Merge pull request #28 from TimInTech/chore/audit-minor-fixes

Chore/audit minor fixes

Author: TimInTech

.github/copilot-instructions.md

@@ -15,23 +15,23 @@ When asked “Run/Build”, provide these options as example commands (explanati
 ```bash
 chmod +x setup_minecraft.sh
 ./setup_minecraft.sh
-screen -r minecraft
-````
+sudo -u minecraft screen -r minecraft
+```
 
 ### Option 2: Java server in LXC/Container
 
 ```bash
 chmod +x setup_minecraft_lxc.sh
 ./setup_minecraft_lxc.sh
-screen -r minecraft
+sudo -u minecraft screen -r minecraft
 ```
 
 ### Option 3: Bedrock server
 
 ```bash
 chmod +x setup_bedrock.sh
 ./setup_bedrock.sh
-screen -r bedrock
+sudo -u minecraft screen -r bedrock
 ```
 
 ### Option 4: Update existing Java server (PaperMC)
@@ -57,4 +57,3 @@ sudo systemctl enable --now minecraft
 * For detailed step-by-step effects of each script, refer to `SIMULATION.md`.
 
 
-

README.md

@@ -39,8 +39,8 @@ Perfect for self-hosters, gaming communities, and homelab enthusiasts!
 
 ## 📊 Status
 
-> ⚠ No build workflow present  
-> For automated tests or deployment, please add `main.yml` to `.github/workflows/`.
+ShellCheck linting workflow is present under `.github/workflows/shellcheck.yml`.  
+Add additional tests or deployment workflows as needed.
 
 ---
 
@@ -55,7 +55,7 @@ chmod +x setup_minecraft.sh
 ```
 Open console:
 ```bash
-screen -r minecraft
+sudo -u minecraft screen -r minecraft
 ```
 
 ### VM (Static IP)
@@ -86,7 +86,7 @@ chmod +x setup_minecraft_lxc.sh
 ```
 Open console:
 ```bash
-screen -r minecraft
+sudo -u minecraft screen -r minecraft
 ```
 
 ### Bedrock
@@ -98,7 +98,7 @@ chmod +x setup_bedrock.sh
 ```
 Open console:
 ```bash
-screen -r bedrock
+sudo -u minecraft screen -r bedrock
 ```
 
 ---

scripts/proxmox_create_ct_bedrock.sh

@@ -11,7 +11,7 @@ pct create "$CTID" "${STORE}:vztmpl/${TPL}"   -hostname mc-bedrock -cores 2 -mem
 pct start "$CTID"
 pct exec "$CTID" -- bash -lc '
   apt update && apt -y install wget curl
-  wget -qO /root/setup_bedrock.sh https://raw.githubusercontent.com/TimInTech/minecraft-server-Proxmox.git/main/setup_bedrock.sh
+  wget -qO /root/setup_bedrock.sh https://raw.githubusercontent.com/TimInTech/minecraft-server-Proxmox/main/setup_bedrock.sh
   bash /root/setup_bedrock.sh
 '
 echo "CT $CTID ready. Change password. Attach: pct enter $CTID"

setup_minecraft.sh

@@ -20,7 +20,6 @@ fi
 sudo mkdir -p /opt/minecraft
 if ! id -u minecraft >/dev/null 2>&1; then sudo useradd -r -m -s /bin/bash minecraft; fi
 sudo chown -R minecraft:minecraft /opt/minecraft
-sudo chown "$(whoami)":"$(whoami)" /opt/minecraft
 cd /opt/minecraft || exit 1
 
 # Fetch the latest PaperMC version
@@ -60,19 +59,37 @@ EOF
 chmod +x start.sh
 
 # Create update script
-cat <<EOF > update.sh
+cat <<'EOF' > update.sh
 #!/bin/bash
+set -euo pipefail
 cd /opt/minecraft || exit 1
-LATEST_VERSION=\$(curl -s https://api.papermc.io/v2/projects/paper | jq -r '.versions | last')
-LATEST_BUILD=\$(curl -s https://api.papermc.io/v2/projects/paper/versions/\$LATEST_VERSION | jq -r '.builds | last')
+LATEST_VERSION=$(curl -s https://api.papermc.io/v2/projects/paper | jq -r '.versions | last')
+LATEST_BUILD=$(curl -s https://api.papermc.io/v2/projects/paper/versions/"$LATEST_VERSION" | jq -r '.builds | last')
+BUILD_JSON="$(curl -s "https://api.papermc.io/v2/projects/paper/versions/${LATEST_VERSION}/builds/${LATEST_BUILD}")"
+EXPECTED_SHA="$(printf '%s' "$BUILD_JSON" | jq -r '.downloads.application.sha256')"
+JAR_NAME="$(printf '%s' "$BUILD_JSON" | jq -r '.downloads.application.name')"
 
-wget -O server.jar "https://api.papermc.io/v2/projects/paper/versions/\$LATEST_VERSION/builds/\$LATEST_BUILD/downloads/paper-\$LATEST_VERSION-\$LATEST_BUILD.jar"
-echo "✅ Update complete."
+wget -O "server.jar" "https://api.papermc.io/v2/projects/paper/versions/${LATEST_VERSION}/builds/${LATEST_BUILD}/downloads/${JAR_NAME}"
+ACTUAL_SHA="$(sha256sum server.jar | awk '{print $1}')"
+if [ -n "$EXPECTED_SHA" ] && [ "$EXPECTED_SHA" != "null" ]; then
+  if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
+    echo "ERROR: SHA256 mismatch for PaperMC (expected ${EXPECTED_SHA}, got ${ACTUAL_SHA})"
+    exit 1
+  fi
+  echo "SHA256 verified: ${ACTUAL_SHA}"
+else
+  echo "WARNING: No upstream SHA provided; computed: ${ACTUAL_SHA}"
+fi
+
+echo "✅ Update complete to version $LATEST_VERSION (build $LATEST_BUILD)"
 EOF
 chmod +x update.sh
 
+# Ensure all files are owned by the runtime user
+sudo chown -R minecraft:minecraft /opt/minecraft
+
 # Start server in detached screen session
 if command -v runuser >/dev/null 2>&1; then runuser -u minecraft -- bash -lc 'cd /opt/minecraft && screen -dmS minecraft ./start.sh'; else sudo -u minecraft bash -lc 'cd /opt/minecraft && screen -dmS minecraft ./start.sh'; fi
 
 echo "✅ Minecraft Server setup complete!"
-echo "To access console: sudo -u $(whoami) screen -r minecraft"
+echo "To access console: sudo -u minecraft screen -r minecraft"

setup_minecraft_lxc.sh

@@ -59,6 +59,9 @@ EOF
 
 chmod +x start.sh
 
+# Ensure all files are owned by the runtime user
+chown -R minecraft:minecraft /opt/minecraft
+
 # Start the server in a detached screen session
 if command -v runuser >/dev/null 2>&1; then runuser -u minecraft -- bash -lc 'cd /opt/minecraft && screen -dmS minecraft ./start.sh'; else sudo -u minecraft bash -lc 'cd /opt/minecraft && screen -dmS minecraft ./start.sh'; fi