# ︽︽ If any new settings are added in future updates, they will appear at the top of the configuration file automatically. ︽︽
#+------------------------------------------------------------------------------------------------------+
#|                                                                                                      |
#|                                             M A X A U T H                                            |
#|                                       P R O X Y   C O N F I G                                        |
#|                                                                                                      |
#+------------------------------------------------------------------------------------------------------+


#+------------------------------------------------------------------------------------------------------+
#|  STARTUP AND DEBUG                                                                                   |
#+------------------------------------------------------------------------------------------------------+

# Log premium/cracked detection, resolver decisions, redirect decisions, and other auth flow details.
# Keep this disabled on production unless you are diagnosing a problem.
debug : false


#+------------------------------------------------------------------------------------------------------+
#|  STORAGE                                                                                             |
#+------------------------------------------------------------------------------------------------------+

# Database type used by MaxAuth.
# Supported values: SQLITE, MYSQL, MARIADB, POSTGRESQL.
# SQLITE is fine for testing and small servers. MYSQL/MARIADB/POSTGRESQL are recommended for networks.
storageType : SQLITE

# Database table name used for storing MaxAuth user profiles.
# Default: maxauth_users
# Use only letters, numbers, and underscores.
storageTableName : maxauth_users

# Database connection settings.
# SQLITE ignores host, port, database, user, and password.
storageHost : ''
storagePort : 3306
storageDatabase : ''
storageUser : ''
storagePassword : ''

# Extra JDBC properties appended to the database connection.
# Example: ['useSSL=false', 'characterEncoding=utf8']
storageProperties : [ ]

# Storage connection pool settings.
# Lower these values on shared hosting or small VPS databases with low connection limits.
connectionPoolSize : 10
connectionPoolIdle : 10
connectionPoolTimeout : 5000
connectionPoolLifetime : 1800000
connectionKeepAliveTime : 0


#+------------------------------------------------------------------------------------------------------+
#|  PROXY AND BACKEND COMMUNICATION                                                                     |
#+------------------------------------------------------------------------------------------------------+

# Access token used to verify MaxAuth plugin messages between the proxy and backend servers.
# Use a long random value and set the exact same value in every backend configuration.
# Keep this private. Anyone with this token could try to spoof backend state messages.
# You can generate a secure random token using online tools (e.g., https://www.browserling.com/tools/random-string).
accessToken : ' { {ACCESS_TOKEN } }'


#+------------------------------------------------------------------------------------------------------+
#|  SERVER ROUTING                                                                                      |
#+------------------------------------------------------------------------------------------------------+

# Limbo server names.
# Unauthorized cracked players are sent here to login or register.
# You can add multiple servers as fallbacks, for example: [limbo1, limbo2]
# If empty, MaxAuth will not redirect unauthorized players.
limboServerNames : [limbo ]

# Main server names.
# Authorized players are sent here after successful login/register when redirects are enabled.
# You can add multiple servers as fallbacks, for example: [lobby, survival]
# If empty, MaxAuth will not redirect authorized players.
mainServerNames : [main ]

# Redirect cracked players to mainServerNames after successful /register.
# If enabled, register success chat/title messages are shown after the player reaches the main server.
afterRegisterRedirect : true

# Redirect cracked players to mainServerNames after successful /login.
# If enabled, login success chat/title messages are shown after the player reaches the main server.
afterLoginRedirect : true

# Redirect players to the last non-limbo server they were on before quitting.
# If disabled, players use the normal mainServerNames selection.
lastServerRedirection : false

# BungeeCord only: redirect players to a fallback target after they are kicked from a backend server.
disconnectRedirection : true

# Delay titles and first join messages after the player reaches a backend server, in milliseconds.
# Increase this if your server needs more time before it can reliably show titles or chat messages.
delayTitlesAfterJoinTime : 1000


#+------------------------------------------------------------------------------------------------------+
#|  ACCOUNT DETECTION AND UUIDS                                                                         |
#+------------------------------------------------------------------------------------------------------+

