docs: Add links to matrix guides

2026-04-02 11:35:58 +00:00 · 2026-02-11 18:25:11 +00:00
132 changed files with 2344 additions and 4172 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,9 +1,9 @@
 # Local build and dev artifacts
 target/
-!target/debug/conduwuit

 # Docker files
 Dockerfile*
+docker/

 # IDE files
 .vscode
--- a/.forgejo/workflows/build-debian.yml
+++ b/.forgejo/workflows/build-debian.yml
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        container: [ "ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable" ]
+        container: ["ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable"]
    container:
      image: "ghcr.io/tcpipuk/act-runner:${{ matrix.container }}"

@@ -30,28 +30,6 @@ jobs:
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
          echo "Debian distribution: $DISTRIBUTION ($VERSION)"
-      - name: Work around llvm-project#153385
-        id: llvm-workaround
-        run: |
-          if [ -f /usr/share/apt/default-sequoia.config ]; then
-            echo "Applying workaround for llvm-project#153385"
-            mkdir -p /etc/crypto-policies/back-ends/
-            cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
-            sed -i 's/\(sha1\.second_preimage_resistance = \)2026-02-01/\12026-06-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
-          else
-            echo "No workaround needed for llvm-project#153385"
-          fi
-      - name: Pick compatible clang version
-        id: clang-version
-        run: |
-          # both latest need to use clang-23, but oldstable and previous can just use clang
-          if [[ "${{ matrix.container }}" == "ubuntu-latest" || "${{ matrix.container }}" == "debian-latest" ]]; then
-            echo "Using clang-23 package for ${{ matrix.container }}"
-            echo "version=clang-23" >> $GITHUB_OUTPUT
-          else
-            echo "Using default clang package for ${{ matrix.container }}"
-            echo "version=clang" >> $GITHUB_OUTPUT
-          fi

      - name: Checkout repository with full history
        uses: actions/checkout@v6
@@ -127,7 +105,7 @@ jobs:
        run: |
          apt-get update -y
          # Build dependencies for rocksdb
-          apt-get install -y liburing-dev ${{ steps.clang-version.outputs.version }}
+          apt-get install -y clang liburing-dev

      - name: Run cargo-deb
        id: cargo-deb
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,7 +23,7 @@ repos:
        - id: check-added-large-files

  - repo: https://github.com/crate-ci/typos
-    rev: v1.43.5
+    rev: v1.43.4
    hooks:
      - id: typos
      - id: typos
--- a/.typos.toml
+++ b/.typos.toml
@@ -24,5 +24,3 @@ extend-ignore-re = [
 "continuwity" = "continuwuity"
 "execuse" = "execuse"
 "oltp" = "OTLP"
-
-rememvering = "remembering"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,65 +1,25 @@
-# Continuwuity v0.5.5 (2026-02-15)
-
-## Features
-
- Added unstable support for [MSC4406:
-  `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406).
-  Contributed by @nex ([#1308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1308))
- Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by
-  @Omar007 ([#1349](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1349))
- Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by
-  @nex. ([#1368](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1368))
- You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be
-  rejected. Contributed by @trashpanda ([#1372](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1372))
- Improved the first-time setup experience for new homeserver administrators:
-    - Account registration is disabled on the first run, except for with a new special registration token that is logged
-      to the console.
-    - Other helpful information is logged to the console as well, including a giant warning if open registration is
-      enabled.
-    - The default index page now says to check the console for setup instructions if no accounts have been created.
-    - Once the first admin account is created, an improved welcome message is sent to the admin room.
-
-  Contributed by @ginger.
-
-## Bugfixes
-
- Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or
-  broken invites should clear their client caches after updating to make them appear. ([#1249](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1249))
- LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured.
-  Contributed by @Jade ([#1307](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1307))
- Fixed sliding sync not resolving wildcard state key requests, enabling Video/Audio calls in Element X. ([#1370](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1370))
-
-## Misc
-
- #1344
-
 # Continuwuity v0.5.4 (2026-02-08)

 ## Features

 - The announcement checker will now announce errors it encounters in the first run to the admin room, plus a few other
  misc improvements. Contributed by @Jade ([#1288](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1288))
- Drastically improved the performance and reliability of account deactivations. Contributed by
-  @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314))
+- Drastically improved the performance and reliability of account deactivations. Contributed by @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314))
 - Refuse to process requests for and events in rooms that we no longer have any local users in (reduces state resets
-  and improves performance). Contributed by
-  @nex ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316))
+  and improves performance). Contributed by @nex ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316))
 - Added server-specific admin API routes to ban and unban rooms, for use with moderation bots. Contributed by @nex
  ([#1301](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1301))

 ## Bugfixes

- Fix the generated configuration containing uncommented optional sections. Contributed by
-  @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290))
- Fixed specification non-compliance when handling remote media errors. Contributed by
-  @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298))
+- Fix the generated configuration containing uncommented optional sections. Contributed by @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290))
+- Fixed specification non-compliance when handling remote media errors. Contributed by @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298))
 - UIAA requests which check for out-of-band success (sent by matrix-js-sdk) will no longer create unhelpful errors in
  the logs. Contributed by @ginger ([#1305](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1305))
 - Use exists instead of contains to save writing to a buffer in `src/service/users/mod.rs`: `is_login_disabled`.
  Contributed
  by @aprilgrimoire. ([#1340](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1340))
- Fixed backtraces being swallowed during panics. Contributed by
-  @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337))
+- Fixed backtraces being swallowed during panics. Contributed by @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337))
 - Fixed a potential vulnerability that could allow an evil remote server to return malicious events during the room join
  and knock process. Contributed by @nex, reported by violet & [mat](https://matdoes.dev).
 - Fixed a race condition that could result in outlier PDUs being incorrectly marked as visible to a remote server.
@@ -68,30 +28,25 @@ ## Bugfixes

 ## Docs

- Fixed Fedora install instructions. Contributed by
-  @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342))
+- Fixed Fedora install instructions. Contributed by @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342))

 # Continuwuity 0.5.3 (2026-01-12)

 ## Features

- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by
-  @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279))
+- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279))

 ## Bugfixes

- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by
-  @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286))
+- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286))

 ## Docs

- Improve admin command documentation generation. Contributed by
-  @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280))
+- Improve admin command documentation generation. Contributed by @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280))

 ## Misc

- Improve timeout-related code for federation and URL previews. Contributed by
-  @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278))
+- Improve timeout-related code for federation and URL previews. Contributed by @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278))

 # Continuwuity 0.5.2 (2026-01-09)

@@ -102,14 +57,11 @@ ## Features
  after a certain amount of time has passed. Additionally, the `registration_token_file` configuration option is
  superseded by this feature and **has been removed**. Use the new `!admin token` command family to manage registration
  tokens. Contributed by @ginger (#783).
- Implemented a configuration defined admin list independent of the admin room. Contributed by
-  @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253))
+- Implemented a configuration defined admin list independent of the admin room. Contributed by @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253))
 - Added support for invite and join anti-spam via Draupnir and Meowlnir, similar to that of synapse-http-antispam.
  Contributed by @nex. ([#1263](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1263))
- Implemented account locking functionality, to complement user suspension. Contributed by
-  @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266))
- Added admin command to forcefully log out all of a user's existing sessions. Contributed by
-  @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271))
+- Implemented account locking functionality, to complement user suspension. Contributed by @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266))
+- Added admin command to forcefully log out all of a user's existing sessions. Contributed by @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271))
 - Implemented toggling the ability for an account to log in without mutating any of its data. Contributed by @nex. (
  [#1272](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1272))
 - Add support for custom room create event timestamps, to allow generating custom prefixes in hashed room IDs.
@@ -119,8 +71,7 @@ ## Features

 ## Bugfixes

- Fixed unreliable room summary fetching and improved error messages. Contributed by
-  @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257))
+- Fixed unreliable room summary fetching and improved error messages. Contributed by @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257))
 - Client requested timeout parameter is now applied to e2ee key lookups and claims. Related federation requests are now
  also concurrent. Contributed by @nex. ([#1261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1261))
 - Fixed the whoami endpoint returning HTTP 404 instead of HTTP 403, which confused some appservices. Contributed by
@@ -139,12 +90,9 @@ # Continuwuity 0.5.0 (2025-12-30)

 ## Features

- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (
-  @Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251))
+- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (@Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251))

 ## Bug Fixes

- Don't allow admin room upgrades, as this can break the admin room (
-  @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
- Fix invalid creators in power levels during upgrade to v12 (
-  @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
+- Don't allow admin room upgrades, as this can break the admin room (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
+- Fix invalid creators in power levels during upgrade to v12 (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -85,31 +85,24 @@ ### Matrix tests

 ### Writing documentation

-Continuwuity's website uses [`rspress`][rspress] and is deployed via CI using Cloudflare Pages
+Continuwuity's website uses [`mdbook`][mdbook] and is deployed via CI using Cloudflare Pages
 in the [`documentation.yml`][documentation.yml] workflow file. All documentation is in the `docs/`
 directory at the top level.

-To load the documentation locally:
-
-1. Install NodeJS and npm from their [official website][nodejs-download] or via your package manager of choice
-
-2. From the project's root directory, install the relevant npm modules
+To build the documentation locally:

+1. Install mdbook if you don't have it already:
   ```bash
-   npm ci
+   cargo install mdbook # or cargo binstall, or another method
   ```

-3. Make changes to the document pages as you see fit
-
-4. Generate a live preview of the documentation
-
+2. Build the documentation:
   ```bash
-   npm run docs:dev
+   mdbook build
   ```

-   A webserver for the docs will be spun up for you (e.g. at `http://localhost:3000`). Any changes you make to the documentation will be live-reloaded on the webpage.
+The output of the mdbook generation is in `public/`. You can open the HTML files directly in your browser without needing a web server.

-Alternatively, you can build the documentation using `npm run docs:build` - the output of this will be in the `/doc_build` directory. Once you're happy with your documentation updates, you can commit the changes.

 ### Commit Messages

@@ -176,6 +169,5 @@ ### Creating pull requests
 [continuwuity-matrix]: https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org
 [complement]: https://github.com/matrix-org/complement/
 [sytest]: https://github.com/matrix-org/sytest/
-[nodejs-download]: https://nodejs.org/en/download
-[rspress]: https://rspress.rs/
+[mdbook]: https://rust-lang.github.io/mdBook/
 [documentation.yml]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/.forgejo/workflows/documentation.yml
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "0.5.5"
+version = "0.5.4"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -68,7 +68,7 @@ default-features = false
 version = "0.1.3"

 [workspace.dependencies.rand]
-version = "0.10.0"
+version = "0.8.5"

 # Used for the http request / response body type for Ruma endpoints used with reqwest
 [workspace.dependencies.bytes]
@@ -84,7 +84,7 @@ version = "1.3.1"
 version = "1.11.1"

 [workspace.dependencies.axum]
-version = "0.8.8"
+version = "0.7.9"
 default-features = false
 features = [
    "form",
@@ -97,7 +97,7 @@ features = [
 ]

 [workspace.dependencies.axum-extra]
-version = "0.10.1"
+version = "0.9.6"
 default-features = false
 features = ["typed-header", "tracing"]

@@ -110,7 +110,7 @@ default-features = false
 version = "0.7"

 [workspace.dependencies.axum-client-ip]
-version = "0.7"
+version = "0.6.1"

 [workspace.dependencies.tower]
 version = "0.5.2"
@@ -118,7 +118,7 @@ default-features = false
 features = ["util"]

 [workspace.dependencies.tower-http]
-version = "0.6.8"
+version = "0.6.2"
 default-features = false
 features = [
    "add-extension",
@@ -158,7 +158,7 @@ features = ["raw_value"]

 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.19"
+version = "0.0.17"

 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -253,7 +253,7 @@ features = [
 version = "0.4.0"

 [workspace.dependencies.libloading]
-version = "0.9.0"
+version = "0.8.6"

 # Validating urls in config, was already a transitive dependency
 [workspace.dependencies.url]
@@ -298,7 +298,7 @@ default-features = false
 features = ["env", "toml"]

 [workspace.dependencies.hickory-resolver]
-version = "0.25.2"
+version = "0.25.1"
 default-features = false
 features = [
    "serde",
@@ -342,8 +342,7 @@ version = "0.1.2"
 # Used for matrix spec type definitions and helpers
 [workspace.dependencies.ruma]
 git = "https://forgejo.ellis.link/continuwuation/ruwuma"
-#branch = "conduwuit-changes"
-rev = "e087ff15888156942ca2ffe6097d1b4c3fd27628"
+rev = "458d52bdc7f9a07c497be94a1420ebd3d87d7b2b"
 features = [
    "compat",
    "rand",
@@ -379,8 +378,7 @@ features = [
    "unstable-msc4210", # remove legacy mentions
    "unstable-extensible-events",
    "unstable-pdu",
-    "unstable-msc4155",
-    "unstable-msc4143", # livekit well_known response
+    "unstable-msc4155"
 ]

 [workspace.dependencies.rust-rocksdb]
@@ -425,7 +423,7 @@ features = ["http", "grpc-tonic", "trace", "logs", "metrics"]

 # optional sentry metrics for crash/panic reporting
 [workspace.dependencies.sentry]
-version = "0.46.0"
+version = "0.45.0"
 default-features = false
 features = [
    "backtrace",
@@ -441,9 +439,9 @@ features = [
 ]

 [workspace.dependencies.sentry-tracing]
-version = "0.46.0"
+version = "0.45.0"
 [workspace.dependencies.sentry-tower]
-version = "0.46.0"
+version = "0.45.0"

 # jemalloc usage
 [workspace.dependencies.tikv-jemalloc-sys]
@@ -472,7 +470,7 @@ features = ["use_std"]
 version = "0.5"

 [workspace.dependencies.nix]
-version = "0.31.0"
+version = "0.30.1"
 default-features = false
 features = ["resource"]

@@ -550,12 +548,6 @@ features = ["sync", "tls-rustls", "rustls-provider"]
 [workspace.dependencies.resolv-conf]
 version = "0.7.5"

-[workspace.dependencies.yansi]
-version = "1.0.1"
-
-[workspace.dependencies.askama]
-version = "0.15.0"
-
 #
 # Patches
 #
--- a/README.md
+++ b/README.md
@@ -57,15 +57,10 @@ ### What are the project's goals?

 ### Can I try it out?

-Check out the [documentation](https://continuwuity.org) for installation instructions.
+Check out the [documentation](https://continuwuity.org) for installation instructions, or join one of these vetted public homeservers running Continuwuity to get a feel for things!

-If you want to try it out as a user, we have some partnered homeservers you can use:
-* You can head over to [https://federated.nexus](https://federated.nexus/) in your browser.
-  * Hit the `Apply to Join` button. Once your request has been accepted, you will receive an email with your username and password.
-  * Head over to [https://app.federated.nexus](https://app.federated.nexus/) and you can sign in there, or use any other matrix chat client you wish elsewhere.
-  * Your username for matrix will be in the form of `@username:federated.nexus`, however you can simply use the `username` part to log in. Your password is your password.
-
-* There's also [https://continuwuity.rocks/](https://continuwuity.rocks/). You can register a new account using Cinny via [this convenient link](https://app.cinny.in/register/continuwuity.rocks), or you can use Element or another matrix client *that supports registration*.
+- https://continuwuity.rocks -- A public demo server operated by the Continuwuity Team.
+- https://federated.nexus -- Federated Nexus is a community resource hosting multiple FOSS (especially federated) services, including Matrix and Forgejo.

 ### What are we working on?

--- a/changelog.d/1249.bugfix.md
+++ b/changelog.d/1249.bugfix.md
@@ -0,0 +1 @@
+Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or broken invites should clear their client caches after updating to make them appear.
--- a/changelog.d/1349.feature
+++ b/changelog.d/1349.feature
@@ -0,0 +1 @@
+Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by @Omar007
--- a/changelog.d/1393.bugfix
+++ b/changelog.d/1393.bugfix
@@ -1 +0,0 @@
-Removed non-compliant nor functional room alias lookups over federation. Contributed by @nex
--- a/changelog.d/1399.feature
+++ b/changelog.d/1399.feature
@@ -1 +0,0 @@
-Outgoing presence is now disabled by default, and the config option documentation has been adjusted to more accurately represent the weight of presence, typing indicators, and read receipts. Contributed by @nex.
--- a/changelog.d/1418.bugfix
+++ b/changelog.d/1418.bugfix
@@ -1 +0,0 @@
-Removed ability to set rocksdb as read only. Doing so would cause unintentional and buggy behaviour. Contributed by @Terryiscool160.
--- a/changelog.d/1421.bugfix
+++ b/changelog.d/1421.bugfix
@@ -1 +0,0 @@
-Fixed a startup crash in the sender service if we can't detect the number of CPU cores, even if the `sender_workers' config option is set correctly. Contributed by @katie.
--- a/changelog.d/1428.feature
+++ b/changelog.d/1428.feature
@@ -1 +0,0 @@
-Improved the concurrency handling of federation transactions, vastly improving performance and reliability by more accurately handling inbound transactions and reducing the amount of repeated wasted work. Contributed by @nex and @Jade.
--- a/changelog.d/1435.feature.md
+++ b/changelog.d/1435.feature.md
@@ -1 +0,0 @@
-Added MSC3202 Device masquerading (not all of MSC3202). This should fix issues with enabling MSC4190 for some Mautrix bridges. Contributed by @Jade
--- a/changelog.d/list-backups-formatting.feature
+++ b/changelog.d/list-backups-formatting.feature
@@ -1 +0,0 @@
-Updated `list-backups` admin command to output one backup per line.
--- a/changelog.d/url-preview-fix.feature
+++ b/changelog.d/url-preview-fix.feature
@@ -1 +0,0 @@
-Improved URL preview fetching with a more compatible user agent for sites like YouTube Music. Added `!admin media delete-url-preview <url>` command to clear cached URL previews that were stuck and broken.
--- a/conduwuit-example.toml
+++ b/conduwuit-example.toml
@@ -290,25 +290,6 @@
 #
 #max_fetch_prev_events = 192

-# How many incoming federation transactions the server is willing to be
-# processing at any given time before it becomes overloaded and starts
-# rejecting further transactions until some slots become available.
-#
-# Setting this value too low or too high may result in unstable
-# federation, and setting it too high may cause runaway resource usage.
-#
-#max_concurrent_inbound_transactions = 150
-
-# Maximum age (in seconds) for cached federation transaction responses.
-# Entries older than this will be removed during cleanup.
-#
-#transaction_id_cache_max_age_secs = 7200 (2 hours)
-
-# Maximum number of cached federation transaction responses.
-# When the cache exceeds this limit, older entries will be removed.
-#
-#transaction_id_cache_max_entries = 8192
-
 # Default/base connection timeout (seconds). This is used only by URL
 # previews and update/news endpoint checks.
 #
@@ -452,7 +433,7 @@
 # If you would like registration only via token reg, please configure
 # `registration_token`.
 #
-#allow_registration = true
+#allow_registration = false

 # If registration is enabled, and this setting is true, new users
 # registered after the first admin user will be automatically suspended
@@ -1075,6 +1056,14 @@
 #
 #rocksdb_repair = false

+# This item is undocumented. Please contribute documentation for it.
+#
+#rocksdb_read_only = false
+
+# This item is undocumented. Please contribute documentation for it.
+#
+#rocksdb_secondary = false
+
 # Enables idle CPU priority for compaction thread. This is not enabled by
 # default to prevent compaction from falling too far behind on busy
 # systems.
@@ -1131,34 +1120,27 @@

 # Allow local (your server only) presence updates/requests.
 #
-# Local presence must be enabled for outgoing presence to function.
-#
-# Note that local presence is not as heavy on the CPU as federated
-# presence, but will still become more expensive the more local users you
-# have.
+# Note that presence on continuwuity is very fast unlike Synapse's. If
+# using outgoing presence, this MUST be enabled.
 #
 #allow_local_presence = true

-# Allow incoming federated presence updates.
+# Allow incoming federated presence updates/requests.
 #
-# This option enables processing inbound presence updates from other
-# servers. Without it, remote users will appear as if they are always
-# offline to your local users. This does not affect typing indicators or
-# read receipts.
+# This option receives presence updates from other servers, but does not
+# send any unless `allow_outgoing_presence` is true. Note that presence on
+# continuwuity is very fast unlike Synapse's.
 #
 #allow_incoming_presence = true

 # Allow outgoing presence updates/requests.
 #
-# This option sends presence updates to other servers, and requires that
-# `allow_local_presence` is also enabled.
+# This option sends presence updates to other servers, but does not
+# receive any unless `allow_incoming_presence` is true. Note that presence
+# on continuwuity is very fast unlike Synapse's. If using outgoing
+# presence, you MUST enable `allow_local_presence` as well.
 #
-# Note that outgoing presence is very heavy on the CPU and network, and
-# will typically cause extreme strain and slowdowns for no real benefit.
-# There are only a few clients that even implement presence, so you
-# probably don't want to enable this.
-#
-#allow_outgoing_presence = false
+#allow_outgoing_presence = true

 # How many seconds without presence updates before you become idle.
 # Defaults to 5 minutes.
@@ -1192,10 +1174,6 @@

 # Allow sending read receipts to remote servers.
 #
-# Note that sending read receipts to remote servers in large rooms with
-# lots of other homeservers may cause additional strain on the CPU and
-# network.
-#
 #allow_outgoing_read_receipts = true

 # Allow local typing updates.
@@ -1207,10 +1185,6 @@

 # Allow outgoing typing updates to federation.
 #
-# Note that sending typing indicators to remote servers in large rooms
-# with lots of other homeservers may cause additional strain on the CPU
-# and network.
-#
 #allow_outgoing_typing = true

 # Allow incoming typing updates from federation.
@@ -1344,7 +1318,7 @@
 # sender user's server name, inbound federation X-Matrix origin, and
 # outbound federation handler.
 #
-# You can set this to [".*"] to block all servers by default, and then
+# You can set this to ["*"] to block all servers by default, and then
 # use `allowed_remote_server_names` to allow only specific servers.
 #
 # example: ["badserver\\.tld$", "badphrase", "19dollarfortnitecards"]
@@ -1500,10 +1474,6 @@
 #
 #url_preview_check_root_domain = false

-# User agent that is used specifically when fetching url previews.
-#
-#url_preview_user_agent = "continuwuity/<version> (bot; +https://continuwuity.org)"
-
 # List of forbidden room aliases and room IDs as strings of regex
 # patterns.
 #
@@ -1850,17 +1820,6 @@
 #
 #support_mxid =

-# A list of MatrixRTC foci URLs which will be served as part of the
-# MSC4143 client endpoint at /.well-known/matrix/client.  If you're
-# setting up livekit, you'd want something like:
-# rtc_focus_server_urls = [
-#     { type = "livekit", livekit_service_url = "https://livekit.example.com" },
-# ]
-#
-# To disable, set this to be an empty vector (`[]`).
-#
-#rtc_focus_server_urls = []
-
 [global.blurhashing]

 # blurhashing x component, 4 is recommended by https://blurha.sh/
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -48,11 +48,11 @@ EOF

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.17.5
+ENV BINSTALL_VERSION=1.17.4
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
-ENV LDDTREE_VERSION=0.5.0
+ENV LDDTREE_VERSION=0.4.0
 # renovate: datasource=crate depName=timelord-cli
 ENV TIMELORD_VERSION=3.0.1

@@ -162,7 +162,6 @@ ENV CONDUWUIT_VERSION_EXTRA=$CONDUWUIT_VERSION_EXTRA
 ENV CONTINUWUITY_VERSION_EXTRA=$CONTINUWUITY_VERSION_EXTRA

 ARG RUST_PROFILE=release
-ARG CARGO_FEATURES="default,http3"

 # Build the binary
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
@@ -172,20 +171,11 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
    set -o allexport
    set -o xtrace
    . /etc/environment
-
-    # Check if http3 feature is enabled and set appropriate RUSTFLAGS
-    if echo "${CARGO_FEATURES}" | grep -q "http3"; then
-        export RUSTFLAGS="${RUSTFLAGS} --cfg reqwest_unstable"
-    else
-        export RUSTFLAGS="${RUSTFLAGS}"
-    fi
-
    TARGET_DIR=($(cargo metadata --no-deps --format-version 1 | \
            jq -r ".target_directory"))
    mkdir /out/sbin
    PACKAGE=conduwuit
    xx-cargo build --locked --profile ${RUST_PROFILE} \
-        --no-default-features --features ${CARGO_FEATURES} \
        -p $PACKAGE;
    BINARIES=($(cargo metadata --no-deps --format-version 1 | \
        jq -r ".packages[] | select(.name == \"$PACKAGE\") | .targets[] | select( .kind | map(. == \"bin\") | any ) | .name"))
--- a/docker/complement.Dockerfile
+++ b/docker/complement.Dockerfile
@@ -2,9 +2,9 @@ FROM ubuntu:latest
 EXPOSE 8008
 EXPOSE 8448
 RUN apt-get update && apt-get install -y ca-certificates liburing2 && rm -rf /var/lib/apt/lists/*
-RUN mkdir -p /etc/continuwuity /var/lib/continuwuity /usr/local/bin/
-COPY complement/complement-entrypoint.sh /usr/local/bin/complement-entrypoint.sh
-COPY complement/complement.config.toml /etc/continuwuity/config.toml
+RUN mkdir -p /etc/continuwuity /var/lib/continuwuity
+COPY docker/complement-entrypoint.sh /usr/local/bin/complement-entrypoint.sh
+COPY docker/complement.config.toml /etc/continuwuity/config.toml
 COPY target/debug/conduwuit /usr/local/bin/conduwuit
 RUN chmod +x /usr/local/bin/conduwuit /usr/local/bin/complement-entrypoint.sh
 #HEALTHCHECK --interval=30s --timeout=5s CMD curl --fail http://localhost:8008/_continuwuity/server_version || exit 1
--- a/docker/musl.Dockerfile
+++ b/docker/musl.Dockerfile
@@ -18,11 +18,11 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.17.5
+ENV BINSTALL_VERSION=1.17.4
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
-ENV LDDTREE_VERSION=0.5.0
+ENV LDDTREE_VERSION=0.4.0

