Bump 1.4.1

Signed-off-by: Jason Volk <jason@zemos.net>

.cargo/config.toml

@@ -0,0 +1,2 @@
+[env]
+RUMA_UNSTABLE_EXHAUSTIVE_TYPES = "true"

.dockerignore

@@ -1,27 +1,31 @@
 # Local build and dev artifacts
-target
-tests
+target/
+#tests
 
 # Docker files
 Dockerfile*
+docker/
 
 # IDE files
 .vscode
 .idea
 *.iml
 
+.
+
 # Git folder
-.git
-.gitea
-.gitlab
-.github
+#.git
+#.gitea
+#.gitlab
+#.github
 
 # Dot files
 .env
-.gitignore
+#.gitignore
 
 # Toml files
-rustfmt.toml
+#rustfmt.toml
 
 # Documentation
 #*.md
+*.hcl

.github/workflows/README.md

@@ -0,0 +1,13 @@
+## Overview
+
+The release pipeline `Main` (main.yml) and its subroutines defined in the other yamls form a high-level
+description for the underlying self-hosted build system in  `/docker`. In other words, this is a sort of
+terminal, a "thin-client" with a display and a keyboard for our docker mainframe. We minimize
+vendor-lockin and duplication with other services by limiting everything here to only what is
+essential for driving the docker builder.
+
+Though we slightly relax the above by specifying details of the actual CI pipeline, the 
+control-flow logic to go from some input event to some output or release here. This gives us
+better integration  with github, like granular progress indications by breaking up operations
+as individual jobs and workflows within the pipeline. This means we'll have duplicate logic
+with other services, but only as it relates to high-level control flow.

.github/workflows/bake.yml

@@ -0,0 +1,252 @@
+name: Bakery
+
+on:
+  workflow_call:
+    inputs:
+      bake_targets:
+        type: string
+        description: Bake Matrix
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_targets:
+        type: string
+        description: Rust targets
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_targets:
+        type: string
+        description: System targets
+      sys_versions:
+        type: string
+        description: System versions
+      machines:
+        type: string
+        description: Hardware platforms
+      runner:
+        type: string
+        description: Runner mask
+        default: 'self-hosted'
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      max-parallel:
+        type: number
+        default: 128
+        description: Limit number of concurrent jobs.
+      verbose_env:
+        type: string
+        default: ${{vars.CI_VERBOSE_ENV || false}}
+        description: Print the bake environment.
+      silent_bake:
+        type: string
+        default: ${{vars.CI_SILENT_BAKE || false}}
+        description: Print as little as possible.
+      print_bake:
+        type: string
+        default: ${{vars.CI_PRINT_BAKE || false}}
+        description: Print the computed receipe.
+      fail_fast:
+        type: boolean
+        default: false
+        description: Fail-fast for the underlying matrix.
+      release_url:
+        type: string
+        description: Upload url for created release.
+      artifact:
+        type: string
+        default: '{}'
+        description: >
+          Map of targets to artifact files to upload. Key is bake target (image prefix),
+          value is a JSON object containing keys 'src' and 'dst'. dst is the artifact name,
+          src is optional path inside image, defaulting to dst.
+
+jobs:
+  bake:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && fromJSON(inputs.machines)[0] != null
+      && fromJSON(inputs.bake_targets)[0] != null
+
+    name: >
+      ${{matrix.bake_target}}
+      ${{matrix.cargo_profile}}
+      ${{matrix.rust_toolchain}}
+      ${{matrix.feat_set}}
+      ${{matrix.sys_name}}
+      ${{matrix.sys_version}}
+      ${{matrix.sys_target}}
+
+    runs-on: ["${{matrix.machine}}", "${{inputs.runner}}"]
+    strategy:
+      fail-fast: ${{inputs.fail_fast}}
+      max-parallel: ${{inputs.max-parallel}}
+      matrix:
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+        bake_target: ${{fromJSON(inputs.bake_targets)}}
+        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
+        feat_set: ${{fromJSON(inputs.feat_sets)}}
+        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+
+    # Call docker
+    - name: Bake ${{matrix.bake_target}}
+      env:
+        bake_target: ${{matrix.bake_target}}
+        cargo_profile: ${{matrix.cargo_profile}}
+        rust_toolchain: ${{matrix.rust_toolchain}}
+        rust_target: ${{matrix.rust_target}}
+        feat_set: ${{matrix.feat_set}}
+        sys_name: ${{matrix.sys_name}}
+        sys_version: ${{matrix.sys_version}}
+        sys_target: ${{matrix.sys_target}}
+        machine: ${{matrix.machine}}
+        acct: ${{github.actor}}
+        repo: ${{github.repository}}
+        CI_VERBOSE_ENV: ${{inputs.verbose_env}}
+        CI_SILENT_BAKE: ${{inputs.silent_bake}}
+        CI_PRINT_BAKE: ${{inputs.print_bake}}
+
+      run: |
+        docker/bake.sh "${{matrix.bake_target}}"
+
+    # Optionally extract an inner artifact
+    - name: Extract Inner Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].img == null
+        && fromJSON(inputs.artifact)[matrix.bake_target].runner != true
+
+      env:
+        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
+
+      run: |
+        cid=$(docker create "$iid" /)
+        rm -rf _artifact
+        mkdir -p "_artifact"
+        docker cp "$cid:$src" "_artifact/$dst"
+        chmod "$mod" "_artifact/$dst"
+
+    # Optionally extract the image itself as an artifact.
+    - name: Extract Image Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].img != null
+
+      env:
+        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+
+      run: |
+        rm -rf _artifact
+        mkdir -p "_artifact"
+        docker save -o "_artifact/$dst" "$iid"
+
+    # Optionally extract a runner artifact
+    - name: Extract Outer Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].runner == true
+
+      env:
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
+
+      run: |
+        rm -rf _artifact
+        mkdir -p "_artifact"
+        mv "$src" "_artifact/$dst"
+        chmod "$mod" "_artifact/$dst"
+
+    # Optionally compress extracted artifact
+    - name: Compress Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && (fromJSON(inputs.artifact)[matrix.bake_target].gzip || fromJSON(inputs.artifact)[matrix.bake_target].zstd)
+
+      env:
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        gzlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].gzip }}
+        zstlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].zstd }}
+
+      run: |
+        if test -n "$gzlev"; then
+          mv "_artifact/$dst" "_artifact/$dst.artifact"
+          gzip "-$gzlev" "_artifact/$dst.artifact"
+          mv "_artifact/$dst.artifact.gz" "_artifact/$dst"
+        elif test -n "$zstlev"; then
+          zstd "-$zstlev" "_artifact/$dst"
+          mv "_artifact/$dst.zst" "_artifact/$dst"
+        fi
+
+    # Upload either artifact
+    - name: Upload Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+
+      uses: actions/upload-artifact@v4
+      with:
+        path: _artifact/*
+        name: ${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+
+    # Optionally upload artifact as pages-artifact
+    - name: Upload Pages Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].pages == true
+
+      uses: actions/upload-pages-artifact@v3
+      with:
+        path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+        name: github-pages
+
+    # Optionally upload artifact as release-artifact
+    - name: Upload Release Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].mime
+        && contains(github.ref, 'refs/tags/v')
+        && inputs.release_url
+
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      with:
+        upload_url: ${{inputs.release_url}}
+        asset_path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+        asset_name: ${{github.ref_name}}-${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+        asset_content_type: ${{fromJSON(inputs.artifact)[matrix.bake_target].mime || 'application/octet-stream'}}

.github/workflows/ci.yml

@@ -1,717 +0,0 @@
-name: CI and Artifacts
-
-on:
-    pull_request:
-    push:
-        paths-ignore:
-          - '.gitlab-ci.yml'
-          - '.gitignore'
-          - 'renovate.json'
-          - 'debian/**'
-          - 'docker/**'
-        branches:
-            - main
-        tags:
-          - '*'
-    # Allows you to run this workflow manually from the Actions tab
-    workflow_dispatch:
-
-concurrency:
-    group: ${{ github.head_ref || github.ref_name }}
-    cancel-in-progress: true
-
-env:
-    # Required to make some things output color
-    TERM: ansi
-    # Publishing to my nix binary cache
-    ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
-    # conduwuit.cachix.org
-    CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-    # Just in case incremental is still being set to true, speeds up CI
-    CARGO_INCREMENTAL: 0
-    # Custom nix binary cache if fork is being used
-    ATTIC_ENDPOINT: ${{ vars.ATTIC_ENDPOINT }}
-    ATTIC_PUBLIC_KEY: ${{ vars.ATTIC_PUBLIC_KEY }}
-    # Get error output from nix that we can actually use, and use our binary caches for the earlier CI steps
-    NIX_CONFIG: |
-      show-trace = true
-      extra-substituters = https://attic.kennel.juneis.dog/conduwuit https://attic.kennel.juneis.dog/conduit https://conduwuit.cachix.org https://aseipp-nix-cache.freetls.fastly.net https://nix-community.cachix.org https://crane.cachix.org
-      extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= crane.cachix.org-1:8Scfpmn9w+hGdXH/Q9tTLiYAE/2dnJYRJP7kl80GuRk=
-      experimental-features = nix-command flakes
-      extra-experimental-features = nix-command flakes
-      accept-flake-config = true
-    WEB_UPLOAD_SSH_USERNAME: ${{ secrets.WEB_UPLOAD_SSH_USERNAME }}
-    GH_REF_NAME: ${{ github.ref_name }}
-    WEBSERVER_DIR_NAME: ${{ (github.head_ref != '' && format('merge-{0}-{1}', github.event.number, github.event.pull_request.user.login)) || github.ref_name }}-${{ github.sha }}
-
-permissions: {}
-
-jobs:
-    tests:
-        name: Test
-        runs-on: self-hosted
-        steps:
-            - name: Setup SSH web publish
-              env:
-                web_upload_ssh_private_key: ${{ secrets.WEB_UPLOAD_SSH_PRIVATE_KEY }}
-              if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || (github.event.pull_request.draft != true)) && (env.web_upload_ssh_private_key != '') && github.event.pull_request.user.login != 'renovate[bot]'
-              run: |
-                  mkdir -p -v ~/.ssh
-
-                  echo "${{ secrets.WEB_UPLOAD_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-                  echo "${{ secrets.WEB_UPLOAD_SSH_PRIVATE_KEY }}" >> ~/.ssh/id_ed25519
-
-                  chmod 600 ~/.ssh/id_ed25519
-
-                  cat >>~/.ssh/config <<END
-                  Host website
-                    HostName ${{ secrets.WEB_UPLOAD_SSH_HOSTNAME }}
-                    User ${{ secrets.WEB_UPLOAD_SSH_USERNAME }}
-                    IdentityFile ~/.ssh/id_ed25519
-                    StrictHostKeyChecking yes
-                    AddKeysToAgent no
-                    ForwardX11 no
-                    BatchMode yes
-                  END
-
-                  echo "Checking connection"
-                  ssh -q website "echo test" || ssh -q website "echo test"
-
-                  echo "Creating commit rev directory on web server"
-                  ssh -q website "rm -rf /var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/" || ssh -q website "rm -rf /var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/"
-                  ssh -q website "mkdir -v /var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/" || ssh -q website "mkdir -v /var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/"
-
-                  echo "SSH_WEBSITE=1" >> "$GITHUB_ENV"
-
-            - name: Sync repository
-              uses: actions/checkout@v4
-              with:
-                persist-credentials: false
-
-            - name: Tag comparison check
-              if: ${{ startsWith(github.ref, 'refs/tags/v') && !endsWith(github.ref, '-rc') }}
-              run: |
-                  # Tag mismatch with latest repo tag check to prevent potential downgrades
-                  LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)
-
-                  if [ ${LATEST_TAG} != ${GH_REF_NAME} ]; then
-                    echo '# WARNING: Attempting to run this workflow for a tag that is not the latest repo tag. Aborting.'
-                    echo '# WARNING: Attempting to run this workflow for a tag that is not the latest repo tag. Aborting.' >> $GITHUB_STEP_SUMMARY
-                    exit 1
-                  fi
-
-            - name: Prepare build environment
-              run: |
-                  echo 'source $HOME/.nix-profile/share/nix-direnv/direnvrc' > "$HOME/.direnvrc"
-                  direnv allow
-                  nix develop .#all-features --command true
-
-            - name: Cache CI dependencies
-              run: |
-                  bin/nix-build-and-cache ci
-                  bin/nix-build-and-cache just '.#devShells.x86_64-linux.default'
-                  bin/nix-build-and-cache just '.#devShells.x86_64-linux.all-features'
-                  bin/nix-build-and-cache just '.#devShells.x86_64-linux.dynamic'
-
-            # use rust-cache
-            - uses: Swatinem/rust-cache@v2
-              # we want a fresh-state when we do releases/tags to avoid potential cache poisoning attacks impacting
-              # releases and tags
-              #if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-              with:
-                cache-all-crates: "true"
-                cache-on-failure: "true"
-                cache-targets: "true"
-
-            - name: Run CI tests
-              env:
-                CARGO_PROFILE: "test"
-              run: |
-                  direnv exec . engage > >(tee -a test_output.log)
-
-            - name: Run Complement tests
-              env:
-                CARGO_PROFILE: "test"
-              run: |
-                  # the nix devshell sets $COMPLEMENT_SRC, so "/dev/null" is no-op
-                  direnv exec . bin/complement "/dev/null" complement_test_logs.jsonl complement_test_results.jsonl > >(tee -a test_output.log)
-                  cp -v -f result complement_oci_image.tar.gz
-
-            - name: Upload Complement OCI image
-              uses: actions/upload-artifact@v4
-              with:
-                name: complement_oci_image.tar.gz
-                path: complement_oci_image.tar.gz
-                if-no-files-found: error
-                compression-level: 0
-
-            - name: Upload Complement logs
-              uses: actions/upload-artifact@v4
-              with:
-                name: complement_test_logs.jsonl
-                path: complement_test_logs.jsonl
-                if-no-files-found: error
-
-            - name: Upload Complement results
-              uses: actions/upload-artifact@v4
-              with:
-                name: complement_test_results.jsonl
-                path: complement_test_results.jsonl
-                if-no-files-found: error
-
-            - name: Diff Complement results with checked-in repo results
-              run: |
-                  diff -u --color=always tests/test_results/complement/test_results.jsonl complement_test_results.jsonl > >(tee -a complement_diff_output.log)
-
-            - name: Update Job Summary
-              env:
-                GH_JOB_STATUS: ${{ job.status }}
-              if: success() || failure()
-              run: |
-                  if [ ${GH_JOB_STATUS} == 'success' ]; then
-                      echo '# ✅ CI completed suwuccessfully' >> $GITHUB_STEP_SUMMARY
-                  else
-                      echo '# ❌ CI failed (last 100 lines of output)' >> $GITHUB_STEP_SUMMARY
-                      echo '```' >> $GITHUB_STEP_SUMMARY
-                      tail -n 100 test_output.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY
-                      echo '```' >> $GITHUB_STEP_SUMMARY
-
-                      echo '# Complement diff results (last 100 lines)' >> $GITHUB_STEP_SUMMARY
-                      echo '```diff' >> $GITHUB_STEP_SUMMARY
-                      tail -n 100 complement_diff_output.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY
-                      echo '```' >> $GITHUB_STEP_SUMMARY
-                  fi
-
-    build:
-        name: Build
-        runs-on: self-hosted
-        strategy:
-            matrix:
-                include:
-                    - target: aarch64-linux-musl
-                    - target: x86_64-linux-musl
-        steps:
-            - name: Sync repository
-              uses: actions/checkout@v4
-              with:
-                persist-credentials: false
-
-            - name: Setup SSH web publish
-              env:
-                web_upload_ssh_private_key: ${{ secrets.WEB_UPLOAD_SSH_PRIVATE_KEY }}
-              if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || (github.event.pull_request.draft != true)) && (env.web_upload_ssh_private_key != '') && github.event.pull_request.user.login != 'renovate[bot]'
-              run: |
-                  mkdir -p -v ~/.ssh
-
-                  echo "${{ secrets.WEB_UPLOAD_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-                  echo "${{ secrets.WEB_UPLOAD_SSH_PRIVATE_KEY }}" >> ~/.ssh/id_ed25519
-
-                  chmod 600 ~/.ssh/id_ed25519
-
-                  cat >>~/.ssh/config <<END
-                  Host website
-                    HostName ${{ secrets.WEB_UPLOAD_SSH_HOSTNAME }}
-                    User ${{ secrets.WEB_UPLOAD_SSH_USERNAME }}
-                    IdentityFile ~/.ssh/id_ed25519
-                    StrictHostKeyChecking yes
-                    AddKeysToAgent no
-                    ForwardX11 no
-                    BatchMode yes
-                  END
-
-                  echo "Checking connection"
-                  ssh -q website "echo test" || ssh -q website "echo test"
-
-                  echo "SSH_WEBSITE=1" >> "$GITHUB_ENV"
-
-            - name: Prepare build environment
-              run: |
-                  echo 'source $HOME/.nix-profile/share/nix-direnv/direnvrc' > "$HOME/.direnvrc"
-                  direnv allow
-                  nix develop .#all-features --command true --impure
-
-            # use rust-cache
-            - uses: Swatinem/rust-cache@v2
-              # we want a fresh-state when we do releases/tags to avoid potential cache poisoning attacks impacting
-              # releases and tags
-              #if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-              with:
-                cache-all-crates: "true"
-                cache-on-failure: "true"
-                cache-targets: "true"
-
-            - name: Build static ${{ matrix.target }}-all-features
-              run: |
-                  if [[ ${{ matrix.target }} == "x86_64-linux-musl" ]]
-                  then
-                    CARGO_DEB_TARGET_TUPLE="x86_64-unknown-linux-musl"
-                  elif [[ ${{ matrix.target }} == "aarch64-linux-musl" ]]
-                  then
-                    CARGO_DEB_TARGET_TUPLE="aarch64-unknown-linux-musl"
-                  fi
-
-                  SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
-
-                  bin/nix-build-and-cache just .#static-${{ matrix.target }}-all-features
-
-                  mkdir -v -p target/release/
-                  mkdir -v -p target/$CARGO_DEB_TARGET_TUPLE/release/
-                  cp -v -f result/bin/conduwuit target/release/conduwuit
-                  cp -v -f result/bin/conduwuit target/$CARGO_DEB_TARGET_TUPLE/release/conduwuit
-                  direnv exec . cargo deb --verbose --no-build --no-strip -p conduwuit --target=$CARGO_DEB_TARGET_TUPLE --output target/release/${{ matrix.target }}.deb
-                  mv -v target/release/conduwuit static-${{ matrix.target }}
-                  mv -v target/release/${{ matrix.target }}.deb ${{ matrix.target }}.deb
-
-            - name: Build static x86_64-linux-musl-all-features-x86_64-haswell-optimised
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              run: |
-                  CARGO_DEB_TARGET_TUPLE="x86_64-unknown-linux-musl"
-                  SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
-
-                  bin/nix-build-and-cache just .#static-x86_64-linux-musl-all-features-x86_64-haswell-optimised
-
-                  mkdir -v -p target/release/
-                  mkdir -v -p target/$CARGO_DEB_TARGET_TUPLE/release/
-                  cp -v -f result/bin/conduwuit target/release/conduwuit
-                  cp -v -f result/bin/conduwuit target/$CARGO_DEB_TARGET_TUPLE/release/conduwuit
-                  direnv exec . cargo deb --verbose --no-build --no-strip -p conduwuit --target=$CARGO_DEB_TARGET_TUPLE --output target/release/x86_64-linux-musl-x86_64-haswell-optimised.deb
-                  mv -v target/release/conduwuit static-x86_64-linux-musl-x86_64-haswell-optimised
-                  mv -v target/release/x86_64-linux-musl-x86_64-haswell-optimised.deb x86_64-linux-musl-x86_64-haswell-optimised.deb
-
-            # quick smoke test of the x86_64 static release binary
-            - name: Quick smoke test the x86_64 static release binary
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              run: |
-                  # GH actions default runners are x86_64 only
-                  if file result/bin/conduwuit | grep x86-64; then
-                    result/bin/conduwuit --version
-                    result/bin/conduwuit --help
-                    result/bin/conduwuit -Oserver_name="'$(date -u +%s).local'" -Odatabase_path="'/tmp/$(date -u +%s)'" --execute "server admin-notice awawawawawawawawawawa" --execute "server memory-usage" --execute "server shutdown"
-                  fi
-
-            - name: Build static debug ${{ matrix.target }}-all-features
-              run: |
-                  if [[ ${{ matrix.target }} == "x86_64-linux-musl" ]]
-                  then
-                    CARGO_DEB_TARGET_TUPLE="x86_64-unknown-linux-musl"
-                  elif [[ ${{ matrix.target }} == "aarch64-linux-musl" ]]
-                  then
-                    CARGO_DEB_TARGET_TUPLE="aarch64-unknown-linux-musl"
-                  fi
-
-                  SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
-
-                  bin/nix-build-and-cache just .#static-${{ matrix.target }}-all-features-debug
-
-                  # > warning: dev profile is not supported and will be a hard error in the future. cargo-deb is for making releases, and it doesn't make sense to use it with dev profiles.
-                  # so we need to coerce cargo-deb into thinking this is a release binary
-                  mkdir -v -p target/release/
-                  mkdir -v -p target/$CARGO_DEB_TARGET_TUPLE/release/
-                  cp -v -f result/bin/conduwuit target/release/conduwuit
-                  cp -v -f result/bin/conduwuit target/$CARGO_DEB_TARGET_TUPLE/release/conduwuit
-                  direnv exec . cargo deb --verbose --no-build --no-strip -p conduwuit --target=$CARGO_DEB_TARGET_TUPLE --output target/release/${{ matrix.target }}-debug.deb
-                  mv -v target/release/conduwuit static-${{ matrix.target }}-debug
-                  mv -v target/release/${{ matrix.target }}-debug.deb ${{ matrix.target }}-debug.deb
-
-            # quick smoke test of the x86_64 static debug binary
-            - name: Run x86_64 static debug binary
-              run: |
-                  # GH actions default runners are x86_64 only
-                  if file result/bin/conduwuit | grep x86-64; then
-                    result/bin/conduwuit --version
-                  fi
-
-            # check validity of produced deb package, invalid debs will error on these commands
-            - name: Validate produced deb package
-              run: |
-                  # List contents
-                  dpkg-deb --contents ${{ matrix.target }}.deb
-                  dpkg-deb --contents ${{ matrix.target }}-debug.deb
-                  # List info
-                  dpkg-deb --info ${{ matrix.target }}.deb
-                  dpkg-deb --info ${{ matrix.target }}-debug.deb
-
-            - name: Upload static-x86_64-linux-musl-all-features-x86_64-haswell-optimised to GitHub
-              uses: actions/upload-artifact@v4
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              with:
-                  name: static-x86_64-linux-musl-x86_64-haswell-optimised
-                  path: static-x86_64-linux-musl-x86_64-haswell-optimised
-                  if-no-files-found: error
-
-            - name: Upload static-${{ matrix.target }}-all-features to GitHub
-              uses: actions/upload-artifact@v4
-              with:
-                  name: static-${{ matrix.target }}
-                  path: static-${{ matrix.target }}
-                  if-no-files-found: error
-
-            - name: Upload static deb ${{ matrix.target }}-all-features to GitHub
-              uses: actions/upload-artifact@v4
-              with:
-                  name: deb-${{ matrix.target }}
-                  path: ${{ matrix.target }}.deb
-                  if-no-files-found: error
-                  compression-level: 0
-
-            - name: Upload static-x86_64-linux-musl-all-features-x86_64-haswell-optimised to webserver
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    chmod +x static-x86_64-linux-musl-x86_64-haswell-optimised
-                    scp static-x86_64-linux-musl-x86_64-haswell-optimised website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/static-x86_64-linux-musl-x86_64-haswell-optimised
-                  fi
-
-            - name: Upload static-${{ matrix.target }}-all-features to webserver
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    chmod +x static-${{ matrix.target }}
-                    scp static-${{ matrix.target }} website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/static-${{ matrix.target }}
-                  fi
-
-            - name: Upload static deb x86_64-linux-musl-all-features-x86_64-haswell-optimised to webserver
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp x86_64-linux-musl-x86_64-haswell-optimised.deb website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/x86_64-linux-musl-x86_64-haswell-optimised.deb
-                  fi
-
-            - name: Upload static deb ${{ matrix.target }}-all-features to webserver
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp ${{ matrix.target }}.deb website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/${{ matrix.target }}.deb
-                  fi
-
-            - name: Upload static-${{ matrix.target }}-debug-all-features to GitHub
-              uses: actions/upload-artifact@v4
-              with:
-                  name: static-${{ matrix.target }}-debug
-                  path: static-${{ matrix.target }}-debug
-                  if-no-files-found: error
-
-            - name: Upload static deb ${{ matrix.target }}-debug-all-features to GitHub
-              uses: actions/upload-artifact@v4
-              with:
-                  name: deb-${{ matrix.target }}-debug
-                  path: ${{ matrix.target }}-debug.deb
-                  if-no-files-found: error
-                  compression-level: 0
-
-            - name: Upload static-${{ matrix.target }}-debug-all-features to webserver
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp static-${{ matrix.target }}-debug website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/static-${{ matrix.target }}-debug
-                  fi
-
-            - name: Upload static deb ${{ matrix.target }}-debug-all-features to webserver
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp ${{ matrix.target }}-debug.deb website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/${{ matrix.target }}-debug.deb
-                  fi
-
-            - name: Build OCI image ${{ matrix.target }}-all-features
-              run: |
-                  bin/nix-build-and-cache just .#oci-image-${{ matrix.target }}-all-features
-
-                  cp -v -f result oci-image-${{ matrix.target }}.tar.gz
-
-            - name: Build OCI image x86_64-linux-musl-all-features-x86_64-haswell-optimised
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              run: |
-                  bin/nix-build-and-cache just .#oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised
-
-                  cp -v -f result oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised.tar.gz
-
-            - name: Build debug OCI image ${{ matrix.target }}-all-features
-              run: |
-                  bin/nix-build-and-cache just .#oci-image-${{ matrix.target }}-all-features-debug
-
-                  cp -v -f result oci-image-${{ matrix.target }}-debug.tar.gz
-
-            - name: Upload OCI image x86_64-linux-musl-all-features-x86_64-haswell-optimised to GitHub
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              uses: actions/upload-artifact@v4
-              with:
-                  name: oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised
-                  path: oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised.tar.gz
-                  if-no-files-found: error
-                  compression-level: 0
-            - name: Upload OCI image ${{ matrix.target }}-all-features to GitHub
-              uses: actions/upload-artifact@v4
-              with:
-                  name: oci-image-${{ matrix.target }}
-                  path: oci-image-${{ matrix.target }}.tar.gz
-                  if-no-files-found: error
-                  compression-level: 0
-
-            - name: Upload OCI image ${{ matrix.target }}-debug-all-features to GitHub
-              uses: actions/upload-artifact@v4
-              with:
-                  name: oci-image-${{ matrix.target }}-debug
-                  path: oci-image-${{ matrix.target }}-debug.tar.gz
-                  if-no-files-found: error
-                  compression-level: 0
-
-            - name: Upload OCI image x86_64-linux-musl-all-features-x86_64-haswell-optimised.tar.gz to webserver
-              if: ${{ matrix.target == 'x86_64-linux-musl' }}
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised.tar.gz website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised.tar.gz
-                  fi
-
-            - name: Upload OCI image ${{ matrix.target }}-all-features to webserver
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp oci-image-${{ matrix.target }}.tar.gz website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/oci-image-${{ matrix.target }}.tar.gz
-                  fi
-
-            - name: Upload OCI image ${{ matrix.target }}-debug-all-features to webserver
-              run: |
-                  if [ ! -z $SSH_WEBSITE ]; then
-                    scp oci-image-${{ matrix.target }}-debug.tar.gz website:/var/www/girlboss.ceo/~strawberry/conduwuit/ci-bins/${WEBSERVER_DIR_NAME}/oci-image-${{ matrix.target }}-debug.tar.gz
-                  fi
-
-    variables: 
-      outputs:
-        github_repository: ${{ steps.var.outputs.github_repository }}
-      runs-on: self-hosted
-      steps:
-        - name: Setting global variables
-          uses: actions/github-script@v7
-          id: var
-          with:
-            script: |
-              core.setOutput('github_repository', '${{ github.repository }}'.toLowerCase())
-    docker:
-        name: Docker publish
-        runs-on: self-hosted
-        needs: [build, variables, tests]
-        permissions:
-          packages: write
-          contents: read
-        if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || (github.event.pull_request.draft != true)) && github.event.pull_request.user.login != 'renovate[bot]'
-        env:
-            DOCKER_HUB_REPO: docker.io/${{ needs.variables.outputs.github_repository }}
-            GHCR_REPO: ghcr.io/${{ needs.variables.outputs.github_repository }}
-            GLCR_REPO: registry.gitlab.com/conduwuit/conduwuit
-            UNIQUE_TAG: ${{ (github.head_ref != '' && format('merge-{0}-{1}', github.event.number, github.event.pull_request.user.login)) || github.ref_name }}-${{ github.sha }}
-            BRANCH_TAG: ${{ (startsWith(github.ref, 'refs/tags/v') && !endsWith(github.ref, '-rc') && 'latest') || (github.head_ref != '' && format('merge-{0}-{1}', github.event.number, github.event.pull_request.user.login)) || github.ref_name }}
-
-            DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-            GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-            GHCR_ENABLED: "${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) && 'true' || 'false' }}"
-        steps:
-            - name: Login to GitHub Container Registry
-              uses: docker/login-action@v3
-              with:
-                  registry: ghcr.io
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Login to Docker Hub
-              if: ${{ (vars.DOCKER_USERNAME != '') && (env.DOCKERHUB_TOKEN != '') }}
-              uses: docker/login-action@v3
-              with:
-                  registry: docker.io
-                  username: ${{ vars.DOCKER_USERNAME }}
-                  password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-            - name: Login to GitLab Container Registry
-              if: ${{ (vars.GITLAB_USERNAME != '') && (env.GITLAB_TOKEN != '') }}
-              uses: docker/login-action@v3
-              with:
-                  registry: registry.gitlab.com
-                  username: ${{ vars.GITLAB_USERNAME }}
-                  password: ${{ secrets.GITLAB_TOKEN }}
-
-            - name: Download artifacts
-              uses: actions/download-artifact@v4
-              with:
-                pattern: "oci*"
-
-            - name: Move OCI images into position
-              run: |
-                  mv -v oci-image-x86_64-linux-musl-all-features-x86_64-haswell-optimised/*.tar.gz oci-image-amd64-haswell-optimised.tar.gz
-                  mv -v oci-image-x86_64-linux-musl/*.tar.gz oci-image-amd64.tar.gz
-                  mv -v oci-image-aarch64-linux-musl/*.tar.gz oci-image-arm64v8.tar.gz
-                  mv -v oci-image-x86_64-linux-musl-debug/*.tar.gz oci-image-amd64-debug.tar.gz
-                  mv -v oci-image-aarch64-linux-musl-debug/*.tar.gz oci-image-arm64v8-debug.tar.gz
-
-            - name: Load and push amd64 haswell image
-              run: |
-                  docker load -i oci-image-amd64-haswell-optimised.tar.gz
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell
-                    docker push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GHCR_REPO}:${UNIQUE_TAG}-haswell
-                    docker push ${GHCR_REPO}:${UNIQUE_TAG}-haswell
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GLCR_REPO}:${UNIQUE_TAG}-haswell
-                    docker push ${GLCR_REPO}:${UNIQUE_TAG}-haswell
-                  fi
-
-            - name: Load and push amd64 image
-              run: |
-                  docker load -i oci-image-amd64.tar.gz
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64
-                    docker push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GHCR_REPO}:${UNIQUE_TAG}-amd64
-                    docker push ${GHCR_REPO}:${UNIQUE_TAG}-amd64
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GLCR_REPO}:${UNIQUE_TAG}-amd64
-                    docker push ${GLCR_REPO}:${UNIQUE_TAG}-amd64
-                  fi
-
-            - name: Load and push arm64 image
-              run: |
-                  docker load -i oci-image-arm64v8.tar.gz
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8
-                    docker push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8
-                    docker push ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8
-                    docker push ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8
-                  fi
-
-            - name: Load and push amd64 debug image
-              run: |
-                  docker load -i oci-image-amd64-debug.tar.gz
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64-debug
-                    docker push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64-debug
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GHCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                    docker push ${GHCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GLCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                    docker push ${GLCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                  fi
-
-            - name: Load and push arm64 debug image
-              run: |
-                  docker load -i oci-image-arm64v8-debug.tar.gz
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8-debug
-                    docker push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8-debug
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8-debug
-                    docker push ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8-debug
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker tag $(docker images -q conduwuit:main) ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8-debug
-                    docker push ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8-debug
-                  fi
-
-            - name: Create Docker haswell manifests
-              run: |
-                  # Dockerhub Container Registry
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker manifest create ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell
-                    docker manifest create ${DOCKER_HUB_REPO}:${BRANCH_TAG}-haswell --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell
-                  fi
-                  # GitHub Container Registry
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker manifest create ${GHCR_REPO}:${UNIQUE_TAG}-haswell --amend ${GHCR_REPO}:${UNIQUE_TAG}-haswell
-                    docker manifest create ${GHCR_REPO}:${BRANCH_TAG}-haswell --amend ${GHCR_REPO}:${UNIQUE_TAG}-haswell
-                  fi
-                  # GitLab Container Registry
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker manifest create ${GLCR_REPO}:${UNIQUE_TAG}-haswell --amend ${GLCR_REPO}:${UNIQUE_TAG}-haswell
-                    docker manifest create ${GLCR_REPO}:${BRANCH_TAG}-haswell --amend ${GLCR_REPO}:${UNIQUE_TAG}-haswell
-                  fi
-
-            - name: Create Docker combined manifests
-              run: |
-                  # Dockerhub Container Registry
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker manifest create ${DOCKER_HUB_REPO}:${UNIQUE_TAG} --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8 --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64
-                    docker manifest create ${DOCKER_HUB_REPO}:${BRANCH_TAG} --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8 --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64
-                  fi
-                  # GitHub Container Registry
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker manifest create ${GHCR_REPO}:${UNIQUE_TAG} --amend ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8 --amend ${GHCR_REPO}:${UNIQUE_TAG}-amd64
-                    docker manifest create ${GHCR_REPO}:${BRANCH_TAG} --amend ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8 --amend ${GHCR_REPO}:${UNIQUE_TAG}-amd64
-                  fi
-                  # GitLab Container Registry
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker manifest create ${GLCR_REPO}:${UNIQUE_TAG} --amend ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8 --amend ${GLCR_REPO}:${UNIQUE_TAG}-amd64
-                    docker manifest create ${GLCR_REPO}:${BRANCH_TAG} --amend ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8 --amend ${GLCR_REPO}:${UNIQUE_TAG}-amd64
-                  fi
-
-            - name: Create Docker combined debug manifests
-              run: |
-                  # Dockerhub Container Registry
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker manifest create ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-debug --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8-debug --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64-debug
-                    docker manifest create ${DOCKER_HUB_REPO}:${BRANCH_TAG}-debug --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-arm64v8-debug --amend ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-amd64-debug
-                  fi
-                  # GitHub Container Registry
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker manifest create ${GHCR_REPO}:${UNIQUE_TAG}-debug --amend ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8-debug --amend ${GHCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                    docker manifest create ${GHCR_REPO}:${BRANCH_TAG}-debug --amend ${GHCR_REPO}:${UNIQUE_TAG}-arm64v8-debug --amend ${GHCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                  fi
-                  # GitLab Container Registry
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker manifest create ${GLCR_REPO}:${UNIQUE_TAG}-debug --amend ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8-debug --amend ${GLCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                    docker manifest create ${GLCR_REPO}:${BRANCH_TAG}-debug --amend ${GLCR_REPO}:${UNIQUE_TAG}-arm64v8-debug --amend ${GLCR_REPO}:${UNIQUE_TAG}-amd64-debug
-                  fi
-
-            - name: Push manifests to Docker registries
-              run: |
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    docker manifest push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}
-                    docker manifest push ${DOCKER_HUB_REPO}:${BRANCH_TAG}
-                    docker manifest push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-debug
-                    docker manifest push ${DOCKER_HUB_REPO}:${BRANCH_TAG}-debug
-                    docker manifest push ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell
-                    docker manifest push ${DOCKER_HUB_REPO}:${BRANCH_TAG}-haswell
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    docker manifest push ${GHCR_REPO}:${UNIQUE_TAG}
-                    docker manifest push ${GHCR_REPO}:${BRANCH_TAG}
-                    docker manifest push ${GHCR_REPO}:${UNIQUE_TAG}-debug
-                    docker manifest push ${GHCR_REPO}:${BRANCH_TAG}-debug
-                    docker manifest push ${GHCR_REPO}:${UNIQUE_TAG}-haswell
-                    docker manifest push ${GHCR_REPO}:${BRANCH_TAG}-haswell
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    docker manifest push ${GLCR_REPO}:${UNIQUE_TAG}
-                    docker manifest push ${GLCR_REPO}:${BRANCH_TAG}
-                    docker manifest push ${GLCR_REPO}:${UNIQUE_TAG}-debug
-                    docker manifest push ${GLCR_REPO}:${BRANCH_TAG}-debug
-                    docker manifest push ${GLCR_REPO}:${UNIQUE_TAG}-haswell
-                    docker manifest push ${GLCR_REPO}:${BRANCH_TAG}-haswell
-                  fi
-
-            - name: Add Image Links to Job Summary
-              run: |
-                  if [ ! -z $DOCKERHUB_TOKEN ]; then
-                    echo "- \`docker pull ${DOCKER_HUB_REPO}:${UNIQUE_TAG}\`" >> $GITHUB_STEP_SUMMARY
-                    echo "- \`docker pull ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-debug\`" >> $GITHUB_STEP_SUMMARY
-                    echo "- \`docker pull ${DOCKER_HUB_REPO}:${UNIQUE_TAG}-haswell\`" >> $GITHUB_STEP_SUMMARY
-                  fi
-                  if [ $GHCR_ENABLED = "true" ]; then
-                    echo "- \`docker pull ${GHCR_REPO}:${UNIQUE_TAG}\`" >> $GITHUB_STEP_SUMMARY
-                    echo "- \`docker pull ${GHCR_REPO}:${UNIQUE_TAG}-debug\`" >> $GITHUB_STEP_SUMMARY
-                    echo "- \`docker pull ${GHCR_REPO}:${UNIQUE_TAG}-haswell\`" >> $GITHUB_STEP_SUMMARY
-                  fi
-                  if [ ! -z $GITLAB_TOKEN ]; then
-                    echo "- \`docker pull ${GLCR_REPO}:${UNIQUE_TAG}\`" >> $GITHUB_STEP_SUMMARY
-                    echo "- \`docker pull ${GLCR_REPO}:${UNIQUE_TAG}-debug\`" >> $GITHUB_STEP_SUMMARY
-                    echo "- \`docker pull ${GLCR_REPO}:${UNIQUE_TAG}-haswell\`" >> $GITHUB_STEP_SUMMARY
-                  fi

