dmg/minecraft-account-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 28 Wiki Activity

feat(rcon): allow administrator-defined endpoints
CI / validate (push) Successful in 6m16s
Details
Release / release (push) Successful in 8m27s
Details

Browse Source
This commit is contained in:
dmg
2026-08-08 07:45:24 -04:00
parent f9ccfd821d
commit 7f6d69e0a7
9 changed files with 35 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/rcon.md
+2 -6
View File
@@ -4,13 +4,9 @@ The administrator RCON console proxies commands through the Next.js server runti
## Application configuration
Set `RCON_ALLOWED_ENDPOINTS` to a comma-separated allowlist of exact internal `host:port` pairs:
Administrators may configure any syntactically valid DNS hostname and TCP port without deployment-managed endpoint configuration. IP literals, trailing-dot hostnames, and malformed DNS names are rejected whenever a connection is saved, tested, or used.
```text
RCON_ALLOWED_ENDPOINTS=season4.somc.svc.cluster.local:25575
```
IP literals, trailing-dot hostnames, malformed DNS names, and endpoints absent from the allowlist are rejected whenever a connection is saved, tested, or used.
This flexibility means an authorized or compromised administrator can make RCON connection attempts to any DNS hostname and port reachable from the web runtime. Use cluster egress policy and administrator access controls to constrain that trust boundary where required.
Saved passwords are encrypted with AES-256-GCM and connection-bound authenticated data. By default, domain-separated credential and audit keys are derived from `AUTH_SECRET`. Deployments may instead provide independent 32-byte base64 values through `RCON_CREDENTIAL_KEY` and `RCON_AUDIT_KEY`. Rotating the credential key requires replacing saved RCON passwords.