Increase traefik read timeout to allow uploading larger container images

- Include server name in discord channel room name
- Enable setting room info in gmessages

.cargo/audit.toml

@@ -1,27 +0,0 @@
-[advisories]
-ignore = ["RUSTSEC-2024-0436", "RUSTSEC-2025-0014"] # advisory IDs to ignore e.g. ["RUSTSEC-2019-0001", ...]
-informational_warnings = [] # warn for categories of informational advisories
-severity_threshold = "none" # CVSS severity ("none", "low", "medium", "high", "critical")
-
-# Advisory Database Configuration
-[database]
-path = "~/.cargo/advisory-db" # Path where advisory git repo will be cloned
-url = "https://github.com/RustSec/advisory-db.git" # URL to git repo
-fetch = true # Perform a `git fetch` before auditing (default: true)
-stale = false # Allow stale advisory DB (i.e. no commits for 90 days, default: false)
-
-# Output Configuration
-[output]
-deny = ["warnings", "unmaintained", "unsound", "yanked"] # exit on error if unmaintained dependencies are found
-format = "terminal" # "terminal" (human readable report) or "json"
-quiet = false # Only print information on error
-show_tree = true # Show inverse dependency trees along with advisories (default: true)
-
-# Target Configuration
-[target]
-arch = ["x86_64", "aarch64"] # Ignore advisories for CPU architectures other than these
-os = ["linux", "windows", "macos"] # Ignore advisories for operating systems other than these
-
-[yanked]
-enabled = true # Warn for yanked crates in Cargo.lock (default: true)
-update_index = true # Auto-update the crates.io index (default: true)

.cargo/config.toml

@@ -1,2 +0,0 @@
-[env]
-RUMA_UNSTABLE_EXHAUSTIVE_TYPES = "true"

.cargo/smoketest.sh

@@ -1,63 +0,0 @@
-#!/bin/bash
-export CARGO_TARGET_DIR="target/smokes"
-
-run () {
-	RUN_COMMAND=$@
-	echo -ne "\033[1;33mTEST\033[0m $RUN_COMMAND"
-	ERRORS=$($RUN_COMMAND 2>&1>/tmp/uwu_smoketest.out)
-	RESULT=$?
-	echo
-	if test $RESULT -ne 0; then
-		cat /tmp/uwu_smoketest.out
-		echo -e "$ERRORS"
-		echo -e "\033[1;5;41;37mFAIL\033[0m exit ($RESULT): $RUN_COMMAND"
-		exit $RESULT
-	else
-		echo -ne "\033[1F"
-		echo -e "\033[1;32mPASS\033[0m $RUN_COMMAND"
-	fi
-}
-
-tuwunel () {
-	UWU_OPTS=$@
-	rm -rf /tmp/uwu_smoketest.db
-	echo -e "[global]\nserver_name = \"localhost\"\ndatabase_path = \"/tmp/uwu_smoketest.db\"" > /tmp/uwu_smoketest.toml
-	cargo $UWU_OPTS -- -c /tmp/uwu_smoketest.toml &
-	sleep 15s
-	kill -QUIT %1
-	wait %1
-	return $?
-}
-
-element () {
-	TOOLCHAIN=$1; shift
-	ELEMENT_OPTS=$@
-	run cargo "$TOOLCHAIN" check $ELEMENT_OPTS --all-targets
-	run cargo "$TOOLCHAIN" clippy $ELEMENT_OPTS --all-targets -- -D warnings
-	if [ "$BUILD" != "check" ]; then
-		run cargo "$TOOLCHAIN" build $ELEMENT_OPTS --all-targets
-		run cargo "$TOOLCHAIN" test $ELEMENT_OPTS --all-targets
-		run cargo "$TOOLCHAIN" bench $ELEMENT_OPTS --all-targets
-		run cargo "$TOOLCHAIN" run $ELEMENT_OPTS --bin tuwunel -- -V
-		run tuwunel "$TOOLCHAIN" run $ELEMENT_OPTS --bin tuwunel
-	fi
-}
-
-vector () {
-	TOOLCHAIN=$1; shift
-	VECTOR_OPTS=$@
-	element "$TOOLCHAIN" $VECTOR_OPTS --no-default-features
-	element "$TOOLCHAIN" $VECTOR_OPTS --features=default
-	element "$TOOLCHAIN" $VECTOR_OPTS --all-features
-}
-
-matrix () {
-	run cargo +nightly fmt --all --check
-	vector "" --profile=dev
-	vector "" --profile=release
-	vector +nightly --profile=dev
-	vector +nightly --profile=release
-}
-
-BUILD=${1:-build}
-matrix && exit 0

.dockerignore

@@ -1,31 +1,9 @@
-# Local build and dev artifacts
-target/
-#tests
-
-# Docker files
-Dockerfile*
-docker/
-
-# IDE files
-.vscode
-.idea
-*.iml
-
-.
-
-# Git folder
-#.git
-#.gitea
-#.gitlab
-#.github
-
-# Dot files
-.env
-#.gitignore
-
-# Toml files
-#rustfmt.toml
-
-# Documentation
-#*.md
-*.hcl
+servers
+compose.yml
+node_modules
+.gitignore
+Dockerfile
+.svelte-kit
+build
+output
+.git

.editorconfig

@@ -1,24 +1,6 @@
-# EditorConfig is awesome: https://EditorConfig.org
-
 root = true
-
-[*]
+[*.{js,ts,svelte}]
 charset = utf-8
-end_of_line = lf
-tab_width = 4
-indent_size = 4
+
 indent_style = space
-insert_final_newline = true
-max_line_length = 120
-
-[*.{md,txt}]
-indent_style = space
-indent_size = 4
-max_line_length = 80
-
-[*.nix]
-indent_size = 2
-
-[*.rs]
-indent_style = tab
-max_line_length = 98
+indent_size = 4

.envrc

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-dotenv_if_exists
-
-use flake ".#${DIRENV_DEVSHELL:-default}"
-
-PATH_add bin

.git-blame-ignore-revs

@@ -1,7 +0,0 @@
-# .git-blame-ignore-revs
-# adds a proper rustfmt.toml and formats the entire codebase
-1d1ac065141181438e744e7d8abd0e45f75a2f91
-f419c64aca300a338096b4e0db4c73ace54f23d0
-# use chain_width 60
-162948313c212193965dece50b816ef0903172ba
-5998a0d883d31b866f7c8c46433a8857eae51a89

.gitattributes

@@ -1,87 +1,2 @@
-# taken from https://github.com/gitattributes/gitattributes/blob/46a8961ad73f5bd4d8d193708840fbc9e851d702/Rust.gitattributes
-# Auto detect text files and perform normalization
-*          text=auto
-
-*.rs       text diff=rust
-*.toml     text diff=toml
-Cargo.lock text
-
-# taken from https://github.com/gitattributes/gitattributes/blob/46a8961ad73f5bd4d8d193708840fbc9e851d702/Common.gitattributes
-# Documents
-*.bibtex   text diff=bibtex
-*.doc      diff=astextplain
-*.DOC      diff=astextplain
-*.docx     diff=astextplain
-*.DOCX     diff=astextplain
-*.dot      diff=astextplain
-*.DOT      diff=astextplain
-*.pdf      diff=astextplain
-*.PDF      diff=astextplain
-*.rtf      diff=astextplain
-*.RTF      diff=astextplain
-*.md       text diff=markdown
-*.mdx      text diff=markdown
-*.tex      text diff=tex
-*.adoc     text
-*.textile  text
-*.mustache text
-*.csv      text eol=crlf
-*.tab      text
-*.tsv      text
-*.txt      text
-*.sql      text
-*.epub     diff=astextplain
-
-# Graphics
-*.png      binary
-*.jpg      binary
-*.jpeg     binary
-*.gif      binary
-*.tif      binary
-*.tiff     binary
-*.ico      binary
-# SVG treated as text by default.
-*.svg      text
-*.eps      binary
-
-# Scripts
-*.bash     text eol=lf
-*.fish     text eol=lf
-*.ksh      text eol=lf
-*.sh       text eol=lf
-*.zsh      text eol=lf
-# These are explicitly windows files and should use crlf
-*.bat      text eol=crlf
-*.cmd      text eol=crlf
-*.ps1      text eol=crlf
-
-# Serialisation
-*.json     text
-*.toml     text
-*.xml      text
-*.yaml     text
-*.yml      text
-
-# Archives
-*.7z       binary
-*.bz       binary
-*.bz2      binary
-*.bzip2    binary
-*.gz       binary
-*.lz       binary
-*.lzma     binary
-*.rar      binary
-*.tar      binary
-*.taz      binary
-*.tbz      binary
-*.tbz2     binary
-*.tgz      binary
-*.tlz      binary
-*.txz      binary
-*.xz       binary
-*.Z        binary
-*.zip      binary
-*.zst      binary
-
-# Text files where line endings should be preserved
-*.patch    -text
+# Auto detect text files and perform LF normalization
+* text=auto

.github/workflows/README.md

@@ -1,13 +0,0 @@
-## Overview
-
-The release pipeline `Main` (main.yml) and its subroutines defined in the other yamls form a high-level
-description for the underlying self-hosted build system in  `/docker`. In other words, this is a sort of
-terminal, a "thin-client" with a display and a keyboard for our docker mainframe. We minimize
-vendor-lockin and duplication with other services by limiting everything here to only what is
-essential for driving the docker builder.
-
-Though we slightly relax the above by specifying details of the actual CI pipeline, the 
-control-flow logic to go from some input event to some output or release here. This gives us
-better integration  with github, like granular progress indications by breaking up operations
-as individual jobs and workflows within the pipeline. This means we'll have duplicate logic
-with other services, but only as it relates to high-level control flow.

.github/workflows/bake.yml

@@ -1,252 +0,0 @@
-name: Bakery
-
-on:
-  workflow_call:
-    inputs:
-      bake_targets:
-        type: string
-        description: Bake Matrix
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_targets:
-        type: string
-        description: Rust targets
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_targets:
-        type: string
-        description: System targets
-      sys_versions:
-        type: string
-        description: System versions
-      machines:
-        type: string
-        description: Hardware platforms
-      runner:
-        type: string
-        description: Runner mask
-        default: 'self-hosted'
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      max-parallel:
-        type: number
-        default: 128
-        description: Limit number of concurrent jobs.
-      verbose_env:
-        type: string
-        default: ${{vars.CI_VERBOSE_ENV || false}}
-        description: Print the bake environment.
-      silent_bake:
-        type: string
-        default: ${{vars.CI_SILENT_BAKE || false}}
-        description: Print as little as possible.
-      print_bake:
-        type: string
-        default: ${{vars.CI_PRINT_BAKE || false}}
-        description: Print the computed receipe.
-      fail_fast:
-        type: boolean
-        default: false
-        description: Fail-fast for the underlying matrix.
-      release_url:
-        type: string
-        description: Upload url for created release.
-      artifact:
-        type: string
-        default: '{}'
-        description: >
-          Map of targets to artifact files to upload. Key is bake target (image prefix),
-          value is a JSON object containing keys 'src' and 'dst'. dst is the artifact name,
-          src is optional path inside image, defaulting to dst.
-
-jobs:
-  bake:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && fromJSON(inputs.machines)[0] != null
-      && fromJSON(inputs.bake_targets)[0] != null
-
-    name: >
-      ${{matrix.bake_target}}
-      ${{matrix.cargo_profile}}
-      ${{matrix.rust_toolchain}}
-      ${{matrix.feat_set}}
-      ${{matrix.sys_name}}
-      ${{matrix.sys_version}}
-      ${{matrix.sys_target}}
-
-    runs-on: ["${{matrix.machine}}", "${{inputs.runner}}"]
-    strategy:
-      fail-fast: ${{inputs.fail_fast}}
-      max-parallel: ${{inputs.max-parallel}}
-      matrix:
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-        bake_target: ${{fromJSON(inputs.bake_targets)}}
-        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
-        feat_set: ${{fromJSON(inputs.feat_sets)}}
-        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        persist-credentials: false
-
-    # Call docker
-    - name: Bake ${{matrix.bake_target}}
-      env:
-        bake_target: ${{matrix.bake_target}}
-        cargo_profile: ${{matrix.cargo_profile}}
-        rust_toolchain: ${{matrix.rust_toolchain}}
-        rust_target: ${{matrix.rust_target}}
-        feat_set: ${{matrix.feat_set}}
-        sys_name: ${{matrix.sys_name}}
-        sys_version: ${{matrix.sys_version}}
-        sys_target: ${{matrix.sys_target}}
-        machine: ${{matrix.machine}}
-        acct: ${{github.actor}}
-        repo: ${{github.repository}}
-        CI_VERBOSE_ENV: ${{inputs.verbose_env}}
-        CI_SILENT_BAKE: ${{inputs.silent_bake}}
-        CI_PRINT_BAKE: ${{inputs.print_bake}}
-
-      run: |
-        docker/bake.sh "${{matrix.bake_target}}"
-
-    # Optionally extract an inner artifact
-    - name: Extract Inner Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].img == null
-        && fromJSON(inputs.artifact)[matrix.bake_target].runner != true
-
-      env:
-        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
-
-      run: |
-        cid=$(docker create "$iid" /)
-        rm -rf _artifact
-        mkdir -p "_artifact"
-        docker cp "$cid:$src" "_artifact/$dst"
-        chmod "$mod" "_artifact/$dst"
-
-    # Optionally extract the image itself as an artifact.
-    - name: Extract Image Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].img != null
-
-      env:
-        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-
-      run: |
-        rm -rf _artifact
-        mkdir -p "_artifact"
-        docker save -o "_artifact/$dst" "$iid"
-
-    # Optionally extract a runner artifact
-    - name: Extract Outer Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].runner == true
-
-      env:
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
-
-      run: |
-        rm -rf _artifact
-        mkdir -p "_artifact"
-        mv "$src" "_artifact/$dst"
-        chmod "$mod" "_artifact/$dst"
-
-    # Optionally compress extracted artifact
-    - name: Compress Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && (fromJSON(inputs.artifact)[matrix.bake_target].gzip || fromJSON(inputs.artifact)[matrix.bake_target].zstd)
-
-      env:
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        gzlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].gzip }}
-        zstlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].zstd }}
-
-      run: |
-        if test -n "$gzlev"; then
-          mv "_artifact/$dst" "_artifact/$dst.artifact"
-          gzip "-$gzlev" "_artifact/$dst.artifact"
-          mv "_artifact/$dst.artifact.gz" "_artifact/$dst"
-        elif test -n "$zstlev"; then
-          zstd "-$zstlev" "_artifact/$dst"
-          mv "_artifact/$dst.zst" "_artifact/$dst"
-        fi
-
-    # Upload either artifact
-    - name: Upload Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-
-      uses: actions/upload-artifact@v4
-      with:
-        path: _artifact/*
-        name: ${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-
-    # Optionally upload artifact as pages-artifact
-    - name: Upload Pages Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].pages == true
-
-      uses: actions/upload-pages-artifact@v3
-      with:
-        path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-        name: github-pages
-
-    # Optionally upload artifact as release-artifact
-    - name: Upload Release Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].mime
-        && contains(github.ref, 'refs/tags/v')
-        && inputs.release_url
-
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-      with:
-        upload_url: ${{inputs.release_url}}
-        asset_path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-        asset_name: ${{github.ref_name}}-${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-        asset_content_type: ${{fromJSON(inputs.artifact)[matrix.bake_target].mime || 'application/octet-stream'}}

.github/workflows/lint.yml

@@ -1,175 +0,0 @@
-name: Linting
-
-on:
-  workflow_call:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-
-jobs:
-  fmt:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Format
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["fmt"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      rust_targets: ${{inputs.rust_targets}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  typos:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Typos
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["typos"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  audit:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Audit
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["audit"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  # disabled due to excessive build time issue installing cargo lychee
-  lychee:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-      && false
-
-    name: Lychee
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["lychee"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  check:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Check
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["check"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  clippy:
-    if: >
-      !failure() && !cancelled()
-      && inputs.cargo_profiles
-
-    name: Clippy
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["clippy"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}

.github/workflows/main.yml

@@ -1,336 +0,0 @@
-name: Main
-
-on:
-  push:
-    branches:
-      - "**"
-    tags:
-      - "v*"
-  pull_request:
-    branches:
-      - "**"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{github.workflow}}-${{github.ref}}
-  cancel-in-progress: false
-
-jobs:
-  init:
-    name: Init
-    runs-on: ${{matrix.runner}}
-    env:
-      default_cargo_profiles: '["test", "release"]'
-      default_feat_sets: '["none", "default", "all"]'
-      default_rust_toolchains: '["nightly", "stable"]'
-      default_sys_names: '["debian"]'
-      default_sys_versions: '["testing-slim"]'
-      default_rust_targets: '["x86_64-unknown-linux-gnu"]'
-      default_sys_targets: '["x86_64-v1-linux-gnu"]'
-      default_machines: '["X64"]'
-
-    outputs:
-      cargo_profiles: ${{vars.CARGO_PROFILES || env.default_cargo_profiles}}
-      feat_sets: ${{vars.FEAT_SETS || env.default_feat_sets}}
-      rust_toolchains: ${{vars.RUST_TOOLCHAINS || env.default_rust_toolchains}}
-      rust_targets: ${{vars.RUST_TARGETS || env.default_rust_targets}}
-      sys_names: ${{vars.SYS_NAMES || env.default_sys_names}}
-      sys_targets: ${{vars.SYS_TARGETS || env.default_sys_targets}}
-      sys_versions: ${{vars.SYS_VERSIONS || env.default_sys_versions}}
-      machines: ${{vars.MACHINES || env.default_machines}}
-      package: ${{vars.PACKAGE || !contains(github.ref, 'refs/pull/')}}
-      publish: ${{vars.PUBLISH || !contains(github.ref, 'refs/pull/')}}
-      build_nix: ${{vars.BUILD_NIX || !contains(github.ref, 'refs/pull/')}}
-      build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')}}
-      check_pkgs: ${{vars.CHECK_PKGS || 'false'}}
-      complement: ${{vars.COMPLEMENT || 'true'}}
-      complement_runner: 'het'
-      docker_repo: ${{vars.DOCKER_REPO}}
-      release_url: ${{steps.release.outputs.upload_url}}
-      pages_url: 'https://matrix-construct.github.io/tuwunel/'
-      rust_sdk_integration: ${{vars.RUST_SDK_INTEGRATION || 'true'}}
-      head_msg: ${{github.event.head_commit.message || github.event.workflow_run.head_commit.message}}
-
-    strategy:
-      fail-fast: true
-      matrix:
-        runner: ${{fromJSON(vars.RUNNERS || '["het"]')}}
-        machine: ${{fromJSON(vars.MACHINES || '["X64"]')}}
-        exclude: ${{fromJSON(vars.RUNNERS_EXCLUDES || '[]')}}
-
-    steps:
-    - name: Initialize Builder
-      env:
-        runner: ${{matrix.runner}}
-        reserved_space: '{"het": "192GB", "aws": "48GB", "gcp": "160GB"}'
-        max_used_space: '{"het": "384GB", "aws": "64GB", "gcp": "192GB"}'
-      run: |
-        set +e
-        docker buildx inspect "${GITHUB_ACTOR}"
-        if test x"$?" = x"0"; then
-          exit 0
-        fi
-
-        set -eux
-        reserved_space=$(echo -n "$reserved_space" | jq -r ".$runner")
-        max_used_space=$(echo -n "$max_used_space" | jq -r ".$runner")
-        cat <<EOF > ./buildkitd.toml
-        [system]
-          platformsCacheMaxAge = "504h"
-        [worker.oci]
-          enabled = true
-          rootless = false
-          gc = true
-          reservedSpace = "${reserved_space}"
-          maxUsedSpace = "${max_used_space}"
-        [[worker.oci.gcpolicy]]
-          reservedSpace = "${reserved_space}"
-          maxUsedSpace = "${max_used_space}"
-          filters = ["label!=cache==pin"]
-          all = true
-        EOF
-
-        docker buildx create \
-          --bootstrap \
-          --driver docker-container \
-          --buildkitd-config ./buildkitd.toml \
-          --name "${GITHUB_ACTOR}" \
-          --buildkitd-flags "--allow-insecure-entitlement network.host"
-
-    - if: >
-        !failure() && !cancelled()
-        && contains(github.ref, 'refs/tags/v')
-        && matrix.runner == 'het'
-
-      id: release
-      name: Create Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-      with:
-        release_name: Release ${{github.ref_name}}
-        tag_name: ${{github.ref}}
-        body_path: RELEASE.md
-        draft: ${{ contains(github.ref, '-draft') }}
-        prerelease: ${{ contains(github.ref, '-rc') }}
-
-  lint:
-    if: >
-      !failure() && !cancelled()
-      && !contains(github.ref, 'refs/tags/v')
-      && !contains(needs.init.outputs.head_msg, '[ci no lint]')
-      && !contains(needs.init.outputs.head_msg, '[ci only it]')
-
-    name: Lint
-    needs: [init] #needs: [init, deps]
-    uses: ./.github/workflows/lint.yml
-    with:
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"cargo_profile": "test", "feat_set": "logging"},
-          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "none"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "default"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "logging"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native", "feat_set": "none"},
-          {"cargo_profile": "release-native", "feat_set": "default"},
-          {"cargo_profile": "release-native", "feat_set": "logging"},
-          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
-          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu"},
-          {"sys_target": "x86_64-v3-linux-gnu"},
-          {"sys_target": "x86_64-v4-linux-gnu"},
-        ]
-
-  test:
-    if: >
-      !failure() && !cancelled()
-      && !contains(github.ref, 'refs/tags/v')
-      && !contains(needs.init.outputs.head_msg, '[ci no test]')
-
-    name: Test
-    needs: [init, lint]
-    uses: ./.github/workflows/test.yml
-    with:
-      head_msg: ${{needs.init.outputs.head_msg}}
-      build_nix: ${{fromJSON(needs.init.outputs.build_nix)}}
-      rust_sdk_integration: ${{fromJSON(needs.init.outputs.rust_sdk_integration)}}
-      complement: ${{fromJSON(needs.init.outputs.complement)}}
-      complement_runner: ${{needs.init.outputs.complement_runner}}
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"feat_set": "logging"},
-          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native", "feat_set": "none"},
-          {"cargo_profile": "release-native", "feat_set": "default"},
-          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
-          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
-        ]
-
-  package:
-    if: >
-      !failure() && !cancelled()
-      && needs.init.outputs.package
-      && !contains(needs.init.outputs.head_msg, '[ci only it]')
-      && !contains(needs.init.outputs.head_msg, '[ci no build]')
-      && !contains(needs.init.outputs.head_msg, '[ci no package]')
-
-    name: Package
-    needs: [init, test]
-    uses: ./.github/workflows/package.yml
-    with:
-      release_url: ${{needs.init.outputs.release_url}}
-      check_pkgs: ${{needs.init.outputs.check_pkgs}}
-      build_pkgs: ${{needs.init.outputs.build_pkgs}}
-      build_nix: ${{fromJSON(needs.init.outputs.build_nix)}}
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"feat_set": "none"},
-          {"cargo_profile": "test"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release-native"},
-          {"cargo_profile": "release-debuginfo", "feat_set": "default"},
-          {"cargo_profile": "release-debuginfo", "feat_set": "logging"},
-          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
-          {"cargo_profile": "release-debuginfo", "bake_target": "oci"},
-          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v4-linux-gnu"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "bake_target": "nix"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v2-linux-gnu", "bake_target": "nix"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "bake_target": "nix"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v4-linux-gnu", "bake_target": "nix"},
-        ]
-
-  publish:
-    if: >
-      !failure() && !cancelled()
-      && needs.init.outputs.publish
-      && !contains(needs.init.outputs.head_msg, '[ci only it]')
-      && !contains(needs.init.outputs.head_msg, '[ci no build]')
-      && !contains(needs.init.outputs.head_msg, '[ci no package]')
-      && !contains(needs.init.outputs.head_msg, '[ci no publish]')
-
-    name: Publish
-    needs: [init, test, package]
-    uses: ./.github/workflows/publish.yml
-    with:
-      docker_repo: ${{needs.init.outputs.docker_repo}}
-      release_url: ${{needs.init.outputs.release_url}}
-      pages_url: ${{needs.init.outputs.pages_url}}
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"feat_set": "none"},
-          {"feat_set": "default"},
-          {"cargo_profile": "test"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native"},
-          {"rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
-        ]
-
-    secrets:
-      ghcr_token: ${{ secrets.GHCR_TOKEN }}
-      dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/package.yml

@@ -1,213 +0,0 @@
-name: Package
-
-on:
-  workflow_call:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      release_url:
-        type: string
-        description: For release assets
-      build_pkgs:
-        type: string
-        default: 'true'
-      check_pkgs:
-        type: string
-        default: 'false'
-      build_nix:
-        type: string
-        default: 'true'
-
-jobs:
-  book:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["default"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Book
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["book"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["default"]'
-      rust_toolchains: '["stable"]'
-      rust_targets: ${{inputs.rust_targets}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      runner: 'het'
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "book": {
-            "dst": "book",
-            "src": "/book",
-            "pages": true
-          }
-        }
-
-  binary:
-    if: >
-      !failure() && !cancelled()
-
-    name: Binaries
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["static"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "static": {
-            "dst": "tuwunel.zst",
-            "src": "/usr/bin/tuwunel",
-            "mime": "application/zstd",
-            "zstd": 11,
-            "chmod": "a+x"
-          }
-        }
-
-  container:
-    if: >
-      !failure() && !cancelled()
-
-    name: Containers
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["docker", "oci"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "docker": {
-            "dst": "tuwunel-docker.tar.gz",
-            "img": true,
-            "mime": "application/gzip",
-            "gzip": 7
-          },
-          "oci": {
-            "dst": "tuwunel-oci.tar.zst",
-            "runner": true,
-            "mime": "application/zstd",
-            "zstd": 11
-          }
-        }
-
-  pkgs:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && fromJSON(inputs.build_pkgs)
-
-    name: Distro Packages
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["deb", "rpm", "nix"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["stable"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "deb": {
-            "dst": "tuwunel.deb",
-            "mime": "application/vnd.debian.binary-package"
-          },
-          "rpm": {
-            "dst": "tuwunel.rpm",
-            "mime": "application/x-rpm"
-          },
-          "nix": {
-            "dst": "tuwunel.drv.tar.zst",
-            "src": "/opt/tuwunel/tuwunel.drv",
-            "mime": "application/zstd",
-            "zstd": 6
-          }
-        }
-
-  check_pkgs:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && fromJSON(inputs.check_pkgs)
-
-    name: Check Packages
-    needs: [pkgs]
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["deb-install", "rpm-install"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["stable"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}

.github/workflows/publish.yml

@@ -1,328 +0,0 @@
-name: Publish
-
-on:
-  workflow_call:
-    secrets:
-      ghcr_token:
-      dockerhub_token:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      docker_repo:
-        type: string
-        description: DockerHub Repository
-      release_url:
-        type: string
-        description: For release assets
-      pages_url:
-        type: string
-        description: For pages deployment
-
-jobs:
-  documents:
-    if: >
-      !failure() && !cancelled()
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-      && !contains(github.ref, '-draft')
-
-    name: Documents
-    runs-on: ['X64', 'het']
-    permissions:
-      contents: read
-      id-token: write
-      pages: write
-
-    environment:
-      name: github-pages
-      url: ${{inputs.pages_url}}
-
-    steps:
-      - id: book
-        name: Book
-        uses: actions/deploy-pages@v4
-
-  containers:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && inputs.docker_repo != ''
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-    name: Containers
-    runs-on: ${{matrix.machine}}
-    permissions: write-all
-    strategy:
-      fail-fast: true
-      matrix:
-        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
-        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
-        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
-        feat_set: ${{fromJSON(inputs.feat_sets)}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: GitHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.ghcr_token }}
-
-      - name: DockerHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.dockerhub_token }}
-
-      - name: Bake
-        env:
-          bake_target: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          rust_toolchain: ${{matrix.rust_toolchain}}
-          rust_target: ${{matrix.rust_target}}
-          feat_set: ${{matrix.feat_set}}
-          sys_name: ${{matrix.sys_name}}
-          sys_version: ${{matrix.sys_version}}
-          sys_target: ${{matrix.sys_target}}
-          machine: ${{matrix.machine}}
-          acct: ${{github.actor}}
-          repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker/bake.sh "${{matrix.bake_target}}"
-
-  bundles:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && inputs.docker_repo != ''
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-    name: Bundles
-    needs: [containers]
-    runs-on: 'het'
-    permissions: write-all
-    strategy:
-      fail-fast: true
-      matrix:
-        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
-        cargo_profile: ${{fromJSON('["release"]')}}
-        feat_set: ${{fromJSON('["all"]')}}
-        rust_toolchain: ${{fromJSON('["stable"]')}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-
-    steps:
-      - name: GitHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.ghcr_token }}
-
-      - name: DockerHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.dockerhub_token }}
-
-      - name: Release Branch
-        if: >
-          !failure() && !cancelled()
-          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-        env:
-          acct: ${{github.actor}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-          registry: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          feat_set: ${{matrix.feat_set}}
-          sys_target: ${{matrix.sys_target}}
-          ref_name: ${{github.ref_name}}
-
-        run: |
-          registry="$(echo -n $registry | sed s/_/./)"
-          if test "$registry" = "ghcr.io"; then
-            repo="$ghcr_repo"
-          else
-            repo="$docker_repo"
-          fi
-
-          docker manifest create "${registry}/${repo}:${ref_name}" \
-            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
-
-      - name: Release Preview
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-
-        env:
-          acct: ${{github.actor}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-          registry: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          feat_set: ${{matrix.feat_set}}
-          sys_target: ${{matrix.sys_target}}
-          ref_name: ${{github.ref_name}}
-
-        run: |
-          registry="$(echo -n $registry | sed s/_/./)"
-          if test "$registry" = "ghcr.io"; then
-            repo="$ghcr_repo"
-          else
-            repo="$docker_repo"
-          fi
-
-          docker manifest create "${registry}/${repo}:preview" \
-            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
-
-      - name: Release Latest
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-          && !contains(github.ref, '-rc')
-
-        env:
-          acct: ${{github.actor}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-          registry: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          feat_set: ${{matrix.feat_set}}
-          sys_target: ${{matrix.sys_target}}
-          ref_name: ${{github.ref_name}}
-
-        run: |
-          registry="$(echo -n $registry | sed s/_/./)"
-          if test "$registry" = "ghcr.io"; then
-            repo="$ghcr_repo"
-          else
-            repo="$docker_repo"
-          fi
-
-          docker manifest create "${registry}/${repo}:latest" \
-            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
-
-  delivery:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && inputs.docker_repo != ''
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-    name: Delivery
-    needs: [bundles, documents]
-    runs-on: 'het'
-    permissions: write-all
-    steps:
-      - name: GitHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.ghcr_token }}
-
-      - name: DockerHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.dockerhub_token }}
-
-      - name: Push Branch
-        if: >
-          !failure() && !cancelled()
-          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-        env:
-          ref_name: ${{github.ref_name}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker manifest push -p "ghcr.io/${ghcr_repo}:${ref_name}"
-          docker manifest push -p "docker.io/${docker_repo}:${ref_name}"
-
-      - name: Push Preview
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-
-        env:
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker manifest push -p "ghcr.io/${ghcr_repo}:preview"
-          docker manifest push -p "docker.io/${docker_repo}:preview"
-
-      - name: Push Latest
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-          && !contains(github.ref, '-rc')
-
-        env:
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker manifest push -p "ghcr.io/${ghcr_repo}:latest"
-          docker manifest push -p "docker.io/${docker_repo}:latest"

