File manager

Each server's data lives at /var/mcdata/<id> on the host. Inside the container, that path is mounted at /data. The layout matches what itzg/minecraft-server expects: server.properties, world/, plugins/, logs/, and so on.

GET    /api/servers/:id/files?path=/world
GET    /api/servers/:id/files/content?path=/server.properties
PUT    /api/servers/:id/files/content    { path, content }
POST   /api/servers/:id/files/mkdir      { path }
POST   /api/servers/:id/files/rename     { from, to }
POST   /api/servers/:id/files/upload     { path, filename, contentB64, intoDir }
GET    /api/servers/:id/files/download?path=/backup.zip
POST   /api/servers/:id/files/archive    { paths, outputPath }
POST   /api/servers/:id/files/extract    { archivePath, destPath }
DELETE /api/servers/:id/files?path=/world/region/r.0.0.mca

Every endpoint sits behind the ServerOwnerGuard: reads require the subuser FILES_READ permission and mutations require FILES_WRITE (owners and admins always pass). The path query is resolved against the data root with path.resolve and verified to start with the same prefix; anything that escapes is rejected with 403.

Read size

5 MB max for the inline text editor; larger files load truncated. Download the full, untouched file via GET /files/download.

Upload size

100 MB per file (multer limit). Datapacks fit, world archives do not.

Delete root

Refused. DELETE ?path=/ returns 403; use the server delete endpoint to nuke an entire installation.

Most config files (server.properties, ops.json, whitelist.json) only take effect after a restart, with the exception of a few that the server reloads on demand. The panel does not stop the server when you save; do that yourself if you need the change live.