SlurpNet FiveM server configuration, resources, deployment workflow, and operational documentation.
| Path | Purpose |
|---|---|
cfg/ |
Base server configuration, profile overlays, and safe secret examples |
resources/ |
Vendored and first-party FiveM resources |
slurpnet_* |
First-party SlurpNet resources |
docs/ |
Runbooks, roadmap notes, asset/provenance notes, and deployment docs |
.github/workflows/ |
PR lifecycle, issue triage, and production deploy automation |
deploy.sh |
Self-hosted runner deploy script |
This repo is production-sensitive. Small mistakes can affect a live server, so keep PRs focused and include verification evidence.
Review changes for:
- server/client trust boundaries
- event validation
- resource load order
- config secret exposure
- vendored resource provenance
- performance-sensitive loops
- deploy and rollback behavior
Live secrets must not be committed. Use cfg/server.secrets.cfg.example as the checked-in shape for local or environment-specific secret values.
Quasar resources are the preferred paid stack and own their feature lane whenever a matching qs-* resource is installed and enabled. Legacy QB/QBX/Ox/standalone resources may stay enabled only as documented compatibility shims, low-level dependencies, or non-overlapping gameplay additions.
When adding or re-enabling a resource, keep one owner per lane. For example, qs-multicharacter owns character selection and first spawn, qs-appearance owns appearance, qs-housing owns housing, and qs-smartphone-pro owns the phone lane. Do not re-enable competing spawn, character, appearance, housing, phone, inventory, fuel, HUD, dispatch, radial menu, garage, police evidence, admin menu, scoreboard, or chat resources without disabling the Quasar owner and documenting the intentional rollback.
Deploys run through GitHub Actions on the self-hosted FiveM production runner. The deploy workflow includes a Sentinel readiness smoke test when SENTINEL_STATUS_BASE is configured.
Runner recovery and persistence details live in docs/fivem-runner-persistence.md. The replayable host-side recovery command is bash scripts/recover-fivem-runner.sh.
Use pull requests for all changes. Include:
- what changed
- why it changed
- verification performed
- live-proof gap if not fully verified
- rollback notes
Report suspected vulnerabilities or leaked credentials privately. See SECURITY.md.