SkyWall CMS

A modern, secure, and multi-core World of Warcraft CMS built for private server operators.

Requirements

Installation

SkyWall CMS features a guided installer that handles database setup, configuration, and core detection automatically.

chmod 775 cache/ logs/ templates/

Nginx Configuration

Recommended Nginx config for clean URLs, security, and the dynamic robots.txt/sitemap.xml:

server {
    listen 80;
    server_name yourdomain.com;
    root /var/www/html;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # Dynamic robots.txt and sitemap.xml
    location = /robots.txt { rewrite ^ /core/seo/robots.php last; }
    location = /sitemap.xml { rewrite ^ /core/seo/sitemap.php last; }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Block sensitive files and directories
    location ~ /\.(env|git|htaccess) { deny all; }
    location ~ \.sql$ { deny all; }
    location ~ ^/(cache|logs|vendor|node_modules|dist|app)/ { deny all; }
    location ~ ^/(core|modules|templates)/.*\.php$ { deny all; }
}

Apache Configuration

SkyWall includes a .htaccess file with rewrite rules. Ensure mod_rewrite is enabled:

a2enmod rewrite
systemctl restart apache2

Configuration

All settings are stored in the .env file at the project root. The installer generates this file automatically. You can edit it directly or use the Admin Panel settings pages.

Core Type

CORE_TYPE=azerothcore    # azerothcore, trinitycore, cmangos, vmangos

Database Settings

DB_HOST=127.0.0.1
DB_USERNAME=root
DB_PASSWORD=your_password
DB_AUTH=acore_auth
DB_CHA=acore_characters
DB_WORLD=acore_world
DB_CMS=skywall_cms

SOAP Settings

SOAP_IP=127.0.0.1
SOAP_PORT=7878
SOAP_USER=gamemaster
SOAP_PASS=your_password

GM Levels

GM levels are defined as PHP constants in core/GmLevels.php (they are not .env values):

GM_LEVEL_PLAYER    = 0
GM_LEVEL_VIP       = 1
GM_LEVEL_MODERATOR = 2
GM_LEVEL_ADMIN     = 3
GM_LEVEL_CONSOLE   = 4

Developer Build (Compiling Tailwind CSS)

SkyWall is distributed in two forms. This section explains the difference and how to rebuild the frontend stylesheet if you are a developer.

Requirements

To compile the stylesheet yourself you need Node.js (LTS) with npm installed on your machine.

Files Involved

package.json                                  # build scripts + tailwindcss dependency
tailwind.config.js                            # Tailwind config (theme colors, fonts, content paths)
templates/skywall/assets/css/tailwind-input.css   # input file (@tailwind directives)
templates/skywall/assets/css/tailwind.css         # compiled output (generated)

Building

npm install

npm run css:build

npm run css:watch

Customizing the Theme

Edit tailwind.config.js to change the brand palette and fonts:

module.exports = {
  content: [
    './modules/**/*.php',
    './templates/**/*.php',
    './core/**/*.php',
    './index.php',
    './install.php',
    './core/migrate.php',
    './Router.php',
    './assets/js/**/*.js',
  ],
  theme: {
    extend: {
      colors: {
        'sky-gold': { DEFAULT: '#FF7E02', light: '#FFC010', deep: '#CC6502' },
        'sky-void': '#07090F',
      },
      // ...
    },
  },
};

SEO, Robots.txt & Sitemap

robots.txt and sitemap.xml are generated dynamically — there are no static files to edit. The domain is detected automatically from the current request, so each installation serves its own URLs without any manual configuration.

