Server configuration limits

CURRENT IN UPDATE 0.1.3 — expanded-budget BUILD81 (2026-09-12).

All numeric ranges below are extracted from the production configuration parser, not guessed from a running server. Defaults are the compiled defaults; an explicit setting in your existing configuration overrides them. Invalid out-of-range values fail configuration loading instead of being silently clamped. Restart with the new server executable/configuration to apply changes. Do not overwrite your passwords, keys or other custom settings with a sample configuration.

See Scripting limits for fixed API capacities and client limits. Server [lua] settings do not propagate to the client VM.

Complete numeric configuration table

Setting	Compiled default	Minimum	Maximum	Unit
server.port	7777	1	65535	TCP/UDP port
server.maxPlayers	500	1	5000	count / integer
server.tickrate	30	1	240	ticks/s
server.syncDistance	15000	500	200000	cm (100 cm = 1 m)
server.peerTimeoutMinimumMs	20000	5000	60000	ms
server.peerTimeoutMaximumMs	40000	5000	120000	ms
server.peerTimeoutLimit	32	4	64	count / integer
http.port	7780	1	65535	TCP/UDP port
http.workerThreads	8	1	64	count / integer
http.maxQueuedRequests	1024	8	16384	count / integer
http.requestsPerMinutePerIp	1200	60	100000	per minute
http.maxTrackedAddresses	8192	256	1000000	count / integer
http.readTimeoutMs	5000	500	120000	ms
http.writeTimeoutMs	30000	1000	600000	ms
nameplates.maxPairs	250000	1	1000000	count / integer
nameplates.maxPairsPerResource	250000	1	1000000	count / integer
nameplates.mutationsPerSecond	4096	1	250000	per second
nameplates.mutationBurst	8192	1	250000	count / integer
voice.port	7778	1	65535	TCP/UDP port
voice.ticketTtlMs	15000	1000	120000	ms
voice.idleTimeoutMs	5000	2000	120000	ms
voice.heartbeatIntervalMs	1000	250	10000	ms
voice.maxFramesPerSecond	55	10	200	per second
voice.maxBytesPerSecond	65536	8192	1048576	bytes/s
voice.maxPendingHandshakes	128	1	4096	count / integer
voice.maxConnectionsPerIp	32	1	1000	count / integer
voice.maxTrackedAddresses	16384	256	1000000	count / integer
voice.whisperRange	500	50	200000	cm (100 cm = 1 m)
voice.defaultRange	1800	50	200000	cm (100 cm = 1 m)
voice.shoutRange	3500	50	200000	cm (100 cm = 1 m)
voice.maxRange	10000	50	200000	cm (100 cm = 1 m)
lua.memoryLimitMB	1024	4	4096	MiB
lua.instructionLimit	10000000	10000	1000000000	count / integer
lua.timeoutMs	5000	10	60000	ms
lua.hookInstructionInterval	10000	100	1000000	count / integer
magic.projectileTickrate	30	10	120	ticks/s
magic.maxCastsPerSecond	6	1	30	per second
magic.maxSnapshotAgeMs	1000	100	10000	ms
magic.playerCapsuleRadius	45	10	500	cm (100 cm = 1 m)
magic.playerCapsuleHalfHeight	90	20	1000	cm (100 cm = 1 m)
ranged.projectileTickrate	30	10	120	ticks/s
ranged.maxShotsPerSecond	8	1	30	per second
ranged.maxSnapshotAgeMs	1000	100	10000	ms
ranged.developmentArrowCount	0	0	65535	count / integer
ranged.developmentBoltCount	0	0	65535	count / integer
ranged.playerCapsuleRadius	45	10	500	cm (100 cm = 1 m)
ranged.playerCapsuleHalfHeight	90	20	1000	cm (100 cm = 1 m)
rcon.port	7781	1	65535	TCP/UDP port
rcon.timestampWindowSeconds	30	5	300	s
rcon.requestsPerMinute	60	1	600	per minute
security.handshakeTimeoutMs	5000	1000	30000	ms
security.maxConnectionsPerIp	32	1	1000	count / integer
security.maxPendingHandshakes	128	1	2048	count / integer
security.connectionAttemptsPerMinute	120	1	100000	per minute
security.preAuthPacketsPerSecond	12	1	1000	per second
security.authenticatedPacketsPerSecond	240	30	10000	per second
security.authenticatedBytesPerSecond	524288	65536	67108864	bytes/s
security.invalidPacketsPerMinute	16	1	10000	per minute
security.temporaryBlockSeconds	120	10	86400	s
security.maxTrackedAddresses	16384	256	1000000	count / integer
security.maxPacketBytes	65536	16384	1048576	bytes
security.maxWaitingDataPerPeerBytes	524288	65536	16777216	bytes
world.day	0	0	1000000	count / integer
world.hour	8	0	23	count / integer
world.minute	0	0	59	count / integer
world.minuteDurationMs	1000	0	3600000	ms
world.weatherTransitionMs	3000	0	300000	ms
world.syncIntervalMs	5000	500	60000	ms
database.workerThreads	8	1	64	count / integer
database.maxConnectionsPerResource	16	1	128	count / integer
database.maxPendingQueriesPerResource	1024	1	100000	count / integer
database.maxQueryBytes	4194304	1024	67108864	bytes
database.maxResultRows	50000	1	1000000	count / integer
database.maxResultBytes	67108864	1024	536870912	bytes
database.connectTimeoutMs	5000	100	120000	ms
database.readTimeoutMs	15000	100	300000	ms
database.writeTimeoutMs	15000	100	300000	ms
database.maxBlockingPollMs	100	0	5000	ms
security.passwordWorkerThreads	4	1	8	count / integer
security.passwordQueueCapacity	1024	8	4096	count / integer
security.passwordPendingPerResource	256	1	512	count / integer
security.passwordMemoryKiB	65536	8192	1048576	KiB
security.passwordIterations	3	1	10	count / integer
security.passwordParallelism	1	1	4	count / integer

Additional validation and units

• Peer timeout maximum must be at least the minimum. Voice idle timeout must be at least twice its heartbeat interval.
• Voice ranges must satisfy whisper <= default <= shout <= max. These configuration values and server.syncDistance are centimetres, not the metre units used by camera, NPC route and 3D-text Lua functions.
• world.minuteDurationMs=0 pauses time. Day 0..1000000, hour 0..23 and minute 0..59 are separate limits.
• Enabled voice must use a different port from gameplay, resource HTTP and enabled RCON.
• At least one autostart resource and a nonempty navigation map filename are required. Navigation geometry settings are not exposed as numeric serverconf settings; see Scripting limits#Navigation.
• Listing/name text: server name at most 96 UTF-8 bytes and 48 codepoints; description at most 320 bytes and 160 codepoints. Game mode is an ASCII token up to 24 bytes, region 12, version 24; at most 8 tags of 16 bytes each. Join password is at most 128 bytes.
• Production master-list heartbeat is fixed at 20 seconds and authorization maximum staleness at 300 seconds. These are not operator-adjustable Lua limits. Device identity verification remains mandatory.
• Rate controls are shared traffic budgets, not one independent allowance per Lua event. Increasing Lua storage does not disable anti-abuse controls.

Source audit

server/src/config/ServerConfig.cpp (every numeric parse_unsigned setting), ServerConfig.hpp, server/src/database/DatabaseTypes.hpp, shared/native_protocol.hpp. Audit: 2026-09-12, protocol 34, expanded-budget 0.1.3 BUILD81.