 # Install unpackaged tools
 RUN <<EOF
--- a/docs/_meta.json
+++ b/docs/_meta.json
@@ -15,9 +15,9 @@
        "label": "Deploying"
    },
    {
-        "type": "dir",
-        "name": "calls",
-        "label": "Calls"
+        "type": "file",
+        "name": "turn",
+        "label": "TURN"
    },
    {
        "type": "file",
@@ -64,11 +64,6 @@
        "label": "Configuration Reference",
        "name": "/reference/config"
    },
-    {
-        "type": "file",
-        "label": "Environment Variables",
-        "name": "/reference/environment-variables"
-    },
    {
        "type": "dir",
        "label": "Admin Command Reference",
--- a/docs/_nav.json
+++ b/docs/_nav.json
@@ -2,7 +2,7 @@
    {
        "text": "Guide",
        "link": "/introduction",
-        "activeMatch": "^/(introduction|configuration|deploying|calls|appservices|maintenance|troubleshooting)"
+        "activeMatch": "^/(introduction|configuration|deploying|turn|appservices|maintenance|troubleshooting)"
    },
    {
        "text": "Development",
--- a/docs/calls.mdx
+++ b/docs/calls.mdx
@@ -1,13 +0,0 @@
-# Calls
-
-Matrix supports two types of calls:
-
- Element Call powered by [MatrixRTC](https://half-shot.github.io/msc-crafter/#msc/4143) and [LiveKit](https://github.com/livekit/livekit)
- Legacy calls, sometimes using Jitsi
-
-Both types of calls are supported by different sets of clients, but most clients are moving towards MatrixRTC / Element Call.
-
-For either one to work correctly, you have to do some additional setup.
-
- For legacy calls to work, you need to set up a TURN/STUN server. [Read the TURN guide for tips on how to set up coturn](./calls/turn.mdx)
- For MatrixRTC / Element Call to work, you have to set up the LiveKit backend (foci). LiveKit also uses TURN/STUN to increase reliability, so you might want to configure your TURN server first. [Read the LiveKit guide](./calls/livekit.mdx)
--- a/docs/calls/_meta.json
+++ b/docs/calls/_meta.json
@@ -1,12 +0,0 @@
-[
-    {
-        "type": "file",
-        "name": "turn",
-        "label": "TURN"
-    },
-    {
-        "type": "file",
-        "name": "livekit",
-        "label": "MatrixRTC / LiveKit"
-    }
-]
--- a/docs/calls/livekit.mdx
+++ b/docs/calls/livekit.mdx
@@ -1,268 +0,0 @@
-# Matrix RTC/Element Call Setup
-
-:::info
-This guide assumes that you are using docker compose for deployment. LiveKit only provides Docker images.
-:::
-
-## Instructions
-
-### 1. Domain
-
-LiveKit should live on its own domain or subdomain. In this guide we use `livekit.example.com` - this should be replaced with a domain you control.
-
-Make sure the DNS record for the (sub)domain you plan to use is pointed to your server.
-
-### 2. Services
-
-Using LiveKit with Matrix requires two services - Livekit itself, and a service (`lk-jwt-service`) that grants Matrix users permission to connect to it.
-
-You must generate a key and secret to allow the Matrix service to authenticate with LiveKit. `LK_MATRIX_KEY` should be around 20 random characters, and `LK_MATRIX_SECRET` should be around 64. Remember to replace these with the actual values!
-
-:::tip Generating the secrets
-LiveKit provides a utility to generate secure random keys
-```bash
-docker run --rm livekit/livekit-server:latest generate-keys
-```
-:::
-
-```yaml
-services:
-  lk-jwt-service:
-    image: ghcr.io/element-hq/lk-jwt-service:latest
-    container_name: lk-jwt-service
-    environment:
-      - LIVEKIT_JWT_BIND=:8081
-      - LIVEKIT_URL=wss://livekit.example.com
-      - LIVEKIT_KEY=LK_MATRIX_KEY
-      - LIVEKIT_SECRET=LK_MATRIX_SECRET
-      - LIVEKIT_FULL_ACCESS_HOMESERVERS=example.com
-    restart: unless-stopped
-    ports:
-      - "8081:8081"
-
-  livekit:
-    image: livekit/livekit-server:latest
-    container_name: livekit
-    command: --config /etc/livekit.yaml
-    restart: unless-stopped
-    volumes:
-      - ./livekit.yaml:/etc/livekit.yaml:ro
-    network_mode: "host" # /!\ LiveKit binds to all addresses by default.
-    # Make sure port 7880 is blocked by your firewall to prevent access bypassing your reverse proxy
-    # Alternatively, uncomment the lines below and comment `network_mode: "host"` above to specify port mappings.
-#    ports:
-#      - "127.0.0.1:7880:7880/tcp"
-#      - "7881:7881/tcp"
-#      - "50100-50200:50100-50200/udp"
-```
-
-Next, we need to configure LiveKit. In the same directory, create `livekit.yaml` with the following content - remembering to replace `LK_MATRIX_KEY` and `LK_MATRIX_SECRET` with the values you generated:
-
-```yaml
-port: 7880
-bind_addresses:
-  - ""
-rtc:
-  tcp_port: 7881
-  port_range_start: 50100
-  port_range_end: 50200
-  use_external_ip: true
-  enable_loopback_candidate: false
-keys:
-  LK_MATRIX_KEY: LK_MATRIX_SECRET
-```
-
-#### Firewall hints
-
-You will need to allow ports `7881/tcp` and `50100:50200/udp` through your firewall. If you use UFW, the commands are: `ufw allow 7881/tcp` and `ufw allow 50100:50200/udp`.
-
-### 3. Telling clients where to find LiveKit
-
-To tell clients where to find LiveKit, you need to add the address of your `lk-jwt-service` to your client .well-known file. To do so, in the config section `global.well-known`, add (or modify) the option `rtc_focus_server_urls`.
-
-The variable should be a list of servers serving as MatrixRTC endpoints to serve in the well-known file to the client.
-
-```toml
-rtc_focus_server_urls = [
-    { type = "livekit", livekit_service_url = "https://livekit.example.com" },
-]
-```
-
-Remember to replace the URL with the address you are deploying your instance of lk-jwt-service to.
-
-#### Serving .well-known manually
-
-If you don't let Continuwuity serve your `.well-known` files, you need to add the following lines to your `.well-known/matrix/client` file, remembering to replace the URL with your own `lk-jwt-service` deployment:
-
-```json
-  "org.matrix.msc4143.rtc_foci": [
-    {
-      "type": "livekit",
-      "livekit_service_url": "https://livekit.example.com"
-    }
-  ]
-```
-
-The final file should look something like this:
-
-```json
-{
-  "m.homeserver": {
-    "base_url":"https://matrix.example.com"
-  },
-  "org.matrix.msc4143.rtc_foci": [
-    {
-      "type": "livekit",
-      "livekit_service_url": "https://livekit.example.com"
-    }
-  ]
-}
-```
-
-### 4. Configure your Reverse Proxy
-
-Reverse proxies can be configured in many different ways - so we can't provide a step by step for this.
-
-By default, all routes should be forwarded to Livekit with the exception of the following path prefixes, which should be forwarded to the JWT/Authentication service:
-
- `/sfu/get`
- `/healthz`
- `/get_token`
-
-<details>
-    <summary>Example caddy config</summary>
-    ```
-    matrix-rtc.example.com {
-
-        # for lk-jwt-service
-        @lk-jwt-service path /sfu/get* /healthz* /get_token*
-        route @lk-jwt-service {
-            reverse_proxy 127.0.0.1:8081
-        }
-
-        # for livekit
-        reverse_proxy 127.0.0.1:7880
-    }
-    ```
-</details>
-
-<details>
-    <summary>Example nginx config</summary>
-    ```
-    server {
-        server_name matrix-rtc.example.com;
-
-        # for lk-jwt-service
-        location ~ ^/(sfu/get|healthz|get_token) {
-            proxy_pass http://127.0.0.1:8081$request_uri;
-            proxy_set_header X-Forwarded-For $remote_addr;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header Host $http_host;
-            proxy_buffering off;
-        }
-
-        # for livekit
-        location / {
-            proxy_pass http://127.0.0.1:7880$request_uri;
-            proxy_set_header X-Forwarded-For $remote_addr;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header Host $http_host;
-            proxy_buffering off;
-
-            # websocket
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-        }
-    }
-    ```
-
-    Note that for websockets to work, you need to have this somewhere outside your server block:
-    ```
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        ''      close;
-    }
-    ```
-</details>
-
-<details>
-    <summary>Example traefik router</summary>
-    ```
-    # on LiveKit itself
-    traefik.http.routers.livekit.rule=Host(`livekit.example.com`)
-    # on the JWT service
-    traefik.http.routers.livekit-jwt.rule=Host(`livekit.example.com`) && (PathPrefix(`/sfu/get`) || PathPrefix(`/healthz`) || PathPrefix(`/get_token`))
-    ```
-</details>
-
-
-### 6. Start Everything
-
-Start up the services using your usual method - for example `docker compose up -d`.
-
-## Additional Configuration
-
-### TURN Integration
-
-If you've already set up coturn, there may be a port clash between the two services. To fix this, make sure the `min-port` and `max-port` for coturn so it doesn't overlap with LiveKit's range:
-
-```ini
-min-port=50201
-max-port=65535
-```
-
-To improve LiveKit's reliability, you can configure it to use your coturn server.
-
-Generate a long random secret for LiveKit, and add it to your coturn config under the `static-auth-secret` option. You can add as many secrets as you want - so set a different one for each thing using your TURN server.
-
-Then configure livekit, making sure to replace `COTURN_SECRET`:
-
-```yaml
-# livekit.yaml
-rtc:
-  turn_servers:
-    - host: coturn.ellis.link
-      port: 3478
-      protocol: tcp
-      secret: "COTURN_SECRET"
-    - host: coturn.ellis.link
-      port: 5349
-      protocol: tls # Only if you've set up TLS in your coturn
-      secret: "COTURN_SECRET"
-    - host: coturn.ellis.link
-      port: 3478
-      protocol: udp
-      secret: "COTURN_SECRET"
-```
-
-## LiveKit's built in TURN server
-
-Livekit includes a built in TURN server which can be used in place of an external option. This TURN server will only work with Livekit, so you can't use it for legacy Matrix calling - or anything else.
-
-If you don't want to set up a separate TURN server, you can enable this with the following changes:
-
-```yaml
-### add this to livekit.yaml ###
-turn:
-  enabled: true
-  udp_port: 3478
-  relay_range_start: 50300
-  relay_range_end: 50400
-  domain: matrix-rtc.example.com
-```
-
-```yaml
-### Add these to docker-compose ###
- "3478:3478/udp"
- "50300-50400:50300-50400/udp"
-```
-
-### Related Documentation
-
- [LiveKit GitHub](https://github.com/livekit/livekit)
- [LiveKit Connection Tester](https://livekit.io/connection-test) - use with the token returned by `/sfu/get` or `/get_token`
- [MatrixRTC proposal](https://half-shot.github.io/msc-crafter/#msc/4143)
- [Synapse documentation](https://github.com/element-hq/element-call/blob/livekit/docs/self-hosting.md)
- [Community guide](https://tomfos.tr/matrix/livekit/)
- [Community guide](https://blog.kimiblock.top/2024/12/24/hosting-element-call/)
--- a/docs/calls/turn.mdx
+++ b/docs/calls/turn.mdx
@@ -1,214 +0,0 @@
-# Setting up TURN/STUN
-
-[TURN](https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT) and [STUN](https://en.wikipedia.org/wiki/STUN) are used as a component in many calling systems. Matrix uses them directly for legacy calls and indirectly for MatrixRTC via Livekit.
-
-Continuwuity recommends using [Coturn](https://github.com/coturn/coturn) as your TURN/STUN server, which is available as a Docker image or a distro package.
-
-## Installing Coturn
-
-### Configuration
-
-Create a configuration file called `coturn.conf` containing:
-
-```ini
-use-auth-secret
-static-auth-secret=<a secret key>
-realm=<your server domain>
-```
-
-:::tip Generating a secure secret
-A common way to generate a suitable alphanumeric secret key is by using:
-```bash
-pwgen -s 64 1
-```
-:::
-
-#### Port Configuration
-
-By default, coturn uses the following ports:
- `3478` (UDP/TCP): Standard TURN/STUN port
- `5349` (UDP/TCP): TURN/STUN over TLS
- `49152-65535` (UDP): Media relay ports
-
-If you're also running LiveKit, you'll need to avoid port conflicts. Configure non-overlapping port ranges:
-
-```ini
-# In coturn.conf
-min-port=50201
-max-port=65535
-```
-
-This leaves ports `50100-50200` available for LiveKit's default configuration.
-
-### Running with Docker
-
-Run the [Coturn](https://hub.docker.com/r/coturn/coturn) image using:
-
-```bash
-docker run -d --network=host \
-  -v $(pwd)/coturn.conf:/etc/coturn/turnserver.conf \
-  coturn/coturn
-```
-
-### Running with Docker Compose
-
-Create a `docker-compose.yml` file and run `docker compose up -d`:
-
-```yaml
-version: '3'
-services:
-  turn:
-    container_name: coturn-server
-    image: docker.io/coturn/coturn
-    restart: unless-stopped
-    network_mode: "host"
-    volumes:
-      - ./coturn.conf:/etc/coturn/turnserver.conf
-```
-
-:::info Why host networking?
-Coturn uses host networking mode because it needs to bind to multiple ports and work with various network protocols. Using host networking is better for performance, and reduces configuration complexity. To understand alternative configuration options, visit [Coturn's Docker documentation](https://github.com/coturn/coturn/blob/master/docker/coturn/README.md).
-:::
-
-### Security Recommendations
-
-For security best practices, see Synapse's [Coturn documentation](https://element-hq.github.io/synapse/latest/turn-howto.html), which includes important firewall and access control recommendations.
-
-## Configuring Continuwuity
-
-Once your TURN server is running, configure Continuwuity to provide credentials to clients. Add the following to your Continuwuity configuration file:
-
-### Shared Secret Authentication (Recommended)
-
-This is the most secure method and generates time-limited credentials automatically:
-
-```toml
-# TURN URIs that clients should connect to
-turn_uris = [
-    "turn:coturn.example.com?transport=udp",
-    "turn:coturn.example.com?transport=tcp",
-    "turns:coturn.example.com?transport=udp",
-    "turns:coturn.example.com?transport=tcp"
-]
-
-# Shared secret for generating credentials (must match coturn's static-auth-secret)
-turn_secret = "<your coturn static-auth-secret>"
-
-# Optional: Read secret from a file instead (takes priority over turn_secret)
-# turn_secret_file = "/etc/continuwuity/.turn_secret"
-
-# TTL for generated credentials in seconds (default: 86400 = 24 hours)
-turn_ttl = 86400
-```
-
-:::tip Using TLS
-The `turns:` URI prefix instructs clients to connect to TURN over TLS, which is highly recommended for security. Make sure you've configured TLS in your coturn server first.
-:::
-
-### Static Credentials (Alternative)
-
-If you prefer static username/password credentials instead of shared secrets:
-
-```toml
-turn_uris = [
-    "turn:coturn.example.com?transport=udp",
-    "turn:coturn.example.com?transport=tcp"
-]
-
-turn_username = "your_username"
-turn_password = "your_password"
-```
-
-:::warning
-Static credentials are less secure than shared secrets because they don't expire and must be configured in coturn separately. It is strongly advised you use shared secret authentication.
-:::
-
-### Guest Access
-
-By default, TURN credentials require client authentication. To allow unauthenticated access:
-
-```toml
-turn_allow_guests = true
-```
-
-:::caution
-This is not recommended as it allows unauthenticated users to access your TURN server, potentially enabling abuse by bots. All major Matrix clients that support legacy calls *also* support authenticated TURN access.
-:::
-
-### Important Notes
-
- Replace `coturn.example.com` with your actual TURN server domain (the `realm` from coturn.conf)
- The `turn_secret` must match the `static-auth-secret` in your coturn configuration
- Restart or reload Continuwuity after making configuration changes
-
-## Testing Your TURN Server
-
-### Testing Credentials
-
-Verify that Continuwuity is correctly serving TURN credentials to clients:
-
-```bash
-curl "https://matrix.example.com/_matrix/client/r0/voip/turnServer" \
-  -H "Authorization: Bearer <your_client_token>" | jq
-```
-
-You should receive a response like this:
-
-```json
-{
-  "username": "1752792167:@jade:example.com",
-  "password": "KjlDlawdPbU9mvP4bhdV/2c/h65=",
-  "uris": [
-    "turns:coturn.example.com?transport=udp",
-    "turns:coturn.example.com?transport=tcp",
-    "turn:coturn.example.com?transport=udp",
-    "turn:coturn.example.com?transport=tcp"
-  ],
-  "ttl": 86400
-}
-```
-
-:::note MSC4166 Compliance
-If no TURN URIs are configured (`turn_uris` is empty), Continuwuity will return a 404 Not Found response, as specified in MSC4166.
-:::
-
-### Testing Connectivity
-
-Use [Trickle ICE](https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/) to verify that the TURN credentials actually work:
-
-1. Copy the credentials from the response above
-2. Paste them into the Trickle ICE testing tool
-3. Click "Gather candidates"
-4. Look for successful `relay` candidates in the results
-
-If you see relay candidates, your TURN server is working correctly!
-
-## Troubleshooting
-
-### Clients can't connect to TURN server
-
- Verify firewall rules allow the necessary ports (3478, 5349, and your media port range)
- Check that DNS resolves correctly for your TURN domain
- Ensure your `turn_secret` matches coturn's `static-auth-secret`
- Test with Trickle ICE to isolate the issue
-
-### Port conflicts with LiveKit
-
- Make sure coturn's `min-port` starts above LiveKit's `port_range_end` (default: 50200)
- Or adjust LiveKit's port range to avoid coturn's default range
-
-### 404 when calling turnServer endpoint
-
- Verify that `turn_uris` is not empty in your Continuwuity config
- This behavior is correct per MSC4166 if no TURN URIs are configured
-
-### Credentials expire too quickly
-
- Adjust the `turn_ttl` value in your Continuwuity configuration
- Default is 86400 seconds (24 hours)
-
-### Related Documentation
-
- [MatrixRTC/LiveKit Setup](./livekit.mdx) - Configure group calling with LiveKit
- [Coturn GitHub](https://github.com/coturn/coturn) - Official coturn repository
- [Synapse TURN Guide](https://element-hq.github.io/synapse/latest/turn-howto.html) - Additional security recommendations
--- a/docs/deploying/docker-compose.for-traefik.yml
+++ b/docs/deploying/docker-compose.for-traefik.yml
@@ -8,6 +8,7 @@ services:
    restart: unless-stopped
    volumes:
      - db:/var/lib/continuwuity
+      - /etc/resolv.conf:/etc/resolv.conf:ro # Use the host's DNS resolver rather than Docker's.
      #- ./continuwuity.toml:/etc/continuwuity.toml
    networks:
      - proxy
--- a/docs/deploying/docker.mdx
+++ b/docs/deploying/docker.mdx
@@ -2,26 +2,28 @@ # Continuwuity for Docker

 ## Docker

-To run Continuwuity with Docker, you can either build the image yourself or pull
-it from a registry.
+To run Continuwuity with Docker, you can either build the image yourself or pull it
+from a registry.

 ### Use a registry

-Available OCI images:
+OCI images for Continuwuity are available in the registries listed below.

-| Registry         | Image                                                                                                                                                       | Notes                                                                        |
-| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
-| Forgejo Registry | [forgejo.ellis.link/continuwuation/continuwuity:latest](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/latest)                 | Latest tagged image.                                                         |
-| Forgejo Registry | [forgejo.ellis.link/continuwuation/continuwuity:main](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/main)                     | Main branch image.                                                           |
-| Forgejo Registry | [forgejo.ellis.link/continuwuation/continuwuity:latest-maxperf](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/latest-maxperf) | [Performance optimised version.](./generic.mdx#performance-optimised-builds) |
-| Forgejo Registry | [forgejo.ellis.link/continuwuation/continuwuity:main-maxperf](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/main-maxperf)     | [Performance optimised version.](./generic.mdx#performance-optimised-builds) |
+| Registry        | Image                                                           | Notes                  |
+| --------------- | --------------------------------------------------------------- | -----------------------|
+| Forgejo Registry| [forgejo.ellis.link/continuwuation/continuwuity:latest](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/latest)     | Latest tagged image.   |
+| Forgejo Registry| [forgejo.ellis.link/continuwuation/continuwuity:main](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/main)       | Main branch image.     |
+| Forgejo Registry| [forgejo.ellis.link/continuwuation/continuwuity:latest-maxperf](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/latest-maxperf) | [Performance optimised version.](./generic.mdx#performance-optimised-builds) |
+| Forgejo Registry| [forgejo.ellis.link/continuwuation/continuwuity:main-maxperf](https://forgejo.ellis.link/continuwuation/-/packages/container/continuwuity/main-maxperf)   | [Performance optimised version.](./generic.mdx#performance-optimised-builds) |

-**Example:**
+Use

 ```bash
-docker image pull forgejo.ellis.link/continuwuation/continuwuity:main-maxperf
+docker image pull $LINK
 ```

+to pull it to your machine.
+
 #### Mirrors

 Images are mirrored to multiple locations automatically, on a schedule:
@@ -31,146 +33,39 @@ #### Mirrors
 - `registry.gitlab.com/continuwuity/continuwuity`
 - `git.nexy7574.co.uk/mirrored/continuwuity` (releases only, no `main`)

-### Quick Run
+### Run

-Get a working Continuwuity server with an admin user in four steps:
-
-#### Prerequisites
-
-Continuwuity requires HTTPS for Matrix federation. You'll need:
-
- A domain name pointing to your server
- A reverse proxy with SSL/TLS certificates (Traefik, Caddy, nginx, etc.)
-
-See [Docker Compose](#docker-compose) for complete examples.
-
-#### Environment Variables
-
- `CONTINUWUITY_SERVER_NAME` - Your Matrix server's domain name
- `CONTINUWUITY_DATABASE_PATH` - Where to store your database (must match the
-  volume mount)
- `CONTINUWUITY_ADDRESS` - Bind address (use `0.0.0.0` to listen on all
-  interfaces)
- `CONTINUWUITY_ALLOW_REGISTRATION` - Set to `false` to disable registration, or
-  use with `CONTINUWUITY_REGISTRATION_TOKEN` to require a token (see
-  [reference](../reference/environment-variables.mdx#registration--user-configuration)
-  for details)
-
-See the
-[Environment Variables Reference](../reference/environment-variables.mdx) for
-more configuration options.
-
-#### 1. Pull the image
+When you have the image, you can simply run it with

 ```bash
-docker pull forgejo.ellis.link/continuwuation/continuwuity:latest
+docker run -d -p 8448:6167 \
+    -v db:/var/lib/continuwuity/ \
+    -e CONTINUWUITY_SERVER_NAME="your.server.name" \
+    -e CONTINUWUITY_ALLOW_REGISTRATION=false \
+    --name continuwuity $LINK
 ```

-#### 2. Start the server with initial admin user
+or you can use [Docker Compose](#docker-compose).

-```bash
-docker run -d \
-  -p 6167:6167 \
-  -v continuwuity_db:/var/lib/continuwuity \
-  -e CONTINUWUITY_SERVER_NAME="matrix.example.com" \
-  -e CONTINUWUITY_DATABASE_PATH="/var/lib/continuwuity" \
-  -e CONTINUWUITY_ADDRESS="0.0.0.0" \
-  -e CONTINUWUITY_ALLOW_REGISTRATION="false" \
-  --name continuwuity \
-  forgejo.ellis.link/continuwuation/continuwuity:latest \
-  --execute "users create-user admin"
-```
+The `-d` flag lets the container run in detached mode. You may supply an
+optional `continuwuity.toml` config file, the example config can be found
+[here](../reference/config.mdx). You can pass in different env vars to
+change config values on the fly. You can even configure Continuwuity completely by
+using env vars. For an overview of possible values, please take a look at the
+<a href="/examples/docker-compose.yml" target="_blank">`docker-compose.yml`</a> file.

-Replace `matrix.example.com` with your actual server name and `admin` with
-your preferred username.
-
-#### 3. Get your admin password
-
-```bash
-docker logs continuwuity 2>&1 | grep "Created user"
-```
-
-You'll see output like:
-
-```
-Created user with user_id: @admin:matrix.example.com and password: `[auto-generated-password]`
-```
-
-#### 4. Configure your reverse proxy
-
-Configure your reverse proxy to forward HTTPS traffic to Continuwuity. See
-[Docker Compose](#docker-compose) for examples.
-
-Once configured, log in with any Matrix client using `@admin:matrix.example.com`
-and the generated password. You'll automatically be invited to the admin room
-where you can manage your server.
+If you just want to test Continuwuity for a short time, you can use the `--rm`
+flag, which cleans up everything related to your container after you stop
+it.

 ### Docker Compose

-Docker Compose is the recommended deployment method. These examples include
-reverse proxy configurations for Matrix federation.
+If the `docker run` command is not suitable for you or your setup, you can also use one
+of the provided `docker-compose` files.

-#### Matrix Federation Requirements
+Depending on your proxy setup, you can use one of the following files:

-For Matrix federation to work, you need to serve `.well-known/matrix/client` and
-`.well-known/matrix/server` endpoints. You can achieve this either by:
-
-1. **Using a well-known service** - The compose files below include an nginx
-   container to serve these files
-2. **Using Continuwuity's built-in delegation** (easier for Traefik) - Configure
-   delegation files in your config, then proxy `/.well-known/matrix/*` to
-   Continuwuity
-
-**Traefik example using built-in delegation:**
-
-```yaml
-labels:
-  traefik.http.routers.continuwuity.rule: >-
-    (Host(`matrix.example.com`) ||
-     (Host(`example.com`) && PathPrefix(`/.well-known/matrix`)))
-```
-
-This routes your Matrix domain and well-known paths to Continuwuity.
-
-#### Creating Your First Admin User
-
-Add the `--execute` command to create an admin user on first startup. In your
-compose file, add under the `continuwuity` service:
-
-```yaml
-services:
-    continuwuity:
-        image: forgejo.ellis.link/continuwuation/continuwuity:latest
-        command: --execute "users create-user admin"
-        # ... rest of configuration
-```
-
-Then retrieve the auto-generated password:
-
-```bash
-docker compose logs continuwuity | grep "Created user"
-```
-
-#### Choose Your Reverse Proxy
-
-Select the compose file that matches your setup:
-
-:::note DNS Performance
-Docker's default DNS resolver can cause performance issues with Matrix
-federation. If you experience slow federation or DNS timeouts, you may need to
-use your host's DNS resolver instead. Add this volume mount to the
-`continuwuity` service:
-
-```yaml
-volumes:
-  - /etc/resolv.conf:/etc/resolv.conf:ro
-```
-
-See [Troubleshooting - DNS Issues](../troubleshooting.mdx#potential-dns-issues-when-using-docker)
-for more details and alternative solutions.
-:::
-
-##### For existing Traefik setup
+### For existing Traefik setup

 <details>
 <summary>docker-compose.for-traefik.yml</summary>
@@ -181,7 +76,7 @@ ##### For existing Traefik setup

 </details>

-##### With Traefik included
+### With Traefik included

 <details>
 <summary>docker-compose.with-traefik.yml</summary>
@@ -192,7 +87,7 @@ ##### With Traefik included

 </details>

-##### With Caddy Docker Proxy
+### With Caddy Docker Proxy

 <details>
 <summary>docker-compose.with-caddy.yml</summary>
@@ -203,15 +98,9 @@ ##### With Caddy Docker Proxy

 ```

-If you don't already have a network for Caddy to monitor, create one first:
-
-```bash
-docker network create caddy
-```
-
 </details>

-##### For other reverse proxies
+### For other reverse proxies

 <details>
 <summary>docker-compose.yml</summary>
@@ -222,7 +111,7 @@ ##### For other reverse proxies

 </details>

-##### Override file for customisation
+### Override file

 <details>
 <summary>docker-compose.override.yml</summary>
@@ -233,25 +122,99 @@ ##### Override file for customisation

 </details>

-#### Starting Your Server
+When picking the Traefik-related compose file, rename it to
+`docker-compose.yml`, and rename the override file to
+`docker-compose.override.yml`. Edit the latter with the values you want for your
+server.

-1. Choose your compose file and rename it to `docker-compose.yml`
-2. If using the override file, rename it to `docker-compose.override.yml` and
-   edit your values
-3. Start the server:
+When picking the `caddy-docker-proxy` compose file, it's important to first
+create the `caddy` network before spinning up the containers:
+
+```bash
+docker network create caddy
+```
+
+After that, you can rename it to `docker-compose.yml` and spin up the
+containers!
+
+Additional info about deploying Continuwuity can be found [here](generic.mdx).
+
+### Build
+
+Official Continuwuity images are built using **Docker Buildx** and the Dockerfile found at [`docker/Dockerfile`][dockerfile-path]. This approach uses common Docker tooling and enables efficient multi-platform builds.
+
+The resulting images are widely compatible with Docker and other container runtimes like Podman or containerd.
+
+The images *do not contain a shell*. They contain only the Continuwuity binary, required libraries, TLS certificates, and metadata.
+
+<details>
+<summary>Click to view the Dockerfile</summary>
+
+You can also <a href="https://forgejo.ellis.link/continuwuation/continuwuation/src/branch/main/docker/Dockerfile" target="_blank">view the Dockerfile on Forgejo</a>.
+
+```dockerfile file="../../docker/Dockerfile"
+
+```
+
+</details>
+
+To build an image locally using Docker Buildx, you can typically run a command like:
+
+```bash
+# Build for the current platform and load into the local Docker daemon
+docker buildx build --load --tag continuwuity:latest -f docker/Dockerfile .
+
+# Example: Build for specific platforms and push to a registry.
+# docker buildx build --platform linux/amd64,linux/arm64 --tag registry.io/org/continuwuity:latest -f docker/Dockerfile . --push
+
+# Example: Build binary optimised for the current CPU (standard release profile)
+# docker buildx build --load \
+#   --tag continuwuity:latest \
+#   --build-arg TARGET_CPU=native \
+#   -f docker/Dockerfile .
+
+# Example: Build maxperf variant (release-max-perf profile with LTO)
+# Optimised for runtime performance and smaller binary size, but requires longer build time
+# docker buildx build --load \
+#   --tag continuwuity:latest-maxperf \
+#   --build-arg TARGET_CPU=native \
+#   --build-arg RUST_PROFILE=release-max-perf \
+#   -f docker/Dockerfile .
+```
+
+Refer to the Docker Buildx documentation for more advanced build options.
+
+[dockerfile-path]: https://forgejo.ellis.link/continuwuation/continuwuation/src/branch/main/docker/Dockerfile
+
+### Run
+
+If you have already built the image or want to use one from the registries, you
+can start the container and everything else in the compose file in detached
+mode with:

 ```bash
 docker compose up -d
 ```

-See the [generic deployment guide](generic.mdx) for more deployment options.
+> **Note:** Don't forget to modify and adjust the compose file to your needs.

-### Building Custom Images
+### Use Traefik as Proxy

-For information on building your own Continuwuity Docker images, see the
-[Building Docker Images](../development/index.mdx#building-docker-images)
-section in the development documentation.
+As a container user, you probably know about Traefik. It is an easy-to-use
+reverse proxy for making containerized apps and services available through the
+web. With the Traefik-related docker-compose files provided above, it is equally easy
+to deploy and use Continuwuity, with a small caveat. If you have already looked at
+the files, you should have seen the `well-known` service, which is the
+small caveat. Traefik is simply a proxy and load balancer and cannot
+serve any kind of content. For Continuwuity to federate, we need to either
+expose ports `443` and `8448` or serve two endpoints: `.well-known/matrix/client`
+and `.well-known/matrix/server`.
+
+With the service `well-known`, we use a single `nginx` container that serves
+those two files.
+
+Alternatively, you can use Continuwuity's built-in delegation file capability. Set up the delegation files in the configuration file, and then proxy paths under `/.well-known/matrix` to continuwuity. For example, the label ``traefik.http.routers.continuwuity.rule=(Host(`matrix.ellis.link`) || (Host(`ellis.link`) && PathPrefix(`/.well-known/matrix`)))`` does this for the domain `ellis.link`.

 ## Voice communication

-See the [Calls](../calls.mdx) page.
+See the [TURN](../turn.md) page.
--- a/docs/deploying/freebsd.mdx
+++ b/docs/deploying/freebsd.mdx
@@ -3,5 +3,3 @@ # Continuwuity for FreeBSD
 Continuwuity currently does not provide FreeBSD builds or FreeBSD packaging. However, Continuwuity does build and work on FreeBSD using the system-provided RocksDB.

 Contributions to get Continuwuity packaged for FreeBSD are welcome.
-
-Please join our [Continuwuity BSD](https://matrix.to/#/%23bsd:continuwuity.org) community room.
--- a/docs/deploying/generic.mdx
+++ b/docs/deploying/generic.mdx
@@ -56,8 +56,6 @@ ### Building with the Rust toolchain

 You can build Continuwuity using `cargo build --release`.

-Continuwuity supports various optional features that can be enabled during compilation. Please see the Cargo.toml file for a comprehensive list, or ask in our rooms.
-
 ### Building with Nix

 If you prefer, you can use Nix (or [Lix](https://lix.systems)) to build Continuwuity. This provides improved reproducibility and makes it easy to set up a build environment and generate output. This approach also allows for easy cross-compilation.
@@ -271,7 +269,7 @@ # If federation is enabled
 ```

 - To check if your server can communicate with other homeservers, use the
-[Matrix Federation Tester](https://federationtester.mtrnord.blog/). If you can
+[Matrix Federation Tester](https://federationtester.matrix.org/). If you can
 register but cannot join federated rooms, check your configuration and verify
 that port 8448 is open and forwarded correctly.

