Your Asbern Box

Asbern is hosted by us. There is no copy of the bot for you to run yourself.

• The casino and Pokémon are free, and need nothing but adding the bot to your server.
• Everything else is included too: every feature, in every server, with no card needed.
• Your Asbern box is the only part that runs on your own machine. It is included too, and it connects your own Plex and your own game servers to the bot.

What the Box Is

The bot lives in a datacentre and your machine does not. The box is what connects the two: a few Docker containers on the machine that runs your Plex and your games, so Plex, music, game servers and the watch party work from Discord.

• asbern-agent looks after the rest. It is the only Asbern container that holds Docker's socket, it has no network of its own, and it only ever makes containers from a short, fixed list of shapes.
• asbern-companion keeps the link to Asbern open and answers Discord's requests. It has no access to Docker at all: when something has to be started, it asks the agent.
• Your game servers (game-…) and the watch party, which the agent makes when you ask for them in Discord.
• asbern-portmap, only while Router ports is on: it asks your router to open a game's player ports while that game runs, and closes them when it stops.

You never open a port for the box itself. It dials out to Asbern and keeps that connection open, the same way a VPN client does. Commands travel back down a connection your machine opened.

Each container is a standalone container, never part of a compose project, so redeploying something else on the same machine cannot sweep them away. To stop Asbern, stop asbern-agent and asbern-companion: the companion keeps its own link to Asbern, so with only the agent stopped Discord still shows your box connected and everything it asks fails. Router ports your box opened close by themselves within about 10 minutes of the agent stopping; press Close all now first to close them at once. Your game servers keep their own containers.

Get It

1. In Discord, open /menu › Other › Admin › Box and press Pick on where it will run: Unraid, Synology, Proxmox / Linux, Windows or Mac.
2. Choose Router ports: On or Off (below). The line you copy carries the choice.
3. Copy the line the card shows and paste it on that machine. Each section below says where to paste it. The line works once, for 60 minutes; New line makes a fresh one and stops the old one.
4. Leave the window open until it says Paired, then press Check again. The card turns into Your box is online, and from there you link Plex, add game servers and turn the watch party on. Music is on by default; it plays once your box is online with Plex linked and a music library in Plex, and Music under /menu › Other › Admin › Media switches it off.

The line carries a one-time pass for your server, so it is only ever shown on a card only you can see. Never paste it into a channel. This page only ever shows its shape, <line from Discord>.

What the line does: it downloads Asbern's install script from this website (/install/<version>/install.sh, or install.ps1 on Windows), checks it against the checksum written into the line, and only then runs it. On Windows it runs inside your PowerShell window and writes no file. The script checks that Docker is there and fits, fetches Asbern's images from Asbern's own private registry by their exact fingerprints, starts the agent, and pairs it with your server. It never asks for your Discord or Plex password.

Router Ports: On or Off

The Router ports row sits above the line, and the install script prints the same sentence:

While a game server you create runs with Friends outside can join, your box asks your router to open that game's player ports, and closes them when it stops. Friends then connect straight to your home's internet address, and while it runs a name for that server can point at that address in public DNS; our DNS provider keeps a log of the addresses we set. Turn it off any time on the box: docker exec -it asbern-agent asbern ports off.

• It starts at Off on any platform where Asbern has not yet proven its safety rule (below); you can still turn it on there. In a terminal, the script asks Open game ports on your router automatically? with the same answer already chosen, and Enter keeps it. Where there is no terminal (Synology's Task Scheduler), the line's choice stands.
• The safety rule. Before it opens anything, the box puts a rule on the machine so that no game server, and no mod inside one, can ask your router to open ports by itself. If the rule cannot be put in place, the box opens nothing and says so; you can still forward ports yourself. Where it can never run on that computer, its games wait too, until an admin presses Start without it on the Safety rule row of Box › Check, which says the risk first. That is kept for this box only.
• Only the box can turn it back on: docker exec -it asbern-agent asbern ports on. Discord can close ports but never open what the box closed. Close all now, on the Router ports row of your box's Status, closes every port it opened and takes every server name down at once.
• What friends then see, and what to do when your router says no: Friends Join Automatically.

On Unraid

You need Docker switched on (Settings › Docker) and the array started.

