fix(oauth): Use unauthorized_client for unregistered grant types

The token endpoint already refused grant types the client had not
registered, but reported it as `invalid_grant`. RFC 6749 section 5.2
reserves `invalid_grant` for an authorization grant which is "invalid,
expired, revoked, does not match the redirection URI used in the
authorization request, or was issued to another client", and defines
`unauthorized_client` for a client which "is not authorized to use this
authorization grant type".

Report the condition with the error code the specification assigns to it,
matching the device authorization endpoint.

.cargo/config.toml

@@ -1,2 +1,2 @@
-[env]
-RUMA_UNSTABLE_EXHAUSTIVE_TYPES = "true"
+[alias]
+xtask = "run --package xtask --"

.dockerignore

@@ -1,31 +1,28 @@
 # Local build and dev artifacts
 target/
-#tests
+!target/debug/conduwuit
 
 # Docker files
 Dockerfile*
-docker/
 
 # IDE files
 .vscode
 .idea
 *.iml
 
-.
-
 # Git folder
-#.git
-#.gitea
-#.gitlab
-#.github
+# .git
+.gitea
+.gitlab
+.github
+.forgejo
 
 # Dot files
 .env
-#.gitignore
+.gitignore
 
 # Toml files
-#rustfmt.toml
+rustfmt.toml
 
 # Documentation
 #*.md
-*.hcl

.editorconfig

@@ -22,3 +22,11 @@ indent_size = 2
 [*.rs]
 indent_style = tab
 max_line_length = 98
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.json]
+indent_size = 4
+indent_style = space

.envrc

@@ -2,6 +2,8 @@
 
 dotenv_if_exists
 
-use flake ".#${DIRENV_DEVSHELL:-default}"
+if command -v nix >/dev/null 2>&1; then
+    use flake ".#${DIRENV_DEVSHELL:-default}"
+fi
 
 PATH_add bin

.forgejo/actions/create-docker-manifest/action.yml

@@ -0,0 +1,110 @@
+name: create-manifest
+description: |
+  Create and push a multi-platform Docker manifest from individual platform digests.
+  Handles downloading digests, creating manifest lists, and pushing to registry.
+
+inputs:
+  digest_pattern:
+    description: Glob pattern to match digest artifacts (e.g. "digests-linux-{amd64,arm64}")
+    required: true
+  tag_suffix:
+    description: Suffix to add to all Docker tags (e.g. "-maxperf")
+    required: false
+    default: ""
+  images:
+    description: Container registry images (newline-separated)
+    required: true
+  registry_user:
+    description: Registry username for authentication
+    required: false
+  registry_password:
+    description: Registry password for authentication
+    required: false
+
+outputs:
+  version:
+    description: The version tag created for the manifest
+    value: ${{ steps.meta.outputs.version }}
+  tags:
+    description: All tags created for the manifest
+    value: ${{ steps.meta.outputs.tags }}
+
+runs:
+  using: composite
+  steps:
+    - run: mkdir -p digests
+      shell: bash
+    - name: Download digests
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      uses: forgejo/download-artifact@v4
+      with:
+        path: digests
+        pattern: ${{ inputs.digest_pattern }}
+        merge-multiple: true
+
+    - name: Login to builtin registry
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      with:
+        registry: ${{ env.BUILTIN_REGISTRY }}
+        username: ${{ inputs.registry_user }}
+        password: ${{ inputs.registry_password }}
+
+    - name: Set up Docker Buildx
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      with:
+        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
+        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
+        endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
+
+    - name: Extract metadata (tags) for Docker
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      id: meta
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+      with:
+        flavor: |
+          latest=auto
+          suffix=${{ inputs.tag_suffix }},onlatest=true
+        tags: |
+          type=semver,pattern={{version}},prefix=v
+          type=semver,pattern={{major}}.{{minor}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.0.') }},prefix=v
+          type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v
+          type=ref,event=branch,prefix=${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref && 'branch-' || '' }},
+          type=ref,event=pr
+          type=sha,format=short
+        images: ${{ inputs.images }}
+        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
+      env:
+        DOCKER_METADATA_ANNOTATIONS_LEVELS: index
+
+    - name: Create manifest list and push
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      working-directory: digests
+      shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+      run: |
+        set -o xtrace
+        IFS=$'\n'
+        IMAGES_LIST=($IMAGES)
+        ANNOTATIONS_LIST=($DOCKER_METADATA_OUTPUT_ANNOTATIONS)
+        TAGS_LIST=($DOCKER_METADATA_OUTPUT_TAGS)
+        for REPO in "${IMAGES_LIST[@]}"; do
+            docker buildx imagetools create \
+              $(for tag in "${TAGS_LIST[@]}"; do echo "--tag"; echo "$tag"; done) \
+              $(for annotation in "${ANNOTATIONS_LIST[@]}"; do echo "--annotation"; echo "$annotation"; done) \
+              $(for reference in *; do printf "$REPO@sha256:%s\n" $reference; done)
+        done
+
+    - name: Inspect image
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+      run: |
+        set -o xtrace
+        IMAGES_LIST=($IMAGES)
+        for REPO in "${IMAGES_LIST[@]}"; do
+          docker buildx imagetools inspect $REPO:${{ steps.meta.outputs.version }}
+        done

.forgejo/actions/prepare-docker-build/action.yml

@@ -0,0 +1,113 @@
+name: prepare-docker-build
+description: |
+  Prepare the Docker build environment for Continuwuity builds.
+  Sets up Rust toolchain, Docker Buildx, caching, and extracts metadata for Docker builds.
+
+inputs:
+  platform:
+    description: Target platform (e.g. linux/amd64, linux/arm64)
+    required: true
+  slug:
+    description: Platform slug for artifact naming (e.g. linux-amd64, linux-arm64)
+    required: true
+  target_cpu:
+    description: Target CPU architecture (e.g. haswell, empty for base)
+    required: false
+    default: ""
+  profile:
+    description: Cargo build profile (release or release-max-perf)
+    required: true
+  images:
+    description: Container registry images (newline-separated)
+    required: true
+  registry_user:
+    description: Registry username for authentication
+    required: false
+  registry_password:
+    description: Registry password for authentication
+    required: false
+
+outputs:
+  cpu_suffix:
+    description: CPU suffix for artifact naming
+    value: ${{ steps.cpu-suffix.outputs.suffix }}
+  metadata_labels:
+    description: Docker labels for the image
+    value: ${{ steps.meta.outputs.labels }}
+  metadata_annotations:
+    description: Docker annotations for the image
+    value: ${{ steps.meta.outputs.annotations }}
+
+runs:
+  using: composite
+  steps:
+    - name: Set CPU suffix variable
+      id: cpu-suffix
+      shell: bash
+      run: |
+        if [[ -n "${{ inputs.target_cpu }}" ]]; then
+          echo "suffix=-${{ inputs.target_cpu }}" >> $GITHUB_OUTPUT
+          echo "CPU_SUFFIX=-${{ inputs.target_cpu }}" >> $GITHUB_ENV
+        else
+          echo "suffix=" >> $GITHUB_OUTPUT
+          echo "CPU_SUFFIX=" >> $GITHUB_ENV
+        fi
+
+    - name: Echo matrix configuration
+      shell: bash
+      run: |
+        echo "Platform: ${{ inputs.platform }}"
+        echo "Slug: ${{ inputs.slug }}"
+        echo "Target CPU: ${{ inputs.target_cpu }}"
+        echo "Profile: ${{ inputs.profile }}"
+
+    - name: Install rust
+      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+      id: rust-toolchain
+      uses: ./.forgejo/actions/rust-toolchain
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      with:
+        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
+        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
+        endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
+
+    - name: Set up QEMU
+      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+
+    - name: Login to builtin registry
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      with:
+        registry: ${{ env.BUILTIN_REGISTRY }}
+        username: ${{ inputs.registry_user }}
+        password: ${{ inputs.registry_password }}
+
+    - name: Extract metadata (labels, annotations) for Docker
+      id: meta
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+      with:
+        images: ${{ inputs.images }}
+        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
+      env:
+        DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
+
+    - name: Get short git commit SHA
+      id: sha
+      shell: bash
+      run: |
+        calculatedSha=$(git rev-parse --short ${{ github.sha }})
+        echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+        echo "Short SHA: $calculatedSha"
+
+    - name: Get Git commit timestamps
+      shell: bash
+      run: |
+        timestamp=$(git log -1 --pretty=%ct)
+        echo "TIMESTAMP=$timestamp" >> $GITHUB_ENV
+        echo "Commit timestamp: $timestamp"
+
+    - uses: ./.forgejo/actions/timelord
+      id: timelord

.forgejo/actions/rust-toolchain/action.yml

@@ -0,0 +1,63 @@
+name: rust-toolchain
+description: |
+  Install a Rust toolchain using rustup.
+  See https://rust-lang.github.io/rustup/concepts/toolchains.html#toolchain-specification
+  for more information about toolchains.
+inputs:
+  toolchain:
+    description: |
+      Rust toolchain name.
+      See https://rust-lang.github.io/rustup/concepts/toolchains.html#toolchain-specification
+    required: false
+  target:
+    description: Target triple to install for this toolchain
+    required: false
+  components:
+    description: Space-separated list of components to be additionally installed for a new toolchain
+    required: false
+outputs:
+  rustc_version:
+    description: The rustc version installed
+    value: ${{ steps.rustc-version.outputs.version }}
+  rustup_version:
+    description: The rustup version installed
+    value: ${{ steps.rustup-version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check if rustup is already installed
+      shell: bash
+      id: rustup-version
+      run: |
+        echo "version=$(rustup --version)" >> $GITHUB_OUTPUT
+    - name: Cache rustup toolchains
+      if: steps.rustup-version.outputs.version == ''
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: |
+          ~/.rustup
+          !~/.rustup/tmp
+          !~/.rustup/downloads
+        # Requires repo to be cloned if toolchain is not specified
+        key: continuwuity-${{ runner.os }}-rustup-${{ inputs.toolchain || hashFiles('**/rust-toolchain.toml') }}
+    - name: Install Rust toolchain
+      if: steps.rustup-version.outputs.version == ''
+      shell: bash
+      run: |
+        if ! command -v rustup &> /dev/null ; then
+            curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused -fsSL "https://sh.rustup.rs" | sh -s -- --default-toolchain none -y
+            echo "${CARGO_HOME:-$HOME/.cargo}/bin" >> $GITHUB_PATH
+        fi
+    - shell: bash
+      run: |
+        set -x
+        ${{ inputs.toolchain && format('rustup override set {0}', inputs.toolchain) }}
+        ${{ inputs.target && format('rustup target add {0}', inputs.target) }}
+        ${{ inputs.components && format('rustup component add {0}', inputs.components) }}
+        cargo --version
+        rustc --version
+    - id: rustc-version
+      shell: bash
+      run: |
+        echo "version=$(rustc --version)" >> $GITHUB_OUTPUT

