Send events to Discord
Your server can post alerts into a Discord channel, and use one for two-factor approval of root account logins.
These webhooks need no bot.
There is no in-game screen for this. You set it in storyforce_server.cfg.
The Discord block ships commented out from top to bottom.
Set and test a webhook
Two webhooks, addressed by purpose.
| Cvar | Carries |
|---|---|
sf_webhookroot2fa | Root login approval requests |
sf_webhooksusact | Injection-guard trips |
Send suspicious activity alerts
Set sf_webhooksusact and the SQL injection guard posts a Suspicious Activity embed when a
command trips it.
sf_injectionattempt decides what the guard does when it trips: 0 logs only, 1 kicks, 2 bans. The alert works at every level. At 0, repeated trips from one player are reduced to one audit, security-log and webhook record every 5 seconds. A kick or ban always leaves a record.
Turn on two-factor login for root account
Set sf_webhookroot2fa to a webhook in a channel only your staff can see and turn it on via sf_discord2fa 1.
The flow is deliberately two-staged. A root account login with the right password and the server posts an approval request and refuses the login:
A member of staff adds ✅ to approve or ❌ to deny. Denial wins if both reactions are present.
Once approved, the person can run /login again.
sf_discord2fatimeout sets how long it stands, in seconds, defaulting to 300 and clamped between 30 and 3600.
Get back in when Discord approval fails
If two-factor login for the root account is unreachable, the root account cannot log in at all.
The way back in is sf_discord2fa 0 at the server console or over rcon.
If root's password is lost, sf_rootreset at the server console or over rcon re-hashes it and restores membership and leadership admin. See Secure a new server.
Things to note
- One request at a time, server-wide. While an approval is pending for one address, a login from a different address is refused rather than raising a second request.