@@ -279,7 +277,7 @@ # What's next?

 ## Audio/Video calls

-For Audio/Video call functionality see the [Calls](../calls.md) page.
+For Audio/Video call functionality see the [TURN Guide](../turn.md).

 ## Appservices

--- a/docs/deploying/kubernetes.mdx
+++ b/docs/deploying/kubernetes.mdx
@@ -1,109 +1,7 @@
 # Continuwuity for Kubernetes

 Continuwuity doesn't support horizontal scalability or distributed loading
-natively. However, a deployment in Kubernetes is very similar to the docker
-setup. This is because Continuwuity can be fully configured using environment
-variables. A sample StatefulSet is shared below. The only thing missing is
-a PVC definition (named `continuwuity-data`) for the volume mounted to
-the StatefulSet, an Ingress resources to point your webserver to the
-Continuwuity Pods, and a Service resource (targeting `app.kubernetes.io/name: continuwuity`)
-to glue the Ingress and Pod together.
-
-Carefully go through the `env` section and add, change, and remove any env vars you like using the [Configuration reference](https://continuwuity.org/reference/config.html)
-
-```yaml
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: continuwuity
-  namespace: matrix
-  labels:
-    app.kubernetes.io/name: continuwuity
-spec:
-  replicas: 1
-  serviceName: continuwuity
-  podManagementPolicy: Parallel
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: continuwuity
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: continuwuity
-    spec:
-      securityContext:
-        sysctls:
-          - name: net.ipv4.ip_unprivileged_port_start
-            value: "0"
-      containers:
-        - name: continuwuity
-          # use a sha hash <3
-          image: forgejo.ellis.link/continuwuation/continuwuity:latest
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-          volumeMounts:
-            - mountPath: /data
-              name: data
-              subPath: data
-          securityContext:
-            capabilities:
-              add:
-                - NET_BIND_SERVICE
-          env:
-            - name: TOKIO_WORKER_THREADS
-              value: "2"
-            - name: CONTINUWUITY_SERVER_NAME
-              value: "example.com"
-            - name: CONTINUWUITY_DATABASE_PATH
-              value: "/data/db"
-            - name: CONTINUWUITY_DATABASE_BACKEND
-              value: "rocksdb"
-            - name: CONTINUWUITY_PORT
-              value: "80"
-            - name: CONTINUWUITY_MAX_REQUEST_SIZE
-              value: "20000000"
-            - name: CONTINUWUITY_ALLOW_FEDERATION
-              value: "true"
-            - name: CONTINUWUITY_TRUSTED_SERVERS
-              value: '["matrix.org"]'
-            - name: CONTINUWUITY_ADDRESS
-              value: "0.0.0.0"
-            - name: CONTINUWUITY_ROCKSDB_PARALLELISM_THREADS
-              value: "1"
-            - name: CONTINUWUITY_WELL_KNOWN__SERVER
-              value: "matrix.example.com:443"
-            - name: CONTINUWUITY_WELL_KNOWN__CLIENT
-              value: "https://matrix.example.com"
-            - name: CONTINUWUITY_ALLOW_REGISTRATION
-              value: "false"
-            - name: RUST_LOG
-              value: info
-          readinessProbe:
-            httpGet:
-              path: /_matrix/federation/v1/version
-              port: http
-            periodSeconds: 4
-            failureThreshold: 5
-          resources:
-            # Continuwuity might use quite some RAM :3
-            requests:
-              cpu: "2"
-              memory: "512Mi"
-            limits:
-              cpu: "4"
-              memory: "2048Mi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: continuwuity-data
-```
-
---
-
-Apart from manually configuring the containers,
-[a community-maintained Helm Chart is available here to run
+natively. However, [a community-maintained Helm Chart is available here to run
 conduwuit on Kubernetes](https://gitlab.cronce.io/charts/conduwuit)

 This should be compatible with Continuwuity, but you will need to change the image reference.
--- a/docs/development/index.mdx
+++ b/docs/development/index.mdx
@@ -2,8 +2,7 @@ # Development

 Information about developing the project. If you are only interested in using
 it, you can safely ignore this page. If you plan on contributing, see the
-[contributor's guide](./contributing.mdx) and
-[code style guide](./code_style.mdx).
+[contributor's guide](./contributing.mdx) and [code style guide](./code_style.mdx).

 ## Continuwuity project layout

@@ -13,98 +12,86 @@ ## Continuwuity project layout
 `Cargo.toml`.

 The crate names are generally self-explanatory:
-
 - `admin` is the admin room
 - `api` is the HTTP API, Matrix C-S and S-S endpoints, etc
- `core` is core Continuwuity functionality like config loading, error
-  definitions, global utilities, logging infrastructure, etc
- `database` is RocksDB methods, helpers, RocksDB config, and general database
-  definitions, utilities, or functions
- `macros` are Continuwuity Rust [macros][macros] like general helper macros,
-  logging and error handling macros, and [syn][syn] and [procedural
-  macros][proc-macro] used for admin room commands and others
+- `core` is core Continuwuity functionality like config loading, error definitions,
+global utilities, logging infrastructure, etc
+- `database` is RocksDB methods, helpers, RocksDB config, and general database definitions,
+utilities, or functions
+- `macros` are Continuwuity Rust [macros][macros] like general helper macros, logging
+and error handling macros, and [syn][syn] and [procedural macros][proc-macro]
+used for admin room commands and others
 - `main` is the "primary" sub-crate. This is where the `main()` function lives,
-  tokio worker and async initialisation, Sentry initialisation, [clap][clap]
-  init, and signal handling. If you are adding new [Rust features][features],
-  they _must_ go here.
- `router` is the webserver and request handling bits, using axum, tower,
-  tower-http, hyper, etc, and the [global server state][state] to access
-  `services`.
+tokio worker and async initialisation, Sentry initialisation, [clap][clap] init,
+and signal handling. If you are adding new [Rust features][features], they *must*
+go here.
+- `router` is the webserver and request handling bits, using axum, tower, tower-http,
+hyper, etc, and the [global server state][state] to access `services`.
 - `service` is the high-level database definitions and functions for data,
-  outbound/sending code, and other business logic such as media fetching.
+outbound/sending code, and other business logic such as media fetching.

-It is highly unlikely you will ever need to add a new workspace member, but if
-you truly find yourself needing to, we recommend reaching out to us in the
-Matrix room for discussions about it beforehand.
+It is highly unlikely you will ever need to add a new workspace member, but
+if you truly find yourself needing to, we recommend reaching out to us in
+the Matrix room for discussions about it beforehand.

 The primary inspiration for this design was apart of hot reloadable development,
-to support "Continuwuity as a library" where specific parts can simply be
-swapped out. There is evidence Conduit wanted to go this route too as `axum` is
-technically an optional feature in Conduit, and can be compiled without the
-binary or axum library for handling inbound web requests; but it was never
-completed or worked.
+to support "Continuwuity as a library" where specific parts can simply be swapped out.
+There is evidence Conduit wanted to go this route too as `axum` is technically an
+optional feature in Conduit, and can be compiled without the binary or axum library
+for handling inbound web requests; but it was never completed or worked.

-See the Rust documentation on [Workspaces][workspaces] for general questions and
-information on Cargo workspaces.
+See the Rust documentation on [Workspaces][workspaces] for general questions
+and information on Cargo workspaces.

 ## Adding compile-time [features][features]

-If you'd like to add a compile-time feature, you must first define it in the
-`main` workspace crate located in `src/main/Cargo.toml`. The feature must enable
-a feature in the other workspace crate(s) you intend to use it in. Then the said
-workspace crate(s) must define the feature there in its `Cargo.toml`.
+If you'd like to add a compile-time feature, you must first define it in
+the `main` workspace crate located in `src/main/Cargo.toml`. The feature must
+enable a feature in the other workspace crate(s) you intend to use it in. Then
+the said workspace crate(s) must define the feature there in its `Cargo.toml`.

-So, if this is adding a feature to the API such as `woof`, you define the
-feature in the `api` crate's `Cargo.toml` as `woof = []`. The feature definition
-in `main`'s `Cargo.toml` will be `woof = ["conduwuit-api/woof"]`.
+So, if this is adding a feature to the API such as `woof`, you define the feature
+in the `api` crate's `Cargo.toml` as `woof = []`. The feature definition in `main`'s
+`Cargo.toml` will be `woof = ["conduwuit-api/woof"]`.

-The rationale for this is due to Rust / Cargo not supporting ["workspace level
-features"][9], we must make a choice of; either scattering features all over the
-workspace crates, making it difficult for anyone to add or remove default
-features; or define all the features in one central workspace crate that
-propagate down/up to the other workspace crates. It is a Cargo pitfall, and we'd
-like to see better developer UX in Rust's Workspaces.
+The rationale for this is due to Rust / Cargo not supporting
+["workspace level features"][9], we must make a choice of; either scattering
+features all over the workspace crates, making it difficult for anyone to add
+or remove default features; or define all the features in one central workspace
+crate that propagate down/up to the other workspace crates. It is a Cargo pitfall,
+and we'd like to see better developer UX in Rust's Workspaces.

-Additionally, the definition of one single place makes "feature collection" in
-our Nix flake a million times easier instead of collecting and deduping them all
-from searching in all the workspace crates' `Cargo.toml`s. Though we wouldn't
-need to do this if Rust supported workspace-level features to begin with.
+Additionally, the definition of one single place makes "feature collection" in our
+Nix flake a million times easier instead of collecting and deduping them all from
+searching in all the workspace crates' `Cargo.toml`s. Though we wouldn't need to
+do this if Rust supported workspace-level features to begin with.

 ## List of forked dependencies

-During Continuwuity (and prior projects) development, we have had to fork some
-dependencies to support our use-cases. These forks exist for various reasons
-including features that upstream projects won't accept, faster-paced
-development, Continuwuity-specific usecases, or lack of time to upstream
-changes.
+During Continuwuity (and prior projects) development, we have had to fork some dependencies to support our use-cases.
+These forks exist for various reasons including features that upstream projects won't accept,
+faster-paced development, Continuwuity-specific usecases, or lack of time to upstream changes.

-All forked dependencies are maintained under the
-[continuwuation organization on Forgejo](https://forgejo.ellis.link/continuwuation):
+All forked dependencies are maintained under the [continuwuation organization on Forgejo](https://forgejo.ellis.link/continuwuation):

- [ruwuma][continuwuation-ruwuma] - Fork of [ruma/ruma][ruma] with various
-  performance improvements, more features and better client/server interop
- [rocksdb][continuwuation-rocksdb] - Fork of [facebook/rocksdb][rocksdb] via
-  [`@zaidoon1`][8] with liburing build fixes and GCC debug build fixes
- [jemallocator][continuwuation-jemallocator] - Fork of
-  [tikv/jemallocator][jemallocator] fixing musl builds, suspicious code, and
-  adding support for redzones in Valgrind
- [rustyline-async][continuwuation-rustyline-async] - Fork of
-  [zyansheep/rustyline-async][rustyline-async] with tab completion callback and
-  `CTRL+\` signal quit event for Continuwuity console CLI
- [rust-rocksdb][continuwuation-rust-rocksdb] - Fork of
-  [rust-rocksdb/rust-rocksdb][rust-rocksdb] fixing musl build issues, removing
-  unnecessary `gtest` include, and using our RocksDB and jemallocator forks
- [tracing][continuwuation-tracing] - Fork of [tokio-rs/tracing][tracing]
-  implementing `Clone` for `EnvFilter` to support dynamically changing tracing
-  environments
+- [ruwuma][continuwuation-ruwuma] - Fork of [ruma/ruma][ruma] with various performance improvements, more features and better client/server interop
+- [rocksdb][continuwuation-rocksdb] - Fork of [facebook/rocksdb][rocksdb] via [`@zaidoon1`][8] with liburing build fixes and GCC debug build fixes
+- [jemallocator][continuwuation-jemallocator] - Fork of [tikv/jemallocator][jemallocator] fixing musl builds, suspicious code,
+  and adding support for redzones in Valgrind
+- [rustyline-async][continuwuation-rustyline-async] - Fork of [zyansheep/rustyline-async][rustyline-async] with tab completion callback
+  and `CTRL+\` signal quit event for Continuwuity console CLI
+- [rust-rocksdb][continuwuation-rust-rocksdb] - Fork of [rust-rocksdb/rust-rocksdb][rust-rocksdb] fixing musl build issues,
+  removing unnecessary `gtest` include, and using our RocksDB and jemallocator forks
+- [tracing][continuwuation-tracing] - Fork of [tokio-rs/tracing][tracing] implementing `Clone` for `EnvFilter` to
+  support dynamically changing tracing environments

 ## Debugging with `tokio-console`

 [`tokio-console`][7] can be a useful tool for debugging and profiling. To make a
-`tokio-console`-enabled build of Continuwuity, enable the `tokio_console`
-feature, disable the default `release_max_log_level` feature, and set the
-`--cfg tokio_unstable` flag to enable experimental tokio APIs. A build might
-look like this:
+`tokio-console`-enabled build of Continuwuity, enable the `tokio_console` feature,
+disable the default `release_max_log_level` feature, and set the `--cfg
+tokio_unstable` flag to enable experimental tokio APIs. A build might look like
+this:

 ```bash
 RUSTFLAGS="--cfg tokio_unstable" cargo +nightly build \
@@ -113,84 +100,34 @@ ## Debugging with `tokio-console`
    --features=systemd,element_hacks,gzip_compression,brotli_compression,zstd_compression,tokio_console
 ```

-You will also need to enable the `tokio_console` config option in Continuwuity
-when starting it. This was due to tokio-console causing gradual memory
-leak/usage if left enabled.
+You will also need to enable the `tokio_console` config option in Continuwuity when
+starting it. This was due to tokio-console causing gradual memory leak/usage
+if left enabled.

 ## Building Docker Images

-Official Continuwuity images are built using **Docker Buildx** and the
-Dockerfile found at [`docker/Dockerfile`][dockerfile-path].
-
-The images are compatible with Docker and other container runtimes like Podman
-or containerd.
-
-The images _do not contain a shell_. They contain only the Continuwuity binary,
-required libraries, TLS certificates, and metadata.
-
-<details>
-<summary>Click to view the Dockerfile</summary>
-
-You can also
-
-<a
-    href="<https://forgejo.ellis.link/continuwuation/continuwuation/src/branch/main/docker/Dockerfile>"
-    target="_blank"
->
-    view the Dockerfile on Forgejo
-</a>
-.
-
-```dockerfile file="../../docker/Dockerfile"
-
-```
-
-</details>
-
-### Building Locally
-
-To build an image locally using Docker Buildx:
+To build a Docker image for Continuwuity, use the standard Docker build command:

 ```bash
-# Build for the current platform and load into the local Docker daemon
-docker buildx build --load --tag continuwuity:latest -f docker/Dockerfile .
-
-# Example: Build for specific platforms and push to a registry
-# docker buildx build --platform linux/amd64,linux/arm64 --tag registry.io/org/continuwuity:latest -f docker/Dockerfile . --push
-
-# Example: Build binary optimised for the current CPU (standard release profile)
-# docker buildx build --load \
-#   --tag continuwuity:latest \
-#   --build-arg TARGET_CPU=native \
-#   -f docker/Dockerfile .
-
-# Example: Build maxperf variant (release-max-perf profile with LTO)
-# docker buildx build --load \
-#   --tag continuwuity:latest-maxperf \
-#   --build-arg TARGET_CPU=native \
-#   --build-arg RUST_PROFILE=release-max-perf \
-#   -f docker/Dockerfile .
+docker build -f docker/Dockerfile .
 ```

-Refer to the Docker Buildx documentation for more advanced build options.
+The image can be cross-compiled for different architectures.

-[dockerfile-path]:
-    https://forgejo.ellis.link/continuwuation/continuwuation/src/branch/main/docker/Dockerfile
 [continuwuation-ruwuma]: https://forgejo.ellis.link/continuwuation/ruwuma
 [continuwuation-rocksdb]: https://forgejo.ellis.link/continuwuation/rocksdb
-[continuwuation-jemallocator]:
-    https://forgejo.ellis.link/continuwuation/jemallocator
-[continuwuation-rustyline-async]:
-    https://forgejo.ellis.link/continuwuation/rustyline-async
-[continuwuation-rust-rocksdb]:
-    https://forgejo.ellis.link/continuwuation/rust-rocksdb
+[continuwuation-jemallocator]: https://forgejo.ellis.link/continuwuation/jemallocator
+[continuwuation-rustyline-async]: https://forgejo.ellis.link/continuwuation/rustyline-async
+[continuwuation-rust-rocksdb]: https://forgejo.ellis.link/continuwuation/rust-rocksdb
 [continuwuation-tracing]: https://forgejo.ellis.link/continuwuation/tracing
+
 [ruma]: https://github.com/ruma/ruma/
 [rocksdb]: https://github.com/facebook/rocksdb/
 [jemallocator]: https://github.com/tikv/jemallocator/
 [rustyline-async]: https://github.com/zyansheep/rustyline-async/
 [rust-rocksdb]: https://github.com/rust-rocksdb/rust-rocksdb/
 [tracing]: https://github.com/tokio-rs/tracing/
+
 [7]: https://docs.rs/tokio-console/latest/tokio_console/
 [8]: https://github.com/zaidoon1/
 [9]: https://github.com/rust-lang/cargo/issues/12162
--- a/docs/introduction.mdx
+++ b/docs/introduction.mdx
@@ -51,13 +51,7 @@ ## Can I try it out?

 Check out the [documentation](https://continuwuity.org) for installation instructions.

-If you want to try it out as a user, we have some partnered homeservers you can use:
-* You can head over to [https://federated.nexus](https://federated.nexus/) in your browser.
-  * Hit the `Apply to Join` button. Once your request has been accepted, you will receive an email with your username and password.
-  * Head over to [https://app.federated.nexus](https://app.federated.nexus/) and you can sign in there, or use any other matrix chat client you wish elsewhere.
-  * Your username for matrix will be in the form of `@username:federated.nexus`, however you can simply use the `username` part to log in. Your password is your password.
-
-* There's also [https://continuwuity.rocks/](https://continuwuity.rocks/). You can register a new account using Cinny via [this convenient link](https://app.cinny.in/register/continuwuity.rocks), or you can use Element or another matrix client *that supports registration*.
+There are currently no open registration continuwuity instances available.

 ## What are we working on?

--- a/docs/reference/_meta.json
+++ b/docs/reference/_meta.json
@@ -4,11 +4,6 @@
        "name": "config",
        "label": "Configuration"
    },
-    {
-        "type": "file",
-        "name": "environment-variables",
-        "label": "Environment Variables"
-    },
    {
        "type": "file",
        "name": "admin",
--- a/docs/reference/admin/media.md
+++ b/docs/reference/admin/media.md
@@ -36,7 +36,3 @@ ## `!admin media delete-all-from-user`
 ## `!admin media delete-all-from-server`

 Deletes all remote media from the specified remote server. This will always ignore errors by default
-
-## `!admin media delete-url-preview`
-
-Deletes a cached URL preview, forcing it to be re-fetched. Use --all to purge all cached URL previews
--- a/docs/reference/environment-variables.mdx
+++ b/docs/reference/environment-variables.mdx
@@ -1,281 +0,0 @@
-# Environment Variables
-
-Continuwuity can be configured entirely through environment variables, making it
-ideal for containerised deployments and infrastructure-as-code scenarios.
-
-This is a convenience reference and may not be exhaustive. The
-[Configuration Reference](./config.mdx) is the primary source for all
-configuration options.
-
-## Prefix System
-
-Continuwuity supports three environment variable prefixes for backwards
-compatibility:
-
- `CONTINUWUITY_*` (current, recommended)
- `CONDUWUIT_*` (compatibility)
- `CONDUIT_*` (legacy)
-
-All three prefixes work identically. Use double underscores (`__`) to represent
-nested configuration sections from the TOML config.
-
-**Examples:**
-
-```bash
-# Simple top-level config
-CONTINUWUITY_SERVER_NAME="matrix.example.com"
-CONTINUWUITY_PORT="8008"
-
-# Nested config sections use double underscores
-# This maps to [database] section in TOML
-CONTINUWUITY_DATABASE__PATH="/var/lib/continuwuity"
-
-# This maps to [tls] section in TOML
-CONTINUWUITY_TLS__CERTS="/path/to/cert.pem"
-```
-
-## Configuration File Override
-
-You can specify a custom configuration file path:
-
- `CONTINUWUITY_CONFIG` - Path to continuwuity.toml (current)
- `CONDUWUIT_CONFIG` - Path to config file (compatibility)
- `CONDUIT_CONFIG` - Path to config file (legacy)
-
-## Essential Variables
-
-These are the minimum variables needed for a working deployment:
-
-| Variable                     | Description                        | Default                |
-| ---------------------------- | ---------------------------------- | ---------------------- |
-| `CONTINUWUITY_SERVER_NAME`   | Your Matrix server's domain name   | Required               |
-| `CONTINUWUITY_DATABASE_PATH` | Path to RocksDB database directory | `/var/lib/conduwuit`   |
-| `CONTINUWUITY_ADDRESS`       | IP address to bind to              | `["127.0.0.1", "::1"]` |
-| `CONTINUWUITY_PORT`          | Port to listen on                  | `8008`                 |
-
-## Network Configuration
-
-| Variable                         | Description                                     | Default                |
-| -------------------------------- | ----------------------------------------------- | ---------------------- |
-| `CONTINUWUITY_ADDRESS`           | Bind address (use `0.0.0.0` for all interfaces) | `["127.0.0.1", "::1"]` |
-| `CONTINUWUITY_PORT`              | HTTP port                                       | `8008`                 |
-| `CONTINUWUITY_UNIX_SOCKET_PATH`  | UNIX socket path (alternative to TCP)           | -                      |
-| `CONTINUWUITY_UNIX_SOCKET_PERMS` | Socket permissions (octal)                      | `660`                  |
-
-## Database Configuration
-
-| Variable                                   | Description                 | Default              |
-| ------------------------------------------ | --------------------------- | -------------------- |
-| `CONTINUWUITY_DATABASE_PATH`               | RocksDB data directory      | `/var/lib/conduwuit` |
-| `CONTINUWUITY_DATABASE_BACKUP_PATH`        | Backup directory            | -                    |
-| `CONTINUWUITY_DATABASE_BACKUPS_TO_KEEP`    | Number of backups to retain | `1`                  |
-| `CONTINUWUITY_DB_CACHE_CAPACITY_MB`        | Database read cache (MB)    | -                    |
-| `CONTINUWUITY_DB_WRITE_BUFFER_CAPACITY_MB` | Write cache (MB)            | -                    |
-
-## Cache Configuration
-
-| Variable                                 | Description              |
-| ---------------------------------------- | ------------------------ |
-| `CONTINUWUITY_CACHE_CAPACITY_MODIFIER`   | LRU cache multiplier     |
-| `CONTINUWUITY_PDU_CACHE_CAPACITY`        | PDU cache entries        |
-| `CONTINUWUITY_AUTH_CHAIN_CACHE_CAPACITY` | Auth chain cache entries |
-
-## DNS Configuration
-
-Configure DNS resolution behaviour for federation and external requests.
-
-| Variable                             | Description                  | Default  |
-| ------------------------------------ | ---------------------------- | -------- |
-| `CONTINUWUITY_DNS_CACHE_ENTRIES`     | Max DNS cache entries        | `32768`  |
-| `CONTINUWUITY_DNS_MIN_TTL`           | Minimum cache TTL (seconds)  | `10800`  |
-| `CONTINUWUITY_DNS_MIN_TTL_NXDOMAIN`  | NXDOMAIN cache TTL (seconds) | `259200` |
-| `CONTINUWUITY_DNS_ATTEMPTS`          | Retry attempts               | -        |
-| `CONTINUWUITY_DNS_TIMEOUT`           | Query timeout (seconds)      | -        |
-| `CONTINUWUITY_DNS_TCP_FALLBACK`      | Allow TCP fallback           | -        |
-| `CONTINUWUITY_QUERY_ALL_NAMESERVERS` | Query all nameservers        | -        |
-| `CONTINUWUITY_QUERY_OVER_TCP_ONLY`   | TCP-only queries             | -        |
-
-## Request Configuration
-
-| Variable                             | Description                   |
-| ------------------------------------ | ----------------------------- |
-| `CONTINUWUITY_MAX_REQUEST_SIZE`      | Max HTTP request size (bytes) |
-| `CONTINUWUITY_REQUEST_CONN_TIMEOUT`  | Connection timeout (seconds)  |
-| `CONTINUWUITY_REQUEST_TIMEOUT`       | Overall request timeout       |
-| `CONTINUWUITY_REQUEST_TOTAL_TIMEOUT` | Total timeout                 |
-| `CONTINUWUITY_REQUEST_IDLE_TIMEOUT`  | Idle timeout                  |
-| `CONTINUWUITY_REQUEST_IDLE_PER_HOST` | Idle connections per host     |
-
-## Federation Configuration
-
-Control how your server federates with other Matrix servers.
-
-| Variable                                       | Description                   | Default |
-| ---------------------------------------------- | ----------------------------- | ------- |
-| `CONTINUWUITY_ALLOW_FEDERATION`                | Enable federation             | `true`  |
-| `CONTINUWUITY_FEDERATION_LOOPBACK`             | Allow loopback federation     | -       |
-| `CONTINUWUITY_FEDERATION_CONN_TIMEOUT`         | Connection timeout            | -       |
-| `CONTINUWUITY_FEDERATION_TIMEOUT`              | Request timeout               | -       |
-| `CONTINUWUITY_FEDERATION_IDLE_TIMEOUT`         | Idle timeout                  | -       |
-| `CONTINUWUITY_FEDERATION_IDLE_PER_HOST`        | Idle connections per host     | -       |
-| `CONTINUWUITY_TRUSTED_SERVERS`                 | JSON array of trusted servers | -       |
-| `CONTINUWUITY_QUERY_TRUSTED_KEY_SERVERS_FIRST` | Query trusted first           | -       |
-| `CONTINUWUITY_ONLY_QUERY_TRUSTED_KEY_SERVERS`  | Only query trusted            | -       |
-
-**Example:**
-
-```bash
-# Trust matrix.org for key verification
-CONTINUWUITY_TRUSTED_SERVERS='["matrix.org"]'
-```
-
-## Registration & User Configuration
-
-Control user registration and account creation behaviour.
-
-| Variable                                   | Description           | Default |
-| ------------------------------------------ | --------------------- | ------- |
-| `CONTINUWUITY_ALLOW_REGISTRATION`          | Enable registration   | `true`  |
-| `CONTINUWUITY_REGISTRATION_TOKEN`          | Token requirement     | -       |
-| `CONTINUWUITY_SUSPEND_ON_REGISTER`         | Suspend new accounts  | -       |
-| `CONTINUWUITY_NEW_USER_DISPLAYNAME_SUFFIX` | Display name suffix   | 🏳️‍⚧️      |
-| `CONTINUWUITY_RECAPTCHA_SITE_KEY`          | reCAPTCHA site key    | -       |
-| `CONTINUWUITY_RECAPTCHA_PRIVATE_SITE_KEY`  | reCAPTCHA private key | -       |
-
-**Example:**
-
-```bash
-# Disable open registration
-CONTINUWUITY_ALLOW_REGISTRATION="false"
-
-# Require a registration token
-CONTINUWUITY_REGISTRATION_TOKEN="your_secret_token_here"
-```
-
-## Feature Configuration
-
-| Variable                                                   | Description                | Default |
-| ---------------------------------------------------------- | -------------------------- | ------- |
-| `CONTINUWUITY_ALLOW_ENCRYPTION`                            | Enable E2EE                | `true`  |
-| `CONTINUWUITY_ALLOW_ROOM_CREATION`                         | Enable room creation       | -       |
-| `CONTINUWUITY_ALLOW_UNSTABLE_ROOM_VERSIONS`                | Allow unstable versions    | -       |
-| `CONTINUWUITY_DEFAULT_ROOM_VERSION`                        | Default room version       | `v11`   |
-| `CONTINUWUITY_REQUIRE_AUTH_FOR_PROFILE_REQUESTS`           | Auth for profiles          | -       |
-| `CONTINUWUITY_ALLOW_PUBLIC_ROOM_DIRECTORY_OVER_FEDERATION` | Federate directory         | -       |
-| `CONTINUWUITY_ALLOW_PUBLIC_ROOM_DIRECTORY_WITHOUT_AUTH`    | Unauth directory           | -       |
-| `CONTINUWUITY_ALLOW_DEVICE_NAME_FEDERATION`                | Device names in federation | -       |
-
-## TLS Configuration
-
-Built-in TLS support is primarily for testing. **For production deployments,
-especially when federating on the internet, use a reverse proxy** (Traefik,
-Caddy, nginx) to handle TLS termination.
-
-| Variable                          | Description               |
-| --------------------------------- | ------------------------- |
-| `CONTINUWUITY_TLS__CERTS`         | TLS certificate file path |
-| `CONTINUWUITY_TLS__KEY`           | TLS private key path      |
-| `CONTINUWUITY_TLS__DUAL_PROTOCOL` | Support TLS 1.2 + 1.3     |
-
-**Example (testing only):**
-
-```bash
-CONTINUWUITY_TLS__CERTS="/etc/letsencrypt/live/matrix.example.com/fullchain.pem"
-CONTINUWUITY_TLS__KEY="/etc/letsencrypt/live/matrix.example.com/privkey.pem"
-```
-
-## Logging Configuration
-
-Control log output format and verbosity.
-
-| Variable                       | Description        | Default |
-| ------------------------------ | ------------------ | ------- |
-| `CONTINUWUITY_LOG`             | Log filter level   | -       |
-| `CONTINUWUITY_LOG_COLORS`      | ANSI colours       | `true`  |
-| `CONTINUWUITY_LOG_SPAN_EVENTS` | Log span events    | `none`  |
-| `CONTINUWUITY_LOG_THREAD_IDS`  | Include thread IDs | -       |
-
-**Examples:**
-
-```bash
-# Set log level to info
-CONTINUWUITY_LOG="info"
-
-# Enable debug logging for specific modules
-CONTINUWUITY_LOG="warn,continuwuity::api=debug"
-
-# Disable colours for log aggregation
-CONTINUWUITY_LOG_COLORS="false"
-```
-
-## Observability Configuration
-
-| Variable                                 | Description           |
-| ---------------------------------------- | --------------------- |
-| `CONTINUWUITY_ALLOW_OTLP`                | Enable OpenTelemetry  |
-| `CONTINUWUITY_OTLP_FILTER`               | OTLP filter level     |
-| `CONTINUWUITY_OTLP_PROTOCOL`             | Protocol (http/grpc)  |
-| `CONTINUWUITY_TRACING_FLAME`             | Enable flame graphs   |
-| `CONTINUWUITY_TRACING_FLAME_FILTER`      | Flame graph filter    |
-| `CONTINUWUITY_TRACING_FLAME_OUTPUT_PATH` | Output directory      |
-| `CONTINUWUITY_SENTRY`                    | Enable Sentry         |
-| `CONTINUWUITY_SENTRY_ENDPOINT`           | Sentry DSN            |
-| `CONTINUWUITY_SENTRY_SEND_SERVER_NAME`   | Include server name   |
-| `CONTINUWUITY_SENTRY_TRACES_SAMPLE_RATE` | Sample rate (0.0-1.0) |
-
-## Admin Configuration
-
-Configure admin users and automated command execution.
-
-| Variable                                   | Description                      | Default           |
-| ------------------------------------------ | -------------------------------- | ----------------- |
-| `CONTINUWUITY_ADMINS_LIST`                 | JSON array of admin user IDs     | -                 |
-| `CONTINUWUITY_ADMINS_FROM_ROOM`            | Derive admins from room          | -                 |
-| `CONTINUWUITY_ADMIN_ESCAPE_COMMANDS`       | Allow `\` prefix in public rooms | -                 |
-| `CONTINUWUITY_ADMIN_CONSOLE_AUTOMATIC`     | Auto-activate console            | -                 |
-| `CONTINUWUITY_ADMIN_EXECUTE`               | JSON array of startup commands   | -                 |
-| `CONTINUWUITY_ADMIN_EXECUTE_ERRORS_IGNORE` | Ignore command errors            | -                 |
-| `CONTINUWUITY_ADMIN_SIGNAL_EXECUTE`        | Commands on SIGUSR2              | -                 |
-| `CONTINUWUITY_ADMIN_ROOM_TAG`              | Admin room tag                   | `m.server_notice` |
-
-**Examples:**
-
-```bash
-# Create admin user on startup
-CONTINUWUITY_ADMIN_EXECUTE='["users create-user admin", "users make-user-admin admin"]'
-
-# Specify admin users directly
-CONTINUWUITY_ADMINS_LIST='["@alice:example.com", "@bob:example.com"]'
-```
-
-## Media & URL Preview Configuration
-
-| Variable                                             | Description        |
-| ---------------------------------------------------- | ------------------ |
-| `CONTINUWUITY_URL_PREVIEW_BOUND_INTERFACE`           | Bind interface     |
-| `CONTINUWUITY_URL_PREVIEW_DOMAIN_CONTAINS_ALLOWLIST` | Domain allowlist   |
-| `CONTINUWUITY_URL_PREVIEW_DOMAIN_EXPLICIT_ALLOWLIST` | Explicit allowlist |
-| `CONTINUWUITY_URL_PREVIEW_DOMAIN_EXPLICIT_DENYLIST`  | Explicit denylist  |
-| `CONTINUWUITY_URL_PREVIEW_MAX_SPIDER_SIZE`           | Max fetch size     |
-| `CONTINUWUITY_URL_PREVIEW_TIMEOUT`                   | Fetch timeout      |
-| `CONTINUWUITY_IP_RANGE_DENYLIST`                     | IP range denylist  |
-
-## Tokio Runtime Configuration
-
-These can be set as environment variables or CLI arguments:
-
-| Variable                                  | Description                |
-| ----------------------------------------- | -------------------------- |
-| `TOKIO_WORKER_THREADS`                    | Worker thread count        |
-| `TOKIO_GLOBAL_QUEUE_INTERVAL`             | Global queue interval      |
-| `TOKIO_EVENT_INTERVAL`                    | Event interval             |
-| `TOKIO_MAX_IO_EVENTS_PER_TICK`            | Max I/O events per tick    |
-| `CONTINUWUITY_RUNTIME_HISTOGRAM_INTERVAL` | Histogram bucket size (μs) |
-| `CONTINUWUITY_RUNTIME_HISTOGRAM_BUCKETS`  | Bucket count               |
-| `CONTINUWUITY_RUNTIME_WORKER_AFFINITY`    | Enable worker affinity     |
-
-## See Also
-
- [Configuration Reference](./config.mdx) - Complete TOML configuration
-  documentation
- [Admin Commands](./admin/) - Admin command reference
--- a/docs/troubleshooting.mdx
+++ b/docs/troubleshooting.mdx
@@ -1,28 +1,13 @@
 # Troubleshooting Continuwuity