.github/workflows/test.yml

@@ -1,396 +0,0 @@
-name: Testing
-
-on:
-  workflow_call:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      complement:
-        type: boolean
-        default: true
-      complement_feat_sets:
-        type: string
-        default: '["all"]'
-      complement_runner:
-        type: string
-      rust_sdk_integration:
-        type: boolean
-        default: true
-      build_nix:
-        type: boolean
-        default: true
-      head_msg:
-        type: string
-
-jobs:
-  docs:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Docs
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["docs"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  unit:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Unit
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["unit", "integration"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  bench:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
-
-    name: Bench
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["unit", "integration"]'
-      cargo_profiles: '["bench"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v3-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  valgrind:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
-
-    name: Memcheck
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["integration-valgrind"]'
-      cargo_profiles: '["bench"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v3-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  smoke:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci only it]')
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.cargo_profiles
-      && inputs.machines
-
-    name: Smoke
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["smoke", "smoke-valgrind"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      includes: ${{inputs.includes}}
-      excludes: >
-        [
-          {"cargo_profile": "test", "feat_set": "default"},
-          {"cargo_profile": "test", "feat_set": "logging"},
-          {"cargo_profile": "test", "feat_set": "none", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "test", "rust_toolchain": "stable"},
-          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "test", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly"},
-          {"cargo_profile": "release", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "release", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "release-debuginfo", "feat_set": "logging"},
-          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
-          {"cargo_profile": "release-debuginfo", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "release-debuginfo", "bake_target": "smoke"},
-          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
-          {"cargo_profile": "release-native", "feat_set": "none"},
-          {"cargo_profile": "release-native", "feat_set": "default"},
-          {"cargo_profile": "release-native", "feat_set": "logging"},
-          {"cargo_profile": "release-native", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-native", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "release-native", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "release-native", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "bake_target": "smoke-valgrind"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v4-linux-gnu", "bake_target": "smoke-valgrind"},
-        ]
-
-  nix:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci only it]')
-      && !contains(inputs.head_msg, '[ci no build]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-      && fromJSON(inputs.build_nix)
-
-    name: Smoke NixOS
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["smoke-nix"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["stable"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  matrix-rust-sdk-integration:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.rust_sdk_integration
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.rust_targets), fromJSON('["x86_64-unknown-linux-gnu"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Matrix SDK Integration
-    needs: [smoke]
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["matrix-rust-sdk-integration"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: '["x86_64-unknown-linux-gnu"]'
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: '["X64"]'
-      runner: ${{inputs.complement_runner}}
-      includes: ${{inputs.includes}}
-      artifact: >
-        {
-          "matrix-rust-sdk-integration": {
-            "src": "/var/log/tuwunel.log",
-            "dst": "matrix-rust-sdk-integration.tuwunel.log",
-          }
-        }
-      excludes: >
-        [
-          {"feat_set": "none"},
-          {"feat_set": "logging"},
-          {"cargo_profile": "release"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native"},
-        ]
-
-  complement:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.complement
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.complement_feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Complement
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["complement-tester", "complement-testee"]'
-      cargo_profiles: '["test"]'
-      feat_sets: ${{inputs.complement_feat_sets}}
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      runner: ${{inputs.complement_runner}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  compliance:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.complement
-      && inputs.machines
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Matrix Compliance
-    needs: [complement, smoke]
-    runs-on: ["${{matrix.machine}}", "${{inputs.complement_runner}}"]
-    concurrency:
-      group: complement-cant-walk-and-chew-bubblegum
-      cancel-in-progress: false
-
-    strategy:
-      fail-fast: false
-      matrix:
-        cargo_profile: ${{fromJSON('["test"]')}}
-        feat_set: ${{fromJSON(inputs.complement_feat_sets)}}
-        rust_toolchain: ${{fromJSON('["nightly"]')}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON('["x86_64-v1-linux-gnu"]')}}
-        machine: ${{fromJSON(inputs.machines)}}
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-
-    steps:
-    - uses: actions/checkout@v3
-    - name: Execute
-      id: execute
-      env:
-        cargo_profile: ${{matrix.cargo_profile}}
-        rust_toolchain: ${{matrix.rust_toolchain}}
-        rust_target: ${{matrix.rust_target}}
-        feat_set: ${{matrix.feat_set}}
-        sys_name: ${{matrix.sys_name}}
-        sys_target: ${{matrix.sys_target}}
-        sys_version: ${{matrix.sys_version}}
-        machine: ${{matrix.machine}}
-
-      run: |
-        docker/complement.sh
-
-    - if: success() || failure() && steps.execute.outcome == 'failure'
-      name: Extract
-      id: extract
-      env:
-        name: complement_tester__${{matrix.sys_name}}__${{matrix.sys_version}}__${{matrix.sys_target}}
-        tag: latest
-
-      run: |
-        cid=$(cat "$name")
-        docker cp "$cid:/usr/src/complement/new_results.jsonl" tests/complement/results.jsonl
-
-    - if: success() || failure() && steps.execute.outcome == 'failure'
-      name: Upload New Results
-      id: upload-result
-      uses: actions/upload-artifact@v4
-      with:
-        name: complement_results-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
-        path: ./tests/complement/results.jsonl
-
-    - if: failure() && steps.execute.outcome == 'failure'
-      name: Upload Failure Output
-      id: upload-output
-      uses: actions/upload-artifact@v4
-      with:
-        name: complement_output-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
-        path: ./complement.jsonl
-        if-no-files-found: ignore
-
-    - name: Accept
-      id: accept
-      run: |
-        git diff --exit-code --color --color-moved

.gitignore

@@ -1,104 +1,4 @@
-# Local environment overrides
-/.env
+node_modules
 
-# CMake
-cmake-build-*/
-
-# IntelliJ
-.idea/
-out/
-*.iml
-modules.xml
-*.ipr
-
-# mpeltonen/sbt-idea plugin
-.idea_modules/
-
-# Linux backup files
-*~
-
-# temporary files which can be created if a process still has a handle open of a deleted file
-.fuse_hidden*
-
-# KDE directory preferences
-.directory
-
-# Linux trash folder which might appear on any partition or disk
-.Trash-*
-
-# .nfs files are created when an open file is removed but is still being accessed
-.nfs*
-
-# Rust
-/target
-
-### vscode ###
-.vscode/*
-!.vscode/tasks.json
-!.vscode/launch.json
-!.vscode/extensions.json
-*.code-workspace
-
-### Windows ###
-# Windows thumbnail cache files
-Thumbs.db
-Thumbs.db:encryptable
-ehthumbs.db
-ehthumbs_vista.db
-
-# Dump file
-*.stackdump
-
-# Folder config file
-[Dd]esktop.ini
-
-# Recycle Bin used on file shares
-$RECYCLE.BIN/
-
-# Windows shortcuts
-*.lnk
-
-# Conduit
-conduit.toml
-conduit.db
-
-# Etc.
-**/*.rs.bk
-cached_target
-
-# Nix artifacts
-/result*
-
-# Direnv cache
-/.direnv
-
-test-conduit/
-test-conduit.toml
-
-# Gitlab CI cache
-/.gitlab-ci.d
-
-# mdbook output
-public/
-
-# macOS
-.DS_Store
-
-# VS Code
-.vscode/
-
-# Zed
-.zed/
-
-# idk where you're coming from, but i'm tired of you
-rustc-ice-*
-
-# complement test logs are huge
-tests/test_results/complement/test_logs.jsonl
-
-# cargo profiles from -Z self-profile
-*.mm_profdata
-
-# Editor crashfiles
-*.save
-*.swp
+servers/*.ign
+.parcel-cache

.gitlab/merge_request_templates/MR.md

@@ -1,8 +0,0 @@
-
-<!-- Please describe your changes here -->
-
------------------------------------------------------------------------------
-
-- [ ] I ran `cargo fmt`, `cargo clippy`, and `cargo test`
-- [ ] I agree to release my code and all other changes of this MR under the Apache-2.0 license
-

.gitlab/route-map.yml

@@ -1,3 +0,0 @@
-# Docs: Map markdown to html files
-- source: /docs/(.+)\.md/
-  public: '\1.html'

.markdownlintignore

@@ -1 +0,0 @@
-.gitignore

.typos.toml

@@ -1,6 +0,0 @@
-[default.extend-words]
-"allocatedp" = "allocatedp"
-"conduwuit" = "conduwuit"
-"execuse" = "execuse"
-"leafs" = "leafs"
-"serialize" = "serialize"

CODE_OF_CONDUCT.md

@@ -1,132 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, caste, color, religion, or sexual
-identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people.
-* Being respectful of differing opinions, viewpoints, and experiences.
-* Giving and gracefully accepting constructive feedback.
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience.
-* Focusing on what is best not just for us as individuals, but for the overall
-  community.
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or advances of
-  any kind.
-* Trolling, insulting or derogatory comments, and personal or political attacks.
-* Public or private harassment.
-* Publishing others' private information, such as a physical or email address,
-  without their explicit permission.
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting.
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement over email at
-<abuse@tuwunel.chat> or over Matrix at @abuse:tuwunel.chat.
-
-All complaints will be reviewed and investigated promptly and fairly. All
-community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series of
-actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or permanent
-ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within the
-community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.1, available at
-[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
-
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
-
-For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
-[https://www.contributor-covenant.org/translations][translations].
-
-[homepage]: https://www.contributor-covenant.org
-[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
-[Mozilla CoC]: https://github.com/mozilla/diversity
-[FAQ]: https://www.contributor-covenant.org/faq
-[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -1,125 +0,0 @@
-# Contributing guide
-
-This page is for about contributing to Tuwunel. The
-[development](./development.md) page may be of interest for you as well.
-
-If you would like to work on an [issue][issues] that is not assigned, preferably
-ask in the Matrix room first at [#tuwunel:tuwunel.chat][tuwunel-chat],
-and comment on it.
-
-### Linting and Formatting
-
-It is mandatory all your changes satisfy the lints (clippy, rustc, rustdoc, etc)
-and your code is formatted via the **nightly** `cargo fmt`. A lot of the
-`rustfmt.toml` features depend on nightly toolchain. It would be ideal if they
-weren't nightly-exclusive features, but they currently still are. CI's rustfmt
-uses nightly.
-
-If you need to allow a lint, please make sure it's either obvious as to why
-(e.g. clippy saying redundant clone but it's actually required) or it has a
-comment saying why. Do not write inefficient code for the sake of satisfying
-lints. If a lint is wrong and provides a more inefficient solution or
-suggestion, allow the lint and mention that in a comment.
-
-### Running CI tests locally
-
-<sub>TODO: docker bake matrix</sub>
-
-### Matrix tests
-
-CI runs [Complement][complement], but currently does not fail if results from
-the checked-in results differ with the new results. If your changes are done to
-fix Matrix tests, note that in your pull request. If more Complement tests start
-failing from your changes, please review the logs (they are uploaded as
-artifacts) and determine if they're intended or not.
-
-If you'd like to run Complement locally using Nix, see the
-[testing](development/testing.md) page.
-
-[Sytest][sytest] support will come soon.
-
-### Writing documentation
-
-Tuwunel's website uses [`mdbook`][mdbook] and deployed via CI using GitHub
-Pages in the [`documentation.yml`][documentation.yml] workflow file with Nix's
-mdbook in the devshell. All documentation is in the `docs/` directory at the top
-level. The compiled mdbook website is also uploaded as an artifact.
-
-To build the documentation using Nix, run: `bin/nix-build-and-cache just .#book`
-
-The output of the mdbook generation is in `result/`. mdbooks can be opened in
-your browser from the individual HTML files without any web server needed.
-
-### Inclusivity and Diversity
-
-All **MUST** code and write with inclusivity and diversity in mind. See the
-[following page by Google on writing inclusive code and
-documentation](https://developers.google.com/style/inclusive-documentation).
-
-This **EXPLICITLY** forbids usage of terms like "blacklist"/"whitelist" and
-"master"/"slave", [forbids gender-specific words and
-phrases](https://developers.google.com/style/pronouns#gender-neutral-pronouns),
-forbids ableist language like "sanity-check", "cripple", or "insane", and
-forbids culture-specific language (e.g. US-only holidays or cultures).
-
-No exceptions are allowed. Dependencies that may use these terms are allowed but
-[do not replicate the name in your functions or
-variables](https://developers.google.com/style/inclusive-documentation#write-around).
-
-In addition to language, write and code with the user experience in mind. This
-is software that intends to be used by everyone, so make it easy and comfortable
-for everyone to use. 🏳️‍⚧️
-
-### Variable, comment, function, etc standards
-
-Rust's default style and standards with regards to [function names, variable
-names, comments](https://rust-lang.github.io/api-guidelines/naming.html), etc
-applies here.
-
-### Creating pull requests
-
-Please try to keep contributions to the GitHub. While the mirrors of Tuwunel
-allow for pull/merge requests, there is no guarantee I will see them in a timely
-manner. Additionally, please mark WIP or unfinished or incomplete PRs as drafts.
-This prevents me from having to ping once in a while to double check the status
-of it, especially when the CI completed successfully and everything so it
-*looks* done.
-
-If you open a pull request on one of the mirrors, it is your responsibility to
-inform me about its existence. In the future I may try to solve this with more
-repo bots in the Tuwunel Matrix room. There is no mailing list or email-patch
-support on the sr.ht mirror, but if you'd like to email me a git patch you can
-do so at `maintainer@tuwunel.chat`.
-
-Direct all PRs/MRs to the `main` branch.
-
-By sending a pull request or patch, you are agreeing that your changes are
-allowed to be licenced under the Apache-2.0 licence and all of your conduct is
-in line with the Contributor's Covenant, and Tuwunel's Code of Conduct.
-
-Contribution by users who violate either of these code of conducts will not have
-their contributions accepted. This includes users who have been banned from
-Tuwunel Matrix rooms for Code of Conduct violations.
-
-### Branch Policy
-
-##### This section applies to Matrix-Construct members and Tuwunel maintainers
-
-All branches on the matrix-construct/tuwunel repository are _centrally
-maintained_. They may be rebased without your consent. Trivial conflicts may be
-resolved by another maintainer. Please resolve more difficult conflicts as soon
-as possible. Personal forks are advised to reduce the workload on other
-maintainers. Stale branches will be deleted to reduce the effort for this
-policy.
-
-[issues]: https://github.com/matrix-construct/tuwunel/issues
-[tuwunel-chat]: https://matrix.to/#/#tuwunel:tuwunel.chat
-[complement]: https://github.com/matrix-org/complement/
-[sytest]: https://github.com/matrix-org/sytest/
-[cargo-deb]: https://github.com/kornelski/cargo-deb
-[lychee]: https://github.com/lycheeverse/lychee
-[markdownlint-cli]: https://github.com/igorshubovych/markdownlint-cli
-[cargo-audit]: https://github.com/RustSec/rustsec/tree/main/cargo-audit
-[direnv]: https://direnv.net/
-[mdbook]: https://rust-lang.github.io/mdBook/
-[documentation.yml]: https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/docs.yml

LICENSE

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2023 June
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

README.md

@@ -1,157 +0,0 @@
-# Tuwunel<sup>💕</sup>
-
-![GitHub License](https://img.shields.io/github/license/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
-![GitHub Created At](https://img.shields.io/github/created-at/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
-![GitHub Commit Activity](https://img.shields.io/github/commit-activity/m/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel%2Fpulse%2Fmonthly&color=%238A2BE2)
-![Docker Pulls](https://img.shields.io/docker/pulls/jevolk/tuwunel?style=flat&color=8A2BE2)
-![GitHub Repo Stars](https://img.shields.io/github/stars/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel&color=%238A2BE2)
-[![CI/CD](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml/badge.svg?branch=main&style=flat)](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml)
-
-<!-- ANCHOR: catchphrase -->
-
-## High Performance Matrix Homeserver in Rust!
-
-<!-- ANCHOR_END: catchphrase -->
-
-<!-- ANCHOR: body -->
-
-Tuwunel is a featureful [Matrix](https://matrix.org/) homeserver you can use instead of Synapse
-with your favorite [client](https://matrix.org/ecosystem/clients/),
-[bridge](https://matrix.org/ecosystem/bridges/) or
-[bot](https://matrix.org/ecosystem/integrations/). It is written entirely in Rust to be a scalable,
-lightweight, low-cost, community-driven alternative covering all but the most niche uses.
-
-This project is the official successor to conduwuit, which
-was a featureful and high-performance fork of [Conduit](https://gitlab.com/famedly/conduit), all
-community-lead homeservers implementing the compatible
-[Matrix Specification](https://spec.matrix.org/latest/).
-
-Tuwunel is operated by enterprise users with a vested interest in sponsoring its continued
-development. It is now maintained by full-time staff.
-
-### Getting Started
-
-- [GitHub Releases](https://github.com/matrix-construct/tuwunel/releases)
-- [Sourcecode](https://github.com/matrix-construct/tuwunel/) `git clone https://github.com/matrix-construct/tuwunel.git`
-- [DockerHub](https://hub.docker.com/r/jevolk/tuwunel) or `docker pull jevolk/tuwunel:latest`
-- [GHCR](https://github.com/matrix-construct/tuwunel/pkgs/container/tuwunel) or `docker pull ghcr.io/matrix-construct/tuwunel:latest`
-- Static binaries available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
-- Deb and RPM packages available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
-- Arch package available as [tuwunel](https://aur.archlinux.org/packages/tuwunel) or [tuwunel-git](https://aur.archlinux.org/packages/tuwunel-git).
-- Nix package still [needs some love](https://github.com/NixOS/nixpkgs/issues/415469).
-
-**1.** [Configure](https://matrix-construct.github.io/tuwunel/configuration.html) by
-copying and editing the `tuwunel-example.toml`. The `server_name` and `database_path` must be
-configured. **Most users deploy via docker or a distribution package and should follow the
-[appropriate guide](https://matrix-construct.github.io/tuwunel/deploying.html) instead.**
-This is just a summary for the impatient. See the full
-[documentation](https://matrix-construct.github.io/tuwunel/).
-
-> [!TIP]
-> Avoid using a sub-domain for your `server_name`. You can always delegate later with a [`.well-known`](https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-well-known.md)
-> file, but you can never change your `server_name`.
-
-**2.** Setup TLS certificates. Most users enjoy the [Caddy](https://caddyserver.com/) reverse-proxy
-which automates their certificate renewal. Advanced users can load their own TLS certificates
-using the configuration and Tuwunel can be deployed without a reverse proxy. Example
-`/etc/caddy/Caddyfile` configuration with [Element](https://github.com/element-hq/element-web/releases)
-unzipped to `/var/www/element`:
-```
-tuwunel.me, tuwunel.me:8448 {
-    reverse_proxy localhost:8008
-}
-web.tuwunel.me {
-    root * /var/www/element/
-    file_server
-}
-```
-`caddy reload --config /etc/caddy/Caddyfile`
-
-**3.** Start the server, connect your client and register your username. The first registration is
-granted server admin.
-
-> [!TIP]
-> Configure a secret `registration_token` and set `allow_registration = true`
-
- 🤗 Did you find this and other documentation helpful? We would love to hear feedback about setting
- up Tuwunel.
-
-
-### Migrating to Tuwunel
-
-| Can I migrate from | |
-|-----------------|-----------|
-| conduwuit? | ✅ Yes. This will be supported at a minimum for one year, but likely indefinitely. |
-| Synapse? | ❌ Not yet, but this is planned and an important issue. Subscribe to [#2](https://github.com/matrix-construct/tuwunel/issues/2). |
-| Conduit? | ❌ Not right now, but this is planned for the near future. Subscribe to [#41](https://github.com/matrix-construct/tuwunel/issues/41). |
-| Any other fork of Conduit? | ❌ No. The migration must be explicitly listed in this table. |
-> [!CAUTION]
-> **Never switch between different forks of Conduit or you will corrupt your database.**
-> All derivatives of Conduit share the same linear database version without any awareness of other
-> forks. The database will permanently corrupt and we will not be able to help you.
-
-#### Migrating from conduwuit
-
-Migrating from conduwuit to Tuwunel _just works_. In technical parlance it is a "binary swap."
-All you have to do is update to the latest Tuwunel and change the path to the executable from
-`conduwuit` to `tuwunel`.
-
-Anything else named "conduwuit" is still recognized, this includes environment variables with prefixes
-such as `CONDUWUIT_`. In fact, `CONDUIT_` is still recognized for our legacy users. You may have
-noticed that various configs, yamls, services, users, and other items were renamed, but if you
-were a conduwuit user we recommend against changing anything at all. This will keep things simple.
-If you are not sure please ask. If you found out that something did in fact need to be changed
-please open an issue immediately.
-
-
-### Upgrading & Downgrading Tuwunel
-
-We strive to make moving between versions of Tuwunel safe and easy. Downgrading Tuwunel is always
-safe but often prevented by a guard. An error will indicate the downgrade is not possible and a
-newer version which does not error must be sought.
-
-#### Branches
-
-The main branch is always _reasonably safe_ to run. We understand the propensity for users to simply clone
-the main branch to get up and running, and we're obliged to ensure it's always viable. Nevertheless, only
-tagged releases are true releases.
-
-#### Container Tracking
-
-> [!IMPORTANT]
-> **We strongly advise tracking the `:latest` tag when automatically updating.**
-
-Tracking `:latest` gives us the necessary discretion to keep you on the appropriate stable version.
-We discourage tracking the main branch unless frequent restarts are acceptable. Alternatively,
-tracking the `:preview` tag provides the latest release-candidate becoming equivalent to `:latest`
-after a release. Tracking the `:preview` tag is a worthy alternative to the main branch, with
-turbulence limited to release-time.
-
-### Getting Help & Support
-
-If you are opposed to using github, or if private discussion is required such as for security
-disclosures, or for any other reason, I would be happy to receive your DM at
-[@jason:tuwunel.me](https://matrix.to/#/@jason:tuwunel.me). This will not be bothering me as it would
-be my pleasure to help you when possible. As an emergency contact you can send an email to
-jasonzemos@gmail.com.
-
-##### Tuwunel Fanclub
-
-We have an unofficial community-run chat which is publicly accessible at
-[#tuwunel:matrix.org](https://matrix.to/#/#tuwunel:matrix.org). The members, content, or moderation
-decisions of this room are not in any way related or endorsed by this project or its sponsors,
-and not all project staff will be present there. There will be at least some presence by staff to
-offer assistance so long as the room remains in minimally good standing.
-
-
-## Tuwunel<sup>💕</sup>
-
-Tuwunel's theme is **empathy** in communication defined by the works of
-[Edith Stein](https://plato.stanford.edu/entries/stein/). Empathy is the basis for how we approach
-every message and our responsibility to the other in every conversation.
-
-<!-- ANCHOR_END: body -->
-
-<!-- ANCHOR: footer -->
-
-<!-- ANCHOR_END: footer -->

RELEASE.md

@@ -1,9 +0,0 @@
-# Tuwunel 1.4.5
-
-October 24, 2025
-
-All deployments serving ElementX, Element Pro, SchildiChat Next, or any client using sliding-sync should upgrade to this patch for an improved experience.
-
-### Bug Fixes
-
-- Progress made for sliding-sync in 1.4.3 was effectively reverted by 1.4.4. This release puts sliding-sync back on track with further progress exceeding 1.4.3. This release is now shipping without any known issues. Please report all issues. **IMPORTANT:** Issues from prior releases (such as stuck or incorrect unread counts) benefit from clearing the app's cache to immediately resolve. Go to settings, tap the version number 7 times, then enter the menu to select `clear cache`.

