# TDK high-score service

This small Axum service stores the shared top-ten table in SQLite. It exposes:

```text
GET  /healthz
GET  /api/highscores
POST /api/highscores
```

The POST body is JSON with a 21-character maximum name and a `u32` score. The
response is the canonical top-ten JSON array.

Submissions are anonymous and intentionally trust the browser's score. Add
rate limiting, moderation, or server-side run verification if the table needs
to resist forged scores.

Run it from `tdkpin-rs` with:

```sh
TDKPIN_HIGHSCORE_BIND=127.0.0.1:3000 \
TDKPIN_HIGHSCORE_DB=/var/lib/tdkpin/highscores.sqlite3 \
cargo run --manifest-path highscore-server/Cargo.toml
```

Place [nginx.conf.example](nginx.conf.example) inside the public site's
existing `server` block. The browser client expects the API at
`/api/highscores` on the same origin as the game.