fix: Don't panic when running startup admin commands

.forgejo/workflows/build-debian.yml

@@ -31,10 +31,27 @@ jobs:
           echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
           echo "Debian distribution: $DISTRIBUTION ($VERSION)"
       - name: Work around llvm-project#153385
+        id: llvm-workaround
         run: |
-          mkdir -p /etc/crypto-policies/back-ends/
-          cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
-          sed -i 's/\(sha1\.second_preimage_resistance = \)2026-02-01/\12026-06-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
+          if [ -f /usr/share/apt/default-sequoia.config ]; then
+            echo "Applying workaround for llvm-project#153385"
+            mkdir -p /etc/crypto-policies/back-ends/
+            cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
+            sed -i 's/\(sha1\.second_preimage_resistance = \)2026-02-01/\12026-06-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
+          else
+            echo "No workaround needed for llvm-project#153385"
+          fi
+      - name: Pick compatible clang version
+        id: clang-version
+        run: |
+          # both latest need to use clang-23, but oldstable and previous can just use clang
+          if [[ "${{ matrix.container }}" == "ubuntu-latest" || "${{ matrix.container }}" == "debian-latest" ]]; then
+            echo "Using clang-23 package for ${{ matrix.container }}"
+            echo "version=clang-23" >> $GITHUB_OUTPUT
+          else
+            echo "Using default clang package for ${{ matrix.container }}"
+            echo "version=clang" >> $GITHUB_OUTPUT
+          fi
 
       - name: Checkout repository with full history
         uses: actions/checkout@v6
@@ -110,7 +127,7 @@ jobs:
         run: |
           apt-get update -y
           # Build dependencies for rocksdb
-          apt-get install -y clang-23 liburing-dev
+          apt-get install -y liburing-dev ${{ steps.clang-version.outputs.version }}
 
       - name: Run cargo-deb
         id: cargo-deb

CHANGELOG.md

@@ -1,25 +1,65 @@
+# Continuwuity v0.5.5 (2026-02-15)
+
+## Features
+
+- Added unstable support for [MSC4406:
+  `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406).
+  Contributed by @nex ([#1308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1308))
+- Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by
+  @Omar007 ([#1349](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1349))
+- Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by
+  @nex. ([#1368](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1368))
+- You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be
+  rejected. Contributed by @trashpanda ([#1372](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1372))
+- Improved the first-time setup experience for new homeserver administrators:
+    - Account registration is disabled on the first run, except for with a new special registration token that is logged
+      to the console.
+    - Other helpful information is logged to the console as well, including a giant warning if open registration is
+      enabled.
+    - The default index page now says to check the console for setup instructions if no accounts have been created.
+    - Once the first admin account is created, an improved welcome message is sent to the admin room.
+
+  Contributed by @ginger.
+
+## Bugfixes
+
+- Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or
+  broken invites should clear their client caches after updating to make them appear. ([#1249](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1249))
+- LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured.
+  Contributed by @Jade ([#1307](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1307))
+- Fixed sliding sync not resolving wildcard state key requests, enabling Video/Audio calls in Element X. ([#1370](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1370))
+
+## Misc
+
+- #1344
+
 # Continuwuity v0.5.4 (2026-02-08)
 
 ## Features
 
 - The announcement checker will now announce errors it encounters in the first run to the admin room, plus a few other
   misc improvements. Contributed by @Jade ([#1288](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1288))
-- Drastically improved the performance and reliability of account deactivations. Contributed by @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314))
+- Drastically improved the performance and reliability of account deactivations. Contributed by
+  @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314))
 - Refuse to process requests for and events in rooms that we no longer have any local users in (reduces state resets
-  and improves performance). Contributed by @nex ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316))
+  and improves performance). Contributed by
+  @nex ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316))
 - Added server-specific admin API routes to ban and unban rooms, for use with moderation bots. Contributed by @nex
   ([#1301](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1301))
 