-:::warning{title="Docker users:"}
-Docker can be difficult to use and debug. It's common for Docker
-misconfigurations to cause issues, particularly with networking and permissions.
-Please check that your issues are not due to problems with your Docker setup.
-:::
+> **Docker users ⚠️**
+>
+> Docker can be difficult to use and debug. It's common for Docker
+> misconfigurations to cause issues, particularly with networking and permissions.
+> Please check that your issues are not due to problems with your Docker setup.

 ## Continuwuity and Matrix issues

-### Slow joins to rooms
-
-Some slowness is to be expected if you're the first person on your homserver to join a room (which will
-always be the case for single-user homeservers). In this situation, your homeserver has to verify the signatures of
-all of the state events sent by other servers before your join. To make this process as fast as possible, make sure you have
-multiple fast, trusted servers listed in `trusted_servers` in your configuration, and ensure
-`query_trusted_key_servers_first_on_join` is set to true (the default).
-If you need suggestions for trusted servers, ask in the Continuwuity main room.
-
-However, _very_ slow joins, especially to rooms with only a few users in them or rooms created by another user
-on your homeserver, may be caused by [issue !779](https://forgejo.ellis.link/continuwuation/continuwuity/issues/779),
-which is a longstanding bug with synchronizing room joins to clients. In this situation, you did succeed in joining the room, but
-the bug caused your homeserver to forget to tell your client. **To fix this, clear your client's cache.** Both Element and Cinny
-have a button to clear their cache in the "About" section of their settings.
-
 ### Lost access to admin room

 You can reinvite yourself to the admin room through the following methods:
--- a/docs/turn.mdx
+++ b/docs/turn.mdx
@@ -0,0 +1,94 @@
+# Setting up TURN/STURN
+
+In order to make or receive calls, a TURN server is required. Continuwuity suggests
+using [Coturn](https://github.com/coturn/coturn) for this purpose, which is also
+available as a Docker image.
+
+### Configuration
+
+Create a configuration file called `coturn.conf` containing:
+
+```
+use-auth-secret
+static-auth-secret=<a secret key>
+realm=<your server domain>
+```
+
+A common way to generate a suitable alphanumeric secret key is by using `pwgen
+-s 64 1`.
+
+These same values need to be set in Continuwuity. See the [example
+config](./reference/config.mdx) in the TURN section for configuring these and
+restart Continuwuity after.
+
+`turn_secret` or a path to `turn_secret_file` must have a value of your
+coturn `static-auth-secret`, or use `turn_username` and `turn_password`
+if using legacy username:password TURN authentication (not preferred).
+
+`turn_uris` must be the list of TURN URIs you would like to send to the client.
+Typically you will just replace the example domain `example.turn.uri` with the
+`realm` you set from the example config.
+
+If you are using TURN over TLS, you can replace `turn:` with `turns:` in the
+`turn_uris` config option to instruct clients to attempt to connect to
+TURN over TLS. This is highly recommended.
+
+If you need unauthenticated access to the TURN URIs, or some clients may be
+having trouble, you can enable `turn_guest_access` in Continuwuity which disables
+authentication for the TURN URI endpoint `/_matrix/client/v3/voip/turnServer`
+
+### Run
+
+Run the [Coturn](https://hub.docker.com/r/coturn/coturn) image using
+
+```bash
+docker run -d --network=host -v
+$(pwd)/coturn.conf:/etc/coturn/turnserver.conf coturn/coturn
+```
+
+or docker-compose. For the latter, paste the following section into a file
+called `docker-compose.yml` and run `docker compose up -d` in the same
+directory.
+
+```yml
+version: 3
+services:
+    turn:
+      container_name: coturn-server
+      image: docker.io/coturn/coturn
+      restart: unless-stopped
+      network_mode: "host"
+      volumes:
+        - ./coturn.conf:/etc/coturn/turnserver.conf
+```
+
+To understand why the host networking mode is used and explore alternative
+configuration options, please visit [Coturn's Docker
+documentation](https://github.com/coturn/coturn/blob/master/docker/coturn/README.md).
+
+For security recommendations see Synapse's [Coturn
+documentation](https://element-hq.github.io/synapse/latest/turn-howto.html).
+
+### Testing
+
+To make sure turn credentials are being correctly served to clients, you can manually make a HTTP request to the turnServer endpoint.
+
+`curl "https://<matrix.example.com>/_matrix/client/r0/voip/turnServer" -H 'Authorization: Bearer <your_client_token>' | jq`
+
+You should get a response like this:
+
+```json
+{
+  "username": "1752792167:@jade:example.com",
+  "password": "KjlDlawdPbU9mvP4bhdV/2c/h65=",
+  "uris": [
+    "turns:coturn.example.com?transport=udp",
+    "turns:coturn.example.com?transport=tcp",
+    "turn:coturn.example.com?transport=udp",
+    "turn:coturn.example.com?transport=tcp"
+  ],
+  "ttl": 86400
+}
+```
+
+You can test these credentials work using [Trickle ICE](https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/)
--- a/nix/packages/uwulib/build.nix
+++ b/nix/packages/uwulib/build.nix
@@ -20,7 +20,7 @@ rec {
      # we need to keep the `web` directory which would be filtered out by the regular source filtering function
      #
      # https://crane.dev/API.html#cranelibcleancargosource
-      isWebTemplate = path: _type: builtins.match ".*(src/(web|service)|docs).*" path != null;
+      isWebTemplate = path: _type: builtins.match ".*src/web.*" path != null;
      isRust = craneLib.filterCargoSources;
      isNix = path: _type: builtins.match ".+/nix.*" path != null;
      webOrRustNotNix = p: t: !(isNix p t) && (isWebTemplate p t || isRust p t);
@@ -77,12 +77,7 @@ rec {
    craneLib.buildDepsOnly (
      (commonAttrs commonAttrsArgs)
      // {
-        env = uwuenv.buildDepsOnlyEnv
-              // (makeRocksDBEnv { inherit rocksdb; })
-              // {
-                # required since we started using unstable reqwest apparently ... otherwise the all-features build will fail
-                RUSTFLAGS = "--cfg reqwest_unstable";
-              };
+        env = uwuenv.buildDepsOnlyEnv // (makeRocksDBEnv { inherit rocksdb; });
        inherit (features) cargoExtraArgs;
      }

@@ -107,13 +102,7 @@ rec {
        '';
        cargoArtifacts = deps;
        doCheck = true;
-        env =
-          uwuenv.buildPackageEnv
-          // rocksdbEnv
-          // {
-            # required since we started using unstable reqwest apparently ... otherwise the all-features build will fail
-            RUSTFLAGS = "--cfg reqwest_unstable";
-          };
+        env = uwuenv.buildPackageEnv // rocksdbEnv;
        passthru.env = uwuenv.buildPackageEnv // rocksdbEnv;
        meta.mainProgram = crateInfo.pname;
        inherit (features) cargoExtraArgs;
--- a/package-lock.json
+++ b/package-lock.json
@@ -119,13 +119,13 @@
      }
    },
    "node_modules/@rsbuild/core": {
-      "version": "2.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.0-beta.3.tgz",
-      "integrity": "sha512-dfH+Pt2GuF3rWOWGsf5XOhn3Zarvr4DoHwoI1arAsCGvpzoeud3DNGmWPy13tngj0r/YvQRcPTRBCRV4RP5CMw==",
+      "version": "2.0.0-beta.1",
+      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.0-beta.1.tgz",
+      "integrity": "sha512-m7L3oi4evTDODcY+Qk3cmY/p7GCaauSRe00D0AkXVohNvxFBt7F49uPwBSThS24I9d31zFuAED2jFqBeBlDqWw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/core": "2.0.0-beta.0",
+        "@rspack/core": "2.0.0-alpha.1",
        "@swc/helpers": "^0.5.18",
        "jiti": "^2.6.1"
      },
@@ -159,28 +159,28 @@
      }
    },
    "node_modules/@rspack/binding": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.0-beta.0.tgz",
-      "integrity": "sha512-L6PPqhwZWC2vzwdhBItNPXw+7V4sq+MBDRXLdd8NMqaJSCB5iKdJIbpbEQucST9Nn7V28IYoQTXs6+ol5vWUBA==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-Glz0SNFYPtNVM+ExJ4ocSzW+oQhb1iHTmxqVEAILbL17Hq3N/nwZpo1cWEs6hJjn8cosJIb1VKbbgb/1goEtCQ==",
      "dev": true,
      "license": "MIT",
      "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "2.0.0-beta.0",
-        "@rspack/binding-darwin-x64": "2.0.0-beta.0",
-        "@rspack/binding-linux-arm64-gnu": "2.0.0-beta.0",
-        "@rspack/binding-linux-arm64-musl": "2.0.0-beta.0",
-        "@rspack/binding-linux-x64-gnu": "2.0.0-beta.0",
-        "@rspack/binding-linux-x64-musl": "2.0.0-beta.0",
-        "@rspack/binding-wasm32-wasi": "2.0.0-beta.0",
-        "@rspack/binding-win32-arm64-msvc": "2.0.0-beta.0",
-        "@rspack/binding-win32-ia32-msvc": "2.0.0-beta.0",
-        "@rspack/binding-win32-x64-msvc": "2.0.0-beta.0"
+        "@rspack/binding-darwin-arm64": "2.0.0-alpha.1",
+        "@rspack/binding-darwin-x64": "2.0.0-alpha.1",
+        "@rspack/binding-linux-arm64-gnu": "2.0.0-alpha.1",
+        "@rspack/binding-linux-arm64-musl": "2.0.0-alpha.1",
+        "@rspack/binding-linux-x64-gnu": "2.0.0-alpha.1",
+        "@rspack/binding-linux-x64-musl": "2.0.0-alpha.1",
+        "@rspack/binding-wasm32-wasi": "2.0.0-alpha.1",
+        "@rspack/binding-win32-arm64-msvc": "2.0.0-alpha.1",
+        "@rspack/binding-win32-ia32-msvc": "2.0.0-alpha.1",
+        "@rspack/binding-win32-x64-msvc": "2.0.0-alpha.1"
      }
    },
    "node_modules/@rspack/binding-darwin-arm64": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.0-beta.0.tgz",
-      "integrity": "sha512-PPx1+SPEROSvDKmBuCbsE7W9tk07ajPosyvyuafv2wbBI6PW2rNcz62uzpIFS+FTgwwZ5u/06WXRtlD2xW9bKg==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-+6E6pYgpKvs41cyOlqRjpCT3djjL9hnntF61JumM/TNo1aTYXMNNG4b8ZsLMpBq5ZwCy9Dg8oEDe8AZ84rfM7A==",
      "cpu": [
        "arm64"
      ],
@@ -192,9 +192,9 @@
      ]
    },
    "node_modules/@rspack/binding-darwin-x64": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.0-beta.0.tgz",
-      "integrity": "sha512-GucsfjrSKBZ9cuOTXmHWxeY2wPmaNyvGNxTyzttjRcfwqOWz8r+ku6PCsMSXUqxZRYWW1L9mvtTdlDrzTYJZ0w==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-Ccf9NNupVe67vlaS9zKQJ+BvsAn385uBC1vXnYaUxxHoY/tEwNJf6t+XyDARt7mCtT7+Bu4L/iJ/JEF/MsO5zg==",
      "cpu": [
        "x64"
      ],
@@ -206,9 +206,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-gnu": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.0-beta.0.tgz",
-      "integrity": "sha512-nTtYtklRZD4sb2RIFCF9YS8tZ/MjpqIBKVS3YIvdXcfHUdVfmQHTZGtwEuZGg6AxTC5L1hcvkYmTXCG0ok7auw==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-B7omNsPSsinOq2VRD4d4VFrLgHceMQobqlLg0txFUZ7PDjE307gpTcGViWQlUhNCbkZXMPzDeXBFa5ZlEmxgnA==",
      "cpu": [
        "arm64"
      ],
@@ -220,9 +220,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-musl": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.0-beta.0.tgz",
-      "integrity": "sha512-S2fshx0Rf7/XYwoMLaqFsVg4y+VAfHzubrczy8AW5xIs6UNC3eRLVTgShLerUPtF6SG+v6NQxQ9JI3vOo2qPOA==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-NCG401ofZcDKlTWD8VHv76Y+02Stmd9Nu5MRbVUBOCTVgXMj8Mgrm5XsGBWUjzd5J/Mvo2hstCKIZxNzmPd8uQ==",
      "cpu": [
        "arm64"
      ],
@@ -234,9 +234,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-gnu": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.0-beta.0.tgz",
-      "integrity": "sha512-yx5Fk1gl7lfkvqcjolNLCNeduIs6C2alMsQ/kZ1pLeP5MPquVOYNqs6EcDPIp+fUjo3lZYtnJBiZKK+QosbzYg==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-Xgp8wJ5gjpPG8I3VMEsVAesfckWryQVUhJkHcxPfNi72QTv8UkMER7Jl+JrlQk7K7nMO5ltokx/VGl1c3tMx+w==",
      "cpu": [
        "x64"
      ],
@@ -248,9 +248,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-musl": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.0-beta.0.tgz",
-      "integrity": "sha512-sBX4b2W0PgehlAVT224k0Q6GaH6t9HP+hBNDrbX/g6d0hfxZN56gm5NfOTOD1Rien4v7OBEejJ3/uFbm1WjwYQ==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-lrYKcOgsPA1UMswxzFAV37ofkznbtTLCcEas6lxtlT3Dr28P6VRzC8TgVbIiprkm10I0BlThQWDJ3aGzzLj9Kg==",
      "cpu": [
        "x64"
      ],
@@ -262,9 +262,9 @@
      ]
    },
    "node_modules/@rspack/binding-wasm32-wasi": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.0-beta.0.tgz",
-      "integrity": "sha512-o6OatnNvb4kCzXbCaomhENGaCsO3naIyAqqErew90HeAwa1lfY3NhRfDLeIyuANQ+xqFl34/R7n8q3ZDx3nd4Q==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-rppGiT7CtXlM8st+IgzBDqb7V//1xx5Oe0SY1sxxw0cfOGMpIQCwhJqx/uI6ioqJLZLGX/obt359+hPXyqGl4w==",
      "cpu": [
        "wasm32"
      ],
@@ -276,9 +276,9 @@
      }
    },
    "node_modules/@rspack/binding-win32-arm64-msvc": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.0-beta.0.tgz",
-      "integrity": "sha512-neCzVllXzIqM8p8qKb89qV7wyk233gC/V9VrHIKbGeQjAEzpBsk5GOWlFbq5DDL6tivQ+uzYaTrZWm9tb2qxXg==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-yD2g1JmnCxrix/344r7lBn+RH+Nv8uWP0UDP8kwv4kQGCWr4U7IP8PKFpoyulVOgOUjvJpgImeyrDJ7R8he+5w==",
      "cpu": [
        "arm64"
      ],
@@ -290,9 +290,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-ia32-msvc": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.0-beta.0.tgz",
-      "integrity": "sha512-/f0n2eO+DxMKQm9IebeMQJITx8M/+RvY/i8d3sAQZBgR53izn8y7EcDlidXpr24/2DvkLbiub8IyCKPlhLB+1A==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-5qpQL5Qz3uYb56pwffEGzznXSX9TNkLpigQbIObfnUwX7WkdjgTT7oTHpjn2sRSLLNiJ/jCp2r4ZHvjmnNRsRA==",
      "cpu": [
        "ia32"
      ],
@@ -304,9 +304,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-x64-msvc": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.0-beta.0.tgz",
-      "integrity": "sha512-dx4zgiAT88EQE7kEUpr7Z9EZAwLnO5FhzWzvd/cDK4bkqYsx+rTklgf/c0EYPBeroXCxlGiMsuC9wHAFNK7sFw==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-dZ76NN9tXLaF2gnB/pU+PcK4Adf9tj8dY06KcWk5F81ur2V4UbrMfkWJkQprur8cgL/F49YtFMRWa4yp/qNbpQ==",
      "cpu": [
        "x64"
      ],
@@ -318,13 +318,13 @@
      ]
    },
    "node_modules/@rspack/core": {
-      "version": "2.0.0-beta.0",
-      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.0-beta.0.tgz",
-      "integrity": "sha512-aEqlQQjiXixT5i9S4DFtiAap8ZjF6pOgfY2ALHOizins/QqWyB8dyLxSoXdzt7JixmKcFmHkbL9XahO28BlVUA==",
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-2KK3hbxrRqzxtzg+ka7LsiEKIWIGIQz317k9HHC2U4IC5yLJ31K8y/vQfA1aIT2QcFls9gW7GyRjp8A4X5cvLA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/binding": "2.0.0-beta.0",
+        "@rspack/binding": "2.0.0-alpha.1",
        "@rspack/lite-tapable": "1.1.0"
      },
      "engines": {
@@ -371,20 +371,20 @@
      }
    },
    "node_modules/@rspress/core": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.3.tgz",
-      "integrity": "sha512-a+JJFiALqMxGJBqR38/lkN6tas42UF4jRIhu6RilC/3DdqpfqR8j6jjQFOmqoNKo6ZGXW2W+i1Pscn6drvoG3w==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.2.tgz",
+      "integrity": "sha512-tU8rUVaPyC8o8k4ezgigRVQuZhBAC41KWdwZZ0BldN6o+QXSEIb722RnxCTpa9FGK2riqcwJgM+OqqcqXsFpmw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@mdx-js/mdx": "^3.1.1",
        "@mdx-js/react": "^3.1.1",
-        "@rsbuild/core": "2.0.0-beta.3",
+        "@rsbuild/core": "2.0.0-beta.1",
        "@rsbuild/plugin-react": "~1.4.5",
-        "@rspress/shared": "2.0.3",
+        "@rspress/shared": "2.0.2",
        "@shikijs/rehype": "^3.21.0",
        "@types/unist": "^3.0.3",
-        "@unhead/react": "^2.1.4",
+        "@unhead/react": "^2.1.2",
        "body-scroll-lock": "4.0.0-beta.0",
        "cac": "^6.7.14",
        "chokidar": "^3.6.0",
@@ -428,39 +428,39 @@
      }
    },
    "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.3.tgz",
-      "integrity": "sha512-9+SoAbfoxM6OCRWx8jWHHi2zwJDcNaej/URx0CWZk8tvQ618yJW5mXJydknlac62399eYh/F7C3w8TZM3ORGVA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.2.tgz",
+      "integrity": "sha512-FOxUBDOGP06+1hL4jgbIxUe0XoEduXIQ0rSjWjzpo2mC+qTdhZUGJ0xYE2laQIfJXYv/up5zk25zjxUBnxsejw==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
      },
      "peerDependencies": {
-        "@rspress/core": "^2.0.3"
+        "@rspress/core": "^2.0.2"
      }
    },
    "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.3.tgz",
-      "integrity": "sha512-SKa7YEAdkUqya2YjMKbakg3kcYMkXgXhTQdDsHd+QlJWN8j8cDPiCcctMZu8iIPeKZlb+hTJkTWvh27LSIKdOA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.2.tgz",
+      "integrity": "sha512-3E0yEif4Pj3RX+QVOsyWXW6IIjuhwh93bhVSmhShmTKi8opH5vnHcRVZZ1z7X/P3MHXFTrC925F8383Sl2qOEg==",
      "dev": true,
      "license": "MIT",
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
      },
      "peerDependencies": {
-        "@rspress/core": "^2.0.3"
+        "@rspress/core": "^2.0.2"
      }
    },
    "node_modules/@rspress/shared": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.3.tgz",
-      "integrity": "sha512-yI9G4P165fSsmm6QoYTUrdgUis1aFnDh04GcM4SQIpL3itvEZhGtItgoeGkX9EWbnEjhriwI8mTqDDJIp+vrGA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.2.tgz",
+      "integrity": "sha512-9+QC8UL1gV2KpRZx4n55vAl6bE38y7eDnGJhdFSHdJkpFbUCiJDk9ZcR6jD/Rrtq7vlT0gfumUk640pxpi3IDQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rsbuild/core": "2.0.0-beta.3",
+        "@rsbuild/core": "2.0.0-beta.1",
        "@shikijs/rehype": "^3.21.0",
        "gray-matter": "4.0.3",
        "lodash-es": "^4.17.23",
@@ -664,13 +664,13 @@
      "license": "ISC"
    },
    "node_modules/@unhead/react": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@unhead/react/-/react-2.1.4.tgz",
-      "integrity": "sha512-3DzMi5nJkUyLVfQF/q78smCvcSy84TTYgTwXVz5s3AjUcLyHro5Z7bLWriwk1dn5+YRfEsec8aPkLCMi5VjMZg==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@unhead/react/-/react-2.1.2.tgz",
+      "integrity": "sha512-VNKa0JJZq5Jp28VuiOMfjAA7CTLHI0SdW/Hs1ZPq2PsNV/cgxGv8quFBGXWx4gfoHB52pejO929RKjIpYX5+iQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "unhead": "2.1.4"
+        "unhead": "2.1.2"
      },
      "funding": {
        "url": "https://github.com/sponsors/harlan-zw"
@@ -3563,9 +3563,9 @@
      }
    },
    "node_modules/unhead": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/unhead/-/unhead-2.1.4.tgz",
-      "integrity": "sha512-+5091sJqtNNmgfQ07zJOgUnMIMKzVKAWjeMlSrTdSGPB6JSozhpjUKuMfWEoLxlMAfhIvgOU8Me0XJvmMA/0fA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/unhead/-/unhead-2.1.2.tgz",
+      "integrity": "sha512-vSihrxyb+zsEUfEbraZBCjdE0p/WSoc2NGDrpwwSNAwuPxhYK1nH3eegf02IENLpn1sUhL8IoO84JWmRQ6tILA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,6 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": ["config:recommended", "replacements:all"],
-    "dependencyDashboard": true,
    "osvVulnerabilityAlerts": true,
    "lockFileMaintenance": {
        "enabled": true,
@@ -58,25 +57,12 @@
            "matchUpdateTypes": ["minor", "patch"],
            "groupName": "github-actions-non-major"
        },
-        {
-            "description": "Batch patch-level Node.js dependency updates",
-            "matchManagers": ["npm"],
-            "matchUpdateTypes": ["patch"],
-            "groupName": "node-patch-updates"
-        },
        {
            "description": "Pin forgejo artifact actions to prevent breaking changes",
            "matchManagers": ["github-actions"],
            "matchPackageNames": ["forgejo/upload-artifact", "forgejo/download-artifact"],
            "enabled": false
        },
-        {
-            "description": "Auto-merge crate-ci/typos minor updates",
-            "matchPackageNames": ["crate-ci/typos"],
-            "matchUpdateTypes": ["minor", "patch"],
-            "automerge": true,
-            "automergeStrategy": "fast-forward"
-        },
        {
            "description": "Auto-merge renovatebot docker image updates",
            "matchDatasources": ["docker"],
--- a/rspress.config.ts
+++ b/rspress.config.ts
@@ -56,9 +56,6 @@ export default defineConfig({
        }, {
            from: '/community$',
            to: '/community/guidelines'
-        }, {
-            from: "^/turn",
-            to: "/calls/turn",
        }
        ]
    })],
--- a/src/admin/federation/commands.rs
+++ b/src/admin/federation/commands.rs
@@ -30,15 +30,12 @@ pub(super) async fn incoming_federation(&self) -> Result {
 			.federation_handletime
 			.read();