# UUID mode assigned to players.
# Supported values: REAL, OFFLINE, FIXED.
# REAL    = recommended default; premium players use Mojang UUIDs and cracked players use MaxAuth's normal auth flow.
# OFFLINE = offline UUID fallback based on nickname; useful mainly for specific migrations or legacy offline setups.
# FIXED   = stable MaxAuth offline fallback UUID mode; useful mainly for specific migrations or special setups.
# Do not change this after players are registered unless you are intentionally migrating data.
uniqueIdsType : REAL

# Support Floodgate/Geyser Bedrock players.
# enabled:
#   Enables basic Floodgate compatibility and Bedrock UUID handling.
# useApiVerification:
#   Uses Floodgate API when available for more accurate detection,
#   especially linked Bedrock-Java accounts. Falls back to basic detection
#   if Floodgate API is not installed.
floodgateSupport:
  enabled : false
  useApiVerification : true

# Automatically register new premium players.
# If enabled, premium players can join without manually creating a password account.
registerPremiumUsers : true

# Use the 1.19.1+ handshake UUID hint to distinguish premium players earlier in the login flow.
# Older clients and unsupported setups fall back to the normal resolver flow.
detectPremiumUniqueIdsInHandshake : true

# If a player with a premium nickname disconnects during premium verification,
# treat the next attempt as cracked.
secondLoginCracked : false

# Kick a new player on first join and ask them to reconnect.
# This is applied only when the player is not in the database yet.
firstTimeJoinKick : false

# New player types affected by firstTimeJoinKick.
# allcracked = all non-premium joins
# cracked    = only clearly cracked players
# premium    = confirmed premium players
# all        = every new player
firstTimeJoinKickUser : allcracked

# Force new cracked players to register on your website instead of in-game.
registerOnWebsite : false # !! deprecated and not used now, as the old website registration flow is removed. !!


#+------------------------------------------------------------------------------------------------------+
#|  AUTHENTICATION                                                                                      |
#+------------------------------------------------------------------------------------------------------+

# Require cracked players to confirm passwords in register, change password, create password,
# and password recovery confirm commands.
# When changing this, update related usage messages in messages.yml if needed.
confirmPassword : true

# Require /confirm before risky commands such as /unregister, /premium, and /cracked.
riskyCommandsConfirmation : true

# Maximum time cracked players have to login or register, in seconds.
# When the time expires, they are disconnected.
maximumAuthorisationTime : 90

# Maximum failed login attempts before disconnecting a cracked player.
# Use 0 to disable this limit.
maximumLoginTriesBeforeDisconnection : 5

# IP ban duration after reaching the failed login limit, in minutes.
addressBanDuration : 10

# Maximum cracked profiles that can be registered from one IP address.
# Use 0 to disable the limit.
maximumUserProfilesPerAddress : 0

# Days after which absent cracked players are automatically unregistered.
# Use 0 to disable automatic cleanup.
automaticUnregisterTime : 0


#+------------------------------------------------------------------------------------------------------+
#|  PASSWORDS                                                                                           |
#+------------------------------------------------------------------------------------------------------+

# Password hashing algorithm for new cracked-player passwords.
# Recommended values: ARGON2ID, BCRYPT.
# Other configurable values: PBKDF2_SHA256, PBKDF2_SHA512, SALTEDSHA512, SHA256, SHA512.
# SHA256 and SHA512 are MaxAuth salted hashes. Classic unsalted SHA hashes are migration-only as CSHA256 and CSHA512.
passwordHashingAlgorithm : ARGON2ID

