features/sentinel/
Every setting of features/sentinel/ and its per-provider setting.
features/sentinel/ holds the sentinel's settings.yml and messages.yml. Sentinel explains what each sentinel counts. Credential's brute-force protection is set in Credential's settings.
settings.yml
Takestrue or false
Defaulttrue
Affectswhether the checks that run once a provider is known apply, for every provider that does not set its own value
The checks that run before a provider is known, such as the contested-connection sentinel, follow only their own enabled.
Advanced
Takestrue or false
Defaultfalse
Affectswhether connections that keep trying to continue or push a waiting login are locked out
Advanced
Takesan integer greater than 0
Default10
Affectshow many attempts are allowed before the lockout
Advanced
Takestrue or false
Defaulttrue
Affectswhether reaching maxAttempts locks the player out
Advanced
Takesa positive duration
Default"30s"
Affectshow long the lockout lasts
Advanced
Takestrue or false
Defaultfalse
Affectswhether the player is warned before the lockout
Advanced
Takesan integer percentage from 0 to 100
Default0
Affectsfrom which share of maxAttempts the warning is shown
Values outside 0 to 100 are treated as the nearest end. For example, with maxAttempts: 10 and thresholdPercentage: 70, warnings begin on attempt 8.
Takestrue or false
Defaulttrue
Affectswhether the contested-connection sentinel locks out an address that keeps contesting usernames
It counts the connections of an address that are refused because another address is logging in under their username, whatever username each connection uses. Once the address reaches maxAttempts, every connection from it is refused for the lockout duration. See Two connections with one username.
Takesan integer greater than 0
Default5
Affectshow many refused connections an address may have before it is locked out
Takestrue or false
Defaulttrue
Affectswhether the sentinel locks the address out once it reaches maxAttempts
Takesa positive duration
Default"1m"
Affectshow long the address stays locked out
Takestrue or false
Defaultfalse
Affectswhether registrations from one address are limited
Once an address reached maxAccounts, its next registration is refused before the player is asked for a password. Players who already have an account keep logging in. It counts the addresses Identica keeps in identity/addresses.yml, which also decides which addresses count as one; see Limiting accounts per address.
Takesan integer greater than 0
Default3
Affectshow many accounts may be registered from one address
Takesa duration, or 0m
Default"0m"
Affectshow far back registrations count
0m counts every account whose registration address is still kept. With a window such as "30d", a registration stops counting 30 days after it happened.
Takesa list of addresses and ranges, such as 203.0.113.7 or 10.0.0.0/8
Default[]
Affectswhich addresses are never limited
Use it for addresses many real players share, such as a school. Their registrations are still kept, unlike the addresses identity/addresses.yml ignores. An entry that is not an address or range is skipped with a warning.
Advanced
Takesa string
Default"identica:sentinels"
Affectsthe name under which proxies share counters and lockouts
Per provider
Takestrue or false
Defaultabsent
Affectswhether the checks that run once a provider is known apply to this provider, among them Credential's brute-force protection
When absent, the shared enabled applies.
messages.yml
Takesa list of lines
Affectsthe message shown while the resume-spam lockout lasts
The {seconds} placeholder is replaced with the remaining lockout duration.
An empty list silences the message; the lockout still denies.
Takesa list of lines
Defaulta notice reading Too many attempts to log in under names in use. and the time left
Affectsthe reason shown to a connection from an address the contested-connection sentinel locked out
The {seconds} placeholder is replaced with the remaining lockout duration. An empty list silences the message; the lockout still denies.
Takesa list of lines
Defaulta notice reading Too many accounts were registered from your address. and the limit
Affectsthe reason shown to a player whose registration the account limit refuses
{maxAccounts} is replaced with sentinels.accountsPerAddress.maxAccounts. {seconds} is replaced with the time until the oldest registration that counts leaves the window, and with 0 without a window. An empty list silences the message; the registration is still refused.
Example
features/sentinel/settings.yml:
sentinels:
resumeSpam:
enabled: true
maxAttempts: 10
lockout:
enabled: true
duration: "30s"
warning:
enabled: true
thresholdPercentage: 70
contestedConnection:
enabled: true
maxAttempts: 5
lockout:
enabled: true
duration: "1m"
accountsPerAddress:
enabled: false
maxAccounts: 3
window: "0m"
allowlist: []
replication:
state: "identica:sentinels"