Your server.
Your place to hang out.

Release candidate 0.2.0-rc.3. Packages contain native Rust executables. Node.js and Docker are not required on a server host. Official downloads: https://playeraudio.net/docs/server

This release prevents role-assignment privilege escalation and bounds WebSocket connections and reconnect attempts. It retains the JWT malformed-claim validation fix from 0.2.0-rc.2 (CVE-2026-25537). Hosts running earlier releases should update.

Supported packages

• Windows x64: portable executable and PowerShell instance helper, targeting Windows 10/11 and Windows Server 2022 or later. Acceptance runs on Windows 11. No Windows service is installed. The Microsoft C runtime is linked into the executable.
• Linux x64: GNU/Linux with glibc 2.36 or newer, including Debian 12/13 and Ubuntu 24.04 or later. The installer and instance manager require systemd. Alpine/musl and ARM packages are not included.

A public server needs a hostname, an available TCP port, a trusted TLS certificate and outbound HTTPS access to playeraudio.net. Voice connections may also need a TURN relay. Start with a small community and measure memory, CPU and bandwidth; this candidate has not been load-certified.

Verify downloads

Compare the archive's SHA-256 with the official download page. Use Get-FileHash ARCHIVE.zip -Algorithm SHA256 on Windows or sha256sum ARCHIVE.tar.gz on Linux.

The Windows executable is not Authenticode-signed. Release manifests use Ed25519 signatures, separate from Windows publisher signing. Obtain the release public key from the official documentation and compare its fingerprint before trusting an installer or update. Never put a release signing private key on a server host.

Windows

Extract the ZIP into a folder you control. Open PowerShell there:

.\playeraudio.ps1 create main -CommunityName "My community"
.\playeraudio.ps1 run main -Port 8788 -BindAddress 0.0.0.0 -Certificate C:\Certificates\fullchain.pem -PrivateKey C:\Certificates\privkey.pem

Run a second community in a separate terminal:

.\playeraudio.ps1 create friends -CommunityName "Friends"
.\playeraudio.ps1 run friends -Port 8789 -BindAddress 0.0.0.0 -Certificate C:\Certificates\fullchain.pem -PrivateKey C:\Certificates\privkey.pem
.\playeraudio.ps1 list

Ctrl+C stops that instance gracefully. Keep its terminal open while serving. The helper does not install a Windows service, change execution policy or open firewall ports. If local policy blocks scripts, follow your organization's policy or run the executable directly:

.\playeraudio-server.exe setup --config C:\PlayerAudioData\main\server.json --name "My community"
.\playeraudio-server.exe serve --config C:\PlayerAudioData\main\server.json --host 0.0.0.0 --port 8788 --tls-cert C:\Certificates\fullchain.pem --tls-key C:\Certificates\privkey.pem

The helper restricts each instance directory to its Windows user and SYSTEM. In direct executable mode, secure the data directory yourself. Add the chosen inbound TCP ports to Windows Firewall and any provider firewall. Keep TLS private keys private. Renew Windows certificates by stopping only the affected instance, replacing its certificate files and restarting it.

Linux

Prerequisites: systemd, curl, jq, OpenSSL with Ed25519 support, flock, tar, coreutils, useradd and iproute2. Install these with your distribution's package manager. The installer does not install packages, obtain certificates, edit DNS or open firewalls.

Download install.sh, the release manifest URL and trusted release-public.pem from the official documentation:

curl -fSLo install.sh https://playeraudio.net/downloads/server/0.2.0-rc.3/install.sh
curl -fSLo release-public.pem https://playeraudio.net/downloads/server/0.2.0-rc.3/release-public.pem
# Compare the key fingerprint with the official download page before installing.
sudo sh install.sh https://playeraudio.net/updates/server/linux-x64/manifest.json release-public.pem
sudo playeraudio create main community.example.com 8788 "My community" --tls fullchain.pem privkey.pem
sudo playeraudio create friends community.example.com 8789 "Friends" --tls fullchain.pem privkey.pem
sudo playeraudio list
sudo playeraudio status main
sudo playeraudio logs main
sudo playeraudio restart main
sudo playeraudio stop friends
sudo playeraudio start friends

Each instance has its own system user, data directory, port and selected executable. Services start at boot. If Caddy is already installed, the installer can configure optional proxy support; use --proxy instead of --tls CERT KEY and a distinct hostname for each proxy instance. Account for existing services on ports 80/443 before enabling a proxy.

A reverse proxy is optional: direct TLS works at https://community.example.com:8788. Without TLS, only loopback listeners are permitted; use that mode behind a local HTTPS proxy.

