Document dedicated server operators

README.md

@@ -67,8 +67,34 @@ to returning players.
 Configuration is applied in this order: config file, environment variables,
 then command-line overrides. Supported command-line options are `--name`,
 `--bind`, `--port`, `--max-players`, `--data-dir`, `--discovery-url`,
-`--public`, and `--private`. Value options use `--option=value`. Keep the first
+`--operators`, `--public`, and `--private`. Value options use `--option=value`.
-standalone `--` shown above; it separates Godot engine flags from server flags.
+Keep the first standalone `--` shown above; it separates Godot engine flags
+from server flags.
+
+### Headless operators
+
+Headless moderation is granted by authenticated player identity, never by a
+display name or shared password. A player can copy their complete 64-character
+fingerprint from **Settings → Data & Identity → Copy Player Fingerprint**.
+
+Add trusted fingerprints to `/etc/netfishing-server.cfg`:
+
+```ini
+[moderation]
+operators=PackedStringArray("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
+```
+
+Alternatively, provide a comma-separated list through
+`NETFISHING_SERVER_OPERATORS` or `--operators=fingerprint1,fingerprint2`.
+Configuration file values are overridden by the environment, then by the
+command line. Restart the server after changing the allowlist.
+
+The server grants operator status only after the connecting player proves
+ownership of that exact identity key. Operators can kick, ban, unban, and clear
+shared session artwork through the in-game Players page. They cannot grant
+operator access, revoke another operator, or moderate another operator. Keep
+the server data directory persistent because it owns the server identity and
+stored bans.
 
 Public listing requires the discovery URL and a publicly reachable ENet UDP
 port. Discovery makes a server findable but does not relay gameplay traffic.
@@ -103,9 +129,10 @@ docker compose up -d
 ```
 
 Set values such as `NETFISHING_SERVER_NAME`, `NETFISHING_SERVER_PORT`,
-`NETFISHING_SERVER_MAX_PLAYERS`, and `NETFISHING_SERVER_PUBLIC` in a local
+`NETFISHING_SERVER_MAX_PLAYERS`, `NETFISHING_SERVER_PUBLIC`, and the optional
-`.env` file. The Compose service runs without Linux capabilities, uses a
+comma-separated `NETFISHING_SERVER_OPERATORS` in a local `.env` file. The
-read-only root filesystem, and stores persistent state in a named volume.
+Compose service runs without Linux capabilities, uses a read-only root
+filesystem, and stores persistent state in a named volume.
 
 ## Steam distribution
 

compose.yaml

@@ -18,6 +18,7 @@ services:
       NETFISHING_SERVER_PUBLIC: "${NETFISHING_SERVER_PUBLIC:-false}"
       NETFISHING_DISCOVERY_URL: "${NETFISHING_DISCOVERY_URL:-https://discovery.netfishing.org}"
       NETFISHING_DATA_DIR: /var/lib/netfishing-server
+      NETFISHING_SERVER_OPERATORS: "${NETFISHING_SERVER_OPERATORS:-}"
     volumes:
       - netfishing-server-data:/var/lib/netfishing-server
     tmpfs:

config/netfishing-server.env.example

@@ -5,3 +5,4 @@ NETFISHING_SERVER_MAX_PLAYERS=8
 NETFISHING_SERVER_PUBLIC=false
 NETFISHING_DISCOVERY_URL=https://discovery.netfishing.org
 NETFISHING_DATA_DIR=/var/lib/netfishing-server
+NETFISHING_SERVER_OPERATORS=

config/server.cfg.example

@@ -8,3 +8,6 @@ data_directory="/var/lib/netfishing-server"
 
 [discovery]
 url="https://discovery.netfishing.org"
+
+[moderation]
+operators=PackedStringArray()