# Better-WebConsole Secure browser console and admin dashboard for Paper/Purpur/Spigot 1.21.x servers.

## Features ### Web Console - Embedded Jetty web server with one built-in web UI. - Live console log streaming over WebSocket with buffered history for new sessions. - Console command execution through the server command map, including commands from plugins such as CMI. - Command history, filtering, log export and clear action in the browser. - Configurable web aliases through `!alias`, including chained aliases with `&&`. - Audit log for auth events, command execution, player actions and log exports. ### Dashboard - Desktop-focused two-column dashboard layout for server administration. - Server health: TPS, JVM heap, online players, worlds, loaded chunks, entities and session errors. - Machine health: host CPU load, Java process CPU load, physical RAM, server disk usage and JVM thread counts. - Performance history charts for TPS, JVM RAM, online players and host CPU. - Machine details: CPU model, cores/threads, memory, disk mount, OS, Java runtime, PID and JVM uptime. - Analytics blocks for log levels, per-world chunks/entities and recent activity. - Player list with quick kick/ban actions. ### Security - Web users stored in `plugins/Better-WebConsole/users.dat` with BCrypt hashes. - HttpOnly + SameSite session cookies, optional Secure cookies for HTTPS reverse proxies. - CSRF protection for login. - IP whitelist with CIDR support. - Login lockout and command rate limit. - Optional command block list for dangerous console commands. ## First Setup 1. Put the JAR into the server `plugins/` folder. 2. Start the server once to generate `plugins/Better-WebConsole/config.yml`. 3. Create a web user: ```text /bwc adduser admin YourStrongPassword123 ``` 4. Open: ```text http://your-server-ip:4242 ``` Production recommendation: bind to `127.0.0.1` and expose the panel through Nginx, Caddy, a VPN or a tunnel with HTTPS. ## Commands Main command aliases: `/betterwebconsole`, `/bwc`, `/webconsole`, `/bwconsole`, `/betterconsole`. Permission: `betterwebconsole.admin` (default: op). | Command | Description | | --- | --- | | `/bwc status` | Show web server, user, session and config status | | `/bwc reload` | Reload config values that do not require web server restart | | `/bwc adduser ` | Add a web user | | `/bwc removeuser ` | Remove a web user and invalidate sessions | | `/bwc listusers` | List web users | | `/bwc setpassword

` | Change password and invalidate sessions | | `/bwc logoutall ` | Invalidate active sessions for a user | Extra command aliases: `useradd`, `createuser`, `deluser`, `deleteuser`, `users`, `passwd`, `password`, `killsessions`. ## Configuration The default config is intentionally small and only contains implemented behavior. ```yaml web: port: 4242 bind-address: "0.0.0.0" log-buffer-size: 1000 security: session-timeout-minutes: 60 max-login-attempts: 5 lockout-duration-minutes: 15 command-rate-limit-per-minute: 30 ip-whitelist: [] secure-cookies: false logging: log-commands: true log-auth: true audit-log: true system-stats: # Adds host CPU, machine RAM, disk, OS and JVM details to the dashboard. enabled: true # OS-level polling interval. Keep this above 2 seconds for production servers. update-interval-seconds: 5 # Reports disk usage for the Minecraft server folder. show-disk: true commands: blocked: [] aliases: tps: "tps" list: "list" save: "save-all" day: "time set day" night: "time set night" clear-weather: "weather clear" ``` `system-stats` can be disabled if the host does not allow OS-level metrics or if you only need Minecraft/JVM data. Use `commands.blocked` to prevent risky commands from web access, for example: ```yaml commands: blocked: ["stop", "restart", "op", "deop"] ``` Use an alias by typing `!name` in the web console. Aliases can chain up to 10 commands with `&&`. `/bwc reload` updates aliases, logging, system stats settings and command block rules. Restart the Minecraft server after changing `web.port`, `web.bind-address`, `security.ip-whitelist`, session timeout or rate-limit settings. ## Security Notes - Do not expose `0.0.0.0:4242` directly to the internet unless firewall/IP whitelist/VPN rules are in place. - Set `secure-cookies: true` only when users access the panel through HTTPS. - Block or avoid destructive commands such as `stop`, `restart`, `op`, `deop`, `ban-ip` and `whitelist`. - Keep aliases short and auditable. - Keep `commands.blocked` empty only when every web user is trusted as a full console administrator. - Treat machine metrics as operational data: expose the panel only to trusted administrators.

AREKKUZZERA