ci(release): fix wrong directory name

Closes https://github.com/pterodactyl/panel/issues/3841

.github/FUNDING.yaml

@@ -0,0 +1 @@
+github: [matthewpi]

.github/FUNDING.yml

@@ -1,2 +0,0 @@
-github: [ DaneEveritt ]
-custom: [ "https://paypal.me/PterodactylSoftware" ]

.github/workflows/codeql.yaml

@@ -1,4 +1,5 @@
 name: CodeQL
+
 on:
   push:
     branches:
@@ -7,24 +8,35 @@ on:
     branches:
       - develop
   schedule:
-    - cron: '0 9 * * 4'
+    - cron: "0 9 * * 4"
+
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
+
     permissions:
       actions: read
       contents: read
       security-events: write
+
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'go' ]
+        language:
+          - go
+
     steps:
-      - uses: actions/checkout@v2
+      - name: Code Checkout
+        uses: actions/checkout@v3
+
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@v1
+
-      - uses: github/codeql-action/analyze@v1
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/docker.yaml

@@ -1,58 +1,72 @@
-name: Publish Docker Image
+name: Docker
+
 on:
   push:
     branches:
       - develop
     tags:
-      - 'v*'
+      - "v*"
+
 jobs:
-  push:
+  build-and-push:
-    name: Push
+    name: Build and Push
     runs-on: ubuntu-20.04
     # Always run against a tag, even if the commit into the tag has [docker skip] within the commit message.
     if: "!contains(github.ref, 'develop') || (!contains(github.event.head_commit.message, 'skip docker') && !contains(github.event.head_commit.message, 'docker skip'))"
+
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
       - name: Docker Meta
         id: docker_meta
         uses: crazy-max/ghaction-docker-meta@v1
         with:
           images: ghcr.io/pterodactyl/wings
+
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
+
       - name: Install buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
-        with:
+
-          version: v0.5.1
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.REGISTRY_TOKEN }}
+
       - name: Get Build Information
         id: build_info
         run: |
           echo "::set-output name=version_tag::${GITHUB_REF/refs\/tags\/v/}"
           echo "::set-output name=short_sha::$(git rev-parse --short HEAD)"
-      - name: Release Production Build
+
+      - name: Build and push (latest)
         uses: docker/build-push-action@v2
         if: "!contains(github.ref, 'develop')"
         with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
           build-args: |
             VERSION=${{ steps.build_info.outputs.version_tag }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-          push: true
           tags: ${{ steps.docker_meta.outputs.tags }}
-      - name: Release Development Build
+
+      - name: Build and push (develop)
         uses: docker/build-push-action@v2
         if: "contains(github.ref, 'develop')"
         with:
+          context: .
+          file: ./Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
           build-args: |
             VERSION=dev-${{ steps.build_info.outputs.short_sha }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/push.yaml

@@ -1,4 +1,5 @@
-name: Run Tests
+name: Push
+
 on:
   push:
     branches:
@@ -6,24 +7,29 @@ on:
   pull_request:
     branches:
       - develop
+
 jobs:
-  build:
+  build-and-test:
+    name: Build and Test
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os: [ ubuntu-20.04 ]
+        os: [ubuntu-20.04]
-        go: [ '^1.17' ]
+        go: ["1.18.8", "1.19.3"]
-        goos: [ linux ]
+        goos: [linux]
-        goarch: [ amd64, arm64 ]
+        goarch: [amd64, arm64]
-    runs-on: ${{ matrix.os }}
+
     steps:
-      - name: Code Checkout
+      - name: Setup Go
-        uses: actions/checkout@v2
+        uses: actions/setup-go@v3
-      - name: Setup Go v${{ matrix.go }}
-        uses: actions/setup-go@v2
         with:
           go-version: ${{ matrix.go }}
-      - name: Print Environment
+
+      - name: Code Checkout
+        uses: actions/checkout@v3
+
+      - name: Gather environment variables
         id: env
         run: |
           printf "Go Executable Path: $(which go)\n"
@@ -33,22 +39,27 @@ jobs:
           printf "\n\nSystem Environment:\n\n"
           env
           printf "Git Version: $(git version)\n\n"
-          echo "::set-output name=version_tag::${GITHUB_REF/refs\/tags\//}"
+          echo "version_tag=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
-          echo "::set-output name=short_sha::$(git rev-parse --short HEAD)"
+          echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-          echo "::set-output name=go_cache::$(go env GOCACHE)"
+          echo "go_cache=$(go env GOCACHE)" >> $GITHUB_OUTPUT
-          echo "::set-output name=go_mod_cache::$(go env GOMODCACHE)"
+          echo "go_mod_cache=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
+
       - name: Build Cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
-          key: ${{ runner.os }}-go${{ matrix.go }}-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
-            ${{ runner.os }}-go${{ matrix.go }}-
+            ${{ runner.os }}-go-
           path: |
             ${{ steps.env.outputs.go_cache }}
             ${{ steps.env.outputs.go_mod_cache }}
-      - name: Get Dependencies
+
+      - name: go mod download
+        env:
+          CGO_ENABLED: 0
         run: |
-          go get -v -t -d ./...
+          go mod download
+
       - name: Build
         env:
           GOOS: ${{ matrix.goos }}
@@ -56,21 +67,34 @@ jobs:
           CGO_ENABLED: 0
           SRC_PATH: github.com/pterodactyl/wings
         run: |
-          go build -v -trimpath -ldflags="-s -w -X ${SRC_PATH}/system.Version=dev-${GIT_COMMIT:0:7}" -o build/wings_${GOOS}_${GOARCH} wings.go
+          go build -v -trimpath -ldflags="-s -w -X ${SRC_PATH}/system.Version=dev-${GIT_COMMIT:0:7}" -o dist/wings ${SRC_PATH}
-          go build -v -trimpath -ldflags="-X ${SRC_PATH}/system.Version=dev-${GIT_COMMIT:0:7}" -o build/wings_${GOOS}_${GOARCH}_debug wings.go
+          go build -v -trimpath -ldflags="-X ${SRC_PATH}/system.Version=dev-${GIT_COMMIT:0:7}" -o dist/wings_debug ${SRC_PATH}
-          upx build/wings_${GOOS}_${{ matrix.goarch }}
+          chmod 755 dist/*
-          chmod +x build/*
+
-      - name: Tests
+      - name: go test
-        run: go test -race ./...
+        if: ${{ matrix.goarch == 'amd64' }}
+        env:
+          CGO_ENABLED: 0
+        run: |
+          go test $(go list ./...)
+
+      - name: go test -race
+        if: ${{ matrix.goarch == 'amd64' }}
+        env:
+          CGO_ENABLED: 1
+        run: |
+          go test -race $(go list ./...)
+
       - name: Upload Release Artifact
         uses: actions/upload-artifact@v2
         if: ${{ github.ref == 'refs/heads/develop' || github.event_name == 'pull_request' }}
         with:
           name: wings_linux_${{ matrix.goarch }}
-          path: build/wings_linux_${{ matrix.goarch }}
+          path: dist/wings
+
       - name: Upload Debug Artifact
         uses: actions/upload-artifact@v2
         if: ${{ github.ref == 'refs/heads/develop' || github.event_name == 'pull_request' }}
         with:
           name: wings_linux_${{ matrix.goarch }}_debug
-          path: build/wings_linux_${{ matrix.goarch }}_debug
+          path: dist/wings_debug

.github/workflows/release.yaml

@@ -1,41 +1,48 @@
-name: Create Release
+name: Release
+
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
+
 jobs:
   release:
+    name: Release
     runs-on: ubuntu-20.04
+
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
-      - uses: actions/setup-go@v2
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
         with:
-          go-version: '^1.17'
+          go-version: "1.18.8"
-      - name: Build
+
+      - name: Build release binaries
         env:
+          CGO_ENABLED: 0
           REF: ${{ github.ref }}
         run: |
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/pterodactyl/wings/system.Version=${REF:11}" -o build/wings_linux_amd64 -v wings.go
+          GOARCH=amd64 go build -o dist/wings_linux_amd64 -v -trimpath -ldflags="-s -w -X github.com/pterodactyl/wings/system.Version=${REF:11}" github.com/pterodactyl/wings
-          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X github.com/pterodactyl/wings/system.Version=${REF:11}" -o build/wings_linux_arm64 -v wings.go
+          chmod 755 dist/wings_linux_amd64
-      - name: Test
+          GOARCH=arm64 go build -o dist/wings_linux_arm64 -v -trimpath -ldflags="-s -w -X github.com/pterodactyl/wings/system.Version=${REF:11}" github.com/pterodactyl/wings
-        run: go test ./...
+          chmod 755 dist/wings_linux_arm64
-      - name: Compress binary and make it executable
+
-        run: |
-          upx build/wings_linux_amd64 && chmod +x build/wings_linux_amd64
-          upx build/wings_linux_arm64 && chmod +x build/wings_linux_arm64
       - name: Extract changelog
         env:
           REF: ${{ github.ref }}
         run: |
           sed -n "/^## ${REF:10}/,/^## /{/^## /b;p}" CHANGELOG.md > ./RELEASE_CHANGELOG
-          echo ::set-output name=version_name::`sed -nr "s/^## (${REF:10} .*)$/\1/p" CHANGELOG.md`
+          echo "version_name=`sed -nr "s/^## (${REF:10} .*)$/\1/p" CHANGELOG.md`" > $GITHUB_OUTPUT
+
       - name: Create checksum and add to changelog
         run: |
-          SUM=`cd build && sha256sum wings_linux_amd64`
+          SUM=`cd dist && sha256sum wings_linux_amd64`
-          SUM2=`cd build && sha256sum wings_linux_arm64`
+          SUM2=`cd dist && sha256sum wings_linux_arm64`
           echo -e "\n#### SHA256 Checksum\n\`\`\`\n$SUM\n$SUM2\n\`\`\`\n" >> ./RELEASE_CHANGELOG
           echo -e "$SUM\n$SUM2" > checksums.txt
+
       - name: Create release branch
         env:
           REF: ${{ github.ref }}
@@ -49,7 +56,8 @@ jobs:
           git add system/const.go
           git commit -m "bump version for release"
           git push
-      - name: Create Release
+
+      - name: Create release
         id: create_release
         uses: actions/create-release@v1
         env:
@@ -60,24 +68,27 @@ jobs:
           body_path: ./RELEASE_CHANGELOG
           draft: true
           prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }}
-      - name: Upload amd64 Binary
+
+      - name: Upload amd64 binary
         uses: actions/upload-release-asset@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: build/wings_linux_amd64
+          asset_path: dist/wings_linux_amd64
           asset_name: wings_linux_amd64
           asset_content_type: application/octet-stream
-      - name: Upload arm64 Binary
+
+      - name: Upload arm64 binary
         uses: actions/upload-release-asset@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: build/wings_linux_arm64
+          asset_path: dist/wings_linux_arm64
           asset_name: wings_linux_arm64
           asset_content_type: application/octet-stream
+
       - name: Upload checksum
         uses: actions/upload-release-asset@v1
         env:

.gitignore

@@ -23,6 +23,8 @@
 # ignore configuration file
 /config.yml
 /config*.yml
+/config.yaml
+/config*.yaml
 
 # Ignore Vagrant stuff
 /.vagrant

CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## v1.11.0-rc.1
+### Changed
+* Wings release versions will now follow the major and minor version of the panel.
+* Transfers no longer buffer to disk, instead they are fully streamed with only a small amount of memory used for buffering.
+* Release binaries are no longer compressed with UPX.
+
+### Fixed
+* Wings can be run with podman instead of Docker, this is still experimental and not recommended for production use.
+* Archive progress is now reported correctly.
+* Labels for containers can now be set by the Panel.
+
+## v1.7.2
+### Fixed
+* The S3 backup driver now supports Cloudflare R2
+
+### Added
+* During a server transfer, there is a new "Archiving" status that outputs the progress of creating the server transfer archive.
+* Adds a configuration option to control the list of trusted proxies that can be used to determine the client IP address.
+* Adds a configuration option to control the Docker username space setting when Wings creates containers.
+
+### Changed
+* Releases are now built using `Go 1.18` — the minimum version required to build Wings is now `Go 1.18`.
+
+## v1.7.1
+### Fixed
+* YAML parser has been updated to fix some strange issues
+
+### Added
+* Added `Force Outgoing IP` option for servers to ensure outgoing traffic uses the server's IP address
+* Adds an option to control the level of gzip compression for backups
+
+## v1.7.0
+### Fixed
+* Fixes multi-platform support for Wings' Docker image.
+
+### Added
+* Adds support for tracking of SFTP actions, power actions, server commands, and file uploads by utilizing a local SQLite database and processing events before sending them to the Panel.
+* Adds support for configuring the MTU on the `pterodactyl0` network.
+
 ## v1.6.4
 ### Fixed
 * Fixes a bug causing CPU limiting to not be properly applied to servers.

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1 (Build)
-FROM golang:1.17-alpine AS builder
+FROM golang:1.18-alpine AS builder
 
 ARG VERSION
 RUN apk add --update --no-cache git make

Makefile

@@ -14,9 +14,6 @@ rmdebug:
 	go build -gcflags "all=-N -l" -ldflags="-X github.com/pterodactyl/wings/system.Version=$(GIT_HEAD)" -race
 	sudo dlv --listen=:2345 --headless=true --api-version=2 --accept-multiclient exec ./wings -- --debug --ignore-certificate-errors --config config.yml
 
-compress:
-	upx --brute build/wings_*
-
 cross-build: clean build compress
 
 clean:

README.md

@@ -14,7 +14,7 @@ dependencies, and allowing users to authenticate with the same credentials they
 
 ## Sponsors
 I would like to extend my sincere thanks to the following sponsors for helping find Pterodactyl's developement.
-[Interested in becoming a sponsor?](https://github.com/sponsors/DaneEveritt)
+[Interested in becoming a sponsor?](https://github.com/sponsors/matthewpi)
 
 | Company | About |
 | ------- | ----- |

cmd/diagnostics.go

@@ -58,14 +58,14 @@ func newDiagnosticsCommand() *cobra.Command {
 	return command
 }
 
-// diagnosticsCmdRun collects diagnostics about wings, it's configuration and the node.
+// diagnosticsCmdRun collects diagnostics about wings, its configuration and the node.
 // We collect:
 // - wings and docker versions
 // - relevant parts of daemon configuration
 // - the docker debug output
 // - running docker containers
 // - logs
-func diagnosticsCmdRun(cmd *cobra.Command, args []string) {
+func diagnosticsCmdRun(*cobra.Command, []string) {
 	questions := []*survey.Question{
 		{
 			Name:   "IncludeEndpoints",

cmd/root.go

@@ -5,8 +5,6 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
-	"github.com/pterodactyl/wings/internal/cron"
-	"github.com/pterodactyl/wings/internal/database"
 	log2 "log"
 	"net/http"
 	_ "net/http/pprof"
@@ -30,6 +28,8 @@ import (
 
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/environment"
+	"github.com/pterodactyl/wings/internal/cron"
+	"github.com/pterodactyl/wings/internal/database"
 	"github.com/pterodactyl/wings/loggers/cli"
 	"github.com/pterodactyl/wings/remote"
 	"github.com/pterodactyl/wings/router"
@@ -81,7 +81,7 @@ func init() {
 	rootCommand.Flags().Bool("pprof", false, "if the pprof profiler should be enabled. The profiler will bind to localhost:6060 by default")
 	rootCommand.Flags().Int("pprof-block-rate", 0, "enables block profile support, may have performance impacts")
 	rootCommand.Flags().Int("pprof-port", 6060, "If provided with --pprof, the port it will run on")
-	rootCommand.Flags().Bool("auto-tls", false, "pass in order to have wings generate and manage it's own SSL certificates using Let's Encrypt")
+	rootCommand.Flags().Bool("auto-tls", false, "pass in order to have wings generate and manage its own SSL certificates using Let's Encrypt")
 	rootCommand.Flags().String("tls-hostname", "", "required with --auto-tls, the FQDN for the generated SSL certificate")
 	rootCommand.Flags().Bool("ignore-certificate-errors", false, "ignore certificate verification errors when executing API calls")
 
@@ -110,7 +110,6 @@ func rootCmdRun(cmd *cobra.Command, _ []string) {
 		log.WithField("error", err).Fatal("failed to configure system directories for pterodactyl")
 		return
 	}
-	log.WithField("username", config.Get().System.User).Info("checking for pterodactyl system user")
 	if err := config.EnsurePterodactylUser(); err != nil {
 		log.WithField("error", err).Fatal("failed to create pterodactyl system user")
 	}
@@ -162,7 +161,7 @@ func rootCmdRun(cmd *cobra.Command, _ []string) {
 	ticker := time.NewTicker(time.Minute)
 	// Every minute, write the current server states to the disk to allow for a more
 	// seamless hard-reboot process in which wings will re-sync server states based
-	// on it's last tracked state.
+	// on its last tracked state.
 	go func() {
 		for {
 			select {
@@ -363,7 +362,7 @@ func rootCmdRun(cmd *cobra.Command, _ []string) {
 		return
 	}
 
-	// Check if main http server should run with TLS. Otherwise reset the TLS
+	// Check if main http server should run with TLS. Otherwise, reset the TLS
 	// config on the server and then serve it over normal HTTP.
 	if api.Ssl.Enabled {
 		if err := s.ListenAndServeTLS(api.Ssl.CertificateFile, api.Ssl.KeyFile); err != nil {

config/config.go

@@ -16,8 +16,8 @@ import (
 	"time"
 
 	"emperror.dev/errors"
+	"github.com/acobaugh/osrelease"
 	"github.com/apex/log"
-	"github.com/cobaugh/osrelease"
 	"github.com/creasty/defaults"
 	"github.com/gbrlsnchs/jwt/v3"
 	"gopkg.in/yaml.v2"
@@ -91,6 +91,9 @@ type ApiConfiguration struct {
 
 	// The maximum size for files uploaded through the Panel in MB.
 	UploadLimit int64 `default:"100" json:"upload_limit" yaml:"upload_limit"`
+
+	// A list of IP address of proxies that may send a X-Forwarded-For header to set the true clients IP
+	TrustedProxies []string `json:"trusted_proxies" yaml:"trusted_proxies"`
 }
 
 // RemoteQueryConfiguration defines the configuration settings for remote requests
@@ -149,9 +152,23 @@ type SystemConfiguration struct {
 	// Definitions for the user that gets created to ensure that we can quickly access
 	// this information without constantly having to do a system lookup.
 	User struct {
-		Uid int
+		// Rootless controls settings related to rootless container daemons.
-		Gid int
+		Rootless struct {
-	}
+			// Enabled controls whether rootless containers are enabled.
+			Enabled bool `yaml:"enabled" default:"false"`
+			// ContainerUID controls the UID of the user inside the container.
+			// This should likely be set to 0 so the container runs as the user
+			// running Wings.
+			ContainerUID int `yaml:"container_uid" default:"0"`
+			// ContainerGID controls the GID of the user inside the container.
+			// This should likely be set to 0 so the container runs as the user
+			// running Wings.
+			ContainerGID int `yaml:"container_gid" default:"0"`
+		} `yaml:"rootless"`
+
+		Uid int `yaml:"uid"`
+		Gid int `yaml:"gid"`
+	} `yaml:"user"`
 
 	// The amount of time in seconds that can elapse before a server's disk space calculation is
 	// considered stale and a re-check should occur. DANGER: setting this value too low can seriously
@@ -167,10 +184,10 @@ type SystemConfiguration struct {
 	// being sent to the Panel. By default this will send activity collected over the last minute. Keep
 	// in mind that only a fixed number of activity log entries, defined by ActivitySendCount, will be sent
 	// in each run.
-	ActivitySendInterval int64 `default:"60" yaml:"activity_send_interval"`
+	ActivitySendInterval int `default:"60" yaml:"activity_send_interval"`
 