arch/tuwunel.service

@@ -1,79 +0,0 @@
-[Unit]
-Description=Tuwunel Matrix homeserver
-Wants=network-online.target
-After=network-online.target
-Documentation=https://tuwunel.chat/
-RequiresMountsFor=/var/lib/private/tuwunel
-
-[Service]
-DynamicUser=yes
-Type=notify-reload
-ReloadSignal=SIGUSR1
-
-TTYPath=/dev/tty25
-DeviceAllow=char-tty
-StandardInput=tty-force
-StandardOutput=tty
-StandardError=journal+console
-TTYReset=yes
-# uncomment to allow buffer to be cleared every restart
-TTYVTDisallocate=no
-
-TTYColumns=120
-TTYRows=40
-
-AmbientCapabilities=
-CapabilityBoundingSet=
-
-DevicePolicy=closed
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-NoNewPrivileges=yes
-#ProcSubset=pid
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=yes
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectProc=invisible
-ProtectSystem=strict
-PrivateDevices=yes
-PrivateMounts=yes
-PrivateTmp=yes
-PrivateUsers=yes
-PrivateIPC=yes
-RemoveIPC=yes
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native
-SystemCallFilter=@system-service @resources
-SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
-SystemCallErrorNumber=EPERM
-StateDirectory=tuwunel
-
-RuntimeDirectory=tuwunel
-RuntimeDirectoryMode=0750
-
-Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
-BindPaths=/var/lib/private/tuwunel:/var/lib/conduwuit
-BindPaths=/var/lib/private/tuwunel:/var/lib/private/conduwuit
-BindPaths=/var/lib/private/tuwunel:/var/lib/matrix-conduit
-BindPaths=/var/lib/private/tuwunel:/var/lib/private/matrix-conduit
-
-ExecStart=/usr/bin/tuwunel
-Restart=on-failure
-RestartSec=5
-
-TimeoutStopSec=4m
-TimeoutStartSec=4m
-
-StartLimitInterval=1m
-StartLimitBurst=5
-
-[Install]
-WantedBy=multi-user.target
-Alias=matrix-tuwunel.service

book.toml

@@ -1,30 +0,0 @@
-[book]
-authors = [
-	"girlbossceo",
-	"jevolk"
-]
-description = "Tuwunel, a high performance successor to Conduit and Conduwuit"
-language = "en"
-multilingual = false
-src = "docs"
-title = "Tuwunel One"
-text-direction = "ltr"
-
-[build]
-build-dir = "public"
-create-missing = true
-extra-watch-dirs = [
-	"debian",
-	"docs",
-]
-
-[rust]
-edition = "2024"
-
-[output.html]
-git-repository-url = "https://github.com/matrix-construct/tuwunel"
-edit-url-template = "https://github.com/matrix-construct/tuwunel/edit/main/{path}"
-git-repository-icon = "fa-github-square"
-
-[output.html.search]
-limit-results = 15

clippy.toml

@@ -1,20 +0,0 @@
-array-size-threshold = 4096
-cognitive-complexity-threshold = 100        # TODO reduce me ALARA
-excessive-nesting-threshold = 8
-future-size-threshold = 8192
-stack-size-threshold = 196608               # TODO reduce me ALARA
-too-many-lines-threshold = 780              # TODO reduce me to <= 100
-type-complexity-threshold = 250             # reduce me to ~200
-large-error-threshold = 256                 # TODO reduce me ALARA
-
-#disallowed-macros = [
-#	{ path = "log::error", reason = "use tuwunel_core::error" },
-#	{ path = "log::warn", reason = "use tuwunel_core::warn" },
-#	{ path = "log::info", reason = "use tuwunel_core::info" },
-#	{ path = "log::debug", reason = "use tuwunel_core::debug" },
-#	{ path = "log::trace", reason = "use tuwunel_core::trace" },
-#]
-
-#disallowed-methods = [
-#	{ path = "tokio::spawn", reason = "use and pass tuwunel_core::server::Server::runtime() to spawn from" },
-#]

compose.yml

@@ -0,0 +1,114 @@
+# podman save --format oci-archive jade-website-frontend:latest | gzip | ssh core@176.126.240.240 -T "zcat | podman load"
+# podman compose create
+# let containers = podman ps -a --format json | from json | where Labels."com.docker.compose.project" == "jade-website"
+
+# podman compose create; let containers = podman ps -a --format json | from json | where Labels."com.docker.compose.project" == "jade-website"; podman kube generate ($containers | get Id) | save deployment.yml
+# echo deployment.yml | ssh core@176.126.240.240 -T "cat > deployment.yml"
+#  $containers.1.Labels | to yaml
+
+# podman kube generate -s ($containers | get Id) --podman-only | ssh core@176.126.240.240 -T "cat > deployment.yml"
+
+
+version: '2'
+services:
+  jade-website-frontend:
+    image: jade-website-frontend:latest
+    build:
+      context: .
+      dockerfile: packages/website/Dockerfile
+    restart: unless-stopped
+    # ports:
+      # - 3000:3000
+    networks:
+        - proxy
+    # deploy:
+      
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"  # Change this to the name of your Traefik docker proxy network
+
+      # - "traefik.http.routers.to-website.rule=Host(`jade.ellis.link`)"
+      # - "traefik.http.routers.to-website.entrypoints=http"
+      - "traefik.http.routers.to-website.rule=Host(`jade.ellis.link.localhost`)"
+      - "traefik.http.routers.to-website.entrypoints=http"
+      # - "traefik.http.routers.to-website.tls=true"
+      # - "traefik.http.routers.to-website.tls.certresolver=letsencrypt"
+      # - "traefik.http.routers.to-website.middlewares=cors-headers@docker"
+
+      # - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
+      # - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
+      # - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"
+
+
+  traefik:
+    image: "traefik:latest"
+    container_name: "traefik"
+    restart: "unless-stopped"
+    # privileged: true
+    security_opt:
+      - "label=type:container_runtime_t"
+    command: 
+      - "--log.level=DEBUG"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.http.address=:8080"
+      # - "--entrypoints.https.address=:443"
+      # - "--acme"
+      # - "--certificatesresolvers.letsencrypt.acme.email='jade@ellis.link'"
+      # - "--certificatesresolvers.letsencrypt.acme.storage=/certificates/acme.json"
+
+      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      # - "--certificatesresolvers.letsencrypt.acme.httpChallenge.entryPoint=http"
+      # - "--certificatesresolvers.lets-encrypt.acme.tlschallenge=true"
+
+      # - "--entrypoints.http.http.redirections.entryPoint.to=https" 
+      # - "--entrypoints.http.http.redirections.entryPoint.scheme=https"
+      
+      # - --api.dashboard=true 
+      # - --api.insecure=true 
+    ports:
+      # - "80:80"
+      # - "443:443"
+      - "8080:8080"
+    volumes:
+      - "/run/user/1000/podman/podman.sock:/var/run/docker.sock"
+      # - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "traefik-public-certificates:/certificates"
+      # - "./traefik_config:/etc/traefik"
+    # labels:
+      # - "traefik.enable=true"
+
+      # # middleware redirect
+      # - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      # # global redirect to https
+      # - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
+      # - "traefik.http.routers.redirs.entrypoints=http"
+      # - "traefik.http.routers.redirs.middlewares=redirect-to-https"
+
+    networks:
+      - proxy
+
+networks:
+    proxy:
+      # external: true
+      enable_ipv6: true
+
+      
+
+
+volumes:
+  traefik-public-certificates:
+# mkdir -p ~/.config/containers/systemd
+#  nano  ~/.config/containers/systemd/deployment.kube
+
+# [Unit]
+# Description=Deployment via kubernetes
+# Before=local-fs.target
+# [Kube]
+# Yaml=/var/home/core/deployment.yml
+# [Install]
+# # Start by default on boot
+# WantedBy=multi-user.target default.target
+
+# systemctl --user daemon-reload
+# systemctl --user start deployment.service

debian/README.md

@@ -1,36 +0,0 @@
-# Tuwunel for Debian
-
-Information about downloading and deploying the Debian package. This may also be
-referenced for other `apt`-based distros such as Ubuntu.
-
-### Installation
-
-It is recommended to see the [generic deployment guide](../deploying/generic.md)
-for further information if needed as usage of the Debian package is generally
-related.
-
-No `apt` repository is currently offered yet, it is in the works/development.
-
-### Configuration
-
-When installed, the example config is placed at `/etc/tuwunel/tuwunel.toml`
-as the default config. The config mentions things required to be changed before
-starting.
-
-You can tweak more detailed settings by uncommenting and setting the config
-options in `/etc/tuwunel/tuwunel.toml`.
-
-### Running
-
-The package uses the [`tuwunel.service`](../configuration/examples.md#example-systemd-unit-file)
-systemd unit file to start and stop Tuwunel. The binary is installed at `/usr/sbin/tuwunel`.
-
-This package assumes by default that Tuwunel will be placed behind a reverse
-proxy. The default config options apply (listening on `localhost` and TCP port
-`6167`). Matrix federation requires a valid domain name and TLS, so you will
-need to set up TLS certificates and renewal for it to work properly if you
-intend to federate.
-
-Consult various online documentation and guides on setting up a reverse proxy
-and TLS. Caddy is documented at the [generic deployment guide](../deploying/generic.md#setting-up-the-reverse-proxy)
-as it's the easiest and most user friendly.

debian/config

@@ -1,18 +0,0 @@
-#!/bin/sh
-set -e
-
-# TODO: implement debconf support that is maintainable without duplicating the config
-# Source debconf library.
-#. /usr/share/debconf/confmodule
-#
-## Ask for the Matrix homeserver name, address and port.
-#db_input high tuwunel/hostname || true
-#db_go
-#
-#db_input low tuwunel/address || true
-#db_go
-#
-#db_input medium tuwunel/port || true
-#db_go
-
-exit 0

debian/postinst

@@ -1,47 +0,0 @@
-#!/bin/sh
-set -e
-
-# TODO: implement debconf support that is maintainable without duplicating the config
-#. /usr/share/debconf/confmodule
-
-TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
-TUWUNEL_CONFIG_PATH=/etc/tuwunel
-
-case "$1" in
-  configure)
-    # Create the `tuwunel` user if it does not exist yet.
-    if ! getent passwd tuwunel > /dev/null ; then
-      echo 'Adding system user for the tuwunel Matrix homeserver' 1>&2
-      adduser --system --group --quiet \
-        --home "$TUWUNEL_DATABASE_PATH" \
-        --disabled-login \
-        --shell "/usr/sbin/nologin" \
-        tuwunel
-    fi
-
-    # Create the database path if it does not exist yet and fix up ownership
-    # and permissions for the config.
-    mkdir -v -p "$TUWUNEL_DATABASE_PATH"
-
-    # symlink the previous location for compatibility if it does not exist yet.
-    if ! test -L "/var/lib/matrix-conduit" ; then
-        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/matrix-conduit"
-    fi
-    if ! test -L "/var/lib/conduwuit" ; then
-        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/conduwuit"
-    fi
-
-    chown -v tuwunel:tuwunel -R "$TUWUNEL_DATABASE_PATH"
-    chown -v tuwunel:tuwunel -R "$TUWUNEL_CONFIG_PATH"
-
-    chmod -v 740 "$TUWUNEL_DATABASE_PATH"
-
-    echo ''
-    echo 'Make sure you edit the example config at /etc/tuwunel/tuwunel.toml before starting!'
-    echo 'To start the server, run: systemctl start tuwunel.service'
-    echo ''
-
-    ;;
-esac
-
-#DEBHELPER#

debian/postrm

@@ -1,52 +0,0 @@
-#!/bin/sh
-set -e
-
-#. /usr/share/debconf/confmodule
-
-TUWUNEL_CONFIG_PATH=/etc/tuwunel
-TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
-CONDUIT_DATABASE_PATH_SYMLINK=/var/lib/matrix-conduit
-CONDUWUIT_DATABASE_PATH_SYMLINK=/var/lib/conduwuit
-
-case $1 in
-  purge)
-    # Remove debconf changes from the db
-    #db_purge
-
-    # Per https://www.debian.org/doc/debian-policy/ch-files.html#behavior
-    # "configuration files must be preserved when the package is removed, and
-    #  only deleted when the package is purged."
-
-    #
-
-    if [ -d "$TUWUNEL_CONFIG_PATH" ]; then
-      if test -L "$TUWUNEL_CONFIG_PATH"; then
-        echo "Deleting tuwunel configuration files"
-        rm -v -r "$TUWUNEL_CONFIG_PATH"
-      fi
-    fi
-
-    if [ -d "$TUWUNEL_DATABASE_PATH" ]; then
-      if test -L "$TUWUNEL_DATABASE_PATH"; then
-        echo "Deleting tuwunel database directory"
-        rm -r "$TUWUNEL_DATABASE_PATH"
-      fi
-    fi
-
-    if [ -d "$CONDUIT_DATABASE_PATH_SYMLINK" ]; then
-      if test -L "$CONDUIT_DATABASE_SYMLINK"; then
-        echo "Removing matrix-conduit symlink"
-        rm -r "$CONDUIT_DATABASE_PATH_SYMLINK"
-      fi
-    fi
-
-    if [ -d "$CONDUWUIT_DATABASE_PATH_SYMLINK" ]; then
-      if test -L "$CONDUWUIT_DATABASE_SYMLINK"; then
-        echo "Removing conduwuit symlink"
-        rm -r "$CONDUWUIT_DATABASE_PATH_SYMLINK"
-      fi
-    fi
-    ;;
-esac
-
-#DEBHELPER#

debian/tuwunel.service

@@ -1,66 +0,0 @@
-[Unit]
-Description=Tuwunel Matrix homeserver
-Wants=network-online.target
-After=network-online.target
-Documentation=https://tuwunel.chat/
-
-[Service]
-DynamicUser=yes
-User=tuwunel
-Group=tuwunel
-Type=notify
-
-Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
-
-ExecStart=/usr/sbin/tuwunel
-
-ReadWritePaths=/var/lib/tuwunel /etc/tuwunel
-
-AmbientCapabilities=
-CapabilityBoundingSet=
-
-DevicePolicy=closed
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-NoNewPrivileges=yes
-#ProcSubset=pid
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=yes
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectProc=invisible
-ProtectSystem=strict
-PrivateDevices=yes
-PrivateMounts=yes
-PrivateTmp=yes
-PrivateUsers=yes
-PrivateIPC=yes
-RemoveIPC=yes
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native
-SystemCallFilter=@system-service @resources
-SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
-SystemCallErrorNumber=EPERM
-#StateDirectory=tuwunel
-
-RuntimeDirectory=tuwunel
-RuntimeDirectoryMode=0750
-
-Restart=on-failure
-RestartSec=5
-
-TimeoutStopSec=2m
-TimeoutStartSec=2m
-
-StartLimitInterval=1m
-StartLimitBurst=5
-
-[Install]
-WantedBy=multi-user.target
-Alias=matrix-tuwunel.service

default.nix

@@ -1,10 +0,0 @@
-(import
-  (
-    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
-    fetchTarball {
-      url = lock.nodes.flake-compat.locked.url or "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-      sha256 = lock.nodes.flake-compat.locked.narHash;
-    }
-  )
-  { src = ./.; }
-).defaultNix

deploy_website.nu

@@ -0,0 +1,2 @@
+podman build . -f packages/website/Dockerfile  -t jade-website-frontend:latest;
+podman save --format oci-archive jade-website-frontend:latest | gzip | ssh fedora@213.32.25.24 -T "sudo sh -c ' zcat > /opt/images/jade-website-frontend'"

development.md

@@ -1 +0,0 @@
-docs/development.md

docker/Dockerfile.cargo

@@ -1,102 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS cargo
-ARG sys_triple
-ARG rust_target
-ARG rust_toolchain
-ARG RUST_HOME
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG CARGO_TERM_VERBOSE=0
-ARG RUST_BACKTRACE
-ARG JEMALLOC_OVERRIDE
-ARG ROCKSDB_LIB_DIR
-ARG VALGRINDFLAGS=""
-ARG CARGO_BUILD_RUSTFLAGS
-ARG CARGO_PROFILE_TEST_DEBUG
-ARG CARGO_PROFILE_TEST_INCREMENTAL
-ARG CARGO_PROFILE_BENCH_DEBUG
-ARG CARGO_PROFILE_BENCH_LTO
-ARG CARGO_PROFILE_RELEASE_LTO
-ARG CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG
-ARG CARGO_PROFILE_RELEASE_DEBUGINFO_LTO
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG cargo_cmd
-ARG color_args="--color always"
-ARG recipe_args=""
-ARG cargo_args=""
-ARG git_checkout
-
-WORKDIR /
-COPY --link --from=input . .
-COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
-COPY --link --from=deps /usr/src/tuwunel /usr/src/tuwunel
-
-WORKDIR /usr/lib/${sys_triple}
-COPY --link --from=rocksdb . .
-
-WORKDIR /usr/src/tuwunel
-ENV PATH="${CARGO_HOME}/bin:$PATH"
-ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
-ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
-ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
-ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
-ENV VALGRINDFLAGS="${VALGRINDFLAGS}"
-ENV CARGO_PROFILE_TEST_DEBUG="${CARGO_PROFILE_TEST_DEBUG}"
-ENV CARGO_PROFILE_TEST_INCREMENTAL="${CARGO_PROFILE_TEST_INCREMENTAL}"
-ENV CARGO_PROFILE_BENCH_DEBUG="${CARGO_PROFILE_BENCH_DEBUG}"
-ENV CARGO_PROFILE_BENCH_LTO="${CARGO_PROFILE_BENCH_LTO}"
-ENV CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO}"
-ENV CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG="${CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG}"
-ENV CARGO_PROFILE_RELEASE_DEBUGINFO_LTO="${CARGO_PROFILE_RELEASE_DEBUGINFO_LTO}"
-ENV CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}"
-ENV CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
-ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-    set -eux
-    ulimit -n 65535
-    rustup run ${rust_toolchain} \
-        cargo ${cargo_cmd} \
-            --verbose \
-            --locked \
-            --workspace \
-            "${cargo_spec_features}" \
-            "--features=${cargo_features}" \
-            "--profile=${cargo_profile}" \
-            "--target=${CARGO_TARGET}" \
-            "--target-dir=${CARGO_TARGET_DIR}" \
-            "--manifest-path=Cargo.toml" \
-            ${recipe_args} \
-            ${color_args} \
-            ${cargo_args}
-
-    # If this image is further reused with other cargo commands, all
-    # modifications made by cargo chef cook outside of target-dir have to be
-    # cleared. If not, resulting build artifacts will link incorrectly, even
-    # without error. For example, a target executable may be produced which
-    # does nothing except exit(0). If you have observed a smoketest failing in
-    # such a manner, investigate this as a cause of the issue.
-    git restore -W -S --source=${git_checkout} .
-EOF

docker/Dockerfile.cargo.audit

@@ -1,28 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS audit
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG audit_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        cargo audit \
-            --stale \
-            --deny yanked \
-            --deny unsound \
-            --deny unmaintained \
-            --deny warnings \
-            --color=always \
-            ${audit_args}
-EOF

docker/Dockerfile.cargo.deb

@@ -1,82 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS build-deb
-ARG rust_target
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG pkg_dir
-ARG deb_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-ENV targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ENV targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-    set -eux
-    mkdir -p "${pkg_dir}"
-    rustup run ${rust_toolchain} \
-        cargo deb \
-            --verbose \
-            --locked \
-            --no-build \
-            "${cargo_spec_features}" \
-            --features "${cargo_features}" \
-            --profile "${cargo_profile}" \
-            --target "${CARGO_TARGET}" \
-            --manifest-path Cargo.toml \
-            --multiarch same \
-            --compress-type gz \
-            --output "${pkg_dir}" \
-            ${deb_args}
-
-	mv ${pkg_dir}/* "${pkg_dir}/tuwunel.deb"
-	dpkg --info "${pkg_dir}/tuwunel.deb"
-	dpkg --contents "${pkg_dir}/tuwunel.deb"
-EOF
-
-
-FROM scratch AS deb
-ARG pkg_dir
-
-COPY --from=input ${pkg_dir}/tuwunel.deb .
-
-
-FROM input AS deb-install
-ARG pkg_dir
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${pkg_dir}
-COPY --from=deb . .
-RUN <<EOF
-	set -eux
-	dpkg --info tuwunel.deb
-	dpkg --contents tuwunel.deb
-	dpkg --install tuwunel.deb
-EOF

docker/Dockerfile.cargo.fmt

@@ -1,25 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS fmt
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG fmt_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        cargo fmt \
-            --all \
-            --check \
-            --manifest-path Cargo.toml \
-            ${fmt_args}
-EOF

docker/Dockerfile.cargo.lychee

@@ -1,36 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS lychee
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG lychee_cache_age="7d"
-ARG lychee_mode="color"
-# .lycheecache is hardcoded as path to reg file in the cwd so we execute lychee
-# in cache directory itself. all paths here should be absolute paths
-ARG lychee_args="/usr/src/tuwunel/docs /usr/src/tuwunel/*.md"
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=lychee,sharing=locked \
-<<EOF
-    set -eux
-    cd lychee
-    rustup run ${rust_toolchain} \
-        lychee \
-            --verbose \
-            --no-progress \
-            --offline \
-            --cache \
-            --max-cache-age "${lychee_cache_age}" \
-            --mode "${lychee_mode}" \
-            --exclude /usr/src/tuwunel/contributing.md \
-            --exclude /usr/src/tuwunel/development/testing.md \
-            ${lychee_args}
-EOF

docker/Dockerfile.cargo.rpm

@@ -1,72 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS build-rpm
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG pkg_dir
-ARG gen_rpm_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-	set -eux
-	mkdir -p "${pkg_dir}"
-	rustup run ${rust_toolchain} \
-		cargo generate-rpm \
-			--package src/main \
-			--auto-req auto \
-			--target "${CARGO_TARGET}" \
-			--target-dir "${CARGO_TARGET_DIR}" \
-			--profile "${cargo_profile}" \
-			--payload-compress zstd \
-			--output "${pkg_dir}" \
-			${gen_rpm_args}
-
-	mv ${pkg_dir}/* "${pkg_dir}/tuwunel.rpm"
-EOF
-
-
-FROM scratch AS rpm
-ARG pkg_dir
-
-COPY --from=input ${pkg_dir}/tuwunel.rpm .
-
-
-FROM input AS rpm-install
-ARG pkg_dir
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${pkg_dir}
-COPY --link --from=rpm . .
-RUN <<EOF
-	set -eux
-	rpm -i --test tuwunel.rpm
-	rpm -i tuwunel.rpm
-EOF

docker/Dockerfile.cargo.typos

@@ -1,25 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS typos
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG typos_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        typos \
-            --color always \
-            --exclude docker \
-            --exclude nix \
-            ${typos_args}
-EOF

docker/Dockerfile.complement

@@ -1,216 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS key-gen
-
-WORKDIR /complement
-COPY <<EOF v3.ext
-    authorityKeyIdentifier=keyid,issuer
-    basicConstraints=CA:FALSE
-    keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
-    subjectAltName = @alt_names
-    [alt_names]
-    DNS.0 = *.docker.internal
-    DNS.1 = hs1
-    DNS.2 = hs2
-    DNS.3 = hs3
-    DNS.4 = hs4
-    IP.1 = 127.0.0.1
-EOF
-RUN <<EOF
-    set -eux
-    mkdir ca
-    openssl genrsa \
-        -out private_key.pem \
-        2048
-
-    openssl req \
-        -new \
-        -sha256 \
-        -key private_key.pem \
-        -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=hs1" \
-        -addext "subjectAltName = DNS:*.docker.internal DNS:hs1, DNS:hs2, DNS:hs3, DNS:hs4, IP:127.0.0.1" \
-        -out signing_request.csr
-
-    openssl x509 \
-        -req \
-        -extfile v3.ext \
-        -in signing_request.csr \
-        -key private_key.pem \
-        -out certificate.crt \
-        -days 1 \
-        -sha256
-EOF
-RUN [ -f certificate.crt ] && [ -f private_key.pem ]
-
-
-FROM scratch AS complement-config
-WORKDIR /complement
-COPY --from=key-gen /complement/* .
-COPY --from=source /usr/src/tuwunel/tests/complement/results.jsonl old_results.jsonl
-COPY <<EOF complement.toml
-    [global]
-    address = "0.0.0.0"
-    admin_room_notices = false
-    allow_device_name_federation = true
-    allow_guest_registration = true
-    allow_invalid_tls_certificates = true
-    allow_legacy_media = true
-    allow_public_room_directory_over_federation = true
-    allow_public_room_directory_without_auth = true
-    allow_registration = true
-    create_admin_room = false
-    database_path = "/database"
-    dns_attempts = 20
-    dns_timeout = 60
-    federation_idle_timeout = 300
-    intentionally_unknown_config_option_for_testing = true
-    ip_range_denylist = []
-    log = "debug,tuwunel=trace,h2=warn,hyper=warn"
-    log_colors = false
-    log_guest_registrations = false
-    log_span_events = "NONE"
-    log_thread_ids = true
-    media_compat_file_link = false
-    media_startup_check = true
-    port = [8008, 8448]
-    prune_missing_media = true
-    query_trusted_key_servers_first = false
-    query_trusted_key_servers_first_on_join = false
-    request_conn_timeout = 60
-    request_timeout = 120
-    rocksdb_log_level = "debug"
-    rocksdb_max_log_files = 1
-    rocksdb_paranoid_file_checks = true
-    rocksdb_recovery_mode = 0
-    sender_idle_timeout = 300
-    sender_retry_backoff_limit = 300
-    sender_timeout = 300
-    startup_netburst = true
-    startup_netburst_keep = -1
-    trusted_servers = []
-    url_preview_domain_contains_allowlist = ["*"]
-    url_preview_domain_explicit_denylist = ["*"]
-    well_known_conn_timeout = 60
-    well_known_timeout = 60
-    yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true
-
-    [global.tls]
-    certs = "/complement/certificate.crt"
-    dual_protocol = true
-    key = "/complement/private_key.pem"
-EOF
-
-
-FROM input AS complement-testee
-
-WORKDIR /
-COPY --link --from=input . .
-
-EXPOSE 8008 8448
-RUN mkdir /database
-COPY --from=complement-config * /complement/
-ENV TUWUNEL_CONFIG="/complement/complement.toml"
-ENTRYPOINT tuwunel -Oserver_name=\""$SERVER_NAME\""
-
-
-FROM input AS complement-testee-valgrind
-
-WORKDIR /
-COPY --link --from=input . .
-
-EXPOSE 8008 8448
-RUN mkdir /database
-COPY --from=complement-config * /complement/
-ENV TUWUNEL_CONFIG="/complement/complement.toml"
-ENTRYPOINT valgrind \
-    --leak-check=no \
-    --undef-value-errors=no \
-    --exit-on-first-error=yes \
-    --error-exitcode=1 \
-    tuwunel \
-        -Oserver_name=\""$SERVER_NAME\""
-
-
-FROM input AS complement-base
-ARG var_cache
-ARG var_lib_apt
-ARG complement_tags="conduwuit_blacklist"
-ARG complement_tests="./tests/..."
-ARG complement_run=".*"
-
-WORKDIR /usr/src
-ADD https://github.com/matrix-construct/complement.git#403840348f6bcc9cc8ed1671dc2f638c2b1ce4ac complement
-
-WORKDIR /usr/src/complement
-ENV COMPLEMENT_BASE_IMAGE="complement-testee"
-RUN \
---mount=type=cache,dst=/go/pkg/mod/cache,sharing=locked \
-<<EOF
-    env
-    set -eux
-    go test -tags="$complement_tags" -list="$complement_run" $complement_tests
-EOF
-
-
-FROM input AS complement-tester
-ARG complement_verbose=0
-ARG complement_debug=0
-ARG complement_count=1
-ARG complement_parallel=16
-ARG complement_shuffle=1337
-ARG complement_timeout="1h"
-ARG complement_run=".*"
-ARG complement_skip=""
-ARG complement_tags="conduwuit_blacklist"
-ARG complement_tests="./tests/..."
-ARG complement_base_image
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/complement
-ENV COMPLEMENT_DEBUG=$complement_debug
-ENV complement_parallel="$complement_parallel"
-ENV complement_shuffle="$complement_shuffle"
-ENV complement_tags="$complement_tags"
-ENV complement_timeout="$complement_timeout"
-ENV complement_count="$complement_count"
-ENV complement_tests="$complement_tests"
-ENV complement_skip="$complement_skip"
-ENV complement_run="$complement_run"
-ENV complement_tests="$complement_tests"
-ENV COMPLEMENT_ALWAYS_PRINT_SERVER_LOGS="$complement_verbose"
-ENV COMPLEMENT_HOSTNAME_RUNNING_COMPLEMENT="host.docker.internal"
-ENV COMPLEMENT_HOST_MOUNTS="/var/run/docker.sock:/var/run/docker.sock"
-ENV jq_res='{Action: .Action, Test: .Test}'
-ENV jq_sel='select((.Action == \"pass\" or .Action == \"fail\" or .Action == \"skip\") and .Test != null)'
-ENV jq_tab='[.Action, .Test] | @tsv'
-ENV jq_out='select(.Test != null) | {Test: .Test, Output: .Output}'
-COPY --from=complement-config /complement/old_results.jsonl .
-COPY <<EOF uwu.sh
-    env;
-    set -eux;
-
-    COMPLEMENT_BASE_IMAGE="\${1:-$complement_base_image}"
-    go test
-        -json
-        "-shuffle=\$complement_shuffle"
-        "-parallel=\$complement_parallel"
-        "-timeout=\$complement_timeout"
-        "-count=\$complement_count"
-        "-tags=\$complement_tags"
-        "-skip=\$complement_skip"
-        "-run=\$complement_run"
-        "\$complement_tests"
-    | jq --unbuffered -c "."
-    | tee output.jsonl
-    | jq --unbuffered -c "$jq_sel | $jq_res"
-    | tee results.jsonl
-    | jq --unbuffered -r "$jq_tab"
-    ;
-
-    jq -s -c "sort_by(.Test)[]" < results.jsonl | uniq > new_results.jsonl;
-    jq -s -c "sort_by(.Test, .Timestamp)[] | $jq_out" < output.jsonl > full_output.jsonl;
-EOF
-RUN echo $(tr -d '\n' < uwu.sh) > uwu.sh && chmod a+x uwu.sh
-ENTRYPOINT ["/bin/bash", "/usr/src/complement/uwu.sh"]

docker/Dockerfile.install

@@ -1,29 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS install
-ARG rust_target
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG install_prefix
-ARG assert_linkage=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${install_prefix}
-ENV src_path="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}/tuwunel"
-ENV dst_path="${install_prefix}/bin/tuwunel"
-COPY --from=bins $src_path $dst_path
-RUN <<EOF
-    ret=$(ldd "${dst_path}")
-    if [ "$ret" = "0" ] && [ "$assert_linkage" = "static" ]; then
-        exit 1
-    elif [ "$ret" != "0" ] && [ "$assert_linkage" = "dynamic" ]; then
-        exit 1
-    fi
-
-    set -eux
-    ldd -v ${dst_path} || true
-    du -h ${dst_path}
-    sha1sum ${dst_path}
-EOF