.github/workflows/docker-hub-description.yml

@@ -1,41 +0,0 @@
-name: Update Docker Hub Description
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - README.md
-      - .github/workflows/docker-hub-description.yml
-
-  workflow_dispatch:
-
-jobs:
-  dockerHubDescription:
-    runs-on: ubuntu-latest
-    if: ${{ (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || (github.event.pull_request.draft != true)) && github.event.pull_request.user.login != 'renovate[bot]' && (vars.DOCKER_USERNAME != '') }}
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        persist-credentials: false
-
-    - name: Setting variables
-      uses: actions/github-script@v7
-      id: var
-      with:
-        script: |
-          const githubRepo = '${{ github.repository }}'.toLowerCase()
-          const repoId = githubRepo.split('/')[1]
-          
-          core.setOutput('github_repository', githubRepo)
-          const dockerRepo = '${{ vars.DOCKER_USERNAME }}'.toLowerCase() + '/' + repoId
-          core.setOutput('docker_repo', dockerRepo)
-
-    - name: Docker Hub Description
-      uses: peter-evans/dockerhub-description@v4
-      with:
-        username: ${{ vars.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-        repository: ${{ steps.var.outputs.docker_repo }}
-        short-description: ${{ github.event.repository.description }}
-        enable-url-completion: true

.github/workflows/documentation.yml

@@ -1,104 +0,0 @@
-name: Documentation and GitHub Pages
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-    tags:
-      - '*'
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-env:
-  # Required to make some things output color
-  TERM: ansi
-  # Publishing to my nix binary cache
-  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
-  # conduwuit.cachix.org
-  CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-  # Custom nix binary cache if fork is being used
-  ATTIC_ENDPOINT: ${{ vars.ATTIC_ENDPOINT }}
-  ATTIC_PUBLIC_KEY: ${{ vars.ATTIC_PUBLIC_KEY }}
-  # Get error output from nix that we can actually use, and use our binary caches for the earlier CI steps
-  NIX_CONFIG: |
-    show-trace = true
-    extra-substituters = https://attic.kennel.juneis.dog/conduwuit https://attic.kennel.juneis.dog/conduit https://conduwuit.cachix.org https://aseipp-nix-cache.freetls.fastly.net https://nix-community.cachix.org https://crane.cachix.org
-    extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= crane.cachix.org-1:8Scfpmn9w+hGdXH/Q9tTLiYAE/2dnJYRJP7kl80GuRk=
-    experimental-features = nix-command flakes
-    extra-experimental-features = nix-command flakes
-    accept-flake-config = true
-
-# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
-# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
-concurrency:
-  group: "pages"
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  docs:
-    name: Documentation and GitHub Pages
-    runs-on: self-hosted
-
-    permissions:
-      pages: write
-      id-token: write
-
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-
-    steps:
-      - name: Sync repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Setup GitHub Pages
-        if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') && (github.event_name != 'pull_request')
-        uses: actions/configure-pages@v5
-
-      - name: Prepare build environment
-        run: |
-            echo 'source $HOME/.nix-profile/share/nix-direnv/direnvrc' > "$HOME/.direnvrc"
-            direnv allow
-            nix develop --command true
-
-      - name: Cache CI dependencies
-        run: |
-            bin/nix-build-and-cache ci
-
-      - name: Run lychee and markdownlint
-        run: |
-            direnv exec . engage just lints lychee
-            direnv exec . engage just lints markdownlint
-
-      - name: Build documentation (book)
-        run: |
-            bin/nix-build-and-cache just .#book
-
-            cp -r --dereference result public
-            chmod u+w -R public
-
-      - name: Upload generated documentation (book) as normal artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: public
-          path: public
-          if-no-files-found: error
-          # don't compress again
-          compression-level: 0
-
-      - name: Upload generated documentation (book) as GitHub Pages artifact
-        if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') && (github.event_name != 'pull_request')
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: public
-
-      - name: Deploy to GitHub Pages
-        if: (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') && (github.event_name != 'pull_request')
-        id: deployment
-        uses: actions/deploy-pages@v4

.github/workflows/lint.yml

@@ -0,0 +1,175 @@
+name: Linting
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+
+jobs:
+  fmt:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Format
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["fmt"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      rust_targets: ${{inputs.rust_targets}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  typos:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Typos
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["typos"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  audit:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Audit
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["audit"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  # disabled due to excessive build time issue installing cargo lychee
+  lychee:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+      && false
+
+    name: Lychee
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["lychee"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  check:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Check
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["check"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  clippy:
+    if: >
+      !failure() && !cancelled()
+      && inputs.cargo_profiles
+
+    name: Clippy
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["clippy"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

.github/workflows/main.yml

@@ -0,0 +1,298 @@
+name: Main
+
+on:
+  push:
+    branches:
+      - "**"
+    tags:
+      - "v*"
+  pull_request:
+    branches:
+      - "**"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{github.workflow}}-${{github.ref}}
+  cancel-in-progress: false
+
+jobs:
+  init:
+    name: Init
+    runs-on: ${{matrix.runner}}
+    env:
+      default_cargo_profiles: '["test", "release"]'
+      default_feat_sets: '["none", "default", "all"]'
+      default_rust_toolchains: '["nightly", "stable"]'
+      default_sys_names: '["debian"]'
+      default_sys_versions: '["testing-slim"]'
+      default_rust_targets: '["x86_64-unknown-linux-gnu"]'
+      default_sys_targets: '["x86_64-v1-linux-gnu"]'
+      default_machines: '["X64"]'
+
+    outputs:
+      cargo_profiles: ${{vars.CARGO_PROFILES || env.default_cargo_profiles}}
+      feat_sets: ${{vars.FEAT_SETS || env.default_feat_sets}}
+      rust_toolchains: ${{vars.RUST_TOOLCHAINS || env.default_rust_toolchains}}
+      rust_targets: ${{vars.RUST_TARGETS || env.default_rust_targets}}
+      sys_names: ${{vars.SYS_NAMES || env.default_sys_names}}
+      sys_targets: ${{vars.SYS_TARGETS || env.default_sys_targets}}
+      sys_versions: ${{vars.SYS_VERSIONS || env.default_sys_versions}}
+      machines: ${{vars.MACHINES || env.default_machines}}
+      package: ${{vars.PACKAGE || !contains(github.ref, 'refs/pull/')}}
+      publish: ${{vars.PUBLISH || !contains(github.ref, 'refs/pull/')}}
+      build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')}}
+      check_pkgs: ${{vars.CHECK_PKGS || 'false'}}
+      complement: ${{vars.COMPLEMENT || 'true'}}
+      complement_runner: 'het'
+      docker_repo: ${{vars.DOCKER_REPO}}
+      release_url: ${{steps.release.outputs.upload_url}}
+
+    strategy:
+      fail-fast: true
+      matrix:
+        runner: ${{fromJSON(vars.RUNNERS || '["het"]')}}
+        machine: ${{fromJSON(vars.MACHINES || '["X64"]')}}
+        exclude: ${{fromJSON(vars.RUNNERS_EXCLUDES || '[]')}}
+
+    steps:
+    - name: Initialize Builder
+      env:
+        runner: ${{matrix.runner}}
+        reserved_space: '{"het": "128GB", "aws": "48GB", "gcp": "160GB"}'
+        max_used_space: '{"het": "256GB", "aws": "64GB", "gcp": "192GB"}'
+      run: |
+        set +e
+        docker buildx inspect "${GITHUB_ACTOR}"
+        if test x"$?" = x"0"; then
+          exit 0
+        fi
+
+        set -eux
+        reserved_space=$(echo -n "$reserved_space" | jq -r ".$runner")
+        max_used_space=$(echo -n "$max_used_space" | jq -r ".$runner")
+        cat <<EOF > ./buildkitd.toml
+        [system]
+          platformsCacheMaxAge = "504h"
+        [worker.oci]
+          enabled = true
+          rootless = false
+          gc = true
+          reservedSpace = "${reserved_space}"
+          maxUsedSpace = "${max_used_space}"
+        [[worker.oci.gcpolicy]]
+          reservedSpace = "${reserved_space}"
+          maxUsedSpace = "${max_used_space}"
+          filters = ["label!=cache==pin"]
+          all = true
+        EOF
+
+        docker buildx create \
+          --bootstrap \
+          --driver docker-container \
+          --buildkitd-config ./buildkitd.toml \
+          --name "${GITHUB_ACTOR}" \
+          --buildkitd-flags "--allow-insecure-entitlement network.host"
+
+    - if: >
+        !failure() && !cancelled()
+        && contains(github.ref, 'refs/tags/v')
+        && matrix.runner == 'het'
+
+      id: release
+      name: Create Release
+      uses: actions/create-release@v1
+      env:
+        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      with:
+        release_name: Release ${{github.ref_name}}
+        tag_name: ${{github.ref}}
+        body_path: RELEASE.md
+        draft: ${{ contains(github.ref, '-draft') }}
+        prerelease: ${{ contains(github.ref, '-rc') }}
+
+  lint:
+    if: >
+      !failure() && !cancelled()
+      && !contains(github.ref, 'refs/tags/v')
+
+    name: Lint
+    needs: [init] #needs: [init, deps]
+    uses: ./.github/workflows/lint.yml
+    with:
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "none"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "default"},
+          {"cargo_profile": "release-debuginfo"},
+          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
+          {"cargo_profile": "release-native", "feat_set": "none"},
+          {"cargo_profile": "release-native", "feat_set": "default"},
+          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu"},
+          {"sys_target": "x86_64-v3-linux-gnu"},
+          {"sys_target": "x86_64-v4-linux-gnu"},
+        ]
+
+  test:
+    if: >
+      !failure() && !cancelled()
+      && !contains(github.ref, 'refs/tags/v')
+
+    name: Test
+    needs: [init, lint]
+    uses: ./.github/workflows/test.yml
+    with:
+      complement: ${{fromJSON(needs.init.outputs.complement)}}
+      complement_runner: ${{needs.init.outputs.complement_runner}}
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-debuginfo"},
+          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
+          {"cargo_profile": "release-native", "feat_set": "default"},
+          {"cargo_profile": "release-native", "feat_set": "none"},
+          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+        ]
+
+  package:
+    if: >
+      !failure() && !cancelled()
+      && needs.init.outputs.package
+
+    name: Package
+    needs: [init, lint]
+    uses: ./.github/workflows/package.yml
+    with:
+      release_url: ${{needs.init.outputs.release_url}}
+      check_pkgs: ${{needs.init.outputs.check_pkgs}}
+      build_pkgs: ${{needs.init.outputs.build_pkgs}}
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"feat_set": "none"},
+          {"cargo_profile": "test"},
+          {"cargo_profile": "release-native"},
+          {"cargo_profile": "release-debuginfo", "feat_set": "default"},
+          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release-debuginfo", "bake_target": "oci"},
+          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v4-linux-gnu"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+        ]
+
+  publish:
+    if: >
+      !failure() && !cancelled()
+      && needs.init.outputs.publish
+
+    name: Publish
+    needs: [init, test, package]
+    uses: ./.github/workflows/publish.yml
+    with:
+      docker_repo: ${{needs.init.outputs.docker_repo}}
+      release_url: ${{needs.init.outputs.release_url}}
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"feat_set": "none"},
+          {"cargo_profile": "test"},
+          {"cargo_profile": "release-debuginfo"},
+          {"cargo_profile": "release-native"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+        ]
+
+    secrets:
+      ghcr_token: ${{ secrets.GHCR_TOKEN }}
+      dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/package.yml

@@ -0,0 +1,204 @@
+name: Package
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      release_url:
+        type: string
+        description: For release assets
+      build_pkgs:
+        type: string
+        default: 'true'
+      check_pkgs:
+        type: string
+        default: 'false'
+
+jobs:
+  book:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["default"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Book
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["book"]'
+      cargo_profiles: '["release"]'
+      feat_sets: '["default"]'
+      rust_toolchains: '["stable"]'
+      rust_targets: ${{inputs.rust_targets}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      runner: 'het'
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "book": {
+            "dst": "book",
+            "src": "/book",
+            "pages": true
+          }
+        }
+
+  binary:
+    if: >
+      !failure() && !cancelled()
+
+    name: Binaries
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["static"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "static": {
+            "dst": "tuwunel.zst",
+            "src": "/usr/bin/tuwunel",
+            "mime": "application/zstd",
+            "zstd": 11,
+            "chmod": "a+x"
+          }
+        }
+
+  container:
+    if: >
+      !failure() && !cancelled()
+
+    name: Containers
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["docker", "oci"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "docker": {
+            "dst": "tuwunel-docker.tar.gz",
+            "img": true,
+            "mime": "application/gzip",
+            "gzip": 7
+          },
+          "oci": {
+            "dst": "tuwunel-oci.tar.zst",
+            "runner": true,
+            "mime": "application/zstd",
+            "zstd": 11
+          }
+        }
+
+  pkgs:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && fromJSON(inputs.build_pkgs)
+
+    name: Distro Packages
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["deb", "rpm"]'
+      cargo_profiles: '["release"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["stable"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "deb": {
+            "dst": "tuwunel.deb",
+            "mime": "application/vnd.debian.binary-package"
+          },
+          "rpm": {
+            "dst": "tuwunel.rpm",
+            "mime": "application/x-rpm"
+          }
+        }
+
+  check_pkgs:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && fromJSON(inputs.check_pkgs)
+
+    name: Check Packages
+    needs: [pkgs]
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["deb-install", "rpm-install"]'
+      cargo_profiles: '["release"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["stable"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

.github/workflows/publish.yml

@@ -0,0 +1,321 @@
+name: Publish
+
+on:
+  workflow_call:
+    secrets:
+      ghcr_token:
+      dockerhub_token:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      docker_repo:
+        type: string
+        description: DockerHub Repository
+      release_url:
+        type: string
+        description: For release assets
+
+jobs:
+  documents:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["X64"]')[0])
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+      && !contains(github.ref, '-draft')
+
+    name: Documents
+    runs-on: ['X64', 'het']
+    permissions:
+      pages: write
+      id-token: write
+
+    steps:
+      - id: book
+        name: Book
+        uses: actions/deploy-pages@v4
+
+  containers:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && inputs.docker_repo != ''
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+    name: Containers
+    runs-on: ${{matrix.machine}}
+    permissions: write-all
+    strategy:
+      fail-fast: true
+      matrix:
+        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
+        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
+        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
+        feat_set: ${{fromJSON(inputs.feat_sets)}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: GitHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr_token }}
+
+      - name: DockerHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Bake
+        env:
+          bake_target: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          rust_toolchain: ${{matrix.rust_toolchain}}
+          rust_target: ${{matrix.rust_target}}
+          feat_set: ${{matrix.feat_set}}
+          sys_name: ${{matrix.sys_name}}
+          sys_version: ${{matrix.sys_version}}
+          sys_target: ${{matrix.sys_target}}
+          machine: ${{matrix.machine}}
+          acct: ${{github.actor}}
+          repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker/bake.sh "${{matrix.bake_target}}"
+
+  bundles:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && inputs.docker_repo != ''
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+    name: Bundles
+    needs: [containers]
+    runs-on: 'het'
+    permissions: write-all
+    strategy:
+      fail-fast: true
+      matrix:
+        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
+        cargo_profile: ${{fromJSON('["release"]')}}
+        feat_set: ${{fromJSON('["all"]')}}
+        rust_toolchain: ${{fromJSON('["stable"]')}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+
+    steps:
+      - name: GitHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr_token }}
+
+      - name: DockerHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Release Branch
+        if: >
+          !failure() && !cancelled()
+          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+        env:
+          acct: ${{github.actor}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+          registry: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          feat_set: ${{matrix.feat_set}}
+          sys_target: ${{matrix.sys_target}}
+          ref_name: ${{github.ref_name}}
+
+        run: |
+          registry="$(echo -n $registry | sed s/_/./)"
+          if test "$registry" = "ghcr.io"; then
+            repo="$ghcr_repo"
+          else
+            repo="$docker_repo"
+          fi
+
+          docker manifest create "${registry}/${repo}:${ref_name}" \
+            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
+
+      - name: Release Preview
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+
+        env:
+          acct: ${{github.actor}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+          registry: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          feat_set: ${{matrix.feat_set}}
+          sys_target: ${{matrix.sys_target}}
+          ref_name: ${{github.ref_name}}
+
+        run: |
+          registry="$(echo -n $registry | sed s/_/./)"
+          if test "$registry" = "ghcr.io"; then
+            repo="$ghcr_repo"
+          else
+            repo="$docker_repo"
+          fi
+
+          docker manifest create "${registry}/${repo}:preview" \
+            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
+
+      - name: Release Latest
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+          && !contains(github.ref, '-rc')
+
+        env:
+          acct: ${{github.actor}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+          registry: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          feat_set: ${{matrix.feat_set}}
+          sys_target: ${{matrix.sys_target}}
+          ref_name: ${{github.ref_name}}
+
+        run: |
+          registry="$(echo -n $registry | sed s/_/./)"
+          if test "$registry" = "ghcr.io"; then
+            repo="$ghcr_repo"
+          else
+            repo="$docker_repo"
+          fi
+
+          docker manifest create "${registry}/${repo}:latest" \
+            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
+
+  delivery:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && inputs.docker_repo != ''
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+    name: Delivery
+    needs: [bundles, documents]
+    runs-on: 'het'
+    permissions: write-all
+    steps:
+      - name: GitHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr_token }}
+
+      - name: DockerHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Push Branch
+        if: >
+          !failure() && !cancelled()
+          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+        env:
+          ref_name: ${{github.ref_name}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker manifest push -p "ghcr.io/${ghcr_repo}:${ref_name}"
+          docker manifest push -p "docker.io/${docker_repo}:${ref_name}"
+
+      - name: Push Preview
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+
+        env:
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker manifest push -p "ghcr.io/${ghcr_repo}:preview"
+          docker manifest push -p "docker.io/${docker_repo}:preview"
+
+      - name: Push Latest
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+          && !contains(github.ref, '-rc')
+
+        env:
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker manifest push -p "ghcr.io/${ghcr_repo}:latest"
+          docker manifest push -p "docker.io/${docker_repo}:latest"

.github/workflows/release.yml

@@ -1,118 +0,0 @@
-name: Upload Release Assets
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to release'
-        required: true
-        type: string
-      action_id:
-        description: 'Action ID of the CI run'
-        required: true
-        type: string
-
-permissions: {}
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    env:
-      GH_EVENT_NAME: ${{ github.event_name }}
-      GH_EVENT_INPUTS_ACTION_ID: ${{ github.event.inputs.action_id }}
-      GH_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
-      GH_REPOSITORY: ${{ github.repository }}
-      GH_SHA: ${{ github.sha }}
-      GH_TAG: ${{ github.event.release.tag_name }}
-
-    steps:
-      - name: get latest ci id
-        id: get_ci_id
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          if [ "${GH_EVENT_NAME}" == "workflow_dispatch" ]; then
-            id="${GH_EVENT_INPUTS_ACTION_ID}"
-            tag="${GH_EVENT_INPUTS_TAG}"
-          else
-            # get all runs of the ci workflow
-            json=$(gh api "repos/${GH_REPOSITORY}/actions/workflows/ci.yml/runs")
-
-            # find first run that is github sha and status is completed
-            id=$(echo "$json" | jq ".workflow_runs[] | select(.head_sha == \"${GH_SHA}\" and .status == \"completed\") | .id" | head -n 1)
-
-            if [ ! "$id" ]; then
-              echo "No completed runs found"
-              echo "ci_id=0" >> "$GITHUB_OUTPUT"
-              exit 0
-            fi
-
-            tag="${GH_TAG}"
-          fi
-
-          echo "ci_id=$id" >> "$GITHUB_OUTPUT"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-
-      - name: get latest ci artifacts
-        if: steps.get_ci_id.outputs.ci_id != 0
-        uses: actions/download-artifact@v4
-        env:
-          GH_TOKEN: ${{ github.token }}
-        with:
-          merge-multiple: true
-          run-id: ${{ steps.get_ci_id.outputs.ci_id }}
-          github-token: ${{ github.token }}
-
-      - run: |
-          ls
-
-      - name: upload release assets
-        if: steps.get_ci_id.outputs.ci_id != 0
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ steps.get_ci_id.outputs.tag }}
-        run: |
-          for file in $(find . -type f); do
-            case "$file" in
-              *json*) echo "Skipping $file...";;
-              *) echo "Uploading $file..."; gh release upload $TAG "$file" --clobber --repo="${GH_REPOSITORY}" || echo "Something went wrong, skipping.";;
-            esac
-          done
-
-      - name: upload release assets to website
-        if: steps.get_ci_id.outputs.ci_id != 0
-        env:
-          TAG: ${{ steps.get_ci_id.outputs.tag }}
-        run: |
-          mkdir -p -v ~/.ssh
-
-          echo "${{ secrets.WEB_UPLOAD_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-          echo "${{ secrets.WEB_UPLOAD_SSH_PRIVATE_KEY }}" >> ~/.ssh/id_ed25519
-
-          chmod 600 ~/.ssh/id_ed25519
-
-          cat >>~/.ssh/config <<END
-          Host website
-            HostName ${{ secrets.WEB_UPLOAD_SSH_HOSTNAME }}
-            User ${{ secrets.WEB_UPLOAD_SSH_USERNAME }}
-            IdentityFile ~/.ssh/id_ed25519
-            StrictHostKeyChecking yes
-            AddKeysToAgent no
-            ForwardX11 no
-            BatchMode yes
-          END
-
-          echo "Creating tag directory on web server"
-          ssh -q website "rm -rf /var/www/girlboss.ceo/~strawberry/conduwuit/releases/$TAG/"
-          ssh -q website "mkdir -v /var/www/girlboss.ceo/~strawberry/conduwuit/releases/$TAG/"
-
-          for file in $(find . -type f); do
-            case "$file" in
-              *json*) echo "Skipping $file...";;
-              *) echo "Uploading $file to website"; scp $file website:/var/www/girlboss.ceo/~strawberry/conduwuit/releases/$TAG/$file;;
-            esac
-          done

.github/workflows/test.yml

@@ -0,0 +1,238 @@
+name: Testing
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      complement:
+        type: boolean
+        default: true
+      complement_feat_sets:
+        type: string
+        default: '["all"]'
+      complement_runner:
+        type: string
+
+jobs:
+  unit:
+    if: >
+      contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Unit
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["unit"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  smoke:
+    if: >
+      !failure() && !cancelled()
+      && inputs.cargo_profiles
+      && inputs.machines
+
+    name: Smoke
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["smoke", "smoke-valgrind"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      includes: ${{inputs.includes}}
+      excludes: >
+        [
+          {"cargo_profile": "test", "feat_set": "default"},
+          {"cargo_profile": "test", "feat_set": "none", "bake_target": "smoke-valgrind"},
+          {"cargo_profile": "test", "rust_toolchain": "stable"},
+          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "release", "bake_target": "smoke-valgrind"},
+          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release-debuginfo", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "release-debuginfo", "bake_target": "smoke"},
+          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
+          {"cargo_profile": "release-native", "feat_set": "none"},
+          {"cargo_profile": "release-native", "feat_set": "default"},
+          {"cargo_profile": "release-native", "bake_target": "smoke-valgrind"},
+          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-native", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "release-native", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "release-native", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "bake_target": "smoke-valgrind"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "bake_target": "smoke-valgrind"},
+        ]
+
+  complement:
+    if: >
+      !failure() && !cancelled()
+      && inputs.complement
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.complement_feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Complement
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["complement-tester", "complement-testee"]'
+      cargo_profiles: '["test"]'
+      feat_sets: ${{inputs.complement_feat_sets}}
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      runner: ${{inputs.complement_runner}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  compliance:
+    if: >
+      !failure() && !cancelled()
+      && inputs.complement
+      && inputs.machines
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Matrix Compliance
+    needs: [complement]
+    runs-on: ["${{matrix.machine}}", "${{inputs.complement_runner}}"]
+    concurrency:
+      group: complement-cant-walk-and-chew-bubblegum
+      cancel-in-progress: false
+
+    strategy:
+      fail-fast: false
+      matrix:
+        cargo_profile: ${{fromJSON('["test"]')}}
+        feat_set: ${{fromJSON(inputs.complement_feat_sets)}}
+        rust_toolchain: ${{fromJSON('["nightly"]')}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON('["x86_64-v1-linux-gnu"]')}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Execute
+      id: execute
+      env:
+        cargo_profile: ${{matrix.cargo_profile}}
+        rust_toolchain: ${{matrix.rust_toolchain}}
+        rust_target: ${{matrix.rust_target}}
+        feat_set: ${{matrix.feat_set}}
+        sys_name: ${{matrix.sys_name}}
+        sys_target: ${{matrix.sys_target}}
+        sys_version: ${{matrix.sys_version}}
+        machine: ${{matrix.machine}}
+
+      run: |
+        docker/complement.sh
+
+    - if: success() || failure() && steps.execute.outcome == 'failure'
+      name: Extract
+      id: extract
+      env:
+        name: complement_tester__${{matrix.sys_name}}__${{matrix.sys_version}}__${{matrix.sys_target}}
+        tag: latest
+
+      run: |
+        cid=$(cat "$name")
+        docker cp "$cid:/usr/src/complement/new_results.jsonl" tests/test_results/complement/test_results.jsonl
+
+    - if: success() || failure() && steps.execute.outcome == 'failure'
+      name: Upload New Results
+      id: upload-result
+      uses: actions/upload-artifact@v4
+      with:
+        name: complement_results-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
+        path: ./tests/test_results/complement/test_results.jsonl
+
+    - if: failure() && steps.execute.outcome == 'failure'
+      name: Upload Failure Output
+      id: upload-output
+      uses: actions/upload-artifact@v4
+      with:
+        name: complement_output-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
+        path: ./complement.jsonl
+        if-no-files-found: ignore
+
+    - name: Accept
+      id: accept
+      run: |
+        git diff --exit-code --color --color-moved

.gitignore

@@ -95,3 +95,10 @@ rustc-ice-*
 
 # complement test logs are huge
 tests/test_results/complement/test_logs.jsonl
+
+# cargo profiles from -Z self-profile
+*.mm_profdata
+
+# Editor crashfiles
+*.save
+*.swp

.gitlab-ci.yml

@@ -1,152 +0,0 @@
-stages:
-  - ci
-  - artifacts
-  - publish
-
-variables:
-  # Makes some things print in color
-  TERM: ansi
-  # Faster cache and artifact compression / decompression
-  FF_USE_FASTZIP: true
-  # Print progress reports for cache and artifact transfers
-  TRANSFER_METER_FREQUENCY: 5s
-  NIX_CONFIG: |
-    show-trace = true
-    extra-substituters = https://attic.kennel.juneis.dog/conduit https://attic.kennel.juneis.dog/conduwuit https://conduwuit.cachix.org
-    extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk= conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE= conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
-    experimental-features = nix-command flakes
-    extra-experimental-features = nix-command flakes
-    accept-flake-config = true
-
-# Avoid duplicate pipelines
-# See: https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
-workflow:
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
-      when: never
-    - if: $CI
-
-before_script:
-  # Enable nix-command and flakes
-  - if command -v nix > /dev/null; then echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf; fi
-  - if command -v nix > /dev/null; then echo "extra-experimental-features = nix-command flakes" >> /etc/nix/nix.conf; fi
-  # Accept flake config from "untrusted" users
-  - if command -v nix > /dev/null; then echo "accept-flake-config = true" >> /etc/nix/nix.conf; fi
-
-  # Add conduwuit binary cache
-  - if command -v nix > /dev/null; then echo "extra-substituters = https://attic.kennel.juneis.dog/conduwuit" >> /etc/nix/nix.conf; fi
-  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE=" >> /etc/nix/nix.conf; fi
-
-  - if command -v nix > /dev/null; then echo "extra-substituters = https://attic.kennel.juneis.dog/conduit" >> /etc/nix/nix.conf; fi
-  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk=" >> /etc/nix/nix.conf; fi
-
-  # Add alternate binary cache
-  - if command -v nix > /dev/null && [ -n "$ATTIC_ENDPOINT" ]; then echo "extra-substituters = $ATTIC_ENDPOINT" >> /etc/nix/nix.conf; fi
-  - if command -v nix > /dev/null && [ -n "$ATTIC_PUBLIC_KEY" ]; then echo "extra-trusted-public-keys = $ATTIC_PUBLIC_KEY" >> /etc/nix/nix.conf; fi
-
-  # Add crane binary cache
-  - if command -v nix > /dev/null; then echo "extra-substituters = https://crane.cachix.org" >> /etc/nix/nix.conf; fi
-  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = crane.cachix.org-1:8Scfpmn9w+hGdXH/Q9tTLiYAE/2dnJYRJP7kl80GuRk=" >> /etc/nix/nix.conf; fi
-
-  # Add nix-community binary cache
-  - if command -v nix > /dev/null; then echo "extra-substituters = https://nix-community.cachix.org" >> /etc/nix/nix.conf; fi
-  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" >> /etc/nix/nix.conf; fi
-
-  - if command -v nix > /dev/null; then echo "extra-substituters = https://aseipp-nix-cache.freetls.fastly.net" >> /etc/nix/nix.conf; fi
-
-  # Install direnv and nix-direnv
-  - if command -v nix > /dev/null; then nix-env -iA nixpkgs.direnv nixpkgs.nix-direnv; fi
-
-  # Allow .envrc
-  - if command -v nix > /dev/null; then direnv allow; fi
-
-  # Set CARGO_HOME to a cacheable path
-  - export CARGO_HOME="$(git rev-parse --show-toplevel)/.gitlab-ci.d/cargo"
-
-ci:
-  stage: ci
-  image: nixos/nix:2.24.9
-  script:
-    # Cache CI dependencies
-    - ./bin/nix-build-and-cache ci
-
-    - direnv exec . engage
-  cache:
-    key: nix
-    paths:
-      - target
-      - .gitlab-ci.d
-  rules:
-    # CI on upstream runners (only available for maintainers)
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $IS_UPSTREAM_CI == "true"
-    # Manual CI on unprotected branches that are not MRs
-    - if: $CI_PIPELINE_SOURCE != "merge_request_event" && $CI_COMMIT_REF_PROTECTED == "false"
-      when: manual
-    # Manual CI on forks
-    - if: $IS_UPSTREAM_CI != "true"
-      when: manual
-    - if: $CI
-  interruptible: true
-
-artifacts:
-  stage: artifacts
-  image: nixos/nix:2.24.9
-  script:
-    - ./bin/nix-build-and-cache just .#static-x86_64-linux-musl
-    - cp result/bin/conduit x86_64-linux-musl
-
-    - mkdir -p target/release
-    - cp result/bin/conduit target/release
-    - direnv exec . cargo deb --no-build --no-strip
-    - mv target/debian/*.deb x86_64-linux-musl.deb
-
-    # Since the OCI image package is based on the binary package, this has the
-    # fun side effect of uploading the normal binary too. Conduit users who are
-    # deploying with Nix can leverage this fact by adding our binary cache to
-    # their systems.
-    #
-    # Note that although we have an `oci-image-x86_64-linux-musl`
-    # output, we don't build it because it would be largely redundant to this
-    # one since it's all containerized anyway.
-    - ./bin/nix-build-and-cache just .#oci-image
-    - cp result oci-image-amd64.tar.gz
-
-    - ./bin/nix-build-and-cache just .#static-aarch64-linux-musl
-    - cp result/bin/conduit aarch64-linux-musl
-
-    - ./bin/nix-build-and-cache just .#oci-image-aarch64-linux-musl
-    - cp result oci-image-arm64v8.tar.gz
-
-    - ./bin/nix-build-and-cache just .#book
-    # We can't just copy the symlink, we need to dereference it https://gitlab.com/gitlab-org/gitlab/-/issues/19746
-    - cp -r --dereference result public
-  artifacts:
-    paths:
-      - x86_64-linux-musl
-      - aarch64-linux-musl
-      - x86_64-linux-musl.deb
-      - oci-image-amd64.tar.gz
-      - oci-image-arm64v8.tar.gz
-      - public
-  rules:
-    # CI required for all MRs
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    # Optional CI on forks
-    - if: $IS_UPSTREAM_CI != "true"
-      when: manual
-      allow_failure: true
-    - if: $CI
-  interruptible: true
-
-pages:
-  stage: publish
-  dependencies:
-    - artifacts
-  only:
-    - next
-  script:
-    - "true"
-  artifacts:
-    paths:
-      - public

.typos.toml

@@ -0,0 +1,6 @@
+[default.extend-words]
+"allocatedp" = "allocatedp"
+"conduwuit" = "conduwuit"
+"execuse" = "execuse"
+"leafs" = "leafs"
+"serialize" = "serialize"

CODE_OF_CONDUCT.md

@@ -1,4 +1,3 @@
-
 # Contributor Covenant Code of Conduct
 
 ## Our Pledge
@@ -18,24 +17,24 @@ ## Our Standards
 Examples of behavior that contributes to a positive environment for our
 community include:
 
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
+* Demonstrating empathy and kindness toward other people.
+* Being respectful of differing opinions, viewpoints, and experiences.
+* Giving and gracefully accepting constructive feedback.
 * Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
+  and learning from the experience.
 * Focusing on what is best not just for us as individuals, but for the overall
-  community
+  community.
 
