Add NXS provider signalling support

[ziaxzulu]

Geyser can register with a NetherNet External Signalling (NXS) provider and accept connections using admission tokens validated locally. Hybrid mode runs this alongside the existing inbuilt HTTP signalling. Warden is the default provider; operators can supply another endpoint and credentials.

Configuration

signalling: hybrid # inbuilt, nxs, hybrid, none
nxs:
  advertise-addresses: [] # IPv4:port and [IPv6]:port
  token: '' # bearer token or file:/path/to/token
  endpoint: https://agent.warden.cloud
  data: {} # region/pool placement and instance tags

Each field supports a NETHERNET_ environment override, including YAML/JSON lists and maps. Environment credentials are applied after saving and never written into the config file. See provider configuration for examples.

Both listeners inherit Geyser’s effective bind address. Inbuilt HTTP uses the Bedrock TCP port; NXS uses UDP port plus one. Hybrid keeps their startup and cleanup independent. Signing identities are generated automatically and reused, with private NXS state stored in the extension directory. Explicit advertised endpoints supplement discovered bound IPv4/IPv6 addresses.

Provider integration

The extension registers, publishes server status and its native endpoint, renews leases, reports connection outcomes, and drains before shutdown. Credential authority determines whether registration creates a service or attaches an instance to a fleet.

Network’s asynchronous native admission retains the first STUN request while Java validates its token, then answers after acceptance. Established packets stay on the native path. The optional Warden account-claim adapter is isolated from the NXS lifecycle.

Validation

The fresh hosted native build passed all 43 extension tests, pinned Network/native conformance, Java/native probes and packaging/provenance checks on the squashed head 7785594. Tests cover signalling modes, environment overrides, token files and redaction, endpoint selection, identity persistence, status, claims and shutdown.

This history cleanup preserves the previous head’s exact Git tree. Warden delivery PR #50 records the deployment of this same code, including healthy inbuilt/external status and signed NXS readiness. Stock-client gameplay remains unverified.

Provenance and upstream plan

Source	Contribution
GeyserMC baseline 83e12aa	Existing extension and inbuilt HTTP signalling.
Preserved Zulu development history	Provider lifecycle, native host integration, configuration, status/outcomes, optional claim adapter, packaging and follow-up fixes; consolidated into this feature commit.

This aggregate draft remains open against the fork’s upstream mirror. Later GeyserMC submissions can separate provider lifecycle, native endpoint/address discovery, status/outcomes and the optional claim adapter, with dependencies on the corresponding Network integration. Fork build pins and maintained-branch CI stay with the fork. No upstream PR has been submitted. Prepared with AI assistance for maintainer review.