fix: Panic on PL content deserialization failures

fix: Add stable routes for admin suspension endpoints
fix: Re-add support for custom room IDs
2026-07-09 18:52:22 +00:00 · 2026-04-22 10:44:40 -04:00 · 2026-04-22 10:43:00 -04:00 · 2026-04-22 10:41:01 -04:00 · 2026-04-22 10:34:04 -04:00 · 2026-04-22 10:33:16 -04:00
150 changed files with 3770 additions and 3394 deletions
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@b5fddbb5361bce8a06fb168c9d403a6cc552b084 # v2
+      uses: https://github.com/taiki-e/install-action@a2352fc6ce487f030a3aa709482d57823eadfb37 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -45,6 +45,7 @@
  - [ ] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes)
        myself, if applicable. This includes ensuring code compiles.
  - [ ] My commit messages follow the [commit message format][c1cm] and are descriptive.
+  - [ ] I have written a [news fragment][n1] for this PR, if applicable<!--(can be done after hitting open!)-->.

 <!--
 Notes on these requirements:
@@ -78,3 +79,4 @@
 [c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks
 [c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally
 [c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages
+[n1]: https://towncrier.readthedocs.io/en/stable/tutorial.html#creating-news-fragments
@@ -37,9 +37,6 @@ jobs:
              if (file.startsWith('pkg/') || file.startsWith('nix/') || file === 'flake.nix' || file === 'flake.lock' || file.startsWith('docker/')) {
                labelsToAdd.add('Meta/Packaging');
              }
-              if (file === 'Cargo.lock') {
-                labelsToAdd.add('Dependencies');
-              }
            }

            if (labelsToAdd.size > 0) {
@@ -96,7 +96,7 @@ jobs:
          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]\.+[0-9]\.+[0-9]$ ]]; then
            # Use the "stable" component for tagged semver releases
            COMPONENT="stable"
-          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]\.+[0-9]\.+[0-9] ]]; then
+          elif [[ ${{ forge.ref }} =~ ^refs/tags/^v+[0-9]\.+[0-9]\.+[0-9] ]]; then
            # Use the "unstable" component for tagged semver pre-releases
            COMPONENT="unstable"
          else
@@ -105,7 +105,7 @@ jobs:
            RELEASE_SUFFIX=""
            TAG_NAME="${{ github.ref_name }}"
            # Extract version from tag (remove v prefix if present)
-            TAG_VERSION=$(echo "$TAG_NAME" | sed 's/^v//' | tr '-' '~')
+            TAG_VERSION=$(echo "$TAG_NAME" | sed 's/^v//')

            # Create spec file with tag version
            sed -e "s/^Version:.*$/Version:        $TAG_VERSION/" \
@@ -270,13 +270,9 @@ jobs:

          # Determine the group based on ref type and branch
          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+            GROUP="stable"
            # For tags, extract the tag name for version info
            TAG_NAME="${{ github.ref_name }}"
-            if [[ "$TAG_NAME" == *"-"* ]]; then
-              GROUP="unstable"
-            else
-              GROUP="stable"
-            fi
          elif [ "${{ github.ref_name }}" = "main" ]; then
            GROUP="dev"
          else
@@ -32,7 +32,7 @@ jobs:

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: 22

@@ -24,7 +24,7 @@ jobs:

    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: "22"

@@ -9,7 +9,6 @@ on:

 permissions:
  contents: read
-  pull-requests: read

 jobs:
  fast-checks:
@@ -41,32 +40,10 @@ jobs:
          cargo +nightly fmt --all -- --check && \
            echo "✅ Formatting check passed" || \
            exit 1
-  check-changes:
-    name: Check changed files
-    runs-on: ubuntu-latest
-    outputs:
-      rust: ${{ steps.filter.outputs.rust }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-
-      - name: Check for file changes
-        uses: https://github.com/dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
-        id: filter
-        with:
-          filters: |
-            rust:
-              - '**/*.rs'
-              - '**/Cargo.toml'
-              - '**/Cargo.lock'

  clippy-and-tests:
    name: Clippy and Cargo Tests
    runs-on: ubuntu-latest
-    needs: check-changes
-    if: needs.check-changes.outputs.rust == 'true'

    steps:
      - name: Checkout repository
@@ -199,28 +199,6 @@ jobs:
          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}

-  release-binaries:
-    name: "Release Binaries"
-    runs-on: ubuntu-latest
-    needs:
-      - build-release
-      - build-maxperf
-    permissions:
-      contents: write
-    if: startsWith(github.ref, 'refs/tags/')
-    steps:
-      - name: Download binary artifacts
-        uses: forgejo/download-artifact@v4
-        with:
-          pattern: conduwuit*
-          path: binaries
-          merge-multiple: true
-      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@v2
-        with:
-          draft: true
-          files: binaries/*
-
  mirror_images:
    name: "Mirror Images"
    runs-on: ubuntu-latest
@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.140.0@sha256:61303c28b10a491c559529fb6f41745850e4755a43a54c04c3ae6848d6eaf5cc
+      image: ghcr.io/renovatebot/renovate:43.111.0@sha256:da5fcac20c48d9792aac9c61fd234531bfa8df61263a39387cd8920263ca4768
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -90,12 +90,12 @@ jobs:
          RENOVATE_PLATFORM: forgejo
          RENOVATE_ENDPOINT: ${{ github.server_url }}
          RENOVATE_AUTODISCOVER: 'false'
-          RENOVATE_REPOSITORIES: '["${{ github.repository }}", "continuwuation/resolvematrix"]'
+          RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'

          RENOVATE_GIT_TIMEOUT: 60000

          RENOVATE_REQUIRE_CONFIG: 'required'
-          # RENOVATE_ONBOARDING: 'false'
+          RENOVATE_ONBOARDING: 'false'
          RENOVATE_INHERIT_CONFIG: 'true'

          RENOVATE_GITHUB_TOKEN_WARN: 'false'
@@ -24,7 +24,7 @@ repos:
        - id: check-added-large-files

  - repo: https://github.com/crate-ci/typos
-    rev: v1.46.1
+    rev: v1.45.1
    hooks:
      - id: typos
      - id: typos
@@ -1,20 +1,3 @@
-# Continuwuity 0.5.8 (2026-04-24)
-
-## Features
-
- LDAP can now optionally be connected to using StartTLS, and you may unsafely skip verification. Contributed by @getz (#1389)
- Users will now be prevented from removing their email if the server is configured to require an email when registering an account.
-
-## Bugfixes
-
- Fixed a situation where multiple email addresses could be associated with one user when that user changes their email address.
-
-## Improved Documentation
-
- Updated config docs to state we support room version 12, and set it as default. Contributed by @ezera. (#1622)
- Improve instructions for generic deployments, removing unnecessary parts and documenting the new initial registration token flow. Contributed by @stratself (#1677)
-
-
 # Continuwuity v0.5.7 (2026-04-17)

 ## Features
@@ -1 +1 @@
-Contributors are expected to follow the [Continuwuity Community Guidelines](https://continuwuity.org/community/guidelines).
+Contributors are expected to follow the [Continuwuity Community Guidelines](continuwuity.org/community/guidelines).
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "0.5.9"
+version = "0.5.7"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -36,13 +36,10 @@ version = "0.3"
 features = ["ffi", "std", "union"]

 [workspace.dependencies.const-str]
-version = "1.1.0"
+version = "0.7.0"

 [workspace.dependencies.ctor]
-version = "0.13.0"
-
-[workspace.dependencies.dtor]
-version = "0.13.0"
+version = "0.10.0"

 [workspace.dependencies.cargo_toml]
 version = "0.22"
@@ -50,7 +47,7 @@ default-features = false
 features = ["features"]

 [workspace.dependencies.toml]
-version = "1.1.2"
+version = "1.0.0"
 default-features = false
 features = ["parse", "serde"]

@@ -105,18 +102,15 @@ default-features = false
 features = ["typed-header", "tracing", "cookie"]

 [workspace.dependencies.axum-server]
-version = "0.8.0"
+version = "0.7.2"
 default-features = false

 # to listen on both HTTP and HTTPS if listening on TLS dierctly from conduwuit for complement or sytest
 [workspace.dependencies.axum-server-dual-protocol]
-# version = "0.7"
-git = "https://github.com/vinchona/axum-server-dual-protocol.git"
-rev = "ca6db055254255b74238673ce4135698e347d71c" # feat!: bump axum_server to 0.8.0
-default-features = false
+version = "0.7"

 [workspace.dependencies.axum-client-ip]
-version = "1.3"
+version = "0.7"

 [workspace.dependencies.tower]
 version = "0.5.2"
@@ -140,12 +134,13 @@ features = [
 [workspace.dependencies.rustls]
 version = "0.23.25"
 default-features = false
+features = ["aws_lc_rs"]

 [workspace.dependencies.reqwest]
-version = "0.13.2"
+version = "0.12.15"
 default-features = false
 features = [
-    "rustls-no-provider",
+    "rustls-tls-native-roots",
    "socks",
    "hickory-dns",
    "http2",
@@ -164,7 +159,7 @@ features = ["raw_value"]

 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.25"
+version = "0.0.23"

 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -180,7 +175,7 @@ version = "0.5.3"
 features = ["alloc", "rand"]
 default-features = false

-# Used to generate thumbnails for images
+# Used to generate thumbnails for images & blurhashes
 [workspace.dependencies.image]
 version = "0.25.5"
 default-features = false
@@ -191,6 +186,14 @@ features = [
    "webp",
 ]

+[workspace.dependencies.blurhash]
+version = "0.2.3"
+default-features = false
+features = [
+    "fast-linear-to-srgb",
+    "image",
+]
+
 # logging
 [workspace.dependencies.log]
 version = "0.4.27"
@@ -248,7 +251,7 @@ features = [
 ]

 [workspace.dependencies.tokio-metrics]
-version = "0.5.0"
+version = "0.4.0"

 [workspace.dependencies.libloading]
 version = "0.9.0"
@@ -344,7 +347,7 @@ version = "1.1.1"
 [workspace.dependencies.ruma]
 # version = "0.14.1"
 git = "https://github.com/ruma/ruma.git"
-rev = "9c9dccc93f054bbd28f23f630223fffa6289ecbc"
+rev = "985dec87f235f169b3adddf3a7d37f590403e6e9"
 features = [
    "appservice-api-c",
    "client-api",
@@ -356,6 +359,7 @@ features = [
    "ring-compat",
    "compat-upload-signatures",
    "compat-optional-txn-pdus",
+    "unstable-msc2448",
    "unstable-msc2666",
    "unstable-msc2867",
    "unstable-msc2870",
@@ -376,7 +380,6 @@ features = [
    "unstable-msc4373",
    "unstable-msc4380",
    "unstable-msc4143",
-    "unstable-msc4293",
    "unstable-msc4406",
    "unstable-msc4439",
    "unstable-extensible-events",
@@ -424,13 +427,14 @@ features = ["http", "grpc-tonic", "trace", "logs", "metrics"]

 # optional sentry metrics for crash/panic reporting
 [workspace.dependencies.sentry]
-version = "0.48.0"
+version = "0.46.0"
 default-features = false
 features = [
    "backtrace",
    "contexts",
    "debug-images",
    "panic",
+    "rustls",
    "tower",
    "tower-http",
    "tracing",
@@ -439,9 +443,9 @@ features = [
 ]

 [workspace.dependencies.sentry-tracing]
-version = "0.48.0"
+version = "0.46.0"
 [workspace.dependencies.sentry-tower]
-version = "0.48.0"
+version = "0.46.0"

 # jemalloc usage
 [workspace.dependencies.tikv-jemalloc-sys]
@@ -540,16 +544,21 @@ features = ["std"]
 [workspace.dependencies.maplit]
 version = "1.0.2"

+[workspace.dependencies.ldap3]
+version = "0.12.0"
+default-features = false
+features = ["sync", "tls-rustls", "rustls-provider"]
+
 [workspace.dependencies.yansi]
 version = "1.0.1"

 [workspace.dependencies.askama]
-version = "0.16.0"
+version = "0.15.0"

 [workspace.dependencies.lettre]
 version = "0.11.19"
 default-features = false
-features = ["smtp-transport", "pool", "hostname", "builder", "rustls", "rustls-native-certs", "tokio1", "rustls-no-provider", "tokio1-rustls", "tracing", "serde"]
+features = ["smtp-transport", "pool", "hostname", "builder", "rustls", "rustls-native-certs", "tokio1", "ring", "tokio1-rustls", "tracing", "serde"]

 [workspace.dependencies.governor]
 version = "0.10.4"
@@ -1 +0,0 @@
-The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger
@@ -1 +1 @@
-Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger.
+Switched from Continuwuity's fork of Ruma back to upstream Ruma, unblocking exciting new features such as OAuth login. Contributed by @ginger.
@@ -1 +0,0 @@
-Removed support for guest user registration, a little-used and deprecated approach to room previews.
@@ -1 +0,0 @@
-The deprecated `well_known.rtc_focus_server_urls` config option has been removed. MatrixRTC foci should be configured using the `matrix_rtc.foci` config option.
@@ -1 +0,0 @@
-Support for server-side blurhashing (part of MSC2448) has been removed.
@@ -1 +0,0 @@
-Add performance tuning documentation. Contributed by @stratself.
@@ -0,0 +1 @@
+Updated config docs to state we support room version 12, and set it as default. Contributed by @ezera.
@@ -1 +0,0 @@
-Explain accessing Continuwuity's server console when deployed via Docker.
@@ -1 +0,0 @@
-Removed support for LDAP.
@@ -1 +0,0 @@
-Clarified in the config that `max_request_size` affects federated media as well.
@@ -1 +0,0 @@
-Added support for fallback encryption keys.
@@ -1 +0,0 @@
-Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex.
@@ -1 +0,0 @@
-Add `!admin users reject-all-invites` to clean invite spam
@@ -1 +0,0 @@
-fix `!admin query account-data account-data-get` not returning the content
@@ -1 +0,0 @@
-Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles (QuadRadical)
@@ -7,6 +7,7 @@
 [global]
 address = "0.0.0.0"
 allow_device_name_federation = true
+allow_guest_registration = true
 allow_public_room_directory_over_federation = true
 allow_registration = true
 database_path = "/database"
@@ -31,6 +32,7 @@ rocksdb_log_level = "info"
 rocksdb_max_log_files = 1
 rocksdb_recovery_mode = 0
 rocksdb_paranoid_file_checks = true
+log_guest_registrations = false
 allow_legacy_media = true
 startup_netburst = true
 startup_netburst_keep = -1
@@ -291,7 +291,6 @@
 #ip_lookup_strategy = 5

 # Max request size for file uploads in bytes. Defaults to 20MB.
-# Also limits incoming federated media.
 #
 #max_request_size = 20971520

@@ -1271,6 +1270,21 @@
 #
 #brotli_compression = false

+# Set to true to allow user type "guest" registrations. Some clients like
+# Element attempt to register guest users automatically.
+#
+#allow_guest_registration = false
+
+# Set to true to log guest registrations in the admin room. Note that
+# these may be noisy or unnecessary if you're a public homeserver.
+#
+#log_guest_registrations = false
+
+# Set to true to allow guest registrations/users to auto join any rooms
+# specified in `auto_join_rooms`.
+#
+#allow_guests_auto_join_rooms = false
+
 # Enable the legacy unauthenticated Matrix media repository endpoints.
 # These endpoints consist of:
 # - /_matrix/media/*/config
@@ -1874,6 +1888,34 @@
 #
 #support_pgp_key =

+# **DEPRECATED**: Use `[global.matrix_rtc].foci` instead.
+#
+# A list of MatrixRTC foci URLs which will be served as part of the
+# MSC4143 client endpoint at /.well-known/matrix/client.
+#
+# This option is deprecated and will be removed in a future release.
+# Please migrate to the new `[global.matrix_rtc]` config section.
+#
+#rtc_focus_server_urls = []
+
+[global.blurhashing]
+
+# blurhashing x component, 4 is recommended by https://blurha.sh/
+#
+#components_x = 4
+
+# blurhashing y component, 3 is recommended by https://blurha.sh/
+#
+#components_y = 3
+
+# Max raw size that the server will blurhash, this is the size of the
+# image after converting it to raw data, it should be higher than the
+# upload limit but not too high. The higher it is the higher the
+# potential load will be for clients requesting blurhashes. The default
+# is 33.55MB. Setting it to 0 disables blurhashing.
+#
+#blurhash_max_raw_size = 33554432
+
 [global.matrix_rtc]

 # A list of MatrixRTC foci (transports) which will be served via the
@@ -1891,6 +1933,94 @@
 #
 #foci = []

+[global.ldap]
+
+# Whether to enable LDAP login.
+#
+# example: "true"
+#
+#enable = false
+
+# Whether to force LDAP authentication or authorize classical password
+# login.
+#
+# example: "true"
+#
+#ldap_only = false
+
+# URI of the LDAP server.
+#
+# example: "ldap://ldap.example.com:389"
+#
+#uri = ""
+
+# Root of the searches.
+#
+# example: "ou=users,dc=example,dc=org"
+#
+#base_dn = ""
+
+# Bind DN if anonymous search is not enabled.
+#
+# You can use the variable `{username}` that will be replaced by the
+# entered username. In such case, the password used to bind will be the
+# one provided for the login and not the one given by
+# `bind_password_file`. Beware: automatically granting admin rights will
+# not work if you use this direct bind instead of a LDAP search.
+#
+# example: "cn=ldap-reader,dc=example,dc=org" or
+# "cn={username},ou=users,dc=example,dc=org"
+#
+#bind_dn = ""
+
+# Path to a file on the system that contains the password for the
+# `bind_dn`.
+#
+# The server must be able to access the file, and it must not be empty.
+#
+#bind_password_file = ""
+
+# Search filter to limit user searches.
+#
+# You can use the variable `{username}` that will be replaced by the
+# entered username for more complex filters.
+#
+# example: "(&(objectClass=person)(memberOf=matrix))"
+#
+#filter = "(objectClass=*)"
+
+# Attribute to use to uniquely identify the user.
+#
+# example: "uid" or "cn"
+#
+#uid_attribute = "uid"
+
+# Attribute containing the display name of the user.
+#
+# example: "givenName" or "sn"
+#
+#name_attribute = "givenName"
+
+# Root of the searches for admin users.
+#
+# Defaults to `base_dn` if empty.
+#
+# example: "ou=admins,dc=example,dc=org"
+#
+#admin_base_dn = ""
+
+# The LDAP search filter to find administrative users for continuwuity.
+#
+# If left blank, administrative state must be configured manually for each
+# user.
+#
+# You can use the variable `{username}` that will be replaced by the
+# entered username for more complex filters.
+#
+# example: "(objectClass=conduwuitAdmin)" or "(uid={username})"
+#
+#admin_filter = ""
+
 #[global.antispam]

 #[global.antispam.meowlnir]
@@ -1962,9 +2092,6 @@
 # Whether to require that users provide an email address when they
 # register.
 #
-# If either this option or `require_email_for_token_registration` are set,
-# users will not be allowed to remove their email address.
-#
 #require_email_for_registration = false

 # Whether to require that users who register with a registration token
@@ -17,14 +17,12 @@ ARG LLVM_VERSION=21
 # Line one: compiler tools
 # Line two: curl, for downloading binaries and wget because llvm.sh is broken with curl
 # Line three: for xx-verify
-# golang, cmake: For aws-lc-rs bindgen
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y \
    pkg-config make jq \
    wget curl git software-properties-common \
    file
-    # golang cmake

 # LLVM packages
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
@@ -50,7 +48,7 @@ EOF

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.19.1
+ENV BINSTALL_VERSION=1.18.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -164,7 +162,7 @@ ENV CONDUWUIT_VERSION_EXTRA=$CONDUWUIT_VERSION_EXTRA
 ENV CONTINUWUITY_VERSION_EXTRA=$CONTINUWUITY_VERSION_EXTRA

 ARG RUST_PROFILE=release
-ARG CARGO_FEATURES="default"
+ARG CARGO_FEATURES="default,http3"

 # Build the binary
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
@@ -18,7 +18,7 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.19.1
+ENV BINSTALL_VERSION=1.18.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -8,11 +8,6 @@
        "type": "file",
        "name": "dns",
        "label": "DNS tuning (recommended)"
-    },
-    {
-        "type": "file",
-        "name": "performance",
-        "label": "Performance tuning"
    }

 ]
@@ -50,6 +50,8 @@ # Defaults to members of the admin room if unset
      # CONTINUWUITY_WELL_KNOWN__SERVER: matrix.example.com:443
 ```

+## Reverse proxying well-known files to Continuwuity
+
 After doing the steps above, Continuwuity will serve these 3 JSON files:

 - `/.well-known/matrix/client`: for Client-Server discovery
@@ -58,11 +60,9 @@ # Defaults to members of the admin room if unset

 To enable full discovery, you will need to reverse proxy these paths from the base domain back to Continuwuity.

-## Reverse proxying well-known files to Continuwuity
-
 <details>

-<summary>For **Caddy**</summary>
+<summary>For Caddy</summary>

 ```
 matrix.example.com:443 {
@@ -78,7 +78,7 @@ ## Reverse proxying well-known files to Continuwuity

