# TDK high-score service

This small Axum service stores the shared top-ten table in SQLite. It exposes:

```text
GET  /healthz
GET  /api/highscores
POST /api/highscores
```

The POST body is JSON with a 21-character maximum name and a `u32` score. The
response is the canonical top-ten JSON array.

Submissions are anonymous and intentionally trust the browser's score. Add
rate limiting, moderation, or server-side run verification if the table needs
to resist forged scores.

Run it from `tdkpin-rs` with:

```sh
TDKPIN_HIGHSCORE_BIND=127.0.0.1:3000 \
TDKPIN_HIGHSCORE_DB=/var/lib/tdkpin/highscores.sqlite3 \
cargo run --manifest-path highscore-server/Cargo.toml
```

Copy the rate and connection zone declarations from
[nginx.conf.example](nginx.conf.example) into the existing `http` block, then
place its two `location` blocks inside the public site's `server` block. The
example bounds per-client and aggregate API traffic, request bodies, and proxy
waits. The browser client expects the API at `/api/highscores` on the same
origin as the game.

The crate inherits the parent [`rustfmt.toml`](../rustfmt.toml); run
`just fmt-highscore-server` when formatting it directly.