-		let mut msg = format!(
-			"Handling {} incoming PDUs across {} active transactions:\n",
-			map.len(),
-			self.services.transactions.txn_active_handle_count()
-		);
+		let mut msg = format!("Handling {} incoming pdus:\n", map.len());
 		for (r, (e, i)) in map.iter() {
 			let elapsed = i.elapsed();
 			writeln!(msg, "{} {}: {}m{}s", r, e, elapsed.as_secs() / 60, elapsed.as_secs() % 60)?;
 		}
+
 		msg
 	};

--- a/src/admin/media/commands.rs
+++ b/src/admin/media/commands.rs
@@ -388,19 +388,3 @@ pub(super) async fn get_remote_thumbnail(
 	self.write_str(&format!("```\n{result:#?}\nreceived {len} bytes for file content.\n```"))
 		.await
 }
-
-#[admin_command]
-pub(super) async fn delete_url_preview(&self, url: Option<String>, all: bool) -> Result {
-	if all {
-		self.services.media.clear_url_previews().await;
-
-		return self.write_str("Deleted all cached URL previews.").await;
-	}
-
-	let url = url.expect("clap enforces url is required unless --all");
-
-	self.services.media.remove_url_preview(&url).await?;
-
-	self.write_str(&format!("Deleted cached URL preview for: {url}"))
-		.await
-}
--- a/src/admin/media/mod.rs
+++ b/src/admin/media/mod.rs
@@ -108,16 +108,4 @@ pub enum MediaCommand {
 		#[arg(long, default_value("800"))]
 		height: u32,
 	},
-
-	/// Deletes a cached URL preview, forcing it to be re-fetched.
-	/// Use --all to purge all cached URL previews.
-	DeleteUrlPreview {
-		/// The URL to clear from the saved preview data
-		#[arg(required_unless_present = "all")]
-		url: Option<String>,
-
-		/// Purge all cached URL previews
-		#[arg(long, conflicts_with = "url")]
-		all: bool,
-	},
 }
--- a/src/admin/query/raw.rs
+++ b/src/admin/query/raw.rs
@@ -209,7 +209,7 @@ pub(super) async fn compact(
 	let parallelism = parallelism.unwrap_or(1);
 	let results = maps
 		.into_iter()
-		.try_stream::<conduwuit::Error>()
+		.try_stream()
 		.paralleln_and_then(runtime, parallelism, move |map| {
 			map.compact_blocking(options.clone())?;
 			Ok(map.name().to_owned())
--- a/src/admin/query/resolver.rs
+++ b/src/admin/query/resolver.rs
@@ -20,17 +20,7 @@ pub enum ResolverCommand {
 		name: Option<String>,
 	},

-	/// Flush a given server from the resolver caches or flush them completely
-	///
-	/// * Examples:
-	///   * Flush a specific server:
-	///
-	///     `!admin query resolver flush-cache matrix.example.com`
-	///
-	///   * Flush all resolver caches completely:
-	///
-	///     `!admin query resolver flush-cache --all`
-	#[command(verbatim_doc_comment)]
+	/// Flush a specific server from the resolver caches or everything
 	FlushCache {
 		name: Option<OwnedServerName>,

--- a/src/admin/room/commands.rs
+++ b/src/admin/room/commands.rs
@@ -4,14 +4,12 @@

 use crate::{PAGE_SIZE, admin_command, get_room_info};

-#[allow(clippy::fn_params_excessive_bools)]
 #[admin_command]
 pub(super) async fn list_rooms(
 	&self,
 	page: Option<usize>,
 	exclude_disabled: bool,
 	exclude_banned: bool,
-	include_empty: bool,
 	no_details: bool,
 ) -> Result {
 	// TODO: i know there's a way to do this with clap, but i can't seem to find it
@@ -30,20 +28,6 @@ pub(super) async fn list_rooms(
 				.then_some(room_id)
 		})
 		.then(|room_id| get_room_info(self.services, room_id))
-		.then(|(room_id, total_members, name)| async move {
-			let local_members: Vec<_> = self
-				.services
-				.rooms
-				.state_cache
-				.active_local_users_in_room(&room_id)
-				.collect()
-				.await;
-			let local_members = local_members.len();
-			(room_id, total_members, local_members, name)
-		})
-		.filter_map(|(room_id, total_members, local_members, name)| async move {
-			(include_empty || local_members > 0).then_some((room_id, total_members, name))
-		})
 		.collect::<Vec<_>>()
 		.await;

--- a/src/admin/room/mod.rs
+++ b/src/admin/room/mod.rs
@@ -30,10 +30,6 @@ pub enum RoomCommand {
 		#[arg(long)]
 		exclude_banned: bool,

-		/// Includes disconnected/empty rooms (rooms with zero members)
-		#[arg(long)]
-		include_empty: bool,
-
 		#[arg(long)]
 		/// Whether to only output room IDs without supplementary room
 		/// information
--- a/src/admin/room/moderation.rs
+++ b/src/admin/room/moderation.rs
@@ -89,7 +89,13 @@ async fn ban_room(&self, room: OwnedRoomOrAliasId) -> Result {
 			 locally, if not using get_alias_helper to fetch room ID remotely"
 		);

-		match self.services.rooms.alias.resolve_alias(room_alias).await {
+		match self
+			.services
+			.rooms
+			.alias
+			.resolve_alias(room_alias, None)
+			.await
+		{
 			| Ok((room_id, servers)) => {
 				debug!(
 					%room_id,
@@ -229,7 +235,7 @@ async fn ban_list_of_rooms(&self) -> Result {
 										.services
 										.rooms
 										.alias
-										.resolve_alias(room_alias)
+										.resolve_alias(room_alias, None)
 										.await
 									{
 										| Ok((room_id, servers)) => {
@@ -382,7 +388,13 @@ async fn unban_room(&self, room: OwnedRoomOrAliasId) -> Result {
 					 room ID over federation"
 				);

-				match self.services.rooms.alias.resolve_alias(room_alias).await {
+				match self
+					.services
+					.rooms
+					.alias
+					.resolve_alias(room_alias, None)
+					.await
+				{
 					| Ok((room_id, servers)) => {
 						debug!(
 							%room_id,
--- a/src/admin/server/commands.rs
+++ b/src/admin/server/commands.rs
@@ -86,7 +86,7 @@ pub(super) async fn list_backups(&self) -> Result {
 		.db
 		.backup_list()?
 		.try_stream()
-		.try_for_each(|result| writeln!(self, "{result}"))
+		.try_for_each(|result| write!(self, "{result}"))
 		.await
 }

--- a/src/admin/user/commands.rs
+++ b/src/admin/user/commands.rs
@@ -5,7 +5,7 @@

 use api::client::{full_user_deactivate, join_room_by_id_helper, leave_room, remote_leave_room};
 use conduwuit::{
-	Err, Result, debug_warn, error, info,
+	Err, Result, debug, debug_warn, error, info, is_equal_to,
 	matrix::{Event, pdu::PduBuilder},
 	utils::{self, ReadyExt},
 	warn,
@@ -140,6 +140,7 @@ pub(super) async fn create_user(&self, username: String, password: Option<String
 						self.services.globals.server_name().to_owned(),
 						room_server_name.to_owned(),
 					],
+					None,
 					&None,
 				)
 				.await
@@ -167,8 +168,27 @@ pub(super) async fn create_user(&self, username: String, password: Option<String

 	// we dont add a device since we're not the user, just the creator

-	// Make the first user to register an administrator and disable first-run mode.
-	self.services.firstrun.empower_first_user(&user_id).await?;
+	// if this account creation is from the CLI / --execute, invite the first user
+	// to admin room
+	if let Ok(admin_room) = self.services.admin.get_admin_room().await {
+		if self
+			.services
+			.rooms
+			.state_cache
+			.room_joined_count(&admin_room)
+			.await
+			.is_ok_and(is_equal_to!(1))
+		{
+			self.services
+				.admin
+				.make_user_admin(&user_id)
+				.boxed()
+				.await?;
+			warn!("Granting {user_id} admin privileges as the first user");
+		}
+	} else {
+		debug!("create_user admin command called without an admin room being available");
+	}

 	self.write_str(&format!("Created user with user_id: {user_id} and password: `{password}`"))
 		.await
@@ -529,6 +549,7 @@ pub(super) async fn force_join_list_of_local_users(
 			&room_id,
 			Some(String::from(BULK_JOIN_REASON)),
 			&servers,
+			None,
 			&None,
 		)
 		.await
@@ -614,6 +635,7 @@ pub(super) async fn force_join_all_local_users(
 			&room_id,
 			Some(String::from(BULK_JOIN_REASON)),
 			&servers,
+			None,
 			&None,
 		)
 		.await
@@ -653,7 +675,8 @@ pub(super) async fn force_join_room(
 		self.services.globals.user_is_local(&user_id),
 		"Parsed user_id must be a local user"
 	);
-	join_room_by_id_helper(self.services, &user_id, &room_id, None, &servers, &None).await?;
+	join_room_by_id_helper(self.services, &user_id, &room_id, None, &servers, None, &None)
+		.await?;

 	self.write_str(&format!("{user_id} has been joined to {room_id}.",))
 		.await
--- a/src/api/Cargo.toml
+++ b/src/api/Cargo.toml
@@ -28,10 +28,6 @@ gzip_compression = [
 	"conduwuit-service/gzip_compression",
 	"reqwest/gzip",
 ]
-http3 = [
-	"conduwuit-core/http3",
-	"conduwuit-service/http3",
-]
 io_uring = [
 	"conduwuit-service/io_uring",
 ]
--- a/src/api/client/account.rs
+++ b/src/api/client/account.rs
@@ -3,7 +3,7 @@
 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
 use conduwuit::{
-	Err, Error, Event, Result, debug_info, err, error, info,
+	Err, Error, Event, Result, debug_info, err, error, info, is_equal_to,
 	matrix::pdu::PduBuilder,
 	utils::{self, ReadyExt, stream::BroadbandExt},
 	warn,
@@ -148,12 +148,7 @@ pub(crate) async fn register_route(
 	let is_guest = body.kind == RegistrationKind::Guest;
 	let emergency_mode_enabled = services.config.emergency_password.is_some();

-	// Allow registration if it's enabled in the config file or if this is the first
-	// run (so the first user account can be created)
-	let allow_registration =
-		services.config.allow_registration || services.firstrun.is_first_run();
-
-	if !allow_registration && body.appservice_info.is_none() {
+	if !services.config.allow_registration && body.appservice_info.is_none() {
 		match (body.username.as_ref(), body.initial_device_display_name.as_ref()) {
 			| (Some(username), Some(device_display_name)) => {
 				info!(
@@ -190,10 +185,17 @@ pub(crate) async fn register_route(
 		)));
 	}

-	if is_guest && !services.config.allow_guest_registration {
+	if is_guest
+		&& (!services.config.allow_guest_registration
+			|| (services.config.allow_registration
+				&& services
+					.registration_tokens
+					.get_config_file_token()
+					.is_some()))
+	{
 		info!(
-			"Guest registration disabled, rejecting guest registration attempt, initial device \
-			 name: \"{}\"",
+			"Guest registration disabled / registration enabled with token configured, \
+			 rejecting guest registration attempt, initial device name: \"{}\"",
 			body.initial_device_display_name.as_deref().unwrap_or("")
 		);
 		return Err!(Request(GuestAccessForbidden("Guest registration is disabled.")));
@@ -252,13 +254,6 @@ pub(crate) async fn register_route(
 						}
 					}

-					// Don't allow registration with user IDs that aren't local
-					if !services.globals.user_is_local(&user_id) {
-						return Err!(Request(InvalidUsername(
-							"Username {body_username} is not local to this server"
-						)));
-					}
-
 					user_id
 				},
 				| Err(e) => {
@@ -314,63 +309,54 @@ pub(crate) async fn register_route(
 	let skip_auth = body.appservice_info.is_some() || is_guest;

 	// Populate required UIAA flows
-
-	if services.firstrun.is_first_run() {
-		// Registration token forced while in first-run mode
+	if services
+		.registration_tokens
+		.iterate_tokens()
+		.next()
+		.await
+		.is_some()
+	{
+		// Registration token required
 		uiaainfo.flows.push(AuthFlow {
 			stages: vec![AuthType::RegistrationToken],
 		});
-	} else {
-		if services
-			.registration_tokens
-			.iterate_tokens()
-			.next()
-			.await
-			.is_some()
+	}
+	if services.config.recaptcha_private_site_key.is_some() {
+		if let Some(pubkey) = &services.config.recaptcha_site_key {
+			// ReCaptcha required
+			uiaainfo
+				.flows
+				.push(AuthFlow { stages: vec![AuthType::ReCaptcha] });
+			uiaainfo.params = serde_json::value::to_raw_value(&serde_json::json!({
+				"m.login.recaptcha": {
+					"public_key": pubkey,
+				},
+			}))
+			.expect("Failed to serialize recaptcha params");
+		}
+	}
+
+	if uiaainfo.flows.is_empty() && !skip_auth {
+		// Registration isn't _disabled_, but there's no captcha configured and no
+		// registration tokens currently set. Bail out by default unless open
+		// registration was explicitly enabled.
+		if !services
+			.config
+			.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
 		{
-			// Registration token required
-			uiaainfo.flows.push(AuthFlow {
-				stages: vec![AuthType::RegistrationToken],
-			});
+			return Err!(Request(Forbidden(
+				"This server is not accepting registrations at this time."
+			)));
 		}

-		if services.config.recaptcha_private_site_key.is_some() {
-			if let Some(pubkey) = &services.config.recaptcha_site_key {
-				// ReCaptcha required
-				uiaainfo
-					.flows
-					.push(AuthFlow { stages: vec![AuthType::ReCaptcha] });
-				uiaainfo.params = serde_json::value::to_raw_value(&serde_json::json!({
-					"m.login.recaptcha": {
-						"public_key": pubkey,
-					},
-				}))
-				.expect("Failed to serialize recaptcha params");
-			}
-		}
-
-		if uiaainfo.flows.is_empty() && !skip_auth {
-			// Registration isn't _disabled_, but there's no captcha configured and no
-			// registration tokens currently set. Bail out by default unless open
-			// registration was explicitly enabled.
-			if !services
-				.config
-				.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-			{
-				return Err!(Request(Forbidden(
-					"This server is not accepting registrations at this time."
-				)));
-			}
-
-			// We have open registration enabled (😧), provide a dummy stage
-			uiaainfo = UiaaInfo {
-				flows: vec![AuthFlow { stages: vec![AuthType::Dummy] }],
-				completed: Vec::new(),
-				params: Box::default(),
-				session: None,
-				auth_error: None,
-			};
-		}
+		// We have open registration enabled (😧), provide a dummy stage
+		uiaainfo = UiaaInfo {
+			flows: vec![AuthFlow { stages: vec![AuthType::Dummy] }],
+			completed: Vec::new(),
+			params: Box::default(),
+			session: None,
+			auth_error: None,
+		};
 	}

 	if !skip_auth {
@@ -528,29 +514,39 @@ pub(crate) async fn register_route(
 		}
 	}

+	// If this is the first real user, grant them admin privileges except for guest
+	// users
+	// Note: the server user is generated first
 	if !is_guest {
-		// Make the first user to register an administrator and disable first-run mode.
-		let was_first_user = services.firstrun.empower_first_user(&user_id).await?;
-
-		// If the registering user was not the first and we're suspending users on
-		// register, suspend them.
-		if !was_first_user && services.config.suspend_on_register {
-			// Note that we can still do auto joins for suspended users
-			services
-				.users
-				.suspend_account(&user_id, &services.globals.server_user)
-				.await;
-			// And send an @room notice to the admin room, to prompt admins to review the
-			// new user and ideally unsuspend them if deemed appropriate.
-			if services.server.config.admin_room_notices {
+		if let Ok(admin_room) = services.admin.get_admin_room().await {
+			if services
+				.rooms
+				.state_cache
+				.room_joined_count(&admin_room)
+				.await
+				.is_ok_and(is_equal_to!(1))
+			{
+				services.admin.make_user_admin(&user_id).boxed().await?;
+				warn!("Granting {user_id} admin privileges as the first user");
+			} else if services.config.suspend_on_register {
+				// This is not an admin, suspend them.
+				// Note that we can still do auto joins for suspended users
 				services
-					.admin
-					.send_loud_message(RoomMessageEventContent::text_plain(format!(
-						"User {user_id} has been suspended as they are not the first user on \
-						 this server. Please review and unsuspend them if appropriate."
-					)))
-					.await
-					.ok();
+					.users
+					.suspend_account(&user_id, &services.globals.server_user)
+					.await;
+				// And send an @room notice to the admin room, to prompt admins to review the
+				// new user and ideally unsuspend them if deemed appropriate.
+				if services.server.config.admin_room_notices {
+					services
+						.admin
+						.send_loud_message(RoomMessageEventContent::text_plain(format!(
+							"User {user_id} has been suspended as they are not the first user \
+							 on this server. Please review and unsuspend them if appropriate."
+						)))
+						.await
+						.ok();
+				}
 			}
 		}
 	}
@@ -587,6 +583,7 @@ pub(crate) async fn register_route(
 					&room_id,
 					Some("Automatically joining this room upon registration".to_owned()),
 					&[services.globals.server_name().to_owned(), room_server_name.to_owned()],
+					None,
 					&body.appservice_info,
 				)
 				.boxed()
--- a/src/api/client/alias.rs
+++ b/src/api/client/alias.rs
@@ -1,6 +1,12 @@
 use axum::extract::State;
-use conduwuit::{Err, Result};
-use ruma::api::client::alias::{create_alias, delete_alias, get_alias};
+use conduwuit::{Err, Result, debug};
+use conduwuit_service::Services;
+use futures::StreamExt;
+use rand::seq::SliceRandom;
+use ruma::{
+	OwnedServerName, RoomAliasId, RoomId,
+	api::client::alias::{create_alias, delete_alias, get_alias},
+};

 use crate::Ruma;

@@ -90,9 +96,65 @@ pub(crate) async fn get_alias_route(
 ) -> Result<get_alias::v3::Response> {
 	let room_alias = body.body.room_alias;

-	let Ok((room_id, servers)) = services.rooms.alias.resolve_alias(&room_alias).await else {
+	let Ok((room_id, servers)) = services.rooms.alias.resolve_alias(&room_alias, None).await
+	else {
 		return Err!(Request(NotFound("Room with alias not found.")));
 	};

+	let servers = room_available_servers(&services, &room_id, &room_alias, servers).await;
+	debug!(%room_alias, %room_id, "available servers: {servers:?}");
+
 	Ok(get_alias::v3::Response::new(room_id, servers))
 }
+
+async fn room_available_servers(
+	services: &Services,
+	room_id: &RoomId,
+	room_alias: &RoomAliasId,
+	pre_servers: Vec<OwnedServerName>,
+) -> Vec<OwnedServerName> {
+	// find active servers in room state cache to suggest
+	let mut servers: Vec<OwnedServerName> = services
+		.rooms
+		.state_cache
+		.room_servers(room_id)
+		.map(ToOwned::to_owned)
+		.collect()
+		.await;
+
+	// push any servers we want in the list already (e.g. responded remote alias
+	// servers, room alias server itself)
+	servers.extend(pre_servers);
+
+	servers.sort_unstable();
+	servers.dedup();
+
+	// shuffle list of servers randomly after sort and dedupe
+	servers.shuffle(&mut rand::thread_rng());
+
+	// insert our server as the very first choice if in list, else check if we can
+	// prefer the room alias server first
+	match servers
+		.iter()
+		.position(|server_name| services.globals.server_is_ours(server_name))
+	{
+		| Some(server_index) => {
+			servers.swap_remove(server_index);
+			servers.insert(0, services.globals.server_name().to_owned());
+		},
+		| _ => {
+			match servers
+				.iter()
+				.position(|server| server == room_alias.server_name())
+			{
+				| Some(alias_server_index) => {
+					servers.swap_remove(alias_server_index);
+					servers.insert(0, room_alias.server_name().into());
+				},
+				| _ => {},
+			}
+		},
+	}
+
+	servers
+}
--- a/src/api/client/context.rs
+++ b/src/api/client/context.rs
@@ -16,10 +16,7 @@

 use crate::{
 	Ruma,
-	client::{
-		is_ignored_pdu,
-		message::{event_filter, ignored_filter, lazy_loading_witness, visibility_filter},
-	},
+	client::message::{event_filter, ignored_filter, lazy_loading_witness, visibility_filter},
 };

 const LIMIT_MAX: usize = 100;
@@ -81,9 +78,6 @@ pub(crate) async fn get_context_route(
 		return Err!(Request(NotFound("Event not found.")));
 	}

-	// Return M_SENDER_IGNORED if the sender of base_event is ignored (MSC4406)
-	is_ignored_pdu(&services, &base_pdu, sender_user).await?;
-
 	let base_count = base_id.pdu_count();

 	let base_event = ignored_filter(&services, (base_count, base_pdu), sender_user);
--- a/src/api/client/media.rs
+++ b/src/api/client/media.rs
@@ -6,7 +6,6 @@
 	Err, Result, err,
 	utils::{self, content_disposition::make_content_disposition, math::ruma_from_usize},
 };
-use conduwuit_core::error;
 use conduwuit_service::{
 	Services,
 	media::{CACHE_CONTROL_IMMUTABLE, CORP_CROSS_ORIGIN, Dim, FileMeta, MXC_LENGTH},
@@ -145,22 +144,12 @@ pub(crate) async fn get_content_route(
 		server_name: &body.server_name,
 		media_id: &body.media_id,
 	};
+
 	let FileMeta {
 		content,
 		content_type,
 		content_disposition,
-	} = match fetch_file(&services, &mxc, user, body.timeout_ms, None).await {
-		| Ok(meta) => meta,
-		| Err(conduwuit::Error::Io(e)) => match e.kind() {
-			| std::io::ErrorKind::NotFound => return Err!(Request(NotFound("Media not found."))),
-			| std::io::ErrorKind::PermissionDenied => {
-				error!("Permission denied when trying to read file: {e:?}");
-				return Err!(Request(Unknown("Unknown error when fetching file.")));
-			},
-			| _ => return Err!(Request(Unknown("Unknown error when fetching file."))),
-		},
-		| Err(_) => return Err!(Request(Unknown("Unknown error when fetching file."))),
-	};
+	} = fetch_file(&services, &mxc, user, body.timeout_ms, None).await?;

 	Ok(get_content::v1::Response {
 		file: content.expect("entire file contents"),
@@ -196,18 +185,7 @@ pub(crate) async fn get_content_as_filename_route(
 		content,
 		content_type,
 		content_disposition,
-	} = match fetch_file(&services, &mxc, user, body.timeout_ms, None).await {
-		| Ok(meta) => meta,
-		| Err(conduwuit::Error::Io(e)) => match e.kind() {
-			| std::io::ErrorKind::NotFound => return Err!(Request(NotFound("Media not found."))),
-			| std::io::ErrorKind::PermissionDenied => {
-				error!("Permission denied when trying to read file: {e:?}");
-				return Err!(Request(Unknown("Unknown error when fetching file.")));
-			},
-			| _ => return Err!(Request(Unknown("Unknown error when fetching file."))),
-		},
-		| Err(_) => return Err!(Request(Unknown("Unknown error when fetching file."))),
-	};
+	} = fetch_file(&services, &mxc, user, body.timeout_ms, Some(&body.filename)).await?;

 	Ok(get_content_as_filename::v1::Response {
 		file: content.expect("entire file contents"),
--- a/src/api/client/membership/join.rs
+++ b/src/api/client/membership/join.rs
@@ -3,7 +3,7 @@
 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
 use conduwuit::{
-	Err, Result, debug, debug_info, debug_warn, err, error, info, is_true,
+	Err, Result, debug, debug_info, debug_warn, err, error, info,
 	matrix::{
 		StateKey,
 		event::{gen_event_id, gen_event_id_canonical_json},
@@ -26,7 +26,7 @@
 	api::{
 		client::{
 			error::ErrorKind,
-			membership::{join_room_by_id, join_room_by_id_or_alias},
+			membership::{ThirdPartySigned, join_room_by_id, join_room_by_id_or_alias},
 		},
 		federation::{self},
 	},
@@ -34,7 +34,7 @@
 	events::{
 		StateEventType,
 		room::{
-			join_rules::JoinRule,
+			join_rules::{AllowRule, JoinRule},
 			member::{MembershipState, RoomMemberEventContent},
 		},
 	},
@@ -48,13 +48,9 @@
 		timeline::pdu_fits,
 	},
 };
-use tokio::join;

 use super::{banned_room_check, validate_remote_member_event_stub};
-use crate::{
-	Ruma,
-	server::{select_authorising_user, user_can_perform_restricted_join},
-};
+use crate::Ruma;

 /// # `POST /_matrix/client/r0/rooms/{roomId}/join`
 ///
@@ -120,6 +116,7 @@ pub(crate) async fn join_room_by_id_route(
 		&body.room_id,
 		body.reason.clone(),
 		&servers,
+		body.third_party_signed.as_ref(),
 		&body.appservice_info,
 	)
 	.boxed()
@@ -198,7 +195,11 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 			(servers, room_id)
 		},
 		| Err(room_alias) => {
-			let (room_id, mut servers) = services.rooms.alias.resolve_alias(&room_alias).await?;
+			let (room_id, mut servers) = services
+				.rooms
+				.alias
+				.resolve_alias(&room_alias, Some(body.via.clone()))
+				.await?;

 			banned_room_check(
 				&services,
@@ -247,6 +248,7 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 		&room_id,
 		body.reason.clone(),
 		&servers,
+		body.third_party_signed.as_ref(),
 		appservice_info,
 	)
 	.boxed()
@@ -261,6 +263,7 @@ pub async fn join_room_by_id_helper(
 	room_id: &RoomId,
 	reason: Option<String>,
 	servers: &[OwnedServerName],
+	third_party_signed: Option<&ThirdPartySigned>,
 	appservice_info: &Option<RegistrationInfo>,
 ) -> Result<join_room_by_id::v3::Response> {
 	let state_lock = services.rooms.state.mutex.lock(room_id).await;
@@ -348,9 +351,17 @@ pub async fn join_room_by_id_helper(
 	}

 	if server_in_room {
-		join_room_by_id_helper_local(services, sender_user, room_id, reason, servers, state_lock)
-			.boxed()
-			.await?;
+		join_room_by_id_helper_local(
+			services,
+			sender_user,
+			room_id,
+			reason,
+			servers,
+			third_party_signed,
+			state_lock,
+		)
+		.boxed()
+		.await?;
 	} else {
 		// Ask a remote server if we are not participating in this room
 		join_room_by_id_helper_remote(
@@ -359,6 +370,7 @@ pub async fn join_room_by_id_helper(
 			room_id,
 			reason,
 			servers,
+			third_party_signed,
 			state_lock,
 		)
 		.boxed()
@@ -374,6 +386,7 @@ async fn join_room_by_id_helper_remote(
 	room_id: &RoomId,
 	reason: Option<String>,
 	servers: &[OwnedServerName],
+	_third_party_signed: Option<&ThirdPartySigned>,
 	state_lock: RoomMutexGuard,
 ) -> Result {
 	info!("Joining {room_id} over federation.");
@@ -383,10 +396,11 @@ async fn join_room_by_id_helper_remote(

 	info!("make_join finished");

-	let room_version_id = make_join_response.room_version.unwrap_or(RoomVersionId::V1);
+	let Some(room_version_id) = make_join_response.room_version else {
+		return Err!(BadServerResponse("Remote room version is not supported by conduwuit"));
+	};

 	if !services.server.supported_room_version(&room_version_id) {
-		// How did we get here?
 		return Err!(BadServerResponse(
 			"Remote room version {room_version_id} is not supported by conduwuit"
 		));
@@ -415,6 +429,10 @@ async fn join_room_by_id_helper_remote(
 		}
 	};

