AbyssLink

A backend-initiated control plane for heartbeats, proxy ping, health, and advisory threat signals. Premium only, disabled by default.

AbyssLink is a separate native listener in the proxy. It never installs handlers in the gameplay pipeline. Forwarding, ConnectionGate, FrameGuard, verification, throttling, and reputation remain the security path.

What it is

A backend initiates a mutually authenticated TLS session to a private proxy listener. The negotiated session carries heartbeats, UUID-based native ping lookups, health reports, and advisory threat signals. The listener is disabled by default and bound to a private numeric address.

Direction	Backend-initiated; proxy accepts, never dials backends
Transport	TLS 1.2/1.3 with client certificate and pinned backend leaf
Capabilities	heartbeat (required), ping, health, threat
Admission	16 connections, 32 outstanding requests, 100 frames/s, 3 s deadline
Metrics	Fixed-cardinality leviathan_abysslink_* counters; no player/IP/node labels
Status	/leviathan status shows authenticated backend count and up to four nodes

Entitlement gate

Only a Premium distribution with a valid Premium entitlement can start the listener. The entitlement is checked at startup, accept, and per message. Loss of entitlement disconnects AbyssLink control sessions; ordinary gameplay policy continues.

Free Trial cannot activate itEnabling the YAML block in a Free Trial build does not create a control plane. The edition and entitlement gate still refuse it. Do not treat the YAML flag as a license.

Configuration

leviathan.yml · AbyssLink

abysslink:
  enabled: false
  bind-host: '127.0.0.1'
  port: 25580
  plaintext-development: false
  tls-certificate: leviathan/abysslink/proxy.pem
  tls-private-key: leviathan/abysslink/proxy-key.pem
  tls-trust-certificate: leviathan/abysslink/ca.pem
  trusted-identities:
    backend-01: '<64 lowercase hex: SHA-256 of backend DER leaf>'
  heartbeat-interval-ms: 5000
  idle-timeout-ms: 20000
  maximum-connections: 16
  maximum-outstanding-requests: 32
  request-timeout-ms: 3000
  requests-per-second: 100
  telemetry-enabled: true

Paths resolve relative to the proxy working directory. Keep the private key readable only by the proxy account. trusted-identities must be nonempty when enabled and contains at most 1,024 node entries. Plaintext development is loopback-only and must not be reused for a remote peer.

All AbyssLink keys are restart-required. A normal configuration reload does not rebind the listener, rotate TLS material, or change an active session policy.

Limits

v1 has no remote administration, transfer command, player blacklist action, or gameplay packet compression.
Health values default to zero before the first report; an unreported default is not a health measurement.
Control RTT is backend-to-proxy control transport, not a player’s gameplay latency.
No per-node, per-player, per-IP, or per-certificate metric labels are exported.
The listener is not a public HTTP endpoint. Bind it privately and firewall it to approved backends.

Evidence

Local codec/session/mTLS suites and both native fork builds pass. Real-peer mTLS interoperability with the SourbyCraft client passes 16/16 checks. A live cross-fork gameplay ping through a production proxy is not demonstrated, and no external penetration test or live security qualification is claimed.

This is a deliberately narrow v1. The control plane is useful for fleet heartbeat and native ping; it is not a promise of remote game administration.

Back to Premium licensing · Read the product page