CoA Hosting Guide: A Beginner Walkthrough That Publishes the Default Database Password

By Indie Kings | October 23, 2026

Updated October 23, 2026: ScikuVRC's CoA-Hosting-Guide is a five-star GitHub repository six sections of batch files and SQL settings plus a quick-setup checklist in walkthrough form, and one detail most hosting guides do not print: a default database password, published in the open.

Image: GitHub repository card for ScikuVRC/CoA-Hosting-Guide.

What the repository is

CoA is Conquest of Azeroth, and the repack this guide serves is an AzerothCore-family server package dishing out Blizzard's classic client. The repository calls itself "Easy way to host a CoA server", and at creation time it stood at two text files: README.md at 6,481 bytes and a readme.txt at 5,501 bytes. No code, no licence, no issue tracker activity. ScikuVRC created the repository on 16 September 2026, pushed 19 September, and left it at five stars and three forks.

Our take: a repository like this is best read as a snapshot of how a private-server community actually teaches hosting, and it is worth covering because those guides usually appear and disappear inside a Discord channel rather than arriving with per-branch versioning at all. This one is unusually orderly for its type, and parts of it are honest about gaps that other guides skip.

The walkthrough, from download to running server

The guide opens by defining what it is for and what to bring. It says itself: beginner difficulty, Windows platform, and Notepad++ and HeidiSQL recommended. It then walks a single path from download to server start in six numbered sections, which is rare for anything this community-facing.

Step	What the guide tells you to do
1	Download the CoA Repack and the latest CoA Repack Update from Discord channel links, create a folder, extract the repack, then extract the update into the Server folder root
2	Run `Start_All_Server.bat`, let the server components start and create the required databases, watch the console windows for errors, then run `Stop_All_Server.bat`
3	Run `Apply_Update.bat` from the update folder and wait for it to complete
4	Configure the server for local or online play; the guide stops before inventing a firewall rule on your behalf
5	Point the realm at your own address in `Manage.py`
6	Run `Start_All_Server.bat` once configuration is done and watch the server consoles for errors

Our take: running the server once before touching any SQL or conf value is the step most people skip, and the failure it prevents, editing a config file the first boot has not written yet, is a common one in repack setups. The guide gets that ordering right by making it an explicit run of Start_All_Server.bat and a stop before anything is edited.

Binding to localhost or the internet

Conquest of Azeroth's repack makes the local-versus-online split a pair of BindIP lines, in Server\CoA-Repack\Settings inside two template files, Authserver.conf.template and Worldserver.conf.template. Local players bind to 127.0.0.1, and the guide is worth quoting directly on the subject: "Do not change the BindIP setting" applies to the local case.

For the online case, both templates submit to BindIP = "0.0.0.0", which makes the server listen on every interface on the machine. That is the correct change if you intend friends outside your network to reach you, and it is also the change that matters: a server bound to all interfaces on a home PC is a working server, and everything that keeps unwanted traffic away from it becomes your own router's and Windows firewall's job at that point.

The Manage.py realmlist edit, the fragile part

The realm-list step is the only section that requires the user to edit Python source instead of a conf file. The guide sends you into Server\CoA-Repack\Scripts to open Manage.py, press CTRL + F, and search for mysql(f"UPDATE acore_auth.realmlist SET. The two strings you then edit are Name= and Address=, because Conquest of Azeroth ships with its name and realm address options inside a SQL statement the script executes.

Our take: the two edges of this step are structural. Editable values live inside a SQL statement inside a Python script, so the realm's name and address do not sit in a conf file where most people expect them, and they apply on the next run rather than immediately. And the address is your public IPv4 rather than a hostname, which is why the guide's only hint at reachability, the router and firewall sentence, matters. A ruler-written statement in the README notes the rest, but the walkthrough itself does not open ports for you.

Our take: editing a database row via a literal match on an SQL string is the kind of step that rots first when a repack updates. The guide's own risk is small because it says where the string sits, but there is nothing versioning-scoped here against a repack update, and a future repack that moves that statement out of Manage.py silently deletes this section's correctness. Anyone running this section should expect to re-read it when the repack updates.

The database section, and the published password

The optional SQL management section is where the guide stumbles from tutorial into something that should make readers sit up. It says to open authserver.conf inside Server\Settings, search for LoginDatabaseInfo =, and the default credentials it prints include a User: acore line and a default password string of 48 hex characters, with the guide reproducing the full password in the README body rather than describing it as "whatever you find there".

The troubleshooting route is the same road but in the template: authserver.conf.template, around line 232, the same LoginDatabaseInfo =, and the guide gives the complete line you are expected to enter, an address 127.0.0.1 on the 3307 port, the acore user, the same 48-character password, into acore_auth. The guide adds a clause that matters: make sure MySQL.bat is running before you attempt the connection.

Our take on this section is blunt. Default database credentials printed publicly in a guide is a bad default for any server that is bound to 0.0.0.0, even when the database itself never binds outside the machine. Anyone following this guide and intending internet-facing play should change both the account and the password before opening any ports, and should not treat the published password as a secure value just because it is not obviously guessable. It is in the README, and that means anyone can read it.

