Administration Security

Administration and Security

Admin and moderator access

The web administration panel supports server-management functions such as message moderation, guest/IP mutes, session revocation, and configured web command actions.

Minecraft permission:

bluemapwebchat.admin

Default: OP.

Local web admin accounts

Local admin accounts can be created and managed with:

/bmchat admin create <id>
/bmchat admin password <id> <password>
/bmchat admin role <id> <user|moderator|admin>

Restrict where admin login is accepted with the admin security settings, especially on public deployments.

Login brute-force protection

Review security settings for failed-login windows, lock duration, and related limits. Passwords are stored hashed, but HTTP transport itself is not encrypted; use HTTPS publicly.

Reverse proxies and client IPs

Only configure http.trusted-proxies for proxies you actually control. Do not accept forwarded client IP headers from arbitrary Internet sources.

Private-chat super admins

private-chat-super-admins is a separate exact-account allowlist for private-chat metadata and, when explicitly enabled, read-only DM content audit.

private-chat-super-admins:
  - "ExactMinecraftNameOrUUID"

Normal ADMIN/MODERATOR role membership alone is not enough to read DM bodies.

Optional DM body audit

direct-message:
  admin-audit:
    enabled: false

Enable this only when your moderation policy explicitly requires private-message review for incidents or abuse reports. The audit view cannot send messages or act as a participant.

Audit logs

Administrative actions are written to date-based text audit files under the configured audit directory. DM body audit records access metadata such as actor, thread, page position, requested limit, and returned count; it does not duplicate message bodies into the audit log.

Public deployment checklist

• Use HTTPS
• Bind internal BMChat HTTP to 127.0.0.1 when a same-host reverse proxy is used
• Restrict admin login origins/IPs
• Set upload size/rate/retention limits
• Keep secrets and passwords out of screenshots, issue reports, and public config examples
• Back up SQLite/JSONL stores before upgrades
• Keep all servers participating in cross-server DMs on BlueMapWebChat 4.6.1