minecraft

Whitelist: write allowlist.json+whitelist.json, verify after reload, learn UUIDs from logs

On 26.2 the file whitelist entries load at startup but 'whitelist reload'
and shutdown saves use the renamed allowlist.json, so panel writes never
took effect live and got wiped on stop. Now the panel writes both file
names, verifies the player actually appears in 'whitelist list' after
reload, falls back to the vanilla add command, and captures each player's
real UUID from 'UUID of player …' log lines for future entries. The auth
watcher's self-heal loop reports a loud notification after 3 failed
retries instead of silently spamming reloads.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-11 17:16:22 -05:00

b043f03d28

Fix gamerule toggles for 26.x renames; add map/skins/pregen + admin favors

Minecraft 26.x renamed every gamerule to snake_case (keepInventory →
keep_inventory, doDaylightCycle → advance_time, ...), so the panel's
queries hit unknown rules: reads returned nothing, toggles always
started from 'off', and sets silently failed. Rules are now defined by
candidate names resolved against the live server (works on old and new
versions), sets are verified by re-query, and failures surface the
server's actual reply. Toggles render only for rules the server reports.

Creative additions:
- Featured mods on the Mods page: BlueMap (3D web map), SkinRestorer
  (real skins in offline mode), Chunky (pregen) — verified for 26.2
- BlueMap plumbing: MAP_PORT mapping in compose, in-network detection,
  'Open the live world map' link on the Overview
- Player modal favors: heal, teleport-to-player, give item
- Broadcast box gained a full-screen title mode

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-11 12:05:23 -05:00

b2ff88b255

Security page, admin quick controls, and whitelist reload self-healing

- RCON client retries once on a fresh connection after stale-socket
  timeouts (panel idle overnight held dead sockets, so 'whitelist
  reload' silently failed and approvals needed a server restart)
- Auth watcher verifies pending players against the LIVE whitelist every
  5s and re-writes/reloads if the server missed it, refunding lost
  window time
- Log watcher records blocked join attempts (name + IP) with rate-
  limited notifications — scanner bots are now visible in the panel
- New Security page: blocked-attempt log with one-click IP ban, banned
  players/IPs management, kick-everyone lockdown
- Player detail modal: ban, op/deop, gamemode switching
- Overview quick controls: time/weather/difficulty, gamerule toggles
  (keepInventory, mobGriefing, PvP...), broadcast box
- Settings toggles for blocked-attempt notifications (panel + Discord)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-11 11:50:27 -05:00

deeeaf0042

Whitelist by offline UUID: write whitelist.json directly, not 'whitelist add'

The vanilla command resolves never-seen names through Mojang's API, so a
premium account's UUID gets whitelisted instead of the offline UUID the
player actually connects with — the exact 'You are not white-listed'
loop hit on first join. The panel now computes the offline UUID
(md5 OfflinePlayer:<name>, UUID v3 — verified against known vectors),
writes whitelist.json itself, and issues 'whitelist reload'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-10 18:25:28 -05:00

4fe304c5af

Fix blank TPS: read tick timing from vanilla 'tick query' instead of spark

spark sends command output asynchronously, so its RCON responses are
empty and the sampler recorded null TPS/MSPT. Use the synchronous
vanilla 'tick query' as the primary source (treating paused/frozen idle
servers as healthy), keep spark as fallback, and route spark ping /
healthreport through the server console (mc-send-to-console) with the
log watcher capturing ping lines. Lag endpoint now falls back to the
freshest recorded ping sample.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-10 12:39:46 -05:00

6b7839360d

Disable enforce-secure-profile so offline-launcher players can join

EasyAuth flagged it at startup: with enforce-secure-profile on (vanilla
default), TLauncher/offline clients are rejected before they can even
authenticate. Set ENFORCE_SECURE_PROFILE=FALSE on the mc service and
document the symptom in troubleshooting.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-10 12:34:02 -05:00

85414391b0

Allow beta-typed Modrinth builds for EasyAuth (easyauth:beta)

EasyAuth publishes its 26.x builds as beta on Modrinth, and the itzg
resolver only accepts release-typed versions by default, so the mc
container failed to start. Pin easyauth:beta in the default mod list and
teach the panel's mod manager to compare entries by base slug so version
qualifiers don't break protected/duplicate checks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-10 12:26:33 -05:00

795c2af50b

Minecraft 26.2 Fabric server stack with CraftDeck management panel

- docker-compose: itzg/minecraft-server (Fabric, offline mode, whitelist
  enforced, Modrinth-managed mods), itzg/mc-backup sidecar, custom dashboard
- Gated auth for offline mode: approve username -> whitelisted with a short
  registration window -> EasyAuth /register + /login; auto-revoke on expiry
- CraftDeck panel (Next.js 16, zero native deps): live console (SSE), players
  & stats, lag diagnostics (server TPS vs player ping via spark), performance
  graphs, Modrinth mod search/manager, backups & restore, sandboxed file
  browser/editor, .env config editor with compose apply, cron schedules,
  Discord alerts, scrypt-hashed panel login
- scripts/setup.sh generates secrets; docs/ covers auth, mods, updating,
  backups, networking (Tailscale), troubleshooting

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Aryan SinghandClaude Fable 5

2026-07-10 11:07:07 -05:00

279d137ce5