# Re-hash a password on login when it uses a different algorithm than configured above.
# Useful when migrating from legacy algorithms to ARGON2ID or BCRYPT.
# Migration-only hashes accepted from the database include:
# SALTEDSHA256, DOUBLE_SHA512, AUTHME_SHA256, AUTHME_SHA, PBKDF2, CSHA256, CSHA512,
# MD5VB, IPB3, IPB4, JOOMLA, MYBB, PHPBB, PHPFUSION, SMF, WBB3, WBB4, XFBCRYPT,
# ROYALAUTH, MD5, SHA1, DOUBLE_MD5, DOUBLE_SHA1, BCRYPT2Y.
rehashPasswordWhenUsingDifferentAlgorithm : true

# Regular expression that cracked-player passwords must match.
# Default: 6-25 non-whitespace characters.
safePasswordPattern : ' [\S ] {6,25 }'


#+------------------------------------------------------------------------------------------------------+
#|  CAPTCHA                                                                                             |
#+------------------------------------------------------------------------------------------------------+

# Require new cracked players to enter the captcha code shown on the backend captcha map.
# If false, captcha is fully disabled and the backend will not give the captcha map.
# The map slot itself is configured only in backend configuration.yml as captchaMapSlot.
verifyCaptchaCode : false


#+------------------------------------------------------------------------------------------------------+
#|  SESSIONS                                                                                            |
#+------------------------------------------------------------------------------------------------------+

# Manual session duration started by /startsession, in minutes.
manuallySessionTime : 720

# Automatic session duration after successful login/register, in minutes.
# Use 0 to disable automatic sessions.
automaticSessionTime : 10


#+------------------------------------------------------------------------------------------------------+
#|  PASSWORD RECOVERY AND 2FA                                                                           |
#+------------------------------------------------------------------------------------------------------+

# Server name shown in TOTP authenticator apps and recovery-related messages.
serverName : Your server name

# Enable email-based features.
# If false, email reminders are not sent and these commands are disabled:
# /changeemailaddress, /requestpasswordrecovery, /confirmpasswordrecovery,
# and matching /maxauth admin subcommands.
emailEnabled : false

# Enable two-factor authentication features.
# If false, 2FA reminders are not sent, existing 2FA tokens are ignored during login,
# and these commands are disabled:
# /requestsecondfactor, /activatesecondfactor, /deactivatesecondfactor,
# and matching /maxauth admin subcommands.
secondFactorEnabled : false

# Delay between password recovery requests, in minutes.
recoveringPasswordDelay : 60

# Email subject used for password recovery.
passwordRecoverySubject : The password recovery

# Mail server used by password recovery.
# If you do not use recovery, leave these empty.
mailHost : ''
mailPort : 25
mailUser : ''
mailPassword : ''
mailName : Your server name
# Mail encryption mode.
# Supported values: NONE, STARTTLS, SSL.
# Use STARTTLS for ports such as 587 and SSL for ports such as 465.
mailEncryption : STARTTLS
# Deprecated compatibility fallback for old configs.
# If mailEncryption is missing, true maps to STARTTLS and false maps to NONE.
mailUseTLS : true

# mailEncryption values:
# NONE     = plain SMTP
# STARTTLS = upgraded TLS connection, usually port 587
# SSL      = implicit TLS connection, usually port 465


#+------------------------------------------------------------------------------------------------------+
#|  USERNAME AND STAFF PROTECTION                                                                       |
#+------------------------------------------------------------------------------------------------------+

# Regular expression for allowed usernames.
# Do not add the Floodgate prefix here; MaxAuth handles Floodgate separately when enabled.
allowedUsernamePattern : ' [a-zA-Z0-9_ ] {2,16 }'

# Account UUIDs that staff/admin commands cannot manage.
# Use full UUID format with dashes.
protectedAccounts : [ ]


#+------------------------------------------------------------------------------------------------------+
#|  COMMANDS                                                                                            |
#+------------------------------------------------------------------------------------------------------+

# Commands that not-logged cracked players can execute.
# Include login aliases here too, otherwise aliases may be blocked before authorization.
logoutUserCommands : [login, register, requestpasswordrecovery, confirmpasswordrecovery, l ]

