Holofed Godot client/server

This is main part of Holofed project - experimental virtual world platform, which wants to be as libre as possible (that's why I picked Godot as game engine) and have ActivityPub-based federation support.

WARNING!

Although master server part has encryption support via HTTPS (depending by WSGI server) and PGP (latter required by ActivityPub), game server is only partially protected. ENet UPD (used for actual multiplayer) is protected with DTLS (enabled by default), but HTTP TCP (used for map serving) is not. MITM attacks are still possible while downloading the map. You have been warned.

You can also provide custom key and certificate by placing custom.key and custom.crt into %godot_user_folder%/cert. Both files have to be present, otherwise server will generate self-signed key and certificate for the time of hosting the instance.

As of now, scripts in both avatars and maps are loaded "as is". Untrusted scripts are effectively sub-programs, and they can do nasty things! Some sort of sandbox may be implemented in the future.

Unless you're on Windows or Linux, login token is stored in plain text inside user folder. While it's okay on Android and (potentially) visionOS (iOS), it's extemely insecure on MacOS or Web (although latter two have limited or no support).

Also it's mostly WIP (Work In Progress), and mostly only core features are implemented. It's being done in my spare time, amount of which is unstable.

If you're on Linux, ffmpeg must be installed system-wide to make playing videos possible from Youtube, Vimeo, PeerTube etc.

Currently implemented

• basic desktop/VR locomotion (WASD/left controller stick for movement, Space/right controller X to jump, mouse to turn around, right controller sitck for snap turning)

• VoIP (V/left controller A to toggle mute)

• Basic object interact (E/controller trigger to interact)

• Basic object grab (E/controller grip to toggle grab)

• Downloading map from the server (with MD5 and name checks to download only when needed)

• Connection to master server (instance browser, optional login to access non-public instances, creating instances)

• Direct connect (allows to use this part as standalone program)

• CLI launch parameters (custom ones along side Godot ones, used primarily by master server to launch instance in dedicated mode)

• Offline viewer mode (launched with --viewer argument or from "Browse local maps" button in login screen). On Web build, it's the only mode available

• Encryption of game server (DTLS)

• Automatic forward ports with UPnP

• Avatar system (7 built-in ones + ability to load custom ones from Relay)

• Basic support for standalone VR Android headsets (such as Quest, Pico etc.)

• Saving settings and login token (in secure way where possible)

• TV (Video player) with 3d sound and online videos/streams support (native builds only; Youtube, Vimeo, PeerTube etc. are NOT SUPPORTED on standalone builds; streams are not supported for macOS as well)

• Traditional chatbox system

• SST-based chatbox (GPU-accelerated Whisper running locally). Hidden by default, processing is disabled on low-end devices by default, all of that can be changed in settings.

• Instance-togglable "cheats" (only noclip for now)

Nearest plans

• Improved locomotion/character controller

• Asyncronous map loading

• Portals system (semi-seamless)

• Calibration system for full body tracking (VRChat-like)

• Either add SSL encryption for HTTP (map) server or swap it with WebSocket.

Contributing

How to contribute

Join the tapafon's project Space on either or . Both communities are bridged, so you won't miss anything - feel free to choose!

Forgejo is invite-only for now, that may change in the future.

Contributions mean not just PRs and issues, but also participating in WAN tests and discussing potential ideas.

(gen)AI policy

All generative models are enhanced autocompletes, which can only predict what human COULD make (pattern-based), mostly limited to whatever was in their dataset (which may include copyrighted/patented/illegal data) and therefore mostly stuck in the past. However, significant amount of people overestimate their capabilities and start to misuse them, to the point they speedrun . That includes delegating whole projects to AI agents, with little to no human testing, manual fixes etc. Windows 11 is the most famous result of that.

To reduce any new harm made by genAI:

• Generating CSS styles, images (including logos), music, videos, 3d models, shaders, issues, pull requests is banned whatsoever;

• Direct code generation (copy-paste of large code chunks or entire *.gd files written by AI chatbot, see clause below for AI agents) is banned;

• Usage of agentic LLMs (so-called AI agents, such as Codex or Claude Code, or even OpenClaw with local model) is banned whatsoever;

• Delegating something to LLMs without any monitoring, testing, doublechecking by external sources or manual edits is banned as well;

• Local LLMs can be used, running on your GPU/NPU/CPU in something like LM Studio or Ollama. That means that any usage of Gemini, ChatGPT, Claude or other cloud models is banned whatsoever, so is using rented cloud VM (which includes but doesn't limit to Google Collaboratory) to run LLM for you;

• Any remaining usage of LLMs not covered by rules above (brainstorming, translation etc.) is discouraged. Try to prefer alternatives (such as human-made tutorials, actually thinking, discussing idea in Matrix/Discord etc.) when possible;

• SLOP-LEVEL CONTRIBUTIONS WILL BE REJECTED REGARDLESS WHO/WHAT MADE THEM.

TL;DR Usage of generative AI is mostly banned, and parts which aren't are extremely limited.

If I wanted to vibe-code the entire project, I would do that on the day one.

This policy is subject to change, depeding on current situation.

Why not full anti-AI?

Because this project was not written from scratch, but using plugins and frameworks (to speed up development and rely less/not at all on genAI. If you want "not at all" quicker, see Discord/Matrix servers above).

Some of those plugins and frameworks are "tainted", some have strict anti-AI policy, some are uncertain. What's worse is Godot itself, Python itself are "tainted". And, what's worse, Linux kernel itself is "tainted" too (and, therefore, all Linux distros go along).

Fixing all of that goes out of scope for this project. Switching to forks or alternatives might require removing/rewriting certain features or HoloFed as a whole. I could paste long thoughts about all of this, but this file is already too long, and that deserves Fediverse thread or even full-blown article on my website. If you still want to discuss, you already know where to go.

Installation/upgrade/development

For initial install (depending on platform):

• Unpack Windows.zip or Linux.zip on PC

• Unpack Web.zip and then copy to your web server. The latter one should be properly configured, like such: https://gist.github.com/nisovin/cf9dd74678641fb70902866c79692b17

• Install HoloFedPrototype *.apk, where * stands for your headset. Q1 stands for Quest 1, Q2+ - Quest 2 and newer, others should be obvious.

Then launch executable on PC, index.html (where you unpacked) on Web, or application in standalone headset.

For upgrade, reunpack zip folder over older one or install *.apk file again.

For development, cloning repository and opening the project in Godot editor should be enough.

How to create/port a map for HoloFed

See , as well as TestScene.tscn for reference. *.tscn, *.pck files and folder with resources must have the same name.

Than export the project (ideally only ExternalMaps folder) as *.pck file, and put it into %godot_user_folder%/maps. All neccesarry folders will be created automatically on launch if missing.

How to create/port an avatar for HoloFed

See built-in avatars for reference. Then use as a starting point.

Export project (ideally only ExternalAvatars folder) as a *.pck file. Upload it into Relay with your web browser.

Credits

This software uses FFmpeg code licensed under the GPLv3. You can get the source code for this version of FFmpeg here: https://github.com/EIRTeam/EIRTeam.FFmpeg

Other addons are licensed under the MIT License (some components of them may have different licenses), with notable exception of Kenney Prototype textures (CC0).

"Humanoid Avatar with Rig" (https://skfb.ly/otUFC) by 3DStory is licensed under Creative Commons Attribution (http://creativecommons.org/licenses/by/4.0/).