A modernised fork of luadch by
blastbeat and pulsar, hosted at luadch-ng.
Maintained by Aybo, with help from Claude.
| Line | Status | What it gets |
|---|---|---|
| 3.2.x | active development (master) |
New features, (HTTP API, Dual-Stack, audit log, etc.), refactors |
| 3.1.x | security fixes only (release/3.1.x branch) |
Backports for critical CVEs / severity-1 bugs only; no new features |
| ≤ 3.0.x | end of life | No updates of any kind |
The 3.1.x line concludes the modernisation programme (Phases 1-7 + ADC-coverage closure). The active 3.2.x line picks up the Phase 8 feature work.
- TLS 1.3 with AES-128 / AES-256 cipher suites
- Fast, small footprint (≈ 3 MB install size)
- ARM-compatible (Raspberry Pi, ARM servers, Apple Silicon Linux)
- Easy-to-use Lua scripting API for plugins
- Many bundled command and bot scripts
- Right-click menu support in modern clients (AirDC++)
- Lua 5.4.8 runtime - bumped from upstream Lua 5.1 (EOL since 2012). Modern bytecode, integer-aware math, native
utf8library, supported standard library - DoS hardening (#56) - per-IP / per-user rate limits, TLS handshake deadline, failed-auth lockout
- Per-userlevel rate-limit tiers (#80) - independent buckets for chat / PM / INF / CTM-RCM / search, optional named tiers per user level (see
docs/SCRIPTS.md) - Encrypted user database (#52) - AES-256-GCM at-rest encryption of
cfg/user.tbl - Sandboxed config / state loaders (#51) - tampered
.tblfiles cannot achieve RCE - POSIX file-permission enforcement on secret files
- TLS-only default + auto-generated cert on first boot (#77 / #113) - fresh installs ship TLS-only on both IPv4 and IPv6, with a P-256 ECDSA cert generated automatically when none exists
- Atomic plugin saves (#133) -
util.savearray/util.savetableuse tmp + rename so a hub crash mid-write leaves the.tblintact - Docker plugin + language autosync (#118) - container restarts pull in new bundled scripts and lang files without overwriting operator customisations
See docs/SECURITY.md for the full threat model
and operator guidance.
- docs/BUILDING.md - build from source on Linux, Windows, or ARM
- docs/INSTALLING.md - deploy a built hub (file layout, permissions, systemd, backups, updates)
- docs/CONFIGURATION.md - configure the hub, register users, manage plugins, set up TLS
- docs/SCRIPTS.md - every bundled plugin with its commands and cfg keys, plus the rate-limit configuration guide
- docs/SECURITY.md - threat model, plugin trust contract, file-permission baseline, network-defense map, CVE-tracking process, how to report a security issue
- docs/DOCKER.md - container image, mount layout, TLS-only deployments, troubleshooting
- docs/PLUGIN_API.md - plugin scripting API reference (listeners, modules, objects, conventions, pitfalls)
Pre-built binaries for Linux x86_64 and Windows x86_64 are attached to each release - extract and run.
git clone https://github.com/luadch-ng/luadch.git
cd luadch
cp .env.example .env # adjust PUID / PGID if `id -u` is not 1000
mkdir -p cfg scripts certs log secrets
docker compose up -dThe image (ghcr.io/luadch-ng/luadch:latest, multi-arch
linux/amd64+arm64) runs unprivileged by default; the entrypoint
seeds empty mounts, generates a self-signed TLS cert, and logs the
keyprint for the adcs:// URL. See docs/DOCKER.md
for the full operator guide.
git clone https://github.com/luadch-ng/luadch.git
cd luadch
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j$(nproc)
cmake --install build
cd build/install/luadch && ./luadchThen connect with an ADC client (e.g. AirDC++) to adc://127.0.0.1:5000,
log in as dummy / test, and read CONFIGURATION.md
for first-run steps. Windows users: see the Windows section of
BUILDING.md.
GPLv3.0 - see LICENSE.
All conceptual credit goes to blastbeat and pulsar, the original authors of luadch. This fork only modernises and extends their excellent foundation.