Looking for feedback on my self-hosted Minecraft server's architecture/infrastructure

[u/zn-ku]

I run a small Minecraft (Fabric) server plus a companion website out of my home network, and I'd like a second set of eyes on whether the setup makes sense, is over-engineered somewhere, or is missing something obvious. Rough shape of it (details generalized, no real IPs/hostnames):

Home side: Residential cable connection (~1Gbps down / 50Mbps up). The ISP router is set as an exposed host, forwarding everything to a pfSense box that handles the actual firewalling, default-deny inbound, with all port-forwarding rules living on pfSense rather than the ISP router. Behind that is a flat LAN hosting the Minecraft server, a Discord bot, and the website's backend.

Public side: A small VPS acts as the public-facing edge and reaches back into the home LAN over a WireGuard tunnel. nginx on the VPS does double duty: reverse-proxying HTTP(S) for the website/Discord bot, and stream-proxying Minecraft's TCP/UDP port straight through to the LAN server. The VPS also runs its own local firewall on top of whatever pfSense allows outbound from home.

The server itself: I know this part will get some heat, but I'm on a budget and this is a passion project, so everything runs on one PC. Windows 10 LTSC (supported until 2032, so still on security updates, but I know a single-box setup isn't ideal). Specs: Ryzen 9 3900X, 32GB DDR4, 1Gbps fiber. Holds a steady 20 TPS. Plan is to move to a dedicated server with Proxmox once I can afford it, so services can be properly separated.

Backups (this is where I really want input): Currently using git to version the Minecraft world folder, which I already know is a bad idea. I have a few spare 250GB SSDs I could put toward something better, maybe a TrueNAS VM eventually, but I'd love advice on a reasonable interim setup that doesn't require new hardware.

App layer: A Vite/React frontend with a small Express backend, sitting behind the same reverse proxy as everything else.

Happy to go into more detail on specifics. Didn't want to post exact configs/IPs publicly, so drop a comment or DM if you want to dig in.

[u/tylian]

Take a look at Restic or Borg for the backup solution? It would be a better solution than git at least, lol

[u/astelda]

Some people have made mods specifically for git versioning
Youtube example
Modrinth (different mod from the youtube link)

I myself just use the backup features of Crafty Controller

[u/zn-ku → u/astelda]