Renew Linux certificates with sudo playeraudio certificates main fullchain.pem privkey.pem. The manager validates and installs private copies, then signals that instance to reload. ACME issuance and certificate renewal scheduling are external.

Connect and claim ownership

In PlayerAudio, add your HTTPS server address and connect. Use the generated setup-code.txt once to claim ownership. Keep it private. Set region and discovery preferences in the owner controls. Platform discovery needs a publicly reachable HTTPS endpoint; a server can remain unlisted.

The owner can set an optional server password in Server settings → Access. This is separate from account passwords; changing it revokes remembered access for other members. Server-browser artwork appears only for verified servers. Verification and capacity licensing are separate.

The default capacity is 100 connected identities. A valid server-bound unlimited license removes that identity-tier cap; connection, hardware and network limits still apply. Stop the instance, add the issued token to the license property in its private server.json and restart. Do not share the token or configuration, or reuse a license for a different community ID.

Storage and backups

Linux managed data: /var/lib/playeraudio/instances/NAME/data/. Linux environment: /etc/playeraudio/instances/NAME.env. Windows helper data: %LOCALAPPDATA%\PlayerAudioServer\instances\NAME\, or the supplied -DataRoot. Direct executable mode stores data beside the --config path.

Keep server.json, community.enc, attachments and artwork together. The configuration contains the storage encryption key and may contain licenses or relay credentials. Losing that key makes encrypted state unrecoverable. Backups containing it are sensitive even though the community store is encrypted.

Linux: sudo playeraudio backup main stops the selected instance, makes a consistent private backup under /var/lib/playeraudio/backups/main/ and restores its previous running state.

Windows: stop the instance with Ctrl+C, confirm its process exited, then copy the complete instance directory to a private encrypted backup destination. Keep the matching executable version. Restore only while stopped; never run two writers against one directory. Restoring an older backup discards later writes.

Signed updates

Linux: sudo playeraudio update main https://playeraudio.net/updates/server/linux-x64/manifest.json. The manager verifies signature, target, expiry, sequence and SHA-256 before stopping the selected instance. It backs up data, validates the store with the candidate and checks health after restart. On failure it restores the previous executable, never stale data automatically.

Windows: use the current executable and the official raw public key file:

.\playeraudio-server.exe stage-update --manifest-url https://playeraudio.net/updates/server/windows-x64/manifest.json --key .\release-key.hex --target x86_64-pc-windows-msvc --minimum-sequence INSTALLED_SEQUENCE --destination C:\PlayerAudioUpdates\candidate

Use the sequence from the installed release manifest or build.json (9 for 0.2.0-rc.3). Staging verifies signature, target, expiry, increasing sequence, size and SHA-256. It does not replace or restart running instances. Stop the selected instance, back up its complete data directory and run the candidate's check-store --config FULL_CONFIG_PATH. Start with the candidate executable and existing arguments. Check /health for the same ID and new version before accepting traffic. Retain the previous executable and new release.json sequence. If instances share an executable, move only the selected instance to a new executable path.

Private alpha deployments trust a test key. Verify the public release-key fingerprint through the official documentation and explicitly change that trust key before using public release manifests.

Voice, files and troubleshooting

Direct TLS handles signaling; it does not remove NAT restrictions on peer-to-peer media. Configure static ICE servers, coturn credentials or Cloudflare TURN where needed. Keep relay secrets private. TURN firewall rules are separate from the community HTTPS port.

Community files are encrypted by clients. Owners can configure upload/storage limits; available disk space remains a hard limit. Reserve space for state, backups and logs. DMs use the platform CDN with a 50 MB upload limit. Videos do not autoplay; channel/post NSFW settings control visibility in compatible clients.

GET /health reports status, ID, version and protocol. Check it over the same trusted HTTPS endpoint the client uses.

• Connection refused: check process, selected port, host and provider firewalls.
• TLS failure: check hostname, chain, expiry and private key. A bare IP needs a certificate covering that IP.
• Instance already owned by a process: stop the existing process or select a distinct directory; do not force another writer.
• Voice works only on LAN: check TURN configuration, credential issuance and relay ports.
• Update rejected: check target, trusted key, expiry, installed sequence and digest.
• Storage failure: check free space and instance-user permissions.

Dependency notices are included under third-party/ and listed in THIRD-PARTY.json in each archive.

### Connection limits

Each account may hold four WebSocket connections per server. The server admits at most 512 connections in total, including pending upgrades, and limits reconnect attempts to 20 per account and 600 in total per minute. Excess attempts receive HTTP 429; wait before reconnecting. Role managers can assign only permissions they already hold.