Modules
The entrypoint for defining your web interface, such as controllers, components, channels, and so on.
Admin view over player activity and retention: DAU / WAU / MAU, new users,
D1 / D7 / D30 cohort retention and payer conversion, plus a per-day table
for the last 30 (or 90) UTC days. Read-only; the numbers come from
Gamend.Analytics.
Admin view over player blacklists: every block in the system, filterable by the user on either side of it, with force-unblock.
Admin view over the chat word blocklist: CRUD on the filter words, import and
removal of the bundled per-language lists, and a test box that runs a phrase
through the same matcher Gamend.Chat.send_message/2 uses.
Admin view over chat mutes: every mute in the system, filterable by scope and by whether it is still in force, with add and unmute.
The chat report queue: what players — and the word filter — reported, newest first. A moderator claims a report for review, then dismisses it, warns the player, deletes the message or mutes the player; every action resolves the report and can notify both the player and the reporter.
Admin view over the virtual economy: grant/spend against any wallet, and browse wallets and the ledger.
Admin view over friendships: every non-block row in the system — pending, accepted and rejected — filterable by the user on either side and by status, with force-remove (unfriend an accepted pair or cancel a request).
Browse the durable per-run record of lobby state.
Logs, from both sides of the wire.
Admin view over the matchmaking queue: live stats, per-queue depths, and a paginated, filterable ticket list with force-cancel.
Admin view over data retention: the configured per-class windows, what the last sweep pruned, and a manual "run now".
Read-only introspection of the running server: hooks, env vars, protobuf messages, channels and realtime events, the data model (with an ER diagram), plugins and their RPCs, scheduled jobs, advisory lock namespaces, and migration status.
Every declared setting, grouped, with its effective value and where that value came from.
Admin view over object storage: usage summary, a paginated object list with preview and delete, and a direct upload. Backend-agnostic — works the same whether storage is local disk or S3/R2.
Admin LiveView for listing and managing users.
In-memory ring buffer of recent log entries for the admin dashboard.
Admin API for chat moderation: the report queue, mutes and the word filter.
Admin control over wallets: grant/spend against any user's balance and browse wallets and the ledger.
Admin API parity for the admin Push page: list registered device tokens, delete one, and send a push to a user.
Scoped chat mutes, applied by a room's own authority.
Ingest for logs from the game client, and the policy that tells a client what to send.
Read-only wallet access for the current user. Balance mutations are server-authoritative (hooks / admin), never a raw client endpoint.
Health check endpoint for the API.
Terminates unmatched /api/v1/* requests with a JSON 404.
Device push-token registration for the current user. Sending pushes is server-authoritative (hooks / admin) and has no public endpoint.
The one client-facing surface for ready checks.
Read-only view of WebRTC signaling.
GET /api/v1/stats — every public counter in one response, from
Gamend.Analytics.snapshot/0. The per-resource /<resource>/stats
endpoints keep working and read the same cached composition; this one saves
a client six requests. Gated by :public_stats like the others.
Receives local uploads and serves stored objects.
The server's clock, so a client can render in server-time space instead of
guessing from HTTP Date headers, which have one-second resolution.
OpenAPI specification for the Gamend API.
The OpenAPI response shape shared by every /<resource>/stats endpoint.
Plug to assign current_scope from Guardian's loaded user resource.
Handles authentication errors for the Guardian pipeline.
Guardian implementation for JWT-based authentication.
Guardian pipeline for optional API JWT authentication.
Guardian pipeline for API JWT authentication.
A Phoenix.Digester.Compressor that shells out to brotli.
/changelog, rendered from the registered :changelog markdown file.
Format-aware channel push.
Outbound state-update pushes for channels: drop no-op updates, and optionally coalesce bursts into one message.
A tiny runtime SVG loader for hero-style icons stored under
priv/static/heroicons/.
Tracks active WebSocket channel and WebRTC peer connections using a Registry
with :duplicate keys.
The changelog and roadmap pages: one markup, two rendering styles.
Translates the user-facing text stored on quests, leaderboards and tournaments.
Provides core UI components.