Open your Unraid page and press the >_ terminal button, top right. It runs as root, so there is no password. Paste the line, press Enter, and leave the window open until it says Paired.

The box keeps your game servers' folders under /mnt/user/appdata/asbern.

Its Page, From Another Computer

Unraid has no browser of its own. Switch SSH on (Settings › Management Access), then on your own computer run ssh -L 8420:127.0.0.1:8420 root@<your Unraid's address> and leave it open while you use the box's page.

On Synology

You need Container Manager, and either SSH or the Task Scheduler. The card gives two lines:

• With SSH: turn it on in Control Panel › Terminal & SNMP, sign in as an administrator and paste the first line. It asks for that password once.
• Without SSH: Control Panel › Task Scheduler › Create › Scheduled Task › User-defined script, user root. Paste the second line, press Run, then delete the task, so the line does not stay on the NAS.

The box keeps your game servers' folders under /volume<N>/docker/asbern, on the first volume with a docker shared folder.

Its Page, From Another Computer

With SSH on, run ssh -L 8420:127.0.0.1:8420 <your administrator>@<your NAS's address> on your own computer and leave it open while you use the box's page.

On Proxmox or Linux

You need Docker Engine (the docker-ce packages) on a virtual machine, an LXC container or bare metal. Open a shell on the machine that runs Docker, never the Proxmox host itself, and paste the line. It asks for your password if you are not root.

• Rootless Docker is not supported, and the script says so before it changes anything.
• Docker Engine inside WSL is refused: on a Windows PC, use Docker Desktop (below).
• Docker Desktop for Linux is refused too. Its virtual machine hides your network from the box, so install Docker Engine instead.
• A firewall on the machine that filters forwarded traffic (a DOCKER-USER rule, firewalld or an nftables forward policy) can stop friends reaching a game after your router let them in. Check says so if it happens.

The box keeps your game servers' folders under /opt/asbern: the line runs the script as root, through sudo when you are not. Someone in the docker group with no sudo rights gets ~/asbern, which the box then owns.

Its Page, From Another Computer

On a machine with no desktop, run ssh -L 8420:127.0.0.1:8420 <you>@<the machine's address> on your own computer (for a Proxmox VM or LXC, its own address, not the host's) and leave it open while you use the box's page.

On Windows

You need Docker Desktop, set to start when you sign in. If you switch that on after setting up, run docker exec asbern-agent asbern autostart on, so Check knows: nothing in a container can read that setting.

Docker Desktop must be running. Open PowerShell, not as administrator. Paste the line and press Enter. It writes no file, and your window stays open.

Windows Firewall. The script reads what Windows Firewall really does on the network you are on, and says it in words before Windows asks anything:

• On a network Windows treats as Private (or a work domain), it adds one rule that lets in only Asbern's game ports, for Docker only. Windows asks for permission once.
• On a network Windows treats as Public, it adds nothing unasked. It offers three answers: mark this network Private (recommended, if it is your home network), allow game ports on every public network this PC joins, or neither, in which case friends outside cannot join while the PC is on that network.
• An old Block rule for Docker, a firewall your organisation manages, or another firewall program is named with its own fix. A Block rule is removed only if you say yes.

The box keeps everything, game servers included, inside Docker's own storage, so there is no folder to look after.

Its page opens on the PC itself, at the address in its log (below).

On a Mac

You need Docker Desktop and Terminal. Docker Desktop must be running. Open Terminal, paste the line and press Enter.

The box keeps your game servers' folders under ~/Asbern. Its page opens on the Mac itself.

When Your Home Network and Docker Disagree

A Docker network on the machine that uses the same addresses as your home network cuts your games off from your router and from your other devices, without any error. The box checks for it:

• When you install, the script compares Docker's networks with your home network before it fetches anything. An unused network that is not Asbern's is removed only if you say yes in the terminal. One that a container uses is named, and never touched.
• Later, Check, under /menu › Other › Admin › Box, has a Docker networks row that says which network it is. If nothing uses it, Remove it asks once, and your box checks again before removing it: it refuses a network that a container uses, that belongs to Asbern, or that no longer clashes. If something does use it, the row names the project it belongs to: give it another range of addresses there, or remove it yourself when you no longer need it.

Asbern's own networks are given addresses away from your home network's when they are made.