docker/Dockerfile.matrix-rust-sdk

@@ -1,107 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS matrix-rust-sdk-integration
-ARG sys_name
-ARG sys_version
-ARG rust_toolchain
-ARG rust_target
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG MRSDK_TARGET_DIR="/usr/src/matrix-rust-sdk"
-ARG mrsdk_profile="release"
-ARG mrsdk_target_share="${MRSDK_TARGET_DIR}/${sys_name}/${sys_version}/${rust_target}/${rust_toolchain}/${mrsdk_profile}/_shared_cache"
-ARG mrsdk_test_args=""
-ARG mrsdk_test_opts=""
-ARG mrsdk_skip_list=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src
-ADD --link https://github.com/matrix-construct/matrix-rust-sdk.git#integration matrix-rust-sdk
-
-WORKDIR /etc
-COPY <<EOF tuwunel.toml
-    [global]
-    admin_room_notices = false
-    allow_device_name_federation = true
-    allow_guest_registration = true
-    allow_legacy_media = true
-    allow_public_room_directory_over_federation = true
-    allow_public_room_directory_without_auth = true
-    allow_registration = true
-    create_admin_room = false
-    ip_range_denylist = []
-    log = "debug,tuwunel=trace,h2=warn,hyper=warn"
-    log_colors = false
-    log_guest_registrations = false
-    log_span_events = "NONE"
-    log_thread_ids = true
-    media_compat_file_link = false
-    media_startup_check = true
-    query_trusted_key_servers_first = false
-    query_trusted_key_servers_first_on_join = false
-    rocksdb_log_level = "debug"
-    rocksdb_max_log_files = 1
-    rocksdb_paranoid_file_checks = true
-    rocksdb_recovery_mode = 0
-    trusted_servers = []
-    url_preview_domain_contains_allowlist = ["*"]
-    url_preview_domain_explicit_denylist = ["*"]
-    yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true
-EOF
-
-WORKDIR /usr/lib
-COPY --link --from=install /usr/lib .
-
-WORKDIR /usr/bin
-COPY --link --from=install /usr/bin/tuwunel .
-
-WORKDIR /usr/src/matrix-rust-sdk
-ENV targ_dir="${MRSDK_TARGET_DIR}/${mrsdk_profile}"
-ENV targ_targ_dir="${MRSDK_TARGET_DIR}/${rust_target}/${mrsdk_profile}"
-ENV RUST_BACKTRACE="full"
-ENV TUWUNEL_CONFIG="/etc/tuwunel.toml"
-ENV TUWUNEL_DATABASE_PATH="/var/db/tuwunel"
-ENV TUWUNEL_SERVER_NAME="localhost:6167"
-ENV TUWUNEL_PORT="[6167]"
-ENV HOMESERVER_URL="http://localhost:6167"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${mrsdk_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${mrsdk_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${mrsdk_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${mrsdk_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${mrsdk_target_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${mrsdk_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${mrsdk_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${mrsdk_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${mrsdk_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${mrsdk_target_share}/fingerprint,sharing=locked \
-<<EOF
-    set -eux
-
-    nohup /usr/bin/tuwunel 1> /var/log/tuwunel.log &
-    PID=$!; trap "sleep 10s; set +ex; kill -QUIT ${PID}; wait ${PID}" EXIT
-    sleep 3s
-
-    rustup run ${rust_toolchain} \
-        cargo test \
-            --locked \
-            --release \
-            --color always \
-            --features default \
-            --target "${rust_target}" \
-            --target-dir "${MRSDK_TARGET_DIR}" \
-            --package matrix-sdk-integration-testing \
-            ${mrsdk_test_args} \
-            -- \
-            --test-threads 1 \
-            --color always \
-            ${mrsdk_skip_list} \
-            ${mrsdk_test_opts} \
-            ;
-EOF

docker/Dockerfile.nix

@@ -1,89 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS nix-base
-ARG sys_name
-ARG sys_version
-ARG sys_target
-
-WORKDIR /
-COPY --link --from=input . .
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-	set -eux
-	curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install > nix-install
-	sh ./nix-install --daemon
-	rm nix-install
-EOF
-
-
-FROM nix-base AS build-nix
-ARG sys_name
-ARG sys_version
-ARG sys_target
-
-WORKDIR /usr/src/tuwunel
-COPY --link --from=source /usr/src/tuwunel .
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-	set -eux
-
-	nix-build \
-		--verbose \
-		--cores 0 \
-		--max-jobs $(nproc) \
-		--log-format raw \
-		.
-
-	cp -afRL --copy-contents result /opt/tuwunel
-EOF
-
-
-FROM build-nix AS smoke-nix
-ARG sys_name
-ARG sys_version
-ARG sys_target
-
-WORKDIR /
-COPY --link --from=build-nix . .
-
-WORKDIR /opt/tuwunel
-ENV TUWUNEL_DATABASE_PATH="/tmp/tuwunel/smoketest.db"
-ENV TUWUNEL_LOG="info"
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-    set -eux
-
-    bin/tuwunel \
-        -Otest='["smoke", "fresh"]' \
-        -Oserver_name=\"localhost\" \
-EOF
-
-
-FROM build-nix AS nix-pkg
-ARG sys_name
-ARG sys_version
-ARG sys_target
-
-WORKDIR /
-COPY --link --from=build-nix . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-	set -eux
-    #TODO: extract derivation?
-    mkdir -p /opt/tuwunel
-    touch /opt/tuwunel/tuwunel.drv
-EOF

docker/Dockerfile.rocksdb

@@ -1,93 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS rocksdb-fetch
-ARG rocksdb_branch="tuwunel-changes"
-ARG rust_rocksdb_branch="conduwuit-changes"
-ARG librocksdb_submodule="librocksdb-sys/rocksdb"
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src
-COPY --link --from=recipe rocksdb.url .
-
-RUN <<EOF
-    set -eux
-    rocksdb_url="$(cat rocksdb.url)"
-    git clone \
-        --depth 1 \
-        --single-branch \
-        --branch "${rust_rocksdb_branch}" \
-        "--recurse-submodules=${librocksdb_submodule}" \
-        "${rocksdb_url}" \
-        /usr/src/rocksdb
-EOF
-
-
-FROM input AS rocksdb-build
-ARG rocksdb_shared=0
-ARG rocksdb_portable="1"
-ARG rocksdb_opt_level="3"
-ARG rocksdb_build_type="Release"
-ARG rocksdb_cxx_flags="-ftls-model=initial-exec"
-ARG rocksdb_make_verbose="ON"
-ARG rocksdb_make_rule_messages="OFF"
-ARG rocksdb_jemalloc=1
-ARG rocksdb_iouring=1
-ARG rocksdb_zstd=1
-ARG rocksdb_lz4=0
-ARG rocksdb_bz2=0
-ARG rocksdb_zlib=0
-ARG rocksdb_snappy=0
-ARG nprocs
-
-WORKDIR /
-COPY --link --from=input . .
-COPY --link --from=rocksdb-fetch /usr/src/rocksdb /usr/src/rocksdb
-
-WORKDIR /usr/src/rocksdb/librocksdb-sys/rocksdb
-ENV CC="clang"
-ENV CXX="clang++"
-ENV nprocs=${nprocs}
-RUN <<EOF
-    set -eux
-
-    cmake -H. -Bbuild \
-        "-DCMAKE_RULE_MESSAGES:BOOL=${rocksdb_make_rule_messages}" \
-        "-DCMAKE_VERBOSE_MAKEFILE:BOOL=${rocksdb_make_verbose}" \
-        "-DCMAKE_BUILD_TYPE=${rocksdb_build_type}" \
-        "-DBUILD_SHARED_LIBS=${rocksdb_shared}" \
-        "-DROCKSDB_BUILD_SHARED=${rocksdb_shared}" \
-        "-DCMAKE_CXX_FLAGS:STRING=${rocksdb_cxx_flags}" \
-        "-DCMAKE_CXX_FLAGS_RELEASE:STRING=-g0 -O${rocksdb_opt_level} -DNDEBUG" \
-        "-DPORTABLE=${rocksdb_portable}" \
-        "-DFAIL_ON_WARNINGS=0" \
-        "-DUSE_RTTI=0" \
-        "-DWITH_RUNTIME_DEBUG=0" \
-        "-DWITH_JNI=0" \
-        "-DWITH_EXAMPLES=0" \
-        "-DWITH_BENCHMARK=0" \
-        "-DWITH_BENCHMARK_TOOLS=0" \
-        "-DWITH_TRACE_TOOLS=0" \
-        "-DWITH_CORE_TOOLS=0" \
-        "-DWITH_TOOLS=0" \
-        "-DWITH_TESTS=0" \
-        "-DWITH_GFLAGS=0" \
-        "-DWITH_LIBURING=${rocksdb_iouring}" \
-        "-DWITH_JEMALLOC=${rocksdb_jemalloc}" \
-        "-DWITH_ZSTD=${rocksdb_zstd}" \
-        "-DWITH_LZ4=${rocksdb_lz4}" \
-        "-DWITH_BZ2=${rocksdb_bz2}" \
-        "-DWITH_ZLIB=${rocksdb_zlib}" \
-        "-DWITH_SNAPPY=${rocksdb_snappy}"
-
-    nprocs=${nprocs:=$(nproc)}
-    cmake \
-        --build build \
-        --target install \
-        --parallel "${nprocs}"
-EOF
-
-
-FROM scratch AS rocksdb
-COPY --from=input /usr/src/rocksdb/librocksdb-sys/rocksdb/build/librocksdb.* .

docker/Dockerfile.rust

@@ -1,72 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS rustup
-ARG RUST_HOME
-ARG rust_target
-ARG rustup_version="1.28.2"
-ARG rustup_profile="minimal"
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${RUST_HOME}
-RUN <<EOF
-    set -eux
-
-    var="${rustup_version}/${rust_target}"
-    url="https://static.rust-lang.org/rustup/archive/$var/rustup-init"
-    curl -S -O -s "$url"
-    chmod a+rx rustup-init
-EOF
-
-FROM input AS rust
-ARG rust_toolchain
-ARG rust_target
-ARG RUST_HOME
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG rustup_version="1.28.1"
-ARG rustup_profile="minimal"
-ARG CARGO_TERM_VERBOSE
-ARG rustup_components
-ARG cargo_installs
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${RUST_HOME}
-ENV CARGO_TARGET="${rust_target}"
-ENV RUSTUP_HOME="${RUSTUP_HOME}"
-ENV CARGO_HOME="${CARGO_HOME}"
-ENV PATH="${CARGO_HOME}/bin:$PATH"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
-<<EOF
-    set -eux
-    ./rustup-init -y \
-        --quiet \
-        --profile "${rustup_profile}" \
-        --default-host "${CARGO_TARGET}" \
-        --default-toolchain "${rust_toolchain}" \
-        --no-update-default-toolchain \
-        --no-modify-path
-
-    chmod -R a+rw $CARGO_HOME $RUSTUP_HOME
-    rm rustup-init
-
-    rustup component add \
-        --toolchain ${rust_toolchain} \
-        --target ${rust_target} \
-        ${rustup_components} \
-        ;
-
-    rustup run --install ${rust_toolchain} \
-        cargo install \
-            --locked \
-            --target ${rust_target} \
-            ${cargo_installs} \
-            ;
-EOF

docker/Dockerfile.smoketest

@@ -1,66 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS smoke-version
-COPY --link --from=input . .
-RUN <<EOF
-    set -eux
-    tuwunel -V
-    version=$(tuwunel -V)
-    /bin/test -n "$version"
-EOF
-
-
-FROM input AS smoke-startup
-COPY --link --from=input . .
-ENV TUWUNEL_LOG="info"
-ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
-RUN <<EOF
-    set -eux
-    tuwunel \
-        -Otest='["smoke"]' \
-        -Oserver_name=\"localhost\" \
-        -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
-
-    rm -rf "${TUWUNEL_DATABASE_PATH}"
-EOF
-
-
-FROM input AS smoke-valgrind
-ARG leak_check="no"
-ARG undef_value_errors="no"
-COPY --link --from=input . .
-ENV TUWUNEL_LOG="info"
-ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
-RUN <<EOF
-    set -eux
-    ulimit -n 65535
-    valgrind \
-        --leak-check=${leak_check} \
-        --undef-value-errors=${undef_value_errors} \
-        --exit-on-first-error=yes \
-        --error-exitcode=1 \
-        tuwunel \
-            -Otest='["smoke"]' \
-            -Oserver_name=\"localhost\" \
-            -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
-
-    rm -rf "${TUWUNEL_DATABASE_PATH}"
-EOF
-
-
-FROM input AS smoke-perf
-COPY --link --from=input . .
-ENV TUWUNEL_LOG="error"
-ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
-RUN <<EOF
-    set -eux
-    perf stat \
-        -j \
-        -ddd \
-        tuwunel \
-            -Otest='["smoke"]' \
-            -Oserver_name=\"localhost\" \
-            -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
-
-    rm -rf "${TUWUNEL_DATABASE_PATH}"
-EOF

docker/Dockerfile.source

@@ -1,99 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS source
-ARG git_checkout
-
-WORKDIR /
-COPY --link --from=input . .
-
-ADD --link --keep-git-dir . /usr/src/tuwunel
-WORKDIR /usr/src/tuwunel
-RUN <<EOF
-    set -eux
-    git reset \
-        --hard \
-        --no-recurse-submodules \
-        ${git_checkout}
-EOF
-
-
-FROM input AS ingredients
-ARG rust_target
-ARG rust_toolchain
-ARG RUST_HOME
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TERM_VERBOSE=0
-ARG RUST_BACKTRACE
-ARG JEMALLOC_OVERRIDE
-ARG ROCKSDB_LIB_DIR
-
-WORKDIR /
-COPY --link --from=input . .
-COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
-COPY --link --from=source /usr/src/tuwunel /usr/src/tuwunel
-
-WORKDIR /usr/src/tuwunel
-ENV PATH="${CARGO_HOME}/bin:$PATH"
-ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
-ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
-ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
-ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
-<<EOF
-    set -eux
-    git submodule update \
-        --remote \
-        --no-fetch \
-        --recursive \
-        --checkout \
-        --init
-
-    rustup run ${rust_toolchain} \
-        cargo fetch \
-            --locked \
-            --target ${CARGO_TARGET}
-EOF
-
-
-FROM input AS preparing
-ARG rust_target
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
-<<EOF
-    set -euxo pipefail
-    rustup run ${rust_toolchain} \
-        cargo chef prepare \
-            --recipe-path recipe.json
-
-    manifest="Cargo.toml"
-    package="rust-librocksdb-sys"
-    cmd="cargo tree --manifest-path ${manifest} -f {r} -p ${package}"
-    url="$(rustup run ${rust_toolchain} ${cmd} | head -n 1)"
-    url="https://github.com/matrix-construct/rust-rocksdb" #TODO fixme
-    echo "$url" > rocksdb.url
-
-    sha1sum recipe.json rocksdb.url
-EOF
-
-
-FROM scratch AS recipe
-
-WORKDIR /
-COPY --from=preparing /usr/src/tuwunel/recipe.json .
-COPY --from=preparing /usr/src/tuwunel/rocksdb.url .

docker/Dockerfile.system

@@ -1,31 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-ARG sys_name=debian
-ARG sys_version=testing-slim
-
-FROM ${sys_name}:${sys_version} AS system
-
-
-FROM input AS runtime
-ARG var_cache
-ARG var_lib_apt
-ARG packages
-ARG DEBIAN_FRONTEND
-
-WORKDIR /
-COPY --link --from=input . .
-
-ENV DEBIAN_FRONTEND="${DEBIAN_FRONTEND}"
-RUN \
---mount=type=cache,dst=/var/cache,id=${var_cache},sharing=locked \
---mount=type=cache,dst=/var/lib/apt,id=${var_lib_apt},sharing=locked \
-<<EOF
-    echo $(uname -a) $0 $-
-    set -eux
-
-    keep_downloaded='Binary::apt::APT::Keep-Downloaded-Packages "true";'
-    echo "$keep_downloaded" > /etc/apt/apt.conf.d/keep-downloaded
-    rm -f /etc/apt/apt.conf.d/docker-clean
-
-    apt-get -y -U install --no-install-recommends ${packages}
-EOF

docker/README.md

@@ -1,106 +0,0 @@
-# Docker Builder
-
-> [!NOTE]
-> This directory is for building docker images. For [deploying](https://github.com/matrix-construct/tuwunel/tree/main/docs/deploying)
-> [docker](https://github.com/matrix-construct/tuwunel/blob/main/docs/deploying/docker.md) visit
-> the appropriate documentation instead.
-
-All Docker images for the project are built here. All images are
-[Docker Bake](https://docs.docker.com/build/bake/) targets. All targets are leaves and
-branches of a unified tree leading to a single root. It is a combinatorial matrix
-of images from shared intermediate layers with a huge ever-growing pulsating cache.
-
-The result is the ability to run continuous integration for a number of build
-variations while only paying the cost of rebuilding the last layer for each one.
-
-
-### Layout
-
-This directory is made up of three types of files:
-
-- Shell scripts are the user interface. Use this system through one of the shell scripts. The
-bake files can still be docker'ed directly but it's recommended to run the script.
-
-- The `.hcl` files specify the targets of the tree. This is all standard
-[docker bake](https://docs.docker.com/build/bake/reference/). All targets are ordered where each
-depends on one or more below it. The root of the tree is at the bottom. At the time of this
-writing there is only one `bake.hcl` file but this might be broken up; in any case there will
-always be a single unified tree.
-
-- The `Dockerfile.*` files are like "library functions" and provide definition for targets.
-These are written generically in the style of "template functions" with many variables allowing
-many targets to create many variations using the same Dockerfile.
-
-
-### Getting started
-
-1. You will need to install docker buildx/buildkit and maybe a couple other related things.
-
-	`apt-get install docker-buildx`
-
-2. You will need to create a builder. There are a few complications that must be explained here
-so please be patient.
-
-	- Some unsavory options are required for some targets. It might be possible to omit these if
-	you're not building the full tree. Otherwise I've included them in the create command below.
-
-		- To run the complement compliance suite we need the `--allow-insecure-entitlement network.host`.
-		This requirement is probably a defect in Complement.
-
-	- The default cache policies are usually insufficient and custom values should be used,
-	 though the ones below are probably too much for a single or simple build.
-
-	Finally create:
-	
-	```
-	cat <<EOF > ./buildkitd.toml
-		[system]
-		  platformsCacheMaxAge = "504h"
-		[worker.oci]
-		  enabled = true
-		  gc = true
-		  reservedSpace = "64GB"
-		  maxUsedSpace = "128GB"
-		[[worker.oci.gcpolicy]]
-		  reservedSpace = "64GB"
-		  maxUsedSpace = "128GB"
-		  all = true
-	EOF
-
-	BKD_FLAGS="--allow-insecure-entitlement network.host"
-	docker buildx create \
-		--name owo \
-		--bootstrap \
-		--buildkitd-config ./buildkitd.toml \
-		--driver docker-container \
-		--buildkitd-flags "$BKD_FLAGS"
-	```
-
-3. Build something simple. The usage is `./bake.sh [target]` which defaults to building all
-elements for one vector of the full matrix. You can start smaller though by running
-`docker/bake.sh system` which is the root target. You can browse the `bake.hcl` from the bottom
-and progressively build targets, or build one or more leaf targets directly. For example try
-to run a smoketest: `./bake.sh tests-smoke`.
-
-4. Build something more complicated. Set environment variables or just edit the default vectors
-near the top of in the `bake.sh` with multiple elements (they are JSON arrays). You can take
-cues from the primary user of this system, the [GitHub CI](https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/main.yml#L32)
-
-5. Defeat the final boss by building and running complement to completion. This will involve
-building the targets for `complement-tester` and `complement-testee` using `bake.sh` and then
-invoking `complement.sh`. You can take cues again from another user of this in the
-[GitHub CI](https://github.com/matrix-construct/tuwunel/blob/7e8c4c8883ca17de91c3323d329541342366ee0c/.github/workflows/test.yml#L140).
-
-## Notes
-
-- For CI our builders are more persistent rather than being created and destroyed for
-each invocation. The builder is meant to be safely reused across operations, but
-for concurrent operations this is tricky, see the next point.
-
-- For CI our builders are isolated only by actor/user. This will probably change to
-`actor/repo/branch` as it's easy to cause issues with concurrent builds right now.
-However we can't accept destroying the builder after each use, so we'll likely
-choose `actor/repo/branch` with the expectation of one build at a time under those
-constraints. Some external caching might need to be contrived between builders for
-deduplication but with care such that malicious actors cannot poison data used
-by other actors, otherwise it defeats the purpose of builder isolation.

docker/bake.sh

@@ -1,118 +0,0 @@
-#!/bin/bash
-set -eo pipefail
-
-BASEDIR=$(dirname "$0")
-
-CI="${CI:-false}"
-CI_VERBOSE="${CI_VERBOSE:-false}"
-CI_VERBOSE_ENV="${CI_VERBOSE_ENV:-$CI_VERBOSE}"
-CI_SILENT_BAKE="${CI_SILENT_BAKE:-false}"
-CI_PRINT_BAKE="${CI_PRINT_BAKE:-$CI_VERBOSE}"
-
-default_cargo_profiles='["test"]'
-default_feat_sets='["all"]'
-default_rust_toolchains='["nightly"]'
-default_rust_targets='["x86_64-unknown-linux-gnu"]'
-default_sys_names='["debian"]'
-default_sys_versions='["testing-slim"]'
-default_sys_targets='["x86_64-v1-linux-gnu"]'
-
-if test ! -z "$cargo_profile"; then
-    env_cargo_profiles="[\"${cargo_profile}\"]"
-fi
-
-if test ! -z "$feat_set"; then
-    env_feat_sets="[\"${feat_set}\"]"
-fi
-
-if test ! -z "$rust_target"; then
-    env_rust_targets="[\"${rust_target}\"]"
-fi
-
-if test ! -z "$rust_toolchain"; then
-    env_rust_toolchains="[\"${rust_toolchain}\"]"
-fi
-
-if test ! -z "$sys_name"; then
-    env_sys_names="[\"${sys_name}\"]"
-fi
-
-if test ! -z "$sys_target"; then
-    env_sys_targets="[\"${sys_target}\"]"
-fi
-
-if test ! -z "$sys_version"; then
-    env_sys_versions="[\"${sys_version}\"]"
-fi
-
-set -a
-bake_target="${bake_target:-$@}"
-cargo_profiles="${env_cargo_profiles:-$default_cargo_profiles}"
-feat_sets="${env_feat_sets:-$default_feat_sets}"
-rust_targets="${env_rust_targets:-$default_rust_targets}"
-rust_toolchains="${env_rust_toolchains:-$default_rust_toolchains}"
-sys_names="${env_sys_names:-$default_sys_names}"
-sys_targets="${env_sys_targets:-$default_sys_targets}"
-sys_versions="${env_sys_versions:-$default_sys_versions}"
-
-docker_dir="$PWD/$BASEDIR"
-builder_name="${GITHUB_ACTOR:-owo}"
-toolchain_toml="$docker_dir/../rust-toolchain.toml"
-rust_msrv=$(grep "channel = " "$toolchain_toml" | cut -d'=' -f2 | sed 's/\s"\|"$//g')
-rocksdb_opt_level=3
-rocksdb_portable=1
-git_checkout="${git_checkout:-HEAD}"
-use_chef="true"
-set +a
-
-###############################################################################
-
-export DOCKER_BUILDKIT=1
-if test "$CI" = "true"; then
-    export BUILDKIT_PROGRESS="plain"
-fi
-
-args=""
-args="$args --provenance=false"
-args="$args --builder ${builder_name}"
-#args="$args --set *.platform=${sys_platform}"
-
-if test "$CI" = "true"; then
-	args="$args --allow=network.host"
-fi
-
-if test "$(uname)" = "Darwin"; then
-    nprocs=$(sysctl -n hw.logicalcpu)
-    args="$args --set *.args.nprocs=${nprocs}"
-    :
-else
-    nprocs=$(nproc)
-    args="$args --set *.args.nprocs=${nprocs}"
-    :
-fi
-
-if test "$CI_SILENT_BAKE" = "true"; then
-	args="$args --progress=quiet"
-fi
-
-arg="$args -f $BASEDIR/bake.hcl"
-trap 'set +x; date; echo -e "\033[1;41;37mERROR\033[0m"' ERR
-
-if test "$CI_VERBOSE_ENV" = "true"; then
-	date
-	env
-fi
-
-if test "$CI_PRINT_BAKE" = "true"; then
-    docker buildx bake --print $arg $bake_target
-fi
-
-if test "$NO_BAKE" = "1"; then
-    exit 0
-fi
-
-trap '' ERR
-set -ux
-docker buildx bake $arg $bake_target
-set +x
-echo -e "\033[1;42;30mACCEPT\033[0m"

docker/complement.sh

@@ -1,105 +0,0 @@
-#!/bin/bash
-set -eo pipefail
-
-BASEDIR=$(dirname "$0")
-
-CI="${CI:-false}"
-CI_VERBOSE="${CI_VERBOSE_ENV:-false}"
-CI_VERBOSE_ENV="${CI_VERBOSE_ENV:-$CI_VERBOSE}"
-
-default_cargo_profile="test"
-default_feat_set="all"
-default_rust_toolchain="nightly"
-default_rust_target="x86_64-unknown-linux-gnu"
-default_sys_name="debian"
-default_sys_target="x86_64-v1-linux-gnu"
-default_sys_version="testing-slim"
-
-default_complement_verbose=0
-default_complement_count=1
-default_complement_parallel=1
-default_complement_shuffle=0
-default_complement_timeout="1h"
-default_complement_run=".*"
-
-run="${1:-$default_complement_run}"
-skip=""
-skip="${skip}TestToDeviceMessagesOverFederation/stopped_server"
-skip="${skip}|TestToDeviceMessagesOverFederation/interrupted_connectivity"
-skip="${skip}|TestRoomCreate/Parallel/POST_/createRoom_makes_a_room_with_a_topic_and_writes_rich_topic_representation"
-skip="${skip}|TestRoomCreate/Parallel/POST_/createRoom_makes_a_room_with_a_topic_via_initial_state_overwritten_by_topic"
-skip="${skip}|TestLogin/parallel/POST_/"
-skip="${skip}|TestUnbanViaInvite"
-skip="${skip}|TestRoomState/Parallel/GET_/publicRooms_lists_newly-created_room"
-# flakes due to timeout in debug-mode
-skip="${skip}|TestMSC4297StateResolutionV2_1_starts_from_empty_set"
-skip="${skip}|TestMSC4297StateResolutionV2_1_includes_conflicted_subgraph"
-
-set -a
-cargo_profile="${cargo_profile:-$default_cargo_profile}"
-feat_set="${feat_set:-$default_feat_set}"
-rust_target="${rust_target:-$default_rust_target}"
-rust_toolchain="${rust_toolchain:-$default_rust_toolchain}"
-sys_name="${sys_name:-$default_sys_name}"
-sys_target="${sys_target:-$default_sys_target}"
-sys_version="${sys_version:-$default_sys_version}"
-
-runner_name=$(echo $RUNNER_NAME | cut -d"." -f1)
-runner_num=$(echo $RUNNER_NAME | cut -d"." -f2)
-set +a
-
-###############################################################################
-
-envs=""
-envs="$envs -e complement_verbose=${complement_verbose:-$default_complement_verbose}"
-envs="$envs -e complement_count=${complement_count:-$default_complement_count}"
-envs="$envs -e complement_parallel=${complement_parallel:-$default_complement_parallel}"
-envs="$envs -e complement_shuffle=${complement_shuffle:-$default_complement_shuffle}"
-envs="$envs -e complement_timeout=${complement_timeout:-$default_complement_timeout}"
-envs="$envs -e complement_skip=${complement_skip:-$skip}"
-envs="$envs -e complement_run=${1:-$default_complement_run}"
-
-set -x
-tester_image="complement-tester--${sys_name}--${sys_version}--${sys_target}"
-testee_image="complement-testee--${cargo_profile}--${rust_toolchain}--${rust_target}--${feat_set}--${sys_name}--${sys_version}--${sys_target}"
-name="complement_tester__${sys_name}__${sys_version}__${sys_target}"
-sock="/var/run/docker.sock"
-arg="--name $name -v $sock:$sock --network=host $envs $tester_image ${testee_image}"
-set +x
-
-if test "$CI_VERBOSE_ENV" = "true"; then
-	date
-	env
-fi
-
-docker rm -f "$name" 2>/dev/null
-
-arg="-d $arg"
-cid=$(docker run $arg)
-
-if test "$CI" = "true"; then
-	echo -n "$cid" > "$name"
-fi
-
-output_src="$cid:/usr/src/complement/full_output.jsonl"
-output_dst="complement.jsonl"
-extract_output() {
-	docker cp "$output_src" "$output_dst"
-}
-
-result_src="$cid:/usr/src/complement/new_results.jsonl"
-result_dst="tests/complement/results.jsonl"
-extract_results() {
-	docker cp "$result_src" "$result_dst"
-}
-
-trap 'extract_output; set +x; date; echo -e "\033[1;41;37mERROR\033[0m"' ERR
-trap 'docker container stop $cid; extract_output' INT
-docker logs -f "$cid"
-docker wait "$cid" 2>/dev/null
-
-extract_results
-git diff -U0 --color --shortstat "$result_dst" | (grep "$run" || true)
-
-git diff --quiet --exit-code "$result_dst"
-echo -e "\033[1;42;30mACCEPT\033[0m"

docs/CODE_OF_CONDUCT.md

@@ -1 +0,0 @@
-../CODE_OF_CONDUCT.md

docs/README.md

@@ -1 +0,0 @@
-SUMMARY.md

docs/SUMMARY.md

@@ -1,23 +0,0 @@
-# Summary
-
-- [Introduction](introduction.md)
-- [Configuration](configuration.md)
-  - [Examples](configuration/examples.md)
-- [Deploying](deploying.md)
-  - [Generic](deploying/generic.md)
-  - [NixOS](deploying/nixos.md)
-  - [Docker](deploying/docker.md)
-  - [Kubernetes](deploying/kubernetes.md)
-  - [Arch Linux](deploying/arch-linux.md)
-  - [Debian](deploying/debian.md)
-  - [Red Hat](deploying/redhat.md)
-  - [FreeBSD](deploying/freebsd.md)
-- [TURN](turn.md)
-- [Appservices](appservices.md)
-- [Maintenance](maintenance.md)
-- [Troubleshooting](troubleshooting.md)
-- [Development](development.md)
-  - [Contributing](contributing.md)
-  - [Testing](development/testing.md)
-  - [Hot Reloading ("Live" Development)](development/hot_reload.md)
-- [Tuwunel Community Code of Conduct](CODE_OF_CONDUCT.md)

docs/appservices.md

@@ -1,53 +0,0 @@
-# Setting up Appservices
-
-## Getting help
-
-If you run into any problems while setting up an Appservice: ask us in
-[#tuwunel:tuwunel.chat](https://matrix.to/#/#tuwunel:tuwunel.chat) or
-[open an issue on GitHub](https://github.com/matrix-construct/tuwunel/issues/new).
-
-## Set up the appservice - general instructions
-
-Follow whatever instructions are given by the appservice. This usually includes
-downloading, changing its config (setting domain, homeserver url, port etc.) and
-later starting it.
-
-At some point the appservice guide should ask you to add a registration yaml
-file to the homeserver. In Synapse you would do this by adding the path to the
-homeserver.yaml, but in tuwunel you can do this from within Matrix:
-
-First, go into the `#admins` room of your homeserver. The first person that
-registered on the homeserver automatically joins it. Then send a message into
-the room like this:
-
-    !admin appservices register
-    ```
-    paste
-    the
-    contents
-    of
-    the
-    yaml
-    registration
-    here
-    ```
-
-You can confirm it worked by sending a message like this:
-`!admin appservices list`
-
-The server bot should answer with `Appservices (1): your-bridge`
-
-Then you are done. Tuwunel will send messages to the appservices and the
-appservice can send requests to the homeserver. You don't need to restart
-tuwunel, but if it doesn't work, restarting while the appservice is running
-could help.
-
-## Appservice-specific instructions
-
-### Remove an appservice
-
-To remove an appservice go to your admin room and execute
-
-`!admin appservices unregister <name>`
-
-where `<name>` one of the output of `appservices list`.

