woofmeow/straywild-discovery-server
1
0
Fork 0
Code Issues Projects Releases Packages Wiki Activity Actions

feat: add selectable allocation-based privacy relay

Browse source
This commit is contained in:
Alexander Sellite 2026-09-01 10:21:34 -04:00
parent e979da9e76
commit 46de16db00
14 changed files with 1067 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

18
deploy/straywild-discovery.env.example
View file

@ -14,6 +14,24 @@ straywild_DISCOVERY_TRAVERSAL_HOST=0.0.0.0
straywild_DISCOVERY_TRAVERSAL_PORT=7771
straywild_DISCOVERY_TRAVERSAL_PUBLIC_HOST=discovery.straywild.io
# Allocation-based ENet/UDP privacy relay for player-hosted rooms. Player hosts
# explicitly select direct or relay discovery. Dedicated rooms are always
# direct and are rejected if they request this shared relay. Open the complete
# UDP range in the host and provider firewalls. Relay joins fail closed and
# never downgrade to direct when an allocation is unavailable.
straywild_DISCOVERY_RELAY_ENABLED=true
straywild_DISCOVERY_RELAY_HOST=0.0.0.0
straywild_DISCOVERY_RELAY_PUBLIC_HOST=discovery.straywild.io
straywild_DISCOVERY_RELAY_PORT_START=20000
straywild_DISCOVERY_RELAY_PORT_END=22047
straywild_DISCOVERY_RELAY_MAX_ALLOCATIONS=2048
straywild_DISCOVERY_RELAY_AUTH_TTL=12
straywild_DISCOVERY_RELAY_IDLE_TTL=120
# Only trust X-Forwarded-For when the immediate peer is within one of these CIDRs.
# The loopback values suit a reverse proxy on the same host.
straywild_DISCOVERY_TRUSTED_PROXY_CIDRS=127.0.0.0/8,::1/128
# Privacy invariant: the application does not emit request/access logs. The
# reverse proxy must also have access logging disabled for discovery routes;
# never log peer addresses, request bodies, headers, capabilities, or tokens.

1
deploy/straywild-discovery.service
View file

@ -22,6 +22,7 @@ ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
LimitNOFILE=8192
[Install]
WantedBy=multi-user.target