Pin Minecraft 26.3 and add safe Orion managed deployment support

docker-compose.yml

@@ -1,20 +1,29 @@
 name: minecraft
 
+x-logging: &logging
+  logging:
+    driver: json-file
+    options:
+      max-size: "10m"
+      max-file: "3"
+
 services:
   # ── Minecraft server (Fabric via itzg/minecraft-server) ─────────────────
   mc:
-    image: itzg/minecraft-server:latest
+    image: itzg/minecraft-server:java25@sha256:783d2712019a3996b4168752517a08d3448ef8995879b200316c3888f98dc394
     container_name: mc
     restart: unless-stopped
+    <<: *logging
     stop_grace_period: 2m
     tty: false
     stdin_open: false
     environment:
       EULA: "TRUE"
       TYPE: ${SERVER_TYPE:-FABRIC}
-      VERSION: ${MC_VERSION:-26.2}
+      VERSION: ${MC_VERSION:-26.3}
       MEMORY: ${MC_MEMORY:-6G}
-      USE_AIKAR_FLAGS: "true"
+      FABRIC_LOADER_VERSION: "0.19.5"
+      FABRIC_LAUNCHER_VERSION: "1.1.2"
 
       # Offline mode + whitelist as the approval gate (see docs/auth-flow.md).
       # enforce-secure-profile must be off or offline-launcher players are
@@ -36,35 +45,28 @@ services:
       ENABLE_RCON: "true"
       RCON_PASSWORD: ${RCON_PASSWORD:?generate with scripts/setup.sh}
 
-      # Server-side mods, auto-resolved for the current MC version on every start.
-      # ":beta" allows beta-typed builds for that project (EasyAuth publishes
-      # its 26.x builds as beta).
-      MODRINTH_PROJECTS: ${MODRINTH_PROJECTS:-fabric-api,easyauth:beta,spark,lithium,ferrite-core}
-      MODRINTH_DOWNLOAD_DEPENDENCIES: required
+      # Reviewed exact Modrinth version IDs. Update these with Minecraft.
+      MODRINTH_PROJECTS: ${MODRINTH_PROJECTS:-fabric-api:bNnaTiuM,easyauth:Qd0CWVQP,spark:e3hsPc1o,lithium:xS0Q8LSi,ferrite-core:d5ddUdiB}
+      MODRINTH_DOWNLOAD_DEPENDENCIES: none
 
       # Modpack support (leave empty for lean Fabric; see docs/mods-and-modpacks.md)
       MODRINTH_MODPACK: ${MODRINTH_MODPACK:-}
 
-      # Enforce mod configs on every boot (proxy-protocol/TCPShield settings —
-      # see docs/tcpshield.md). Mods that rewrite their own config files can't
-      # clobber these: patches re-apply before each server start.
-      PATCH_DEFINITIONS: /patches/patch-set.json
+
 
       TZ: ${TZ:-UTC}
     ports:
       - "${MC_PORT:-25565}:25565"
-      # BlueMap web map (only active if the bluemap mod is installed)
-      - "${MAP_PORT:-8100}:8100"
     volumes:
       - ./data/mc:/data
-      - ./config/patches:/patches:ro
     mem_limit: ${MC_CONTAINER_MEM_LIMIT:-7g}
 
   # ── Scheduled world backups (itzg/mc-backup) ─────────────────────────────
   backup:
-    image: itzg/mc-backup:latest
+    image: itzg/mc-backup:latest@sha256:5ddce05d917f7fb94c752e7be5aeb67ec043360615b0043d9b40a78809de0383
     container_name: mc-backup
     restart: unless-stopped
+    <<: *logging
     environment:
       BACKUP_INTERVAL: ${BACKUP_INTERVAL:-24h}
       INITIAL_DELAY: 10m
@@ -90,6 +92,7 @@ services:
     image: minecraft-dashboard:local
     container_name: mc-dashboard
     restart: unless-stopped
+    <<: *logging
     environment:
       PANEL_SESSION_SECRET: ${PANEL_SESSION_SECRET:?generate with scripts/setup.sh}
       PANEL_ADMIN_PASSWORD: ${PANEL_ADMIN_PASSWORD:-}
@@ -98,10 +101,11 @@ services:
       RCON_PASSWORD: ${RCON_PASSWORD}
       MC_CONTAINER: mc
       BACKUP_CONTAINER: mc-backup
-      MC_DATA_DIR: /mc-data
-      BACKUPS_DIR: /backups
-      APP_DATA_DIR: /app-data
-      PROJECT_DIR: /project
+      MC_DATA_DIR: /server-data/mc
+      RESTORE_WORK_DIR: /server-data/restore
+      BACKUPS_DIR: /server-data/backups
+      APP_DATA_DIR: /server-data/dashboard
+      PROJECT_DIR: ${PROJECT_DIR:?Set PROJECT_DIR to the absolute host checkout path}
       REGISTRATION_WINDOW_MINUTES: ${REGISTRATION_WINDOW_MINUTES:-2}
       DISCORD_WEBHOOK_URL: ${DISCORD_WEBHOOK_URL:-}
       TZ: ${TZ:-UTC}
@@ -110,10 +114,8 @@ services:
       - "${DASHBOARD_PORT:-8080}:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - ./data/mc:/mc-data
-      - ./data/backups:/backups
-      - ./data/dashboard:/app-data
-      - ./:/project
+      - ./data:/server-data
+      - ${PROJECT_DIR:?Set PROJECT_DIR}:${PROJECT_DIR}
     mem_limit: 512m
     depends_on:
       - mc