external stuff

I use cloudflare as both my registrar and for dns stuff. Clients connect to one of my addresses (mc. mc2. mc3..) depending on the server (as i sometimes host multiple). On cloudflare. these are dns-only (non "orange cloud'ed") SRV and A records. The SRV records are _minecraft._tcp.mc which targets mc.iamas.ink, duplicated with "mc" changed to "mc2"/"mc3".
these target the A record, which points to my IP address, which is being updated (when it rarely changes) ~~using timothymiller/cloudflare-ddns~~
(update 2025-02-01: i suggest using this instead favonia/cloudflare-ddns)

internal stuff

after cloudflare, the requests come to my ip, which has 25565 port forwarded to my server machine, which runs itzg/mc-router in docker, alongside a minecraft server using itzg/docker-minecraft-server.
mc-router then routes the connection to either that server in docker, or the local ip for my main pc. the reason i need to use mc-router here is because these domains all use the same port, and i don't think theres any easy way to do this otherwise.

here's my docker-compose.yml

---
services:
  mcserver:
    stop_grace_period: 2m
    container_name: mcserver
    image: itzg/minecraft-server
    environment:
      - EULA=TRUE
      - TYPE=FABRIC
 
      - MODRINTH_PROJECTS=styled-chat,styled-nicknames,dynres,anti-xray,luckperms,chunky,spark,minimotd,carpet,itemrename,lithium,krypton,ferrite-core,noisium,adaptiveview,fabric-api
      - MODRINTH_ALLOWED_VERSION_TYPE=release
      - MODRINTH_DOWNLOAD_DEPENDENCIES=required
      - REMOVE_OLD_MODS=false
      
      - DIFFICULTY=normal
      - TZ=Europe/London
      - USE_AIKAR_FLAGS=true
      - MEMORY=4G
      - SNOOPER_ENABLED=false
      - RCON_PASSWORD=password
      - ENABLE_COMMAND_BLOCK=true
      - ENFORCE_SECURE_PROFILE=false
      - SEED=seed
      - STOP_SERVER_ANNOUNCE_DELAY=30
      - ENABLE_WHITELIST=true
      - ENFORCE_WHITELIST=true
      - WHITELIST=lilyl
  
 
      - USE_SIMD_FLAGS=true
      - MAX_TICK_TIME=-1 # DISABLE THIS (-1) if autopause is enabled. otherwise 120000
 
      - JVM_DD_OPTS=disable.watchdog:true,paper.playerconnection.keepalive:120
      - SPAWN_PROTECTION=0
      - ENABLE_AUTOPAUSE=FALSE
      - AUTOPAUSE_TIMEOUT_EST=1200 # default 3600 describes the time between the last client disconnect and the pausing of the process
      - AUTOPAUSE_TIMEOUT_INIT=120 # default 600 describes the time between server start and the pausing of the process, when no client connects inbetween
      - AUTOPAUSE_TIMEOUT_KN=60 # default 120 describes the time between knocking of the port (e.g. by the main menu ping) and the pausing of the process, when no client connects inbetween
      - AUTOPAUSE_PERIOD=10 # default 10 describes period of the daemonized state machine, that handles the pausing of the process
      - DEBUG_AUTOPAUSE=FALSE
 
    healthcheck:
      test: mc-health
      start_period: 1m
      interval: 5s
      retries: 20
    tty: true
    stdin_open: true
    restart: unless-stopped
    volumes:
      - ~/app/minecraftserver:/data
    deploy:
      resources:
        limits:
          cpus: "3"
          memory: 7G
  mc-router:
    container_name: mc-router
    image: itzg/mc-router
    depends_on:
      mcserver13:
        condition: service_healthy
    environment:
      MAPPING: |
	    mc.iamas.ink=mcserver:25565
        mc2.iamas.ink=192.168.0.3:25565
      CLOUDFLARE_SRV: true
      TZ: Europe/London
    ports:
      - "25565:25565"

whitelist

this may seem obvious, but you should whitelist your private minecraft servers. there are bots that scan for open servers and you may find unwanted visitors. IP addresses are not private information, and there's few enough IPv4's that you can scan every one in less than an hour.