+	join_event_stub.insert(
+		"origin".to_owned(),
+		CanonicalJsonValue::String(services.globals.server_name().as_str().to_owned()),
+	);
 	join_event_stub.insert(
 		"origin_server_ts".to_owned(),
 		CanonicalJsonValue::Integer(
@@ -726,45 +744,87 @@ async fn join_room_by_id_helper_local(
 	room_id: &RoomId,
 	reason: Option<String>,
 	servers: &[OwnedServerName],
+	_third_party_signed: Option<&ThirdPartySigned>,
 	state_lock: RoomMutexGuard,
 ) -> Result {
-	info!("Joining room locally");
+	debug_info!("We can join locally");
+	let join_rules = services.rooms.state_accessor.get_join_rules(room_id).await;

-	let (room_version, join_rules, is_invited) = join!(
-		services.rooms.state.get_room_version(room_id),
-		services.rooms.state_accessor.get_join_rules(room_id),
-		services.rooms.state_cache.is_invited(sender_user, room_id)
-	);
-
-	let room_version = room_version?;
-	let mut auth_user: Option<OwnedUserId> = None;
-	if !is_invited && matches!(join_rules, JoinRule::Restricted(_) | JoinRule::KnockRestricted(_))
-	{
-		use RoomVersionId::*;
-		if !matches!(room_version, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
-			// This is a restricted room, check if we can complete the join requirements
-			// locally.
-			let needs_auth_user =
-				user_can_perform_restricted_join(services, sender_user, room_id, &room_version)
-					.await;
-			if needs_auth_user.is_ok_and(is_true!()) {
-				// If there was an error or the value is false, we'll try joining over
-				// federation. Since it's Ok(true), we can authorise this locally.
-				// If we can't select a local user, this will remain None, the join will fail,
-				// and we'll fall back to federation.
-				auth_user = select_authorising_user(services, room_id, sender_user, &state_lock)
-					.await
-					.ok();
+	let mut restricted_join_authorized = None;
+	match join_rules {
+		| JoinRule::Restricted(restricted) | JoinRule::KnockRestricted(restricted) => {
+			for restriction in restricted.allow {
+				match restriction {
+					| AllowRule::RoomMembership(membership) => {
+						if services
+							.rooms
+							.state_cache
+							.is_joined(sender_user, &membership.room_id)
+							.await
+						{
+							restricted_join_authorized = Some(true);
+							break;
+						}
+					},
+					| AllowRule::UnstableSpamChecker => {
+						match services
+							.antispam
+							.meowlnir_accept_make_join(room_id.to_owned(), sender_user.to_owned())
+							.await
+						{
+							| Ok(()) => {
+								restricted_join_authorized = Some(true);
+								break;
+							},
+							| Err(_) =>
+								return Err!(Request(Forbidden(
+									"Antispam rejected join request."
+								))),
+						}
+					},
+					| _ => {},
+				}
 			}
-		}
+		},
+		| _ => {},
 	}
+	let join_authorized_via_users_server = if restricted_join_authorized.is_none() {
+		None
+	} else {
+		match restricted_join_authorized.unwrap() {
+			| true => services
+				.rooms
+				.state_cache
+				.local_users_in_room(room_id)
+				.filter(|user| {
+					trace!("Checking if {user} can invite {sender_user} to {room_id}");
+					services.rooms.state_accessor.user_can_invite(
+						room_id,
+						user,
+						sender_user,
+						&state_lock,
+					)
+				})
+				.boxed()
+				.next()
+				.await
+				.map(ToOwned::to_owned),
+			| false => {
+				warn!(
+					"Join authorization failed for restricted join in room {room_id} for user \
+					 {sender_user}"
+				);
+				return Err!(Request(Forbidden("You are not authorized to join this room.")));
+			},
+		}
+	};

 	let content = RoomMemberEventContent {
 		displayname: services.users.displayname(sender_user).await.ok(),
 		avatar_url: services.users.avatar_url(sender_user).await.ok(),
 		blurhash: services.users.blurhash(sender_user).await.ok(),
 		reason: reason.clone(),
-		join_authorized_via_users_server: auth_user,
+		join_authorized_via_users_server,
 		..RoomMemberEventContent::new(MembershipState::Join)
 	};

@@ -780,7 +840,6 @@ async fn join_room_by_id_helper_local(
 		)
 		.await
 	else {
-		info!("Joined room locally");
 		return Ok(());
 	};

@@ -788,13 +847,138 @@ async fn join_room_by_id_helper_local(
 		return Err(error);
 	}

-	info!(
+	warn!(
 		?error,
-		remote_servers = %servers.len(),
-		"Could not join room locally, attempting remote join",
+		servers = %servers.len(),
+		"Could not join restricted room locally, attempting remote join",
 	);
-	join_room_by_id_helper_remote(services, sender_user, room_id, reason, servers, state_lock)
-		.await
+	let Ok((make_join_response, remote_server)) =
+		make_join_request(services, sender_user, room_id, servers).await
+	else {
+		return Err(error);
+	};
+
+	let Some(room_version_id) = make_join_response.room_version else {
+		return Err!(BadServerResponse("Remote room version is not supported by conduwuit"));
+	};
+
+	if !services.server.supported_room_version(&room_version_id) {
+		return Err!(BadServerResponse(
+			"Remote room version {room_version_id} is not supported by conduwuit"
+		));
+	}
+
+	let mut join_event_stub: CanonicalJsonObject =
+		serde_json::from_str(make_join_response.event.get()).map_err(|e| {
+			err!(BadServerResponse("Invalid make_join event json received from server: {e:?}"))
+		})?;
+
+	validate_remote_member_event_stub(
+		&MembershipState::Join,
+		sender_user,
+		room_id,
+		&join_event_stub,
+	)?;
+
+	let join_authorized_via_users_server = join_event_stub
+		.get("content")
+		.map(|s| {
+			s.as_object()?
+				.get("join_authorised_via_users_server")?
+				.as_str()
+		})
+		.and_then(|s| OwnedUserId::try_from(s.unwrap_or_default()).ok());
+
+	join_event_stub.insert(
+		"origin".to_owned(),
+		CanonicalJsonValue::String(services.globals.server_name().as_str().to_owned()),
+	);
+	join_event_stub.insert(
+		"origin_server_ts".to_owned(),
+		CanonicalJsonValue::Integer(
+			utils::millis_since_unix_epoch()
+				.try_into()
+				.expect("Timestamp is valid js_int value"),
+		),
+	);
+	join_event_stub.insert(
+		"content".to_owned(),
+		to_canonical_value(RoomMemberEventContent {
+			displayname: services.users.displayname(sender_user).await.ok(),
+			avatar_url: services.users.avatar_url(sender_user).await.ok(),
+			blurhash: services.users.blurhash(sender_user).await.ok(),
+			reason,
+			join_authorized_via_users_server,
+			..RoomMemberEventContent::new(MembershipState::Join)
+		})
+		.expect("event is valid, we just created it"),
+	);
+
+	// We keep the "event_id" in the pdu only in v1 or
+	// v2 rooms
+	match room_version_id {
+		| RoomVersionId::V1 | RoomVersionId::V2 => {},
+		| _ => {
+			join_event_stub.remove("event_id");
+		},
+	}
+
+	// In order to create a compatible ref hash (EventID) the `hashes` field needs
+	// to be present
+	services
+		.server_keys
+		.hash_and_sign_event(&mut join_event_stub, &room_version_id)?;
+
+	// Generate event id
+	let event_id = gen_event_id(&join_event_stub, &room_version_id)?;
+
+	// Add event_id back
+	join_event_stub
+		.insert("event_id".to_owned(), CanonicalJsonValue::String(event_id.clone().into()));
+
+	// It has enough fields to be called a proper event now
+	let join_event = join_event_stub;
+
+	let send_join_response = services
+		.sending
+		.send_synapse_request(
+			&remote_server,
+			federation::membership::create_join_event::v2::Request {
+				room_id: room_id.to_owned(),
+				event_id: event_id.clone(),
+				omit_members: false,
+				pdu: services
+					.sending
+					.convert_to_outgoing_federation_event(join_event.clone())
+					.await,
+			},
+		)
+		.await?;
+
+	if let Some(signed_raw) = send_join_response.room_state.event {
+		let (signed_event_id, signed_value) =
+			gen_event_id_canonical_json(&signed_raw, &room_version_id).map_err(|e| {
+				err!(Request(BadJson(warn!("Could not convert event to canonical JSON: {e}"))))
+			})?;
+
+		if signed_event_id != event_id {
+			return Err!(Request(BadJson(
+				warn!(%signed_event_id, %event_id, "Server {remote_server} sent event with wrong event ID")
+			)));
+		}
+
+		drop(state_lock);
+		services
+			.rooms
+			.event_handler
+			.handle_incoming_pdu(&remote_server, room_id, &signed_event_id, signed_value, true)
+			.boxed()
+			.await?;
+	} else {
+		return Err(error);
+	}
+
+	Ok(())
 }

 async fn make_join_request(
@@ -803,16 +987,17 @@ async fn make_join_request(
 	room_id: &RoomId,
 	servers: &[OwnedServerName],
 ) -> Result<(federation::membership::prepare_join_event::v1::Response, OwnedServerName)> {
-	let mut make_join_counter: usize = 1;
+	let mut make_join_response_and_server =
+		Err!(BadServerResponse("No server available to assist in joining."));
+
+	let mut make_join_counter: usize = 0;
+	let mut incompatible_room_version_count: usize = 0;

 	for remote_server in servers {
 		if services.globals.server_is_ours(remote_server) {
 			continue;
 		}
-		info!(
-			"Asking {remote_server} for make_join (attempt {make_join_counter}/{})",
-			servers.len()
-		);
+		info!("Asking {remote_server} for make_join ({make_join_counter})");
 		let make_join_response = services
 			.sending
 			.send_federation_request(
@@ -840,44 +1025,47 @@ async fn make_join_request(
 					warn!("make_join response from {remote_server} failed validation: {e}");
 					continue;
 				}
-				return Ok((response, remote_server.clone()));
+				make_join_response_and_server = Ok((response, remote_server.clone()));
+				break;
 			},
-			| Err(e) => match e.kind() {
-				| ErrorKind::UnableToAuthorizeJoin => {
+			| Err(e) => {
+				info!("make_join request to {remote_server} failed: {e}");
+				if matches!(
+					e.kind(),
+					ErrorKind::IncompatibleRoomVersion { .. } | ErrorKind::UnsupportedRoomVersion
+				) {
+					incompatible_room_version_count =
+						incompatible_room_version_count.saturating_add(1);
+				}
+
+				if incompatible_room_version_count > 15 {
 					info!(
-						"{remote_server} was unable to verify the joining user satisfied \
-						 restricted join requirements: {e}. Will continue trying."
+						"15 servers have responded with M_INCOMPATIBLE_ROOM_VERSION or \
+						 M_UNSUPPORTED_ROOM_VERSION, assuming that conduwuit does not support \
+						 the room version {room_id}: {e}"
 					);
-				},
-				| ErrorKind::UnableToGrantJoin => {
-					info!(
-						"{remote_server} believes the joining user satisfies restricted join \
-						 rules, but is unable to authorise a join for us. Will continue trying."
-					);
-				},
-				| ErrorKind::IncompatibleRoomVersion { room_version } => {
+					make_join_response_and_server =
+						Err!(BadServerResponse("Room version is not supported by Conduwuit"));
+					return make_join_response_and_server;
+				}
+
+				if make_join_counter > 40 {
 					warn!(
-						"{remote_server} reports the room we are trying to join is \
-						 v{room_version}, which we do not support."
+						"40 servers failed to provide valid make_join response, assuming no \
+						 server can assist in joining."
 					);
-					return Err(e);
-				},
-				| ErrorKind::Forbidden { .. } => {
-					warn!("{remote_server} refuses to let us join: {e}.");
-					return Err(e);
-				},
-				| ErrorKind::NotFound => {
-					info!(
-						"{remote_server} does not know about {room_id}: {e}. Will continue \
-						 trying."
-					);
-				},
-				| _ => {
-					info!("{remote_server} failed to make_join: {e}. Will continue trying.");
-				},
+					make_join_response_and_server =
+						Err!(BadServerResponse("No server available to assist in joining."));
+
+					return make_join_response_and_server;
+				}
 			},
 		}
+
+		if make_join_response_and_server.is_ok() {
+			break;
+		}
 	}
-	info!("All {} servers were unable to assist in joining {room_id} :(", servers.len());
-	Err!(BadServerResponse("No server available to assist in joining."))
+
+	make_join_response_and_server
 }
--- a/src/api/client/membership/knock.rs
+++ b/src/api/client/membership/knock.rs
@@ -102,7 +102,11 @@ pub(crate) async fn knock_room_route(
 			(servers, room_id)
 		},
 		| Err(room_alias) => {
-			let (room_id, mut servers) = services.rooms.alias.resolve_alias(&room_alias).await?;
+			let (room_id, mut servers) = services
+				.rooms
+				.alias
+				.resolve_alias(&room_alias, Some(body.via.clone()))
+				.await?;

 			banned_room_check(
 				&services,
@@ -249,6 +253,7 @@ async fn knock_room_by_id_helper(
 				room_id,
 				reason.clone(),
 				servers,
+				None,
 				&None,
 			)
 			.await
--- a/src/api/client/message.rs
+++ b/src/api/client/message.rs
@@ -1,7 +1,7 @@
 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
 use conduwuit::{
-	Err, Error, Result, at, debug_warn,
+	Err, Result, at, debug_warn,
 	matrix::{
 		event::{Event, Matches},
 		pdu::PduCount,
@@ -26,7 +26,7 @@
 	DeviceId, RoomId, UserId,
 	api::{
 		Direction,
-		client::{error::ErrorKind, filter::RoomEventFilter, message::get_message_events},
+		client::{filter::RoomEventFilter, message::get_message_events},
 	},
 	events::{
 		AnyStateEvent, StateEventType,
@@ -279,30 +279,23 @@ pub(crate) async fn ignored_filter(

 	is_ignored_pdu(services, pdu, user_id)
 		.await
-		.unwrap_or(true)
 		.eq(&false)
 		.then_some(item)
 }

-/// Determine whether a PDU should be ignored for a given recipient user.
-/// Returns True if this PDU should be ignored, returns False otherwise.
-///
-/// The error SenderIgnored is returned if the sender or the sender's server is
-/// ignored by the relevant user. If the error cannot be returned to the user,
-/// it should equate to a true value (i.e. ignored).
 #[inline]
 pub(crate) async fn is_ignored_pdu<Pdu>(
 	services: &Services,
 	event: &Pdu,
 	recipient_user: &UserId,
-) -> Result<bool>
+) -> bool
 where
 	Pdu: Event + Send + Sync,
 {
 	// exclude Synapse's dummy events from bloating up response bodies. clients
 	// don't need to see this.
 	if event.kind().to_cow_str() == "org.matrix.dummy_event" {
-		return Ok(true);
+		return true;
 	}

 	let sender_user = event.sender();
@@ -317,27 +310,21 @@ pub(crate) async fn is_ignored_pdu<Pdu>(

 	if !type_ignored {
 		// We cannot safely ignore this type
-		return Ok(false);
+		return false;
 	}

 	if server_ignored {
 		// the sender's server is ignored, so ignore this event
-		return Err(Error::BadRequest(
-			ErrorKind::SenderIgnored { sender: None },
-			"The sender's server is ignored by this server.",
-		));
+		return true;
 	}

 	if user_ignored && !services.config.send_messages_from_ignored_users_to_client {
 		// the recipient of this PDU has the sender ignored, and we're not
 		// configured to send ignored messages to clients
-		return Err(Error::BadRequest(
-			ErrorKind::SenderIgnored { sender: Some(event.sender().to_owned()) },
-			"You have ignored this sender.",
-		));
+		return true;
 	}

-	Ok(false)
+	false
 }

 #[inline]
--- a/src/api/client/relations.rs
+++ b/src/api/client/relations.rs
@@ -1,6 +1,6 @@
 use axum::extract::State;
 use conduwuit::{
-	Err, Result, at, debug_warn, err,
+	Err, Result, at, debug_warn,
 	matrix::{Event, event::RelationTypeEqual, pdu::PduCount},
 	utils::{IterStream, ReadyExt, result::FlatOk, stream::WidebandExt},
 };
@@ -18,7 +18,7 @@
 	events::{TimelineEventType, relation::RelationType},
 };

-use crate::{Ruma, client::is_ignored_pdu};
+use crate::Ruma;

 /// # `GET /_matrix/client/r0/rooms/{roomId}/relations/{eventId}/{relType}/{eventType}`
 pub(crate) async fn get_relating_events_with_rel_type_and_event_type_route(
@@ -118,14 +118,6 @@ async fn paginate_relations_with_filter(
 		debug_warn!(req_evt = %target, %room_id, "Event relations requested by {sender_user} but is not allowed to see it, returning 404");
 		return Err!(Request(NotFound("Event not found.")));
 	}
-	let target_pdu = services
-		.rooms
-		.timeline
-		.get_pdu(target)
-		.await
-		.map_err(|_| err!(Request(NotFound("Event not found."))))?;
-	// Return M_SENDER_IGNORED if the sender of base_event is ignored (MSC4406)
-	is_ignored_pdu(services, &target_pdu, sender_user).await?;

 	let start: PduCount = from
 		.map(str::parse)
@@ -167,7 +159,6 @@ async fn paginate_relations_with_filter(
 		.ready_take_while(|(count, _)| Some(*count) != to)
 		.take(limit)
 		.wide_filter_map(|item| visibility_filter(services, sender_user, item))
-		.wide_filter_map(|item| ignored_filter(services, item, sender_user))
 		.then(async |mut pdu| {
 			if let Err(e) = services
 				.rooms
@@ -223,17 +214,3 @@ async fn visibility_filter<Pdu: Event + Send + Sync>(
 		.await
 		.then_some(item)
 }
-
-async fn ignored_filter<Pdu: Event + Send + Sync>(
-	services: &Services,
-	item: (PduCount, Pdu),
-	sender_user: &UserId,
-) -> Option<(PduCount, Pdu)> {
-	let (_, pdu) = &item;
-
-	if is_ignored_pdu(services, pdu, sender_user).await.ok()? {
-		None
-	} else {
-		Some(item)
-	}
-}
--- a/src/api/client/report.rs
+++ b/src/api/client/report.rs
@@ -4,6 +4,7 @@
 use axum_client_ip::InsecureClientIp;
 use conduwuit::{Err, Event, Result, debug_info, info, matrix::pdu::PduEvent, utils::ReadyExt};
 use conduwuit_service::Services;
+use rand::Rng;
 use ruma::{
 	EventId, OwnedEventId, OwnedRoomId, OwnedUserId, RoomId, UserId,
 	api::client::{
@@ -243,7 +244,7 @@ fn build_report(report: Report) -> RoomMessageEventContent {
 /// random delay sending a response per spec suggestion regarding
 /// enumerating for potential events existing in our server.
 async fn delay_response() {
-	let time_to_wait = rand::random_range(2..5);
+	let time_to_wait = rand::thread_rng().gen_range(2..5);
 	debug_info!(
 		"Got successful /report request, waiting {time_to_wait} seconds before sending \
 		 successful response."
--- a/src/api/client/room/event.rs
+++ b/src/api/client/room/event.rs
@@ -29,7 +29,7 @@ pub(crate) async fn get_room_event_route(

 	let (mut event, visible) = try_join(event, visible).await?;

-	if !visible || is_ignored_pdu(services, &event, body.sender_user()).await? {
+	if !visible || is_ignored_pdu(services, &event, body.sender_user()).await {
 		return Err!(Request(Forbidden("You don't have permission to view this event.")));
 	}

--- a/src/api/client/send.rs
+++ b/src/api/client/send.rs
@@ -50,8 +50,8 @@ pub(crate) async fn send_message_event_route(

 	// Check if this is a new transaction id
 	if let Ok(response) = services
-		.transactions
-		.get_client_txn(sender_user, sender_device, &body.txn_id)
+		.transaction_ids
+		.existing_txnid(sender_user, sender_device, &body.txn_id)
 		.await
 	{
 		// The client might have sent a txnid of the /sendToDevice endpoint
@@ -92,7 +92,7 @@ pub(crate) async fn send_message_event_route(
 		)
 		.await?;

-	services.transactions.add_client_txnid(
+	services.transaction_ids.add_txnid(
 		sender_user,
 		sender_device,
 		&body.txn_id,
--- a/src/api/client/session.rs
+++ b/src/api/client/session.rs
@@ -107,7 +107,7 @@ pub(super) async fn ldap_login(
 ) -> Result<OwnedUserId> {
 	let (user_dn, is_ldap_admin) = match services.config.ldap.bind_dn.as_ref() {
 		| Some(bind_dn) if bind_dn.contains("{username}") =>
-			(bind_dn.replace("{username}", lowercased_user_id.localpart()), None),
+			(bind_dn.replace("{username}", lowercased_user_id.localpart()), false),
 		| _ => {
 			debug!("Searching user in LDAP");

@@ -144,16 +144,12 @@ pub(super) async fn ldap_login(
 			.await?;
 	}

-	// Only sync admin status if LDAP can actually determine it.
-	// None means LDAP cannot determine admin status (manual config required).
-	if let Some(is_ldap_admin) = is_ldap_admin {
-		let is_conduwuit_admin = services.admin.user_is_admin(lowercased_user_id).await;
+	let is_conduwuit_admin = services.admin.user_is_admin(lowercased_user_id).await;

-		if is_ldap_admin && !is_conduwuit_admin {
-			Box::pin(services.admin.make_user_admin(lowercased_user_id)).await?;
-		} else if !is_ldap_admin && is_conduwuit_admin {
-			Box::pin(services.admin.revoke_admin(lowercased_user_id)).await?;
-		}
+	if is_ldap_admin && !is_conduwuit_admin {
+		Box::pin(services.admin.make_user_admin(lowercased_user_id)).await?;
+	} else if !is_ldap_admin && is_conduwuit_admin {
+		Box::pin(services.admin.revoke_admin(lowercased_user_id)).await?;
 	}

 	Ok(user_id)
--- a/src/api/client/state.rs
+++ b/src/api/client/state.rs
@@ -342,10 +342,10 @@ async fn allowed_to_send_state_event(
 					}

 					for alias in aliases {
-						let (alias_room_id, _) = services
+						let (alias_room_id, _servers) = services
 							.rooms
 							.alias
-							.resolve_alias(&alias)
+							.resolve_alias(&alias, None)
 							.await
 							.map_err(|e| {
 								err!(Request(Unknown("Failed resolving alias \"{alias}\": {e}")))
--- a/src/api/client/sync/v5.rs
+++ b/src/api/client/sync/v5.rs
@@ -30,8 +30,7 @@
 	api::client::sync::sync_events::{self, DeviceLists, UnreadNotificationsCount},
 	directory::RoomTypeFilter,
 	events::{
-		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, AnySyncStateEvent, StateEventType,
-		TimelineEventType,
+		AnyRawAccountDataEvent, AnySyncEphemeralRoomEvent, StateEventType, TimelineEventType,
 		room::member::{MembershipState, RoomMemberEventContent},
 		typing::TypingEventContent,
 	},
@@ -534,9 +533,6 @@ async fn process_rooms<'a, Rooms>(
 				}
 			});

-		let required_state =
-			collect_required_state(services, room_id, required_state_request).await;
-
 		let room_events: Vec<_> = timeline_pdus
 			.iter()
 			.stream()
@@ -555,6 +551,21 @@ async fn process_rooms<'a, Rooms>(
 			}
 		}

+		let required_state = required_state_request
+			.iter()
+			.stream()
+			.filter_map(|state| async move {
+				services
+					.rooms
+					.state_accessor
+					.room_state_get(room_id, &state.0, &state.1)
+					.await
+					.map(Event::into_format)
+					.ok()
+			})
+			.collect()
+			.await;
+
 		// Heroes
 		let heroes: Vec<_> = services
 			.rooms
@@ -678,51 +689,6 @@ async fn process_rooms<'a, Rooms>(
 	Ok(rooms)
 }

-/// Collect the required state events for a room
-async fn collect_required_state(
-	services: &Services,
-	room_id: &RoomId,
-	required_state_request: &BTreeSet<TypeStateKey>,
-) -> Vec<Raw<AnySyncStateEvent>> {
-	let mut required_state = Vec::new();
-	let mut wildcard_types: HashSet<&StateEventType> = HashSet::new();
-
-	for (event_type, state_key) in required_state_request {
-		if wildcard_types.contains(event_type) {
-			continue;
-		}
-
-		if state_key.as_str() == "*" {
-			wildcard_types.insert(event_type);
-			if let Ok(keys) = services
-				.rooms
-				.state_accessor
-				.room_state_keys(room_id, event_type)
-				.await
-			{
-				for key in keys {
-					if let Ok(event) = services
-						.rooms
-						.state_accessor
-						.room_state_get(room_id, event_type, &key)
-						.await
-					{
-						required_state.push(Event::into_format(event));
-					}
-				}
-			}
-		} else if let Ok(event) = services
-			.rooms
-			.state_accessor
-			.room_state_get(room_id, event_type, state_key)
-			.await
-		{
-			required_state.push(Event::into_format(event));
-		}
-	}
-	required_state
-}
-
 async fn collect_typing_events(
 	services: &Services,
 	sender_user: &UserId,
--- a/src/api/client/to_device.rs
+++ b/src/api/client/to_device.rs
@@ -26,8 +26,8 @@ pub(crate) async fn send_event_to_device_route(

 	// Check if this is a new transaction id
 	if services
-		.transactions
-		.get_client_txn(sender_user, sender_device, &body.txn_id)
+		.transaction_ids
+		.existing_txnid(sender_user, sender_device, &body.txn_id)
 		.await
 		.is_ok()
 	{
@@ -104,8 +104,8 @@ pub(crate) async fn send_event_to_device_route(

 	// Save transaction id with empty data
 	services
-		.transactions
-		.add_client_txnid(sender_user, sender_device, &body.txn_id, &[]);
+		.transaction_ids
+		.add_txnid(sender_user, sender_device, &body.txn_id, &[]);

 	Ok(send_event_to_device::v3::Response {})
 }
--- a/src/api/client/well_known.rs
+++ b/src/api/client/well_known.rs
@@ -27,7 +27,6 @@ pub(crate) async fn well_known_client(
 		identity_server: None,
 		sliding_sync_proxy: Some(SlidingSyncProxyInfo { url: client_url }),
 		tile_server: None,
-		rtc_foci: services.config.well_known.rtc_focus_server_urls.clone(),
 	})
 }

--- a/src/api/router.rs
+++ b/src/api/router.rs
@@ -122,23 +122,23 @@ pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 		// Ruma doesn't have support for multiple paths for a single endpoint yet, and these routes
 		// share one Ruma request / response type pair with {get,send}_state_event_for_key_route
 		.route(
-			"/_matrix/client/r0/rooms/{room_id}/state/{event_type}",
+			"/_matrix/client/r0/rooms/:room_id/state/:event_type",
 			get(client::get_state_events_for_empty_key_route)
 				.put(client::send_state_event_for_empty_key_route),
 		)
 		.route(
-			"/_matrix/client/v3/rooms/{room_id}/state/{event_type}",
+			"/_matrix/client/v3/rooms/:room_id/state/:event_type",
 			get(client::get_state_events_for_empty_key_route)
 				.put(client::send_state_event_for_empty_key_route),
 		)
 		// These two endpoints allow trailing slashes
 		.route(
-			"/_matrix/client/r0/rooms/{room_id}/state/{event_type}/",
+			"/_matrix/client/r0/rooms/:room_id/state/:event_type/",
 			get(client::get_state_events_for_empty_key_route)
 				.put(client::send_state_event_for_empty_key_route),
 		)
 		.route(
-			"/_matrix/client/v3/rooms/{room_id}/state/{event_type}/",
+			"/_matrix/client/v3/rooms/:room_id/state/:event_type/",
 			get(client::get_state_events_for_empty_key_route)
 				.put(client::send_state_event_for_empty_key_route),
 		)
@@ -177,7 +177,7 @@ pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 		.ruma_route(&client::get_mutual_rooms_route)
 		.ruma_route(&client::get_room_summary)
 		.route(
-			"/_matrix/client/unstable/im.nheko.summary/rooms/{room_id_or_alias}/summary",
+			"/_matrix/client/unstable/im.nheko.summary/rooms/:room_id_or_alias/summary",
 			get(client::get_room_summary_legacy)
 		)
 		.ruma_route(&client::get_suspended_status)
@@ -196,7 +196,7 @@ pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 			.ruma_route(&server::get_server_version_route)
 			.route("/_matrix/key/v2/server", get(server::get_server_keys_route))
 			.route(
-				"/_matrix/key/v2/server/{key_id}",
+				"/_matrix/key/v2/server/:key_id",
 				get(server::get_server_keys_deprecated_route),
 			)
 			.ruma_route(&server::get_public_rooms_route)
@@ -232,9 +232,9 @@ pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 			.route("/_continuwuity/local_user_count", get(client::conduwuit_local_user_count));
 	} else {
 		router = router
-			.route("/_matrix/federation/{*path}", any(federation_disabled))
+			.route("/_matrix/federation/*path", any(federation_disabled))
 			.route("/.well-known/matrix/server", any(federation_disabled))
-			.route("/_matrix/key/{*path}", any(federation_disabled))
+			.route("/_matrix/key/*path", any(federation_disabled))
 			.route("/_conduwuit/local_user_count", any(federation_disabled))
 			.route("/_continuwuity/local_user_count", any(federation_disabled));
 	}
@@ -253,27 +253,27 @@ pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 				get(client::get_media_preview_legacy_legacy_route),
 			)
 			.route(
-				"/_matrix/media/v1/download/{server_name}/{media_id}",
+				"/_matrix/media/v1/download/:server_name/:media_id",
 				get(client::get_content_legacy_legacy_route),
 			)
 			.route(
-				"/_matrix/media/v1/download/{server_name}/{media_id}/{file_name}",
+				"/_matrix/media/v1/download/:server_name/:media_id/:file_name",
 				get(client::get_content_as_filename_legacy_legacy_route),
 			)
 			.route(
-				"/_matrix/media/v1/thumbnail/{server_name}/{media_id}",
+				"/_matrix/media/v1/thumbnail/:server_name/:media_id",
 				get(client::get_content_thumbnail_legacy_legacy_route),
 			);
 	} else {
 		router = router
-			.route("/_matrix/media/v1/{*path}", any(legacy_media_disabled))
+			.route("/_matrix/media/v1/*path", any(legacy_media_disabled))
 			.route("/_matrix/media/v3/config", any(legacy_media_disabled))
-			.route("/_matrix/media/v3/download/{*path}", any(legacy_media_disabled))
-			.route("/_matrix/media/v3/thumbnail/{*path}", any(legacy_media_disabled))
+			.route("/_matrix/media/v3/download/*path", any(legacy_media_disabled))
+			.route("/_matrix/media/v3/thumbnail/*path", any(legacy_media_disabled))
 			.route("/_matrix/media/v3/preview_url", any(redirect_legacy_preview))
 			.route("/_matrix/media/r0/config", any(legacy_media_disabled))
-			.route("/_matrix/media/r0/download/{*path}", any(legacy_media_disabled))
-			.route("/_matrix/media/r0/thumbnail/{*path}", any(legacy_media_disabled))
+			.route("/_matrix/media/r0/download/*path", any(legacy_media_disabled))
+			.route("/_matrix/media/r0/thumbnail/*path", any(legacy_media_disabled))
 			.route("/_matrix/media/r0/preview_url", any(redirect_legacy_preview));
 	}

