woggioni
ed90a2a5a6
Build the backend as a fully static musl binary (rust:1-alpine + x86_64-unknown-linux-musl) and run it in a scratch image with only the binary and the compiled frontend: 32 MB instead of ~110 MB, no shell, package manager or libc, running as the numeric user 10001:10001. The binary moves to /usr/local/bin/tavolo so `tavolo migrate` and `tavolo serve` resolve on PATH in compose and Kubernetes. TLS for OIDC and Postgres validates against Mozilla's roots embedded in the binary by webpki-roots, so no certificate files are needed; the OTLP client is built without a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http:// (documented). The Docker HEALTHCHECK is removed since scratch has no curl: Kubernetes probes /api/health over HTTP and Compose gates on its dependency checks. `strip = "symbols"` trims the release binary. Validated with docker compose up --build: migrations, sessions, lobby creation, the OIDC discovery redirect and the SPA all work, proving musl DNS resolution for the postgres/redis/mockoauth service names.
tavolo
A platform for multiplayer card games. The first game is scopone scientifico — the four-player, fixed-partnership Italian card game:
server/— backend: Rust + Axum, OIDC login, live games in Redis, match statistics in Postgres. A Cargo workspace of three crates: the game-independenttavolo-platform, the scopone gametavolo-scopone, and thetavolo-appcomposition root (thetavolobinary:serve,migrate,backfill-elo). See server/README.md.web/— frontend: Rust + Sycamore compiled to WebAssembly, built with Trunk and styled with Bootstrap 5.3 (MIT, vendored underweb/vendor/so builds work offline) plus the custom felt theme inweb/theme.css. Card images are the CC0 woodcut napoletane deck traced from a 1902 Naples print (SONDLecT/woodcut-napoletane).
Run the whole stack
docker compose up --build
Postgres, Redis, a mock OIDC provider (test users alice, bob, carol,
dave), the database migrator and the app all come up together. The app —
frontend and API — listens on http://127.0.0.1:8080.
Because both the browser and the app talk to the OIDC issuer at
http://mockoauth:8180/tavolo, add a host entry once:
echo "127.0.0.1 mockoauth" | sudo tee -a /etc/hosts
Between hands
When a hand ends but the match is not decided, the game pauses on a
scoring summary screen: every player sees how each category was won
(carte, denara, settebello, primiera, scope — plus napola and asso
pigliatutto when enabled)
with the running totals and
must click "Understood" before the next hand is dealt. If someone is away
the next hand is dealt automatically after HAND_ACK_TIMEOUT_SECONDS
(default 30s). The match-ending hand is explained on the final screen.
On your turn
Every turn shows a countdown (TURN_TIMEOUT_SECONDS, default 30s). If a
player does not move — disconnected or fallen asleep — the server plays a
random legal card for them (randomizing among the legal captures when the
rules require a capture), so one absent player cannot stall the table.
Development
Backend (from server/):
cd server
cargo test --workspace # unit + integration suites
cargo run -p tavolo-app # serves on :8080 (Postgres required)
cargo run -p tavolo-app -- migrate # apply the embedded sqlx migrations
The Redis- and Postgres-backed tests run when TEST_REDIS_URL /
TEST_DATABASE_URL point at throwaway services (e.g. from
docker compose up postgres redis plus the port mappings) and are skipped
otherwise.
Frontend (from web/), with the backend running on :8080:
cd web
trunk serve # SPA on http://localhost:8000, /api /auth /ws proxied
Trunk proxies /api, /auth and /ws to 127.0.0.1:8080 (see
web/Trunk.toml). For the login redirect to land back on the dev server,
run the backend with:
OIDC_0_PROVIDER=default \
OIDC_0_ISSUER=http://localhost:8180/tavolo \
OIDC_0_CLIENT_ID=tavolo \
OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback \
OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8000/ \
OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8000/ \
cargo run -p tavolo-app
Card images are committed under web/assets/cards/; web/fetch-cards.sh
re-downloads them if needed.