docs/configuration.md

@@ -1,84 +0,0 @@
-# Configuration
-
-This chapter describes various ways to configure Tuwunel.
-
-## Basics
-
-Tuwunel uses a config file for the majority of the settings, but also supports
-setting individual config options via commandline.
-
-Please refer to the [example config file](./configuration/examples.md#example-configuration) for all of those settings.
-
-The config file to use can be specified on the commandline when running
-Tuwunel by specifying the `-c`, `--config` flag. It is also possible to specify
-more than one config file.
-
-Alternatively, you can use the environment variable `TUWUNEL_CONFIG` to specify
-the config file to used. Conduit's environment variables are supported for 
-backwards compatibility.
-
-> [!IMPORTANT]
-> It is bad practice to uncomment default options without changing them. Many
-> defaults are updated by developers as features evolve and can be essential
-> to expected server function.
-
-## Option commandline flag
-
-Tuwunel supports setting individual config options in TOML format from the
-`-O` / `--option` flag. For example, you can set your server name via `-O
-server_name=\"example.com\"`.
-
-Note that the config is parsed as TOML, and shells like bash will remove quotes.
-So unfortunately it is required to escape quotes if the config option takes a
-string. This does not apply to options that take booleans or numbers:
-- `--option allow_registration=true` works ✅
-- `-O max_request_size=99999999` works ✅
-- `-O server_name=example.com` does not work ❌
-- `--option log=\"debug\"` works ✅
-- `--option server_name='"example.com'"` works ✅
-
-## Relevance of configuration settings
-
-There is a specific sequence for reading and overwriting the settings. The
-latest setting takes precedence and defines the configuration.
-
-1. Set in `CONDUIT_CONFIG`.
-2. Set in `CONDUWUIT_CONFIG`.
-3. Set in `TUWUNEL_CONFIG`.
-4. Set in the first config file on the command line (e.g. `-c config_file_1.toml`).
-5. Set in the second config file on the command line (e.g. `-c config_file_2.toml`).
-6. Set in any additional config file on the command line (e.g. `-c config_file_n.toml`).
-7. Set within the options (again, the latest option in the list overrides).
-
-
-## Execute commandline flag
-
-Tuwunel supports running admin commands on startup using the commandline
-argument `--execute`. The most notable use for this is to create an admin user
-on first startup.
-
-The syntax of this is a standard admin command without the prefix such as
-`./tuwunel --execute "users create_user june"`
-
-An example output of a success is:
-```
-INFO tuwunel_service::admin::startup: Startup command #0 completed:
-Created user with user_id: @june:girlboss.ceo and password: `<redacted>`
-```
-
-This commandline argument can be paired with the `--option` flag.
-
-## Environment variables
-
-All of the settings that are found in the config file can be specified by using
-environment variables. The environment variable names should be all caps and
-prefixed with `TUWUNEL_`.
-
-For example, if the setting you are changing is `max_request_size`, then the
-environment variable to set is `TUWUNEL_MAX_REQUEST_SIZE`.
-
-To modify config options not in the `[global]` context such as
-`[global.well_known]`, use the `__` suffix split: `TUWUNEL_WELL_KNOWN__SERVER`
-
-Conduit and conduwuit's environment variables are supported for backwards
-compatibility (e.g. `CONDUIT_SERVER_NAME` or `CONDUWUIT_SERVER_NAME`).

docs/configuration/examples.md

@@ -1,32 +0,0 @@
-## Example configuration
-
-<details>
-<summary>Example configuration</summary>
-
-```toml
-{{#include ../../tuwunel-example.toml}}
-```
-
-</details>
-
-## Debian systemd unit file
-
-<details>
-<summary>Debian systemd unit file</summary>
-
-```
-{{#include ../../debian/tuwunel.service}}
-```
-
-</details>
-
-## Arch Linux systemd unit file
-
-<details>
-<summary>Arch Linux systemd unit file</summary>
-
-```
-{{#include ../../arch/tuwunel.service}}
-```
-
-</details>

docs/contributing.md

@@ -1 +0,0 @@
-../CONTRIBUTING.md

docs/deploying.md

@@ -1,3 +0,0 @@
-# Deploying
-
-This chapter describes various ways to deploy Tuwunel.

docs/deploying/README.md

@@ -1 +0,0 @@
-SUMMARY.md

docs/deploying/SUMMARY.md

@@ -1,11 +0,0 @@
-# Deployment Guides
-
-- [Generic](generic.md)
-- [NixOS](nixos.md)
-- [Docker](docker.md)
-- [Kubernetes](kubernetes.md)
-- [Arch Linux](arch-linux.md)
-- [Debian](debian.md)
-- [Red Hat](redhat.md)
-- [FreeBSD](freebsd.md)
-- [Podman systemd](podman-systemd.md)

docs/deploying/arch-linux.md

@@ -1,15 +0,0 @@
-# Tuwunel for Arch Linux
-
-Currently Tuwunel is only on the Arch User Repository (AUR).
-
-The Tuwunel AUR packages are community maintained and are not maintained by
-Tuwunel development team, but the AUR package maintainers are in the Matrix
-room. Please attempt to verify your AUR package's PKGBUILD file looks fine
-before asking for support.
-
-- [tuwunel](https://aur.archlinux.org/packages/tuwunel) - latest tagged
-tuwunel
-- [tuwunel-git](https://aur.archlinux.org/packages/tuwunel-git) - latest git
-tuwunel from `main` branch
-- [tuwunel-bin](https://aur.archlinux.org/packages/tuwunel-bin) - latest
-tagged tuwunel static binary

docs/deploying/debian.md

@@ -1 +0,0 @@
-{{#include ../../debian/README.md}}

docs/deploying/docker-compose.for-traefik.yml

@@ -1,66 +0,0 @@
-# tuwunel - Behind Traefik Reverse Proxy
-
-services:
-  homeserver:
-    ### If you already built the conduduwit image with 'docker build' or want to use the Docker Hub image,
-    ### then you are ready to go.
-    image: jevolk/tuwunel:latest
-    restart: unless-stopped
-    volumes:
-      - db:/var/lib/tuwunel
-      #- ./tuwunel.toml:/etc/tuwunel.toml
-    networks:
-      - proxy
-    environment:
-      TUWUNEL_SERVER_NAME: your.server.name.example # EDIT THIS
-      TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
-      TUWUNEL_PORT: 6167 # should match the loadbalancer traefik label
-      TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-      TUWUNEL_ALLOW_REGISTRATION: 'true'
-      TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
-      #TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-      TUWUNEL_ALLOW_FEDERATION: 'true'
-      TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
-      TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
-      #TUWUNEL_LOG: warn,state_res=warn
-      TUWUNEL_ADDRESS: 0.0.0.0
-      #TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
-
-      # We need some way to serve the client and server .well-known json. The simplest way is via the TUWUNEL_WELL_KNOWN
-      # variable / config option, there are multiple ways to do this, e.g. in the tuwunel.toml file, and in a separate
-      # see the override file for more information about delegation
-      TUWUNEL_WELL_KNOWN: |
-        {
-        client=https://your.server.name.example,
-        server=your.server.name.example:443
-        }
-    #cpuset: "0-4" # Uncomment to limit to specific CPU cores
-    ulimits: # tuwunel uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
-      nofile:
-        soft: 1048567
-        hard: 1048567
-
-    ### Uncomment if you want to use your own Element-Web App.
-    ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and tuwunel
-    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
-    # element-web:
-    #     image: vectorim/element-web:latest
-    #     restart: unless-stopped
-    #     volumes:
-    #         - ./element_config.json:/app/config.json
-    #     networks:
-    #         - proxy
-    #     depends_on:
-    #         - homeserver
-
-volumes:
-  db:
-
-networks:
-  # This is the network Traefik listens to, if your network has a different
-  # name, don't forget to change it here and in the docker-compose.override.yml
-  proxy:
-    external: true
-
-# vim: ts=2:sw=2:expandtab

docs/deploying/docker-compose.override.yml

@@ -1,37 +0,0 @@
-# tuwunel - Traefik Reverse Proxy Labels
-
-services:
-  homeserver:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=proxy"  # Change this to the name of your Traefik docker proxy network
-
-      - "traefik.http.routers.to-tuwunel.rule=Host(`<SUBDOMAIN>.<DOMAIN>`)"  # Change to the address on which tuwunel is hosted
-      - "traefik.http.routers.to-tuwunel.tls=true"
-      - "traefik.http.routers.to-tuwunel.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.to-tuwunel.middlewares=cors-headers@docker"
-      - "traefik.http.services.to_tuwunel.loadbalancer.server.port=6167"
-
-      - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
-      - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
-      - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"
-
-      # If you want to have your account on <DOMAIN>, but host tuwunel on a subdomain,
-      # you can let it only handle the well known file on that domain instead
-      #- "traefik.http.routers.to-matrix-wellknown.rule=Host(`<DOMAIN>`) && PathPrefix(`/.well-known/matrix`)"
-      #- "traefik.http.routers.to-matrix-wellknown.tls=true"
-      #- "traefik.http.routers.to-matrix-wellknown.tls.certresolver=letsencrypt"
-      #- "traefik.http.routers.to-matrix-wellknown.middlewares=cors-headers@docker"
-
-  ### Uncomment this if you uncommented Element-Web App in the docker-compose.yml
-  # element-web:
-  #     labels:
-  #         - "traefik.enable=true"
-  #         - "traefik.docker.network=proxy"  # Change this to the name of your Traefik docker proxy network
-
-  #         - "traefik.http.routers.to-element-web.rule=Host(`<SUBDOMAIN>.<DOMAIN>`)"  # Change to the address on which Element-Web is hosted
-  #         - "traefik.http.routers.to-element-web.tls=true"
-  #         - "traefik.http.routers.to-element-web.tls.certresolver=letsencrypt"
-
-# vim: ts=2:sw=2:expandtab
-

docs/deploying/docker-compose.with-caddy.yml

@@ -1,55 +0,0 @@
-services:
-    caddy:
-    # This compose file uses caddy-docker-proxy as the reverse proxy for tuwunel!
-    # For more info, visit https://github.com/lucaslorentz/caddy-docker-proxy
-        image: lucaslorentz/caddy-docker-proxy:ci-alpine
-        ports:
-            - 80:80
-            - 443:443
-        environment:
-            - CADDY_INGRESS_NETWORKS=caddy
-        networks:
-            - caddy
-        volumes:
-            - /var/run/docker.sock:/var/run/docker.sock
-            - ./data:/data
-        restart: unless-stopped
-        labels:
-            caddy: example.com
-            caddy.0_respond: /.well-known/matrix/server {"m.server":"matrix.example.com:443"}
-            caddy.1_respond: /.well-known/matrix/client {"m.server":{"base_url":"https://matrix.example.com"},"m.homeserver":{"base_url":"https://matrix.example.com"},"org.matrix.msc3575.proxy":{"url":"https://matrix.example.com"}}
-
-    homeserver:
-        ### If you already built the tuwunel image with 'docker build' or want to use a registry image,
-        ### then you are ready to go.
-        image: jevolk/tuwunel:latest
-        restart: unless-stopped
-        volumes:
-            - db:/var/lib/tuwunel
-            #- ./tuwunel.toml:/etc/tuwunel.toml
-        environment:
-            TUWUNEL_SERVER_NAME: example.com # EDIT THIS
-            TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
-            TUWUNEL_PORT: 6167
-            TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-            TUWUNEL_ALLOW_REGISTRATION: 'true'
-            TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
-            #TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-            TUWUNEL_ALLOW_FEDERATION: 'true'
-            TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
-            TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
-            #TUWUNEL_LOG: warn,state_res=warn
-            TUWUNEL_ADDRESS: 0.0.0.0
-            #TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
-        networks:
-            - caddy
-        labels:
-            caddy: matrix.example.com
-            caddy.reverse_proxy: "{{upstreams 6167}}"
-
-volumes:
-    db:
-
-networks:
-    caddy:
-        external: true

docs/deploying/docker-compose.with-traefik.yml

@@ -1,146 +0,0 @@
-# tuwunel - Behind Traefik Reverse Proxy
-
-services:
-  homeserver:
-    ### If you already built the tuwunel image with 'docker build' or want to use the Docker Hub image,
-    ### then you are ready to go.
-    image: jevolk/tuwunel:latest
-    restart: unless-stopped
-    volumes:
-      - db:/var/lib/tuwunel
-      #- ./tuwunel.toml:/etc/tuwunel.toml
-    networks:
-      - proxy
-    environment:
-      TUWUNEL_SERVER_NAME: your.server.name.example # EDIT THIS
-      TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
-      TUWUNEL_ALLOW_REGISTRATION: 'false' # After setting a secure registration token, you can enable this
-      TUWUNEL_REGISTRATION_TOKEN: "" # This is a token you can use to register on the server
-      #TUWUNEL_REGISTRATION_TOKEN_FILE: "" # Alternatively you can configure a path to a token file to read
-      TUWUNEL_ADDRESS: 0.0.0.0
-      TUWUNEL_PORT: 6167 # you need to match this with the traefik load balancer label if you're want to change it
-      TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
-      #TUWUNEL_CONFIG: '/etc/conduit.toml' # Uncomment if you mapped config toml above
-      ### Uncomment and change values as desired, note that tuwunel has plenty of config options, so you should check out the example example config too
-      # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
-      # TUWUNEL_LOG: info  # default is: "warn,state_res=warn"
-      # TUWUNEL_ALLOW_ENCRYPTION: 'true'
-      # TUWUNEL_ALLOW_FEDERATION: 'true'
-      # TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
-      # TUWUNEL_ALLOW_INCOMING_PRESENCE: true
-      # TUWUNEL_ALLOW_OUTGOING_PRESENCE: true
-      # TUWUNEL_ALLOW_LOCAL_PRESENCE: true
-      # TUWUNEL_WORKERS: 10
-      # TUWUNEL_MAX_REQUEST_SIZE: 20000000  # in bytes, ~20 MB
-      # TUWUNEL_NEW_USER_DISPLAYNAME_SUFFIX = "🏳<200d>⚧"
-
-      # We need some way to serve the client and server .well-known json. The simplest way is via the TUWUNEL_WELL_KNOWN
-      # variable / config option, there are multiple ways to do this, e.g. in the tuwunel.toml file, and in a separate
-      # reverse proxy, but since you do not have a reverse proxy and following this guide, this example is included
-      TUWUNEL_WELL_KNOWN: |
-        {
-          client=https://your.server.name.example,
-          server=your.server.name.example:443
-        }
-    #cpuset: "0-4" # Uncomment to limit to specific CPU cores
-    ulimits: # tuwunel uses quite a few file descriptors, and on some systems it defaults to 1024, so you can tell docker to increase it
-      nofile:
-        soft: 1048567
-        hard: 1048567
-
-    ### Uncomment if you want to use your own Element-Web App.
-    ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and tuwunel
-    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
-    # element-web:
-    #     image: vectorim/element-web:latest
-    #     restart: unless-stopped
-    #     volumes:
-    #         - ./element_config.json:/app/config.json
-    #     networks:
-    #         - proxy
-    #     depends_on:
-    #         - homeserver
-
-  traefik:
-    image: "traefik:latest"
-    container_name: "traefik"
-    restart: "unless-stopped"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:z"
-      - "acme:/etc/traefik/acme"
-      #- "./traefik_config:/etc/traefik:z"
-    labels:
-      - "traefik.enable=true"
-
-      # middleware redirect
-      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
-      # global redirect to https
-      - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
-      - "traefik.http.routers.redirs.entrypoints=web"
-      - "traefik.http.routers.redirs.middlewares=redirect-to-https"
-
-    configs:
-      - source: dynamic.yml
-        target: /etc/traefik/dynamic.yml
-
-    environment:
-      TRAEFIK_LOG_LEVEL: DEBUG
-      TRAEFIK_ENTRYPOINTS_WEB: true
-      TRAEFIK_ENTRYPOINTS_WEB_ADDRESS: ":80"
-      TRAEFIK_ENTRYPOINTS_WEB_HTTP_REDIRECTIONS_ENTRYPOINT_TO: websecure
-
-      TRAEFIK_ENTRYPOINTS_WEBSECURE: true
-      TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS: ":443"
-      TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_TLS_CERTRESOLVER: letsencrypt
-      #TRAEFIK_ENTRYPOINTS_WEBSECURE_HTTP_MIDDLEWARES: secureHeaders@file # if you want to enabled STS
-
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT: true
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: # Set this to the email you want to receive certificate expiration emails for
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_KEYTYPE: EC384
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE: true
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT: web
-      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE: "/etc/traefik/acme/acme.json"
-
-      TRAEFIK_PROVIDERS_DOCKER: true
-      TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: "unix:///var/run/docker.sock"
-      TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: false
-
-      TRAEFIK_PROVIDERS_FILE: true
-      TRAEFIK_PROVIDERS_FILE_FILENAME: "/etc/traefik/dynamic.yml"
-
-configs:
-  dynamic.yml:
-    content: |
-      # Optionally set STS headers, like in https://hstspreload.org
-      # http:
-      #   middlewares:
-      #     secureHeaders:
-      #       headers:
-      #         forceSTSHeader: true
-      #         stsIncludeSubdomains: true
-      #         stsPreload: true
-      #         stsSeconds: 31536000
-      tls:
-        options:
-          default:
-            cipherSuites:
-              - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-              - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-              - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
-              - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-              - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
-              - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
-            minVersion: VersionTLS12
-
-volumes:
-    db:
-    acme:
-
-networks:
-    proxy:
-
-# vim: ts=2:sw=2:expandtab

docs/deploying/docker-compose.yml

@@ -1,44 +0,0 @@
-# tuwunel
-
-services:
-    homeserver:
-        ### If you already built the tuwunel image with 'docker build' or want to use a registry image,
-        ### then you are ready to go.
-        image: jevolk/tuwunel:latest
-        restart: unless-stopped
-        ports:
-            - 8448:6167
-        volumes:
-            - db:/var/lib/tuwunel
-            #- ./tuwunel.toml:/etc/tuwunel.toml
-        environment:
-            TUWUNEL_SERVER_NAME: your.server.name # EDIT THIS
-            TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
-            TUWUNEL_PORT: 6167
-            TUWUNEL_MAX_REQUEST_SIZE: 20000000 # in bytes, ~20 MB
-            TUWUNEL_ALLOW_REGISTRATION: 'true'
-            TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
-            #TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
-            TUWUNEL_ALLOW_FEDERATION: 'true'
-            TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
-            TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
-            #TUWUNEL_LOG: warn,state_res=warn
-            TUWUNEL_ADDRESS: 0.0.0.0
-            #TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
-    #
-    ### Uncomment if you want to use your own Element-Web App.
-    ### Note: You need to provide a config.json for Element and you also need a second
-    ###       Domain or Subdomain for the communication between Element and tuwunel
-    ### Config-Docs: https://github.com/vector-im/element-web/blob/develop/docs/config.md
-    # element-web:
-    #     image: vectorim/element-web:latest
-    #     restart: unless-stopped
-    #     ports:
-    #         - 8009:80
-    #     volumes:
-    #         - ./element_config.json:/app/config.json
-    #     depends_on:
-    #         - homeserver
-
-volumes:
-    db:

docs/deploying/docker.md

@@ -1,141 +0,0 @@
-# tuwunel for Docker
-
-## Docker
-
-To run tuwunel with Docker you can either build the image yourself or pull it
-from a registry.
-
-### Use a registry
-
-OCI images for tuwunel are available in the registries listed below.
-
-| Registry        | Image                                                           | Size                          | Notes                  |
-| --------------- | --------------------------------------------------------------- | ----------------------------- | ---------------------- |
-| GitHub Registry | [ghcr.io/matrix-construct/tuwunel:latest][gh] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
-| Docker Hub      | [docker.io/jevolk/tuwunel:latest][dh]             | ![Image Size][shield-latest]  | Stable latest tagged image.          |
-| GitHub Registry | [ghcr.io/matrix-construct/tuwunel:main][gh]   | ![Image Size][shield-main]    | Stable main branch.   |
-| Docker Hub      | [docker.io/jevolk/tuwunel:main][dh]               | ![Image Size][shield-main]    | Stable main branch.   |
-
-[dh]: https://hub.docker.com/r/jevolk/tuwunel
-[gh]: https://github.com/matrix-construct/tuwunel/pkgs/container/tuwunel
-[shield-latest]: https://img.shields.io/docker/image-size/jevolk/tuwunel/latest
-[shield-main]: https://img.shields.io/docker/image-size/jevolk/tuwunel/main
-
-### Run
-
-When you have the image you can simply run it with
-
-```bash
-docker run -d -p 8448:6167 \
-    -v db:/var/lib/tuwunel/ \
-    -e TUWUNEL_SERVER_NAME="your.server.name" \
-    -e TUWUNEL_ALLOW_REGISTRATION=false \
-    --name tuwunel $LINK
-```
-
-or you can use [docker compose](#docker-compose).
-
-The `-d` flag lets the container run in detached mode. You may supply an
-optional `tuwunel.toml` config file, the example config can be found
-[here](../configuration/examples.md). You can pass in different env vars to
-change config values on the fly. You can even configure tuwunel completely by
-using env vars. For an overview of possible values, please take a look at the
-[`docker-compose.yml`](docker-compose.yml) file.
-
-If you just want to test tuwunel for a short time, you can use the `--rm`
-flag, which will clean up everything related to your container after you stop
-it.
-
-### Docker-compose
-
-If the `docker run` command is not for you or your setup, you can also use one
-of the provided `docker-compose` files.
-
-Depending on your proxy setup, you can use one of the following files;
-
-- If you already have a `traefik` instance set up, use
-[`docker-compose.for-traefik.yml`](docker-compose.for-traefik.yml)
-- If you don't have a `traefik` instance set up and would like to use it, use
-[`docker-compose.with-traefik.yml`](docker-compose.with-traefik.yml)
-- If you want a setup that works out of the box with `caddy-docker-proxy`, use
-[`docker-compose.with-caddy.yml`](docker-compose.with-caddy.yml) and replace all
-`example.com` placeholders with your own domain
-- For any other reverse proxy, use [`docker-compose.yml`](docker-compose.yml)
-
-When picking the traefik-related compose file, rename it so it matches
-`docker-compose.yml`, and rename the override file to
-`docker-compose.override.yml`. Edit the latter with the values you want for your
-server.
-
-When picking the `caddy-docker-proxy` compose file, it's important to first
-create the `caddy` network before spinning up the containers:
-
-```bash
-docker network create caddy
-```
-
-After that, you can rename it so it matches `docker-compose.yml` and spin up the
-containers!
-
-Additional info about deploying tuwunel can be found [here](generic.md).
-
-### Run
-
-If you already have built the image or want to use one from the registries, you
-can just start the container and everything else in the compose file in detached
-mode with:
-
-```bash
-docker compose up -d
-```
-
-> **Note:** Don't forget to modify and adjust the compose file to your needs.
-
-### Nix build
-
-Tuwunel's Nix images are built using [`buildLayeredImage`][nix-buildlayeredimage].
-This ensures all OCI images are repeatable and reproducible by anyone, keeps the
-images lightweight, and can be built offline.
-
-This also ensures portability of our images because `buildLayeredImage` builds
-OCI images, not Docker images, and works with other container software.
-
-The OCI images are OS-less with only a very minimal environment of the `tini`
-init system, CA certificates, and the tuwunel binary. This does mean there is
-not a shell, but in theory you can get a shell by adding the necessary layers
-to the layered image. However it's very unlikely you will need a shell for any
-real troubleshooting.
-
-The flake file for the OCI image definition is at [`nix/pkgs/oci-image/default.nix`][oci-image-def].
-
-To build an OCI image using Nix, the following outputs can be built:
-- `nix build -L .#oci-image` (default features, x86_64 glibc)
-- `nix build -L .#oci-image-x86_64-linux-musl` (default features, x86_64 musl)
-- `nix build -L .#oci-image-aarch64-linux-musl` (default features, aarch64 musl)
-- `nix build -L .#oci-image-x86_64-linux-musl-all-features` (all features, x86_64 musl)
-- `nix build -L .#oci-image-aarch64-linux-musl-all-features` (all features, aarch64 musl)
-
-### Use Traefik as Proxy
-
-As a container user, you probably know about Traefik. It is a easy to use
-reverse proxy for making containerized app and services available through the
-web. With the two provided files,
-[`docker-compose.for-traefik.yml`](docker-compose.for-traefik.yml) (or
-[`docker-compose.with-traefik.yml`](docker-compose.with-traefik.yml)) and
-[`docker-compose.override.yml`](docker-compose.override.yml), it is equally easy
-to deploy and use tuwunel, with a little caveat. If you already took a look at
-the files, then you should have seen the `well-known` service, and that is the
-little caveat. Traefik is simply a proxy and loadbalancer and is not able to
-serve any kind of content, but for tuwunel to federate, we need to either
-expose ports `443` and `8448` or serve two endpoints `.well-known/matrix/client`
-and `.well-known/matrix/server`.
-
-With the service `well-known` we use a single `nginx` container that will serve
-those two files.
-
-## Voice communication
-
-See the [TURN](../turn.md) page.
-
-[nix-buildlayeredimage]: https://ryantm.github.io/nixpkgs/builders/images/dockertools/#ssec-pkgs-dockerTools-buildLayeredImage
-[oci-image-def]: https://github.com/jevolk/tuwunel/blob/main/nix/pkgs/oci-image/default.nix

docs/deploying/freebsd.md

@@ -1,6 +0,0 @@
-# Tuwunel for FreeBSD
-
-Tuwunel at the moment does not provide FreeBSD builds or have FreeBSD packaging, however Tuwunel does
-build and work on FreeBSD using the system-provided RocksDB.
-
-Contributions for getting Tuwunel into ports are welcome.

