Waving Hands: a browser duel after Bartle's 1977 game

SvelteKit 5 single-player version against a heuristic bot. The engine
resolves all forty spells simultaneously as the rules describe, the
ledger of gestures is the interface, and the duel is saved in the
browser. Tester feedback rounds added per-hand planning, threat
evidence, a result strip with one-time rule explanations, a phone
layout and a structured rules page. Deploys as a static site behind
Caddy.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/README.md

@@ -0,0 +1,47 @@
+# Deploying Waving Hands
+
+The game runs entirely in the browser: the duel state lives in local storage
+and nothing is rendered or stored on a server. Production is therefore a
+single DigitalOcean droplet running only Caddy, which terminates TLS with
+automatic certificates and serves the static build from
+/opt/waving-hands/build. No Node, no service, no database.
+
+## Sizing
+
+The smallest droplet is enough: `s-1vcpu-512mb-10gb` ($4 a month). The build
+is under half a megabyte and Caddy idles in about 30 MB of memory. Move up to
+`s-1vcpu-1gb` only if the site ever gains a server side.
+
+The zero-cost alternative is a second site block in the wizwar droplet's
+Caddyfile pointing at a second directory; the deploy script works unchanged
+against that host. A separate droplet keeps the two games' uptime and
+upgrades independent.
+
+## New droplet from scratch
+
+1. `doctl compute droplet create waving-hands --region nyc3 \
+    --size s-1vcpu-512mb-10gb --image ubuntu-24-04-x64 \
+    --ssh-keys <your-key-ids> --tag-name waving-hands --wait`
+2. `scp deploy/setup-droplet.sh root@<ip>:/root/ && ssh root@<ip> \
+    "bash /root/setup-droplet.sh waving-hands.<ip>.sslip.io"`
+3. `deploy/deploy.sh <ip>`
+
+The sslip.io hostname works with no DNS at all. To add a real name, point an
+A record at the droplet and add the name to the first line of
+/etc/caddy/Caddyfile (space separated), then `systemctl reload caddy`; Caddy
+fetches the certificate on first request.
+
+## Everyday deploys
+
+    deploy/deploy.sh <ip>
+
+Runs the type-check, the tests and the build locally, rsyncs `build/` to the
+droplet keeping the previous week's hashed assets, and reloads Caddy. A
+player mid-duel loses nothing: their game is in their own browser, and the
+next page load picks up the new build.
+
+## Operations
+
+- Logs: `ssh root@<ip> journalctl -u caddy -f`, access log in
+  /var/lib/caddy/access.log
+- Nothing to back up on the server. Player duels are in their browsers.

deploy/deploy.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Build locally and push the static site to the droplet.
+# Usage: deploy/deploy.sh <droplet-ip-or-host>
+set -euo pipefail
+HOST="${1:?usage: deploy.sh <droplet-ip-or-host>}"
+
+npm run check
+npm test
+npm run build
+
+# Old hashed chunks stay a week: a page loaded before this deploy can still
+# fetch the module it was built against instead of failing mid-duel.
+rsync -az --delete --filter='P _app/immutable/*' \
+  build/ "root@$HOST:/opt/waving-hands/build/"
+ssh "root@$HOST" '
+  find /opt/waving-hands/build/_app/immutable -type f -mtime +7 -delete
+  chown -R root:caddy /opt/waving-hands
+  chmod -R g+rX /opt/waving-hands
+  systemctl reload caddy
+  systemctl --no-pager -l status caddy | head -3
+'
+echo "deployed."

deploy/setup-droplet.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# One-time droplet setup. Run ON the droplet as root:
+#   bash setup-droplet.sh waving-hands.<droplet-ip>.sslip.io
+# Waving Hands is a static site: Caddy serves the built files and terminates
+# TLS. There is no application process, so nothing but Caddy and rsync is
+# installed.
+set -euo pipefail
+HOST="${1:?usage: setup-droplet.sh <hostname>}"
+
+apt-get update -q
+apt-get install -qy curl rsync
+
+# Caddy (auto-HTTPS)
+apt-get install -qy debian-keyring debian-archive-keyring apt-transport-https
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+  | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+  | tee /etc/apt/sources.list.d/caddy-stable.list
+apt-get update -q && apt-get install -qy caddy
+
+# Site directory, readable by Caddy.
+mkdir -p /opt/waving-hands/build
+chown -R root:caddy /opt/waving-hands
+chmod -R g+rX /opt/waving-hands
+
+# Caddy vhost: auto-TLS, security headers, static files. SvelteKit writes
+# each route as <route>.html, so /rules is tried as /rules.html before
+# falling back to the app shell. Hashed assets under _app/immutable are
+# cached for a year; everything else is revalidated so a deploy shows up
+# on the next load.
+cat > /etc/caddy/Caddyfile <<CADDY
+$HOST
+
+root * /opt/waving-hands/build
+encode gzip zstd
+
+header {
+	Strict-Transport-Security "max-age=31536000"
+	X-Content-Type-Options "nosniff"
+	X-Frame-Options "DENY"
+	Referrer-Policy "no-referrer"
+}
+header /_app/immutable/* Cache-Control "public, max-age=31536000, immutable"
+header /index.html Cache-Control "no-cache"
+
+log {
+	output file /var/lib/caddy/access.log {
+		roll_size 10MiB
+		roll_keep 30
+	}
+}
+
+try_files {path} {path}.html /index.html
+file_server
+CADDY
+systemctl reload caddy
+
+# Firewall: ssh + web only.
+ufw allow OpenSSH
+ufw allow 80/tcp
+ufw allow 443/tcp
+ufw --force enable
+
+echo "droplet ready: now run deploy/deploy.sh <ip> from your machine"