chore: Configure Renovate

README.md

@@ -1,3 +1,12 @@
+# ABOMINATION VELOCITY FOR 6b6t
+
+After installing check `abomination_velocity.yml`.
+To reload a command whitelist do `abomination:reload` in the console (not as a player).
+
+
+
+
+
 # Velocity
 
 [![Build Status](https://img.shields.io/github/actions/workflow/status/PaperMC/Velocity/gradle.yml)](https://papermc.io/downloads/velocity)

VELOCITY_HARDEN_PLAN.md

@@ -0,0 +1,74 @@
+# Velocity Hardening Plan
+
+Goal: Make authentication and networking resilient to abusive spikes and remote auth/server flakiness, preventing Netty I/O starvation and cascading disconnects.
+
+Status
+- Fixed: Decoupled JDK HttpClient from Netty event loops (commit 82e4451a). This removes a starvation vector under load.
+
+Phase 1 — Short-Term (Low risk, high impact)
+- Shared HttpClient: Reuse a singleton `HttpClient` across requests instead of per-login creation. Stop closing per-request clients in `InitialLoginSessionHandler`.
+  - Builder: `.connectTimeout(5s)`, `.version(HTTP_1_1)` (Mojang supports 1.1), dedicated executor (see below).
+- Dedicated HTTP executor: Create a bounded `ThreadPoolExecutor` for auth/HTTP with named threads (not Netty event loops, not commonPool).
+  - Example: core=max(4, 2xCPU), max=32, queue=1024, `CallerRunsPolicy` to shed under extreme load.
+  - Shutdown executor on proxy shutdown.
+- Per-request timeouts: Set `HttpRequest.Builder.timeout(5s)` and wrap `CompletableFuture` with an overall guard (e.g., 6–8s) to ensure completion.
+- Cancellation on disconnect: Store auth future on the connection and `cancel(true)` if the player disconnects; short-circuit continuations when `mcConnection.isClosed()`.
+- Concurrency bulkhead: Limit max in-flight auth requests via `Semaphore` (configurable, default 256). Deny fast with user-friendly message if saturated to avoid pile-ups.
+- Gentle retry with jitter: For transient I/O (connect timeout, EOF), retry up to 1–2 times with exponential backoff (total <1.5s additional) — no retry on 4xx/5xx.
+- Observability: Log auth latency buckets, error categorization, and bulkhead saturation; expose counters/gauges for dashboards.
+
+Phase 2 — Resilience and Backpressure
+- Small positive cache: Optional, short-lived (e.g., 30s) positive cache of hasJoined results keyed by `(username, serverId, ip)` to smooth retries if the response is reused in a tight window. Guard correctness and disable by default.
+- Circuit breaker: If remote auth failure rate > X% over Y seconds, open breaker for a brief window (e.g., 10–30s) to fast-fail with a clear message instead of overwhelming threads with doomed requests.
+- Backpressure in login pipeline: When bulkhead is full or breaker is open, fail fast instead of queueing work on event loops.
+
+Phase 3 — Threading Hygiene and Plugin Safety
+- Event loop watchdog: Log a WARN stack sample if any Netty worker task runs > 200ms to surface blocking code.
+- Offload heavy work: Ensure CPU/IO heavy tasks (JSON parsing, crypto beyond current usage) run off event loops.
+- Plugin guidance: Provide helper executors and short docs for plugin authors; detect common patterns of performing blocking I/O on event loops and log advisories.
+
+Phase 4 — Netty and Queue Robustness
+- Chat/command queue guardrails: When backend connection drops, drop or buffer with small TTL instead of throwing `IllegalStateException` and spamming logs.
+- Tune Idle/keepalive: Review `IdleStateHandler` and timeouts to reduce noisy disconnect storms while keeping detection snappy.
+
+Configuration (new/updated)
+- `http.maxAuthConcurrency` (int, default 256): Max concurrent hasJoined requests.
+- `http.connectTimeoutMs` (int, default 5000) and `http.requestTimeoutMs` (int, default 5000–8000).
+- `http.maxQueue` (int, default 1024): Queue size for the HTTP executor.
+- `auth.retry.count` (0–2, default 1) and `auth.retry.initialBackoffMs` (100–200ms).
+- `auth.circuitBreaker.enabled` (bool), `failureThresholdPct` (e.g., 50), `windowSeconds` (e.g., 20), `openSeconds` (e.g., 15).
+- `loginRatelimit` (already exists): Revisit defaults and document guidance for public servers.
+
+Code Changes (high level)
+- `VelocityServer`:
+  - Hold a singleton `HttpClient` and a dedicated `ExecutorService` for HTTP.
+  - Expose `getHttpClient()` and `shutdownHttpExecutor()`; wire shutdown in server stop.
+- `InitialLoginSessionHandler`:
+  - Use shared client; remove per-request `AutoCloseable` close.
+  - Apply per-request timeout; capture and cancel future on disconnect.
+  - Add concurrency bulkhead and lightweight retry with jitter.
+  - Optional: consult short-lived positive cache.
+- `ConnectionManager`:
+  - No longer responsible for per-request client creation; keep networking concerns isolated from HTTP.
+- `VelocityConfiguration`:
+  - Add new config options and validation with sane bounds.
+
+Observability
+- Metrics: counters for auth attempts, successes, failures (by category), retries, timeouts, breaker state. Histogram for auth latency.
+- Logs: Single-line structured entries on failures including username (hashed), IP (redacted), durations, and error type.
+
+Validation Plan
+- Load test: Simulate 500–1000 concurrent login attempts; verify stable Netty I/O and bounded auth concurrency.
+- Chaos: Inject 50% auth connect timeouts and 5xx responses; verify retries limited, breaker engages, and the proxy remains responsive.
+- Regression: Ensure normal login latency remains low; verify no resource leaks on shutdown.
+
+Rollout and Risk
+- Gate new behaviors behind config flags; defaults conservative.
+- Staged rollout: enable shared client + timeouts first; then bulkhead; then (optionally) caching and breaker.
+- Rollback: Config toggles to disable each feature independently.
+
+Success Criteria
+- No Netty starvation under auth spikes; no mass disconnects related to auth HTTP overload.
+- Auth error spikes do not degrade unrelated proxy networking.
+- Clear, actionable telemetry for operators when Mojang services degrade.
+