# /login command aliases.
# Example: [l, log]
loginCommandAliases : [l ]


#+------------------------------------------------------------------------------------------------------+
#|  DISCORD AUDIT WEBHOOKS                                                                              |
#+------------------------------------------------------------------------------------------------------+

# Discord audit webhooks.
# You can define multiple webhooks and route different event categories to different Discord channels.
# Leave enabled false or url empty to disable a webhook entry.
# Event switches:
# adminDiagnostics          = /maxauth configcheck and /maxauth checkflow
# adminProfileViews         = profile lookup/view commands
# adminProfileMutations     = register, unregister, password, premium/cracked, purge, merge, email changes
# adminAuthActions          = login/session admin actions
# adminRecoveryActions      = password recovery admin actions
# adminSecondFactorActions  = 2FA admin actions
# adminSpawnSet             = /maxauth spawnset
# adminReload               = /maxauth reload
# allPlayerCommands         = every player command attempt, including commands from other plugins
# blockedCommands           = commands blocked before authorization
# commandLogin              = /login and aliases from MaxAuth
# commandRegister           = /register
# commandConfirm            = /confirm
# commandStartSession       = /startsession
# commandDestroySession     = /destroysession
# commandCreatePassword     = /createpassword
# commandChangePassword     = /changepassword
# commandUnregister         = /unregister
# commandPremium            = /premium
# commandCracked            = /cracked
# commandChangeEmailAddress = /changeemailaddress
# commandRequestPasswordRecovery = /requestpasswordrecovery
# commandConfirmPasswordRecovery = /confirmpasswordrecovery
# commandRequestSecondFactor     = /requestsecondfactor
# commandActivateSecondFactor    = /activatesecondfactor
# commandDeactivateSecondFactor  = /deactivatesecondfactor
# commandMaxAuth            = /maxauth, /mauth, /reloadmaxauth
# loginResults              = successful and failed /login results
# registerResults           = successful and failed /register results
# sessionResults            = session-related command results
# accountResults            = premium/cracked/unregister account command results
# passwordResults           = password command results
# recoveryResults           = password recovery command results
# secondFactorResults       = 2FA command results
# playerKicks               = MaxAuth kicks/disconnects
# joinFlow                  = join/session flow diagnostics
# successfulActions         = send successful actions
# failedActions             = send failed actions and invalid usage/profile-not-found attempts
sendDiscordWebhooks:
  - name : admin-audit
    enabled : false
    url : ''
    adminDiagnostics : true
    adminProfileViews : true
    adminProfileMutations : true
    adminAuthActions : true
    adminRecoveryActions : true
    adminSecondFactorActions : true
    adminSpawnSet : true
    adminReload : true
    allPlayerCommands : false
    blockedCommands : true
    commandLogin : true
    commandRegister : true
    commandConfirm : true
    commandStartSession : true
    commandDestroySession : true
    commandCreatePassword : true
    commandChangePassword : true
    commandUnregister : true
    commandPremium : true
    commandCracked : true
    commandChangeEmailAddress : true
    commandRequestPasswordRecovery : true
    commandConfirmPasswordRecovery : true
    commandRequestSecondFactor : true
    commandActivateSecondFactor : true
    commandDeactivateSecondFactor : true
    commandMaxAuth : true
    loginResults : true
    registerResults : true
    sessionResults : true
    accountResults : true
    passwordResults : true
    recoveryResults : true
    secondFactorResults : true
    playerKicks : true
    joinFlow : false
    successfulActions : true
    failedActions : true
 

# ︽︽ If any new settings are added in future updates, they will appear at the top of the configuration file automatically. ︽︽
#+------------------------------------------------------------------------------------------------------+
#|                                                                                                      |
#|                                             M A X A U T H                                            |
#|                                       B A C K E N D   C O N F I G                                    |
#|                                                                                                      |
#+------------------------------------------------------------------------------------------------------+


