Running a Hytale Server on Debian 13 (Trixie)

Debian 13 went stable back in August 2025, and if you’re looking for something to run a Hytale server on long-term - this is the boring, reliable choice. I’ve been running own stuff on Debian for years. It doesn’t break, it doesn’t surprise you, it is indeed boring.

This is a start-to-finish walkthrough for getting a Hytale dedicated server running on a fresh Debian 13 box.

In this article: Hardware · System Prep · SSH Hardening · Firewall · Java 25 · Getting the Server Files · First Launch · Configuration · Systemd Service · Server Console with Screen · Debian 13 Gotchas · Backups and Maintenance

Hardware

The game is in early access - performance characteristics change with every patch and there’s no point pretending any specific numbers are final. What I can say from running servers right now:

4 GB RAM is the minimum the server needs to start comfortably. Budget more if you expect more than a handful of players.
CPU clock speed matters more than core count. This is true for most game servers and Hytale is no exception.
Use an NVMe SSD. World saves hit the disk with random I/O and SATA SSDs feel it. You don’t need a huge drive - 30 GB is enough to start, but it depends on how many worlds you run and how far players explore.

Keep an eye on the official server documentation as requirements will shift with updates. Start small, monitor your resources, and scale up when you actually hit limits - not before.

System Prep

SSH into your fresh Debian 13 install and get it up to date:

apt-get update && apt-get upgrade -y
apt-get install -y wget unzip screen

Create a user for the server. Running game servers as root is the kind of decision you regret exactly once.

useradd -m -r -s /bin/bash hytale

Everything server-related goes under /home/hytale.

SSH Hardening

Before we install anything else - lock down SSH. A fresh server on the public internet will start getting brute-force login attempts within or even seconds on popular providers. This isn’t paranoia, it’s just what happens.

Key-Only Authentication

If you don’t already have an SSH key pair on your local machine, generate one:

ssh-keygen -t ed25519

Copy your public key to the server:

ssh-copy-id root@your-server

Now verify you can log in with the key before you disable passwords. SSH in from a new terminal - if it doesn’t ask for a password, you’re good. If it does, something went wrong and you should fix that first. Locking yourself out of your own server is not a productive evening.

Once key auth is confirmed working, edit the SSH config:

nano /etc/ssh/sshd_config

Change (or add) these lines:

Port 2222
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes

Moving SSH to port 2222 won’t stop a determined attacker, but it cuts out the bulk of automated scanners that only hit port 22. Less noise in your logs ¯_(ツ)_/¯.

Restart SSH and test from a new terminal before closing your current session:

systemctl restart sshd

ssh -p 2222 root@your-server

If that works, you’re set. If not, you still have your original session open to fix things. Don’t skip this step - fixing a locked-out server from a VPS console is miserable.

From this point on, SSH lives on port 2222.

Firewall

Get the firewall up before anything starts listening on a port. Debian 13 uses nftables under the hood, though neither it nor iptables is enabled by default on a fresh install. Hytale runs on QUIC (UDP-based), so you need to open UDP, not TCP.

The fast path with ufw:

apt-get install ufw -y
ufw allow 2222/tcp    # SSH (moved from 22 earlier)
ufw allow 5520/udp    # Hytale (QUIC)
ufw enable

If you’re running OneQuery, it shares port 5520 by default - no extra rules needed.

If you’d rather use nftables directly:

nft add rule inet filter input tcp dport 2222 accept
nft add rule inet filter input udp dport 5520 accept

Persist your rules or they’re gone on reboot:

nft list ruleset > /etc/nftables.conf
systemctl enable nftables

Java 25

Here’s the thing that trips people up: Hytale needs Java 25. Hypixel Studios recommends Eclipse Temurin specifically, and that’s what we’d go with too. It’s well-maintained, it gets updates fast, and Adoptium provides a proper APT repo so you’re not manually downloading .deb files like it’s 2008.

