Game server for cooperative action - authoritative simulation, matchmaking and anti-cheat based on Node.js + Colyseus

The initial situation is that there is a prototype of a cooperative game in Unity (Netcode for GameObjects) for 2-8 players. Problems have appeared on P2P - out of sync, no lag compensation, the host quits - the match falls apart, cheaters change the damage and speed parameters. You need to switch to a dedicated reputable server with rooms, matchmaking and minimal anti-cheat, while maintaining the current battle and inventory logic.

Technical environment - Linux (Ubuntu 22.04), Docker, Node.js 20 LTS, Colyseus 0.15+, Redis (for queues and presence), PostgreSQL (for accounts and progress), Nginx (TLS termination), GitHub Actions (CI). Unity 2022 LTS client, WebSocket transport (no WebRTC). Deployment in one region (no multi-region yet).

What should happen is a working server backend with an authoritative simulation of key mechanics (movement, taking damage, death/respawn, loot and inventory) and match infrastructure. The result should be reproducibly deployable in Docker Compose and have a basic set of metrics/logs for diagnostics.

Scope of work by stages
1) Analysis of the current network model - analyze the client message protocol, highlight the states that should become server states, and propose an event/snapshot scheme. The result should be a 1-2 page document with a list of authoritative state, a list of client commands and a migration plan.
2) Implementation of the Colyseus server
- Match rooms with life cycle: wait - start - play - finish
- Matchmaking by mode and MMR range (simplified) with a queue in Redis
- Authoritative processing of client commands: input movement, use item, attack, pickup, drop
- Server validation: speed, attack frequency, pickup radii, cooldowns
- Tickrate 20/s, state snapshots 10/s, interpolation on the client remains on the Unity side (you need to determine the data format)
3) Save and progress
- PostgreSQL schema: users, sessions, progression (minimum), match_results
- JWT authorization (access token) and server verification at the entrance to the room
- Record match results and update MMR
4) Anti-cheat minimum level
- Rate limiting on commands
- Server checks for impossible states (teleport, speedhack, rapid fire)
- Violation system: N suspicious events per match - mark in match_results and kick from the room
5) Infrastructure and quality
- Docker Compose: game-server, redis, postgres, nginx
- Healthchecks, structured logging (pino or similar), basic metrics (Prometheus endpoint or simple counters in /metrics)
- GitHub Actions: linting, tests (minimum unit for command validation), building a Docker image

Restrictions
- You cannot use managed services, everything must work on one machine in Docker Compose
- Without purchasing paid anti-cheat solutions and without kernel drivers
- The Unity client can be changed minimally - it is possible to add a thin adapter layer for a new protocol and interpolation, but without rewriting the entire game
- External dependencies should be common and actively maintained

Measurable acceptance criteria
- Raised with one docker compose up command, after which the following are available: /health, /metrics, creating matches and connecting clients
- Under a load of 8 players in one room, the server maintains 20 tick/s without degradation of more than 10% on a 4 vCPU 8GB machine (checked with a simple bot script or built-in load script)
- The server rejects at least 5 types of cheat commands: speeding, accelerated attack, attempting to cause damage without hitting the server model, picking up loot outside the radius, spamming commands over the limit
- Match results are written to PostgreSQL, MMR is updated, user re-login saves progress
- The repository has a README with startup steps, environment variables and a description of the message protocol

Available materials - current Unity project (repository), description of game mechanics, list of messages/events in the current prototype. The final PR/repository with the server, configs, database migrations and minimal client edits required to connect to the new server is expected.