Caddy routes the duel server's paths with handle blocks, from one template

try_files ran before reverse_proxy and rewrote /api to the shell; handle
blocks are exclusive. Both setup scripts render deploy/Caddyfile.tmpl.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/setup-droplet.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# One-time droplet setup. Run ON the droplet as root:
+# One-time droplet setup. Copy this script and Caddyfile.tmpl to the droplet
+# and run ON the droplet as root:
 #   bash setup-droplet.sh 'hands.kestrelsnest.social, waving-hands.<droplet-ip>.sslip.io'
 # The argument is the Caddy site address line: one name, or several
 # separated by commas. Every name must already resolve to this droplet.
@@ -24,39 +25,9 @@ mkdir -p /opt/waving-hands/build
 chown -R root:caddy /opt/waving-hands
 chmod -R g+rX /opt/waving-hands
 
-# Caddy vhost: auto-TLS, security headers, static files. SvelteKit writes
-# each route as <route>.html, so /rules is tried as /rules.html before
-# falling back to the app shell. Hashed assets under _app/immutable are
-# cached for a year; every other response is revalidated so a deploy shows
-# up on the next load. The two header matchers are disjoint, so their order
-# does not matter.
-cat > /etc/caddy/Caddyfile <<CADDY
-$HOST
-
-root * /opt/waving-hands/build
-encode gzip zstd
-
-header {
-	Strict-Transport-Security "max-age=31536000"
-	X-Content-Type-Options "nosniff"
-	X-Frame-Options "DENY"
-	Referrer-Policy "no-referrer"
-}
-@immutable path /_app/immutable/*
-header @immutable Cache-Control "public, max-age=31536000, immutable"
-@mutable not path /_app/immutable/*
-header @mutable Cache-Control "no-cache"
-
-log {
-	output file /var/lib/caddy/access.log {
-		roll_size 10MiB
-		roll_keep 30
-	}
-}
-
-try_files {path} {path}.html /index.html
-file_server
-CADDY
+# Caddy: the site and the duel server's paths, from the template beside this script.
+sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/Caddyfile
+caddy validate --config /etc/caddy/Caddyfile
 systemctl reload caddy
 
 # Firewall: ssh + web only.