From 430552a0b1b252de00009cb2c33c213f203c1907 Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Sun, 19 Jul 2026 15:01:30 -0500
Subject: [PATCH] fix(minecraft): set enforce-secure-profile=false to bypass
 Mojang WAF block on homelab egress IP

---
 cluster/applications/minecraft/configmap.yaml  | 4 ++++
 cluster/applications/minecraft/deployment.yaml | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/cluster/applications/minecraft/configmap.yaml b/cluster/applications/minecraft/configmap.yaml
index 40e75a3..726bd7b 100644
--- a/cluster/applications/minecraft/configmap.yaml
+++ b/cluster/applications/minecraft/configmap.yaml
@@ -27,6 +27,10 @@ data:
 
   # Auth
   ONLINE_MODE: "true"
+  # Mojang's sessionserver blocks some datacenter/homelab IPs via Cloudflare WAF.
+  # enforce-secure-profile=false allows players to join without mandatory profile key validation.
+  # ONLINE_MODE=true still enforces Mojang account auth — this only relaxes the key signing requirement.
+  ENFORCE_SECURE_PROFILE: "false"
 
   # Whitelist — set to true when ready to lock down the server
   WHITE_LIST: "false"
diff --git a/cluster/applications/minecraft/deployment.yaml b/cluster/applications/minecraft/deployment.yaml
index 8594f80..063b122 100644
--- a/cluster/applications/minecraft/deployment.yaml
+++ b/cluster/applications/minecraft/deployment.yaml
@@ -109,6 +109,11 @@ spec:
                 configMapKeyRef:
                   name: papermc-config
                   key: ONLINE_MODE
+            - name: ENFORCE_SECURE_PROFILE
+              valueFrom:
+                configMapKeyRef:
+                  name: papermc-config
+                  key: ENFORCE_SECURE_PROFILE
             - name: WHITE_LIST
               valueFrom:
                 configMapKeyRef: