v0.13.0 web and terminal client enhance, replay api, linux server deploy, doc and dependency update

deploy/freebsd/chess-backup.sh

@@ -1,23 +0,0 @@
-#!/bin/sh
-# Nightly logical backup of the chess database. setup-jail.sh installs this as
-# /usr/local/sbin/chess-backup and schedules it as the postgres user through
-# /usr/local/etc/cron.d/chess-backup.
-#
-#   CHESS_BACKUP_DIR   destination (default: /var/db/postgres/backups)
-#   CHESS_BACKUP_KEEP  days of dumps to keep (default: 14)
-#
-# Restore into a freshly provisioned database with:
-#   su -m postgres -c 'pg_restore --no-owner --role=chess -d chess <dump>'
-# (use --role=chess_owner for the split-privilege setup).
-set -eu
-PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
-
-dir=${CHESS_BACKUP_DIR:-/var/db/postgres/backups}
-keep=${CHESS_BACKUP_KEEP:-14}
-umask 077
-mkdir -p "$dir"
-
-target="$dir/chess-$(date -u +%Y%m%dT%H%M%SZ).dump"
-pg_dump --format=custom --dbname=chess --file="$target.partial"
-mv "$target.partial" "$target"
-find "$dir" -name 'chess-*.dump' -type f -mtime "+$keep" -delete

deploy/freebsd/host.sh

@@ -9,7 +9,7 @@
 # restart stops every service in the jail, including a running chess-server.
 #
 # After setup-jail.sh has run inside the jail, add the location block from
-# deploy/freebsd/nginx-chess.conf to the host nginx configuration, then
+# deploy/nginx-chess.conf to the host nginx configuration, then
 #   nginx -t && service nginx reload
 set -eu
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin

deploy/freebsd/nginx-chess.conf

@@ -1,52 +0,0 @@
-# Host nginx for chess: browsers (web and WASM clients) call
-# <origin>/chess/api/... and <origin>/chess/health, which map to the server's
-# /api/... and /health. Replace <jail-address> and <port> (chessd_port,
-# default 8080).
-#
-# chess-server keys rate limits on X-Real-IP, trusted only from the addresses
-# in chessd_trusted_proxies: the address this nginx uses to reach the jail.
-# $remote_addr must be the real client: with PROXY protocol in front of nginx,
-# set real_ip_header proxy_protocol and set_real_ip_from for that hop.
-
-# --- http {} context ---
-upstream chess_api {
-    server <jail-address>:<port>;
-    keepalive 16;
-}
-
-# --- TLS server {} context ---
-location /chess/api/ {
-    proxy_pass http://chess_api/api/;
-    proxy_http_version 1.1;
-    # Empty Connection header lets nginx reuse upstream keepalive connections.
-    proxy_set_header Connection "";
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header X-Forwarded-Proto https;
-
-    # Long-polling holds a request up to 30 seconds.
-    proxy_buffering off;
-    proxy_read_timeout 60s;
-    proxy_send_timeout 60s;
-
-    # API payloads are small JSON documents.
-    client_max_body_size 16k;
-}
-
-location = /chess/health {
-    proxy_pass http://chess_api/health;
-    proxy_http_version 1.1;
-    proxy_set_header Connection "";
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_read_timeout 10s;
-}
-
-# Everything else under /chess is not served by the API.
-location = /chess {
-    return 404;
-}
-location /chess/ {
-    return 404;
-}

deploy/freebsd/setup-jail.sh

@@ -78,7 +78,7 @@ yes_no() {
 [ "$(id -u)" -eq 0 ] || die "run as root"
 [ "$(uname -s)" = FreeBSD ] || die "this script targets FreeBSD"
 [ -f "$CHESS_BINARY" ] || die "CHESS_BINARY not found: $CHESS_BINARY"
-for f in "$repo/deploy/postgresql/setup.sql" "$here/rc.d/chessd" "$here/chess-backup.sh"; do
+for f in "$repo/deploy/postgresql/setup.sql" "$here/rc.d/chessd" "$repo/deploy/postgresql/chess-backup.sh"; do
 	[ -f "$f" ] || die "missing $f; run from a complete repository copy"
 done
 yes_no SPLIT_PRIVILEGES "$SPLIT_PRIVILEGES"
@@ -182,12 +182,20 @@ fi
 
 bindir=$(dirname "$bin")
 [ -d "$bindir" ] || install -d -o root -g wheel -m 0755 "$bindir"
-if [ -f "$bin" ] && ! cmp -s "$CHESS_BINARY" "$bin"; then
-	log "keeping the previous binary as $bin.prev"
-	cp -p "$bin" "$bin.prev"
-fi
 # Root-owned: the service account cannot replace its own executable file.
-install -o root -g wheel -m 0555 "$CHESS_BINARY" "$bin"
+if [ -f "$bin" ] && cmp -s "$CHESS_BINARY" "$bin"; then
+	# Same content, possibly the installed file itself (a rerun with
+	# CHESS_BINARY pointing at it): install(1) refuses to copy a file onto
+	# itself, so only normalize ownership and mode.
+	chown root:wheel "$bin"
+	chmod 0555 "$bin"
+else
+	if [ -f "$bin" ]; then
+		log "keeping the previous binary as $bin.prev"
+		cp -p "$bin" "$bin.prev"
+	fi
+	install -o root -g wheel -m 0555 "$CHESS_BINARY" "$bin"
+fi
 
 [ -d "$RC_DIR" ] || install -d "$RC_DIR"
 if [ -f "$RC_DIR/chessd" ] && ! cmp -s "$here/rc.d/chessd" "$RC_DIR/chessd"; then
@@ -247,7 +255,7 @@ fi
 if [ "$ENABLE_BACKUP" = yes ]; then
 	# Nightly pg_dump at 03:30 as postgres, keeping 14 days.
 	[ -d "$SBIN_DIR" ] || install -d "$SBIN_DIR"
-	install -o root -g wheel -m 0555 "$here/chess-backup.sh" "$SBIN_DIR/chess-backup"
+	install -o root -g wheel -m 0555 "$repo/deploy/postgresql/chess-backup.sh" "$SBIN_DIR/chess-backup"
 	[ -d "$BACKUP_DIR" ] || install -d -o postgres -g postgres -m 0700 "$BACKUP_DIR"
 	[ -d "$CRON_DIR" ] || install -d "$CRON_DIR"
 	printf '%s\n' \