Self-Hosting

The game can run on your own Windows PC and use router port forwarding. Account registration, sessions, characters, progression, inventory, loot history, and leaderboards are stored in the SQLite database at data/game.db.

That database file is the persistent storage. It remains after the server or PC restarts. If the file is deleted or lost, all accounts and save data are lost, so keep regular backups.

Build and run

npm ci
npm run db:init
npm run build
$env:HOST = "127.0.0.1"
$env:PORT = "4173"
$env:TRUST_PROXY = "1"
npm start

Run npm run db:init after pulling schema changes. It creates missing tables and seed content without erasing existing player data.

Internet access

Do not expose the Node port directly over unencrypted HTTP. Passwords would travel across the internet without encryption. Put Caddy or another HTTPS reverse proxy in front of the game:

game.example.com {
  reverse_proxy 127.0.0.1:4173
}

Point a domain or dynamic-DNS name to your public IP, forward router ports 80 and 443 to the PC running Caddy, and allow those ports through Windows Firewall. Caddy obtains and renews the HTTPS certificate.

Keep the game server bound to 127.0.0.1. Set TRUST_PROXY=1 only when the server can be reached solely through your local reverse proxy. This lets account limits use the visitor's public IP instead of the proxy's address.

Account limits

Registration permits one account per public IP by default. Login and API rate limits also apply. To allow a shared household to create more accounts, run a local administrator command:

npm run accounts:ip -- set 203.0.113.42 4 Smith-household
npm run accounts:ip -- list
npm run accounts:ip -- remove 203.0.113.42

set changes the total number of accounts that address may create. remove returns it to the default one-account limit. These commands must be run on the host PC and are not exposed through the website.

An IP account limit reduces casual account spam, but it is not DDoS protection. Your router and internet connection can still be overwhelmed before requests reach the game. Keep Windows patched, expose only required ports, and use router or ISP protections where available.

Backups

Create a consistent live backup with:

npm run db:backup

Backups are written to backups/game-<timestamp>.db. Copy them to another disk or cloud backup location; backups left only on the game PC will not help if its drive fails. Test restoration occasionally by stopping the server, preserving the current data/game.db, and placing a backup at that path.

Current scaling boundary

SQLite is a good fit for a small private server running one game process. Do not run multiple Node server instances against this setup.

Combat currently runs in the browser. It is suitable for a friend group, but a modified client could submit false completion metrics. Move combat simulation and run validation to the server before treating rankings as cheat-resistant.

3.0 KiB Raw Blame History