docs(mc): document Simple Voice Chat voice_host gotcha + commit prod snapshot

voice_host lives in the mc_data volume and regenerates empty on world wipe,
silently breaking remote voice (secret sent, UDP handshake never completes →
red icon). Document the set/restore steps and the VPN-client false-positive
(Cloudflare One/WARP, FortiClient drop voice UDP). Add a known-good prod
snapshot at server-configs/voicechat-server.properties (voice_host=ulicraft.net).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/05-minecraft.md

@@ -68,6 +68,52 @@ docker exec minecraft sh -c 'cat /data/ops.json'    # verify level 4 + right UUI
 needed (takes effect live). Current op: `oier`
 (`7fbc9adb-bcf4-3913-9a99-46d46acd1009`), level 4, set 2026-06-21.
 
+## Simple Voice Chat — `voice_host` (NOT repo-tracked)
+
+Voice chat is UDP `24454/udp`, published in compose. The mod auto-generates
+`/data/config/voicechat/voicechat-server.properties` in the `mc_data` volume.
+
+**Gotcha — `voice_host` must be set or remote clients get a red/crossed icon.**
+Behind any NAT/Docker the server announces an address for clients' UDP
+connection; if `voice_host=` is empty it auto-detects the internal Docker IP →
+unreachable → the secret (TCP) is sent but the UDP handshake never completes
+("Sent secret" with no following "successfully connected to voice chat").
+
+Set on prod:
+
+```
+docker exec minecraft sed -i 's/^voice_host=.*/voice_host=ulicraft.net/' \
+  /data/config/voicechat/voicechat-server.properties
+docker restart minecraft   # mod reads props only at startup
+```
+
+**⚠️ This value lives in the `mc_data` volume, NOT auto-managed from this repo.**
+It survives restarts and `compose down/up`, but a **world wipe / fresh `mc_data`**
+regenerates the file with `voice_host=` empty → voice silently breaks again.
+
+A known-good prod snapshot is committed at
+`server-configs/voicechat-server.properties` (reference copy, `voice_host=ulicraft.net`).
+After a world reset, either re-run the `sed` + `docker restart` above, or restore
+the snapshot:
+
+```
+docker cp server-configs/voicechat-server.properties \
+  minecraft:/data/config/voicechat/voicechat-server.properties
+docker restart minecraft
+```
+
+(Snapshot is not auto-mounted — to make it durable, add a bind mount of
+`server-configs/voicechat-server.properties` into `/data/config/voicechat/` in
+compose.)
+
+Verify after a client joins:
+`docker logs minecraft 2>&1 | grep -i "connected to voice"` → expect
+`Player <name> ... successfully connected to voice chat`.
+
+Note: a red voice icon can ALSO be client-side — a VPN/zero-trust client
+(Cloudflare One/WARP, FortiClient) on the player's machine silently drops the
+voice UDP. Rule out VPNs before touching the server.
+
 ## Tasks
 
 - [ ] Compose: authlib URL `http://auth.${BASE_DOMAIN}/authlib-injector`
@@ -77,3 +123,4 @@ needed (takes effect live). Current op: `oier`
 - [ ] `depends_on`: drasl (authlib must resolve at boot)
 - [ ] Confirm `ENFORCE_SECURE_PROFILE=FALSE` ↔ drasl `SignPublicKeys=false`
 - [ ] Verify a client joins with their drasl skin
+- [ ] After any world wipe: re-set `voice_host` (see Simple Voice Chat section)

server-configs/voicechat-server.properties

@@ -0,0 +1,56 @@
+# Simple Voice Chat server config v1.21.1-2.6.18
+
+# The port number to use for the voice chat communication.
+# Audio packets are always transmitted via the UDP protocol on the port number
+# specified here, independently of other networking used for the game server.
+# Set this to '-1' to use the same port number that is used by the Minecraft server.
+# However, it is strongly recommended NOT to use the same port number because UDP on
+# it is also used by default for the server query. Doing so may crash the server!
+port=24454
+# The server IP address to bind the voice chat to
+# Leave blank to use the 'server-ip' property from the 'server.properties' config file
+# To bind to the wildcard IP address, use '*'
+bind_address=
+# The distance to which the voice can be heard
+max_voice_distance=48.0
+# The distance to which the voice can be heard when whispering
+whisper_distance=24.0
+# The Opus codec
+# Valid values are 'VOIP', 'AUDIO', and 'RESTRICTED_LOWDELAY'
+codec=VOIP
+# The maximum size that audio packets are allowed to have (in bytes)
+# Setting this to lower values might cause issues
+mtu_size=1275
+# The maximum number of packets a player can send per second
+# Set this to -1 to disable the rate limit - This must be greater than 0 in all other cases
+# This only applies to voice chat packets that are sent through Minecrafts networking
+# This affects actions like opening/joining/leaving voice chat groups or general state changes like disabling/enabling the voice chat
+tcp_rate_limit=16
+# The frequency at which keep-alive packets are sent (in milliseconds)
+# Setting this to a higher value may result in timeouts
+keep_alive=1000
+# If group chats are allowed
+enable_groups=true
+# The hostname that clients should use to connect to the voice chat
+# This may also include a port, e.g. 'example.com:24454' or just a port, e.g. '24454'
+# Do NOT change this value if you don't know what you're doing
+voice_host=ulicraft.net
+# If players are allowed to record the voice chat audio
+allow_recording=true
+# If spectators are allowed to talk to other players
+spectator_interaction=false
+# If spectators can talk to players they are spectating
+spectator_player_possession=false
+# If players without the voice chat mod should be kicked from the server
+force_voice_chat=false
+# The amount of time the server should wait to check if a player has the mod installed (in milliseconds)
+# Only relevant when 'force_voice_chat' is set to 'true'
+login_timeout=10000
+# The range in which the voice chat should broadcast audio
+# A value less than 0 means 'max_voice_distance'
+broadcast_range=-1.0
+# If the voice chat server should reply to external pings
+allow_pings=true
+# If the mod should load native libraries on dedicated servers
+# This is mostly relevant for voice chat addons
+use_natives=true