Skip to content

Public Site

Jump to bottom
jack edited this page Jun 25, 2026 · 4 revisions

Wawel Auth can serve a public static website from:

config/wawelauth/public-page/
image

This site is served by the same HTTP server as the auth API and the admin UI.

When same-port HTTPS is enabled (http.httpsEnabled), the public site is served using the HTTPS certificate stored at config/wawelauth/data/https-cert.der and config/wawelauth/data/https-private.der. This certificate keypair only secures the HTTPS transport and is not related to the server's signing keypair.

How it works

The public site is mounted under publicPagePath (server.json).

Examples:

  • publicPagePath = "/" serves the site from the root
  • publicPagePath = "/info" serves the site from /info

On startup, Wawel Auth scans the public-page/ directory, reads all files into memory, and serves that frozen snapshot. Only files present when the snapshot is built are served, and there is no live-reload functionality.

Note

Wawel Auth only seeds the bundled default site when public-page/ is completely empty.

Bundled default site

The default page fetches server data from the public info API and refreshes itself periodically.

It displays:

  • Server name and MOTD
  • Public description
  • Player count
  • Advertised server address. It can be dragged and dropped into a LWJGL3ify client to add the server to the server list. The drag payload uses a wawelauth-server:// URI.
  • Registration policy
  • Local auth API root
  • Configured fallback providers
  • Installed mods
  • Connected players with rendered head icons
  • Links to homepage, registration page, admin UI, and Dynmap when available

Note

If you use the bundled default page and disable publicInfoApiPath, the page will still load, but it will not be able to populate its server data.

Note

enablePublicInfoApi and enablePublicPage are separate: enablePublicPage=false disables the static site, and enablePublicInfoApi=true can still leave the JSON endpoint enabled.

Route behavior

Wawel Auth creates direct routes for every frozen file under public-page/.

Special handling for index files:

  • index.htm and index.html are also served from the containing directory path
  • For example, public-page/docs/index.htm is available at both /docs/index.htm and /docs/

Reserved built-in routes under the public page cannot be overridden by files:

  • __server-icon.png
  • __server-icon.gif
  • __player-avatar.png
  • Whatever path is configured as publicInfoApiPath

These built-in routes are managed by Wawel Auth itself.

Caching

  • Player avatars are cached for 30 seconds
  • The public info API is cached for 5 seconds server-side, and 30 seconds client-side

Clone this wiki locally