 ## Bugfixes
 
-- Fix the generated configuration containing uncommented optional sections. Contributed by @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290))
-- Fixed specification non-compliance when handling remote media errors. Contributed by @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298))
+- Fix the generated configuration containing uncommented optional sections. Contributed by
+  @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290))
+- Fixed specification non-compliance when handling remote media errors. Contributed by
+  @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298))
 - UIAA requests which check for out-of-band success (sent by matrix-js-sdk) will no longer create unhelpful errors in
   the logs. Contributed by @ginger ([#1305](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1305))
 - Use exists instead of contains to save writing to a buffer in `src/service/users/mod.rs`: `is_login_disabled`.
   Contributed
   by @aprilgrimoire. ([#1340](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1340))
-- Fixed backtraces being swallowed during panics. Contributed by @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337))
+- Fixed backtraces being swallowed during panics. Contributed by
+  @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337))
 - Fixed a potential vulnerability that could allow an evil remote server to return malicious events during the room join
   and knock process. Contributed by @nex, reported by violet & [mat](https://matdoes.dev).
 - Fixed a race condition that could result in outlier PDUs being incorrectly marked as visible to a remote server.
@@ -28,25 +68,30 @@ ## Bugfixes
 
 ## Docs
 
-- Fixed Fedora install instructions. Contributed by @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342))
+- Fixed Fedora install instructions. Contributed by
+  @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342))
 
 # Continuwuity 0.5.3 (2026-01-12)
 
 ## Features
 
-- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279))
+- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by
+  @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279))
 
 ## Bugfixes
 
-- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286))
+- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by
+  @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286))
 
 ## Docs
 
-- Improve admin command documentation generation. Contributed by @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280))
+- Improve admin command documentation generation. Contributed by
+  @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280))
 
 ## Misc
 
-- Improve timeout-related code for federation and URL previews. Contributed by @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278))
+- Improve timeout-related code for federation and URL previews. Contributed by
+  @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278))
 
 # Continuwuity 0.5.2 (2026-01-09)
 
@@ -57,11 +102,14 @@ ## Features
   after a certain amount of time has passed. Additionally, the `registration_token_file` configuration option is
   superseded by this feature and **has been removed**. Use the new `!admin token` command family to manage registration
   tokens. Contributed by @ginger (#783).
-- Implemented a configuration defined admin list independent of the admin room. Contributed by @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253))
+- Implemented a configuration defined admin list independent of the admin room. Contributed by
+  @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253))
 - Added support for invite and join anti-spam via Draupnir and Meowlnir, similar to that of synapse-http-antispam.
   Contributed by @nex. ([#1263](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1263))
-- Implemented account locking functionality, to complement user suspension. Contributed by @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266))
-- Added admin command to forcefully log out all of a user's existing sessions. Contributed by @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271))
+- Implemented account locking functionality, to complement user suspension. Contributed by
+  @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266))
+- Added admin command to forcefully log out all of a user's existing sessions. Contributed by
+  @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271))
 - Implemented toggling the ability for an account to log in without mutating any of its data. Contributed by @nex. (
   [#1272](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1272))
 - Add support for custom room create event timestamps, to allow generating custom prefixes in hashed room IDs.
@@ -71,7 +119,8 @@ ## Features
 
 ## Bugfixes
 
-- Fixed unreliable room summary fetching and improved error messages. Contributed by @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257))
+- Fixed unreliable room summary fetching and improved error messages. Contributed by
+  @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257))
 - Client requested timeout parameter is now applied to e2ee key lookups and claims. Related federation requests are now
   also concurrent. Contributed by @nex. ([#1261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1261))
 - Fixed the whoami endpoint returning HTTP 404 instead of HTTP 403, which confused some appservices. Contributed by
@@ -90,9 +139,12 @@ # Continuwuity 0.5.0 (2025-12-30)
 
 ## Features
 
-- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (@Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251))
+- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (
+  @Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251))
 
 ## Bug Fixes
 
-- Don't allow admin room upgrades, as this can break the admin room (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
-- Fix invalid creators in power levels during upgrade to v12 (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
+- Don't allow admin room upgrades, as this can break the admin room (
+  @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
+- Fix invalid creators in power levels during upgrade to v12 (
+  @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))

Cargo.lock

@@ -1013,7 +1013,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "clap",
  "conduwuit_admin",
@@ -1045,7 +1045,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_admin"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "clap",
  "conduwuit_api",
@@ -1066,7 +1066,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_api"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "async-trait",
  "axum 0.7.9",
@@ -1098,14 +1098,14 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_build_metadata"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "built",
 ]
 
 [[package]]
 name = "conduwuit_core"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "argon2",
  "arrayvec",
@@ -1166,7 +1166,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_database"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "async-channel",
  "conduwuit_core",
@@ -1184,7 +1184,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_macros"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "itertools 0.14.0",
  "proc-macro2",
@@ -1194,7 +1194,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_router"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "axum 0.7.9",
  "axum-client-ip",
@@ -1228,7 +1228,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_service"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "askama 0.14.0",
  "async-trait",
@@ -1270,7 +1270,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_web"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "askama 0.14.0",
  "axum 0.7.9",
@@ -6589,7 +6589,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "askama 0.15.4",
  "cargo_metadata",

