ASP.NET Core 9 (net9.0) implementation of the RecNet API surface that archived 2023 Rec Room clients call. Root namespace RadicadeServer; one process serves both the game API and the public web/share endpoints.

Running

dotnet run --project Server

Development listens on https://localhost:3030 and http://127.0.0.1:3031 (see appsettings.Development.json); Production defaults to http://0.0.0.0:3030 for a TLS-terminating proxy in front (see the repo-level Caddyfile).

Program.cs builds the host, loads configuration into DBConfig, then:

fails fast in Production if AdminApiKey, JwtKey or SteamApiKey are blank;
registers the EF Core RecDBContext (SQL Server, retry-on-failure, pending-model warnings ignored);
wires JWT bearer auth (signing key from Radicade:JwtKey; the access_token query parameter is accepted on notify-hub paths for WebSocket clients) plus a token version check that revokes sessions;
configures ImageSharp (with a cropSquare command used by avatar images);
applies migrations and idempotent schema fix-ups at startup;
maps controllers and the NotifyHub SignalR hubs.

Layout

Folder	Contents
`Program.cs`	Host, DI, auth, middleware pipeline and startup schema work.
`DB/`	`DBConfig` (all runtime configuration + paths), `RecDBContext`, `Defaults`, factory and bootstrap helpers.
`Migrations/`	EF Core migrations.
`NameServer/`	`GET /`, `/ns`, `/nameserver` — the document that tells a client where every service lives.
`Auth/`, `AccountCreation/`	Login, token issuance, onboarding flows, platform identity proofing.
`Players/`, `PlayersBanned/`, `Relationships/`, `Messages/`, `Chat/`, `Notifications/`	Player records, presence, friends, direct messages, chat and notifications.
`Rooms/`, `Clubs/`, `Board/`, `PlayerEvents/`, `Inventions/`, `Keepsakes/`, `Studio/`, `Royale/`	User-generated and social content surfaces.
`Avatars/`, `CustomAvatarItems/`, `Images/`, `CDN/`, `Storage/`, `LoadingScreens/`, `Launcher/`	Cosmetics, image/video CDN routes, stored blobs, launcher manifest.
`Commerce/`, `Storefront/`, `Gift/`, `Promotions/`, `PlayerCheer/`, `ProgressionEvents/`	Economy: storefronts, purchases, gifts, promotions, progression rewards.
`Matchmaking/`, `Activities/`, `Leaderboards/`, `Compatibility/`, `Health/`	Session/matchmaking, activity feed, leaderboards, version compatibility checks, health endpoints.
`Moderation/`, `PlayerReporting/`, `PlayerWarnings/`, `PlayerReputation/`, `BanAppeal/`	Moderation and safety tooling.
`Config/`	Client configuration/split-test endpoints and player settings.
`Analytics/`, `BugReporting/`	Game log ingestion and bug reports.
`Admin/`	Admin panel API. Endpoints authenticate with `AdminApiKey`/`SupportApiKey` (see `AdminUtils`).
`Web/`	Public web/share API (`/web/...`).
`Discord/`	Discord webhook config (`webhooks.json` git-ignored, `webhooks.example.json` tracked).
`RecNet/`, `Radicade/`	Shared response/enum models and RecNet-shaped DTOs.
`RadicadeServer-Config/`	Catalogs served to clients (storefronts, avatars, equipment, keepsakes, level-up rewards, Steam whitelist).
`Middleware/`, `Extensions/`, `Utils/`	Cross-cutting plumbing and helpers.
`Tooling/`	Debug and test-case management endpoints.

Routing and multi-version support

Routes are declared with controller attributes and many endpoints deliberately expose several paths for the same handler, because different 2023 builds call slightly different URLs (for example ~/clubs/club/home/me, ~/club/home/me and ~/api/clubs/v1/home/me). Supported client versions are listed in DBConfig.SupportedGameVersions, with 20230831 (September 2023) as the primary target and 20230301–20231207 plus a couple of 2025 builds also accepted.

CORS is wide open (AllowAllOrigins), which is appropriate for a self-hosted server serving the game client and local tooling.

Data

DBConfig.PublicData defaults to ./RadicadeServer-Data/ and is split into:

CDN/Images, CDN/Videos, CDN/Storage, CDN/Custom — served content and uploads;
Persistent/Logs — rotating logs and generated debugkey.txt;
Persistent/DataProtection-Keys — Data Protection key ring;
Persistent/localhost-rsa-aes-devcert.pfx — the Development HTTPS certificate.

Configuration

See the configuration table in the root README. The checked-in appsettings.*.json files contain USEYOURS placeholders; override real values with user secrets or environment variables (Radicade__JwtKey, ConnectionStrings__DefaultConnection, …). Production startup validates the three required secrets.

Tests

Covered by ServerTests/ — see that README for how to run them and which helpers they use.

README.md Unescape Escape