The GameCP

What It Is

Every release includes webserver, a single binary we call the GameCP. It is two things at once: the public website your players use, and the control panel you run the server from. There is nothing else to install, no PHP, no separate admin tool and no second database.

It is the same panel on every game we publish files for. What differs between them is the settings list behind it, not the pages.

It is optional. A server runs perfectly well without one, and players can create accounts through the launcher instead. Run it when you want a public front door.

What Your Players Get

• Accounts. Register, sign in, change a display name or a password, and see the characters on the account. The same account works in the game and on the site, because both read the same accounts database.
• Live status. Whether the server is up, how many people are online and the split across the factions.
• A game database. Items, monsters, NPCs, skills, forces, quests, stores and maps, searchable, drawn from your server’s own content. On the RF versions the icons and readable names come out of your own client, which item icons and names covers.
• A live map of who is where, for the worlds you leave visible.
• News, written by you from the panel.
• A leaderboard and player profiles.
• Support tickets. A player opens one from their account page and your staff answer from the panel. No email, no third-party helpdesk.
• Downloads and client patching. The client/ directory is served for the launcher to patch from, which the launcher page covers from the player’s end.

What You Get

An Admin link appears in the header once the signed-in account holds an Administrator grant on this game, and there is no way in without one: every page behind it re-checks the level on the request rather than trusting the browser.

Area	What it does	Level
Overview	Live server state, who is online, recent activity.	Administrator
Accounts	Search accounts, read login and address history, ban, unban, kick, force a password reset.	Moderator upward
Staff	See who holds a grant, and change it.	Administrator to read, Super Administrator to change
Settings	Every server setting this game exposes.	Administrator to read, Super Administrator to change
Server controls	Reload settings, announce to everyone online, start a graceful shutdown.	Administrator
News	Write, edit, categorise, publish and trash articles.	Administrator
Tickets	The support queue: assign, reply, close.	Moderator
Credits	The account credit ledger, with every adjustment recorded against a reason.	Administrator to read, Super Administrator to change
Game Data	Edit the server’s game data as spreadsheets. On 2.2.3.2 today, see Game Data Editor.	Administrator to read, Super Administrator to save

Making the first admin account needs no database tooling. On its first start, while nobody is staff yet, the panel prints a one-time bootstrap password. GM accounts covers the five levels, that bootstrap flow, and how to promote everyone else.

It Is Your Site

The panel ships whitelabel. Nothing in the binary advertises us to your players, and the parts that say whose server this is live in a settings table in your own game database, editable from Admin -> Site Settings: the site name, the accent colours, your chat link, your download mirrors, the address you publish release notes at, and the footer credit.

Every one of those starts empty, which means “use the built-in default”. Blanking a value later puts the default back rather than leaving a hole, and a value that does not make sense is ignored rather than rendering a broken page.

The Settings Behind It Vary by Game

Everything above is the same wherever you run it. The Settings page is not: it lists what that particular game exposes, and the games differ in what there is to expose. Rates, world visibility, the GM command controls, the anti-cheat toggles and the game-specific systems are all per game, and some of them exist on one version and not on the next.

We are documenting those option by option, per game, and it is not finished yet. Until it is, the Settings page is the reference: every setting carries its own description, its default and its range in the panel itself, which is the copy that cannot go stale.

Starting It

From the archive root:

server/linux/webserver -http :8080

Then open http://localhost:8080. On Windows it is server\windows\webserver.exe with the same flag.

-http serves plain HTTP on the port you name and turns off TLS. That is the right mode for local testing, and also for a real deployment where something else terminates TLS in front of it.

Certificates

With no -http flag and a real hostname configured, the panel obtains and renews its own certificate from Let’s Encrypt, serves HTTPS on 443, and redirects 80. There is no certificate tool to install and nothing to renew by hand.

Set the hostname in settings.cfg. TLS_DOMAIN is the one the certificate is requested for, and COOKIE_DOMAIN is used if you leave it empty:

[webserver]
TLS_DOMAIN      your-server.example.com
COOKIE_DOMAIN   your-server.example.com

There is no half-working state here, so read this before you start it without -http. It decides once, at start, on the hostname alone. If it looks like a real public name, it commits to Let’s Encrypt: HTTPS on 443, and port 80 answering the certificate challenge and redirecting everything else. If the hostname does not resolve to the machine, or ports 80 and 443 do not reach it, the certificate never arrives and the site stays unreachable. It does not fall back to plain HTTP. Use -http until both of those are true, then take it off.

The names it does not treat as public are the ones it cannot get a certificate for anyway: empty, localhost, anything with no dot in it, and a bare IP address. Those start plain HTTP on port 80 with no TLS at all.

One thing to check before the first start. The shipped settings.cfg carries a COOKIE_DOMAIN pointing at one of our own hosts, because that is the file our servers run from. Left as it is, and started without -http, your site asks Let’s Encrypt for a certificate for a domain you do not own, which will not be issued. Set it to your own hostname, or clear it.

Behind a Reverse Proxy

If you already run nginx, Caddy or similar, use -http on a loopback port and proxy to it. Pass X-Forwarded-Proto through: the panel reads it to decide whether to mark session cookies secure, and without it a player behind your proxy is issued a cookie that the browser will send over plain HTTP.

How It Knows the Game Is Up

It does not guess from the database, and it does not merely report that it is itself running. The game server exposes a small status channel on a loopback address, and the panel polls it about once a second. If the game server stops, the site says so within a few seconds, and it says why.

That channel is bound to 127.0.0.1 and nothing else. It publishes no credentials, but it does publish player counts, and a mistyped address in a config file cannot expose it.

News, and Where Release Notes Live

News articles are stored in your game database and written from Admin -> News, in markdown, with categories you control. They belong to your server: they come back with a database restore, they do not leak between two installs sharing a machine, and publishing one is a button rather than a file copied onto a box you may only have a web login to.

The panel deliberately does not carry the software’s release notes. Those describe the build rather than your server, every operator running that build shares them, and a copy per server is a copy per server to keep true. Ours are on this site, under changelog. To point your players at them, set the release notes address in Site Settings. To write about changes that are yours alone, file them under a news category of your own.

It Also Serves Client Updates

The panel is what pushes client changes to your players. It serves the client/ directory at /downloads/client/ and its index at /downloads/client/manifest.txt, and each player’s launcher fetches whatever differs from what they already have.

The consequence worth knowing here is the one-liner: no website, no client updates. Everything else about it, including how to rebuild the index and how to drive the updater from the command line, is on Client updater.