How it works

The files are served by two small PHP scripts located in core/seo/:

core/seo/robots.php     # outputs robots.txt
core/seo/sitemap.php   # outputs sitemap.xml

The .htaccess rewrites the public URLs to these scripts:

RewriteRule ^robots\.txt$ core/seo/robots.php [L]
RewriteRule ^sitemap\.xml$ core/seo/sitemap.php [L]

Nginx

On Nginx (which ignores .htaccess), add the equivalent rules to your server { } block:

location = /robots.txt { rewrite ^ /core/seo/robots.php last; }
location = /sitemap.xml { rewrite ^ /core/seo/sitemap.php last; }

Admin Panel

The Admin Panel is accessible at ?page=admin and requires GM Level 3+ (configurable via GM_LEVEL_ADMIN). The sidebar is organized with 5 fixed core items at the top, followed by sortable module items.

Sidebar Structure

Dashboard

The dashboard provides a real-time overview of your server and CMS activity.

Shop Management

The shop system allows players to purchase items, gold, services, and more using in-site currency or real money integration.

Adding Shop Items

Navigate to Admin Panel → Shop Items → Add Item and fill in:

Shop Activity Log

View all purchases with timestamps, buyer info, item details, and delivery status. Failed deliveries show SOAP error messages for debugging.

Donation Management

Manage donation packages, transactions and payment gateways from Admin Panel → Donations.

Packages

Create packages with a name, price, DP amount and optional bonus. For example: Supporter Pack — €10 → 1100 DP (100 bonus). The currency is global and set in Settings.

Settings

Transactions

The transactions log lists every donation with user, package, amount, DP, gateway, reference code and proof. Manual requests (manual_pending) show Approve and Reject buttons — approving credits the DP, rejecting records an optional note shown to the player.

User Management

Manage player accounts, GM levels, bans, and character data directly from the admin panel.

Account Management

• View all registered accounts with email, registration date, and last login
• Edit GM levels via account_access
• Ban/unban accounts by username or IP
• Reset passwords (SRP6 re-encrypted automatically)

Character Management

• Search characters by name
• View character details: level, race, class, guild, location
• Transfer characters between accounts
• Rename characters

Content Management

News

Publish news articles with a rich-text editor (HTML sanitized). Articles appear on the public archive (?page=news) and in the homepage news section.

Site Layout

Manage the homepage sections (hero slider, promos, news, etc.), the navigation menu, hero buttons, and social links. Sections can be enabled/disabled and reordered via drag-and-drop.

Hero Slider Editor

The hero slider content is fully editable from Site Layout → Hero Slider: titles, subtitles and descriptions for guests and members, the background image (template path or full URL), and the Discord / register button labels. It's stored in the settings table and falls back to sensible defaults when empty.

Cache Management

SkyWall uses file-based caching for shop items, server status, and other frequently accessed data.

Template System

SkyWall v3.0.0 introduces a powerful template system that allows you to create, customize, and switch themes without modifying core files.

How It Works

Each template lives in templates/{template_id}/ and contains its own views, assets, and configuration. The active template is set in Admin Panel → Settings.

Live Template Editor

The Template Editor provides a VS Code-like editing experience directly in your browser, powered by Monaco Editor.

Features

• Syntax highlighting for PHP, HTML, CSS, and JavaScript
• File browser sidebar with tree view of template files
• Auto-save with manual save button
• Preview button to see changes in a new tab
• Error detection with inline diagnostics

Accessing the Editor

Admin Panel → Modules → Template Editor. Select the active template and browse files in the left panel.

Template Asset Helper

Use template_asset() in your templates to reference assets from the active template directory:

// In template PHP files:
<img src="">
<link href="" rel="stylesheet">

This resolves to templates/{active}/assets/img/logo.png automatically.

Template Structure

Each template follows a consistent directory structure:

templates/
  skywall/                    
    template.php              
    views/
      index.php               
      header.php              
      footer.php              
      login.php               
      register.php            
      shop.php                
      ...                     
    assets/
      img/
        logo.png              
        bg.jpg                
      css/
        custom.css            
      js/
        custom.js             

template.php

Every template must have a template.php file that returns metadata:

<?php
return [
    'name'        => 'SkyWall Default',
    'author'      => 'SkyWall Team',
    'version'     => '3.0.0',
    'description' => 'Default dark theme with gold accents',
];

Creating Custom Templates

mkdir templates/mytheme

cp -r templates/skywall/views/ templates/mytheme/views/

Module Overview

SkyWall is built with a modular architecture. Each module is self-contained with its own controllers, views, and routes.

