View source for Hosting a G1R:MP dedicated server

{{DISPLAYTITLE:Hosting a G1R:MP dedicated server}}
__NOTOC__

= Hosting a G1R:MP dedicated server =

<div style="border:1px solid #b28a3d; border-left:4px solid #b28a3d; background:#faf9f5; padding:0.9rem 1rem; margin:0.8rem 0 1.2rem;">
'''Public network access is required.''' A server hosted on your own computer still needs a publicly reachable address and the required ports opened or forwarded.
</div>

This requirement also applies when the dedicated server, launcher, and game are running on the same computer. The current 0.1.3 release uses Protocol 35 and the official G1R:MP service for server discovery and connection authorization, including direct-connect attempts. Private-only server addresses are not accepted for public registration. Update both the client and server; see [[Update 0.1.3]].

The official service does not relay gameplay. After authorization, gameplay, voice, and resource traffic connects directly to the public endpoint advertised by the dedicated server. This architecture requires that endpoint to be reachable from the Internet.

== Public address requirement ==

The host must have either:

* a public, externally reachable IP address; or
* a DNS name that resolves to that public address.

Addresses such as <code>127.0.0.1</code>, <code>localhost</code>, <code>192.168.x.x</code>, and <code>10.x.x.x</code> are not reachable from the Internet.

If the server is behind a home router, configure port forwarding from the router's public address to the computer's fixed LAN address. If the ISP uses carrier-grade NAT (CGNAT), ordinary router port forwarding is not sufficient; request a public IP address from the ISP or host the server on a publicly reachable VPS.

For the standard automatic listing configuration, leave <code>listing.publicHost</code> empty. The official service can use the source address of the server heartbeat. Set it only when advertising a public DNS name that resolves to the same server.

<syntaxhighlight lang="ini">
[listing]
publicHost=
</syntaxhighlight>

== Default ports ==

The current default configuration uses the following ports:

{| class="wikitable" style="width:100%;"
! Purpose !! Default port !! Protocol !! Public access
|-
| Gameplay transport || <code>7777</code> || UDP || Required
|-
| Voice relay || <code>7778</code> || UDP || Required when voice chat is enabled
|-
| Resource download service || <code>7780</code> || TCP || Required when <code>http.mode=auto</code> or the built-in HTTP service is used
|-
| RCON administration || <code>7781</code> || TCP || '''Do not expose'''; loopback-only by default
|-
| MariaDB/MySQL || <code>3307</code> in the shipped Gothic RP configuration, or the locally configured database port (commonly <code>3306</code>) || TCP || '''Do not expose''' when the database is on the same host
|}

The server also requires outbound HTTPS access, normally TCP port <code>443</code>, to synchronize with the official G1R:MP service. This is an outbound connection and does not require router port forwarding.

If any ports are changed in <code>serverconf.cfg</code>, update the firewall and router rules to match the configured values.

== Recommended bind configuration ==

The public services should normally listen on all local interfaces:

<syntaxhighlight lang="ini">
[server]
bind=0.0.0.0
port=7777

[voice]
enabled=true
bind=0.0.0.0
port=7778

[http]
mode=auto
bind=0.0.0.0
port=7780
</syntaxhighlight>

Keep RCON restricted to the local machine:

<syntaxhighlight lang="ini">
[rcon]
enabled=true
allowRemote=false
bind=127.0.0.1
port=7781
</syntaxhighlight>

== Player capacity and server password ==

Set the player limit and optional join password in the <code>[server]</code> section. <code>maxPlayers</code> accepts any integer from <code>1</code> through <code>5000</code>, inclusive. The server refuses to start when the value is outside that range.