 <details>

-<summary>For **Traefik** (via Docker labels)</summary>
+<summary>For Traefik (via Docker labels)</summary>

 ```
 services:
@@ -93,10 +93,7 @@ ## Reverse proxying well-known files to Continuwuity

 </details>

-
-For **Docker** users, consult the compose files in the [Appendix section](#docker-compose-examples).
-
-After applying these changes, restart Continuwuity and your reverse proxy.Visit these routes and check that the responses match the examples below:
+Restart Continuwuity and your reverse proxy. Once that's done, visit these routes and check that the responses match the examples below:

 <details open>

@@ -156,11 +153,9 @@ ### Serving well-known files manually

 ## Troubleshooting

-Check that other servers can connect to you.
-Here are some tools that can help identify federation issues:
+Check with the [Matrix Connectivity Tester][federation-tester] to see that it's working.

- [Matrix Connectivity Tester](https://federationtester.mtrnord.blog/)
- [Matrix Federation Tester](https://federationtester.matrix.org/)
+[federation-tester]: https://federationtester.mtrnord.blog/

 ### Cannot log in with web clients

@@ -258,45 +253,3 @@ ## Related Documentation
 - [Server-to-Server resolution](https://spec.matrix.org/v1.17/server-server-api/#resolving-server-names) (see this for more information on SRV records)
 - [Client-to-Server resolution](https://spec.matrix.org/v1.17/client-server-api/#server-discovery)
 - [MSC1929: Homeserver Admin Contact and Support page](https://github.com/matrix-org/matrix-spec-proposals/pull/1929)
-
-## Appendix
-
-### Docker Compose examples
-
-The following Compose files are taken from [Docker instructions](../deploying/docker.mdx) and reconfigured to support split-domain delegation. Note the updated `CONTINUWUITY_WELL_KNOWN` variable and relevant changes in reverse proxy rules.
-
-<details>
-<summary>Caddy (using Caddyfile) - delegated.docker-compose.with-caddy.yml ([view raw](/advanced/delegated.docker-compose.with-caddy.yml))</summary>
-
-```yaml file="../public/advanced/delegated.docker-compose.with-caddy.yml"
-
-```
-
-</details>
-
-<details>
-<summary>Caddy (using labels) - delegated.docker-compose.with-caddy-labels.yml ([view raw](/advanced/delegated.docker-compose.with-caddy-labels.yml))</summary>
-
-```yaml file="../public/advanced/delegated.docker-compose.with-caddy-labels.yml"
-
-```
-
-</details>
-
-<details>
-<summary>Traefik (for existing setup) - delegated.docker-compose.for-traefik.yml ([view raw](/advanced/delegated.docker-compose.for-traefik.yml))</summary>
-
-```yaml file="../public/advanced/delegated.docker-compose.for-traefik.yml"
-
-```
-
-</details>
-
-<details>
-<summary>Traefik included - delegated.docker-compose.with-traefik.yml ([view raw](/advanced/delegated.docker-compose.with-traefik.yml))</summary>
-
-```yaml file="../public/advanced/delegated.docker-compose.with-traefik.yml"
-
-```
-
-</details>
@@ -1,135 +0,0 @@
-# Performance tuning
-
-Continuwuity's default configs are suited for many typical setups and scales appropriately with the size of your hardware. However, there are many scenarios where additional modifications can be made to better utilize your server resources.
-
-This page aims to outline various performance tweaks for Continuwuity and their effects. These adjustments are especially helpful for homeservers that join many large federated rooms or have many users, and it will become increasingly necessary as the Matrix network expands. As always, your mileage may vary according to your setup's specifics. If you have further discussions or recommendations, please share them in the community rooms.
-
-## DNS tuning (recommended)
-
-Please see the dedicated [DNS tuning guide](./dns.mdx).
-
-## Cache capacities
-
-If you have memory to spare, consider increasing the `cache_capacity_modifier` value to a larger number to allow more data to be stored in hot memory. This *significantly* speeds up many intensive operations (such as state resolutions) and decreases CPU usage and disk I/O. Start with a baseline of `cache_capacity_modifier = 2.0` and tune up until you are satisfied with RAM usage.
-
-On the other hand, if your system doesn't have a lot of RAM, consider decreasing the cache capacity modifier to something smaller than `1.0` to avoid low-memory issues (at the cost of higher load on disk/CPU). This recommendation also works if your system has abnormally little RAM compared to the number of CPU cores (for example, 2GB RAM for 12 cores), as cache capacities scale according to number of available cores.
-
-## Disabling some features
-
-You can disable outgoing **typing notifications** and **read markers** to reduce strain on the CPU and network when actively participating in rooms.
-
-```toml
-# disables sending read receipts
-allow_outgoing_read_receipts = false
-# disables sending typing notifications
-allow_outgoing_typing = false
-```
-
-Outgoing presence updates are also considered very expensive and have been disabled by default (`allow_outgoing_presence = false`). For more savings, you may wish to disable _all_ processing of presence entirely.
-
-```toml title=continuwuity.toml
-# disabling presence updates entirely
-allow_local_presence = false
-allow_incoming_presence = false
-allow_outgoing_presence = false
-```
-
-## Tuning database compression
-
-:::warning
-These steps SHOULD be done **before** starting Continuwuity for the first time. While switching database compression midway through is theoretically possible, this has not been tested extensively in the wild.
-:::
-
-### Changing the compression algorithm
-
-For reduced CPU usage at a tradeoff of increased storage space, consider deploying Continuwuity with the faster and less intensive `lz4` algorithm instead of `zstd` for rocksdb, and disable WAL compression entirely:
-
-```toml
-### in continuwuity.toml ###
-rocksdb_compression_algo = "lz4"
-rocksdb_wal_compression = "none"
-```
-
-This tweak can especially be helpful if you have an older or less performant CPU (e.g. a Raspberry Pi) and disk space to spare.
-
-### Increasing bottommost layer compression (`zstd` only)
-
-The bottommost layer of the database usually contains old and read-only data, so it is a suitable place for further compression. In Continuwuity, this is possible by setting `rocksdb_bottommost_compression = true` and tuning `rocksdb_bottommost_compression_level` to a more compact level than the default one used in `rocksdb_compression_level`. This tweak comes at a cost of increased CPU usage, but may prevent your database from growing too large in the long run.
-
-For those using `zstd` compression, the compression level ranges from 1 to 22. An example like this could apply:
-
-```toml
-### in continuwuity.toml ###
-rocksdb_compression_algo = "zstd"
-rocksdb_compression_level = 32767 # magic number, translates to level 3 on zstd
-rocksdb_bottommost_compression = true
-rocksdb_bottommost_compression_level = 9 # level 9 on zstd
-```
-
-For `lz4` users, the default level (`-1`) is already the most compact. You can only further decrease it to favor compression speed over ratio.
-
-Consult these documents for more information on compression tuning and levels:
-
- [Rocksdb compression documentation][rocksdb-compression]
- [Rocksdb default compression levels][rocksdb-compression-defaults]
- [Zstd manual][zstd-manual]
- [Lz4 manual][lz4-manual]
-
-[rocksdb-compression]: https://github.com/facebook/rocksdb/wiki/Compression
-[rocksdb-compression-defaults]: https://github.com/facebook/rocksdb/blob/main/include/rocksdb/options.h#L208-L217
-[zstd-manual]: https://facebook.github.io/zstd/zstd_manual.html
-[lz4-manual]: https://github.com/lz4/lz4/blob/release/doc/lz4_manual.html
-
-## Other tweaks
-
-### Using UNIX sockets
-
-If your homeserver and reverse proxy live on the same machine, you may wish to expose Continuwuity on a UNIX socket instead of a port. This removes TCP overhead between the two programs.
-
-<details>
-
-<summary>Example config with Caddy</summary>
-
-```toml
-### in continuwuity.toml ###
-
-# `address` and `port` has to be commented out first
-#address = ["127.0.0.1", "::1"]
-#port = 8008
-unix_socket_path = "/run/continuwuity/continuwuity.sock"
-```
-
-```
-### in your Caddyfile ###
-https://matrix.example.com {
-    reverse_proxy unix//run/continuwuity/continuwuity.sock
-
-    # alternatively, use the http2-plaintext protocol
-    # reverse_proxy unix+h2c//run/continuwuity/continuwuity.sock
-}
-```
-
-</details>
-
-### Tuning your trusted servers
-
-:::info Vet your trusted servers!
-Trusted servers are your first point of contact when obtaining public keys from other servers, and they could theoretically impersonate other servers and cause significant harm to your deployment. Please thoroughly verify your trusted servers' credibility before adding them to your configuration.
-:::
-
-Trusted servers are queried sequentially in the order they are listed. If you have multiple trusted servers configured, put the faster ones first:
-
-```toml
-# Example config, using maintainers' recommended homeservers
-trusted_servers = ["codestorm.net","starstruck.systems","unredacted.org","matrix.org"]
-```
-
-Avoid prioritising `matrix.org` as your primary trusted server, as it tends to be quite slow.
-
-Some users have also reported that increasing `trusted_server_batch_size` has helped with faster joins for huge rooms. Start with doubling the default to `2048` until you find a suitable value.
-
-### Enable HTTP/3 on your reverse proxy
-
-Consider enabling the newer **HTTP/3** protocol for inbound connections to Continuwuity. In Caddy HTTP/3 is allowed by default, but you must expose port :443/**udp** on your firewall.
-
-HTTP/3 can vastly improve Client-Server connections especially on unstable networks, as it reduces packet losses and latency from TCP head-of-line blocking, includes workarounds for network switching, and reduces connection establishment handshakes. Continuwuity also includes experimental _outbound_ HTTP/3 support in its Docker images, so connections between Continuwuity servers can benefit from this too.
@@ -91,7 +91,7 @@ ### 3. Telling clients where to find LiveKit

 To tell clients where to find LiveKit, you need to add the address of your `lk-jwt-service` to the `[global.matrix_rtc]` config section using the `foci` option.

-The variable should be a list of servers serving as MatrixRTC endpoints. Replace the URL with the address you are deploying your instance of lk-jwt-service to:
+The variable should be a list of servers serving as MatrixRTC endpoints. Clients discover these via the `/_matrix/client/v1/rtc/transports` endpoint (MSC4143).

 ```toml
 [global.matrix_rtc]
@@ -100,10 +100,7 @@ ### 3. Telling clients where to find LiveKit
 ]
 ```

-This will expose LiveKit information on the following endpoints for clients to discover:
-
- `/_matrix/client/unstable/org.matrix.msc4143/rtc/transports` (MSC4143 unstable, behind auth)
- `/.well-known/matrix/client` (fallback, not behind auth. Only enabled if `[global.well_known].client` is set)
+Remember to replace the URL with the address you are deploying your instance of lk-jwt-service to.

 ### 4. Configure your Reverse Proxy

@@ -117,7 +114,6 @@ ### 4. Configure your Reverse Proxy

 <details>
    <summary>Example caddy config</summary>
-
    ```
    livekit.example.com {

@@ -131,12 +127,10 @@ ### 4. Configure your Reverse Proxy
        reverse_proxy 127.0.0.1:7880
    }
    ```
-
 </details>

 <details>
    <summary>Example nginx config</summary>
-
    ```
    server {
        server_name livekit.example.com;
@@ -173,19 +167,16 @@ ### 4. Configure your Reverse Proxy
        ''      close;
    }
    ```
-
 </details>

 <details>
    <summary>Example traefik router</summary>
-
    ```
    # on LiveKit itself
    traefik.http.routers.livekit.rule=Host(`livekit.example.com`)
    # on the JWT service
    traefik.http.routers.livekit-jwt.rule=Host(`livekit.example.com`) && (PathPrefix(`/sfu/get`) || PathPrefix(`/healthz`) || PathPrefix(`/get_token`))
    ```
-
 </details>


@@ -219,7 +210,7 @@ ### add these to livekit's docker-compose ###
 ### if you're using `network_mode: host`, you can skip this part
 ```

-Recreate the LiveKit container (with `docker-compose up -d livekit`) to apply these changes. Remember to allow the new `3478/udp` and `50300:50400/udp` ports through your firewall.
+Recreate the LiveKit container (with `docker-compose up -d livekit`) to apply these changes. Remember to allow the new `3478/udp` and `50100:50200/udp` ports through your firewall.

 ### Integration with an external TURN server

@@ -266,25 +257,11 @@ ## Testing

 First, you will need an access token for your current login session. These can be found in your client's settings or obtained via [this website](https://timedout.uk/mxtoken.html).

-Then, using that token, fetch the discovery endpoints for MatrixRTC services
+Then, using that token, request another OpenID token for use with the lk-jwt-service:

 ```bash
-curl -X POST -H "Authorization: Bearer <session-access-token>" \
-  https://matrix.example.com/_matrix/client/unstable/org.matrix.msc4143/rtc/transports
-```
-
-In the output, you should see the LiveKit URL matching the one [configured above](#3-telling-clients-where-to-find-livekit).
-
-With the same token, request another OpenID token for use with the lk-jwt-service:
-
-```bash
-curl -X POST -H "Authorization: Bearer <session-access-token>" \
+~$ curl -X POST -H "Authorization: Bearer <session-access-token>" \
  https://matrix.example.com/_matrix/client/v3/user/@user:example.com/openid/request_token
-```
-
-You will see a response as below:
-
-```json
 {"access_token":"<openid_access_token>","token_type":"Bearer","matrix_server_name":"example.com","expires_in":3600}
 ```

@@ -319,15 +296,10 @@ ## Testing

 ```bash
 ~$ curl -X POST -d @payload.json https://livekit.example.com/get_token
-```
-
-The lk-jwt-service will, after checking against Continuwuity, answer with a `jwt` token to create a LiveKit media room:
-
-```json
 {"url":"wss://livekit.example.com","jwt":"a_really_really_long_string"}
 ```

-Use this token to test at the [LiveKit Connection Tester](https://livekit.io/connection-test). If everything works there, then you have set up LiveKit successfully!
+The lk-jwt-service will, after checking against Continuwuity, answer with a `jwt` token to create a LiveKit media room. Use this token to test at the [LiveKit Connection Tester](https://livekit.io/connection-test). If everything works there, then you have set up LiveKit successfully!

 ## Troubleshooting

@@ -391,8 +363,8 @@ ## Related Documentation

 Specifications:

- [MSC4143 - MatrixRTC proposal](https://github.com/matrix-org/matrix-spec-proposals/pull/4143)
- [MSC4195 - LiveKit proposal](https://github.com/matrix-org/matrix-spec-proposals/pull/4195)
+- [MatrixRTC proposal](https://github.com/matrix-org/matrix-spec-proposals/pull/4143)
+- [LiveKit proposal](https://github.com/matrix-org/matrix-spec-proposals/pull/4195)

 Source code:

@@ -34,11 +34,6 @@
        "name": "kubernetes",
        "label": "Kubernetes"
    },
-    {
-        "type": "file",
-        "name": "nomad",
-        "label": "Nomad"
-    },
    {
        "type": "file",
        "name": "freebsd",
@@ -148,7 +148,7 @@ #### For other reverse proxies

 </details>

-See the [Other reverse proxies](generic.mdx#setting-up-the-reverse-proxy) section of the Generic page for further routing details.
+You will then need to point your reverse proxy towards Continuwuity at `127.0.0.1:8008`. See the [Other reverse proxies](generic.mdx#setting-up-the-reverse-proxy) section of the Generic page for further routing details.

 ### Starting Your Server

@@ -243,30 +243,9 @@ ### (Optional) Building Custom Images
 [Building Docker Images](../development/index.mdx#building-docker-images)
 section in the development documentation.

-### Accessing the Server's Console
-
-Before you can access the server's console and [send admin commands](../reference/admin/index.md) from the CLI, you will need to make the container interactive and allocate a pseudo-tty. Make sure you set `admin_console_automatic` to `true` in [the config](../reference/config.mdx) as well for Continuwuity to activate the CLI on startup.
-
-For Docker Compose deployments this means adding `stdin_open: true` and `tty: true` to the container's declaration:
-
-```yaml
-services:
-    homeserver:
-        stdin_open: true
-        tty: true
-        # ...
-```
-
-If you choose to deploy via `docker run`, add the flags `-i`/`--interactive` and `-t`/`--tty` to the command.
-
-From there you can access the server's console by running `docker attach <container-name>`, which will show the server's prompt `uwu> `. To exit `docker attach`, press `CTRL+p` then `CTRL+q`.
-
-Note that using `CTRL+c` within `docker attach`'s context will forward the signal to the server, stopping it. See [Docker's reference][docker-attach-reference] for more information.
-
-[docker-attach-reference]: https://docs.docker.com/reference/cli/docker/container/attach/
-
 ## Next steps

 - For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
 - To set up Audio/Video communication, see the [**Calls**](../calls.mdx) page.
- If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.mdx).
+- If you want to set up an appservice, take a look at the [**Appservice
+Guide**](../appservices.mdx).
@@ -1,12 +1,10 @@
 # Generic deployment documentation

-:::tip Getting help
-If you run into any problems while setting up Continuwuity, ask us in
-`#continuwuity:continuwuity.org` or [open an issue on
-Forgejo][forgejo-new-issue].
-:::
-
-[forgejo-new-issue]: https://forgejo.ellis.link/continuwuation/continuwuity/issues/new
+> ### Getting help
+>
+> If you run into any problems while setting up Continuwuity, ask us in
+> `#continuwuity:continuwuity.org` or [open an issue on
+> Forgejo](https://forgejo.ellis.link/continuwuation/continuwuity/issues/new).

 ## Installing Continuwuity

@@ -17,16 +15,17 @@ ### Prebuilt binary

 Prebuilt binaries are available from:

- **Tagged releases**: [see Release page][release-page]
- **Development builds**: CI artifacts from the `main` branch,
-  [see `release-image.yml` for details][release-image]
+- **Tagged releases**: [Latest release page](https://forgejo.ellis.link/continuwuation/continuwuity/releases/latest)
+- **Development builds**: CI artifacts from the `main` branch
+  (includes Debian/Ubuntu packages)
+
+When browsing CI artifacts, `ci-bins` contains binaries organised
+by commit hash, while `releases` contains tagged versions. Sort
+by last modified date to find the most recent builds.

 The binaries require jemalloc and io_uring on the host system. Currently
 we can't cross-build static binaries - contributions are welcome here.

-[release-page]: https://forgejo.ellis.link/continuwuation/continuwuity/releases/
-[release-image]: https://forgejo.ellis.link/continuwuation/continuwuity/actions/?workflow=release-image.yml
-
 #### Performance-optimised builds

 For x86_64 systems with CPUs from the last ~15 years, use the
@@ -39,12 +38,11 @@ #### Performance-optimised builds
 If you're using Docker instead, equivalent performance-optimised
 images are available with the `-maxperf` suffix (e.g.
 `forgejo.ellis.link/continuwuation/continuwuity:latest-maxperf`).
-These images use the `release-max-perf` build profile with
-[link-time optimisation (LTO)][lto-rust-docs]
+These images use the `release-max-perf`
+build profile with
+[link-time optimisation (LTO)](https://doc.rust-lang.org/cargo/reference/profiles.html#lto)
 and, for amd64, target the haswell CPU architecture.

-[lto-rust-docs]: https://doc.rust-lang.org/cargo/reference/profiles.html#lto
-
 ### Nix

 Theres a Nix package defined in our flake, available for Linux and MacOS. Add continuwuity as an input to your flake, and use `inputs.continuwuity.packages.${system}.default` to get a working Continuwuity package.
@@ -57,8 +55,7 @@ ### Compiling

 #### Using Docker

-See the [Building Docker Images](../development/index.mdx#building-docker-images)
-section in the development documentation.
+If you would like to build using docker, you can run the command `docker build -f ./docker/Dockerfile -t forgejo.ellis.link/continuwuation/continuwuity:main .` to compile continuwuity.

 #### Manual

@@ -72,7 +69,7 @@ ##### Dependencies

 ##### Build

-You can now build Continuwuity using `cargo build --release`.
+You can build Continuwuity using `cargo build --release`.

 Continuwuity supports various optional features that can be enabled during compilation. Please see the Cargo.toml file for a comprehensive list, or ask in our rooms.

@@ -94,6 +91,27 @@ ## Adding a Continuwuity user
 sudo useradd -r --shell /usr/bin/nologin --no-create-home continuwuity
 ```

+## Forwarding ports in the firewall or the router
+
+Matrix's default federation port is 8448, and clients must use port 443.
+If you would like to use only port 443 or a different port, you will need to set up
+delegation. Continuwuity has configuration options for delegation, or you can configure
+your reverse proxy to manually serve the necessary JSON files for delegation
+(see the `[global.well_known]` config section).
+
+If Continuwuity runs behind a router or in a container and has a different public
+IP address than the host system, you need to forward these public ports directly
+or indirectly to the port mentioned in the configuration.
+
+Note for NAT users: if you have trouble connecting to your server from inside
+your network, check if your router supports "NAT
+hairpinning" or "NAT loopback".
+
+If your router does not support this feature, you need to research doing local
+DNS overrides and force your Matrix DNS records to use your local IP internally.
+This can be done at the host level using `/etc/hosts`. If you need this to be
+on the network level, consider something like NextDNS or Pi-Hole.
+
 ## Setting up a systemd service

 You can find an example unit for continuwuity below.
@@ -105,7 +123,7 @@ ## Setting up a systemd service
 `/etc/rsyslog.conf` to allow color in logs.

 If you are using a different `database_path` than the systemd unit's
-configured default (`/var/lib/conduwuit`), you need to add your path to the
+configured default `/var/lib/conduwuit`, you need to add your path to the
 systemd unit's `ReadWritePaths=`. You can do this by either directly editing
 `conduwuit.service` and reloading systemd, or by running `systemctl edit conduwuit.service`
 and entering the following:
@@ -126,9 +144,7 @@ ### Example systemd Unit File

 </details>

-You can also [view the file on Foregejo][systemd-file].
-
-[systemd-file]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/pkg/conduwuit.service
+You can also [view the file on Foregejo](https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/pkg/conduwuit.service).

 ## Creating the Continuwuity configuration file

@@ -139,7 +155,9 @@ ## Creating the Continuwuity configuration file
 **Please take a moment to read the config. You need to change at least the
 server name.**

-### Setting the correct file permissions
+RocksDB is the only supported database backend.
+
+## Setting the correct file permissions

 If you are using a dedicated user for Continuwuity, you need to allow it to
 read the configuration. To do this, run:
@@ -157,29 +175,22 @@ ### Setting the correct file permissions
 sudo chmod 700 /var/lib/conduwuit/
 ```

-## Exposing ports in the firewall or the router
-
-Matrix's default federation port is **:8448**, and clients use port **:443**. You will need to
-expose these ports on your firewall or router. If you use UFW, the commands to allow them
-are: `ufw allow 8448/tcp` and `ufw allow 443/tcp`.
-
-:::tip Alternative port/domain setups
-If you would like to use only port 443, a different port, or a subdomain for the homeserver, you will need to set up `.well-known` delegation. Consult the `[global.well_known]` section of the config file, and the [**Delegation/Split-domain**](../advanced/delegation) page to learn more about these kinds of deployments.
-:::
-
 ## Setting up the Reverse Proxy

+We recommend Caddy as a reverse proxy because it is trivial to use and handles TLS certificates, reverse proxy headers, etc. transparently with proper defaults.
+For other software, please refer to their respective documentation or online guides.
+
 ### Caddy

-Caddy is the recommended reverse proxy as it is easy to use, has good defaults,
-and handle TLS certificates automatically. After installing Caddy via your preferred
-method, create `/etc/caddy/conf.d/conduwuit_caddyfile` and enter the following
-(substitute `example.com` with your actual server name):
+After installing Caddy via your preferred method, create `/etc/caddy/conf.d/conduwuit_caddyfile`
+and enter the following (substitute your actual server name):

 ```
-example.com, example.com:8448 {
+your.server.name, your.server.name:8448 {
    # TCP reverse_proxy
-    reverse_proxy 127.0.0.1:8008
+    reverse_proxy 127.0.0.1:6167
+    # UNIX socket
+    #reverse_proxy unix//run/conduwuit/conduwuit.sock
 }
 ```

@@ -191,45 +202,51 @@ ### Caddy

 ### Other Reverse Proxies

-Normally, your reverse proxy should route everything from port :8448 and :443 back to Continuwuity.
+As we prefer our users to use Caddy, we do not provide configuration files for other proxies.

-For more granular controls, you will need to proxy everything under these following routes:
+You will need to reverse proxy everything under the following routes:

- `/_matrix/` - core Matrix APIs, which includes:
-
-  - `/_matrix/federation` and `/_matrix/key` - core Server-Server APIs. These should be available on port :8448
-
-  - `/_matrix/client` - core Client-Server APIs. These should be available on port :443
-
- `/_conduwuit/` and `/_continuwuity/` - ad-hoc Continuwuity routes for password resets, email verification, and server details such as `/local_user_count` and `/server_version`.
+- `/_matrix/` - core Matrix C-S and S-S APIs
+- `/_conduwuit/` and/or `/_continuwuity/` - ad-hoc Continuwuity routes such as `/local_user_count` and
+  `/server_version`

 You can optionally reverse proxy the following individual routes:

 - `/.well-known/matrix/client` and `/.well-known/matrix/server` if using
  Continuwuity to perform delegation (see the `[global.well_known]` config section)
 - `/.well-known/matrix/support` if using Continuwuity to send the homeserver admin
-  [contact and support page][well-known-support]
- `/` and `/_continuwuity/logo.svg` if you would like to see the Continuwuity landing page
+  contact and support page (formerly known as MSC1929)
+- `/` if you would like to see `hewwo from conduwuit woof!` at the root

-Refer to the respective software's documentation and online guides on how to do so.
+See the following spec pages for more details on these files:

-[well-known-support]: https://spec.matrix.org/v1.18/client-server-api/#getwell-knownmatrixsupport
+- [`/.well-known/matrix/server`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixserver)
+- [`/.well-known/matrix/client`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient)
+- [`/.well-known/matrix/support`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixsupport)

-#### Caveats for specific reverse proxies
+Examples of delegation:

- Lighttpd is not supported as it appears to interfere with the `X-Matrix` Authorization
+- https://continuwuity.org/.well-known/matrix/server
+- https://continuwuity.org/.well-known/matrix/client
+- https://ellis.link/.well-known/matrix/server
+- https://ellis.link/.well-known/matrix/client
+
+For Apache and Nginx there are many examples available online.
+
+Lighttpd is not supported as it appears to interfere with the `X-Matrix` Authorization
 header, making federation non-functional. If you find a workaround, please share it so we can add it to this documentation.

- If using Apache, you need to use `nocanon` in your `ProxyPass` directive to prevent httpd from interfering with the `X-Matrix` header (note that Apache is not ideal as a general reverse proxy, so we discourage using it if alternatives are available).
+If using Apache, you need to use `nocanon` in your `ProxyPass` directive to prevent httpd from interfering with the `X-Matrix` header (note that Apache is not ideal as a general reverse proxy, so we discourage using it if alternatives are available).

- If using Nginx, you need to pass the request URI to Continuwuity using `$request_uri`, like this:
+If using Nginx, you need to pass the request URI to Continuwuity using `$request_uri`, like this:

-    - `proxy_pass http://127.0.0.1:6167$request_uri;`
-    - `proxy_pass http://127.0.0.1:6167;`
+- `proxy_pass http://127.0.0.1:6167$request_uri;`
+- `proxy_pass http://127.0.0.1:6167;`

-    Furthermore, Nginx users need to increase the `client_max_body_size` setting (default is 1M) to match the `max_request_size` defined in conduwuit.toml.
+Nginx users need to increase the `client_max_body_size` setting (default is 1M) to match the
+`max_request_size` defined in conduwuit.toml.

-## Starting Your Server
+## You're done

 Now you can start Continuwuity with:

@@ -243,57 +260,36 @@ ## Starting Your Server
 sudo systemctl enable conduwuit
 ```

-Check Continuwuity logs with the following command:
-
-```bash
-sudo journalctl -u conduwuit.service
-```
-
-If Continuwuity has successfully initialized, you'll see output as below.
-
-```
-In order to use your new homeserver, you need to create its
-first user account.
-Open your Matrix client of choice and register an account
-on example.com using registration token x5keUZ811RqvLsNa .
-Pick your own username and password!
-```
-
-You can then open [a Matrix client][matrix-clients],
-enter your homeserver address, and try to register with the provided token.
-By default, the first user is the instance's first admin. They will be added
-to the `#admin:example.com` room and be able to [issue admin commands](../reference/admin/index.md).
-
-[matrix-clients]: https://matrix.org/ecosystem/clients
-
 ## How do I know it works?

-To check if your server can communicate with other homeservers,
-use an external testing tool:
+You can open [a Matrix client](https://matrix.org/ecosystem/clients), enter your
+homeserver address, and try to register.