.forgejo/actions/sccache/action.yml

@@ -0,0 +1,23 @@
+name: sccache
+description: |
+  Install sccache for caching builds in GitHub Actions.
+
+
+runs:
+  using: composite
+  steps:
+  - name: Install sccache
+    uses: https://git.tomfos.tr/tom/sccache-action@v1
+  - name: Configure sccache
+    uses: https://github.com/actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+    with:
+      script: |
+        core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
+        core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
+  - shell: bash
+    run: |
+      echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
+      echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+      echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+      echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+      echo "CMAKE_CUDA_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV

.forgejo/actions/setup-llvm-with-apt/action.yml

@@ -0,0 +1,167 @@
+name: setup-llvm-with-apt
+description: |
+  Set up LLVM toolchain with APT package management and smart caching.
+  Supports cross-compilation architectures and additional package installation.
+
+  Creates symlinks in /usr/bin: clang, clang++, lld, llvm-ar, llvm-ranlib
+
+inputs:
+  dpkg-arch:
+    description: 'Debian architecture for cross-compilation (e.g. arm64)'
+    required: false
+    default: ''
+  extra-packages:
+    description: 'Additional APT packages to install (space-separated)'
+    required: false
+    default: ''
+  llvm-version:
+    description: 'LLVM version to install'
+    required: false
+    default: '21'
+
+outputs:
+  llvm-version:
+    description: 'Installed LLVM version'
+    value: ${{ steps.configure.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Detect runner OS
+      id: runner-os
+      uses: https://git.tomfos.tr/actions/detect-versions@v1
+
+    - name: Configure cross-compilation architecture
+      if: inputs.dpkg-arch != ''
+      shell: bash
+      run: |
+        echo "🏗️ Adding ${{ inputs.dpkg-arch }} architecture"
+        sudo dpkg --add-architecture ${{ inputs.dpkg-arch }}
+
+        # Restrict default sources to amd64
+        sudo sed -i 's/^deb http/deb [arch=amd64] http/g' /etc/apt/sources.list
+        sudo sed -i 's/^deb https/deb [arch=amd64] https/g' /etc/apt/sources.list
+
+        # Add ports sources for foreign architecture
+        sudo tee /etc/apt/sources.list.d/${{ inputs.dpkg-arch }}.list > /dev/null <<EOF
+        deb [arch=${{ inputs.dpkg-arch }}] http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe multiverse
+        deb [arch=${{ inputs.dpkg-arch }}] http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe multiverse
+        deb [arch=${{ inputs.dpkg-arch }}] http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse
+        EOF
+
+        echo "✅ Architecture ${{ inputs.dpkg-arch }} configured"
+
+    - name: Start LLVM cache group
+      shell: bash
+      run: echo "::group::📦 Restoring LLVM cache"
+
+    - name: Check for LLVM cache
+      id: cache
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: |
+          /usr/bin/clang-*
+          /usr/bin/clang++-*
+          /usr/bin/lld-*
+          /usr/bin/llvm-*
+          /usr/lib/llvm-*/
+          /usr/lib/x86_64-linux-gnu/libLLVM*.so*
+          /usr/lib/x86_64-linux-gnu/libclang*.so*
+          /etc/apt/sources.list.d/archive_uri-*
+          /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+        key: continuwuity-llvm-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-v${{ inputs.llvm-version }}-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
+
+    - name: End LLVM cache group
+      shell: bash
+      run: echo "::endgroup::"
+
+    - name: Check and install LLVM if needed
+      id: llvm-setup
+      shell: bash
+      run: |
+        echo "🔍 Checking for LLVM ${{ inputs.llvm-version }}..."
+
+        # Check both binaries and libraries exist
+        if [ -f "/usr/bin/clang-${{ inputs.llvm-version }}" ] && \
+           [ -f "/usr/bin/clang++-${{ inputs.llvm-version }}" ] && \
+           [ -f "/usr/bin/lld-${{ inputs.llvm-version }}" ] && \
+           ([ -f "/usr/lib/x86_64-linux-gnu/libLLVM.so.${{ inputs.llvm-version }}.1" ] || \
+            [ -f "/usr/lib/x86_64-linux-gnu/libLLVM-${{ inputs.llvm-version }}.so.1" ] || \
+            [ -f "/usr/lib/llvm-${{ inputs.llvm-version }}/lib/libLLVM.so" ]); then
+          echo "✅ LLVM ${{ inputs.llvm-version }} found and verified"
+          echo "needs-install=false" >> $GITHUB_OUTPUT
+        else
+          echo "📦 LLVM ${{ inputs.llvm-version }} not found or incomplete - installing..."
+
+          echo "::group::🔧 Installing LLVM ${{ inputs.llvm-version }}"
+          wget -O - https://apt.llvm.org/llvm.sh | bash -s -- ${{ inputs.llvm-version }}
+          echo "::endgroup::"
+
+          if [ ! -f "/usr/bin/clang-${{ inputs.llvm-version }}" ]; then
+            echo "❌ Failed to install LLVM ${{ inputs.llvm-version }}"
+            exit 1
+          fi
+
+          echo "✅ Installed LLVM ${{ inputs.llvm-version }}"
+          echo "needs-install=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Prepare for additional packages
+      if: inputs.extra-packages != ''
+      shell: bash
+      run: |
+        # Update APT if LLVM was cached (installer script already does apt-get update)
+        if [[ "${{ steps.llvm-setup.outputs.needs-install }}" != "true" ]]; then
+          echo "::group::📦 Running apt-get update (LLVM cached, extra packages needed)"
+          sudo apt-get update
+          echo "::endgroup::"
+        fi
+        echo "::group::📦 Installing additional packages"
+
+    - name: Install additional packages
+      if: inputs.extra-packages != ''
+      uses: https://github.com/awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
+      with:
+        packages: ${{ inputs.extra-packages }}
+        version: 1.0
+
+    - name: End package installation group
+      if: inputs.extra-packages != ''
+      shell: bash
+      run: echo "::endgroup::"
+
+    - name: Configure LLVM environment
+      id: configure
+      shell: bash
+      run: |
+        echo "::group::🔧 Configuring LLVM ${{ inputs.llvm-version }} environment"
+
+        # Create symlinks
+        sudo ln -sf "/usr/bin/clang-${{ inputs.llvm-version }}" /usr/bin/clang
+        sudo ln -sf "/usr/bin/clang++-${{ inputs.llvm-version }}" /usr/bin/clang++
+        sudo ln -sf "/usr/bin/lld-${{ inputs.llvm-version }}" /usr/bin/lld
+        sudo ln -sf "/usr/bin/llvm-ar-${{ inputs.llvm-version }}" /usr/bin/llvm-ar
+        sudo ln -sf "/usr/bin/llvm-ranlib-${{ inputs.llvm-version }}" /usr/bin/llvm-ranlib
+        echo "  ✓ Created symlinks"
+
+        # Setup library paths
+        LLVM_LIB_PATH="/usr/lib/llvm-${{ inputs.llvm-version }}/lib"
+        if [ -d "$LLVM_LIB_PATH" ]; then
+          echo "LD_LIBRARY_PATH=${LLVM_LIB_PATH}:${LD_LIBRARY_PATH:-}" >> $GITHUB_ENV
+          echo "LIBCLANG_PATH=${LLVM_LIB_PATH}" >> $GITHUB_ENV
+
+          echo "$LLVM_LIB_PATH" | sudo tee "/etc/ld.so.conf.d/llvm-${{ inputs.llvm-version }}.conf" > /dev/null
+          sudo ldconfig
+          echo "  ✓ Configured library paths"
+        else
+          # Fallback to standard library location
+          if [ -d "/usr/lib/x86_64-linux-gnu" ]; then
+            echo "LIBCLANG_PATH=/usr/lib/x86_64-linux-gnu" >> $GITHUB_ENV
+            echo "  ✓ Using fallback library path"
+          fi
+        fi
+
+        # Set output
+        echo "version=${{ inputs.llvm-version }}" >> $GITHUB_OUTPUT
+        echo "::endgroup::"
+        echo "✅ LLVM ready: $(clang --version | head -1)"