docs/deploying/generic.md

@@ -1,252 +0,0 @@
-# Generic deployment documentation
-
-> ### Getting help
->
-> If you run into any problems while setting up Tuwunel [open an issue on
-> GitHub](https://github.com/matrix-construct/tuwunel/issues/new).
-
-## Installing Tuwunel
-
-### Static prebuilt binary
-
-You may simply download the binary that fits your machine architecture (x86_64
-or aarch64). Run `uname -m` to see what you need.
-
-Prebuilt fully static binaries can be downloaded from the latest tagged
-release [here](https://github.com/matrix-construct/tuwunel/releases/latest) or
-`main` CI branch workflow artifact output. These also include `.deb` packages
-for Debian or Ubuntu and `.rpm` packages for Red Hat or Fedora.
-
-For the **best** performance; if using an `x86_64` CPU made in the last ~10 years,
-we recommend using the `-v3-` optimised packages. See below for a command to check
-what your system supports. If the server refuses to start or exits with an "Illegal
-Instruction" error you will need `-v2-` or `-v1-` packages instead. The database
-backend, RocksDB, benefits from `-v2-` or greater as it features performance
-critical hardware accelerated CRC32 hashing/checksumming.
-
-Linux users can run this script to display which optimization levels they may
-choose:
-```
-cat /proc/cpuinfo | grep -Po '(avx|sse)[235]' | sort -u | sed 's/avx5/v4/;s/avx2/v3/;s/sse3/v2/;s/sse2/v1/' | sort
-```
-
-### Compiling
-
-Alternatively, you may compile the binary yourself. We recommend using
-Nix to build tuwunel as this has the most
-guaranteed reproducibiltiy and easiest to get a build environment and output
-going. This also allows easy cross-compilation.
-
-You can run the `nix build -L .#static-x86_64-linux-musl-all-features` or
-`nix build -L .#static-aarch64-linux-musl-all-features` commands based
-on architecture to cross-compile the necessary static binary located at
-`result/bin/tuwunel`. This is reproducible with the static binaries produced
-in our CI.
-
-If wanting to build using standard Rust toolchains, make sure you install:
-- `liburing-dev` on the compiling machine, and `liburing` on the target host
-- LLVM and libclang for RocksDB
-
-You can build Tuwunel using `cargo build --release --all-features`
-
-## Adding a Tuwunel user
-
-While Tuwunel can run as any user it is better to use dedicated users for
-different services. This also allows you to make sure that the file permissions
-are correctly set up.
-
-In Debian, you can use this command to create a Tuwunel user:
-
-```bash
-sudo adduser --system tuwunel --group --disabled-login --no-create-home
-```
-
-For distros without `adduser` (or where it's a symlink to `useradd`):
-
-```bash
-sudo useradd -r --shell /usr/bin/nologin --no-create-home tuwunel
-```
-
-## Forwarding ports in the firewall or the router
-
-Matrix's default federation port is port 8448, and clients must be using port 443.
-If you would like to use only port 443, or a different port, you will need to setup
-delegation. Tuwunel has config options for doing delegation, or you can configure
-your reverse proxy to manually serve the necessary JSON files to do delegation
-(see the `[global.well_known]` config section).
-
-If Tuwunel runs behind a router or in a container and has a different public
-IP address than the host system these public ports need to be forwarded directly
-or indirectly to the port mentioned in the config.
-
-Note for NAT users; if you have trouble connecting to your server from the inside
-of your network, you need to research your router and see if it supports "NAT
-hairpinning" or "NAT loopback".
-
-If your router does not support this feature, you need to research doing local
-DNS overrides and force your Matrix DNS records to use your local IP internally.
-This can be done at the host level using `/etc/hosts`. If you need this to be
-on the network level, consider something like NextDNS or Pi-Hole.
-
-## Setting up a systemd service
-
-Two example systemd units for Tuwunel can be found
-[on the configuration page](../configuration/examples.md#debian-systemd-unit-file).
-You may need to change the `ExecStart=` path to where you placed the Tuwunel
-binary if it is not `/usr/bin/tuwunel`.
-
-On systems where rsyslog is used alongside journald (i.e. Red Hat-based distros
-and OpenSUSE), put `$EscapeControlCharactersOnReceive off` inside
-`/etc/rsyslog.conf` to allow color in logs.
-
-If you are using a different `database_path` other than the systemd unit
-configured default `/var/lib/tuwunel`, you need to add your path to the
-systemd unit's `ReadWritePaths=`. This can be done by either directly editing
-`tuwunel.service` and reloading systemd, or running `systemctl edit tuwunel.service`
-and entering the following:
-
-```
-[Service]
-ReadWritePaths=/path/to/custom/database/path
-```
-
-## Creating the Tuwunel configuration file
-
-Now we need to create the Tuwunel's config file in
-`/etc/tuwunel/tuwunel.toml`. The example config can be found at
-[tuwunel-example.toml](../configuration/examples.md).
-
-**Please take a moment to read the config. You need to change at least the
-server name.**
-
-RocksDB is the only supported database backend.
-
-## Setting the correct file permissions
-
-If you are using a dedicated user for Tuwunel, you will need to allow it to
-read the config. To do that you can run this:
-
-```bash
-sudo chown -R root:root /etc/tuwunel
-sudo chmod -R 755 /etc/tuwunel
-```
-
-If you use the default database path you also need to run this:
-
-```bash
-sudo mkdir -p /var/lib/tuwunel/
-sudo chown -R tuwunel:tuwunel /var/lib/tuwunel/
-sudo chmod 700 /var/lib/tuwunel/
-```
-
-## Setting up the Reverse Proxy
-
-We recommend Caddy as a reverse proxy, as it is trivial to use, handling TLS certificates, reverse proxy headers, etc transparently with proper defaults.
-For other software, please refer to their respective documentation or online guides.
-
-### Caddy
-
-After installing Caddy via your preferred method, create `/etc/caddy/conf.d/tuwunel_caddyfile`
-and enter this (substitute for your server name).
-
-```caddyfile
-your.server.name, your.server.name:8448 {
-    # TCP reverse_proxy
-    reverse_proxy localhost:8008
-    # UNIX socket
-    #reverse_proxy unix//run/tuwunel/tuwunel.sock
-}
-```
-
-That's it! Just start and enable the service and you're set.
-
-```bash
-sudo systemctl enable --now caddy
-```
-
-### Other Reverse Proxies
-
-_Specific contributions for other proxies are welcome!_
-
-You will need to reverse proxy everything under following routes:
-- `/_matrix/` - core Matrix C-S and S-S APIs
-- `/_tuwunel/` - ad-hoc Tuwunel routes such as `/local_user_count` and
-`/server_version`
-
-You can optionally reverse proxy the following individual routes:
-- `/.well-known/matrix/client` and `/.well-known/matrix/server` if using
-Tuwunel to perform delegation (see the `[global.well_known]` config section)
-- `/.well-known/matrix/support` if using Tuwunel to send the homeserver admin
-contact and support page (formerly known as MSC1929)
-- `/` if you would like to see `hewwo from tuwunel woof!` at the root
-
-See the following spec pages for more details on these files:
-- [`/.well-known/matrix/server`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixserver)
-- [`/.well-known/matrix/client`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient)
-- [`/.well-known/matrix/support`](https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixsupport)
-
-Examples of delegation:
-- <https://matrix.org/.well-known/matrix/server>
-- <https://matrix.org/.well-known/matrix/client>
-
-For Apache and Nginx there are many examples available online.
-
-Lighttpd is not supported as it seems to mess with the `X-Matrix` Authorization
-header, making federation non-functional. If a workaround is found, feel free to share to get it added to the documentation here.
-
-If using Apache, you need to use `nocanon` in your `ProxyPass` directive to prevent httpd from messing with the `X-Matrix` header (note that Apache isn't very good as a general reverse proxy and we discourage the usage of it if you can).
-
-If using Nginx, you need to give Tuwunel the request URI using `$request_uri`, or like so:
-- `proxy_pass http://127.0.0.1:6167$request_uri;`
-- `proxy_pass http://127.0.0.1:6167;`
-
-Nginx users need to increase `client_max_body_size` (default is 1M) to match
-`max_request_size` defined in tuwunel.toml.
-
-## You're done
-
-Now you can start Tuwunel with:
-
-```bash
-sudo systemctl start tuwunel
-```
-
-Set it to start automatically when your system boots with:
-
-```bash
-sudo systemctl enable tuwunel
-```
-
-## How do I know it works?
-
-You can open [a Matrix client](https://matrix.org/ecosystem/clients), enter your
-homeserver and try to register.
-
-You can also use these commands as a quick health check (replace
-`your.server.name`).
-
-```bash
-curl https://your.server.name/_tuwunel/server_version
-
-# If using port 8448
-curl https://your.server.name:8448/_tuwunel/server_version
-
-# If federation is enabled
-curl https://your.server.name:8448/_matrix/federation/v1/version
-```
-
-- To check if your server can talk with other homeservers, you can use the
-[Matrix Federation Tester](https://federationtester.matrix.org/). If you can
-register but cannot join federated rooms check your config again and also check
-if the port 8448 is open and forwarded correctly.
-
-# What's next?
-
-## Audio/Video calls
-
-For Audio/Video call functionality see the [TURN Guide](../turn.md).
-
-## Appservices
-
-If you want to set up an appservice, take a look at the [Appservice
-Guide](../appservices.md).

docs/deploying/kubernetes.md

@@ -1,9 +0,0 @@
-# Tuwunel for Kubernetes
-
-Tuwunel doesn't support horizontal scalability or distributed loading
-natively, however a community maintained Helm Chart is available here to run
-Tuwunel on Kubernetes: <https://github.com/AreYouLoco/tuwunel-helm> and the
-legacy conduwuit version: <https://gitlab.cronce.io/charts/conduwuit>.
-
-Should changes need to be made, please reach out to the maintainer in our
-Matrix room as this is not maintained/controlled by the Tuwunel maintainers.

docs/deploying/nixos.md

@@ -1,109 +0,0 @@
-_This file may be out of date. Please help us update it_
-
-# Tuwunel for NixOS
-
-Tuwunel can be acquired by Nix from various places:
-
-* The `flake.nix` at the root of the repo
-* The `default.nix` at the root of the repo
-* From Tuwunel's binary cache
-
-A community maintained NixOS package is available at [`tuwunel`](https://search.nixos.org/packages?channel=unstable&show=tuwunel&from=0&size=50&sort=relevance&type=packages&query=tuwunel)
-
-### Binary cache
-
-A binary cache for Tuwunel that the CI/CD publishes to is available at the
-following places (both are the same just different names):
-
-```
-https://attic.kennel.juneis.dog/conduit
-conduit:eEKoUwlQGDdYmAI/Q/0slVlegqh/QmAvQd7HBSm21Wk=
-
-https://attic.kennel.juneis.dog/conduwuit
-conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE=
-```
-
-The binary caches were recreated some months ago due to attic issues. The old public
-keys were:
-
-```
-conduit:Isq8FGyEC6FOXH6nD+BOeAA+bKp6X6UIbupSlGEPuOg=
-conduwuit:lYPVh7o1hLu1idH4Xt2QHaRa49WRGSAqzcfFd94aOTw=
-```
-
-If needed, we have a binary cache on Cachix but it is only limited to 5GB:
-
-```
-https://conduwuit.cachix.org
-conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg=
-```
-
-If specifying a Git remote URL in your flake, you can use any remotes that
-are specified on the README (the mirrors), such as the GitHub: `github:matrix-construct/tuwunel`
-
-### NixOS module
-
-The `flake.nix` and `default.nix` do not currently provide a NixOS module (contributions
-welcome!), so [`services.matrix-conduit`][module] from Nixpkgs can be used to configure
-Tuwunel.
-
-### Conduit NixOS Config Module and SQLite
-
-Beware! The [`services.matrix-conduit`][module] module defaults to SQLite as a database backend.
-Conduwuit dropped SQLite support in favor of exclusively supporting the much faster RocksDB.
-Make sure that you are using the RocksDB backend before migrating!
-
-There is a [tool to  migrate a Conduit SQLite database to
-RocksDB](https://github.com/ShadowJonathan/conduit_toolbox/).
-
-If you want to run the latest code, you should get Tuwunel from the `flake.nix`
-or `default.nix` and set [`services.matrix-conduit.package`][package]
-appropriately to use Tuwunel instead of Conduit.
-
-### UNIX sockets
-
-Due to the lack of a Tuwunel NixOS module, when using the `services.matrix-conduit` module
-a workaround like the one below is necessary to use UNIX sockets. This is because the UNIX
-socket option does not exist in Conduit, and the module forcibly sets the `address` and 
-`port` config options.
-
-```nix
-options.services.matrix-conduit.settings = lib.mkOption {
-  apply = old: old // (
-    if (old.global ? "unix_socket_path")
-    then { global = builtins.removeAttrs old.global [ "address" "port" ]; }
-    else {  }
-  );
-};
-
-```
-
-Additionally, the [`matrix-conduit` systemd unit][systemd-unit] in the module does not allow
-the `AF_UNIX` socket address family in their systemd unit's `RestrictAddressFamilies=` which
-disallows the namespace from accessing or creating UNIX sockets and has to be enabled like so:
-
-```nix
-systemd.services.conduit.serviceConfig.RestrictAddressFamilies = [ "AF_UNIX" ];
-```
-
-Even though those workarounds are feasible a Tuwunel NixOS configuration module, developed and
-published by the community, would be appreciated.
-
-### jemalloc and hardened profile
-
-Tuwunel uses jemalloc by default. This may interfere with the [`hardened.nix` profile][hardened.nix]
-due to them using `scudo` by default. You must either disable/hide `scudo` from Tuwunel, or
-disable jemalloc like so:
-
-```nix
-let
-    tuwunel = pkgs.unstable.tuwunel.override {
-      enableJemalloc = false;
-    };
-in
-```
-
-[module]: https://search.nixos.org/options?channel=unstable&query=services.matrix-conduit
-[package]: https://search.nixos.org/options?channel=unstable&query=services.matrix-conduit.package
-[hardened.nix]: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix#L22
-[systemd-unit]: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/matrix/conduit.nix#L132

docs/deploying/podman-systemd.md

@@ -1,16 +0,0 @@
-# tuwunel in Podman systemd
-
-Copy [tuwunel.container](tuwunel.container) to ~/.config/containers/systemd/tuwunel.container.
-Reload daemon:
-```
-systemctl --user daemon-reload
-```
-Start the service:
-```
-systemctl --user start tuwunel
-```
-
-To check the logs, run:
-```
-journalctl -eu tuwunel.container --user
-```

docs/deploying/redhat.md

@@ -1 +0,0 @@
-{{#include ../../rpm/README.md}}

docs/deploying/tuwunel.container

@@ -1,9 +0,0 @@
-[Container]
-Environment=TUWUNEL_SERVER_NAME=your.domain.here TUWUNEL_DATABASE_PATH=/var/lib/tuwunel TUWUNEL_PORT=6167 TUWUNEL_MAX_REQUEST_SIZE=20000000 TUWUNEL_ALLOW_REGISTRATION=true TUWUNEL_REGISTRATION_TOKEN=YOUR_TOKEN TUWUNEL_ALLOW_FEDERATION=true TUWUNEL_ALLOW_CHECK_FOR_UPDATES=true TUWUNEL_TRUSTED_SERVERS=["matrix.org"] TUWUNEL_ADDRESS=0.0.0.0 # Add TUWUNEL_CONFIG: '/etc/tuwunel.toml' if the config is mapped
-Image=docker.io/jevolk/tuwunel:latest
-PublishPort=8448:6167
-Volume=/path/to/db:/var/lib/tuwunel
-#Volume=/path/to/tuwunel.toml:/etc/tuwunel.toml #Uncomment to use the config file
-
-[Service]
-Restart=always

docs/development.md

@@ -1,131 +0,0 @@
-# Development
-
-Information about developing the project. If you are only interested in using
-it, you can safely ignore this page. If you plan on contributing, see the
-[contributor's guide](./contributing.md).
-
-## Tuwunel project layout
-
-Tuwunel uses a collection of sub-crates, packages, or workspace members
-that indicate what each general area of code is for. All of the workspace
-members are under `src/`. The workspace definition is at the top level / root
-`Cargo.toml`.
-
-The crate names are generally self-explanatory:
-- `admin` is the admin room
-- `api` is the HTTP API, Matrix C-S and S-S endpoints, etc
-- `core` is core Tuwunel functionality like config loading, error definitions,
-global utilities, logging infrastructure, etc
-- `database` is RocksDB methods, helpers, RocksDB config, and general database definitions,
-utilities, or functions
-- `macros` are Tuwunel Rust [macros][macros] like general helper macros, logging
-and error handling macros, and [syn][syn] and [procedural macros][proc-macro]
-used for admin room commands and others
-- `main` is the "primary" sub-crate. This is where the `main()` function lives,
-tokio worker and async initialisation, Sentry initialisation, [clap][clap] init,
-and signal handling. If you are adding new [Rust features][features], they *must*
-go here.
-- `router` is the webserver and request handling bits, using axum, tower, tower-http,
-hyper, etc, and the [global server state][state] to access `services`.
-- `service` is the high-level database definitions and functions for data,
-outbound/sending code, and other business logic such as media fetching.
-
-It is highly unlikely you will ever need to add a new workspace member, but
-if you truly find yourself needing to, we recommend reaching out to us in
-the Matrix room for discussions about it beforehand.
-
-The primary inspiration for this design was apart of hot reloadable development,
-to support "Tuwunel as a library" where specific parts can simply be swapped out.
-There is evidence Conduit wanted to go this route too as `axum` is technically an
-optional feature in Conduit, and can be compiled without the binary or axum library
-for handling inbound web requests; but it was never completed or worked.
-
-See the Rust documentation on [Workspaces][workspaces] for general questions
-and information on Cargo workspaces.
-
-## Adding compile-time [features][features]
-
-If you'd like to add a compile-time feature, you must first define it in
-the `main` workspace crate located in `src/main/Cargo.toml`. The feature must
-enable a feature in the other workspace crate(s) you intend to use it in. Then
-the said workspace crate(s) must define the feature there in its `Cargo.toml`.
-
-So, if this is adding a feature to the API such as `woof`, you define the feature
-in the `api` crate's `Cargo.toml` as `woof = []`. The feature definition in `main`'s
-`Cargo.toml` will be `woof = ["tuwunel-api/woof"]`.
-
-The rationale for this is due to Rust / Cargo not supporting
-["workspace level features"][9], we must make a choice of; either scattering
-features all over the workspace crates, making it difficult for anyone to add
-or remove default features; or define all the features in one central workspace
-crate that propagate down/up to the other workspace crates. It is a Cargo pitfall,
-and we'd like to see better developer UX in Rust's Workspaces.
-
-Additionally, the definition of one single place makes "feature collection" in our
-Nix flake a million times easier instead of collecting and deduping them all from
-searching in all the workspace crates' `Cargo.toml`s. Though we wouldn't need to
-do this if Rust supported workspace-level features to begin with.
-
-## List of forked dependencies
-
-During Tuwunel development, we have had to fork
-some dependencies to support our use-cases in some areas. This ranges from
-things said upstream project won't accept for any reason, faster-paced
-development (unresponsive or slow upstream), Tuwunel-specific usecases, or
-lack of time to upstream some things.
-
-- [ruma/ruma][1]: <https://github.com/matrix-construct/ruma> - various performance
-improvements, more features, faster-paced development, better client/server interop
-hacks upstream won't accept, etc
-- [facebook/rocksdb][2]: <https://github.com/matrix-construct/rocksdb> - liburing
-build fixes and GCC debug build fix
-- [tikv/jemallocator][3]: <https://github.com/matrix-construct/jemallocator> - musl
-builds seem to be broken on upstream, fixes some broken/suspicious code in
-places, additional safety measures, and support redzones for Valgrind
-- [zyansheep/rustyline-async][4]:
-<https://github.com/matrix-construct/rustyline-async> - tab completion callback and
-`CTRL+\` signal quit event for Tuwunel console CLI
-- [rust-rocksdb/rust-rocksdb][5]:
-<https://github.com/matrix-construct/rust-rocksdb-zaidoon1> - [`@zaidoon1`][8]'s fork
-has quicker updates, more up to date dependencies, etc. Our fork fixes musl build
-issues, removes unnecessary `gtest` include, and uses our RocksDB and jemallocator
-forks.
-- [tokio-rs/tracing][6]: <https://github.com/matrix-construct/tracing> - Implements
-`Clone` for `EnvFilter` to support dynamically changing tracing envfilter's
-alongside other logging/metrics things
-
-## Debugging with `tokio-console`
-
-[`tokio-console`][7] can be a useful tool for debugging and profiling. To make a
-`tokio-console`-enabled build of Tuwunel, enable the `tokio_console` feature,
-disable the default `release_max_log_level` feature, and set the `--cfg
-tokio_unstable` flag to enable experimental tokio APIs. A build might look like
-this:
-
-```bash
-RUSTFLAGS="--cfg tokio_unstable" cargo +nightly build \
-    --release \
-    --no-default-features \
-    --features=systemd,element_hacks,gzip_compression,brotli_compression,zstd_compression,tokio_console
-```
-
-You will also need to enable the `tokio_console` config option in Tuwunel when
-starting it. This was due to tokio-console causing gradual memory leak/usage
-if left enabled.
-
-[1]: https://github.com/ruma/ruma/
-[2]: https://github.com/facebook/rocksdb/
-[3]: https://github.com/tikv/jemallocator/
-[4]: https://github.com/zyansheep/rustyline-async/
-[5]: https://github.com/rust-rocksdb/rust-rocksdb/
-[6]: https://github.com/tokio-rs/tracing/
-[7]: https://docs.rs/tokio-console/latest/tokio_console/
-[8]: https://github.com/zaidoon1/
-[9]: https://github.com/rust-lang/cargo/issues/12162
-[workspaces]: https://doc.rust-lang.org/cargo/reference/workspaces.html
-[macros]: https://doc.rust-lang.org/book/ch19-06-macros.html
-[syn]: https://docs.rs/syn/latest/syn/
-[proc-macro]: https://doc.rust-lang.org/reference/procedural-macros.html
-[clap]: https://docs.rs/clap/latest/clap/
-[features]: https://doc.rust-lang.org/cargo/reference/features.html
-[state]: https://docs.rs/axum/latest/axum/extract/struct.State.html

docs/development/hot_reload.md

@@ -1,200 +0,0 @@
-# Hot Reloading ("Live" Development)
-
-Note that hot reloading has not been refactored in quite a while and is not
-guaranteed to work at this time.
-
-### Summary
-
-When developing in debug-builds with the nightly toolchain, Tuwunel is modular
-using dynamic libraries and various parts of the application are hot-reloadable
-while the server is running: http api handlers, admin commands, services,
-database, etc. These are all split up into individual workspace crates as seen
-in the `src/` directory. Changes to sourcecode in a crate rebuild that crate and
-subsequent crates depending on it. Reloading then occurs for the changed crates.
-
-Release builds still produce static binaries which are unaffected. Rust's
-soundness guarantees are in full force. Thus you cannot hot-reload release
-binaries.
-
-### Requirements
-
-Currently, this development setup only works on x86_64 and aarch64 Linux glibc.
-[musl explicitly does not support hot reloadable libraries, and does not
-implement `dlclose`][2]. macOS does not fully support our usage of `RTLD_GLOBAL`
-possibly due to some thread-local issues. [This Rust issue][3] may be of
-relevance, specifically [this comment][4]. It may be possible to get it working
-on only very modern macOS versions such as at least Sonoma, as currently loading
-dylibs is supported, but not unloading them in our setup, and the cited comment
-mentions an Apple WWDC confirming there have been TLS changes to somewhat make
-this possible.
-
-As mentioned above this requires the nightly toolchain. This is due to reliance
-on various Cargo.toml features that are only available on nightly, most
-specifically `RUSTFLAGS` in Cargo.toml. Some of the implementation could also be
-simpler based on other various nightly features. We hope lots of nightly
-features start making it out of nightly sooner as there have been dozens of very
-helpful features that have been stuck in nightly ("unstable") for at least 5+
-years that would make this simpler. We encourage greater community consensus to
-move these features into stability.
-
-This currently only works on x86_64/aarch64 Linux with a glibc C library. musl C
-library, macOS, and likely other host architectures are not supported (if other
-architectures work, feel free to let us know and/or make a PR updating this).
-This should work on GNU ld and lld (rust-lld) and gcc/clang, however if you
-happen to have linker issues it's recommended to try using `mold` or `gold`
-linkers, and please let us know in the [Tuwunel Matrix room][7] the linker
-error and what linker solved this issue so we can figure out a solution. Ideally
-there should be minimal friction to using this, and in the future a build script
-(`build.rs`) may be suitable to making this easier to use if the capabilities
-allow us.
-
-### Usage
-
-As of 19 May 2024, the instructions for using this are:
-
-0. Have patience. Don't hesitate to join the [Tuwunel Matrix room][7] to
-   receive help using this. As indicated by the various rustflags used and some
-of the interesting issues linked at the bottom, this is definitely not something
-the Rust ecosystem or toolchain is used to doing.
-
-1. Install the nightly toolchain using rustup. You may need to use `rustup
-   override set nightly` in your local Tuwunel directory, or use `cargo
-+nightly` for all actions.
-
-2. Uncomment `cargo-features` at the top level / root Cargo.toml
-
-3. Scroll down to the `# Developer profile` section and uncomment ALL the
-   rustflags for each dev profile and their respective packages.
-
-4. In each workspace crate's Cargo.toml (everything under `src/*` AND
-   `deps/rust-rocksdb/Cargo.toml`), uncomment the `dylib` crate type under
-`[lib]`.
-
-5. Due to [this rpath issue][5], you must export the `LD_LIBRARY_PATH`
-   environment variable to your nightly Rust toolchain library directory. If
-using rustup (hopefully), use this: `export
-LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$HOME/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/`
-
-6. Start the server. You can use `cargo +nightly run` for this along with the
-   standard.
-
-7. Make some changes where you need to.
-
-8. In a separate terminal window in the same directory (or using a terminal
-   multiplexer like tmux), run the *build* Cargo command `cargo +nightly build`.
-   Cargo should only rebuild what was changed / what's necessary, so it should
-   not be rebuilding all the crates.
-
-9. In your Tuwunel server terminal, hit/send `CTRL+C` signal. This will tell
-   Tuwunel to find which libraries need to be reloaded, and reloads them as
-   necessary.
-
-10. If there were no errors, it will tell you it successfully reloaded `#`
-   modules, and your changes should now be visible. Repeat 7 - 9 as needed.
-
-To shutdown Tuwunel in this setup, hit/send `CTRL+\`. Normal builds still
-shutdown with `CTRL+C` as usual.
-
-Steps 1 - 5 are the initial first-time steps for using this. To remove the hot
-reload setup, revert/comment all the Cargo.toml changes.
-
-As mentioned in the requirements section, if you happen to have some linker
-issues, try using the `-fuse-ld=` rustflag and specify mold or gold in all the
-`rustflags` definitions in the top level Cargo.toml, and please let us know in
-the [Tuwunel Matrix room][7] the problem. mold can be installed typically
-through your distro, and gold is provided by the binutils package.
-
-It's possible a helper script can be made to do all of this, or most preferably
-a specially made build script (build.rs). `cargo watch` support will be
-implemented soon which will eliminate the need to manually run `cargo build` all
-together.
-
-### Addendum
-
-Conduit was inherited as a single crate without modularity or reloading in its
-design. Reasonable partitioning and abstraction allowed a split into several
-crates, though many circular dependencies had to be corrected. The resulting
-crates now form a directed graph as depicted in figures below. The interfacing
-between these crates is still extremely broad which is not mitigable.
-
-Initially [hot_lib_reload][6] was investigated but found appropriate for a
-project designed with modularity through limited interfaces, not a large and
-complex existing codebase. Instead a bespoke solution built directly on
-[libloading][8] satisfied our constraints. This required relatively minimal
-modifications and zero maintenance burden compared to what would be required
-otherwise. The technical difference lies with relocation processing: we leverage
-global bindings (`RTLD_GLOBAL`) in a very intentional way. Most libraries and
-off-the-shelf module systems (such as [hot_lib_reload][6]) restrict themselves
-to local bindings (`RTLD_LOCAL`). This allows them to release software to
-multiple platforms with much greater consistency, but at the cost of burdening
-applications to explicitly manage these bindings. In our case with an optional
-feature for developers, we shrug any such requirement to enjoy the cost/benefit
-on platforms where global relocations are properly cooperative.
-
-To make use of `RTLD_GLOBAL` the application has to be oriented as a directed
-acyclic graph. The primary rule is simple and illustrated in the figure below:
-**no crate is allowed to call a function or use a variable from a crate below
-it.**
-
-![Tuwunel's dynamic library setup diagram - created by Jason
-Volk](assets/libraries.png)
-
-When a symbol is referenced between crates they become bound: **crates cannot be
-unloaded until their calling crates are first unloaded.** Thus we start the
-reloading process from the crate which has no callers. There is a small problem
-though: the first crate is called by the base executable itself! This is solved
-by using an `RTLD_LOCAL` binding for just one link between the main executable
-and the first crate, freeing the executable from all modules as no global
-binding ever occurs between them.
-
-![Tuwunel's reload and load order diagram - created by Jason
-Volk](assets/reload_order.png)
-
-Proper resource management is essential for reliable reloading to occur. This is
-a very basic ask in RAII-idiomatic Rust and the exposure to reloading hazards is
-remarkably low, generally stemming from poor patterns and practices.
-Unfortunately static analysis doesn't enforce reload-safety programmatically
-(though it could one day), for now hazards can be avoided by knowing a few basic
-do's and dont's:
-
-1. Understand that code is memory. Just like one is forbidden from referencing
-   free'd memory, one must not transfer control to free'd code. Exposure to this
-is primarily from two things:
-
-    - Callbacks, which this project makes very little use of.
-    - Async tasks, which are addressed below.
-
-2. Tie all resources to a scope or object lifetime with greatest possible
-symmetry (locality). For our purposes this applies to code resources, which
-means async blocks and tokio tasks.
-
-    - **Never spawn a task without receiving and storing its JoinHandle**.
-    - **Always wait on join handles** before leaving a scope or in another cleanup
-    function called by an owning scope.
-
-3. Know any minor specific quirks documented in code or here:
-
-    - Don't use `tokio::spawn`, instead use our `Handle` in `core/server.rs`, which
-    is reachable in most of the codebase via `services()` or other state. This is
-    due to some bugs or assumptions made in tokio, as it happens in `unsafe {}`
-    blocks, which are mitigated by circumventing some thread-local variables. Using
-    runtime handles is good practice in any case.
-
-The initial implementation PR is available [here][1].
-
-### Interesting related issues/bugs
-
-- [DT_RUNPATH produced in binary with rpath = true is wrong (cargo)][5]
-- [Disabling MIR Optimization in Rust Compilation
-(cargo)](https://internals.rust-lang.org/t/disabling-mir-optimization-in-rust-compilation/19066/5)
-- [Workspace-level metadata
-(cargo-deb)](https://github.com/kornelski/cargo-deb/issues/68)
-
-[1]: https://github.com/girlbossceo/conduwuit/pull/387
-[2]: https://wiki.musl-libc.org/functional-differences-from-glibc.html#Unloading-libraries
-[3]: https://github.com/rust-lang/rust/issues/28794
-[4]: https://github.com/rust-lang/rust/issues/28794#issuecomment-368693049
-[5]: https://github.com/rust-lang/cargo/issues/12746
-[6]: https://crates.io/crates/hot-lib-reloader/
-[7]: https://matrix.to/#/#tuwunel:tuwunel.chat
-[8]: https://crates.io/crates/libloading