 	// ActivitySendCount is the number of activity events to send per batch.
-	ActivitySendCount int64 `default:"100" yaml:"activity_send_count"`
+	ActivitySendCount int `default:"100" yaml:"activity_send_count"`
 
 	// If set to true, file permissions for a server will be checked when the process is
 	// booted. This can cause boot delays if the server has a large amount of files. In most
@@ -219,6 +236,15 @@ type Backups struct {
 	//
 	// Defaults to 0 (unlimited)
 	WriteLimit int `default:"0" yaml:"write_limit"`
+
+	// CompressionLevel determines how much backups created by wings should be compressed.
+	//
+	// "none" -> no compression will be applied
+	// "best_speed" -> uses gzip level 1 for fast speed
+	// "best_compression" -> uses gzip level 9 for minimal disk space useage
+	//
+	// Defaults to "best_speed" (level 1)
+	CompressionLevel string `default:"best_speed" yaml:"compression_level"`
 }
 
 type Transfers struct {
@@ -413,6 +439,19 @@ func EnsurePterodactylUser() error {
 		return nil
 	}
 
+	if _config.System.User.Rootless.Enabled {
+		log.Info("rootless mode is enabled, skipping user creation...")
+		u, err := user.Current()
+		if err != nil {
+			return err
+		}
+		_config.System.Username = u.Username
+		_config.System.User.Uid = system.MustInt(u.Uid)
+		_config.System.User.Gid = system.MustInt(u.Gid)
+		return nil
+	}
+
+	log.WithField("username", _config.System.Username).Info("checking for pterodactyl system user")
 	u, err := user.Lookup(_config.System.Username)
 	// If an error is returned but it isn't the unknown user error just abort
 	// the process entirely. If we did find a user, return it immediately.

config/config_docker.go

@@ -5,6 +5,7 @@ import (
 	"sort"
 
 	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/goccy/go-json"
 )
 
@@ -78,6 +79,30 @@ type DockerConfiguration struct {
 	Overhead Overhead `json:"overhead" yaml:"overhead"`
 
 	UsePerformantInspect bool `default:"true" json:"use_performant_inspect" yaml:"use_performant_inspect"`
+
+	// Sets the user namespace mode for the container when user namespace remapping option is
+	// enabled.
+	//
+	// If the value is blank, the daemon's user namespace remapping configuration is used,
+	// if the value is "host", then the pterodactyl containers are started with user namespace
+	// remapping disabled
+	UsernsMode string `default:"" json:"userns_mode" yaml:"userns_mode"`
+
+	LogConfig struct {
+		Type   string            `default:"local" json:"type" yaml:"type"`
+		Config map[string]string `default:"{\"max-size\":\"5m\",\"max-file\":\"1\",\"compress\":\"false\",\"mode\":\"non-blocking\"}" json:"config" yaml:"config"`
+	} `json:"log_config" yaml:"log_config"`
+}
+
+func (c DockerConfiguration) ContainerLogConfig() container.LogConfig {
+	if c.LogConfig.Type == "" {
+		return container.LogConfig{}
+	}
+
+	return container.LogConfig{
+		Type:   c.LogConfig.Type,
+		Config: c.LogConfig.Config,
+	}
 }
 
 // RegistryConfiguration defines the authentication credentials for a given

environment/allocations.go

@@ -12,6 +12,11 @@ import (
 // Defines the allocations available for a given server. When using the Docker environment
 // driver these correspond to mappings for the container that allow external connections.
 type Allocations struct {
+	// ForceOutgoingIP causes a dedicated bridge network to be created for the
+	// server with a special option, causing Docker to SNAT outgoing traffic to
+	// the DefaultMapping's IP. This is important to servers which rely on external
+	// services that check the IP of the server (Source Engine servers, for example).
+	ForceOutgoingIP bool `json:"force_outgoing_ip"`
 	// Defines the default allocation that should be used for this server. This is
 	// what will be used for {SERVER_IP} and {SERVER_PORT} when modifying configuration
 	// files or the startup arguments for a server.

environment/config.go

@@ -8,6 +8,7 @@ type Settings struct {
 	Mounts      []Mount
 	Allocations Allocations
 	Limits      Limits
+	Labels      map[string]string
 }
 
 // Defines the actual configuration struct for the environment with all of the settings
@@ -68,6 +69,14 @@ func (c *Configuration) Mounts() []Mount {
 	return c.settings.Mounts
 }
 
+// Labels returns the container labels associated with this instance.
+func (c *Configuration) Labels() map[string]string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	return c.settings.Labels
+}
+
 // Returns the environment variables associated with this instance.
 func (c *Configuration) EnvironmentVariables() []string {
 	c.mu.RLock()

environment/docker.go

@@ -41,12 +41,12 @@ func ConfigureDocker(ctx context.Context) error {
 	nw := config.Get().Docker.Network
 	resource, err := cli.NetworkInspect(ctx, nw.Name, types.NetworkInspectOptions{})
 	if err != nil {
-		if client.IsErrNotFound(err) {
+		if !client.IsErrNotFound(err) {
-			log.Info("creating missing pterodactyl0 interface, this could take a few seconds...")
-			if err := createDockerNetwork(ctx, cli); err != nil {
 			return err
 		}
-		} else {
+
+		log.Info("creating missing pterodactyl0 interface, this could take a few seconds...")
+		if err := createDockerNetwork(ctx, cli); err != nil {
 			return err
 		}
 	}

environment/docker/api.go

@@ -14,6 +14,7 @@ import (
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/errdefs"
 	"github.com/goccy/go-json"
+
 	"github.com/pterodactyl/wings/config"
 )
 

environment/docker/container.go

@@ -16,7 +16,6 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/client"
-	"github.com/docker/docker/daemon/logger/local"
 
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/environment"
@@ -43,17 +42,13 @@ func (nw noopWriter) Write(b []byte) (int, error) {
 //
 // Calling this function will poll resources for the container in the background
 // until the container is stopped. The context provided to this function is used
-// for the purposes of attaching to the container, a seecond context is created
+// for the purposes of attaching to the container, a second context is created
 // within the function for managing polling.
 func (e *Environment) Attach(ctx context.Context) error {
 	if e.IsAttached() {
 		return nil
 	}
 
-	if err := e.followOutput(); err != nil {
-		return err
-	}
-
 	opts := types.ContainerAttachOptions{
 		Stdin:  true,
 		Stdout: true,
@@ -90,20 +85,13 @@ func (e *Environment) Attach(ctx context.Context) error {
 			}
 		}()
 
-		// Block the completion of this routine until the container is no longer running. This allows
+		if err := system.ScanReader(e.stream.Reader, func(v []byte) {
-		// the pollResources function to run until it needs to be stopped. Because the container
+			e.logCallbackMx.Lock()
-		// can be polled for resource usage, even when stopped, we need to have this logic present
+			defer e.logCallbackMx.Unlock()
-		// in order to cancel the context and therefore stop the routine that is spawned.
+			e.logCallback(v)
-		//
+		}); err != nil && err != io.EOF {
-		// For now, DO NOT use client#ContainerWait from the Docker package. There is a nasty
+			log.WithField("error", err).WithField("container_id", e.Id).Warn("error processing scanner line in console output")
-		// bug causing containers to hang on deletion and cause servers to lock up on the system.
+			return
-		//
-		// This weird code isn't intuitive, but it keeps the function from ending until the container
-		// is stopped and therefore the stream reader ends up closed.
-		// @see https://github.com/moby/moby/issues/41827
-		c := new(noopWriter)
-		if _, err := io.Copy(c, e.stream.Reader); err != nil {
-			e.log().WithField("error", err).Error("could not copy from environment stream to noop writer")
 		}
 	}()
 
@@ -147,10 +135,12 @@ func (e *Environment) InSituUpdate() error {
 // currently available for it. If the container already exists it will be
 // returned.
 func (e *Environment) Create() error {
+	ctx := context.Background()
+
 	// If the container already exists don't hit the user with an error, just return
 	// the current information about it which is what we would do when creating the
 	// container anyways.
-	if _, err := e.ContainerInspect(context.Background()); err == nil {
+	if _, err := e.ContainerInspect(ctx); err == nil {
 		return nil
 	} else if !client.IsErrNotFound(err) {
 		return errors.Wrap(err, "environment/docker: failed to inspect container")
@@ -161,21 +151,30 @@ func (e *Environment) Create() error {
 		return errors.WithStackIf(err)
 	}
 
+	cfg := config.Get()
 	a := e.Configuration.Allocations()
-
 	evs := e.Configuration.EnvironmentVariables()
 	for i, v := range evs {
 		// Convert 127.0.0.1 to the pterodactyl0 network interface if the environment is Docker
 		// so that the server operates as expected.
 		if v == "SERVER_IP=127.0.0.1" {
-			evs[i] = "SERVER_IP=" + config.Get().Docker.Network.Interface
+			evs[i] = "SERVER_IP=" + cfg.Docker.Network.Interface
 		}
 	}
 
+	// Merge user-provided labels with system labels
+	confLabels := e.Configuration.Labels()
+	labels := make(map[string]string, 2+len(confLabels))
+
+	for key := range confLabels {
+		labels[key] = confLabels[key]
+	}
+	labels["Service"] = "Pterodactyl"
+	labels["ContainerType"] = "server_process"
+
 	conf := &container.Config{
 		Hostname:     e.Id,
-		Domainname:   config.Get().Docker.Domainname,
+		Domainname:   cfg.Docker.Domainname,
-		User:         strconv.Itoa(config.Get().System.User.Uid) + ":" + strconv.Itoa(config.Get().System.User.Gid),
 		AttachStdin:  true,
 		AttachStdout: true,
 		AttachStderr: true,
@@ -184,13 +183,44 @@ func (e *Environment) Create() error {
 		ExposedPorts: a.Exposed(),
 		Image:        strings.TrimPrefix(e.meta.Image, "~"),
 		Env:          e.Configuration.EnvironmentVariables(),
-		Labels: map[string]string{
+		Labels:       labels,
-			"Service":       "Pterodactyl",
-			"ContainerType": "server_process",
-		},
 	}
 
-	tmpfsSize := strconv.Itoa(int(config.Get().Docker.TmpfsSize))
+	// Set the user running the container properly depending on what mode we are operating in.
+	if cfg.System.User.Rootless.Enabled {
+		conf.User = fmt.Sprintf("%d:%d", cfg.System.User.Rootless.ContainerUID, cfg.System.User.Rootless.ContainerGID)
+	} else {
+		conf.User = strconv.Itoa(cfg.System.User.Uid) + ":" + strconv.Itoa(cfg.System.User.Gid)
+	}
+
+	networkMode := container.NetworkMode(cfg.Docker.Network.Mode)
+	if a.ForceOutgoingIP {
+		e.log().Debug("environment/docker: forcing outgoing IP address")
+		networkName := strings.ReplaceAll(e.Id, "-", "")
+		networkMode = container.NetworkMode(networkName)
+
+		if _, err := e.client.NetworkInspect(ctx, networkName, types.NetworkInspectOptions{}); err != nil {
+			if !client.IsErrNotFound(err) {
+				return err
+			}
+
+			if _, err := e.client.NetworkCreate(ctx, networkName, types.NetworkCreate{
+				Driver:     "bridge",
+				EnableIPv6: false,
+				Internal:   false,
+				Attachable: false,
+				Ingress:    false,
+				ConfigOnly: false,
+				Options: map[string]string{
+					"encryption": "false",
+					"com.docker.network.bridge.default_bridge": "false",
+					"com.docker.network.host_ipv4":             a.DefaultMapping.Ip,
+				},
+			}); err != nil {
+				return err
+			}
+		}
+	}
 
 	hostConf := &container.HostConfig{
 		PortBindings: a.DockerBindings(),
@@ -202,28 +232,20 @@ func (e *Environment) Create() error {
 		// Configure the /tmp folder mapping in containers. This is necessary for some
 		// games that need to make use of it for downloads and other installation processes.
 		Tmpfs: map[string]string{
-			"/tmp": "rw,exec,nosuid,size=" + tmpfsSize + "M",
+			"/tmp": "rw,exec,nosuid,size=" + strconv.Itoa(int(cfg.Docker.TmpfsSize)) + "M",
 		},
 
 		// Define resource limits for the container based on the data passed through
 		// from the Panel.
 		Resources: e.Configuration.Limits().AsContainerResources(),
 
-		DNS: config.Get().Docker.Network.Dns,
+		DNS: cfg.Docker.Network.Dns,
 
 		// Configure logging for the container to make it easier on the Daemon to grab
 		// the server output. Ensure that we don't use too much space on the host machine
 		// since we only need it for the last few hundred lines of output and don't care
 		// about anything else in it.
-		LogConfig: container.LogConfig{
+		LogConfig: cfg.Docker.ContainerLogConfig(),
-			Type: local.Name,
-			Config: map[string]string{
-				"max-size": "5m",
-				"max-file": "1",
-				"compress": "false",
-				"mode":     "non-blocking",
-			},
-		},
 
 		SecurityOpt:    []string{"no-new-privileges"},
 		ReadonlyRootfs: true,
@@ -231,10 +253,11 @@ func (e *Environment) Create() error {
 			"setpcap", "mknod", "audit_write", "net_raw", "dac_override",
 			"fowner", "fsetid", "net_bind_service", "sys_chroot", "setfcap",
 		},
-		NetworkMode: container.NetworkMode(config.Get().Docker.Network.Mode),
+		NetworkMode: networkMode,
+		UsernsMode:  container.UsernsMode(cfg.Docker.UsernsMode),
 	}
 
-	if _, err := e.client.ContainerCreate(context.Background(), conf, hostConf, nil, nil, e.Id); err != nil {
+	if _, err := e.client.ContainerCreate(ctx, conf, hostConf, nil, nil, e.Id); err != nil {
 		return errors.Wrap(err, "environment/docker: failed to create container")
 	}
 
@@ -312,59 +335,6 @@ func (e *Environment) Readlog(lines int) ([]string, error) {
 	return out, nil
 }
 
-// Attaches to the log for the container. This avoids us missing crucial output
-// that happens in the split seconds before the code moves from 'Starting' to
-// 'Attaching' on the process.
-func (e *Environment) followOutput() error {
-	if exists, err := e.Exists(); !exists {
-		if err != nil {
-			return err
-		}
-		return errors.New(fmt.Sprintf("no such container: %s", e.Id))
-	}
-
-	opts := types.ContainerLogsOptions{
-		ShowStderr: true,
-		ShowStdout: true,
-		Follow:     true,
-		Since:      time.Now().Format(time.RFC3339),
-	}
-
-	reader, err := e.client.ContainerLogs(context.Background(), e.Id, opts)
-	if err != nil {
-		return err
-	}
-
-	go e.scanOutput(reader)
-
-	return nil
-}
-
-func (e *Environment) scanOutput(reader io.ReadCloser) {
-	defer reader.Close()
-
-	if err := system.ScanReader(reader, func(v []byte) {
-		e.logCallbackMx.Lock()
-		defer e.logCallbackMx.Unlock()
-		e.logCallback(v)
-	}); err != nil && err != io.EOF {
-		log.WithField("error", err).WithField("container_id", e.Id).Warn("error processing scanner line in console output")
-		return
-	}
-
-	// Return here if the server is offline or currently stopping.
-	if e.State() == environment.ProcessStoppingState || e.State() == environment.ProcessOfflineState {
-		return
-	}
-
-	// Close the current reader before starting a new one, the defer will still run,
-	// but it will do nothing if we already closed the stream.
-	_ = reader.Close()
-
-	// Start following the output of the server again.
-	go e.followOutput()
-}
-
 // Pulls the image from Docker. If there is an error while pulling the image
 // from the source but the image already exists locally, we will report that
 // error to the logger but continue with the process.

environment/docker/environment.go

@@ -10,6 +10,7 @@ import (
 	"github.com/apex/log"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/client"
+
 	"github.com/pterodactyl/wings/environment"
 	"github.com/pterodactyl/wings/events"
 	"github.com/pterodactyl/wings/remote"
@@ -95,7 +96,7 @@ func (e *Environment) SetStream(s *types.HijackedResponse) {
 	e.mu.Unlock()
 }
 
-// IsAttached determine if the this process is currently attached to the
+// IsAttached determines if this process is currently attached to the
 // container instance by checking if the stream is nil or not.
 func (e *Environment) IsAttached() bool {
 	e.mu.RLock()

environment/docker/power.go

@@ -39,7 +39,7 @@ func (e *Environment) OnBeforeStart(ctx context.Context) error {
 	//
 	// This won't actually run an installation process however, it is just here to ensure the
 	// environment gets created properly if it is missing and the server is started. We're making
-	// an assumption that all of the files will still exist at this point.
+	// an assumption that all the files will still exist at this point.
 	if err := e.Create(); err != nil {
 		return err
 	}
@@ -107,7 +107,7 @@ func (e *Environment) Start(ctx context.Context) error {
 	}
 
 	// If we cannot start & attach to the container in 30 seconds something has gone
-	// quite sideways and we should stop trying to avoid a hanging situation.
+	// quite sideways, and we should stop trying to avoid a hanging situation.
 	actx, cancel := context.WithTimeout(ctx, time.Second*30)
 	defer cancel()
 

environment/docker/stats.go

@@ -134,7 +134,11 @@ func calculateDockerAbsoluteCpu(pStats types.CPUStats, stats types.CPUStats) flo
 
 	percent := 0.0
 	if systemDelta > 0.0 && cpuDelta > 0.0 {
-		percent = (cpuDelta / systemDelta) * cpus * 100.0
+		percent = (cpuDelta / systemDelta) * 100.0
+
+		if cpus > 0 {
+			percent *= cpus
+		}
 	}
 
 	return math.Round(percent*1000) / 1000

events/events.go

@@ -5,6 +5,7 @@ import (
 
 	"emperror.dev/errors"
 	"github.com/goccy/go-json"
+
 	"github.com/pterodactyl/wings/system"
 )
 

go.mod

@@ -1,129 +1,124 @@
 module github.com/pterodactyl/wings
 
-go 1.17
+go 1.18
 
 require (
 	emperror.dev/errors v0.8.1
-	github.com/AlecAivazis/survey/v2 v2.3.4
+	github.com/AlecAivazis/survey/v2 v2.3.6
 	github.com/Jeffail/gabs/v2 v2.6.1
 	github.com/NYTimes/logrotate v1.0.0
+	github.com/acobaugh/osrelease v0.1.0
 	github.com/apex/log v1.9.0
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/beevik/etree v1.1.0
 	github.com/buger/jsonparser v1.1.1
-	github.com/cenkalti/backoff/v4 v4.1.2
+	github.com/cenkalti/backoff/v4 v4.1.3
-	github.com/cobaugh/osrelease v0.0.0-20181218015638-a93a0a55a249
+	github.com/creasty/defaults v1.6.0
-	github.com/creasty/defaults v1.5.2
+	github.com/docker/docker v20.10.18+incompatible
-	github.com/docker/docker v20.10.14+incompatible
 	github.com/docker/go-connections v0.4.0
 	github.com/fatih/color v1.13.0
 	github.com/franela/goblin v0.0.0-20200825194134-80c0062ed6cd
-	github.com/gabriel-vasile/mimetype v1.4.0
+	github.com/gabriel-vasile/mimetype v1.4.1
-	github.com/gammazero/workerpool v1.1.2
+	github.com/gammazero/workerpool v1.1.3
 	github.com/gbrlsnchs/jwt/v3 v3.0.1
-	github.com/gin-gonic/gin v1.7.7
+	github.com/gin-gonic/gin v1.8.1
+	github.com/glebarez/sqlite v1.4.8
+	github.com/go-co-op/gocron v1.17.0
+	github.com/goccy/go-json v0.9.11
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/websocket v1.5.0
 	github.com/iancoleman/strcase v0.2.0
-	github.com/icza/dyno v0.0.0-20210726202311-f1bafe5d9996
+	github.com/icza/dyno v0.0.0-20220812133438-f0b6f8a18845
-	github.com/juju/ratelimit v1.0.1
+	github.com/juju/ratelimit v1.0.2
-	github.com/karrick/godirwalk v1.16.1
+	github.com/karrick/godirwalk v1.17.0
+	github.com/klauspost/compress v1.15.11
 	github.com/klauspost/pgzip v1.2.5
 	github.com/magiconair/properties v1.8.6
-	github.com/mattn/go-colorable v0.1.12
+	github.com/mattn/go-colorable v0.1.13
-	github.com/mholt/archiver/v3 v3.5.1
+	github.com/mholt/archiver/v4 v4.0.0-alpha.7
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db
 	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/pkg/sftp v1.13.4
+	github.com/pkg/sftp v1.13.5
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
-	github.com/spf13/cobra v1.4.0
+	github.com/spf13/cobra v1.5.0
-	github.com/stretchr/testify v1.7.5
+	github.com/stretchr/testify v1.8.0
-	golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064
+	golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
+	golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0
-	gopkg.in/ini.v1 v1.66.4
+	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.1
+	gorm.io/gorm v1.23.10
 )
 