Shop Module

The shop is the core revenue module. Players browse items, add to cart, and purchase with points or real currency.

Features

• Category filtering and search
• Rarity-based visual styling (Common to Legendary)
• Purchase limits per account
• Automatic SOAP delivery on purchase
• Activity log with delivery status tracking
• Rate limiting (10 purchases/hour)

Cart & Checkout

Players can add multiple items to their cart. At checkout, the system processes each item sequentially via SOAP commands. If any delivery fails, the error is logged and visible in the admin activity log.

Donation Module

Let players support the server by buying Donation Points (DP) — a second currency alongside Vote Points (VP) — which they can then spend in the shop.

How it works

1. You create packages (e.g. 500 DP for €5, or 1100 DP for €10 with a 100 DP bonus).
2. The player picks a package on ?page=donate and chooses a payment method.
3. In automatic mode, the payment is handled by Stripe or PayPal and DP are credited instantly via webhook.
4. In manual mode, the player sends the payment with a reference code, then submits a proof. An admin approves it and credits the DP.

Modes

Payment gateways

• Stripe — Checkout Sessions with HMAC webhook signature verification and replay protection (5-minute window).
• PayPal — Orders API v2 with server-side order verification and optional webhook signature validation.
• Manual / Crypto — list your wallet addresses (BTC, ETH, …), players send a payment with a unique reference code and submit proof for review.

Webhooks

Configure these endpoints in your Stripe / PayPal dashboard:

Stripe:  https://yoursite.com/index.php?page=api/donate/webhook&gateway=stripe   (event: checkout.session.completed, charge.refunded)
PayPal:  https://yoursite.com/index.php?page=api/donate/webhook&gateway=paypal  (event: CHECKOUT.ORDER.APPROVED, PAYMENT.CAPTURE.COMPLETED, PAYMENT.CAPTURE.REFUNDED)

Security

• Idempotent crediting — a transaction can never be credited twice, even on webhook retries.
• Refunds (Stripe charge.refunded, PayPal PAYMENT.CAPTURE.REFUNDED) automatically reverse the DP if still available.
• Stripe signature (HMAC) and PayPal signature verification, plus server-side order re-checking.
• Optional Discord/Slack notification whenever a manual donation awaits review.

Forum Module

A lightweight community forum with categories, threads, posts, and reactions.

Features

• Category-based organization with icons and permissions
• Thread creation with rich text (HTML sanitized)
• Post reactions (AJAX-powered, no page reload)
• Pinned and locked threads
• Rate limiting (5 posts/hour)
• Math CAPTCHA for guests

News Module

A public news archive (?page=news) that lists every published article in a card grid, with a full-article reading modal. The homepage keeps a shorter "Latest News" teaser.

Where articles live

• Admin — write, edit, publish and delete articles (rich text, HTML sanitized, optional header image).
• Public archive — ?page=news shows all articles, newest first.
• Homepage teaser — the "Latest News" section (a carousel) is enabled/disabled from Site Layout → Page Sections.

The News module is self-contained: its admin controller, admin views (views/admin/), public archive and homepage section all live under modules/news/. Disabling the module removes the news archive, the homepage news section and the News menu item automatically.

Armory Module

A standalone character armory with a search page. Players can look up any character by name and view their full profile.

How it works

• Open ?page=armory and search by character name
• Or link directly: ?page=armory&name=Stylo or ?page=armory&guid=5

Features

• Character sheet: level, race, class, guild, health, resources, gold
• Equipment slots with real item icons and item-level average
• Base stats (strength, agility, stamina, intellect, spirit), armor, crit
• Talent tree distribution with spec detection
• Achievements with real names and icons (from Wowhead)
• PvP stats: arena ratings, honor kills
• Professions with progress bars
• Multi-core compatible (queries adapt to core schema)

Rankings Module

Player leaderboards driven by direct queries to the characters database, cached for 60 seconds.