docs/development/testing.md

@@ -1,31 +0,0 @@
-# Testing
-
-## Complement
-
-Have a look at [Complement's repository][complement] for an explanation of what
-it is.
-
-To test against Complement, with Nix and
-[direnv installed and set up][direnv] (run `direnv allow` after setting up the hook), you can:
-
-* Run `./bin/complement "$COMPLEMENT_SRC"` to build a Complement image, run
-the tests, and output the logs and results to the specified paths. This will also output the OCI image
-at `result`
-* Run `nix build .#complement` from the root of the repository to just build a
-Complement OCI image outputted to `result` (it's a `.tar.gz` file)
-* Or download the latest Complement OCI image from the CI workflow artifacts
-output from the commit/revision you want to test (e.g. from main)
-[here][ci-workflows]
-
-If you want to use your own prebuilt OCI image (such as from our CI) without needing
-Nix installed, put the image at `complement_oci_image.tar.gz` in the root of the repo
-and run the script.
-
-If you're on macOS and need to build an image, run `nix build .#linux-complement`.
-
-We have a Complement fork as some tests have needed to be fixed. This can be found
-at: <https://github.com/matrix-construct/complement>
-
-[ci-workflows]: https://github.com/matrix-construct/tuwunel/actions/workflows/ci.yml?query=event%3Apush+is%3Asuccess+actor%3Ajevolk
-[complement]: https://github.com/matrix-org/complement
-[direnv]: https://direnv.net/docs/hook.html

docs/introduction.md

@@ -1,18 +0,0 @@
-# Tuwunel
-
-{{#include ../README.md:catchphrase}}
-
-{{#include ../README.md:body}}
-
-#### How can I deploy my own?
-
-- [Deployment options](deploying.md)
-
-If you want to connect an appservice to Tuwunel, take a look at the
-[appservices documentation](appservices.md).
-
-#### How can I contribute?
-
-See the [contributor's guide](contributing.md)
-
-{{#include ../README.md:footer}}

docs/maintenance.md

@@ -1,135 +0,0 @@
-# Maintaining your Tuwunel setup
-
-## Moderation
-
-Tuwunel has moderation through admin room commands. "binary commands" (medium
-priority) and an admin API (low priority) is planned. Some moderation-related
-config options are available in the example config such as "global ACLs" and
-blocking media requests to certain servers. See the example config for the
-moderation config options under the "Moderation / Privacy / Security" section.
-
-Tuwunel has moderation admin commands for:
-
-- managing room aliases (`!admin rooms alias`)
-- managing room directory (`!admin rooms directory`)
-- managing room banning/blocking and user removal (`!admin rooms moderation`)
-- managing user accounts (`!admin users`)
-- fetching `/.well-known/matrix/support` from servers (`!admin federation`)
-- blocking incoming federation for certain rooms (not the same as room banning)
-(`!admin federation`)
-- deleting media (see [the media section](#media))
-
-Any commands with `-list` in them will require a codeblock in the message with
-each object being newline delimited. An example of doing this is:
-
-````
-!admin rooms moderation ban-list-of-rooms
-```
-!roomid1:server.name
-#badroomalias1:server.name
-!roomid2:server.name
-!roomid3:server.name
-#badroomalias2:server.name
-```
-````
-
-## Database (RocksDB)
-
-Generally there is very little you need to do. [Compaction][rocksdb-compaction]
-is ran automatically based on various defined thresholds tuned for Tuwunel to
-be high performance with the least I/O amplifcation or overhead. Manually
-running compaction is not recommended, or compaction via a timer, due to
-creating unnecessary I/O amplification. RocksDB is built with io_uring support
-via liburing for improved read performance.
-
-RocksDB troubleshooting can be found [in the RocksDB section of troubleshooting](troubleshooting.md).
-
-### Compression
-
-Some RocksDB settings can be adjusted such as the compression method chosen. See
-the RocksDB section in the [example config](configuration/examples.md).
-
-btrfs users have reported that database compression does not need to be disabled
-on Tuwunel as the filesystem already does not attempt to compress. This can be
-validated by using `filefrag -v` on a `.SST` file in your database, and ensure
-the `physical_offset` matches (no filesystem compression). It is very important
-to ensure no additional filesystem compression takes place as this can render
-unbuffered Direct IO inoperable, significantly slowing down read and write
-performance. See <https://btrfs.readthedocs.io/en/latest/Compression.html#compatibility>
-
-> Compression is done using the COW mechanism so it’s incompatible with
-> nodatacow. Direct IO read works on compressed files but will fall back to
-> buffered writes and leads to no compression even if force compression is set.
-> Currently nodatasum and compression don’t work together.
-
-### Files in database
-
-Do not touch any of the files in the database directory. This must be said due
-to users being mislead by the `.log` files in the RocksDB directory, thinking
-they're server logs or database logs, however they are critical RocksDB files
-related to WAL tracking.
-
-The only safe files that can be deleted are the `LOG` files (all caps). These
-are the real RocksDB telemetry/log files, however Tuwunel has already
-configured to only store up to 3 RocksDB `LOG` files due to generally being
-useless for average users unless troubleshooting something low-level. If you
-would like to store nearly none at all, see the `rocksdb_max_log_files`
-config option.
-
-## Backups
-
-Currently only RocksDB supports online backups. If you'd like to backup your
-database online without any downtime, see the `!admin server` command for the
-backup commands and the `database_backup_path` config options in the example
-config. Please note that the format of the database backup is not the exact
-same. This is unfortunately a bad design choice by Facebook as we are using the
-database backup engine API from RocksDB, however the data is still there and can
-still be joined together.
-
-To restore a backup from an online RocksDB backup:
-
-- shutdown Tuwunel
-- create a new directory for merging together the data
-- in the online backup created, copy all `.sst` files in
-`$DATABASE_BACKUP_PATH/shared_checksum` to your new directory
-- trim all the strings so instead of `######_sxxxxxxxxx.sst`, it reads
-`######.sst`. A way of doing this with sed and bash is `for file in *.sst; do mv
-"$file" "$(echo "$file" | sed 's/_s.*/.sst/')"; done`
-- copy all the files in `$DATABASE_BACKUP_PATH/1` (or the latest backup number
-if you have multiple) to your new directory
-- set your `database_path` config option to your new directory, or replace your
-old one with the new one you crafted
-- start up Tuwunel again and it should open as normal
-
-If you'd like to do an offline backup, shutdown Tuwunel and copy your
-`database_path` directory elsewhere. This can be restored with no modifications
-needed.
-
-Backing up media is also just copying the `media/` directory from your database
-directory.
-
-## Media
-
-Media still needs various work, however Tuwunel implements media deletion via:
-
-- MXC URI or Event ID (unencrypted and attempts to find the MXC URI in the
-event)
-- Delete list of MXC URIs
-- Delete remote media in the past `N` seconds/minutes via filesystem metadata on
-the file created time (`btime`) or file modified time (`mtime`)
-
-See the `!admin media` command for further information. All media in Tuwunel
-is stored at `$DATABASE_DIR/media`. This will be configurable soon.
-
-If you are finding yourself needing extensive granular control over media, we
-recommend looking into [Matrix Media
-Repo](https://github.com/t2bot/matrix-media-repo). Tuwunel intends to
-implement various utilities for media, but MMR is dedicated to extensive media
-management.
-
-Built-in S3 support is also planned, but for now using a "S3 filesystem" on
-`media/` works. Tuwunel also sends a `Cache-Control` header of 1 year and
-immutable for all media requests (download and thumbnail) to reduce unnecessary
-media requests from browsers, reduce bandwidth usage, and reduce load.
-
-[rocksdb-compaction]: https://github.com/facebook/rocksdb/wiki/Compaction

docs/troubleshooting.md

@@ -1,246 +0,0 @@
-# Troubleshooting Tuwunel
-
-> [!IMPORTANT]
-> If you intend on asking for support and you are using Docker, **PLEASE**
-> triple validate your issues are **NOT** because you have a misconfiguration in
-> your Docker setup. We must remain focused on supporting Tuwunel issues and
-> cannot budget our time for generic Docker support. Compose file issues or
-> Dockerhub image issues are okay if they are something we can fix.
-
-## Tuwunel and Matrix issues
-
-#### Lost access to admin room
-
-You can reinvite yourself to the admin room through the following methods:
-- Use the `--execute "users make_user_admin <username>"` Tuwunel binary
-argument once to invite yourslf to the admin room on startup
-- Use the Tuwunel console/CLI to run the `users make_user_admin` command
-- Or specify the `emergency_password` config option to allow you to temporarily
-log into the server account (`@conduit`) from a web client
-
-## General potential issues
-
-#### Potential DNS issues when using Docker
-
-Docker has issues with its default DNS setup that may cause DNS to not be
-properly functional when running Tuwunel, resulting in federation issues. The
-symptoms of this have shown in excessively long room joins (30+ minutes) from
-very long DNS timeouts, log entries of "mismatching responding nameservers",
-and/or partial or non-functional inbound/outbound federation.
-
-This is **not** a Tuwunel issue, and is purely a Docker issue. It is not
-sustainable for heavy DNS activity which is normal for Matrix federation. The
-workarounds for this are:
-- Use DNS over TCP via the config option `query_over_tcp_only = true`
-- Don't use Docker's default DNS setup and instead allow the container to use
-and communicate with your host's DNS servers (host's `/etc/resolv.conf`)
-
-#### DNS No connections available error message
-
-If you receive spurious amounts of error logs saying "DNS No connections
-available", this is due to your DNS server (servers from `/etc/resolv.conf`)
-being overloaded and unable to handle typical Matrix federation volume. Some
-users have reported that the upstream servers are rate-limiting them as well
-when they get this error (e.g. popular upstreams like Google DNS).
-
-Matrix federation is extremely heavy and sends wild amounts of DNS requests.
-Unfortunately this is by design and has only gotten worse with more
-server/destination resolution steps. Synapse also expects a very perfect DNS
-setup.
-
-There are some ways you can reduce the amount of DNS queries, but ultimately
-the best solution/fix is selfhosting a high quality caching DNS server like
-[Unbound][unbound-arch] without any upstream resolvers, and without DNSSEC
-validation enabled.
-
-DNSSEC validation is highly recommended to be **disabled** due to DNSSEC being
-very computationally expensive, and is extremely susceptible to denial of
-service, especially on Matrix. Many servers also strangely have broken DNSSEC
-setups and will result in non-functional federation.
-
-Tuwunel cannot provide a "works-for-everyone" Unbound DNS setup guide, but
-the [official Unbound tuning guide][unbound-tuning] and the [Unbound Arch Linux wiki page][unbound-arch]
-may be of interest. Disabling DNSSEC on Unbound is commenting out trust-anchors
-config options and removing the `validator` module.
-
-**Avoid** using `systemd-resolved` as it does **not** perform very well under
-high load, and we have identified its DNS caching to not be very effective.
-
-dnsmasq can possibly work, but it does **not** support TCP fallback which can be
-problematic when receiving large DNS responses such as from large SRV records.
-If you still want to use dnsmasq, make sure you **disable** `dns_tcp_fallback`
-in Tuwunel config.
-
-Raising `dns_cache_entries` in Tuwunel config from the default can also assist
-in DNS caching, but a full-fledged external caching resolver is better and more
-reliable.
-
-If you don't have IPv6 connectivity, changing `ip_lookup_strategy` to match
-your setup can help reduce unnecessary AAAA queries
-(`1 - Ipv4Only (Only query for A records, no AAAA/IPv6)`).
-
-If your DNS server supports it, some users have reported enabling
-`query_over_tcp_only` to force only TCP querying by default has improved DNS
-reliability at a slight performance cost due to TCP overhead.
-
-## RocksDB / database issues
-
-#### Database corruption
-
-There are many causes and varieties of database corruption. There are several
-methods for mitigation, each with outcomes ranging from a recovered state down
-to a savage state. This guide has been simplified into a set of universal steps
-which everyone can follow from the top until they have recovered or reach the
-end. The details and implications will be explained within each step.
-
-> [!TIP]
-> All command-line `-O` options can be expressed as environment variables or in
-> the config file based on your deployment's requirements. Note that
-> `--maintenance` is equivalent to configuring `startup_netburst = false` and
-> `listening = false`.
-
-> [!IMPORTANT]
-> Always create a backup of the database before running any operation. This is
-> critical for steps 3 and above.
-
-**0. Start the server with the following options:**
-
-`tuwunel --maintenance -O rocksdb_recovery_mode=0`
-
-This is actually a "control" and not a method of recovery. If the server starts
-you either do not have corruption or have deep corruption indicated by very
-specific errors from rocksdb citing corruption during runtime. If you are
-certain there is deep corruption skip to step 4, otherwise you are finished
-without any modifications.
-
-**1. Start the server in Tolerate-Corrupted-Tail-Records mode:**
-
-`tuwunel --maintenance -O rocksdb_recovery_mode=1`
-
-The most common corruption scenario is from a loss of power to the hardware
-(not an application crash, though it is still possible). This is remediated
-by dropping the most recently written record. It is highly unlikely there will
-be any impact on the application from this loss. In the best-case the same data
-is often re-requested over the federation or replaced by a client. In the
-worst-case clients may need to clear-cache & reload to guarantee correctness.
-If the server starts you are finished.
-
-**2. Start the server in Point-In-Time mode:**
-
-`tuwunel --maintenance -O rocksdb_recovery_mode=2`
-
-Similar to the corruption scenario above but for more severe cases. The most
-recent records are discarded back to the point where there is no corruption.
-It is highly unlikely there will be any impact on the application from this
-loss, but it is more likely than above that clients may need to clear-cache
-& reload to correctly resynchronize with the server.
-
-**3. Start the server in Skip-Any-Corrupted-Record mode:**
-
-> [!WARNING]
-> Salvage mode potentially impacting the application's ability to function.
-> We cannot provide support for users who have entered this mode.
-
-`tuwunel --maintenance -O rocksdb_recovery_mode=3`
-
-Similar to the prior corruption scenarios but for the most severe cases.
-The database will be inconsistent. It is theoretically possible for the
-server to continue functioning without notable issue in the best case, but
-it is completely uncertain what the effect of this operation will be. If
-the server starts you should immediately export your messages, encryption
-keys, etc, in a salvage effort and prepare to reinstall.
-
-**4. Start the server in repair mode.**
-
-> [!WARNING]
-> Salvage mode potentially impacting the application's ability to function.
-> We cannot provide support for users who have entered this mode.
-
-> [!CAUTION]
-> Always create a backup of the database before entering this mode. The repair
-> is not configurable and not interactive. It may automatically remove more
-> data than anticipated, preventing further salvage efforts.
-
-`tuwunel --maintenance -O rocksdb_repair=true`
-
-For corruption affecting the bulk database tables not covered by any journal.
-This will leave the database in an inconsistent and unpredictable state. It
-is theoretically possible to continue operating the server depending on which
-records were dropped, such as some historical records which are no longer
-essential. Nevertheless the impact of this operation is impossible to assess
-and a successful recovery should be used to salvage data prior to reinstall.
-
-Once finished, restart the server without `rocksdb_repair`. If no errors
-persist, restart the server again without maintenance mode.
-
-**5. Utilize an external repair tool.**
-
-> [!WARNING]
-> Salvage mode potentially impacting the application's ability to function.
-> We cannot provide support for users who have entered this mode.
-
-```
-git clone https://github.com/facebook/rocksdb
-cd rocksdb
-make -j$(nproc) ldb
-./ldb repair --db=/var/lib/tuwunel/ 2>./repair-log.txt
-```
-
-For situations when the repair mode in step 4 failed or produced unexpected
-results.
-
-## Debugging
-
-Note that users should not really be debugging things. If you find yourself
-debugging and find the issue, please let us know and/or how we can fix it.
-Various debug commands can be found in `!admin debug`.
-
-#### Debug/Trace log level
-
-Tuwunel builds without debug or trace log levels at compile time by default
-for substantial performance gains in CPU usage and improved compile times. If
-you need to access debug/trace log levels, you will need to build without the
-`release_max_log_level` feature or use our provided release-logging binaries
-and images.
-
-#### Changing log level dynamically
-
-Tuwunel supports changing the tracing log environment filter on-the-fly using
-the admin command `!admin debug change-log-level <log env filter>`. This accepts
-a string **without quotes** the same format as the `log` config option.
-
-Example: `!admin debug change-log-level debug`
-
-This can also accept complex filters such as:
-`!admin debug change-log-level info,conduit_service[{dest="example.com"}]=trace,ruma_state_res=trace`
-`!admin debug change-log-level info,conduit_service[{dest="example.com"}]=trace,conduit_service[send{dest="example.org"}]=trace`
-
-And to reset the log level to the one that was set at startup / last config
-load, simply pass the `--reset` flag.
-
-`!admin debug change-log-level --reset`
-
-#### Pinging servers
-
-Tuwunel can ping other servers using `!admin debug ping <server>`. This takes
-a server name and goes through the server discovery process and queries
-`/_matrix/federation/v1/version`. Errors are outputted.
-
-While it does measure the latency of the request, it is not indicative of
-server performance on either side as that endpoint is completely unauthenticated
-and simply fetches a string on a static JSON endpoint. It is very low cost both
-bandwidth and computationally.
-
-#### Allocator memory stats
-
-When using jemalloc with jemallocator's `stats` feature (`--enable-stats`), you
-can see Tuwunel's high-level allocator stats by using
-`!admin server memory-usage` at the bottom.
-
-If you are a developer, you can also view the raw jemalloc statistics with
-`!admin debug memory-stats`. Please note that this output is extremely large
-which may only be visible in the Tuwunel console CLI due to PDU size limits,
-and is not easy for non-developers to understand.
-
-[unbound-tuning]: https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/performance.html
-[unbound-arch]: https://wiki.archlinux.org/title/Unbound

docs/turn.md

@@ -1,70 +0,0 @@
-# Setting up TURN/STURN
-
-In order to make or receive calls, a TURN server is required. Tuwunel suggests
-using [Coturn](https://github.com/coturn/coturn) for this purpose, which is also
-available as a Docker image.
-
-### Configuration
-
-Create a configuration file called `coturn.conf` containing:
-
-```conf
-use-auth-secret
-static-auth-secret=<a secret key>
-realm=<your server domain>
-```
-
-A common way to generate a suitable alphanumeric secret key is by using `pwgen
--s 64 1`.
-
-These same values need to be set in Tuwunel. See the [example
-config](configuration/examples.md) in the TURN section for configuring these and
-restart Tuwunel after.
-
-`turn_secret` or a path to `turn_secret_file` must have a value of your
-coturn `static-auth-secret`, or use `turn_username` and `turn_password`
-if using legacy username:password TURN authentication (not preferred).
-
-`turn_uris` must be the list of TURN URIs you would like to send to the client.
-Typically you will just replace the example domain `example.turn.uri` with the
-`realm` you set from the example config.
-
-If you are using TURN over TLS, you can replace `turn:` with `turns:` in the
-`turn_uris` config option to instruct clients to attempt to connect to
-TURN over TLS. This is highly recommended.
-
-If you need unauthenticated access to the TURN URIs, or some clients may be
-having trouble, you can enable `turn_guest_access` in Tuwunel which disables
-authentication for the TURN URI endpoint `/_matrix/client/v3/voip/turnServer`
-
-### Run
-
-Run the [Coturn](https://hub.docker.com/r/coturn/coturn) image using
-
-```bash
-docker run -d --network=host -v
-$(pwd)/coturn.conf:/etc/coturn/turnserver.conf coturn/coturn
-```
-
-or docker-compose. For the latter, paste the following section into a file
-called `docker-compose.yml` and run `docker compose up -d` in the same
-directory.
-
-```yml
-version: 3
-services:
-    turn:
-      container_name: coturn-server
-      image: docker.io/coturn/coturn
-      restart: unless-stopped
-      network_mode: "host"
-      volumes:
-        - ./coturn.conf:/etc/coturn/turnserver.conf
-```
-
-To understand why the host networking mode is used and explore alternative
-configuration options, please visit [Coturn's Docker
-documentation](https://github.com/coturn/coturn/blob/master/docker/coturn/README.md).
-
-For security recommendations see Synapse's [Coturn
-documentation](https://element-hq.github.io/synapse/latest/turn-howto.html).