.forgejo/actions/setup-rust/action.yml

@@ -0,0 +1,216 @@
+name: setup-rust
+description: |
+  Set up Rust toolchain with sccache for compilation caching.
+  Respects rust-toolchain.toml by default or accepts explicit version override.
+
+inputs:
+  cache-key-suffix:
+    description: 'Optional suffix for cache keys (e.g. platform identifier)'
+    required: false
+    default: ''
+  rust-components:
+    description: 'Additional Rust components to install (space-separated)'
+    required: false
+    default: ''
+  rust-target:
+    description: 'Rust target triple (e.g. x86_64-unknown-linux-gnu)'
+    required: false
+    default: ''
+  rust-version:
+    description: 'Rust version to install (e.g. nightly). Defaults to the version specified in rust-toolchain.toml'
+    required: false
+    default: ''
+  sccache-cache-limit:
+    description: 'Maximum size limit for sccache local cache (e.g. 2G, 500M)'
+    required: false
+    default: '2G'
+  github-token:
+    description: 'GitHub token for downloading sccache from GitHub releases'
+    required: false
+    default: ''
+
+outputs:
+  rust-version:
+    description: 'Installed Rust version'
+    value: ${{ steps.rust-setup.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Detect runner OS
+      id: runner-os
+      uses: https://git.tomfos.tr/actions/detect-versions@v1
+
+    - name: Configure Cargo environment
+      shell: bash
+      run: |
+        # Use workspace-relative paths for better control and consistency
+        echo "CARGO_HOME=${{ github.workspace }}/.cargo" >> $GITHUB_ENV
+        echo "CARGO_TARGET_DIR=${{ github.workspace }}/target" >> $GITHUB_ENV
+        echo "SCCACHE_DIR=${{ github.workspace }}/.sccache" >> $GITHUB_ENV
+        echo "RUSTUP_HOME=${{ github.workspace }}/.rustup" >> $GITHUB_ENV
+
+        # Limit binstall resolution timeout to avoid GitHub rate limit delays
+        echo "BINSTALL_MAXIMUM_RESOLUTION_TIMEOUT=10" >> $GITHUB_ENV
+
+        # Ensure directories exist for first run
+        mkdir -p "${{ github.workspace }}/.cargo"
+        mkdir -p "${{ github.workspace }}/.sccache"
+        mkdir -p "${{ github.workspace }}/target"
+        mkdir -p "${{ github.workspace }}/.rustup"
+
+    - name: Start registry/toolchain restore group
+      shell: bash
+      run: echo "::group::📦 Restoring registry and toolchain caches"
+
+    - name: Cache toolchain binaries
+      id: toolchain-cache
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: |
+          .cargo/bin
+          .rustup/toolchains
+          .rustup/update-hashes
+        # Shared toolchain cache across all Rust versions
+        key: continuwuity-toolchain-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}
+
+    - name: Cache Cargo registry and git
+      id: registry-cache
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: |
+          .cargo/registry/index
+          .cargo/registry/cache
+          .cargo/git/db
+        # Registry cache saved per workflow, restored from any workflow's cache
+        # Each workflow maintains its own registry that accumulates its needed crates
+        key: continuwuity-cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ github.workflow }}
+        restore-keys: |
+          continuwuity-cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-
+
+    - name: End registry/toolchain restore group
+      shell: bash
+      run: echo "::endgroup::"
+
+    - name: Setup Rust toolchain
+      shell: bash
+      id: rust-setup
+      run: |
+        # Install rustup if not already cached
+        if ! command -v rustup &> /dev/null; then
+          echo "::group::📦 Installing rustup"
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain none
+          source "$CARGO_HOME/env"
+          echo "::endgroup::"
+        else
+          echo "✅ rustup already available"
+        fi
+
+        # Setup the appropriate Rust version
+        if [[ -n "${{ inputs.rust-version }}" ]]; then
+          echo "::group::📦 Setting up Rust ${{ inputs.rust-version }}"
+          # Set override first to prevent rust-toolchain.toml from auto-installing
+          rustup override set ${{ inputs.rust-version }} 2>/dev/null || true
+
+          # Check if we need to install/update the toolchain
+          if rustup toolchain list | grep -q "^${{ inputs.rust-version }}-"; then
+            rustup update ${{ inputs.rust-version }}
+          else
+            rustup toolchain install ${{ inputs.rust-version }} --profile minimal -c cargo,clippy,rustfmt
+          fi
+        else
+          echo "::group::📦 Setting up Rust from rust-toolchain.toml"
+          rustup show
+        fi
+
+        RUST_VERSION=$(rustc --version | cut -d' ' -f2)
+        echo "version=$RUST_VERSION" >> $GITHUB_OUTPUT
+
+        echo "::endgroup::"
+
+    - name: Install Rust components
+      if: inputs.rust-components != ''
+      shell: bash
+      run: |
+        echo "📦 Installing components: ${{ inputs.rust-components }}"
+        rustup component add ${{ inputs.rust-components }}
+
+    - name: Install Rust target
+      if: inputs.rust-target != ''
+      shell: bash
+      run: |
+        echo "📦 Installing target: ${{ inputs.rust-target }}"
+        rustup target add ${{ inputs.rust-target }}
+
+    - name: Start build cache restore group
+      shell: bash
+      run: echo "::group::📦 Restoring build cache"
+
+    - name: Setup sccache
+      uses: https://git.tomfos.tr/tom/sccache-action@v1
+
+    - name: End build cache restore group
+      shell: bash
+      run: echo "::endgroup::"
+
+    - name: Configure PATH and install tools
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: |
+        # Add .cargo/bin to PATH permanently for all subsequent steps
+        echo "${{ github.workspace }}/.cargo/bin" >> $GITHUB_PATH
+
+        # For this step only, we need to add it to PATH since GITHUB_PATH takes effect in the next step
+        export PATH="${{ github.workspace }}/.cargo/bin:$PATH"
+
+        # Install cargo-binstall for fast binary installations
+        if command -v cargo-binstall &> /dev/null; then
+          echo "✅ cargo-binstall already available"
+        else
+          echo "::group::📦 Installing cargo-binstall"
+          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+          echo "::endgroup::"
+        fi
+
+        if command -v prek &> /dev/null; then
+          echo "✅ prek already available"
+        else
+          echo "::group::📦 Installing prek"
+          # prek isn't regularly published to crates.io, so we use git source
+          cargo-binstall -y --no-symlinks --git https://github.com/j178/prek prek
+          echo "::endgroup::"
+        fi
+
+        if command -v timelord &> /dev/null; then
+          echo "✅ timelord already available"
+        else
+          echo "::group::📦 Installing timelord"
+          cargo-binstall -y --no-symlinks timelord-cli
+          echo "::endgroup::"
+        fi
+
+    - name: Configure sccache environment
+      shell: bash
+      run: |
+        echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+        echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+        echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+        echo "CMAKE_CUDA_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+        echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
+
+        # Configure incremental compilation GC
+        # If we restored from old cache (partial hit), clean up aggressively
+        if [[ "${{ steps.build-cache.outputs.cache-hit }}" != "true" ]]; then
+          echo "♻️ Partial cache hit - enabling cache cleanup"
+          echo "CARGO_INCREMENTAL_GC_THRESHOLD=5" >> $GITHUB_ENV
+        fi
+
+    - name: Output version and summary
+      shell: bash
+      run: |
+        echo "📋 Setup complete:"
+        echo "  Rust: $(rustc --version)"
+        echo "  Cargo: $(cargo --version)"
+        echo "  prek: $(prek --version 2>/dev/null || echo 'installed')"
+        echo "  timelord: $(timelord --version 2>/dev/null || echo 'installed')"

.forgejo/actions/timelord/action.yml

@@ -0,0 +1,120 @@
+name: timelord
+description: |
+  Use timelord to set file timestamps with git-warp-time fallback for cache misses
+inputs:
+  key:
+    description: |
+      The key to use for caching the timelord data.
+    required: false
+    default: ''
+  path:
+    description: |
+      The path to the directory to be timestamped.
+    required: false
+    default: ''
+
+outputs:
+  database-path:
+    description: Path to timelord database
+    value: '${{ env.TIMELORD_CACHE_PATH }}'
+
+runs:
+  using: composite
+  steps:
+    - name: Set defaults
+      shell: bash
+      run: |
+        echo "TIMELORD_KEY=${{ inputs.key || format('timelord-v1-{0}-{1}', github.repository, hashFiles('**/*.rs', '**/Cargo.toml', '**/Cargo.lock')) }}" >> $GITHUB_ENV
+        echo "TIMELORD_PATH=${{ inputs.path || '.' }}" >> $GITHUB_ENV
+        echo "TIMELORD_CACHE_PATH=$HOME/.cache/timelord" >> $GITHUB_ENV
+        echo "PATH=$HOME/.cargo/bin:/usr/share/rust/.cargo/bin:$PATH" >> $GITHUB_ENV
+
+    - name: Restore binary cache
+      id: binary-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: |
+          /usr/share/rust/.cargo/bin
+          ~/.cargo/bin
+        key: continuwuity-timelord-binaries
+
+    - name: Check if binaries need installation
+      shell: bash
+      id: check-binaries
+      run: |
+        NEED_INSTALL=false
+
+        # Ensure ~/.cargo/bin exists
+        mkdir -p ~/.cargo/bin
+
+        # Check and move timelord if needed
+        if [ -f /usr/share/rust/.cargo/bin/timelord ] && [ ! -f ~/.cargo/bin/timelord ]; then
+          echo "Moving timelord from /usr/share/rust/.cargo/bin to ~/.cargo/bin"
+          mv /usr/share/rust/.cargo/bin/timelord ~/.cargo/bin/
+        fi
+        if [ ! -f ~/.cargo/bin/timelord ]; then
+          echo "timelord-cli not found, needs installation"
+          NEED_INSTALL=true
+        fi
+
+        # Check and move git-warp-time if needed
+        if [ -f /usr/share/rust/.cargo/bin/git-warp-time ] && [ ! -f ~/.cargo/bin/git-warp-time ]; then
+          echo "Moving git-warp-time from /usr/share/rust/.cargo/bin to ~/.cargo/bin"
+          mv /usr/share/rust/.cargo/bin/git-warp-time ~/.cargo/bin/
+        fi
+        if [ ! -f ~/.cargo/bin/git-warp-time ]; then
+          echo "git-warp-time not found, needs installation"
+          NEED_INSTALL=true
+        fi
+
+        echo "need-install=$NEED_INSTALL" >> $GITHUB_OUTPUT
+
+    - name: Install timelord-cli and git-warp-time
+      if: steps.check-binaries.outputs.need-install == 'true'
+      uses: https://github.com/taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2
+      with:
+        tool: git-warp-time,timelord-cli@3.0.1
+
+    - name: Save binary cache
+      if: steps.check-binaries.outputs.need-install == 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: |
+          /usr/share/rust/.cargo/bin
+          ~/.cargo/bin
+        key: continuwuity-timelord-binaries
+
+
+    - name: Restore timelord cache with fallbacks
+      id: timelord-restore
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ env.TIMELORD_CACHE_PATH }}
+        key: ${{ env.TIMELORD_KEY }}
+        restore-keys: |
+          continuwuity-timelord-${{ github.repository }}-
+
+    - name: Initialize timestamps on complete cache miss
+      if: steps.timelord-restore.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        echo "Complete timelord cache miss - running git-warp-time"
+        git fetch --unshallow
+        if [ "${{ env.TIMELORD_PATH }}" = "." ]; then
+          git-warp-time --quiet
+        else
+          git-warp-time --quiet ${{ env.TIMELORD_PATH }}
+        fi
+        echo "Git timestamps restored"
+
+    - name: Run timelord sync
+      shell: bash
+      run: |
+        mkdir -p ${{ env.TIMELORD_CACHE_PATH }}
+        timelord sync --source-dir ${{ env.TIMELORD_PATH }} --cache-dir ${{ env.TIMELORD_CACHE_PATH }}
+
+    - name: Save updated timelord cache immediately
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ env.TIMELORD_CACHE_PATH }}
+        key: ${{ env.TIMELORD_KEY }}