 Examples of unacceptable behavior include:
 
 * The use of sexualized language or imagery, and sexual attention or advances of
-  any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
+  any kind.
+* Trolling, insulting or derogatory comments, and personal or political attacks.
+* Public or private harassment.
 * Publishing others' private information, such as a physical or email address,
-  without their explicit permission
+  without their explicit permission.
 * Other conduct which could reasonably be considered inappropriate in a
-  professional setting
+  professional setting.
 
 ## Enforcement Responsibilities
 
@@ -61,10 +60,10 @@ ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement over email at
-<strawberry@puppygock.gay> or over Matrix at @strawberry:puppygock.gay.
-All complaints will be reviewed and investigated promptly and fairly.
+<abuse@tuwunel.chat> or over Matrix at @abuse:tuwunel.chat.
 
-All community leaders are obligated to respect the privacy and security of the
+All complaints will be reviewed and investigated promptly and fairly. All
+community leaders are obligated to respect the privacy and security of the
 reporter of any incident.
 
 ## Enforcement Guidelines

CONTRIBUTING.md

@@ -1,10 +1,10 @@
 # Contributing guide
 
-This page is for about contributing to conduwuit. The
+This page is for about contributing to Tuwunel. The
 [development](./development.md) page may be of interest for you as well.
 
 If you would like to work on an [issue][issues] that is not assigned, preferably
-ask in the Matrix room first at [#conduwuit:puppygock.gay][conduwuit-matrix],
+ask in the Matrix room first at [#tuwunel:tuwunel.chat][tuwunel-chat],
 and comment on it.
 
 ### Linting and Formatting
@@ -23,40 +23,7 @@ ### Linting and Formatting
 
 ### Running CI tests locally
 
-conduwuit's CI for tests, linting, formatting, audit, etc use
-[`engage`][engage]. engage can be installed from nixpkgs or `cargo install
-engage`. conduwuit's Nix flake devshell has the nixpkgs engage with `direnv`.
-Use `engage --help` for more usage details.
-
-To test, format, lint, etc that CI would do, install engage, allow the `.envrc`
-file using `direnv allow`, and run `engage`.
-
-All of the tasks are defined at the [engage.toml][engage.toml] file. You can
-view all of them neatly by running `engage list`
-
-If you would like to run only a specific engage task group, use `just`:
-
-- `engage just <group>`
-- Example: `engage just lints`
-
-If you would like to run a specific engage task in a specific group, use `just
-<GROUP> [TASK]`: `engage just lints cargo-fmt`
-
-The following binaries are used in [`engage.toml`][engage.toml]:
-
-- [`engage`][engage]
-- `nix`
-- [`direnv`][direnv]
-- `rustc`
-- `cargo`
-- `cargo-fmt`
-- `rustdoc`
-- `cargo-clippy`
-- [`cargo-audit`][cargo-audit]
-- [`cargo-deb`][cargo-deb]
-- [`lychee`][lychee]
-- [`markdownlint-cli`][markdownlint-cli]
-- `dpkg`
+<sub>TODO: docker bake matrix</sub>
 
 ### Matrix tests
 
@@ -73,7 +40,7 @@ ### Matrix tests
 
 ### Writing documentation
 
-conduwuit's website uses [`mdbook`][mdbook] and deployed via CI using GitHub
+Tuwunel's website uses [`mdbook`][mdbook] and deployed via CI using GitHub
 Pages in the [`documentation.yml`][documentation.yml] workflow file with Nix's
 mdbook in the devshell. All documentation is in the `docs/` directory at the top
 level. The compiled mdbook website is also uploaded as an artifact.
@@ -111,7 +78,7 @@ ### Variable, comment, function, etc standards
 
 ### Creating pull requests
 
-Please try to keep contributions to the GitHub. While the mirrors of conduwuit
+Please try to keep contributions to the GitHub. While the mirrors of Tuwunel
 allow for pull/merge requests, there is no guarantee I will see them in a timely
 manner. Additionally, please mark WIP or unfinished or incomplete PRs as drafts.
 This prevents me from having to ping once in a while to double check the status
@@ -120,25 +87,34 @@ ### Creating pull requests
 
 If you open a pull request on one of the mirrors, it is your responsibility to
 inform me about its existence. In the future I may try to solve this with more
-repo bots in the conduwuit Matrix room. There is no mailing list or email-patch
+repo bots in the Tuwunel Matrix room. There is no mailing list or email-patch
 support on the sr.ht mirror, but if you'd like to email me a git patch you can
-do so at `strawberry@puppygock.gay`.
+do so at `maintainer@tuwunel.chat`.
 
 Direct all PRs/MRs to the `main` branch.
 
 By sending a pull request or patch, you are agreeing that your changes are
 allowed to be licenced under the Apache-2.0 licence and all of your conduct is
-in line with the Contributor's Covenant, and conduwuit's Code of Conduct.
+in line with the Contributor's Covenant, and Tuwunel's Code of Conduct.
 
 Contribution by users who violate either of these code of conducts will not have
 their contributions accepted. This includes users who have been banned from
-conduwuit Matrix rooms for Code of Conduct violations.
+Tuwunel Matrix rooms for Code of Conduct violations.
 
-[issues]: https://github.com/girlbossceo/conduwuit/issues
-[conduwuit-matrix]: https://matrix.to/#/#conduwuit:puppygock.gay
+### Branch Policy
+
+##### This section applies to Matrix-Construct members and Tuwunel maintainers
+
+All branches on the matrix-construct/tuwunel repository are _centrally
+maintained_. They may be rebased without your consent. Trivial conflicts may be
+resolved by another maintainer. Please resolve more difficult conflicts as soon
+as possible. Personal forks are advised to reduce the workload on other
+maintainers. Stale branches will be deleted to reduce the effort for this
+policy.
+
+[issues]: https://github.com/matrix-construct/tuwunel/issues
+[tuwunel-chat]: https://matrix.to/#/#tuwunel:tuwunel.chat
 [complement]: https://github.com/matrix-org/complement/
-[engage.toml]: https://github.com/girlbossceo/conduwuit/blob/main/engage.toml
-[engage]: https://charles.page.computer.surgery/engage/
 [sytest]: https://github.com/matrix-org/sytest/
 [cargo-deb]: https://github.com/kornelski/cargo-deb
 [lychee]: https://github.com/lycheeverse/lychee
@@ -146,4 +122,4 @@ ### Creating pull requests
 [cargo-audit]: https://github.com/RustSec/rustsec/tree/main/cargo-audit
 [direnv]: https://direnv.net/
 [mdbook]: https://rust-lang.github.io/mdBook/
-[documentation.yml]: https://github.com/girlbossceo/conduwuit/blob/main/.github/workflows/documentation.yml
+[documentation.yml]: https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/docs.yml

README.md

@@ -1,178 +1,168 @@
-# conduwuit
-
-[![conduwuit main room](https://img.shields.io/matrix/conduwuit%3Apuppygock.gay?server_fqdn=matrix.transfem.dev&style=flat&logo=matrix&logoColor=%23f5b3ff&label=%23conduwuit%3Apuppygock.gay&color=%23f652ff)](https://matrix.to/#/#conduwuit:puppygock.gay) [![conduwuit space](https://img.shields.io/matrix/conduwuit-space%3Apuppygock.gay?server_fqdn=matrix.transfem.dev&style=flat&logo=matrix&logoColor=%23f5b3ff&label=%23conduwuit-space%3Apuppygock.gay&color=%23f652ff)](https://matrix.to/#/#conduwuit-space:puppygock.gay)
-
-[![CI and Artifacts](https://github.com/girlbossceo/conduwuit/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/girlbossceo/conduwuit/actions/workflows/ci.yml)
-
-![GitHub Repo stars](https://img.shields.io/github/stars/girlbossceo/conduwuit?style=flat&color=%23fcba03&link=https%3A%2F%2Fgithub.com%2Fgirlbossceo%2Fconduwuit) ![GitHub commit activity](https://img.shields.io/github/commit-activity/m/girlbossceo/conduwuit?style=flat&color=%2303fcb1&link=https%3A%2F%2Fgithub.com%2Fgirlbossceo%2Fconduwuit%2Fpulse%2Fmonthly) ![GitHub Created At](https://img.shields.io/github/created-at/girlbossceo/conduwuit) ![GitHub Sponsors](https://img.shields.io/github/sponsors/girlbossceo?color=%23fc03ba&link=https%3A%2F%2Fgithub.com%2Fsponsors%2Fgirlbossceo) ![GitHub License](https://img.shields.io/github/license/girlbossceo/conduwuit)
-
-
-
-![Docker Image Size (tag)](https://img.shields.io/docker/image-size/girlbossceo/conduwuit/latest?label=image%20size%20(latest)&link=https%3A%2F%2Fhub.docker.com%2Frepository%2Fdocker%2Fgirlbossceo%2Fconduwuit%2Ftags%3Fname%3Dlatest) ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/girlbossceo/conduwuit/main?label=image%20size%20(main)&link=https%3A%2F%2Fhub.docker.com%2Frepository%2Fdocker%2Fgirlbossceo%2Fconduwuit%2Ftags%3Fname%3Dmain)
-
+# Tuwunel<sup>💕</sup>
 
+![GitHub License](https://img.shields.io/github/license/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
+![GitHub Created At](https://img.shields.io/github/created-at/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
+![GitHub Commit Activity](https://img.shields.io/github/commit-activity/m/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel%2Fpulse%2Fmonthly&color=%238A2BE2)
+![Docker Pulls](https://img.shields.io/docker/pulls/jevolk/tuwunel?style=flat&color=8A2BE2)
+![GitHub Repo Stars](https://img.shields.io/github/stars/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel&color=%238A2BE2)
+[![CI/CD](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml/badge.svg?branch=main&style=flat)](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml)
 
 <!-- ANCHOR: catchphrase -->
 
-### a very cool [Matrix](https://matrix.org/) chat homeserver written in Rust
+## High Performance Matrix Homeserver in Rust!
 
 <!-- ANCHOR_END: catchphrase -->
 
-Visit the [conduwuit documentation](https://conduwuit.puppyirl.gay/) for more
-information and how to deploy/setup conduwuit.
-
 <!-- ANCHOR: body -->
 
-#### What is Matrix?
+Tuwunel is a featureful [Matrix](https://matrix.org/) homeserver you can use instead of Synapse
+with your favorite [client](https://matrix.org/ecosystem/clients/),
+[bridge](https://matrix.org/ecosystem/bridges/) or
+[bot](https://matrix.org/ecosystem/integrations/). It is written entirely in Rust to be a scalable,
+lightweight, low-cost, community-driven alternative covering all but the most niche uses.
 
-[Matrix](https://matrix.org) is an open, federated, and extensible network for
-decentralised communication. Users from any Matrix homeserver can chat with users from all
-other homeservers over federation. Matrix is designed to be extensible and built on top of.
-You can even use bridges such as Matrix Appservices to communicate with users outside of Matrix, like a community on Discord.
+This project is the official successor to conduwuit, which
+was a featureful and high-performance fork of [Conduit](https://gitlab.com/famedly/conduit), all
+community-lead homeservers implementing the compatible
+[Matrix Specification](https://spec.matrix.org/latest/).
 
-#### What is the goal?
+Tuwunel is operated by enterprise users with a vested interest in sponsoring its continued
+development. It is now maintained by full-time staff.
 
-A high-performance, efficient, low-cost, and featureful Matrix homeserver that's
-easy to set up and just works with minimal configuration needed.
+### Getting Started
 
-#### Can I try it out?
+- [GitHub Releases](https://github.com/matrix-construct/tuwunel/releases)
+- [Sourcecode](https://github.com/matrix-construct/tuwunel/) `git clone https://github.com/matrix-construct/tuwunel.git`
+- [DockerHub](https://hub.docker.com/r/jevolk/tuwunel) or `docker pull jevolk/tuwunel:latest`
+- [GHCR](https://github.com/matrix-construct/tuwunel/pkgs/container/tuwunel) or `docker pull ghcr.io/matrix-construct/tuwunel:latest`
+- Static binaries available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
+- Deb and RPM packages available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
+- Arch package available as [tuwunel](https://aur.archlinux.org/packages/tuwunel) or [tuwunel-git](https://aur.archlinux.org/packages/tuwunel-git).
+- Nix package still [needs some love](https://github.com/NixOS/nixpkgs/issues/415469).
 
-An official conduwuit server ran by me is available at transfem.dev
-([element.transfem.dev](https://element.transfem.dev) /
-[cinny.transfem.dev](https://cinny.transfem.dev))
+**1.** [Configure](https://matrix-construct.github.io/tuwunel/configuration.html) by
+copying and editing the `tuwunel-example.toml`. The `server_name` and `database_path` must be
+configured. **Most users deploy via docker or a distribution package and should follow the
+[appropriate guide](https://matrix-construct.github.io/tuwunel/deploying.html) instead.**
+This is just a summary for the impatient. See the full
+[documentation](https://matrix-construct.github.io/tuwunel/).
 
-transfem.dev is a public homeserver that can be used, it is not a "test only
-homeserver". This means there are rules, so please read the rules:
-[https://transfem.dev/homeserver_rules.txt](https://transfem.dev/homeserver_rules.txt)
+> [!TIP]
+> Avoid using a sub-domain for your `server_name`. You can always delegate later with a [`.well-known`](https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-well-known.md)
+> file, but you can never change your `server_name`.
 
-transfem.dev is also listed at
-[servers.joinmatrix.org](https://servers.joinmatrix.org/), which is a list of
-popular public Matrix homeservers, including some others that run conduwuit.
+**2.** Setup TLS certificates. Most users enjoy the [Caddy](https://caddyserver.com/) reverse-proxy
+which automates their certificate renewal. Advanced users can load their own TLS certificates
+using the configuration and Tuwunel can be deployed without a reverse proxy. Example
+`/etc/caddy/Caddyfile` configuration with [Element](https://github.com/element-hq/element-web/releases)
+unzipped to `/var/www/element`:
+```
+tuwunel.me, tuwunel.me:8448 {
+    reverse_proxy localhost:8008
+}
+web.tuwunel.me {
+    root * /var/www/element/
+    file_server
+}
+```
+`caddy reload --config /etc/caddy/Caddyfile`
 
-#### What is the current status?
+**3.** Start the server, connect your client and register your username. The first registration is
+granted server admin.
 
-conduwuit is technically a hard fork of [Conduit](https://conduit.rs/), which is in beta.
-The beta status initially was inherited from Conduit, however the huge amount of
-codebase divergance, changes, fixes, and improvements have effectively made this
-beta status not entirely applicable to us anymore.
+> [!TIP]
+> Configure a secret `registration_token` and set `allow_registration = true`
 
-conduwuit is very stable based on our rapidly growing userbase, has lots of features that users
-expect, and very usable as a daily driver for small, medium, and upper-end medium sized homeservers.
+ 🤗 Did you find this and other documentation helpful? We would love to hear feedback about setting
+ up Tuwunel.
 
-A lot of critical stability and performance issues have been fixed, and a lot of
-necessary groundwork has finished; making this project way better than it was
-back in the start at ~early 2024.
 
-#### Where is the differences page?
+### Migrating to Tuwunel
 
-conduwuit historically had a "differences" page that listed each and every single
-different thing about conduwuit from Conduit, as a way to promote and advertise
-conduwuit by showing significant amounts of work done. While this was feasible to
-maintain back when the project was new in early-2024, this became impossible
-very quickly and has unfortunately became heavily outdated, missing tons of things, etc.
+| Can I migrate from | |
+|-----------------|-----------|
+| conduwuit? | ✅ Yes. This will be supported at a minimum for one year, but likely indefinitely. |
+| Synapse? | ❌ Not yet, but this is planned and an important issue. Subscribe to [#2](https://github.com/matrix-construct/tuwunel/issues/2). |
+| Conduit? | ❌ Not right now, but this is planned for the near future. Subscribe to [#41](https://github.com/matrix-construct/tuwunel/issues/41). |
+| Any other fork of Conduit? | ❌ No. The migration must be explicitly listed in this table. |
+> [!CAUTION]
+> **Never switch between different forks of Conduit or you will corrupt your database.**
+> All derivatives of Conduit share the same linear database version without any awareness of other
+> forks. The database will permanently corrupt and we will not be able to help you.
 
-It's difficult to list out what we do differently, what are our notable features, etc
-when there's so many things and features and bug fixes and performance optimisations, 
-the list goes on. We simply recommend folks to just try out conduwuit, or ask us
-what features you are looking for and if they're implemented in conduwuit.
+#### Migrating from conduwuit
 
-#### How is conduwuit funded? Is conduwuit sustainable?
+Migrating from conduwuit to Tuwunel _just works_. In technical parlance it is a "binary swap."
+All you have to do is update to the latest Tuwunel and change the path to the executable from
+`conduwuit` to `tuwunel`.
 
-conduwuit has no external funding. This is made possible purely in my freetime with
-contributors, also in their free time, and only by user-curated donations.
+Anything else named "conduwuit" is still recognized, this includes environment variables with prefixes
+such as `CONDUWUIT_`. In fact, `CONDUIT_` is still recognized for our legacy users. You may have
+noticed that various configs, yamls, services, users, and other items were renamed, but if you
+were a conduwuit user we recommend against changing anything at all. This will keep things simple.
+If you are not sure please ask. If you found out that something did in fact need to be changed
+please open an issue immediately.
 
-conduwuit has existed since around November 2023, but [only became more publicly known
-in March/April 2024](https://matrix.org/blog/2024/04/26/this-week-in-matrix-2024-04-26/#conduwuit-website)
-and we have no plans in stopping or slowing down any time soon!
 
-#### Can I migrate or switch from Conduit?
+### Upgrading & Downgrading Tuwunel
 
-conduwuit had drop-in migration/replacement support for Conduit for about 12 months before
-bugs somewhere along the line broke it. Maintaining this has been difficult and
-the majority of Conduit users have already migrated, additionally debugging Conduit
-is not one of our interests, and so Conduit migration no longer works. We also
-feel that 12 months has been plenty of time for people to seamlessly migrate.
+We strive to make moving between versions of Tuwunel safe and easy. Downgrading Tuwunel is always
+safe but often prevented by a guard. An error will indicate the downgrade is not possible and a
+newer version which does not error must be sought.
 
-If you are a Conduit user looking to migrate, you will have to wipe and reset
-your database. We may fix seamless migration support at some point, but it's not an interest
-from us.
+#### Versioning
 
-#### Can I migrate from Synapse or Dendrite?
+Tuwunel uses a semantic version tag in the format of `v<major>.<minor>.<patch>`. The `patch` value will
+always correspond to the number of commits from the last `minor` change with significance to developers.
+The `minor` version is changed for fixes or features significant to users. The `major` value corresponds
+to significant feature evolutions, and does not indicate any "breaking change" nor connote stability.
 
-Currently there is no known way to seamlessly migrate all user data from the old
-homeserver to conduwuit. However it is perfectly acceptable to replace the old
-homeserver software with conduwuit using the same server name and there will not
-be any issues with federation.
+> [!IMPORTANT]
+> **Users should attempt to keep up to date with the latest minor version.**
 
-There is an interest in developing a built-in seamless user data migration
-method into conduwuit, however there is no concrete ETA or timeline for this.
+#### Branches
 
+The main branch is always _reasonably safe_ to run. We understand the propensity for users to simply clone
+the main branch to get up and running, and we're obliged to ensure it's always viable. Nevertheless, only
+tagged releases are true releases. If you don't care to update often, find the latest `minor` version
+change rather than `patch`. We don't recommend simply following `major` version changes at this time.
+
+#### Container Tracking
+
+> [!IMPORTANT]
+> **We strongly advise tracking the `:latest` tag when automatically updating.**
+
+Tracking `:latest` gives us the necessary discretion to keep you on the appropriate stable version.
+We discourage tracking the main branch unless frequent restarts are acceptable. Alternatively,
+tracking the `:preview` tag provides the latest release-candidate becoming equivalent to `:latest`
+after a release. Tracking the `:preview` tag is a worthy alternative to the main branch, with
+turbulence limited to release-time.
+
+### Getting Help & Support
+
+If you are opposed to using github, or if private discussion is required such as for security
+disclosures, or for any other reason, I would be happy to receive your DM at
+[@jason:tuwunel.me](https://matrix.to/#/@jason:tuwunel.me). This will not be bothering me as it would
+be my pleasure to help you when possible. As an emergency contact you can send an email to
+jasonzemos@gmail.com.
+
+##### Tuwunel Fanclub
+
+We have an unofficial community-run chat which is publicly accessible at
+[#tuwunel:matrix.org](https://matrix.to/#/#tuwunel:matrix.org). The members, content, or moderation
+decisions of this room are not in any way related or endorsed by this project or its sponsors,
+and not all project staff will be present there. There will be at least some presence by staff to
+offer assistance so long as the room remains in minimally good standing.
+
+
+## Tuwunel<sup>💕</sup>
+
+Tuwunel's theme is **empathy** in communication defined by the works of
+[Edith Stein](https://plato.stanford.edu/entries/stein/). Empathy is the basis for how we approach
+every message and our responsibility to the other in every conversation.
 
 <!-- ANCHOR_END: body -->
 
 <!-- ANCHOR: footer -->
 
-#### Contact
-
-[`#conduwuit:puppygock.gay`](https://matrix.to/#/#conduwuit:puppygock.gay)
-is the official project Matrix room. You can get support here, ask questions or
-concerns, get assistance setting up conduwuit, etc.
-
-This room should stay relevant and focused on conduwuit. An offtopic general
-chatter room can be found in the room topic there as well.
-
-Please keep the issue trackers focused on *actual* bug reports and enhancement requests.
-
-General support is extremely difficult to be offered over an issue tracker, and
-simple questions should be asked directly in an interactive platform like our
-Matrix room above as they can turn into a relevant discussion and/or may not be
-simple to answer. If you're not sure, just ask in the Matrix room.
-
-If you have a bug or feature to request: [Open an issue on GitHub](https://github.com/girlbossceo/conduwuit/issues/new)
-
-If you need to contact the primary maintainer, my contact methods are on my website: https://girlboss.ceo
-
-#### Donate
-
-conduwuit development is purely made possible by myself and contributors. I do
-not get paid to work on this, and I work on it in my free time. Donations are
-heavily appreciated! 💜🥺
-
-- Liberapay: <https://liberapay.com/girlbossceo>
-- GitHub Sponsors: <https://github.com/sponsors/girlbossceo>
-- Ko-fi: <https://ko-fi.com/puppygock>
-
-I do not and will not accept cryptocurrency donations, including things related.
-
-Note that donations will NOT guarantee you or give you any kind of tangible product,
-feature prioritisation, etc. By donating, you are agreeing that conduwuit is NOT
-going to provide you any goods or services as part of your donation, and this
-donation is purely a generous donation. We will not provide things like paid
-personal/direct support, feature request priority, merchandise, etc.
-
-#### Logo
-
-Original repo and Matrix room picture was from bran (<3). Current banner image
-and logo is directly from [this cohost
-post](https://web.archive.org/web/20241126004041/https://cohost.org/RatBaby/post/1028290-finally-a-flag-for).
-
-An SVG logo made by [@nktnet1](https://github.com/nktnet1) is available here: <https://github.com/girlbossceo/conduwuit/blob/main/docs/assets/>
-
-#### Is it conduwuit or Conduwuit?
-
-Both, but I prefer conduwuit.
-
-#### Mirrors of conduwuit
-
-If GitHub is unavailable in your country, or has poor connectivity, conduwuit's
-source code is mirrored onto the following additional platforms I maintain:
-
-- GitHub: <https://github.com/girlbossceo/conduwuit>
-- GitLab: <https://gitlab.com/conduwuit/conduwuit>
-- git.girlcock.ceo: <https://git.girlcock.ceo/strawberry/conduwuit>
-- git.gay: <https://git.gay/june/conduwuit>
-- mau.dev: <https://mau.dev/june/conduwuit>
-- Codeberg: <https://codeberg.org/arf/conduwuit>
-- sourcehut: <https://git.sr.ht/~girlbossceo/conduwuit>
-
 <!-- ANCHOR_END: footer -->

RELEASE.md

@@ -0,0 +1,9 @@
+# Tuwunel 1.4.1
+
+September 2, 2025
+
+Bridge and Application Service users must update from Tuwunel 1.4.0 to this patch. All other users are encouraged to update at their convenience.
+
+### Bug Fixes
+
+- Special thanks to @alaviss for immediately reporting incorrect results from the `/joined_members` endpoint in the v1.4.0 release. This regression primarily affects Application Services and Bridges; the most popular clients have been verified to not make use of this API.

arch/tuwunel.service

@@ -1,10 +1,10 @@
 [Unit]
-Description=conduwuit Matrix homeserver
+Description=Tuwunel Matrix homeserver
 Wants=network-online.target
 After=network-online.target
-Documentation=https://conduwuit.puppyirl.gay/
-RequiresMountsFor=/var/lib/private/conduwuit
-Alias=matrix-conduwuit.service
+Documentation=https://tuwunel.chat/
+RequiresMountsFor=/var/lib/private/tuwunel
+Alias=matrix-tuwunel.service
 
 [Service]
 DynamicUser=yes
@@ -54,16 +54,18 @@ SystemCallArchitectures=native
 SystemCallFilter=@system-service @resources
 SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
 SystemCallErrorNumber=EPERM
-StateDirectory=conduwuit
+StateDirectory=tuwunel
 
-RuntimeDirectory=conduwuit
+RuntimeDirectory=tuwunel
 RuntimeDirectoryMode=0750
 
-Environment="CONDUWUIT_CONFIG=/etc/conduwuit/conduwuit.toml"
-BindPaths=/var/lib/private/conduwuit:/var/lib/matrix-conduit
-BindPaths=/var/lib/private/conduwuit:/var/lib/private/matrix-conduit
+Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
+BindPaths=/var/lib/private/tuwunel:/var/lib/conduwuit
+BindPaths=/var/lib/private/tuwunel:/var/lib/private/conduwuit
+BindPaths=/var/lib/private/tuwunel:/var/lib/matrix-conduit
+BindPaths=/var/lib/private/tuwunel:/var/lib/private/matrix-conduit
 
-ExecStart=/usr/bin/conduwuit
+ExecStart=/usr/bin/tuwunel
 Restart=on-failure
 RestartSec=5
 

book.toml

@@ -1,27 +1,30 @@
 [book]
-title = "conduwuit 🏳️‍⚧️ 💜 🦴"
-description = "conduwuit, which is a well-maintained fork of Conduit, is a simple, fast and reliable chat server for the Matrix protocol"
+authors = [
+	"girlbossceo",
+	"jevolk"
+]
+description = "Tuwunel, a high performance successor to Conduit and Conduwuit"
 language = "en"
-authors = ["strawberry (June)"]
-text-direction = "ltr"
 multilingual = false
 src = "docs"
+title = "Tuwunel One"
+text-direction = "ltr"
 
 [build]
 build-dir = "public"
 create-missing = true
-extra-watch-dirs = ["debian", "docs"]
+extra-watch-dirs = [
+	"debian",
+	"docs",
+]
 
 [rust]
 edition = "2024"
 
 [output.html]
-git-repository-url = "https://github.com/girlbossceo/conduwuit"
-edit-url-template = "https://github.com/girlbossceo/conduwuit/edit/main/{path}"
+git-repository-url = "https://github.com/matrix-construct/tuwunel"
+edit-url-template = "https://github.com/matrix-construct/tuwunel/edit/main/{path}"
 git-repository-icon = "fa-github-square"
 
-[output.html.redirect]
-"/differences.html" = "https://conduwuit.puppyirl.gay/#where-is-the-differences-page"
-
 [output.html.search]
 limit-results = 15

clippy.toml

@@ -1,20 +1,20 @@
 array-size-threshold = 4096
-cognitive-complexity-threshold = 94         # TODO reduce me ALARA
-excessive-nesting-threshold = 11            # TODO reduce me to 4 or 5
-future-size-threshold = 7745                # TODO reduce me ALARA
+cognitive-complexity-threshold = 100        # TODO reduce me ALARA
+excessive-nesting-threshold = 8
+future-size-threshold = 8192
 stack-size-threshold = 196608               # TODO reduce me ALARA
 too-many-lines-threshold = 780              # TODO reduce me to <= 100
 type-complexity-threshold = 250             # reduce me to ~200
 large-error-threshold = 256                 # TODO reduce me ALARA
 
-disallowed-macros = [
-	{ path = "log::error", reason = "use conduwuit_core::error" },
-	{ path = "log::warn", reason = "use conduwuit_core::warn" },
-	{ path = "log::info", reason = "use conduwuit_core::info" },
-	{ path = "log::debug", reason = "use conduwuit_core::debug" },
-	{ path = "log::trace", reason = "use conduwuit_core::trace" },
-]
+#disallowed-macros = [
+#	{ path = "log::error", reason = "use tuwunel_core::error" },
+#	{ path = "log::warn", reason = "use tuwunel_core::warn" },
+#	{ path = "log::info", reason = "use tuwunel_core::info" },
+#	{ path = "log::debug", reason = "use tuwunel_core::debug" },
+#	{ path = "log::trace", reason = "use tuwunel_core::trace" },
+#]
 
-disallowed-methods = [
-    { path = "tokio::spawn", reason = "use and pass conduuwit_core::server::Server::runtime() to spawn from" },
-]
+#disallowed-methods = [
+#	{ path = "tokio::spawn", reason = "use and pass tuwunel_core::server::Server::runtime() to spawn from" },
+#]

debian/README.md

@@ -1,4 +1,4 @@
-# conduwuit for Debian
+# Tuwunel for Debian
 
 Information about downloading and deploying the Debian package. This may also be
 referenced for other `apt`-based distros such as Ubuntu.
@@ -13,17 +13,24 @@ ### Installation
 
 ### Configuration
 
-When installed, the example config is placed at `/etc/conduwuit/conduwuit.toml`
+When installed, the example config is placed at `/etc/tuwunel/tuwunel.toml`
 as the default config. The config mentions things required to be changed before
 starting.
 
 You can tweak more detailed settings by uncommenting and setting the config
-options in `/etc/conduwuit/conduwuit.toml`.
+options in `/etc/tuwunel/tuwunel.toml`.
 
 ### Running
 
-The package uses the [`conduwuit.service`](../configuration/examples.md#example-systemd-unit-file) systemd unit file to start and stop conduwuit. The binary is installed at `/usr/sbin/conduwuit`.
+The package uses the [`tuwunel.service`](../configuration/examples.md#example-systemd-unit-file)
+systemd unit file to start and stop Tuwunel. The binary is installed at `/usr/sbin/tuwunel`.
 
-This package assumes by default that conduwuit will be placed behind a reverse proxy. The default config options apply (listening on `localhost` and TCP port `6167`). Matrix federation requires a valid domain name and TLS, so you will need to set up TLS certificates and renewal for it to work properly if you intend to federate.
+This package assumes by default that Tuwunel will be placed behind a reverse
+proxy. The default config options apply (listening on `localhost` and TCP port
+`6167`). Matrix federation requires a valid domain name and TLS, so you will
+need to set up TLS certificates and renewal for it to work properly if you
+intend to federate.
 