- [Matrix Connectivity Tester](https://federationtester.mtrnord.blog/)
- [Matrix Federation Tester](https://federationtester.matrix.org/)
-
-If you can register your account but cannot join federated rooms, check your configuration
-and verify that your federation endpoints are opened and forwarded correctly.
-
-As a quick health check, you can also use these cURL commands:
+You can also use these commands as a quick health check (replace
+`your.server.name`).

 ```bash
-curl https://example.com/_conduwuit/server_version
+curl https://your.server.name/_conduwuit/server_version

 # If using port 8448
-curl https://example.com:8448/_conduwuit/server_version
+curl https://your.server.name:8448/_conduwuit/server_version

 # If federation is enabled
-curl https://example.com:8448/_matrix/federation/v1/version
-
-# For client-server endpoints
-curl https://example.com/_matrix/client/versions
+curl https://your.server.name:8448/_matrix/federation/v1/version
 ```

+- To check if your server can communicate with other homeservers, use the
+  [Matrix Federation Tester](https://federationtester.mtrnord.blog/). If you can
+  register but cannot join federated rooms, check your configuration and verify
+  that port 8448 is open and forwarded correctly.
+
 ## What's next?

- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
- For Audio/Video call functionality see the [**Calls**](../calls.md) page.
- If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.md).
+### Audio/Video calls
+
+For Audio/Video call functionality see the [Calls](../calls.md) page.
+
+### Appservices
+
+If you want to set up an appservice, take a look at the [Appservice
+Guide](../appservices.md).
@@ -1,118 +0,0 @@
-# Continuwuity for Nomad
-
-You can either pass the configuration as environment variables or mount a file containing the configuration from consul.
-This given configuration assumes that you have a traefik reverse proxy running.
-
-## Persistence
-The database being a RockDB file, it is recommended to use a volume to persist the data.
-The example below uses a volume, you need to configure the CSI driver on your cluster.
-
-| Volume Name | Mount Path | Purpose |
-|-------------|------------|---------|
-| continuwuity-volume | `/var/lib/continuwuity` | Store the database |
-| continuwuity-media-volume | `/var/lib/continuwuity/media` | Store uploaded media |
-
-## Configuration
-### Using environment variables
-```hcl
-job "continuwuity" {
-  datacenters = ["dc1"]
-  type      = "service"
-  node_pool = "default"
-
-  group "continuwuity" {
-    count = 1
-
-    network {
-      port "http" {
-        static = 6167
-      }
-    }
-
-    service {
-      name = "continuwuity"
-      port = "http"
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.continuwuity.rule=(Host(`matrix.example.com`) || (Host(`example.com`) && PathPrefix(`/.well-known/matrix`)))",
-        "traefik.http.routers.continuwuity.entrypoints=https",
-        "traefik.http.routers.continuwuity.tls=true",
-        "traefik.http.routers.continuwuity.tls.certresolver=letsencrypt",
-        "traefik.http.routers.continuwuity-http.rule=(Host(`matrix.example.com`) || (Host(`example.com`) && PathPrefix(`/.well-known/matrix`)))",
-        "traefik.http.routers.continuwuity-http.entrypoints=http",
-        "traefik.http.routers.continuwuity-http.middlewares=continuwuity-redirect",
-        "traefik.http.middlewares.continuwuity-redirect.redirectscheme.scheme=https",
-        "traefik.http.middlewares.continuwuity-redirect.redirectscheme.permanent=true",
-      ]
-    }
-
-    volume "continuwuity-volume" {
-      type            = "csi"
-      read_only       = false
-      source          = "continuwuity-volume"
-      attachment_mode = "file-system"
-      access_mode     = "single-node-writer"
-      per_alloc       = false
-    }
-
-    volume "continuwuity-media-volume" {
-      type            = "csi"
-      read_only       = false
-      source          = "continuwuity-media-volume"
-      attachment_mode = "file-system"
-      access_mode     = "single-node-writer"
-      per_alloc       = false
-
-      mount_options {
-        mount_flags = []
-      }
-    }
-
-    task "continuwuity" {
-      driver = "docker"
-
-      env {
-        CONTINUWUITY_SERVER_NAME        = "matrix.example.com"
-        CONTINUWUITY_TRUSTED_SERVERS    = "[\"matrix.org\", \"mozilla.org\"]"
-        CONTINUWUITY_ALLOW_REGISTRATION = false
-        CONTINUWUITY_ADDRESS            = "0.0.0.0"
-        CONTINUWUITY_PORT               = 6167
-        CONTINUWUITY_DATABASE_PATH      = "/var/lib/continuwuity"
-        CONTINUWUITY_WELL_KNOWN         = <<EOF
-{
-client=https://matrix.example.com,
-server=matrix.example.com:443
-}
-EOF
-      }
-
-      config {
-        image = "forgejo.ellis.link/continuwuation/continuwuity:latest"
-        ports = ["http"]
-      }
-
-      volume_mount {
-        volume      = "continuwuity-volume"
-        destination = "/var/lib/continuwuity"
-      }
-
-      volume_mount {
-        volume      = "continuwuity-media-volume"
-        destination = "/var/lib/continuwuity/media"
-      }
-    }
-  }
-}
-```
-
-### Using consul
-```hcl
-...
-      template {
-        data = <<EOF
-{{key "config/continuwuity"}}
-EOF
-        destination = "local/conduwuit.toml"
-      }
-...
-```
@@ -81,6 +81,8 @@ ## List of forked dependencies
 All forked dependencies are maintained under the
 [continuwuation organization on Forgejo](https://forgejo.ellis.link/continuwuation):

+- [ruwuma][continuwuation-ruwuma] - Fork of [ruma/ruma][ruma] with various
+  performance improvements, more features and better client/server interop
 - [rocksdb][continuwuation-rocksdb] - Fork of [facebook/rocksdb][rocksdb] via
  [`@zaidoon1`][8] with liburing build fixes and GCC debug build fixes
 - [jemallocator][continuwuation-jemallocator] - Fork of
@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 13,
-            "mention_room": true,
-            "date": "2026-05-08",
-            "message": "[v0.5.9](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.9) has been released, fixing a few low-severity federation-related vulnerabilities. It is recommended you read the changelog and update as soon as possible. There are no new features or other changes in this release, only related bugfixes. Deployments tracking the main branch should also update to the latest commit."
+            "id": 11,
+            "mention_room": false,
+            "date": "2026-04-17",
+            "message": "[v0.5.7](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.7) is out! Email verification! Terms and Conditions! Deleting notification pushers! So much good stuff. Go grab the release and read the changelog!"
        }
    ]
 }
@@ -1,43 +0,0 @@
-# Continuwuity - Behind Traefik Reverse Proxy
-
-services:
-  homeserver:
-    image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
-    restart: unless-stopped
-    command: /sbin/conduwuit
-    volumes:
-      - db:/var/lib/continuwuity
-      - ./continuwuity-resolv.conf:/etc/resolv.conf # use custom resolvers rather than Docker's
-      #- ./continuwuity.toml:/etc/continuwuity.toml
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.continuwuity.rule=(Host(`matrix.example.com`) || (Host(`example.com`) && PathPrefix(`/.well-known/matrix`)))"
-      - "traefik.http.routers.continuwuity.entrypoints=websecure" # your HTTPS entry point
-      - "traefik.http.routers.continuwuity.tls=true"
-      - "traefik.http.routers.continuwuity.service=continuwuity"
-      - "traefik.http.services.continuwuity.loadbalancer.server.port=8008"
-      # possibly, depending on your config:
-      # - "traefik.http.routers.continuwuity.tls.certresolver=letsencrypt"
-    environment:
-      CONTINUWUITY_SERVER_NAME: example.com # EDIT THIS
-      CONTINUWUITY_DATABASE_PATH: /var/lib/continuwuity
-      CONTINUWUITY_ADDRESS: 0.0.0.0
-      CONTINUWUITY_PORT: 8008 # This must match with traefik's loadbalancer label
-      #CONTINUWUITY_CONFIG: '/etc/continuwuity.toml' # Uncomment if you mapped config toml above
-
-      # Serve .well-known files to tell others to reach Continuwuity on port :443
-      CONTINUWUITY_WELL_KNOWN: |
-        {
-        client=https://matrix.example.com,
-        server=matrix.example.com:443
-        }
-
-volumes:
-  db:
-
-networks:
-  # This must match the network name that Traefik listens on
-  proxy:
-    external: true
@@ -1,54 +0,0 @@
-# Continuwuity - With Caddy Labels
-
-services:
-    caddy:
-    # This compose file uses caddy-docker-proxy as the reverse proxy for Continuwuity!
-    # For more info, visit https://github.com/lucaslorentz/caddy-docker-proxy
-        image: "docker.io/lucaslorentz/caddy-docker-proxy:ci-alpine"
-        ports:
-            - 80:80
-            - 443:443
-        environment:
-            - CADDY_INGRESS_NETWORKS=caddy
-        networks:
-            - caddy
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock
-            - ./data:/data
-        restart: unless-stopped
-        labels:
-            caddy: example.com
-            caddy.reverse_proxy: /.well-known/matrix/* homeserver:8008
-
-    homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
-        restart: unless-stopped
-        command: /sbin/conduwuit
-        volumes:
-            - db:/var/lib/continuwuity
-            - ./continuwuity-resolv.conf:/etc/resolv.conf # use custom resolvers rather than Docker's
-            #- ./continuwuity.toml:/etc/continuwuity.toml
-        environment:
-            CONTINUWUITY_SERVER_NAME: example.com # EDIT THIS
-            CONTINUWUITY_DATABASE_PATH: /var/lib/continuwuity
-            CONTINUWUITY_ADDRESS: 0.0.0.0
-            CONTINUWUITY_PORT: 8008
-            #CONTINUWUITY_CONFIG: '/etc/continuwuity.toml' # Uncomment if you mapped config toml above
-
-            # Serve .well-known files to tell others to reach Continuwuity on port :443
-            CONTINUWUITY_WELL_KNOWN: |
-                {
-                client=https://matrix.example.com,
-                server=matrix.example.com:443
-                }
-
-        networks:
-            - caddy
-        labels:
-            caddy: matrix.example.com
-            caddy.reverse_proxy: "{{upstreams 8008}}"
-volumes:
-    db:
-
-networks:
-    caddy:
@@ -1,57 +0,0 @@
-# Continuwuity - Using Caddy Docker Image
-
-services:
-    caddy:
-        image: "docker.io/caddy:latest"
-        ports:
-            - 80:80
-            - 443:443
-        networks:
-            - caddy
-        volumes:
-            - ./data:/data
-        restart: unless-stopped
-        configs:
-            - source: Caddyfile
-              target: /etc/caddy/Caddyfile
-
-    homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
-        restart: unless-stopped
-        command: /sbin/conduwuit
-        volumes:
-            - db:/var/lib/continuwuity
-            - ./continuwuity-resolv.conf:/etc/resolv.conf # use custom resolvers rather than Docker's
-            #- ./continuwuity.toml:/etc/continuwuity.toml
-        environment:
-            CONTINUWUITY_SERVER_NAME: example.com
-            CONTINUWUITY_DATABASE_PATH: /var/lib/continuwuity
-            CONTINUWUITY_ADDRESS: 0.0.0.0
-            CONTINUWUITY_PORT: 8008
-            #CONTINUWUITY_CONFIG: '/etc/continuwuity.toml' # Uncomment if you mapped config toml above
-
-            ## Serve .well-known files to tell others to reach Continuwuity on port :443
-            CONTINUWUITY_WELL_KNOWN: |
-                {
-                client=https://matrix.example.com,
-                server=matrix.example.com:443
-                }
-
-        networks:
-            - caddy
-
-networks:
-    caddy:
-
-volumes:
-    db:
-
-configs:
-    Caddyfile:
-        content: |
-            https://matrix.example.com:443 {
-                reverse_proxy http://homeserver:8008
-            }
-            https://example.com:443 {
-                reverse_proxy /.well-known/matrix* http://homeserver:8008
-            }
@@ -1,85 +0,0 @@
-# Continuwuity - With Traefik Reverse Proxy
-
-services:
-  homeserver:
-    image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
-    restart: unless-stopped
-    command: /sbin/conduwuit
-    volumes:
-      - db:/var/lib/continuwuity
-      - ./continuwuity-resolv.conf:/etc/resolv.conf # use custom resolvers rather than Docker's
-      #- ./continuwuity.toml:/etc/continuwuity.toml
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.continuwuity.rule=(Host(`matrix.example.com`) || (Host(`example.com`) && PathPrefix(`/.well-known/matrix`)))"
-      - "traefik.http.routers.continuwuity.entrypoints=websecure"
-      - "traefik.http.routers.continuwuity.tls.certresolver=letsencrypt"
-      - "traefik.http.services.continuwuity.loadbalancer.server.port=8008"
-    environment:
-      CONTINUWUITY_SERVER_NAME: example.com # EDIT THIS
-      CONTINUWUITY_DATABASE_PATH: /var/lib/continuwuity
-      CONTINUWUITY_ADDRESS: 0.0.0.0
-      CONTINUWUITY_PORT: 8008 # This must match with traefik's loadbalancer label
-      #CONTINUWUITY_CONFIG: '/etc/continuwuity.toml' # Uncomment if you mapped config toml above
-
-      # Serve .well-known files to tell others to reach Continuwuity on port :443
-      CONTINUWUITY_WELL_KNOWN: |
-        {
-          client=https://matrix.example.com,
-          server=matrix.example.com:443
-        }
-
-  traefik:
-    image: "docker.io/traefik:latest"
-    container_name: "traefik"
-    restart: "unless-stopped"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "acme:/etc/traefik/acme"
-    labels:
-      - "traefik.enable=true"
-
-      # middleware redirect
-      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
-      # global redirect to https
-      - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
-      - "traefik.http.routers.redirs.entrypoints=web"
-      - "traefik.http.routers.redirs.middlewares=redirect-to-https"
-
-    environment:
-
-      TRAEFIK_LOG_LEVEL: DEBUG
-      TRAEFIK_ENTRYPOINTS_WEB: true
-      TRAEFIK_ENTRYPOINTS_WEB_ADDRESS: ":80"
-      TRAEFIK_ENTRYPOINTS_WEB_HTTP_REDIRECTIONS_ENTRYPOINT_TO: websecure
-
-      TRAEFIK_ENTRYPOINTS_WEBSECURE: true
-      TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS: ":443"
-      TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_TLS_CERTRESOLVER: letsencrypt
-
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT: true
-      # CHANGE THIS to desired email for ACME
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: user@example.com
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE: true
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT: web
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE: "/etc/traefik/acme/acme.json"
-
-      # Since Traefik 3.6.3, paths with certain "encoded characters" are now blocked by default; we need a couple, or else things *will* break
-      TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDSLASH: true
-      TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_ENCODEDCHARACTERS_ALLOWENCODEDHASH: true
-
-      TRAEFIK_PROVIDERS_DOCKER: true
-      TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: "unix:///var/run/docker.sock"
-      TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: false
-
-volumes:
-  db:
-  acme:
-
-networks:
-  proxy:
@@ -2,7 +2,7 @@

 services:
  homeserver:
-    image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+    image: forgejo.ellis.link/continuwuation/continuwuity:latest
    restart: unless-stopped
    command: /sbin/conduwuit
    volumes:
@@ -38,6 +38,7 @@ volumes:
  db:

 networks:
-  # This must match the network name that Traefik listens on
+  # This is the network Traefik listens to, if your network has a different
+  # name, don't forget to change it here and in the docker-compose.override.yml
  proxy:
    external: true
@@ -1,10 +1,10 @@
-# Continuwuity - Traefik Reverse Proxy Labels (override file)
+# Continuwuity - Traefik Reverse Proxy Labels

 services:
  homeserver:
    labels:
      - "traefik.enable=true"
-      - "traefik.docker.network=proxy" # Change this to the name of your Traefik docker proxy network
+      - "traefik.docker.network=proxy"  # Change this to the name of your Traefik docker proxy network

      - "traefik.http.routers.to-continuwuity.rule=Host(`example.com`)"  # Change to the address on which Continuwuity is hosted
      - "traefik.http.routers.to-continuwuity.tls=true"
@@ -14,10 +14,13 @@ services:
      # This must match with CONTINUWUITY_PORT (default: 8008)
      - "traefik.http.services.to_continuwuity.loadbalancer.server.port=8008"

+      - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
+      - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
+      - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"
+
      # If you want to have your account on <DOMAIN>, but host Continuwuity on a subdomain,
-      # you can let it only handle the well known file on the base domain instead
-      #
-      # - "traefik.http.routers.to-matrix-wellknown.rule=Host(`example.com`) && PathPrefix(`/.well-known/matrix`)"
+      # you can let it only handle the well known file on that domain instead
+      #- "traefik.http.routers.to-matrix-wellknown.rule=Host(`example.com`) && PathPrefix(`/.well-known/matrix`)"
      #- "traefik.http.routers.to-matrix-wellknown.tls=true"
      #- "traefik.http.routers.to-matrix-wellknown.tls.certresolver=letsencrypt"
      #- "traefik.http.routers.to-matrix-wellknown.middlewares=cors-headers@docker"
@@ -1,10 +1,8 @@
-# Continuwuity - With Caddy Labels
-
 services:
    caddy:
    # This compose file uses caddy-docker-proxy as the reverse proxy for Continuwuity!
    # For more info, visit https://github.com/lucaslorentz/caddy-docker-proxy
-        image: "docker.io/lucaslorentz/caddy-docker-proxy:ci-alpine"
+        image: lucaslorentz/caddy-docker-proxy:ci-alpine
        ports:
            - 80:80
            - 443:443
@@ -18,7 +16,7 @@ services:
        restart: unless-stopped

    homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        image: forgejo.ellis.link/continuwuation/continuwuity:latest
        restart: unless-stopped
        command: /sbin/conduwuit
        volumes:
@@ -1,8 +1,6 @@
-# Continuwuity - Using Caddy Docker Image
-
 services:
    caddy:
-        image: "docker.io/caddy:latest"
+        image: docker.io/caddy:latest
        ports:
            - 80:80
            - 443:443
@@ -17,7 +15,7 @@ services:
              target: /etc/caddy/Caddyfile

    homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        image: forgejo.ellis.link/continuwuation/continuwuity:latest
        restart: unless-stopped
        command: /sbin/conduwuit
        volumes:
@@ -39,6 +37,7 @@ services:
            #     server=example.com:443
            #     }

+
        networks:
            - caddy

@@ -49,8 +48,8 @@ volumes:
    db:

 configs:
-    Caddyfile:
+    dynamic.yml:
        content: |
-            https://example.com:443, https://example.com:8448 {
+            https://example.com, https://example.com:8448 {
                reverse_proxy http://homeserver:8008
            }
@@ -1,8 +1,8 @@
-# Continuwuity - With Traefik Reverse Proxy
+# Continuwuity - Behind Traefik Reverse Proxy

 services:
  homeserver:
-    image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+    image: forgejo.ellis.link/continuwuation/continuwuity:latest
    restart: unless-stopped
    command: /sbin/conduwuit
    volumes:
@@ -32,14 +32,14 @@ services:
        }

  traefik:
-    image: "docker.io/traefik:latest"
+    image: "traefik:latest"
    container_name: "traefik"
    restart: "unless-stopped"
    ports:
      - "80:80"
      - "443:443"
    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "/var/run/docker.sock:/var/run/docker.sock:z"
      - "acme:/etc/traefik/acme"
    labels:
      - "traefik.enable=true"
@@ -52,7 +52,6 @@ services:
      - "traefik.http.routers.redirs.middlewares=redirect-to-https"

    environment:
-
      TRAEFIK_LOG_LEVEL: DEBUG
      TRAEFIK_ENTRYPOINTS_WEB: true
      TRAEFIK_ENTRYPOINTS_WEB_ADDRESS: ":80"
@@ -1,23 +1,12 @@
-# Continuwuity - Bare Configuration (for other reverse proxies)
+# Continuwuity

 services:
    homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        image: forgejo.ellis.link/continuwuation/continuwuity:latest
        restart: unless-stopped
        command: /sbin/conduwuit
        ports:
-
-            # If your reverse proxy is on the host, use this
-            # and configure it to connect to `127.0.0.1:8008`
            - 127.0.0.1:8008:8008
-
-            # If your reverse proxy is on another machine, use this
-            # and configure it to connect to <this-machine-ip>:8008
-            # - 8008:8008
-
-            # If your reverse proxy is a docker container on the same network,
-            # comment out the entire `ports` section, and configure it to connect to `continuwuity:8008`
-
        volumes:
            - db:/var/lib/continuwuity
            - ./continuwuity-resolv.conf:/etc/resolv.conf # use custom resolvers rather than Docker's
@@ -37,5 +26,6 @@ services:
            #     server=example.com:443
            #     }

