# Self-Hosting

The game can run on your own Windows PC and use router port forwarding. Account
registration, sessions, characters, progression, inventory, loot history, and
leaderboards are stored in the SQLite database at `data/game.db`.

That database file is the persistent storage. It remains after the server or PC
restarts. If the file is deleted or lost, all accounts and save data are lost,
so keep regular backups.

## Build and run

```powershell
npm ci
npm run db:init
npm run build
$env:HOST = "127.0.0.1"
$env:PORT = "4173"
$env:TRUST_PROXY = "1"
npm start
```

Run `npm run db:init` after pulling schema changes. It creates missing tables and
seed content without erasing existing player data.

## Internet access

Do not expose the Node port directly over unencrypted HTTP. Passwords would
travel across the internet without encryption. Put Caddy or another HTTPS
reverse proxy in front of the game:

```caddyfile
game.example.com {
  reverse_proxy 127.0.0.1:4173
}
```

Point a domain or dynamic-DNS name to your public IP, forward router ports 80
and 443 to the PC running Caddy, and allow those ports through Windows Firewall.
Caddy obtains and renews the HTTPS certificate.

Keep the game server bound to `127.0.0.1`. Set `TRUST_PROXY=1` only when the
server can be reached solely through your local reverse proxy. This lets account
limits use the visitor's public IP instead of the proxy's address.

## Account limits

Registration permits one account per public IP by default. Login and API rate
limits also apply. To allow a shared household to create more accounts, run a
local administrator command:

```powershell
npm run accounts:ip -- set 203.0.113.42 4 Smith-household
npm run accounts:ip -- list
npm run accounts:ip -- remove 203.0.113.42
```

`set` changes the total number of accounts that address may create. `remove`
returns it to the default one-account limit. These commands must be run on the
host PC and are not exposed through the website.

An IP account limit reduces casual account spam, but it is not DDoS protection.
Your router and internet connection can still be overwhelmed before requests
reach the game. Keep Windows patched, expose only required ports, and use router
or ISP protections where available.

## Backups

Create a consistent live backup with:

```powershell
npm run db:backup
```

Backups are written to `backups/game-<timestamp>.db`. Copy them to another disk
or cloud backup location; backups left only on the game PC will not help if its
drive fails. Test restoration occasionally by stopping the server, preserving
the current `data/game.db`, and placing a backup at that path.

## Current scaling boundary

SQLite is a good fit for a small private server running one game process. Do not
run multiple Node server instances against this setup.

Combat currently runs in the browser. It is suitable for a friend group, but a
modified client could submit false completion metrics. Move combat simulation
and run validation to the server before treating rankings as cheat-resistant.