.forgejo/actions/upload-docker-artifacts/action.yml

@@ -0,0 +1,70 @@
+name: upload-docker-artifacts
+description: |
+  Upload Docker build artifacts including binary and digest files.
+  Handles artifact naming and conditional digest uploads for registry publishing.
+
+inputs:
+  slug:
+    description: Platform slug for artifact naming (e.g. linux-amd64, linux-arm64)
+    required: true
+  cpu_suffix:
+    description: CPU suffix for artifact naming (e.g. -haswell)
+    required: false
+    default: ""
+  artifact_suffix:
+    description: Suffix for binary artifacts (e.g. -maxperf)
+    required: false
+    default: ""
+  digest_suffix:
+    description: Suffix for digest artifacts (e.g. -maxperf)
+    required: false
+    default: ""
+  digest:
+    description: The digest of the built Docker image
+    required: true
+
+outputs:
+  binary_artifact_name:
+    description: The name of the uploaded binary artifact
+    value: conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
+
+runs:
+  using: composite
+  steps:
+    - name: Export digest
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      shell: bash
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ inputs.digest }}"
+        echo "🔍 Build step digest output: '$digest'"
+        if [[ -z "$digest" ]]; then
+          echo "❌ ERROR: No digest found from build step"
+          exit 1
+        fi
+        digest_file="/tmp/digests/${digest#sha256:}"
+        echo "📁 Creating digest file: $digest_file"
+        touch "$digest_file"
+        echo "✅ Digest file created successfully"
+        echo "📋 Contents of /tmp/digests:"
+        ls -la /tmp/digests/
+
+    - name: Rename extracted binary
+      shell: bash
+      run: mv /tmp/binaries/sbin/conduwuit /tmp/binaries/conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
+
+    - name: Upload binary artifact
+      uses: forgejo/upload-artifact@v4
+      with:
+        name: conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
+        path: /tmp/binaries/conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
+        if-no-files-found: error
+
+    - name: Upload digest
+      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+      uses: forgejo/upload-artifact@v4
+      with:
+        name: digests${{ inputs.digest_suffix }}-${{ inputs.slug }}${{ inputs.cpu_suffix }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 5

.forgejo/pull_request_template.md

@@ -0,0 +1,80 @@
+---
+name: 'New pull request'
+about: 'Open a new pull request to contribute to continuwuity'
+ref: 'main'
+---
+
+<!--
+In order to help reviewers know what your pull request does at a glance, you should ensure that
+
+1. Your PR title is a short, single sentence describing what you changed
+2. You have described in more detail what you have changed, why you have changed it, what the
+   intended effect is, and why you think this will be beneficial to the project.
+
+If you have made any potentially strange/questionable design choices, but didn't feel they'd benefit
+from code comments, please don't mention them here - after opening your pull request,
+go to "files changed", and click on the "+" symbol in the line number gutter,
+and attach comments to the lines that you think would benefit from some clarification.
+-->
+
+This pull request...
+
+<!-- Example:
+This pull request allows us to warp through time and space ten times faster than before by
+double-inverting the warp drive with hyperheated jump fluid, both making the drive faster and more
+efficient. This resolves the common issue where we have to wait more than 10 milliseconds to
+engage, use, and disengage the warp drive when travelling between galaxies.
+-->
+
+<!-- Closes: #... -->
+<!-- Fixes: #...  -->
+<!-- Uncomment the above line(s) if your pull request fixes an issue or closes another pull request
+by superseding it. Replace `#...` with the issue/pr number, such as `#123`. -->
+
+**Pull request checklist:**
+
+<!-- You need to complete these before your PR can be considered.
+If you aren't sure about some, feel free to ask for clarification in #dev:continuwuity.org. -->
+- [ ] This pull request targets the `main` branch, and the branch is named something other than
+      `main`.
+- [ ] I have written an appropriate pull request title and my description is clear.
+- [ ] I understand I am responsible for the contents of this pull request.
+- I have followed the [contributing guidelines][c1]:
+  - [ ] My contribution follows the [code style][c2], if applicable.
+  - [ ] I ran [pre-commit checks][c1pc] before opening/drafting this pull request.
+  - [ ] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes)
+        myself, if applicable. This includes ensuring code compiles.
+  - [ ] My commit messages follow the [commit message format][c1cm] and are descriptive.
+
+<!--
+Notes on these requirements:
+
+- While not required, we encourage you to sign your commits with GPG or SSH to attest the
+  authenticity of your changes.
+- While we allow LLM-assisted contributions, we do not appreciate contributions that are
+  low quality, which is typical of machine-generated contributions that have not had a lot of love
+  and care from a human. Please do not open a PR if all you have done is asked ChatGPT to tidy up
+  the codebase with a +-100,000 diff.
+- In the case of code style violations, reviewers may leave review comments/change requests
+  indicating what the ideal change would look like. For example, a reviewer may suggest you lower
+  a log level, or use `match` instead of `if/else` etc.
+- In the case of code style violations, pre-commit check failures, minor things like typos/spelling
+  errors, and in some cases commit format violations, reviewers may modify your branch directly,
+  typically by making changes and adding a commit. Particularly in the latter case, a reviewer may
+  rebase your commits to squash "spammy" ones (like "fix", "fix", "actually fix"), and reword
+  commit messages that don't satisfy the format.
+- Pull requests MUST pass the `Checks` CI workflows to be capable of being merged. This can only be
+  bypassed in exceptional circumstances.
+  If your CI flakes, let us know in matrix:r/dev:continuwuity.org.
+- Pull requests have to be based on the latest `main` commit before being merged. If the main branch
+  changes while you're making your changes, you should make sure you rebase on main before
+  opening a PR. Your branch will be rebased on main before it is merged if it has fallen behind.
+- We typically only do fast-forward merges, so your entire commit log will be included. Once in
+  main, it's difficult to get out cleanly, so put on your best dress, smile for the cameras!
+-->
+
+[c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md
+[c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx
+[c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks
+[c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally
+[c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages

.forgejo/regsync/regsync.yml

@@ -0,0 +1,72 @@
+version: 1
+
+x-source: &source forgejo.ellis.link/continuwuation/continuwuity
+
+x-tags:
+  releases: &tags-releases
+    tags:
+      allow:
+      - "latest"
+      - "v[0-9]+\\.[0-9]+\\.[0-9]+(-[a-z0-9\\.]+)?"
+      - "v[0-9]+\\.[0-9]+"
+      - "v[0-9]+"
+  main: &tags-main
+    tags:
+      allow:
+      - "latest"
+      - "v[0-9]+\\.[0-9]+\\.[0-9]+(-[a-z0-9\\.]+)?"
+      - "v[0-9]+\\.[0-9]+"
+      - "v[0-9]+"
+      - "main"
+  commits: &tags-commits
+    tags:
+      allow:
+      - "latest"
+      - "v[0-9]+\\.[0-9]+\\.[0-9]+(-[a-z0-9\\.]+)?"
+      - "v[0-9]+\\.[0-9]+"
+      - "v[0-9]+"
+      - "main"
+      - "sha-[a-f0-9]+"
+  all: &tags-all
+    tags:
+      allow:
+      - ".*"
+
+# Registry credentials
+creds:
+  - registry: forgejo.ellis.link
+    user: "{{env \"BUILTIN_REGISTRY_USER\"}}"
+    pass: "{{env \"BUILTIN_REGISTRY_PASSWORD\"}}"
+  - registry: registry.gitlab.com
+    user: "{{env \"GITLAB_USERNAME\"}}"
+    pass: "{{env \"GITLAB_TOKEN\"}}"
+  - registry: git.nexy7574.co.uk
+    user: "{{env \"N7574_GIT_USERNAME\"}}"
+    pass: "{{env \"N7574_GIT_TOKEN\"}}"
+  - registry: ghcr.io
+    user: "{{env \"GH_PACKAGES_USER\"}}"
+    pass: "{{env \"GH_PACKAGES_TOKEN\"}}"
+  - registry: docker.io
+    user: "{{env \"DOCKER_MIRROR_USER\"}}"
+    pass: "{{env \"DOCKER_MIRROR_TOKEN\"}}"
+
+# Global defaults
+defaults:
+  parallel: 3
+  interval: 2h
+  digestTags: true
+
+# Sync configuration - each registry gets different image sets
+sync:
+  - source: *source
+    target: registry.gitlab.com/continuwuity/continuwuity
+    type: repository
+    <<: *tags-main
+  - source: *source
+    target: ghcr.io/continuwuity/continuwuity
+    type: repository
+    <<: *tags-main
+  - source: *source
+    target: docker.io/jadedblueeyes/continuwuity
+    type: repository
+    <<: *tags-main

.forgejo/workflows/auto-labeler.yml

@@ -0,0 +1,56 @@
+name: Auto Labeler
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  auto-label:
+    name: Apply labels based on changed files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Apply PR Labels
+        uses: https://github.com/actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const allFiles = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+            });
+
+            const fileNames = allFiles.map(f => f.filename);
+            const labelsToAdd = new Set();
+
+            for (const file of fileNames) {
+              if (file.startsWith('docs/') || file.startsWith('theme/') || (file.endsWith('.md') && !file.startsWith('changelog.d/')) || file == 'rspress.config.ts') {
+                labelsToAdd.add('Documentation');
+              }
+              if (file.startsWith('.forgejo/')) {
+                labelsToAdd.add('Meta/CI');
+              }
+              if (file.startsWith('pkg/') || file.startsWith('nix/') || file === 'flake.nix' || file === 'flake.lock' || file.startsWith('docker/')) {
+                labelsToAdd.add('Meta/Packaging');
+              }
+              if (file === 'Cargo.lock') {
+                labelsToAdd.add('Dependencies');
+              }
+            }
+
+            if (labelsToAdd.size > 0) {
+              const labelsArray = Array.from(labelsToAdd);
+              console.log('Adding labels:', labelsArray);
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                labels: labelsArray,
+              });
+            } else {
+              console.log('No files changed that require auto-labeling.');
+            }

