config.yml

Written with these defaults on first start (or with -init). Changes to servers, groups, join and fallback groups, forced hosts, transfer style, limbo and MOTD apply with reload (console) or POST /api/reload; listeners, keys, limits, admin and logging need a restart.

Listening

Key	Default	Meaning
listen.bind	"0.0.0.0:19132"	TCP address for NetherNet signaling; its port is also the UDP port. Open it in TCP and UDP.
listen.udp-port	0	UDP port for NetherNet data, RakNet and Query; 0 = the port of bind.
listen.advertise-addresses	[]	Extra public IPs given to clients (when the proxy is behind NAT).
listen.advertise-host	true	Also offer the address the player typed.

NetherNet and RakNet

Key	Default	Meaning
nethernet.enabled	true	NetherNet (WebRTC), needed by Bedrock 1.26.50+.
nethernet.identity-file	"nethernet_identity.pem"	Operator P-384 key. Back it up; use the same file on every proxy.
nethernet.domain	"self"	Name shown in the client's trust prompt.
nethernet.require-identity	false	Reject clients that do not sign their connection.
nethernet.verify-identity	true	Kick Xbox players whose connection is not signed with their login key (replayed logins).
nethernet.https.certificate / private-key	""	PEM files, reloaded when they change. iOS clients need HTTPS.
nethernet.https.acme-domains / acme-email	[] / ""	Let's Encrypt certificates; port 80 or 443 must reach the host while they are issued.
raknet.enabled	false	RakNet for 1.26.5x clients on the same UDP port (IPv4 only).

Players and identity

Key	Default	Meaning
online-mode	true	Check Xbox Live logins.
proxy-id	"proxy-1"	Name of this proxy, sent in tickets.
proxy-key-file	"proxy_key.pem"	P-256 key that signs tickets. Its public key goes into each backend.
transfer-style	dimension	How a server change looks: dimension, seamless or cinematic.
motd.name / motd.sub-name	"VanillaGate" / "Luxury Nodes"	Text in the server list.
motd.max-players	100	Shown in the list, and the player cap; 0 = no limit.

Servers

Key	Default	Meaning
servers.<name>.address	lobby-1: "127.0.0.1:19200"	pm-link address of a backend. <name> = its network.proxy.server-name.
groups	lobby: [lobby-1]	Groups of servers; a group picks its server with the fewest players.
join-priority	[lobby]	Groups tried, in order, for players who join.
fallback-groups	[lobby]	Groups tried when a player's server stops or sends them back.
limbo-seconds	90	How long a player waits when no fallback is up; 0 = disconnect at once.
forced-hosts	{}	Host name the player typed → server or group.

Resource packs

Key	Default	Meaning
resource-packs.enabled	false	The proxy sends packs to players.
resource-packs.folder	"resource_packs"	Where the packs are.
resource-packs.required	false	Players must accept them.
resource-packs.encrypt	true	Encrypt packs. Keys are kept in <folder>/.encrypted; a <file>.key next to a pack means it is already encrypted.

Permissions

Key	Default	Meaning
player-groups	{}	Player name or XUID → permission groups.
permissions.default	pmproxy.command.hub, pmproxy.command.glist	Nodes every player has.
permissions.admin	pmproxy.command.server, .find, .send, .alert, .kick	Admin nodes. * and prefix.* wildcards work.
plugins.permissions.enabled / file	false / "permissions.yml"	Permissions plugin with groups and inheritance; replaces player-groups and permissions.

Limits

Key	Default	Meaning
limits.pings-per-second / ping-burst	5 / 10	Server list pings per address.
limits.joins-per-minute / join-burst	20 / 5	Connection attempts per address.
limits.joins-per-second	50	Connection attempts of everyone together.
limits.max-logins-in-progress	100	Logins checked at the same time.
limits.max-players-per-ip	5	Players from one address.
limits.packets-per-second / packet-burst	400 / 800	Packets per player; above it the player is kicked.
limits.strikes / block-seconds	30 / 300	An address with more strikes than this in a minute is blocked for block-seconds. 0 disables a limit.

Several proxies, admin, logs

Key	Default	Meaning
redis.address / password / db / prefix	"" / "" / 0 / "pmproxy:"	Shared state for several proxies; empty address = this proxy is alone.
plugins.multiversion.enabled	false	Let older clients join the newest servers (1.26.52 on 1.26.60).
admin.bind / admin.token	"" / ""	HTTP admin API; off when bind is empty. With a token, requests need Authorization: Bearer <token>. Never expose it publicly.
log.level / format / file	info / text / ""	debug, info, warn, error; text or json; file also appends logs to that file.