-require (
-	github.com/glebarez/sqlite v1.4.6
-	github.com/go-co-op/gocron v1.15.0
-	github.com/goccy/go-json v0.9.6
-	github.com/klauspost/compress v1.15.1
-	gorm.io/gorm v1.23.8
-)
-
-require golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect
-
 require (
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
-	github.com/Microsoft/go-winio v0.5.2 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
-	github.com/Microsoft/hcsshim v0.9.2 // indirect
+	github.com/Microsoft/hcsshim v0.9.4 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/containerd/containerd v1.6.2 // indirect
 	github.com/containerd/fifo v1.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.1+incompatible // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/fsnotify/fsnotify v1.5.1 // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/gammazero/deque v0.1.1 // indirect
+	github.com/gammazero/deque v0.2.0 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
-	github.com/glebarez/go-sqlite v1.17.3 // indirect
+	github.com/glebarez/go-sqlite v1.19.1 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
-	github.com/go-playground/validator/v10 v10.10.1 // indirect
+	github.com/go-playground/validator/v10 v10.11.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/gorilla/mux v1.7.4 // indirect
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
-	github.com/magefile/mage v1.13.0 // indirect
+	github.com/magefile/mage v1.14.0 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
-	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
+	github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/nwaples/rardecode v1.1.3 // indirect
+	github.com/nwaples/rardecode/v2 v2.0.0-beta.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
-	github.com/pierrec/lz4/v4 v4.1.14 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
+	github.com/pierrec/lz4/v4 v4.1.17 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.12.1 // indirect
+	github.com/prometheus/client_golang v1.13.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.32.1 // indirect
+	github.com/prometheus/common v0.37.0 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20220927061507-ef77025ab5aa // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/therootcompany/xz v1.0.1 // indirect
 	github.com/ugorji/go/codec v1.2.7 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
-	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.8.0 // indirect
-	golang.org/x/net v0.0.0-20220225172249-27dd8689420f // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
+	golang.org/x/net v0.0.0-20221004154528-8021a29435af // indirect
+	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
+	golang.org/x/term v0.0.0-20220919170432-7a66f970e087 // indirect
 	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20220224211638-0e9765cccd65 // indirect
+	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.org/x/tools v0.1.12 // indirect
-	google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	modernc.org/libc v1.20.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/libc v1.16.17 // indirect
+	modernc.org/memory v1.4.0 // indirect
-	modernc.org/mathutil v1.4.1 // indirect
+	modernc.org/sqlite v1.19.1 // indirect
-	modernc.org/memory v1.1.1 // indirect
-	modernc.org/sqlite v1.17.3 // indirect
 )

internal/cron/activity_cron.go

@@ -2,7 +2,9 @@ package cron
 
 import (
 	"context"
+
 	"emperror.dev/errors"
+
 	"github.com/pterodactyl/wings/internal/database"
 	"github.com/pterodactyl/wings/internal/models"
 	"github.com/pterodactyl/wings/server"
@@ -12,7 +14,7 @@ import (
 type activityCron struct {
 	mu      *system.AtomicBool
 	manager *server.Manager
-	max     int64
+	max     int
 }
 
 // Run executes the cronjob and ensures we fetch and send all of the stored activity to the
@@ -30,7 +32,7 @@ func (ac *activityCron) Run(ctx context.Context) error {
 	var activity []models.Activity
 	tx := database.Instance().WithContext(ctx).
 		Where("event NOT LIKE ?", "server:sftp.%").
-		Limit(int(ac.max)).
+		Limit(ac.max).
 		Find(&activity)
 
 	if tx.Error != nil {

internal/cron/cron.go

@@ -2,13 +2,15 @@ package cron
 
 import (
 	"context"
+	"time"
+
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/go-co-op/gocron"
+
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/server"
 	"github.com/pterodactyl/wings/system"
-	"time"
 )
 
 const ErrCronRunning = errors.Sentinel("cron: job already running")
@@ -22,7 +24,7 @@ func Scheduler(ctx context.Context, m *server.Manager) (*gocron.Scheduler, error
 	if !o.SwapIf(true) {
 		return nil, errors.New("cron: cannot call scheduler more than once in application lifecycle")
 	}
-	l, err := time.LoadLocation(config.Get().System.Timezone)
+	location, err := time.LoadLocation(config.Get().System.Timezone)
 	if err != nil {
 		return nil, errors.Wrap(err, "cron: failed to parse configured system timezone")
 	}
@@ -39,23 +41,30 @@ func Scheduler(ctx context.Context, m *server.Manager) (*gocron.Scheduler, error
 		max:     config.Get().System.ActivitySendCount,
 	}
 
-	s := gocron.NewScheduler(l)
+	s := gocron.NewScheduler(location)
-	_, _ = s.Tag("activity").Every(config.Get().System.ActivitySendInterval).Seconds().Do(func() {
+	l := log.WithField("subsystem", "cron")
+
+	interval := time.Duration(config.Get().System.ActivitySendInterval) * time.Second
+	l.WithField("interval", interval).Info("configuring system crons")
+
+	_, _ = s.Tag("activity").Every(interval).Do(func() {
+		l.WithField("cron", "activity").Debug("sending internal activity events to Panel")
 		if err := activity.Run(ctx); err != nil {
 			if errors.Is(err, ErrCronRunning) {
-				log.WithField("cron", "activity").Warn("activity process is already running, skipping...")
+				l.WithField("cron", "activity").Warn("activity process is already running, skipping...")
 			} else {
-				log.WithField("cron", "activity").WithField("error", err).Error("activity process failed to execute")
+				l.WithField("cron", "activity").WithField("error", err).Error("activity process failed to execute")
 			}
 		}
 	})
 
-	_, _ = s.Tag("sftp").Every(config.Get().System.ActivitySendInterval).Seconds().Do(func() {
+	_, _ = s.Tag("sftp").Every(interval).Do(func() {
+		l.WithField("cron", "sftp").Debug("sending sftp events to Panel")
 		if err := sftp.Run(ctx); err != nil {
 			if errors.Is(err, ErrCronRunning) {
-				log.WithField("cron", "sftp").Warn("sftp events process already running, skipping...")
+				l.WithField("cron", "sftp").Warn("sftp events process already running, skipping...")
 			} else {
-				log.WithField("cron", "sftp").WithField("error", err).Error("sftp events process failed to execute")
+				l.WithField("cron", "sftp").WithField("error", err).Error("sftp events process failed to execute")
 			}
 		}
 	})

internal/cron/sftp_cron.go

@@ -2,19 +2,20 @@ package cron
 
 import (
 	"context"
+	"reflect"
+
 	"emperror.dev/errors"
+
 	"github.com/pterodactyl/wings/internal/database"
 	"github.com/pterodactyl/wings/internal/models"
 	"github.com/pterodactyl/wings/server"
 	"github.com/pterodactyl/wings/system"
-	"gorm.io/gorm"
-	"reflect"
 )
 
 type sftpCron struct {
 	mu      *system.AtomicBool
 	manager *server.Manager
-	max     int64
+	max     int
 }
 
 type mapKey struct {
@@ -52,7 +53,7 @@ func (sc *sftpCron) Run(ctx context.Context) error {
 	events := &eventMap{
 		m:   map[mapKey]*models.Activity{},
 		ids: []int{},
-		max: int(sc.max),
+		max: sc.max,
 	}
 
 	for {
@@ -79,17 +80,13 @@ func (sc *sftpCron) Run(ctx context.Context) error {
 	if len(events.m) == 0 {
 		return nil
 	}
-
+	if err := sc.manager.Client().SendActivityLogs(ctx, events.Elements()); err != nil {
-	err = database.Instance().Transaction(func(tx *gorm.DB) error {
+		return errors.Wrap(err, "failed to send sftp activity logs to Panel")
-		tx.Where("id IN ?", events.ids).Delete(&models.Activity{})
-		if tx.Error != nil {
-			return tx.Error
 	}
-
+	if tx := database.Instance().Where("id IN ?", events.ids).Delete(&models.Activity{}); tx.Error != nil {
-		return sc.manager.Client().SendActivityLogs(ctx, events.Elements())
+		return errors.WithStack(tx.Error)
-	})
+	}
-
+	return nil
-	return errors.WithStack(err)
 }
 
 // fetchRecords returns a group of activity events starting at the given offset. This is used
@@ -102,7 +99,7 @@ func (sc *sftpCron) fetchRecords(ctx context.Context, offset int) (activity []mo
 		Where("event LIKE ?", "server:sftp.%").
 		Order("event DESC").
 		Offset(offset).
-		Limit(int(sc.max)).
+		Limit(sc.max).
 		Find(&activity)
 	if tx.Error != nil {
 		err = errors.WithStack(tx.Error)

internal/database/database.go

@@ -1,17 +1,23 @@
 package database
 
 import (
+	"path/filepath"
+	"time"
+
 	"emperror.dev/errors"
 	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/internal/models"
 	"github.com/pterodactyl/wings/system"
-	"gorm.io/gorm"
-	"path/filepath"
 )
 
-var o system.AtomicBool
+var (
-var db *gorm.DB
+	o  system.AtomicBool
+	db *gorm.DB
+)
 
 // Initialize configures the local SQLite database for Wings and ensures that the models have
 // been fully migrated.
@@ -20,11 +26,25 @@ func Initialize() error {
 		panic("database: attempt to initialize more than once during application lifecycle")
 	}
 	p := filepath.Join(config.Get().System.RootDirectory, "wings.db")
-	instance, err := gorm.Open(sqlite.Open(p), &gorm.Config{})
+	instance, err := gorm.Open(sqlite.Open(p), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
 	if err != nil {
 		return errors.Wrap(err, "database: could not open database file")
 	}
 	db = instance
+	if sql, err := db.DB(); err != nil {
+		return errors.WithStack(err)
+	} else {
+		sql.SetMaxOpenConns(1)
+		sql.SetConnMaxLifetime(time.Hour)
+	}
+	if tx := db.Exec("PRAGMA synchronous = OFF"); tx.Error != nil {
+		return errors.WithStack(tx.Error)
+	}
+	if tx := db.Exec("PRAGMA journal_mode = MEMORY"); tx.Error != nil {
+		return errors.WithStack(tx.Error)
+	}
 	if err := db.AutoMigrate(&models.Activity{}); err != nil {
 		return errors.WithStack(err)
 	}

internal/models/activity.go

@@ -1,9 +1,11 @@
 package models
 
 import (
-	"github.com/pterodactyl/wings/system"
-	"gorm.io/gorm"
 	"time"
+
+	"gorm.io/gorm"
+
+	"github.com/pterodactyl/wings/system"
 )
 
 type Event string
@@ -60,5 +62,8 @@ func (a *Activity) BeforeCreate(_ *gorm.DB) error {
 		a.Timestamp = time.Now()
 	}
 	a.Timestamp = a.Timestamp.UTC()
+	if a.Metadata == nil {
+		a.Metadata = ActivityMeta{}
+	}
 	return nil
 }

internal/models/models.go

@@ -2,6 +2,7 @@ package models
 
 import (
 	"database/sql"
+
 	"emperror.dev/errors"
 	"github.com/goccy/go-json"
 )

internal/progress/progress.go

@@ -0,0 +1,90 @@
+package progress
+
+import (
+	"io"
+	"strings"
+	"sync/atomic"
+
+	"github.com/pterodactyl/wings/system"
+)
+
+// Progress is used to track the progress of any I/O operation that are being
+// performed.
+type Progress struct {
+	// written is the total size of the files that have been written to the writer.
+	written uint64
+	// Total is the total size of the archive in bytes.
+	total uint64
+
+	// Writer .
+	Writer io.Writer
+}
+
+// NewProgress returns a new progress tracker for the given total size.
+func NewProgress(total uint64) *Progress {
+	return &Progress{total: total}
+}
+
+// Written returns the total number of bytes written.
+// This function should be used when the progress is tracking data being written.
+func (p *Progress) Written() uint64 {
+	return atomic.LoadUint64(&p.written)
+}
+
+// Total returns the total size in bytes.
+func (p *Progress) Total() uint64 {
+	return atomic.LoadUint64(&p.total)
+}
+
+// SetTotal sets the total size of the archive in bytes. This function is safe
+// to call concurrently and can be used to update the total size if it changes,
+// such as when the total size is simultaneously being calculated as data is
+// being written through the progress writer.
+func (p *Progress) SetTotal(total uint64) {
+	atomic.StoreUint64(&p.total, total)
+}
+
+// Write totals the number of bytes that have been written to the writer.
+func (p *Progress) Write(v []byte) (int, error) {
+	n := len(v)
+	atomic.AddUint64(&p.written, uint64(n))
+	if p.Writer != nil {
+		return p.Writer.Write(v)
+	}
+	return n, nil
+}
+
+// Progress returns a formatted progress string for the current progress.
+func (p *Progress) Progress(width int) string {
+	// current = 100 (Progress, dynamic)
+	// total = 1000 (Content-Length, dynamic)
+	// width = 25 (Number of ticks to display, static)
+	// widthPercentage = 100 / width (What percentage does each tick represent, static)
+	//
+	// percentageDecimal = current / total = 0.1
+	// percentage = percentageDecimal * 100 = 10%
+	// ticks = percentage / widthPercentage = 2.5
+	//
+	// ticks is a float64, so we cast it to an int which rounds it down to 2.
+
+	// Values are cast to floats to prevent integer division.
+	current := p.Written()
+	total := p.Total()
+	// width := is passed as a parameter
+	widthPercentage := float64(100) / float64(width)
+	percentageDecimal := float64(current) / float64(total)
+	percentage := percentageDecimal * 100
+	ticks := int(percentage / widthPercentage)
+
+	// Ensure that we never get a negative number of ticks, this will prevent strings#Repeat
+	// from panicking.  A negative number of ticks is likely to happen when the total size is
+	// inaccurate, such as when we are going off of rough disk usage calculation.
+	if ticks < 0 {
+		ticks = 0
+	} else if ticks > width {
+		ticks = width
+	}
+
+	bar := strings.Repeat("=", ticks) + strings.Repeat(" ", width-ticks)
+	return "[" + bar + "] " + system.FormatBytes(current) + " / " + system.FormatBytes(total)
+}

internal/progress/progress_test.go

@@ -0,0 +1,50 @@
+package progress_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/franela/goblin"
+
+	"github.com/pterodactyl/wings/internal/progress"
+)
+
+func TestProgress(t *testing.T) {
+	g := goblin.Goblin(t)
+
+	g.Describe("Progress", func() {
+		g.It("properly initializes", func() {
+			total := uint64(1000)
+			p := progress.NewProgress(total)
+			g.Assert(p).IsNotNil()
+			g.Assert(p.Total()).Equal(total)
+			g.Assert(p.Written()).Equal(uint64(0))
+		})
+
+		g.It("increments written when Write is called", func() {
+			v := []byte("hello")
+			p := progress.NewProgress(1000)
+			_, err := p.Write(v)
+			g.Assert(err).IsNil()
+			g.Assert(p.Written()).Equal(uint64(len(v)))
+		})
+
+		g.It("renders a progress bar", func() {
+			v := bytes.Repeat([]byte{' '}, 100)
+			p := progress.NewProgress(1000)
+			_, err := p.Write(v)
+			g.Assert(err).IsNil()
+			g.Assert(p.Written()).Equal(uint64(len(v)))
+			g.Assert(p.Progress(25)).Equal("[==                       ] 100 B / 1000 B")
+		})
+
+		g.It("renders a progress bar when written exceeds total", func() {
+			v := bytes.Repeat([]byte{' '}, 1001)
+			p := progress.NewProgress(1000)
+			_, err := p.Write(v)
+			g.Assert(err).IsNil()
+			g.Assert(p.Written()).Equal(uint64(len(v)))
+			g.Assert(p.Progress(25)).Equal("[=========================] 1001 B / 1000 B")
+		})
+	})
+}

parser/parser.go

@@ -15,7 +15,7 @@ import (
 	"github.com/icza/dyno"
 	"github.com/magiconair/properties"
 	"gopkg.in/ini.v1"
-	"gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
 
 	"github.com/pterodactyl/wings/config"
 )

remote/http.go

@@ -4,13 +4,14 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"github.com/pterodactyl/wings/internal/models"
 	"io"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/pterodactyl/wings/internal/models"
+
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/cenkalti/backoff/v4"

remote/servers.go

@@ -3,10 +3,11 @@ package remote
 import (
 	"context"
 	"fmt"
-	"github.com/pterodactyl/wings/internal/models"
 	"strconv"
 	"sync"
 
+	"github.com/pterodactyl/wings/internal/models"
+
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"golang.org/x/sync/errgroup"

remote/types.go

@@ -2,11 +2,12 @@ package remote
 
 import (
 	"bytes"
-	"github.com/apex/log"
-	"github.com/goccy/go-json"
 	"regexp"
 	"strings"
 
+	"github.com/apex/log"
+	"github.com/goccy/go-json"
+
 	"github.com/pterodactyl/wings/parser"
 )
 
@@ -156,9 +157,15 @@ type BackupRemoteUploadResponse struct {
 	PartSize int64    `json:"part_size"`
 }
 
+type BackupPart struct {
+	ETag       string `json:"etag"`
+	PartNumber int    `json:"part_number"`
+}
+
 type BackupRequest struct {
 	Checksum     string       `json:"checksum"`
 	ChecksumType string       `json:"checksum_type"`
 	Size         int64        `json:"size"`
 	Successful   bool         `json:"successful"`
+	Parts        []BackupPart `json:"parts"`
 }

router/router.go

@@ -4,6 +4,7 @@ import (
 	"github.com/apex/log"
 	"github.com/gin-gonic/gin"
 
+	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/remote"
 	"github.com/pterodactyl/wings/router/middleware"
 	wserver "github.com/pterodactyl/wings/server"
@@ -15,6 +16,7 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 
 	router := gin.New()
 	router.Use(gin.Recovery())
+	_ = router.SetTrustedProxies(config.Get().Api.TrustedProxies)
 	router.Use(middleware.AttachRequestID(), middleware.CaptureErrors(), middleware.SetAccessControlHeaders())
 	router.Use(middleware.AttachServerManager(m), middleware.AttachApiClient(client))
 	// @todo log this into a different file so you can setup IP blocking for abusive requests and such.
@@ -38,7 +40,7 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 	router.GET("/download/file", getDownloadFile)
 	router.POST("/upload/file", postServerUploadFiles)
 
