# Chronicle Proxy Deployment

The Android app never receives an OpenRouter credential. Deploy this directory on a trusted server and store the token separately:

```bash
install -d -m 700 /opt/starfall-chronicle
install -m 700 server.py /opt/starfall-chronicle/server.py
printf '%s' "$OPENROUTER_API_KEY" > /opt/starfall-chronicle/openrouter.token
chmod 600 /opt/starfall-chronicle/openrouter.token
install -m 644 starfall-chronicle.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now starfall-chronicle
```

Example Caddy route inside the public site block:

```caddy
handle /api/starfall-chronicle {
    rewrite * /narrate
    reverse_proxy 127.0.0.1:18083
}
```

Do not commit or distribute `openrouter.token`. The proxy pins `x-ai/grok-4.6`, validates an allowlisted event schema, bounds all request/response fields, and cannot issue game commands.
