No description
  • Python 65.1%
  • C# 17.2%
  • Shell 15.3%
  • Dockerfile 2.4%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
epistemophiliac bc65e34f72 Retarget patch for AppData installs after official VS updates
Official updater drops 1.22.x into Proton %AppData%\Vintagestory; patch both
that tree and any Steam common copy, and document re-run after updates.

Co-authored-by: Cursor <[email protected]>
2026-07-13 05:06:19 -04:00
app Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00
keys Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00
PatchTool Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00
scripts Retarget patch for AppData installs after official VS updates 2026-07-13 05:06:19 -04:00
.gitignore Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00
docker-compose.yml Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00
Dockerfile Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00
README.md Retarget patch for AppData installs after official VS updates 2026-07-13 05:06:19 -04:00
requirements.txt Add Vintage Story auth3-compatible backend and Lib patch 2026-07-13 04:49:40 -04:00

Vintage Story Auth Backend

Self-hosted auth3-compatible API for Vintage Story, deployed at https://vintagestory.aexoradao.com.

Why not patch VintagestoryServer.exe?

Ghidra shows both Vintagestory.exe and VintagestoryServer.exe are .NET apphost stubs (hostfxr → managed DLL). All auth HTTP calls live in VintagestoryLib.dll, which both client and dedicated server load. The patch script restores stock Lib (undoes Kirigiri offline login) and retargets URLs + session RSA pubkey there.

Coolify

  1. Create a Docker Compose resource from this repo.
  2. Assign domain vintagestory.aexoradao.com to service vs-backend, port 8000.
  3. Deploy. Health: GET /health.

Env (optional seeds):

Var Default
SEED_ADMIN_EMAIL admin@local
SEED_ADMIN_PASSWORD admin
SEED_ADMIN_NAME Admin
SEED_PLAYER_EMAIL player@local
SEED_PLAYER_PASSWORD password
SEED_PLAYER_NAME VSPlayer

Implemented endpoints

Method Path Role
POST /v2/gamelogin Account login
POST /gamelogout Logout
POST /clientvalidate Session check
POST /v2.1/clientrequestmptoken One-shot MP token
POST /v2/servervalidate Server join verify
POST /resolveplayername name → uid
POST /resolveplayeruid uid → name
POST /v2/gameserverctrl Hosted-server ctrl stub
POST /api/v1/servers/register Master list register
POST /api/v1/servers/heartbeat Master list heartbeat

Session keys are RSA-SHA256 PKCS1 signed with keys/session_private.pem. The matching public XML is baked into the patched Lib.

Patch the game

./scripts/patch-vs-to-aexoradao.sh

After an official in-game update, VS lives under Proton %AppData%\Vintagestory (not only Steam common/). The script patches that AppData tree (and the Steam copy if separate), saves stock as VintagestoryLib_o.dll, then retargets auth + session RSA pubkey. Re-run after every game update.

Dedicated servers: set "VerifyPlayerAuth": true in serverconfig.json so joins call /v2/servervalidate.

Local smoke

export DATA_DIR=/tmp/vs-auth-data
export SESSION_PRIVATE_KEY_PATH=$PWD/keys/session_private.pem
uvicorn app.main:app --host 127.0.0.1 --port 8099
curl -sf http://127.0.0.1:8099/health