+
 volumes:
    db:
@@ -146,7 +146,7 @@ cargo clippy \
    --locked \
    --profile test \
    --no-default-features \
-    --features=console,systemd,element_hacks,direct_tls,perf_measurements,brotli_compression \
+    --features=console,systemd,element_hacks,direct_tls,perf_measurements,brotli_compression,blurhashing \
    --color=always \
    -- \
    -D warnings
@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1777645914,
-        "narHash": "sha256-P1T7QVQS13OvkXEuEhI91CLaQfyv6iqV9vW8IBLLDYg=",
+        "lastModified": 1775907537,
+        "narHash": "sha256-vbeLNgmsx1Z6TwnlDV0dKyeBCcon3UpkV9yLr/yc6HM=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "d6ba1f7070ba91f45efe372d68eb648be67d0417",
+        "rev": "d99f7b9eb81731bddebf80a355f8be7b2f8b1b28",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1777335812,
-        "narHash": "sha256-bEg5xoAxAwsyfnGhkEX7RJViTIBIYPd8ISg4O1c0HFc=",
+        "lastModified": 1775839657,
+        "narHash": "sha256-SPm9ck7jh3Un9nwPuMGbRU04UroFmOHjLP56T10MOeM=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "5e0fb2f64edff2822249f21293b8304dedaaf676",
+        "rev": "7cf72d978629469c4bd4206b95c402514c1f6000",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1777624102,
-        "narHash": "sha256-thSyElkje577x/kAbP72nHlfiFc1a+tCudskLPHXe9s=",
+        "lastModified": 1775891769,
+        "narHash": "sha256-EOfVlTKw2n8w1uhfh46GS4hEGnQ7oWrIWQfIY6utIkI=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "4d81601e0b73f20d81d066754ad0e7d1e7f75a06",
+        "rev": "6fbc54dde15aee725bdc7aae5e478849685d5f56",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "lastModified": 1775710090,
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1777583169,
-        "narHash": "sha256-dVJ4+wrRKc8oIgp3rLOFSq1obt/sCKlXy3h47qof/w0=",
+        "lastModified": 1775843361,
+        "narHash": "sha256-j53ZgyDvmYf3Sjh1IPvvTjqa614qUfVQSzj59+MpzkY=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "aa64e4828a2bbba44463c1229a81c748d3cce583",
+        "rev": "9eb97ea96d8400e8957ddd56702e962614296583",
        "type": "github"
      },
      "original": {
@@ -16,24 +16,26 @@
      }
    },
    "node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.2.tgz",
+      "integrity": "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==",
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "@emnapi/wasi-threads": "1.2.1",
        "tslib": "^2.4.0"
      }
    },
    "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.2.tgz",
+      "integrity": "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw==",
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "tslib": "^2.4.0"
      }
@@ -45,6 +47,7 @@
      "dev": true,
      "license": "MIT",
      "optional": true,
+      "peer": true,
      "dependencies": {
        "tslib": "^2.4.0"
      }
@@ -106,9 +109,9 @@
      }
    },
    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
-      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.2.tgz",
+      "integrity": "sha512-sNXv5oLJ7ob93xkZ1XnxisYhGYXfaG9f65/ZgYuAu3qt7b3NadcOEhLvx28hv31PgX8SZJRYrAIPQilQmFpLVw==",
      "dev": true,
      "license": "MIT",
      "optional": true,
@@ -125,13 +128,13 @@
      }
    },
    "node_modules/@rsbuild/core": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.5.tgz",
-      "integrity": "sha512-KajO50hbXb32S8MsyDh2f+xKcVeRy9Gfzdcy0JjpMLj22djHugly6jrGo7jH7ls9X6/TDcyCTncSuNK4+D2lTw==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.0-rc.1.tgz",
+      "integrity": "sha512-eqxtRlQiFSm/ibCNGiPj8ozsGSNK91NY+GksmPuTCPmWQExGtPqM1V+s13UYeWZS6fYbMRs7NlQKD896e0QkKA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/core": "~2.0.2",
+        "@rspack/core": "2.0.0-rc.1",
        "@swc/helpers": "^0.5.21"
      },
      "bin": {
@@ -150,17 +153,17 @@
      }
    },
    "node_modules/@rsbuild/plugin-react": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.0.0.tgz",
-      "integrity": "sha512-/1gzt39EGUSFEqB83g46QoOwsgv172HI18i6au1b6lgIaX4sv9stuX4ijdHbHCp8PqYEq+MyQ99jIQMO6I+etg==",
+      "version": "1.4.6",
+      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-1.4.6.tgz",
+      "integrity": "sha512-LAT6xHlEyZKA0VjF/ph5d50iyG+WSmBx+7g98HNZUwb94VeeTMZFB8qVptTkbIRMss3BNKOXmHOu71Lhsh9oEw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/plugin-react-refresh": "2.0.0",
+        "@rspack/plugin-react-refresh": "^1.6.1",
        "react-refresh": "^0.18.0"
      },
      "peerDependencies": {
-        "@rsbuild/core": "^2.0.0-0"
+        "@rsbuild/core": "^1.0.0 || ^2.0.0-0"
      },
      "peerDependenciesMeta": {
        "@rsbuild/core": {
@@ -169,28 +172,28 @@
      }
    },
    "node_modules/@rspack/binding": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.2.tgz",
-      "integrity": "sha512-0kZPplW9GWx8mfC6DfsaRY3QBIYPuUs42JfmSM6aSb8tMHZAXQeLeMB8M+h8i4SeI+aFtCgO6UuYGtyWf7+L+A==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.0-rc.1.tgz",
+      "integrity": "sha512-rhJqtbyiRPOjTAZW0xTZFbOrS5yP5yL1SF0DPE9kvFfzePz30IqjMDMxL0KuhkDZd/M1eUINJyoqd8NTbR9wHw==",
      "dev": true,
      "license": "MIT",
      "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "2.0.2",
-        "@rspack/binding-darwin-x64": "2.0.2",
-        "@rspack/binding-linux-arm64-gnu": "2.0.2",
-        "@rspack/binding-linux-arm64-musl": "2.0.2",
-        "@rspack/binding-linux-x64-gnu": "2.0.2",
-        "@rspack/binding-linux-x64-musl": "2.0.2",
-        "@rspack/binding-wasm32-wasi": "2.0.2",
-        "@rspack/binding-win32-arm64-msvc": "2.0.2",
-        "@rspack/binding-win32-ia32-msvc": "2.0.2",
-        "@rspack/binding-win32-x64-msvc": "2.0.2"
+        "@rspack/binding-darwin-arm64": "2.0.0-rc.1",
+        "@rspack/binding-darwin-x64": "2.0.0-rc.1",
+        "@rspack/binding-linux-arm64-gnu": "2.0.0-rc.1",
+        "@rspack/binding-linux-arm64-musl": "2.0.0-rc.1",
+        "@rspack/binding-linux-x64-gnu": "2.0.0-rc.1",
+        "@rspack/binding-linux-x64-musl": "2.0.0-rc.1",
+        "@rspack/binding-wasm32-wasi": "2.0.0-rc.1",
+        "@rspack/binding-win32-arm64-msvc": "2.0.0-rc.1",
+        "@rspack/binding-win32-ia32-msvc": "2.0.0-rc.1",
+        "@rspack/binding-win32-x64-msvc": "2.0.0-rc.1"
      }
    },
    "node_modules/@rspack/binding-darwin-arm64": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.2.tgz",
-      "integrity": "sha512-0o7lbgBBsDlICWdjIH0q3e0BsSco4GRiImHWVfZSVEG+q2+ykZJvSvYCVhPM1Co375Z0S3VMPa/8SjcY1FHwlw==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.0-rc.1.tgz",
+      "integrity": "sha512-fYbeDDDg6QKZzXYt/J0/j0Qhr01wQLuISUsYnNhu5MLwdXVUSVcqz+CTqgF3d0EQVVn6FqLV63lbNRzUGfSq9g==",
      "cpu": [
        "arm64"
      ],
@@ -202,9 +205,9 @@
      ]
    },
    "node_modules/@rspack/binding-darwin-x64": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.2.tgz",
-      "integrity": "sha512-tOwxZpoPlTlRs/w6UyUinXJ4TYRVHMlR7+eQxO1R3muKpixvhXQjtvoaY16HuFyTVky5F0IfOoWr3x9FEsgdLg==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.0-rc.1.tgz",
+      "integrity": "sha512-MvXi9kr8xXn1y0PD1WI/4YphRNOdbykJjKdEsAG4JxEVoERmhIHOTwKvUqlejajizAwlVZcxQl/FacoPLsKN5Q==",
      "cpu": [
        "x64"
      ],
@@ -216,9 +219,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-gnu": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.2.tgz",
-      "integrity": "sha512-1ZD4YFhG1rmgqj+W8hfwHyKV8xDxGsc/3KgU0FwmiVEX7JfzhCkgBO/xlCG79kRKSrzuVzt4icO/G3cCKn0pag==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.0-rc.1.tgz",
+      "integrity": "sha512-j6WsHEwGSdUoiy4BsQBW0RjFl+MBzozdybSYhkiyVSoHlbm7CPt3XaaS3elH5YcwuLHORmVHPP91QhwWl9UFJg==",
      "cpu": [
        "arm64"
      ],
@@ -233,9 +236,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-musl": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.2.tgz",
-      "integrity": "sha512-/PtTkM/DsDLjeuXTmeJeRfbjCDbcL9jvoVgZrgxYFZ28y2cdLvbChbW9uigOzs5dQEs1CIBQXMTTj7KhdBTuQg==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.0-rc.1.tgz",
+      "integrity": "sha512-MPoZE0aS8oH+Wr0R5tIYch8gbUwYYf4LsiGdP6enMKMTrmpJyOVGlhPHVSwsrFgBg7fjTGOuxHuibtsvDUdLOQ==",
      "cpu": [
        "arm64"
      ],
@@ -250,9 +253,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-gnu": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.2.tgz",
-      "integrity": "sha512-bBjsZxMHRaPo6X9SokApm6ucs+UhXtAJFyJJyuk2BH4XJsLeCU9Dz1vMwioeohFbJUUeTASVPm6/BL+RhSaunw==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.0-rc.1.tgz",
+      "integrity": "sha512-gOlPCwtIg9GsFG/8ZdUyV5SyXDaGq2kmtXmyyFU7RO33MaalltNEBMf2hevRPj9z39eSzxwgJDonMOdx5Fo0Og==",
      "cpu": [
        "x64"
      ],
@@ -267,9 +270,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-musl": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.2.tgz",
-      "integrity": "sha512-HjlpInqzabDNkhVsUJpsHPqa9QYVWBViJoyWNjzXCAW0vKMDvwaphyUvokSinX8FGTlZi/sr5UEaHJo6XtQ35g==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.0-rc.1.tgz",
+      "integrity": "sha512-K6Swk1rfP4z4b6bp84NlikGlUWMOPpIWCtlPr/W0TWgc2C/cd844oHdoIu7WtmOH7y9AwB5UG2bWpgFAVwykCw==",
      "cpu": [
        "x64"
      ],
@@ -284,9 +287,9 @@
      ]
    },
    "node_modules/@rspack/binding-wasm32-wasi": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.2.tgz",
-      "integrity": "sha512-YaRYNFLJRpkGfYjSWR7n9f+nQKtrlmrrffpAn/blc2geHcRvXoBc5SCs1idPtsLhj7H9qWWhs7ucjyHy4csWFg==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.0-rc.1.tgz",
+      "integrity": "sha512-aa9oUTqOb1QjwsHVlMr5sV+7mcBI4MLQ/xhFO2CIEcfVnJIPl8XpKUbDEgqMwcFlzcgzKmHg5cVmIvd82BLgow==",
      "cpu": [
        "wasm32"
      ],
@@ -294,15 +297,13 @@
      "license": "MIT",
      "optional": true,
      "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "1.1.4"
+        "@napi-rs/wasm-runtime": "1.1.2"
      }
    },
    "node_modules/@rspack/binding-win32-arm64-msvc": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.2.tgz",
-      "integrity": "sha512-d/3kTEKq+asLjRFPO96t+wfWiM7DLN76VQEPDD9bc1kdsZXlVJBuvyXfsgK8bbEvKplWXYcSsokhmEnuXrLOpg==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.0-rc.1.tgz",
+      "integrity": "sha512-+UxF0c7E9bE3siFbMHi+mmoeQJzcTKl1j3x+Y6MY/PJ3V70cU23wOaxMvmSsCyq2JNJBT2RCNZ9HaL+o3kReug==",
      "cpu": [
        "arm64"
      ],
@@ -314,9 +315,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-ia32-msvc": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.2.tgz",
-      "integrity": "sha512-161cWineq3RW+Jdm1FAfSpXeUtYWvhB3kAbm46vNT9h/YYz+spwsFMvveAZ1nsVSVL0IC5lDBGUte7yUAY8K2g==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.0-rc.1.tgz",
+      "integrity": "sha512-gc0JdkdxSWo+o/b1qTCT6mZ3DrlGe32eW+Ps3xInxcG4UHjUG7hTDgFtOgVQ6VhQ8WMUXG+TQOz0CySVpYjsoQ==",
      "cpu": [
        "ia32"
      ],
@@ -328,9 +329,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-x64-msvc": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.2.tgz",
-      "integrity": "sha512-y7Q0S1FE+OlkL5GMqLG0PwxrPw6E1r892KhGrGKE1Vdufe5YTEx6xTPxzZ+b7N2KPD7s9G1/iJmWHQxb1+Bjkg==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.0-rc.1.tgz",
+      "integrity": "sha512-Dnj0jthyVUikf65MGEyZy3akshtSmR1xsp/Xr0h/NWTo5JFWHKAFNYFE+jFfY0uzC8e4IDcLQLYoFomqV1DsEg==",
      "cpu": [
        "x64"
      ],
@@ -342,13 +343,13 @@
      ]
    },
    "node_modules/@rspack/core": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.2.tgz",
-      "integrity": "sha512-VM3UHOo26uC+4QSqY5tU1ybI7KuXY5rTof8nhFOaBY9SYau0Smvr+hMSAPmrmHwknB6dXT8yaNVxrj7I+qxE1Q==",
+      "version": "2.0.0-rc.1",
+      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.0-rc.1.tgz",
+      "integrity": "sha512-OIfkYn05/IWtVIdZ8Y/a0y/k4ipzqfApxIZqnJM59G/bGwQKMBrLHpOMGgV2Wmq1j9UMXzF7ZtsFMUbYBhFb9A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/binding": "2.0.2"
+        "@rspack/binding": "2.0.0-rc.1"
      },
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
@@ -367,36 +368,39 @@
      }
    },
    "node_modules/@rspack/plugin-react-refresh": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@rspack/plugin-react-refresh/-/plugin-react-refresh-2.0.0.tgz",
-      "integrity": "sha512-Cf6CxBStNDJbiXMc/GmsvG1G8PRlUpa0MSfWsMTI+e8npzuTN/p8nwLs3shriBZOLciqgkSZpBtPTd10BLpj1g==",
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/@rspack/plugin-react-refresh/-/plugin-react-refresh-1.6.2.tgz",
+      "integrity": "sha512-k+/VrfTNgo+KirjI6V+8CWRj6y+DH9jOUWv8JorYY4vKf/9xfnZ8xHzuB4iqCwTtoZl9YnxOaOuoyjJipc2tiQ==",
      "dev": true,
      "license": "MIT",
+      "dependencies": {
+        "error-stack-parser": "^2.1.4"
+      },
      "peerDependencies": {
-        "@rspack/core": "^2.0.0-0",
-        "react-refresh": ">=0.10.0 <1.0.0"
+        "react-refresh": ">=0.10.0 <1.0.0",
+        "webpack-hot-middleware": "2.x"
      },
      "peerDependenciesMeta": {
-        "@rspack/core": {
+        "webpack-hot-middleware": {
          "optional": true
        }
      }
    },
    "node_modules/@rspress/core": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.11.tgz",
-      "integrity": "sha512-4YBOFmSMFv5GWrCa80qSIW8VxqZQQS/PknVq2r7Hb7kgfB38Fzciopn3hjb3hNwI4TTRbsi/Jev2HyRWD4bYAQ==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.9.tgz",
+      "integrity": "sha512-cfbqqbWtdimrWIsfeyPnQOTKwJpdNLr8VnwLIL4JYC2ZcRq+xcInpszLXVpV86nONL6qI19usr2Or7uzZJ+ynA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@mdx-js/mdx": "^3.1.1",
        "@mdx-js/react": "^3.1.1",
-        "@rsbuild/core": "^2.0.5",
-        "@rsbuild/plugin-react": "~2.0.0",
-        "@rspress/shared": "2.0.11",
+        "@rsbuild/core": "2.0.0-rc.1",
+        "@rsbuild/plugin-react": "~1.4.6",
+        "@rspress/shared": "2.0.9",
        "@shikijs/rehype": "^4.0.2",
        "@types/unist": "^3.0.3",
-        "@unhead/react": "^2.1.15",
+        "@unhead/react": "^2.1.13",
        "body-scroll-lock": "4.0.0-beta.0",
        "clsx": "2.1.1",
        "copy-to-clipboard": "^3.3.3",
@@ -407,12 +411,12 @@
        "mdast-util-mdxjs-esm": "^2.0.1",
        "medium-zoom": "1.1.0",
        "nprogress": "^0.2.0",
-        "react": "^19.2.6",
-        "react-dom": "^19.2.6",
+        "react": "^19.2.4",
+        "react-dom": "^19.2.4",
        "react-lazy-with-preload": "^2.2.1",
        "react-reconciler": "0.33.0",
        "react-render-to-markdown": "19.0.1",
-        "react-router-dom": "^7.15.0",
+        "react-router-dom": "^7.13.2",
        "rehype-external-links": "^3.0.0",
        "rehype-raw": "^7.0.0",
        "remark-cjk-friendly": "^2.0.1",
@@ -436,39 +440,39 @@
      }
    },
    "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.11.tgz",
-      "integrity": "sha512-DI9vod5mGccg57c19CuFpN3mGP1FEEueOUnEUz1UHXSyXg9YTj+ox7Xla4jUUzAzoPVGiWSSsfbtCTwdoxAsbg==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.9.tgz",
+      "integrity": "sha512-r2GyHzOSt8CeS4UIsy/cPM5Zotekt1JVQFmgOYGapvll5ktUlVcd77HLtXDbZjtpgtj0XlaMLrXueOpV2gsBoQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
      },
      "peerDependencies": {
-        "@rspress/core": "^2.0.10"
+        "@rspress/core": "^2.0.9"
      }
    },
    "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.11.tgz",
-      "integrity": "sha512-046LCHgbJXdaPipWB2SWMjZcAtIrOjXGZOD92xlTjhZ74D7Mk1Nod1MQdtOEoISWedcHdgpUVXMDbB1doKBpPQ==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.9.tgz",
+      "integrity": "sha512-GTuXuySaeaazUZoUxdk2vZ8p0ehIgulPjCP9C7gDg6lIh5JGpUbcjG4def4tWHsxUoKp2rIwu/93bHwKb8T0Mw==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
      },
      "peerDependencies": {
-        "@rspress/core": "^2.0.10"
+        "@rspress/core": "^2.0.9"
      }
    },
    "node_modules/@rspress/shared": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.11.tgz",
-      "integrity": "sha512-7l5Pso4s597utJyisVEnd7n/40h053nfE8DwGQMeS8RLGtSwVgxFwNHsSrvQEGtFlLrg2aWWSITqnAVO1wfTew==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.9.tgz",
+      "integrity": "sha512-G48n3pC7AVAR58pLqwClUCYj5Nt7ZgYEStR8VTBGFuPgXtzb3+KPfo/gz0hb6wxdKJ1cL5ohPsZ6EXqllu6lew==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rsbuild/core": "^2.0.5",
+        "@rsbuild/core": "2.0.0-rc.1",
        "@shikijs/rehype": "^4.0.2",
        "unified": "^11.0.5"
      }
@@ -610,9 +614,9 @@
      }
    },
    "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
+      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
      "dev": true,
      "license": "MIT",
      "optional": true,
@@ -707,13 +711,13 @@
      "license": "ISC"
    },
    "node_modules/@unhead/react": {
-      "version": "2.1.15",
-      "resolved": "https://registry.npmjs.org/@unhead/react/-/react-2.1.15.tgz",
-      "integrity": "sha512-5hfAaZ3XJq9JkspRzZdSPsMrXXA8v/SKiEOxZcN9L40o44byF/50bcQuOLgSSCAx8802mI5VG32KZXWTtsLu9Q==",
+      "version": "2.1.13",
+      "resolved": "https://registry.npmjs.org/@unhead/react/-/react-2.1.13.tgz",
+      "integrity": "sha512-gC48tNJ0UtbithkiKCc2WUlxbVVk5o171EtruS2w2hQUblfYFHzCPu2hljjT1e0tUHXXqN8EMv7mpxHddMB2sg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "unhead": "2.1.15"
+        "unhead": "2.1.13"
      },
      "funding": {
        "url": "https://github.com/sponsors/harlan-zw"
@@ -968,6 +972,16 @@
        "url": "https://github.com/fb55/entities?sponsor=1"
      }
    },
+    "node_modules/error-stack-parser": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
+      "integrity": "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "stackframe": "^1.3.4"
+      }
+    },
    "node_modules/esast-util-from-estree": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/esast-util-from-estree/-/esast-util-from-estree-2.0.0.tgz",
@@ -1399,9 +1413,9 @@
      }
    },
    "node_modules/hookable": {
-      "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/hookable/-/hookable-6.1.1.tgz",
-      "integrity": "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/hookable/-/hookable-6.1.0.tgz",
+      "integrity": "sha512-ZoKZSJgu8voGK2geJS+6YtYjvIzu9AOM/KZXsBxr83uhLL++e9pEv/dlgwgy3dvHg06kTz6JOh1hk3C8Ceiymw==",
      "dev": true,
      "license": "MIT"
    },
@@ -2683,20 +2697,20 @@
      "license": "MIT"
    },
    "node_modules/oniguruma-parser": {
-      "version": "0.12.2",
-      "resolved": "https://registry.npmjs.org/oniguruma-parser/-/oniguruma-parser-0.12.2.tgz",
-      "integrity": "sha512-6HVa5oIrgMC6aA6WF6XyyqbhRPJrKR02L20+2+zpDtO5QAzGHAUGw5TKQvwi5vctNnRHkJYmjAhRVQF2EKdTQw==",
+      "version": "0.12.1",
+      "resolved": "https://registry.npmjs.org/oniguruma-parser/-/oniguruma-parser-0.12.1.tgz",
+      "integrity": "sha512-8Unqkvk1RYc6yq2WBYRj4hdnsAxVze8i7iPfQr8e4uSP3tRv0rpZcbGUDvxfQQcdwHt/e9PrMvGCsa8OqG9X3w==",
      "dev": true,
      "license": "MIT"
    },
    "node_modules/oniguruma-to-es": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/oniguruma-to-es/-/oniguruma-to-es-4.3.6.tgz",
-      "integrity": "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA==",
+      "version": "4.3.5",
+      "resolved": "https://registry.npmjs.org/oniguruma-to-es/-/oniguruma-to-es-4.3.5.tgz",
+      "integrity": "sha512-Zjygswjpsewa0NLTsiizVuMQZbp0MDyM6lIt66OxsF21npUDlzpHi1Mgb/qhQdkb+dWFTzJmFbEWdvZgRho8eQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "oniguruma-parser": "^0.12.2",
+        "oniguruma-parser": "^0.12.1",
        "regex": "^6.1.0",
        "regex-recursion": "^6.0.2"
      }
@@ -2753,9 +2767,9 @@
      }
    },
    "node_modules/react": {
-      "version": "19.2.6",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.6.tgz",
-      "integrity": "sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==",
+      "version": "19.2.5",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.5.tgz",
+      "integrity": "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2763,16 +2777,16 @@
      }
    },
    "node_modules/react-dom": {
-      "version": "19.2.6",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.6.tgz",
-      "integrity": "sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g==",
+      "version": "19.2.5",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.5.tgz",
+      "integrity": "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "scheduler": "^0.27.0"
      },
      "peerDependencies": {
-        "react": "^19.2.6"
+        "react": "^19.2.5"
      }
    },
    "node_modules/react-lazy-with-preload": {
@@ -2822,9 +2836,9 @@
      }
    },
    "node_modules/react-router": {
-      "version": "7.15.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.15.0.tgz",
-      "integrity": "sha512-HW9vYwuM8f4yx66Izy8xfrzCM+SBJluoZcCbww9A1TySax11S5Vgw6fi3ZjMONw9J4gQwngL7PzkyIpJJpJ7RQ==",
+      "version": "7.14.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.14.0.tgz",
+      "integrity": "sha512-m/xR9N4LQLmAS0ZhkY2nkPA1N7gQ5TUVa5n8TgANuDTARbn1gt+zLPXEm7W0XDTbrQ2AJSJKhoa6yx1D8BcpxQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2845,13 +2859,13 @@
      }
    },
    "node_modules/react-router-dom": {
-      "version": "7.15.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.15.0.tgz",
-      "integrity": "sha512-VcrVg64Fo8nwBvDscajG8gRTLIuTC6N50nb22l2HOOV4PTOHgoGp8mUjy9wLiHYoYTSYI36tUnXZgasSRFZorQ==",
+      "version": "7.14.0",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.14.0.tgz",
+      "integrity": "sha512-2G3ajSVSZMEtmTjIklRWlNvo8wICEpLihfD/0YMDxbWK2UyP5EGfnoIn9AIQGnF3G/FX0MRbHXdFcD+rL1ZreQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "react-router": "7.15.0"
+        "react-router": "7.14.0"
      },
      "engines": {
        "node": ">=20.0.0"
@@ -3204,6 +3218,13 @@
        "url": "https://github.com/sponsors/wooorm"
      }
    },
+    "node_modules/stackframe": {
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/stackframe/-/stackframe-1.3.4.tgz",
+      "integrity": "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/stringify-entities": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
@@ -3290,9 +3311,9 @@
      }
    },
    "node_modules/unhead": {
-      "version": "2.1.15",
-      "resolved": "https://registry.npmjs.org/unhead/-/unhead-2.1.15.tgz",
-      "integrity": "sha512-MCt5T90mCWyr3Z6pUCdM9lVRXoMoVBlL7z7U4CYVIiaDiuzad/UCfLuMqz5MeNmpZUgoBCQnrucJimU7EZR+XA==",
+      "version": "2.1.13",
+      "resolved": "https://registry.npmjs.org/unhead/-/unhead-2.1.13.tgz",
+      "integrity": "sha512-jO9M1sI6b2h/1KpIu4Jeu+ptumLmUKboRRLxys5pYHFeT+lqTzfNHbYUX9bxVDhC1FBszAGuWcUVlmvIPsah8Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -20,11 +20,7 @@ export default defineConfig({
                    '/deploying/docker-compose.for-traefik.yml',
                    '/deploying/docker-compose.with-traefik.yml',
                    `/deploying/docker-compose.override.yml`,
-                    `/deploying/docker-compose.yml`,
-                    '/advanced/delegated.docker-compose.with-caddy.yml',
-                    '/advanced/delegated.docker-compose.with-caddy-labels.yml',
-                    '/advanced/delegated.docker-compose.for-traefik.yml',
-                    '/advanced/delegated.docker-compose.with-traefik.yml',
+                    `/deploying/docker-compose.yml`
                ]
            },
        },
@@ -81,7 +81,6 @@ conduwuit-macros.workspace = true
 conduwuit-service.workspace = true
 const-str.workspace = true
 ctor.workspace = true
-dtor.workspace = true
 futures.workspace = true
 lettre.workspace = true
 log.workspace = true
@@ -102,6 +102,10 @@ pub(super) async fn remote_user_in_rooms(&self, user_id: OwnedUserId) -> Result
 		);
 	}

+	if !self.services.users.exists(&user_id).await {
+		return Err!("Remote user does not exist in our database.",);
+	}
+
 	let mut rooms: Vec<(OwnedRoomId, u64, String)> = self
 		.services
 		.rooms
@@ -1,8 +1,7 @@
 use clap::Subcommand;
 use conduwuit::Result;
-use conduwuit_database::Deserialized as _;
 use futures::StreamExt;
-use ruma::{OwnedRoomId, OwnedUserId, exports::serde::Serialize};
+use ruma::{OwnedRoomId, OwnedUserId};

 use crate::{admin_command, admin_command_dispatch};

@@ -59,22 +58,13 @@ async fn account_data_get(
 	room_id: Option<OwnedRoomId>,
 ) -> Result {
 	let timer = tokio::time::Instant::now();
-	let result = self
+	let results = self
 		.services
 		.account_data
 		.get_raw(room_id.as_deref(), &user_id, &kind)
 		.await;
 	let query_time = timer.elapsed();

-	let json = serde_json::to_string_pretty(&match room_id {
-		| None => result
-			.deserialized::<ruma::serde::Raw<ruma::events::AnyGlobalAccountDataEvent>>()?
-			.serialize(serde_json::value::Serializer)?,
-		| Some(_) => result
-			.deserialized::<ruma::serde::Raw<ruma::events::AnyRoomAccountDataEvent>>()?
-			.serialize(serde_json::value::Serializer)?,
-	})?;
-
-	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{json}\n```"))
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{results:#?}\n```"))
 		.await
 }
@@ -15,6 +15,10 @@ pub enum UsersCommand {

 	IterUsers2,

+	PasswordHash {
+		user_id: OwnedUserId,
+	},
+
 	ListDevices {
 		user_id: OwnedUserId,
 	},
@@ -231,6 +235,16 @@ async fn count_users(&self) -> Result {
 		.await
 }

