# Craft++ Hub

Craft++ Hub is a self hosted game directory with local Craft++ accounts and owner managed listings.

Build it with the .NET 8 SDK:

```sh
dotnet run --project CraftPlusPlus.HubSite/CraftPlusPlus.HubSite.csproj --framework net8.0
```

## Public Docker hosting

From the `codelanguage` directory, run `docker compose -f CraftPlusPlus.HubSite/compose.yaml up -d --build`. The service binds to `0.0.0.0:5000`, persists accounts and game listings in a named Docker volume, and restarts automatically. Allow inbound TCP port 5000 in the server firewall and provider firewall for direct public access at `http://SERVER_IP:5000`.

For production HTTPS, put a reverse proxy with a valid certificate in front of the service and keep port 5000 private to the proxy. The Hub rejects remote cleartext HTTP requests, so direct-IP HTTP is suitable only for a temporary reachability check; normal public sign-in and registration require HTTPS. Keep the persisted `/data` volume when recreating the container. Set `CRAFTPLUSPLUS_OWNER_BOOTSTRAP_PASSWORD` only for first-time owner setup, then remove it.

The local data directory defaults to the current user's application data directory. Set `CRAFTPLUSPLUS_HUB_DATA` to choose a different location for the account and game JSON stores.

`Gizhy` is the reserved, protected Owner key. An existing `Gizhy` account is migrated to Owner automatically. For a new data store, set `CRAFTPLUSPLUS_OWNER_BOOTSTRAP_PASSWORD` to a password of at least 12 characters before the first start; the Hub creates the account with a PBKDF2 hash and never stores that environment value. Remove the variable after successful provisioning. The Owner and delegated administrators can open `/admin` to manage usernames, email addresses, active status, roles, and password replacements. The Owner identity cannot be renamed, disabled, demoted, or assigned to another account.

The directory supports title/description/path search, owner-defined tags, live/offline filters, and player-count/recent/name sorting. Game detail pages provide documentation and download links, live players, and `craft://` join links. Account pages support private-by-default game creation, publishing, owner editing, helper access, and deletion. Public Craft++ key profiles show only that account's visible games. Form posts require antiforgery tokens. Remote cleartext HTTP requests are rejected; remote hosting must terminate HTTPS. Loopback HTTP is allowed for local development.

Create a listing in My Hub, set its Hub password, then add this to the game's
world definition in the IDE:

```dm
world
    hub = "yourkey.mygame"
    hub_password = "your-secret-password"
```

The world path and password must match the listing. The IDE's hosted world
registers against that owner-created listing, sends heartbeats with authenticated
player keys, and marks it offline during a clean shutdown. Registration never
creates an unowned public listing, and starting a server preserves the owner's
private/public choice. Stale servers stop being playable after 90 seconds.
Live website entries show player counts/names and a certificate-pinned
`craft://` link. Pager signs in through
`/api/session`; Dream Daemon validates that opaque session through
`/api/session/validate` and assigns the canonical Hub username to the hosted
mob's `key` and `ckey` before invoking `Login()`.

On Windows, Pager remains signed in when minimized or closed to the notification
area. Use its tray menu to restore or explicitly exit. Joining from Pager reuses
the signed-in Hub identity without sending the Hub password to the game server.

The Hub serves update metadata and packages from `/updateddata/{file}`. Point
`CRAFTPLUSPLUS_UPDATE_DATA` at the flat directory containing `version.json`
and the update archives. The release script prepares this directory under
`codelanguage/artifacts/updateddata`; deploy that directory with the Hub
and its feed to make update checks available over the Hub's HTTPS endpoint.

Accounts and session keys belong to this Craft++ installation. They do not sign in to BYOND.com, prove ownership of a BYOND key, or modify a BYOND Hub entry. The site stores password hashes and game listing metadata locally.