How to host a Nakama server for $10/mo

Nakama is a scalable Open Source game backend, that I've written a couple articles about recently.

I encountered an interesting response to my posts that I wasn't expecting:

"Nakama is too expensive"

However, I have a small indie game (Retro Tank Party) for sale on Steam that's running Nakama on a $10/mo Linode!

Of course, running a single, low-powered server won't work for all games. Some might need multiple servers (especially for high availability if one goes down) or a more expensive, higher-powered server.

But for testing in early development - OR if your game is small enough and you can tolerate some downtime if the data center is hit by a tornado - a single $10/mo server from Linode, or Digital Ocean, or wherever is totally sufficient.

In this tutorial, I'll show you how to setup Nakama with production configuration, and explain how to perform some routine maintenance on it.

Wait - why do people think Nakama is expensive?

Since I went with the click-bait title and intro about price (sorry!), I figure I should quickly explain why this misconception exists.

Heroic Labs, the creators of Nakama, sell their own hosting for Nakama called the Heroic Cloud. It costs $600/mo for the lowest plan.

They're clearly targeting bigger games that are generating enough revenue month over month to justify that cost.

But that's the beauty of Open Source!

You don't have to host on the Heroic Cloud - you can host anywhere you want.

Prerequisites

First of all, I'm going to assume that you have basic Linux skills, can navigate your way around on the command-line, and install new software. If not, you may need to find a friend to help you set this up. :-)

To get started, launch a new server using whichever Linux distribution you are most comfortable with (I'm using Ubuntu) on the hosting provider of your choice (I'm using Linode).

Then install Docker and Docker Compose. Those links will take you to the installation documentation, which is pretty good, but I'm sure you can find tutorials online.

Also, it probably goes without saying that you should do some basic security setup on your server, for example:

1. Harden your SSH configuration (ex. disable root login, require key-based authentication, etc)
2. Enable automatic security updates from your distro
3. Uninstall any internet-facing software that you don't need

But that's just basic Linux stuff that I'm not going to cover here.

Create the Docker Compose app

We're going to make a Docker Compose app to run Nakama and the related services.

First, you'll need to create a directory where it's going to live. On my servers, I like to use a top-level directory called /app to hold my Docker Compose apps:

sudo mkdir -p /app/nakama
cd /app/nakama

Then we need to create a docker-compose.yml file with the following contents:

version: '3'

services:
  cockroachdb:
    image: cockroachdb/cockroach:v19.2.5
    command: start --insecure --store=attrs=ssd,path=/var/lib/cockroach/
    restart: always
    volumes:
      - ./db:/var/lib/cockroach
    expose:
      - "8080"
      - "26257"
  nakama:
    image: heroiclabs/nakama:3.4.0
    entrypoint:
      - "/bin/sh"
      - "-ecx"
      - > 
          /nakama/nakama migrate up --database.address root@cockroachdb:26257 &&
          exec /nakama/nakama --config /nakama/data/config.yml --database.address root@cockroachdb:26257
    restart: always
    links:
      - "cockroachdb:db"
    depends_on:
      - cockroachdb
    volumes:
      - ./data:/nakama/data
    expose:
      - "7349"
      - "7350"
      - "7351"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7350/"]
      interval: 10s
      timeout: 5s
      retries: 5
  nginx:
    image: jonasal/nginx-certbot:latest
    environment:
      CERTBOT_EMAIL: "[email protected]"
    ports:
      - "80:80"
      - "443:443"
      - "7349:7349"
      - "7350:7350"
      - "7351:7351"
    volumes:
      - nginx_secrets:/etc/letsencrypt
      - ./nginx_conf.d:/etc/nginx/user_conf.d
    links:
      - nakama
    depends_on:
      - nakama

volumes:
  nginx_secrets: {}

This creates 3 services:

• CockroachDB: This is the database backend used by Nakama. (FYI, if you're more comfortable with Postgres, it can be used with Nakama instead.)
• Nakama: Specifically, version 3.4.0 which is the latest at the time of this writing. We'll talk about how to upgrade Nakama later in the article.
• NGINX: We're using NGINX as a reverse-proxy in front of Nakama, so we can provide access via secure HTTPS, rather than HTTP.

Be sure to replace the "[email protected]" in your docker-compose.yml with a real email address! This is required by Let's Encrypt to generate an SSL certificate for HTTPS.

And before we move on, we need to make sure to create a few directories:

# The raw data from CockroachDB for easier backups.
sudo mkdir db
 
# The Nakama data directory, for configuration and custom Nakama modules.
sudo mkdir data
sudo mkdir data/modules
 
# The NGINX configuration.
sudo mkdir nginx_conf.d

Configure Nakama

Next, we'll be configuring Nakama for production use, which requires setting a bunch of secret keys.

You can use any string of characters, but I'd recommend randomly generating them, and using at least 32 characters. If you don't have any better options (I like to use LastPass), you can use Random.org to generate them.

Create a file called config.yml inside the 'data' directory we just created above:

name: nakama1
socket:
  # Replace this with a random string.
  server_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

session:
  # 6h token expiry
  token_expiry_sec: 21600
  # Replace both of these with a random strings.
  encryption_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  refresh_encryption_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

runtime:
  # Replace this with a random string.
  http_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

console:
  # Replace these with a secure username and password.
  username: "adminuser"
  password: "adminpass"
 
  # Replace this with a random string.
  signing_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

If you have any Nakama modules (or create any later), you'll want to copy those into the 'data/modules' directory.