+#[admin_command]
+async fn password_hash(&self, user_id: OwnedUserId) -> Result {
+	let timer = tokio::time::Instant::now();
+	let result = self.services.users.password_hash(&user_id).await;
+	let query_time = timer.elapsed();
+
+	self.write_str(&format!("Query completed in {query_time:?}:\n\n```rs\n{result:#?}\n```"))
+		.await
+}
+
 #[admin_command]
 async fn list_devices(&self, user_id: OwnedUserId) -> Result {
 	let timer = tokio::time::Instant::now();
@@ -4,7 +4,8 @@
 };

 use api::client::{
-	full_user_deactivate, leave_room, recreate_push_rules_and_return, remote_leave_room,
+	full_user_deactivate, join_room_by_id_helper, leave_room, recreate_push_rules_and_return,
+	remote_leave_room,
 };
 use conduwuit::{
 	Err, Result, debug_warn, error, info,
@@ -23,7 +24,6 @@
 		tag::{TagEvent, TagEventContent, TagInfo},
 	},
 };
-use service::users::HashedPassword;

 use crate::{
 	admin_command, get_room_info,
@@ -70,7 +70,7 @@ pub(super) async fn create_user(&self, username: String, password: Option<String
 	// Create user
 	self.services
 		.users
-		.create(&user_id, Some(HashedPassword::new(&password)?))
+		.create(&user_id, Some(password.as_str()), None)
 		.await?;

 	// Default to pretty displayname
@@ -134,20 +134,18 @@ pub(super) async fn create_user(&self, username: String, password: Option<String
 			}

 			if let Some(room_server_name) = room.server_name() {
-				match self
-					.services
-					.rooms
-					.membership
-					.join_room(
-						&user_id,
-						&room_id,
-						Some("Automatically joining this room upon registration".to_owned()),
-						&[
-							self.services.globals.server_name().to_owned(),
-							room_server_name.to_owned(),
-						],
-					)
-					.await
+				match join_room_by_id_helper(
+					self.services,
+					&user_id,
+					&room_id,
+					Some("Automatically joining this room upon registration".to_owned()),
+					&[
+						self.services.globals.server_name().to_owned(),
+						room_server_name.to_owned(),
+					],
+					&None,
+				)
+				.await
 				{
 					| Ok(_response) => {
 						info!("Automatically joined room {room} for user {user_id}");
@@ -276,13 +274,17 @@ pub(super) async fn reset_password(

 	let new_password = password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH));

-	self.services
+	match self
+		.services
 		.users
-		.set_password(&user_id, Some(HashedPassword::new(&new_password)?));
-
-	self.write_str(&format!(
-		"Successfully reset the password for user {user_id}: `{new_password}`"
-	))
+		.set_password(&user_id, Some(new_password.as_str()))
+		.await
+	{
+		| Err(e) => return Err!("Couldn't reset the password for user {user_id}: {e}"),
+		| Ok(()) => {
+			write!(self, "Successfully reset the password for user {user_id}: `{new_password}`")
+		},
+	}
 	.await?;

 	if logout {
@@ -429,82 +431,6 @@ pub(super) async fn deactivate_all(&self, no_leave_rooms: bool, force: bool) ->
 	.await
 }

-#[admin_command]
-pub(super) async fn list_invited_rooms(&self, user_id: String) -> Result {
-	// Validate user id
-	let user_id = parse_local_user_id(self.services, &user_id)?;
-
-	let mut rooms: Vec<((OwnedRoomId, u64, String), Result<OwnedUserId>)> = self
-		.services
-		.rooms
-		.state_cache
-		.rooms_invited(&user_id)
-		.then(async |(room_id, _)| {
-			let sender = self
-				.services
-				.rooms
-				.state_cache
-				.invite_sender(&user_id, &room_id)
-				.await;
-			(get_room_info(self.services, &room_id).await, sender)
-		})
-		.collect()
-		.await;
-
-	if rooms.is_empty() {
-		return Err!("User is not invited to any rooms.");
-	}
-
-	rooms.sort_by_key(|r| r.0.1);
-	rooms.reverse();
-
-	let body = rooms
-		.iter()
-		.map(|((id, members, name), sender)| match sender {
-			| Ok(user_id) =>
-				format!("{id}\tInviter: {user_id}\tMembers: {members}\tName: {name}"),
-			| Err(_) => format!("{id}\tMembers: {members}\tName: {name}"),
-		})
-		.collect::<Vec<_>>()
-		.join("\n");
-
-	self.write_str(&format!("Rooms {user_id} is Invited to ({}):\n```\n{body}\n```", rooms.len()))
-		.await
-}
-
-#[admin_command]
-pub(super) async fn reject_all_invites(&self, user_id: String) -> Result {
-	let user_id = parse_local_user_id(self.services, &user_id)?;
-
-	assert!(
-		self.services.globals.user_is_local(&user_id),
-		"Parsed user_id must be a local user"
-	);
-
-	let fails = self
-		.services
-		.rooms
-		.state_cache
-		.rooms_invited(&user_id)
-		.filter_map(async |(room_id, _)| {
-			match leave_room(self.services, &user_id, &room_id, None).await {
-				| Err(ref e) => {
-					warn!(%user_id, "Failed to leave {room_id}: {e}");
-					Some(())
-				},
-				| Ok(()) => None,
-			}
-		})
-		.count()
-		.await;
-
-	if fails > 0 {
-		return Err!("{fails} invites could not be rejected");
-	}
-
-	self.write_str("Successfully rejected all invites.").await
-}
-
 #[admin_command]
 pub(super) async fn list_joined_rooms(&self, user_id: String) -> Result {
 	// Validate user id
@@ -630,12 +556,15 @@ pub(super) async fn force_join_list_of_local_users(
 	let mut successful_joins: usize = 0;

 	for user_id in user_ids {
-		match self
-			.services
-			.rooms
-			.membership
-			.join_room(&user_id, &room_id, Some(String::from(BULK_JOIN_REASON)), &servers)
-			.await
+		match join_room_by_id_helper(
+			self.services,
+			&user_id,
+			&room_id,
+			Some(String::from(BULK_JOIN_REASON)),
+			&servers,
+			&None,
+		)
+		.await
 		{
 			| Ok(_res) => {
 				successful_joins = successful_joins.saturating_add(1);
@@ -711,12 +640,15 @@ pub(super) async fn force_join_all_local_users(
 		.collect::<Vec<_>>()
 		.await
 	{
-		match self
-			.services
-			.rooms
-			.membership
-			.join_room(user_id, &room_id, Some(String::from(BULK_JOIN_REASON)), &servers)
-			.await
+		match join_room_by_id_helper(
+			self.services,
+			user_id,
+			&room_id,
+			Some(String::from(BULK_JOIN_REASON)),
+			&servers,
+			&None,
+		)
+		.await
 		{
 			| Ok(_res) => {
 				successful_joins = successful_joins.saturating_add(1);
@@ -753,11 +685,7 @@ pub(super) async fn force_join_room(
 		self.services.globals.user_is_local(&user_id),
 		"Parsed user_id must be a local user"
 	);
-	self.services
-		.rooms
-		.membership
-		.join_room(&user_id, &room_id, None, &servers)
-		.await?;
+	join_room_by_id_helper(self.services, &user_id, &room_id, None, &servers, &None).await?;

 	self.write_str(&format!("{user_id} has been joined to {room_id}."))
 		.await
@@ -160,17 +160,6 @@ pub enum UserCommand {
 	#[clap(alias = "list")]
 	ListUsers,

-	/// Lists all the rooms (local and remote) that the specified user is
-	///   invited to
-	ListInvitedRooms {
-		user_id: String,
-	},
-
-	/// Manually make a user reject all current invites
-	RejectAllInvites {
-		user_id: String,
-	},
-
 	/// Lists all the rooms (local and remote) that the specified user is
 	///   joined in
 	ListJoinedRooms {
@@ -48,7 +48,7 @@ pub(crate) fn parse_local_user_id(services: &Services, user_id: &str) -> Result<
 	Ok(user_id)
 }

-/// Parses user ID that is an active (not deactivated) local user
+/// Parses user ID that is an active (not guest or deactivated) local user
 pub(crate) async fn parse_active_local_user_id(
 	services: &Services,
 	user_id: &str,
@@ -29,6 +29,10 @@ gzip_compression = [
 	"conduwuit-service/gzip_compression",
 	"reqwest/gzip",
 ]
+http3 = [
+	"conduwuit-core/http3",
+	"conduwuit-service/http3",
+]
 io_uring = [
 	"conduwuit-service/io_uring",
 ]
@@ -48,6 +52,9 @@ jemalloc_stats = [
 	"conduwuit-core/jemalloc_stats",
 	"conduwuit-service/jemalloc_stats",
 ]
+ldap = [
+    "conduwuit-service/ldap"
+]
 release_max_log_level = [
 	"conduwuit-core/release_max_log_level",
 	"conduwuit-service/release_max_log_level",
@@ -74,7 +81,6 @@ conduwuit-macros.workspace = true
 conduwuit-service.workspace = true
 const-str.workspace = true
 ctor.workspace = true
-dtor.workspace = true
 futures.workspace = true
 hmac.workspace = true
 http.workspace = true
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	pdu::PartialPdu,
@@ -24,9 +24,9 @@
 		power_levels::RoomPowerLevelsEventContent,
 	},
 };
-use service::{mailer::messages, uiaa::Identity, users::HashedPassword};
+use service::{mailer::messages, uiaa::Identity};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
+use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH, join_room_by_id_helper};
 use crate::Ruma;

 pub(crate) mod register;
@@ -46,7 +46,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "register_available", level = "info")]
 pub(crate) async fn get_register_available_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_username_availability::v3::Request>,
 ) -> Result<get_username_availability::v3::Response> {
 	// Validate user id
@@ -108,7 +108,7 @@ pub(crate) async fn get_register_available_route(
 #[tracing::instrument(skip_all, fields(%client), name = "change_password", level = "info")]
 pub(crate) async fn change_password_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
 	let identity = if let Some(ref user_id) = body.sender_user {
@@ -150,7 +150,8 @@ pub(crate) async fn change_password_route(

 	services
 		.users
-		.set_password(&sender_user, Some(HashedPassword::new(&body.new_password)?));
+		.set_password(&sender_user, Some(&body.new_password))
+		.await?;

 	if body.logout_devices {
 		// Logout all devices except the current one
@@ -238,11 +239,19 @@ pub(crate) async fn request_password_change_token_via_email_route(
 ///
 /// Note: Also works for Application Services
 pub(crate) async fn whoami_route(
-	State(_): State<crate::State>,
+	State(services): State<crate::State>,
 	body: Ruma<whoami::v3::Request>,
 ) -> Result<whoami::v3::Response> {
-	Ok(assign!(whoami::v3::Response::new(body.sender_user().to_owned(), false), {
-		device_id: body.sender_device,
+	let is_guest = services
+		.users
+		.is_deactivated(body.sender_user())
+		.await
+		.map_err(|_| {
+			err!(Request(Forbidden("Application service has not registered this user.")))
+		})? && body.appservice_info.is_none();
+
+	Ok(assign!(whoami::v3::Response::new(body.sender_user().to_owned(), is_guest), {
+		device_id: body.sender_device.clone(),
 	}))
 }

@@ -260,7 +269,7 @@ pub(crate) async fn whoami_route(
 #[tracing::instrument(skip_all, fields(%client), name = "deactivate", level = "info")]
 pub(crate) async fn deactivate_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<deactivate::v3::Request>,
 ) -> Result<deactivate::v3::Response> {
 	// Authentication for this endpoint is technically optional,
@@ -322,6 +331,8 @@ pub(crate) async fn check_registration_token_validity(
 /// Runs through all the deactivation steps:
 ///
 /// - Mark as deactivated
+/// - Removing display name
+/// - Removing avatar URL and blurhash
 /// - Removing all profile data
 /// - Leaving all rooms (and forgets all of them)
 pub async fn full_user_deactivate(
@@ -1,7 +1,7 @@
 use std::{collections::HashMap, fmt::Write};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, debug_info, error, info,
 	utils::{self},
@@ -10,11 +10,12 @@
 use conduwuit_service::Services;
 use futures::{FutureExt, StreamExt};
 use lettre::{Address, message::Mailbox};
+use register::RegistrationKind;
 use ruma::{
 	OwnedUserId, UserId,
 	api::client::{
 		account::{
-			register::{self, LoginType, RegistrationKind},
+			register::{self, LoginType},
 			request_registration_token_via_email,
 		},
 		uiaa::{AuthFlow, AuthType},
@@ -27,9 +28,9 @@
 	push,
 };
 use serde_json::value::RawValue;
-use service::{mailer::messages, users::HashedPassword};
+use service::mailer::messages;

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
+use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH, join_room_by_id_helper};
 use crate::Ruma;

 const RANDOM_USER_ID_LENGTH: usize = 10;
@@ -41,17 +42,24 @@
 /// You can use [`GET
 /// /_matrix/client/v3/register/available`](fn.get_register_available_route.
 /// html) to check if the user id is valid and available.
+///
+/// - Only works if registration is enabled
+/// - If type is guest: ignores all parameters except
+///   initial_device_display_name
+/// - If sender is not appservice: Requires UIAA (but we only use a dummy stage)
+/// - If type is not guest and no username is given: Always fails after UIAA
+///   check
+/// - Creates a new account and populates it with default account data
+/// - If `inhibit_login` is false: Creates a device and returns device id and
+///   access_token
 #[allow(clippy::doc_markdown)]
 #[tracing::instrument(skip_all, fields(%client), name = "register", level = "info")]
 pub(crate) async fn register_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<register::v3::Request>,
 ) -> Result<register::v3::Response> {
-	if body.kind != RegistrationKind::User {
-		return Err!(Request(GuestAccessForbidden("Guests may not register on this server.")));
-	}
-
+	let is_guest = body.kind == RegistrationKind::Guest;
 	let emergency_mode_enabled = services.config.emergency_password.is_some();

 	// Allow registration if it's enabled in the config file or if this is the first
@@ -60,19 +68,69 @@ pub(crate) async fn register_route(
 		services.config.allow_registration || services.firstrun.is_first_run();

 	if !allow_registration && body.appservice_info.is_none() {
-		info!(
-			?body.username,
-			?body.initial_device_display_name,
-			"Rejecting registration attempt as registration is disabled"
-		);
+		match (body.username.as_ref(), body.initial_device_display_name.as_ref()) {
+			| (Some(username), Some(device_display_name)) => {
+				info!(
+					%is_guest,
+					user = %username,
+					device_name = %device_display_name,
+					"Rejecting registration attempt as registration is disabled"
+				);
+			},
+			| (Some(username), _) => {
+				info!(
+					%is_guest,
+					user = %username,
+					"Rejecting registration attempt as registration is disabled"
+				);
+			},
+			| (_, Some(device_display_name)) => {
+				info!(
+					%is_guest,
+					device_name = %device_display_name,
+					"Rejecting registration attempt as registration is disabled"
+				);
+			},
+			| (None, _) => {
+				info!(
+					%is_guest,
+					"Rejecting registration attempt as registration is disabled"
+				);
+			},
+		}

 		return Err!(Request(Forbidden(
 			"This server is not accepting registrations at this time."
 		)));
 	}

-	let identity = if body.appservice_info.is_some() {
-		// Appservices can skip auth
+	if is_guest && !services.config.allow_guest_registration {
+		info!(
+			"Guest registration disabled, rejecting guest registration attempt, initial device \
+			 name: \"{}\"",
+			body.initial_device_display_name.as_deref().unwrap_or("")
+		);
+		return Err!(Request(GuestAccessForbidden("Guest registration is disabled.")));
+	}
+
+	// forbid guests from registering if there is not a real admin user yet. give
+	// generic user error.
+	if is_guest && services.firstrun.is_first_run() {
+		warn!(
+			"Guest account attempted to register before a real admin user has been registered, \
+			 rejecting registration. Guest's initial device name: \"{}\"",
+			body.initial_device_display_name.as_deref().unwrap_or("")
+		);
+		return Err!(Request(Forbidden(
+			"This server is not accepting registrations at this time."
+		)));
+	}
+
+	// Appeservices and guests get to skip auth
+	let skip_auth = body.appservice_info.is_some() || is_guest;
+
+	let identity = if skip_auth {
+		// Appservices and guests have no identity
 		None
 	} else {
 		// Perform UIAA to determine the user's identity
@@ -99,9 +157,13 @@ pub(crate) async fn register_route(
 		}
 	});

-	let user_id =
-		determine_registration_user_id(&services, supplied_username, emergency_mode_enabled)
-			.await?;
+	let user_id = determine_registration_user_id(
+		&services,
+		supplied_username,
+		is_guest,
+		emergency_mode_enabled,
+	)
+	.await?;

 	if body.body.login_type == Some(LoginType::ApplicationService) {
 		// For appservice logins, make sure that the user ID is in the appservice's
@@ -125,16 +187,10 @@ pub(crate) async fn register_route(
 		return Err!(Request(Exclusive("Username is reserved by an appservice.")));
 	}

-	let password = if body.appservice_info.is_some() {
-		None
-	} else if let Some(password) = body.password.as_deref() {
-		Some(HashedPassword::new(password)?)
-	} else {
-		return Err!(Request(InvalidParam("A password must be provided")));
-	};
+	let password = if is_guest { None } else { body.password.as_deref() };

 	// Create user
-	services.users.create(&user_id, password).await?;
+	services.users.create(&user_id, password, None).await?;

 	// Set an initial display name
 	let mut displayname = user_id.localpart().to_owned();
@@ -166,9 +222,7 @@ pub(crate) async fn register_route(

 	// Generate new device id if the user didn't specify one
 	let (token, device) = if !body.inhibit_login {
-		let device_id = body
-			.device_id
-			.clone()
+		let device_id = if is_guest { None } else { body.device_id.clone() }
 			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());

 		// Generate new token for the device
@@ -209,7 +263,8 @@ pub(crate) async fn register_route(

 	let device_display_name = body.initial_device_display_name.as_deref().unwrap_or("");

-	if body.appservice_info.is_none() {
+	// log in conduit admin channel if a non-guest user registered
+	if body.appservice_info.is_none() && !is_guest {
 		if !device_display_name.is_empty() {
 			let notice = format!(
 				"New user \"{user_id}\" registered on this server from IP {client} and device \
@@ -230,32 +285,65 @@ pub(crate) async fn register_route(
 		}
 	}

-	// Make the first user to register an administrator and disable first-run mode.
-	let was_first_user = services.firstrun.empower_first_user(&user_id).await?;
+	// log in conduit admin channel if a guest registered
+	if body.appservice_info.is_none() && is_guest && services.config.log_guest_registrations {
+		debug_info!("New guest user \"{user_id}\" registered on this server.");

-	// If the registering user was not the first and we're suspending users on
-	// register, suspend them.
-	if !was_first_user && services.config.suspend_on_register {
-		// Note that we can still do auto joins for suspended users
-		services
-			.users
-			.suspend_account(&user_id, &services.globals.server_user)
-			.await;
-		// And send an @room notice to the admin room, to prompt admins to review the
-		// new user and ideally unsuspend them if deemed appropriate.
-		if services.server.config.admin_room_notices {
-			services
-				.admin
-				.send_loud_message(RoomMessageEventContent::text_plain(format!(
-					"User {user_id} has been suspended as they are not the first user on this \
-					 server. Please review and unsuspend them if appropriate."
-				)))
-				.await
-				.ok();
+		if !device_display_name.is_empty() {
+			if services.server.config.admin_room_notices {
+				services
+					.admin
+					.notice(&format!(
+						"Guest user \"{user_id}\" with device display name \
+						 \"{device_display_name}\" registered on this server from IP {client}"
+					))
+					.await;
+			}
+		} else {
+			#[allow(clippy::collapsible_else_if)]
+			if services.server.config.admin_room_notices {
+				services
+					.admin
+					.notice(&format!(
+						"Guest user \"{user_id}\" with no device display name registered on \
+						 this server from IP {client}",
+					))
+					.await;
+			}
 		}
 	}

-	if body.appservice_info.is_none() && !services.server.config.auto_join_rooms.is_empty() {
+	if !is_guest {
+		// Make the first user to register an administrator and disable first-run mode.
+		let was_first_user = services.firstrun.empower_first_user(&user_id).await?;
+
+		// If the registering user was not the first and we're suspending users on
+		// register, suspend them.
+		if !was_first_user && services.config.suspend_on_register {
+			// Note that we can still do auto joins for suspended users
+			services
+				.users
+				.suspend_account(&user_id, &services.globals.server_user)
+				.await;
+			// And send an @room notice to the admin room, to prompt admins to review the
+			// new user and ideally unsuspend them if deemed appropriate.
+			if services.server.config.admin_room_notices {
+				services
+					.admin
+					.send_loud_message(RoomMessageEventContent::text_plain(format!(
+						"User {user_id} has been suspended as they are not the first user on \
+						 this server. Please review and unsuspend them if appropriate."
+					)))
+					.await
+					.ok();
+			}
+		}
+	}
+
+	if body.appservice_info.is_none()
+		&& !services.server.config.auto_join_rooms.is_empty()
+		&& (services.config.allow_guests_auto_join_rooms || !is_guest)
+	{
 		for room in &services.server.config.auto_join_rooms {
 			let Ok(room_id) = services.rooms.alias.resolve(room).await else {
 				error!(
@@ -278,17 +366,16 @@ pub(crate) async fn register_route(
 			}

 			if let Some(room_server_name) = room.server_name() {
-				match services
-					.rooms
-					.membership
-					.join_room(
-						&user_id,
-						&room_id,
-						Some("Automatically joining this room upon registration".to_owned()),
-						&[services.globals.server_name().to_owned(), room_server_name.to_owned()],
-					)
-					.boxed()
-					.await
+				match join_room_by_id_helper(
+					&services,
+					&user_id,
+					&room_id,
+					Some("Automatically joining this room upon registration".to_owned()),
+					&[services.globals.server_name().to_owned(), room_server_name.to_owned()],
+					&body.appservice_info,
+				)
+				.boxed()
+				.await
 				{
 					| Err(e) => {
 						// don't return this error so we don't fail registrations
@@ -424,9 +511,12 @@ async fn create_registration_uiaa_session(
 async fn determine_registration_user_id(
 	services: &Services,
 	supplied_username: Option<String>,
+	is_guest: bool,
 	emergency_mode_enabled: bool,
 ) -> Result<OwnedUserId> {
-	if let Some(supplied_username) = supplied_username {
+	if let Some(supplied_username) = supplied_username
+		&& !is_guest
+	{
 		// The user gets to pick their username. Do some validation to make sure it's
 		// acceptable.