-Consult various online documentation and guides on setting up a reverse proxy and TLS. Caddy is documented at the [generic deployment guide](../deploying/generic.md#setting-up-the-reverse-proxy) as it's the easiest and most user friendly.
+Consult various online documentation and guides on setting up a reverse proxy
+and TLS. Caddy is documented at the [generic deployment guide](../deploying/generic.md#setting-up-the-reverse-proxy)
+as it's the easiest and most user friendly.

debian/config

@@ -6,13 +6,13 @@ set -e
 #. /usr/share/debconf/confmodule
 #
 ## Ask for the Matrix homeserver name, address and port.
-#db_input high conduwuit/hostname || true
+#db_input high tuwunel/hostname || true
 #db_go
 #
-#db_input low conduwuit/address || true
+#db_input low tuwunel/address || true
 #db_go
 #
-#db_input medium conduwuit/port || true
+#db_input medium tuwunel/port || true
 #db_go
 
 exit 0

debian/postinst

@@ -4,38 +4,41 @@ set -e
 # TODO: implement debconf support that is maintainable without duplicating the config
 #. /usr/share/debconf/confmodule
 
-CONDUWUIT_DATABASE_PATH=/var/lib/conduwuit
-CONDUWUIT_CONFIG_PATH=/etc/conduwuit
+TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
+TUWUNEL_CONFIG_PATH=/etc/tuwunel
 
 case "$1" in
   configure)
-    # Create the `conduwuit` user if it does not exist yet.
-    if ! getent passwd conduwuit > /dev/null ; then
-      echo 'Adding system user for the conduwuit Matrix homeserver' 1>&2
+    # Create the `tuwunel` user if it does not exist yet.
+    if ! getent passwd tuwunel > /dev/null ; then
+      echo 'Adding system user for the tuwunel Matrix homeserver' 1>&2
       adduser --system --group --quiet \
-        --home "$CONDUWUIT_DATABASE_PATH" \
+        --home "$TUWUNEL_DATABASE_PATH" \
         --disabled-login \
         --shell "/usr/sbin/nologin" \
-        conduwuit
+        tuwunel
     fi
 
     # Create the database path if it does not exist yet and fix up ownership
     # and permissions for the config.
-    mkdir -v -p "$CONDUWUIT_DATABASE_PATH"
+    mkdir -v -p "$TUWUNEL_DATABASE_PATH"
 
     # symlink the previous location for compatibility if it does not exist yet.
     if ! test -L "/var/lib/matrix-conduit" ; then
-        ln -s -v "$CONDUWUIT_DATABASE_PATH" "/var/lib/matrix-conduit"
+        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/matrix-conduit"
+    fi
+    if ! test -L "/var/lib/conduwuit" ; then
+        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/conduwuit"
     fi
 
-    chown -v conduwuit:conduwuit -R "$CONDUWUIT_DATABASE_PATH"
-    chown -v conduwuit:conduwuit -R "$CONDUWUIT_CONFIG_PATH"
+    chown -v tuwunel:tuwunel -R "$TUWUNEL_DATABASE_PATH"
+    chown -v tuwunel:tuwunel -R "$TUWUNEL_CONFIG_PATH"
 
-    chmod -v 740 "$CONDUWUIT_DATABASE_PATH"
+    chmod -v 740 "$TUWUNEL_DATABASE_PATH"
 
     echo ''
-    echo 'Make sure you edit the example config at /etc/conduwuit/conduwuit.toml before starting!'
-    echo 'To start the server, run: systemctl start conduwuit.service'
+    echo 'Make sure you edit the example config at /etc/tuwunel/tuwunel.toml before starting!'
+    echo 'To start the server, run: systemctl start tuwunel.service'
     echo ''
 
     ;;

debian/postrm

@@ -3,9 +3,10 @@ set -e
 
 #. /usr/share/debconf/confmodule
 
-CONDUWUIT_CONFIG_PATH=/etc/conduwuit
-CONDUWUIT_DATABASE_PATH=/var/lib/conduwuit
-CONDUWUIT_DATABASE_PATH_SYMLINK=/var/lib/matrix-conduit
+TUWUNEL_CONFIG_PATH=/etc/tuwunel
+TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
+CONDUIT_DATABASE_PATH_SYMLINK=/var/lib/matrix-conduit
+CONDUWUIT_DATABASE_PATH_SYMLINK=/var/lib/conduwuit
 
 case $1 in
   purge)
@@ -18,23 +19,30 @@ case $1 in
 
     #
 
-    if [ -d "$CONDUWUIT_CONFIG_PATH" ]; then
-      if test -L "$CONDUWUIT_CONFIG_PATH"; then
-        echo "Deleting conduwuit configuration files"
-        rm -v -r "$CONDUWUIT_CONFIG_PATH"
+    if [ -d "$TUWUNEL_CONFIG_PATH" ]; then
+      if test -L "$TUWUNEL_CONFIG_PATH"; then
+        echo "Deleting tuwunel configuration files"
+        rm -v -r "$TUWUNEL_CONFIG_PATH"
       fi
     fi
 
-    if [ -d "$CONDUWUIT_DATABASE_PATH" ]; then
-      if test -L "$CONDUWUIT_DATABASE_PATH"; then
-        echo "Deleting conduwuit database directory"
-        rm -r "$CONDUWUIT_DATABASE_PATH"
+    if [ -d "$TUWUNEL_DATABASE_PATH" ]; then
+      if test -L "$TUWUNEL_DATABASE_PATH"; then
+        echo "Deleting tuwunel database directory"
+        rm -r "$TUWUNEL_DATABASE_PATH"
+      fi
+    fi
+
+    if [ -d "$CONDUIT_DATABASE_PATH_SYMLINK" ]; then
+      if test -L "$CONDUIT_DATABASE_SYMLINK"; then
+        echo "Removing matrix-conduit symlink"
+        rm -r "$CONDUIT_DATABASE_PATH_SYMLINK"
       fi
     fi
 
     if [ -d "$CONDUWUIT_DATABASE_PATH_SYMLINK" ]; then
       if test -L "$CONDUWUIT_DATABASE_SYMLINK"; then
-        echo "Removing matrix-conduit symlink"
+        echo "Removing conduwuit symlink"
         rm -r "$CONDUWUIT_DATABASE_PATH_SYMLINK"
       fi
     fi

debian/tuwunel.service

@@ -1,21 +1,21 @@
 [Unit]
-Description=conduwuit Matrix homeserver
+Description=Tuwunel Matrix homeserver
 Wants=network-online.target
 After=network-online.target
-Alias=matrix-conduwuit.service
-Documentation=https://conduwuit.puppyirl.gay/
+Alias=matrix-tuwunel.service
+Documentation=https://tuwunel.chat/
 
 [Service]
 DynamicUser=yes
-User=conduwuit
-Group=conduwuit
+User=tuwunel
+Group=tuwunel
 Type=notify
 
-Environment="CONDUWUIT_CONFIG=/etc/conduwuit/conduwuit.toml"
+Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
 
-ExecStart=/usr/sbin/conduwuit
+ExecStart=/usr/sbin/tuwunel
 
-ReadWritePaths=/var/lib/conduwuit /etc/conduwuit
+ReadWritePaths=/var/lib/tuwunel /etc/tuwunel
 
 AmbientCapabilities=
 CapabilityBoundingSet=
@@ -48,9 +48,9 @@ SystemCallArchitectures=native
 SystemCallFilter=@system-service @resources
 SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
 SystemCallErrorNumber=EPERM
-#StateDirectory=conduwuit
+#StateDirectory=tuwunel
 
-RuntimeDirectory=conduwuit
+RuntimeDirectory=tuwunel
 RuntimeDirectoryMode=0750
 
 Restart=on-failure

docker/Dockerfile.cargo

@@ -0,0 +1,99 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS cargo
+ARG sys_triple
+ARG rust_target
+ARG rust_toolchain
+ARG RUST_HOME
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+ARG CARGO_TARGET_DIR
+ARG cargo_target_profile
+ARG cargo_target_artifact
+ARG cargo_target_share
+ARG CARGO_TERM_VERBOSE=0
+ARG RUST_BACKTRACE
+ARG JEMALLOC_OVERRIDE
+ARG ROCKSDB_LIB_DIR
+ARG CARGO_BUILD_RUSTFLAGS
+ARG CARGO_PROFILE_TEST_DEBUG
+ARG CARGO_PROFILE_TEST_INCREMENTAL
+ARG CARGO_PROFILE_BENCH_DEBUG
+ARG CARGO_PROFILE_BENCH_LTO
+ARG CARGO_PROFILE_RELEASE_LTO
+ARG CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG
+ARG CARGO_PROFILE_RELEASE_DEBUGINFO_LTO
+ARG cargo_profile
+ARG cargo_features
+ARG cargo_spec_features
+ARG cargo_cmd
+ARG color_args="--color always"
+ARG recipe_args=""
+ARG cargo_args=""
+ARG git_checkout
+
+WORKDIR /
+COPY --link --from=input . .
+COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
+COPY --link --from=deps /usr/src/tuwunel /usr/src/tuwunel
+
+WORKDIR /usr/lib/${sys_triple}
+COPY --link --from=rocksdb . .
+
+WORKDIR /usr/src/tuwunel
+ENV PATH="${CARGO_HOME}/bin:$PATH"
+ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
+ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
+ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
+ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
+ENV CARGO_PROFILE_TEST_DEBUG="${CARGO_PROFILE_TEST_DEBUG}"
+ENV CARGO_PROFILE_TEST_INCREMENTAL="${CARGO_PROFILE_TEST_INCREMENTAL}"
+ENV CARGO_PROFILE_BENCH_DEBUG="${CARGO_PROFILE_BENCH_DEBUG}"
+ENV CARGO_PROFILE_BENCH_LTO="${CARGO_PROFILE_BENCH_LTO}"
+ENV CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO}"
+ENV CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG="${CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG}"
+ENV CARGO_PROFILE_RELEASE_DEBUGINFO_LTO="${CARGO_PROFILE_RELEASE_DEBUGINFO_LTO}"
+ENV CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}"
+ENV CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
+ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
+ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+<<EOF
+    set -eux
+    rustup run ${rust_toolchain} \
+        cargo ${cargo_cmd} \
+            --verbose \
+            --locked \
+            --workspace \
+            "${cargo_spec_features}" \
+            "--features=${cargo_features}" \
+            "--profile=${cargo_profile}" \
+            "--target=${CARGO_TARGET}" \
+            "--target-dir=${CARGO_TARGET_DIR}" \
+            "--manifest-path=Cargo.toml" \
+            ${recipe_args} \
+            ${color_args} \
+            ${cargo_args}
+
+    # If this image is further reused with other cargo commands, all
+    # modifications made by cargo chef cook outside of target-dir have to be
+    # cleared. If not, resulting build artifacts will link incorrectly, even
+    # without error. For example, a target executable may be produced which
+    # does nothing except exit(0). If you have observed a smoketest failing in
+    # such a manner, investigate this as a cause of the issue.
+    git restore -W -S --source=${git_checkout} .
+EOF

docker/Dockerfile.cargo.audit

@@ -0,0 +1,28 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS audit
+ARG rust_toolchain="nightly"
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG audit_args=""
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+<<EOF
+    set -eux
+    rustup run ${rust_toolchain} \
+        cargo audit \
+            --stale \
+            --deny yanked \
+            --deny unsound \
+            --deny unmaintained \
+            --deny warnings \
+            --color=always \
+            ${audit_args}
+EOF

docker/Dockerfile.cargo.deb

@@ -0,0 +1,82 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS build-deb
+ARG rust_target
+ARG rust_toolchain
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+ARG CARGO_TARGET_DIR
+ARG cargo_target_profile
+ARG cargo_target_artifact
+ARG cargo_target_share
+ARG cargo_profile
+ARG cargo_features
+ARG cargo_spec_features
+ARG pkg_dir
+ARG deb_args=""
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/tuwunel
+ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
+ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+<<EOF
+    set -eux
+    mkdir -p "${pkg_dir}"
+    rustup run ${rust_toolchain} \
+        cargo deb \
+            --verbose \
+            --locked \
+            --no-build \
+            "${cargo_spec_features}" \
+            --features "${cargo_features}" \
+            --profile "${cargo_profile}" \
+            --target "${CARGO_TARGET}" \
+            --manifest-path Cargo.toml \
+            --multiarch same \
+            --compress-type gz \
+            --output "${pkg_dir}" \
+            ${deb_args}
+
+	mv ${pkg_dir}/* "${pkg_dir}/tuwunel.deb"
+	dpkg --info "${pkg_dir}/tuwunel.deb"
+	dpkg --contents "${pkg_dir}/tuwunel.deb"
+EOF
+
+
+FROM scratch AS deb
+ARG pkg_dir
+
+COPY --from=input ${pkg_dir}/tuwunel.deb .
+
+
+FROM input AS deb-install
+ARG pkg_dir
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR ${pkg_dir}
+COPY --from=deb . .
+RUN <<EOF
+	set -eux
+	dpkg --info tuwunel.deb
+	dpkg --contents tuwunel.deb
+	dpkg --install tuwunel.deb
+EOF

docker/Dockerfile.cargo.fmt

@@ -0,0 +1,25 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS fmt
+ARG rust_toolchain="nightly"
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG fmt_args=""
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+<<EOF
+    set -eux
+    rustup run ${rust_toolchain} \
+        cargo fmt \
+            --all \
+            --check \
+            --manifest-path Cargo.toml \
+            ${fmt_args}
+EOF

docker/Dockerfile.cargo.lychee

@@ -0,0 +1,36 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS lychee
+ARG rust_toolchain="nightly"
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG lychee_cache_age="7d"
+ARG lychee_mode="color"
+# .lycheecache is hardcoded as path to reg file in the cwd so we execute lychee
+# in cache directory itself. all paths here should be absolute paths
+ARG lychee_args="/usr/src/tuwunel/docs /usr/src/tuwunel/*.md"
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+--mount=type=cache,dst=lychee,sharing=locked \
+<<EOF
+    set -eux
+    cd lychee
+    rustup run ${rust_toolchain} \
+        lychee \
+            --verbose \
+            --no-progress \
+            --offline \
+            --cache \
+            --max-cache-age "${lychee_cache_age}" \
+            --mode "${lychee_mode}" \
+            --exclude /usr/src/tuwunel/contributing.md \
+            --exclude /usr/src/tuwunel/development/testing.md \
+            ${lychee_args}
+EOF

docker/Dockerfile.cargo.rpm

@@ -0,0 +1,72 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS build-rpm
+ARG rust_toolchain
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+ARG CARGO_TARGET_DIR
+ARG cargo_target_profile
+ARG cargo_target_artifact
+ARG cargo_target_share
+ARG cargo_profile
+ARG cargo_features
+ARG cargo_spec_features
+ARG pkg_dir
+ARG gen_rpm_args=""
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+--mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
+--mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
+<<EOF
+	set -eux
+	mkdir -p "${pkg_dir}"
+	rustup run ${rust_toolchain} \
+		cargo generate-rpm \
+			--package src/main \
+			--auto-req auto \
+			--target "${CARGO_TARGET}" \
+			--target-dir "${CARGO_TARGET_DIR}" \
+			--profile "${cargo_profile}" \
+			--payload-compress zstd \
+			--output "${pkg_dir}" \
+			${gen_rpm_args}
+
+	mv ${pkg_dir}/* "${pkg_dir}/tuwunel.rpm"
+EOF
+
+
+FROM scratch AS rpm
+ARG pkg_dir
+
+COPY --from=input ${pkg_dir}/tuwunel.rpm .
+
+
+FROM input AS rpm-install
+ARG pkg_dir
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR ${pkg_dir}
+COPY --link --from=rpm . .
+RUN <<EOF
+	set -eux
+	rpm -i --test tuwunel.rpm
+	rpm -i tuwunel.rpm
+EOF

docker/Dockerfile.cargo.typos

@@ -0,0 +1,25 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS typos
+ARG rust_toolchain="nightly"
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG typos_args=""
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
+<<EOF
+    set -eux
+    rustup run ${rust_toolchain} \
+        typos \
+            --color always \
+            --exclude docker \
+            --exclude nix \
+            ${typos_args}
+EOF

docker/Dockerfile.complement

@@ -0,0 +1,244 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS key-gen-base
+ARG var_cache
+ARG var_lib_apt
+
+WORKDIR /
+COPY --link --from=input . .
+
+RUN \
+--mount=type=cache,dst=/var/cache,id=${var_cache},sharing=locked \
+--mount=type=cache,dst=/var/lib/apt,id=${var_lib_apt},sharing=locked \
+<<EOF
+    set -eux
+    apt-get -y -U install --no-install-recommends openssl gawk
+EOF
+
+
+FROM key-gen-base AS key-gen
+
+WORKDIR /complement
+COPY <<EOF v3.ext
+    authorityKeyIdentifier=keyid,issuer
+    basicConstraints=CA:FALSE
+    keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+    subjectAltName = @alt_names
+    [alt_names]
+    DNS.0 = *.docker.internal
+    DNS.1 = hs1
+    DNS.2 = hs2
+    DNS.3 = hs3
+    DNS.4 = hs4
+    IP.1 = 127.0.0.1
+EOF
+RUN <<EOF
+    set -eux
+    mkdir ca
+    openssl genrsa \
+        -out private_key.pem \
+        2048
+
+    openssl req \
+        -new \
+        -sha256 \
+        -key private_key.pem \
+        -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=hs1" \
+        -addext "subjectAltName = DNS:*.docker.internal DNS:hs1, DNS:hs2, DNS:hs3, DNS:hs4, IP:127.0.0.1" \
+        -out signing_request.csr
+
+    openssl x509 \
+        -req \
+        -extfile v3.ext \
+        -in signing_request.csr \
+        -key private_key.pem \
+        -out certificate.crt \
+        -days 1 \
+        -sha256
+EOF
+RUN [ -f certificate.crt ] && [ -f private_key.pem ]
+
+
+FROM scratch AS complement-config
+WORKDIR /complement
+COPY --from=key-gen /complement/* .
+COPY --from=source /usr/src/tuwunel/tests/test_results/complement/test_results.jsonl old_results.jsonl
+COPY <<EOF complement.toml
+    [global]
+    address = "0.0.0.0"
+    admin_room_notices = false
+    allow_check_for_updates = false
+    allow_device_name_federation = true
+    allow_guest_registration = true
+    allow_invalid_tls_certificates = true
+    allow_legacy_media = true
+    allow_public_room_directory_over_federation = true
+    allow_public_room_directory_without_auth = true
+    allow_registration = true
+    create_admin_room = false
+    database_path = "/database"
+    dns_attempts = 20
+    dns_timeout = 60
+    federation_idle_timeout = 300
+    intentionally_unknown_config_option_for_testing = true
+    ip_range_denylist = []
+    log = "debug,tuwunel=trace,h2=warn,hyper=warn"
+    log_colors = false
+    log_guest_registrations = false
+    log_span_events = "NONE"
+    log_thread_ids = true
+    media_compat_file_link = false
+    media_startup_check = true
+    only_query_trusted_key_servers = false
+    port = [8008, 8448]
+    prune_missing_media = true
+    query_trusted_key_servers_first = false
+    query_trusted_key_servers_first_on_join = false
+    request_conn_timeout = 60
+    request_timeout = 120
+    rocksdb_log_level = "debug"
+    rocksdb_max_log_files = 1
+    rocksdb_paranoid_file_checks = true
+    rocksdb_recovery_mode = 0
+    sender_idle_timeout = 300
+    sender_retry_backoff_limit = 300
+    sender_timeout = 300
+    startup_netburst = true
+    startup_netburst_keep = -1
+    trusted_servers = []
+    url_preview_domain_contains_allowlist = ["*"]
+    url_preview_domain_explicit_denylist = ["*"]
+    well_known_conn_timeout = 60
+    well_known_timeout = 60
+    yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true
+
+    [global.tls]
+    certs = "/complement/certificate.crt"
+    dual_protocol = true
+    key = "/complement/private_key.pem"
+EOF
+
+
+FROM input AS complement-testee
+
+WORKDIR /
+COPY --link --from=input . .
+
+EXPOSE 8008 8448
+RUN mkdir /database
+COPY --from=complement-config * /complement/
+ENV TUWUNEL_CONFIG="/complement/complement.toml"
+ENTRYPOINT tuwunel -Oserver_name=\""$SERVER_NAME\""
+
+
+FROM input AS complement-testee-valgrind
+
+WORKDIR /
+COPY --link --from=input . .
+
+EXPOSE 8008 8448
+RUN mkdir /database
+COPY --from=complement-config * /complement/
+ENV TUWUNEL_CONFIG="/complement/complement.toml"
+ENTRYPOINT valgrind \
+    --leak-check=no \
+    --undef-value-errors=no \
+    --exit-on-first-error=yes \
+    --error-exitcode=1 \
+    tuwunel \
+        -Oserver_name=\""$SERVER_NAME\""
+
+
+FROM input AS complement-base
+ARG var_cache
+ARG var_lib_apt
+ARG complement_tags="conduwuit_blacklist"
+ARG complement_tests="./tests/..."
+ARG complement_run=".*"
+
+WORKDIR /
+RUN \
+--mount=type=cache,dst=/var/cache,id=${var_cache},sharing=locked \
+--mount=type=cache,dst=/var/lib/apt,id=${var_lib_apt},sharing=locked \
+--mount=type=cache,dst=/go/pkg/mod/cache,sharing=locked \
+<<EOF
+    set -eux
+    apt-get -y -U install --no-install-recommends golang-go jq
+EOF
+
+WORKDIR /usr/src
+ADD https://github.com/matrix-construct/complement.git#403840348f6bcc9cc8ed1671dc2f638c2b1ce4ac complement
+
+WORKDIR /usr/src/complement
+ENV COMPLEMENT_BASE_IMAGE="complement-testee"
+RUN \
+--mount=type=cache,dst=/go/pkg/mod/cache,sharing=locked \
+<<EOF
+    env
+    set -eux
+    go test -tags="$complement_tags" -list="$complement_run" $complement_tests
+EOF
+
+
+FROM input AS complement-tester
+ARG complement_verbose=0
+ARG complement_debug=0
+ARG complement_count=1
+ARG complement_parallel=16
+ARG complement_shuffle=1337
+ARG complement_timeout="1h"
+ARG complement_run=".*"
+ARG complement_skip=""
+ARG complement_tags="conduwuit_blacklist"
+ARG complement_tests="./tests/..."
+ARG complement_base_image
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/complement
+ENV COMPLEMENT_DEBUG=$complement_debug
+ENV complement_parallel="$complement_parallel"
+ENV complement_shuffle="$complement_shuffle"
+ENV complement_tags="$complement_tags"
+ENV complement_timeout="$complement_timeout"
+ENV complement_count="$complement_count"
+ENV complement_tests="$complement_tests"
+ENV complement_skip="$complement_skip"
+ENV complement_run="$complement_run"
+ENV complement_tests="$complement_tests"
+ENV COMPLEMENT_ALWAYS_PRINT_SERVER_LOGS="$complement_verbose"
+ENV COMPLEMENT_HOSTNAME_RUNNING_COMPLEMENT="host.docker.internal"
+ENV COMPLEMENT_HOST_MOUNTS="/var/run/docker.sock:/var/run/docker.sock"
+ENV jq_res='{Action: .Action, Test: .Test}'
+ENV jq_sel='select((.Action == \"pass\" or .Action == \"fail\" or .Action == \"skip\") and .Test != null)'
+ENV jq_tab='[.Action, .Test] | @tsv'
+ENV jq_out='select(.Test != null) | {Test: .Test, Output: .Output}'
+COPY --from=complement-config /complement/old_results.jsonl .
+COPY <<EOF uwu.sh
+    env;
+    set -eux;
+
+    COMPLEMENT_BASE_IMAGE="\${1:-$complement_base_image}"
+    go test
+        -json
+        "-shuffle=\$complement_shuffle"
+        "-parallel=\$complement_parallel"
+        "-timeout=\$complement_timeout"
+        "-count=\$complement_count"
+        "-tags=\$complement_tags"
+        "-skip=\$complement_skip"
+        "-run=\$complement_run"
+        "\$complement_tests"
+    | jq --unbuffered -c "."
+    | tee output.jsonl
+    | jq --unbuffered -c "$jq_sel | $jq_res"
+    | tee results.jsonl
+    | jq --unbuffered -r "$jq_tab"
+    ;
+
+    jq -s -c "sort_by(.Test)[]" < results.jsonl | uniq > new_results.jsonl;
+    jq -s -c "sort_by(.Test, .Timestamp)[] | $jq_out" < output.jsonl > full_output.jsonl;
+EOF
+RUN echo $(tr -d '\n' < uwu.sh) > uwu.sh && chmod a+x uwu.sh
+ENTRYPOINT ["/bin/bash", "/usr/src/complement/uwu.sh"]

docker/Dockerfile.install

@@ -0,0 +1,29 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS install
+ARG rust_target
+ARG CARGO_TARGET_DIR
+ARG cargo_target_profile
+ARG install_prefix
+ARG assert_linkage=""
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR ${install_prefix}
+ENV src_path="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}/tuwunel"
+ENV dst_path="${install_prefix}/bin/tuwunel"
+COPY --from=bins $src_path $dst_path
+RUN <<EOF
+    ret=$(ldd "${dst_path}")
+    if [ "$ret" = "0" ] && [ "$assert_linkage" = "static" ]; then
+        exit 1
+    elif [ "$ret" != "0" ] && [ "$assert_linkage" = "dynamic" ]; then
+        exit 1
+    fi
+
+    set -eux
+    ldd -v ${dst_path} || true
+    du -h ${dst_path}
+    sha1sum ${dst_path}
+EOF

docker/Dockerfile.rocksdb

@@ -0,0 +1,93 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS rocksdb-fetch
+ARG rocksdb_branch="tuwunel-changes"
+ARG rust_rocksdb_branch="conduwuit-changes"
+ARG librocksdb_submodule="librocksdb-sys/rocksdb"
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src
+COPY --link --from=recipe rocksdb.url .
+
+RUN <<EOF
+    set -eux
+    rocksdb_url="$(cat rocksdb.url)"
+    git clone \
+        --depth 1 \
+        --single-branch \
+        --branch "${rust_rocksdb_branch}" \
+        "--recurse-submodules=${librocksdb_submodule}" \
+        "${rocksdb_url}" \
+        /usr/src/rocksdb
+EOF
+
+
+FROM input AS rocksdb-build
+ARG rocksdb_shared=0
+ARG rocksdb_portable="1"
+ARG rocksdb_opt_level="3"
+ARG rocksdb_build_type="Release"
+ARG rocksdb_cxx_flags="-ftls-model=initial-exec"
+ARG rocksdb_make_verbose="ON"
+ARG rocksdb_make_rule_messages="OFF"
+ARG rocksdb_jemalloc=1
+ARG rocksdb_iouring=1
+ARG rocksdb_zstd=1
+ARG rocksdb_lz4=0
+ARG rocksdb_bz2=0
+ARG rocksdb_zlib=0
+ARG rocksdb_snappy=0
+ARG nprocs
+
+WORKDIR /
+COPY --link --from=input . .
+COPY --link --from=rocksdb-fetch /usr/src/rocksdb /usr/src/rocksdb
+
+WORKDIR /usr/src/rocksdb/librocksdb-sys/rocksdb
+ENV CC="clang"
+ENV CXX="clang++"
+ENV nprocs=${nprocs}
+RUN <<EOF
+    set -eux
+
+    cmake -H. -Bbuild \
+        "-DCMAKE_RULE_MESSAGES:BOOL=${rocksdb_make_rule_messages}" \
+        "-DCMAKE_VERBOSE_MAKEFILE:BOOL=${rocksdb_make_verbose}" \
+        "-DCMAKE_BUILD_TYPE=${rocksdb_build_type}" \
+        "-DBUILD_SHARED_LIBS=${rocksdb_shared}" \
+        "-DROCKSDB_BUILD_SHARED=${rocksdb_shared}" \
+        "-DCMAKE_CXX_FLAGS:STRING=${rocksdb_cxx_flags}" \
+        "-DCMAKE_CXX_FLAGS_RELEASE:STRING=-g0 -O${rocksdb_opt_level} -DNDEBUG" \
+        "-DPORTABLE=${rocksdb_portable}" \
+        "-DFAIL_ON_WARNINGS=0" \
+        "-DUSE_RTTI=0" \
+        "-DWITH_RUNTIME_DEBUG=0" \
+        "-DWITH_JNI=0" \
+        "-DWITH_EXAMPLES=0" \
+        "-DWITH_BENCHMARK=0" \
+        "-DWITH_BENCHMARK_TOOLS=0" \
+        "-DWITH_TRACE_TOOLS=0" \
+        "-DWITH_CORE_TOOLS=0" \
+        "-DWITH_TOOLS=0" \
+        "-DWITH_TESTS=0" \
+        "-DWITH_GFLAGS=0" \
+        "-DWITH_LIBURING=${rocksdb_iouring}" \
+        "-DWITH_JEMALLOC=${rocksdb_jemalloc}" \
+        "-DWITH_ZSTD=${rocksdb_zstd}" \
+        "-DWITH_LZ4=${rocksdb_lz4}" \
+        "-DWITH_BZ2=${rocksdb_bz2}" \
+        "-DWITH_ZLIB=${rocksdb_zlib}" \
+        "-DWITH_SNAPPY=${rocksdb_snappy}"
+
+    nprocs=${nprocs:=$(nproc)}
+    cmake \
+        --build build \
+        --target install \
+        --parallel "${nprocs}"
+EOF
+
+
+FROM scratch AS rocksdb
+COPY --from=input /usr/src/rocksdb/librocksdb-sys/rocksdb/build/librocksdb.* .

docker/Dockerfile.rust

@@ -0,0 +1,72 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS rustup
+ARG RUST_HOME
+ARG rust_target
+ARG rustup_version="1.28.2"
+ARG rustup_profile="minimal"
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR ${RUST_HOME}
+RUN <<EOF
+    set -eux
+
+    var="${rustup_version}/${rust_target}"
+    url="https://static.rust-lang.org/rustup/archive/$var/rustup-init"
+    curl -S -O -s "$url"
+    chmod a+rx rustup-init
+EOF
+
+FROM input AS rust
+ARG rust_toolchain
+ARG rust_target
+ARG RUST_HOME
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+ARG rustup_version="1.28.1"
+ARG rustup_profile="minimal"
+ARG CARGO_TERM_VERBOSE
+ARG rustup_components
+ARG cargo_installs
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR ${RUST_HOME}
+ENV CARGO_TARGET="${rust_target}"
+ENV RUSTUP_HOME="${RUSTUP_HOME}"
+ENV CARGO_HOME="${CARGO_HOME}"
+ENV PATH="${CARGO_HOME}/bin:$PATH"
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
+<<EOF
+    set -eux
+    ./rustup-init -y \
+        --quiet \
+        --profile "${rustup_profile}" \
+        --default-host "${CARGO_TARGET}" \
+        --default-toolchain "${rust_toolchain}" \
+        --no-update-default-toolchain \
+        --no-modify-path
+
+    chmod -R a+rw $CARGO_HOME $RUSTUP_HOME
+    rm rustup-init
+
+    rustup component add \
+        --toolchain ${rust_toolchain} \
+        --target ${rust_target} \
+        ${rustup_components} \
+        ;
+
+    rustup run --install ${rust_toolchain} \
+        cargo install \
+            --locked \
+            --target ${rust_target} \
+            ${cargo_installs} \
+            ;
+EOF

docker/Dockerfile.smoketest

@@ -0,0 +1,66 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS smoke-version
+COPY --link --from=input . .
+RUN <<EOF
+    set -eux
+    tuwunel -V
+    version=$(tuwunel -V)
+    /bin/test -n "$version"
+EOF
+
+
+FROM input AS smoke-startup
+COPY --link --from=input . .
+ENV TUWUNEL_LOG="info"
+ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
+RUN <<EOF
+    set -eux
+    tuwunel \
+        -Otest='["smoke"]' \
+        -Oserver_name=\"localhost\" \
+        -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
+
+    rm -rf "${TUWUNEL_DATABASE_PATH}"
+EOF
+
+
+FROM input AS smoke-valgrind
+ARG leak_check="no"
+ARG undef_value_errors="no"
+COPY --link --from=input . .
+ENV TUWUNEL_LOG="info"
+ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
+RUN <<EOF
+    set -eux
+    ulimit -n 65535
+    valgrind \
+        --leak-check=${leak_check} \
+        --undef-value-errors=${undef_value_errors} \
+        --exit-on-first-error=yes \
+        --error-exitcode=1 \
+        tuwunel \
+            -Otest='["smoke"]' \
+            -Oserver_name=\"localhost\" \
+            -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
+
+    rm -rf "${TUWUNEL_DATABASE_PATH}"
+EOF
+
+
+FROM input AS smoke-perf
+COPY --link --from=input . .
+ENV TUWUNEL_LOG="error"
+ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
+RUN <<EOF
+    set -eux
+    perf stat \
+        -j \
+        -ddd \
+        tuwunel \
+            -Otest='["smoke"]' \
+            -Oserver_name=\"localhost\" \
+            -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
+
+    rm -rf "${TUWUNEL_DATABASE_PATH}"
+EOF

docker/Dockerfile.source

@@ -0,0 +1,99 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS source
+ARG git_checkout
+
+WORKDIR /
+COPY --link --from=input . .
+
+ADD --link --keep-git-dir . /usr/src/tuwunel
+WORKDIR /usr/src/tuwunel
+RUN <<EOF
+    set -eux
+    git reset \
+        --hard \
+        --no-recurse-submodules \
+        ${git_checkout}
+EOF
+
+
+FROM input AS ingredients
+ARG rust_target
+ARG rust_toolchain
+ARG RUST_HOME
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+ARG CARGO_TERM_VERBOSE=0
+ARG RUST_BACKTRACE
+ARG JEMALLOC_OVERRIDE
+ARG ROCKSDB_LIB_DIR
+
+WORKDIR /
+COPY --link --from=input . .
+COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
+COPY --link --from=source /usr/src/tuwunel /usr/src/tuwunel
+
+WORKDIR /usr/src/tuwunel
+ENV PATH="${CARGO_HOME}/bin:$PATH"
+ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
+ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
+ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
+ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
+<<EOF
+    set -eux
+    git submodule update \
+        --remote \
+        --no-fetch \
+        --recursive \
+        --checkout \
+        --init
+
+    rustup run ${rust_toolchain} \
+        cargo fetch \
+            --locked \
+            --target ${CARGO_TARGET}
+EOF
+
+
+FROM input AS preparing
+ARG rust_target
+ARG rust_toolchain
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+
+WORKDIR /
+COPY --link --from=input . .
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
+<<EOF
+    set -euxo pipefail
+    rustup run ${rust_toolchain} \
+        cargo chef prepare \
+            --recipe-path recipe.json
+
+    manifest="Cargo.toml"
+    package="rust-librocksdb-sys"
+    cmd="cargo tree --manifest-path ${manifest} -f {r} -p ${package}"
+    url="$(rustup run ${rust_toolchain} ${cmd} | head -n 1)"
+    url="https://github.com/matrix-construct/rust-rocksdb" #TODO fixme
+    echo "$url" > rocksdb.url
+
+    sha1sum recipe.json rocksdb.url
+EOF
+
+
+FROM scratch AS recipe
+
+WORKDIR /
+COPY --from=preparing /usr/src/tuwunel/recipe.json .
+COPY --from=preparing /usr/src/tuwunel/rocksdb.url .

docker/Dockerfile.system

@@ -0,0 +1,31 @@
+# syntax = docker/dockerfile:1.11-labs
+
+ARG sys_name=debian
+ARG sys_version=testing-slim
+
+FROM ${sys_name}:${sys_version} AS system
+
+
+FROM input AS runtime
+ARG var_cache
+ARG var_lib_apt
+ARG packages
+ARG DEBIAN_FRONTEND
+
+WORKDIR /
+COPY --link --from=input . .
+
+ENV DEBIAN_FRONTEND="${DEBIAN_FRONTEND}"
+RUN \
+--mount=type=cache,dst=/var/cache,id=${var_cache},sharing=locked \
+--mount=type=cache,dst=/var/lib/apt,id=${var_lib_apt},sharing=locked \
+<<EOF
+    echo $(uname -a) $0 $-
+    set -eux
+
+    keep_downloaded='Binary::apt::APT::Keep-Downloaded-Packages "true";'
+    echo "$keep_downloaded" > /etc/apt/apt.conf.d/keep-downloaded
+    rm -f /etc/apt/apt.conf.d/docker-clean
+
+    apt-get -y -U install --no-install-recommends ${packages}
+EOF

docker/README.md

@@ -0,0 +1,106 @@
+# Docker Builder
+
+> [!NOTE]
+> This directory is for building docker images. For [deploying](https://github.com/matrix-construct/tuwunel/tree/main/docs/deploying)
+> [docker](https://github.com/matrix-construct/tuwunel/blob/main/docs/deploying/docker.md) visit
+> the appropriate documentation instead.
+
+All Docker images for the project are built here. All images are
+[Docker Bake](https://docs.docker.com/build/bake/) targets. All targets are leaves and
+branches of a unified tree leading to a single root. It is a combinatorial matrix
+of images from shared intermediate layers with a huge ever-growing pulsating cache.
+
+The result is the ability to run continuous integration for a number of build
+variations while only paying the cost of rebuilding the last layer for each one.
+
+
+### Layout
+
+This directory is made up of three types of files:
+
+- Shell scripts are the user interface. Use this system through one of the shell scripts. The
+bake files can still be docker'ed directly but it's recommended to run the script.
+
+- The `.hcl` files specify the targets of the tree. This is all standard
+[docker bake](https://docs.docker.com/build/bake/reference/). All targets are ordered where each
+depends on one or more below it. The root of the tree is at the bottom. At the time of this
+writing there is only one `bake.hcl` file but this might be broken up; in any case there will
+always be a single unified tree.
+
+- The `Dockerfile.*` files are like "library functions" and provide definition for targets.
+These are written generically in the style of "template functions" with many variables allowing
+many targets to create many variations using the same Dockerfile.
+
+
+### Getting started
+
+1. You will need to install docker buildx/buildkit and maybe a couple other related things.
+
+	`apt-get install docker-buildx`
+
+2. You will need to create a builder. There are a few complications that must be explained here
+so please be patient.
+
+	- Some unsavory options are required for some targets. It might be possible to omit these if
+	you're not building the full tree. Otherwise I've included them in the create command below.
+
+		- To run the complement compliance suite we need the `--allow-insecure-entitlement network.host`.
+		This requirement is probably a defect in Complement.
+
+	- The default cache policies are usually insufficient and custom values should be used,
+	 though the ones below are probably too much for a single or simple build.
+
+	Finally create:
+	
+	```
+	cat <<EOF > ./buildkitd.toml
+		[system]
+		  platformsCacheMaxAge = "504h"
+		[worker.oci]
+		  enabled = true
+		  gc = true
+		  reservedSpace = "64GB"
+		  maxUsedSpace = "128GB"
+		[[worker.oci.gcpolicy]]
+		  reservedSpace = "64GB"
+		  maxUsedSpace = "128GB"
+		  all = true
+	EOF
+
+	BKD_FLAGS="--allow-insecure-entitlement network.host"
+	docker buildx create \
+		--name owo \
+		--bootstrap \
+		--buildkitd-config ./buildkitd.toml \
+		--driver docker-container \
+		--buildkitd-flags "$BKD_FLAGS"
+	```
+
+3. Build something simple. The usage is `./bake.sh [target]` which defaults to building all
+elements for one vector of the full matrix. You can start smaller though by running
+`docker/bake.sh system` which is the root target. You can browse the `bake.hcl` from the bottom
+and progressively build targets, or build one or more leaf targets directly. For example try
+to run a smoketest: `./bake.sh tests-smoke`.
+
+4. Build something more complicated. Set environment variables or just edit the default vectors
+near the top of in the `bake.sh` with multiple elements (they are JSON arrays). You can take
+cues from the primary user of this system, the [GitHub CI](https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/main.yml#L32)
+
+5. Defeat the final boss by building and running complement to completion. This will involve
+building the targets for `complement-tester` and `complement-testee` using `bake.sh` and then
+invoking `complement.sh`. You can take cues again from another user of this in the
+[GitHub CI](https://github.com/matrix-construct/tuwunel/blob/7e8c4c8883ca17de91c3323d329541342366ee0c/.github/workflows/test.yml#L140).
+
+## Notes
+
+- For CI our builders are more persistent rather than being created and destroyed for
+each invocation. The builder is meant to be safely reused across operations, but
+for concurrent operations this is tricky, see the next point.
+
+- For CI our builders are isolated only by actor/user. This will probably change to
+`actor/repo/branch` as it's easy to cause issues with concurrent builds right now.
+However we can't accept destroying the builder after each use, so we'll likely
+choose `actor/repo/branch` with the expectation of one build at a time under those
+constraints. Some external caching might need to be contrived between builders for
+deduplication but with care such that malicious actors cannot poison data used
+by other actors, otherwise it defeats the purpose of builder isolation.