.forgejo/workflows/build-debian.yml

@@ -0,0 +1,212 @@
+name: Build / Debian DEB
+
+concurrency:
+  group: "build-debian-${{ forge.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+  schedule:
+    - cron: '30 0 * * 1'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        container: [ "ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable" ]
+        arch: [ "amd64", "arm64" ]
+    container:
+      image: "ghcr.io/tcpipuk/act-runner:${{ matrix.container }}"
+
+    steps:
+      - name: Get Debian version
+        id: debian-version
+        run: |
+          VERSION=$(cat /etc/debian_version)
+          DISTRIBUTION=$(lsb_release -sc 2>/dev/null)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
+          echo "Debian distribution: $DISTRIBUTION ($VERSION)"
+      #- name: Work around llvm-project#153385
+      #  id: llvm-workaround
+      #  run: |
+      #    if [ -f /usr/share/apt/default-sequoia.config ]; then
+      #      echo "Applying workaround for llvm-project#153385"
+      #      mkdir -p /etc/crypto-policies/back-ends/
+      #      cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
+      #      sed -i 's/\(sha1\.second_preimage_resistance = \)2026-02-01/\12026-06-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
+      #    else
+      #      echo "No workaround needed for llvm-project#153385"
+      #    fi
+
+      - name: Checkout repository with full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+
+      - name: Cache Cargo registry
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-debian-${{ steps.debian-version.outputs.distribution }}-${{ matrix.arch }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-debian-${{ steps.debian-version.outputs.distribution }}-${{ matrix.arch }}-
+
+      - name: Setup sccache
+        uses: https://git.tomfos.tr/tom/sccache-action@v1
+
+      - name: Configure sccache environment
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
+          # Aggressive GC since cache restores don't increment counter
+          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
+
+      - name: Install cross-compilation tools for arm64
+        if: matrix.arch == 'arm64'
+        run: |
+          dpkg --add-architecture arm64
+          if ! apt-get update; then
+            # Older Ubuntu releases (e.g. noble) advertise arm64 in their
+            # Release files but only serve amd64/i386 from archive.ubuntu.com,
+            # so apt update 404s. Restrict the main sources to amd64 and
+            # fetch arm64 from ports.ubuntu.com instead.
+            CODENAME=$(lsb_release -sc)
+            # deb822 sources (noble and newer)
+            if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
+              sed -i '/^Components:/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
+            fi
+            # one-line sources (jammy and older)
+            if [ -f /etc/apt/sources.list ]; then
+              sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
+            fi
+            printf 'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports %s main restricted universe multiverse\n' \
+              "$CODENAME" "$CODENAME-updates" "$CODENAME-security" \
+              > /etc/apt/sources.list.d/arm64-ports.list
+            apt-get update
+          fi
+          apt-get install -y \
+            gcc-aarch64-linux-gnu \
+            g++-aarch64-linux-gnu \
+            libc6-dev-arm64-cross
+
+      - name: Setup Rust
+        uses: ./.forgejo/actions/setup-rust
+        with:
+          github-token: ${{ secrets.GH_PUBLIC_RO }}
+
+      - name: Add Rust target
+        run: |
+          TARGET=${{ matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu' }}
+          rustup target add $TARGET
+
+      - name: Configure cross-compilation for arm64
+        if: matrix.arch == 'arm64'
+        run: |
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
+          echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
+          echo "CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++" >> $GITHUB_ENV
+          # rust-rocksdb's build script probes liburing via pkg-config, which
+          # refuses to run when host != target unless explicitly allowed
+          echo "PKG_CONFIG_ALLOW_CROSS=1" >> $GITHUB_ENV
+          echo "PKG_CONFIG_PATH_aarch64_unknown_linux_gnu=/usr/lib/aarch64-linux-gnu/pkgconfig" >> $GITHUB_ENV
+
+      - name: Get package version and component
+        id: package-meta
+        run: |
+          BASE_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r ".packages[] | select(.name == \"conduwuit\").version" | sed 's/[^a-zA-Z0-9.+]/~/g')
+          # VERSION is the package version, COMPONENT is used in
+          # apt's repository config like a git repo branch
+          VERSION=$BASE_VERSION
+          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+$ ]]; then
+            # Use the "stable" component for tagged semver releases
+            COMPONENT="stable"
+          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+ ]]; then
+            # Use the "unstable" component for tagged semver pre-releases
+            COMPONENT="unstable"
+          else
+            # Use the "dev" component for development builds
+            SHA=$(echo "${{ forge.sha }}" | cut -c1-7)
+            DATE=$(date +%Y%m%d)
+            if [ "${{ forge.ref_name }}" = "main" ]; then
+              COMPONENT="dev"
+            else
+              # Use the sanitized ref name as the component for feature branches
+              COMPONENT="dev-$(echo '${{ forge.ref_name }}' | sed 's/[^a-zA-Z0-9.+]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)"
+            fi
+            CLEAN_COMPONENT=$(echo $COMPONENT | sed 's/[^a-zA-Z0-9.+]/~/g')
+            VERSION="$BASE_VERSION~git$DATE.$SHA-$CLEAN_COMPONENT"
+          fi
+          echo "component=$COMPONENT" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Component: $COMPONENT"
+          echo "Version: $VERSION"
+
+      - name: Install cargo-deb
+        run: |
+          if command -v cargo-deb &> /dev/null; then
+            echo "cargo-deb already available"
+          else
+            echo "Installing cargo-deb"
+            cargo-binstall -y --no-symlinks cargo-deb
+          fi
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -y
+          # Build dependencies for rocksdb
+          apt-get install -y liburing-dev clang
+          # For arm64 builds, install cross-compiled dependencies.
+          # libstdc++6:arm64 is needed by dpkg-shlibdeps to resolve the
+          # dynamically-linked libstdc++ when cargo-deb computes $auto depends.
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            apt-get install -y liburing-dev:arm64 libstdc++6:arm64
+          fi
+
+      - name: Run cargo-deb
+        id: cargo-deb
+        run: |
+          TARGET=${{ matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu' }}
+          DEB_PATH=$(cargo deb --target $TARGET --deb-version ${{ steps.package-meta.outputs.version }})
+          echo "path=$DEB_PATH" >> $GITHUB_OUTPUT
+
+      - name: Test deb installation
+        if: matrix.arch == 'amd64'
+        run: |
+          echo "Installing: ${{ steps.cargo-deb.outputs.path }}"
+          apt-get install -y ${{ steps.cargo-deb.outputs.path }}
+          dpkg -s continuwuity
+          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
+          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
+          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
+
+      - name: Upload deb artifact
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: continuwuity-${{ steps.debian-version.outputs.distribution }}-${{ matrix.arch }}
+          path: ${{ steps.cargo-deb.outputs.path }}
+
+      - name: Publish to Forgejo package registry
+        if: ${{ forge.event_name == 'push' || forge.event_name == 'workflow_dispatch' || forge.event_name == 'schedule' }}
+        run: |
+          OWNER="continuwuation"
+          DISTRIBUTION=${{ steps.debian-version.outputs.distribution }}
+          COMPONENT=${{ steps.package-meta.outputs.component }}
+          DEB=${{ steps.cargo-deb.outputs.path }}
+
+          echo "Publishing: $DEB in component $COMPONENT for distribution $DISTRIBUTION"
+
+          curl --fail-with-body \
+            -X PUT \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            --upload-file "$DEB" \
+            "${{ forge.server_url }}/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"

.forgejo/workflows/build-nix.yml

@@ -0,0 +1,71 @@
+name: Build / Static via Nix
+
+concurrency:
+  group: "build-nix-${{ forge.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+  schedule:
+    - cron: '30 0 * * 3'
+
+jobs:
+  build:
+    name: "Build ${{ matrix.filename }} Binary"
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        include:
+          - package: default-static-x86_64
+            filename: conduwuit-linux-static-amd64
+          - package: default-static-aarch64
+            filename: conduwuit-linux-static-arm64
+
+          - package: max-perf-static-aarch64
+            filename: conduwuit-linux-static-arm64-maxperf
+          - package: max-perf-haswell-static-x86_64
+            filename: conduwuit-haswell-linux-static-amd64-maxperf
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      - name: Install Lix
+        uses: https://github.com/samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d
+        with:
+          extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
+
+      - name: Build static binary
+        run: |
+          nix build .#${{ matrix.package }}
+          install -D result/bin/conduwuit /tmp/binaries/${{ matrix.filename }}
+
+      - name: Upload binary artifact
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: ${{ matrix.filename }}
+          path: /tmp/binaries/${{ matrix.filename }}
+
+  release-binaries:
+    name: "Release Binaries"
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    permissions:
+      contents: write
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Download binary artifacts
+        uses: forgejo/download-artifact@v4
+        with:
+          pattern: conduwuit*
+          path: binaries
+          merge-multiple: true
+      - name: Create Release and Upload
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        with:
+          draft: true
+          files: binaries/*

.forgejo/workflows/check-changelog.yml

@@ -0,0 +1,90 @@
+name: Checks / Changelog
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  check-changelog:
+    name: Check changelog is added
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for changelog entry
+        id: check_files
+        run: |
+          AUTH=$(echo -n "x-access-token:${{ secrets.GITHUB_TOKEN }}" | base64 -w 0)
+          git config --global http.${{ github.server_url }}/.extraheader "Authorization: basic $AUTH"
+          git clone "${{ github.event.repository.clone_url }}" repo.git --bare
+
+          git -C repo.git fetch origin pull/${{ github.event.pull_request.number }}/head
+
+          # Check for Added (A) or Modified (M) files in changelog.d
+          CHANGELOG_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- changelog.d/)
+
+          SRC_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- src/)
+
+          echo "Changes in changelog.d/:"
+          echo "$CHANGELOG_CHANGES"
+          echo "Changes in src/:"
+          echo "$SRC_CHANGES"
+
+          if echo "$CHANGELOG_CHANGES" | grep -q "^[AM]"; then
+            echo "has_changelog=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_changelog=false" >> $GITHUB_OUTPUT
+          fi
+
+          if [ -n "$SRC_CHANGES" ]; then
+            echo "src_changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "src_changed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Manage PR Labels
+        uses: https://github.com/actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          HAS_CHANGELOG: ${{ steps.check_files.outputs.has_changelog }}
+          SRC_CHANGED: ${{ steps.check_files.outputs.src_changed }}
+        with:
+          script: |
+            const hasChangelog = process.env.HAS_CHANGELOG === 'true';
+            const srcChanged = process.env.SRC_CHANGED === 'true';
+
+            const { data: pullRequest } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+            });
+
+            const currentLabels = pullRequest.labels.map(l => l.name);
+
+            if (hasChangelog) {
+              console.log('PR has changelog');
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                labels: ['Changelog/Added'],
+              });
+            } else if (currentLabels.includes('Changelog/None')) {
+              console.log('PR has Changelog/None label, skipping.');
+            } else if (srcChanged) {
+              console.log('PR is missing changelog');
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                labels: ['Changelog/Missing'],
+              });
+              core.setFailed("Missing changelog entry (detected)");
+            } else if (currentLabels.includes('Changelog/Missing')) {
+              core.setFailed("Missing changelog entry (label)");
+            } else {
+              console.log('Changelog not needed');
+              // Changelog is probably not needed
+            }

