Begin Wyrm from the game kit

deploy/setup-droplet.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Prepare a host for Wyrm. The host may be shared with other games of
+# Kestrel's Hall: each keeps its own Caddy site file in /etc/caddy/sites, its
+# own port, service user, data directory and access log, and this script
+# touches nothing that belongs to another game. Copy it and Caddyfile.tmpl
+# to the host and run ON it as root; safe to run again.
+#   bash setup-droplet.sh 'wyrm.kestrelsnest.social, wyrm.<host-ip>.sslip.io'
+# The argument is this game's Caddy site address line: one name, or several
+# separated by commas. Every name must already resolve to this host.
+set -euo pipefail
+HOST="${1:?usage: setup-droplet.sh <site address line>}"
+
+apt-get update -q
+apt-get install -qy curl rsync
+
+# Caddy (auto-HTTPS), once per host.
+if ! command -v caddy >/dev/null; then
+  apt-get install -qy debian-keyring debian-archive-keyring apt-transport-https
+  curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+    | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+  curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+    | tee /etc/apt/sources.list.d/caddy-stable.list
+  apt-get update -q && apt-get install -qy caddy
+fi
+
+# Node 22, once per host; every game runs its server on it.
+if ! command -v node >/dev/null || [[ "$(node -v)" != v22* ]]; then
+  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+  apt-get install -qy nodejs
+fi
+
+# The host's Caddyfile only gathers the games' site files. A Caddyfile that
+# is neither Caddy's stock one nor this is a single-game host from before the
+# shared layout: stop rather than overwrite it.
+ROOT_CADDY='# Kestrel'"'"'s Hall: every game on this host brings its own site file.
+import sites/*.caddy'
+mkdir -p /etc/caddy/sites
+if ! grep -q '^import sites/\*.caddy' /etc/caddy/Caddyfile 2>/dev/null; then
+  if [ -s /etc/caddy/Caddyfile ] && ! grep -q 'root \* /usr/share/caddy' /etc/caddy/Caddyfile; then
+    echo "/etc/caddy/Caddyfile holds another site; move it into /etc/caddy/sites/ first" >&2
+    exit 1
+  fi
+  printf '%s\n' "$ROOT_CADDY" > /etc/caddy/Caddyfile
+fi
+
+# This game: its user, its directories, its site.
+# The service user shares the slug. A slug that is already a system group
+# (Ubuntu ships "dip", "games", "audio" and others) cannot also be a user:
+# stop and say so, and choose another user name in this script and the unit.
+if ! id -u wyrm &>/dev/null; then
+  if getent group wyrm >/dev/null; then
+    echo "a system group is already called wyrm; pick another service user name" >&2
+    exit 1
+  fi
+  useradd -r -m -d /opt/wyrm-home wyrm
+fi
+mkdir -p /opt/wyrm/build /opt/wyrm/app /var/lib/wyrm/rooms /var/log/wyrm
+chown -R root:caddy /opt/wyrm/build
+chmod -R g+rX /opt/wyrm/build
+chown -R wyrm:wyrm /var/lib/wyrm
+sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/sites/wyrm.caddy
+
+caddy validate --config /etc/caddy/Caddyfile
+# Validation as root touches the access logs; Caddy runs as caddy and must own them.
+chown -R caddy:caddy /var/lib/caddy
+systemctl reload-or-restart caddy
+
+# Firewall: ssh + web only.
+ufw allow OpenSSH
+ufw allow 80/tcp
+ufw allow 443/tcp
+ufw --force enable
+
+echo "host ready for wyrm: now run deploy/deploy.sh <ip> from your machine"