docker/bake.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+set -eo pipefail
+
+BASEDIR=$(dirname "$0")
+
+CI="${CI:-false}"
+CI_VERBOSE="${CI_VERBOSE:-false}"
+CI_VERBOSE_ENV="${CI_VERBOSE_ENV:-$CI_VERBOSE}"
+CI_SILENT_BAKE="${CI_SILENT_BAKE:-false}"
+CI_PRINT_BAKE="${CI_PRINT_BAKE:-$CI_VERBOSE}"
+
+default_cargo_profiles='["test"]'
+default_feat_sets='["all"]'
+default_rust_toolchains='["nightly"]'
+default_rust_targets='["x86_64-unknown-linux-gnu"]'
+default_sys_names='["debian"]'
+default_sys_versions='["testing-slim"]'
+default_sys_targets='["x86_64-v1-linux-gnu"]'
+
+if test ! -z "$cargo_profile"; then
+    env_cargo_profiles="[\"${cargo_profile}\"]"
+fi
+
+if test ! -z "$feat_set"; then
+    env_feat_sets="[\"${feat_set}\"]"
+fi
+
+if test ! -z "$rust_target"; then
+    env_rust_targets="[\"${rust_target}\"]"
+fi
+
+if test ! -z "$rust_toolchain"; then
+    env_rust_toolchains="[\"${rust_toolchain}\"]"
+fi
+
+if test ! -z "$sys_name"; then
+    env_sys_names="[\"${sys_name}\"]"
+fi
+
+if test ! -z "$sys_target"; then
+    env_sys_targets="[\"${sys_target}\"]"
+fi
+
+if test ! -z "$sys_version"; then
+    env_sys_versions="[\"${sys_version}\"]"
+fi
+
+set -a
+bake_target="${bake_target:-$@}"
+cargo_profiles="${env_cargo_profiles:-$default_cargo_profiles}"
+feat_sets="${env_feat_sets:-$default_feat_sets}"
+rust_targets="${env_rust_targets:-$default_rust_targets}"
+rust_toolchains="${env_rust_toolchains:-$default_rust_toolchains}"
+sys_names="${env_sys_names:-$default_sys_names}"
+sys_targets="${env_sys_targets:-$default_sys_targets}"
+sys_versions="${env_sys_versions:-$default_sys_versions}"
+
+docker_dir="$PWD/$BASEDIR"
+builder_name="${GITHUB_ACTOR:-owo}"
+toolchain_toml="$docker_dir/../rust-toolchain.toml"
+rust_msrv=$(grep "channel = " "$toolchain_toml" | cut -d'=' -f2 | sed 's/\s"\|"$//g')
+rocksdb_opt_level=3
+rocksdb_portable=1
+git_checkout="${git_checkout:-HEAD}"
+use_chef="true"
+set +a
+
+###############################################################################
+
+export DOCKER_BUILDKIT=1
+if test "$CI" = "true"; then
+    export BUILDKIT_PROGRESS="plain"
+fi
+
+args=""
+args="$args --provenance=false"
+args="$args --builder ${builder_name}"
+#args="$args --set *.platform=${sys_platform}"
+
+if test "$CI" = "true"; then
+	args="$args --allow=network.host"
+fi
+
+if test "$(uname)" = "Darwin"; then
+    nprocs=$(sysctl -n hw.logicalcpu)
+    args="$args --set *.args.nprocs=${nprocs}"
+    :
+else
+    nprocs=$(nproc)
+    args="$args --set *.args.nprocs=${nprocs}"
+    :
+fi
+
+if test "$CI_SILENT_BAKE" = "true"; then
+	args="$args --progress=quiet"
+fi
+
+arg="$args -f $BASEDIR/bake.hcl"
+trap 'set +x; date; echo -e "\033[1;41;37mERROR\033[0m"' ERR
+
+if test "$CI_VERBOSE_ENV" = "true"; then
+	date
+	env
+fi
+
+if test "$CI_PRINT_BAKE" = "true"; then
+    docker buildx bake --print $arg $bake_target
+fi
+
+if test "$NO_BAKE" = "1"; then
+    exit 0
+fi
+
+trap '' ERR
+set -ux
+docker buildx bake $arg $bake_target
+set +x
+echo -e "\033[1;42;30mACCEPT\033[0m"

docker/complement.sh

@@ -0,0 +1,105 @@
+#!/bin/bash
+set -eo pipefail
+
+BASEDIR=$(dirname "$0")
+
+CI="${CI:-false}"
+CI_VERBOSE="${CI_VERBOSE_ENV:-false}"
+CI_VERBOSE_ENV="${CI_VERBOSE_ENV:-$CI_VERBOSE}"
+
+default_cargo_profile="test"
+default_feat_set="all"
+default_rust_toolchain="nightly"
+default_rust_target="x86_64-unknown-linux-gnu"
+default_sys_name="debian"
+default_sys_target="x86_64-v1-linux-gnu"
+default_sys_version="testing-slim"
+
+default_complement_verbose=0
+default_complement_count=1
+default_complement_parallel=1
+default_complement_shuffle=0
+default_complement_timeout="1h"
+default_complement_run=".*"
+
+run="${1:-$default_complement_run}"
+skip=""
+skip="${skip}TestToDeviceMessagesOverFederation/stopped_server"
+skip="${skip}|TestToDeviceMessagesOverFederation/interrupted_connectivity"
+skip="${skip}|TestRoomCreate/Parallel/POST_/createRoom_makes_a_room_with_a_topic_and_writes_rich_topic_representation"
+skip="${skip}|TestRoomCreate/Parallel/POST_/createRoom_makes_a_room_with_a_topic_via_initial_state_overwritten_by_topic"
+skip="${skip}|TestLogin/parallel/POST_/"
+skip="${skip}|TestUnbanViaInvite"
+skip="${skip}|TestRoomState/Parallel/GET_/publicRooms_lists_newly-created_room"
+# flakes due to timeout in debug-mode
+skip="${skip}|TestMSC4297StateResolutionV2_1_starts_from_empty_set"
+skip="${skip}|TestMSC4297StateResolutionV2_1_includes_conflicted_subgraph"
+
+set -a
+cargo_profile="${cargo_profile:-$default_cargo_profile}"
+feat_set="${feat_set:-$default_feat_set}"
+rust_target="${rust_target:-$default_rust_target}"
+rust_toolchain="${rust_toolchain:-$default_rust_toolchain}"
+sys_name="${sys_name:-$default_sys_name}"
+sys_target="${sys_target:-$default_sys_target}"
+sys_version="${sys_version:-$default_sys_version}"
+
+runner_name=$(echo $RUNNER_NAME | cut -d"." -f1)
+runner_num=$(echo $RUNNER_NAME | cut -d"." -f2)
+set +a
+
+###############################################################################
+
+envs=""
+envs="$envs -e complement_verbose=${complement_verbose:-$default_complement_verbose}"
+envs="$envs -e complement_count=${complement_count:-$default_complement_count}"
+envs="$envs -e complement_parallel=${complement_parallel:-$default_complement_parallel}"
+envs="$envs -e complement_shuffle=${complement_shuffle:-$default_complement_shuffle}"
+envs="$envs -e complement_timeout=${complement_timeout:-$default_complement_timeout}"
+envs="$envs -e complement_skip=${complement_skip:-$skip}"
+envs="$envs -e complement_run=${1:-$default_complement_run}"
+
+set -x
+tester_image="complement-tester--${sys_name}--${sys_version}--${sys_target}"
+testee_image="complement-testee--${cargo_profile}--${rust_toolchain}--${rust_target}--${feat_set}--${sys_name}--${sys_version}--${sys_target}"
+name="complement_tester__${sys_name}__${sys_version}__${sys_target}"
+sock="/var/run/docker.sock"
+arg="--name $name -v $sock:$sock --network=host $envs $tester_image ${testee_image}"
+set +x
+
+if test "$CI_VERBOSE_ENV" = "true"; then
+	date
+	env
+fi
+
+docker rm -f "$name" 2>/dev/null
+
+arg="-d $arg"
+cid=$(docker run $arg)
+
+if test "$CI" = "true"; then
+	echo -n "$cid" > "$name"
+fi
+
+output_src="$cid:/usr/src/complement/full_output.jsonl"
+output_dst="complement.jsonl"
+extract_output() {
+	docker cp "$output_src" "$output_dst"
+}
+
+result_src="$cid:/usr/src/complement/new_results.jsonl"
+result_dst="tests/test_results/complement/test_results.jsonl"
+extract_results() {
+	docker cp "$result_src" "$result_dst"
+}
+
+trap 'extract_output; set +x; date; echo -e "\033[1;41;37mERROR\033[0m"' ERR
+trap 'docker container stop $cid; extract_output' INT
+docker logs -f "$cid"
+docker wait "$cid" 2>/dev/null
+
+extract_results
+git diff -U0 --color --shortstat "$result_dst" | (grep "$run" || true)
+
+git diff --quiet --exit-code "$result_dst"
+echo -e "\033[1;42;30mACCEPT\033[0m"

docs/README.md

@@ -0,0 +1 @@
+SUMMARY.md

docs/SUMMARY.md

@@ -10,6 +10,7 @@ # Summary
   - [Kubernetes](deploying/kubernetes.md)
   - [Arch Linux](deploying/arch-linux.md)
   - [Debian](deploying/debian.md)
+  - [Red Hat](deploying/redhat.md)
   - [FreeBSD](deploying/freebsd.md)
 - [TURN](turn.md)
 - [Appservices](appservices.md)
@@ -19,4 +20,4 @@ # Summary
   - [Contributing](contributing.md)
   - [Testing](development/testing.md)
   - [Hot Reloading ("Live" Development)](development/hot_reload.md)
-- [conduwuit Community Code of Conduct](conduwuit_coc.md)
+- [Tuwunel Community Code of Conduct](../CODE_OF_CONDUCT.md)

docs/appservices.md

@@ -3,8 +3,8 @@ # Setting up Appservices
 ## Getting help
 
 If you run into any problems while setting up an Appservice: ask us in
-[#conduwuit:puppygock.gay](https://matrix.to/#/#conduwuit:puppygock.gay) or
-[open an issue on GitHub](https://github.com/girlbossceo/conduwuit/issues/new).
+[#tuwunel:tuwunel.chat](https://matrix.to/#/#tuwunel:tuwunel.chat) or
+[open an issue on GitHub](https://github.com/matrix-construct/tuwunel/issues/new).
 
 ## Set up the appservice - general instructions
 
@@ -14,7 +14,7 @@ ## Set up the appservice - general instructions
 
 At some point the appservice guide should ask you to add a registration yaml
 file to the homeserver. In Synapse you would do this by adding the path to the
-homeserver.yaml, but in conduwuit you can do this from within Matrix:
+homeserver.yaml, but in tuwunel you can do this from within Matrix:
 
 First, go into the `#admins` room of your homeserver. The first person that
 registered on the homeserver automatically joins it. Then send a message into
@@ -37,9 +37,9 @@ ## Set up the appservice - general instructions
 
 The server bot should answer with `Appservices (1): your-bridge`
 
-Then you are done. conduwuit will send messages to the appservices and the
+Then you are done. Tuwunel will send messages to the appservices and the
 appservice can send requests to the homeserver. You don't need to restart
-conduwuit, but if it doesn't work, restarting while the appservice is running
+tuwunel, but if it doesn't work, restarting while the appservice is running
 could help.
 
 ## Appservice-specific instructions

docs/assets/conduwuit_logo.svg

@@ -1,36 +0,0 @@
-<svg
-  version="1.1"
-  id="Layer_1"
-  xmlns="http://www.w3.org/2000/svg"
-  x="0px"
-  y="0px"
-  width="100%"
-  viewBox="0 0 864 864"
-  enableBackground="new 0 0 864 864"
-  xmlSpace="preserve"
->
-  <path
-    fill="#EC008C"
-    opacity="1.000000"
-    stroke="none"
-    d="M0.999997,649.000000 C1.000000,433.052795 1.000000,217.105591 1.000000,1.079198 C288.876801,1.079198 576.753601,1.079198 865.000000,1.079198 C865.000000,73.025414 865.000000,145.051453 864.634888,217.500671 C852.362488,223.837280 840.447632,229.735275 828.549438,235.666794 C782.143677,258.801056 735.743225,281.945923 688.998657,304.980469 C688.122009,304.476532 687.580750,304.087708 687.053894,303.680206 C639.556946,266.944733 573.006775,291.446869 560.804199,350.179443 C560.141357,353.369446 559.717590,356.609131 559.195374,359.748962 C474.522705,359.748962 390.283478,359.748962 306.088135,359.748962 C298.804138,318.894806 265.253357,295.206024 231.834442,293.306793 C201.003021,291.554596 169.912033,310.230042 156.935104,338.792725 C149.905151,354.265930 147.884064,370.379944 151.151794,387.034515 C155.204453,407.689667 166.300507,423.954224 183.344437,436.516663 C181.938263,437.607025 180.887405,438.409576 179.849426,439.228516 C147.141953,465.032562 139.918045,510.888947 163.388611,545.322632 C167.274551,551.023804 172.285187,555.958313 176.587341,561.495728 C125.846893,587.012817 75.302292,612.295532 24.735992,637.534790 C16.874903,641.458496 8.914484,645.183228 0.999997,649.000000 z"
-  />
-  <path
-    fill="#000000"
-    opacity="1.000000"
-    stroke="none"
-    d="M689.340759,305.086823 C735.743225,281.945923 782.143677,258.801056 828.549438,235.666794 C840.447632,229.735275 852.362488,223.837280 864.634888,217.961929 C865.000000,433.613190 865.000000,649.226379 865.000000,864.919800 C577.000000,864.919800 289.000000,864.919800 1.000000,864.919800 C1.000000,793.225708 1.000000,721.576721 0.999997,649.463867 C8.914484,645.183228 16.874903,641.458496 24.735992,637.534790 C75.302292,612.295532 125.846893,587.012817 176.939667,561.513062 C178.543060,562.085083 179.606812,562.886414 180.667526,563.691833 C225.656799,597.853394 291.232574,574.487244 304.462524,519.579773 C304.989105,517.394409 305.501068,515.205505 305.984619,513.166748 C391.466370,513.166748 476.422729,513.166748 561.331177,513.166748 C573.857727,555.764343 608.978149,572.880920 638.519897,572.672791 C671.048340,572.443665 700.623230,551.730408 711.658752,520.910583 C722.546875,490.502106 715.037842,453.265564 682.776733,429.447052 C683.966064,428.506866 685.119507,427.602356 686.265320,426.688232 C712.934143,405.412262 723.011475,370.684631 711.897339,338.686676 C707.312805,325.487671 699.185303,314.725128 689.340759,305.086823 z"
-  />
-  <path
-    fill="#FEFBFC"
-    opacity="1.000000"
-    stroke="none"
-    d="M688.998657,304.980469 C699.185303,314.725128 707.312805,325.487671 711.897339,338.686676 C723.011475,370.684631 712.934143,405.412262 686.265320,426.688232 C685.119507,427.602356 683.966064,428.506866 682.776733,429.447052 C715.037842,453.265564 722.546875,490.502106 711.658752,520.910583 C700.623230,551.730408 671.048340,572.443665 638.519897,572.672791 C608.978149,572.880920 573.857727,555.764343 561.331177,513.166748 C476.422729,513.166748 391.466370,513.166748 305.984619,513.166748 C305.501068,515.205505 304.989105,517.394409 304.462524,519.579773 C291.232574,574.487244 225.656799,597.853394 180.667526,563.691833 C179.606812,562.886414 178.543060,562.085083 177.128418,561.264465 C172.285187,555.958313 167.274551,551.023804 163.388611,545.322632 C139.918045,510.888947 147.141953,465.032562 179.849426,439.228516 C180.887405,438.409576 181.938263,437.607025 183.344437,436.516663 C166.300507,423.954224 155.204453,407.689667 151.151794,387.034515 C147.884064,370.379944 149.905151,354.265930 156.935104,338.792725 C169.912033,310.230042 201.003021,291.554596 231.834442,293.306793 C265.253357,295.206024 298.804138,318.894806 306.088135,359.748962 C390.283478,359.748962 474.522705,359.748962 559.195374,359.748962 C559.717590,356.609131 560.141357,353.369446 560.804199,350.179443 C573.006775,291.446869 639.556946,266.944733 687.053894,303.680206 C687.580750,304.087708 688.122009,304.476532 688.998657,304.980469 M703.311279,484.370789 C698.954468,457.053253 681.951416,440.229645 656.413696,429.482330 C673.953552,421.977875 688.014709,412.074219 696.456482,395.642365 C704.862061,379.280853 706.487793,362.316345 700.947998,344.809204 C691.688965,315.548492 664.183716,296.954437 633.103516,298.838257 C618.467957,299.725372 605.538086,305.139557 594.588501,314.780121 C577.473999,329.848511 570.185486,349.121399 571.838501,371.750854 C479.166595,371.750854 387.082886,371.750854 294.582672,371.750854 C293.993011,354.662048 288.485260,339.622314 276.940491,327.118439 C265.392609,314.611176 251.082092,307.205322 234.093262,305.960541 C203.355347,303.708374 176.337585,320.898438 166.089890,348.816620 C159.557541,366.613007 160.527206,384.117401 168.756042,401.172516 C177.054779,418.372589 191.471954,428.832886 207.526581,435.632172 C198.407059,442.272583 188.815598,448.302246 180.383728,455.660675 C171.685028,463.251984 166.849655,473.658661 163.940216,484.838684 C161.021744,496.053375 161.212982,507.259705 164.178833,518.426208 C171.577927,546.284302 197.338104,566.588867 226.001465,567.336853 C240.828415,567.723816 254.357819,563.819092 266.385468,555.199646 C284.811554,541.994751 293.631104,523.530579 294.687347,501.238312 C387.354828,501.238312 479.461304,501.238312 571.531799,501.238312 C577.616638,543.189026 615.312866,566.342102 651.310059,559.044739 C684.973938,552.220398 708.263306,519.393127 703.311279,484.370789 z"
-  />
-  <path
-    fill="#EC008C"
-    opacity="1.000000"
-    stroke="none"
-    d="M703.401855,484.804718 C708.263306,519.393127 684.973938,552.220398 651.310059,559.044739 C615.312866,566.342102 577.616638,543.189026 571.531799,501.238312 C479.461304,501.238312 387.354828,501.238312 294.687347,501.238312 C293.631104,523.530579 284.811554,541.994751 266.385468,555.199646 C254.357819,563.819092 240.828415,567.723816 226.001465,567.336853 C197.338104,566.588867 171.577927,546.284302 164.178833,518.426208 C161.212982,507.259705 161.021744,496.053375 163.940216,484.838684 C166.849655,473.658661 171.685028,463.251984 180.383728,455.660675 C188.815598,448.302246 198.407059,442.272583 207.526581,435.632172 C191.471954,428.832886 177.054779,418.372589 168.756042,401.172516 C160.527206,384.117401 159.557541,366.613007 166.089890,348.816620 C176.337585,320.898438 203.355347,303.708374 234.093262,305.960541 C251.082092,307.205322 265.392609,314.611176 276.940491,327.118439 C288.485260,339.622314 293.993011,354.662048 294.582672,371.750854 C387.082886,371.750854 479.166595,371.750854 571.838501,371.750854 C570.185486,349.121399 577.473999,329.848511 594.588501,314.780121 C605.538086,305.139557 618.467957,299.725372 633.103516,298.838257 C664.183716,296.954437 691.688965,315.548492 700.947998,344.809204 C706.487793,362.316345 704.862061,379.280853 696.456482,395.642365 C688.014709,412.074219 673.953552,421.977875 656.413696,429.482330 C681.951416,440.229645 698.954468,457.053253 703.401855,484.804718 z"
-  />
-</svg>

docs/conduwuit_coc.md

@@ -1,93 +0,0 @@
-# conduwuit Community Code of Conduct
-
-Welcome to the conduwuit community! We’re excited to have you here. conduwuit is
-a hard-fork of the Conduit homeserver, aimed at making Matrix more accessible
-and inclusive for everyone.
-
-This space is dedicated to fostering a positive, supportive, and inclusive
-environment for everyone. This Code of Conduct applies to all conduwuit spaces,
-including any further community rooms that reference this CoC. Here are our
-guidelines to help maintain the welcoming atmosphere that sets conduwuit apart.
-
-For the general foundational rules, please refer to the [Contributor's
-Covenant](https://github.com/girlbossceo/conduwuit/blob/main/CODE_OF_CONDUCT.md).
-Below are additional guidelines specific to the conduwuit community.
-
-## Our Values and Guidelines
-
-1. **Respect and Inclusivity**: We are committed to maintaining a community
-   where everyone feels safe and respected. Discrimination, harassment, or hate
-speech of any kind will not be tolerated. Recognise that each community member
-experiences the world differently based on their past experiences, background,
-and identity. Share your own experiences and be open to learning about others'
-diverse perspectives.
-
-2. **Positivity and Constructiveness**: Engage in constructive discussions and
-   support each other. If you feel angry, negative, or aggressive, take a break
-until you can participate in a positive and constructive manner. Process intense
-feelings with a friend or in a private setting before engaging in community
-conversations to help maintain a supportive and focused environment.
-
-3. **Clarity and Understanding**: Our community includes neurodivergent
-   individuals and those who may not appreciate sarcasm or subtlety. Communicate
-clearly and kindly, avoiding sarcasm and ensuring your messages are easily
-understood by all. Additionally, avoid putting the burden of education on
-marginalized groups by doing your own research before asking for explanations.
-
-4. **Be Open to Inclusivity**: Actively engage in conversations about making our
-   community more inclusive. Report discriminatory behavior to the moderators
-and be open to constructive feedback that aims to improve our community.
-Understand that discussing discrimination and negative experiences can be
-emotionally taxing, so focus on the message rather than critiquing the tone
-used.
-
-5. **Commit to Inclusivity**: Building an inclusive community requires time,
-   energy, and resources. Recognise that addressing discrimination and bias is
-an ongoing process that necessitates commitment and action from all community
-members.
-
-## Matrix Community
-
-This Code of Conduct applies to the entire [conduwuit Matrix
-Space](https://matrix.to/#/#conduwuit-space:puppygock.gay) and its rooms,
-including:
-
-### [#conduwuit:puppygock.gay](https://matrix.to/#/#conduwuit:puppygock.gay)
-
-This room is for support and discussions about conduwuit. Ask questions, share
-insights, and help each other out.
-
-### [#conduwuit-offtopic:girlboss.ceo](https://matrix.to/#/#conduwuit-offtopic:girlboss.ceo)
-
-For off-topic community conversations about any subject. While this room allows
-for a wide range of topics, the same CoC applies. Keep discussions respectful
-and inclusive, and avoid divisive subjects like country/world politics. General
-topics, such as world events, are welcome as long as they follow the CoC.
-
-### [#conduwuit-dev:puppygock.gay](https://matrix.to/#/#conduwuit-dev:puppygock.gay)
-
-This room is dedicated to discussing active development of conduwuit. Posting
-requires an elevated power level, which can be requested in one of the other
-rooms. Use this space to collaborate and innovate.
-
-## Enforcement
-
-We have a zero-tolerance policy for violations of this Code of Conduct. If
-someone’s behavior makes you uncomfortable, please report it to the moderators.
-Actions we may take include:
-
-1. **Warning**: A warning given directly in the room or via a private message
-   from the moderators, identifying the violation and requesting corrective
-action.
-2. **Temporary Mute**: Temporary restriction from participating in discussions
-   for a specified period to allow for reflection and cooling off.
-3. **Kick or Ban**: Egregious behavior may result in an immediate kick or ban to
-   protect other community members. Bans are considered permanent and will only
-be reversed in exceptional circumstances after proven good behavior.
-
-Please highlight issues directly in rooms when possible, but if you don't feel
-comfortable doing that, then please send a DM to one of the moderators directly.
-
-Together, let’s build a community where everyone feels valued and respected.
-
-— The conduwuit Moderation Team

docs/configuration.md

@@ -1,24 +1,30 @@
 # Configuration
 
-This chapter describes various ways to configure conduwuit.
+This chapter describes various ways to configure Tuwunel.
 
 ## Basics
 
-conduwuit uses a config file for the majority of the settings, but also supports
+Tuwunel uses a config file for the majority of the settings, but also supports
 setting individual config options via commandline.
 
-Please refer to the [example config
-file](./configuration/examples.md#example-configuration) for all of those
-settings.
+Please refer to the [example config file](./configuration/examples.md#example-configuration) for all of those settings.
 
 The config file to use can be specified on the commandline when running
-conduwuit by specifying the `-c`, `--config` flag. Alternatively, you can use
-the environment variable `CONDUWUIT_CONFIG` to specify the config file to used.
-Conduit's environment variables are supported for backwards compatibility.
+Tuwunel by specifying the `-c`, `--config` flag. It is also possible to specify
+more than one config file.
+
+Alternatively, you can use the environment variable `TUWUNEL_CONFIG` to specify
+the config file to used. Conduit's environment variables are supported for 
+backwards compatibility.
+
+> [!IMPORTANT]
+> It is bad practice to uncomment default options without changing them. Many
+> defaults are updated by developers as features evolve and can be essential
+> to expected server function.
 
 ## Option commandline flag
 
-conduwuit supports setting individual config options in TOML format from the
+Tuwunel supports setting individual config options in TOML format from the
 `-O` / `--option` flag. For example, you can set your server name via `-O
 server_name=\"example.com\"`.
 
@@ -31,18 +37,32 @@ ## Option commandline flag
 - `--option log=\"debug\"` works ✅
 - `--option server_name='"example.com'"` works ✅
 
+## Relevance of configuration settings
+
+There is a specific sequence for reading and overwriting the settings. The
+latest setting takes precedence and defines the configuration.
+
+1. Set in `CONDUIT_CONFIG`.
+2. Set in `CONDUWUIT_CONFIG`.
+3. Set in `TUWUNEL_CONFIG`.
+4. Set in the first config file on the command line (e.g. `-c config_file_1.toml`).
+5. Set in the second config file on the command line (e.g. `-c config_file_2.toml`).
+6. Set in any additional config file on the command line (e.g. `-c config_file_n.toml`).
+7. Set within the options (again, the latest option in the list overrides).
+
+
 ## Execute commandline flag
 
-conduwuit supports running admin commands on startup using the commandline
+Tuwunel supports running admin commands on startup using the commandline
 argument `--execute`. The most notable use for this is to create an admin user
 on first startup.
 
 The syntax of this is a standard admin command without the prefix such as
-`./conduwuit --execute "users create_user june"`
+`./tuwunel --execute "users create_user june"`
 
 An example output of a success is:
 ```
-INFO conduwuit_service::admin::startup: Startup command #0 completed:
+INFO tuwunel_service::admin::startup: Startup command #0 completed:
 Created user with user_id: @june:girlboss.ceo and password: `<redacted>`
 ```
 
@@ -52,13 +72,13 @@ ## Environment variables
 
 All of the settings that are found in the config file can be specified by using
 environment variables. The environment variable names should be all caps and
-prefixed with `CONDUWUIT_`.
+prefixed with `TUWUNEL_`.
 
 For example, if the setting you are changing is `max_request_size`, then the
-environment variable to set is `CONDUWUIT_MAX_REQUEST_SIZE`.
+environment variable to set is `TUWUNEL_MAX_REQUEST_SIZE`.
 
 To modify config options not in the `[global]` context such as
-`[global.well_known]`, use the `__` suffix split: `CONDUWUIT_WELL_KNOWN__SERVER`
+`[global.well_known]`, use the `__` suffix split: `TUWUNEL_WELL_KNOWN__SERVER`
 
-Conduit's environment variables are supported for backwards compatibility (e.g.
-`CONDUIT_SERVER_NAME`).
+Conduit and conduwuit's environment variables are supported for backwards
+compatibility (e.g. `CONDUIT_SERVER_NAME` or `CONDUWUIT_SERVER_NAME`).

docs/configuration/examples.md

@@ -4,7 +4,7 @@ ## Example configuration
 <summary>Example configuration</summary>
 
 ```toml
-{{#include ../../conduwuit-example.toml}}
+{{#include ../../tuwunel-example.toml}}
 ```
 
 </details>
@@ -15,7 +15,7 @@ ## Debian systemd unit file
 <summary>Debian systemd unit file</summary>
 
 ```
-{{#include ../../debian/conduwuit.service}}
+{{#include ../../debian/tuwunel.service}}
 ```
 
 </details>
@@ -26,7 +26,7 @@ ## Arch Linux systemd unit file
 <summary>Arch Linux systemd unit file</summary>
 
 ```
-{{#include ../../arch/conduwuit.service}}
+{{#include ../../arch/tuwunel.service}}
 ```
 
 </details>

docs/deploying.md

@@ -1,3 +1,3 @@
 # Deploying
 
-This chapter describes various ways to deploy conduwuit.
+This chapter describes various ways to deploy Tuwunel.

docs/deploying/README.md

@@ -0,0 +1 @@
+SUMMARY.md

docs/deploying/SUMMARY.md

@@ -0,0 +1,11 @@
+# Deployment Guides
+
+- [Generic](generic.md)
+- [NixOS](nixos.md)
+- [Docker](docker.md)
+- [Kubernetes](kubernetes.md)
+- [Arch Linux](arch-linux.md)
+- [Debian](debian.md)
+- [Red Hat](redhat.md)
+- [FreeBSD](freebsd.md)
+- [Podman systemd](podman-systemd.md)

docs/deploying/arch-linux.md

@@ -1,15 +1,15 @@
-# conduwuit for Arch Linux
+# Tuwunel for Arch Linux
 
-Currently conduwuit is only on the Arch User Repository (AUR).
+Currently Tuwunel is only on the Arch User Repository (AUR).
 
-The conduwuit AUR packages are community maintained and are not maintained by
-conduwuit development team, but the AUR package maintainers are in the Matrix
+The Tuwunel AUR packages are community maintained and are not maintained by
+Tuwunel development team, but the AUR package maintainers are in the Matrix
 room. Please attempt to verify your AUR package's PKGBUILD file looks fine
 before asking for support.
 