abomination_velocity.yml

@@ -0,0 +1,95 @@
+# Abomination Velocity configuration
+
+packet-captures:
+  enabled: false
+
+# Plugin message channels players are allowed to send
+plugin-channels:
+  - minecraft:brand
+  - minecraft:register
+  - minecraft:unregister
+
+# Commands players are allowed to execute
+commands:
+  - register
+  - reg
+  - unregister
+  - login
+  - l
+  - email
+  - changepassword
+  - confirmpassword
+  - totp
+  - captcha
+  - 2fa
+  - verification
+  - help
+  - echochamber
+  - msg
+  - whisper
+  - w
+  - reply
+  - last
+  - kill
+  - suicide
+  - stats
+  - r
+  - ignore
+  - ignorehard
+  - ignorelist
+  - togglewhispering
+  - togglechat
+  - groupchat
+  - gc
+  - connectionmsgs
+  - deathmsgs
+  - sethome
+  - home
+  - homes
+  - homelist
+  - delhome
+  - tpa
+  - tpt
+  - tpn
+  - tpy
+  - tpyes
+  - tpno
+  - tps
+  - tptoggle
+  - hat
+  - skin
+  - hotspot
+  - buildermode
+  - particles
+  - nametag
+  - pvpmode
+  - togglespamchat
+  - freecam
+  - f
+  - vote
+  - discord
+  - website
+  - youtube
+  - twitter
+  - reddit
+  - instagram
+  - donate
+  - buy
+  - shop
+  - skins
+  - summon
+  - give
+  - chatcolor
+  - christmas
+  - balloons
+  - balloon
+  - sit
+  - link
+  - namecolor
+  - namecolors
+  - nc
+  - chatcolors
+  - cc
+  - invisframe
+  - thor
+  - playerstats

build.gradle.kts

@@ -1,14 +1,19 @@
 plugins {
+    base
     `java-library`
     id("velocity-checkstyle") apply false
     id("velocity-spotless") apply false
 }
 
+tasks.named<UpdateDaemonJvm>("updateDaemonJvm") {
+    languageVersion = JavaLanguageVersion.of(25)
+}
+
 subprojects {
     apply<JavaLibraryPlugin>()
 
-    apply(plugin = "velocity-checkstyle")
-    apply(plugin = "velocity-spotless")
+//    apply(plugin = "velocity-checkstyle")
+//    apply(plugin = "velocity-spotless")
 
     java {
         toolchain {

gradle/gradle-daemon-jvm.properties

@@ -0,0 +1,12 @@
+#This file is generated by updateDaemonJvm
+toolchainUrl.FREE_BSD.AARCH64=https\://api.foojay.io/disco/v3.0/ids/c5ee947fbfb70bc347d8d531e3a578c4/redirect
+toolchainUrl.FREE_BSD.X86_64=https\://api.foojay.io/disco/v3.0/ids/cd495626d2ee49a75447e3fdc6afb287/redirect
+toolchainUrl.LINUX.AARCH64=https\://api.foojay.io/disco/v3.0/ids/c5ee947fbfb70bc347d8d531e3a578c4/redirect
+toolchainUrl.LINUX.X86_64=https\://api.foojay.io/disco/v3.0/ids/cd495626d2ee49a75447e3fdc6afb287/redirect
+toolchainUrl.MAC_OS.AARCH64=https\://api.foojay.io/disco/v3.0/ids/f2eb759b13be68e51cbe892c2e95efbe/redirect
+toolchainUrl.MAC_OS.X86_64=https\://api.foojay.io/disco/v3.0/ids/59a9771cad43219260d9aac9a8ec4d6a/redirect
+toolchainUrl.UNIX.AARCH64=https\://api.foojay.io/disco/v3.0/ids/c5ee947fbfb70bc347d8d531e3a578c4/redirect
+toolchainUrl.UNIX.X86_64=https\://api.foojay.io/disco/v3.0/ids/cd495626d2ee49a75447e3fdc6afb287/redirect
+toolchainUrl.WINDOWS.AARCH64=https\://api.foojay.io/disco/v3.0/ids/a4c09dd2e2d7079373d30e524bbc2829/redirect
+toolchainUrl.WINDOWS.X86_64=https\://api.foojay.io/disco/v3.0/ids/303c95a051768711e2ec6e0c82bc7dbb/redirect
+toolchainVersion=25

proxy/build.gradle.kts

@@ -151,6 +151,7 @@ dependencies {
     implementation(libs.netty.transport.native.kqueue)
     implementation(variantOf(libs.netty.transport.native.kqueue) { classifier("osx-x86_64") })
     implementation(variantOf(libs.netty.transport.native.kqueue) { classifier("osx-aarch_64") })
+    implementation("com.github.luben:zstd-jni:1.5.5-5")
 
     implementation(libs.jopt)
     implementation(libs.terminalconsoleappender)
@@ -162,6 +163,7 @@ dependencies {
     implementation(libs.adventure.facet)
     implementation(libs.completablefutures)
     implementation(libs.nightconfig)
+    implementation(libs.snakeyaml)
     implementation(libs.bstats)
     implementation(libs.lmbda)
     implementation(libs.asm)