flake.lock

@@ -1,573 +0,0 @@
-{
-  "nodes": {
-    "attic": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable"
-      },
-      "locked": {
-        "lastModified": 1758711588,
-        "narHash": "sha256-0nZlCCDC5PfndsQJXXtcyrtrfW49I3KadGMDlutzaGU=",
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "rev": "12cbeca141f46e1ade76728bce8adc447f2166c6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "ref": "main",
-        "repo": "attic",
-        "type": "github"
-      }
-    },
-    "cachix": {
-      "inputs": {
-        "devenv": "devenv",
-        "flake-compat": "flake-compat_2",
-        "git-hooks": "git-hooks",
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1756385612,
-        "narHash": "sha256-+NU5MMhuPHHRyvZZWNFG7zt+leRSPsJu1MwhOUzkPUk=",
-        "owner": "cachix",
-        "repo": "cachix",
-        "rev": "dc24688cd67518c3711d511fa369c0f5a131063a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "ref": "master",
-        "repo": "cachix",
-        "type": "github"
-      }
-    },
-    "cachix_2": {
-      "inputs": {
-        "devenv": [
-          "cachix",
-          "devenv"
-        ],
-        "flake-compat": [
-          "cachix",
-          "devenv"
-        ],
-        "git-hooks": [
-          "cachix",
-          "devenv",
-          "git-hooks"
-        ],
-        "nixpkgs": [
-          "cachix",
-          "devenv",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1748883665,
-        "narHash": "sha256-R0W7uAg+BLoHjMRMQ8+oiSbTq8nkGz5RDpQ+ZfxxP3A=",
-        "owner": "cachix",
-        "repo": "cachix",
-        "rev": "f707778d902af4d62d8dd92c269f8e70de09acbe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "ref": "latest",
-        "repo": "cachix",
-        "type": "github"
-      }
-    },
-    "complement": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1756358878,
-        "narHash": "sha256-H/4TkbFcGsMRDZ7gNaXZ7NxeO3b1YgkVt9zPb+3ATSg=",
-        "owner": "matrix-construct",
-        "repo": "complement",
-        "rev": "403840348f6bcc9cc8ed1671dc2f638c2b1ce4ac",
-        "type": "github"
-      },
-      "original": {
-        "owner": "matrix-construct",
-        "ref": "main",
-        "repo": "complement",
-        "type": "github"
-      }
-    },
-    "crane": {
-      "locked": {
-        "lastModified": 1751562746,
-        "narHash": "sha256-smpugNIkmDeicNz301Ll1bD7nFOty97T79m4GUMUczA=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "aed2020fd3dc26e1e857d4107a5a67a33ab6c1fd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "crane_2": {
-      "locked": {
-        "lastModified": 1758758545,
-        "narHash": "sha256-NU5WaEdfwF6i8faJ2Yh+jcK9vVFrofLcwlD/mP65JrI=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "95d528a5f54eaba0d12102249ce42f4d01f4e364",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "ref": "master",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "devenv": {
-      "inputs": {
-        "cachix": "cachix_2",
-        "flake-compat": [
-          "cachix",
-          "flake-compat"
-        ],
-        "git-hooks": [
-          "cachix",
-          "git-hooks"
-        ],
-        "nix": "nix",
-        "nixpkgs": [
-          "cachix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1754404745,
-        "narHash": "sha256-BdbW/iTImczgcuATgQIa9sPGuYIBxVq2xqcvICsa2AQ=",
-        "owner": "cachix",
-        "repo": "devenv",
-        "rev": "6563b21105168f90394dfaf58284b078af2d7275",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "devenv",
-        "type": "github"
-      }
-    },
-    "fenix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-analyzer-src": "rust-analyzer-src"
-      },
-      "locked": {
-        "lastModified": 1759251341,
-        "narHash": "sha256-0vt4IQnTLyAhaeom3h9GOCpO2+av+wK4zP7O8BSKr6I=",
-        "owner": "nix-community",
-        "repo": "fenix",
-        "rev": "af8a7505a1c62fab493157ea380a05c094bb63af",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "main",
-        "repo": "fenix",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_3": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "ref": "master",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1751413152,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "cachix",
-          "devenv",
-          "nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "ref": "main",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "git-hooks": {
-      "inputs": {
-        "flake-compat": [
-          "cachix",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "cachix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "cachix",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "liburing": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1759268303,
-        "narHash": "sha256-nT3JWey0P2lPWlnwN57XHmuzkeW8Mo795+Ahf8S5TMI=",
-        "owner": "axboe",
-        "repo": "liburing",
-        "rev": "1671cb952a8f680214b04ae9546d4f649f1b367b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "axboe",
-        "ref": "master",
-        "repo": "liburing",
-        "type": "github"
-      }
-    },
-    "nix": {
-      "inputs": {
-        "flake-compat": [
-          "cachix",
-          "devenv",
-          "flake-compat"
-        ],
-        "flake-parts": "flake-parts_2",
-        "git-hooks-nix": [
-          "cachix",
-          "devenv",
-          "git-hooks"
-        ],
-        "nixpkgs": [
-          "cachix",
-          "devenv",
-          "nixpkgs"
-        ],
-        "nixpkgs-23-11": [
-          "cachix",
-          "devenv"
-        ],
-        "nixpkgs-regression": [
-          "cachix",
-          "devenv"
-        ]
-      },
-      "locked": {
-        "lastModified": 1752773918,
-        "narHash": "sha256-dOi/M6yNeuJlj88exI+7k154z+hAhFcuB8tZktiW7rg=",
-        "owner": "cachix",
-        "repo": "nix",
-        "rev": "031c3cf42d2e9391eee373507d8c12e0f9606779",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "ref": "devenv-2.30",
-        "repo": "nix",
-        "type": "github"
-      }
-    },
-    "nix-filter": {
-      "locked": {
-        "lastModified": 1757882181,
-        "narHash": "sha256-+cCxYIh2UNalTz364p+QYmWHs0P+6wDhiWR4jDIKQIU=",
-        "owner": "numtide",
-        "repo": "nix-filter",
-        "rev": "59c44d1909c72441144b93cf0f054be7fe764de5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "ref": "main",
-        "repo": "nix-filter",
-        "type": "github"
-      }
-    },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1737420293,
-        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1751949589,
-        "narHash": "sha256-mgFxAPLWw0Kq+C8P3dRrZrOYEQXOtKuYVlo9xvPntt8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9b008d60392981ad674e04016d25619281550a9d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1751741127,
-        "narHash": "sha256-t75Shs76NgxjZSgvvZZ9qOmz5zuBE8buUaYD28BMTxg=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "29e290002bfff26af1db6f64d070698019460302",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1754214453,
-        "narHash": "sha256-Q/I2xJn/j1wpkGhWkQnm20nShYnG7TI99foDBpXm1SY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5b09dc45f24cf32316283e62aec81ffee3c3e376",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1759070547,
-        "narHash": "sha256-JVZl8NaVRYb0+381nl7LvPE+A774/dRpif01FKLrYFQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "647e5c14cbd5067f44ac86b74f014962df460840",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "rocksdb": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1749358049,
-        "narHash": "sha256-ZSjvAZBfZkJrBIpw8ANZMbJVb8AeuogvuAipGVE4Qe4=",
-        "owner": "matrix-construct",
-        "repo": "rocksdb",
-        "rev": "cf7f65d0b377af019661c240f9165b3ef60640c3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "matrix-construct",
-        "ref": "tuwunel-changes",
-        "repo": "rocksdb",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "attic": "attic",
-        "cachix": "cachix",
-        "complement": "complement",
-        "crane": "crane_2",
-        "fenix": "fenix",
-        "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils",
-        "liburing": "liburing",
-        "nix-filter": "nix-filter",
-        "nixpkgs": "nixpkgs_3",
-        "rocksdb": "rocksdb"
-      }
-    },
-    "rust-analyzer-src": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1759134797,
-        "narHash": "sha256-YPi+jL3tx/yC5J5l7/OB7Lnlr9BMTzYnZtm7tRJzUNg=",
-        "owner": "rust-lang",
-        "repo": "rust-analyzer",
-        "rev": "062ac7a5451e8e92a32e22a60d86882d6a034f3f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "rust-lang",
-        "ref": "nightly",
-        "repo": "rust-analyzer",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,533 +0,0 @@
-{
-  inputs = {
-    attic.url = "github:zhaofengli/attic?ref=main";
-    cachix.url = "github:cachix/cachix?ref=master";
-    complement = { url = "github:matrix-construct/complement?ref=main"; flake = false; };
-    crane = { url = "github:ipetkov/crane?ref=master"; };
-    fenix = { url = "github:nix-community/fenix?ref=main"; inputs.nixpkgs.follows = "nixpkgs"; };
-    flake-compat = { url = "github:edolstra/flake-compat?ref=master"; flake = false; };
-    flake-utils.url = "github:numtide/flake-utils?ref=main";
-    nix-filter.url = "github:numtide/nix-filter?ref=main";
-    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixpkgs-unstable";
-    rocksdb = { url = "github:matrix-construct/rocksdb?ref=tuwunel-changes"; flake = false; };
-    liburing = { url = "github:axboe/liburing?ref=master"; flake = false; };
-  };
-
-  outputs = inputs:
-    inputs.flake-utils.lib.eachDefaultSystem (system:
-    let
-      pkgsHost = import inputs.nixpkgs{
-        inherit system;
-      };
-      pkgsHostStatic = pkgsHost.pkgsStatic;
-
-      # The Rust toolchain to use
-      toolchain = inputs.fenix.packages.${system}.fromToolchainFile {
-        file = ./rust-toolchain.toml;
-
-        # See also `rust-toolchain.toml`
-        sha256 = "sha256-Qxt8XAuaUR2OMdKbN4u8dBJOhSHxS+uS06Wl9+flVEk=";
-      };
-
-      mkScope = pkgs: pkgs.lib.makeScope pkgs.newScope (self: {
-        inherit pkgs;
-        book = self.callPackage ./nix/pkgs/book {};
-        complement = self.callPackage ./nix/pkgs/complement {};
-        craneLib = ((inputs.crane.mkLib pkgs).overrideToolchain (_: toolchain));
-        inherit inputs;
-        main = self.callPackage ./nix/pkgs/main {};
-        oci-image = self.callPackage ./nix/pkgs/oci-image {};
-        tini = pkgs.tini.overrideAttrs {
-            # newer clang/gcc is unhappy with tini-static: <https://3.dog/~strawberry/pb/c8y4>
-            patches = [ (pkgs.fetchpatch {
-                url = "https://patch-diff.githubusercontent.com/raw/krallin/tini/pull/224.patch";
-                hash = "sha256-4bTfAhRyIT71VALhHY13hUgbjLEUyvgkIJMt3w9ag3k=";
-              })
-            ];
-        };
-        liburing = pkgs.liburing.overrideAttrs {
-          # Tests weren't building
-          outputs = [ "out" "dev" "man" ];
-          buildFlags = [ "library" ];
-          src = inputs.liburing;
-        };
-        rocksdb = (pkgs.rocksdb.override {
-          liburing = self.liburing;
-        }).overrideAttrs (final: old: {
-          src = inputs.rocksdb;
-          version = pkgs.lib.removePrefix
-            "v"
-            (builtins.fromJSON (builtins.readFile ./flake.lock))
-              .nodes.rocksdb.original.ref;
-          # we have this already at https://github.com/girlbossceo/rocksdb/commit/a935c0273e1ba44eacf88ce3685a9b9831486155
-          # unsetting this so i don't have to revert it and make this nix exclusive
-          patches = [];
-          postPatch =
-            pkgs.lib.optionalString (pkgs.lib.versionOlder final.version "8") ''
-              # Fix gcc-13 build failures due to missing <cstdint> and
-              # <system_error> includes, fixed upstream since 8.x
-              sed -e '1i #include <cstdint>' -i db/compaction/compaction_iteration_stats.h
-              sed -e '1i #include <cstdint>' -i table/block_based/data_block_hash_index.h
-              sed -e '1i #include <cstdint>' -i util/string_util.h
-              sed -e '1i #include <cstdint>' -i include/rocksdb/utilities/checkpoint.h
-            '';
-          cmakeFlags = pkgs.lib.subtractLists
-            [
-              # no real reason to have snappy or zlib, no one uses this
-              "-DWITH_SNAPPY=1"
-              "-DZLIB=1"
-              "-DWITH_ZLIB=1"
-              # we dont need to use ldb or sst_dump (core_tools)
-              "-DWITH_CORE_TOOLS=1"
-              # we dont need to build rocksdb tests
-              "-DWITH_TESTS=1"
-              # we use rust-rocksdb via C interface and dont need C++ RTTI
-              "-DUSE_RTTI=1"
-              # this doesn't exist in RocksDB, and USE_SSE is deprecated for
-              # PORTABLE=$(march)
-              "-DFORCE_SSE42=1"
-              # PORTABLE will get set in main/default.nix
-              "-DPORTABLE=1"
-            ]
-            old.cmakeFlags
-            ++ [
-              # no real reason to have snappy, no one uses this
-              "-DWITH_SNAPPY=0"
-              "-DZLIB=0"
-              "-DWITH_ZLIB=0"
-              # we dont need to use ldb or sst_dump (core_tools)
-              "-DWITH_CORE_TOOLS=0"
-              # we dont need trace tools
-              "-DWITH_TRACE_TOOLS=0"
-              # we dont need to build rocksdb tests
-              "-DWITH_TESTS=0"
-              # we use rust-rocksdb via C interface and dont need C++ RTTI
-              "-DUSE_RTTI=0"
-            ];
-
-          # outputs has "tools" which we dont need or use
-          outputs = [ "out" ];
-
-          # preInstall hooks has stuff for messing with ldb/sst_dump which we dont need or use
-          preInstall = "";
-        });
-      });
-
-      scopeHost = mkScope pkgsHost;
-      scopeHostStatic = mkScope pkgsHostStatic;
-      scopeCrossLinux = mkScope pkgsHost.pkgsLinux.pkgsStatic;
-      mkCrossScope = crossSystem:
-        let pkgsCrossStatic = (import inputs.nixpkgs {
-          inherit system;
-          crossSystem = {
-           config = crossSystem;
-          };
-        }).pkgsStatic;
-         in
-        mkScope pkgsCrossStatic;
-
-      mkDevShell = scope: scope.pkgs.mkShell {
-        env = scope.main.env // {
-          # Rust Analyzer needs to be able to find the path to default crate
-          # sources, and it can read this environment variable to do so. The
-          # `rust-src` component is required in order for this to work.
-          RUST_SRC_PATH = "${toolchain}/lib/rustlib/src/rust/library";
-
-          # Convenient way to access a pinned version of Complement's source
-          # code.
-          COMPLEMENT_SRC = inputs.complement.outPath;
-
-          # Needed for Complement: <https://github.com/golang/go/issues/52690>
-          CGO_CFLAGS = "-Wl,--no-gc-sections";
-          CGO_LDFLAGS = "-Wl,--no-gc-sections";
-        };
-
-        # Development tools
-        packages = [
-          # Always use nightly rustfmt because most of its options are unstable
-          #
-          # This needs to come before `toolchain` in this list, otherwise
-          # `$PATH` will have stable rustfmt instead.
-          inputs.fenix.packages.${system}.latest.rustfmt
-
-          toolchain
-        ]
-        ++ (with pkgsHost.pkgs; [
-          # Required by hardened-malloc.rs dep
-          binutils
-
-          cargo-audit
-          cargo-auditable
-
-          # Needed for producing Debian packages
-          cargo-deb
-
-          # Needed for CI to check validity of produced Debian packages (dpkg-deb)
-          dpkg
-
-	  engage
-
-          # Needed for Complement
-          go
-
-          # Needed for our script for Complement
-          jq
-          gotestfmt
-
-          # Needed for finding broken markdown links
-          lychee
-
-          # Needed for linting markdown files
-          markdownlint-cli
-
-          # Useful for editing the book locally
-          mdbook
-
-          # used for rust caching in CI to speed it up
-          sccache
-        ]
-        # liburing is Linux-exclusive
-        ++ lib.optional stdenv.hostPlatform.isLinux liburing
-        ++ lib.optional stdenv.hostPlatform.isLinux numactl)
-        ++ scope.main.buildInputs
-        ++ scope.main.propagatedBuildInputs
-        ++ scope.main.nativeBuildInputs;
-      };
-    in
-    {
-      packages = {
-        default = scopeHost.main.override {
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # jemalloc profiling/stats features are expensive and shouldn't
-                # be expected on non-debug builds.
-                "jemalloc_prof"
-                "jemalloc_stats"
-                # tuwunel_mods is a development-only hot reload feature
-                "tuwunel_mods"
-            ];
-        };
-        default-debug = scopeHost.main.override {
-            profile = "dev";
-            # debug build users expect full logs
-            disable_release_max_log_level = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # this is non-functional on nix for some reason
-                "tuwunel_mods"
-            ];
-        };
-        # just a test profile used for things like CI and complement
-        default-test = scopeHost.main.override {
-            profile = "test";
-            disable_release_max_log_level = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # this is non-functional on nix for some reason
-                "tuwunel_mods"
-            ];
-        };
-        all-features = scopeHost.main.override {
-            all_features = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # jemalloc profiling/stats features are expensive and shouldn't
-                # be expected on non-debug builds.
-                "jemalloc_prof"
-                "jemalloc_stats"
-                # this is non-functional on nix for some reason
-                "tuwunel_mods"
-            ];
-        };
-        all-features-debug = scopeHost.main.override {
-            profile = "dev";
-            all_features = true;
-            # debug build users expect full logs
-            disable_release_max_log_level = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # this is non-functional on nix for some reason
-                "tuwunel_mods"
-            ];
-        };
-
-        oci-image = scopeHost.oci-image;
-        oci-image-all-features = scopeHost.oci-image.override {
-          main = scopeHost.main.override {
-            all_features = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # jemalloc profiling/stats features are expensive and shouldn't
-                # be expected on non-debug builds.
-                "jemalloc_prof"
-                "jemalloc_stats"
-                # tuwunel_mods is a development-only hot reload feature
-                "tuwunel_mods"
-            ];
-          };
-        };
-        oci-image-all-features-debug = scopeHost.oci-image.override {
-          main = scopeHost.main.override {
-            profile = "dev";
-            all_features = true;
-            # debug build users expect full logs
-            disable_release_max_log_level = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # tuwunel_mods is a development-only hot reload feature
-                "tuwunel_mods"
-            ];
-          };
-        };
-
-        book = scopeHost.book;
-
-        complement = scopeHost.complement;
-        static-complement = scopeHostStatic.complement;
-        # macOS containers don't exist, so the complement images must be forced to linux
-        linux-complement = (mkCrossScope "${pkgsHost.hostPlatform.qemuArch}-linux-musl").complement;
-      }
-      //
-      builtins.listToAttrs
-        (builtins.concatLists
-          (builtins.map
-            (crossSystem:
-              let
-                binaryName = "static-${crossSystem}";
-                scopeCrossStatic = mkCrossScope crossSystem;
-              in
-              [
-                # An output for a statically-linked binary
-                {
-                  name = binaryName;
-                  value = scopeCrossStatic.main;
-                }
-
-                # An output for a statically-linked binary with x86_64 haswell
-                # target optimisations
-                {
-                  name = "${binaryName}-x86_64-haswell-optimised";
-                  value = scopeCrossStatic.main.override {
-                    x86_64_haswell_target_optimised = (if (crossSystem == "x86_64-linux-gnu" || crossSystem == "x86_64-linux-musl") then true else false);
-                  };
-                }
-
-                # An output for a statically-linked unstripped debug ("dev") binary
-                {
-                  name = "${binaryName}-debug";
-                  value = scopeCrossStatic.main.override {
-                    profile = "dev";
-                    # debug build users expect full logs
-                    disable_release_max_log_level = true;
-                  };
-                }
-
-                # An output for a statically-linked unstripped debug binary with the
-                # "test" profile (for CI usage only)
-                {
-                  name = "${binaryName}-test";
-                  value = scopeCrossStatic.main.override {
-                    profile = "test";
-                    disable_release_max_log_level = true;
-                    disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                    ];
-                  };
-                }
-
-                # An output for a statically-linked binary with `--all-features`
-                {
-                  name = "${binaryName}-all-features";
-                  value = scopeCrossStatic.main.override {
-                    all_features = true;
-                    disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # jemalloc profiling/stats features are expensive and shouldn't
-                        # be expected on non-debug builds.
-                        "jemalloc_prof"
-                        "jemalloc_stats"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                    ];
-                  };
-                }
-
-                # An output for a statically-linked binary with `--all-features` and with x86_64 haswell
-                # target optimisations
-                {
-                  name = "${binaryName}-all-features-x86_64-haswell-optimised";
-                  value = scopeCrossStatic.main.override {
-                    all_features = true;
-                    disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # jemalloc profiling/stats features are expensive and shouldn't
-                        # be expected on non-debug builds.
-                        "jemalloc_prof"
-                        "jemalloc_stats"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                    ];
-                    x86_64_haswell_target_optimised = (if (crossSystem == "x86_64-linux-gnu" || crossSystem == "x86_64-linux-musl") then true else false);
-                  };
-                }
-
-                # An output for a statically-linked unstripped debug ("dev") binary with `--all-features`
-                {
-                  name = "${binaryName}-all-features-debug";
-                  value = scopeCrossStatic.main.override {
-                    profile = "dev";
-                    all_features = true;
-                    # debug build users expect full logs
-                    disable_release_max_log_level = true;
-                    disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                    ];
-                  };
-                }
-
-                # An output for an OCI image based on that binary
-                {
-                  name = "oci-image-${crossSystem}";
-                  value = scopeCrossStatic.oci-image;
-                }
-
-                # An output for an OCI image based on that binary with x86_64 haswell
-                # target optimisations
-                {
-                  name = "oci-image-${crossSystem}-x86_64-haswell-optimised";
-                  value = scopeCrossStatic.oci-image.override {
-                    main = scopeCrossStatic.main.override {
-                      x86_64_haswell_target_optimised = (if (crossSystem == "x86_64-linux-gnu" || crossSystem == "x86_64-linux-musl") then true else false);
-                    };
-                  };
-                }
-
-                # An output for an OCI image based on that unstripped debug ("dev") binary
-                {
-                  name = "oci-image-${crossSystem}-debug";
-                  value = scopeCrossStatic.oci-image.override {
-                    main = scopeCrossStatic.main.override {
-                        profile = "dev";
-                        # debug build users expect full logs
-                        disable_release_max_log_level = true;
-                    };
-                  };
-                }
-
-                # An output for an OCI image based on that binary with `--all-features`
-                {
-                  name = "oci-image-${crossSystem}-all-features";
-                  value = scopeCrossStatic.oci-image.override {
-                    main = scopeCrossStatic.main.override {
-                      all_features = true;
-                      disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # jemalloc profiling/stats features are expensive and shouldn't
-                        # be expected on non-debug builds.
-                        "jemalloc_prof"
-                        "jemalloc_stats"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                      ];
-                    };
-                  };
-                }
-
-                # An output for an OCI image based on that binary with `--all-features` and with x86_64 haswell
-                # target optimisations
-                {
-                  name = "oci-image-${crossSystem}-all-features-x86_64-haswell-optimised";
-                  value = scopeCrossStatic.oci-image.override {
-                    main = scopeCrossStatic.main.override {
-                      all_features = true;
-                      disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # jemalloc profiling/stats features are expensive and shouldn't
-                        # be expected on non-debug builds.
-                        "jemalloc_prof"
-                        "jemalloc_stats"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                      ];
-                      x86_64_haswell_target_optimised = (if (crossSystem == "x86_64-linux-gnu" || crossSystem == "x86_64-linux-musl") then true else false);
-                    };
-                  };
-                }
-
-                # An output for an OCI image based on that unstripped debug ("dev") binary with `--all-features`
-                {
-                  name = "oci-image-${crossSystem}-all-features-debug";
-                  value = scopeCrossStatic.oci-image.override {
-                    main = scopeCrossStatic.main.override {
-                      profile = "dev";
-                      all_features = true;
-                      # debug build users expect full logs
-                      disable_release_max_log_level = true;
-                      disable_features = [
-                        # dont include experimental features
-                        "experimental"
-                        # tuwunel_mods is a development-only hot reload feature
-                        "tuwunel_mods"
-                      ];
-                    };
-                  };
-                }
-
-                # An output for a complement OCI image for the specified platform
-                {
-                  name = "complement-${crossSystem}";
-                  value = scopeCrossStatic.complement;
-                }
-              ]
-            )
-            [
-              #"x86_64-apple-darwin"
-              #"aarch64-apple-darwin"
-              "x86_64-linux-gnu"
-              "x86_64-linux-musl"
-              "aarch64-linux-musl"
-            ]
-          )
-        );
-
-      devShells.default = mkDevShell scopeHostStatic;
-      devShells.all-features = mkDevShell
-        (scopeHostStatic.overrideScope (final: prev: {
-          main = prev.main.override {
-            all_features = true;
-            disable_features = [
-                # dont include experimental features
-                "experimental"
-                # jemalloc profiling/stats features are expensive and shouldn't
-                # be expected on non-debug builds.
-                "jemalloc_prof"
-                "jemalloc_stats"
-                # tuwunel_mods is a development-only hot reload feature
-                "tuwunel_mods"
-            ];
-        };
-        }));
-      devShells.no-features = mkDevShell
-        (scopeHostStatic.overrideScope (final: prev: {
-          main = prev.main.override { default_features = false; };
-        }));
-      devShells.dynamic = mkDevShell scopeHost;
-    });
-}

images/misc-webserver/deploy.nu

@@ -0,0 +1,2 @@
+podman build -t misc-webserver -f "Dockerfile"
+podman save --format oci-archive localhost/misc-webserver:latest | gzip | ssh fedora@213.32.25.24 -T "zcat | sudo podman load"

nix/pkgs/book/default.nix

@@ -1,38 +0,0 @@
-{ inputs
-
-# Dependencies
-, main
-, mdbook
-, stdenv
-}:
-
-stdenv.mkDerivation {
-  inherit (main) pname version;
-
-  src = inputs.nix-filter {
-    root = inputs.self;
-    include = [
-      "book.toml"
-      "tuwunel-example.toml"
-      "CODE_OF_CONDUCT.md"
-      "CONTRIBUTING.md"
-      "README.md"
-      "development.md"
-      "debian/tuwunel.service"
-      "debian/README.md"
-      "arch/tuwunel.service"
-      "rpm/tuwunel.service"
-      "rpm/README.md"
-      "docs"
-      "theme"
-    ];
-  };
-
-  nativeBuildInputs = [
-    mdbook
-  ];
-
-  buildPhase = ''
-    mdbook build -d $out
-  '';
-}

nix/pkgs/complement/bin/complement

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-# Path to Complement's source code
-#
-# The `COMPLEMENT_SRC` environment variable is set in the Nix dev shell, which
-# points to a store path containing the Complement source code. It's likely you
-# want to just pass that as the first argument to use it here.
-COMPLEMENT_SRC="${COMPLEMENT_SRC:-$1}"
-
-# A `.jsonl` file to write test logs to
-LOG_FILE="${2:-complement_test_logs.jsonl}"
-
-# A `.jsonl` file to write test results to
-RESULTS_FILE="${3:-complement_test_results.jsonl}"
-
-COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-complement-tuwunel:main}"
-
-# Complement tests that are skipped due to flakiness/reliability issues or we don't implement such features and won't for a long time
-SKIPPED_COMPLEMENT_TESTS='TestPartialStateJoin.*|TestRoomDeleteAlias/Parallel/Regular_users_can_add_and_delete_aliases_when_m.*|TestRoomDeleteAlias/Parallel/Can_delete_canonical_alias|TestUnbanViaInvite.*|TestRoomState/Parallel/GET_/publicRooms_lists.*"|TestRoomDeleteAlias/Parallel/Users_with_sufficient_power-level_can_delete_other.*'
-
-# $COMPLEMENT_SRC needs to be a directory to Complement source code
-if [ -f "$COMPLEMENT_SRC" ]; then
-    echo "\$COMPLEMENT_SRC must be a directory/path to Complement source code"
-    exit 1
-fi
-
-# quick test to make sure we can actually write to $LOG_FILE and $RESULTS_FILE
-touch $LOG_FILE && rm -v $LOG_FILE
-touch $RESULTS_FILE && rm -v $RESULTS_FILE
-
-toplevel="$(git rev-parse --show-toplevel)"
-
-pushd "$toplevel" > /dev/null
-
-if [ ! -f "complement_oci_image.tar.gz" ]; then
-    echo "building complement tuwunel image"
-
-    # if using macOS, use linux-complement
-    #bin/nix-build-and-cache just .#linux-complement
-    bin/nix-build-and-cache just .#complement
-    #nix build -L .#complement
-
-    echo "complement tuwunel image tar.gz built at \"result\""
-
-    echo "loading into docker"
-    docker load < result
-    popd > /dev/null
-else
-    echo "skipping building a complement tuwunel image as complement_oci_image.tar.gz was already found, loading this"
-
-    docker load < complement_oci_image.tar.gz
-    popd > /dev/null
-fi
-
-echo ""
-echo "running go test with:"
-echo "\$COMPLEMENT_SRC: $COMPLEMENT_SRC"
-echo "\$COMPLEMENT_BASE_IMAGE: $COMPLEMENT_BASE_IMAGE"
-echo "\$RESULTS_FILE: $RESULTS_FILE"
-echo "\$LOG_FILE: $LOG_FILE"
-echo ""
-
-# It's okay (likely, even) that `go test` exits nonzero
-# `COMPLEMENT_ENABLE_DIRTY_RUNS=1`  reuses the same complement container for faster complement, at the possible expense of test environment pollution
-set +o pipefail
-env \
-    -C "$COMPLEMENT_SRC" \
-    COMPLEMENT_BASE_IMAGE="$COMPLEMENT_BASE_IMAGE" \
-    go test -tags="conduwuit_blacklist" -skip="$SKIPPED_COMPLEMENT_TESTS" -v -timeout 1h -json ./tests/... | tee "$LOG_FILE"
-set -o pipefail
-
-# Post-process the results into an easy-to-compare format, sorted by Test name for reproducible results
-cat "$LOG_FILE" | jq -s -c 'sort_by(.Test)[]' | jq -c '
-    select(
-        (.Action == "pass" or .Action == "fail" or .Action == "skip")
-        and .Test != null
-    ) | {Action: .Action, Test: .Test}
-    ' > "$RESULTS_FILE"
-
-#if command -v gotestfmt &> /dev/null; then
-#    echo "using gotestfmt on $LOG_FILE"
-#    grep '{"Time":' "$LOG_FILE" | gotestfmt > "complement_test_logs_gotestfmt.log"
-#fi
-
-echo ""
-echo ""
-echo "complement logs saved at $LOG_FILE"
-echo "complement results saved at $RESULTS_FILE"
-#if command -v gotestfmt &> /dev/null; then
-#    echo "complement logs in gotestfmt pretty format outputted at complement_test_logs_gotestfmt.log (use an editor/terminal/pager that interprets ANSI colours and UTF-8 emojis)"
-#fi
-echo ""
-echo ""

nix/pkgs/complement/bin/nix-build-and-cache

@@ -1,110 +0,0 @@
-#!/usr/bin/env bash
-
-set -eo pipefail
-
-toplevel="$(git rev-parse --show-toplevel)"
-
-# Build just the single installable and forward any other arguments too
-just() {
-    # uses nix-output-monitor (nom) if available
-    if command -v nom &> /dev/null; then
-        nom build "$@"
-    else
-        nix build -L "$@"
-    fi
-
-    if [ -z "$ATTIC_TOKEN" ]; then
-        echo "\$ATTIC_TOKEN is unset, skipping uploading to the binary cache"
-        return
-    fi
-
-    # historical "conduit" store for compatibility purposes, same as tuwunel
-    nix run --inputs-from "$toplevel" attic -- \
-        login \
-        conduit \
-        "${ATTIC_ENDPOINT:-https://attic.kennel.juneis.dog/conduit}" \
-        "$ATTIC_TOKEN"
-
-    # Find all output paths of the installables and their build dependencies
-    #readarray -t derivations < <(nix path-info --derivation "$@")
-    derivations=()
-    while IFS=$'\n' read derivation; do
-        derivations+=("$derivation")
-    done < <(nix path-info --derivation "$@")
-
-    cache=()
-    for derivation in "${derivations[@]}"; do
-        cache+=(
-            "$(nix-store --query --requisites --include-outputs "$derivation")"
-        )
-    done
-
-    withattic() {
-        nix shell --inputs-from "$toplevel" attic --command xargs attic push "$@" <<< "${cache[*]}"
-    }
-    # Upload them to Attic (conduit store)
-    #
-    # Use `xargs` and a here-string because something would probably explode if
-    # several thousand arguments got passed to a command at once. Hopefully no
-    # store paths include a newline in them.
-    (
-        IFS=$'\n'
-        withattic conduit || withattic conduit || withattic conduit || true
-    )
-
-    # main "tuwunel" store
-    nix run --inputs-from "$toplevel" attic -- \
-        login \
-        tuwunel \
-        "${ATTIC_ENDPOINT:-https://attic.kennel.juneis.dog/tuwunel}" \
-        "$ATTIC_TOKEN"
-
-    # Upload them to Attic (tuwunel store) and Cachix
-    #
-    # Use `xargs` and a here-string because something would probably explode if
-    # several thousand arguments got passed to a command at once. Hopefully no
-    # store paths include a newline in them.
-    (
-        IFS=$'\n'
-        withattic tuwunel || withattic tuwunel || withattic tuwunel || true
-
-        # push to cachix if available
-        if [ "$CACHIX_AUTH_TOKEN" ]; then
-            nix shell --inputs-from "$toplevel" cachix -c xargs \
-            cachix push tuwunel <<< "${cache[*]}"
-        fi
-    )
-}
-
-# Build and cache things needed for CI
-ci() {
-    cache=(
-        --inputs-from "$toplevel"
-
-        # Keep sorted
-        #"$toplevel#devShells.x86_64-linux.default"
-        #"$toplevel#devShells.x86_64-linux.all-features"
-        attic#default
-        cachix#default
-        nixpkgs#direnv
-        nixpkgs#jq
-        nixpkgs#nix-direnv
-    )
-
-    just "${cache[@]}"
-}
-
-# Build and cache *all* the package outputs from the flake.nix
-packages() {
-    declare -a cache="($(
-        nix flake show --json 2> /dev/null |
-            nix run --inputs-from "$toplevel" nixpkgs#jq -- \
-            -r \
-            '.packages."x86_64-linux" | keys | map("'"$toplevel"'#" + .) | @sh'
-    ))"
-
-    just "${cache[@]}"
-}
-
-
-eval "$@"

nix/pkgs/complement/certificate.crt

@@ -1,21 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDfzCCAmegAwIBAgIUcrZdSPmCh33Evys/U6mTPpShqdcwDQYJKoZIhvcNAQEL
-BQAwPzELMAkGA1UEBhMCNjkxCzAJBgNVBAgMAjQyMRUwEwYDVQQKDAx3b29mZXJz
-IGluYy4xDDAKBgNVBAMMA2hzMTAgFw0yNTAzMTMxMjU4NTFaGA8yMDUyMDcyODEy
-NTg1MVowPzELMAkGA1UEBhMCNjkxCzAJBgNVBAgMAjQyMRUwEwYDVQQKDAx3b29m
-ZXJzIGluYy4xDDAKBgNVBAMMA2hzMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-AQoCggEBANL+h2ZmK/FqN5uLJPtIy6Feqcyb6EX7MQBEtxuJ56bTAbjHuCLZLpYt
-/wOWJ91drHqZ7Xd5iTisGdMu8YS803HSnHkzngf4VXKhVrdzW2YDrpZRxmOhtp88
-awOHmP7mqlJyBbCOQw8aDVrT0KmEIWzA7g+nFRQ5Ff85MaP+sQrHGKZbo61q8HBp
-L0XuaqNckruUKtxnEqrm5xx5sYyYKg7rrSFE5JMFoWKB1FNWJxyWT42BhGtnJZsK
-K5c+NDSOU4TatxoN6mpNSBpCz/a11PiQHMEfqRk6JA4g3911dqPTfZBevUdBh8gl
-8maIzqeZGhvyeKTmull1Y0781yyuj98CAwEAAaNxMG8wCQYDVR0TBAIwADALBgNV
-HQ8EBAMCBPAwNgYDVR0RBC8wLYIRKi5kb2NrZXIuaW50ZXJuYWyCA2hzMYIDaHMy
-ggNoczOCA2hzNIcEfwAAATAdBgNVHQ4EFgQUr4VYrmW1d+vjBTJewvy7fJYhLDYw
-DQYJKoZIhvcNAQELBQADggEBADkYqkjNYxjWX8hUUAmFHNdCwzT1CpYe/5qzLiyJ
-irDSdMlC5g6QqMUSrpu7nZxo1lRe1dXGroFVfWpoDxyCjSQhplQZgtYqtyLfOIx+
-HQ7cPE/tUU/KsTGc0aL61cETB6u8fj+rQKUGdfbSlm0Rpu4v0gC8RnDj06X/hZ7e
-VkWU+dOBzxlqHuLlwFFtVDgCyyTatIROx5V+GpMHrVqBPO7HcHhwqZ30k2kMM8J3
-y1CWaliQM85jqtSZV+yUHKQV8EksSowCFJuguf+Ahz0i0/koaI3i8m4MRN/1j13d
-jbTaX5a11Ynm3A27jioZdtMRty6AJ88oCp18jxVzqTxNNO4=
------END CERTIFICATE-----