The hall comes first, in the shape of wizwar's landing

The home page is a centred card: title and pitch, your name, play the
bot or continue the duel under way, create or join a duel by code, a
sample ledger, the duels this browser holds with whose move it is, and
the story of the game. The single-player board lives at /play. The
droplet gains the duel server as a systemd service behind Caddy.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/waving-hands.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Waving Hands duel server
+After=network.target
+
+[Service]
+Type=simple
+User=waving-hands
+WorkingDirectory=/opt/waving-hands/app
+Environment=PORT=8788
+# Caddy terminates TLS; the plaintext port must not face the internet.
+Environment=HOST=127.0.0.1
+Environment=WH_DATA_DIR=/var/lib/waving-hands/rooms
+ExecStart=/opt/waving-hands/app/node_modules/.bin/tsx server/src/index.ts
+Restart=always
+RestartSec=3
+
+# Sandbox: the process reads /opt/waving-hands and writes only its data dir.
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/waving-hands
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+# A runaway process gets killed and restarted before it can take the box down.
+MemoryMax=300M
+LimitNOFILE=4096
+
+[Install]
+WantedBy=multi-user.target