<syntaxhighlight lang="ini">
[server]
maxPlayers=500
password=
</syntaxhighlight>

The <code>password</code> setting supports three forms:

{| class="wikitable" style="width:100%;"
! Configuration !! Result
|-
| <code>password=</code> || No join password. The server is advertised as public.
|-
| <code>password=a-literal-secret</code> || Uses the literal value from <code>serverconf.cfg</code>. A non-empty password must contain from <code>1</code> through <code>128</code> bytes.
|-
| <code>password=env:VARIABLE</code> || Reads the password from the named environment variable when the server starts. The resolved value must contain from <code>1</code> through <code>128</code> bytes.
|}

The environment-variable form keeps the credential out of <code>serverconf.cfg</code> and is recommended for hosted servers. The variable name must be a valid environment-variable identifier, and the server stops during configuration loading if the variable is missing, empty, longer than 128 bytes, or contains a forbidden control character.

Do not set <code>listing.passworded</code> manually. The advertised <code>passworded</code> value is derived automatically from the resolved <code>[server] password</code>, so the server list and health response cannot claim a password policy different from the one enforced by the server.

Before downloading resources, the launcher checks the server health response. It stops early when <code>players</code> has reached <code>maxPlayers</code>, and it requests a password when <code>passworded</code> is true. These checks provide immediate feedback only: the dedicated server independently enforces the slot limit and validates the password during admission. A stale server-list entry or modified client cannot bypass either rule.

== Resource package limits ==

These expanded values apply from '''update 0.1.3 BUILD81'''. Older 0.1.3 clients must be updated. See [[Scripting limits]] and [[Server configuration limits]] for all other budgets and exact units.

The dedicated server and client enforce matching compatibility limits for Lua scripts and downloadable resources. Values at a stated hard boundary are accepted; a resource that exceeds that boundary is rejected before it can run.

{| class="wikitable" style="width:100%;"
! Limit !! Value !! Scope
|-
| Lua script size || <code>128 MiB</code> || Each individual <code>.lua</code> script.
|-
| Resource file size || <code>256 MiB</code> || Each individual file included in the client resource catalog.
|-
| Catalog file count || <code>262,144</code> files || All client scripts and downloadable files across the complete catalog.
|-
| Catalog payload || <code>32 GiB</code> || Sum of the file sizes declared by the complete client resource catalog.
|-
| Catalog JSON document || <code>128 MiB</code> || Serialized <code>catalog.json</code> metadata returned by the resource service.
|-
| Lua VM memory || <code>1024 MiB</code> by default || Each client-side resource Lua VM uses the 1024 MiB default. For each server-side resource Lua VM, <code>[lua] memoryLimitMB</code> is configurable from <code>4</code> through <code>4096</code> MiB; the shipped default is <code>1024</code> MiB.
|}

The dedicated server validates manifests, script sizes, file counts, payload totals, and catalog JSON size while building the catalog. The client validates the catalog and every downloaded file again before caching or executing it. When <code>http.mode=external</code> is used, a CDN or reverse proxy may impose stricter transfer limits, but it cannot raise the limits enforced by the client.

== Firewall examples ==

=== Windows ===

Run PowerShell as Administrator:

<syntaxhighlight lang="powershell">
New-NetFirewallRule -DisplayName "G1R:MP Gameplay" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 7777
New-NetFirewallRule -DisplayName "G1R:MP Voice" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 7778
New-NetFirewallRule -DisplayName "G1R:MP Resources" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 7780
</syntaxhighlight>

=== Linux with UFW ===

<syntaxhighlight lang="bash">
sudo ufw allow 7777/udp
sudo ufw allow 7778/udp
sudo ufw allow 7780/tcp
</syntaxhighlight>

On a VPS or cloud host, add equivalent inbound rules to the provider firewall or security group as well as the operating-system firewall.

== Testing reachability ==

Test the server from a different Internet connection, such as another household or a mobile hotspot. Testing only from the same LAN can give misleading results because routers handle NAT loopback differently.

A server appearing in the master list confirms that its outbound heartbeat reached the official service. It does not by itself prove that UDP <code>7777</code>, UDP <code>7778</code>, and TCP <code>7780</code> are reachable from the Internet.

Do not solve a connection problem by opening RCON or MariaDB publicly. Those services should remain private.

[[Category:Server administration]]
[[Category:Networking]]