JPAuth

# Used to add new options to this file after an update. Don't change it.
config-version: 1

# ========================================================
# JPAuth - Enterprise Authentication Plugin Configuration
# ========================================================
# Login system for offline-mode (cracked) servers: players /register once and
# /login every time they join. Until then they cannot move, chat, use commands
# or interact.
#
# Messages are in messages.yml. Apply changes with /auth reload.
# Spawns are set in-game with /auth setspawn <type> (see the bottom of this file).

# Language of the messages: en (messages.yml), es, pt, fr or de (lang/<code>.yml).
# Your own language: copy a file in the lang folder to lang/<code>.yml, translate it
# and set its code here (for example it for lang/it.yml).
language: en

# Replace messages.yml with the new design when the plugin is updated.
# Your old file is kept as messages.old-vX.yml. false = never touch it.
auto-update-style: true

# The setup screen opens for the first admin who logs in (login style, kick time...).
# It turns itself off once saved. /auth setup opens it again any time.
setup-completed: false

# --------------------------------------------------------
# Auth world
# --------------------------------------------------------
# Players wait in a separate world until they log in. Afterwards they go back to where
# they logged out (or, the first time, where they joined). A place inside this world
# is never remembered, so nobody comes back in it; players with nowhere to go get the
# lobby spawn, or the spawn of the main world.
auth-world:
  enabled: false
  # The world's folder name. Made by another plugin (Multiverse...) or by JPAuth below.
  world: auth
  # Make an empty world (a small platform in the void) when the folder does not exist.
  create-if-missing: true
  # The block of that platform.
  platform: GLASS
  # Where in the world players stand: its spawn, or /auth setspawn unauthenticated
  # while standing inside it.

# --------------------------------------------------------
# Database Configuration
# --------------------------------------------------------
database:
  # Type: sqlite or mysql
  # sqlite = a local file (no setup). mysql = needed to share accounts between servers.
  type: sqlite
  # Only used when type is mysql.
  mysql:
    host: localhost
    port: 3306
    database: jpauth
    username: root
    password: ""
    # Database connections kept open.
    pool-size: 10

# --------------------------------------------------------
# Security Configuration
# --------------------------------------------------------
# Login screen. false (default) = players type /login <password> and /register in chat.
# true = a Minecraft dialog window with password boxes opens when a player has to log
# in or register. Passwords typed there never go through chat, so chat logs, chat
# plugins and other players never see them. /login and /register still work too.
# Note: Minecraft shows the typed text in the box (it has no *** password boxes).
dialog:
  enabled: false
  # Used for {server} in the dialog texts (messages.yml, dialog-*).
  server-name: 'the server'

security:
  # Password hashing strength (10-14). Higher = safer but slower logins. 12 is a good default.
  bcrypt-cost: 12
  # Wrong passwords before the account is locked and the player kicked.
  max-login-attempts: 5
  # How long a locked account stays locked.
  lock-duration-seconds: 300
  # Players who do not log in or register within this time are kicked.
  login-timeout-seconds: 60
  # Allow new players to create accounts with /register.
  allow-registration: true
  # Allow /changepassword.
  allow-password-change: true
  # Allow /logout.
  allow-logout: true
  # After logging in, send players back to where they were (off = stay at the login spawn).
  restore-location: true
  # Registered accounts allowed per IP address (0 = unlimited).
  max-accounts-per-ip: 3
  # Show a title and a countdown bossbar while the player has to log in.
  title-prompt: true
  bossbar-timer: true
  # Blind players until they log in, so nothing can be seen behind the login screen.
  blind-unauthenticated: false
  # Hide /login, /register and /changepassword (with passwords) from the console log.
  hide-passwords-in-console: true
  # Refuse a second connection with the name of someone who is already logged in,
  # so nobody can kick a player off the server by joining with their name.
  single-session: true
  # Refuse names that only differ in capitals from an existing account
  # (for example "notch" when "Notch" is registered).
  block-name-case: true
  # Commands players can use before logging in (without the /).
  allowed-commands-before-auth:
    - "login"
    - "register"
    - "l"
    - "reg"
    - "captcha"
    - "recover"

# --------------------------------------------------------
# Password Policy
# --------------------------------------------------------
password-policy:
  min-length: 6
  max-length: 64
  # Password must contain at least one digit.
  require-number: true
  # Password must contain at least one symbol (!, ?, #...).
  require-symbol: false
  # Refuse the easy-to-guess passwords listed below (not case-sensitive).
  block-common-passwords: true
  common-passwords:
    - "123456"
    - "password"
    - "qwerty"
    - "abc123"
    - "letmein"
    - "welcome"
    - "admin"
    - "monkey"
    - "master"
    - "dragon"
    - "111111"
    - "123123"
    - "1234567"
    - "12345678"
    - "123456789"
    - "1234567890"
    - "iloveyou"
    - "sunshine"
    - "princess"
    - "football"
    - "minecraft"

# --------------------------------------------------------
# Session Configuration
# --------------------------------------------------------
# After logging in, players who rejoin within this time are logged in automatically.
session:
  # 0 = always ask for the password.
  expiration-minutes: 30
  # Only reuse the session when the player rejoins from the same IP address (recommended).
  ip-binding: true