-	// This route is special it sits above all of the other requests because we are
+	// This route is special it sits above all the other requests because we are
 	// using a JWT to authorize access to it, therefore it needs to be publicly
 	// accessible.
 	router.GET("/api/servers/:server/ws", middleware.ServerExists(), getServerWebsocket)
@@ -46,16 +48,16 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 	// This request is called by another daemon when a server is going to be transferred out.
 	// This request does not need the AuthorizationMiddleware as the panel should never call it
 	// and requests are authenticated through a JWT the panel issues to the other daemon.
-	router.GET("/api/servers/:server/archive", middleware.ServerExists(), getServerArchive)
+	router.POST("/api/transfers", postTransfers)
 
-	// All of the routes beyond this mount will use an authorization middleware
+	// All the routes beyond this mount will use an authorization middleware
 	// and will not be accessible without the correct Authorization header provided.
 	protected := router.Use(middleware.RequireAuthorization())
 	protected.POST("/api/update", postUpdateConfiguration)
 	protected.GET("/api/system", getSystemInformation)
 	protected.GET("/api/servers", getAllServers)
 	protected.POST("/api/servers", postCreateServer)
-	protected.POST("/api/transfer", postTransfer)
+	protected.DELETE("/api/transfers/:server", deleteTransfer)
 
 	// These are server specific routes, and require that the request be authorized, and
 	// that the server exist on the Daemon.
@@ -75,7 +77,8 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 
 		// This archive request causes the archive to start being created
 		// this should only be triggered by the panel.
-		server.POST("/archive", postServerArchive)
+		server.POST("/transfer", postServerTransfer)
+		server.DELETE("/transfer", deleteServerTransfer)
 
 		files := server.Group("/files")
 		{

router/router_server.go

@@ -9,10 +9,12 @@ import (
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/gin-gonic/gin"
+
 	"github.com/pterodactyl/wings/router/downloader"
 	"github.com/pterodactyl/wings/router/middleware"
 	"github.com/pterodactyl/wings/router/tokens"
 	"github.com/pterodactyl/wings/server"
+	"github.com/pterodactyl/wings/server/transfer"
 )
 
 // Returns a single server from the collection of servers.
@@ -180,13 +182,24 @@ func postServerReinstall(c *gin.Context) {
 	c.Status(http.StatusAccepted)
 }
 
-// Deletes a server from the wings daemon and dissociate it's objects.
+// Deletes a server from the wings daemon and dissociate its objects.
 func deleteServer(c *gin.Context) {
 	s := middleware.ExtractServer(c)
 
 	// Immediately suspend the server to prevent a user from attempting
 	// to start it while this process is running.
 	s.Config().SetSuspended(true)
+
+	// Notify all websocket clients that the server is being deleted.
+	// This is useful for two reasons, one to tell clients not to bother
+	// retrying to connect to the websocket.  And two, for transfers when
+	// the server has been successfully transferred to another node, and
+	// the client needs to switch to the new node.
+	if s.IsTransferring() {
+		s.Events().Publish(server.TransferStatusEvent, transfer.StatusCompleted)
+	}
+	s.Events().Publish(server.DeletedEvent, nil)
+
 	s.CleanupForDestroy()
 
 	// Remove any pending remote file downloads for the server.
@@ -198,7 +211,7 @@ func deleteServer(c *gin.Context) {
 	// forcibly terminate it before removing the container, so we do not need to handle
 	// that here.
 	if err := s.Environment.Destroy(); err != nil {
-		WithError(c, err)
+		_ = WithError(c, err)
 		return
 	}
 
@@ -206,7 +219,7 @@ func deleteServer(c *gin.Context) {
 	// done in a separate process since failure is not the end of the world and can be
 	// manually cleaned up after the fact.
 	//
-	// In addition, servers with large amounts of files can take some time to finish deleting
+	// In addition, servers with large amounts of files can take some time to finish deleting,
 	// so we don't want to block the HTTP call while waiting on this.
 	go func(p string) {
 		if err := os.RemoveAll(p); err != nil {

router/router_server_files.go

@@ -13,13 +13,13 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/pterodactyl/wings/config"
-
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/gin-gonic/gin"
 	"golang.org/x/sync/errgroup"
 
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/internal/models"
 	"github.com/pterodactyl/wings/router/downloader"
 	"github.com/pterodactyl/wings/router/middleware"
 	"github.com/pterodactyl/wings/router/tokens"
@@ -440,7 +440,7 @@ func postServerDecompressFiles(c *gin.Context) {
 	s := middleware.ExtractServer(c)
 	lg := middleware.ExtractLogger(c).WithFields(log.Fields{"root_path": data.RootPath, "file": data.File})
 	lg.Debug("checking if space is available for file decompression")
-	err := s.Filesystem().SpaceAvailableForDecompression(data.RootPath, data.File)
+	err := s.Filesystem().SpaceAvailableForDecompression(context.Background(), data.RootPath, data.File)
 	if err != nil {
 		if filesystem.IsErrorCode(err, filesystem.ErrCodeUnknownArchive) {
 			lg.WithField("error", err).Warn("failed to decompress file: unknown archive format")
@@ -452,7 +452,7 @@ func postServerDecompressFiles(c *gin.Context) {
 	}
 
 	lg.Info("starting file decompression")
-	if err := s.Filesystem().DecompressFile(data.RootPath, data.File); err != nil {
+	if err := s.Filesystem().DecompressFile(context.Background(), data.RootPath, data.File); err != nil {
 		// If the file is busy for some reason just return a nicer error to the user since there is not
 		// much we specifically can do. They'll need to stop the running server process in order to overwrite
 		// a file like this.
@@ -600,6 +600,11 @@ func postServerUploadFiles(c *gin.Context) {
 		if err := handleFileUpload(p, s, header); err != nil {
 			NewServerError(err, s).Abort(c)
 			return
+		} else {
+			s.SaveActivity(s.NewRequestActivity(token.UserUuid, c.ClientIP()), server.ActivityFileUploaded, models.ActivityMeta{
+				"file":      header.Filename,
+				"directory": filepath.Clean(directory),
+			})
 		}
 	}
 }
@@ -617,6 +622,5 @@ func handleFileUpload(p string, s *server.Server, header *multipart.FileHeader)
 	if err := s.Filesystem().Writefile(p, file); err != nil {
 		return err
 	}
-
 	return nil
 }

router/router_server_transfer.go

@@ -0,0 +1,129 @@
+package router
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/environment"
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/server"
+	"github.com/pterodactyl/wings/server/installer"
+	"github.com/pterodactyl/wings/server/transfer"
+)
+
+// Data passed over to initiate a server transfer.
+type serverTransferRequest struct {
+	URL    string                  `binding:"required" json:"url"`
+	Token  string                  `binding:"required" json:"token"`
+	Server installer.ServerDetails `json:"server"`
+}
+
+// postServerTransfer handles the start of a transfer for a server.
+func postServerTransfer(c *gin.Context) {
+	var data serverTransferRequest
+	if err := c.BindJSON(&data); err != nil {
+		return
+	}
+
+	s := ExtractServer(c)
+
+	// Check if the server is already being transferred.
+	// There will be another endpoint for resetting this value either by deleting the
+	// server, or by canceling the transfer.
+	if s.IsTransferring() {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "A transfer is already in progress for this server.",
+		})
+		return
+	}
+
+	manager := middleware.ExtractManager(c)
+
+	notifyPanelOfFailure := func() {
+		if err := manager.Client().SetTransferStatus(context.Background(), s.ID(), false); err != nil {
+			s.Log().WithField("subsystem", "transfer").
+				WithField("status", false).
+				WithError(err).
+				Error("failed to set transfer status")
+		}
+
+		s.Events().Publish(server.TransferStatusEvent, "failure")
+		s.SetTransferring(false)
+	}
+
+	// Block the server from starting while we are transferring it.
+	s.SetTransferring(true)
+
+	// Ensure the server is offline. Sometimes a "No such container" error gets through
+	// which means the server is already stopped. We can ignore that.
+	if s.Environment.State() != environment.ProcessOfflineState {
+		if err := s.Environment.WaitForStop(
+			s.Context(),
+			time.Minute,
+			false,
+		); err != nil && !strings.Contains(strings.ToLower(err.Error()), "no such container") {
+			notifyPanelOfFailure()
+			s.Log().WithError(err).Error("failed to stop server for transfer")
+			return
+		}
+	}
+
+	// Create a new transfer instance for this server.
+	trnsfr := transfer.New(context.Background(), s)
+	transfer.Outgoing().Add(trnsfr)
+
+	go func() {
+		defer transfer.Outgoing().Remove(trnsfr)
+
+		if _, err := trnsfr.PushArchiveToTarget(data.URL, data.Token); err != nil {
+			notifyPanelOfFailure()
+
+			if err == context.Canceled {
+				trnsfr.Log().Debug("canceled")
+				trnsfr.SendMessage("Canceled.")
+				return
+			}
+
+			trnsfr.Log().WithError(err).Error("failed to push archive to target")
+			return
+		}
+
+		// DO NOT NOTIFY THE PANEL OF SUCCESS HERE. The only node that should send
+		// a success status is the destination node.  When we send a failure status,
+		// the panel will automatically cancel the transfer and attempt to reset
+		// the server state on the destination node, we just need to make sure
+		// we clean up our statuses for failure.
+
+		trnsfr.Log().Debug("transfer complete")
+	}()
+
+	c.Status(http.StatusAccepted)
+}
+
+// deleteServerTransfer cancels an outgoing transfer for a server.
+func deleteServerTransfer(c *gin.Context) {
+	s := ExtractServer(c)
+
+	if !s.IsTransferring() {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Server is not currently being transferred.",
+		})
+		return
+	}
+
+	trnsfr := transfer.Outgoing().Get(s.ID())
+	if trnsfr == nil {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Server is not currently being transferred.",
+		})
+		return
+	}
+
+	trnsfr.Cancel()
+
+	c.Status(http.StatusAccepted)
+}

router/router_server_ws.go

@@ -32,7 +32,7 @@ func getServerWebsocket(c *gin.Context) {
 	ctx, cancel := context.WithCancel(c.Request.Context())
 	defer cancel()
 
-	handler, err := websocket.GetHandler(s, c.Writer, c.Request)
+	handler, err := websocket.GetHandler(s, c.Writer, c.Request, c)
 	if err != nil {
 		NewServerError(err, s).Abort(c)
 		return

router/router_system.go

@@ -10,9 +10,9 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"github.com/pterodactyl/wings/config"
-	"github.com/pterodactyl/wings/installer"
 	"github.com/pterodactyl/wings/router/middleware"
 	"github.com/pterodactyl/wings/server"
+	"github.com/pterodactyl/wings/server/installer"
 	"github.com/pterodactyl/wings/system"
 )
 
@@ -28,7 +28,7 @@ func getSystemInformation(c *gin.Context) {
 	c.JSON(http.StatusOK, i)
 }
 
-// Returns all of the servers that are registered and configured correctly on
+// Returns all the servers that are registered and configured correctly on
 // this wings instance.
 func getAllServers(c *gin.Context) {
 	servers := middleware.ExtractManager(c).All()
@@ -117,7 +117,7 @@ func postUpdateConfiguration(c *gin.Context) {
 	// Try to write this new configuration to the disk before updating our global
 	// state with it.
 	if err := config.WriteToDisk(cfg); err != nil {
-		WithError(c, err)
+		_ = WithError(c, err)
 		return
 	}
 	// Since we wrote it to the disk successfully now update the global configuration

router/router_transfer.go

@@ -1,65 +1,33 @@
 package router
 
 import (
-	"bufio"
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
+	"mime"
+	"mime/multipart"
 	"net/http"
 	"os"
-	"path/filepath"
-	"strconv"
 	"strings"
-	"sync/atomic"
-	"time"
 
-	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
-	"github.com/juju/ratelimit"
-	"github.com/mholt/archiver/v3"
-	"github.com/mitchellh/colorstring"
 
-	"github.com/pterodactyl/wings/config"
-	"github.com/pterodactyl/wings/installer"
-	"github.com/pterodactyl/wings/remote"
 	"github.com/pterodactyl/wings/router/middleware"
 	"github.com/pterodactyl/wings/router/tokens"
 	"github.com/pterodactyl/wings/server"
-	"github.com/pterodactyl/wings/server/filesystem"
+	"github.com/pterodactyl/wings/server/installer"
-	"github.com/pterodactyl/wings/system"
+	"github.com/pterodactyl/wings/server/transfer"
 )
 
-// Number of ticks in the progress bar
+// postTransfers .
-const ticks = 25
+func postTransfers(c *gin.Context) {
-
-// 100% / number of ticks = percentage represented by each tick
-const tickPercentage = 100 / ticks
-
-type downloadProgress struct {
-	size     int64
-	progress int64
-}
-
-// Data passed over to initiate a server transfer.
-type serverTransferRequest struct {
-	ServerID string                  `binding:"required" json:"server_id"`
-	URL      string                  `binding:"required" json:"url"`
-	Token    string                  `binding:"required" json:"token"`
-	Server   installer.ServerDetails `json:"server"`
-}
-
-func getArchivePath(sID string) string {
-	return filepath.Join(config.Get().System.ArchiveDirectory, sID+".tar.gz")
-}
-
-// Returns the archive for a server so that it can be transferred to a new node.
-func getServerArchive(c *gin.Context) {
 	auth := strings.SplitN(c.GetHeader("Authorization"), " ", 2)
-
 	if len(auth) != 2 || auth[0] != "Bearer" {
 		c.Header("WWW-Authenticate", "Bearer")
 		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
@@ -74,437 +42,232 @@ func getServerArchive(c *gin.Context) {
 		return
 	}
 
-	s := ExtractServer(c)
+	manager := middleware.ExtractManager(c)
-	if token.Subject != s.ID() {
+	u, err := uuid.Parse(token.Subject)
-		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+	if err != nil {
-			"error": "Missing required token subject, or subject is not valid for the requested server.",
+		NewTrackedError(err).Abort(c)
+		return
+	}
+
+	// Get or create a new transfer instance for this server.
+	var (
+		ctx    context.Context
+		cancel context.CancelFunc
+	)
+	trnsfr := transfer.Incoming().Get(u.String())
+	if trnsfr == nil {
+		// TODO: should this use the request context?
+		trnsfr = transfer.New(c, nil)
+
+		ctx, cancel = context.WithCancel(trnsfr.Context())
+		defer cancel()
+
+		i, err := installer.New(ctx, manager, installer.ServerDetails{
+			UUID:              u.String(),
+			StartOnCompletion: false,
 		})
-		return
-	}
-
-	archivePath := getArchivePath(s.ID())
-
-	// Stat the archive file.
-	st, err := os.Lstat(archivePath)
 		if err != nil {
-		if !errors.Is(err, os.ErrNotExist) {
+			if err := manager.Client().SetTransferStatus(context.Background(), trnsfr.Server.ID(), false); err != nil {
-			_ = WithError(c, err)
+				trnsfr.Log().WithField("status", false).WithError(err).Error("failed to set transfer status")
-			return
 			}
-		c.AbortWithStatus(http.StatusNotFound)
+			NewTrackedError(err).Abort(c)
 			return
 		}
 