Leaderboards

• World Legends — top by level and XP
• Honored Heroes — top by honor points
• Elite Killers — top by confirmed kills
• Most Dedicated — top by playtime

Hardcore Rankings

When the hardcore module is installed (hc_dead_log table present), two extra sections appear:

• HC Longevity — the highest-level hardcore characters (all-time)
• Hall of Fame (RIP) — fallen heroes with their killer

Character cards are clickable and open the armory. Rankings are automatically hidden from the profile when the module is disabled.

Live Map Module

A live world map showing online players on Azeroth, Outland and Northrend, refreshed every 30 seconds.

How it works

• Open ?page=map and switch between the Azeroth / Outland / Northrend tabs.
• Players are shown as colored dots — blue for Alliance, red for Horde.
• Hover a dot to see the player name, level and zone; click it to open their armory.

Data source

Players are read from the characters table (online = 1) with their map, zone and coordinates. Coordinates are mapped to pixels using the standard WotLK world-map bounds. Results are cached for 30 seconds to limit database load.

Map images

The three continent maps live in modules/livemap/assets/img/map/ (azeroth.jpg, outland.jpg, northrend.jpg — 966×732 px). Placeholder images are shipped by default; replace them with real map images extracted from the WoW client.

Vote System

Reward players for voting on top-listing sites. Supports multiple vote sites with callback verification.

Configuration

Add vote sites in Admin Panel with:

• Site name and URL
• Callback URL (provided by the voting site)
• Secret key for callback verification
• Reward command (SOAP command to execute on vote)

Vote Callback API

The callback endpoint at ?page=api/vote/callback accepts a GET request with the following query parameters:

?user_id=123&site_id=1&secret=your_secret_key

Returns JSON {"success": true, "message": "Vote successful"} or {"success": false, "message": "reason"}.

Account Level System

Reward player progression across all characters with 30 account-wide levels.

Features

• XP calculated from all characters (up to 12) using WotLK 3.3.5a XP table
• 30 levels with progressive XP thresholds and rank titles
• Tier system: gray, white, green, blue, purple, orange, legendary, mythic
• Shareable badges with unique 8-character codes and public URLs
• Character visibility toggle and XP details toggle
• Badges displayed in forum posts

Bugtracker Module

Allow players to report bugs and track their resolution status.

Features

• Submit bug reports with title, description, and severity
• Status tracking: Open, In Progress, Resolved, Closed
• Admin can update status and add comments
• Rate limiting (10 reports/day)

Status Module

A lightweight JSON endpoint that reports the live server state. Point any external status page, Discord bot or monitoring tool at it.

Endpoint

GET /index.php?page=status

Returns a normalized JSON object, cached for 30 seconds, with a stale-cache fallback (5 minutes) and a TCP socket check as a last resort.

{
  "online": 42,
  "status": "online",
  "uptime": 10858,
  "timestamp": 1788729931,
  "fallback": false,
  "stale": false
}

• online — current player count (from the characters DB)
• status — online / offline
• uptime — seconds since last restart (auth uptime table)
• fallback — true when the result came from the socket check
• stale — true when the result came from the stale cache

SOAP Command Reference

Shop items use SOAP commands to deliver rewards. Use the {player} placeholder which is replaced with the buyer's character name at purchase time.

.send mail {player} "Subject" "Body" itemId

.send money {player} "Subject" "Body" copper_amount

.character level {player} #level

.send mail {player} "Subject" "Body text"

.send items {player} "Subject" "Body" id1:count1 id2:count2

.title add {player} #titleId

Security Features

SkyWall v3.0.0 includes 28 security fixes and enterprise-grade protection.

API Endpoints

FAQ

Troubleshooting

APP_DEBUG=true

mysql -h 127.0.0.1 -P 3306 -u root -p