Security
Roles, access tokens, audit log and file permissions for everyone who manages the network.
Who may do what
Two separate mechanisms that are easily confused.
access.toml governs who may operate the cloud, that is /mutecloud in game, the HTTP API
and the dashboard. Roles bundle rights, players get roles:
role list
user add MuteBefehl admin
user info MuteBefehlShipped are admin with *, moderator with view and restart, and viewer with view
only. Own roles come from role create and are filled with role grant.
ranks.toml on the other hand governs player rights on the servers, so prefix, suffix and
Bukkit permissions, distributed through the bridge. If LuckPerms is in use, leaving it empty keeps
MuteCloud out of permission handling entirely.
Tokens
The token in mutecloud.toml under [api] grants full access. For every other consumer:
token create website groups.view players.viewEvery token receives only the rights it requires. token list shows when each was last
used.
After eight wrong tokens an address is locked out for a minute, on HTTP as well as on the WebSocket, and a message goes out. The dashboard has the same brake after five attempts, additionally across all addresses.
Audit log
Every command from outside is recorded in audit.log:
2026-09-15T05:40:12Z spiel MuteBefehl ok groups Lobby stop
2026-09-15T05:41:03Z rest website verweigert:groups.stop groups Lobby stopCovered are the in-game path, the API and the dashboard. Read it with audit or
audit 50, the right for that is *. The log rotates daily and is kept for ninety days,
configurable under [logs].
Files
mutecloud.toml and access.toml belong to the owner only, they hold tokens and password
hashes. The same goes for forwarding.secret in the proxy template. Dashboard passwords
are stored as Argon2id hashes.
Dashboard
Off by default. dashboard on enables it, dashboard password <new> sets the shared
password, user password <name> <new> gives a player their own login with their roles.
For public use set a domain and a mail address, then the cloud fetches a Let's Encrypt certificate:
dashboard domain cloud.example.com
dashboard contact mail@example.comWhich addresses are allowed and what the dashboard can do is described under dashboard, alerts and metrics.
In a cluster
Nodes are only joined inside a private network. Workers only connect to private addresses, and the leader only accepts nodes and template downloads from private networks. See Private network only.
Ports
| Port | Who needs it | Who must not |
|---|---|---|
8770 | workers and your own tools | the internet |
25565 | players, through the proxy | open to everyone |
| game server ports | the proxy only | players |
The API binds to 127.0.0.1:8770 by default and is then reachable from the machine
itself only. A cluster needs it open towards the workers, nothing else; bind it to the
private address rather than to 0.0.0.0 where you can, and never expose it publicly.
Game servers do not need to be reachable from the internet at all. Players connect to
the proxy, the proxy connects to the servers, and a game server open to the world lets
people walk past the proxy and its punishments.