NotABackdoor

NotABackdoor puts a practical server panel inside your Paper server. It is useful when your host's panel makes basic jobs harder than they need to be: checking what Paper actually logged, changing a config file, running a command, or taking a backup before an update.

The overview shows process CPU, TPS, milliseconds per tick, Java heap use, and online players. You can follow the last 60 seconds live or look back from one minute to one week. Minute-level history survives restarts. The console reads Minecraft's logs/latest.log, including startup and plugin messages, and lets you run commands as the server console.

In Files, you can browse, edit, upload, move, ZIP, and extract. Select multiple files or folders to create one ZIP, download one TAR, or delete them after reviewing the selection. The editor detects changes made after you opened a file. Backups run in the background with progress through world saving, file scanning, and archiving. You can also manage operator, ban, and whitelist state by player name.

Getting started

1. Install the JAR on a verified Paper version and start the server. The tested Linux filesystem provides the secure directory handles this panel requires. The default Windows JDK filesystem provider does not, so the plugin refuses to start there.
2. On a direct online-mode=true server, an operator with notabackdoor.admin gets a private reminder and can run /nab for the inventory setup guide. It covers panel access, the first-run code, browser setup, and a connection check. Enter the password only in the browser.
3. On an offline-mode server or Velocity backend, issue the first-run code with nab setup in the server console. The in-game guide still explains the setup and shows diagnostics, but cannot issue codes or change access there. Password resets always use the console.
4. The panel starts on http://127.0.0.1:8127. With SSH access, forward it using ssh -L 8127:127.0.0.1:8127 user@your-server and open http://localhost:8127 on your computer.

Public HTTP can be enabled only after confirming the warning and supplying an exact http://host:port address. Plain HTTP exposes passwords, sessions, commands, and files to anyone who can observe network traffic. The panel grants full server authority after sign-in. Use localhost or an SSH tunnel when you need a private connection. The browser connection check proves only that the browser opening its link reached the panel.

A live backup covers the running server's process folder after Paper saves loaded worlds. Files may change during copying, and worlds stored outside that folder are excluded. For a strictly consistent full-server backup, stop Paper and use your host's snapshot or backup tool.

The packaged outbound relay remains experimental and is not part of this supported setup. See the README for setup, limits, and exact-JAR test evidence.