Deploy to a DigitalOcean droplet: wizwar is on the internet

Production shape: one Node process serves the built client and the
websocket on a single port (SPA fallback, same-origin wss in the
client), with Caddy terminating auto-TLS in front. The droplet
(nyc3, $6/mo) runs it under systemd as an unprivileged user with room
files on the persistent disk at /var/lib/wizwar/rooms — deploys and
reboots cannot eat a game. deploy/ carries the one-time droplet setup
script, the systemd unit, the Caddyfile, an everyday deploy script
(build locally, rsync, install, restart), and a README. Live at
https://wizwar.104.236.96.198.sslip.io via sslip.io, so TLS needed no
DNS setup at all. Verified over the real internet: room created,
second player joined, expansion game started, hands dealt, room file
persisted. Fixed en route: rsync's unanchored "data" exclude was
stripping the engine's card database, and tsx must ship (it is the
runtime).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/setup-droplet.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# One-time droplet setup. Run ON the droplet as root:
+#   bash setup-droplet.sh wizwar.<droplet-ip>.sslip.io
+set -euo pipefail
+HOST="${1:?usage: setup-droplet.sh <hostname>}"
+
+apt-get update -q
+apt-get install -qy curl git rsync
+
+# Node 22
+curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+apt-get install -qy nodejs
+
+# Caddy (auto-HTTPS)
+apt-get install -qy debian-keyring debian-archive-keyring apt-transport-https
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+  | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+  | tee /etc/apt/sources.list.d/caddy-stable.list
+apt-get update -q && apt-get install -qy caddy
+
+# App user + directories
+id -u wizwar &>/dev/null || useradd -r -m -d /opt/wizwar-home wizwar
+mkdir -p /opt/wizwar /var/lib/wizwar/rooms
+chown -R wizwar:wizwar /opt/wizwar /var/lib/wizwar
+
+# Caddy vhost
+printf '%s\n\nreverse_proxy localhost:8787\n' "$HOST" > /etc/caddy/Caddyfile
+systemctl reload caddy
+
+echo "droplet ready — now run deploy.sh from your machine"