minecraft-account-manager/docs/rcon.md

RCON administration

The administrator RCON console proxies commands through the Next.js server runtime. Browsers never receive RCON credentials and never open RCON sockets.

Application configuration

Administrators may configure any syntactically valid DNS hostname and TCP port without deployment-managed endpoint configuration. IP literals, trailing-dot hostnames, and malformed DNS names are rejected whenever a connection is saved, tested, or used.

This flexibility means an authorized or compromised administrator can make RCON connection attempts to any DNS hostname and port reachable from the web runtime. Use cluster egress policy and administrator access controls to constrain that trust boundary where required.

Saved passwords are encrypted with AES-256-GCM and connection-bound authenticated data. By default, domain-separated credential and audit keys are derived from AUTH_SECRET. Deployments may instead provide independent 32-byte base64 values through RCON_CREDENTIAL_KEY and RCON_AUDIT_KEY. Rotating the credential key requires replacing saved RCON passwords.

Minecraft server configuration

Enable RCON with a high-entropy password supplied through the deployment secret. Expose its port only on an internal ClusterIP service. Do not add RCON to an Ingress, NodePort, or public LoadBalancer.

The password entered in the administrator connection form must match the server password. Existing passwords are write-only; leave the replacement field blank when editing unrelated connection settings.

Security behavior

• Existing account-manager administrator authorization is rechecked for every connection mutation, test, and command.
• Commands are limited to 1,024 UTF-8 bytes and reject control characters.
• Each web process allows one operation per connection and at most eight RCON operations total. Size replica counts with that aggregate ceiling in mind.
• Each complete connect-and-response operation times out after five seconds and tears down the socket; cleanup is independently capped at one second.
• Responses are sanitized and limited to 64 KiB.
• Full commands and responses are not persisted or logged. Audit events contain the command verb and a domain-separated HMAC digest.
• Connection passwords are never selected by page queries or returned to the browser.

RCON is plaintext TCP. Keep it on the cluster network and use network policy or an encrypted tunnel when the network trust model requires stronger isolation.

Migration

Apply the generated Drizzle migration before deploying the web image:

npx drizzle-kit migrate

Never use drizzle push for this schema change.