Configure NGINX

We need to tell NGINX the domain name of your server, and to proxy traffic to Nakama.

Create a file called nakama.conf in the 'nginx_conf.d' directory we created earlier:

# Normal web traffic.
server {
  # Listen to port 443 on both IPv4 and IPv6.
  listen 443 ssl default_server reuseport;
  listen [::]:443 ssl default_server reuseport;
 
  # Domain names this server should respond to.
  server_name nakama.example.com;
 
  # SSL certificate configuration.
  ssl_certificate         /etc/letsencrypt/live/nakama/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/nakama/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/nakama/chain.pem;
  ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;
 
  location / {
    # Redirect web visitors to your normal website.
    return 301 https://www.example.com$request_uri;
  }
}
 
# Nakama gRPC API.
server {
  listen 7349 ssl;
  listen [::]:7349 ssl;
 
  # Domain names this server should respond to.
  server_name nakama.example.com;
 
  # SSL certificate configuration.
  ssl_certificate         /etc/letsencrypt/live/nakama/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/nakama/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/nakama/chain.pem;
  ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;
 
  location / {
    proxy_pass http://nakama:7349;
  }
}
 
# Nakama HTTP API.
server {
  listen 7350 ssl;
  listen [::]:7350 ssl;
 
  # Domain names this server should respond to.
  server_name nakama.example.com;
 
  # SSL certificate configuration.
  ssl_certificate         /etc/letsencrypt/live/nakama/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/nakama/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/nakama/chain.pem;
  ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;
 
  location / {
    # Enable CORS from anywhere with support for pre-flight requests.
    # See: https://enable-cors.org/server_nginx.html
    if ($request_method = 'OPTIONS') {
       add_header 'Access-Control-Allow-Origin' '*';
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
       # Tell client that this pre-flight info is valid for 20 days
       add_header 'Access-Control-Max-Age' 1728000;
       add_header 'Content-Type' 'text/plain; charset=utf-8';
       add_header 'Content-Length' 0;
       return 204;
    }
    if ($request_method = 'POST') {
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
       add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
    }
    if ($request_method = 'GET') {
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
       add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
    }
 
    proxy_pass http://nakama:7350;
  }
 
  location /ws {
    # Enable CORS from anywhere with support for pre-flight requests.
    # See: https://enable-cors.org/server_nginx.html
    if ($request_method = 'OPTIONS') {
       add_header 'Access-Control-Allow-Origin' '*';
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
       # Tell client that this pre-flight info is valid for 20 days
       add_header 'Access-Control-Max-Age' 1728000;
       add_header 'Content-Type' 'text/plain; charset=utf-8';
       add_header 'Content-Length' 0;
       return 204;
    }
    if ($request_method = 'POST') {
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
       add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
    }
    if ($request_method = 'GET') {
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
       add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
    }
 
    proxy_pass http://nakama:7350/ws;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
  }
}
 
# Nakama admin console.
server {
  listen 7351 ssl;
  listen [::]:7351 ssl;
 
  # Domain names this server should respond to.
  server_name nakama.example.com;
 
  # SSL certificate configuration.
  ssl_certificate         /etc/letsencrypt/live/nakama/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/nakama/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/nakama/chain.pem;
  ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;
 
  location / {
    proxy_pass http://nakama:7351;
  }
}

That's a lot of stuff! Luckily, you don't need to understand most of it. :-)

You just need to replace a couple of domain names:

• Replace nakama.example.com with the domain name of your Nakama server.
• Replace www.example.com with your normal website. If anyone tries to visit your Nakama server in their web browser, they'll be redirected there.

Start it all up!

In the directory with the docker-compose.yml (which would be /app/nakama if you're following my convention) run:

sudo docker-compose up -d

The first time you run this it could take awhile.

It needs to download the Docker images for CockroachDB, Nakama and NGINX. Then the first time each of those run, they need to do some first time setup. NGINX will probably be the slowest, because it needs to get an SSL certificate from Let's Encrypt.

You can check on what NGINX is doing by running:

sudo docker-compose logs -f nginx

Anyway, if everything has gone well, you should be able to point your Nakama client at this server! Be sure to use the random 'server_key' you put in Nakama's config.yml earlier.

Basic maintenance

All servers need on-going maintenance. The two most important things are: backups, and updates.

Backing up Nakama with the configuration we used here is super easy! You just need to make an archive of everything in the same directory as the docker-compose.yml (ie. /app/nakama) and all its sub-directories. This will get the full database and Nakama's configuration. You can restore your Nakama instance on a new server by simply extracting the backup, and running 'docker-compose up -d'.

I'd recommend setting up an automatic daily off-site backup, as well as performing a quick manual backup (ie. copying the directory :-)) just before updating Nakama or CockroachDB.

To update Nakama or CochroachDB, simply edit the 'docker-compose.yml' file, change the version number after the 'image' name (ie. change 'nakama:3.4.0' to 'nakama:3.5.0', for example) and run:

sudo docker-compose pull
sudo docker-compose stop
sudo docker-compose up -d

NOTE: This will take your Nakama instance down during the update! So, you'll need to schedule it for a slow time and let your players know. 

That's about it!

I know that might seem like a lot, but once you get it going, there's not much to do but periodic updates.

Please let know how it goes for you!

Happy Hacking :-)