-	// Compute sha1 checksum.
-	h := sha256.New()
-	f, err := os.Open(archivePath)
-	if err != nil {
-		return
-	}
-	if _, err := io.Copy(h, bufio.NewReader(f)); err != nil {
-		_ = f.Close()
-		_ = WithError(c, err)
-		return
-	}
-	if err := f.Close(); err != nil {
-		_ = WithError(c, err)
-		return
-	}
-	checksum := hex.EncodeToString(h.Sum(nil))
-
-	// Stream the file to the client.
-	f, err = os.Open(archivePath)
-	if err != nil {
-		_ = WithError(c, err)
-		return
-	}
-	defer f.Close()
-
-	c.Header("X-Checksum", checksum)
-	c.Header("X-Mime-Type", "application/tar+gzip")
-	c.Header("Content-Length", strconv.Itoa(int(st.Size())))
-	c.Header("Content-Disposition", "attachment; filename="+strconv.Quote(s.ID()+".tar.gz"))
-	c.Header("Content-Type", "application/octet-stream")
-
-	_, _ = bufio.NewReader(f).WriteTo(c.Writer)
-}
-
-func postServerArchive(c *gin.Context) {
-	s := middleware.ExtractServer(c)
-	manager := middleware.ExtractManager(c)
-
-	go func(s *server.Server) {
-		l := log.WithField("server", s.ID())
-
-		// This function automatically adds the Source Node prefix and Timestamp to the log
-		// output before sending it over the websocket.
-		sendTransferLog := func(data string) {
-			output := colorstring.Color(fmt.Sprintf("[yellow][bold]%s [Pterodactyl Transfer System] [Source Node]:[default] %s", time.Now().Format(time.RFC1123), data))
-			s.Events().Publish(server.TransferLogsEvent, output)
-		}
-
-		s.Events().Publish(server.TransferStatusEvent, "starting")
-		sendTransferLog("Attempting to archive server...")
-
-		hasError := true
-		defer func() {
-			if !hasError {
-				return
-			}
-
-			// Mark the server as not being transferred so it can actually be used.
-			s.SetTransferring(false)
-			s.Events().Publish(server.TransferStatusEvent, "failure")
-
-			sendTransferLog("Attempting to notify panel of archive failure..")
-			if err := manager.Client().SetArchiveStatus(s.Context(), s.ID(), false); err != nil {
-				if !remote.IsRequestError(err) {
-					sendTransferLog("Failed to notify panel of archive failure: " + err.Error())
-					l.WithField("error", err).Error("failed to notify panel of failed archive status")
-					return
-				}
-
-				sendTransferLog("Panel returned an error while notifying it of a failed archive: " + err.Error())
-				l.WithField("error", err.Error()).Error("panel returned an error when notifying it of a failed archive status")
-				return
-			}
-
-			sendTransferLog("Successfully notified panel of failed archive status")
-			l.Info("successfully notified panel of failed archive status")
-		}()
-
-		// Mark the server as transferring to prevent problems.
-		s.SetTransferring(true)
-
-		// Ensure the server is offline. Sometimes a "No such container" error gets through
-		// which means the server is already stopped. We can ignore that.
-		if err := s.Environment.WaitForStop(s.Context(), time.Minute, false); err != nil && !strings.Contains(strings.ToLower(err.Error()), "no such container") {
-			sendTransferLog("Failed to stop server, aborting transfer..")
-			l.WithField("error", err).Error("failed to stop server")
-			return
-		}
-
-		// Create an archive of the entire server's data directory.
-		a := &filesystem.Archive{
-			BasePath: s.Filesystem().Path(),
-		}
-
-		// Attempt to get an archive of the server.
-		if err := a.Create(getArchivePath(s.ID())); err != nil {
-			sendTransferLog("An error occurred while archiving the server: " + err.Error())
-			l.WithField("error", err).Error("failed to get transfer archive for server")
-			return
-		}
-
-		sendTransferLog("Successfully created archive, attempting to notify panel..")
-		l.Info("successfully created server transfer archive, notifying panel..")
-
-		if err := manager.Client().SetArchiveStatus(s.Context(), s.ID(), true); err != nil {
-			if !remote.IsRequestError(err) {
-				sendTransferLog("Failed to notify panel of archive success: " + err.Error())
-				l.WithField("error", err).Error("failed to notify panel of successful archive status")
-				return
-			}
-
-			sendTransferLog("Panel returned an error while notifying it of a successful archive: " + err.Error())
-			l.WithField("error", err.Error()).Error("panel returned an error when notifying it of a successful archive status")
-			return
-		}
-
-		hasError = false
-
-		// This log may not be displayed by the client due to the status event being sent before or at the same time.
-		sendTransferLog("Successfully notified panel of successful archive status")
-
-		l.Info("successfully notified panel of successful transfer archive status")
-		s.Events().Publish(server.TransferStatusEvent, "archived")
-	}(s)
-
-	c.Status(http.StatusAccepted)
-}
-
-func (w *downloadProgress) Write(v []byte) (int, error) {
-	n := len(v)
-	atomic.AddInt64(&w.progress, int64(n))
-	return n, nil
-}
-
-// Log helper function to attach all errors and info output to a consistently formatted
-// log string for easier querying.
-func (str serverTransferRequest) log() *log.Entry {
-	return log.WithField("subsystem", "transfers").WithField("server_id", str.ServerID)
-}
-
-// Downloads an archive from the machine that the server currently lives on.
-func (str serverTransferRequest) downloadArchive() (*http.Response, error) {
-	client := http.Client{Timeout: 0}
-	req, err := http.NewRequest(http.MethodGet, str.URL, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", str.Token)
-	res, err := client.Do(req) // lgtm [go/request-forgery]
-	if err != nil {
-		return nil, err
-	}
-	return res, nil
-}
-
-// Returns the path to the local archive on the system.
-func (str serverTransferRequest) path() string {
-	return getArchivePath(str.ServerID)
-}
-
-// Creates the archive location on this machine by first checking that the required file
-// does not already exist. If it does exist, the file is deleted and then re-created as
-// an empty file.
-func (str serverTransferRequest) createArchiveFile() (*os.File, error) {
-	p := str.path()
-	if _, err := os.Stat(p); err != nil {
-		if !os.IsNotExist(err) {
-			return nil, err
-		}
-	} else if err := os.Remove(p); err != nil {
-		return nil, err
-	}
-	return os.Create(p)
-}
-
-// Deletes the archive from the local filesystem. This is executed as a deferred function.
-func (str serverTransferRequest) removeArchivePath() {
-	p := str.path()
-	str.log().Debug("deleting temporary transfer archive")
-	if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
-		str.log().WithField("path", p).WithField("error", err).Error("failed to delete temporary transfer archive file")
-		return
-	}
-	str.log().Debug("deleted temporary transfer archive successfully")
-}
-
-// Verifies that the SHA-256 checksum of the file on the local filesystem matches the
-// expected value from the transfer request. The string value returned is the computed
-// checksum on the system.
-func (str serverTransferRequest) verifyChecksum(matches string) (bool, string, error) {
-	f, err := os.Open(str.path())
-	if err != nil {
-		return false, "", err
-	}
-	defer f.Close()
-	h := sha256.New()
-	if _, err := io.Copy(h, bufio.NewReader(f)); err != nil {
-		return false, "", err
-	}
-	checksum := hex.EncodeToString(h.Sum(nil))
-	return checksum == matches, checksum, nil
-}
-
-// Sends a notification to the Panel letting it know what the status of this transfer is.
-func (str serverTransferRequest) sendTransferStatus(client remote.Client, successful bool) error {
-	lg := str.log().WithField("transfer_successful", successful)
-	lg.Info("notifying Panel of server transfer state")
-	if err := client.SetTransferStatus(context.Background(), str.ServerID, successful); err != nil {
-		lg.WithField("error", err).Error("error notifying panel of transfer state")
-		return err
-	}
-	lg.Debug("notified panel of transfer state")
-	return nil
-}
-
-// Initiates a transfer between two nodes for a server by downloading an archive from the
-// remote node and then applying the server details to this machine.
-func postTransfer(c *gin.Context) {
-	var data serverTransferRequest
-	if err := c.BindJSON(&data); err != nil {
-		return
-	}
-
-	manager := middleware.ExtractManager(c)
-	u, err := uuid.Parse(data.ServerID)
-	if err != nil {
-		WithError(c, err)
-		return
-	}
-	// Force the server ID to be a valid UUID string at this point. If it is not an error
-	// is returned to the caller. This limits injection vulnerabilities that would cause
-	// the str.path() function to return a location not within the server archive directory.
-	data.ServerID = u.String()
-
-	data.log().Info("handling incoming server transfer request")
-	go func(data *serverTransferRequest) {
-		hasError := true
-
-		// Create a new server installer. This will only configure the environment and not
-		// run the installer scripts.
-		i, err := installer.New(context.Background(), manager, data.Server)
-		if err != nil {
-			_ = data.sendTransferStatus(manager.Client(), false)
-			data.log().WithField("error", err).Error("failed to validate received server data")
-			return
-		}
-
-		// This function automatically adds the Target Node prefix and Timestamp to the log output before sending it
-		// over the websocket.
-		sendTransferLog := func(data string) {
-			output := colorstring.Color(fmt.Sprintf("[yellow][bold]%s [Pterodactyl Transfer System] [Target Node]:[default] %s", time.Now().Format(time.RFC1123), data))
-			i.Server().Events().Publish(server.TransferLogsEvent, output)
-		}
-
-		// Mark the server as transferring to prevent problems later on during the process and
-		// then push the server into the global server collection for this instance.
 		i.Server().SetTransferring(true)
 		manager.Add(i.Server())
-		defer func(s *server.Server) {
+
-			// In the event that this transfer call fails, remove the server from the global
+		// We add the transfer to the list of transfers once we have a server instance to use.
-			// server tracking so that we don't have a dangling instance.
+		trnsfr.Server = i.Server()
-			if err := data.sendTransferStatus(manager.Client(), !hasError); hasError || err != nil {
+		transfer.Incoming().Add(trnsfr)
-				sendTransferLog("Server transfer failed, check Wings logs for additional information.")
+	} else {
-				s.Events().Publish(server.TransferStatusEvent, "failure")
+		ctx, cancel = context.WithCancel(trnsfr.Context())
+		defer cancel()
+	}
+
+	// Any errors past this point (until the transfer is complete) will abort
+	// the transfer.
+
+	successful := false
+	defer func(ctx context.Context, trnsfr *transfer.Transfer) {
+		// Remove the transfer from the list of incoming transfers.
+		transfer.Incoming().Remove(trnsfr)
+
+		if !successful {
+			trnsfr.Server.Events().Publish(server.TransferStatusEvent, "failure")
 			manager.Remove(func(match *server.Server) bool {
-					return match.ID() == s.ID()
+				return match.ID() == trnsfr.Server.ID()
 			})
+		}
 
-				// If the transfer status was successful but the request failed, act like the transfer failed.
+		if err := manager.Client().SetTransferStatus(context.Background(), trnsfr.Server.ID(), successful); err != nil {
-				if !hasError && err != nil {
+			// Only delete the files if the transfer actually failed, otherwise we could have
+			// unrecoverable data-loss.
+			if !successful && err != nil {
 				// Delete all extracted files.
-					if err := os.RemoveAll(s.Filesystem().Path()); err != nil && !os.IsNotExist(err) {
+				go func(trnsfr *transfer.Transfer) {
-						data.log().WithField("error", err).Warn("failed to delete local server files directory")
+					if err := os.RemoveAll(trnsfr.Server.Filesystem().Path()); err != nil && !os.IsNotExist(err) {
+						trnsfr.Log().WithError(err).Warn("failed to delete local server files")
 					}
+				}(trnsfr)
 			}
-			} else {
-				s.SetTransferring(false)
-				s.Events().Publish(server.TransferStatusEvent, "success")
-				sendTransferLog("Transfer completed.")
-			}
-		}(i.Server())
 
-		data.log().Info("downloading server archive from current server node")
+			trnsfr.Log().WithField("status", successful).WithError(err).Error("failed to set transfer status on panel")
-		sendTransferLog("Received incoming transfer from Panel, attempting to download archive from source node...")
+			return
-		res, err := data.downloadArchive()
+		}
+
+		trnsfr.Server.SetTransferring(false)
+		trnsfr.Server.Events().Publish(server.TransferStatusEvent, "success")
+	}(ctx, trnsfr)
+
+	mediaType, params, err := mime.ParseMediaType(c.GetHeader("Content-Type"))
 	if err != nil {
-			sendTransferLog("Failed to retrieve server archive from remote node: " + err.Error())
+		trnsfr.Log().Debug("failed to parse content type header")
-			data.log().WithField("error", err).Error("failed to download archive for server transfer")
+		NewTrackedError(err).Abort(c)
-			return
-		}
-		defer res.Body.Close()
-		if res.StatusCode != http.StatusOK {
-			data.log().WithField("error", err).WithField("status", res.StatusCode).Error("unexpected error response from transfer endpoint")
 		return
 	}
 
-		size := res.ContentLength
+	if !strings.HasPrefix(mediaType, "multipart/") {
-		if size == 0 {
+		trnsfr.Log().Debug("invalid content type")
-			data.log().WithField("error", err).Error("received an archive response with Content-Length of 0")
+		NewTrackedError(fmt.Errorf("invalid content type \"%s\", expected \"multipart/form-data\"", mediaType)).Abort(c)
 		return
 	}
-		sendTransferLog("Got server archive response from remote node. (Content-Length: " + strconv.Itoa(int(size)) + ")")
+
-		sendTransferLog("Creating local archive file...")
+	// Used to calculate the hash of the file as it is being uploaded.
-		file, err := data.createArchiveFile()
+	h := sha256.New()
+
+	// Used to read the file and checksum from the request body.
+	mr := multipart.NewReader(c.Request.Body, params["boundary"])
+
+	// Loop through the parts of the request body and process them.
+	var (
+		hasArchive       bool
+		hasChecksum      bool
+		checksumVerified bool
+	)
+out:
+	for {
+		select {
+		case <-ctx.Done():
+			break out
+		default:
+			p, err := mr.NextPart()
+			if err == io.EOF {
+				break out
+			}
 			if err != nil {
-			data.log().WithField("error", err).Error("failed to create archive file on local filesystem")
+				NewTrackedError(err).Abort(c)
 				return
 			}
 
-		sendTransferLog("Writing archive to disk...")
+			name := p.FormName()
-		data.log().Info("writing transfer archive to disk...")
+			switch name {
+			case "archive":
+				trnsfr.Log().Debug("received archive")
 
-		// Copy the file.
+				if err := trnsfr.Server.EnsureDataDirectoryExists(); err != nil {
-		progress := &downloadProgress{size: size}
+					NewTrackedError(err).Abort(c)
-		ticker := time.NewTicker(3 * time.Second)
-		go func(progress *downloadProgress, t *time.Ticker) {
-			for range ticker.C {
-				// p = 100 (Downloaded)
-				// size = 1000 (Content-Length)
-				// p / size = 0.1
-				// * 100 = 10% (Multiply by 100 to get a percentage of the download)
-				// 10% / tickPercentage = (10% / (100 / 25)) (Divide by tick percentage to get the number of ticks)
-				// 2.5 (Number of ticks as a float64)
-				// 2 (convert to an integer)
-				p := atomic.LoadInt64(&progress.progress)
-				// We have to cast these numbers to float in order to get a float result from the division.
-				width := ((float64(p) / float64(size)) * 100) / tickPercentage
-				bar := strings.Repeat("=", int(width)) + strings.Repeat(" ", ticks-int(width))
-				sendTransferLog("Downloading [" + bar + "] " + system.FormatBytes(p) + " / " + system.FormatBytes(progress.size))
-			}
-		}(progress, ticker)
-
-		var reader io.Reader
-		downloadLimit := float64(config.Get().System.Transfers.DownloadLimit) * 1024 * 1024
-		if downloadLimit > 0 {
-			// Wrap the body with a reader that is limited to the defined download limit speed.
-			reader = ratelimit.Reader(res.Body, ratelimit.NewBucketWithRate(downloadLimit, int64(downloadLimit)))
-		} else {
-			reader = res.Body
-		}
-
-		buf := make([]byte, 1024*4)
-		if _, err := io.CopyBuffer(file, io.TeeReader(reader, progress), buf); err != nil {
-			ticker.Stop()
-			_ = file.Close()
-
-			sendTransferLog("Failed while writing archive file to disk: " + err.Error())
-			data.log().WithField("error", err).Error("failed to copy archive file to disk")
-			return
-		}
-		ticker.Stop()
-
-		// Show 100% completion.
-		humanSize := system.FormatBytes(progress.size)
-		sendTransferLog("Downloading [" + strings.Repeat("=", ticks) + "] " + humanSize + " / " + humanSize)
-
-		if err := file.Close(); err != nil {
-			data.log().WithField("error", err).Error("unable to close archive file on local filesystem")
-			return
-		}
-		data.log().Info("finished writing transfer archive to disk")
-		sendTransferLog("Successfully wrote archive to disk.")
-
-		// Whenever the transfer fails or succeeds, delete the temporary transfer archive that
-		// was created on the disk.
-		defer data.removeArchivePath()
-
-		sendTransferLog("Verifying checksum of downloaded archive...")
-		data.log().Info("computing checksum of downloaded archive file")
-		expected := res.Header.Get("X-Checksum")
-		if matches, computed, err := data.verifyChecksum(expected); err != nil {
-			data.log().WithField("error", err).Error("encountered an error while calculating local filesystem archive checksum")
-			return
-		} else if !matches {
-			sendTransferLog("@@@@@ CHECKSUM VERIFICATION FAILED @@@@@")
-			sendTransferLog("  -   Source Checksum: " + expected)
-			sendTransferLog("  - Computed Checksum: " + computed)
-			data.log().WithField("expected_sum", expected).WithField("computed_checksum", computed).Error("checksum mismatch when verifying integrity of local archive")
 					return
 				}
 
-		// Create the server's environment.
+				tee := io.TeeReader(p, h)
-		sendTransferLog("Creating server environment, this could take a while..")
+				if err := trnsfr.Server.Filesystem().ExtractStreamUnsafe(ctx, "/", tee); err != nil {
-		data.log().Info("creating server environment")
+					NewTrackedError(err).Abort(c)
-		if err := i.Server().CreateEnvironment(); err != nil {
-			data.log().WithField("error", err).Error("failed to create server environment")
 					return
 				}
 
-		sendTransferLog("Server environment has been created, extracting transfer archive..")
+				hasArchive = true
-		data.log().Info("server environment configured, extracting transfer archive")
+			case "checksum":
-		if err := archiver.NewTarGz().Unarchive(data.path(), i.Server().Filesystem().Path()); err != nil {
+				trnsfr.Log().Debug("received checksum")
-			// Un-archiving failed, delete the server's data directory.
+
-			if err := os.RemoveAll(i.Server().Filesystem().Path()); err != nil && !os.IsNotExist(err) {
+				if !hasArchive {
-				data.log().WithField("error", err).Warn("failed to delete local server files directory")
+					NewTrackedError(errors.New("archive must be sent before the checksum")).Abort(c)
-			}
-			data.log().WithField("error", err).Error("failed to extract server archive")
 					return
 				}
 
-		// We mark the process as being successful here as if we fail to send a transfer success,
+				hasChecksum = true
-		// then a transfer failure won't probably be successful either.
-		//
-		// It may be useful to retry sending the transfer success every so often just in case of a small
-		// hiccup or the fix of whatever error causing the success request to fail.
-		hasError = false
 
-		data.log().Info("archive extracted successfully, notifying Panel of status")
+				v, err := io.ReadAll(p)
-		sendTransferLog("Archive extracted successfully.")
+				if err != nil {
-	}(&data)
+					NewTrackedError(err).Abort(c)
+					return
+				}
+
+				expected := make([]byte, hex.DecodedLen(len(v)))
+				n, err := hex.Decode(expected, v)
+				if err != nil {
+					NewTrackedError(err).Abort(c)
+					return
+				}
+				actual := h.Sum(nil)
+
+				trnsfr.Log().WithFields(log.Fields{
+					"expected": hex.EncodeToString(expected),
+					"actual":   hex.EncodeToString(actual),
+				}).Debug("checksums")
+
+				if !bytes.Equal(expected[:n], actual) {
+					NewTrackedError(errors.New("checksums don't match")).Abort(c)
+					return
+				}
+
+				trnsfr.Log().Debug("checksums match")
+				checksumVerified = true
+			default:
+				continue
+			}
+		}
+	}
+
+	if !hasArchive || !hasChecksum {
+		NewTrackedError(errors.New("missing archive or checksum")).Abort(c)
+		return
+	}
+
+	if !checksumVerified {
+		NewTrackedError(errors.New("checksums don't match")).Abort(c)
+		return
+	}
+
+	// Transfer is almost complete, we just want to ensure the environment is
+	// configured correctly.  We might want to not fail the transfer at this
+	// stage, but we will just to be safe.
+
+	// Ensure the server environment gets configured.
+	if err := trnsfr.Server.CreateEnvironment(); err != nil {
+		NewTrackedError(err).Abort(c)
+		return
+	}
+
+	// Changing this causes us to notify the panel about a successful transfer,
+	// rather than failing the transfer like we do by default.
+	successful = true
+
+	// The rest of the logic for ensuring the server is unlocked and everything
+	// is handled in the deferred function above.
+	trnsfr.Log().Debug("done!")
+}
+
+// deleteTransfer cancels an incoming transfer for a server.
+func deleteTransfer(c *gin.Context) {
+	s := ExtractServer(c)
+
+	if !s.IsTransferring() {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Server is not currently being transferred.",
+		})
+		return
+	}
+
+	trnsfr := transfer.Incoming().Get(s.ID())
+	if trnsfr == nil {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Server is not currently being transferred.",
+		})
+		return
+	}
+
+	trnsfr.Cancel()
 
 	c.Status(http.StatusAccepted)
 }

router/tokens/upload.go

@@ -8,6 +8,7 @@ type UploadPayload struct {
 	jwt.Payload
 
 	ServerUuid string `json:"server_uuid"`
+	UserUuid   string `json:"user_uuid"`
 	UniqueId   string `json:"unique_id"`
 }
 

router/websocket/listeners.go

@@ -7,6 +7,7 @@ import (
 
 	"emperror.dev/errors"
 	"github.com/goccy/go-json"
+
 	"github.com/pterodactyl/wings/events"
 	"github.com/pterodactyl/wings/system"
 

router/websocket/websocket.go

@@ -3,18 +3,21 @@ package websocket
 import (
 	"context"
 	"fmt"
-	"github.com/pterodactyl/wings/internal/models"
 	"net/http"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/pterodactyl/wings/internal/models"
+
 	"emperror.dev/errors"
 	"github.com/apex/log"
 	"github.com/gbrlsnchs/jwt/v3"
+	"github.com/gin-gonic/gin"
 	"github.com/goccy/go-json"
 	"github.com/google/uuid"
 	"github.com/gorilla/websocket"
+
 	"github.com/pterodactyl/wings/system"
 
 	"github.com/pterodactyl/wings/config"
@@ -79,7 +82,7 @@ func NewTokenPayload(token []byte) (*tokens.WebsocketPayload, error) {
 }
 