--- a/src/api/router/args.rs
+++ b/src/api/router/args.rs
@@ -1,5 +1,6 @@
 use std::{mem, ops::Deref};

+use async_trait::async_trait;
 use axum::{body::Body, extract::FromRequest};
 use bytes::{BufMut, Bytes, BytesMut};
 use conduwuit::{Error, Result, debug, debug_warn, err, trace, utils::string::EMPTY};
@@ -78,6 +79,7 @@ impl<T> Deref for Args<T>
 	fn deref(&self) -> &Self::Target { &self.body }
 }

+#[async_trait]
 impl<T> FromRequest<State, Body> for Args<T>
 where
 	T: IncomingRequest + Send + Sync + 'static,
--- a/src/api/router/auth.rs
+++ b/src/api/router/auth.rs
@@ -14,8 +14,7 @@
 	pin_mut,
 };
 use ruma::{
-	CanonicalJsonObject, CanonicalJsonValue, DeviceId, OwnedDeviceId, OwnedServerName,
-	OwnedUserId, UserId,
+	CanonicalJsonObject, CanonicalJsonValue, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 	api::{
 		AuthScheme, IncomingRequest, Metadata,
 		client::{
@@ -55,8 +54,7 @@ pub(super) async fn auth(
 	json_body: Option<&CanonicalJsonValue>,
 	metadata: &Metadata,
 ) -> Result<Auth> {
-	let bearer: Option<TypedHeader<Authorization<Bearer>>> =
-		request.parts.extract().await.unwrap_or(None);
+	let bearer: Option<TypedHeader<Authorization<Bearer>>> = request.parts.extract().await?;
 	let token = match &bearer {
 		| Some(TypedHeader(Authorization(bearer))) => Some(bearer.token()),
 		| None => request.query.access_token.as_deref(),
@@ -235,33 +233,10 @@ async fn auth_appservice(
 		return Err!(Request(Exclusive("User is not in namespace.")));
 	}

-	// MSC3202/MSC4190: Handle device_id masquerading for appservices.
-	// The device_id can be provided via `device_id` or
-	// `org.matrix.msc3202.device_id` query parameter.
-	let sender_device = if let Some(ref device_id_str) = request.query.device_id {
-		let device_id: &DeviceId = device_id_str.as_str().into();
-
-		// Verify the device exists for this user
-		if services
-			.users
-			.get_device_metadata(&user_id, device_id)
-			.await
-			.is_err()
-		{
-			return Err!(Request(Forbidden(
-				"Device does not exist for user or appservice cannot masquerade as this device."
-			)));
-		}
-
-		Some(device_id.to_owned())
-	} else {
-		None
-	};
-
 	Ok(Auth {
 		origin: None,
 		sender_user: Some(user_id),
-		sender_device,
+		sender_device: None,
 		appservice_info: Some(*info),
 	})
 }
--- a/src/api/router/request.rs
+++ b/src/api/router/request.rs
@@ -11,10 +11,6 @@
 pub(super) struct QueryParams {
 	pub(super) access_token: Option<String>,
 	pub(super) user_id: Option<String>,
-	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
-	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
-	#[serde(alias = "org.matrix.msc3202.device_id")]
-	pub(super) device_id: Option<String>,
 }

 pub(super) struct Request {
--- a/src/api/server/get_missing_events.rs
+++ b/src/api/server/get_missing_events.rs
@@ -1,9 +1,6 @@
-use std::collections::{HashSet, VecDeque};
-
 use axum::extract::State;
-use conduwuit::{Err, Event, Result, debug, info, trace, utils::to_canonical_object, warn};
-use ruma::{OwnedEventId, api::federation::event::get_missing_events};
-use serde_json::{json, value::RawValue};
+use conduwuit::{Err, Result, debug, debug_error, info, utils::to_canonical_object};
+use ruma::api::federation::event::get_missing_events;

 use super::AccessCheck;
 use crate::Ruma;
@@ -48,76 +45,59 @@ pub(crate) async fn get_missing_events_route(
 		.unwrap_or(LIMIT_DEFAULT)
 		.min(LIMIT_MAX);

-	let room_version = services.rooms.state.get_room_version(&body.room_id).await?;
+	let mut queued_events = body.latest_events.clone();
+	// the vec will never have more entries the limit
+	let mut events = Vec::with_capacity(limit);

-	let mut queue: VecDeque<OwnedEventId> = VecDeque::from(body.latest_events.clone());
-	let mut results: Vec<Box<RawValue>> = Vec::with_capacity(limit);
-	let mut seen: HashSet<OwnedEventId> = HashSet::from_iter(body.earliest_events.clone());
-
-	while let Some(next_event_id) = queue.pop_front() {
-		if seen.contains(&next_event_id) {
-			trace!(%next_event_id, "already seen event, skipping");
+	let mut i: usize = 0;
+	while i < queued_events.len() && events.len() < limit {
+		let Ok(pdu) = services.rooms.timeline.get_pdu(&queued_events[i]).await else {
+			debug!(
+				body.origin = body.origin.as_ref().map(tracing::field::display),
+				"Event {} does not exist locally, skipping", &queued_events[i]
+			);
+			i = i.saturating_add(1);
 			continue;
-		}
-
-		if results.len() >= limit {
-			debug!(%next_event_id, "reached limit of events to return, breaking");
-			break;
-		}
-
-		let mut pdu = match services.rooms.timeline.get_pdu(&next_event_id).await {
-			| Ok(pdu) => pdu,
-			| Err(e) => {
-				warn!("could not find event {next_event_id} while walking missing events: {e}");
-				continue;
-			},
 		};
-		if pdu.room_id_or_hash() != body.room_id {
-			return Err!(Request(Unknown(
-				"Event {next_event_id} is not in room {}",
-				body.room_id
-			)));
+
+		if body.earliest_events.contains(&queued_events[i]) {
+			i = i.saturating_add(1);
+			continue;
 		}

 		if !services
 			.rooms
 			.state_accessor
-			.server_can_see_event(body.origin(), &body.room_id, pdu.event_id())
+			.server_can_see_event(body.origin(), &body.room_id, &queued_events[i])
 			.await
 		{
-			debug!(%next_event_id, origin = %body.origin(), "redacting event origin cannot see");
-			pdu.redact(&room_version, json!({}))?;
+			debug!(
+				body.origin = body.origin.as_ref().map(tracing::field::display),
+				"Server cannot see {:?} in {:?}, skipping", pdu.event_id, pdu.room_id
+			);
+			i = i.saturating_add(1);
+			continue;
 		}

-		trace!(
-			%next_event_id,
-			prev_events = ?pdu.prev_events().collect::<Vec<_>>(),
-			"adding event to results and queueing prev events"
-		);
-		queue.extend(pdu.prev_events.clone());
-		seen.insert(next_event_id.clone());
-		if body.latest_events.contains(&next_event_id) {
-			continue; // Don't include latest_events in results,
-			// but do include their prev_events in the queue
-		}
-		results.push(
-			services
-				.sending
-				.convert_to_outgoing_federation_event(to_canonical_object(pdu)?)
-				.await,
-		);
-		trace!(
-			%next_event_id,
-			queue_len = queue.len(),
-			seen_len = seen.len(),
-			results_len = results.len(),
-			"event added to results"
-		);
+		i = i.saturating_add(1);
+		let Ok(event) = to_canonical_object(&pdu) else {
+			debug_error!(
+				body.origin = body.origin.as_ref().map(tracing::field::display),
+				"Failed to convert PDU in database to canonical JSON: {pdu:?}"
+			);
+			continue;
+		};
+
+		let prev_events = pdu.prev_events.iter().map(ToOwned::to_owned);
+
+		let event = services
+			.sending
+			.convert_to_outgoing_federation_event(event)
+			.await;
+
+		queued_events.extend(prev_events);
+		events.push(event);
 	}

-	if !queue.is_empty() {
-		debug!("limit reached before queue was empty");
-	}
-	results.reverse(); // return oldest first
-	Ok(get_missing_events::v1::Response { events: results })
+	Ok(get_missing_events::v1::Response { events })
 }
--- a/src/api/server/invite.rs
+++ b/src/api/server/invite.rs
@@ -2,7 +2,7 @@
 use axum_client_ip::InsecureClientIp;
 use base64::{Engine as _, engine::general_purpose};
 use conduwuit::{
-	Err, Error, PduEvent, Result, err, error,
+	Err, Error, PduEvent, Result, err,
 	matrix::{Event, event::gen_event_id},
 	utils::{self, hash::sha256},
 	warn,
@@ -199,27 +199,20 @@ pub(crate) async fn create_invite_route(

 		for appservice in services.appservice.read().await.values() {
 			if appservice.is_user_match(&recipient_user) {
-				let request = ruma::api::appservice::event::push_events::v1::Request {
-					events: vec![pdu.to_format()],
-					txn_id: general_purpose::URL_SAFE_NO_PAD
-						.encode(sha256::hash(pdu.event_id.as_bytes()))
-						.into(),
-					ephemeral: Vec::new(),
-					to_device: Vec::new(),
-				};
 				services
 					.sending
-					.send_appservice_request(appservice.registration.clone(), request)
-					.await
-					.map_err(|e| {
-						error!(
-							"failed to notify appservice {} about incoming invite: {e}",
-							appservice.registration.id
-						);
-						err!(BadServerResponse(
-							"Failed to notify appservice about incoming invite."
-						))
-					})?;
+					.send_appservice_request(
+						appservice.registration.clone(),
+						ruma::api::appservice::event::push_events::v1::Request {
+							events: vec![pdu.to_format()],
+							txn_id: general_purpose::URL_SAFE_NO_PAD
+								.encode(sha256::hash(pdu.event_id.as_bytes()))
+								.into(),
+							ephemeral: Vec::new(),
+							to_device: Vec::new(),
+						},
+					)
+					.await?;
 			}
 		}
 	}
--- a/src/api/server/make_join.rs
+++ b/src/api/server/make_join.rs
@@ -16,8 +16,6 @@
 	},
 };
 use serde_json::value::to_raw_value;
-use service::rooms::state::RoomMutexGuard;
-use tokio::join;

 use crate::Ruma;

@@ -87,24 +85,16 @@ pub(crate) async fn create_join_event_template_route(
 	}

 	let state_lock = services.rooms.state.mutex.lock(&body.room_id).await;
-	let (is_invited, is_joined) = join!(
-		services
-			.rooms
-			.state_cache
-			.is_invited(&body.user_id, &body.room_id),
-		services
-			.rooms
-			.state_cache
-			.is_joined(&body.user_id, &body.room_id)
-	);
+	let is_invited = services
+		.rooms
+		.state_cache
+		.is_invited(&body.user_id, &body.room_id)
+		.await;
 	let join_authorized_via_users_server: Option<OwnedUserId> = {
 		use RoomVersionId::*;
-		if is_joined || is_invited {
-			// User is already joined or invited and consequently does not need an
-			// authorising user
-			None
-		} else if matches!(room_version_id, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
-			// room version does not support restricted join rules
+		if matches!(room_version_id, V1 | V2 | V3 | V4 | V5 | V6 | V7) || is_invited {
+			// room version does not support restricted join rules, or the user is currently
+			// already invited
 			None
 		} else if user_can_perform_restricted_join(
 			&services,
@@ -114,10 +104,32 @@ pub(crate) async fn create_join_event_template_route(
 		)
 		.await?
 		{
-			Some(
-				select_authorising_user(&services, &body.room_id, &body.user_id, &state_lock)
-					.await?,
-			)
+			let Some(auth_user) = services
+				.rooms
+				.state_cache
+				.local_users_in_room(&body.room_id)
+				.filter(|user| {
+					services.rooms.state_accessor.user_can_invite(
+						&body.room_id,
+						user,
+						&body.user_id,
+						&state_lock,
+					)
+				})
+				.boxed()
+				.next()
+				.await
+				.map(ToOwned::to_owned)
+			else {
+				info!(
+					"No local user is able to authorize the join of {} into {}",
+					&body.user_id, &body.room_id
+				);
+				return Err!(Request(UnableToGrantJoin(
+					"No user on this server is able to assist in joining."
+				)));
+			};
+			Some(auth_user)
 		} else {
 			None
 		}
@@ -147,7 +159,9 @@ pub(crate) async fn create_join_event_template_route(
 		)
 		.await?;
 	drop(state_lock);
-	pdu_json.remove("event_id");
+
+	// room v3 and above removed the "event_id" field from remote PDU format
+	maybe_strip_event_id(&mut pdu_json, &room_version_id)?;

 	Ok(prepare_join_event::v1::Response {
 		room_version: Some(room_version_id),
@@ -155,38 +169,6 @@ pub(crate) async fn create_join_event_template_route(
 	})
 }

-/// Attempts to find a user who is able to issue an invite in the target room.
-pub(crate) async fn select_authorising_user(
-	services: &Services,
-	room_id: &RoomId,
-	user_id: &UserId,
-	state_lock: &RoomMutexGuard,
-) -> Result<OwnedUserId> {
-	let auth_user = services
-		.rooms
-		.state_cache
-		.local_users_in_room(room_id)
-		.filter(|user| {
-			services
-				.rooms
-				.state_accessor
-				.user_can_invite(room_id, user, user_id, state_lock)
-		})
-		.boxed()
-		.next()
-		.await
-		.map(ToOwned::to_owned);
-
-	match auth_user {
-		| Some(auth_user) => Ok(auth_user),
-		| None => {
-			Err!(Request(UnableToGrantJoin(
-				"No user on this server is able to assist in joining."
-			)))
-		},
-	}
-}
-
 /// Checks whether the given user can join the given room via a restricted join.
 pub(crate) async fn user_can_perform_restricted_join(
 	services: &Services,
@@ -198,9 +180,12 @@ pub(crate) async fn user_can_perform_restricted_join(

 	// restricted rooms are not supported on <=v7
 	if matches!(room_version_id, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
-		// This should be impossible as it was checked earlier on, but retain this check
-		// for safety.
-		unreachable!("user_can_perform_restricted_join got incompatible room version");
+		return Ok(false);
+	}
+
+	if services.rooms.state_cache.is_joined(user_id, room_id).await {
+		// joining user is already joined, there is nothing we need to do
+		return Ok(false);
 	}

 	let Ok(join_rules_event_content) = services
@@ -220,31 +205,17 @@ pub(crate) async fn user_can_perform_restricted_join(
 	let (JoinRule::Restricted(r) | JoinRule::KnockRestricted(r)) =
 		join_rules_event_content.join_rule
 	else {
-		// This is not a restricted room
 		return Ok(false);
 	};

 	if r.allow.is_empty() {
-		// This will never be authorisable, return forbidden.
-		return Err!(Request(Forbidden("You are not invited to this room.")));
+		debug_info!("{room_id} is restricted but the allow key is empty");
+		return Ok(false);
 	}

-	let mut could_satisfy = true;
 	for allow_rule in &r.allow {
 		match allow_rule {
 			| AllowRule::RoomMembership(membership) => {
-				if !services
-					.rooms
-					.state_cache
-					.server_in_room(services.globals.server_name(), &membership.room_id)
-					.await
-				{
-					// Since we can't check this room, mark could_satisfy as false
-					// so that we can return M_UNABLE_TO_AUTHORIZE_JOIN later.
-					could_satisfy = false;
-					continue;
-				}
-
 				if services
 					.rooms
 					.state_cache
@@ -268,8 +239,6 @@ pub(crate) async fn user_can_perform_restricted_join(
 					| Err(_) => Err!(Request(Forbidden("Antispam rejected join request."))),
 				},
 			| _ => {
-				// We don't recognise this join rule, so we cannot satisfy the request.
-				could_satisfy = false;
 				debug_info!(
 					"Unsupported allow rule in restricted join for room {}: {:?}",
 					room_id,
@@ -279,23 +248,9 @@ pub(crate) async fn user_can_perform_restricted_join(
 		}
 	}

-	if could_satisfy {
-		// We were able to check all the restrictions and can be certain that the
-		// prospective member is not permitted to join.
-		Err!(Request(Forbidden(
-			"You do not belong to any of the rooms or spaces required to join this room."
-		)))
-	} else {
-		// We were unable to check all the restrictions. This usually means we aren't in
-		// one of the rooms this one is restricted to, ergo can't check its state for
-		// the user's membership, and consequently the user *might* be able to join if
-		// they ask another server.
-		Err!(Request(UnableToAuthorizeJoin(
-			"You do not belong to any of the recognised rooms or spaces required to join this \
-			 room, but this server is unable to verify every requirement. You may be able to \
-			 join via another server."
-		)))
-	}
+	Err!(Request(UnableToAuthorizeJoin(
+		"Joining user is not known to be in any required room."
+	)))
 }

 pub(crate) fn maybe_strip_event_id(
--- a/src/api/server/query.rs
+++ b/src/api/server/query.rs
@@ -40,7 +40,7 @@ pub(crate) async fn get_room_information_route(
 	servers.sort_unstable();
 	servers.dedup();

-	servers.shuffle(&mut rand::rng());
+	servers.shuffle(&mut rand::thread_rng());

 	// insert our server as the very first choice if in list
 	if let Some(server_index) = servers
--- a/src/api/server/send.rs
+++ b/src/api/server/send.rs
@@ -1,33 +1,27 @@
-use std::{
-	collections::{BTreeMap, HashMap, HashSet},
-	net::IpAddr,
-	time::{Duration, Instant},
-};
+use std::{collections::BTreeMap, net::IpAddr, time::Instant};

 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
 use conduwuit::{
 	Err, Error, Result, debug, debug_warn, err, error,
 	result::LogErr,
-	state_res::lexicographical_topological_sort,
 	trace,
 	utils::{
 		IterStream, ReadyExt, millis_since_unix_epoch,
 		stream::{BroadbandExt, TryBroadbandExt, automatic_width},
 	},
+	warn,
 };
 use conduwuit_service::{
 	Services,
 	sending::{EDU_LIMIT, PDU_LIMIT},
 };
 use futures::{FutureExt, Stream, StreamExt, TryFutureExt, TryStreamExt};
-use http::StatusCode;
 use itertools::Itertools;
 use ruma::{
-	CanonicalJsonObject, MilliSecondsSinceUnixEpoch, OwnedEventId, OwnedRoomId, OwnedUserId,
-	RoomId, ServerName, UserId,
+	CanonicalJsonObject, OwnedEventId, OwnedRoomId, OwnedUserId, RoomId, ServerName, UserId,
 	api::{
-		client::error::{ErrorKind, ErrorKind::LimitExceeded},
+		client::error::ErrorKind,
 		federation::transactions::{
 			edu::{
 				DeviceListUpdateContent, DirectDeviceContent, Edu, PresenceContent,
@@ -38,16 +32,9 @@
 		},
 	},
 	events::receipt::{ReceiptEvent, ReceiptEventContent, ReceiptType},
-	int,
 	serde::Raw,
 	to_device::DeviceIdOrAllDevices,
-	uint,
 };
-use service::transactions::{
-	FederationTxnState, TransactionError, TxnKey, WrappedTransactionResponse,
-};
-use tokio::sync::watch::{Receiver, Sender};
-use tracing::instrument;

 use crate::Ruma;

@@ -57,6 +44,15 @@
 /// # `PUT /_matrix/federation/v1/send/{txnId}`
 ///
 /// Push EDUs and PDUs to this server.
+#[tracing::instrument(
+	name = "txn",
+	level = "debug",
+	skip_all,
+	fields(
+		%client,
+		origin = body.origin().as_str()
+	),
+)]
 pub(crate) async fn send_transaction_message_route(
 	State(services): State<crate::State>,
 	InsecureClientIp(client): InsecureClientIp,
@@ -80,73 +76,16 @@ pub(crate) async fn send_transaction_message_route(
 		)));
 	}

-	let txn_key = (body.origin().to_owned(), body.transaction_id.clone());
-
-	// Atomically check cache, join active, or start new transaction
-	match services
-		.transactions
-		.get_or_start_federation_txn(txn_key.clone())?
-	{
-		| FederationTxnState::Cached(response) => {
-			// Already responded
-			Ok(response)
-		},
-		| FederationTxnState::Active(receiver) => {
-			// Another thread is processing
-			wait_for_result(receiver).await
-		},
-		| FederationTxnState::Started { receiver, sender } => {
-			// We're the first, spawn the processing task
-			services
-				.server
-				.runtime()
-				.spawn(process_inbound_transaction(services, body, client, txn_key, sender));
-			// and wait for it
-			wait_for_result(receiver).await
-		},
-	}
-}
-
-async fn wait_for_result(
-	mut recv: Receiver<WrappedTransactionResponse>,
-) -> Result<send_transaction_message::v1::Response> {
-	if tokio::time::timeout(Duration::from_secs(50), recv.changed())
-		.await
-		.is_err()
-	{
-		// Took too long, return 429 to encourage the sender to try again
-		return Err(Error::BadRequest(
-			LimitExceeded { retry_after: None },
-			"Transaction is being still being processed. Please try again later.",
-		));
-	}
-	let value = recv.borrow_and_update();
-	match value.clone() {
-		| Some(Ok(response)) => Ok(response),
-		| Some(Err(err)) => Err(transaction_error_to_response(&err)),
-		| None => Err(Error::Request(
-			ErrorKind::Unknown,
-			"Transaction processing failed unexpectedly".into(),
-			StatusCode::INTERNAL_SERVER_ERROR,
-		)),
-	}
-}
-
-#[instrument(
-	skip_all,
-	fields(
-		id = ?body.transaction_id.as_str(),
-		origin = ?body.origin()
-	)
-)]
-async fn process_inbound_transaction(
-	services: crate::State,
-	body: Ruma<send_transaction_message::v1::Request>,
-	client: IpAddr,
-	txn_key: TxnKey,
-	sender: Sender<WrappedTransactionResponse>,
-) {
 	let txn_start_time = Instant::now();
+	trace!(
+		pdus = body.pdus.len(),
+		edus = body.edus.len(),
+		elapsed = ?txn_start_time.elapsed(),
+		id = %body.transaction_id,
+		origin = %body.origin(),
+		"Starting txn",
+	);
+
 	let pdus = body
 		.pdus
 		.iter()
@@ -163,79 +102,40 @@ async fn process_inbound_transaction(
 		.filter_map(Result::ok)
 		.stream();

-	debug!(pdus = body.pdus.len(), edus = body.edus.len(), "Processing transaction",);
-	let results = match handle(&services, &client, body.origin(), pdus, edus).await {
-		| Ok(results) => results,
-		| Err(err) => {
-			fail_federation_txn(services, &txn_key, &sender, err);
-			return;
-		},
-	};
-
-	for (id, result) in &results {
-		if let Err(e) = result {
-			if matches!(e, Error::BadRequest(ErrorKind::NotFound, _)) {
-				debug_warn!("Incoming PDU failed {id}: {e:?}");
-			}
-		}
-	}
+	let results = handle(&services, &client, body.origin(), txn_start_time, pdus, edus).await?;

 	debug!(
 		pdus = body.pdus.len(),
 		edus = body.edus.len(),
 		elapsed = ?txn_start_time.elapsed(),
-		"Finished processing transaction"
+		id = %body.transaction_id,
+		origin = %body.origin(),
+		"Finished txn",
 	);
+	for (id, result) in &results {
+		if let Err(e) = result {
+			if matches!(e, Error::BadRequest(ErrorKind::NotFound, _)) {
+				warn!("Incoming PDU failed {id}: {e:?}");
+			}
+		}
+	}

-	let response = send_transaction_message::v1::Response {
+	Ok(send_transaction_message::v1::Response {
 		pdus: results
 			.into_iter()
 			.map(|(e, r)| (e, r.map_err(error::sanitized_message)))
 			.collect(),
-	};
-
-	services
-		.transactions
-		.finish_federation_txn(txn_key, sender, response);
+	})
 }

-/// Handles a failed federation transaction by sending the error through
-/// the channel and cleaning up the transaction state. This allows waiters to
-/// receive an appropriate error response.
-fn fail_federation_txn(
-	services: crate::State,
-	txn_key: &TxnKey,
-	sender: &Sender<WrappedTransactionResponse>,
-	err: TransactionError,
-) {
-	debug!("Transaction failed: {err}");
-
-	// Remove from active state so the transaction can be retried
-	services.transactions.remove_federation_txn(txn_key);
-
-	// Send the error to any waiters
-	if let Err(e) = sender.send(Some(Err(err))) {
-		debug_warn!("Failed to send transaction error to receivers: {e}");
-	}
-}
-
-/// Converts a TransactionError into an appropriate HTTP error response.
-fn transaction_error_to_response(err: &TransactionError) -> Error {
-	match err {
-		| TransactionError::ShuttingDown => Error::Request(
-			ErrorKind::Unknown,
-			"Server is shutting down, please retry later".into(),
-			StatusCode::SERVICE_UNAVAILABLE,
-		),
-	}
-}
 async fn handle(
 	services: &Services,
 	client: &IpAddr,
 	origin: &ServerName,
+	started: Instant,
 	pdus: impl Stream<Item = Pdu> + Send,
 	edus: impl Stream<Item = Edu> + Send,
-) -> std::result::Result<ResolvedMap, TransactionError> {
+) -> Result<ResolvedMap> {
 	// group pdus by room
 	let pdus = pdus
 		.collect()
@@ -252,7 +152,7 @@ async fn handle(
 		.into_iter()
 		.try_stream()
 		.broad_and_then(|(room_id, pdus): (_, Vec<_>)| {
-			handle_room(services, client, origin, room_id, pdus.into_iter())
+			handle_room(services, client, origin, started, room_id, pdus.into_iter())
 				.map_ok(Vec::into_iter)
 				.map_ok(IterStream::try_stream)
 		})
@@ -269,51 +169,14 @@ async fn handle(
 	Ok(results)
 }

