Solomon

Solomon is a self-hosted engine for running game servers for families and small groups of friends. It assumes that many of the players are children and that the adults running it are parents rather than system administrators, so it puts safety, privacy and plain controls ahead of everything else. It is in development and not yet released.

Bubbles, seals and passkeys

Sign-in is passkeys only, with no passwords to leak or reuse. People join through seals, which are single-use invite codes, and each seal joins a bubble: one family's or group's moderated space with its own members, invites, servers and audit log. Roles are held per bubble, an owner can invite and promote only to roles below their own, and staff of one bubble never see another bubble's people, chat or servers. An authorisation test runs every route against ten kinds of caller, from signed-out to operator, to keep it that way.

Controls a parent actually uses

• Bedtime: school-night and weekend times with per-child overrides, warnings at ten and two minutes, then a kick and a temporary block that survives restarts. A parent can grant "+30 minutes tonight" in one tap.
• Play-time limits: weekday and weekend minutes per child, with a five-minute warning.
• Schedules: chained steps such as announce, wait, back up and restart, in the bubble's own time zone.
• Moderation: chat checked against a word list, each hit shown with the lines around it, and Mark OK, Kick, Time-out or Ban. IP addresses are blanked before anything is stored.
• Help and alerts: a player types !help in game to reach a grown-up. Alerts go out grouped and rate-limited by email and Web Push, with a weekly digest. They never include chat text or player names.

One engine, several games

Every feature is written against a small game-adapter contract. Hosted adapters run the server in a container that Solomon controls: Minecraft (Java, with Paper and Fabric templates) and Luanti, the open-source voxel engine, whose bridge mod handles the allowlist, events and commands. Luanti is tested against a real server. The linked adapter works with Roblox, where Solomon hosts nothing: a small Luau module inside an experience the family owns reports chat and play time, and moderation goes back through Roblox's official cloud API. The Roblox adapter is tested only against fakes so far. Each person has one identity per game, and a server page offers console, files, properties, backups and a mod list.

Hardened at the edges

The panel cannot run Docker itself. Its only route to the containers is a root helper with a fixed list of verbs, which validates every argument again, never passes anything through a shell, and is exercised by a fuzz harness. Mods are pinned by SHA-512, fetched only from allow-listed hosts, and scanned for known malware families before they are installed into a read-only mount. Anything unexpected is quarantined with a note saying why. Off-site backups are encrypted with a pinned restic release, and the credentials never reach the panel. A written threat model, a disclosure policy and the findings of a security audit sit in the repository.

Privacy designed around the amended COPPA Rule

A public privacy notice is generated from the same catalogue of data and retention policies that the code enforces, so the two cannot drift. A parent can export a child's data as a zip or erase it. Erasure reaches chat, flags, play sessions, per-game identities and linked Roblox rows, and removes the player's files from each server. The database is then vacuumed with secure delete on, and a test checks the raw file for leftovers. Every table has a retention period and a daily clean-up, and nothing is kept indefinitely.

djinn: lending a PC to the pool

The longer-term idea is a pool of ordinary home computers, lent by the families themselves. djinn is a single Go binary for Windows, macOS and Linux. It pairs with the panel using a seal and an Ed25519 identity bound to that panel's hostname and a fresh challenge, then reports its specs and live load and accepts the owner's budget for how much of the machine may be used. It can install itself to start at login. Today djinn measures and reports only. Running game servers on pooled machines is the next stage and is not built yet.

Engine, not instance

Nothing in the engine names a deployment. An instance supplies an environment file, a logo and a colour theme, and its own server list, so an improvement made here reaches every instance on its next deploy.