Deploy AtlasEngine

AtlasEngine 2 ships as a single-host Docker Compose stack behind a TLS reverse proxy. PostgreSQL stores Auth.js sessions, preferences, and AI chat history. The editor and game server share the writable games/ directory.

Service map

Public address	Service
https://atlasengine.ca	Landing site
https://docs.atlasengine.ca	Documentation
https://app.atlasengine.ca	Authenticated web editor
port 25565	Minecraft server
/pack.zip on the RPC host	Generated resource pack

The supplied SWAG examples use host ports 8327 for the public site and 8326 for the editor.

Configure the stack

cp .env.production.example .env.production

openssl rand -base64 32  # AUTH_SECRET
openssl rand -hex 32     # AE2_API_TOKEN
openssl rand -hex 32     # AE2_RPC_TOKEN

docker compose --env-file .env.production config
docker compose --env-file .env.production up --build -d

At minimum, replace every placeholder in .env.production. Public URLs must use HTTPS, production secrets must be strong, and the email allowlist cannot contain a wildcard.

Google OAuth

Create a Google OAuth 2.0 Client ID with application type Web application. For the production editor, enter these exact values:

Authorized JavaScript origin
https://app.atlasengine.ca

Authorized redirect URI
https://app.atlasengine.ca/api/auth/callback/google

For local development, add:

Authorized JavaScript origin
http://localhost:3000

Authorized redirect URI
http://localhost:3000/api/auth/callback/google

Then configure:

NEXTAUTH_URL=https://app.atlasengine.ca
GOOGLE_CLIENT_ID=your-client-id
GOOGLE_CLIENT_SECRET=your-client-secret
AE2_ALLOWED_EMAILS=you@example.com

Origins contain only the scheme and host—no trailing slash or path. Redirect URIs include the full Auth.js callback path and must match exactly.

Keep the downloaded JSON private

Do not commit the Google client-secret JSON. Copy only its client ID and client secret into ignored local environment files and the production host's secret store. If a secret was ever committed or shared publicly, rotate it in Google Cloud.

Reverse proxy requirements

Your proxy must:

• terminate HTTPS and forward the original host and scheme;
• route the landing, docs, and editor hosts to their corresponding service;
• support WebSockets when proxying port 9472;
• expose the resource pack URL configured by AE2_PUBLIC_PACK_URL;
• never expose PostgreSQL.

Copy the examples from deploy/swag/, verify certificates exist, then test Nginx before reloading it.

Production safety

• Keep AE2_MC_ONLINE_MODE=true on any Internet-accessible Minecraft port.
• Use a 32-character-or-longer AE2_RPC_TOKEN when RPC is not loopback-only.
• Set AE2_UID and AE2_GID to the owner of the host games/ directory.
• Back up the PostgreSQL volume and games/ together.
• Rotate the web API and RPC tokens together across services.
• Expect rotating AUTH_SECRET to sign every user out.

Health and operations

curl -fsS https://app.atlasengine.ca/api/health
docker compose --env-file .env.production logs -f web server
docker compose --env-file .env.production up --build -d

The health endpoint returns 200 only when PostgreSQL and the game-server RPC endpoint are reachable.