Storage and networks

One server

Nothing to do. Enrolments, recovery codes and remembered devices live in the plugin's own folder.

storage:
  type: yaml

A network

Set every server to the same database and an enrolment done once is known everywhere. A player sets up on the lobby and is not asked to do it again on survival.

storage:
  type: mysql
  host: 10.0.0.5
  port: 3306
  database: emberlock
  user: mc
  password: "secret"
  ssl: false

The driver is probed across MySQL 8, MySQL 5 and MariaDB, so it works with whatever your host provides. Tables are created on first start.

It fails closed

If MySQL is configured and cannot be reached, logins are refused, not waved through.

That is the correct behaviour for a security plugin and it is worth stating plainly, because the alternative is worse than having no plugin at all: an attacker who can knock over your database would otherwise walk straight past every second factor on the server. If the database is down, so is the door.

Plan for it the way you plan for the database going down generally. The failure is loud, in the console, on every attempt.

What is stored

TOTP secret	The shared secret the app needs. Required to verify a code at all.
PIN	Salted hash. Never stored readable.
Recovery codes	Salted hashes. A used code is marked dead.
Remembered devices	A hash of the address, plus when it expires.

Nothing here is a Minecraft password, because there is no Minecraft password to store: Mojang does the authenticating and this plugin adds the second step.