Cubepals

Data model

• users, auth_*, account_standing.
• minecraft_servers: owner, name, slug, region, memory tier, status, stop reason, desired revision, active world, deleted_at.
• server_revisions: immutable boot config (game version, loader, settings, mods pinned by URL + sha512) and why it changed.
• server_runtimes: provider, opaque handle, what last booted, last observed state.
• server_operations: kind, status, input, requester, idempotency key, progress, error.
• worlds; backups (snapshot or archive, with the revision at capture).
• server_access + entries: whitelist, operators, bans by player UUID, with pending states.
• power_intervals: the source of play time and billing.
• billing_subscriptions, billing_orders, audit_log, joins.

Build it in this order

1. Monorepo, config, database, auth. One dev command starts everything with no outside accounts.
2. The Runtime interface with fake and Docker adapters, and a pure function from revision to container spec.
3. Create/start/stop: a pure state machine plus queued operations.
4. Dashboard: create a server, start/stop it, live status.
5. Edge: mc-router plus a route-syncing agent. Join from a real client.
6. Wake-on-join and idle sleep, with presence from RCON list.
7. The Fly adapter and reconcile loop, on a staging org.
8. Usage metering and plan limits in one policy function, checked again in workers before spending money.
9. Settings and version changes as new revisions; automatic rollback when a boot fails.
10. Mods: search, dependency resolution, pinned hashes.
11. Backups, restore, console, logs.
12. Billing webhooks, then what a downgrade does.

Tools to connect

• Fly Machines API and flyctl; Docker Engine API.
• Modrinth API (mods); Mojang API (player name to UUID).
• Polar, PostHog and Cloudflare, by API or their MCP servers.
• GitHub CLI for CI and deploys.

Watch out for

• Waking is the product, and the hardest part. Fly doesn't promise a suspended machine resumes, and nothing supervises a resume. Bound every wait; fall back to a cold boot, then a new machine on another host. A new image or config drops saved memory, so refresh sleepers in the background. Record why each slow wake was slow.
• Pings wake servers. Wake on a server-list ping only from the server's own players, or bots run up your bill.
• Idle shutdown needs true presence. The edge's player identity is a client claim; trust RCON.
• Access has two writers, your dashboard and in-game /op or /whitelist. Keep your own record, reconcile both ways, and reseed after a restore rewinds the files.
• Volumes are tied to hosts. Restore means a new volume and machine. Deleting a Fly app loses its volumes, so delete in two phases.
• Fly rate-limits around one request per second per machine. List org-wide and back off.
• Realtime runs as one process when rooms live in memory. WebTransport needs UDP and a dedicated IPv4.
• Next.js as a Worker can pass every test and fail every request. Check a deployed preview before merging runtime upgrades.
• Money code needs stricter rules: every charge accounted for, decisions re-read under a lock, idempotent webhooks.
• Free tiers attract abuse. Keep thresholds in private config.
• Manual work an agent can't do: provider accounts, the dedicated IP, wildcard DNS, OAuth apps, billing products, and joining from real Java and Bedrock clients.

Done when

• A new user signs up, creates a server, and joins its address from a real Minecraft client.
• With nobody on, it sleeps. Joining again wakes it, and the client waits instead of erroring.
• A setting change makes a new revision, a bad one rolls back by itself, and a backup restores.
• Play time is metered, and a plan limit stops a server with the reason shown.
• It runs locally from one command, and staging passes the same flow.