0 Fork 0

Files

T

Aryan SinghandClaude Fable 5 279d137ce5 Minecraft 26.2 Fabric server stack with CraftDeck management panel

- docker-compose: itzg/minecraft-server (Fabric, offline mode, whitelist
  enforced, Modrinth-managed mods), itzg/mc-backup sidecar, custom dashboard
- Gated auth for offline mode: approve username -> whitelisted with a short
  registration window -> EasyAuth /register + /login; auto-revoke on expiry
- CraftDeck panel (Next.js 16, zero native deps): live console (SSE), players
  & stats, lag diagnostics (server TPS vs player ping via spark), performance
  graphs, Modrinth mod search/manager, backups & restore, sandboxed file
  browser/editor, .env config editor with compose apply, cron schedules,
  Discord alerts, scrypt-hashed panel login
- scripts/setup.sh generates secrets; docs/ covers auth, mods, updating,
  backups, networking (Tailscale), troubleshooting

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 11:07:07 -05:00

2.6 KiB

Raw Blame History

Authentication flow

The server runs with online-mode=false so offline launchers (TLauncher, etc.) can join. That disables Mojang's account verification, so this stack layers two gates on top:

Whitelist (vanilla) — only approved usernames can connect at all
EasyAuth (Fabric mod) — every player must /register a password once, then /login on every join. Unauthenticated players are frozen, invisible to the world, and kicked after a timeout.

The approval lifecycle

you approve a name ──► whitelisted + "pending" + countdown starts (default 2 min)
        │
        ├─ player joins and /register-s in time ──► "registered"  (permanent access)
        │
        └─ countdown lapses ──► whitelist entry removed ──► "expired"
                                 (re-approve any time to restart the window)

The panel enforces this automatically: a background watcher reconciles the pending list against EasyAuth's registered accounts every 5 seconds and revokes lapsed windows.

Why the short window matters

While a name is whitelisted but unregistered, anyone who knows the name could join and claim it. The window shrinks that exposure to a couple of minutes, and you control exactly when it opens — approve while your friend is sitting in the launcher. If someone does sneak in and register a name that isn't theirs, just Revoke it (removes the account + whitelist entry) and approve again.

In-game commands (players)

Command	What it does
`/register <pass> <pass>`	Create your password (first join only)
`/login <pass>`	Log in (every join)
`/account`	Change password, manage sessions
`/logout`	Log out manually

Panel actions (Access & Auth page)

Action	Effect
Approve	Whitelist + open registration window
Re-open window	Same, for an expired/revoked name
Reset password	Sets a temporary password (shown once) and kicks them to re-login
Revoke	Whitelist entry + EasyAuth account deleted, player kicked
Import whitelist	Adopt names whitelisted outside the panel

Storage

EasyAuth stores password hashes in its own database under data/mc/mods/EasyAuth/ (included in backups). The panel's approval state lives in data/dashboard/craftdeck.db. The two are reconciled via RCON (auth list, auth remove, auth update), so there's no fragile file coupling.

Tuning

Window length: Settings → "Player registration window" (0.5–120 minutes)
EasyAuth options (kick timeout, session lifetime, password rules): Files → config/EasyAuth/ — edit and restart the server

2.6 KiB Raw Blame History Unescape Escape