Server configuration limits
CURRENT IN UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).
All numeric ranges below are extracted from the production configuration parser, not guessed from a running server. Defaults are the compiled defaults; an explicit setting in your existing configuration overrides them. Invalid out-of-range values fail configuration loading instead of being silently clamped. Restart with the new server executable/configuration to apply changes. Do not overwrite your passwords, keys or other custom settings with a sample configuration.
See Scripting limits for fixed API capacities and client limits. Server [lua] settings do not propagate to the client VM.
Complete numeric configuration table
| Setting | Compiled default | Minimum | Maximum | Unit |
|---|---|---|---|---|
server.port |
7777 | 1 | 65535 | TCP/UDP port |
server.maxPlayers |
500 | 1 | 5000 | count / integer |
server.tickrate |
30 | 1 | 240 | ticks/s |
server.syncDistance |
15000 | 500 | 200000 | cm (100 cm = 1 m) |
server.peerTimeoutMinimumMs |
20000 | 5000 | 60000 | ms |
server.peerTimeoutMaximumMs |
40000 | 5000 | 120000 | ms |
server.peerTimeoutLimit |
32 | 4 | 64 | count / integer |
http.port |
7780 | 1 | 65535 | TCP/UDP port |
http.workerThreads |
8 | 1 | 64 | count / integer |
http.maxQueuedRequests |
1024 | 8 | 16384 | count / integer |
http.requestsPerMinutePerIp |
1200 | 60 | 100000 | per minute |
http.maxTrackedAddresses |
8192 | 256 | 1000000 | count / integer |
http.readTimeoutMs |
5000 | 500 | 120000 | ms |
http.writeTimeoutMs |
30000 | 1000 | 600000 | ms |
nameplates.maxPairs |
250000 | 1 | 1000000 | count / integer |
nameplates.maxPairsPerResource |
250000 | 1 | 1000000 | count / integer |
nameplates.mutationsPerSecond |
4096 | 1 | 250000 | per second |
nameplates.mutationBurst |
8192 | 1 | 250000 | count / integer |
voice.port |
7778 | 1 | 65535 | TCP/UDP port |
voice.ticketTtlMs |
15000 | 1000 | 120000 | ms |
voice.idleTimeoutMs |
5000 | 2000 | 120000 | ms |
voice.heartbeatIntervalMs |
1000 | 250 | 10000 | ms |
voice.maxFramesPerSecond |
55 | 10 | 200 | per second |
voice.maxBytesPerSecond |
65536 | 8192 | 1048576 | bytes/s |
voice.maxPendingHandshakes |
128 | 1 | 4096 | count / integer |
voice.maxConnectionsPerIp |
32 | 1 | 1000 | count / integer |
voice.maxTrackedAddresses |
16384 | 256 | 1000000 | count / integer |
voice.whisperRange |
500 | 50 | 200000 | cm (100 cm = 1 m) |
voice.defaultRange |
1800 | 50 | 200000 | cm (100 cm = 1 m) |
voice.shoutRange |
3500 | 50 | 200000 | cm (100 cm = 1 m) |
voice.maxRange |
10000 | 50 | 200000 | cm (100 cm = 1 m) |
lua.memoryLimitMB |
1024 | 4 | 4096 | MiB |
lua.instructionLimit |
10000000 | 10000 | 1000000000 | count / integer |
lua.timeoutMs |
5000 | 10 | 60000 | ms |
lua.hookInstructionInterval |
10000 | 100 | 1000000 | count / integer |
magic.projectileTickrate |
30 | 10 | 120 | ticks/s |
magic.maxCastsPerSecond |
6 | 1 | 30 | per second |
magic.maxSnapshotAgeMs |
1000 | 100 | 10000 | ms |
magic.playerCapsuleRadius |
45 | 10 | 500 | cm (100 cm = 1 m) |
magic.playerCapsuleHalfHeight |
90 | 20 | 1000 | cm (100 cm = 1 m) |
ranged.projectileTickrate |
30 | 10 | 120 | ticks/s |
ranged.maxShotsPerSecond |
8 | 1 | 30 | per second |
ranged.maxSnapshotAgeMs |
1000 | 100 | 10000 | ms |
ranged.developmentArrowCount |
0 | 0 | 65535 | count / integer |
ranged.developmentBoltCount |
0 | 0 | 65535 | count / integer |
ranged.playerCapsuleRadius |
45 | 10 | 500 | cm (100 cm = 1 m) |
ranged.playerCapsuleHalfHeight |
90 | 20 | 1000 | cm (100 cm = 1 m) |
rcon.port |
7781 | 1 | 65535 | TCP/UDP port |
rcon.timestampWindowSeconds |
30 | 5 | 300 | s |
rcon.requestsPerMinute |
60 | 1 | 600 | per minute |