-- [conduwuit](https://aur.archlinux.org/packages/conduwuit) - latest tagged
-conduwuit
-- [conduwuit-git](https://aur.archlinux.org/packages/conduwuit-git) - latest git
-conduwuit from `main` branch
-- [conduwuit-bin](https://aur.archlinux.org/packages/conduwuit-bin) - latest
-tagged conduwuit static binary
+- [tuwunel](https://aur.archlinux.org/packages/tuwunel) - latest tagged
+tuwunel
+- [tuwunel-git](https://aur.archlinux.org/packages/tuwunel-git) - latest git
+tuwunel from `main` branch
+- [tuwunel-bin](https://aur.archlinux.org/packages/tuwunel-bin) - latest
+tagged tuwunel static binary

docs/deploying/docker-compose.for-traefik.yml

@@ -1,48 +1,48 @@
-# conduwuit - Behind Traefik Reverse Proxy
+# tuwunel - Behind Traefik Reverse Proxy
 
 services:
   homeserver:
     ### If you already built the conduduwit image with 'docker build' or want to use the Docker Hub image,
     ### then you are ready to go.
-    image: girlbossceo/conduwuit:latest
+    image: jevolk/tuwunel:latest
     restart: unless-stopped
     volumes:
-      - db:/var/lib/conduwuit
-      #- ./conduwuit.toml:/etc/conduwuit.toml
+      - db:/var/lib/tuwunel
+      #- ./tuwunel.toml:/etc/tuwunel.toml
     networks:
       - proxy
     environment:
-      CONDUWUIT_SERVER_NAME: your.server.name.example # EDIT THIS
-      CONDUWUIT_DATABASE_PATH: /var/lib/conduwuit
-      CONDUWUIT_PORT: 6167 # should match the loadbalancer traefik label
-      CONDUWUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-      CONDUWUIT_ALLOW_REGISTRATION: 'true'
-      CONDUWUIT_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
-      #CONDUWUIT_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-      CONDUWUIT_ALLOW_FEDERATION: 'true'
-      CONDUWUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
-      CONDUWUIT_TRUSTED_SERVERS: '["matrix.org"]'
-      #CONDUWUIT_LOG: warn,state_res=warn
-      CONDUWUIT_ADDRESS: 0.0.0.0
-      #CONDUWUIT_CONFIG: '/etc/conduwuit.toml' # Uncomment if you mapped config toml above
+      TUWUNEL_SERVER_NAME: your.server.name.example # EDIT THIS
+      TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
+      TUWUNEL_PORT: 6167 # should match the loadbalancer traefik label
+      TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
+      TUWUNEL_ALLOW_REGISTRATION: 'true'
+      TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
+      #TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
+      TUWUNEL_ALLOW_FEDERATION: 'true'
+      TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
+      TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
+      #TUWUNEL_LOG: warn,state_res=warn
+      TUWUNEL_ADDRESS: 0.0.0.0
+      #TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
 
-      # We need some way to serve the client and server .well-known json. The simplest way is via the CONDUWUIT_WELL_KNOWN
-      # variable / config option, there are multiple ways to do this, e.g. in the conduwuit.toml file, and in a seperate
+      # We need some way to serve the client and server .well-known json. The simplest way is via the TUWUNEL_WELL_KNOWN
+      # variable / config option, there are multiple ways to do this, e.g. in the tuwunel.toml file, and in a separate
       # see the override file for more information about delegation
-      CONDUWUIT_WELL_KNOWN: |
+      TUWUNEL_WELL_KNOWN: |
         {
         client=https://your.server.name.example,
         server=your.server.name.example:443
         }
     #cpuset: "0-4" # Uncomment to limit to specific CPU cores
-    ulimits: # conduwuit uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
+    ulimits: # tuwunel uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
       nofile:
         soft: 1048567
         hard: 1048567
 
     ### Uncomment if you want to use your own Element-Web App.
     ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and conduwuit
+    ###       Domain or Subdomain for the communication between Element and tuwunel
     ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
     # element-web:
     #     image: vectorim/element-web:latest

docs/deploying/docker-compose.override.yml

@@ -1,4 +1,4 @@
-# conduwuit - Traefik Reverse Proxy Labels
+# tuwunel - Traefik Reverse Proxy Labels
 
 services:
   homeserver:
@@ -6,17 +6,17 @@ services:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"  # Change this to the name of your Traefik docker proxy network
 
-      - "traefik.http.routers.to-conduwuit.rule=Host(`<SUBDOMAIN>.<DOMAIN>`)"  # Change to the address on which conduwuit is hosted
-      - "traefik.http.routers.to-conduwuit.tls=true"
-      - "traefik.http.routers.to-conduwuit.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.to-conduwuit.middlewares=cors-headers@docker"
-      - "traefik.http.services.to_conduwuit.loadbalancer.server.port=6167"
+      - "traefik.http.routers.to-tuwunel.rule=Host(`<SUBDOMAIN>.<DOMAIN>`)"  # Change to the address on which tuwunel is hosted
+      - "traefik.http.routers.to-tuwunel.tls=true"
+      - "traefik.http.routers.to-tuwunel.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.to-tuwunel.middlewares=cors-headers@docker"
+      - "traefik.http.services.to_tuwunel.loadbalancer.server.port=6167"
 
       - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
       - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
       - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"
 
-      # If you want to have your account on <DOMAIN>, but host conduwuit on a subdomain,
+      # If you want to have your account on <DOMAIN>, but host tuwunel on a subdomain,
       # you can let it only handle the well known file on that domain instead
       #- "traefik.http.routers.to-matrix-wellknown.rule=Host(`<DOMAIN>`) && PathPrefix(`/.well-known/matrix`)"
       #- "traefik.http.routers.to-matrix-wellknown.tls=true"

docs/deploying/docker-compose.with-caddy.yml

@@ -1,6 +1,6 @@
 services:
     caddy:
-    # This compose file uses caddy-docker-proxy as the reverse proxy for conduwuit!
+    # This compose file uses caddy-docker-proxy as the reverse proxy for tuwunel!
     # For more info, visit https://github.com/lucaslorentz/caddy-docker-proxy
         image: lucaslorentz/caddy-docker-proxy:ci-alpine
         ports:
@@ -20,27 +20,27 @@ services:
             caddy.1_respond: /.well-known/matrix/client {"m.server":{"base_url":"https://matrix.example.com"},"m.homeserver":{"base_url":"https://matrix.example.com"},"org.matrix.msc3575.proxy":{"url":"https://matrix.example.com"}}
 
     homeserver:
-        ### If you already built the conduwuit image with 'docker build' or want to use a registry image,
+        ### If you already built the tuwunel image with 'docker build' or want to use a registry image,
         ### then you are ready to go.
-        image: girlbossceo/conduwuit:latest
+        image: jevolk/tuwunel:latest
         restart: unless-stopped
         volumes:
-            - db:/var/lib/conduwuit
-            #- ./conduwuit.toml:/etc/conduwuit.toml
+            - db:/var/lib/tuwunel
+            #- ./tuwunel.toml:/etc/tuwunel.toml
         environment:
-            CONDUWUIT_SERVER_NAME: example.com # EDIT THIS
-            CONDUWUIT_DATABASE_PATH: /var/lib/conduwuit
-            CONDUWUIT_PORT: 6167
-            CONDUWUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-            CONDUWUIT_ALLOW_REGISTRATION: 'true'
-            CONDUWUIT_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
-            #CONDUWUIT_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-            CONDUWUIT_ALLOW_FEDERATION: 'true'
-            CONDUWUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
-            CONDUWUIT_TRUSTED_SERVERS: '["matrix.org"]'
-            #CONDUWUIT_LOG: warn,state_res=warn
-            CONDUWUIT_ADDRESS: 0.0.0.0
-            #CONDUWUIT_CONFIG: '/etc/conduwuit.toml' # Uncomment if you mapped config toml above
+            TUWUNEL_SERVER_NAME: example.com # EDIT THIS
+            TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
+            TUWUNEL_PORT: 6167
+            TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
+            TUWUNEL_ALLOW_REGISTRATION: 'true'
+            TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
+            #TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
+            TUWUNEL_ALLOW_FEDERATION: 'true'
+            TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
+            TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
+            #TUWUNEL_LOG: warn,state_res=warn
+            TUWUNEL_ADDRESS: 0.0.0.0
+            #TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
         networks:
             - caddy
         labels:

docs/deploying/docker-compose.with-traefik.yml

@@ -1,56 +1,56 @@
-# conduwuit - Behind Traefik Reverse Proxy
+# tuwunel - Behind Traefik Reverse Proxy
 
 services:
   homeserver:
-    ### If you already built the conduwuit image with 'docker build' or want to use the Docker Hub image,
+    ### If you already built the tuwunel image with 'docker build' or want to use the Docker Hub image,
     ### then you are ready to go.
-    image: girlbossceo/conduwuit:latest
+    image: jevolk/tuwunel:latest
     restart: unless-stopped
     volumes:
-      - db:/var/lib/conduwuit
-      #- ./conduwuit.toml:/etc/conduwuit.toml
+      - db:/var/lib/tuwunel
+      #- ./tuwunel.toml:/etc/tuwunel.toml
     networks:
       - proxy
     environment:
-      CONDUWUIT_SERVER_NAME: your.server.name.example # EDIT THIS
-      CONDUWUIT_TRUSTED_SERVERS: '["matrix.org"]'
-      CONDUWUIT_ALLOW_REGISTRATION: 'false' # After setting a secure registration token, you can enable this
-      CONDUWUIT_REGISTRATION_TOKEN: "" # This is a token you can use to register on the server
-      #CONDUWUIT_REGISTRATION_TOKEN_FILE: "" # Alternatively you can configure a path to a token file to read
-      CONDUWUIT_ADDRESS: 0.0.0.0
-      CONDUWUIT_PORT: 6167 # you need to match this with the traefik load balancer label if you're want to change it
-      CONDUWUIT_DATABASE_PATH: /var/lib/conduwuit
-      #CONDUWUIT_CONFIG: '/etc/conduit.toml' # Uncomment if you mapped config toml above
-      ### Uncomment and change values as desired, note that conduwuit has plenty of config options, so you should check out the example example config too
+      TUWUNEL_SERVER_NAME: your.server.name.example # EDIT THIS
+      TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
+      TUWUNEL_ALLOW_REGISTRATION: 'false' # After setting a secure registration token, you can enable this
+      TUWUNEL_REGISTRATION_TOKEN: "" # This is a token you can use to register on the server
+      #TUWUNEL_REGISTRATION_TOKEN_FILE: "" # Alternatively you can configure a path to a token file to read
+      TUWUNEL_ADDRESS: 0.0.0.0
+      TUWUNEL_PORT: 6167 # you need to match this with the traefik load balancer label if you're want to change it
+      TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
+      #TUWUNEL_CONFIG: '/etc/conduit.toml' # Uncomment if you mapped config toml above
+      ### Uncomment and change values as desired, note that tuwunel has plenty of config options, so you should check out the example example config too
       # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
-      # CONDUWUIT_LOG: info  # default is: "warn,state_res=warn"
-      # CONDUWUIT_ALLOW_ENCRYPTION: 'true'
-      # CONDUWUIT_ALLOW_FEDERATION: 'true'
-      # CONDUWUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
-      # CONDUWUIT_ALLOW_INCOMING_PRESENCE: true
-      # CONDUWUIT_ALLOW_OUTGOING_PRESENCE: true
-      # CONDUWUIT_ALLOW_LOCAL_PRESENCE: true
-      # CONDUWUIT_WORKERS: 10
-      # CONDUWUIT_MAX_REQUEST_SIZE: 20000000  # in bytes, ~20 MB
-      # CONDUWUIT_NEW_USER_DISPLAYNAME_SUFFIX = "🏳<200d>⚧"
+      # TUWUNEL_LOG: info  # default is: "warn,state_res=warn"
+      # TUWUNEL_ALLOW_ENCRYPTION: 'true'
+      # TUWUNEL_ALLOW_FEDERATION: 'true'
+      # TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
+      # TUWUNEL_ALLOW_INCOMING_PRESENCE: true
+      # TUWUNEL_ALLOW_OUTGOING_PRESENCE: true
+      # TUWUNEL_ALLOW_LOCAL_PRESENCE: true
+      # TUWUNEL_WORKERS: 10
+      # TUWUNEL_MAX_REQUEST_SIZE: 20000000  # in bytes, ~20 MB
+      # TUWUNEL_NEW_USER_DISPLAYNAME_SUFFIX = "🏳<200d>⚧"
 
-      # We need some way to serve the client and server .well-known json. The simplest way is via the CONDUWUIT_WELL_KNOWN
-      # variable / config option, there are multiple ways to do this, e.g. in the conduwuit.toml file, and in a seperate
+      # We need some way to serve the client and server .well-known json. The simplest way is via the TUWUNEL_WELL_KNOWN
+      # variable / config option, there are multiple ways to do this, e.g. in the tuwunel.toml file, and in a separate
       # reverse proxy, but since you do not have a reverse proxy and following this guide, this example is included
-      CONDUWUIT_WELL_KNOWN: |
+      TUWUNEL_WELL_KNOWN: |
         {
           client=https://your.server.name.example,
           server=your.server.name.example:443
         }
     #cpuset: "0-4" # Uncomment to limit to specific CPU cores
-    ulimits: # conduwuit uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
+    ulimits: # tuwunel uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
       nofile:
         soft: 1048567
         hard: 1048567
 
     ### Uncomment if you want to use your own Element-Web App.
     ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and conduwuit
+    ###       Domain or Subdomain for the communication between Element and tuwunel
     ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
     # element-web:
     #     image: vectorim/element-web:latest

docs/deploying/docker-compose.yml

@@ -1,34 +1,34 @@
-# conduwuit
+# tuwunel
 
 services:
     homeserver:
-        ### If you already built the conduwuit image with 'docker build' or want to use a registry image,
+        ### If you already built the tuwunel image with 'docker build' or want to use a registry image,
         ### then you are ready to go.
-        image: girlbossceo/conduwuit:latest
+        image: jevolk/tuwunel:latest
         restart: unless-stopped
         ports:
             - 8448:6167
         volumes:
-            - db:/var/lib/conduwuit
-            #- ./conduwuit.toml:/etc/conduwuit.toml
+            - db:/var/lib/tuwunel
+            #- ./tuwunel.toml:/etc/tuwunel.toml
         environment:
-            CONDUWUIT_SERVER_NAME: your.server.name # EDIT THIS
-            CONDUWUIT_DATABASE_PATH: /var/lib/conduwuit
-            CONDUWUIT_PORT: 6167
-            CONDUWUIT_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-            CONDUWUIT_ALLOW_REGISTRATION: 'true'
-            CONDUWUIT_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
-            #CONDUWUIT_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-            CONDUWUIT_ALLOW_FEDERATION: 'true'
-            CONDUWUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
-            CONDUWUIT_TRUSTED_SERVERS: '["matrix.org"]'
-            #CONDUWUIT_LOG: warn,state_res=warn
-            CONDUWUIT_ADDRESS: 0.0.0.0
-            #CONDUWUIT_CONFIG: '/etc/conduwuit.toml' # Uncomment if you mapped config toml above
+            TUWUNEL_SERVER_NAME: your.server.name # EDIT THIS
+            TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
+            TUWUNEL_PORT: 6167
+            TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
+            TUWUNEL_ALLOW_REGISTRATION: 'true'
+            TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
+            #TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
+            TUWUNEL_ALLOW_FEDERATION: 'true'
+            TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
+            TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
+            #TUWUNEL_LOG: warn,state_res=warn
+            TUWUNEL_ADDRESS: 0.0.0.0
+            #TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
     #
     ### Uncomment if you want to use your own Element-Web App.
     ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and conduwuit
+    ###       Domain or Subdomain for the communication between Element and tuwunel
     ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
     # element-web:
     #     image: vectorim/element-web:latest

docs/deploying/docker.md

@@ -1,39 +1,25 @@
-# conduwuit for Docker
+# tuwunel for Docker
 
 ## Docker
 
-To run conduwuit with Docker you can either build the image yourself or pull it
+To run tuwunel with Docker you can either build the image yourself or pull it
 from a registry.
 
 ### Use a registry
 
-OCI images for conduwuit are available in the registries listed below.
+OCI images for tuwunel are available in the registries listed below.
 
 | Registry        | Image                                                           | Size                          | Notes                  |
 | --------------- | --------------------------------------------------------------- | ----------------------------- | ---------------------- |
-| GitHub Registry | [ghcr.io/girlbossceo/conduwuit:latest][gh] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
-| GitLab Registry | [registry.gitlab.com/conduwuit/conduwuit:latest][gl] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
-| Docker Hub      | [docker.io/girlbossceo/conduwuit:latest][dh]             | ![Image Size][shield-latest]  | Stable latest tagged image.          |
-| GitHub Registry | [ghcr.io/girlbossceo/conduwuit:main][gh]   | ![Image Size][shield-main]    | Stable main branch.   |
-| GitLab Registry | [registry.gitlab.com/conduwuit/conduwuit:main][gl]   | ![Image Size][shield-main]    | Stable main branch.   |
-| Docker Hub      | [docker.io/girlbossceo/conduwuit:main][dh]               | ![Image Size][shield-main]    | Stable main branch.   |
+| GitHub Registry | [ghcr.io/matrix-construct/tuwunel:latest][gh] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
+| Docker Hub      | [docker.io/jevolk/tuwunel:latest][dh]             | ![Image Size][shield-latest]  | Stable latest tagged image.          |
+| GitHub Registry | [ghcr.io/matrix-construct/tuwunel:main][gh]   | ![Image Size][shield-main]    | Stable main branch.   |
+| Docker Hub      | [docker.io/jevolk/tuwunel:main][dh]               | ![Image Size][shield-main]    | Stable main branch.   |
 
-[dh]: https://hub.docker.com/r/girlbossceo/conduwuit
-[gh]: https://github.com/girlbossceo/conduwuit/pkgs/container/conduwuit
-[gl]: https://gitlab.com/conduwuit/conduwuit/container_registry/6369729
-[shield-latest]: https://img.shields.io/docker/image-size/girlbossceo/conduwuit/latest
-[shield-main]: https://img.shields.io/docker/image-size/girlbossceo/conduwuit/main
-
-OCI image `.tar.gz` files are also hosted directly at when uploaded by CI with a
-commit hash/revision or a tagged release: <https://pup.systems/~strawberry/conduwuit/>
-
-Use
-
-```bash
-docker image pull $LINK
-```
-
-to pull it to your machine.
+[dh]: https://hub.docker.com/r/jevolk/tuwunel
+[gh]: https://github.com/matrix-construct/tuwunel/pkgs/container/tuwunel
+[shield-latest]: https://img.shields.io/docker/image-size/jevolk/tuwunel/latest
+[shield-main]: https://img.shields.io/docker/image-size/jevolk/tuwunel/main
 
 ### Run
 
@@ -41,22 +27,22 @@ ### Run
 
 ```bash
 docker run -d -p 8448:6167 \
-    -v db:/var/lib/conduwuit/ \
-    -e CONDUWUIT_SERVER_NAME="your.server.name" \
-    -e CONDUWUIT_ALLOW_REGISTRATION=false \
-    --name conduwuit $LINK
+    -v db:/var/lib/tuwunel/ \
+    -e TUWUNEL_SERVER_NAME="your.server.name" \
+    -e TUWUNEL_ALLOW_REGISTRATION=false \
+    --name tuwunel $LINK
 ```
 
 or you can use [docker compose](#docker-compose).
 
 The `-d` flag lets the container run in detached mode. You may supply an
-optional `conduwuit.toml` config file, the example config can be found
+optional `tuwunel.toml` config file, the example config can be found
 [here](../configuration/examples.md). You can pass in different env vars to
-change config values on the fly. You can even configure conduwuit completely by
+change config values on the fly. You can even configure tuwunel completely by
 using env vars. For an overview of possible values, please take a look at the
 [`docker-compose.yml`](docker-compose.yml) file.
 
-If you just want to test conduwuit for a short time, you can use the `--rm`
+If you just want to test tuwunel for a short time, you can use the `--rm`
 flag, which will clean up everything related to your container after you stop
 it.
 
@@ -91,32 +77,7 @@ ### Docker-compose
 After that, you can rename it so it matches `docker-compose.yml` and spin up the
 containers!
 
-Additional info about deploying conduwuit can be found [here](generic.md).
-
-### Build
-
-Official conduwuit images are built using Nix's
-[`buildLayeredImage`][nix-buildlayeredimage]. This ensures all OCI images are
-repeatable and reproducible by anyone, keeps the images lightweight, and can be
-built offline.
-
-This also ensures portability of our images because `buildLayeredImage` builds
-OCI images, not Docker images, and works with other container software.
-
-The OCI images are OS-less with only a very minimal environment of the `tini`
-init system, CA certificates, and the conduwuit binary. This does mean there is
-not a shell, but in theory you can get a shell by adding the necessary layers
-to the layered image. However it's very unlikely you will need a shell for any
-real troubleshooting.
-
-The flake file for the OCI image definition is at [`nix/pkgs/oci-image/default.nix`][oci-image-def].
-
-To build an OCI image using Nix, the following outputs can be built:
-- `nix build -L .#oci-image` (default features, x86_64 glibc)
-- `nix build -L .#oci-image-x86_64-linux-musl` (default features, x86_64 musl)
-- `nix build -L .#oci-image-aarch64-linux-musl` (default features, aarch64 musl)
-- `nix build -L .#oci-image-x86_64-linux-musl-all-features` (all features, x86_64 musl)
-- `nix build -L .#oci-image-aarch64-linux-musl-all-features` (all features, aarch64 musl)
+Additional info about deploying tuwunel can be found [here](generic.md).
 
 ### Run
 
@@ -130,6 +91,30 @@ ### Run
 
 > **Note:** Don't forget to modify and adjust the compose file to your needs.
 
+### Nix build
+
+Tuwunel's Nix images are built using [`buildLayeredImage`][nix-buildlayeredimage].
+This ensures all OCI images are repeatable and reproducible by anyone, keeps the
+images lightweight, and can be built offline.
+
+This also ensures portability of our images because `buildLayeredImage` builds
+OCI images, not Docker images, and works with other container software.
+
+The OCI images are OS-less with only a very minimal environment of the `tini`
+init system, CA certificates, and the tuwunel binary. This does mean there is
+not a shell, but in theory you can get a shell by adding the necessary layers
+to the layered image. However it's very unlikely you will need a shell for any
+real troubleshooting.
+
+The flake file for the OCI image definition is at [`nix/pkgs/oci-image/default.nix`][oci-image-def].
+
+To build an OCI image using Nix, the following outputs can be built:
+- `nix build -L .#oci-image` (default features, x86_64 glibc)
+- `nix build -L .#oci-image-x86_64-linux-musl` (default features, x86_64 musl)
+- `nix build -L .#oci-image-aarch64-linux-musl` (default features, aarch64 musl)
+- `nix build -L .#oci-image-x86_64-linux-musl-all-features` (all features, x86_64 musl)
+- `nix build -L .#oci-image-aarch64-linux-musl-all-features` (all features, aarch64 musl)
+
 ### Use Traefik as Proxy
 
 As a container user, you probably know about Traefik. It is a easy to use
@@ -138,10 +123,10 @@ ### Use Traefik as Proxy
 [`docker-compose.for-traefik.yml`](docker-compose.for-traefik.yml) (or
 [`docker-compose.with-traefik.yml`](docker-compose.with-traefik.yml)) and
 [`docker-compose.override.yml`](docker-compose.override.yml), it is equally easy
-to deploy and use conduwuit, with a little caveat. If you already took a look at
+to deploy and use tuwunel, with a little caveat. If you already took a look at
 the files, then you should have seen the `well-known` service, and that is the
 little caveat. Traefik is simply a proxy and loadbalancer and is not able to
-serve any kind of content, but for conduwuit to federate, we need to either
+serve any kind of content, but for tuwunel to federate, we need to either
 expose ports `443` and `8448` or serve two endpoints `.well-known/matrix/client`
 and `.well-known/matrix/server`.
 
@@ -153,4 +138,4 @@ ## Voice communication
 See the [TURN](../turn.md) page.
 
 [nix-buildlayeredimage]: https://ryantm.github.io/nixpkgs/builders/images/dockertools/#ssec-pkgs-dockerTools-buildLayeredImage
-[oci-image-def]: https://github.com/girlbossceo/conduwuit/blob/main/nix/pkgs/oci-image/default.nix
+[oci-image-def]: https://github.com/jevolk/tuwunel/blob/main/nix/pkgs/oci-image/default.nix

docs/deploying/freebsd.md

@@ -1,5 +1,6 @@
-# conduwuit for FreeBSD
+# Tuwunel for FreeBSD
 
-conduwuit at the moment does not provide FreeBSD builds or have FreeBSD packaging, however conduwuit does build and work on FreeBSD using the system-provided RocksDB.
+Tuwunel at the moment does not provide FreeBSD builds or have FreeBSD packaging, however Tuwunel does
+build and work on FreeBSD using the system-provided RocksDB.
 
-Contributions for getting conduwuit packaged are welcome.
+Contributions for getting Tuwunel into ports are welcome.

docs/deploying/generic.md

@@ -2,11 +2,10 @@ # Generic deployment documentation
 
 > ### Getting help
 >
-> If you run into any problems while setting up conduwuit, ask us in
-> `#conduwuit:puppygock.gay` or [open an issue on
-> GitHub](https://github.com/girlbossceo/conduwuit/issues/new).
+> If you run into any problems while setting up Tuwunel [open an issue on
+> GitHub](https://github.com/matrix-construct/tuwunel/issues/new).
 
-## Installing conduwuit
+## Installing Tuwunel
 
 ### Static prebuilt binary
 
@@ -14,12 +13,10 @@ ### Static prebuilt binary
 or aarch64). Run `uname -m` to see what you need.
 
 Prebuilt fully static musl binaries can be downloaded from the latest tagged
-release [here](https://github.com/girlbossceo/conduwuit/releases/latest) or
+release [here](https://github.com/matrix-construct/tuwunel/releases/latest) or
 `main` CI branch workflow artifact output. These also include Debian/Ubuntu
 packages.
 
-Binaries are also available on my website directly at: <https://pup.systems/~strawberry/conduwuit/>
-
 These can be curl'd directly from. `ci-bins` are CI workflow binaries by commit
 hash/revision, and `releases` are tagged releases. Sort by descending last
 modified for the latest.
@@ -37,49 +34,49 @@ ### Static prebuilt binary
 ### Compiling
 
 Alternatively, you may compile the binary yourself. We recommend using
-Nix (or [Lix](https://lix.systems)) to build conduwuit as this has the most
+Nix to build tuwunel as this has the most
 guaranteed reproducibiltiy and easiest to get a build environment and output
 going. This also allows easy cross-compilation.
 
 You can run the `nix build -L .#static-x86_64-linux-musl-all-features` or
 `nix build -L .#static-aarch64-linux-musl-all-features` commands based
 on architecture to cross-compile the necessary static binary located at
-`result/bin/conduwuit`. This is reproducible with the static binaries produced
+`result/bin/tuwunel`. This is reproducible with the static binaries produced
 in our CI.
 
 If wanting to build using standard Rust toolchains, make sure you install:
 - `liburing-dev` on the compiling machine, and `liburing` on the target host
 - LLVM and libclang for RocksDB
 
-You can build conduwuit using `cargo build --release --all-features`
+You can build Tuwunel using `cargo build --release --all-features`
 
-## Adding a conduwuit user
+## Adding a Tuwunel user
 
-While conduwuit can run as any user it is better to use dedicated users for
+While Tuwunel can run as any user it is better to use dedicated users for
 different services. This also allows you to make sure that the file permissions
 are correctly set up.
 
-In Debian, you can use this command to create a conduwuit user:
+In Debian, you can use this command to create a Tuwunel user:
 
 ```bash
-sudo adduser --system conduwuit --group --disabled-login --no-create-home
+sudo adduser --system tuwunel --group --disabled-login --no-create-home
 ```
 
 For distros without `adduser` (or where it's a symlink to `useradd`):
 
 ```bash
-sudo useradd -r --shell /usr/bin/nologin --no-create-home conduwuit
+sudo useradd -r --shell /usr/bin/nologin --no-create-home tuwunel
 ```
 
 ## Forwarding ports in the firewall or the router
 
 Matrix's default federation port is port 8448, and clients must be using port 443.
 If you would like to use only port 443, or a different port, you will need to setup
-delegation. conduwuit has config options for doing delegation, or you can configure
+delegation. Tuwunel has config options for doing delegation, or you can configure
 your reverse proxy to manually serve the necessary JSON files to do delegation
 (see the `[global.well_known]` config section).
 
-If conduwuit runs behind a router or in a container and has a different public
+If Tuwunel runs behind a router or in a container and has a different public
 IP address than the host system these public ports need to be forwarded directly
 or indirectly to the port mentioned in the config.
 
@@ -94,19 +91,19 @@ ## Forwarding ports in the firewall or the router
 
 ## Setting up a systemd service
 
-Two example systemd units for conduwuit can be found
+Two example systemd units for Tuwunel can be found
 [on the configuration page](../configuration/examples.md#debian-systemd-unit-file).
-You may need to change the `ExecStart=` path to where you placed the conduwuit
-binary if it is not `/usr/bin/conduwuit`.
+You may need to change the `ExecStart=` path to where you placed the Tuwunel
+binary if it is not `/usr/bin/tuwunel`.
 
 On systems where rsyslog is used alongside journald (i.e. Red Hat-based distros
 and OpenSUSE), put `$EscapeControlCharactersOnReceive off` inside
 `/etc/rsyslog.conf` to allow color in logs.
 
 If you are using a different `database_path` other than the systemd unit
-configured default `/var/lib/conduwuit`, you need to add your path to the
+configured default `/var/lib/tuwunel`, you need to add your path to the
 systemd unit's `ReadWritePaths=`. This can be done by either directly editing
-`conduwuit.service` and reloading systemd, or running `systemctl edit conduwuit.service`
+`tuwunel.service` and reloading systemd, or running `systemctl edit tuwunel.service`
 and entering the following:
 
 ```
@@ -114,11 +111,11 @@ ## Setting up a systemd service
 ReadWritePaths=/path/to/custom/database/path
 ```
 
-## Creating the conduwuit configuration file
+## Creating the Tuwunel configuration file
 
-Now we need to create the conduwuit's config file in
-`/etc/conduwuit/conduwuit.toml`. The example config can be found at
-[conduwuit-example.toml](../configuration/examples.md).
+Now we need to create the Tuwunel's config file in
+`/etc/tuwunel/tuwunel.toml`. The example config can be found at
+[tuwunel-example.toml](../configuration/examples.md).
 
 **Please take a moment to read the config. You need to change at least the
 server name.**
@@ -127,20 +124,20 @@ ## Creating the conduwuit configuration file
 
 ## Setting the correct file permissions
 
-If you are using a dedicated user for conduwuit, you will need to allow it to
+If you are using a dedicated user for Tuwunel, you will need to allow it to
 read the config. To do that you can run this:
 
 ```bash
-sudo chown -R root:root /etc/conduwuit
-sudo chmod -R 755 /etc/conduwuit
+sudo chown -R root:root /etc/tuwunel
+sudo chmod -R 755 /etc/tuwunel
 ```
 
 If you use the default database path you also need to run this:
 
 ```bash
-sudo mkdir -p /var/lib/conduwuit/
-sudo chown -R conduwuit:conduwuit /var/lib/conduwuit/
-sudo chmod 700 /var/lib/conduwuit/
+sudo mkdir -p /var/lib/tuwunel/
+sudo chown -R tuwunel:tuwunel /var/lib/tuwunel/
+sudo chmod 700 /var/lib/tuwunel/
 ```
 
 ## Setting up the Reverse Proxy
@@ -150,15 +147,15 @@ ## Setting up the Reverse Proxy
 
 ### Caddy
 
-After installing Caddy via your preferred method, create `/etc/caddy/conf.d/conduwuit_caddyfile`
+After installing Caddy via your preferred method, create `/etc/caddy/conf.d/tuwunel_caddyfile`
 and enter this (substitute for your server name).
 
 ```caddyfile
 your.server.name, your.server.name:8448 {
     # TCP reverse_proxy
-    reverse_proxy 127.0.0.1:6167
+    reverse_proxy localhost:8008
     # UNIX socket
-    #reverse_proxy unix//run/conduwuit/conduwuit.sock
+    #reverse_proxy unix//run/tuwunel/tuwunel.sock
 }
 ```
 
@@ -174,15 +171,15 @@ ### Other Reverse Proxies
 
 You will need to reverse proxy everything under following routes:
 - `/_matrix/` - core Matrix C-S and S-S APIs
-- `/_conduwuit/` - ad-hoc conduwuit routes such as `/local_user_count` and
+- `/_tuwunel/` - ad-hoc Tuwunel routes such as `/local_user_count` and
 `/server_version`
 
 You can optionally reverse proxy the following individual routes:
 - `/.well-known/matrix/client` and `/.well-known/matrix/server` if using
-conduwuit to perform delegation (see the `[global.well_known]` config section)
-- `/.well-known/matrix/support` if using conduwuit to send the homeserver admin
+Tuwunel to perform delegation (see the `[global.well_known]` config section)
+- `/.well-known/matrix/support` if using Tuwunel to send the homeserver admin
 contact and support page (formerly known as MSC1929)
-- `/` if you would like to see `hewwo from conduwuit woof!` at the root
+- `/` if you would like to see `hewwo from tuwunel woof!` at the root
 
 See the following spec pages for more details on these files:
 - [`/.well-known/matrix/server`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixserver)
@@ -200,25 +197,25 @@ ### Other Reverse Proxies
 
 If using Apache, you need to use `nocanon` in your `ProxyPass` directive to prevent httpd from messing with the `X-Matrix` header (note that Apache isn't very good as a general reverse proxy and we discourage the usage of it if you can).
 
-If using Nginx, you need to give conduwuit the request URI using `$request_uri`, or like so:
+If using Nginx, you need to give Tuwunel the request URI using `$request_uri`, or like so:
 - `proxy_pass http://127.0.0.1:6167$request_uri;`
 - `proxy_pass http://127.0.0.1:6167;`
 
 Nginx users need to increase `client_max_body_size` (default is 1M) to match
-`max_request_size` defined in conduwuit.toml.
+`max_request_size` defined in tuwunel.toml.
 
 ## You're done
 
-Now you can start conduwuit with:
+Now you can start Tuwunel with:
 
 ```bash
-sudo systemctl start conduwuit
+sudo systemctl start tuwunel
 ```
 
 Set it to start automatically when your system boots with:
 
 ```bash
-sudo systemctl enable conduwuit
+sudo systemctl enable tuwunel
 ```
 
 ## How do I know it works?
@@ -230,10 +227,10 @@ ## How do I know it works?
 `your.server.name`).
 
 ```bash
-curl https://your.server.name/_conduwuit/server_version
+curl https://your.server.name/_tuwunel/server_version
 
 # If using port 8448
-curl https://your.server.name:8448/_conduwuit/server_version
+curl https://your.server.name:8448/_tuwunel/server_version
 
 # If federation is enabled
 curl https://your.server.name:8448/_matrix/federation/v1/version

docs/deploying/kubernetes.md

@@ -1,8 +1,8 @@
-# conduwuit for Kubernetes
+# Tuwunel for Kubernetes
 
-conduwuit doesn't support horizontal scalability or distributed loading
+Tuwunel doesn't support horizontal scalability or distributed loading
 natively, however a community maintained Helm Chart is available here to run
-conduwuit on Kubernetes: <https://gitlab.cronce.io/charts/conduwuit>
+Tuwunel on Kubernetes: <https://gitlab.cronce.io/charts/conduwuit>
 
 Should changes need to be made, please reach out to the maintainer in our
-Matrix room as this is not maintained/controlled by the conduwuit maintainers.
+Matrix room as this is not maintained/controlled by the Tuwunel maintainers.

docs/deploying/nixos.md

@@ -1,16 +1,18 @@
-# conduwuit for NixOS
+_This file may be out of date. Please help us update it_
 
-conduwuit can be acquired by Nix (or [Lix][lix]) from various places:
+# Tuwunel for NixOS
+
+Tuwunel can be acquired by Nix from various places:
 
 * The `flake.nix` at the root of the repo
 * The `default.nix` at the root of the repo
-* From conduwuit's binary cache
+* From Tuwunel's binary cache
 
-A community maintained NixOS package is available at [`conduwuit`](https://search.nixos.org/packages?channel=unstable&show=conduwuit&from=0&size=50&sort=relevance&type=packages&query=conduwuit)
+A community maintained NixOS package is available at [`tuwunel`](https://search.nixos.org/packages?channel=unstable&show=tuwunel&from=0&size=50&sort=relevance&type=packages&query=tuwunel)
 
 ### Binary cache
 
-A binary cache for conduwuit that the CI/CD publishes to is available at the
+A binary cache for Tuwunel that the CI/CD publishes to is available at the
 following places (both are the same just different names):
 
 ```
@@ -37,13 +39,13 @@ ### Binary cache
 ```
 
 If specifying a Git remote URL in your flake, you can use any remotes that
-are specified on the README (the mirrors), such as the GitHub: `github:girlbossceo/conduwuit`
+are specified on the README (the mirrors), such as the GitHub: `github:matrix-construct/tuwunel`
 
 ### NixOS module
 
 The `flake.nix` and `default.nix` do not currently provide a NixOS module (contributions
 welcome!), so [`services.matrix-conduit`][module] from Nixpkgs can be used to configure
-conduwuit.
+Tuwunel.
 
 ### Conduit NixOS Config Module and SQLite
 
@@ -54,13 +56,13 @@ ### Conduit NixOS Config Module and SQLite
 There is a [tool to  migrate a Conduit SQLite database to
 RocksDB](https://github.com/ShadowJonathan/conduit_toolbox/).
 
-If you want to run the latest code, you should get conduwuit from the `flake.nix`
+If you want to run the latest code, you should get Tuwunel from the `flake.nix`
 or `default.nix` and set [`services.matrix-conduit.package`][package]
-appropriately to use conduwuit instead of Conduit.
+appropriately to use Tuwunel instead of Conduit.
 
 ### UNIX sockets
 
-Due to the lack of a conduwuit NixOS module, when using the `services.matrix-conduit` module
+Due to the lack of a Tuwunel NixOS module, when using the `services.matrix-conduit` module
 a workaround like the one below is necessary to use UNIX sockets. This is because the UNIX
 socket option does not exist in Conduit, and the module forcibly sets the `address` and 
 `port` config options.
@@ -84,24 +86,23 @@ ### UNIX sockets
 systemd.services.conduit.serviceConfig.RestrictAddressFamilies = [ "AF_UNIX" ];
 ```
 
-Even though those workarounds are feasible a conduwuit NixOS configuration module, developed and
+Even though those workarounds are feasible a Tuwunel NixOS configuration module, developed and
 published by the community, would be appreciated.
 