.forgejo/workflows/documentation.yml

@@ -0,0 +1,71 @@
+name: Documentation
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: "pages-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  docs:
+    name: Build and Deploy Documentation
+    runs-on: ubuntu-latest
+    if: secrets.CLOUDFLARE_API_TOKEN != ''
+
+    steps:
+      - name: Sync repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Detect runner environment
+        id: runner-env
+        uses: https://git.tomfos.tr/actions/detect-versions@v1
+
+      - name: Setup Node.js
+        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
+        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 22
+
+      - name: Cache npm dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ~/.npm
+          key: continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-${{ steps.runner-env.outputs.node_version }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-${{ steps.runner-env.outputs.node_version }}-
+            continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build Rspress documentation
+        run: npm run docs:build
+
+      - name: Install Wrangler
+        run: npm install --save-dev wrangler@latest
+
+      - name: Deploy to Cloudflare Pages (Production)
+        if: github.ref == 'refs/heads/main' && vars.CLOUDFLARE_PROJECT_NAME != ''
+        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
+        with:
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          command: pages deploy ./doc_build --branch="main" --commit-dirty=true --project-name="${{ vars.CLOUDFLARE_PROJECT_NAME }}"
+
+      - name: Deploy to Cloudflare Pages (Preview)
+        if: github.ref != 'refs/heads/main' && vars.CLOUDFLARE_PROJECT_NAME != ''
+        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
+        with:
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          command: pages deploy ./doc_build --branch="${{ github.head_ref || github.ref_name }}" --commit-dirty=true --project-name="${{ vars.CLOUDFLARE_PROJECT_NAME }}"

.forgejo/workflows/element.yml

@@ -0,0 +1,132 @@
+name: Deploy Element Web
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".forgejo/workflows/element.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - ".forgejo/workflows/element.yml"
+
+concurrency:
+  group: "element-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  build-and-deploy:
+    name: 🏗️ Build and Deploy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: 📦 Setup Node.js
+        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "22"
+
+      - name: 🔨 Clone, setup, and build Element Web
+        run: |
+          echo "Cloning Element Web..."
+          git clone https://github.com/maunium/element-web
+          cd element-web
+          git checkout develop
+          git pull
+
+          echo "Cloning matrix-js-sdk..."
+          git clone https://github.com/matrix-org/matrix-js-sdk.git
+
+          echo "Installing Yarn..."
+          npm install -g yarn
+
+          echo "Installing dependencies..."
+          yarn install
+
+          echo "Preparing build environment..."
+          mkdir -p .home
+
+          echo "Cleaning up specific node_modules paths..."
+          rm -rf node_modules/@types/eslint-scope/ matrix-*-sdk/node_modules/@types/eslint-scope || echo "Cleanup paths not found, continuing."
+
+          echo "Getting matrix-js-sdk commit hash..."
+          cd matrix-js-sdk
+          jsver=$(git rev-parse HEAD)
+          jsver=${jsver:0:12}
+          cd ..
+          echo "matrix-js-sdk version hash: $jsver"
+
+          echo "Getting element-web commit hash..."
+          ver=$(git rev-parse HEAD)
+          ver=${ver:0:12}
+          echo "element-web version hash: $ver"
+
+          chmod +x ./build-sh
+
+          export VERSION="$ver-js-$jsver"
+          echo "Building Element Web version: $VERSION"
+          ./build-sh
+
+          echo "Checking for build output..."
+          ls -la webapp/
+
+      - name: ⚙️ Create config.json
+        run: |
+          cat <<EOF > ./element-web/webapp/config.json
+          {
+            "default_server_name": "continuwuity.org",
+            "default_server_config": {
+              "m.homeserver": {
+                "base_url": "https://matrix.continuwuity.org"
+              }
+            },
+            "default_country_code": "GB",
+            "default_theme": "dark",
+            "mobile_guide_toast": false,
+            "show_labs_settings": true,
+            "room_directory": [
+              "continuwuity.org",
+              "matrixrooms.info"
+            ],
+            "settings_defaults": {
+              "UIFeature.urlPreviews": true,
+              "UIFeature.feedback": false,
+              "UIFeature.voip": false,
+              "UIFeature.shareQrCode": false,
+              "UIFeature.shareSocial": false,
+              "UIFeature.locationSharing": false,
+              "enableSyntaxHighlightLanguageDetection": true
+            },
+            "features": {
+              "feature_pinning": true,
+              "feature_custom_themes": true
+            }
+          }
+          EOF
+          echo "Created ./element-web/webapp/config.json"
+          cat ./element-web/webapp/config.json
+
+      - name: 📤 Upload Artifact
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: element-web
+          path: ./element-web/webapp/
+          retention-days: 14
+
+      - name: 🛠️ Install Wrangler
+        run: npm install --save-dev wrangler@latest
+
+      - name: 🚀 Deploy to Cloudflare Pages
+        if: vars.CLOUDFLARE_PROJECT_NAME != ''
+        id: deploy
+        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
+        with:
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          command: >-
+            pages deploy ./element-web/webapp
+            --branch="${{ github.ref == 'refs/heads/main' && 'main' || github.head_ref || github.ref_name }}"
+            --commit-dirty=true
+            --project-name="${{ vars.CLOUDFLARE_PROJECT_NAME }}-element"

.forgejo/workflows/mirror-images.yml

@@ -0,0 +1,69 @@
+name: Mirror Container Images
+
+on:
+  schedule:
+    # Run nightly
+    - cron: "25 2 * * *"
+
+  workflow_call:
+
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry run (check only, no actual mirroring)'
+        required: false
+        default: false
+        type: boolean
+  push:
+    branches:
+      - main
+    paths:
+      # Re-run when config changes
+      - '.forgejo/regsync/regsync.yml'
+      - '.forgejo/workflows/mirror-images.yml'
+concurrency:
+  group: "mirror-images"
+  cancel-in-progress: true
+
+jobs:
+  mirror-images:
+    runs-on: ubuntu-latest
+    env:
+      BUILTIN_REGISTRY_USER: ${{ vars.BUILTIN_REGISTRY_USER }}
+      BUILTIN_REGISTRY_PASSWORD: ${{ secrets.BUILTIN_REGISTRY_PASSWORD }}
+      GITLAB_USERNAME: ${{ vars.GITLAB_USERNAME }}
+      GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+      N7574_GIT_USERNAME: ${{ vars.N7574_GIT_USERNAME }}
+      N7574_GIT_TOKEN: ${{ secrets.N7574_GIT_TOKEN }}
+      GH_PACKAGES_USER: ${{ vars.GH_PACKAGES_USER }}
+      GH_PACKAGES_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+      DOCKER_MIRROR_USER: ${{ vars.DOCKER_MIRROR_USER }}
+      DOCKER_MIRROR_TOKEN: ${{ secrets.DOCKER_MIRROR_TOKEN }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      # - uses: https://github.com/actions/create-github-app-token@v2
+      #   id: app-token
+      #   with:
+      #     app-id: ${{ vars.GH_APP_ID }}
+      #     private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+      #     github-api-url: https://api.github.com
+      #     owner: continuwuity
+      #     repositories: continuwuity
+
+      - name: Install regsync
+        uses: https://github.com/regclient/actions/regsync-installer@5c882eb04fcca27ebb4f5904e0da01f0780063ea # main
+
+      - name: Check what images need mirroring
+        run: |
+          echo "Checking images that need mirroring..."
+          regsync check -c .forgejo/regsync/regsync.yml -v info
+
+      - name: Mirror images
+        if: ${{ !inputs.dry_run }}
+        run: |
+          echo "Starting image mirroring..."
+          regsync once -c .forgejo/regsync/regsync.yml -v info

.forgejo/workflows/prek-checks.yml

@@ -0,0 +1,106 @@
+name: Checks / Prek
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  fast-checks:
+    name: Pre-commit & Formatting
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Rust nightly
+        uses: ./.forgejo/actions/setup-rust
+        with:
+          rust-version: nightly
+          github-token: ${{ secrets.GH_PUBLIC_RO }}
+
+      - name: Run prek
+        run: |
+          prek run \
+            --all-files \
+            --hook-stage manual \
+            --show-diff-on-failure \
+            --color=always \
+            -v
+
+      - name: Check Rust formatting
+        run: |
+          cargo +nightly fmt --all -- --check && \
+            echo "✅ Formatting check passed" || \
+            exit 1
+  check-changes:
+    name: Check changed files
+    runs-on: ubuntu-latest
+    outputs:
+      rust: ${{ steps.filter.outputs.rust }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Check for file changes
+        uses: https://github.com/dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
+        id: filter
+        with:
+          filters: |
+            rust:
+              - '**/*.rs'
+              - '**/Cargo.toml'
+              - '**/Cargo.lock'
+
+  clippy-and-tests:
+    name: Clippy and Cargo Tests
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: needs.check-changes.outputs.rust == 'true'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup LLVM
+        uses: ./.forgejo/actions/setup-llvm-with-apt
+        with:
+          extra-packages: liburing-dev liburing2
+
+      - name: Setup Rust with caching
+        uses: ./.forgejo/actions/setup-rust
+        with:
+          github-token: ${{ secrets.GH_PUBLIC_RO }}
+
+      - name: Run Clippy lints
+        run: |
+          cargo clippy \
+            --workspace \
+            --features full \
+            --locked \
+            --no-deps \
+            --profile test \
+            -- \
+            -D warnings
+
+      - name: Run Cargo tests
+        run: |
+          cargo test \
+            --workspace \
+            --features full \
+            --locked \
+            --profile test \
+            --all-targets \
+            --no-fail-fast

