Hosting a server

One server distribution for Windows x64 and Linux x64, with JavaScript (Node.js) and C# (.NET) runtimes bundled.

Get the server files

Each release publishes nextmp-server-windows-x64-<version>.zip and nextmp-server-linux-x64-<version>.tar.gz. Both contain the server, conf.json, the folders packages/, client_packages/, plugins/ and game_resources/, the SDK, examples and tools. There is no automatic server updater: you choose when to update.

Configure

conf.json has nine common fields; everything else has safe defaults.

{
  "name": "My Server",
  "gamemode": "freeroam",
  "language": "en",
  "bind": "0.0.0.0",
  "port": 22005,
  "maxplayers": 128,
  "announce": false,
  "stream-distance": 500,
  "voice": false
}

announce: true lists the server on the official public list. Off means private: players join by address.
voice: true enables encrypted voice; your scripts decide who hears whom.
Check a file without starting the server: node tools/nextmp.cjs config validate.

Ports

Port	Protocol	Purpose
22005 (`port`)	UDP	The game. Large player limits use a range starting here; the server prints the exact range to open.
22006 (`http-port`)	TCP	Delivery of client scripts and assets to players.
`admin-port` (off)	TCP, loopback	Optional admin, metrics and health service for your own tools. Never expose it publicly.

Port checkers usually test only TCP. The server log line Connection from … accepted confirms that the game port is reachable.

Run

# Windows
nextmp-server.exe --config conf.json

# Linux (a systemd unit is in examples/nextmp-server.service)
./nextmp-server --config conf.json

On the first start the server creates its identity key. Players' launchers pin it per address; keep the identity files when you move the server, or players see a key mismatch.

Appear on the public list

With announce on, the server registers over HTTPS with certificate checks. The list then asks the server's game port to prove it belongs to the announcer, so the UDP port must be reachable from the internet. Withdrawal happens on a clean stop; a vanished server expires from the list by itself.

Security options

security-require-integrity removes clients whose integrity report is not valid. Off by default: reports are collected and shown.
security-device-identity asks clients to prove a device key (on by default). Resources read player.deviceId and player.deviceStatus.
Connection rate limits, temporary blocks and remote-call abuse counting are on by default and reloadable.

None of these is anti-cheat. Gameplay rules — speed, damage, money — belong to your game mode.

Operate

Enable the loopback admin service to start, stop and reload packages, inspect players, trace events and read Prometheus metrics with node tools/admin.cjs. Many settings, including every security setting, reload without a restart: node tools/admin.cjs config-reload.