Skip to content

Turn off spawn protection so whitelisted players can build - #13

Merged
OpenSource-For-Freedom merged 1 commit into
mainfrom
feat/spawn-protection
Aug 12, 2026
Merged

Turn off spawn protection so whitelisted players can build#13
OpenSource-For-Freedom merged 1 commit into
mainfrom
feat/spawn-protection

Conversation

@OpenSource-For-Freedom

Copy link
Copy Markdown
Owner

Whitelisted non-op players cannot place or break blocks near your house.

Cause

SPAWN_PROTECTION=16 reserves a 33x33 area around world spawn for ops only. World spawn was deliberately moved to the front of your house, so the protected bubble landed exactly where the kids build.

The failure mode is nasty because it is silent. Minecraft gives a non-op no error, no message, no sound. Blocks just refuse to place. To a child that is indistinguishable from the server being broken.

Why turning it off is the right call, not a shortcut

Spawn protection defends the spawn area of a public server against untrusted players wandering in. This server has no untrusted players:

  • whitelist enabled and enforced, so removal kicks immediately
  • online-mode=TRUE, so every player is a verified Microsoft account
  • PvP off
  • the whitelist is four known family members

So the control is guarding against a threat model this server does not have, while reliably blocking the players it is meant to serve.

Griefing also stays recoverable rather than merely prevented: PrismProtect (1.3.2, still installed) logs every block place, break and container access against the player who did it, and can roll it back. That is strictly better than a radius, because it distinguishes a child building a house from someone doing damage, which a radius cannot.

Blast radius

One value, 16 to 0. Nothing else changes.

Unchanged and re-verified locally before pushing:

PASS  online-mode enforced        PASS  read-only rootfs
PASS  whitelist enforced          PASS  caps dropped
PASS  whitelist enabled           PASS  RCON not published
PASS  PvP still off               PASS  BlueMap localhost-only
PASS  flight still refused        PASS  no name-resolved mods
PASS  gamemode still forced

docker compose config renders with SPAWN_PROTECTION: "0".

Reversible

If world spawn is ever moved somewhere public, raise it again. The comment in the file says so, so the next person does not have to rediscover why it was zero.

Drive-by comment fix

ALLOW_FLIGHT: "false" was justified in a comment by "keeps MythicalAC fly-hack check meaningful". MythicalAC was uninstalled on 2026-08-02 after it kicked a whitelisted player for opening a door, so that comment pointed at a mod that no longer exists. The setting is unchanged and still correct; only the reason is corrected, since vanilla's airborne kick is now the sole fly control.

World spawn was moved to the front of the owner's house, which put the
16-block spawn-protection bubble directly over where the kids build.
Every non-op inside it was silently refused: blocks simply do not place
and the game gives no explanation, so it reads as the server being
broken rather than as a rule.

Spawn protection exists to stop untrusted players griefing the spawn
area of a public server. This server has no untrusted players. The
whitelist is enforced, joining requires a real Microsoft account, and
PvP is off, so the population is four known family members. Griefing
also stays recoverable: PrismProtect records every block change against
the player who made it and can roll it back, which is a better control
than a radius that cannot tell a child building a house from an
attacker.

Every other safety setting is untouched: whitelist enforced, online-mode
on, PvP off, flight refused, gamemode forced.

Also correct the ALLOW_FLIGHT comment, which justified the setting by
MythicalAC's fly-hack check. That mod was uninstalled on 2026-08-02, so
vanilla's own airborne kick is now the only fly control.
@OpenSource-For-Freedom
OpenSource-For-Freedom merged commit 1e7407e into main Aug 12, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant