feat: VPS load handling – rate limiting, session cleanup, Redis scaling, PM2 & Nginx

[Copilot]

Single-process in-memory server with no cleanup or backpressure breaks under concurrent player load on a DigitalOcean VPS. This branch adds the infrastructure to handle it without changing game logic.

Server (server/index.js)

• Attack rate limiting – per-socket sliding window (default 10 attacks/sec, tunable via ATTACK_RATE_LIMIT). Drops excess events before they hit the queue, preventing memory exhaustion from flooding clients.
• Idle session cleanup – background interval evicts sessions inactive for >30 min (SESSION_IDLE_MINUTES). Prevents unbounded RAM growth from abandoned games.
• /health endpoint – lightweight JSON response (uptime, sessions, sockets) for Nginx upstream checks and external monitors.
• Graceful shutdown – SIGTERM/SIGINT drains connections before exit; PM2 reload no longer drops live sockets.
• Optional Redis adapter – set REDIS_URL to activate @socket.io/redis-adapter. Socket.io rooms then work correctly across all worker processes; omit it to stay single-process with zero new deps at runtime.

Process management (ecosystem.config.cjs)

PM2 config that auto-selects mode based on environment:

• fork / instances: 1 when REDIS_URL is absent (safe default)
• cluster / instances: max when REDIS_URL is set (all CPU cores)

Includes max_memory_restart: 512M, rolling reload support, and merged log output.

Reverse proxy (nginx.conf)

• Proxies /health, /nimda, /socket.io to Node; serves dist/ statically
• WebSocket Upgrade headers, ip_hash sticky sessions for cluster mode (with hash $cookie_io documented as NAT-safe alternative)
• gzip on JS/CSS/JSON, Cache-Control: immutable on Vite hashed assets
• HTTP → HTTPS redirect with Certbot placeholder

Config & docs

• .env.example – all tunable variables (PORT, CORS_ORIGIN, NIMDA_PASSWORD, ATTACK_RATE_LIMIT, SESSION_IDLE_MINUTES, REDIS_URL)
• DEPLOYMENT.md – end-to-end DigitalOcean setup: Node/PM2/Nginx/Redis install, env wiring, PM2 startup persistence, Certbot HTTPS, UFW firewall rules
• eslint.config.js – adds globals.node override for server/** to fix pre-existing process is-not-defined errors under the browser-scoped config

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spectrum-game	Ready	Preview	Mar 26, 2026 9:45am