The Box's Own Page

The box has a small page of its own, at http://127.0.0.1:8420 on the box itself and nowhere else: not on your home network, not on the internet. You need it only to put a backup back, for Seerr, and for anything else Discord's card sends you to it for. Everything else happens in Discord.

Its address, with the key it needs, is in the box's log: run docker logs asbern-companion and open the address that ends in ?k=. On a machine with no browser of its own, open it through the SSH tunnel from your platform's section, on your own computer.

Values Only the Box Should Know

Some games need a value Discord should never carry, such as Valheim's server password. Set it on the box, where it stays:

docker exec -it asbern-agent asbern secret set <server> <NAME>

It asks for the value without showing it. Set it before you create the server, under the name Add a server shows, and the server has it from its first start. A server made without it runs without it until you set it and restart the server. docker exec -it asbern-agent asbern secret list <server> says which are set, never what they are.

Updates

The box updates itself. A new version arrives signed, and the box fetches it by its exact fingerprint from Asbern's registry, waits for a quiet moment (never in the middle of a screening), and puts the old version back if the new one does not come up healthy. Your box's Status in Discord shows its version, and an update that is waiting and why. Each of its containers is labelled so that auto-updaters such as Watchtower leave it alone: an updater would otherwise replace it with whatever it finds under the same name.

Linking Plex

You never copy a token out of Plex. On your box's card, press Link Plex, then Open Plex to approve: Plex's own sign-in opens, on a phone too, and you approve your box there. The card finishes by itself, and the sign-in stays on your box. Media Server Setup has the rest.

What Your Box Will Do When Asked

Asbern names a request; it never sends a command. The box looks each name up in its own short list and refuses anything else. It reports what it finds, makes a game server from Asbern's vetted list (each game pinned to one exact image), starts and stops the game servers it made or that you linked, reads who is playing, backs them up, opens their player ports where you allowed it, and runs the watch party and music. It never receives a folder, a file or a command from Discord, and it never gives a game server Docker's socket.

Removing It

Remove, on the Box screen, first shows what it will do. It closes every router port the box opened, takes every server name down and unlinks your box, so it can no longer be used from Discord. Your game servers, their folders and Plex are kept. Then it shows the line that takes Asbern off the machine; run it there.

Removing it completely. That line takes off Asbern's own containers and nothing else, so your game servers and their worlds stay, and so does every volume Asbern made. To delete those too, in this order:

1. Back up any world you want to keep.
2. Remove each game server the box made: docker rm -f game-<name>.
3. Remove every volume Asbern made (each one's name starts with asbern-): docker volume rm $(docker volume ls -q --filter name=asbern-). On Windows that includes asbern-gamedata, where every game's data lives, and asbern-root, where its backups are.
4. On any other machine, delete the box's folder too (each platform's section above names it).

Set up Before 0.8.0?

If you linked the companion before Asbern 0.8.0, it keeps working: your linked Plex, Watch and game servers carry on. To move to a box, press Remove under /menu › Other › Admin › Media, take the old companion off the machine (its container in Docker; on a Windows PC, Asbern Companion in Settings › Apps, which closes any router ports it opened), then get a box as above.

An older game-server setup that put a gate and a socket proxy in front of Docker is no longer needed: the install script leaves it alone and says you can remove it.

Troubleshooting

The line says it has expired, or has already been used. A line works once, for 60 minutes. Press New line for a fresh one.

Check again says your box is not paired yet. Leave the window you pasted into open until it says Paired. If it stopped with a reason, it says what to fix, and New line gives you a line to run again.

The card says the box installer is not published yet. It is not open for your server yet, and nothing on your machine changes that. Check back after the next release.

The script says Docker is not running. Start Docker Desktop (Windows, Mac), or Docker on your NAS or Linux machine, and paste the line again.

Your box stopped answering. The machine is asleep, off or offline, or, on Windows and a Mac, Docker Desktop is not running. It reconnects by itself when it can, and your game servers are not counted as empty while it is away.

Friends cannot join a game. Friends Join Automatically lists every answer Check can give, with its fix, and Forward Ports on Your Router is the manual way that always works.

What it Costs

Nothing. Asbern is free. The hosted bot, its updates, support and your box are all included, along with everything the box connects.