hoaxeyehoaxeyedocs
Get started

Server setup

Once the Quickstart works end-to-end, this page covers the configuration knobs that matter on a real server: whitelist entries, performance, the Discord verify hookup, and the FiveM build matrix.

Resource whitelist

Two related views surface resources in the dashboard. The always-on Server analytics tab gives every loaded resource an exploit-risk bucket; the deeper Backdoor scanner runs a scheduled whitelist-first pattern pass. Both share the same trusted-resource list.

  • You ship a custom resource you know is clean. Open the dashboard → Server → Resource hygiene, find the resource, and mark it trusted. Future scans skip it; the analytics view annotates it accordingly.
  • A scan flagged something you believe is a false positive. Don't whitelist on instinct — open it from the dashboard, read the matched signal, and if you're sure, whitelist with a note. The note shows up in the audit log. See the False positives page for what makes a finding survive the three filtering layers in the first place.

Performance considerations

The on-server resource is intentionally small. The cost dominates on two paths:

  • Connect path: one HTTP roundtrip to the API per join. We cache verdicts for short windows so reconnects don't pay the cost twice.
  • Detection events: rate-limited per player. Spam-abusers don't get to flood the API from your server — the limiter eats it.

Tick-budget cost

On a representative test server (FiveM artifact 5500+, modern framework stack) the hoaxeye resource holds well below FiveM's tick warning threshold. Numbers below are from the FiveM resource monitor.

< 0.2 ms
On-server tick cost (typical)
Average resmon tick measurement. The actual snapshot reads ~0.02 ms; we publish a 10× conservative number to absorb worst-case spikes during scan ticks and AI fan-out.
~ 10 %
Tick-budget consumption
Of FiveM's per-tick budget on the test server. FiveM only emits a warning at roughly 80%; the resource sits comfortably in the green band.
< 500 KiB
Memory footprint
Resident memory of the on-server resource as reported by resmon. Includes the cache buffer for connect-path verdicts.

Methodology: FiveM resmon snapshot, not a 30-minute sustained run. The published < 0.2 ms claim covers worst-case spikes (scan ticks, AI fan-out, boot run); we keep the bench script in the resource repo so the number can be reproduced.

If you run a heavy roleplay server (200+ slots) and want to track the load yourself, txAdmin → Performance or any per-resource profiler shows you the ms/tick number directly. The config.lua ships sensible defaults; tune only if you observe a real number you don't like.

Discord verify hookup

The Discord verify family is hardcoded on: there's no per-server toggle to disable it for a specific user category. To wire it up:

config.lua (excerpt)LUA
-- config.lua
Config.DiscordGuildId = "your_discord_server_id"
-- Bot membership in that guild is configured server-side via the dashboard.

If you're stuck because the Discord side is misconfigured (bot kicked, guild ID typo, Discord outage), use the Emergency bypass in the dashboard — it's time-boxed and audited. Details on the Discord verify page.

FiveM build compatibility

The resource targets FiveM artifact 5500 and newer. Older builds may not expose a few of the natives we use for guarding; the resource degrades gracefully (the affected guard goes silent rather than crashes), but you'll get a warning at boot. If you run a long-tail older build for compatibility reasons, ping us — we ship a separate slimmer resource for those.

Going live

The recommended rollout sequence — the same order we'd use ourselves on a fresh server. See Rule engine for what the modes mean.

  1. Stay in observe across all families for at least 24 hours. Skim the verdicts in the dashboard. If nothing flags on traffic you trust, you're good.
  2. Move Anti-VPN to score first, with a conservative threshold. Watch for a few days.
  3. Move to enforce for the verdicts you're confident about — most operators start with datacenter and tor, leaving residential_vpn on score.
  4. Backdoor-scanner and Server-analytics findings should always be reviewed manually. Don't auto-act on them. Wire the dashboard high-risk alert into a private operator Discord channel.