Add the Adoptium repository:

apt-get install -y apt-transport-https gpg
wget -qO - https://packages.adoptium.net/artifactory/api/gpg/key/public \
  | gpg --dearmor | tee /etc/apt/trusted.gpg.d/adoptium.gpg > /dev/null
echo "deb https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" \
  | tee /etc/apt/sources.list.d/adoptium.list

Then install Temurin 25:

apt-get update
apt-get install -y temurin-25-jdk

Confirm it’s active:

java -version

If you have other Java versions on the system (Debian 13 ships OpenJDK 21 by default), make sure Temurin 25 is selected:

update-alternatives --config java

You can find more details on the Adoptium Linux setup at adoptium.net/installation/linux.

Getting the Server Files

Switch to the hytale user first - you want the files owned by the account that’s actually going to run them.

su - hytale
cd ~

Hypixel Studios provides a command-line downloader tool that handles fetching the server files and authentication. Download and run it as the hytale user:

wget https://downloader.hytale.com/hytale-downloader.zip
unzip hytale-downloader.zip
chmod +x hytale-downloader-linux-amd64
./hytale-downloader-linux-amd64

It’ll walk you through an OAuth2 flow - you’ll get a link to open in your browser to authenticate with your Hytale account.

The downloader pulls a versioned zip (something like 2026.01.28-87d03be09.zip). Unpack it:

unzip 2026*.zip

This gives you a Server directory and an Assets.zip file. The jar and AOT cache end up inside Server/:

/home/hytale/
  Server/
    HytaleServer.jar
    HytaleServer.aot
  Assets.zip

HytaleServer.aot is a pre-trained AOT cache that skips JIT warmup on startup - keep it next to the jar.

First Launch

Still as the hytale user, cd into the Server directory and start it up:

cd ~/Server
java -Xms4G -Xmx4G -jar HytaleServer.jar --assets ../Assets.zip --bind 5520

The --assets flag points to the Assets.zip file one level up, and --bind sets the port. 5520 is the default.

On first start, the server generates its config files and world directory. But before anyone can connect, you need to authenticate the server with Hytale’s services.

In the server console, start the device login flow:

/auth login device

The server will spit out a device code and a link to accounts.hytale.com/device. Open the link in your browser, sign in with your Hytale account, enter the code, and approve. Once the server console confirms authentication, you’re linked.

Now tell the server to persist the token so you don’t have to do this dance on every restart:

/auth persistence Encrypted

This saves your auth credentials to an encrypted file on disk. Without it, the token lives in memory only and disappears the moment the server shuts down - meaning you’d need to re-authenticate after every restart. With encrypted persistence, the server picks up the token automatically on boot.

Stop the server for now (/stop or Ctrl+C) so we can configure it properly.

Configuration

Hytale uses JSON for all its config. The main file is config.json in the server root. After first launch, you’ll also see permissions.json, whitelist.json, and bans.json.

After first launch, the directory structure looks like this:

/home/hytale/
  Assets.zip
  Server/
    HytaleServer.jar
    HytaleServer.aot
    config.json
    permissions.json
    whitelist.json
    bans.json
    mods/
    universe/
      worlds/
        <world_name>/
          config.json
    logs/

The main things you’ll want to touch in config.json:

ServerName - what shows up in server lists
MOTD - message of the day
MaxPlayers - defaults to 100, adjust to what your hardware can handle
MaxViewRadius - chunk view distance, 12 chunks (384 blocks) is a good balance between visuals and performance
Password - set one if you want a private server

Each world also gets its own config.json under universe/worlds/<name>/ where you can toggle PvP, fall damage, NPC spawning, day/night cycle, and world gen settings. The per-world config is where you set things like seeds and game modes.

One important note: the server can overwrite these files when you use in-game commands. If you’re editing configs by hand, stop the server first.