@@ -479,7 +569,7 @@ async fn determine_registration_user_id(

 		Ok(user_id)
 	} else {
-		// The user didn't specify a username. Generate a username for
+		// The user is a guest or didn't specify a username. Generate a username for
 		// them.

 		loop {
@@ -53,10 +53,6 @@ pub(crate) async fn request_3pid_management_token_via_email_route(
 	State(services): State<crate::State>,
 	body: Ruma<request_3pid_management_token_via_email::v3::Request>,
 ) -> Result<request_3pid_management_token_via_email::v3::Response> {
-	if !services.threepid.email_requirement().may_change() {
-		return Err!(Request(Forbidden("You may not change your email address.")));
-	}
-
 	let Ok(email) = Address::try_from(body.email.clone()) else {
 		return Err!(Request(InvalidParam("Invalid email address.")));
 	};
@@ -109,10 +105,6 @@ pub(crate) async fn add_3pid_route(
 ) -> Result<add_3pid::v3::Response> {
 	let sender_user = body.sender_user();

-	if !services.threepid.email_requirement().may_change() {
-		return Err!(Request(Forbidden("You may not change your email address.")));
-	}
-
 	// Require password auth to add an email
 	let _ = services
 		.uiaa
@@ -144,10 +136,6 @@ pub(crate) async fn delete_3pid_route(
 		return Ok(delete_3pid::v3::Response::new(ThirdPartyIdRemovalStatus::NoSupport));
 	}

-	if !services.threepid.email_requirement().may_remove() {
-		return Err!(Request(Forbidden("You may not remove your email address.")));
-	}
-
 	if services
 		.threepid
 		.disassociate_localpart_email(sender_user.localpart())
@@ -35,7 +35,7 @@ pub(crate) async fn get_capabilities_route(

 	// Only allow 3pid changes if SMTP is configured
 	capabilities.thirdparty_id_changes =
-		ThirdPartyIdChangesCapability::new(services.threepid.email_requirement().may_change());
+		ThirdPartyIdChangesCapability::new(services.mailer.mailer().is_some());

 	capabilities.get_login_token =
 		GetLoginTokenCapability::new(services.server.config.login_via_existing_session);
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Result, at};
 use futures::StreamExt;
 use ruma::{
@@ -22,7 +22,7 @@
 #[tracing::instrument(skip_all, fields(%client))]
 pub(crate) async fn put_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<put_dehydrated_device::Request>,
 ) -> Result<put_dehydrated_device::Response> {
 	let sender_user = body
@@ -46,7 +46,7 @@ pub(crate) async fn put_dehydrated_device_route(
 #[tracing::instrument(skip_all, fields(%client))]
 pub(crate) async fn delete_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<delete_dehydrated_device::Request>,
 ) -> Result<delete_dehydrated_device::Response> {
 	let sender_user = body.sender_user();
@@ -64,7 +64,7 @@ pub(crate) async fn delete_dehydrated_device_route(
 #[tracing::instrument(skip_all, fields(%client))]
 pub(crate) async fn get_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_dehydrated_device::Request>,
 ) -> Result<get_dehydrated_device::Response> {
 	let sender_user = body.sender_user();
@@ -80,7 +80,7 @@ pub(crate) async fn get_dehydrated_device_route(
 #[tracing::instrument(skip_all, fields(%client))]
 pub(crate) async fn get_dehydrated_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_events::Request>,
 ) -> Result<get_events::Response> {
 	let sender_user = body.sender_user();
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Result, debug, err, utils};
 use futures::StreamExt;
 use ruma::{
@@ -50,7 +50,7 @@ pub(crate) async fn get_device_route(
 #[tracing::instrument(skip_all, fields(%client), name = "update_device", level = "debug")]
 pub(crate) async fn update_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<update_device::v3::Request>,
 ) -> Result<update_device::v3::Response> {
 	let sender_user = body.sender_user();
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	utils::{
@@ -38,7 +38,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_filtered_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_public_rooms_filtered::v3::Request>,
 ) -> Result<get_public_rooms_filtered::v3::Response> {
 	if let Some(server) = &body.server {
@@ -74,7 +74,7 @@ pub(crate) async fn get_public_rooms_filtered_route(
 #[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_public_rooms::v3::Request>,
 ) -> Result<get_public_rooms::v3::Response> {
 	if let Some(server) = &body.server {
@@ -109,7 +109,7 @@ pub(crate) async fn get_public_rooms_route(
 #[tracing::instrument(skip_all, fields(%client), name = "room_directory", level = "info")]
 pub(crate) async fn set_room_visibility_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<set_room_visibility::v3::Request>,
 ) -> Result<set_room_visibility::v3::Response> {
 	let sender_user = body.sender_user();
@@ -122,6 +122,16 @@ pub(crate) async fn set_room_visibility_route(
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}

+	if services
+		.users
+		.is_deactivated(sender_user)
+		.await
+		.unwrap_or(false)
+		&& body.appservice_info.is_none()
+	{
+		return Err!(Request(Forbidden("Guests cannot publish to room directories")));
+	}
+
 	if !user_can_publish_room(&services, sender_user, &body.room_id).await? {
 		return Err!(Request(Forbidden("User is not allowed to publish this room")));
 	}
@@ -64,27 +64,6 @@ pub(crate) async fn upload_keys_route(
 			.await?;
 	}

-	for (key_id, fallback_key) in &body.fallback_keys {
-		if fallback_key
-			.deserialize()
-			.inspect_err(|e| {
-				debug_warn!(
-					%key_id,
-					?fallback_key,
-					"Invalid one time key JSON submitted by client, skipping: {e}"
-				);
-			})
-			.is_err()
-		{
-			continue;
-		}
-
-		services
-			.users
-			.add_fallback_key(sender_user, sender_device, key_id, fallback_key, false)
-			.await?;
-	}
-
 	if let Some(device_keys) = &body.device_keys {
 		let deser_device_keys = device_keys.deserialize().map_err(|e| {
 			err!(Request(BadJson(debug_warn!(
@@ -1,7 +1,7 @@
 use std::time::Duration;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{self, content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -21,6 +21,7 @@
 		},
 		media::create_content,
 	},
+	assign,
 };
 use service::media::mxc::Mxc;

@@ -50,7 +51,7 @@ pub(crate) async fn get_media_config_route(
 )]
 pub(crate) async fn create_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<create_content::v3::Response> {
 	let user = body.sender_user();
@@ -75,7 +76,17 @@ pub(crate) async fn create_content_route(
 		return Err!(Request(Unknown("Failed to save uploaded media")));
 	}

-	Ok(create_content::v3::Response::new(mxc.to_string().into()))
+	let blurhash = body.generate_blurhash.then(|| {
+		services
+			.media
+			.create_blurhash(&body.file, content_type, filename)
+			.ok()
+			.flatten()
+	});
+
+	Ok(assign!(create_content::v3::Response::new(mxc.to_string().into()), {
+		blurhash: blurhash.flatten(),
+	}))
 }

 /// # `GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`
@@ -89,7 +100,7 @@ pub(crate) async fn create_content_route(
 )]
 pub(crate) async fn get_content_thumbnail_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
 	let user = body.sender_user();
@@ -139,7 +150,7 @@ pub(crate) async fn get_content_thumbnail_route(
 )]
 pub(crate) async fn get_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content::v1::Request>,
 ) -> Result<get_content::v1::Response> {
 	let user = body.sender_user();
@@ -186,7 +197,7 @@ pub(crate) async fn get_content_route(
 )]
 pub(crate) async fn get_content_as_filename_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_as_filename::v1::Request>,
 ) -> Result<get_content_as_filename::v1::Response> {
 	let user = body.sender_user();
@@ -237,7 +248,7 @@ pub(crate) async fn get_content_as_filename_route(
 )]
 pub(crate) async fn get_media_preview_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_media_preview::v1::Request>,
 ) -> Result<get_media_preview::v1::Response> {
 	let sender_user = body.sender_user();
@@ -1,7 +1,7 @@
 #![allow(deprecated)]

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -53,7 +53,7 @@ pub(crate) async fn get_media_config_legacy_legacy_route(
 #[tracing::instrument(skip_all, fields(%client), name = "url_preview_legacy", level = "debug")]
 pub(crate) async fn get_media_preview_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<get_media_preview::v3::Response> {
 	let sender_user = body.sender_user();
@@ -95,10 +95,10 @@ pub(crate) async fn get_media_preview_legacy_route(
 /// Returns URL preview.
 pub(crate) async fn get_media_preview_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<RumaResponse<get_media_preview::v3::Response>> {
-	get_media_preview_legacy_route(State(services), ClientIp(client), body)
+	get_media_preview_legacy_route(State(services), InsecureClientIp(client), body)
 		.await
 		.map(RumaResponse)
 }
@@ -115,10 +115,10 @@ pub(crate) async fn get_media_preview_legacy_legacy_route(
 /// - Media will be saved in the media/ directory
 pub(crate) async fn create_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<RumaResponse<create_content::v3::Response>> {
-	create_content_route(State(services), ClientIp(client), body)
+	create_content_route(State(services), InsecureClientIp(client), body)
 		.await
 		.map(RumaResponse)
 }
@@ -134,7 +134,7 @@ pub(crate) async fn create_content_legacy_route(
 #[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<get_content::v3::Response> {
 	let mxc = Mxc {
@@ -212,10 +212,10 @@ pub(crate) async fn get_content_legacy_route(
 #[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<RumaResponse<get_content::v3::Response>> {
-	get_content_legacy_route(State(services), ClientIp(client), body)
+	get_content_legacy_route(State(services), InsecureClientIp(client), body)
 		.await
 		.map(RumaResponse)
 }
@@ -231,7 +231,7 @@ pub(crate) async fn get_content_legacy_legacy_route(
 #[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_as_filename_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<get_content_as_filename::v3::Response> {
 	let mxc = Mxc {
@@ -307,10 +307,10 @@ pub(crate) async fn get_content_as_filename_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<RumaResponse<get_content_as_filename::v3::Response>> {
-	get_content_as_filename_legacy_route(State(services), ClientIp(client), body)
+	get_content_as_filename_legacy_route(State(services), InsecureClientIp(client), body)
 		.await
 		.map(RumaResponse)
 }
@@ -326,7 +326,7 @@ pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 #[tracing::instrument(skip_all, fields(%client), name = "media_thumbnail_get_legacy", level = "debug")]
 pub(crate) async fn get_content_thumbnail_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<get_content_thumbnail::v3::Response> {
 	let mxc = Mxc {
@@ -404,10 +404,10 @@ pub(crate) async fn get_content_thumbnail_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_thumbnail_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<RumaResponse<get_content_thumbnail::v3::Response>> {
-	get_content_thumbnail_legacy_route(State(services), ClientIp(client), body)
+	get_content_thumbnail_legacy_route(State(services), InsecureClientIp(client), body)
 		.await
 		.map(RumaResponse)
 }
@@ -34,8 +34,8 @@ pub(crate) async fn ban_user_route(
 			PartialPdu::state(
 				body.user_id.to_string(),
 				&assign!(RoomMemberEventContent::new(MembershipState::Ban), {
-					reason: body.reason.clone(),
-					redact_events: body.redact_events,
+					reason: body.reason.clone()
+					// TODO(upstream): MSC4293
 				}),
 			),
 			sender_user,
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, debug_error, err, info,
 	matrix::{event::gen_event_id_canonical_json, pdu::PartialPdu},
@@ -26,7 +26,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "invite", level = "info")]
 pub(crate) async fn invite_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<invite_user::v3::Request>,
 ) -> Result<invite_user::v3::Response> {
 	let sender_user = body.sender_user();
@@ -163,11 +163,7 @@ pub(crate) async fn invite_helper(
 				)
 				.await?;

-			let invite_room_state = services
-				.rooms
-				.state
-				.summary_stripped(&pdu, room_id, recipient_user)
-				.await;
+			let invite_room_state = services.rooms.state.summary_stripped(&pdu, room_id).await;

 			drop(state_lock);

@@ -247,6 +243,7 @@ pub(crate) async fn invite_helper(
 	let mut content = RoomMemberEventContent::new(MembershipState::Invite);
 	content.displayname = services.users.displayname(recipient_user).await.ok();
 	content.avatar_url = services.users.avatar_url(recipient_user).await.ok();
+	content.blurhash = services.users.blurhash(recipient_user).await.ok();
 	content.is_direct = Some(is_direct);
 	content.reason = reason;

@@ -1,18 +1,58 @@
-use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{
-	Err, Result, debug,
-	result::FlatOk,
-	utils::{shuffle, stream::IterStream},
-};
-use futures::{FutureExt, StreamExt};
-use ruma::{
-	OwnedRoomId, OwnedServerName, OwnedUserId, UserId,
-	api::client::membership::{join_room_by_id, join_room_by_id_or_alias},
-};
+use std::{borrow::Borrow, collections::HashMap, iter::once, sync::Arc};

-use super::banned_room_check;
-use crate::Ruma;
+use axum::extract::State;
+use axum_client_ip::InsecureClientIp;
+use conduwuit::{
+	Err, Result, debug, debug_info, debug_warn, err, error, info, is_true,
+	matrix::{
+		StateKey,
+		event::{gen_event_id, gen_event_id_canonical_json},
+		pdu::{PartialPdu, PduEvent},
+		state_res,
+	},
+	result::FlatOk,
+	trace,
+	utils::{
+		self, shuffle,
+		stream::{IterStream, ReadyExt},
+		to_canonical_object,
+	},
+	warn,
+};
+use futures::{FutureExt, StreamExt, TryFutureExt};
+use ruma::{
+	CanonicalJsonObject, CanonicalJsonValue, OwnedRoomId, OwnedServerName, OwnedUserId, RoomId,
+	RoomVersionId, UserId,
+	api::{
+		client::membership::{join_room_by_id, join_room_by_id_or_alias},
+		error::{ErrorKind, IncompatibleRoomVersionErrorData},
+		federation::{self},
+	},
+	canonical_json::to_canonical_value,
+	events::{
+		StateEventType,
+		room::{
+			join_rules::JoinRule,
+			member::{MembershipState, RoomMemberEventContent},
+		},
+	},
+};
+use service::{
+	Services,
+	appservice::RegistrationInfo,
+	rooms::{
+		state::RoomMutexGuard,
+		state_compressor::{CompressedState, HashSetCompressStateEvent},
+		timeline::pdu_fits,
+	},
+};
+use tokio::join;
+
+use super::{banned_room_check, validate_remote_member_event_stub};
+use crate::{
+	Ruma,
+	server::{select_authorising_user, user_can_perform_restricted_join},
+};

 /// # `POST /_matrix/client/r0/rooms/{roomId}/join`
 ///
@@ -25,7 +65,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<join_room_by_id::v3::Request>,
 ) -> Result<join_room_by_id::v3::Response> {
 	let sender_user = body.sender_user();
@@ -72,14 +112,16 @@ pub(crate) async fn join_room_by_id_route(
 	shuffle(&mut servers);
 	let servers = deprioritize(servers, &services.config.deprioritize_joins_through_servers);

-	let room_id = services
-		.rooms
-		.membership
-		.join_room(sender_user, &body.room_id, body.reason.clone(), &servers)
-		.boxed()
-		.await?;
-
-	Ok(join_room_by_id::v3::Response::new(room_id))
+	join_room_by_id_helper(
+		&services,
+		sender_user,
+		&body.room_id,
+		body.reason.clone(),
+		&servers,
+		&body.appservice_info,
+	)
+	.boxed()
+	.await
 }

 /// # `POST /_matrix/client/r0/join/{roomIdOrAlias}`
@@ -94,10 +136,11 @@ pub(crate) async fn join_room_by_id_route(
 #[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_or_alias_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<join_room_by_id_or_alias::v3::Request>,
 ) -> Result<join_room_by_id_or_alias::v3::Response> {
 	let sender_user = body.sender_user();
+	let appservice_info = &body.appservice_info;
 	let body = &body.body;
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
@@ -192,14 +235,650 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 	};

 	let servers = deprioritize(servers, &services.config.deprioritize_joins_through_servers);
-	let room_id = services
+	let join_room_response = join_room_by_id_helper(
+		&services,
+		sender_user,
+		&room_id,
+		body.reason.clone(),
+		&servers,
+		appservice_info,
+	)
+	.boxed()
+	.await?;
+
+	Ok(join_room_by_id_or_alias::v3::Response::new(join_room_response.room_id))
+}
+
+pub async fn join_room_by_id_helper(
+	services: &Services,
+	sender_user: &UserId,
+	room_id: &RoomId,
+	reason: Option<String>,
+	servers: &[OwnedServerName],
+	appservice_info: &Option<RegistrationInfo>,
+) -> Result<join_room_by_id::v3::Response> {
+	let state_lock = services.rooms.state.mutex.lock(room_id).await;
+
+	let user_is_guest = services
+		.users
+		.is_deactivated(sender_user)
+		.await
+		.unwrap_or(false)
+		&& appservice_info.is_none();
+
+	if user_is_guest && !services.rooms.state_accessor.guest_can_join(room_id).await {
+		return Err!(Request(Forbidden("Guests are not allowed to join this room")));
+	}
+
+	if services
 		.rooms
-		.membership
-		.join_room(sender_user, &room_id, body.reason.clone(), &servers)
+		.state_cache
+		.is_joined(sender_user, room_id)
+		.await
+	{
+		debug_warn!("{sender_user} is already joined in {room_id}");
+		return Ok(join_room_by_id::v3::Response::new(room_id.to_owned()));
+	}
+
+	if let Err(e) = services
+		.antispam
+		.user_may_join_room(
+			sender_user.to_owned(),
+			room_id.to_owned(),
+			services
+				.rooms
+				.state_cache
+				.is_invited(sender_user, room_id)
+				.await,
+		)
+		.await
+	{
+		warn!("Antispam prevented user {} from joining room {}: {}", sender_user, room_id, e);
+		return Err!(Request(Forbidden("You are not allowed to join this room.")));
+	}
+
+	let server_in_room = services
+		.rooms
+		.state_cache
+		.server_in_room(services.globals.server_name(), room_id)
+		.await;
+
+	// Only check our known membership if we're already in the room.
+	// See: https://forgejo.ellis.link/continuwuation/continuwuity/issues/855
+	let membership = if server_in_room {
+		services
+			.rooms
+			.state_accessor
+			.get_member(room_id, sender_user)
+			.await
+	} else {
+		debug!("Ignoring local state for join {room_id}, we aren't in the room yet.");
+		Ok(RoomMemberEventContent::new(MembershipState::Leave))
+	};
+	if let Ok(m) = membership {
+		if m.membership == MembershipState::Ban {
+			debug_warn!("{sender_user} is banned from {room_id} but attempted to join");
+			// TODO: return reason
+			return Err!(Request(Forbidden("You are banned from the room.")));
+		}
+	}
+
+	if !server_in_room && servers.is_empty() {
+		return Err!(Request(NotFound(
+			"No servers were provided to assist in joining the room remotely, and we are not \
+			 already participating in the room."
+		)));
+	}
+
+	if services.antispam.check_all_joins() {
+		if let Err(e) = services
+			.antispam
+			.meowlnir_accept_make_join(room_id.to_owned(), sender_user.to_owned())
+			.await
+		{
+			warn!("Antispam prevented user {} from joining room {}: {}", sender_user, room_id, e);
+			return Err!(Request(Forbidden("Antispam rejected join request.")));
+		}
+	}
+
+	if server_in_room {
+		join_room_by_id_helper_local(services, sender_user, room_id, reason, servers, state_lock)
+			.boxed()
+			.await?;
+	} else {
+		// Ask a remote server if we are not participating in this room
+		join_room_by_id_helper_remote(
+			services,
+			sender_user,
+			room_id,
+			reason,
+			servers,
+			state_lock,
+		)
 		.boxed()
 		.await?;
+	}
+	Ok(join_room_by_id::v3::Response::new(room_id.to_owned()))
+}

-	Ok(join_room_by_id_or_alias::v3::Response::new(room_id))
+#[tracing::instrument(skip_all, fields(%sender_user, %room_id), name = "join_remote", level = "info")]
+async fn join_room_by_id_helper_remote(
+	services: &Services,
+	sender_user: &UserId,
+	room_id: &RoomId,
+	reason: Option<String>,
+	servers: &[OwnedServerName],
+	state_lock: RoomMutexGuard,
+) -> Result {
+	info!("Joining {room_id} over federation.");
+
+	let (make_join_response, remote_server) =
+		make_join_request(services, sender_user, room_id, servers).await?;
+
+	info!("make_join finished");
+
+	let room_version = make_join_response.room_version.unwrap_or(RoomVersionId::V1);
+	let room_version_rules = room_version
+		.rules()
+		.expect("room version should have defined rules");
+
+	if !services.server.supported_room_version(&room_version) {
+		// How did we get here?
+		return Err!(BadServerResponse("Remote room version {room_version} is not supported"));
+	}
+
+	let mut join_event_stub: CanonicalJsonObject =
+		serde_json::from_str(make_join_response.event.get()).map_err(|e| {
+			err!(BadServerResponse(warn!(
+				"Invalid make_join event json received from server: {e:?}"
+			)))
+		})?;
+
+	let join_authorized_via_users_server = {
+		use RoomVersionId::*;
+		if !matches!(room_version, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
+			join_event_stub
+				.get("content")
+				.map(|s| {
+					s.as_object()?
+						.get("join_authorised_via_users_server")?
+						.as_str()
+				})
+				.and_then(|s| OwnedUserId::try_from(s.unwrap_or_default()).ok())
+		} else {
+			None
+		}
+	};
+
+	join_event_stub.insert(
+		"origin_server_ts".to_owned(),
+		CanonicalJsonValue::Integer(
+			utils::millis_since_unix_epoch()
+				.try_into()
+				.expect("Timestamp is valid js_int value"),
+		),
+	);
+
+	let mut join_content = RoomMemberEventContent::new(MembershipState::Join);
+	join_content.displayname = services.users.displayname(sender_user).await.ok();
+	join_content.avatar_url = services.users.avatar_url(sender_user).await.ok();
+	join_content.blurhash = services.users.blurhash(sender_user).await.ok();
+	join_content.reason = reason;
+	join_content
+		.join_authorized_via_users_server
+		.clone_from(&join_authorized_via_users_server);
+
+	join_event_stub.insert(
+		"content".to_owned(),
+		to_canonical_value(join_content).expect("event is valid, we just created it"),
+	);
+
+	// Remove event id if it exists
+	join_event_stub.remove("event_id");
+
+	// In order to create a compatible ref hash (EventID) the `hashes` field needs
+	// to be present
+	services
+		.server_keys
+		.hash_and_sign_event(&mut join_event_stub, &room_version_rules)?;
+
+	// Generate event id
+	let event_id = gen_event_id(&join_event_stub, &room_version_rules)?;
+
+	// Add event_id back
+	join_event_stub
+		.insert("event_id".to_owned(), CanonicalJsonValue::String(event_id.clone().into()));
+
+	// It has enough fields to be called a proper event now
+	let mut join_event = join_event_stub;
+
+	info!("Asking {remote_server} for send_join in room {room_id}");
+	let send_join_request = federation::membership::create_join_event::v2::Request::new(
+		room_id.to_owned(),
+		event_id.clone(),
+		services
+			.sending
+			.convert_to_outgoing_federation_event(join_event.clone())
+			.await,
+	);
+
+	let send_join_response = match services
+		.sending
+		.send_synapse_request(&remote_server, send_join_request)
+		.await
+	{
+		| Ok(response) => response,
+		| Err(e) => {
+			error!("send_join failed: {e}");
+			return Err(e);
+		},
+	};
+
+	info!("send_join finished");
+
+	if join_authorized_via_users_server.is_some() {
+		if let Some(signed_raw) = &send_join_response.room_state.event {
+			debug_info!(
+				"There is a signed event with join_authorized_via_users_server. This room is \
+				 probably using restricted joins. Adding signature to our event"
+			);
+
+			let (signed_event_id, signed_value) =
+				gen_event_id_canonical_json(signed_raw, &room_version_rules).map_err(|e| {
+					err!(Request(BadJson(warn!(
+						"Could not convert event to canonical JSON: {e}"
+					))))
+				})?;
+
+			if signed_event_id != event_id {
+				return Err!(Request(BadJson(warn!(
+					%signed_event_id, %event_id,
+					"Server {remote_server} sent event with wrong event ID"
+				))));
+			}
+
+			match signed_value["signatures"]
+				.as_object()
+				.ok_or_else(|| {
+					err!(BadServerResponse(warn!(
+						"Server {remote_server} sent invalid signatures type"
+					)))
+				})
+				.and_then(|e| {
+					e.get(remote_server.as_str()).ok_or_else(|| {
+						err!(BadServerResponse(warn!(
+							"Server {remote_server} did not send its signature for a restricted \
+							 room"
+						)))
+					})
+				}) {
+				| Ok(signature) => {
+					join_event
+						.get_mut("signatures")
+						.expect("we created a valid pdu")
+						.as_object_mut()
+						.expect("we created a valid pdu")
+						.insert(remote_server.to_string(), signature.clone());
+				},
+				| Err(e) => {
+					warn!(
+						"Server {remote_server} sent invalid signature in send_join signatures \
+						 for event {signed_value:?}: {e:?}",
+					);
+				},
+			}
+		}
+	}
+
+	services
+		.rooms
+		.short
+		.get_or_create_shortroomid(room_id)
+		.await;
+
+	info!("Parsing join event");
+	let parsed_join_pdu = PduEvent::from_id_val(&event_id, join_event.clone())
+		.map_err(|e| err!(BadServerResponse("Invalid join event PDU: {e:?}")))?;
+
+	info!("Acquiring server signing keys for response events");
+	let resp_events = &send_join_response.room_state;
+	let resp_state = &resp_events.state;
+	let resp_auth = &resp_events.auth_chain;
+	services
+		.server_keys
+		.acquire_events_pubkeys(resp_auth.iter().chain(resp_state.iter()))
+		.await;
+
+	info!("Going through send_join response room_state");
+	let cork = services.db.cork_and_flush();
+	let state = send_join_response
+		.room_state
+		.state
+		.iter()
+		.stream()
+		.then(|pdu| {
+			services
+				.server_keys
+				.validate_and_add_event_id_no_fetch(pdu, &room_version_rules)
+				.inspect_err(|e| {
+					debug_warn!("Could not validate send_join response room_state event: {e:?}");
+				})
+				.inspect(|_| debug!("Completed validating send_join response room_state event"))
+		})
+		.ready_filter_map(Result::ok)
+		.fold(HashMap::new(), |mut state, (event_id, value)| async move {
+			let pdu = match PduEvent::from_id_val(&event_id, value.clone()) {
+				| Ok(pdu) => pdu,
+				| Err(e) => {
+					debug_warn!("Invalid PDU in send_join response: {e:?}: {value:#?}");
+					return state;
+				},
+			};
+			if !pdu_fits(&mut value.clone()) {
+				warn!(
+					"dropping incoming PDU {event_id} in room {room_id} from room join because \
+					 it exceeds 65535 bytes or is otherwise too large."
+				);
+				return state;
+			}
+			services.rooms.outlier.add_pdu_outlier(&event_id, &value);
+			if let Some(state_key) = &pdu.state_key {
+				let shortstatekey = services
+					.rooms
+					.short
+					.get_or_create_shortstatekey(&pdu.kind.to_string().into(), state_key)
+					.await;
+
+				state.insert(shortstatekey, pdu.event_id.clone());
+			}
+			state
+		})
+		.await;
+
+	drop(cork);
+
+	info!("Going through send_join response auth_chain");
+	let cork = services.db.cork_and_flush();
+	send_join_response
+		.room_state
+		.auth_chain
+		.iter()
+		.stream()
+		.then(|pdu| {
+			services
+				.server_keys
+				.validate_and_add_event_id_no_fetch(pdu, &room_version_rules)
+		})
+		.ready_filter_map(Result::ok)
+		.ready_for_each(|(event_id, value)| {
+			trace!(%event_id, "Adding PDU as an outlier from send_join auth_chain");
+			services.rooms.outlier.add_pdu_outlier(&event_id, &value);
+		})
+		.await;
+
+	drop(cork);
+
+	debug!("Running send_join auth check");
+	let fetch_state = &state;
+	let state_fetch = |k: StateEventType, s: StateKey| async move {
+		let shortstatekey = services.rooms.short.get_shortstatekey(&k, &s).await.ok()?;
+
+		let event_id = fetch_state.get(&shortstatekey)?;
+		services.rooms.timeline.get_pdu(event_id).await.ok()
+	};
+
+	let auth_check = state_res::event_auth::auth_check(
+		&room_version.rules().unwrap(),
+		&parsed_join_pdu,
+		None, // TODO: third party invite
+		|k, s| state_fetch(k.clone(), s.into()),
+		&state_fetch(StateEventType::RoomCreate, "".into())
+			.await
+			.expect("create event is missing from send_join auth"),
+	)
+	.await
+	.map_err(|e| err!(Request(Forbidden(warn!("Auth check failed: {e:?}")))))?;
+
+	if !auth_check {
+		return Err!(Request(Forbidden("Auth check failed")));
+	}
+
+	info!("Compressing state from send_join");
+	let compressed: CompressedState = services
+		.rooms
+		.state_compressor
+		.compress_state_events(state.iter().map(|(ssk, eid)| (ssk, eid.borrow())))
+		.collect()
+		.await;
+
+	debug!("Saving compressed state");
+	let HashSetCompressStateEvent {
+		shortstatehash: statehash_before_join,
+		added,
+		removed,
+	} = services
+		.rooms
+		.state_compressor
+		.save_state(room_id, Arc::new(compressed))
+		.await?;
+
+	debug!("Forcing state for new room");
+	services
+		.rooms
+		.state
+		.force_state(room_id, statehash_before_join, added, removed, &state_lock)
+		.await?;
+
+	debug!("Updating joined counts for new room");
+	services
+		.rooms
+		.state_cache
+		.update_joined_count(room_id)
+		.await;
+
+	// We append to state before appending the pdu, so we don't have a moment in
+	// time with the pdu without it's state. This is okay because append_pdu can't
+	// fail.
+	let statehash_after_join = services
+		.rooms
+		.state
+		.append_to_state(&parsed_join_pdu, room_id)
+		.await?;
+
+	info!("Appending new room join event");
+	services
+		.rooms
+		.timeline
+		.append_pdu(
+			&parsed_join_pdu,
+			join_event,
+			once(parsed_join_pdu.event_id.borrow()),
+			&state_lock,
+			room_id,
+		)
+		.await?;
+
+	info!("Setting final room state for new room");
+	// We set the room state after inserting the pdu, so that we never have a moment
+	// in time where events in the current room state do not exist
+	services
+		.rooms
+		.state
+		.set_room_state(room_id, statehash_after_join, &state_lock);
+
+	Ok(())
+}
+
+#[tracing::instrument(skip_all, fields(%sender_user, %room_id), name = "join_local", level = "info")]
+async fn join_room_by_id_helper_local(
+	services: &Services,
+	sender_user: &UserId,
+	room_id: &RoomId,
+	reason: Option<String>,
+	servers: &[OwnedServerName],
+	state_lock: RoomMutexGuard,
+) -> Result {
+	info!("Joining room locally");
+
+	let (room_version, join_rules, is_invited) = join!(
+		services.rooms.state.get_room_version(room_id),
+		services.rooms.state_accessor.get_join_rules(room_id),
+		services.rooms.state_cache.is_invited(sender_user, room_id)
+	);
+
+	let room_version = room_version?;
+	let mut auth_user: Option<OwnedUserId> = None;
+	if !is_invited && matches!(join_rules, JoinRule::Restricted(_) | JoinRule::KnockRestricted(_))
+	{
+		use RoomVersionId::*;
+		if !matches!(room_version, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
+			// This is a restricted room, check if we can complete the join requirements
+			// locally.
+			let needs_auth_user =
+				user_can_perform_restricted_join(services, sender_user, room_id).await;
+			if needs_auth_user.is_ok_and(is_true!()) {
+				// If there was an error or the value is false, we'll try joining over
+				// federation. Since it's Ok(true), we can authorise this locally.
+				// If we can't select a local user, this will remain None, the join will fail,
+				// and we'll fall back to federation.
+				auth_user = select_authorising_user(services, room_id, sender_user, &state_lock)
+					.await
+					.ok();
+			}
+		}
+	}
+
+	let mut content = RoomMemberEventContent::new(MembershipState::Join);
+	content.displayname = services.users.displayname(sender_user).await.ok();
+	content.avatar_url = services.users.avatar_url(sender_user).await.ok();
+	content.blurhash = services.users.blurhash(sender_user).await.ok();
+	content.reason.clone_from(&reason);
+	content.join_authorized_via_users_server = auth_user;
+
+	// Try normal join first
+	let Err(error) = services
+		.rooms
+		.timeline
+		.build_and_append_pdu(
+			PartialPdu::state(sender_user.to_string(), &content),
+			sender_user,
+			Some(room_id),
+			&state_lock,
+		)
+		.await
+	else {
+		info!("Joined room locally");
+		return Ok(());
+	};
+
+	if servers.is_empty() || servers.len() == 1 && services.globals.server_is_ours(&servers[0]) {
+		if !services.rooms.metadata.exists(room_id).await {
+			return Err!(Request(
+				Unknown(
+					"Room was not found locally and no servers were found to help us discover it"
+				),
+				NOT_FOUND
+			));
+		}
+
+		return Err(error);
+	}
+
+	info!(
+		?error,
+		remote_servers = %servers.len(),
+		"Could not join room locally, attempting remote join",
+	);
+	join_room_by_id_helper_remote(services, sender_user, room_id, reason, servers, state_lock)
+		.await
+}
+
+async fn make_join_request(
+	services: &Services,
+	sender_user: &UserId,
+	room_id: &RoomId,
+	servers: &[OwnedServerName],
+) -> Result<(federation::membership::prepare_join_event::v1::Response, OwnedServerName)> {
+	let mut make_join_counter: usize = 1;
+
+	for remote_server in servers {
+		if services.globals.server_is_ours(remote_server) {
+			continue;
+		}
+		info!(
+			"Asking {remote_server} for make_join (attempt {make_join_counter}/{})",
+			servers.len()
+		);
+
+		let mut request = federation::membership::prepare_join_event::v1::Request::new(
+			room_id.to_owned(),
+			sender_user.to_owned(),
+		);
+		request.ver = services.server.supported_room_versions().collect();
+
+		let make_join_response = services
+			.sending
+			.send_federation_request(remote_server, request)
+			.await;
+
+		trace!("make_join response: {:?}", make_join_response);
+		make_join_counter = make_join_counter.saturating_add(1);
+
+		match make_join_response {
+			| Ok(response) => {
+				info!("Received make_join response from {remote_server}");
+				if let Err(e) = validate_remote_member_event_stub(
+					&MembershipState::Join,
+					sender_user,
+					room_id,
+					&to_canonical_object(&response.event)?,
+				) {
+					warn!("make_join response from {remote_server} failed validation: {e}");
+					continue;
+				}
+				return Ok((response, remote_server.clone()));
+			},
+			| Err(e) => match e.kind() {
+				| ErrorKind::UnableToAuthorizeJoin => {
+					info!(
+						"{remote_server} was unable to verify the joining user satisfied \
+						 restricted join requirements: {e}. Will continue trying."
+					);
+				},
+				| ErrorKind::UnableToGrantJoin => {
+					info!(
+						"{remote_server} believes the joining user satisfies restricted join \
+						 rules, but is unable to authorise a join for us. Will continue trying."
+					);
+				},
+				| ErrorKind::IncompatibleRoomVersion(IncompatibleRoomVersionErrorData {
+					room_version,
+					..
+				}) => {
+					warn!(
+						"{remote_server} reports the room we are trying to join is \
+						 v{room_version}, which we do not support."
+					);
+					return Err(e);
+				},
+				| ErrorKind::Forbidden => {
+					warn!("{remote_server} refuses to let us join: {e}.");
+					return Err(e);
+				},
+				| ErrorKind::NotFound => {
+					info!(
+						"{remote_server} does not know about {room_id}: {e}. Will continue \
+						 trying."
+					);
+				},
+				| _ => {
+					info!("{remote_server} failed to make_join: {e}. Will continue trying.");
+				},
+			},
+		}
+	}
+	info!("All {} servers were unable to assist in joining {room_id} :(", servers.len());
+	Err!(BadServerResponse("No server available to assist in joining."))
 }