.forgejo/workflows/release-image.yml

@@ -0,0 +1,233 @@
+name: Release Docker Image
+concurrency:
+  group: "release-image-${{ github.ref }}"
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "*.md"
+      - "**/*.md"
+      - "*.mdx"
+      - "**/*.mdx"
+      - "changelog.d/**"
+      - ".gitlab-ci.yml"
+      - ".gitignore"
+      - "renovate.json"
+      - "pkg/**"
+      - "docs/**"
+    tags:
+      - "v*.*.*"
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+env:
+  BUILTIN_REGISTRY: forgejo.ellis.link
+  BUILTIN_REGISTRY_ENABLED: "${{ ((vars.BUILTIN_REGISTRY_USER && secrets.BUILTIN_REGISTRY_PASSWORD) || (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)) && 'true' || 'false' }}"
+  IMAGE_PATH: forgejo.ellis.link/continuwuation/continuwuity
+
+jobs:
+  build-release:
+    name: "Build ${{ matrix.slug }} (release)"
+    runs-on: dind
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    strategy:
+      matrix:
+        include:
+          - platform: "linux/amd64"
+            slug: "linux-amd64"
+          - platform: "linux/arm64"
+            slug: "linux-arm64"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Prepare Docker build environment
+        id: prepare
+        uses: ./.forgejo/actions/prepare-docker-build
+        with:
+          platform: ${{ matrix.platform }}
+          slug: ${{ matrix.slug }}
+          target_cpu: ""
+          profile: "release"
+          images: ${{ env.IMAGE_PATH }}
+          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
+          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+      - name: Build and push Docker image by digest
+        id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          file: "docker/Dockerfile"
+          build-args: |
+            GIT_COMMIT_HASH=${{ github.sha }}
+            GIT_COMMIT_HASH_SHORT=${{ env.COMMIT_SHORT_SHA }}
+            GIT_REMOTE_URL=${{github.event.repository.html_url }}
+            GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
+            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
+            TARGET_CPU=
+            RUST_PROFILE=release
+            CARGO_FEATURES=default
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.prepare.outputs.metadata_labels }}
+          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
+          cache-from: type=gha
+          # cache-to: type=gha,mode=max
+          sbom: true
+          outputs: |
+            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', env.IMAGE_PATH) || format('type=image,"name={0}",push=false', env.IMAGE_PATH) }}
+            type=local,dest=/tmp/binaries
+        env:
+          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
+      - name: Upload Docker artifacts
+        uses: ./.forgejo/actions/upload-docker-artifacts
+        with:
+          slug: ${{ matrix.slug }}
+          cpu_suffix: ${{ steps.prepare.outputs.cpu_suffix }}
+          artifact_suffix: ""
+          digest_suffix: ""
+          digest: ${{ steps.build.outputs.digest }}
+
+  merge-release:
+    name: "Create Multi-arch Release Manifest"
+    runs-on: dind
+    needs: build-release
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Create multi-platform manifest
+        uses: ./.forgejo/actions/create-docker-manifest
+        with:
+          digest_pattern: "digests-linux-{amd64,arm64}"
+          tag_suffix: ""
+          images: ${{ env.IMAGE_PATH }}
+          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
+          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+
+  build-maxperf:
+    name: "Build ${{ matrix.slug }} (max-perf)"
+    runs-on: dind
+    needs: build-release
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    strategy:
+      matrix:
+        include:
+          - platform: "linux/amd64"
+            slug: "linux-amd64"
+            target_cpu: "haswell"
+          - platform: "linux/arm64"
+            slug: "linux-arm64"
+            target_cpu: ""
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Prepare max-perf Docker build environment
+        id: prepare
+        uses: ./.forgejo/actions/prepare-docker-build
+        with:
+          platform: ${{ matrix.platform }}
+          slug: ${{ matrix.slug }}
+          target_cpu: ${{ matrix.target_cpu }}
+          profile: "release-max-perf"
+          images: ${{ env.IMAGE_PATH }}
+          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
+          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+      - name: Build and push max-perf Docker image by digest
+        id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          file: "docker/Dockerfile"
+          build-args: |
+            GIT_COMMIT_HASH=${{ github.sha }}
+            GIT_COMMIT_HASH_SHORT=${{ env.COMMIT_SHORT_SHA }}
+            GIT_REMOTE_URL=${{github.event.repository.html_url }}
+            GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
+            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
+            TARGET_CPU=${{ matrix.target_cpu }}
+            RUST_PROFILE=release-max-perf
+            CARGO_FEATURES=default,release_max_log_level
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.prepare.outputs.metadata_labels }}
+          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
+          cache-from: type=gha
+          # cache-to: type=gha,mode=max
+          sbom: true
+          outputs: |
+            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', env.IMAGE_PATH) || format('type=image,"name={0}",push=false', env.IMAGE_PATH) }}
+            type=local,dest=/tmp/binaries
+        env:
+          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
+      - name: Upload max-perf Docker artifacts
+        uses: ./.forgejo/actions/upload-docker-artifacts
+        with:
+          slug: ${{ matrix.slug }}
+          cpu_suffix: ${{ steps.prepare.outputs.cpu_suffix }}
+          artifact_suffix: "-maxperf"
+          digest_suffix: "-maxperf"
+          digest: ${{ steps.build.outputs.digest }}
+
+  merge-maxperf:
+    name: "Create Max-Perf Manifest"
+    runs-on: dind
+    needs: build-maxperf
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Create max-perf manifest
+        uses: ./.forgejo/actions/create-docker-manifest
+        with:
+          digest_pattern: "digests-maxperf-linux-{amd64-haswell,arm64}"
+          tag_suffix: "-maxperf"
+          images: ${{ env.IMAGE_PATH }}
+          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
+          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+
+  release-binaries:
+    name: "Release Binaries"
+    runs-on: ubuntu-latest
+    needs:
+      - build-release
+      - build-maxperf
+    permissions:
+      contents: write
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Download binary artifacts
+        uses: forgejo/download-artifact@v4
+        with:
+          pattern: conduwuit*
+          path: binaries
+          merge-multiple: true
+      - name: Create Release and Upload
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        with:
+          draft: true
+          files: binaries/*
+
+  mirror_images:
+    name: "Mirror Images"
+    runs-on: ubuntu-latest
+    needs:
+      - merge-maxperf
+      - merge-release
+    secrets: inherit
+    uses: ./.forgejo/workflows/mirror-images.yml

.forgejo/workflows/renovate.yml

@@ -0,0 +1,132 @@
+name: Maintenance / Renovate
+
+enable-email-notifications: true
+
+on:
+  schedule:
+    # Run at 5am UTC daily to avoid late-night dev
+    - cron: '0 5 * * *'
+
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: 'Dry run mode'
+        required: false
+        default: ''
+        type: choice
+        options:
+          - ''
+          - 'extract'
+          - 'lookup'
+          - 'full'
+      logLevel:
+        description: 'Log level'
+        required: false
+        default: 'info'
+        type: choice
+        options:
+          - 'debug'
+          - 'info'
+          - 'warning'
+          - 'critical'
+
+  push:
+    branches:
+      - main
+    paths:
+      # Re-run when config changes
+      - '.forgejo/workflows/renovate.yml'
+      - 'renovate.json'
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:43.288.0@sha256:bcde7a061ab42d1ae6d4500769d80727e5694bb889dbcbf1005e9f4e741ab76d
+      options: --tmpfs /tmp:exec
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          show-progress: false
+
+      - name: print node heap
+        run: /usr/local/renovate/node -e 'console.log(`node heap limit = ${require("v8").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'
+
+      - name: Restore renovate repo cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/repository
+          key: renovate-repo-cache-${{ github.run_id }}
+          restore-keys: |
+            renovate-repo-cache-
+
+      - name: Restore renovate package cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/renovate-cache-sqlite
+          key: renovate-package-cache-${{ github.run_id }}
+          restore-keys: |
+            renovate-package-cache-
+
+      - name: Restore renovate OSV cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            /tmp/osv
+          key: renovate-osv-cache-${{ github.run_id }}
+          restore-keys: |
+            renovate-osv-cache-
+
+      - name: Self-hosted Renovate
+        run: renovate
+        env:
+          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
+          RENOVATE_DRY_RUN: ${{ inputs.dryRun || 'false' }}
+
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: ${{ github.server_url }}
+          RENOVATE_AUTODISCOVER: 'false'
+          RENOVATE_REPOSITORIES: '["${{ github.repository }}", "continuwuation/resolvematrix"]'
+
+          RENOVATE_GIT_TIMEOUT: 60000
+
+          RENOVATE_REQUIRE_CONFIG: 'required'
+          # RENOVATE_ONBOARDING: 'false'
+          RENOVATE_INHERIT_CONFIG: 'true'
+
+          RENOVATE_GITHUB_TOKEN_WARN: 'false'
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          GITHUB_COM_TOKEN: ${{ secrets.GH_PUBLIC_RO || secrets.GH_TOKEN }}
+
+          RENOVATE_REPOSITORY_CACHE: 'enabled'
+          RENOVATE_X_SQLITE_PACKAGE_CACHE: 'true'
+          OSV_OFFLINE_ROOT_DIR: /tmp/osv
+
+      - name: Save renovate repo cache
+        if: always()
+        uses:
+          actions/cache/save@v5
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/repository
+          key: renovate-repo-cache-${{ github.run_id }}
+
+      - name: Save renovate package cache
+        if: always()
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            /tmp/renovate/cache/renovate/renovate-cache-sqlite
+          key: renovate-package-cache-${{ github.run_id }}
+
+      - name: Save renovate OSV cache
+        if: always()
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            /tmp/osv
+          key: renovate-osv-cache-${{ github.run_id }}

