A standalone Velocity 3.3.0+ security and maintenance plugin: the five-layer chat filter, violation kicks, timezone-aware daily restarts and a symlink-safe log cleaner — with zero runtime dependencies.
System Velocity (plugin id systemproxy) is a security and maintenance plugin for Velocity 3.3.0+ proxies running Java 21 — and it is standalone by design. The entire product is ten small classes with one shaded, relocated YAML parser as the only bundled library: no database, no Redis, no backend plugin, nothing else to deploy. It filters hostile chat payloads before they reach your backend servers, kicks repeat offenders, restarts the proxy on a timezone-aware daily schedule, and keeps the proxy's own logs from filling the disk. One payment of EUR 5.00 unlocks the full proxy plugin with a permanent license.
Every chat message crosses five filters in a fixed order — null byte → flood → length → Log4Shell → Unicode — and the first filter that objects denies the message before it is forwarded anywhere. The pipeline runs at first priority on the proxy's chat event, which is the whole point of a proxy-side filter: malicious payloads never touch a backend server at all.
| Layer | What it blocks |
|---|---|
| Null byte | Any message containing a null byte (0x00) — the classic packet-crafting trick, denied first in the pipeline |
| Flood | A sliding window over max-messages-per-second × window-seconds messages per player; exceeding it starts a cooldown mute. A zero or misconfigured limit degrades to one message per window instead of locking anyone out |
| Length | Messages longer than max-length (default 256 characters) |
| Anti-Log4Shell | CVE-2021-44228 chat payloads: case-insensitive jndi: matching, nested ${} obfuscation flattened up to four levels deep, dangerous lookup patterns, the payload schemes (ldap://, rmi://, dns:// and more), a >4096-character anti-truncation rule — and console output is sanitized so a blocked payload cannot forge log lines |
| Unicode injection | Zero-width characters, RTL/bidi overrides, control characters (tab, newline and carriage return excepted) and a wider suspicious-invisible set — while normal Persian and Arabic script, standard punctuation and emoji pass through untouched |
Filters feed a per-player violation tracker with per-type breakdowns. The Log4Shell filter kicks after 3 violations with that behavior on by default; the Unicode filter's kick exists but ships switched off (threshold 5). Flood, length and null-byte blocks never kick — they deny the message and move on. When alerts.broadcast is enabled (off by default), staff holding systemproxy.alerts receive a configurable alert with the player and type; placeholders are interpolated after serialization, so a crafted username cannot inject color codes into your staff chat.
Two housekeeping systems run alongside the filter. The daily restart scheduler restarts the whole proxy at a fixed local time in a configurable timezone — default 04:00, Asia/Tehran — with a configurable countdown broadcast, and a reload never cancels an already-running countdown. The log cleaner manages the proxy's own logs/ directory: entries older than the retention window are deleted, a size budget trims oldest-beyond-newest when the folder exceeds its cap, and the cleaner is symlink-safe — it never follows or deletes links, so a bad day cannot cascade outside the logs folder.
Trust is easier when you can test it: /systemproxy test runs six Log4Shell cases (including nested-obfuscation variants) and four Unicode cases through the live filters and prints per-case PASS/FAIL with a summary. After any config change, one command proves the filters still behave exactly as documented — no guessing, no staging environment required.
| Topic | Policy |
|---|---|
| Price | EUR 5.00 one-time — the lowest-priced entry into the Nerotek license ecosystem |
| License | Permanent — one license per proxy |
| Binding | Per-proxy IP and hardware binding through the Nerotek loader |
| Updates | Updates for the current major version included, delivered through the official Nerotek channels |
| Support | Direct developer support, 24/7 on the official Discord server (https://discord.gg/kEPvGp8Yz7) — open a ticket |
Note:System Velocity is standalone: it declares no plugin dependencies and no integration with the backend System plugin. Running both products on one network is a common and complementary setup — see Running Alongside System for what that does and does not involve.
Tip:You can test before buying: the demo network at mc.hypeland.org runs Nerotek products live. The next pages cover installation, configuration (every key documented) and the command reference.