v0.90.0 Say Who You Are

A relay can present a real certificate and pick up its renewal without ending a lobby, a dedicated server keeps its lobby code across a restart, a box reports which version it runs, a game key stays out of every world-readable file, and a server bundle says when it was made and what you called it. Nothing here changes how you write a game; it is the release in which the things you run say what they are.

A relay presents a certificate you gave it

floptle-relay --tls-cert fullchain.pem --tls-key privkey.pem presents the chain in those files instead of minting a self-signed one at startup. PEM, as certbot writes them; half a pair is refused at startup, and a pair that will not load is a relay that does not come up, never one that quietly came up self-signed instead.

A renewal ends no lobby. The relay watches both files; a renewal written to the same paths — which is what certbot does — is presented to new connections within ten seconds, and every connection already up keeps the certificate it agreed. A renewal that will not load (a torn file, a key for a different certificate) is said once on the relay's log and the previous certificate stays. There is no restart to schedule and nothing for a deploy hook to signal.

floptle-relay-bench --verify is how you check it from outside, with the same handshake a player's build runs: it prints the SHA-256 fingerprint of the leaf the relay actually presents, in openssl's spelling, and whether the chain verifies for the relay's name against the public roots. openssl s_client cannot do this — it speaks TCP, and a relay answers QUIC on UDP.

A dedicated server keeps its lobby code across a restart

A server that restarts onto a new build and asks the relay for the code its players already know was granted it — and, in the same second, the relay ended the lobby for having had nobody in it for half an hour. The restored lobby had inherited the old process's idle clock, and a server that sits empty waiting for players is exactly what a dedicated server is for. The server then went on advertising six characters that answered nothing, with no error anywhere.

A reclaimed lobby now starts a fresh idle window at the reclaim, whether its host is a dedicated server or a player whose connection blipped. A dedicated server's lobby is never reaped for idleness; a player's reclaimed lobby gets the same window a new one gets.

A box says which version it runs

The fleet agent and the managed relay each report their own version on the reports they already send — the version compiled into the binary, never read from a file or a unit, so an upgrade cannot leave a row saying the old number. The two are different binaries on different machines and are kept apart.

The agent also forwards which key a running server was started with — the first twelve characters, never the key — so a developer mid-rotation can see what the process that is running presented.

A game key stays out of every world-readable file

A dedicated server's unit file is world-readable, as unit files are, and it carried the whole game key. On a box that runs more than one developer's server, that was somebody else's credential at rest for anyone to read.

The key now lives in a file of its own under --keys (default /etc/floptle/keys), one 0600 root-only file per deployment that the unit names with EnvironmentFile=; the unit itself carries no secret. A rotated key changes that file and not the unit, and the agent restarts the server for it all the same. A deployment that is removed takes its key file with it.

A server bundle says when it was made and what you called it

floptle export … server writes exported_at into the bundle's manifest, and --label "lobby v3" writes a label. The control plane knows when the bytes arrived; it could not know when the build was made, and a bundle exported on Tuesday and uploaded on Friday read as Friday's work — which is how somebody deploys a build they thought they had replaced. The label is what you call the build, shown beside its checksum and never instead of it. Bundles exported before this carry neither and work as they did.

A usage report says where a key's lobbies are hosted from

Each per-key sample a managed relay reports now lists the addresses its live lobbies are hosted from and how many at each. It is the number behind "is my key being used by someone who is not me" — and the first thing the control plane does with it is count and show, not refuse: a CI runner, a LAN party and a whole ISP behind one address all look like "many lobbies from one address" and are honest.

Upgrading

If you run a relay, nothing changes until you pass --tls-cert and --tls-key. If you run a fleet agent, its first reconcile on the new version writes each server's key file and rewrites each unit to read it, which restarts every dedicated server on the box once — pick the moment. If you export server bundles, --label is optional. Nothing else needs a change.