You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
!!! tip "Every field describes the bridge, not the Minecraft server"
6
+
Admincraft never talks to Minecraft directly. It talks to the **Admincraft WebSocket bridge**, and the bridge talks to Minecraft. So **Host**, **Port** and **Secret key** always describe the bridge container, on both editions.
7
+
8
+
This is the part that catches people out. A Java server has an RCON port and an RCON password, and neither of them goes in Admincraft.
9
+
10
+
## The fields
11
+
12
+
| Field | What it is | Where the value comes from |
13
+
| --- | --- | --- |
14
+
|**Alias**| A label for your own benefit. Shown in the server picker. | Anything you like. |
15
+
|**Minecraft edition**| Which kind of server the bridge should drive. Bedrock uses the container console; Java uses RCON. | Match your server. |
16
+
|**Host or IP of the bridge**| The machine running the `websocket` container. | Tailscale address, `ts.net` hostname, or public IP. |
17
+
|**Bridge port**| The port the bridge listens on. |`8080` normally, `443` behind Tailscale Funnel. |
18
+
|**Bridge secret key**| The bridge's own key, used to sign the token Admincraft sends. |`SECRET_KEY` in the bridge's `docker-compose.yml`. |
19
+
|**Connection security**| How the app-to-bridge hop is protected. | See [connection security](connection-security.md). |
20
+
21
+
## Why Java does not ask for RCON details
22
+
23
+
Choosing **Java Edition** changes which backend the *bridge* uses, not where Admincraft connects. The RCON host, port and password are configured on the bridge:
24
+
25
+
```yaml
26
+
websocket:
27
+
environment:
28
+
SECRET_KEY: YOUR_SECRET_KEY_HERE # ← this is the "Bridge secret key"
29
+
RCON_HOST: minecraft
30
+
RCON_PORT: "25575"
31
+
RCON_PASSWORD: CHANGE_THIS_RCON_PASSWORD
32
+
```
33
+
34
+
RCON stays on the internal Docker network and is never published to a host port. That is deliberate: RCON has no encryption, so exposing it would hand out server control in plain text.
35
+
36
+
So the edition selector is a statement about your server, and the RCON password never leaves the machine it runs on.
37
+
38
+
## Worked example: Bedrock over Tailscale Funnel
39
+
40
+
The setup from the [Bedrock guide](../server/SERVER_SETUP.md#alternative-tailscale-funnel-no-app-on-the-client):
41
+
42
+
| Field | Value |
43
+
| --- | --- |
44
+
| Minecraft edition | `Bedrock Edition` |
45
+
| Host or IP of the bridge | `my-server.tailnet-name.ts.net` |
46
+
| Bridge port | `443` |
47
+
| Bridge secret key | the `SECRET_KEY` from your compose file |
48
+
| Connection security | `Public certificate` |
49
+
50
+
The address preview under the dropdown should read `wss://my-server.tailnet-name.ts.net:443`.
51
+
52
+
## Worked example: Java on a private Tailscale network
53
+
54
+
| Field | Value |
55
+
| --- | --- |
56
+
| Minecraft edition | `Java Edition` |
57
+
| Host or IP of the bridge | `100.101.102.103` |
58
+
| Bridge port | `8080` |
59
+
| Bridge secret key | the `SECRET_KEY` from your compose file |
60
+
| Connection security | `Private network` |
61
+
62
+
The preview reads `ws://100.101.102.103:8080`. That is unencrypted by design, and safe only because Tailscale already encrypts the route. It will not work from the hosted web app: see [using the web app](web-app.md#tailscale-in-the-web-app).
63
+
64
+
## If it will not connect
65
+
66
+
Work down the chain, since each step rules out everything before it:
67
+
68
+
1. **Is the preview the address you expect?** It is shown live under the security dropdown.
69
+
2. **Is the port the bridge's port?** Not `19132` (Bedrock game), not `25575` (Java RCON).
70
+
3. **Is the key the bridge's `SECRET_KEY`?** Not the RCON password, not the Minecraft allowlist.
71
+
4. **Does the security mode match the address?** `Private network` gives `ws://` and only works over a private route. `Public certificate` needs a certificate the device already trusts.
72
+
5. **Can the device reach the host at all?** With Tailscale, both ends must be on the tailnet and connected.
0 commit comments