# --------------------------------------------------------
# Premium (Mojang) Account Configuration
# --------------------------------------------------------
# Players who own Minecraft can type /premium (and /premium confirm) to skip /login.
# From then on, every time someone joins with that name, Mojang checks the connection
# the same way an online-mode server does. The real owner is logged in automatically;
# cracked clients using the name are refused. Players who never use /premium keep
# using /login as before.
# This needs the PacketEvents plugin on an offline-mode server
# (https://modrinth.com/plugin/packetevents). Behind an online-mode proxy (Velocity)
# it works without it.
# Behind a proxy: use Velocity's modern forwarding (or BungeeGuard) and let only the proxy
# reach this server's port. With plain BungeeCord forwarding, anyone who connects to this
# port directly can pretend to be any premium player.
# Staff can switch it off for someone with /auth premium <player> off.
premium:
  enabled: true
  # Log verified premium players in automatically on join.
  auto-login: true
  # Premium players who have no account yet are registered by themselves, with no password.
  # Needs PacketEvents. When someone joins with a name that a paid Minecraft account uses and
  # nobody has registered here yet, Mojang checks that they own it. A cracked player who just
  # happens to use such a name gets "Invalid session" once; when they join again from the same
  # address within 5 minutes they get in normally and register with a password.
  auto-register: true

# --------------------------------------------------------
# Bedrock (Floodgate) Account Configuration
# --------------------------------------------------------
# Bedrock players joining through Geyser + Floodgate. This only does something when
# Floodgate is installed. Floodgate has already checked their Xbox account, so they
# are registered and logged in automatically, with no password.
bedrock:
  enabled: true
  # Skip /register and /login for Bedrock players.
  auto-login: true

# --------------------------------------------------------
# Anti-Bot Configuration
# --------------------------------------------------------
antibot:
  enabled: true
  # More joins than this per second (whole server) are refused for a moment.
  global-join-per-second: 5
  # Joins allowed from one IP address within per-ip-window-seconds.
  per-ip-join-limit: 3
  per-ip-window-seconds: 60
  # Names that look like bot names (default: 1-2 letters then 5+ digits, e.g. ab12345).
  suspicious-name-regex: "^[a-zA-Z]{1,2}[0-9]{5,}$"
  # Temporarily ban IPs that join too often (or with a suspicious name when captcha is off).
  auto-ip-ban: true
  auto-ip-ban-duration-minutes: 10
  # true = players with a suspicious name must solve /captcha before logging in.
  # false = they are kicked instead. Bypass: jpauth.bypass.captcha
  captcha-enabled: true

# --------------------------------------------------------
# Recovery e-mail (optional for players)
# --------------------------------------------------------
# Players can add an e-mail with /email add <email> <email> (confirmed with a code
# sent to it). If they forget their password they type /recover before logging in,
# get a code by mail and set a new password with /recover <code> <new> <new>.
# Nothing is sent until you fill in an SMTP server below. Free options: a Gmail
# account with an "app password" (smtp.gmail.com, port 587, STARTTLS) or your host's
# mail server.
email:
  enabled: true
  # Shown in the mails as {server}.
  server-name: 'our Minecraft server'
  # Address the mails come from (usually the same as smtp.username) and the sender name.
  from-address: ''
  from-name: 'Minecraft Server'
  smtp:
    host: ''
    # 587 with STARTTLS, 465 with SSL, 25 with NONE (not recommended).
    port: 587
    security: STARTTLS
    username: ''
    password: ''
  # How long a code stays valid, and the wait between two mails to the same player.
  code-valid-minutes: 15
  resend-cooldown-seconds: 120
  # Mail texts. Placeholders: {player} {code} {minutes} {server}
  verify-subject: 'Confirm your e-mail for {server}'
  verify-body:
    - 'Hi {player},'
    - ''
    - 'Type this in Minecraft to confirm your recovery e-mail:'
    - '/email verify {code}'
    - ''
    - 'The code is valid for {minutes} minutes. If you did not ask for this, ignore this mail.'
  recover-subject: 'Reset your password on {server}'
  recover-body:
    - 'Hi {player},'
    - ''
    - 'Someone asked to reset your password. Type this in Minecraft:'
    - '/recover {code} <new password> <new password>'
    - ''
    - 'The code is valid for {minutes} minutes. If it was not you, ignore this mail;'
    - 'your password stays the same.'

# --------------------------------------------------------
# Discord Webhook (Optional)
# --------------------------------------------------------
# Posts registrations, logins, locked accounts, lockdowns and IP bans to a Discord channel.
# Get the URL in Discord: channel settings > Integrations > Webhooks > New Webhook > Copy URL.
discord:
  webhook-enabled: false
  webhook-url: ""

# --------------------------------------------------------
# Spawn Locations
# Stored automatically via /auth setspawn <type>
# Format: world,x,y,z,yaw,pitch
# Empty = the player is not moved.
#   first-join       where brand-new players appear
#   unauthenticated  where players wait until they log in
#   post-register    where players go right after /register
#   lobby            where players go after /login when restore-location is off
#                    (or they have no saved location)
#   captcha          where players wait while solving the captcha
# --------------------------------------------------------
spawns:
  first-join: ""
  unauthenticated: ""
  post-register: ""
  lobby: ""
  captcha: ""

# --------------------------------------------------------
# Network (several servers behind Velocity or BungeeCord)
# --------------------------------------------------------
# Log in once for the whole network: set database.type to MYSQL with the same database
# on every server (accounts are then shared), and turn this on. After logging in on one
# server, switching to another logs the player in by itself (same IP, within
# session.expiration-minutes, so keep that above 0). /premium also applies everywhere.
#   MYSQL = messages go through that same database (nothing else to install).
#   REDIS = messages go through a Redis server (instant).
network:
  enabled: false
  # A short name for this server (only used in logs).
  server-name: 'lobby'
  messenger: MYSQL
  mysql-poll-ms: 1000
  redis:
    host: localhost
    port: 6379
    password: ''
    channel: jp