Rusty Heathens ModGuard

The approved-client-mod guard used by the Heathens' Haven Valheim server.

Install and update

Install ModGuard 0.3.0 on the server and all connecting player PCs using Thunderstore Mod Manager or r2modman.

0.3.0 includes the controller audit component inside this same Thunderstore package. There is no separate Controller Audit package for players to install.

Keep one active copy of ModGuard. Move earlier manually installed/test copies outside BepInEx/plugins.

What's new in 0.3.0

• Bundles a controller/gamepad audit component with ModGuard.
• Reports controller/gamepad product name when Unity exposes it.
• Reports manufacturer, interface, layout, device ID, and vendor/product IDs when available.
• Reports whether controller activity was observed.
• Sends server log lines beginning with [RHCA] CONTROLLER_AUDIT.
• Does not block controllers yet.
• Does not kick players for controller use yet.
• Does not collect controller serial numbers.
• Preserves the existing ModGuard 0.2.2 admission behavior.

Required server policy update

Because the audit component is a BepInEx plugin inside this package, the server ModGuard policy must allow its GUID:

com.rustylasergaming.controlleraudit

Add that GUID to the server's existing AllowedForPlayers list before players connect with ModGuard 0.3.0.

Do not replace your server policy with a generic packaged allowlist. Your existing server config remains authoritative.

Controller audit

When a player joins, the audit reports what Unity/Valheim can actually see. This helps identify an aftermarket or programmable controller before adding an enforcement rule.

The server log can include:

• legacy Unity joystick/controller name;
• Input System display/product name;
• manufacturer;
• input interface/layout;
• device ID;
• vendor/product IDs when exposed;
• controller activity observed during the session.

Limitation

Steam Input, reWASD, JoyToKey, controller firmware, adapters, or similar software may hide the physical controller model by exposing a generic/virtual controller or by translating controller buttons into keyboard/mouse input.

ModGuard can only report what Unity/Windows exposes to Valheim. Client-side reports are diagnostic and are not tamper-proof attestation.

Existing ModGuard policy

The server config remains the only policy source. Use bare BepInEx plugin GUIDs to allow normal version updates. Exact guid@version pins remain available when deliberately needed.

Approved plugins are optional. Unapproved plugins and normal players using admin-only plugins are denied in Enforce mode. Audit logs results without disconnecting; Disabled turns admission checks off.

Changelog

0.3.0 - 2026-10-07

• Added controller/gamepad audit reporting inside the ModGuard Thunderstore package.
• Reports Unity legacy joystick/controller names.
• Reports Unity Input System device details when available: display/product name, manufacturer, interface, layout, device ID, vendor/product IDs.
• Reports whether controller activity was observed.
• Added server log output beginning with [RHCA] CONTROLLER_AUDIT.
• Does not block or kick for controller use yet.
• Does not collect controller serial numbers.
• Preserves ModGuard 0.2.2 approved-mod admission behavior.
• Requires com.rustylasergaming.controlleraudit in the server AllowedForPlayers policy.

0.2.2 - 2026-10-04

• Start admission deadlines when peers are ready for routed RPC.
• Retry client reports until the connected server acknowledges them.
• Snapshot the peer list before enforcement to tolerate disconnects during iteration.
• Change the default timeout to 60 seconds and upgrade the old 20-second default.
• Preserve configured allowlists, admin IDs and intentional pins after the earlier migration.
• Update the package dependency to BepInExPack Valheim 5.4.2351.

0.2.1

• Removed the packaged player allowlist from Plugin.cs.
• Removed the packaged admin-only plugin list from Plugin.cs.
• Removed packaged fallback admin account IDs from Plugin.cs.
• Server com.rustylasergaming.modguard.cfg is now the only policy source.
• Bare plugin GUIDs allow any version so normal Thunderstore updates do not cause version-lock failures.
• Exact guid@version pins remain supported when intentionally configured.
• Kept Enforce/Audit/Disabled behavior, optional approved mods, admin-only handling, duplicate-plugin detection, report hashing, and server-side admission checks.