 // GetHandler returns a new websocket handler using the context provided.
-func GetHandler(s *server.Server, w http.ResponseWriter, r *http.Request) (*Handler, error) {
+func GetHandler(s *server.Server, w http.ResponseWriter, r *http.Request, c *gin.Context) (*Handler, error) {
 	upgrader := websocket.Upgrader{
 		// Ensure that the websocket request is originating from the Panel itself,
 		// and not some other location.
@@ -111,7 +114,7 @@ func GetHandler(s *server.Server, w http.ResponseWriter, r *http.Request) (*Hand
 		Connection: conn,
 		jwt:        nil,
 		server:     s,
-		ra:         s.NewRequestActivity("", r.RemoteAddr),
+		ra:         s.NewRequestActivity("", c.ClientIP()),
 		uuid:       u,
 	}, nil
 }
@@ -370,7 +373,7 @@ func (h *Handler) HandleInbound(ctx context.Context, m Message) error {
 			}
 
 			if err == nil {
-				_ = h.ra.Save(h.server, models.Event(server.ActivityPowerPrefix+action), nil)
+				h.server.SaveActivity(h.ra, models.Event(server.ActivityPowerPrefix+action), nil)
 			}
 
 			return err
@@ -429,11 +432,13 @@ func (h *Handler) HandleInbound(ctx context.Context, m Message) error {
 				}
 			}
 
-			_ = h.ra.Save(h.server, server.ActivityConsoleCommand, models.ActivityMeta{
+			if err := h.server.Environment.SendCommand(strings.Join(m.Args, "")); err != nil {
+				return err
+			}
+			h.server.SaveActivity(h.ra, server.ActivityConsoleCommand, models.ActivityMeta{
 				"command": strings.Join(m.Args, ""),
 			})
-
+			return nil
-			return h.server.Environment.SendCommand(strings.Join(m.Args, ""))
 		}
 	}
 

rpm/ptero-wings.spec

@@ -1,121 +0,0 @@
-Name:       ptero-wings
-Version:    1.5.3
-Release:    1%{?dist}
-Summary:    The server control plane for Pterodactyl Panel. Written from the ground-up with security, speed, and stability in mind.
-BuildArch:  x86_64
-License:    MIT
-URL:        https://github.com/pterodactyl/wings
-Source0:    https://github.com/pterodactyl/wings/releases/download/v%{version}/wings_linux_amd64
-
-%if 0%{?rhel} && 0%{?rhel} <= 8
-BuildRequires:  systemd
-%else
-BuildRequires:  systemd-rpm-macros
-%endif
-
-
-%description
-Wings is Pterodactyl's server control plane, built for the rapidly
-changing gaming industry and designed to be highly performant and
-secure. Wings provides an HTTP API allowing you to interface directly
-with running server instances, fetch server logs, generate backups,
-and control all aspects of the server lifecycle.
-
-In addition, Wings ships with a built-in SFTP server allowing your
-system to remain free of Pterodactyl specific dependencies, and
-allowing users to authenticate with the same credentials they would
-normally use to access the Panel.
-
-%prep
-
-%build
-#nothing required
-
-%install
-mkdir -p %{buildroot}%{_bindir}
-mkdir -p %{buildroot}%{_unitdir}
-cp %{_sourcedir}/wings_linux_amd64 %{buildroot}%{_bindir}/wings
-
-cat > %{buildroot}%{_unitdir}/wings.service << EOF
-[Unit]
-Description=Pterodactyl Wings Daemon
-After=docker.service
-Requires=docker.service
-PartOf=docker.service
-StartLimitIntervalSec=600
-
-[Service]
-WorkingDirectory=/etc/pterodactyl
-ExecStart=/usr/bin/wings
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
-StartLimitInterval=180
-StartLimitBurst=30
-RestartSec=5s
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-%files
-%attr(0755, root, root) %{_prefix}/bin/wings
-%attr(0644, root, root) %{_unitdir}/wings.service
-
-%post
-
-# Reload systemd
-systemctl daemon-reload
-
-# Create the required directory structure
-mkdir -p /etc/pterodactyl
-mkdir -p /var/lib/pterodactyl/{archives,backups,volumes}
-mkdir -p /var/log/pterodactyl/install
-
-%preun
-
-systemctl is-active %{name} >/dev/null 2>&1
-if [ $? -eq 0 ]; then
-    systemctl stop %{name}
-fi
-
-systemctl is-enabled %{name} >/dev/null 2>&1
-if [ $? -eq 0 ]; then
-    systemctl disable %{name}
-fi
-
-%postun
-rm -rf /var/log/pterodactyl
-
-%verifyscript
-
-wings --version
-
-%changelog
-* Wed Oct 27 2021 Capitol Hosting Solutions Systems Engineering <syseng@chs.gg> - 1.5.3-1
-- specfile by Capitol Hosting Solutions, Upstream by Pterodactyl
-- Rebased for https://github.com/pterodactyl/wings/releases/tag/v1.5.3
-- Fixes improper event registration and error handling during socket authentication that would cause the incorrect error message to be returned to the client, or no error in some scenarios. Event registration is now delayed until the socket is fully authenticated to ensure needless listeners are not registed.
-- Fixes dollar signs always being evaluated as environment variables with no way to escape them. They can now be escaped as $$ which will transform into a single dollar sign.
-- A websocket connection to a server will be closed by Wings if there is a send error encountered and the client will be left to handle reconnections, rather than simply logging the error and continuing to listen for new events.
-
-* Sun Sep 12 2021 Capitol Hosting Solutions Systems Engineering <syseng@chs.gg> - 1.5.0-1
-- specfile by Capitol Hosting Solutions, Upstream by Pterodactyl
-- Rebased for https://github.com/pterodactyl/wings/releases/tag/v1.5.0
-- Fixes a race condition when setting the application name in the console output for a server.
-- Fixes a server being reinstalled causing the file_denylist parameter for an Egg to be ignored until Wings is restarted.
-- Fixes YAML file parser not correctly setting boolean values.
-- Fixes potential issue where the underlying websocket connection is closed but the parent request context is not yet canceled causing a write over a closed connection.
-- Fixes race condition when closing all active websocket connections when a server is deleted.
-- Fixes logic to determine if a server's context is closed out and send a websocket close message to connected clients. Previously this fired off whenever the request itself was closed, and not when the server context was closed.
-- Exposes 8080 in the wings Dockerfile to better support reverse proxy tools.
-- Releases are now built using Go 1.17 — the minimum version required to build Wings remains Go 1.16.
-- Simplifed the logic powering server updates to only pull information from the Panel rather than trying to accept updated values. All parts of Wings needing the most up-to-date server details should call Server#Sync() to fetch the latest stored build information.
-- Installer#New() no longer requires passing all of the server data as a byte slice, rather a new Installer#ServerDetails struct is exposed which can be passed and accepts a UUID and if the server should be started after the installer finishes.
-- Removes complicated (and unused) logic during the server installation process that was a hold-over from legacy Wings architectures.
-- Removes the PATCH /api/servers/:server endpoint — if you were previously using this API call it should be replaced with POST /api/servers/:server/sync.
-
-* Wed Aug 25 2021 Capitol Hosting Solutions Systems Engineering <syseng@chs.gg> - 1.4.7-1
-- specfile by Capitol Hosting Solutions, Upstream by Pterodactyl
-- Rebased for https://github.com/pterodactyl/wings/releases/tag/v1.4.7
-- SFTP access is now properly denied if a server is suspended.
-- Correctly uses start_on_completion and crash_detection_enabled for servers.

server/activity.go

@@ -1,7 +1,11 @@
 package server
 
 import (
+	"context"
+	"time"
+
 	"emperror.dev/errors"
+
 	"github.com/pterodactyl/wings/internal/database"
 	"github.com/pterodactyl/wings/internal/models"
 )
@@ -15,6 +19,7 @@ const (
 	ActivitySftpCreateDirectory = models.Event("server:sftp.create-directory")
 	ActivitySftpRename          = models.Event("server:sftp.rename")
 	ActivitySftpDelete          = models.Event("server:sftp.delete")
+	ActivityFileUploaded        = models.Event("server:file.uploaded")
 )
 
 // RequestActivity is a wrapper around a LoggedEvent that is able to track additional request
@@ -34,29 +39,6 @@ func (ra RequestActivity) Event(event models.Event, metadata models.ActivityMeta
 	return a.SetUser(ra.user)
 }
 
-// Save creates a new event instance and saves it. If an error is encountered it is automatically
-// logged to the provided server's error logging output. The error is also returned to the caller
-// but can be ignored.
-func (ra RequestActivity) Save(s *Server, event models.Event, metadata models.ActivityMeta) error {
-	if tx := database.Instance().Create(ra.Event(event, metadata)); tx.Error != nil {
-		err := errors.WithStackIf(tx.Error)
-
-		s.Log().WithField("error", err).WithField("event", event).Error("activity: failed to save event")
-
-		return err
-	}
-	return nil
-}
-
-// IP returns the IP address associated with this entry.
-func (ra RequestActivity) IP() string {
-	return ra.ip
-}
-
-func (ra *RequestActivity) User() string {
-	return ra.user
-}
-
 // SetUser clones the RequestActivity struct and sets a new user value on the copy
 // before returning it.
 func (ra RequestActivity) SetUser(u string) RequestActivity {
@@ -68,3 +50,17 @@ func (ra RequestActivity) SetUser(u string) RequestActivity {
 func (s *Server) NewRequestActivity(user string, ip string) RequestActivity {
 	return RequestActivity{server: s.ID(), user: user, ip: ip}
 }
+
+// SaveActivity saves an activity entry to the database in a background routine. If an error is
+// encountered it is logged but not returned to the caller.
+func (s *Server) SaveActivity(a RequestActivity, event models.Event, metadata models.ActivityMeta) {
+	ctx, cancel := context.WithTimeout(s.Context(), time.Second*3)
+	go func() {
+		defer cancel()
+		if tx := database.Instance().WithContext(ctx).Create(a.Event(event, metadata)); tx.Error != nil {
+			s.Log().WithField("error", errors.WithStack(tx.Error)).
+				WithField("event", event).
+				Error("activity: failed to save event")
+		}
+	}()
+}

server/backup.go

@@ -24,7 +24,6 @@ func (s *Server) notifyPanelOfBackup(uuid string, ad *backup.ArchiveDetails, suc
 				"backup": uuid,
 				"error":  err,
 			}).Error("failed to notify panel of backup status due to wings error")
-
 			return err
 		}
 
@@ -127,7 +126,7 @@ func (s *Server) RestoreBackup(b backup.BackupInterface, reader io.ReadCloser) (
 	defer func() {
 		s.Config().SetSuspended(false)
 		if reader != nil {
-			reader.Close()
+			_ = reader.Close()
 		}
 	}()
 	// Send an API call to the Panel as soon as this function is done running so that
@@ -142,7 +141,7 @@ func (s *Server) RestoreBackup(b backup.BackupInterface, reader io.ReadCloser) (
 	// instance, otherwise you'll likely hit all types of write errors due to the
 	// server being suspended.
 	if s.Environment.State() != environment.ProcessOfflineState {
-		if err = s.Environment.WaitForStop(s.Context(), time.Minute*2, false); err != nil {
+		if err = s.Environment.WaitForStop(s.Context(), 2*time.Minute, false); err != nil {
 			if !client.IsErrNotFound(err) {
 				return errors.WrapIf(err, "server/backup: restore: failed to wait for container stop")
 			}
@@ -152,14 +151,19 @@ func (s *Server) RestoreBackup(b backup.BackupInterface, reader io.ReadCloser) (
 	// Attempt to restore the backup to the server by running through each entry
 	// in the file one at a time and writing them to the disk.
 	s.Log().Debug("starting file writing process for backup restoration")
-	err = b.Restore(s.Context(), reader, func(file string, r io.Reader, mode fs.FileMode, atime, mtime time.Time) error {
+	err = b.Restore(s.Context(), reader, func(file string, info fs.FileInfo, r io.ReadCloser) error {
+		defer r.Close()
 		s.Events().Publish(DaemonMessageEvent, "(restoring): "+file)
+
 		if err := s.Filesystem().Writefile(file, r); err != nil {
 			return err
 		}
-		if err := s.Filesystem().Chmod(file, mode); err != nil {
+		if err := s.Filesystem().Chmod(file, info.Mode()); err != nil {
 			return err
 		}
+
+		atime := info.ModTime()
+		mtime := atime
 		return s.Filesystem().Chtimes(file, atime, mtime)
 	})
 

server/backup/backup.go

@@ -8,16 +8,21 @@ import (
 	"io/fs"
 	"os"
 	"path"
-	"time"
 
 	"emperror.dev/errors"
 	"github.com/apex/log"
+	"github.com/mholt/archiver/v4"
 	"golang.org/x/sync/errgroup"
 
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/remote"
 )
 
+var format = archiver.CompressedArchive{
+	Compression: archiver.Gz{},
+	Archival:    archiver.Tar{},
+}
+
 type AdapterType string
 
 const (
@@ -27,12 +32,12 @@ const (
 
 // RestoreCallback is a generic restoration callback that exists for both local
 // and remote backups allowing the files to be restored.
-type RestoreCallback func(file string, r io.Reader, mode fs.FileMode, atime, mtime time.Time) error
+type RestoreCallback func(file string, info fs.FileInfo, r io.ReadCloser) error
 
 // noinspection GoNameStartsWithPackageName
 type BackupInterface interface {
 	// SetClient sets the API request client on the backup interface.
-	SetClient(c remote.Client)
+	SetClient(remote.Client)
 	// Identifier returns the UUID of this backup as tracked by the panel
 	// instance.
 	Identifier() string
@@ -41,7 +46,7 @@ type BackupInterface interface {
 	WithLogContext(map[string]interface{})
 	// Generate creates a backup in whatever the configured source for the
 	// specific implementation is.
-	Generate(ctx context.Context, basePath string, ignore string) (*ArchiveDetails, error)
+	Generate(context.Context, string, string) (*ArchiveDetails, error)
 	// Ignored returns the ignored files for this backup instance.
 	Ignored() string
 	// Checksum returns a SHA1 checksum for the generated backup.
@@ -53,13 +58,13 @@ type BackupInterface interface {
 	// to store it until it is moved to the final spot.
 	Path() string
 	// Details returns details about the archive.
-	Details(ctx context.Context) (*ArchiveDetails, error)
+	Details(context.Context, []remote.BackupPart) (*ArchiveDetails, error)
 	// Remove removes a backup file.
 	Remove() error
 	// Restore is called when a backup is ready to be restored to the disk from
 	// the given source. Not every backup implementation will support this nor
 	// will every implementation require a reader be provided.
-	Restore(ctx context.Context, reader io.Reader, callback RestoreCallback) error
+	Restore(context.Context, io.Reader, RestoreCallback) error
 }
 
 type Backup struct {
@@ -119,8 +124,8 @@ func (b *Backup) Checksum() ([]byte, error) {
 
 // Details returns both the checksum and size of the archive currently stored on
 // the disk to the caller.
-func (b *Backup) Details(ctx context.Context) (*ArchiveDetails, error) {
+func (b *Backup) Details(ctx context.Context, parts []remote.BackupPart) (*ArchiveDetails, error) {
-	ad := ArchiveDetails{ChecksumType: "sha1"}
+	ad := ArchiveDetails{ChecksumType: "sha1", Parts: parts}
 	g, ctx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -165,6 +170,7 @@ type ArchiveDetails struct {
 	Checksum     string              `json:"checksum"`
 	ChecksumType string              `json:"checksum_type"`
 	Size         int64               `json:"size"`
+	Parts        []remote.BackupPart `json:"parts"`
 }
 
 // ToRequest returns a request object.
@@ -174,5 +180,6 @@ func (ad *ArchiveDetails) ToRequest(successful bool) remote.BackupRequest {
 		ChecksumType: ad.ChecksumType,
 		Size:         ad.Size,
 		Successful:   successful,
+		Parts:        ad.Parts,
 	}
 }

server/backup/backup_local.go

@@ -6,8 +6,10 @@ import (
 	"os"
 
 	"emperror.dev/errors"
-	"github.com/mholt/archiver/v3"
+	"github.com/juju/ratelimit"
+	"github.com/mholt/archiver/v4"
 
+	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/remote"
 	"github.com/pterodactyl/wings/server/filesystem"
 )
@@ -64,12 +66,12 @@ func (b *LocalBackup) Generate(ctx context.Context, basePath, ignore string) (*A
 	}
 
 	b.log().WithField("path", b.Path()).Info("creating backup for server")
-	if err := a.Create(b.Path()); err != nil {
+	if err := a.Create(ctx, b.Path()); err != nil {
 		return nil, err
 	}
 	b.log().Info("created backup successfully")
 
-	ad, err := b.Details(ctx)
+	ad, err := b.Details(ctx, nil)
 	if err != nil {
 		return nil, errors.WrapIf(err, "backup: failed to get archive details for local backup")
 	}
@@ -79,16 +81,27 @@ func (b *LocalBackup) Generate(ctx context.Context, basePath, ignore string) (*A
 // Restore will walk over the archive and call the callback function for each
 // file encountered.
 func (b *LocalBackup) Restore(ctx context.Context, _ io.Reader, callback RestoreCallback) error {
-	return archiver.Walk(b.Path(), func(f archiver.File) error {
+	f, err := os.Open(b.Path())
-		select {
+	if err != nil {
-		case <-ctx.Done():
+		return err
-			// Stop walking if the context is canceled.
+	}
-			return archiver.ErrStopWalk
+
-		default:
+	var reader io.Reader = f
-			if f.IsDir() {
+	// Steal the logic we use for making backups which will be applied when restoring
+	// this specific backup. This allows us to prevent overloading the disk unintentionally.
+	if writeLimit := int64(config.Get().System.Backups.WriteLimit * 1024 * 1024); writeLimit > 0 {
+		reader = ratelimit.Reader(f, ratelimit.NewBucketWithRate(float64(writeLimit), writeLimit))
+	}
+	if err := format.Extract(ctx, reader, nil, func(ctx context.Context, f archiver.File) error {
+		r, err := f.Open()
+		if err != nil {
+			return err
+		}
+		defer r.Close()
+
+		return callback(filesystem.ExtractNameFromArchive(f), f.FileInfo, r)
+	}); err != nil {
+		return err
+	}
 	return nil
-			}
-			return callback(filesystem.ExtractNameFromArchive(f), f, f.Mode(), f.ModTime(), f.ModTime())
-		}
-	})
 }

server/backup/backup_s3.go

@@ -1,8 +1,6 @@
 package backup
 
 import (
-	"archive/tar"
-	"compress/gzip"
 	"context"
 	"fmt"
 	"io"
@@ -13,13 +11,12 @@ import (
 
 	"emperror.dev/errors"
 	"github.com/cenkalti/backoff/v4"
-
-	"github.com/pterodactyl/wings/server/filesystem"
-
 	"github.com/juju/ratelimit"
+	"github.com/mholt/archiver/v4"
 
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/remote"
+	"github.com/pterodactyl/wings/server/filesystem"
 )
 
 type S3Backup struct {
@@ -60,7 +57,7 @@ func (s *S3Backup) Generate(ctx context.Context, basePath, ignore string) (*Arch
 	}
 
 	s.log().WithField("path", s.Path()).Info("creating backup for server")
-	if err := a.Create(s.Path()); err != nil {
+	if err := a.Create(ctx, s.Path()); err != nil {
 		return nil, err
 	}
 	s.log().Info("created backup successfully")
@@ -71,10 +68,11 @@ func (s *S3Backup) Generate(ctx context.Context, basePath, ignore string) (*Arch
 	}
 	defer rc.Close()
 