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "0.5.4"
+version = "0.5.5"
 
 [workspace.metadata.crane]
 name = "conduwuit"

changelog.d/+ffabfdf8.feature.md

@@ -1,7 +0,0 @@
-Improved the first-time setup experience for new homeserver administrators:
-- Account registration is disabled on the first run, except for with a new special registration token that is logged to the console.
-- Other helpful information is logged to the console as well, including a giant warning if open registration is enabled.
-- The default index page now says to check the console for setup instructions if no accounts have been created.
-- Once the first admin account is created, an improved welcome message is sent to the admin room.
-
-Contributed by @ginger.

changelog.d/1249.bugfix.md

@@ -1 +0,0 @@
-Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or broken invites should clear their client caches after updating to make them appear.

changelog.d/1307.bugfix.md

@@ -1 +0,0 @@
-LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured. Contributed by @Jade

changelog.d/1308.feature.md

@@ -1,2 +0,0 @@
-Added unstable support for [MSC4406: `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406).
-Contributed by @nex

changelog.d/1344.misc.md

@@ -1 +0,0 @@
-Continuwuity will now print information to the console when it detects a deadlock

changelog.d/1349.feature

@@ -1 +0,0 @@
-Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by @Omar007

changelog.d/1368.feature

@@ -1 +0,0 @@
-Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by @nex.

changelog.d/1370.bugfix.md

@@ -1 +0,0 @@
-Fixed sliding sync not resolving wildcard state key requests, enabling Video/Audio calls in Element X.

changelog.d/1372.feature.md

@@ -1 +0,0 @@
-You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be rejected. Contributed by @trashpanda

src/router/run.rs

@@ -39,7 +39,15 @@ pub(crate) async fn run(services: Arc<Services>) -> Result<()> {
 			.runtime()
 			.spawn(serve::serve(services.clone(), handle.clone(), tx.subscribe()));
 
-	// Focal point
+	// Run startup admin commands.
+	// This has to be done after the admin service is initialized otherwise it
+	// panics.
+	services.admin.startup_execute().await?;
+
+	// Print first-run banner if necessary. This needs to be done after the startup
+	// admin commands are run in case one of them created the first user.
+	services.firstrun.print_first_run_banner();
+
 	debug!("Running");
 	let res = tokio::select! {
 		res = &mut listener => res.map_err(Error::from).unwrap_or_else(Err),

src/service/admin/execute.rs

@@ -26,7 +26,7 @@ pub(super) async fn console_auto_stop(&self) {
 
 /// Execute admin commands after startup
 #[implement(super::Service)]
-pub(crate) async fn startup_execute(&self) -> Result {
+pub async fn startup_execute(&self) -> Result {
 	// List of commands to execute
 	let commands = &self.services.server.config.admin_execute;
 

src/service/firstrun/mod.rs

@@ -5,7 +5,7 @@
 
 use askama::Template;
 use async_trait::async_trait;
-use conduwuit::{Result, utils::ReadyExt};
+use conduwuit::{Result, info, utils::ReadyExt};
 use futures::StreamExt;
 use ruma::{UserId, events::room::message::RoomMessageEventContent};
 
@@ -146,6 +146,8 @@ struct WelcomeMessage<'a> {
 			.send_loud_message(RoomMessageEventContent::text_markdown(welcome_message))
 			.await?;
 
+		info!("{user} has been invited to the admin room as the first user.");
+
 		Ok(true)
 	}
 
@@ -162,7 +164,7 @@ pub fn get_first_account_token(&self) -> Option<ValidToken> {
 		}
 	}
 
-	pub(crate) fn print_first_run_banner(&self) {
+	pub fn print_first_run_banner(&self) {
 		use yansi::Paint;
 		// This function is specially called by the core after all other
 		// services have started. It runs last to ensure that the banner it

src/service/services.rs

@@ -149,13 +149,6 @@ pub async fn start(self: &Arc<Self>) -> Result<Arc<Self>> {
 
 		debug_info!("Services startup complete.");
 
-		// Run startup admin commands
-		self.admin.startup_execute().await?;
-
-		// Prin first-run banner if necessary. This needs to be done after the startup
-		// admin commands are run in case one of them created the first user.
-		self.firstrun.print_first_run_banner();
-
 		Ok(Arc::clone(self))
 	}