DiscoPanel

DiscoPanel is a self-hosted, Docker-powered Minecraft server manager. It provides a web interface to manage the following core functionalities:

• Server Management: Creation and lifecycle management of Minecraft servers.
• Modpack Installation: Automated installation of modpacks.
• Proxy Routing: Handling network routing for server access.
• Backups: Managing server data backups.
• Access Control: Multi-user access control and permissions via the web interface.

The default realm.json provided in oidc/keycloak/config/realm.json is imported automatically on first start via the --import-realm flag. It configures the following:

• Client: discopanel (a confidential client using the standard authorization code flow).
• Roles: admin and user realm roles.
• Groups: admin and user groups. New users are added to the user group by default.
• Protocol Mappers:
  • A groups mapper that places group membership into the groups claim on all tokens.
  • A realm-roles mapper for the roles claim.
• Default User: An admin user with credentials admin / admin assigned to both admin and user groups.

Google does not provide a groups claim in its OIDC tokens. You have two primary ways to handle roles:

Standard Setup (Default Roles)

Leave DISCOPANEL_AUTH_OIDC_ROLE_CLAIM empty. Users will be assigned DiscoPanel's default roles upon their first login. An existing admin can then promote them via the DiscoPanel UI.

Google Workspace Domain Mapping

If you use Google Workspace, you can map an entire domain to a specific role using the hd (hosted domain) claim. This is useful for automatically granting admin rights to your organization.

Example Configuration:

- DISCOPANEL_AUTH_OIDC_ROLE_CLAIM=hd
- DISCOPANEL_AUTH_OIDC_ROLE_MAPPING={"yourdomain.com":"admin"}

To ensure DiscoPanel can correctly authenticate and map roles, configure the following sections in Authelia's configuration.yml:

• identity_providers.oidc.clients: Define the DiscoPanel OIDC client. Note that the client_secret in this file must be a PBKDF2-SHA512 hash of the plaintext secret used in your DiscoPanel environment variables.
• claims_policies.discopanel: Configure this to put groups directly in the ID token. This allows DiscoPanel to read roles without requiring a separate UserInfo call.
• identity_providers.oidc.jwks: Contains the RSA key pair used for signing tokens. For production, you should generate your own keys.
• session.cookies.domain: This must match the domain used in DISCOPANEL_AUTH_OIDC_ISSUER_URI. For development, the default is traefik.me.

The default Authelia/DiscoPanel configuration is intended for development only. Before deploying to production, perform the following steps:

• TLS/SSL: Replace self-signed tls.crt and tls.key with real certificates and set DISCOPANEL_AUTH_OIDC_SKIP_TLS_VERIFY=false.
• Secrets: Change all sensitive values, including the HMAC secret, session secret, storage encryption key, JWT reset secret, and the OIDC client secret (both the hash in configuration.yml and the plaintext in the DiscoPanel compose file).
• JWKS: Generate a new RSA key pair for identity_providers.oidc.jwks in configuration.yml.
• Domains: Update session.cookies.domain in Authelia and all localhost entries in DISCOPANEL_AUTH_OIDC_REDIRECT_URL to your actual production domain.
• Authentication: Optionally set DISCOPANEL_AUTH_LOCAL_ENABLED=false to force OIDC-only login.

To prevent any Discord user from logging in and instead restrict access to members of a specific server, use the extra claims mechanism to fetch guild membership data.

1. Add guilds to your DISCOPANEL_AUTH_OIDC_SCOPES.
2. Configure the following environment variables:

- DISCOPANEL_AUTH_OIDC_SCOPES=openid,identify,email,guilds
- DISCOPANEL_AUTH_OIDC_EXTRA_CLAIMS_URL=https://discord.com/api/users/@me/guilds
- DISCOPANEL_AUTH_OIDC_EXTRA_CLAIMS_KEY=#.id
- DISCOPANEL_AUTH_OIDC_EXTRA_CLAIMS_NAME=guilds
- DISCOPANEL_AUTH_OIDC_REQUIRED_CLAIM=guilds
- DISCOPANEL_AUTH_OIDC_REQUIRED_VALUES=YOUR_GUILD_ID

Replace YOUR_GUILD_ID with your Discord server's ID. The EXTRA_CLAIMS_KEY uses gjson path syntax (#.id) to extract IDs from the array returned by Discord.

The recommended way to run DiscoPanel is via Docker Compose. This requires Docker Engine with Docker Compose installed, as DiscoPanel manages Minecraft servers as Docker containers.

1. Create a docker-compose.yml file (you can use the one provided in the repository).
2. Spin up the service using the following command:

docker compose up -d

Once the service is running, access the interface at http://<your-host>:8080 to create your admin account.

You can deploy DiscoPanel in a Debian 13 LXC container using the Proxmox VE Community Scripts helper script. This script automates the installation of Docker, Go, Node.js, and builds DiscoPanel from source, managing it as a systemd service.

Run the following command from your Proxmox host shell to start the interactive installation wizard:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/discopanel.sh)"

After creating your project and installing dependencies (using npm install, pnpm install, or yarn), start the development server to begin working on your application.

npm run dev

# or start the server and open the app in a new browser tab
npm run dev -- --open

You can run DiscoPanel as a standalone Docker container. Ensure you mount the Docker socket to allow DiscoPanel to manage Minecraft server containers, and map your data/backup directories correctly.

docker run -d \
  --name discopanel \
  --restart unless-stopped \
  --network host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ./data:/app/data \
  -v ./backups:/app/backups \
  -v ./tmp:/app/tmp \
  -v ./config.yaml:/app/config.yaml:ro \
  -e DISCOPANEL_DATA_DIR=/app/data \
  -e DISCOPANEL_HOST_DATA_PATH="$(pwd)/data" \
  -e TZ=UTC \
  nickheyer/discopanel:latest