-	if err := s.generateRemoteRequest(ctx, rc); err != nil {
+	parts, err := s.generateRemoteRequest(ctx, rc)
+	if err != nil {
 		return nil, err
 	}
-	ad, err := s.Details(ctx)
+	ad, err := s.Details(ctx, parts)
 	if err != nil {
 		return nil, errors.WrapIf(err, "backup: failed to get archive details after upload")
 	}
@@ -95,50 +93,35 @@ func (s *S3Backup) Restore(ctx context.Context, r io.Reader, callback RestoreCal
 	if writeLimit := int64(config.Get().System.Backups.WriteLimit * 1024 * 1024); writeLimit > 0 {
 		reader = ratelimit.Reader(r, ratelimit.NewBucketWithRate(float64(writeLimit), writeLimit))
 	}
-	gr, err := gzip.NewReader(reader)
+	if err := format.Extract(ctx, reader, nil, func(ctx context.Context, f archiver.File) error {
+		r, err := f.Open()
 		if err != nil {
 			return err
 		}
-	defer gr.Close()
+		defer r.Close()
-	tr := tar.NewReader(gr)
+
-	for {
+		return callback(filesystem.ExtractNameFromArchive(f), f.FileInfo, r)
-		select {
+	}); err != nil {
-		case <-ctx.Done():
-			return nil
-		default:
-			// Do nothing, fall through to the next block of code in this loop.
-		}
-		header, err := tr.Next()
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
 		return err
 	}
-		if header.Typeflag == tar.TypeReg {
-			if err := callback(header.Name, tr, header.FileInfo().Mode(), header.AccessTime, header.ModTime); err != nil {
-				return err
-			}
-		}
-	}
 	return nil
 }
 
 // Generates the remote S3 request and begins the upload.
-func (s *S3Backup) generateRemoteRequest(ctx context.Context, rc io.ReadCloser) error {
+func (s *S3Backup) generateRemoteRequest(ctx context.Context, rc io.ReadCloser) ([]remote.BackupPart, error) {
 	defer rc.Close()
 
 	s.log().Debug("attempting to get size of backup...")
 	size, err := s.Backup.Size()
 	if err != nil {
-		return err
+		return nil, err
 	}
 	s.log().WithField("size", size).Debug("got size of backup")
 
 	s.log().Debug("attempting to get S3 upload urls from Panel...")
 	urls, err := s.client.GetBackupRemoteUploadURLs(context.Background(), s.Backup.Uuid, size)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	s.log().Debug("got S3 upload urls from the Panel")
 	s.log().WithField("parts", len(urls.Parts)).Info("attempting to upload backup to s3 endpoint...")
@@ -156,22 +139,26 @@ func (s *S3Backup) generateRemoteRequest(ctx context.Context, rc io.ReadCloser)
 		}
 
 		// Attempt to upload the part.
-		if _, err := uploader.uploadPart(ctx, part, partSize); err != nil {
+		etag, err := uploader.uploadPart(ctx, part, partSize)
+		if err != nil {
 			s.log().WithField("part_id", i+1).WithError(err).Warn("failed to upload part")
-			return err
+			return nil, err
 		}
-
+		uploader.uploadedParts = append(uploader.uploadedParts, remote.BackupPart{
+			ETag:       etag,
+			PartNumber: i + 1,
+		})
 		s.log().WithField("part_id", i+1).Info("successfully uploaded backup part")
 	}
-
 	s.log().WithField("parts", len(urls.Parts)).Info("backup has been successfully uploaded")
 
-	return nil
+	return uploader.uploadedParts, nil
 }
 
 type s3FileUploader struct {
 	io.ReadCloser
 	client        *http.Client
+	uploadedParts []remote.BackupPart
 }
 
 // newS3FileUploader returns a new file uploader instance.

server/configuration.go

@@ -16,6 +16,11 @@ type EggConfiguration struct {
 	FileDenylist []string `json:"file_denylist"`
 }
 
+type ConfigurationMeta struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+}
+
 type Configuration struct {
 	mu sync.RWMutex
 
@@ -24,6 +29,8 @@ type Configuration struct {
 	// docker containers as well as in log output.
 	Uuid string `json:"uuid"`
 
+	Meta ConfigurationMeta `json:"meta"`
+
 	// Whether or not the server is in a suspended state. Suspended servers cannot
 	// be started or modified except in certain scenarios by an admin user.
 	Suspended bool `json:"suspended"`
@@ -39,6 +46,9 @@ type Configuration struct {
 	// server process.
 	EnvVars environment.Variables `json:"environment"`
 
+	// Labels is a map of container labels that should be applied to the running server process.
+	Labels map[string]string `json:"labels"`
+
 	Allocations           environment.Allocations `json:"allocations"`
 	Build                 environment.Limits      `json:"build"`
 	CrashDetectionEnabled bool                    `json:"crash_detection_enabled"`

server/console.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/mitchellh/colorstring"
+
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/system"
 )

server/events.go

@@ -5,8 +5,7 @@ import (
 	"github.com/pterodactyl/wings/system"
 )
 
-// Defines all of the possible output events for a server.
+// Defines all the possible output events for a server.
-// noinspection GoNameStartsWithPackageName
 const (
 	DaemonMessageEvent          = "daemon message"
 	InstallOutputEvent          = "install output"
@@ -19,6 +18,7 @@ const (
 	BackupCompletedEvent        = "backup completed"
 	TransferLogsEvent           = "transfer logs"
 	TransferStatusEvent         = "transfer status"
+	DeletedEvent                = "deleted"
 )
 
 // Events returns the server's emitter instance.

server/filesystem/archive.go

@@ -2,6 +2,7 @@ package filesystem
 
 import (
 	"archive/tar"
+	"context"
 	"io"
 	"io/fs"
 	"os"
@@ -17,6 +18,7 @@ import (
 	ignore "github.com/sabhiram/go-gitignore"
 
 	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/internal/progress"
 )
 
 const memory = 4 * 1024
@@ -28,6 +30,31 @@ var pool = sync.Pool{
 	},
 }
 
+// TarProgress .
+type TarProgress struct {
+	*tar.Writer
+	p *progress.Progress
+}
+
+// NewTarProgress .
+func NewTarProgress(w *tar.Writer, p *progress.Progress) *TarProgress {
+	if p != nil {
+		p.Writer = w
+	}
+	return &TarProgress{
+		Writer: w,
+		p:      p,
+	}
+}
+
+// Write .
+func (p *TarProgress) Write(v []byte) (int, error) {
+	if p.p == nil {
+		return p.Writer.Write(v)
+	}
+	return p.p.Write(v)
+}
+
 type Archive struct {
 	// BasePath is the absolute path to create the archive from where Files and Ignore are
 	// relative to.
@@ -40,11 +67,14 @@ type Archive struct {
 	// Files specifies the files to archive, this takes priority over the Ignore option, if
 	// unspecified, all files in the BasePath will be archived unless Ignore is set.
 	Files []string
+
+	// Progress wraps the writer of the archive to pass through the progress tracker.
+	Progress *progress.Progress
 }
 
-// Create creates an archive at dst with all of the files defined in the
+// Create creates an archive at dst with all the files defined in the
-// included files struct.
+// included Files array.
-func (a *Archive) Create(dst string) error {
+func (a *Archive) Create(ctx context.Context, dst string) error {
 	f, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 	if err != nil {
 		return err
@@ -62,8 +92,26 @@ func (a *Archive) Create(dst string) error {
 		writer = f
 	}
 
+	return a.Stream(ctx, writer)
+}
+
+// Stream .
+func (a *Archive) Stream(ctx context.Context, w io.Writer) error {
+	// Choose which compression level to use based on the compression_level configuration option
+	var compressionLevel int
+	switch config.Get().System.Backups.CompressionLevel {
+	case "none":
+		compressionLevel = pgzip.NoCompression
+	case "best_compression":
+		compressionLevel = pgzip.BestCompression
+	case "best_speed":
+		fallthrough
+	default:
+		compressionLevel = pgzip.BestSpeed
+	}
+
 	// Create a new gzip writer around the file.
-	gw, _ := pgzip.NewWriterLevel(writer, pgzip.BestSpeed)
+	gw, _ := pgzip.NewWriterLevel(w, compressionLevel)
 	_ = gw.SetConcurrency(1<<20, 1)
 	defer gw.Close()
 
@@ -71,20 +119,22 @@ func (a *Archive) Create(dst string) error {
 	tw := tar.NewWriter(gw)
 	defer tw.Close()
 
+	pw := NewTarProgress(tw, a.Progress)
+
 	// Configure godirwalk.
 	options := &godirwalk.Options{
 		FollowSymbolicLinks: false,
 		Unsorted:            true,
-		Callback:            a.callback(tw),
 	}
 
 	// If we're specifically looking for only certain files, or have requested
 	// that certain files be ignored we'll update the callback function to reflect
 	// that request.
+	var callback godirwalk.WalkFunc
 	if len(a.Files) == 0 && len(a.Ignore) > 0 {
 		i := ignore.CompileIgnoreLines(strings.Split(a.Ignore, "\n")...)
 
-		options.Callback = a.callback(tw, func(_ string, rp string) error {
+		callback = a.callback(pw, func(_ string, rp string) error {
 			if i.MatchesPath(rp) {
 				return godirwalk.SkipThis
 			}
@@ -92,7 +142,19 @@ func (a *Archive) Create(dst string) error {
 			return nil
 		})
 	} else if len(a.Files) > 0 {
-		options.Callback = a.withFilesCallback(tw)
+		callback = a.withFilesCallback(pw)
+	} else {
+		callback = a.callback(pw)
+	}
+
+	// Set the callback function, wrapped with support for context cancellation.
+	options.Callback = func(path string, de *godirwalk.Dirent) error {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+			return callback(path, de)
+		}
 	}
 
 	// Recursively walk the path we are archiving.
@@ -101,9 +163,9 @@ func (a *Archive) Create(dst string) error {
 
 // Callback function used to determine if a given file should be included in the archive
 // being generated.
-func (a *Archive) callback(tw *tar.Writer, opts ...func(path string, relative string) error) func(path string, de *godirwalk.Dirent) error {
+func (a *Archive) callback(tw *TarProgress, opts ...func(path string, relative string) error) func(path string, de *godirwalk.Dirent) error {
 	return func(path string, de *godirwalk.Dirent) error {
-		// Skip directories because we walking them recursively.
+		// Skip directories because we are walking them recursively.
 		if de.IsDir() {
 			return nil
 		}
@@ -125,7 +187,7 @@ func (a *Archive) callback(tw *tar.Writer, opts ...func(path string, relative st
 }
 
 // Pushes only files defined in the Files key to the final archive.
-func (a *Archive) withFilesCallback(tw *tar.Writer) func(path string, de *godirwalk.Dirent) error {
+func (a *Archive) withFilesCallback(tw *TarProgress) func(path string, de *godirwalk.Dirent) error {
 	return a.callback(tw, func(p string, rp string) error {
 		for _, f := range a.Files {
 			// If the given doesn't match, or doesn't have the same prefix continue
@@ -146,9 +208,9 @@ func (a *Archive) withFilesCallback(tw *tar.Writer) func(path string, de *godirw
 }
 
 // Adds a given file path to the final archive being created.
-func (a *Archive) addToArchive(p string, rp string, w *tar.Writer) error {
+func (a *Archive) addToArchive(p string, rp string, w *TarProgress) error {
 	// Lstat the file, this will give us the same information as Stat except that it will not
-	// follow a symlink to it's target automatically. This is important to avoid including
+	// follow a symlink to its target automatically. This is important to avoid including
 	// files that exist outside the server root unintentionally in the backup.
 	s, err := os.Lstat(p)
 	if err != nil {
@@ -173,7 +235,7 @@ func (a *Archive) addToArchive(p string, rp string, w *tar.Writer) error {
 		// it doesn't work.
 		target, err = os.Readlink(s.Name())
 		if err != nil {
-			// Ignore the not exist errors specifically, since theres nothing important about that.
+			// Ignore the not exist errors specifically, since there is nothing important about that.
 			if !os.IsNotExist(err) {
 				log.WithField("path", rp).WithField("readlink_err", err.Error()).Warn("failed reading symlink for target path; skipping...")
 			}

server/filesystem/compress.go

@@ -4,9 +4,10 @@ import (
 	"archive/tar"
 	"archive/zip"
 	"compress/gzip"
+	"context"
 	"fmt"
-	gzip2 "github.com/klauspost/compress/gzip"
+	"io"
-	zip2 "github.com/klauspost/compress/zip"
+	iofs "io/fs"
 	"os"
 	"path"
 	"path/filepath"
@@ -16,10 +17,12 @@ import (
 	"time"
 
 	"emperror.dev/errors"
-	"github.com/mholt/archiver/v3"
+	gzip2 "github.com/klauspost/compress/gzip"
+	zip2 "github.com/klauspost/compress/zip"
+	"github.com/mholt/archiver/v4"
 )
 
-// CompressFiles compresses all of the files matching the given paths in the
+// CompressFiles compresses all the files matching the given paths in the
 // specified directory. This function also supports passing nested paths to only
 // compress certain files and folders when working in a larger directory. This
 // effectively creates a local backup, but rather than ignoring specific files
@@ -34,7 +37,7 @@ func (fs *Filesystem) CompressFiles(dir string, paths []string) (os.FileInfo, er
 		return nil, err
 	}
 
-	// Take all of the paths passed in and merge them together with the root directory we've gotten.
+	// Take all the paths passed in and merge them together with the root directory we've gotten.
 	for i, p := range paths {
 		paths[i] = filepath.Join(cleanedRootDir, p)
 	}
@@ -50,7 +53,7 @@ func (fs *Filesystem) CompressFiles(dir string, paths []string) (os.FileInfo, er
 		fmt.Sprintf("archive-%s.tar.gz", strings.ReplaceAll(time.Now().Format(time.RFC3339), ":", "")),
 	)
 
-	if err := a.Create(d); err != nil {
+	if err := a.Create(context.Background(), d); err != nil {
 		return nil, err
 	}
 
@@ -72,7 +75,7 @@ func (fs *Filesystem) CompressFiles(dir string, paths []string) (os.FileInfo, er
 
 // SpaceAvailableForDecompression looks through a given archive and determines
 // if decompressing it would put the server over its allocated disk space limit.
-func (fs *Filesystem) SpaceAvailableForDecompression(dir string, file string) error {
+func (fs *Filesystem) SpaceAvailableForDecompression(ctx context.Context, dir string, file string) error {
 	// Don't waste time trying to determine this if we know the server will have the space for
 	// it since there is no limit.
 	if fs.MaxDisk() <= 0 {
@@ -88,68 +91,139 @@ func (fs *Filesystem) SpaceAvailableForDecompression(dir string, file string) er
 	// waiting an unnecessary amount of time on this call.
 	dirSize, err := fs.DiskUsage(false)
 
-	var size int64
+	fsys, err := archiver.FileSystem(source)
-	// Walk over the archive and figure out just how large the final output would be from unarchiving it.
-	err = archiver.Walk(source, func(f archiver.File) error {
-		if atomic.AddInt64(&size, f.Size())+dirSize > fs.MaxDisk() {
-			return newFilesystemError(ErrCodeDiskSpace, nil)
-		}
-		return nil
-	})
 	if err != nil {
-		if IsUnknownArchiveFormatError(err) {
+		if errors.Is(err, archiver.ErrNoMatch) {
 			return newFilesystemError(ErrCodeUnknownArchive, err)
 		}
 		return err
 	}
+
+	var size int64
+	return iofs.WalkDir(fsys, ".", func(path string, d iofs.DirEntry, err error) error {
+		if err != nil {
 			return err
+		}
+
+		select {
+		case <-ctx.Done():
+			// Stop walking if the context is canceled.
+			return ctx.Err()
+		default:
+			info, err := d.Info()
+			if err != nil {
+				return err
+			}
+			if atomic.AddInt64(&size, info.Size())+dirSize > fs.MaxDisk() {
+				return newFilesystemError(ErrCodeDiskSpace, nil)
+			}
+			return nil
+		}
+	})
 }
 
 // DecompressFile will decompress a file in a given directory by using the
 // archiver tool to infer the file type and go from there. This will walk over
-// all of the files within the given archive and ensure that there is not a
+// all the files within the given archive and ensure that there is not a
 // zip-slip attack being attempted by validating that the final path is within
 // the server data directory.
-func (fs *Filesystem) DecompressFile(dir string, file string) error {
+func (fs *Filesystem) DecompressFile(ctx context.Context, dir string, file string) error {
 	source, err := fs.SafePath(filepath.Join(dir, file))
 	if err != nil {
 		return err
 	}
-	// Ensure that the source archive actually exists on the system.
+	return fs.DecompressFileUnsafe(ctx, dir, source)
-	if _, err := os.Stat(source); err != nil {
+}
+
+// DecompressFileUnsafe will decompress any file on the local disk without checking
+// if it is owned by the server.  The file will be SAFELY decompressed and extracted
+// into the server's directory.
+func (fs *Filesystem) DecompressFileUnsafe(ctx context.Context, dir string, file string) error {
+	// Ensure that the archive actually exists on the system.
+	if _, err := os.Stat(file); err != nil {
 		return errors.WithStack(err)
 	}
 
-	// Walk all of the files in the archiver file and write them to the disk. If any
+	f, err := os.Open(file)
-	// directory is encountered it will be skipped since we handle creating any missing
+	if err != nil {
-	// directories automatically when writing files.
+		return err
-	err = archiver.Walk(source, func(f archiver.File) error {
+	}
+	// TODO: defer file close?
+
+	// Identify the type of archive we are dealing with.
+	format, input, err := archiver.Identify(filepath.Base(file), f)
+	if err != nil {
+		if errors.Is(err, archiver.ErrNoMatch) {
+			return newFilesystemError(ErrCodeUnknownArchive, err)
+		}
+		return err
+	}
+
+	return fs.extractStream(ctx, extractStreamOptions{
+		Directory: dir,
+		Format:    format,
+		Reader:    input,
+	})
+}
+
+// ExtractStreamUnsafe .
+func (fs *Filesystem) ExtractStreamUnsafe(ctx context.Context, dir string, r io.Reader) error {
+	format, input, err := archiver.Identify("archive.tar.gz", r)
+	if err != nil {
+		if errors.Is(err, archiver.ErrNoMatch) {
+			return newFilesystemError(ErrCodeUnknownArchive, err)
+		}
+		return err
+	}
+
+	return fs.extractStream(ctx, extractStreamOptions{
+		Directory: dir,
+		Format:    format,
+		Reader:    input,
+	})
+}
+
+type extractStreamOptions struct {
+	// The directory to extract the archive to.
+	Directory string
+	// File name of the archive.
+	FileName string
+	// Format of the archive.
+	Format archiver.Format
+	// Reader for the archive.
+	Reader io.Reader
+}
+
+func (fs *Filesystem) extractStream(ctx context.Context, opts extractStreamOptions) error {
+	// Decompress and extract archive
+	if ex, ok := opts.Format.(archiver.Extractor); ok {
+		return ex.Extract(ctx, opts.Reader, nil, func(ctx context.Context, f archiver.File) error {
 			if f.IsDir() {
 				return nil
 			}
-		p := filepath.Join(dir, ExtractNameFromArchive(f))
+			p := filepath.Join(opts.Directory, ExtractNameFromArchive(f))
 			// If it is ignored, just don't do anything with the file and skip over it.
 			if err := fs.IsIgnored(p); err != nil {
 				return nil
 			}
-		if err := fs.Writefile(p, f); err != nil {
+			r, err := f.Open()
-			return wrapError(err, source)
+			if err != nil {
+				return err
+			}
+			defer r.Close()
+			if err := fs.Writefile(p, r); err != nil {
+				return wrapError(err, opts.FileName)
 			}
 			// Update the file permissions to the one set in the archive.
 			if err := fs.Chmod(p, f.Mode()); err != nil {
-			return wrapError(err, source)
+				return wrapError(err, opts.FileName)
 			}
 			// Update the file modification time to the one set in the archive.
 			if err := fs.Chtimes(p, f.ModTime(), f.ModTime()); err != nil {
-			return wrapError(err, source)
+				return wrapError(err, opts.FileName)
 			}
 			return nil
 		})
-	if err != nil {
-		if IsUnknownArchiveFormatError(err) {
-			return newFilesystemError(ErrCodeUnknownArchive, err)
-		}
-		return err
 	}
 	return nil
 }

server/filesystem/compress_test.go

@@ -1,6 +1,7 @@
 package filesystem
 
 import (
+	"context"
 	"os"
 	"sync/atomic"
 	"testing"
@@ -28,7 +29,7 @@ func TestFilesystem_DecompressFile(t *testing.T) {
 				g.Assert(err).IsNil()
 