-/// Attempts to build a localised directed acyclic graph out of the given PDUs,
-/// returning them in a topologically sorted order.
-///
-/// This is used to attempt to process PDUs in an order that respects their
-/// dependencies, however it is ultimately the sender's responsibility to send
-/// them in a processable order, so this is just a best effort attempt. It does
-/// not account for power levels or other tie breaks.
-async fn build_local_dag(
-	pdu_map: &HashMap<OwnedEventId, CanonicalJsonObject>,
-) -> Result<Vec<OwnedEventId>> {
-	debug_assert!(pdu_map.len() >= 2, "needless call to build_local_dag with less than 2 PDUs");
-	let mut dag: HashMap<OwnedEventId, HashSet<OwnedEventId>> = HashMap::new();
-
-	for (event_id, value) in pdu_map {
-		let prev_events = value
-			.get("prev_events")
-			.expect("pdu must have prev_events")
-			.as_array()
-			.expect("prev_events must be an array")
-			.iter()
-			.map(|v| {
-				OwnedEventId::parse(v.as_str().expect("prev_events values must be strings"))
-					.expect("prev_events must be valid event IDs")
-			})
-			.collect::<HashSet<OwnedEventId>>();
-
-		dag.insert(event_id.clone(), prev_events);
-	}
-	lexicographical_topological_sort(&dag, &|_| async {
-		// Note: we don't bother fetching power levels because that would massively slow
-		// this function down. This is a best-effort attempt to order events correctly
-		// for processing, however ultimately that should be the sender's job.
-		Ok((int!(0), MilliSecondsSinceUnixEpoch(uint!(0))))
-	})
-	.await
-	.map_err(|e| err!("failed to resolve local graph: {e}"))
-}
-
 async fn handle_room(
 	services: &Services,
 	_client: &IpAddr,
 	origin: &ServerName,
+	txn_start_time: Instant,
 	room_id: OwnedRoomId,
 	pdus: impl Iterator<Item = Pdu> + Send,
-) -> std::result::Result<Vec<(OwnedEventId, Result)>, TransactionError> {
+) -> Result<Vec<(OwnedEventId, Result)>> {
 	let _room_lock = services
 		.rooms
 		.event_handler
@@ -322,40 +185,27 @@ async fn handle_room(
 		.await;

 	let room_id = &room_id;
-	let pdu_map: HashMap<OwnedEventId, CanonicalJsonObject> = pdus
-		.into_iter()
-		.map(|(_, event_id, value)| (event_id, value))
-		.collect();
-	// Try to sort PDUs by their dependencies, but fall back to arbitrary order on
-	// failure (e.g., cycles). This is best-effort; proper ordering is the sender's
-	// responsibility.
-	let sorted_event_ids = if pdu_map.len() >= 2 {
-		build_local_dag(&pdu_map).await.unwrap_or_else(|e| {
-			debug_warn!("Failed to build local DAG for room {room_id}: {e}");
-			pdu_map.keys().cloned().collect()
+	pdus.try_stream()
+		.and_then(|(_, event_id, value)| async move {
+			services.server.check_running()?;
+			let pdu_start_time = Instant::now();
+			let result = services
+				.rooms
+				.event_handler
+				.handle_incoming_pdu(origin, room_id, &event_id, value, true)
+				.await
+				.map(|_| ());
+
+			debug!(
+				pdu_elapsed = ?pdu_start_time.elapsed(),
+				txn_elapsed = ?txn_start_time.elapsed(),
+				"Finished PDU {event_id}",
+			);
+
+			Ok((event_id, result))
 		})
-	} else {
-		pdu_map.keys().cloned().collect()
-	};
-	let mut results = Vec::with_capacity(sorted_event_ids.len());
-	for event_id in sorted_event_ids {
-		let value = pdu_map
-			.get(&event_id)
-			.expect("sorted event IDs must be from the original map")
-			.clone();
-		services
-			.server
-			.check_running()
-			.map_err(|_| TransactionError::ShuttingDown)?;
-		let result = services
-			.rooms
-			.event_handler
-			.handle_incoming_pdu(origin, room_id, &event_id, value, true)
-			.await
-			.map(|_| ());
-		results.push((event_id, result));
-	}
-	Ok(results)
+		.try_collect()
+		.await
 }

 async fn handle_edu(services: &Services, client: &IpAddr, origin: &ServerName, edu: Edu) {
@@ -628,8 +478,8 @@ async fn handle_edu_direct_to_device(

 	// Check if this is a new transaction id
 	if services
-		.transactions
-		.get_client_txn(sender, None, message_id)
+		.transaction_ids
+		.existing_txnid(sender, None, message_id)
 		.await
 		.is_ok()
 	{
@@ -648,8 +498,8 @@ async fn handle_edu_direct_to_device(

 	// Save transaction id with empty data
 	services
-		.transactions
-		.add_client_txnid(sender, None, message_id, &[]);
+		.transaction_ids
+		.add_txnid(sender, None, message_id, &[]);
 }

 async fn handle_edu_direct_to_device_user<Event: Send + Sync>(
--- a/src/core/Cargo.toml
+++ b/src/core/Cargo.toml
@@ -24,9 +24,6 @@ conduwuit_mods = [
 gzip_compression = [
 	"reqwest/gzip",
 ]
-http3 = [
-	"reqwest/http3",
-]
 hardened_malloc = [
 	"dep:hardened_malloc-rs"
 ]
@@ -86,7 +83,6 @@ libloading.optional = true
 log.workspace = true
 num-traits.workspace = true
 rand.workspace = true
-rand_core = { version = "0.6.4", features = ["getrandom"] }
 regex.workspace = true
 reqwest.workspace = true
 ring.workspace = true
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -19,7 +19,7 @@
 use regex::RegexSet;
 use ruma::{
 	OwnedRoomId, OwnedRoomOrAliasId, OwnedServerName, OwnedUserId, RoomVersionId,
-	api::client::discovery::{discover_homeserver::RtcFocusInfo, discover_support::ContactRole},
+	api::client::discovery::discover_support::ContactRole,
 };
 use serde::{Deserialize, de::IgnoredAny};
 use url::Url;
@@ -368,31 +368,6 @@ pub struct Config {
 	#[serde(default = "default_max_fetch_prev_events")]
 	pub max_fetch_prev_events: u16,

-	/// How many incoming federation transactions the server is willing to be
-	/// processing at any given time before it becomes overloaded and starts
-	/// rejecting further transactions until some slots become available.
-	///
-	/// Setting this value too low or too high may result in unstable
-	/// federation, and setting it too high may cause runaway resource usage.
-	///
-	/// default: 150
-	#[serde(default = "default_max_concurrent_inbound_transactions")]
-	pub max_concurrent_inbound_transactions: usize,
-
-	/// Maximum age (in seconds) for cached federation transaction responses.
-	/// Entries older than this will be removed during cleanup.
-	///
-	/// default: 7200 (2 hours)
-	#[serde(default = "default_transaction_id_cache_max_age_secs")]
-	pub transaction_id_cache_max_age_secs: u64,
-
-	/// Maximum number of cached federation transaction responses.
-	/// When the cache exceeds this limit, older entries will be removed.
-	///
-	/// default: 8192
-	#[serde(default = "default_transaction_id_cache_max_entries")]
-	pub transaction_id_cache_max_entries: usize,
-
 	/// Default/base connection timeout (seconds). This is used only by URL
 	/// previews and update/news endpoint checks.
 	///
@@ -584,7 +559,7 @@ pub struct Config {
 	///
 	/// If you would like registration only via token reg, please configure
 	/// `registration_token`.
-	#[serde(default = "true_fn")]
+	#[serde(default)]
 	pub allow_registration: bool,

 	/// If registration is enabled, and this setting is true, new users
@@ -1269,6 +1244,12 @@ pub struct Config {
 	#[serde(default)]
 	pub rocksdb_repair: bool,

+	#[serde(default)]
+	pub rocksdb_read_only: bool,
+
+	#[serde(default)]
+	pub rocksdb_secondary: bool,
+
 	/// Enables idle CPU priority for compaction thread. This is not enabled by
 	/// default to prevent compaction from falling too far behind on busy
 	/// systems.
@@ -1328,33 +1309,26 @@ pub struct Config {

 	/// Allow local (your server only) presence updates/requests.
 	///
-	/// Local presence must be enabled for outgoing presence to function.
-	///
-	/// Note that local presence is not as heavy on the CPU as federated
-	/// presence, but will still become more expensive the more local users you
-	/// have.
+	/// Note that presence on continuwuity is very fast unlike Synapse's. If
+	/// using outgoing presence, this MUST be enabled.
 	#[serde(default = "true_fn")]
 	pub allow_local_presence: bool,

-	/// Allow incoming federated presence updates.
+	/// Allow incoming federated presence updates/requests.
 	///
-	/// This option enables processing inbound presence updates from other
-	/// servers. Without it, remote users will appear as if they are always
-	/// offline to your local users. This does not affect typing indicators or
-	/// read receipts.
+	/// This option receives presence updates from other servers, but does not
+	/// send any unless `allow_outgoing_presence` is true. Note that presence on
+	/// continuwuity is very fast unlike Synapse's.
 	#[serde(default = "true_fn")]
 	pub allow_incoming_presence: bool,

 	/// Allow outgoing presence updates/requests.
 	///
-	/// This option sends presence updates to other servers, and requires that
-	/// `allow_local_presence` is also enabled.
-	///
-	/// Note that outgoing presence is very heavy on the CPU and network, and
-	/// will typically cause extreme strain and slowdowns for no real benefit.
-	/// There are only a few clients that even implement presence, so you
-	/// probably don't want to enable this.
-	#[serde(default)]
+	/// This option sends presence updates to other servers, but does not
+	/// receive any unless `allow_incoming_presence` is true. Note that presence
+	/// on continuwuity is very fast unlike Synapse's. If using outgoing
+	/// presence, you MUST enable `allow_local_presence` as well.
+	#[serde(default = "true_fn")]
 	pub allow_outgoing_presence: bool,

 	/// How many seconds without presence updates before you become idle.
@@ -1392,10 +1366,6 @@ pub struct Config {
 	pub allow_incoming_read_receipts: bool,

 	/// Allow sending read receipts to remote servers.
-	///
-	/// Note that sending read receipts to remote servers in large rooms with
-	/// lots of other homeservers may cause additional strain on the CPU and
-	/// network.
 	#[serde(default = "true_fn")]
 	pub allow_outgoing_read_receipts: bool,

@@ -1407,10 +1377,6 @@ pub struct Config {
 	pub allow_local_typing: bool,

 	/// Allow outgoing typing updates to federation.
-	///
-	/// Note that sending typing indicators to remote servers in large rooms
-	/// with lots of other homeservers may cause additional strain on the CPU
-	/// and network.
 	#[serde(default = "true_fn")]
 	pub allow_outgoing_typing: bool,

@@ -1550,7 +1516,7 @@ pub struct Config {
 	/// sender user's server name, inbound federation X-Matrix origin, and
 	/// outbound federation handler.
 	///
-	/// You can set this to [".*"] to block all servers by default, and then
+	/// You can set this to ["*"] to block all servers by default, and then
 	/// use `allowed_remote_server_names` to allow only specific servers.
 	///
 	/// example: ["badserver\\.tld$", "badphrase", "19dollarfortnitecards"]
@@ -1730,11 +1696,6 @@ pub struct Config {
 	#[serde(default)]
 	pub url_preview_check_root_domain: bool,

-	/// User agent that is used specifically when fetching url previews.
-	///
-	/// default: "continuwuity/<version> (bot; +https://continuwuity.org)"
-	pub url_preview_user_agent: Option<String>,
-
 	/// List of forbidden room aliases and room IDs as strings of regex
 	/// patterns.
 	///
@@ -2150,19 +2111,6 @@ pub struct WellKnownConfig {
 	/// If no email or mxid is specified, all of the server's admins will be
 	/// listed.
 	pub support_mxid: Option<OwnedUserId>,
-
-	/// A list of MatrixRTC foci URLs which will be served as part of the
-	/// MSC4143 client endpoint at /.well-known/matrix/client.  If you're
-	/// setting up livekit, you'd want something like:
-	/// rtc_focus_server_urls = [
-	///     { type = "livekit", livekit_service_url = "https://livekit.example.com" },
-	/// ]
-	///
-	/// To disable, set this to be an empty vector (`[]`).
-	///
-	/// default: []
-	#[serde(default = "default_rtc_focus_urls")]
-	pub rtc_focus_server_urls: Vec<RtcFocusInfo>,
 }

 #[derive(Clone, Copy, Debug, Deserialize, Default)]
@@ -2565,12 +2513,6 @@ fn default_pusher_idle_timeout() -> u64 { 15 }

 fn default_max_fetch_prev_events() -> u16 { 192_u16 }

-fn default_max_concurrent_inbound_transactions() -> usize { 150 }
-
-fn default_transaction_id_cache_max_age_secs() -> u64 { 60 * 60 * 2 }
-
-fn default_transaction_id_cache_max_entries() -> usize { 8192 }
-
 fn default_tracing_flame_filter() -> String {
 	cfg!(debug_assertions)
 		.then_some("trace,h2=off")
@@ -2666,9 +2608,6 @@ fn default_rocksdb_stats_level() -> u8 { 1 }
 #[inline]
 pub fn default_default_room_version() -> RoomVersionId { RoomVersionId::V11 }

-#[must_use]
-pub fn default_rtc_focus_urls() -> Vec<RtcFocusInfo> { vec![] }
-
 fn default_ip_range_denylist() -> Vec<String> {
 	vec![
 		"127.0.0.0/8".to_owned(),
--- a/src/core/error/response.rs
+++ b/src/core/error/response.rs
@@ -85,8 +85,7 @@ pub(super) fn bad_request_code(kind: &ErrorKind) -> StatusCode {
 		| Unrecognized => StatusCode::METHOD_NOT_ALLOWED,

 		// 404
-		| NotFound | NotImplemented | FeatureDisabled | SenderIgnored { .. } =>
-			StatusCode::NOT_FOUND,
+		| NotFound | NotImplemented | FeatureDisabled => StatusCode::NOT_FOUND,

 		// 403
 		| GuestAccessForbidden
--- a/src/core/info/version.rs
+++ b/src/core/info/version.rs
@@ -8,13 +8,10 @@
 use std::sync::OnceLock;

 static BRANDING: &str = "continuwuity";
-static WEBSITE: &str = "https://continuwuity.org";
 static SEMANTIC: &str = env!("CARGO_PKG_VERSION");

 static VERSION: OnceLock<String> = OnceLock::new();
-static VERSION_UA: OnceLock<String> = OnceLock::new();
 static USER_AGENT: OnceLock<String> = OnceLock::new();
-static USER_AGENT_MEDIA: OnceLock<String> = OnceLock::new();

 #[inline]
 #[must_use]
@@ -23,25 +20,10 @@ pub fn name() -> &'static str { BRANDING }
 #[inline]
 pub fn version() -> &'static str { VERSION.get_or_init(init_version) }

-#[inline]
-pub fn version_ua() -> &'static str { VERSION_UA.get_or_init(init_version_ua) }
-
 #[inline]
 pub fn user_agent() -> &'static str { USER_AGENT.get_or_init(init_user_agent) }

-#[inline]
-pub fn user_agent_media() -> &'static str { USER_AGENT_MEDIA.get_or_init(init_user_agent_media) }
-
-fn init_user_agent() -> String { format!("{}/{} (bot; +{WEBSITE})", name(), version_ua()) }
-
-fn init_user_agent_media() -> String {
-	format!("{}/{} (embedbot; facebookexternalhit/1.1; +{WEBSITE})", name(), version_ua())
-}
-
-fn init_version_ua() -> String {
-	conduwuit_build_metadata::version_tag()
-		.map_or_else(|| SEMANTIC.to_owned(), |extra| format!("{SEMANTIC}+{extra}"))
-}
+fn init_user_agent() -> String { format!("{}/{}", name(), version()) }

 fn init_version() -> String {
 	conduwuit_build_metadata::version_tag()
--- a/src/core/matrix/state_res/mod.rs
+++ b/src/core/matrix/state_res/mod.rs
@@ -1046,7 +1046,7 @@ async fn test_event_sort() {
 		// don't remove any events so we know it sorts them all correctly
 		let mut events_to_sort = events.keys().cloned().collect::<Vec<_>>();

-		events_to_sort.shuffle(&mut rand::rng());
+		events_to_sort.shuffle(&mut rand::thread_rng());

 		let power_level = resolved_power
 			.get(&(StateEventType::RoomPowerLevels, "".into()))
--- a/src/core/utils/hash/argon.rs
+++ b/src/core/utils/hash/argon.rs
@@ -28,7 +28,7 @@ fn init_argon() -> Argon2<'static> {
 }

 pub(super) fn password(password: &str) -> Result<String> {
-	let salt = SaltString::generate(rand_core::OsRng);
+	let salt = SaltString::generate(rand::thread_rng());
 	ARGON
 		.get_or_init(init_argon)
 		.hash_password(password.as_bytes(), &salt)
--- a/src/core/utils/rand.rs
+++ b/src/core/utils/rand.rs
@@ -4,16 +4,16 @@
 };

 use arrayvec::ArrayString;
-use rand::{RngExt, seq::SliceRandom};
+use rand::{Rng, seq::SliceRandom, thread_rng};

 pub fn shuffle<T>(vec: &mut [T]) {
-	let mut rng = rand::rng();
+	let mut rng = thread_rng();
 	vec.shuffle(&mut rng);
 }

 pub fn string(length: usize) -> String {
-	rand::rng()
-		.sample_iter(&rand::distr::Alphanumeric)
+	thread_rng()
+		.sample_iter(&rand::distributions::Alphanumeric)
 		.take(length)
 		.map(char::from)
 		.collect()
@@ -22,8 +22,8 @@ pub fn string(length: usize) -> String {
 #[inline]
 pub fn string_array<const LENGTH: usize>() -> ArrayString<LENGTH> {
 	let mut ret = ArrayString::<LENGTH>::new();
-	rand::rng()
-		.sample_iter(&rand::distr::Alphanumeric)
+	thread_rng()
+		.sample_iter(&rand::distributions::Alphanumeric)
 		.take(LENGTH)
 		.map(char::from)
 		.for_each(|c| ret.push(c));
@@ -40,4 +40,7 @@ pub fn time_from_now_secs(range: Range<u64>) -> SystemTime {
 }

 #[must_use]
-pub fn secs(range: Range<u64>) -> Duration { Duration::from_secs(rand::random_range(range)) }
+pub fn secs(range: Range<u64>) -> Duration {
+	let mut rng = thread_rng();
+	Duration::from_secs(rng.gen_range(range))
+}
--- a/src/core/utils/stream/iter_stream.rs
+++ b/src/core/utils/stream/iter_stream.rs
@@ -3,17 +3,19 @@
 	stream::{Stream, TryStream},
 };

+use crate::{Error, Result};
+
 pub trait IterStream<I: IntoIterator + Send> {
 	/// Convert an Iterator into a Stream
 	fn stream(self) -> impl Stream<Item = <I as IntoIterator>::Item> + Send;

-	/// Convert an Iterator into a TryStream with a generic error type
-	fn try_stream<E>(
+	/// Convert an Iterator into a TryStream
+	fn try_stream(
 		self,
 	) -> impl TryStream<
 		Ok = <I as IntoIterator>::Item,
-		Error = E,
-		Item = Result<<I as IntoIterator>::Item, E>,
+		Error = Error,
+		Item = Result<<I as IntoIterator>::Item, Error>,
 	> + Send;
 }

@@ -26,12 +28,12 @@ impl<I> IterStream<I> for I
 	fn stream(self) -> impl Stream<Item = <I as IntoIterator>::Item> + Send { stream::iter(self) }

 	#[inline]
-	fn try_stream<E>(
+	fn try_stream(
 		self,
 	) -> impl TryStream<
 		Ok = <I as IntoIterator>::Item,
-		Error = E,
-		Item = Result<<I as IntoIterator>::Item, E>,
+		Error = Error,
+		Item = Result<<I as IntoIterator>::Item, Error>,
 	> + Send {
 		self.stream().map(Ok)
 	}
--- a/src/core/utils/stream/try_broadband.rs
+++ b/src/core/utils/stream/try_broadband.rs
@@ -1,10 +1,9 @@
 //! Synchronous combinator extensions to futures::TryStream

-use std::result::Result;
-
 use futures::{TryFuture, TryStream, TryStreamExt};

 use super::automatic_width;
+use crate::Result;

 /// Concurrency extensions to augment futures::TryStreamExt. broad_ combinators
 /// produce out-of-order
--- a/src/database/engine.rs
+++ b/src/database/engine.rs
@@ -33,6 +33,8 @@ pub struct Engine {
 	pub(crate) db: Db,
 	pub(crate) pool: Arc<Pool>,
 	pub(crate) ctx: Arc<Context>,
+	pub(super) read_only: bool,
+	pub(super) secondary: bool,
 	pub(crate) checksums: bool,
 	corks: AtomicU32,
 }
@@ -127,6 +129,14 @@ pub fn current_sequence(&self) -> u64 {

 		sequence
 	}
+
+	#[inline]
+	#[must_use]
+	pub fn is_read_only(&self) -> bool { self.secondary || self.read_only }
+
+	#[inline]
+	#[must_use]
+	pub fn is_secondary(&self) -> bool { self.secondary }
 }

 impl Drop for Engine {
--- a/src/database/engine/backup.rs
+++ b/src/database/engine/backup.rs
@@ -12,8 +12,9 @@ pub fn backup(&self) -> Result {
 	let mut engine = self.backup_engine()?;
 	let config = &self.ctx.server.config;
 	if config.database_backups_to_keep > 0 {
+		let flush = !self.is_read_only();
 		engine
-			.create_new_backup_flush(&self.db, true)
+			.create_new_backup_flush(&self.db, flush)
 			.map_err(map_err)?;

 		let engine_info = engine.get_backup_info();
--- a/src/database/engine/open.rs
+++ b/src/database/engine/open.rs
@@ -35,7 +35,14 @@ pub(crate) async fn open(ctx: Arc<Context>, desc: &[Descriptor]) -> Result<Arc<S
 	}

 	debug!("Opening database...");
-	let db = Db::open_cf_descriptors(&db_opts, path, cfds).or_else(or_else)?;
+	let db = if config.rocksdb_read_only {
+		Db::open_cf_descriptors_read_only(&db_opts, path, cfds, false)
+	} else if config.rocksdb_secondary {
+		Db::open_cf_descriptors_as_secondary(&db_opts, path, path, cfds)
+	} else {
+		Db::open_cf_descriptors(&db_opts, path, cfds)
+	}
+	.or_else(or_else)?;

 	info!(
 		columns = num_cfds,
@@ -48,6 +55,8 @@ pub(crate) async fn open(ctx: Arc<Context>, desc: &[Descriptor]) -> Result<Arc<S
 		db,
 		pool: ctx.pool.clone(),
 		ctx: ctx.clone(),
+		read_only: config.rocksdb_read_only,
+		secondary: config.rocksdb_secondary,
 		checksums: config.rocksdb_checksums,
 		corks: AtomicU32::new(0),
 	}))
--- a/src/database/mod.rs
+++ b/src/database/mod.rs
@@ -74,6 +74,14 @@ pub fn iter(&self) -> impl Iterator<Item = (&MapsKey, &MapsVal)> + Send + '_ {

 	#[inline]
 	pub fn keys(&self) -> impl Iterator<Item = &MapsKey> + Send + '_ { self.maps.keys() }
+
+	#[inline]
+	#[must_use]
+	pub fn is_read_only(&self) -> bool { self.db.is_read_only() }
+
+	#[inline]
+	#[must_use]
+	pub fn is_secondary(&self) -> bool { self.db.is_secondary() }
 }

 impl Index<&str> for Database {
--- a/src/main/Cargo.toml
+++ b/src/main/Cargo.toml
@@ -99,11 +99,6 @@ gzip_compression = [
 hardened_malloc = [
 	"conduwuit-core/hardened_malloc",
 ]
-http3 = [
-	"conduwuit-api/http3",
-	"conduwuit-core/http3",
-	"conduwuit-service/http3",
-]
 io_uring = [
 	"conduwuit-database/io_uring",
 ]
@@ -235,7 +230,6 @@ tracing-opentelemetry.workspace = true
 tracing-subscriber.workspace = true
 tracing.workspace = true
 tracing-journald = { workspace = true, optional = true }
-parking_lot.workspace = true


 [target.'cfg(all(not(target_env = "msvc"), target_os = "linux"))'.dependencies]
--- a/src/main/clap.rs
+++ b/src/main/clap.rs
@@ -27,6 +27,10 @@ pub struct Args {
 	#[arg(long, short('O'))]
 	pub option: Vec<String>,

+	/// Run in a stricter read-only --maintenance mode.
+	#[arg(long)]
+	pub read_only: bool,
+
 	/// Run in maintenance mode while refusing connections.
 	#[arg(long)]
 	pub maintenance: bool,
@@ -139,7 +143,11 @@ pub(crate) fn parse() -> Args { Args::parse() }

 /// Synthesize any command line options with configuration file options.
 pub(crate) fn update(mut config: Figment, args: &Args) -> Result<Figment> {
-	if args.maintenance {
+	if args.read_only {
+		config = config.join(("rocksdb_read_only", true));
+	}
+
+	if args.maintenance || args.read_only {
 		config = config.join(("startup_netburst", false));
 		config = config.join(("listening", false));
 	}
--- a/src/main/deadlock.rs
+++ b/src/main/deadlock.rs
@@ -1,36 +0,0 @@
-use std::{thread, time::Duration};
-
-/// Runs a loop that checks for deadlocks every 10 seconds.
-///
-/// Note that this requires the `deadlock_detection` parking_lot feature to be
-/// enabled.
-pub(crate) fn deadlock_detection_thread() {
-	loop {
-		thread::sleep(Duration::from_secs(10));
-		let deadlocks = parking_lot::deadlock::check_deadlock();
-		if deadlocks.is_empty() {
-			continue;
-		}
-
-		eprintln!("{} deadlocks detected", deadlocks.len());
-		for (i, threads) in deadlocks.iter().enumerate() {
-			eprintln!("Deadlock #{i}");
-			for t in threads {
-				eprintln!("Thread Id {:#?}", t.thread_id());
-				eprintln!("{:#?}", t.backtrace());
-			}
-		}
-	}
-}
-
-/// Spawns the deadlock detection thread.
-///
-/// This thread will run in the background and check for deadlocks every 10
-/// seconds. When a deadlock is detected, it will print detailed information to
-/// stderr.
-pub(crate) fn spawn() {
-	thread::Builder::new()
-		.name("deadlock_detector".to_owned())
-		.spawn(deadlock_detection_thread)
-		.expect("failed to spawn deadlock detection thread");
-}
--- a/src/main/mod.rs
+++ b/src/main/mod.rs
@@ -5,7 +5,6 @@
 use conduwuit_core::{debug_info, error};

 mod clap;
-mod deadlock;
 mod logging;
 mod mods;
 mod panic;
@@ -28,9 +27,6 @@ pub fn run() -> Result<()> {
 }

 pub fn run_with_args(args: &Args) -> Result<()> {
-	// Spawn deadlock detection thread
-	deadlock::spawn();
-
 	let runtime = runtime::new(args)?;
 	let server = Server::new(args, Some(runtime.handle()))?;

--- a/src/router/run.rs
+++ b/src/router/run.rs
@@ -39,15 +39,7 @@ pub(crate) async fn run(services: Arc<Services>) -> Result<()> {
 			.runtime()
 			.spawn(serve::serve(services.clone(), handle.clone(), tx.subscribe()));

-	// Run startup admin commands.
-	// This has to be done after the admin service is initialized otherwise it
-	// panics.
-	services.admin.startup_execute().await?;
-
-	// Print first-run banner if necessary. This needs to be done after the startup
-	// admin commands are run in case one of them created the first user.
-	services.firstrun.print_first_run_banner();
-
+	// Focal point
 	debug!("Running");
 	let res = tokio::select! {
 		res = &mut listener => res.map_err(Error::from).unwrap_or_else(Err),
--- a/src/service/Cargo.toml
+++ b/src/service/Cargo.toml
@@ -32,9 +32,6 @@ gzip_compression = [
 	"conduwuit-core/gzip_compression",
 	"reqwest/gzip",
 ]
-http3 = [
-	"conduwuit-core/http3",
-]
 io_uring = [
 	"conduwuit-database/io_uring",
 ]
@@ -82,7 +79,6 @@ zstd_compression = [
 ]

 [dependencies]
-askama.workspace = true
 async-trait.workspace = true
 base64.workspace = true
 bytes.workspace = true
@@ -122,7 +118,6 @@ webpage.optional = true
 blurhash.workspace = true
 blurhash.optional = true
 recaptcha-verify = { version = "0.1.5", default-features = false }
-yansi.workspace = true

 [target.'cfg(all(unix, target_os = "linux"))'.dependencies]
 sd-notify.workspace = true
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or broken invites should clear their client caches after updating to make them appear.`
				`@@ -0,0 +1 @@`
				`Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by @Omar007`
				`@@ -1 +0,0 @@`
				`Removed non-compliant nor functional room alias lookups over federation. Contributed by @nex`
				`@@ -1 +0,0 @@`
				`Outgoing presence is now disabled by default, and the config option documentation has been adjusted to more accurately represent the weight of presence, typing indicators, and read receipts. Contributed by @nex.`
				`@@ -1 +0,0 @@`
				`Removed ability to set rocksdb as read only. Doing so would cause unintentional and buggy behaviour. Contributed by @Terryiscool160.`
				`@@ -1 +0,0 @@`
				Fixed a startup crash in the sender service if we can't detect the number of CPU cores, even if the `sender_workers' config option is set correctly. Contributed by @katie.
				`@@ -1 +0,0 @@`
				`Improved the concurrency handling of federation transactions, vastly improving performance and reliability by more accurately handling inbound transactions and reducing the amount of repeated wasted work. Contributed by @nex and @Jade.`
				`@@ -1 +0,0 @@`
				`Added MSC3202 Device masquerading (not all of MSC3202). This should fix issues with enabling MSC4190 for some Mautrix bridges. Contributed by @Jade`
				`@@ -1 +0,0 @@`
				Updated `list-backups` admin command to output one backup per line.
				`@@ -1 +0,0 @@`
				Improved URL preview fetching with a more compatible user agent for sites like YouTube Music. Added `!admin media delete-url-preview <url>` command to clear cached URL previews that were stuck and broken.