Production: the tafl droplet at 209.97.148.244, tafl.kestrelsnest.social, and the Sentry project

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jm2auWk6RP71CjaAb4FMoG

deploy/setup-droplet.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # One-time droplet setup. Copy this script and Caddyfile.tmpl to the droplet
 # and run ON the droplet as root:
-#   bash setup-droplet.sh 'hnefatafl.kestrelsnest.social, hnefatafl.<droplet-ip>.sslip.io'
+#   bash setup-droplet.sh 'tafl.kestrelsnest.social, hnefatafl.<droplet-ip>.sslip.io'
 # The argument is the Caddy site address line: one name, or several
 # separated by commas. Every name must already resolve to this droplet.
 # Hnefatafl is a static site: Caddy serves the built files and terminates
@@ -28,7 +28,9 @@ chmod -R g+rX /opt/hnefatafl
 # Caddy: the site and the game server's paths, from the template beside this script.
 sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/Caddyfile
 caddy validate --config /etc/caddy/Caddyfile
-systemctl reload caddy
+# Validation as root touches the access log; Caddy runs as caddy and must own it.
+chown -R caddy:caddy /var/lib/caddy
+systemctl restart caddy
 
 # Firewall: ssh + web only.
 ufw allow OpenSSH