 				// decompress
-				err = fs.DecompressFile("/", "test."+ext)
+				err = fs.DecompressFile(context.Background(), "/", "test."+ext)
 				g.Assert(err).IsNil()
 
 				// make sure everything is where it is supposed to be

server/filesystem/disk_space.go

@@ -71,7 +71,7 @@ func (fs *Filesystem) HasSpaceAvailable(allowStaleValue bool) bool {
 	// If space is -1 or 0 just return true, means they're allowed unlimited.
 	//
 	// Technically we could skip disk space calculation because we don't need to check if the
-	// server exceeds it's limit but because this method caches the disk usage it would be best
+	// server exceeds its limit but because this method caches the disk usage it would be best
 	// to calculate the disk usage and always return true.
 	if fs.MaxDisk() == 0 {
 		return true

server/filesystem/errors.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"emperror.dev/errors"
 	"github.com/apex/log"
@@ -122,15 +121,6 @@ func IsErrorCode(err error, code ErrorCode) bool {
 	return false
 }
 
-// IsUnknownArchiveFormatError checks if the error is due to the archive being
-// in an unexpected file format.
-func IsUnknownArchiveFormatError(err error) bool {
-	if err != nil && strings.HasPrefix(err.Error(), "format ") {
-		return true
-	}
-	return false
-}
-
 // NewBadPathResolution returns a new BadPathResolution error.
 func NewBadPathResolution(path string, resolved string) error {
 	return errors.WithStackDepth(&Error{code: ErrCodePathResolution, path: path, resolved: resolved}, 1)

server/install.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"fmt"
 	"html/template"
 	"io"
 	"os"
@@ -18,6 +19,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/client"
+
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/environment"
 	"github.com/pterodactyl/wings/remote"
@@ -418,7 +420,12 @@ func (ip *InstallationProcess) Execute() (string, error) {
 		},
 	}
 
-	tmpfsSize := strconv.Itoa(int(config.Get().Docker.TmpfsSize))
+	cfg := config.Get()
+	if cfg.System.User.Rootless.Enabled {
+		conf.User = fmt.Sprintf("%d:%d", cfg.System.User.Rootless.ContainerUID, cfg.System.User.Rootless.ContainerGID)
+	}
+
+	tmpfsSize := strconv.Itoa(int(cfg.Docker.TmpfsSize))
 	hostConf := &container.HostConfig{
 		Mounts: []mount.Mount{
 			{
@@ -438,17 +445,11 @@ func (ip *InstallationProcess) Execute() (string, error) {
 		Tmpfs: map[string]string{
 			"/tmp": "rw,exec,nosuid,size=" + tmpfsSize + "M",
 		},
-		DNS: config.Get().Docker.Network.Dns,
+		DNS:         cfg.Docker.Network.Dns,
-		LogConfig: container.LogConfig{
+		LogConfig:   cfg.Docker.ContainerLogConfig(),
-			Type: "local",
-			Config: map[string]string{
-				"max-size": "5m",
-				"max-file": "1",
-				"compress": "false",
-			},
-		},
 		Privileged:  true,
-		NetworkMode: container.NetworkMode(config.Get().Docker.Network.Mode),
+		NetworkMode: container.NetworkMode(cfg.Docker.Network.Mode),
+		UsernsMode:  container.UsernsMode(cfg.Docker.UsernsMode),
 	}
 
 	// Ensure the root directory for the server exists properly before attempting

server/installer/installer.go

@@ -5,6 +5,7 @@ import (
 
 	"emperror.dev/errors"
 	"github.com/asaskevich/govalidator"
+
 	"github.com/pterodactyl/wings/remote"
 	"github.com/pterodactyl/wings/server"
 )

server/listeners.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/apex/log"
+
 	"github.com/pterodactyl/wings/events"
 	"github.com/pterodactyl/wings/system"
 

server/manager.go

@@ -205,6 +205,7 @@ func (m *Manager) InitServer(data remote.ServerConfigurationResponse) (*Server,
 		Mounts:      s.Mounts(),
 		Allocations: s.cfg.Allocations,
 		Limits:      s.cfg.Build,
+		Labels:      s.cfg.Labels,
 	}
 
 	envCfg := environment.NewConfiguration(settings, s.GetEnvironmentVariables())

server/power.go

@@ -8,6 +8,7 @@ import (
 
 	"emperror.dev/errors"
 	"github.com/google/uuid"
+
 	"github.com/pterodactyl/wings/config"
 	"github.com/pterodactyl/wings/environment"
 )

server/power_test.go

@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	. "github.com/franela/goblin"
+
 	"github.com/pterodactyl/wings/system"
 )
 

server/transfer/archive.go

@@ -0,0 +1,52 @@
+package transfer
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/pterodactyl/wings/internal/progress"
+	"github.com/pterodactyl/wings/server/filesystem"
+)
+
+// Archive returns an archive that can be used to stream the contents of the
+// contents of a server.
+func (t *Transfer) Archive() (*Archive, error) {
+	if t.archive == nil {
+		// Get the disk usage of the server (used to calculate the progress of the archive process)
+		rawSize, err := t.Server.Filesystem().DiskUsage(true)
+		if err != nil {
+			return nil, fmt.Errorf("transfer: failed to get server disk usage: %w", err)
+		}
+
+		// Create a new archive instance and assign it to the transfer.
+		t.archive = NewArchive(t, uint64(rawSize))
+	}
+
+	return t.archive, nil
+}
+
+// Archive represents an archive used to transfer the contents of a server.
+type Archive struct {
+	archive *filesystem.Archive
+}
+
+// NewArchive returns a new archive associated with the given transfer.
+func NewArchive(t *Transfer, size uint64) *Archive {
+	return &Archive{
+		archive: &filesystem.Archive{
+			BasePath: t.Server.Filesystem().Path(),
+			Progress: progress.NewProgress(size),
+		},
+	}
+}
+
+// Stream returns a reader that can be used to stream the contents of the archive.
+func (a *Archive) Stream(ctx context.Context, w io.Writer) error {
+	return a.archive.Stream(ctx, w)
+}
+
+// Progress returns the current progress of the archive.
+func (a *Archive) Progress() *progress.Progress {
+	return a.archive.Progress
+}

server/transfer/doc.go

@@ -0,0 +1,4 @@
+// Package transfer handles all logic related to transferring servers between
+// two nodes. This includes the logic for archiving a server on the source node
+// and logic for importing a server from the source node into the target node.
+package transfer

server/transfer/manager.go

@@ -0,0 +1,57 @@
+package transfer
+
+import (
+	"sync"
+)
+
+var (
+	incomingTransfers = NewManager()
+	outgoingTransfers = NewManager()
+)
+
+// Incoming returns a transfer manager for incoming transfers.
+func Incoming() *Manager {
+	return incomingTransfers
+}
+
+// Outgoing returns a transfer manager for outgoing transfers.
+func Outgoing() *Manager {
+	return outgoingTransfers
+}
+
+// Manager manages transfers.
+type Manager struct {
+	mu        sync.RWMutex
+	transfers map[string]*Transfer
+}
+
+// NewManager returns a new transfer manager.
+func NewManager() *Manager {
+	return &Manager{
+		transfers: make(map[string]*Transfer),
+	}
+}
+
+// Add adds a transfer to the manager.
+func (m *Manager) Add(transfer *Transfer) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.transfers[transfer.Server.ID()] = transfer
+}
+
+// Remove removes a transfer from the manager.
+func (m *Manager) Remove(transfer *Transfer) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	delete(m.transfers, transfer.Server.ID())
+}
+
+// Get gets a transfer from the manager using a server ID.
+func (m *Manager) Get(id string) *Transfer {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	return m.transfers[id]
+}

server/transfer/source.go

@@ -0,0 +1,159 @@
+package transfer
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"time"
+
+	"github.com/pterodactyl/wings/internal/progress"
+)
+
+// PushArchiveToTarget POSTs the archive to the target node and returns the
+// response body.
+func (t *Transfer) PushArchiveToTarget(url, token string) ([]byte, error) {
+	ctx, cancel := context.WithCancel(t.ctx)
+	defer cancel()
+
+	t.SendMessage("Preparing to stream server data to destination...")
+	t.SetStatus(StatusProcessing)
+
+	a, err := t.Archive()
+	if err != nil {
+		t.Error(err, "Failed to get archive for transfer.")
+		return nil, errors.New("failed to get archive for transfer")
+	}
+
+	t.SendMessage("Streaming archive to destination...")
+
+	// Send the upload progress to the websocket every 5 seconds.
+	ctx2, cancel2 := context.WithCancel(ctx)
+	defer cancel2()
+	go func(ctx context.Context, p *progress.Progress, tc *time.Ticker) {
+		defer tc.Stop()
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-tc.C:
+				t.SendMessage("Uploading " + p.Progress(25))
+			}
+		}
+	}(ctx2, a.Progress(), time.NewTicker(5*time.Second))
+
+	// Create a new request using the pipe as the body.
+	body, writer := io.Pipe()
+	defer body.Close()
+	defer writer.Close()
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", token)
+
+	// Create a new multipart writer that writes the archive to the pipe.
+	mp := multipart.NewWriter(writer)
+	defer mp.Close()
+	req.Header.Set("Content-Type", mp.FormDataContentType())
+
+	// Create a new goroutine to write the archive to the pipe used by the
+	// multipart writer.
+	errChan := make(chan error)
+	go func() {
+		defer close(errChan)
+		defer writer.Close()
+		defer mp.Close()
+
+		src, pw := io.Pipe()
+		defer src.Close()
+		defer pw.Close()
+
+		h := sha256.New()
+		tee := io.TeeReader(src, h)
+
+		dest, err := mp.CreateFormFile("archive", "archive.tar.gz")
+		if err != nil {
+			errChan <- errors.New("failed to create form file")
+			return
+		}
+
+		ch := make(chan error)
+		go func() {
+			defer close(ch)
+
+			if _, err := io.Copy(dest, tee); err != nil {
+				ch <- fmt.Errorf("failed to stream archive to destination: %w", err)
+				return
+			}
+
+			t.Log().Debug("finished copying dest to tee")
+		}()
+
+		if err := a.Stream(ctx, pw); err != nil {
+			errChan <- errors.New("failed to stream archive to pipe")
+			return
+		}
+		t.Log().Debug("finished streaming archive to pipe")
+
+		// Close the pipe writer early to release resources and ensure that the data gets flushed.
+		_ = pw.Close()
+
+		// Wait for the copy to finish before we continue.
+		t.Log().Debug("waiting on copy to finish")
+		if err := <-ch; err != nil {
+			errChan <- err
+			return
+		}
+
+		if err := mp.WriteField("checksum", hex.EncodeToString(h.Sum(nil))); err != nil {
+			errChan <- errors.New("failed to stream checksum")
+			return
+		}
+
+		cancel2()
+		t.SendMessage("Finished streaming archive to destination.")
+
+		if err := mp.Close(); err != nil {
+			t.Log().WithError(err).Error("error while closing multipart writer")
+		}
+		t.Log().Debug("closed multipart writer")
+	}()
+
+	t.Log().Debug("sending archive to destination")
+	client := http.Client{Timeout: 0}
+	res, err := client.Do(req)
+	t.Log().Debug("waiting for stream to complete")
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case err2 := <-errChan:
+		t.Log().Debug("stream completed")
+		if err != nil || err2 != nil {
+			if err == context.Canceled {
+				return nil, err
+			}
+
+			t.Log().WithError(err).Debug("failed to send archive to destination")
+			return nil, fmt.Errorf("http error: %w, multipart error: %v", err, err2)
+		}
+		defer res.Body.Close()
+		t.Log().Debug("received response from destination")
+
+		v, err := io.ReadAll(res.Body)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read response body: %w", err)
+		}
+
+		if res.StatusCode != http.StatusOK {
+			return nil, errors.New(string(v))
+		}
+
+		return v, nil
+	}
+}

server/transfer/transfer.go

@@ -0,0 +1,128 @@
+package transfer
+
+import (
+	"context"
+	"time"
+
+	"github.com/apex/log"
+	"github.com/mitchellh/colorstring"
+
+	"github.com/pterodactyl/wings/server"
+	"github.com/pterodactyl/wings/system"
+)
+
+// Status represents the current status of a transfer.
+type Status string
+
+// String satisfies the fmt.Stringer interface.
+func (s Status) String() string {
+	return string(s)
+}
+
+const (
+	// StatusPending is the status of a transfer when it is first created.
+	StatusPending Status = "pending"
+	// StatusProcessing is the status of a transfer when it is currently in
+	// progress, such as when the archive is being streamed to the target node.
+	StatusProcessing Status = "processing"
+
+	// StatusCancelling is the status of a transfer when it is in the process of
+	// being cancelled.
+	StatusCancelling Status = "cancelling"
+
+	// StatusCancelled is the final status of a transfer when it has been
+	// cancelled.
+	StatusCancelled Status = "cancelled"
+	// StatusFailed is the final status of a transfer when it has failed.
+	StatusFailed Status = "failed"
+	// StatusCompleted is the final status of a transfer when it has completed.
+	StatusCompleted Status = "completed"
+)
+
+// Transfer represents a transfer of a server from one node to another.
+type Transfer struct {
+	// ctx is the context for the transfer.
+	ctx context.Context
+	// cancel is used to cancel all ongoing transfer operations for the server.
+	cancel *context.CancelFunc
+
+	// Server associated with the transfer.
+	Server *server.Server
+	// status of the transfer.
+	status *system.Atomic[Status]
+
+	// archive is the archive that is being created for the transfer.
+	archive *Archive
+}
+
+// New returns a new transfer instance for the given server.
+func New(ctx context.Context, s *server.Server) *Transfer {
+	ctx, cancel := context.WithCancel(ctx)
+
+	return &Transfer{
+		ctx:    ctx,
+		cancel: &cancel,
+
+		Server: s,
+		status: system.NewAtomic(StatusPending),
+	}
+}
+
+// Context returns the context for the transfer.
+func (t *Transfer) Context() context.Context {
+	return t.ctx
+}
+
+// Cancel cancels the transfer.
+func (t *Transfer) Cancel() {
+	status := t.Status()
+	if status == StatusCancelling ||
+		status == StatusCancelled ||
+		status == StatusCompleted ||
+		status == StatusFailed {
+		return
+	}
+
+	if t.cancel == nil {
+		return
+	}
+
+	t.SetStatus(StatusCancelling)
+	(*t.cancel)()
+}
+
+// Status returns the current status of the transfer.
+func (t *Transfer) Status() Status {
+	return t.status.Load()
+}
+
+// SetStatus sets the status of the transfer.
+func (t *Transfer) SetStatus(s Status) {
+	// TODO: prevent certain status changes from happening.
+	// If we are cancelling, then we can't go back to processing.
+	t.status.Store(s)
+
+	t.Server.Events().Publish(server.TransferStatusEvent, s)
+}
+
+// SendMessage sends a message to the server's console.
+func (t *Transfer) SendMessage(v string) {
+	t.Server.Events().Publish(
+		server.TransferLogsEvent,
+		colorstring.Color("[yellow][bold]"+time.Now().Format(time.RFC1123)+" [Transfer System] [Source Node]:[default] "+v),
+	)
+}
+
+// Error logs an error that occurred on the source node.
+func (t *Transfer) Error(err error, v string) {
+	t.Log().WithError(err).Error(v)
+	t.SendMessage(v)
+}
+
+// Log returns a logger for the transfer.
+func (t *Transfer) Log() *log.Entry {
+	if t.Server == nil {
+		return log.WithField("subsystem", "transfer")
+	}
+	return t.Server.Log().WithField("subsystem", "transfer")
+}

sftp/event.go

@@ -3,6 +3,7 @@ package sftp
 import (
 	"emperror.dev/errors"
 	"github.com/apex/log"
+
 	"github.com/pterodactyl/wings/internal/database"
 	"github.com/pterodactyl/wings/internal/models"
 )
@@ -44,7 +45,7 @@ func (eh *eventHandler) Log(e models.Event, fa FileAction) error {
 	}
 
 	if tx := database.Instance().Create(a.SetUser(eh.user)); tx.Error != nil {
-		return errors.Wrap(tx.Error, "sftp: failed to save event to database")
+		return errors.WithStack(tx.Error)
 	}
 	return nil
 }
@@ -53,6 +54,6 @@ func (eh *eventHandler) Log(e models.Event, fa FileAction) error {
 // if an error is encountered during the logging of the event.
 func (eh *eventHandler) MustLog(e models.Event, fa FileAction) {
 	if err := eh.Log(e, fa); err != nil {
-		log.WithField("error", err).Fatal("sftp: failed to log event")
+		log.WithField("error", errors.WithStack(err)).WithField("event", e).Error("sftp: failed to log event")
 	}
 }

system/sink_pool.go

@@ -23,7 +23,7 @@ type SinkPool struct {
 }
 
 // NewSinkPool returns a new empty SinkPool. A sink pool generally lives with a
-// server instance for it's full lifetime.
+// server instance for its full lifetime.
 func NewSinkPool() *SinkPool {
 	return &SinkPool{}
 }

system/utils.go

@@ -120,7 +120,7 @@ func ScanReader(r io.Reader, callback func(line []byte)) error {
 	return nil
 }
 
-func FormatBytes(b int64) string {
+func FormatBytes[T int | int16 | int32 | int64 | uint | uint16 | uint32 | uint64](b T) string {
 	if b < 1024 {
 		return fmt.Sprintf("%d B", b)
 	}
@@ -188,14 +188,14 @@ func NewAtomicString(v string) *AtomicString {
 	return &AtomicString{v: v}
 }
 
-// Stores the string value passed atomically.
+// Store stores the string value passed atomically.
 func (as *AtomicString) Store(v string) {
 	as.mu.Lock()
 	as.v = v
 	as.mu.Unlock()
 }
 
-// Loads the string value and returns it.
+// Load loads the string value and returns it.
 func (as *AtomicString) Load() string {
 	as.mu.RLock()
 	defer as.mu.RUnlock()
@@ -211,3 +211,41 @@ func (as *AtomicString) UnmarshalJSON(b []byte) error {
 func (as *AtomicString) MarshalJSON() ([]byte, error) {
 	return json.Marshal(as.Load())
 }
+
+type Atomic[T any] struct {
+	v  T
+	mu sync.RWMutex
+}
+
+func NewAtomic[T any](v T) *Atomic[T] {
+	return &Atomic[T]{v: v}
+}
+
+// Store stores the string value passed atomically.
+func (a *Atomic[T]) Store(v T) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.v = v
+}
+
+// Load loads the string value and returns it.
+func (a *Atomic[T]) Load() T {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+
+	return a.v
+}
+
+// UnmarshalJSON unmarshals the JSON value into the Atomic[T] value.
+func (a *Atomic[T]) UnmarshalJSON(b []byte) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return json.Unmarshal(b, &a.v)
+}
+
+// MarshalJSON marshals the Atomic[T] value into JSON.
+func (a *Atomic[T]) MarshalJSON() ([]byte, error) {
+	return json.Marshal(a.Load())
+}

wings.go

@@ -1,9 +1,10 @@
 package main
 
 import (
-	"github.com/pterodactyl/wings/cmd"
 	"math/rand"
 	"time"
+
+	"github.com/pterodactyl/wings/cmd"
 )
 
 func main() {