Begin Wyrm from the game kit

deploy/wyrm.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=Wyrm game server
+After=network.target
+
+[Service]
+Type=simple
+User=wyrm
+WorkingDirectory=/opt/wyrm/app/server
+Environment=PORT=8791
+Environment=KEEPER=Kestrel
+Environment=KEEPER_TZ=America/New_York
+# Caddy terminates TLS; the plaintext port must not face the internet.
+Environment=HOST=127.0.0.1
+Environment=DATA_DIR=/var/lib/wyrm/rooms
+# Empty means no error reporting.
+Environment=SENTRY_DSN=__SENTRY_DSN__
+ExecStart=/opt/wyrm/app/server/node_modules/.bin/tsx src/index.ts
+Restart=always
+RestartSec=3
+
+# Sandbox: the process reads /opt/wyrm and writes only its data dir.
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/wyrm
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+# A runaway process gets killed and restarted before it can take the box down.
+MemoryMax=300M
+LimitNOFILE=4096
+
+[Install]
+WantedBy=multi-user.target