 /// Moves deprioritized servers (if any) to the back of the list.
@@ -24,14 +24,9 @@ pub(crate) async fn kick_user_route(
 	if !services
 		.rooms
 		.state_cache
-		.user_membership(&body.user_id, &body.room_id)
+		.is_joined(&body.user_id, &body.room_id)
 		.await
-		.is_some_and(|membership| {
-			matches!(
-				membership,
-				MembershipState::Invite | MembershipState::Join | MembershipState::Knock
-			)
-		}) {
+	{
 		return Err!(Request(Forbidden("You cannot kick users who are not in the room.")));
 	}

@@ -43,7 +38,7 @@ pub(crate) async fn kick_user_route(
 				body.user_id.to_string(),
 				&assign!(RoomMemberEventContent::new(MembershipState::Leave), {
 					reason: body.reason.clone(),
-					redact_events: body.redact_events,
+					// TODO(upstream): MSC4293
 				}),
 			),
 			sender_user,
@@ -1,7 +1,7 @@
 use std::{borrow::Borrow, collections::HashMap, iter::once, sync::Arc};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, debug, debug_info, debug_warn, err, info,
 	matrix::{
@@ -33,13 +33,12 @@
 use service::{
 	Services,
 	rooms::{
-		membership::validate_remote_member_event_stub,
 		state::RoomMutexGuard,
 		state_compressor::{CompressedState, HashSetCompressStateEvent},
 	},
 };

-use super::banned_room_check;
+use super::{banned_room_check, join::join_room_by_id_helper, validate_remote_member_event_stub};
 use crate::Ruma;

 /// # `POST /_matrix/client/*/knock/{roomIdOrAlias}`
@@ -48,7 +47,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "knock", level = "info")]
 pub(crate) async fn knock_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<knock_room::v3::Request>,
 ) -> Result<knock_room::v3::Response> {
 	let sender_user = body.sender_user();
@@ -239,11 +238,15 @@ async fn knock_room_by_id_helper(
 			// join_room_by_id_helper We need to release the lock here and let
 			// join_room_by_id_helper acquire it again
 			drop(state_lock);
-			match services
-				.rooms
-				.membership
-				.join_room(sender_user, room_id, reason.clone(), servers)
-				.await
+			match join_room_by_id_helper(
+				services,
+				sender_user,
+				room_id,
+				reason.clone(),
+				servers,
+				&None,
+			)
+			.await
 			{
 				| Ok(_) => return Ok(knock_room::v3::Response::new(room_id.to_owned())),
 				| Err(e) => {
@@ -343,6 +346,7 @@ async fn knock_room_helper_local(
 	let mut content = RoomMemberEventContent::new(MembershipState::Knock);
 	content.displayname = services.users.displayname(sender_user).await.ok();
 	content.avatar_url = services.users.avatar_url(sender_user).await.ok();
+	content.blurhash = services.users.blurhash(sender_user).await.ok();
 	content.reason.clone_from(&reason.clone());

 	// Try normal knock first
@@ -526,6 +530,7 @@ async fn knock_room_helper_remote(
 	let mut knock_content = RoomMemberEventContent::new(MembershipState::Knock);
 	knock_content.displayname = services.users.displayname(sender_user).await.ok();
 	knock_content.avatar_url = services.users.avatar_url(sender_user).await.ok();
+	knock_content.blurhash = services.users.blurhash(sender_user).await.ok();
 	knock_content.reason = reason;

 	knock_event_stub.insert(
@@ -19,8 +19,9 @@
 		room::member::{MembershipState, RoomMemberEventContent},
 	},
 };
-use service::{Services, rooms::membership::validate_remote_member_event_stub};
+use service::Services;

+use super::validate_remote_member_event_stub;
 use crate::Ruma;

 /// # `POST /_matrix/client/v3/rooms/{roomId}/leave`
@@ -13,10 +13,16 @@
 use axum::extract::State;
 use conduwuit::{Err, Result, warn};
 use futures::{FutureExt, StreamExt};
-use ruma::{OwnedRoomId, RoomId, ServerName, UserId, api::client::membership::joined_rooms};
+use ruma::{
+	CanonicalJsonObject, OwnedRoomId, RoomId, ServerName, UserId,
+	api::client::membership::joined_rooms,
+	events::{
+		StaticEventContent,
+		room::member::{MembershipState, RoomMemberEventContent},
+	},
+};
 use service::Services;

-pub use self::leave::{leave_all_rooms, leave_room, remote_leave_room};
 pub(crate) use self::{
 	ban::ban_user_route,
 	forget::forget_room_route,
@@ -28,6 +34,10 @@
 	members::{get_member_events_route, joined_members_route},
 	unban::unban_user_route,
 };
+pub use self::{
+	join::join_room_by_id_helper,
+	leave::{leave_all_rooms, leave_room, remote_leave_room},
+};
 use crate::{Ruma, client::full_user_deactivate};

 /// # `POST /_matrix/client/r0/joined_rooms`
@@ -149,3 +159,80 @@ pub(crate) async fn banned_room_check(

 	Ok(())
 }
+
+/// Validates that an event returned from a remote server by `/make_*`
+/// actually is a membership event with the expected fields.
+///
+/// Without checking this, the remote server could use the remote membership
+/// mechanism to trick our server into signing arbitrary malicious events.
+pub(crate) fn validate_remote_member_event_stub(
+	membership: &MembershipState,
+	user_id: &UserId,
+	room_id: &RoomId,
+	event_stub: &CanonicalJsonObject,
+) -> Result<()> {
+	let Some(event_type) = event_stub.get("type") else {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with missing type field"
+		));
+	};
+	if event_type != &RoomMemberEventContent::TYPE {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with invalid event type"
+		));
+	}
+
+	let Some(sender) = event_stub.get("sender") else {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with missing sender field"
+		));
+	};
+	if sender != &user_id.as_str() {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with incorrect sender"
+		));
+	}
+
+	let Some(state_key) = event_stub.get("state_key") else {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with missing state_key field"
+		));
+	};
+	if state_key != &user_id.as_str() {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with incorrect state_key"
+		));
+	}
+
+	let Some(event_room_id) = event_stub.get("room_id") else {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with missing room_id field"
+		));
+	};
+	if event_room_id != &room_id.as_str() {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with incorrect room_id"
+		));
+	}
+
+	let Some(content) = event_stub
+		.get("content")
+		.and_then(|content| content.as_object())
+	else {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with missing content field"
+		));
+	};
+	let Some(event_membership) = content.get("membership") else {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with missing membership field"
+		));
+	};
+	if event_membership != &membership.as_str() {
+		return Err!(BadServerResponse(
+			"Remote server returned member event with incorrect membership type"
+		));
+	}
+
+	Ok(())
+}
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Error, Result, at, debug_warn,
 	matrix::{
@@ -73,7 +73,7 @@
 ///   where the user was joined, depending on `history_visibility`)
 pub(crate) async fn get_message_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	InsecureClientIp(client_ip): InsecureClientIp,
 	body: Ruma<get_message_events::v3::Request>,
 ) -> Result<get_message_events::v3::Response> {
 	let sender_user = body.sender_user();
@@ -58,7 +58,7 @@
 pub(super) use media::*;
 pub(super) use media_legacy::*;
 pub(super) use membership::*;
-pub use membership::{leave_all_rooms, leave_room, remote_leave_room};
+pub use membership::{join_room_by_id_helper, leave_all_rooms, leave_room, remote_leave_room};
 pub(super) use message::*;
 pub(super) use mutual_rooms::*;
 pub(super) use openid::*;
@@ -21,6 +21,10 @@ pub(crate) async fn get_mutual_rooms_route(
 		return Err!(Request(Unknown("You cannot request rooms in common with yourself.")));
 	}

+	if !services.users.exists(&body.user_id).await {
+		return Ok(mutual_rooms::unstable::Response::new(vec![]));
+	}
+
 	let mutual_rooms = services
 		.rooms
 		.state_cache
@@ -23,7 +23,8 @@

 /// # `GET /_matrix/client/v3/profile/{userId}`
 ///
-/// Returns the user's profile information.
+/// Returns the displayname, avatar_url, blurhash, and custom profile fields of
+/// the user.
 ///
 /// - If user is on another server and we do not have a local copy already,
 ///   fetch profile over federation.
@@ -321,9 +322,19 @@ async fn set_profile_field(
 			services.users.set_avatar_url(user_id, None);
 		},
 		| other =>
-			services
-				.users
-				.set_profile_key(user_id, other.field_name().as_str(), other.value()),
+			if other.field_name().as_str() == "blurhash" {
+				if let Some(Value::String(blurhash)) = other.value() {
+					services.users.set_blurhash(user_id, Some(blurhash));
+				} else {
+					services.users.set_blurhash(user_id, None);
+				}
+			} else {
+				services.users.set_profile_key(
+					user_id,
+					other.field_name().as_str(),
+					other.value(),
+				);
+			},
 	}

 	// If the user is local and changed their displayname or avatar_url, update it
@@ -1,7 +1,7 @@
 use std::collections::BTreeMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, PduCount, Result, err};
 use ruma::{
 	MilliSecondsSinceUnixEpoch,
@@ -115,7 +115,7 @@ pub(crate) async fn set_read_marker_route(
 /// Sets private read marker and public read receipt EDU.
 pub(crate) async fn create_receipt_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	InsecureClientIp(client_ip): InsecureClientIp,
 	body: Ruma<create_receipt::v3::Request>,
 ) -> Result<create_receipt::v3::Response> {
 	let sender_user = body.sender_user();
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Result, matrix::pdu::PartialPdu};
 use ruma::{
 	api::client::redact::redact_event, assign, events::room::redaction::RoomRedactionEventContent,
@@ -14,7 +14,7 @@
 /// - TODO: Handle txn id
 pub(crate) async fn redact_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	InsecureClientIp(client_ip): InsecureClientIp,
 	body: Ruma<redact_event::v3::Request>,
 ) -> Result<redact_event::v3::Response> {
 	let sender_user = body.sender_user();
@@ -1,7 +1,7 @@
 use std::{fmt::Write as _, time::Duration};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Event, Result, debug_info, info, matrix::pdu::PduEvent, utils::ReadyExt};
 use conduwuit_service::Services;
 use ruma::{
@@ -33,7 +33,7 @@ struct Report {
 #[tracing::instrument(skip_all, fields(%client), name = "report_room", level = "info")]
 pub(crate) async fn report_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<report_room::v3::Request>,
 ) -> Result<report_room::v3::Response> {
 	let sender_user = body.sender_user();
@@ -88,7 +88,7 @@ pub(crate) async fn report_room_route(
 #[tracing::instrument(skip_all, fields(%client), name = "report_event", level = "info")]
 pub(crate) async fn report_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<report_content::v3::Request>,
 ) -> Result<report_content::v3::Response> {
 	// user authentication
@@ -132,7 +132,7 @@ pub(crate) async fn report_event_route(
 #[tracing::instrument(skip_all, fields(%client), name = "report_user", level = "info")]
 pub(crate) async fn report_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<report_user::v3::Request>,
 ) -> Result<report_user::v3::Response> {
 	// user authentication
@@ -288,6 +288,7 @@ pub(crate) async fn create_room_route(
 	let mut join_event = RoomMemberEventContent::new(MembershipState::Join);
 	join_event.displayname = services.users.displayname(sender_user).await.ok();
 	join_event.avatar_url = services.users.avatar_url(sender_user).await.ok();
+	join_event.blurhash = services.users.blurhash(sender_user).await.ok();
 	join_event.is_direct = Some(body.is_direct);

 	debug_info!("Joining {sender_user} to room {room_id}");
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Result};
 use ruma::api::client::room::get_summary;
 use service::rooms::summary::Accessibility;
@@ -12,7 +12,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "room_summary", level = "info")]
 pub(crate) async fn get_room_summary(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_summary::v1::Request>,
 ) -> Result<get_summary::v1::Response> {
 	let (room_id, servers) = services
@@ -271,6 +271,7 @@ pub(crate) async fn upgrade_room_route(
 				&assign!(RoomMemberEventContent::new(MembershipState::Join), {
 					displayname: services.users.displayname(sender_user).await.ok(),
 					avatar_url: services.users.avatar_url(sender_user).await.ok(),
+					blurhash: services.users.blurhash(sender_user).await.ok(),
 				}),
 			),
 			sender_user,
@@ -1,7 +1,7 @@
 use std::collections::BTreeMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Result, err, matrix::pdu::PartialPdu, utils};
 use ruma::{api::client::message::send_message_event, events::MessageLikeEventType};
 use serde_json::from_str;
@@ -19,7 +19,7 @@
 ///   allowed
 pub(crate) async fn send_message_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	InsecureClientIp(client_ip): InsecureClientIp,
 	body: Ruma<send_message_event::v3::Request>,
 ) -> Result<send_message_event::v3::Response> {
 	let sender_user = body.sender_user();
@@ -1,12 +1,13 @@
 use std::time::Duration;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, debug, err, info,
-	utils::{self, ReadyExt, stream::BroadbandExt},
+	utils::{self, ReadyExt, hash, stream::BroadbandExt},
 	warn,
 };
+use conduwuit_core::{debug_error, debug_warn};
 use conduwuit_service::Services;
 use futures::StreamExt;
 use lettre::Address;
@@ -41,7 +42,7 @@
 #[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
 pub(crate) async fn get_login_types_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	_body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
 	Ok(get_login_types::v3::Response::new(vec![
@@ -53,6 +54,113 @@ pub(crate) async fn get_login_types_route(
 	]))
 }

+/// Authenticates the given user by its ID and its password.
+///
+/// Returns the user ID if successful, and an error otherwise.
+#[tracing::instrument(skip_all, fields(%user_id), name = "password", level = "debug")]
+pub(crate) async fn password_login(
+	services: &Services,
+	user_id: &UserId,
+	lowercased_user_id: &UserId,
+	password: &str,
+) -> Result<OwnedUserId> {
+	// Restrict login to accounts only of type 'password', including untyped
+	// legacy accounts which are equivalent to 'password'.
+	if services
+		.users
+		.origin(user_id)
+		.await
+		.is_ok_and(|origin| origin != "password")
+	{
+		return Err!(Request(Forbidden("Account does not permit password login.")));
+	}
+
+	let (hash, user_id) = match services.users.password_hash(user_id).await {
+		| Ok(hash) => (hash, user_id),
+		| Err(_) => services
+			.users
+			.password_hash(lowercased_user_id)
+			.await
+			.map(|hash| (hash, lowercased_user_id))
+			.map_err(|_| err!(Request(Forbidden("Invalid identifier or password."))))?,
+	};
+
+	if hash.is_empty() {
+		return Err!(Request(UserDeactivated("The user has been deactivated")));
+	}
+
+	hash::verify_password(password, &hash)
+		.inspect_err(|e| debug_error!("{e}"))
+		.map_err(|_| err!(Request(Forbidden("Invalid identifier or password."))))?;
+
+	Ok(user_id.to_owned())
+}
+
+/// Authenticates the given user through the configured LDAP server.
+///
+/// Creates the user if the user is found in the LDAP and do not already have an
+/// account.
+#[tracing::instrument(skip_all, fields(%user_id), name = "ldap", level = "debug")]
+pub(super) async fn ldap_login(
+	services: &Services,
+	user_id: &UserId,
+	lowercased_user_id: &UserId,
+	password: &str,
+) -> Result<OwnedUserId> {
+	let (user_dn, is_ldap_admin) = match services.config.ldap.bind_dn.as_ref() {
+		| Some(bind_dn) if bind_dn.contains("{username}") =>
+			(bind_dn.replace("{username}", lowercased_user_id.localpart()), None),
+		| _ => {
+			debug!("Searching user in LDAP");
+
+			let dns = services.users.search_ldap(user_id).await?;
+			if dns.len() >= 2 {
+				return Err!(Ldap("LDAP search returned two or more results"));
+			}
+
+			let Some((user_dn, is_admin)) = dns.first() else {
+				return password_login(services, user_id, lowercased_user_id, password).await;
+			};
+
+			(user_dn.clone(), *is_admin)
+		},
+	};
+
+	let user_id = services
+		.users
+		.auth_ldap(&user_dn, password)
+		.await
+		.map(|()| lowercased_user_id.to_owned())?;
+
+	// LDAP users are automatically created on first login attempt. This is a very
+	// common feature that can be seen on many services using a LDAP provider for
+	// their users (synapse, Nextcloud, Jellyfin, ...).
+	//
+	// LDAP users are crated with a dummy password but non empty because an empty
+	// password is reserved for deactivated accounts. The conduwuit password field
+	// will never be read to login a LDAP user so it's not an issue.
+	if !services.users.exists(lowercased_user_id).await {
+		services
+			.users
+			.create(lowercased_user_id, Some("*"), Some("ldap"))
+			.await?;
+	}
+
+	// Only sync admin status if LDAP can actually determine it.
+	// None means LDAP cannot determine admin status (manual config required).
+	if let Some(is_ldap_admin) = is_ldap_admin {
+		let is_conduwuit_admin = services.admin.user_is_admin(lowercased_user_id).await;
+
+		if is_ldap_admin && !is_conduwuit_admin {
+			Box::pin(services.admin.make_user_admin(lowercased_user_id)).await?;
+		} else if !is_ldap_admin && is_conduwuit_admin {
+			Box::pin(services.admin.revoke_admin(lowercased_user_id)).await?;
+		}
+	}
+
+	Ok(user_id)
+}
+
 pub(crate) async fn handle_login(
 	services: &Services,
 	identifier: Option<&UserIdentifier>,
@@ -83,7 +191,15 @@ pub(crate) async fn handle_login(
 		UserId::parse_with_server_name(user_id_or_localpart, &services.config.server_name)
 			.map_err(|_| err!(Request(InvalidUsername("User ID is malformed"))))?;