The shared renderer for a markdown guide collection: an index and a page.
Error pages for HTML requests.
This module is invoked by your endpoint in case of errors on JSON requests.
Sends the real error page from a controller or a plug.
Encodes realtime channel event payloads as protobuf for sockets connected
with ?format=protobuf (see proto/gamend_realtime.proto, the wire
contract shared with all clients).
Toggles for the public, unauthenticated surface.
Persists all logs to a rotating file so history survives restarts — the
admin log buffer (GamendWeb.AdminLogBuffer) is in-memory only and is
lost on redeploy/restart.
Periodic cleaner for old geo traffic minute buckets.
A module providing Internationalization with a gettext-based API.
Provides translation completeness statistics for a given locale.
Channel for per-group realtime events.
Channel for broadcasting global group list events.
Shared helpers for safely parsing controller parameters.
Serves host-owned content images directly from the endpoint plug pipeline.
Host-owned layout entrypoints and shared layout helpers.
The boot-time configuration derivations every host shares: declared settings turned into the shapes Phoenix, Ecto, Bandit, Swoosh and Pigeon expect.
The canonical supervision tree for a Gamend host application.
How the endpoint is addressed and who may call it from a browser.
Serves the typed icon set as SVG, so an entity's icon_url can point at an
icon we already ship instead of an image someone has to host.
The typed icon set: every heroicon the site ships, as an atom.
Tells search engines a page changed, instead of waiting to be crawled.
Keeps the node-local IP-ban ETS table in sync with the database and the other app instances.
Compatibility facade for the host-owned layout shell.
Public-facing leaderboards view.
Shared helpers for LiveViews.
Channel for broadcasting global lobby list events.
Channel for lobby realtime events.
A host-supplied rule for dropping log events.
Primary :logger filters for crash reports that are noise, not defects.
Raised to render a 404 from LiveViews/controllers — e.g. when a feature
flag (LIST_*_ENABLED) disables a public listing page and it should look
like the page does not exist.
Logging, metrics and dashboard settings.
LiveView on_mount hook that sets the Gettext locale from the session.
on_mount helper for LiveView that ensures :theme is assigned on the
socket. LiveViews can rely on @theme being present whether rendering
via an HTTP request or a websocket socket lifecycle.
LiveView on_mount hook that registers the LiveView process with
GamendWeb.ConnectionTracker when the socket is connected.
This module contains pages rendered by PageController.
Helpers for the host module behind GamendWeb.Plugs.PageMeta.
The one way list endpoints page: parse the window, build the meta.
Channel for party realtime events.
LiveView wrapper that embeds the Godot web export (/game/index.html)
inside the app layout so the navbar is visible.
Plug to serve ACME HTTP-01 challenge files for Let's Encrypt certificate validation.
Redirects every other hostname to the one canonical host.
Widens the browser Content-Security-Policy for the captcha widget, and only while the captcha is enabled.
Stamps the caller's client session id into Logger metadata for the rest of
the request.
Reads the phx_theme cookie (set by the client-side theme switcher) and
assigns :color_mode so that the root layout can render the data-theme
attribute server-side, preventing a Flash of Unstyled Content (FOUC) when
the user has selected dark mode.
Runtime CORS plug that delegates to Corsica using values read from
application environment at startup. This allows PHX_ALLOWED_ORIGINS
to be configured at runtime (via config/runtime.exs).
Plug that gates routes behind a GamendWeb.Features flag.
Redirects plain HTTP to HTTPS when GamendWeb.Tls's :force is on.
Adds Cross-Origin headers required by Godot 4 web exports.
Resolves the client's country and stores it on conn.assigns[:country].
Serves the IndexNow key file that proves we own this host.
Plug that blocks requests from banned IP addresses.
Plug that assigns the resolved theme map into conn.assigns.theme so
templates and LiveViews can render provider-driven copy alongside the
host-owned branding assets.
Handles the optional locale prefix in the URL path (e.g. /es/about).
Authentication for the /metrics endpoint.
Assigns per-page SEO metadata so the root layout can render a <meta name="description"> that is unique to the page.