Systemd Service

You want this thing to start on boot and come back if it crashes. Here’s a systemd unit that does the job:

# /etc/systemd/system/hytale.service

[Unit]
Description=Hytale Dedicated Server
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=hytale
Group=hytale
WorkingDirectory=/home/hytale/Server

ExecStart=/usr/bin/java -Xms4G -Xmx4G -jar HytaleServer.jar --assets ../Assets.zip --bind 5520
ExecStop=/bin/kill -SIGINT $MAINPID

Restart=on-failure
RestartSec=15

StandardOutput=journal
StandardError=journal
SyslogIdentifier=hytale

# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/hytale/Server
PrivateTmp=true

[Install]
WantedBy=multi-user.target

Enable and start:

systemctl daemon-reload
systemctl enable hytale
systemctl start hytale

Check on it:

systemctl status hytale
journalctl -u hytale -f

Restart=on-failure with a 15-second cooldown means systemd picks the server back up after a crash without hammering your system in a boot loop. If you want it to restart even on clean exits, switch to Restart=always - but make sure that’s actually what you want, because then manually stopping it turns into a fight.

Server Console with Screen

The systemd setup handles starting, stopping, and auto-restart - but it doesn’t give you an interactive console. If you need to run server commands (banning players, changing settings, checking status), screen is the way.

As the hytale user, start the server inside a screen session:

screen -S hytale
cd ~/Server
java -Xms4G -Xmx4G -jar HytaleServer.jar --assets ../Assets.zip --bind 5520

Detach from the session with Ctrl+A then D - the server keeps running in the background. Reattach whenever you need the console:

screen -r hytale

This is useful for one-off admin tasks or debugging. For day-to-day operation, the systemd service is still the better choice - it handles boot startup and crash recovery without you being logged in. But when you need to type commands into the server console, stop the systemd service and spin it up in screen instead.

Debian 13 Gotchas

A few things specific to Trixie that are worth knowing about:

/tmp cleanup is automatic now. Systemd 257 (which Debian 13 ships) enables systemd-tmpfiles by default. Files in /tmp get deleted after 10 days, /var/tmp after 30 days. If you or any scripts are stashing things in /tmp expecting them to stick around, they won’t. This doesn’t affect the server itself (its data lives under /home/hytale/Server), but it’s the kind of thing that bites you three weeks in when a backup script silently stops working.

No Java 17. Debian 13 dropped OpenJDK 17 from the repos entirely. If you’re also running other Java-based tools that explicitly need 17, you’ll have to pull it from Adoptium or another third-party source. Hytale needs 25, so this shouldn’t be an issue for the game server itself.

Network interface names might change. Systemd 257 handles hardware naming differently than Bookworm’s systemd 252 did. If you’re upgrading from Debian 12 rather than doing a fresh install, double-check your interface names before you wonder why your firewall rules aren’t working.

systemd-networkd is the new default for networking. ifupdown still works but is on its way out - it gets dropped in Debian 14. If you’re setting up a new machine, use systemd-networkd and save yourself a migration later.

Backups and Maintenance

World backups - Your world data lives under universe/worlds/. The server has built-in backup support - add --backup --backup-dir ./backups --backup-frequency 60 to your launch flags to get automatic backups every 60 minutes. There’s also --backup-max-count to cap how many it keeps. But a nightly rsync to somewhere offsite is still a good idea on top of that:

# hytale user's crontab
0 4 * * * rsync -az ~/Server/universe/ backup-server:/backups/hytale/universe/

OS updates - Set up unattended-upgrades and stop thinking about it:

apt-get install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

Logs - Everything flows through journald with our systemd setup. No log files to rotate, no disk to fill. Search old logs with journalctl -u hytale --since "2 days ago".

That’s it. Debian 13, Java 25, a systemd unit, and a UDP firewall rule. The Hytale server itself ships with an AOT cache that keeps startup fast, QUIC handles the networking efficiently, and Debian handles the rest. Once it’s running, there isn’t much babysitting to do.

If you want your server on the HytaleONE server list, set up the OneQuery plugin - it takes a couple of minutes and you get live status on the listing.