-	if !services.globals.user_is_local(&user_id) {
+	let lowercased_user_id = UserId::parse_with_server_name(
+		user_id.localpart().to_lowercase(),
+		&services.config.server_name,
+	)
+	.unwrap();
+
+	if !services.globals.user_is_local(&user_id)
+		|| !services.globals.user_is_local(&lowercased_user_id)
+	{
 		return Err!(Request(InvalidParam("User ID does not belong to this homeserver")));
 	}

@@ -96,7 +212,18 @@ pub(crate) async fn handle_login(
 		return Err!(Request(Forbidden("This account is not permitted to log in.")));
 	}

-	services.users.check_password(&user_id, password).await
+	if cfg!(feature = "ldap") && services.config.ldap.enable {
+		match Box::pin(ldap_login(services, &user_id, &lowercased_user_id, password)).await {
+			| Ok(user_id) => Ok(user_id),
+			| Err(err) if services.config.ldap.ldap_only => Err(err),
+			| Err(err) => {
+				debug_warn!("{err}");
+				password_login(services, &user_id, &lowercased_user_id, password).await
+			},
+		}
+	} else {
+		password_login(services, &user_id, &lowercased_user_id, password).await
+	}
 }

 /// # `POST /_matrix/client/v3/login`
@@ -116,7 +243,7 @@ pub(crate) async fn handle_login(
 #[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
 pub(crate) async fn login_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
 	let emergency_mode_enabled = services.config.emergency_password.is_some();
@@ -247,7 +374,7 @@ pub(crate) async fn login_route(
 #[tracing::instrument(skip_all, fields(%client), name = "login_token", level = "info")]
 pub(crate) async fn login_token_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
 	if !services.server.config.login_via_existing_session {
@@ -283,7 +410,7 @@ pub(crate) async fn login_token_route(
 #[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
 pub(crate) async fn logout_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<logout::v3::Request>,
 ) -> Result<logout::v3::Response> {
 	let (sender_user, sender_device) = body.sender();
@@ -329,7 +456,7 @@ pub(crate) async fn logout_route(
 #[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
 pub(crate) async fn logout_all_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<logout_all::v3::Request>,
 ) -> Result<logout_all::v3::Response> {
 	let sender_user = body.sender_user();
@@ -1,7 +1,7 @@
 #[cfg(test)]
 mod tests;
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, err,
 	matrix::{Event, pdu::PartialPdu},
@@ -35,7 +35,7 @@
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	InsecureClientIp(ip): InsecureClientIp,
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<send_state_event::v3::Response> {
 	let sender_user = body.sender_user();
@@ -72,10 +72,10 @@ pub(crate) async fn send_state_event_for_key_route(
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_empty_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	InsecureClientIp(ip): InsecureClientIp,
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<RumaResponse<send_state_event::v3::Response>> {
-	send_state_event_for_key_route(State(services), ClientIp(ip), body)
+	send_state_event_for_key_route(State(services), InsecureClientIp(ip), body)
 		.boxed()
 		.await
 		.map(RumaResponse)
@@ -9,7 +9,7 @@
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Result, at, extract_variant,
 	utils::{
@@ -178,7 +178,7 @@ fn lazy_loading_enabled(&self) -> bool {
 )]
 pub(crate) async fn sync_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	InsecureClientIp(client_ip): InsecureClientIp,
 	body: Ruma<sync_events::v3::Request>,
 ) -> Result<sync_events::v3::Response> {
 	let (sender_user, sender_device) = body.sender();
@@ -395,10 +395,6 @@ pub(crate) async fn build_sync_events(
 		.users
 		.count_one_time_keys(syncing_user, syncing_device);

-	let unused_fallback_key_types = services
-		.users
-		.list_unused_fallback_key_types(syncing_user, syncing_device);
-
 	let (
 		(joined_rooms, mut device_list_updates),
 		left_rooms,
@@ -409,7 +405,6 @@ pub(crate) async fn build_sync_events(
 		to_device_events,
 		keys_changed,
 		device_one_time_keys_count,
-		unused_fallback_key_types,
 	) = async {
 		futures::join!(
 			joined_rooms,
@@ -420,8 +415,7 @@ pub(crate) async fn build_sync_events(
 			account_data,
 			to_device_events,
 			keys_changed,
-			device_one_time_keys_count,
-			unused_fallback_key_types,
+			device_one_time_keys_count
 		)
 	}
 	.boxed()
@@ -439,7 +433,8 @@ pub(crate) async fn build_sync_events(
 		account_data: assign!(GlobalAccountData::new(), { events: account_data }),
 		device_lists: device_list_updates.into(),
 		device_one_time_keys_count,
-		device_unused_fallback_key_types: Some(unused_fallback_key_types),
+		// Fallback keys are not yet supported
+		device_unused_fallback_key_types: None,
 		presence: assign!(Presence::new(), {
 			events: presence_updates
 				.into_iter()
@@ -6,7 +6,7 @@
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Error, Result, at, error, extract_variant, is_equal_to,
 	matrix::{Event, TypeStateKey, pdu::PduCount},
@@ -66,7 +66,7 @@
 /// [MSC4186]: https://github.com/matrix-org/matrix-spec-proposals/pull/4186
 pub(crate) async fn sync_events_v5_route(
 	State(ref services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	InsecureClientIp(client_ip): InsecureClientIp,
 	body: Ruma<sync_events::v5::Request>,
 ) -> Result<sync_events::v5::Response> {
 	debug_assert!(DEFAULT_BUMP_TYPES.is_sorted(), "DEFAULT_BUMP_TYPES is not sorted");
@@ -1,5 +1,5 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
+use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Result, utils, utils::math::Tried};
 use ruma::api::client::typing::create_typing_event::{self, v3::TypingInfo};

@@ -10,7 +10,7 @@
 /// Sets the typing state of the sender user.
 pub(crate) async fn create_typing_event_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	InsecureClientIp(ip): InsecureClientIp,
 	body: Ruma<create_typing_event::v3::Request>,
 ) -> Result<create_typing_event::v3::Response> {
 	use create_typing_event::v3::Typing;
@@ -1,8 +1,7 @@
+use std::collections::BTreeMap;
+
 use axum::{Json, extract::State, response::IntoResponse};
-use conduwuit::{
-	Result,
-	matrix::versions::{unstable_features, versions},
-};
+use conduwuit::Result;
 use futures::StreamExt;
 use ruma::{api::client::discovery::get_supported_versions, assign};

@@ -23,10 +22,47 @@
 pub(crate) async fn get_supported_versions_route(
 	_body: Ruma<get_supported_versions::Request>,
 ) -> Result<get_supported_versions::Response> {
-	Ok(assign!(
-		get_supported_versions::Response::new(versions()),
-		{ unstable_features: unstable_features() }
-	))
+	let versions = vec![
+		"r0.0.1".to_owned(),
+		"r0.1.0".to_owned(),
+		"r0.2.0".to_owned(),
+		"r0.3.0".to_owned(),
+		"r0.4.0".to_owned(),
+		"r0.5.0".to_owned(),
+		"r0.6.0".to_owned(),
+		"r0.6.1".to_owned(),
+		"v1.1".to_owned(),
+		"v1.2".to_owned(),
+		"v1.3".to_owned(),
+		"v1.4".to_owned(),
+		"v1.5".to_owned(),
+		"v1.8".to_owned(),
+		"v1.11".to_owned(),
+		"v1.12".to_owned(),
+		"v1.13".to_owned(),
+		"v1.14".to_owned(),
+	];
+
+	let unstable_features = BTreeMap::from_iter([
+		("org.matrix.e2e_cross_signing".to_owned(), true),
+		("org.matrix.msc2285.stable".to_owned(), true), /* private read receipts (https://github.com/matrix-org/matrix-spec-proposals/pull/2285) */
+		("uk.half-shot.msc2666.query_mutual_rooms".to_owned(), true), /* query mutual rooms (https://github.com/matrix-org/matrix-spec-proposals/pull/2666) */
+		("org.matrix.msc2836".to_owned(), true), /* threading/threads (https://github.com/matrix-org/matrix-spec-proposals/pull/2836) */
+		("org.matrix.msc2946".to_owned(), true), /* spaces/hierarchy summaries (https://github.com/matrix-org/matrix-spec-proposals/pull/2946) */
+		("org.matrix.msc3026.busy_presence".to_owned(), true), /* busy presence status (https://github.com/matrix-org/matrix-spec-proposals/pull/3026) */
+		("org.matrix.msc3814".to_owned(), true),               /* dehydrated devices */
+		("org.matrix.msc3827".to_owned(), true), /* filtering of /publicRooms by room type (https://github.com/matrix-org/matrix-spec-proposals/pull/3827) */
+		("org.matrix.msc3952_intentional_mentions".to_owned(), true), /* intentional mentions (https://github.com/matrix-org/matrix-spec-proposals/pull/3952) */
+		("org.matrix.msc3916.stable".to_owned(), true), /* authenticated media (https://github.com/matrix-org/matrix-spec-proposals/pull/3916) */
+		("org.matrix.msc4180".to_owned(), true), /* stable flag for 3916 (https://github.com/matrix-org/matrix-spec-proposals/pull/4180) */
+		("uk.tcpip.msc4133".to_owned(), true), /* Extending User Profile API with Key:Value Pairs (https://github.com/matrix-org/matrix-spec-proposals/pull/4133) */
+		("us.cloke.msc4175".to_owned(), true), /* Profile field for user time zone (https://github.com/matrix-org/matrix-spec-proposals/pull/4175) */
+		("org.matrix.simplified_msc3575".to_owned(), true), /* Simplified Sliding sync (https://github.com/matrix-org/matrix-spec-proposals/pull/4186) */
+		("uk.timedout.msc4323".to_owned(), true), /* agnostic suspend (https://github.com/matrix-org/matrix-spec-proposals/pull/4323) */
+		("org.matrix.msc4155".to_owned(), true), /* invite filtering (https://github.com/matrix-org/matrix-spec-proposals/pull/4155) */
+	]);
+
+	Ok(assign!(get_supported_versions::Response::new(versions), { unstable_features }))
 }

 /// # `GET /_conduwuit/server_version`
@@ -44,7 +80,7 @@ pub(crate) async fn conduwuit_server_version() -> Result<impl IntoResponse> {
 ///
 /// conduwuit-specific API to return the amount of users registered on this
 /// homeserver. Endpoint is disabled if federation is disabled for privacy. This
-/// only includes active users (not deactivated, etc)
+/// only includes active users (not deactivated, no guests, etc)
 pub(crate) async fn conduwuit_local_user_count(
 	State(services): State<crate::State>,
 ) -> Result<impl IntoResponse> {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ginger	d20707533a	fix: Panic on PL content deserialization failures	2026-04-22 10:44:40 -04:00
Ginger	44814b25ff	fix: Add stable routes for admin suspension endpoints	2026-04-22 10:43:00 -04:00
Ginger	036f26c2e3	fix: Re-add support for custom room IDs	2026-04-22 10:41:01 -04:00
Ginger	7e3aae1ae5	refactor: Remove mystery initial state hack	2026-04-22 10:34:04 -04:00
Ginger	ce86d0735f	fix: Increase max length for report reasons	2026-04-22 10:33:16 -04:00
Ginger	4b91a46a99	fix: Add bounds checking for profile data	2026-04-22 10:30:31 -04:00
Ginger	f890c34fff	fix: Add bounds checking for profile data	2026-04-22 10:30:18 -04:00
Ginger	538e0750d0	refactor: Clean up `api/client/membership/kick.rs`	2026-04-22 10:11:55 -04:00
Ginger	b11dafb85a	refactor: Remove old project name in `api/client/membership/`	2026-04-22 10:09:18 -04:00
Ginger	c537a61284	refactor: Clean up `api/client/membership.ban.rs`	2026-04-22 10:08:40 -04:00
Ginger	4de028158f	fix: Check existing key equality when uploading new E2EE keys	2026-04-22 10:05:08 -04:00
Ginger	a62580d1fb	refactor: Switch back to upstream Ruma	2026-04-22 09:40:15 -04:00
Ginger	06e8977cdd	fix: Enable compatibility feature to fix federation with old conduit-family homeservers	2026-04-22 09:36:42 -04:00
Ginger	3f28cda014	refactor: Improve summary service logging	2026-04-22 09:36:42 -04:00
Ginger	34701dffd1	fix: Fix failing test	2026-04-22 09:36:42 -04:00
Ginger	5eb2dd6807	chore: Changelog	2026-04-22 09:36:42 -04:00
Ginger	c26cac922b	chore: Clippy fixes	2026-04-22 09:36:42 -04:00
Ginger	5d2ed70408	fix: FIx code that was causing rustc to panic somehow	2026-04-22 09:36:40 -04:00
Ginger	f2ff83ae6b	refactor: Remove pointless assert	2026-04-22 09:36:40 -04:00
Ginger	7d3ac813b3	chore: Clippy fixes	2026-04-22 09:36:40 -04:00
Ginger	ccde414978	refactor: Fix errors in `api/client/directory.rs`, again	2026-04-22 09:36:40 -04:00
Ginger	94c70b5fb4	chore: Clippy fixes	2026-04-22 09:36:40 -04:00
Ginger	d5c37ced13	refactor: Fix errors in `admin/processor.rs`	2026-04-22 09:36:40 -04:00
Ginger	347e361ca9	refactor: Fix errors in `admin/user/`	2026-04-22 09:36:40 -04:00
Ginger	77a3665557	refactor: Fix errors in `admin/room/`	2026-04-22 09:36:40 -04:00
Ginger	abbd7c3afe	refactor: Fix errors in `admin/query/`	2026-04-22 09:36:40 -04:00
Ginger	7500d4a510	refactor: Fix errors in `admin/media/commands.rs`	2026-04-22 09:36:40 -04:00
Ginger	b2c0158364	refactor: Resolve errors in `admin/federation/commands.rs`	2026-04-22 09:36:40 -04:00
Ginger	efd9a1c321	refactor: Fix errors in `admin/debug/commands.rs`	2026-04-22 09:36:40 -04:00
Ginger	07af407792	refactor: Fix errors in `admin/check/commands.rs`	2026-04-22 09:36:40 -04:00
Ginger	2d744338e2	refactor: Fix remaining errors in `api/` (and temporarily switch to a fork of ruma)	2026-04-22 09:36:40 -04:00
Ginger	e6c98dff50	refactor: Fix errors in `web/`	2026-04-22 09:36:40 -04:00
Ginger	ae864879f4	refactor: Fix errors in `api/router/`	2026-04-22 09:36:40 -04:00
Ginger	92e16d034c	refactor: Fix errors in `api/server/well_known.rs`	2026-04-22 09:36:38 -04:00
Ginger	20ebc9b666	refactor: Fix errors in `api/server/version.rs`	2026-04-22 09:36:38 -04:00
Ginger	f6e0e1704c	refactor: Fix errors in `api/server/user.rs`	2026-04-22 09:36:38 -04:00
Ginger	fa3210de9a	refactor: Fix errors in `api/server/state.rs`	2026-04-22 09:36:38 -04:00
Ginger	68f115e6ac	refactor: Fix errors in `api/server/state_ids.rs`	2026-04-22 09:36:38 -04:00
Ginger	a3c08a491a	refactor: Fix errors in `api/server/send.rs`	2026-04-22 09:36:38 -04:00
Ginger	30cb7b15a9	refactor: Fix errors in `api/server/send_leave.rs`	2026-04-22 09:36:38 -04:00
Ginger	5fc0b17167	refactor: Fix errors in `api/server/send_knock.rs`	2026-04-22 09:36:38 -04:00
Ginger	fc5ceda091	refactor: Fix errors in `api/server/send_join.rs`	2026-04-22 09:36:38 -04:00
Ginger	4e92d58ce9	refactor: Fix errors in `api/server/query.rs`	2026-04-22 09:36:38 -04:00
Ginger	8a244da3ce	refactor: Fix errors in `api/server/publicrooms.rs`	2026-04-22 09:36:38 -04:00
Ginger	ea52348177	refactor: Fix errors in `api/server/media.rs`	2026-04-22 09:36:38 -04:00
Ginger	9741bb1c15	refactor: Fix errors in `api/server/make_leave.rs`	2026-04-22 09:36:38 -04:00
Ginger	fd3a502f05	refactor: Fix errors in `api/server/make_knock.rs`	2026-04-22 09:36:38 -04:00
Ginger	e578245cfe	refactor: Fix most errors in `api/server/make_join.rs`	2026-04-22 09:36:38 -04:00
Ginger	b0910e6248	refactor: Fix errors in `api/server/key.rs`	2026-04-22 09:36:38 -04:00
Ginger	2fa2829660	refactor: Fix errors in `api/server/invite.rs`	2026-04-22 09:36:38 -04:00
Ginger	756e8d478d	refactor: Fix errors in `api/server/get_missing_events.rs`	2026-04-22 09:36:38 -04:00
Ginger	31d384921d	refactor: Fix errors in `api/server/event.rs`	2026-04-22 09:36:38 -04:00
Ginger	c49823a136	refactor: Fix errors in `api/server/event_auth.rs`	2026-04-22 09:36:38 -04:00
Ginger	a84119e5d3	refactor: Fix errors in `api/server/backfill.rs`	2026-04-22 09:36:38 -04:00
Ginger	53123acff8	refactor: Fix remaining errors in `api/cient/message.rs`	2026-04-22 09:36:38 -04:00
Ginger	89591db677	refactor: Fix mystery weirdness in `api/client/sync/v3/mod.rs`	2026-04-22 09:36:38 -04:00
Ginger	b7316b9e51	refactor: Fix errors in `api/client/well_known.rs`	2026-04-22 09:36:38 -04:00
Ginger	02ba1780b5	refactor: Fix errors in `api/client/voip.rs`	2026-04-22 09:36:37 -04:00
Ginger	be4a94dc69	refactor: Fix errors in `api/client/user_directory.rs`	2026-04-22 09:36:37 -04:00
Ginger	c0b3661ac5	refactor: Fix errors in `api/client/unversioned.rs`	2026-04-22 09:36:37 -04:00
Ginger	b74ac6414b	refactor: Fix errors in `api/client/typing.rs`	2026-04-22 09:36:37 -04:00
Ginger	3470de9086	refactor: Fix errors in `api/client/to_device.rs`	2026-04-22 09:36:37 -04:00
Ginger	a69b957f50	refactor: Fix errors in `api/client/threads.rs`	2026-04-22 09:36:37 -04:00
Ginger	4401f0c482	refactor: Fix errors in `api/client/thirdparty.rs`	2026-04-22 09:36:37 -04:00
Ginger	4886aa8f77	refactor: Fix errors in `api/client/tag.rs`	2026-04-22 09:36:37 -04:00
Ginger	a474ecfede	refactor: Fix errors in `api/client/state.rs`	2026-04-22 09:36:37 -04:00
Ginger	f13c855f34	refactor: Fix errors in `api/client/session.rs`	2026-04-22 09:36:37 -04:00
Ginger	3ded6c7364	refactor: Fix errors in `api/client/send.rs`	2026-04-22 09:36:37 -04:00
Ginger	f06cc8de70	refactor: Fix errors in `api/client/search.rs`	2026-04-22 09:36:37 -04:00
Ginger	d855af52ed	refactor: Fix errors in `api/client/report.rs`	2026-04-22 09:36:37 -04:00
Ginger	0db5536f80	refactor: Fix errors in `api/client/relations.rs`	2026-04-22 09:36:37 -04:00
Ginger	61894853b4	refactor: Fix errors in `api/client/redact.rs`	2026-04-22 09:36:37 -04:00
Ginger	1847f3daff	refactor: Fix errors in `api/client/read_marker.rs`	2026-04-22 09:36:37 -04:00
Ginger	7c737d4092	refactor: Fix errors in `api/client/push.rs`	2026-04-22 09:36:37 -04:00
Ginger	551922fab6	refactor: Fix errors in `api/client/profile.rs` and `api/client/unstable.rs`	2026-04-22 09:36:37 -04:00
Ginger	f17eea4af4	refactor: Fix errors in `api/client/presence.rs`	2026-04-22 09:36:37 -04:00
Ginger	25da9e937c	refactor: Fix errors in `api/client/openid.rs`	2026-04-22 09:36:37 -04:00
Ginger	412346f842	refactor: Fix most errors in `api/client/messages.rs`	2026-04-22 09:36:37 -04:00
Ginger	a0a303ac01	refactor: Fix errors in `api/client/media.rs`	2026-04-22 09:36:37 -04:00
Ginger	85ad4816ac	refactor: Fix errors in `api/client/media_legacy.rs` Sent from my Steam Deck	2026-04-22 09:36:37 -04:00
Ginger	70d5b4bc55	refactor: Fix errors in `api/client/keys.rs`	2026-04-22 09:36:37 -04:00
Ginger	45290829d9	refactor: Fix errors in `api/client/directory.rs`	2026-04-22 09:36:37 -04:00
Ginger	57c574e9dd	refactor: Fix errors in `api/client/device.rs`	2026-04-22 09:36:37 -04:00
Ginger	25565cadfc	refactor: Fix errors in `api/client/dehydrated_device.rs`	2026-04-22 09:36:37 -04:00
Ginger	4e6c83facd	refactor: Fix errors in `api/client/context.rs`	2026-04-22 09:36:37 -04:00
Ginger	34d5966ef9	refactor: Fix errors in `api/client/capabilities.rs`	2026-04-22 09:36:37 -04:00
Ginger	044970fdcd	refactor: Fix errors in `api/client/backup.rs`	2026-04-22 09:36:37 -04:00
Ginger	e3ef6504fb	refactor: Fix errors in `api/client/appservice.rs`	2026-04-22 09:36:37 -04:00
Ginger	e4c0067951	refactor: Fix errors in `api/client/account_data.rs`	2026-04-22 09:36:37 -04:00
Ginger	9502a2428b	refactor: Fix errors in `api/client/sync`	2026-04-22 09:36:37 -04:00
Ginger	4345a64715	refactor: Resolve remaining errors in threepid.rs	2026-04-22 09:36:37 -04:00
Ginger	a28b6cbe1d	refactor: Fix errors in `api/client/room/`	2026-04-22 09:36:37 -04:00
Ginger	5a4006d4a8	refactor: Rename PduBuilder to PartialPdu	2026-04-22 09:36:37 -04:00
Ginger	a68ef84004	refactor: Add function to state_accessor to get create event	2026-04-22 09:36:35 -04:00
Ginger	b750117375	refactor: Consolidate hierarchy and summary logic in a new service	2026-04-22 09:36:35 -04:00
Ginger	ac77be3883	refactor: Fix errors in `api/client/membership/`	2026-04-22 09:36:35 -04:00
Ginger	d2f28c4d97	refactor: Fix (most) errors in `api/client/account/`	2026-04-22 09:36:34 -04:00
Ginger	e9c798f19f	chore: Clippy fixes	2026-04-22 09:36:34 -04:00
Ginger	15b832ff01	refactor: Replace more uses of RoomVersionId with RoomVersionRules	2026-04-22 09:36:34 -04:00
Ginger	ed62e0898c	fix: Resolve errors in recently added services	2026-04-22 09:36:34 -04:00
Jade Ellis	a56b87c088	refactor: Ruma upstraming, bake a little more	2026-04-22 09:36:34 -04:00
Ginger	dde8c226e3	refactor: Ruma upstreaming, half-baked edition Co-authored-by: Jade Ellis <jade@ellis.link>	2026-04-22 09:36:32 -04:00
				`@@ -1 +0,0 @@`
				`The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger`
				`@@ -1 +0,0 @@`
				`Removed support for guest user registration, a little-used and deprecated approach to room previews.`
				`@@ -1 +0,0 @@`
				The deprecated `well_known.rtc_focus_server_urls` config option has been removed. MatrixRTC foci should be configured using the `matrix_rtc.foci` config option.
				`@@ -1 +0,0 @@`
				`Support for server-side blurhashing (part of MSC2448) has been removed.`
				`@@ -1 +0,0 @@`
				`Add performance tuning documentation. Contributed by @stratself.`
				`@@ -0,0 +1 @@`
				`Updated config docs to state we support room version 12, and set it as default. Contributed by @ezera.`
				`@@ -1 +0,0 @@`
				`Explain accessing Continuwuity's server console when deployed via Docker.`
				`@@ -1 +0,0 @@`
				Clarified in the config that `max_request_size` affects federated media as well.
				`@@ -1 +0,0 @@`
				`Added support for fallback encryption keys.`