-         background: #3fb950; margin-right: .4rem; vertical-align: middle; }
-  footer { margin-top: 1.5rem; font-size: .75rem; color: #6e7681; }
-</style>
-</head>
-<body>
-<main>
-  <h1>Minecraft Server</h1>
-  <p class="sub">Java Edition, running on a Hugging Face Space</p>
-  <div class="box">
-    <div class="row"><span>Status</span><span><i class="dot"></i>online</span></div>
-    <div class="row"><span>Version</span><span>26.3</span></div>
-    <div class="row"><span>Java port</span><code>25565</code></div>
-    <div class="row"><span>Heap</span><code>4G</code></div>
-    <div class="row"><span>Auth</span><span>offline mode</span></div>
-  </div>
-  <footer>Tunnel address is set in your playit.gg dashboard and is not baked into this image.</footer>
-</main>
-</body>
-</html>