Document opt-in dedicated chat logging

README.md

@@ -76,10 +76,28 @@ to returning players.
 Configuration is applied in this order: config file, environment variables,
 then command-line overrides. Supported command-line options are `--name`,
 `--bind`, `--port`, `--max-players`, `--data-dir`, `--discovery-url`,
-`--operators`, `--public`, and `--private`. Value options use `--option=value`.
+`--operators`, `--chat-log-path`, `--chat-logging`, `--no-chat-logging`,
+`--public`, and `--private`. Value options use `--option=value`.
 Keep the first standalone `--` shown above; it separates Godot engine flags
 from server flags.
 
+### Chat privacy
+
+Chat logging is disabled by default. With the default configuration, chat is
+kept only in the connected player's current UI, is not replayed to players who
+join or reconnect, and is not written to disk. The live session's chat is
+destroyed when that session ends.
+
+A dedicated-server operator can explicitly opt into logging by setting
+`chat_logging=true` under `[privacy]`, setting
+`NETFISHING_CHAT_LOGGING=true`, or passing `--chat-logging`. The optional
+`chat_log_path`, `NETFISHING_CHAT_LOG_PATH`, or `--chat-log-path` setting must
+be an absolute path; it defaults to `logs/chat.jsonl` inside the configured
+data directory. Players joining a server with logging enabled receive an
+in-game privacy warning. The JSON Lines log contains UTC timestamps, player
+display names, and message bodies. Treat it as sensitive data and configure
+access, retention, and rotation deliberately.
+
 ### Headless operators
 
 Headless moderation is granted by authenticated player identity, never by a
@@ -140,8 +158,9 @@ docker compose up -d
 
 Set values such as `NETFISHING_SERVER_NAME`, `NETFISHING_SERVER_PORT`,
 `NETFISHING_SERVER_MAX_PLAYERS`, `NETFISHING_SERVER_PUBLIC`, `TZ`, and the
-optional comma-separated `NETFISHING_SERVER_OPERATORS` in a local `.env` file. The
+optional comma-separated `NETFISHING_SERVER_OPERATORS` in a local `.env` file.
-Compose service runs without Linux capabilities, uses a read-only root
+Chat logging remains off unless `NETFISHING_CHAT_LOGGING=true` is explicitly
+set. The Compose service runs without Linux capabilities, uses a read-only root
 filesystem, and stores persistent state in a named volume.
 
 ## Steam distribution

compose.yaml

@@ -18,6 +18,8 @@ services:
       NETFISHING_SERVER_PUBLIC: "${NETFISHING_SERVER_PUBLIC:-false}"
       NETFISHING_DISCOVERY_URL: "${NETFISHING_DISCOVERY_URL:-https://discovery.netfishing.org}"
       NETFISHING_DATA_DIR: /var/lib/netfishing-server
+      NETFISHING_CHAT_LOGGING: "${NETFISHING_CHAT_LOGGING:-false}"
+      NETFISHING_CHAT_LOG_PATH: "${NETFISHING_CHAT_LOG_PATH:-/var/lib/netfishing-server/logs/chat.jsonl}"
       TZ: "${TZ:-UTC}"
       NETFISHING_SERVER_OPERATORS: "${NETFISHING_SERVER_OPERATORS:-}"
     volumes:

config/netfishing-server.env.example

@@ -5,5 +5,7 @@ NETFISHING_SERVER_MAX_PLAYERS=8
 NETFISHING_SERVER_PUBLIC=false
 NETFISHING_DISCOVERY_URL=https://discovery.netfishing.org
 NETFISHING_DATA_DIR=/var/lib/netfishing-server
+NETFISHING_CHAT_LOGGING=false
+NETFISHING_CHAT_LOG_PATH=/var/lib/netfishing-server/logs/chat.jsonl
 TZ=UTC
 NETFISHING_SERVER_OPERATORS=

config/server.cfg.example

@@ -9,5 +9,9 @@ data_directory="/var/lib/netfishing-server"
 [discovery]
 url="https://discovery.netfishing.org"
 
+[privacy]
+chat_logging=false
+chat_log_path="/var/lib/netfishing-server/logs/chat.jsonl"
+
 [moderation]
 operators=PackedStringArray()