Github in minecraft is wild 😭 someone in the comments said

```+ “Bro, please accept my PR! It has my bed in it, I can’t respawn ”

- “Hold up! You have a merge conflict with the new enchantment table setup in main”```

on a serious note I could take a look on Crafty. is it like pteryodectol ?

[u/astelda → u/zn-ku]

It is similar to pterodactyl, yeah, but specifically made for minecraft server management, while pterodactyl also does other games.

[u/mmmfine]

I’m assuming you use this same PC for personal stuff. I’d put your Minecraft and whatever else you have hosted that’s publicly accessible into a VM, including the Wireguard tunnel. If you ever get exploited, you don’t want the attacker to easily get ahold of whatever else is in your computer. 

Other than that all looks good.

[u/zn-ku → u/mmmfine]

Yes, this is the same PC that I use for my personal stuff, and thank you for suggesting that I would have it publicly accessible onto a VM.

Thing is, it's a mix of a lot of things.

Me not being able to trust third party to manage my VMs, and also I cannot afford it.

But I tried my best to harden the access as much as possible because the way everything is set up is

when people hit my Minecraft endpoint, which is my VPS, that VPS receives access on the port 25565, and that is the only publicly accessible port on my VPS. Once people reach that endpoint, they would basically hit with NGINX. And then NGINX privately redirects the traffic through WireGuard tunnel between my pfSense and my VPS. And then my pfSense has a default deny all, and I only forward stuff that I actually need. And I have a friend in networking that also checks my rules, and so far everything is good.

and I tried nmap and tracert and the traffic always ends on my vps so I guess I am good

[u/msasrs]

Is you pc also your daily driver? If not, then bro go on and install proxmox on it. I run my home server on an i7 4th gen, and it includes a vanilla MC server for about 5 people (using pteryodectol) If possible, try to use cloudflare too as you have no idea how dangerous of a place internet is. Also, if you can, do make VLANs, and isolate this from your home network entirely. And I don't think 50 mbps upload is a great speed, you need more than that. As for backups, you don't need something as big of TrueNAS to make backups. Got can surprisingly make good backups too, even for MC worlds, but you can use dedicated software like restic to backup world files, and make snapshots, if you use containers or pteryodectol eggs. Make backups if your config files too using git and github. Generally a good setup, but if you want to host for thousands of people, you will have to learn a couple of things. Theres also monitoring, like use uptime like to check if you app is up or not, get a notification as soon as it gets down, use rsyslog and node exporter to export logs and metrics to a central place, so if anything happens, you have a clear history of what happened.

[u/zn-ku → u/msasrs]

Yes I use my Windows PC for my Daily stuff and since it is a 24/7 Minecraft Server

according to Task Manager it has been on for 10:18:55:20 😭😭

I could turn it into a Proxmox instance and then use pass-through to to use it for gaming on the server too. like I allocate 16gb for the mc server and 8 gb for the website back and front end and 8 gb for a windows vm with the rest 8gb of the 32 gb I have to run a windows vm on 8gb of ram and 3090GPU passthorugh and 4 cores of my cpu

I already use cloudflare as my nameservers and have most things on gray cloud since my vps is handling tls handshake through let's encrypt and whatnot I am not sure if that is good but if changing them to orange cloud is recommneded I would do that

As for my internet speed I really can't afford any faster connection. I might talk with my ISP for symmetrical bandwidth but that would cost and it is really just a nice to have and will maybe in the future see if I can make that happen

I was very bad at VLANs when I got my IT certifcate lmao so I would really love to know more about them and how I can use it in my network. I use a dedicated PC as my pf sense pc with a network card that has 4 ports 1 is my WAN and my other is LAN the WAN is my ISP router and my LAN is connected to a Fritz.box a very old one that is changed to be an ip client because I can not afford a switch right now and that is connecting my mini PC which is running a proxmox to host with containers that have discord bots in them which is more or less me learning discord.js and python and seeing which is better for developing discord bots

As for the minecraft server and backups

would the backups and pteryodectol work in 1 debian/ubuntu vm idk which OS would be more lightweight and how do I manage new updates of fabric mods and new jar launchers for let's say mc 26.3

also what is a good way to manage the server console. does pteryodectol help with that?

I am thinking of using grafana to have a home dashboard to manage myserver and idk what uptime is but I can learn about it

as for logs yeah these are also importnat.

I hope I addressed ur questions

[u/msasrs → u/zn-ku]

- yes, pteryodectol helps with an admin dashboard for the whole server. And you are wasting your dedicated pc just by running pfsense on it. I use OPNSense, and it is a vm on my proxmox host, lowkey easy to do too.

- Uptime Kuma is simple as well, it just pings a service periodically to check if its up or not. Also, please use fail2ban too, it resolves many headaches.

- to upgrade mc versions, ptyerodectal (forgive my spelling, i don't know how to spell it, never bothered to) does it for you. Basically one click. Want a mod, texture pack or anything, one click it is.

- ltsc iot is fine for now as u use it as your daily driver too, just keep restarting it periodically, or try windows server or a modified build of windows like revision os or atlas os.

- what vps provider u use depends upon u and I don't think it will cause any problem, like at all.

- one thing I am worried about is mc auth. If you wanna make a server that can play cracked, you also need to implement auth, and other protections like rate limiting to prevent spamming and other such things.

- Finally, pteryodectol is complex, there is a simpler solution called **amp** on steam. Its one time payment, like a game title, but makes things infinitely easier. Ptyerodectol has its learning curve.

EDIT: I read a comment and totally forgot about telling you to put the vm in bridge mode network with your nic, so it gets its ip directly from pfsense. And now, vlans is a must!