Configuration
The settings that decide what Leviathan sees, what it refuses, and when it hardens.
The configuration is leviathan.yml beside the proxy jar. Runtime data lives in ./leviathan/. This is proxy-level configuration, not a plugin folder. Public defaults below are the shipped defaults; tune against your own join rate.
The file
Start from the file written on first boot and keep a copy before editing. The operator command /leviathan reload re-reads it; AbyssLink keys are restart-required and do not rebind on reload.
Throttle
Per-IP and global rate limits run on the socket and handshake, before a username exists.
| throttle.max-connections-per-ip | 3 per 2000 ms (window-ms) |
| throttle.max-connections-per-24 | Optional IPv4 /24 cap; 0 disables |
| throttle.max-logins-per-second | 80 proxy-wide |
| throttle.reject-malformed-handshake | true |
| throttle.max-hostname-length | 255 |
Verify + FrameGuard
Fresh IPs must return after a reconnect challenge. FrameGuard only exists during handshake/login and detaches once the connection is verified.
| verify.reconnect-challenge | true |
| verify.reconnect-window-ms | 30000 |
| verify.trust-duration-ms | 3600000 (one hour) |
| verify.max-names-per-ip | 4 per 60000 ms |
| verify.keepalive-check | true |
| packet-guard.max-packets-per-second | 40 |
| packet-guard.max-login-bytes | 8192 |
| packet-guard.login-deadline-ms | 10000 |
| packet-guard.max-packets-per-tick | 8 per 50 ms tick |
| packet-guard.max-frame-bytes | 2097152 |
Socket fingerprint
An optional Linux epoll check on negotiated MSS. It is a no-op on unsupported hosts and never fails a connection it cannot inspect.
| fingerprint.enabled | false |
| fingerprint.only-during-attack | true |
| fingerprint.min-mss | 500 |
| fingerprint.max-mss | 1500 |
GeoIP / ASN / VPN
Offline country/ASN blocks use operator-supplied MaxMind databases. Online reputation lookups are optional, asynchronous, HTTPS-only, and cached.
| anti-vpn.enabled | false (online lookups) |
| anti-vpn.only-during-attack | true |
| anti-vpn.cache-ttl-ms | 86400000 |
| anti-vpn.provider | proxycheck or iphub |
| geoip-country-db / geoip-asn-db | Operator-supplied .mmdb paths |
| blocked-countries / blocked-asns | Empty by default |
The GeoIP2 library is shaded; the .mmdb data is not bundled. Missing databases skip that check.
Blacklist + reputation
Automatic blacklist entries expire. Reputation catches slow bots that stay under each individual window; scores decay over time.
| blacklist.auto-blacklist-threshold | 6 failures per 60000 ms |
| blacklist.auto-duration-ms | 1800000 (30 minutes) |
| blacklist.persist | true |
| reputation.blacklist-threshold | 100 points |
| reputation.decay-per-minute | 5 points |
| reputation.persist | true |
Attack + webhook
Crossing the trigger hardens verification and can enable paid lookups. The webhook is async and fires on start/end, never on every blocked connection.
| attack.trigger-cps | 60 new connections/second |
| attack.cooldown-seconds | 20 |
| attack.harden-on-attack | true |
| webhook.enabled | false |
| webhook.url | HTTPS Discord-compatible endpoint |
| webhook.on-attack-start / end | true / true |
Set trigger-cps above your real restart-stampede peak. A trigger that is too low makes normal joins look like an attack; a trigger that is too high delays the hardened mode.
Metrics
When enabled, the Prometheus endpoint exposes fixed-cardinality counters and gauges. It has no authentication, so bind it to loopback or a private interface; never expose it directly to the public internet.
AbyssLink
The Premium-only control plane is disabled by default, requires verified entitlement, and is restart-required. It belongs on a private bind and is never a public HTTP mutation endpoint. See AbyssLink for the full boundary.
Read the operations manual →