XFE Server Manager

XFE Server Manager is a server-side Minecraft Forge administration mod with a browser-based control plane, semantic command policies, live health metrics, audited player operations, and an extensible governance layer. It is currently a development implementation, not a production release.

The project targets four explicit Forge baselines. It does not claim that a single jar works across Minecraft versions.

Repository layout

• common/api — neutral public records and extension SPI.
• common/core — policy, authorization, operations, and audit domain logic.
• common/infra — embedded HTTP, authentication, persistence, and telemetry.
• web-ui — React/TypeScript administration console.
• platform — one isolated Forge build root per supported Minecraft version.
• docs — security, API, deployment, and compatibility documentation.

Build

The repository includes Gradle wrappers; a global Gradle installation is not required. Java 17 builds the common modules and the 1.20.1 adapter. Java 21 is required for the newer adapters.

./gradlew check
cd web-ui && npm ci && npm test && npm run build
./scripts/build-all.sh

On Windows, use gradlew.bat and scripts/build-all.ps1.

The web server binds to 127.0.0.1:8765 by default. Put it behind a trusted HTTPS reverse proxy before exposing it outside the host.

See README.zh-CN.md for Chinese documentation.

First start

1. Install exactly one artifact matching the server's Minecraft and Forge versions. The mod deliberately registers no client-required content or network channel; the vanilla-client handshake still requires acceptance testing for every target version before release.
2. Start the dedicated server and keep the management listener on loopback.
3. From the physical server console, run /xfesm web bootstrap.
4. Use the ten-minute, single-use code to create the first owner, then enroll TOTP before enabling privileged Web features.

Configuration and databases are written under the server's XFE Server Manager data directory. Back them up only after a WAL checkpoint or a clean shutdown.

Documentation

• Architecture
• Security model
• Deployment and operations
• Build and release
• Compatibility boundaries
• OpenAPI 3.1 contract
• Implementation and acceptance status

Development status

The repository contains the platform-neutral policy, governance, player, rollback, authentication, SQLite, HTTP/SSE and Web-console implementation, together with isolated Forge adapters for the four baselines. The v2 governance and rollback work is currently a neutral domain core and partial persistence only: its Forge event capture, claim enforcement, world restore and rollback gateway are disabled. See the implementation status.

A build is not a production release until each generated JAR passes the dedicated-server start, vanilla-client handshake, clean-stop and database-recovery acceptance checks listed in the compatibility documentation.

Loopback binding, explicit policy publication, owner isolation, least-privilege command reparse and audited mutations are implemented safety defaults. They do not replace the outstanding production acceptance tests.

License

MIT © XFEstudio.