#+------------------------------------------------------------------------------------------------------+
#|  PROXY PROTECTION                                                                                    |
#+------------------------------------------------------------------------------------------------------+

# Access token used for verifying MaxAuth connections and plugin messages from the proxy.
# This value must be exactly the same as accessToken in the MaxAuth proxy configuration.
# Keep it private. If somebody knows this token, they may be able to spoof proxy/backend communication.
accessToken : ' { {ACCESS_TOKEN } }'

# Disable handshake access-token checks.
# Enable this only when the backend is already protected by Velocity modern forwarding, BungeeGuard,
# firewall rules, or another trusted proxy-only protection.
# MaxAuth plugin-message token validation remains active even when this is enabled.
accessTokenDisabled : false

# Trusted proxy IP addresses allowed to connect to this backend.
# Leave empty to allow any source IP that provides a valid MaxAuth token.
# Supports exact IPs and CIDR ranges, for example:
# trustedProxyIps: ['127.0.0.1', '10.0.0.0/8', '192.168.1.20']
trustedProxyIps : [ ]

# Kick message for players who fail backend token validation.
# Supports legacy colors (&a), hex colors ({#55ff55}), gradients ({#55ff55>}Text{<#55ffff}),
# and multiple lines using the YAML list format below.
disconnectionMessage :
 - '&8 [ { #55ff55}M{#55ff8e}a{#55ffc6}x{#55ffff}A{#71e3e3}u{#8ec6c6}t{#aaaaaa}h&8]'
  - '&7Please join to the server via &amc.example.com&7!'


#+------------------------------------------------------------------------------------------------------+
#|  AUTHORIZATION RESTRICTIONS                                                                          |
#+------------------------------------------------------------------------------------------------------+

# Restrict movement while the player is not authorized.
# When enabled, unauthorized players are kept at their auth/spawn position.
restrictedMovement : true

# Restrict interactions while the player is not authorized.
# This includes breaking, placing, combat, inventory actions, chat, and commands.
restrictedInteractions : true

# Give blindness to unauthorized players.
# The effect is removed when the proxy marks the player as authorized.
blindnessEffect : true


#+------------------------------------------------------------------------------------------------------+
#|  AUTH ENVIRONMENT                                                                                    |
#+------------------------------------------------------------------------------------------------------+

# Player-local time forced while the player is not authorized.
# Leave empty to disable.
# Supported names: day, morning, noon, midday, sunset, dusk, evening, night, midnight, sunrise, dawn.
# Also supports clock time such as 18:15 and raw Minecraft ticks such as 1000.
# The value is held for the player during authorization and reset after login/register.
setPlayerTime : day

# Player-local weather forced while the player is not authorized.
# Leave empty to disable.
# clear/sun/sunny = clear weather.
# rain/rainy/downfall/thunder/storm = local downfall.
# The value is held for the player during authorization and reset after login/register.
setPlayerWeather : clear


#+------------------------------------------------------------------------------------------------------+
#|  SPAWN                                                                                               |
#+------------------------------------------------------------------------------------------------------+

# Teleport players after joining this backend server.
# Format: world/x/y/z/yaw/pitch
# Leave empty to disable.
# Set this in-game from the proxy with /maxauth spawnset while standing at the desired location.
spawnLocation : ''


#+------------------------------------------------------------------------------------------------------+
#|  CAPTCHA                                                                                             |
#+------------------------------------------------------------------------------------------------------+

# Hotbar slot where unregistered players receive the captcha map when proxy verifyCaptchaCode is enabled.
# Use 1-9.
# Captcha is enabled or disabled only in proxy configuration.yml using verifyCaptchaCode.
captchaMapSlot : 1

# Message shown on the captcha map.
# Keep it short and include %captcha_code%.
# The map font supports only basic latin letters, digits, spaces, %, and _.
# Unsupported characters are replaced with ?.
captchaMessage : 'Your captcha is %captcha_code%'