Server Deployment Runbook & PDF Export Generator

# DustBowl Rust Main (US-East) Deployment Runbook

> **Environment:** `Production` | **Game:** `Rust` | **Generated:** `2026-11-05 17:16 UTC`
> **Architecture:** DustBowl Warden Standardized Operations Playbook

## 1. Server Topology & Metadata

| Parameter | Value | Description |
| :--- | :--- | :--- |
| **Server Name** | `DustBowl Rust Main (US-East)` | Public identity and server browser title |
| **Game / Platform** | `Rust` | Target engine framework |
| **Host IP / Domain** | `198.51.100.25` | Target deployment interface |
| **Primary Game Port** | `28015` | UDP/TCP player gameplay traffic |
| **Query Port** | `28016` | Steam A2S / Master server heartbeat |
| **RCON Port** | `28016` | Remote management interface (Protected) |
| **Service User** | `steam:steam` | Sandboxed Linux system execution account |
| **Install Path** | `/opt/gameservers/rust` | Base daemon working directory |
| **Systemd Service** | `rust-server.service` | System daemon manager unit |
| **Admin Contact** | `[email protected]` | Escalation point for outage alerts |

## Table of Contents

- [1. Server Topology & Metadata](#1-server-topology--metadata)
- [2. Host Prerequisites & OS Hardening](#2-host-prerequisites--os-hardening)
- [3. Installation & Directory Staging](#3-installation--directory-staging)
- [4. Core Application Configuration](#4-core-application-configuration)
- [5. Systemd Service Unit](#5-systemd-service-unit)
- [6. Network Security & Firewall Rules](#6-network-security--firewall-rules)
- [7. Automated Backup & Retention SOP](#7-automated-backup--retention-sop)
- [8. Verification & Health Monitoring](#8-verification--health-monitoring)
- [9. Incident Response & Troubleshooting SOP](#9-incident-response--troubleshooting-sop)
- [10. Emergency Recovery & Rollback Plan](#10-emergency-recovery--rollback-plan)
- [11. Team Operating Cadence](#11-team-operating-cadence)

## 2. Host Prerequisites & OS Hardening

Execute host preparation commands to establish non-privileged execution and high-concurrency socket limits:

```bash
# 1. Provision dedicated system user
sudo useradd -r -m -d /opt/gameservers/rust -s /bin/bash steam || true

# 2. Set file descriptor and memory map limits
sudo tee /etc/security/limits.d/99-gameserver.conf << 'EOF'
steam soft nofile 65536
steam hard nofile 65536
steam soft memlock unlimited
steam hard memlock unlimited
EOF

# 3. Optimize network socket buffer limits
sudo sysctl -w net.core.rmem_max=33554432
sudo sysctl -w net.core.wmem_max=33554432
sudo sysctl -w net.core.netdev_max_backlog=10000
```

## 3. Installation & Directory Staging

Create directory structures and grant appropriate file ownership permissions:

```bash
sudo mkdir -p /opt/gameservers/rust/backups
sudo mkdir -p /opt/gameservers/rust/logs
sudo chown -R steam:steam /opt/gameservers/rust
sudo chmod 750 /opt/gameservers/rust
```

## 4. Core Application Configuration

Deploy application configuration to `/opt/gameservers/rust/server.cfg`:

```text
# server.cfg
server.hostname "DustBowl Rust Main"
server.maxplayers 150
server.worldsize 4000
server.seed 1337
server.saveinterval 300
server.radiation true
chat.enabled true
```

### Executable Startup Command

```bash
./RustDedicated -batchmode +server.ip 0.0.0.0 +server.port 28015 +server.queryport 28016 +server.hostname "DustBowl Rust Main" +server.identity "rust_main" +server.maxplayers 150 +server.worldsize 4000 +server.seed 1337 +rcon.ip 0.0.0.0 +rcon.port 28016 +rcon.password "$RCON_SECRET" -logFile /opt/gameservers/rust/server.log
```

## 5. Systemd Service Unit

Save the unit definition below to `/etc/systemd/system/rust-server.service`:

```ini
[Unit]
Description=DustBowl Rust Main (US-East) Dedicated Server
After=network-online.target local-fs.target time-sync.target
Wants=network-online.target

[Service]
Type=simple
User=steam
Group=steam
WorkingDirectory=/opt/gameservers/rust
Environment=RCON_SECRET=change_me_in_production
ExecStart=./RustDedicated -batchmode +server.ip 0.0.0.0 +server.port 28015 +server.queryport 28016 +server.hostname "DustBowl Rust Main" +server.identity "rust_main" +server.maxplayers 150 +server.worldsize 4000 +server.seed 1337 +rcon.ip 0.0.0.0 +rcon.port 28016 +rcon.password "$RCON_SECRET" -logFile /opt/gameservers/rust/server.log
Restart=on-failure
RestartSec=10s
TimeoutStopSec=60s
KillSignal=SIGINT
SendSIGKILL=yes
LimitNOFILE=65536
LimitMEMLOCK=infinity
StandardOutput=journal
StandardError=journal

# Sandboxing & Security Hardening
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
```

Reload the daemon manager and enable boot startup:

```bash
sudo systemctl daemon-reload
sudo systemctl enable rust-server
```