Plug that rate-limits incoming HTTP requests per client IP.
Extracts the real client IP from proxy headers and sets conn.remote_ip.
A plug that logs the total request duration at the end of the request. This runs before the Router and captures the entire pipeline duration.
Ensures the current API request is performed by an admin user.
Sets baseline security headers on every response.
Serves .well-known files with strict headers from the configured static app.
The online / idle / offline dot, shared by every surface that lists a user.
Shared hero-and-sections page renderer for host presentation pages.
Prometheus metrics exporter using PromEx.
Custom PromEx plugin exporting cache-effectiveness and overload metrics.
Custom PromEx plugin that exports geo-traffic Prometheus metrics.
Public-facing quests page.
Rate limiter facade used by GamendWeb.Plugs.RateLimiter, LiveView
helpers, and channels.
Node-local rate limiter backend powered by Hammer's ETS backend.
Redis-backed rate limiter backend powered by Hammer + Redix.
Tuning for outbound realtime state updates.
Registry of every server→client channel event.
/roadmap, rendered from the registered :roadmap markdown file.
Route macros a host app mounts to get the server's HTTP surface.
Data providers for the admin Runtime page (/admin/runtime).
Computes Subresource Integrity (SRI) hashes for static assets.
A batch upload: the run, and the lines collected since the last flush.
One line from a game client.
What the server wants collected. The client gates its own uploads on this, so verbosity is a server-side decision that needs no new build to change.
What the server did with a batch.
The run a batch belongs to. Sent with every batch so the server can create the session on first contact without a prior handshake — a client that has to register before it can log cannot report a failure that happens before it registers.
Error response schema
Health check response schema
Describes the payload stored in OAuthSession.data when a session completes or errors.
Schema describing the response for OAuth session status checks
Shared JSON payload serializers used by API controllers and channels.
Channel for WebRTC signaling relay.
Stores rendered sitemap XML on Gamend.Storage so a request serves bytes
instead of rebuilding them.
Truthful <lastmod> dates for sitemap entries, from content hashing.
The host's answer to "which pages exist, and what is on them".
Rendering a <urlset> or a <sitemapindex>: the parts no host varies.
Public server activity page — the browser view of the /<resource>/stats
endpoints.
Native HTTPS, served directly by Bandit.
Public-facing tournaments view, laid out like the leaderboards page.
The two-step upload every icon and avatar endpoint shares.
Helpers for session / cookie based authentication and LiveView mounts.
Channel for sending per-user realtime updates (e.g. metadata changes).
User settings page: a thin coordinator that renders the tab navigation and
routes events to the per-tab modules under
GamendWeb.UserLive.Settings.* (account, friends, groups, payments,
data). Each tab module owns its template, events, and helpers.
Account tab of the user settings page: template, events, and helpers for email/password/display-name management, provider linking, and account deletion.
Data tab of the user settings page: the user's key-value entries with pagination and key filtering.
Devices tab of the user settings page: the devices registered for push notifications, with removal. View + remove only — a token row has nothing meaningfully editable (token/platform/provider are facts about the device).
Friends tab of the user settings page: friend requests, blocking, user search, and the paginated friends/blocked lists.
Groups tab of the user settings page: my groups, browsing/joining, invitations, join requests, and per-group management (members, roles, editing, notifications).
Items tab of the user settings page: the user's inventory item stacks with
quantities and per-stack metadata, paginated. Read-only — inventory is
server-authoritative (see Gamend.Inventory).
Payments tab of the user settings page: purchase history, entitlements, downloads, and Stripe subscription management.
Wallet tab of the user settings page: the user's virtual-currency balances
and a paginated ledger of every credit/debit. Read-only — balances are
server-authoritative (see Gamend.Economy).
Manages a server-side WebRTC PeerConnection for a single user.
Mix Tasks
Rehashes every page the host's GamendWeb.Sitemap.Source reports and moves
the <lastmod> date only for those whose content actually changed.
Exports every translation for a locale to one CSV, for review in a spreadsheet.
Imports reviewed translations from a CSV back into the PO files.