Two smaller notes. The 3307 port is not default MySQL behavior; the README gives it as this repack's value and never explains why, and any interpretation of that choice is ours, not a documented reason. The credentials also appear in authserver.conf as well as in the template line the guide has you write, and anyone who reads the conf file should notice the two together rather than assume one file is the only place with a password in it.

Bots, which live in Discord

The last section is optional. Bot installs download the CoA Bots package from a separate Discord channel, extract the entire folder into the server root, run Installer-Bots.bat, and then start the server again with Start_All_Server.bat. That is four lines of instruction and everything else is in the Discord distribution rather than the repo.

Neither the repack nor the bots package lives on GitHub. Both include a link into a specific Discord channel, which means the actual downloads you receive are not under the version control this walkthrough itself describes. The guide does not mention checksums, and the repository itself provides no files to compare against.

Repository metadata, which is thin

The repository has one branch, two text files and not much else. There is no licence, so the default rules of the GitHub Terms of Service apply to anything anyone does with the text: a fork is permitted on the platform, and a copied guide republished elsewhere is not. It has zero watchers and no open issues, and a 17 KB file tree five weeks after creation with five stars is roughly a snapshot-shaped audience rather than an active conversation. Our take on the licensing is a short one: with no licence the author keeps their copyright and only their permission, or a licence, lets the text be republished, so a copy of the guide elsewhere is not the same as a fork.

Our take on this shape is that it explains its own existence: when you write a hosting guide and the code distribution happens in Discord, a GitHub repo is the outer shell you keep so that search engines and screenshots have something to link to. Nothing here suggests the author intends to truck in code patches, and the file set is a good fit for that ambition.

Warnings, and the platforms behind them

Running a private server for World of Warcraft clients has expectations beyond systemd services in ways hosting guides rarely spell out, and Project Reclaimer's legal page did that work well; this one, which we have covered before on the matter of Blizzard's private-server enforcement era, is silent about that and about everything else that comes after "bind to 0.0.0.0".

Two risks deserve names. First, account risk apart from anything this page says: Blizzard's client-side account terms are set by Blizzard, not by an AzerothCore repack or a guide like this one, and a Battle.net account associated with private-server software can have consequences. No guide text on this page shifts that, and the site's own coverage of that subject, which we approached on the subject of Blizzard's private-server enforcement earlier this year, lives elsewhere. Second, an executable risk: the repack and bots installers come from Discord, and you are expected to run batch files unreviewed.

Our take: the guide itself does fairly well on the technical sections. The risk is structural, not procedural: its actual targets are host users who want a game up tonight, and it is the work the guide never performs, of making you pause before running anything that is not version-controlled anywhere, that makes a guide like this worth reading slowly, not skimming.

FAQ

What is CoA?
Conquest of Azeroth, a custom World of Warcraft server project in the Ascension/AzerothCore family. The repository in review is a hosting guide for its repack, not the server itself.

Does the guide require programming experience?
It is labeled beginner difficulty, and the only code edits are conf and SQL settings plus any realmlist changes inside Manage.py. The one real requirement is comfort with Windows file paths, batch files and text editing, and Notepad++ and HeidiSQL are called out as the recommended tools.

What is the BindIP change for?
It tells the auth and world servers which interfaces to listen on. Local play keeps 127.0.0.1, and online play binds 0.0.0.0 to let machines outside your network connect, which makes your router and firewall the security boundary.

Is the published database password safe?
No. It is default state, printed in a public README, and the guide prints it and writes it into a template file. If you bind the server to anything wider than localhost, change the database credentials before opening ports.

Why does the database section mention port 3307?
The guide writes 127.0.0.1;3307;acore;... into LoginDatabaseInfo, which puts the database on 3307 rather than the standard 3306 for this repack. The README does not say why the port differs, and it pairs the value with a hard rule: "Make sure MySQL.bat is running" before you attempt a connection.

Where do the repack and the bots come from?
Discord channels linked from the README. They are not on GitHub, the repository ships no checksums, and the guide itself does not appear to operate under any version-control discipline around them.

Bottom Line

CoA-Hosting-Guide is exactly what it claims: a beginner-level walkthrough from repack download to a running Conquest of Azeroth server, and the parts that many repack guides never get right, first boot before config edits and stopping the server cleanly before the update apply, are spelled out correctly in it. Two sections deserve special attention rather than a skim. The Manage.py realmlist section is fragile because its correctness depends on an SQL string matching in a script whose structure could change with any repack update, and the database section publishes a real default password in the open, with guidance that touches both authserver.conf and its template.

The caveats that are not the guide's fault are also real. The actual server packages and bots live only in Discord, so there is no versioning, checksum or signature to compare against a guide whose own repository has no licence and no issue tracker. And the platform risks, from retail-account terms to what 0.0.0.0 binding means for your machine's security posture, are as much yours to research as they are anyone's to document in a guide like this one. If you use it, use it with your own database credentials, your own firewall rules and your own judgment about where you run it, and treat a Discord-downloaded installer as input you intend to inspect rather than trust.

Sources

ScikuVRC/CoA-Hosting-Guide README, accessed 23 October 2026
GitHub repository metadata and file listing for ScikuVRC/CoA-Hosting-Guide, accessed 23 October 2026