## 6. Network Security & Firewall Rules

Restrict open ports strictly to gameplay and telemetry channels. RCON should remain private or bound to VPN:

```bash
#!/usr/bin/env bash
# =============================================================================
# Network Firewall Security Rules for DustBowl Rust Main (US-East)
# Enforces strict port allowances and shields RCON management access.
# =============================================================================
set -euo pipefail

echo "[INFO] Configuring network filters for game ports..."

# 1. Allow Primary Gameplay Traffic (UDP)
sudo ufw allow 28015/udp comment "Rust Game Primary"

# 2. Allow Steam/Engine Query Heartbeat (UDP)
sudo ufw allow 28016/udp comment "Rust Master Query"

# 3. Restrict RCON Management Port (TCP) strictly to internal/VPN subnet
# Adjust 10.0.0.0/8 to your trusted operations network subnet
sudo ufw allow from 10.0.0.0/8 to any port 28016 proto tcp comment "Rust Trusted RCON"

# 4. Drop all unmanaged inbound UDP amplification queries
# sudo iptables -A INPUT -p udp --dport 28016 -m hashlimit --hashlimit-above 30/sec --hashlimit-burst 60 --hashlimit-name game_query_drop -j DROP

echo "[OK] Firewall rules staged successfully."
```

## 7. Automated Backup & Retention SOP

> **Backup Cadence:** Cron expression `0 4 * * *` with rolling 14-day retention.

Automated backup script placed at `/usr/local/bin/backup-gameserver.sh`:

```bash
#!/usr/bin/env bash
set -euo pipefail
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
BACKUP_DIR="/opt/gameservers/rust/backups"
mkdir -p "$BACKUP_DIR"
tar -czf "$BACKUP_DIR/rust-server_$TIMESTAMP.tar.gz" -C "/opt/gameservers/rust" .
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +14 -delete
```

## 8. Verification & Health Monitoring

Execute post-launch validation commands to verify daemon health and socket states:

```bash
#!/usr/bin/env bash
# =============================================================================
# Verification & Healthcheck Script for DustBowl Rust Main (US-East)
# Tests systemd status, socket bindings, process PID, and recent crash traces.
# =============================================================================
set -euo pipefail

echo "=== 1. Checking Systemd Service Status ==="
if systemctl is-active --quiet rust-server; then
    echo "[OK] Service 'rust-server' is running."
else
    echo "[FAIL] Service 'rust-server' is INACTIVE!"
    exit 1
fi

echo "=== 2. Verifying Network Sockets ==="
if ss -tulpn | grep -q ":28015\b"; then
    echo "[OK] Primary port 28015 is listening."
else
    echo "[FAIL] Port 28015 is NOT bound!"
    exit 1
fi

echo "=== 3. Inspecting Live Journal Logs (Last 15 lines) ==="
journalctl -u rust-server -n 15 --no-pager

echo "[OK] Health check completed successfully."
```

## 9. Incident Response & Troubleshooting SOP

| Symptom | Probable Cause | Remediation Command | Verification |
| :--- | :--- | :--- | :--- |
| **RCON client receives connection refused on port 28016** | RCON listening port bound to localhost or blocked by packet filter | `ss -tulpn | grep 28016 && sudo iptables -L INPUT -n -v | grep 28016` | Execute test RCON command via rcon-cli or dustbowl-admin utility |
| **Save loop freeze hitching exceeding 500ms on autosave** | SQLite database disk sync contention on shared storage | `iotop -b -n 2 -d 1 | grep RustDedicated || sync` | Confirm nvme mount options include noatime and barrier=0 |
| **Server fails to start with Steam Auth ticket failure** | SteamCMD app files out of date or missing steam_appid.txt | `echo "252490" > /opt/gameservers/rust/steam_appid.txt && ./steamcmd.sh +login anonymous +app_update 258550 validate +quit` | Check journalctl -u rust-server -n 50 for Steam initialized successfully |

## 10. Emergency Recovery & Rollback Plan

In the event of database corruption or unrecoverable patch defects, execute this restore procedure:

1. **Stop active daemon process:**
   ```bash
   sudo systemctl stop rust-server
   ```
2. **Archive corrupt state for forensics:**
   ```bash
   sudo mv /opt/gameservers/rust /opt/gameservers/rust_corrupt_$(date +%s)
   sudo mkdir -p /opt/gameservers/rust
   ```
3. **Extract most recent known-good snapshot:**
   ```bash
   LATEST_BACKUP=$(ls -t /opt/gameservers/rust_corrupt_*/backups/*.tar.gz | head -n 1)
   sudo tar -xzf "$LATEST_BACKUP" -C /opt/gameservers/rust
   sudo chown -R steam:steam /opt/gameservers/rust
   ```
4. **Restart daemon and confirm socket bind:**
   ```bash
   sudo systemctl start rust-server
   ss -tulpn | grep 28015
   ```

## 11. Team Operating Cadence

> Nightly automated restarts occur at 04:30 EST. Notify Discord #announcements 15 minutes prior.

---
*Generated by DustBowl GameTools Runbook Bundle Generator // DustBowl Warden Infrastructure*