Steam accounts

Some games can only be downloaded with a Steam account that owns them (e.g. DayZ). The panel keeps the password secret and lets Steam Guard stay on.

Add an account

Steam accounts in the tenant menu (owners and admins) hold a user name and a write-only, encrypted password.

Steam Guard

1. The first download on a node runs SteamCMD there. The node types the password into SteamCMD’s prompt.
2. Steam asks for confirmation:
   • a code from the Steam app or the email: the panel shows a field for it. Codes from the app change every 30 seconds, so enter a fresh one.
   • a confirmation in the Steam app: confirm it on the phone; the panel waits.
3. The node keeps the login in a Docker volume for that account (panel-steam-<account>). Later installs and updates don’t ask again.

A prompt left unanswered for 5 minutes fails the job; run it again for a new one.

Sign in on a node on the account’s page does this ahead of time. Sign out everywhere deletes the saved logins.

With push notifications on, the phone is told when a code or a confirmation is needed.

Where credentials go

Only into throwaway job containers. The password is typed into SteamCMD’s prompt, never put on the command line, in the environment, a file or a log. The game’s own container never sees the password or the saved login.

Updates

On a server, Settings → Steam:

• the account
• Update now
• Update before every start: if the update fails, the installed version starts

Members need the settings.update permission to update and to enter Steam Guard codes for the server.

Templates that use Steam: Install and update jobs.