Operations

The commands, status fields, alerting, and recovery paths an operator needs.

Operate the edge from the proxy console. The command aliases are /leviathan,/lev, and /antibot. The permission isleviathan.admin; the console always has it.

Commands

Command	Use
/leviathan status	Distribution edition, attack state, cps, peak, trusted/pending, blacklist, tracked IPs, anti-VPN cache.
/leviathan reload	Re-read leviathan.yml without restarting. AbyssLink TLS/listener changes still require restart.
/leviathan blacklist add <ip>	Manual entry; persisted when blacklist.persist is true.
/leviathan blacklist remove <ip>	Remove a manual or automatic entry.
/leviathan whitelist ip <ip>	Skip all checks for an address.
/leviathan whitelist name <name>	Skip all checks for a username.
/leviathan whitelist remove <value>	Remove an IP or name from the whitelist.
/leviathan clearblacklist	Wipe manual and automatic entries. Use after an attack if legitimate players remain caught.

Status line

Values below are an example of the shape, not a live feed.

example output · values illustrative

> leviathan status
Edition: Premium
under-attack: false
cps: 4
peak: 38
trusted: 41
pending: 0
blacklist size: 12
tracked IPs: 63
anti-vpn cache: 0

Field	Meaning
Edition	Free Trial or Premium distribution. A Premium label does not by itself prove entitlement validation.
under-attack	Whether the detector has hardened the proxy.
cps / peak	Current and highest new connections per second since start.
trusted	IPs that passed verification inside the trust duration.
pending	IPs challenged and waiting to reconnect. A large value during a flood is the challenge working.
blacklist size	Unexpired manual and automatic entries.
tracked IPs	Sources with live throttle/name-flood/reputation state.
anti-vpn cache	Cached online lookup verdicts; disabled/0 when the online filter is off.

Recovery

Player wrongly blocked: /leviathan blacklist remove <ip>, then whitelist the IP or name only if it is genuinely trusted.
Attack over, stale entries: /leviathan clearblacklist. Keep the config; do not disable the gate permanently.
Attack mode flapping: raise attack.trigger-cps above your real peak, or raise cooldown-seconds.
Bots passing: check whether trusted climbs with cps, then tighten name windows, reputation, or ASN policy.
Proxy won’t start: read the startup log. A Premium entitlement failure is fail-open; a malformed config or missing Java is not.

Tuning

Start with the defaults on a calm server. Use peak to set the attack trigger with margin. Then test a reconnect challenge with a real player before enabling extra paid lookups. There is no universal setting for a large network behind TCPShield; the trusted-proxy ingress mode has its own forwarding contract.

Do not tune during an incidentChange one boundary at a time. A new threshold, a new GeoIP database, and a new plugin deployment in the same window is not a controlled test.

GeoIP + webhooks

Place operator-supplied MaxMind databases beside the proxy and point the config at them. The shaded GeoIP2 library is not the data. For Discord alerts, use an HTTPS webhook and keep start/end alerts on; per-connection logging during a flood is noise.

If an online reputation provider is down, the async path drops the lookup; it does not block the event loop. The offline country/ASN policy remains usable.

Fail-open

A license server outage is not a proxy outage. Premium validation warns and keeps the core gate active. AbyssLink control sessions close when entitlement is lost, while normal gameplay processing keeps its existing policy. Read the security modelfor the boundary of the claim.