Hypergrid: opening a Paracosm to other grids

Hypergrid (HG) lets avatars from other OpenSimulator grids teleport into your world, and yours out to theirs, carrying their appearance and a "suitcase" of inventory. A Paracosm is a standalone, and OpenSimulator 0.9.3.0 ships a standalone Hypergrid architecture for it (config-include/StandaloneHypergrid.ini), so turning HG on is a config change, not a build change.

Untested. We have not run a Paracosm on the Hypergrid. This page is built from the 0.9.3.0 source and its example configs (StandaloneHypergrid.ini, StandaloneCommon.ini.example); try it on a copy of your world first (backup.md), and read the risks before you open the door.

Before you start

A public address. Other grids' simulators connect back to yours over HTTP (agent transfer, the gatekeeper, your travellers' inventory and assets), and visitors' viewers connect to your region over UDP. Set PARACOSM_EXTERNAL_HOST to a name that resolves to this machine from the internet, and open and forward PARACOSM_PORT for TCP and UDP (tls.md, quickstart.md section 12).
Everything on tls.md's checklist. An HG world is an internet-facing world.
Your region's name. HG arrivals that name no region go to the region flagged DefaultHGRegion.

The config

Three overlay changes, then python tools/make_config.py <bin> --force and a restart.

config/paracosm.ini (merged into OpenSim.ini): switch the architecture include. Upstream's example has Include-Architecture = "config-include/Standalone.ini" active and the Hypergrid one commented; the overlay line replaces the active one.

[Architecture]
    Include-Architecture = "config-include/StandaloneHypergrid.ini"

config/StandaloneCommon-overlay.ini (merged into config-include/StandaloneCommon.ini):

[Hypergrid]
    ; this world's gatekeeper: for a standalone, this simulator. Upstream's example has it commented out and
    ; HomeURI (the same value) already set
    GatekeeperURI = "${Const|BaseURL}:${Const|PublicPort}"

[GridService]
    ; where HG arrivals (and local logins that cannot go home) land. Spaces in the region name become underscores:
    ; a region named "Paracosm" is Region_Paracosm
    Region_Paracosm = "DefaultRegion, DefaultHGRegion"

[GridInfoService]
    ; optional: tell viewers this grid's HG addresses through get_grid_info
    gatekeeper = ${Const|BaseURL}:${Const|PublicPort}/
    uas = ${Const|BaseURL}:${Const|PublicPort}/

${Const|...} is OpenSim's own substitution and passes through make_config.py untouched. Upstream's example also has an active Region_Welcome_Area = "DefaultRegion, DefaultHGRegion"; it is harmless while no region is called "Welcome Area".

What the architecture switch changes (StandaloneHypergrid.ini, which says not to edit it): the HG versions of entity transfer, inventory access, friends, user management and the world map; MessageTransferModule = HGMessageTransferModule and LureModule = HGLureModule; the in-connectors that serve your gatekeeper, user agent, HG inventory and HG asset services on the simulator port; the grid service's Hypergrid linker and HG map search; and the login service's user agent and suitcase inventory. The [LoginService] SRV_* URLs in StandaloneCommon.ini (home, inventory, asset, profile, friends, IM) are what other grids are told to use for your users; they are built from BaseURL and PublicPort and need no change.

People on other grids reach you by your HG address, <host>:<port> for the default region or <host>:<port>:<region name>, in their viewer's map search.

The risks

Visitors. With the defaults anyone from any HG grid can arrive ([GatekeeperService] ForeignAgentsAllowed, default true). The controls, all in StandaloneCommon.ini:

control	where	does
`ForeignAgentsAllowed`, `AllowExcept`, `DisallowExcept`	`[GatekeeperService]`	allow or refuse foreign visitors, with exceptions by home grid URL
`AllowedClients`, `DeniedClients`	`[GatekeeperService]`	viewer name patterns. The example calls this "very weak security": a viewer can claim any name
`AllowTeleportsToAnyRegion`	`[GatekeeperService]`	false sends every arrival to the `DefaultHGRegion`
`Region_<name> = "DisallowForeigners"`	`[AuthorizationService]`	keep foreigners out of one region
estate access and ban lists	the viewer's estate tools	as for local avatars

What they bring: their attachments and anything they rez run here, scripts included. Use the parcel's build and script permissions (About Land) to decide who may rez and run scripts.

Content leaving. A visitor who may copy an object can take it into their inventory on their own grid; its assets then live on a server you do not control, and your permissions hold only as far as that grid honours them. The switches: [HGInventoryAccessModule] OutboundPermission = false stops foreign visitors taking items out (default true); [HGAssetService] DisallowExport and DisallowImport refuse asset types, by name (OpenMetaverse.AssetType), crossing this grid's border, for example DisallowExport = "LSLText" to keep your scripts' source home. If the world holds work you do not want copied (Paracosm's gift box is meant to be given), set these before you open it.

Your own avatars abroad. While away, your users see only their suitcase inventory ([HGInventoryAccessModule] RestrictInventoryAccessAbroad, default true); [UserAgentService] ForeignTripsAllowed_Level_<n> and its exceptions decide who may travel at all; [EntityTransfer] RestrictAppearanceAbroad and AccountForAppearance limit which appearances leave.

The services you now serve. The gatekeeper, user agent, HG inventory and HG asset services answer on the simulator port to any grid. So does the profile service, whose JSON-RPC methods take no credentials (config.md): on the Hypergrid that is how other grids show your users' profiles, and also how anyone can read and change them.

Paracosm's own pieces, untested with visitors.

WorldBridge sees foreign avatars like local ones (avatars, chat, the avatar-targeted ops). An AI resident will meet strangers; the avatar ops already refuse to guess when more than one avatar is present (worldbridge.md).
Offline IM: HGMessageTransferModule implements the same IMessageTransferModule and raises the same "undelivered" event, so the offline IM module keeps working in principle; not tried.
Groups V2 on SQLite is local to this world; whether foreign avatars can join its groups has not been looked at.

Turning it off

Remove the three overlay blocks (or set Include-Architecture back to config-include/Standalone.ini), make_config.py --force, restart. The grid service in StandaloneHypergrid.ini keeps region links in memory (OpenSim.Data.Null.dll), so no HG link survives the restart. Objects and inventory that visitors took stay where they took them.