 ### jemalloc and hardened profile
 
-conduwuit uses jemalloc by default. This may interfere with the [`hardened.nix` profile][hardened.nix]
-due to them using `scudo` by default. You must either disable/hide `scudo` from conduwuit, or
+Tuwunel uses jemalloc by default. This may interfere with the [`hardened.nix` profile][hardened.nix]
+due to them using `scudo` by default. You must either disable/hide `scudo` from Tuwunel, or
 disable jemalloc like so:
 
 ```nix
 let
-    conduwuit = pkgs.unstable.conduwuit.override {
+    tuwunel = pkgs.unstable.tuwunel.override {
       enableJemalloc = false;
     };
 in
 ```
 
-[lix]: https://lix.systems/
 [module]: https://search.nixos.org/options?channel=unstable&query=services.matrix-conduit
 [package]: https://search.nixos.org/options?channel=unstable&query=services.matrix-conduit.package
 [hardened.nix]: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix#L22

docs/deploying/podman-systemd.md

@@ -0,0 +1,16 @@
+# tuwunel in Podman systemd
+
+Copy [tuwunel.container](tuwunel.container) to ~/.config/containers/systemd/tuwunel.container.
+Reload daemon:
+```
+systemctl --user daemon-reload
+```
+Start the service:
+```
+systemctl --user start tuwunel
+```
+
+To check the logs, run:
+```
+journalctl -eu tuwunel.container --user
+```

docs/deploying/redhat.md

@@ -0,0 +1 @@
+{{#include ../../rpm/README.md}}

docs/deploying/tuwunel.container

@@ -0,0 +1,9 @@
+[Container]
+Environment=TUWUNEL_SERVER_NAME=your.domain.here TUWUNEL_DATABASE_PATH=/var/lib/tuwunel TUWUNEL_PORT=6167 TUWUNEL_MAX_REQUEST_SIZE=20000000 TUWUNEL_ALLOW_REGISTRATION=true TUWUNEL_REGISTRATION_TOKEN=YOUR_TOKEN TUWUNEL_ALLOW_FEDERATION=true TUWUNEL_ALLOW_CHECK_FOR_UPDATES=true TUWUNEL_TRUSTED_SERVERS=["matrix.org"] TUWUNEL_ADDRESS=0.0.0.0 # Add TUWUNEL_CONFIG: '/etc/tuwunel.toml' if the config is mapped
+Image=docker.io/jevolk/tuwunel:latest
+PublishPort=8448:6167
+Volume=/path/to/db:/var/lib/tuwunel
+#Volume=/path/to/tuwunel.toml:/etc/tuwunel.toml #Uncomment to use the config file
+
+[Service]
+Restart=always

docs/development.md

@@ -4,9 +4,9 @@ # Development
 it, you can safely ignore this page. If you plan on contributing, see the
 [contributor's guide](./contributing.md).
 
-## conduwuit project layout
+## Tuwunel project layout
 
-conduwuit uses a collection of sub-crates, packages, or workspace members
+Tuwunel uses a collection of sub-crates, packages, or workspace members
 that indicate what each general area of code is for. All of the workspace
 members are under `src/`. The workspace definition is at the top level / root
 `Cargo.toml`.
@@ -14,11 +14,11 @@ ## conduwuit project layout
 The crate names are generally self-explanatory:
 - `admin` is the admin room
 - `api` is the HTTP API, Matrix C-S and S-S endpoints, etc
-- `core` is core conduwuit functionality like config loading, error definitions,
+- `core` is core Tuwunel functionality like config loading, error definitions,
 global utilities, logging infrastructure, etc
 - `database` is RocksDB methods, helpers, RocksDB config, and general database definitions,
 utilities, or functions
-- `macros` are conduwuit Rust [macros][macros] like general helper macros, logging
+- `macros` are Tuwunel Rust [macros][macros] like general helper macros, logging
 and error handling macros, and [syn][syn] and [procedural macros][proc-macro]
 used for admin room commands and others
 - `main` is the "primary" sub-crate. This is where the `main()` function lives,
@@ -35,7 +35,7 @@ ## conduwuit project layout
 the Matrix room for discussions about it beforehand.
 
 The primary inspiration for this design was apart of hot reloadable development,
-to support "conduwuit as a library" where specific parts can simply be swapped out.
+to support "Tuwunel as a library" where specific parts can simply be swapped out.
 There is evidence Conduit wanted to go this route too as `axum` is technically an
 optional feature in Conduit, and can be compiled without the binary or axum library
 for handling inbound web requests; but it was never completed or worked.
@@ -52,7 +52,7 @@ ## Adding compile-time [features][features]
 
 So, if this is adding a feature to the API such as `woof`, you define the feature
 in the `api` crate's `Cargo.toml` as `woof = []`. The feature definition in `main`'s
-`Cargo.toml` will be `woof = ["conduwuit-api/woof"]`.
+`Cargo.toml` will be `woof = ["tuwunel-api/woof"]`.
 
 The rationale for this is due to Rust / Cargo not supporting
 ["workspace level features"][9], we must make a choice of; either scattering
@@ -68,36 +68,36 @@ ## Adding compile-time [features][features]
 
 ## List of forked dependencies
 
-During conduwuit development, we have had to fork
+During Tuwunel development, we have had to fork
 some dependencies to support our use-cases in some areas. This ranges from
 things said upstream project won't accept for any reason, faster-paced
-development (unresponsive or slow upstream), conduwuit-specific usecases, or
+development (unresponsive or slow upstream), Tuwunel-specific usecases, or
 lack of time to upstream some things.
 
-- [ruma/ruma][1]: <https://github.com/girlbossceo/ruwuma> - various performance
+- [ruma/ruma][1]: <https://github.com/matrix-construct/ruma> - various performance
 improvements, more features, faster-paced development, better client/server interop
 hacks upstream won't accept, etc
-- [facebook/rocksdb][2]: <https://github.com/girlbossceo/rocksdb> - liburing
+- [facebook/rocksdb][2]: <https://github.com/matrix-construct/rocksdb> - liburing
 build fixes and GCC debug build fix
-- [tikv/jemallocator][3]: <https://github.com/girlbossceo/jemallocator> - musl
+- [tikv/jemallocator][3]: <https://github.com/matrix-construct/jemallocator> - musl
 builds seem to be broken on upstream, fixes some broken/suspicious code in
 places, additional safety measures, and support redzones for Valgrind
 - [zyansheep/rustyline-async][4]:
-<https://github.com/girlbossceo/rustyline-async> - tab completion callback and
-`CTRL+\` signal quit event for conduwuit console CLI
+<https://github.com/matrix-construct/rustyline-async> - tab completion callback and
+`CTRL+\` signal quit event for Tuwunel console CLI
 - [rust-rocksdb/rust-rocksdb][5]:
-<https://github.com/girlbossceo/rust-rocksdb-zaidoon1> - [`@zaidoon1`][8]'s fork
+<https://github.com/matrix-construct/rust-rocksdb-zaidoon1> - [`@zaidoon1`][8]'s fork
 has quicker updates, more up to date dependencies, etc. Our fork fixes musl build
 issues, removes unnecessary `gtest` include, and uses our RocksDB and jemallocator
 forks.
-- [tokio-rs/tracing][6]: <https://github.com/girlbossceo/tracing> - Implements
+- [tokio-rs/tracing][6]: <https://github.com/matrix-construct/tracing> - Implements
 `Clone` for `EnvFilter` to support dynamically changing tracing envfilter's
 alongside other logging/metrics things
 
