Host Setup

Host Setup

Running the host

java -jar ServerFabricHost.jar

You can also specify a custom config path:

java -jar ServerFabricHost.jar --config path/to/config.properties

Example config

bindHost=127.0.0.1
bindPort=8085
hostId=local

token=CHANGE_ME_TOKEN

rootPath=dyn/

portMin=25570
portMax=25650

javaCmd=java
jvmArgs=-Xms512M,-Xmx1024M

securityTrustedCidrs=127.0.0.1/32,172.20.0.0/16,10.0.0.0/8
securityAuthMode=TOKEN_OR_SIGNED
securitySignedKeyId=proxy-main
securitySignedSecret=CHANGE_ME_TO_A_LONG_RANDOM_SECRET
securityClockSkewSeconds=30
securityNonceTtlSeconds=300

Folder structure

ServerFabric-Host stores data under:

rootPath/templates/
rootPath/instances/
rootPath/build-cache/
rootPath/tools-cache/
rootPath/logs/

Notes

• token must match the proxy configuration when bearer mode is used
• javaCmd is used for runtime server launch
• build-time Java is managed separately through the internal JDK cache

---

First boot behavior

On first boot, ServerFabric-Host can create:

• config file
• root directories
• default example templates

---

Security configuration

securityTrustedCidrs

Comma-separated list of trusted IPs/CIDRs.

Trusted CIDRs are still authenticated and logged, but they bypass temporary bans and rate limiting in the current implementation.

This is useful for:

• localhost
• Docker/Pterodactyl bridge networks
• proxy hosts
• private/VPN subnets

securityAuthMode

Authentication mode for the host API.

Supported values:

• TOKEN_ONLY
• TOKEN_OR_SIGNED
• SIGNED_ONLY

Recommended migration path:

1. TOKEN_ONLY
2. TOKEN_OR_SIGNED
3. SIGNED_ONLY

securitySignedKeyId

The key ID used for signed requests.

The proxy must send the same key ID in X-SFabric-KeyId.

securitySignedSecret

The shared secret used for HMAC signing.

Use a long random secret.

securityClockSkewSeconds

Allowed timestamp skew for signed requests.

If the proxy and host clocks differ too much, requests will be rejected.

securityNonceTtlSeconds

How long a signed request nonce is remembered to prevent replay attacks.

---

Recommended deployment

Recommended deployment model:

• bind the host to localhost, LAN, or VPN/private IPs
• do not expose it directly to the public internet unless necessary
• restrict access with a firewall
• use trusted CIDRs for internal infrastructure
• migrate to signed requests for stronger authentication

See also: Host API Security