security.handshakeTimeoutMs |
5000 | 1000 | 30000 | ms |
security.maxConnectionsPerIp |
32 | 1 | 1000 | count / integer |
security.maxPendingHandshakes |
128 | 1 | 2048 | count / integer |
security.connectionAttemptsPerMinute |
120 | 1 | 100000 | per minute |
security.preAuthPacketsPerSecond |
12 | 1 | 1000 | per second |
security.authenticatedPacketsPerSecond |
240 | 30 | 10000 | per second |
security.authenticatedBytesPerSecond |
524288 | 65536 | 67108864 | bytes/s |
security.invalidPacketsPerMinute |
16 | 1 | 10000 | per minute |
security.temporaryBlockSeconds |
120 | 10 | 86400 | s |
security.maxTrackedAddresses |
16384 | 256 | 1000000 | count / integer |
security.maxPacketBytes |
65536 | 16384 | 1048576 | bytes |
security.maxWaitingDataPerPeerBytes |
524288 | 65536 | 16777216 | bytes |
world.day |
0 | 0 | 1000000 | count / integer |
world.hour |
8 | 0 | 23 | count / integer |
world.minute |
0 | 0 | 59 | count / integer |
world.minuteDurationMs |
1000 | 0 | 3600000 | ms |
world.weatherTransitionMs |
3000 | 0 | 300000 | ms |
world.syncIntervalMs |
5000 | 500 | 60000 | ms |
database.workerThreads |
8 | 1 | 64 | count / integer |
database.maxConnectionsPerResource |
16 | 1 | 128 | count / integer |
database.maxPendingQueriesPerResource |
1024 | 1 | 100000 | count / integer |
database.maxQueryBytes |
4194304 | 1024 | 67108864 | bytes |
database.maxResultRows |
50000 | 1 | 1000000 | count / integer |
database.maxResultBytes |
67108864 | 1024 | 536870912 | bytes |
database.connectTimeoutMs |
5000 | 100 | 120000 | ms |
database.readTimeoutMs |
15000 | 100 | 300000 | ms |
database.writeTimeoutMs |
15000 | 100 | 300000 | ms |
database.maxBlockingPollMs |
100 | 0 | 5000 | ms |
security.passwordWorkerThreads |
4 | 1 | 8 | count / integer |
security.passwordQueueCapacity |
1024 | 8 | 4096 | count / integer |
security.passwordPendingPerResource |
256 | 1 | 512 | count / integer |
security.passwordMemoryKiB |
65536 | 8192 | 1048576 | KiB |
security.passwordIterations |
3 | 1 | 10 | count / integer |
security.passwordParallelism |
1 | 1 | 4 | count / integer |
Additional validation and units
- Peer timeout maximum must be at least the minimum. Voice idle timeout must be at least twice its heartbeat interval.
- Voice ranges must satisfy whisper <= default <= shout <= max. These configuration values and
server.syncDistanceare centimetres, not the metre units used by camera, NPC route and 3D-text Lua functions. world.minuteDurationMs=0pauses time. Day 0..1000000, hour 0..23 and minute 0..59 are separate limits.- Enabled voice must use a different port from gameplay, resource HTTP and enabled RCON.
- At least one autostart resource and a nonempty navigation map filename are required. Navigation geometry settings are not exposed as numeric serverconf settings; see Scripting limits#Navigation.
- Listing/name text: server name at most 96 UTF-8 bytes and 48 codepoints; description at most 320 bytes and 160 codepoints. Game mode is an ASCII token up to 24 bytes, region 12, version 24; at most 8 tags of 16 bytes each. Join password is at most 128 bytes.
- Production master-list heartbeat is fixed at 20 seconds and authorization maximum staleness at 300 seconds. These are not operator-adjustable Lua limits. Device identity verification remains mandatory.
- Rate controls are shared traffic budgets, not one independent allowance per Lua event. Increasing Lua storage does not disable anti-abuse controls.
Source audit
server/src/config/ServerConfig.cpp (every numeric parse_unsigned setting), ServerConfig.hpp, server/src/database/DatabaseTypes.hpp, shared/native_protocol.hpp. Audit: 2026-09-12, protocol 34, expanded-budget 0.1.3 BUILD81.