server.toml

server.toml is read by LoadServerConfig, a minimal flat key = value parser (a TOML scalar subset), not a full TOML parser. Practical consequences:

• Flat keys only. [section] headers and nested tables are ignored.
• Arrays must be single-line: resources = ["a", "b"]. Multi-line arrays are not supported (the parser reads the file line by line).
• A bool is true for true, 1, yes, or on; anything else is false.
• Quotes around strings are optional and stripped automatically (name = "X" and name = X are equivalent).
• # comments truncate the rest of the line — do not use # inside values (URLs, passwords).
• Unknown keys are silently ignored.

Fields split into two groups: (A) parsed by the loader (setting them works) and (B) present in ServerConfig but NOT parsed by the flat loader (setting them has no effect — the compiled default is kept).

Example

name = "My Varion Server"
host = "0.0.0.0"
port = 7788
httpPort = 7789
maxPlayers = 128
maxQueueSlots = 32

gamemode = "roleplay"
channel = "release"
minClientBuild = 0
tickRate = 64
streamingDistance = 300
migrationDistance = 150

debug = false
collectClientDiagnostics = false
encryptTransport = true
announce = true
masterListUrl = "https://master.example/api"
serverPassword = ""
language = "en"
description = "Freeroam + roleplay"
website = "https://example.com"
tags = ["roleplay", "voice"]

resourcesDir = "resources"
resources = ["my-gamemode"]
modulesDir = "modules"

spawnAfterConnect = false

(A) Parsed fields

Key	Type	Default	Purpose
name	string	"Varion Server"	Server name shown in the server browser
host	string	"0.0.0.0"	Game socket bind address
port	uint16	7788	Game UDP/ENet port
httpPort	uint16	7789	HTTP port (manifest, resource files, /server-info.json)
maxPlayers	uint32	1024	Admitted player cap
maxQueueSlots	uint32	64	Extra ENet slots for the connection queue (on top of maxPlayers)
gamemode	string	"freeroam"	Gamemode label for the server browser
channel	string	"release"	Release channel (release/rc/dev); the client must match
minClientBuild	uint32	0	Minimum client build (0 = no minimum)
tickRate	uint32	64	Server tick frequency (Hz)
streamingDistance	float	300	Entity streaming radius (m)
migrationDistance	float	150	Radius within which empty vehicles migrate ownership to the nearest player (m)
debug	bool	false	Debug logging
collectClientDiagnostics	bool	false	Allow clients to upload bounded log tails to the HTTP endpoint
clientDiagnosticsDir	string	"logs/client-diagnostics"	Directory for uploaded client logs
encryptTransport	bool	true	Transport encryption (ECDH P-256 + AES-256-GCM)
announce	bool	true	Publish to the masterlist (false = never announce, even with a URL set)
masterListUrl	string	""	Masterlist backend URL (empty = don't announce)
description	string	""	Server browser description
website	string	""	Server website
language	string	"en"	Server language
serverPassword	string	""	Connection password (empty = no password)
useEarlyAuth	bool	false	Enable an external login page before the connection completes
earlyAuthUrl	string	""	Early-auth page URL
useCloudAuth	bool	false	Enable cloud identity validation at handshake (see note)
spawnAfterConnect	bool	false	Dev only: the engine spawns the player itself (see note)
resourcesDir	string	"resources"	Resource directory
modulesDir	string	"modules"	Native module directory
resources	string[]	[]	Resources in order; empty = auto-scan every subfolder with a resource.toml
modules / loadModules	string[]	[]	Parsed but NOT used (see note)
tags	string[]	[]	Server browser tags

Notes for (A):

• Exact key names. Use maxPlayers, maxQueueSlots, serverPassword. The old players, queueSlots, password names are ignored.
• Empty resources → auto-scan. Every subfolder of resourcesDir that has a resource.toml is loaded (resources with enabled = false are skipped). A non-empty list is loaded strictly in the given order by exact folder name — wildcards (*, dir/*) are NOT expanded in this list.
• The JS host auto-starts. Any type = "js" resource with a non-empty main automatically starts the server JavaScript host — no modules entry is needed.
• modules / loadModules has no effect on loading. The key is parsed, but the module loader loads EVERY library (*.dll/*.so) in modulesDir regardless of this list.

(B) Fields NOT parsed by the flat parser

These fields are declared in ServerConfig, but the flat parser has no case for them — setting them in server.toml has no effect and the compiled default (the Default column) is kept. Don't waste time configuring them via TOML.

Key	Type	Default (compiled)	Purpose
maxEntities	uint32	65535	Upper entity cap
maxStreamedEntities	uint32	8192	Concurrent streamed-entity cap
serverAntiCheat	bool	true	Anti-cheat flag
extendedLogging	bool	true	Extended logging
masterListToken	string	""	Inline owned-server token
masterListTokenFile	string	"data/masterlist-token.txt"	Token cache path
publicHost	string	""	Public host sent to the backend
serverId	string	""	Official server identity
serverLicenseToken	string	""	Inline license proof
serverLicenseTokenFile	string	"data/server-license.txt"	License proof file
requireServerLicense	bool	false	Fail startup without identity/proof
allowLocalUnlicensed	bool	true	Allow local dev mode without a license
dataDir	string	"data"	Data directory
configFile	string	"server.toml"	Config path (set via launch argument, not from TOML)
cloudAuthUrl	string	""	Cloud identity validation URL
cloudAuthRequired	bool	true	Require cloud identity
cloudApiUrl	string	""	Cloud API URL
cloudApiToken	string	""	Cloud API token
spawnX	float	215.76	Dev spawn X
spawnY	float	-810.12	Dev spawn Y
spawnZ	float	30.73	Dev spawn Z
spawnHeading	float	157.0	Dev spawn heading
spawnModel	uint32	0x705E61F2 (mp_m_freemode_01)	Dev spawn model
debugSpawnRemotePed	bool	false	Test server-owned ped through the normal streaming path
debugRemotePedNetworkId	uint16	65000	Test ped network id
debugRemotePedModel	uint32	0x9B22DBAF (player_one)	Test ped model
debugRemotePedOffsetX	float	2.0	Test ped X offset
debugRemotePedOffsetY	float	0.0	Test ped Y offset
debugRemotePedOffsetZ	float	0.0	Test ped Z offset
debugRemotePedHeading	float	337.0	Test ped heading

Two important asymmetries

• Cloud-auth is half-wired. useCloudAuth is parsed (you can enable it), but none of its detail fields — cloudAuthUrl, cloudAuthRequired, cloudApiUrl, cloudApiToken — are parsed. You can turn cloud validation on, but you cannot configure it via TOML. (Early-auth, by contrast, is fully wired: both useEarlyAuth and earlyAuthUrl are parsed.)
• Dev spawn is fixed. spawnAfterConnect is parsed (the dev fallback can be enabled), but spawnX/Y/Z, spawnHeading, spawnModel are not — the spawn point is hard-compiled (215.76, -810.12, 30.73, heading 157, model mp_m_freemode_01). For a real server keep spawnAfterConnect = false and spawn from a resource's playerReady handler through the SDK.

Identity and license

The identity/license fields (serverId, masterListToken, serverLicenseToken*, requireServerLicense, allowLocalUnlicensed, publicHost) and the trust model are documented in Masterlist. Note: except for masterListUrl and announce, the keys listed there are not read by the current flat server.toml parser — they keep their compiled defaults.