Weered
State of the project (September 2026): public beta, source-available.
The whole platform is on GitHub under the Elastic License 2.0. The Minecraft
mod and the shared types package are MIT. Read it, build it, self-host it,
send patches. The one thing you cannot do is resell it as a hosted service.
See LICENSING.md.
Run it through SonarCloud, CodeRabbit, or whatever you trust. The architecture
is opinionated, the business logic is server-side only, and it ships most days.
Constructive teardowns are welcome. See Code quality below.
Real-time community platform for gaming: lobbies, rooms, crews, presence, and game-aware modules. A modern take on the MPlayer-era game lobby (1996), rebuilt for 2026.
weered.ca · About · Desktop
What it is
Weered organizes communities around what people are actually doing. Open it and you land in a lobby or a room with other people present. You can see who's on Steam, Xbox, PlayStation, or Twitch, co-watch a stream, run a Destiny 2 raid LFG, hold a poker night, paper-trade against your crew on FakeOut, or track the Helldivers 2 galactic war together. Each game gets a lobby wired to that game's own live data.
The look is deliberately dark and cinematic. The model is the MPlayer lobby: show up, see who's around, play together.
Features
The game modules further down sit on top of a full community platform. The core surface:
Presence and social
- Cross-platform presence: see who is live on Steam, Xbox, PlayStation, and Twitch
- Friends, profiles, and an activity feed
- Crews: persistent groups with their own chat, roster, roles, and moderation tools
Real-time rooms
- Voice rooms on LiveKit, with a join queue and a listen-only mode
- Camera video and screen sharing in any room
- A shared real-time canvas, used for the built-in tabletop: map tokens, fog of war, and NPC encounters
Messaging
- Lobby, room, crew, and direct messages, plus group DMs
- Reactions, mentions, and a flair cosmetic system
- Image and file attachments (perceptual-hash blocked and blur-tiered for safety), plus GIFs via Tenor
Moderation and safety
- Per-lobby roles and moderator tiers; every permission is checked server-side
- Automod rules, member reports, a ban-appeal court, and full audit logs
- Notoriety-gated abilities: new accounts earn trust before they can post media or host lobbies
Notifications
- In-app notifications and web push (VAPID)
Communities and events
- Lobbies (each wired to a game module), rooms, crews, and forums with their own moderation
- Forums with threaded replies, images, emoji and link previews in every composer
- Scheduled events and API-verified tournaments (for example, Destiny 2 PGCR scoring)
- start.gg integration: a lobby follows an organizer, tournament or league; brackets,
entrant lists, venue and the stream queue land in the lobby. Members link their own
start.gg accounts so a lobby can see who is entered, and TOs can connect via organiser OAuth
- Station board: which setup a match is on and what is queued next — the venue floor
rather than the bracket, because that is the part running events actually lack
Game servers
- Our own server aggregate built on Steam's master list and the A2S query protocol, kept with
polling history — a live snapshot cannot answer the question a community actually has
- Hell Let Loose and HLL: Vietnam units link their own box over RCON (second-generation
wire protocol, implemented from the published spec rather than wrapped) for live match state
and a live roster
- Muster: drill attendance read straight off the unit's server — a roll of in-game names,
no accounts to create
- Seeding rally board, for the 0-to-40-players problem that decides whether a server lives
Economy
- Two earned currencies, Notoriety (reputation) and Paper (spendable), drive a closed loop: store items, bounties, tournament buy-ins, and tips. See Paper economy.
Clients
- Web at weered.ca, a Tauri desktop app (~5 MB, Windows and Linux), and a mobile app in progress on Expo.
Architecture
apps/
web/ Next.js 15 - primary client at weered.ca
api/ Fastify 5 + Prisma + WebSocket - single source of truth
mobile/ React Native 0.83 + Expo SDK 55 - iOS + Android
desktop/ Tauri 2 + Rust - native shell around the web client
mod/ Weered Connect - Fabric mod (Minecraft 1.21.x), shipped via Modrinth
packages/
shared/ TypeScript types + constants shared across clients
.github/
workflows/ CI - cross-platform desktop release builds
┌──────────────────────────────┐
Steam / Xbox / PSN │ CLIENTS │
Twitch / Bungie / Riot │ web mobile desktop mod │
EVE / PoE / Helldivers │ │ │ │ │ │
presence + └───┼───────┼────────┼──────┼──┘
game data │ HTTPS (REST) + WebSocket (cookie auth)
▼ ▼ ▼ ▼
┌────────────────────────────────────┐
│ apps/api (Fastify 5) │
│ ALL business logic lives here: │
│ permissions · scoring · paper │
│ economy · lobby state · notoriety │
│ routes/* · sockets/* · lib/* │
└───────┬───────────────────┬─────────┘
│ │
Prisma ▼ ▼ LiveKit
┌──────────────┐ ┌──────────────┐
│ PostgreSQL │ │ voice / video│
└──────────────┘ └──────────────┘
Edge: Caddy (TLS + CORS allowlist) · Process mgmt: PM2 · Errors: Sentry
The architectural rule: business logic lives in the API. Permissions, scoring, the paper economy, friend logic, lobby joining, notoriety. Every rule is server-side, decomposed across apps/api/src/routes/*. Clients render and submit; they never decide.
See DEVELOPMENT.md for the full repo guide: per-client release cadence, deploy procedures, and gotchas.
