XIVCHAT NEXT · DESKTOP 1.3.6 / PLUGIN 1.7.15
Your optional self-hosted relay
The plugin and desktop both connect to your HTTPS server when the game PC is not directly reachable. The relay forwards application traffic; it does not proxy the game, keep a character logged in, or store offline chats/screenshots.
Deploy
Use the Ubuntu + 1Panel offline image guide for the release's prebuilt Linux amd64 image. For source builds and 1Panel HTTPS setup, see VPS HTTPS.
On a server without an existing reverse proxy, the repository's default deploy/relay/compose.yaml includes Caddy. In that directory, copy .env.example to .env, set a real RELAY_DOMAIN and independent RELAY_ADMIN_PASSWORD (at least 16 characters), then run docker compose up -d --build. Caddy needs inbound 80/443; do not publish game port 14777 or backend 8080. Do not combine this default configuration with the 1Panel-only configuration.
Open https://your-domain/admin/ and sign in with the administrator password. Use the HTTPS root address as the service URL, without a subpath, query, username or password. Plain HTTP is allowed only for local development on loopback.
Register the game and pair the desktop
- In Game devices, add a named device and save the registration credential shown only once.
- Enter the service URL/credential in the plugin, save and enable Relay. Wait for the device to show online.
- Generate an invitation in the web admin or plugin. A new invitation invalidates the previous unused invitation.
- In the desktop, choose Self-hosted relay and paste the invitation. Compare the complete endpoint fingerprint with the plugin through an independent trusted channel, then save.
- Complete the existing chat-device trust confirmation on both ends.
Registration, invitations and desktop credentials are separate from the admin password. Each desktop has its own credential. Credentials are protected for the current Windows user; moving PCs/users or losing configuration may require new pairing.
A normal restart does not require another invitation. The ten-minute invitation lifetime applies only to its first, one-time exchange. Saved credentials and trust remain valid until revoked. Configuration save failure, revoked/lost credentials or a replaced endpoint certificate can require re-pairing.
After a successful session, the Logo can connect to the last successful target. Interrupted successful relay sessions retry with backoff; explicit Disconnect cancels retries.
Administration and operation
The English/Chinese web admin lists devices, clients and live sessions. Rename devices, create invitations, revoke a client or revoke a whole game device. Original credentials cannot be displayed again. Revocation normally closes affected sessions within the two-second checking interval; it cannot be undone.
Admin sessions last at most eight hours and end on logout or server restart. Restarting the server does not erase device/client authorization. To change the password, update the deployment environment and recreate the relay container. With Compose, provide the original domain and chosen password again when recreating it.
Defaults are intended for small private deployments: 64 online game hosts, 32 clients/sessions per host, 256 total sessions, and 4 MiB/s per session/direction with an 8 MiB burst. Large screenshots share their session with chat. Request/rate limits can apply per instance behind a shared proxy.
Backup, upgrade and troubleshooting
Retain the data volume and the existing image. Stop relay writes before copying SQLite; do not copy only a live main database while omitting its WAL. A sample Compose backup is:
mkdir -p backups
docker compose stop relay
docker compose cp relay:/data/relay.sqlite3 ./backups/relay.sqlite3
docker compose start relay
Keep configuration/volumes for upgrades and restore a matching pre-upgrade data snapshot for rollback when schemas change. Never remove the volume as part of routine upgrades.
| Symptom | Check |
|---|---|
| Wrong admin address | Configured HTTPS domain and forwarded original Host |
| Login failure / 429 | Password and login rate limit; wait a minute before retrying |
| Plugin offline / 409 | HTTPS reachability, registration credential and endpoint certificate |
| 401 | Lost, incorrect or revoked credential |
| Invitation rejected | Expired, used, replaced, incompatible or client limit reached |
| Connected but cannot send | Character login and trust confirmation on both ends |
| Fingerprint mismatch | Stop and independently compare with the plugin; do not bypass it |
The relay sees addresses, timing, device identifiers and traffic sizes. Application data uses an additional endpoint TLS session and the existing chat encryption; the relay does not hold endpoint private keys or persist application traffic.