 ## Debugging with `tokio-console`
 
 [`tokio-console`][7] can be a useful tool for debugging and profiling. To make a
-`tokio-console`-enabled build of conduwuit, enable the `tokio_console` feature,
+`tokio-console`-enabled build of Tuwunel, enable the `tokio_console` feature,
 disable the default `release_max_log_level` feature, and set the `--cfg
 tokio_unstable` flag to enable experimental tokio APIs. A build might look like
 this:
@@ -109,7 +109,7 @@ ## Debugging with `tokio-console`
     --features=systemd,element_hacks,gzip_compression,brotli_compression,zstd_compression,tokio_console
 ```
 
-You will also need to enable the `tokio_console` config option in conduwuit when
+You will also need to enable the `tokio_console` config option in Tuwunel when
 starting it. This was due to tokio-console causing gradual memory leak/usage
 if left enabled.
 

docs/development/hot_reload.md

@@ -5,7 +5,7 @@ # Hot Reloading ("Live" Development)
 
 ### Summary
 
-When developing in debug-builds with the nightly toolchain, conduwuit is modular
+When developing in debug-builds with the nightly toolchain, Tuwunel is modular
 using dynamic libraries and various parts of the application are hot-reloadable
 while the server is running: http api handlers, admin commands, services,
 database, etc. These are all split up into individual workspace crates as seen
@@ -42,7 +42,7 @@ ### Requirements
 architectures work, feel free to let us know and/or make a PR updating this).
 This should work on GNU ld and lld (rust-lld) and gcc/clang, however if you
 happen to have linker issues it's recommended to try using `mold` or `gold`
-linkers, and please let us know in the [conduwuit Matrix room][7] the linker
+linkers, and please let us know in the [Tuwunel Matrix room][7] the linker
 error and what linker solved this issue so we can figure out a solution. Ideally
 there should be minimal friction to using this, and in the future a build script
 (`build.rs`) may be suitable to making this easier to use if the capabilities
@@ -52,13 +52,13 @@ ### Usage
 
 As of 19 May 2024, the instructions for using this are:
 
-0. Have patience. Don't hesitate to join the [conduwuit Matrix room][7] to
+0. Have patience. Don't hesitate to join the [Tuwunel Matrix room][7] to
    receive help using this. As indicated by the various rustflags used and some
 of the interesting issues linked at the bottom, this is definitely not something
 the Rust ecosystem or toolchain is used to doing.
 
 1. Install the nightly toolchain using rustup. You may need to use `rustup
-   override set nightly` in your local conduwuit directory, or use `cargo
+   override set nightly` in your local Tuwunel directory, or use `cargo
 +nightly` for all actions.
 
 2. Uncomment `cargo-features` at the top level / root Cargo.toml
@@ -85,14 +85,14 @@ ### Usage
    Cargo should only rebuild what was changed / what's necessary, so it should
    not be rebuilding all the crates.
 
-9. In your conduwuit server terminal, hit/send `CTRL+C` signal. This will tell
-   conduwuit to find which libraries need to be reloaded, and reloads them as
+9. In your Tuwunel server terminal, hit/send `CTRL+C` signal. This will tell
+   Tuwunel to find which libraries need to be reloaded, and reloads them as
    necessary.
 
 10. If there were no errors, it will tell you it successfully reloaded `#`
    modules, and your changes should now be visible. Repeat 7 - 9 as needed.
 
-To shutdown conduwuit in this setup, hit/send `CTRL+\`. Normal builds still
+To shutdown Tuwunel in this setup, hit/send `CTRL+\`. Normal builds still
 shutdown with `CTRL+C` as usual.
 
 Steps 1 - 5 are the initial first-time steps for using this. To remove the hot
@@ -101,7 +101,7 @@ ### Usage
 As mentioned in the requirements section, if you happen to have some linker
 issues, try using the `-fuse-ld=` rustflag and specify mold or gold in all the
 `rustflags` definitions in the top level Cargo.toml, and please let us know in
-the [conduwuit Matrix room][7] the problem. mold can be installed typically
+the [Tuwunel Matrix room][7] the problem. mold can be installed typically
 through your distro, and gold is provided by the binutils package.
 
 It's possible a helper script can be made to do all of this, or most preferably
@@ -136,7 +136,7 @@ ### Addendum
 **no crate is allowed to call a function or use a variable from a crate below
 it.**
 
-![conduwuit's dynamic library setup diagram - created by Jason
+![Tuwunel's dynamic library setup diagram - created by Jason
 Volk](assets/libraries.png)
 
 When a symbol is referenced between crates they become bound: **crates cannot be
@@ -147,7 +147,7 @@ ### Addendum
 and the first crate, freeing the executable from all modules as no global
 binding ever occurs between them.
 
-![conduwuit's reload and load order diagram - created by Jason
+![Tuwunel's reload and load order diagram - created by Jason
 Volk](assets/reload_order.png)
 
 Proper resource management is essential for reliable reloading to occur. This is
@@ -196,5 +196,5 @@ ### Interesting related issues/bugs
 [4]: https://github.com/rust-lang/rust/issues/28794#issuecomment-368693049
 [5]: https://github.com/rust-lang/cargo/issues/12746
 [6]: https://crates.io/crates/hot-lib-reloader/
-[7]: https://matrix.to/#/#conduwuit:puppygock.gay
+[7]: https://matrix.to/#/#tuwunel:tuwunel.chat
 [8]: https://crates.io/crates/libloading

docs/development/testing.md

@@ -5,7 +5,7 @@ ## Complement
 Have a look at [Complement's repository][complement] for an explanation of what
 it is.
 
-To test against Complement, with Nix (or [Lix](https://lix.systems) and
+To test against Complement, with Nix and
 [direnv installed and set up][direnv] (run `direnv allow` after setting up the hook), you can:
 
 * Run `./bin/complement "$COMPLEMENT_SRC"` to build a Complement image, run
@@ -24,8 +24,8 @@ ## Complement
 If you're on macOS and need to build an image, run `nix build .#linux-complement`.
 
 We have a Complement fork as some tests have needed to be fixed. This can be found
-at: <https://github.com/girlbossceo/complement>
+at: <https://github.com/matrix-construct/complement>
 
-[ci-workflows]: https://github.com/girlbossceo/conduwuit/actions/workflows/ci.yml?query=event%3Apush+is%3Asuccess+actor%3Agirlbossceo
+[ci-workflows]: https://github.com/matrix-construct/tuwunel/actions/workflows/ci.yml?query=event%3Apush+is%3Asuccess+actor%3Ajevolk
 [complement]: https://github.com/matrix-org/complement
 [direnv]: https://direnv.net/docs/hook.html

docs/introduction.md

@@ -1,4 +1,4 @@
-# conduwuit
+# Tuwunel
 
 {{#include ../README.md:catchphrase}}
 
@@ -8,7 +8,7 @@ #### How can I deploy my own?
 
 - [Deployment options](deploying.md)
 
-If you want to connect an appservice to conduwuit, take a look at the
+If you want to connect an appservice to Tuwunel, take a look at the
 [appservices documentation](appservices.md).
 
 #### How can I contribute?

docs/maintenance.md

@@ -1,14 +1,14 @@
-# Maintaining your conduwuit setup
+# Maintaining your Tuwunel setup
 
 ## Moderation
 
-conduwuit has moderation through admin room commands. "binary commands" (medium
+Tuwunel has moderation through admin room commands. "binary commands" (medium
 priority) and an admin API (low priority) is planned. Some moderation-related
 config options are available in the example config such as "global ACLs" and
 blocking media requests to certain servers. See the example config for the
 moderation config options under the "Moderation / Privacy / Security" section.
 
-conduwuit has moderation admin commands for:
+Tuwunel has moderation admin commands for:
 
 - managing room aliases (`!admin rooms alias`)
 - managing room directory (`!admin rooms directory`)
@@ -36,7 +36,7 @@ ## Moderation
 ## Database (RocksDB)
 
 Generally there is very little you need to do. [Compaction][rocksdb-compaction]
-is ran automatically based on various defined thresholds tuned for conduwuit to
+is ran automatically based on various defined thresholds tuned for Tuwunel to
 be high performance with the least I/O amplifcation or overhead. Manually
 running compaction is not recommended, or compaction via a timer, due to
 creating unnecessary I/O amplification. RocksDB is built with io_uring support
@@ -50,7 +50,7 @@ ### Compression
 the RocksDB section in the [example config](configuration/examples.md).
 
 btrfs users have reported that database compression does not need to be disabled
-on conduwuit as the filesystem already does not attempt to compress. This can be
+on Tuwunel as the filesystem already does not attempt to compress. This can be
 validated by using `filefrag -v` on a `.SST` file in your database, and ensure
 the `physical_offset` matches (no filesystem compression). It is very important
 to ensure no additional filesystem compression takes place as this can render
@@ -70,8 +70,8 @@ ### Files in database
 related to WAL tracking.
 
 The only safe files that can be deleted are the `LOG` files (all caps). These
-are the real RocksDB telemetry/log files, however conduwuit has already
-configured to only store up to 3 RocksDB `LOG` files due to generall being
+are the real RocksDB telemetry/log files, however Tuwunel has already
+configured to only store up to 3 RocksDB `LOG` files due to generally being
 useless for average users unless troubleshooting something low-level. If you
 would like to store nearly none at all, see the `rocksdb_max_log_files`
 config option.
@@ -88,7 +88,7 @@ ## Backups
 
 To restore a backup from an online RocksDB backup:
 
-- shutdown conduwuit
+- shutdown Tuwunel
 - create a new directory for merging together the data
 - in the online backup created, copy all `.sst` files in
 `$DATABASE_BACKUP_PATH/shared_checksum` to your new directory
@@ -99,9 +99,9 @@ ## Backups
 if you have multiple) to your new directory
 - set your `database_path` config option to your new directory, or replace your
 old one with the new one you crafted
-- start up conduwuit again and it should open as normal
+- start up Tuwunel again and it should open as normal
 
-If you'd like to do an offline backup, shutdown conduwuit and copy your
+If you'd like to do an offline backup, shutdown Tuwunel and copy your
 `database_path` directory elsewhere. This can be restored with no modifications
 needed.
 
@@ -110,7 +110,7 @@ ## Backups
 
 ## Media
 
-Media still needs various work, however conduwuit implements media deletion via:
+Media still needs various work, however Tuwunel implements media deletion via:
 
 - MXC URI or Event ID (unencrypted and attempts to find the MXC URI in the
 event)
@@ -118,17 +118,17 @@ ## Media
 - Delete remote media in the past `N` seconds/minutes via filesystem metadata on
 the file created time (`btime`) or file modified time (`mtime`)
 
-See the `!admin media` command for further information. All media in conduwuit
+See the `!admin media` command for further information. All media in Tuwunel
 is stored at `$DATABASE_DIR/media`. This will be configurable soon.
 
 If you are finding yourself needing extensive granular control over media, we
 recommend looking into [Matrix Media
-Repo](https://github.com/t2bot/matrix-media-repo). conduwuit intends to
+Repo](https://github.com/t2bot/matrix-media-repo). Tuwunel intends to
 implement various utilities for media, but MMR is dedicated to extensive media
 management.
 
 Built-in S3 support is also planned, but for now using a "S3 filesystem" on
-`media/` works. conduwuit also sends a `Cache-Control` header of 1 year and
+`media/` works. Tuwunel also sends a `Cache-Control` header of 1 year and
 immutable for all media requests (download and thumbnail) to reduce unnecessary
 media requests from browsers, reduce bandwidth usage, and reduce load.
 

docs/troubleshooting.md

@@ -1,9 +1,9 @@
-# Troubleshooting conduwuit
+# Troubleshooting Tuwunel
 
 > ## Docker users ⚠️
 >
 > Docker is extremely UX unfriendly. Because of this, a ton of issues or support
-> is actually Docker support, not conduwuit support. We also cannot document the
+> is actually Docker support, not tuwunel support. We also cannot document the
 > ever-growing list of Docker issues here.
 >
 > If you intend on asking for support and you are using Docker, **PLEASE**
@@ -13,14 +13,14 @@ # Troubleshooting conduwuit
 > If there are things like Compose file issues or Dockerhub image issues, those
 > can still be mentioned as long as they're something we can fix.
 
-## conduwuit and Matrix issues
+## Tuwunel and Matrix issues
 
 #### Lost access to admin room
 
 You can reinvite yourself to the admin room through the following methods:
-- Use the `--execute "users make_user_admin <username>"` conduwuit binary
+- Use the `--execute "users make_user_admin <username>"` Tuwunel binary
 argument once to invite yourslf to the admin room on startup
-- Use the conduwuit console/CLI to run the `users make_user_admin` command
+- Use the Tuwunel console/CLI to run the `users make_user_admin` command
 - Or specify the `emergency_password` config option to allow you to temporarily
 log into the server account (`@conduit`) from a web client
 
@@ -29,12 +29,12 @@ ## General potential issues
 #### Potential DNS issues when using Docker
 
 Docker has issues with its default DNS setup that may cause DNS to not be
-properly functional when running conduwuit, resulting in federation issues. The
+properly functional when running Tuwunel, resulting in federation issues. The
 symptoms of this have shown in excessively long room joins (30+ minutes) from
 very long DNS timeouts, log entries of "mismatching responding nameservers",
 and/or partial or non-functional inbound/outbound federation.
 
-This is **not** a conduwuit issue, and is purely a Docker issue. It is not
+This is **not** a Tuwunel issue, and is purely a Docker issue. It is not
 sustainable for heavy DNS activity which is normal for Matrix federation. The
 workarounds for this are:
 - Use DNS over TCP via the config option `query_over_tcp_only = true`
@@ -64,7 +64,7 @@ #### DNS No connections available error message
 service, especially on Matrix. Many servers also strangely have broken DNSSEC
 setups and will result in non-functional federation.
 
-conduwuit cannot provide a "works-for-everyone" Unbound DNS setup guide, but
+Tuwunel cannot provide a "works-for-everyone" Unbound DNS setup guide, but
 the [official Unbound tuning guide][unbound-tuning] and the [Unbound Arch Linux wiki page][unbound-arch]
 may be of interest. Disabling DNSSEC on Unbound is commenting out trust-anchors
 config options and removing the `validator` module.
@@ -75,9 +75,9 @@ #### DNS No connections available error message
 dnsmasq can possibly work, but it does **not** support TCP fallback which can be
 problematic when receiving large DNS responses such as from large SRV records.
 If you still want to use dnsmasq, make sure you **disable** `dns_tcp_fallback`
-in conduwuit config.
+in Tuwunel config.
 
-Raising `dns_cache_entries` in conduwuit config from the default can also assist
+Raising `dns_cache_entries` in Tuwunel config from the default can also assist
 in DNS caching, but a full-fledged external caching resolver is better and more
 reliable.
 
@@ -93,48 +93,79 @@ ## RocksDB / database issues
 
 #### Database corruption
 
-If your database is corrupted *and* is failing to start (e.g. checksum
-mismatch), it may be recoverable but careful steps must be taken, and there is
-no guarantee it may be recoverable.
+There are many causes and varieties of database corruption. There are several
+methods for mitigation, each with outcomes ranging from a recovered state down
+to a savage state. This guide has been simplified into a set of universal steps
+which everyone can follow from the top until they have recovered or reach the
+end. The details and implications will be explained within each step.
 
-The first thing that can be done is launching conduwuit with the
-`rocksdb_repair` config option set to true. This will tell RocksDB to attempt to
-repair itself at launch. If this does not work, disable the option and continue
-reading.
+> [!NOTE]
+> All command-line `-O` options can be expressed as environment variables or in
+> the config file based on your deployment's requirements. Note that
+> `--maintenance` is only available on the command-line, but is equivalent to
+> configuring `startup_netburst = false` and `listening = false`.
 
-RocksDB has the following recovery modes:
+0. Start the server with the following options:
 
-- `TolerateCorruptedTailRecords`
-- `AbsoluteConsistency`
-- `PointInTime`
-- `SkipAnyCorruptedRecord`
+`tuwunel --maintenance -O rocksdb_recovery_mode=0`
 
-By default, conduwuit uses `TolerateCorruptedTailRecords` as generally these may
-be due to bad federation and we can re-fetch the correct data over federation.
-The RocksDB default is `PointInTime` which will attempt to restore a "snapshot"
-of the data when it was last known to be good. This data can be either a few
-seconds old, or multiple minutes prior. `PointInTime` may not be suitable for
-default usage due to clients and servers possibly not being able to handle
-sudden "backwards time travels", and `AbsoluteConsistency` may be too strict.
+This is actually a "control" and not a method of recovery. If the server starts
+you either do not have corruption or have deep corruption indicated by very
+specific errors from rocksdb citing corruption during runtime. If you are
+certain there is deep corruption skip to step 4, otherwise you are finished
+without any modifications.
 
-`AbsoluteConsistency` will fail to start the database if any sign of corruption
-is detected. `SkipAnyCorruptedRecord` will skip all forms of corruption unless
-it forbids the database from opening (e.g. too severe). Usage of
-`SkipAnyCorruptedRecord` voids any support as this may cause more damage and/or
-leave your database in a permanently inconsistent state, but it may do something
-if `PointInTime` does not work as a last ditch effort.
+1. Start the server in Tolerate-Corrupted-Tail-Records mode:
 
-With this in mind:
+`tuwunel --maintenance -O rocksdb_recovery_mode=1`
 
-- First start conduwuit with the `PointInTime` recovery method. See the [example
-config](configuration/examples.md) for how to do this using
-`rocksdb_recovery_mode`
-- If your database successfully opens, clients are recommended to clear their
-client cache to account for the rollback
-- Leave your conduwuit running in `PointInTime` for at least 30-60 minutes so as
-much possible corruption is restored
-- If all goes will, you should be able to restore back to using
-`TolerateCorruptedTailRecords` and you have successfully recovered your database
+The most common corruption scenario is from a loss of power to the hardware
+(not an application crash, though it is still possible). This is remediated
+by dropping the most recently written record. It is highly unlikely there will
+be any impact on the application from this loss. In the best-case the same data
+is often re-requested over the federation or replaced by a client. In the
+worst-case clients may need to clear-cache & reload to guarantee correctness.
+If the server starts you are finished.
+
+2. Start the server in Point-In-Time mode:
+
+`tuwunel --maintenance -O rocksdb_recovery_mode=2`
+
+Similar to the corruption scenario above but for more severe cases. The most
+recent records are discarded back to the point where there is no corruption.
+It is highly unlikely there will be any impact on the application from this
+loss, but it is more likely than above that clients may need to clear-cache
+& reload to correctly resynchronize with the server.
+
+3. Start the server in Skip-Any-Corrupted-Record mode:
+
+> [!CAUTION]
+> Salvage mode potentially impacting the application's ability to function.
+> We cannot provide any further support for users who have entered this mode.
+
+`tuwunel --maintenance -O rocksdb_recovery_mode=3`
+
+Similar to the prior corruption scenarios but for the most severe cases.
+The database will be inconsistent. It is theoretically possible for the
+server to continue functioning without notable issue in the best case, but
+it is completely uncertain what the effect of this operation will be. If
+the server starts you should immediately export your messages, encryption
+keys, etc, in a salvage effort and prepare to reinstall.
+
+4. Start the server in repair mode.
+
+> [!CAUTION]
+> Salvage mode potentially impacting the application's ability to function.
+> We cannot provide any further support for users who have entered this mode.
+
+`tuwunel --maintenance -O rocksdb_repair=true`
+
+For corruption affecting the bulk database tables not covered by any journal.
+This will leave the database in an inconsistent and unpredictable state. It
+is theoretically possible to continue operating the server depending on which
+records were dropped, such as some historical records which are no longer
+essential. Nevertheless the impact of this operation is impossible to assess
+and a successful recovery should be used to salvage data prior to reinstall.
 
 ## Debugging
 
@@ -144,14 +175,14 @@ ## Debugging
 
 #### Debug/Trace log level
 
-conduwuit builds without debug or trace log levels at compile time by default
+Tuwunel builds without debug or trace log levels at compile time by default
 for substantial performance gains in CPU usage and improved compile times. If
 you need to access debug/trace log levels, you will need to build without the
 `release_max_log_level` feature or use our provided static debug binaries.
 
 #### Changing log level dynamically
 
-conduwuit supports changing the tracing log environment filter on-the-fly using
+Tuwunel supports changing the tracing log environment filter on-the-fly using
 the admin command `!admin debug change-log-level <log env filter>`. This accepts
 a string **without quotes** the same format as the `log` config option.
 
@@ -168,7 +199,7 @@ #### Changing log level dynamically
 
 #### Pinging servers
 
-conduwuit can ping other servers using `!admin debug ping <server>`. This takes
+Tuwunel can ping other servers using `!admin debug ping <server>`. This takes
 a server name and goes through the server discovery process and queries
 `/_matrix/federation/v1/version`. Errors are outputted.
 
@@ -180,12 +211,12 @@ #### Pinging servers
 #### Allocator memory stats
 
 When using jemalloc with jemallocator's `stats` feature (`--enable-stats`), you
-can see conduwuit's high-level allocator stats by using
+can see Tuwunel's high-level allocator stats by using
 `!admin server memory-usage` at the bottom.
 
 If you are a developer, you can also view the raw jemalloc statistics with
 `!admin debug memory-stats`. Please note that this output is extremely large
-which may only be visible in the conduwuit console CLI due to PDU size limits,
+which may only be visible in the Tuwunel console CLI due to PDU size limits,
 and is not easy for non-developers to understand.
 
 [unbound-tuning]: https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/performance.html

docs/turn.md

@@ -1,6 +1,6 @@
 # Setting up TURN/STURN
 
-In order to make or receive calls, a TURN server is required. conduwuit suggests
+In order to make or receive calls, a TURN server is required. Tuwunel suggests
 using [Coturn](https://github.com/coturn/coturn) for this purpose, which is also
 available as a Docker image.
 
@@ -17,9 +17,9 @@ ### Configuration
 A common way to generate a suitable alphanumeric secret key is by using `pwgen
 -s 64 1`.
 
-These same values need to be set in conduwuit. See the [example
+These same values need to be set in Tuwunel. See the [example
 config](configuration/examples.md) in the TURN section for configuring these and
-restart conduwuit after.
+restart Tuwunel after.
 
 `turn_secret` or a path to `turn_secret_file` must have a value of your
 coturn `static-auth-secret`, or use `turn_username` and `turn_password`
@@ -34,7 +34,7 @@ ### Configuration
 TURN over TLS. This is highly recommended.
 
 If you need unauthenticated access to the TURN URIs, or some clients may be
-having trouble, you can enable `turn_guest_access` in conduwuit which disables
+having trouble, you can enable `turn_guest_access` in Tuwunel which disables
 authentication for the TURN URI endpoint `/_matrix/client/v3/voip/turnServer`
 
 ### Run

engage.toml

@@ -1,189 +0,0 @@
-interpreter = ["bash", "-euo", "pipefail", "-c"]
-
-[[task]]
-name = "engage"
-group = "versions"
-script = "engage --version"
-
-[[task]]
-name = "nix"
-group = "versions"
-script = "nix --version"
-
-[[task]]
-name = "direnv"
-group = "versions"
-script = "direnv --version"
-
-[[task]]
-name = "rustc"
-group = "versions"
-script = "rustc --version -v"
-
-[[task]]
-name = "cargo"
-group = "versions"
-script = "cargo --version -v"
-
-[[task]]
-name = "cargo-fmt"
-group = "versions"
-script = "cargo fmt --version"
-
-[[task]]
-name = "rustdoc"
-group = "versions"
-script = "rustdoc --version"
-
-[[task]]
-name = "cargo-clippy"
-group = "versions"
-script = "cargo clippy -- --version"
-
-[[task]]
-name = "cargo-audit"
-group = "versions"
-script = "cargo audit --version"
-
-[[task]]
-name = "cargo-deb"
-group = "versions"
-script = "cargo deb --version"
-
-[[task]]
-name = "lychee"
-group = "versions"
-script = "lychee --version"
-
-[[task]]
-name = "markdownlint"
-group = "versions"
-script = "markdownlint --version"
-
-[[task]]
-name = "cargo-audit"
-group = "security"
-script = "cargo audit --color=always -D warnings -D unmaintained -D unsound -D yanked"
-
-[[task]]
-name = "cargo-fmt"
-group = "lints"
-script = """
-cargo fmt --check -- --color=always
-"""
-
-[[task]]
-name = "cargo-doc"
-group = "lints"
-script = """
-env DIRENV_DEVSHELL=all-features \
-    RUSTDOCFLAGS="-D warnings" \
-    direnv exec . \
-    cargo doc \
-        --workspace \
-        --locked \
-        --profile test \
-        --all-features \
-        --no-deps \
-        --document-private-items \
-        --color always
-"""
-
-[[task]]
-name = "clippy/default"
-group = "lints"
-script = """
-direnv exec . \
-cargo clippy \
-    --workspace \
-    --locked \
-    --profile test \
-    --color=always \
-    -- \
-    -D warnings
-"""
-
-[[task]]
-name = "clippy/all"
-group = "lints"
-script = """
-env DIRENV_DEVSHELL=all-features \
-    direnv exec . \
-    cargo clippy \
-        --workspace \
-        --locked \
-        --profile test \
-        --all-features \
-        --color=always \
-        -- \
-        -D warnings
-"""
-
-[[task]]
-name = "clippy/no-features"
-group = "lints"
-script = """
-env DIRENV_DEVSHELL=no-features \
-    direnv exec . \
-    cargo clippy \
-        --workspace \
-        --locked \
-        --profile test \
-        --no-default-features \
-        --color=always \
-        -- \
-        -D warnings
-"""
-
-[[task]]
-name = "clippy/other-features"
-group = "lints"
-script = """
-direnv exec . \
-cargo clippy \
-    --workspace \
-    --locked \
-    --profile test \
-    --no-default-features \
-    --features=console,systemd,element_hacks,direct_tls,perf_measurements,brotli_compression,blurhashing \
-    --color=always \
-    -- \
-    -D warnings
-"""
-
-[[task]]
-name = "lychee"
-group = "lints"
-script = "lychee --verbose --offline docs *.md --exclude development.md --exclude contributing.md --exclude testing.md"
-
-[[task]]
-name = "markdownlint"
-group = "lints"
-script = "markdownlint docs *.md || true" # TODO: fix the ton of markdown lints so we can drop `|| true`
-
-[[task]]
-name = "cargo/default"
-group = "tests"
-script = """
-env DIRENV_DEVSHELL=default \
-    direnv exec . \
-    cargo test \
-        --workspace \
-        --locked \
-        --profile test \
-        --all-targets \
-        --no-fail-fast \
-        --color=always \
-        -- \
-        --color=always
-"""
-
-# Checks if the generated example config differs from the checked in repo's
-# example config.
-[[task]]
-name = "example-config"
-group = "tests"
-depends = ["cargo/default"]
-script = """
-git diff --exit-code conduwuit-example.toml
-"""

flake.lock

@@ -10,11 +10,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1738524606,
-        "narHash": "sha256-hPYEJ4juK3ph7kbjbvv7PlU1D9pAkkhl+pwx8fZY53U=",
+        "lastModified": 1748532342,
+        "narHash": "sha256-CvaKOUq8G10sghKpZhEB2UYjJoWhEkrDFggDgi7piUI=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e",
+        "rev": "ce9373715fe3fac7a174a65a7e6d6baeba8cb4f9",
         "type": "github"
       },
       "original": {
@@ -32,11 +32,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1737621947,
-        "narHash": "sha256-8HFvG7fvIFbgtaYAY2628Tb89fA55nPm2jSiNs0/Cws=",
+        "lastModified": 1748883665,
+        "narHash": "sha256-R0W7uAg+BLoHjMRMQ8+oiSbTq8nkGz5RDpQ+ZfxxP3A=",
         "owner": "cachix",
         "repo": "cachix",
-        "rev": "f65a3cd5e339c223471e64c051434616e18cc4f5",
+        "rev": "f707778d902af4d62d8dd92c269f8e70de09acbe",
         "type": "github"
       },
       "original": {
@@ -63,11 +63,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1728672398,
-        "narHash": "sha256-KxuGSoVUFnQLB2ZcYODW7AVPAh9JqRlD5BrfsC/Q4qs=",
+        "lastModified": 1744206633,
+        "narHash": "sha256-pb5aYkE8FOoa4n123slgHiOf1UbNSnKe5pEZC+xXD5g=",
         "owner": "cachix",
         "repo": "cachix",
-        "rev": "aac51f698309fd0f381149214b7eee213c66ef0a",
+        "rev": "8a60090640b96f9df95d1ab99e5763a586be1404",
         "type": "github"
       },
       "original": {
@@ -82,13 +82,13 @@
       "locked": {
         "lastModified": 1741891349,
         "narHash": "sha256-YvrzOWcX7DH1drp5SGa+E/fc7wN3hqFtPbqPjZpOu1Q=",
-        "owner": "girlbossceo",
+        "owner": "matrix-construct",
         "repo": "complement",
         "rev": "e587b3df569cba411aeac7c20b6366d03c143745",
         "type": "github"
       },
       "original": {
-        "owner": "girlbossceo",
+        "owner": "matrix-construct",
         "ref": "main",
         "repo": "complement",
         "type": "github"
@@ -117,11 +117,11 @@
     },
     "crane_2": {
       "locked": {
-        "lastModified": 1739936662,
-        "narHash": "sha256-x4syUjNUuRblR07nDPeLDP7DpphaBVbUaSoeZkFbGSk=",
+        "lastModified": 1748970125,
+        "narHash": "sha256-UDyigbDGv8fvs9aS95yzFfOKkEjx1LO3PL3DsKopohA=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "19de14aaeb869287647d9461cbd389187d8ecdb7",
+        "rev": "323b5746d89e04b22554b061522dfce9e4c49b18",
         "type": "github"
       },
       "original": {
@@ -149,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733323168,
-        "narHash": "sha256-d5DwB4MZvlaQpN6OQ4SLYxb5jA4UH5EtV5t5WOtjLPU=",
+        "lastModified": 1748273445,
+        "narHash": "sha256-5V0dzpNgQM0CHDsMzh+ludYeu1S+Y+IMjbaskSSdFh0=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "efa9010b8b1cfd5dd3c7ed1e172a470c3b84a064",
+        "rev": "668a50d8b7bdb19a0131f53c9f6c25c9071e1ffb",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1740724364,
-        "narHash": "sha256-D1jLIueJx1dPrP09ZZwTrPf4cubV+TsFMYbpYYTVj6A=",
+        "lastModified": 1749883145,
+        "narHash": "sha256-RlcGw3vAnbI3cfZn8aFaovNUd7312VZh+/FDWkqdA7E=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "edf7d9e431cda8782e729253835f178a356d3aab",
+        "rev": "a804172f150bcf81262655324e583bb0cd0f28dd",
         "type": "github"
       },
       "original": {
@@ -203,11 +203,11 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -219,11 +219,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -306,15 +306,14 @@
         "nixpkgs": [
           "cachix",
           "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable_2"
+        ]
       },
       "locked": {
-        "lastModified": 1733318908,
-        "narHash": "sha256-SVQVsbafSM1dJ4fpgyBqLZ+Lft+jcQuMtEL3lQWx2Sk=",
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "6f4e2a2112050951a314d2733a994fbab94864c6",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
         "type": "github"
       },
       "original": {
@@ -364,11 +363,11 @@
     "liburing": {
       "flake": false,
       "locked": {
-        "lastModified": 1740613216,
-        "narHash": "sha256-NpPOBqNND3Qe9IwqYs0mJLGTmIx7e6FgUEBAnJ+1ZLA=",
+        "lastModified": 1749816983,
+        "narHash": "sha256-p5hXfDe53Y4MVwL2+wKZYpy4OPGvqFFnOEvkMsFAO6c=",
         "owner": "axboe",
         "repo": "liburing",
-        "rev": "e1003e496e66f9b0ae06674869795edf772d5500",
+        "rev": "ad83d3ab64894c16eaf21ef869656a5bddb93ca4",
         "type": "github"
       },
       "original": {
@@ -401,11 +400,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727438425,
-        "narHash": "sha256-X8ES7I1cfNhR9oKp06F6ir4Np70WGZU5sfCOuNBEwMg=",
+        "lastModified": 1745930071,
+        "narHash": "sha256-bYyjarS3qSNqxfgc89IoVz8cAFDkF9yPE63EJr+h50s=",
         "owner": "domenkozar",
         "repo": "nix",
-        "rev": "f6c5ae4c1b2e411e6b1e6a8181cc84363d6a7546",
+        "rev": "b455edf3505f1bf0172b39a735caef94687d0d9c",
         "type": "github"
       },
       "original": {
@@ -484,29 +483,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-stable_2": {
-      "locked": {
-        "lastModified": 1730741070,
-        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1730531603,
-        "narHash": "sha256-Dqg6si5CqIzm87sp57j5nTaeBbWhHFaVyG7V6L8k3lY=",
+        "lastModified": 1733212471,
+        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7ffd9ae656aec493492b44d0ddfb28e79a1ea25d",
+        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
         "type": "github"
       },
       "original": {
@@ -534,11 +517,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1733212471,
-        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
+        "lastModified": 1748190013,
+        "narHash": "sha256-R5HJFflOfsP5FBtk+zE8FpL8uqE7n62jqOsADvVshhE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
+        "rev": "62b852f6c6742134ade1abdd2a21685fd617a291",
         "type": "github"
       },
       "original": {
@@ -550,11 +533,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1740547748,
-        "narHash": "sha256-Ly2fBL1LscV+KyCqPRufUBuiw+zmWrlJzpWOWbahplg=",
+        "lastModified": 1749871736,
+        "narHash": "sha256-K9yBph93OLTNw02Q6e9CYFGrUhvEXnh45vrZqIRWfvQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3a05eebede89661660945da1f151959900903b6a",
+        "rev": "6afe187897bef7933475e6af374c893f4c84a293",
         "type": "github"
       },
       "original": {
@@ -567,16 +550,16 @@
     "rocksdb": {
       "flake": false,
       "locked": {
-        "lastModified": 1741308171,
-        "narHash": "sha256-YdBvdQ75UJg5ffwNjxizpviCVwVDJnBkM8ZtGIduMgY=",
-        "owner": "girlbossceo",
+        "lastModified": 1749358049,
+        "narHash": "sha256-ZSjvAZBfZkJrBIpw8ANZMbJVb8AeuogvuAipGVE4Qe4=",
+        "owner": "matrix-construct",
         "repo": "rocksdb",
-        "rev": "3ce04794bcfbbb0d2e6f81ae35fc4acf688b6986",
+        "rev": "cf7f65d0b377af019661c240f9165b3ef60640c3",
         "type": "github"
       },
       "original": {
-        "owner": "girlbossceo",
-        "ref": "v9.11.1",
+        "owner": "matrix-construct",
+        "ref": "tuwunel-changes",
         "repo": "rocksdb",
         "type": "github"
       }
@@ -599,11 +582,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1740691488,
-        "narHash": "sha256-Fs6vBrByuiOf2WO77qeMDMTXcTGzrIMqLBv+lNeywwM=",
+        "lastModified": 1749829309,
+        "narHash": "sha256-t6x6/PKg8Shnkd3htrxf3WMgycfRLRWvN9JHAmGWf+s=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "fe3eda77d3a7ce212388bda7b6cec8bffcc077e5",
+        "rev": "a497f4114ccf24978accb56190e60d1e1659e0c7",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,14 +2,14 @@
   inputs = {
     attic.url = "github:zhaofengli/attic?ref=main";
     cachix.url = "github:cachix/cachix?ref=master";
-    complement = { url = "github:girlbossceo/complement?ref=main"; flake = false; };
+    complement = { url = "github:matrix-construct/complement?ref=main"; flake = false; };
     crane = { url = "github:ipetkov/crane?ref=master"; };
     fenix = { url = "github:nix-community/fenix?ref=main"; inputs.nixpkgs.follows = "nixpkgs"; };
     flake-compat = { url = "github:edolstra/flake-compat?ref=master"; flake = false; };
     flake-utils.url = "github:numtide/flake-utils?ref=main";
     nix-filter.url = "github:numtide/nix-filter?ref=main";
     nixpkgs.url = "github:NixOS/nixpkgs?ref=nixpkgs-unstable";
-    rocksdb = { url = "github:girlbossceo/rocksdb?ref=v9.11.1"; flake = false; };
+    rocksdb = { url = "github:matrix-construct/rocksdb?ref=tuwunel-changes"; flake = false; };
     liburing = { url = "github:axboe/liburing?ref=master"; flake = false; };
   };
 
@@ -26,7 +26,7 @@
         file = ./rust-toolchain.toml;
 
         # See also `rust-toolchain.toml`
-        sha256 = "sha256-X/4ZBHO3iW0fOenQ3foEvscgAPJYl2abspaBThDOukI=";
+        sha256 = "sha256-Qxt8XAuaUR2OMdKbN4u8dBJOhSHxS+uS06Wl9+flVEk=";
       };
 
       mkScope = pkgs: pkgs.lib.makeScope pkgs.newScope (self: {
@@ -53,7 +53,7 @@
         };
         rocksdb = (pkgs.rocksdb.override {
           liburing = self.liburing;
-        }).overrideAttrs (old: {
+        }).overrideAttrs (final: old: {
           src = inputs.rocksdb;
           version = pkgs.lib.removePrefix
             "v"
@@ -62,6 +62,15 @@
           # we have this already at https://github.com/girlbossceo/rocksdb/commit/a935c0273e1ba44eacf88ce3685a9b9831486155
           # unsetting this so i don't have to revert it and make this nix exclusive
           patches = [];
+          postPatch =
+            pkgs.lib.optionalString (pkgs.lib.versionOlder final.version "8") ''
+              # Fix gcc-13 build failures due to missing <cstdint> and
+              # <system_error> includes, fixed upstream since 8.x
+              sed -e '1i #include <cstdint>' -i db/compaction/compaction_iteration_stats.h
+              sed -e '1i #include <cstdint>' -i table/block_based/data_block_hash_index.h
+              sed -e '1i #include <cstdint>' -i util/string_util.h
+              sed -e '1i #include <cstdint>' -i include/rocksdb/utilities/checkpoint.h
+            '';
           cmakeFlags = pkgs.lib.subtractLists
             [
               # no real reason to have snappy or zlib, no one uses this
@@ -197,8 +206,8 @@
                 "jemalloc_stats"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
         };
         default-debug = scopeHost.main.override {
@@ -210,8 +219,8 @@
                 "experimental"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
         };
         # just a test profile used for things like CI and complement
@@ -223,8 +232,8 @@
                 "experimental"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
         };
         all-features = scopeHost.main.override {
@@ -238,8 +247,8 @@
                 "jemalloc_stats"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
         };
         all-features-debug = scopeHost.main.override {
@@ -252,8 +261,8 @@
                 "experimental"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
         };
         hmalloc = scopeHost.main.override { features = ["hardened_malloc"]; };
@@ -271,8 +280,8 @@
                 "jemalloc_stats"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
           };
         };
@@ -287,8 +296,8 @@
                 "experimental"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
           };
         };
@@ -352,8 +361,8 @@
                         "experimental"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                     ];
                   };
                 }
@@ -372,8 +381,8 @@
                         "jemalloc_stats"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                     ];
                   };
                 }
@@ -393,8 +402,8 @@
                         "jemalloc_stats"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                     ];
                     x86_64_haswell_target_optimised = (if (crossSystem == "x86_64-linux-gnu" || crossSystem == "x86_64-linux-musl") then true else false);
                   };
@@ -413,8 +422,8 @@
                         "experimental"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                     ];
                   };
                 }
@@ -471,8 +480,8 @@
                         "jemalloc_stats"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                       ];
                     };
                   };
@@ -494,8 +503,8 @@
                         "jemalloc_stats"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                       ];
                       x86_64_haswell_target_optimised = (if (crossSystem == "x86_64-linux-gnu" || crossSystem == "x86_64-linux-musl") then true else false);
                     };
@@ -516,8 +525,8 @@
                         "experimental"
                         # this is non-functional on nix for some reason
                         "hardened_malloc"
-                        # conduwuit_mods is a development-only hot reload feature
-                        "conduwuit_mods"
+                        # tuwunel_mods is a development-only hot reload feature
+                        "tuwunel_mods"
                       ];
                     };
                   };
@@ -564,8 +573,8 @@
                 "jemalloc_stats"
                 # this is non-functional on nix for some reason
                 "hardened_malloc"
-                # conduwuit_mods is a development-only hot reload feature
-                "conduwuit_mods"
+                # tuwunel_mods is a development-only hot reload feature
+                "tuwunel_mods"
             ];
         };
         }));

nix/pkgs/book/default.nix

@@ -13,14 +13,16 @@ stdenv.mkDerivation {
     root = inputs.self;
     include = [
       "book.toml"
-      "conduwuit-example.toml"
+      "tuwunel-example.toml"
       "CODE_OF_CONDUCT.md"
       "CONTRIBUTING.md"
       "README.md"
       "development.md"
-      "debian/conduwuit.service"
+      "debian/tuwunel.service"
       "debian/README.md"
-      "arch/conduwuit.service"
+      "arch/tuwunel.service"
+      "rpm/tuwunel.service"
+      "rpm/README.md"
       "docs"
       "theme"
     ];

nix/pkgs/complement/bin/complement

@@ -15,7 +15,7 @@ LOG_FILE="${2:-complement_test_logs.jsonl}"
 # A `.jsonl` file to write test results to
 RESULTS_FILE="${3:-complement_test_results.jsonl}"
 
-COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-complement-conduwuit:main}"
+COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-complement-tuwunel:main}"
 
 # Complement tests that are skipped due to flakiness/reliability issues or we don't implement such features and won't for a long time
 SKIPPED_COMPLEMENT_TESTS='TestPartialStateJoin.*|TestRoomDeleteAlias/Parallel/Regular_users_can_add_and_delete_aliases_when_m.*|TestRoomDeleteAlias/Parallel/Can_delete_canonical_alias|TestUnbanViaInvite.*|TestRoomState/Parallel/GET_/publicRooms_lists.*"|TestRoomDeleteAlias/Parallel/Users_with_sufficient_power-level_can_delete_other.*'
@@ -35,20 +35,20 @@ toplevel="$(git rev-parse --show-toplevel)"
 pushd "$toplevel" > /dev/null
 
 if [ ! -f "complement_oci_image.tar.gz" ]; then
-    echo "building complement conduwuit image"
+    echo "building complement tuwunel image"
 
     # if using macOS, use linux-complement
     #bin/nix-build-and-cache just .#linux-complement
     bin/nix-build-and-cache just .#complement
     #nix build -L .#complement
 
-    echo "complement conduwuit image tar.gz built at \"result\""
+    echo "complement tuwunel image tar.gz built at \"result\""
 
     echo "loading into docker"
     docker load < result
     popd > /dev/null
 else
-    echo "skipping building a complement conduwuit image as complement_oci_image.tar.gz was already found, loading this"
+    echo "skipping building a complement tuwunel image as complement_oci_image.tar.gz was already found, loading this"
 
     docker load < complement_oci_image.tar.gz
     popd > /dev/null

nix/pkgs/complement/bin/nix-build-and-cache

@@ -18,7 +18,7 @@ just() {
         return
     fi
 
-    # historical "conduit" store for compatibility purposes, same as conduwuit
+    # historical "conduit" store for compatibility purposes, same as tuwunel
     nix run --inputs-from "$toplevel" attic -- \
         login \
         conduit \
@@ -52,26 +52,26 @@ just() {
         withattic conduit || withattic conduit || withattic conduit || true
     )
 
-    # main "conduwuit" store
+    # main "tuwunel" store
     nix run --inputs-from "$toplevel" attic -- \
         login \
-        conduwuit \
-        "${ATTIC_ENDPOINT:-https://attic.kennel.juneis.dog/conduwuit}" \
+        tuwunel \
+        "${ATTIC_ENDPOINT:-https://attic.kennel.juneis.dog/tuwunel}" \
         "$ATTIC_TOKEN"
 
-    # Upload them to Attic (conduwuit store) and Cachix
+    # Upload them to Attic (tuwunel store) and Cachix
     #
     # Use `xargs` and a here-string because something would probably explode if
     # several thousand arguments got passed to a command at once. Hopefully no
     # store paths include a newline in them.
     (
         IFS=$'\n'
-        withattic conduwuit || withattic conduwuit || withattic conduwuit || true
+        withattic tuwunel || withattic tuwunel || withattic tuwunel || true
 
         # push to cachix if available
         if [ "$CACHIX_AUTH_TOKEN" ]; then
             nix shell --inputs-from "$toplevel" cachix -c xargs \
-            cachix push conduwuit <<< "${cache[*]}"
+            cachix push tuwunel <<< "${cache[*]}"
         fi
     )
 }

nix/pkgs/complement/default.nix

@@ -31,7 +31,7 @@ let
         "gzip_compression"
         "zstd_compression"
         # complement doesn't need hot reloading
-        "conduwuit_mods"
+        "tuwunel_mods"
         # complement doesn't have URL preview media tests
         "url_preview"
     ];
@@ -41,19 +41,19 @@ let
     set -euxo pipefail
 
     ${lib.getExe' coreutils "env"} \
-      CONDUWUIT_SERVER_NAME="$SERVER_NAME" \
+      TUWUNEL_SERVER_NAME="$SERVER_NAME" \
       ${lib.getExe main'}
   '';
 in
 
 dockerTools.buildImage {
-  name = "complement-conduwuit";
+  name = "complement-tuwunel";
   tag = "main";
 
   copyToRoot = buildEnv {
     name = "root";
     pathsToLink = [
-      "/bin"
+      "/nix/pkgs/complement/bin"
     ];
     paths = [
       bashInteractive
@@ -75,9 +75,9 @@ dockerTools.buildImage {
       else [];
 
     Env = [
-      "CONDUWUIT_TLS__KEY=${./private_key.key}"
-      "CONDUWUIT_TLS__CERTS=${./certificate.crt}"
-      "CONDUWUIT_CONFIG=${./config.toml}"
+      "TUWUNEL_TLS__KEY=${./private_key.key}"
+      "TUWUNEL_TLS__CERTS=${./certificate.crt}"
+      "TUWUNEL_CONFIG=${./config.toml}"
       "RUST_BACKTRACE=full"
     ];
 

nix/pkgs/main/default.nix

@@ -25,8 +25,8 @@
   "jemalloc_stats"
   # this is non-functional on nix for some reason
   "hardened_malloc"
-  # conduwuit_mods is a development-only hot reload feature
-  "conduwuit_mods"
+  # tuwunel_mods is a development-only hot reload feature
+  "tuwunel_mods"
 ]
 , disable_release_max_log_level ? false
 , features ? []
@@ -130,7 +130,7 @@ buildDepsOnlyEnv =
   });
 
 buildPackageEnv = {
-  CONDUWUIT_VERSION_EXTRA = inputs.self.shortRev or inputs.self.dirtyShortRev or "";
+  TUWUNEL_VERSION_EXTRA = inputs.self.shortRev or inputs.self.dirtyShortRev or "";
 } // buildDepsOnlyEnv // {
   # Only needed in static stdenv because these are transitive dependencies of rocksdb
   CARGO_BUILD_RUSTFLAGS = buildDepsOnlyEnv.CARGO_BUILD_RUSTFLAGS

rpm/README.md

@@ -0,0 +1,36 @@
+# Tuwunel for Red Hat
+
+Information about downloading and deploying the Red Hat package. This may also be
+referenced for other `rpm`-based distros such as CentOS.
+
+### Installation
+
+It is recommended to see the [generic deployment guide](../deploying/generic.md)
+for further information if needed as usage of the RPM package is generally
+related.
+
+No `rpm` repository is currently offered yet, it is in the works/development.
+
+### Configuration
+
+When installed, the example config is placed at `/etc/tuwunel/tuwunel.toml`
+as the default config. The config mentions things required to be changed before
+starting.
+
+You can tweak more detailed settings by uncommenting and setting the config
+options in `/etc/tuwunel/tuwunel.toml`.
+
+### Running
+
+The package uses the [`tuwunel.service`](../configuration/examples.md#example-systemd-unit-file)
+systemd unit file to start and stop Tuwunel. The binary is installed at `/usr/sbin/tuwunel`.
+
+This package assumes by default that Tuwunel will be placed behind a reverse
+proxy. The default config options apply (listening on `localhost` and TCP port
+`8008`). Matrix federation requires a valid domain name and TLS, so you will
+need to set up TLS certificates and renewal for it to work properly if you
+intend to federate.
+
+Consult various online documentation and guides on setting up a reverse proxy
+and TLS. Caddy is documented at the [generic deployment guide](../deploying/generic.md#setting-up-the-reverse-proxy)
+as it's the easiest and most user friendly.

rpm/postinst

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -e
+
+TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
+TUWUNEL_CONFIG_PATH=/etc/tuwunel
+
+case "$1" in
+  configure)
+    # Create the `tuwunel` user if it does not exist yet.
+    if ! getent passwd tuwunel > /dev/null ; then
+      echo 'Adding system user for the tuwunel Matrix homeserver' 1>&2
+      useradd --system --user-group \
+        --create-home --home-dir "$TUWUNEL_DATABASE_PATH" \
+        --shell "/usr/sbin/nologin" \
+        tuwunel
+    fi
+
+    # Create the database path if it does not exist yet and fix up ownership
+    # and permissions for the config.
+    mkdir -v -p "$TUWUNEL_DATABASE_PATH"
+
+    # symlink the previous location for compatibility if it does not exist yet.
+    if ! test -L "/var/lib/matrix-conduit" ; then
+        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/matrix-conduit"
+    fi
+    if ! test -L "/var/lib/conduwuit" ; then
+        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/conduwuit"
+    fi
+
+    chown -v tuwunel:tuwunel -R "$TUWUNEL_DATABASE_PATH"
+    chown -v tuwunel:tuwunel -R "$TUWUNEL_CONFIG_PATH"
+
+    chmod -v 740 "$TUWUNEL_DATABASE_PATH"
+
+    echo ''
+    echo 'Make sure you edit the example config at /etc/tuwunel/tuwunel.toml before starting!'
+    echo 'To start the server, run: systemctl start tuwunel.service'
+    echo ''
+
+    ;;
+esac

rpm/tuwunel.service

@@ -0,0 +1,65 @@
+[Unit]
+Description=Tuwunel Matrix homeserver
+Wants=network-online.target
+After=network-online.target
+Alias=matrix-tuwunel.service
+Documentation=https://tuwunel.chat/
+
+[Service]
+DynamicUser=yes
+User=tuwunel
+Group=tuwunel
+Type=notify
+
+Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
+
+ExecStart=/usr/sbin/tuwunel
+
+ReadWritePaths=/var/lib/tuwunel /etc/tuwunel
+
+AmbientCapabilities=
+CapabilityBoundingSet=
+
+DevicePolicy=closed
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+#ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+PrivateDevices=yes
+PrivateMounts=yes
+PrivateTmp=yes
+PrivateUsers=yes
+PrivateIPC=yes
+RemoveIPC=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service @resources
+SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
+SystemCallErrorNumber=EPERM
+
+RuntimeDirectory=tuwunel
+RuntimeDirectoryMode=0750
+
+Restart=on-failure
+RestartSec=5
+
+TimeoutStopSec=2m
+TimeoutStartSec=2m
+
+StartLimitInterval=1m
+StartLimitBurst=5
+
+[Install]
+WantedBy=multi-user.target

rust-toolchain.toml

@@ -9,7 +9,7 @@
 # If you're having trouble making the relevant changes, bug a maintainer.
 
 [toolchain]
-channel = "1.86.0"
+channel = "1.88.0"
 profile = "minimal"
 components = [
     # For rust-analyzer

rustfmt.toml

@@ -1,5 +1,6 @@
 array_width = 80
-chain_width = 60
+attr_fn_like_width = 60
+chain_width = 50
 comment_width = 80
 condense_wildcard_suffixes = true
 style_edition = "2024"

src/admin/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "conduwuit_admin"
+name = "tuwunel_admin"
 categories.workspace = true
 description.workspace = true
 edition.workspace = true
@@ -17,24 +17,74 @@ crate-type = [
 ]
 
 [features]
+brotli_compression = [
+	"tuwunel-core/brotli_compression",
+	"tuwunel-service/brotli_compression",
+]
+bzip2_compression = [
+	"tuwunel-database/bzip2_compression",
+	"tuwunel-service/bzip2_compression",
+]
+gzip_compression = [
+	"tuwunel-core/gzip_compression",
+	"tuwunel-service/gzip_compression",
+]
+io_uring = [
+	"tuwunel-database/io_uring",
+	"tuwunel-service/io_uring",
+]
+jemalloc = [
+	"tuwunel-core/jemalloc",
+	"tuwunel-database/jemalloc",
+	"tuwunel-service/jemalloc",
+]
+jemalloc_conf = [
+	"tuwunel-core/jemalloc_conf",
+	"tuwunel-database/jemalloc_conf",
+	"tuwunel-service/jemalloc_conf",
+]
+jemalloc_prof = [
+	"tuwunel-core/jemalloc_prof",
+	"tuwunel-database/jemalloc_prof",
+	"tuwunel-service/jemalloc_prof",
+]
+jemalloc_stats = [
+	"tuwunel-core/jemalloc_stats",
+	"tuwunel-database/jemalloc_stats",
+	"tuwunel-service/jemalloc_stats",
+]
+lz4_compression = [
+	"tuwunel-database/lz4_compression",
+	"tuwunel-service/lz4_compression",
+]
 release_max_log_level = [
+	"tuwunel-core/release_max_log_level",
+	"tuwunel-database/release_max_log_level",
+	"tuwunel-service/release_max_log_level",
 	"tracing/max_level_trace",
 	"tracing/release_max_level_info",
 	"log/max_level_trace",
 	"log/release_max_level_info",
 ]
+zstd_compression = [
+	"tuwunel-core/zstd_compression",
+	"tuwunel-database/zstd_compression",
+	"tuwunel-service/zstd_compression",
+]
 
 [dependencies]
+base64.workspace = true
 clap.workspace = true
-conduwuit-api.workspace = true
-conduwuit-core.workspace = true
-conduwuit-database.workspace = true
-conduwuit-macros.workspace = true
-conduwuit-service.workspace = true
+tuwunel-core.workspace = true
+tuwunel-database.workspace = true
+tuwunel-macros.workspace = true
+tuwunel-service.workspace = true
 const-str.workspace = true
+ctor.workspace = true
 futures.workspace = true
 log.workspace = true
 ruma.workspace = true
+serde.workspace = true
 serde_json.workspace = true
 serde_yaml.workspace = true
 tokio.workspace = true

src/admin/admin.rs

@@ -1,15 +1,15 @@
 use clap::Parser;
-use conduwuit::Result;
+use tuwunel_core::Result;
 
 use crate::{
-	appservice, appservice::AppserviceCommand, check, check::CheckCommand, command::Command,
+	appservice, appservice::AppserviceCommand, check, check::CheckCommand, context::Context,
 	debug, debug::DebugCommand, federation, federation::FederationCommand, media,
 	media::MediaCommand, query, query::QueryCommand, room, room::RoomCommand, server,
 	server::ServerCommand, user, user::UserCommand,
 };
 
 #[derive(Debug, Parser)]
-#[command(name = "conduwuit", version = conduwuit::version())]
+#[command(name = "tuwunel", version = tuwunel_core::version())]
 pub(super) enum AdminCommand {
 	#[command(subcommand)]
 	/// - Commands for managing appservices
@@ -49,20 +49,18 @@ pub(super) enum AdminCommand {
 }
 
 #[tracing::instrument(skip_all, name = "command")]
-pub(super) async fn process(command: AdminCommand, context: &Command<'_>) -> Result {
+pub(super) async fn process(command: AdminCommand, context: &Context<'_>) -> Result {
 	use AdminCommand::*;
 
 	match command {
-		| Appservices(command) => appservice::process(command, context).await?,
-		| Media(command) => media::process(command, context).await?,
-		| Users(command) => user::process(command, context).await?,
-		| Rooms(command) => room::process(command, context).await?,
-		| Federation(command) => federation::process(command, context).await?,
-		| Server(command) => server::process(command, context).await?,
-		| Debug(command) => debug::process(command, context).await?,
-		| Query(command) => query::process(command, context).await?,
-		| Check(command) => check::process(command, context).await?,
+		| Appservices(command) => appservice::process(command, context).await,
+		| Media(command) => media::process(command, context).await,
+		| Users(command) => user::process(command, context).await,
+		| Rooms(command) => room::process(command, context).await,
+		| Federation(command) => federation::process(command, context).await,
+		| Server(command) => server::process(command, context).await,
+		| Debug(command) => debug::process(command, context).await,
+		| Query(command) => query::process(command, context).await,
+		| Check(command) => check::process(command, context).await,
 	}
-
-	Ok(())
 }

src/admin/appservice/commands.rs

@@ -1,84 +1,80 @@
-use ruma::{api::appservice::Registration, events::room::message::RoomMessageEventContent};
+use futures::{FutureExt, StreamExt, TryFutureExt};
+use tuwunel_core::{Err, Result, checked};
 
-use crate::{Result, admin_command};
+use crate::admin_command;
 
 #[admin_command]
-pub(super) async fn register(&self) -> Result<RoomMessageEventContent> {
-	if self.body.len() < 2
-		|| !self.body[0].trim().starts_with("```")
-		|| self.body.last().unwrap_or(&"").trim() != "```"
+pub(super) async fn register(&self) -> Result {
+	let body = &self.body;
+	let body_len = self.body.len();
+	if body_len < 2
+		|| !body[0].trim().starts_with("```")
+		|| body.last().unwrap_or(&"").trim() != "```"
 	{
-		return Ok(RoomMessageEventContent::text_plain(
-			"Expected code block in command body. Add --help for details.",
-		));
+		return Err!("Expected code block in command body. Add --help for details.");
 	}
 
-	let appservice_config_body = self.body[1..self.body.len().checked_sub(1).unwrap()].join("\n");
-	let parsed_config = serde_yaml::from_str::<Registration>(&appservice_config_body);
+	let range = 1..checked!(body_len - 1)?;
+	let appservice_config_body = body[range].join("\n");
+	let parsed_config = serde_yaml::from_str(&appservice_config_body);
 	match parsed_config {
+		| Err(e) => return Err!("Could not parse appservice config as YAML: {e}"),
 		| Ok(registration) => match self
 			.services
 			.appservice
 			.register_appservice(&registration, &appservice_config_body)
 			.await
+			.map(|()| registration.id)
 		{
-			| Ok(()) => Ok(RoomMessageEventContent::text_plain(format!(
-				"Appservice registered with ID: {}",
-				registration.id
-			))),
-			| Err(e) => Ok(RoomMessageEventContent::text_plain(format!(
-				"Failed to register appservice: {e}"
-			))),
+			| Err(e) => return Err!("Failed to register appservice: {e}"),
+			| Ok(id) => write!(self, "Appservice registered with ID: {id}"),
 		},
-		| Err(e) => Ok(RoomMessageEventContent::text_plain(format!(
-			"Could not parse appservice config as YAML: {e}"
-		))),
 	}
+	.await
 }
 
 #[admin_command]
-pub(super) async fn unregister(
-	&self,
-	appservice_identifier: String,
-) -> Result<RoomMessageEventContent> {
+pub(super) async fn unregister(&self, appservice_identifier: String) -> Result {
 	match self
 		.services
 		.appservice
 		.unregister_appservice(&appservice_identifier)
 		.await
 	{
-		| Ok(()) => Ok(RoomMessageEventContent::text_plain("Appservice unregistered.")),
-		| Err(e) => Ok(RoomMessageEventContent::text_plain(format!(
-			"Failed to unregister appservice: {e}"
-		))),
+		| Err(e) => return Err!("Failed to unregister appservice: {e}"),
+		| Ok(()) => write!(self, "Appservice unregistered."),
 	}
+	.await
 }
 
 #[admin_command]
-pub(super) async fn show_appservice_config(
-	&self,
-	appservice_identifier: String,
-) -> Result<RoomMessageEventContent> {
+pub(super) async fn show_appservice_config(&self, appservice_identifier: String) -> Result {
 	match self
 		.services
 		.appservice
 		.get_registration(&appservice_identifier)
 		.await
 	{
+		| None => return Err!("Appservice does not exist."),
 		| Some(config) => {
-			let config_str = serde_yaml::to_string(&config)
-				.expect("config should've been validated on register");
-			let output =
-				format!("Config for {appservice_identifier}:\n\n```yaml\n{config_str}\n```",);
-			Ok(RoomMessageEventContent::notice_markdown(output))
+			let config_str = serde_yaml::to_string(&config)?;
+			write!(self, "Config for {appservice_identifier}:\n\n```yaml\n{config_str}\n```")
 		},
-		| None => Ok(RoomMessageEventContent::text_plain("Appservice does not exist.")),
 	}
+	.await
 }
 
 #[admin_command]
-pub(super) async fn list_registered(&self) -> Result<RoomMessageEventContent> {
-	let appservices = self.services.appservice.iter_ids().await;
-	let output = format!("Appservices ({}): {}", appservices.len(), appservices.join(", "));
-	Ok(RoomMessageEventContent::text_plain(output))
+pub(super) async fn list_registered(&self) -> Result {
+	self.services
+		.appservice
+		.iter_ids()
+		.collect()
+		.map(Ok)
+		.and_then(|appservices: Vec<_>| {
+			let len = appservices.len();
+			let list = appservices.join(", ");
+			write!(self, "Appservices ({len}): {list}")
+		})
+		.await
 }

src/admin/appservice/mod.rs

@@ -1,7 +1,7 @@
 mod commands;
 
 use clap::Subcommand;
-use conduwuit::Result;
+use tuwunel_core::Result;
 
 use crate::admin_command_dispatch;
 

src/admin/check/commands.rs

@@ -1,28 +1,31 @@
-use conduwuit::Result;
-use conduwuit_macros::implement;
 use futures::StreamExt;
-use ruma::events::room::message::RoomMessageEventContent;
+use tuwunel_core::Result;
+use tuwunel_macros::implement;
 
-use crate::Command;
+use crate::Context;
 
 /// Uses the iterator in `src/database/key_value/users.rs` to iterator over
 /// every user in our database (remote and local). Reports total count, any
 /// errors if there were any, etc
-#[implement(Command, params = "<'_>")]
-pub(super) async fn check_all_users(&self) -> Result<RoomMessageEventContent> {
+#[implement(Context, params = "<'_>")]
+pub(super) async fn check_all_users(&self) -> Result {
 	let timer = tokio::time::Instant::now();
-	let users = self.services.users.iter().collect::<Vec<_>>().await;
+	let users = self
+		.services
+		.users
+		.iter()
+		.collect::<Vec<_>>()
+		.await;
 	let query_time = timer.elapsed();
 
 	let total = users.len();
 	let err_count = users.iter().filter(|_user| false).count();
 	let ok_count = users.iter().filter(|_user| true).count();
 
-	let message = format!(
+	self.write_str(&format!(
 		"Database query completed in {query_time:?}:\n\n```\nTotal entries: \
 		 {total:?}\nFailure/Invalid user count: {err_count:?}\nSuccess/Valid user count: \
 		 {ok_count:?}\n```"
-	);
-
-	Ok(RoomMessageEventContent::notice_markdown(message))
+	))
+	.await
 }

src/admin/check/mod.rs

@@ -1,7 +1,7 @@
 mod commands;
 
 use clap::Subcommand;
-use conduwuit::Result;
+use tuwunel_core::Result;
 
 use crate::admin_command_dispatch;
 

src/admin/context.rs

@@ -1,15 +1,15 @@
 use std::{fmt, time::SystemTime};
 
-use conduwuit::Result;
-use conduwuit_service::Services;
 use futures::{
-	Future, FutureExt,
+	Future, FutureExt, TryFutureExt,
 	io::{AsyncWriteExt, BufWriter},
 	lock::Mutex,
 };
 use ruma::EventId;
+use tuwunel_core::Result;
+use tuwunel_service::Services;
 
-pub(crate) struct Command<'a> {
+pub(crate) struct Context<'a> {
 	pub(crate) services: &'a Services,
 	pub(crate) body: &'a [&'a str],
 	pub(crate) timer: SystemTime,
@@ -17,14 +17,17 @@ pub(crate) struct Command<'a> {
 	pub(crate) output: Mutex<BufWriter<Vec<u8>>>,
 }
 
-impl Command<'_> {
+impl Context<'_> {
 	pub(crate) fn write_fmt(
 		&self,
 		arguments: fmt::Arguments<'_>,
 	) -> impl Future<Output = Result> + Send + '_ + use<'_> {
 		let buf = format!("{arguments}");
-		self.output.lock().then(|mut output| async move {
-			output.write_all(buf.as_bytes()).await.map_err(Into::into)
+		self.output.lock().then(async move |mut output| {
+			output
+				.write_all(buf.as_bytes())
+				.map_err(Into::into)
+				.await
 		})
 	}
 
@@ -32,8 +35,11 @@ pub(crate) fn write_str<'a>(
 		&'a self,
 		s: &'a str,
 	) -> impl Future<Output = Result> + Send + 'a {
-		self.output.lock().then(move |mut output| async move {
-			output.write_all(s.as_bytes()).await.map_err(Into::into)
+		self.output.lock().then(async move |mut output| {
+			output
+				.write_all(s.as_bytes())
+				.map_err(Into::into)
+				.await
 		})
 	}
 }