Hey everyone,
last week I gave my trainees a supposedly easy task: Set up a CS:Source dedicated server on a headless Debian Buster, safe and sound. And now I'm feeling like stupid since nothing works even if I do it.

What did I do?

## Install the steamcmd (from Buster nonfree)
# apt-get install steamcmd
## Adding a system user to run CS:S
# adduser cssource --system --home /var/lib/cssource
## Creating a root writable directory where CS:S will be
# mkdir /opt/cssource
## Changed the HOME directory of root temporarily to the home directory of cssource to force creation of .steam and subdirectories there
# HOME=/var/lib/cssource
## Downloading CS:S
# /usr/games/steamcmd +login anonymous +force_install_dir /opt/cssource +app_update 232330 validate +quit
## Re-setting owner for cssource home directory to cssource (so it is owner of .steam and subdirs)
# chown -R cssource /var/lib/cssource

### For those confused by using both /var/lib/cssource and /opt/cssource - that is to minimize the danger of a breach and is a quite common measure to secure servers - no binary is owned/writable by the user that is executing it. Hence also the --system when creating the user. If that was a problem, I'd see that in journalctl, like the following bug ###

Since there is a bug where CS:S tries to open .steam/sdk32/steamclient.so, which is located in .steam/steamcmd/linux32, I linked the directory:
# cd /var/lib/cssource/.steam
# ln -s steamcmd/linux32 sdk32

Writing the server config:
# vim /opt/cssource/cstrike/cfg/server.cfg
<<<<
sv_lan 0
sv_region 3
hostname "BattleNeck"
sv_password "mysupersecretpasswd"
rcon_password "amuchmoresecretpasswd"
exec banned_user.cfg
exec banned_ip.cfg
exec mani_server.cfg
mapchangecfgfile "server.cfg"
servercfgfile "server.cfg"
writeid
writeip

***bunch of other mp and bot related options ***
>>>>

Then, wrinting a systemd unit for this:
# vim /etc/systemd/system/cssource.service
<<<<
[Unit]
Description=CS:Source Gameserver
After=network.target

[Service]
ExecStart=/opt/cssource/srcds_run -game cstrike -console -port 27015 +maxplayers 10 +map cs_havana
User=cssource
WorkingDirectory=/var/lib/cssource

[Install]
WantedBy=multi-user.target
>>>>

## Reloading the systemd daemon
# systemctl daemon-reload
## Installing the Unit
# systemctl enable cssource.service
## Starting up
# systemctl start cssource.service

Up until now everything is fine. The unit starts up, opens all ports (TCP 27015, UDP 27005, 27015, 27020), but after 3 seconds I get an error:
srcds_run[$PID]: [S_API FAIL] SteamAPI_Init() failed; SteamAPI_IsSteamRunning() failed.

The internet (which is always right, aye?) says, there's nothing to worry about. Alas I can't connect to the server from my testing rig. No iptables/nftables was used, and we're our own ISP, so no funny home connection problem. Tried similar setups on a couple of machines (local, at home, virtualized, OpenStack...), no luck as of now. Trying the same setup with a Wurm Unlimited dedicated server works like a charm (I even see that server in the server list in CS:S, if I hack in the target IP).

Has anybody a clue what is wrong here? I'm happy to provide further infos, if necessary, and heck, a shell script to automate that setup for you if you want do deploy it yourself...