NilsBriggen
0892b8f19c
Audit-driven; goal: one user can't exhaust the box or starve the shared Traefik stack. Resource containment: - compose: mem_limit 512m, memswap_limit, pids_limit 200, cpus 1.0 (blast radius = container) - Enforce per-user cloud quota (default 30MB, admin override) on /api/save + /api/characters → 413 - Cap published-character size (2MB); cap rooms (200), images/room (40), image bytes/room (40MB) - Cap WS image dataUrl length in the wire schema; per-IP WS connection cap (20) - MAX_USERS registration ceiling → 503 when full Availability + correctness: - Async crypto.scrypt (was scryptSync) so password hashing can't freeze the event loop; constant-time on unknown users to avoid username probing - trustProxy so req.ip is the real client behind Traefik — rate limits are per-IP, not global - Tighter auth-endpoint bucket (10/min) on /register + /login; prune stale rate buckets - O(1) token->user index; log persist() failures instead of swallowing them - Trim /healthz info; surface quota in /api/usage + the admin dashboard storage bar - Client surfaces 413 (quota) / 429 (rate) clearly Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
TTRPG Manager
A local-first campaign manager for D&D 5e and Pathfinder 2e, built for both Game Masters and players. Runs entirely in the browser (installable as a PWA) — your data lives in IndexedDB on your device; no account, no server.
Features (MVP)
- Campaigns — create per-system campaigns; deleting one cascades to all its data.
- Characters — 5e/PF2e sheets with live derived stats: ability modifiers, proficiency, skills, saves, AC, initiative, HP (with damage/heal/temp). Autosaves.
- Combat tracker — initiative order, round/turn tracking, conditions, HP, and add/remove/reorder mid-fight without ever corrupting whose turn it is.
- Dice — full notation (
2d6+3,4d6kh3), advantage/disadvantage, seedable RNG, per-campaign roll history. - Compendium — searchable SRD bestiary, spells, and magic items. Add any monster straight into the open encounter.
Tech
- React 19 + TypeScript (strict) + Vite
- TanStack Router · Zustand · Zod · Dexie (IndexedDB) · Tailwind v4 · Fuse.js
- Vitest (unit) + Playwright (e2e), PWA via vite-plugin-pwa
Architecture
src/
lib/
rules/ # game-system abstraction — 5e & pf2e behind one RulesSystem interface
combat/ # pure, tested turn-order + HP engine
dice/ # notation parser + roller
db/ # Dexie schema + repositories (cascade deletes, validation on write)
schemas/ # Zod entity schemas — every number rejects NaN/Infinity
compendium/ # lazy SRD data loaders (code-split out of the main bundle)
features/ # campaigns, characters, combat, dice, compendium (UI)
components/ui/ # design-system primitives
data/srd/ # SRD JSON (Open5e + MPMB); regenerate with scripts/fetch_data.py
The rules layer means features never branch on if (system === '5e'); they call the
RulesSystem interface, so adding a system is a self-contained module.
Development
bun install
bun run dev # dev server at http://localhost:5173
bun run test # unit tests (vitest)
bun run test:e2e # end-to-end (playwright)
bun run build # typecheck + production build
bun run lint
Roadmap
Notes/journal, maps with fog of war, encounter/loot builders, a shared player view, PF2e compendium data, and an optional sync backend for real-time tables.
History
This is a from-scratch rebuild. The previous implementation (deleted) had ~135
documented bugs and no version control; its bug report is kept at
docs/OLD_BUG_HUNT_REPORT.md as a record of failure modes designed against here
(silent data loss, turn-order corruption, no cascade deletes, NaN inputs, dead
Tauri integration). The SRD data and Python scrapers were preserved.