For the deliberate single-node scaling posture (and why horizontal WS scaling is intentionally deferred), see SCALING.md. Ops and disaster recovery: RUNBOOK.md.
Stack
- Backend: Fastify 5, Prisma + PostgreSQL, WebSockets, LiveKit (voice/video). Type-gated (
tsc --noEmit clean) and esbuild-compiled to dist/ for production. Single-node by design (see SCALING.md); Redis pub/sub is deliberately deferred, not in use.
- Web: Next.js 15.5, React 19, TypeScript.
- Mobile: React Native 0.83, Expo SDK 55, expo-router, NativeWind, TanStack Query, Zustand.
- Desktop: Tauri 2, Rust, native OS webview (~5 MB installer).
- Auth: httpOnly-cookie sessions; Google OAuth, Bungie.net OAuth, and local username/password.
- Presence: Steam Web API, Twitch Helix, Xbox / PlayStation.
- Payments: Stripe (paid tiers: Indicted, Felon, Kingpin).
- Observability: Sentry (web + api), PM2 (process management).
- Hosting: DigitalOcean droplet behind Caddy (edge TLS + CORS).
Modules
Each lobby can opt into a module that wires it to a specific game or activity:
| Module | What it adds |
|---|
BUNGIE (Destiny 2) | Bungie OAuth, Guardian/loadout lookup, raid LFG, API-verified tournaments (PGCR scoring) |
RIOT (League of Legends) | Summoner lookup, ranked leaderboards, rotation tracker |
EVE (EVE Online) | Capsuleer sheet, killboard, sovereignty, market, new-pilot tools |
POE / POE2 (Path of Exile) | Live Currency Exchange economy, ladder, rendered passive tree, build inspector; poe2scout prices for PoE2 |
HELLDIVERS2 | Galactic-war tracker, Major Orders, war map, stratagem + loadout tools, squad finder |
CHESS | Lichess + Chess.com account linking, API-credited challenges, co-watch board |
TRADING (FakeOut) | Paper trading on a live Binance feed, TradingView charts, leaderboards |
WINDROSE | Bounty board (PvE objectives), hunter dossiers, crew tools |
POKER | LiveKit table, Texas Hold'em with paper buy-ins |
MINECRAFT | Weered Connect Fabric mod links in-game state to the lobby |
FORTNITE | Item shop, stats, news |
HLL / HLLV (Hell Let Loose, + Vietnam) | A unit links its own server over RCON: live match state, roster, Muster drill attendance, seeding rally board |
BAR (Beyond All Reason) | Linked BAR accounts, live battles board, and a match launcher inside the room |
DIVISION2 | Ubisoft server status, Ops Board intel feed, operator sit-reps, field resources |
ASSETTOCORSA | Live grid and session board read from each AC server's own public API |
COWORK | The lobby for solo operators: one worldwide 50/10 focus clock, plus a public day board |
Plus lighter topic/content modules: CS2, DOTA2, PUBG, MLB, PGA, MTG, MARATHON, DND, STUDY, NEWS, REDDIT, TWITCH, YOUTUBE, HEADQUARTERS, and CUSTOM.
Paper economy
Closed-loop virtual economy:
- Notoriety: reputation/XP, accrued via activity (chat, room joins, hosting, daily login). Drives a rank ladder and gates what you can do (posting media, hosting lobbies, moderation).
- Paper: spendable currency for store items, bounties, tournament buy-ins, and tips. Earned via activity, never purchasable for cash.
Sits alongside a Stripe-backed tier system (Innocent / Indicted / Felon / Kingpin) for paid features.
Code quality
Continuous analysis runs in CI on every push; the badges above are live.
Security A · Reliability A · Maintainability A · Security Review A: 0 bugs,
0 vulnerabilities, 0 open security hotspots, technical-debt ratio under 0.5%.
A note for anyone running their own scanner, because you should: where a finding
was suppressed instead of code-changed, the reason is committed in
sonar-project.properties for you to read. For
example, the "hardcoded credentials" are test-fixture and CI test-database
passwords (not real secrets), and a few S4325 "redundant" casts are
load-bearing type-narrowing the TypeScript compiler actually requires. Test
coverage is modest and we don't gate on it; we hold the line on the ratings and
zero defects instead.
If you find something real, open an issue. That is the point of going public.
Deploying
Guardrails gate every deploy: the API type gate (tsc --noEmit) must be clean and no source file may exceed the size tripwire (scripts/check.sh). One command:
bash scripts/deploy.sh # guardrails -> web build -> restart both -> smoke test
bash scripts/deploy.sh api # API only: guardrails -> restart api -> smoke test
Runtime: the API is esbuild-bundled to dist/ and run with Node; the web app is next build + next start; both run under PM2 on the droplet. Full procedures in DEVELOPMENT.md.
Local setup, prerequisites, and the dev loop are in DEVELOPMENT.md. Contribution conventions are in CONTRIBUTING.md.
License
Source-available. The core platform is under the Elastic License 2.0
(LICENSE); apps/mod and packages/shared are MIT. The
short version: read it, build it, self-host it for yourself, send patches. You
may not offer it to third parties as a hosted or managed service. Full
directory-by-directory mapping in LICENSING.md.
Security reports: see SECURITY.md. Licensing questions:
[email protected].
Status
Public beta, live at weered.ca. In active development, ships most days. Source-available since June 2026.
Contact