.forgejo/workflows/update-flake-hashes.yml

@@ -0,0 +1,73 @@
+name: Update flake hashes
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "rust-toolchain.toml"
+      - "nix/**/*"
+      - ".forgejo/workflows/update-flake-hashes.yml"
+
+jobs:
+  update-flake-hashes:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: true
+          token: ${{ secrets.FORGEJO_TOKEN }}
+
+      - name: Install Lix
+        uses: https://github.com/samueldr/lix-gha-installer-action@f5e94192f565f53d84f41a056956dc0d3183b343
+        with:
+          extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
+
+      - name: Get new toolchain hash
+        run: |
+          # Set the current sha256 to an empty hash to make `nix build` calculate a new one
+          awk '/fromToolchainName *\{/{found=1; print; next} found && /sha256 =/{sub(/sha256 = .*/, "sha256 = lib.fakeSha256;"); found=0} 1' nix/rust.nix > temp.nix
+          mv temp.nix nix/rust.nix
+
+          # Build continuwuity and filter for the new hash
+          # We do `|| true` because we want this to fail without stopping the workflow
+          nix build .#default 2>&1 | tee >(grep 'got:' | awk '{print $2}' > new_toolchain_hash.txt) || true
+
+          # Place the new hash in place of the empty hash
+          new_hash=$(cat new_toolchain_hash.txt)
+          sed -i "s|lib.fakeSha256|\"$new_hash\"|" nix/rust.nix
+
+          echo "New hash:"
+          awk -F'"' '/fromToolchainName/{found=1; next} found && /sha256 =/{print $2; found=0}' nix/rust.nix
+          echo "Expected new hash:"
+          cat new_toolchain_hash.txt
+
+          rm new_toolchain_hash.txt
+
+      - name: Update rocksdb
+        run: nix run .#update-rocksdb
+
+      - name: Show diff
+        run: git diff flake.nix nix
+
+      - name: Push changes
+        run: |
+          set -euo pipefail
+
+          if git diff --quiet --exit-code; then
+            echo "No changes to commit."
+            exit 0
+          fi
+
+          git config user.email "renovate@mail.ellis.link"
+          git config user.name "renovate"
+
+          REF="${{ github.head_ref }}"
+
+          git fetch origin "$REF"
+          git checkout "$REF"
+
+          git commit -a -m "chore(Nix): Updated flake hashes"
+
+          git push origin HEAD:refs/heads/"$REF"

.git-blame-ignore-revs

@@ -5,3 +5,5 @@ f419c64aca300a338096b4e0db4c73ace54f23d0
 # use chain_width 60
 162948313c212193965dece50b816ef0903172ba
 5998a0d883d31b866f7c8c46433a8857eae51a89
+# trailing whitespace and newlines
+46c193e74b2ce86c48ce802333a0aabce37fd6e9

.gitattributes

@@ -84,4 +84,4 @@ Cargo.lock text
 *.zst      binary
 
 # Text files where line endings should be preserved
-*.patch    -text
+*.patch    -text

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+github: [JadedBlueEyes, timedoutuk, gingershaped]
+custom:
+  - https://timedout.uk/donate.html
+  - https://jade.ellis.link/sponsors

.github/workflows/README.md

@@ -1,13 +0,0 @@
-## Overview
-
-The release pipeline `Main` (main.yml) and its subroutines defined in the other yamls form a high-level
-description for the underlying self-hosted build system in  `/docker`. In other words, this is a sort of
-terminal, a "thin-client" with a display and a keyboard for our docker mainframe. We minimize
-vendor-lockin and duplication with other services by limiting everything here to only what is
-essential for driving the docker builder.
-
-Though we slightly relax the above by specifying details of the actual CI pipeline, the 
-control-flow logic to go from some input event to some output or release here. This gives us
-better integration  with github, like granular progress indications by breaking up operations
-as individual jobs and workflows within the pipeline. This means we'll have duplicate logic
-with other services, but only as it relates to high-level control flow.

.github/workflows/bake.yml

@@ -1,252 +0,0 @@
-name: Bakery
-
-on:
-  workflow_call:
-    inputs:
-      bake_targets:
-        type: string
-        description: Bake Matrix
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_targets:
-        type: string
-        description: Rust targets
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_targets:
-        type: string
-        description: System targets
-      sys_versions:
-        type: string
-        description: System versions
-      machines:
-        type: string
-        description: Hardware platforms
-      runner:
-        type: string
-        description: Runner mask
-        default: 'self-hosted'
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      max-parallel:
-        type: number
-        default: 128
-        description: Limit number of concurrent jobs.
-      verbose_env:
-        type: string
-        default: ${{vars.CI_VERBOSE_ENV || false}}
-        description: Print the bake environment.
-      silent_bake:
-        type: string
-        default: ${{vars.CI_SILENT_BAKE || false}}
-        description: Print as little as possible.
-      print_bake:
-        type: string
-        default: ${{vars.CI_PRINT_BAKE || false}}
-        description: Print the computed receipe.
-      fail_fast:
-        type: boolean
-        default: false
-        description: Fail-fast for the underlying matrix.
-      release_url:
-        type: string
-        description: Upload url for created release.
-      artifact:
-        type: string
-        default: '{}'
-        description: >
-          Map of targets to artifact files to upload. Key is bake target (image prefix),
-          value is a JSON object containing keys 'src' and 'dst'. dst is the artifact name,
-          src is optional path inside image, defaulting to dst.
-
-jobs:
-  bake:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && fromJSON(inputs.machines)[0] != null
-      && fromJSON(inputs.bake_targets)[0] != null
-
-    name: >
-      ${{matrix.bake_target}}
-      ${{matrix.cargo_profile}}
-      ${{matrix.rust_toolchain}}
-      ${{matrix.feat_set}}
-      ${{matrix.sys_name}}
-      ${{matrix.sys_version}}
-      ${{matrix.sys_target}}
-
-    runs-on: ["${{matrix.machine}}", "${{inputs.runner}}"]
-    strategy:
-      fail-fast: ${{inputs.fail_fast}}
-      max-parallel: ${{inputs.max-parallel}}
-      matrix:
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-        bake_target: ${{fromJSON(inputs.bake_targets)}}
-        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
-        feat_set: ${{fromJSON(inputs.feat_sets)}}
-        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        persist-credentials: false
-
-    # Call docker
-    - name: Bake ${{matrix.bake_target}}
-      env:
-        bake_target: ${{matrix.bake_target}}
-        cargo_profile: ${{matrix.cargo_profile}}
-        rust_toolchain: ${{matrix.rust_toolchain}}
-        rust_target: ${{matrix.rust_target}}
-        feat_set: ${{matrix.feat_set}}
-        sys_name: ${{matrix.sys_name}}
-        sys_version: ${{matrix.sys_version}}
-        sys_target: ${{matrix.sys_target}}
-        machine: ${{matrix.machine}}
-        acct: ${{github.actor}}
-        repo: ${{github.repository}}
-        CI_VERBOSE_ENV: ${{inputs.verbose_env}}
-        CI_SILENT_BAKE: ${{inputs.silent_bake}}
-        CI_PRINT_BAKE: ${{inputs.print_bake}}
-
-      run: |
-        docker/bake.sh "${{matrix.bake_target}}"
-
-    # Optionally extract an inner artifact
-    - name: Extract Inner Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].img == null
-        && fromJSON(inputs.artifact)[matrix.bake_target].runner != true
-
-      env:
-        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
-
-      run: |
-        cid=$(docker create "$iid" /)
-        rm -rf _artifact
-        mkdir -p "_artifact"
-        docker cp "$cid:$src" "_artifact/$dst"
-        chmod "$mod" "_artifact/$dst"
-
-    # Optionally extract the image itself as an artifact.
-    - name: Extract Image Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].img != null
-
-      env:
-        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-
-      run: |
-        rm -rf _artifact
-        mkdir -p "_artifact"
-        docker save -o "_artifact/$dst" "$iid"
-
-    # Optionally extract a runner artifact
-    - name: Extract Outer Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].runner == true
-
-      env:
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
-
-      run: |
-        rm -rf _artifact
-        mkdir -p "_artifact"
-        mv "$src" "_artifact/$dst"
-        chmod "$mod" "_artifact/$dst"
-
-    # Optionally compress extracted artifact
-    - name: Compress Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && (fromJSON(inputs.artifact)[matrix.bake_target].gzip || fromJSON(inputs.artifact)[matrix.bake_target].zstd)
-
-      env:
-        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
-        gzlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].gzip }}
-        zstlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].zstd }}
-
-      run: |
-        if test -n "$gzlev"; then
-          mv "_artifact/$dst" "_artifact/$dst.artifact"
-          gzip "-$gzlev" "_artifact/$dst.artifact"
-          mv "_artifact/$dst.artifact.gz" "_artifact/$dst"
-        elif test -n "$zstlev"; then
-          zstd "-$zstlev" "_artifact/$dst"
-          mv "_artifact/$dst.zst" "_artifact/$dst"
-        fi
-
-    # Upload either artifact
-    - name: Upload Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-
-      uses: actions/upload-artifact@v4
-      with:
-        path: _artifact/*
-        name: ${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-
-    # Optionally upload artifact as pages-artifact
-    - name: Upload Pages Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].pages == true
-
-      uses: actions/upload-pages-artifact@v3
-      with:
-        path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-        name: github-pages
-
-    # Optionally upload artifact as release-artifact
-    - name: Upload Release Artifact
-      if: >
-        !failure() && !cancelled()
-        && fromJSON(inputs.artifact)[matrix.bake_target].dst
-        && fromJSON(inputs.artifact)[matrix.bake_target].mime
-        && contains(github.ref, 'refs/tags/v')
-        && inputs.release_url
-
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-      with:
-        upload_url: ${{inputs.release_url}}
-        asset_path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-        asset_name: ${{github.ref_name}}-${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
-        asset_content_type: ${{fromJSON(inputs.artifact)[matrix.bake_target].mime || 'application/octet-stream'}}

.github/workflows/lint.yml

@@ -1,175 +0,0 @@
-name: Linting
-
-on:
-  workflow_call:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-
-jobs:
-  fmt:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Format
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["fmt"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      rust_targets: ${{inputs.rust_targets}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  typos:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Typos
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["typos"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  audit:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Audit
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["audit"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  # disabled due to excessive build time issue installing cargo lychee
-  lychee:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-      && false
-
-    name: Lychee
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["lychee"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  check:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Check
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["check"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  clippy:
-    if: >
-      !failure() && !cancelled()
-      && inputs.cargo_profiles
-
-    name: Clippy
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["clippy"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}

.github/workflows/main.yml

@@ -1,337 +0,0 @@
-name: Main
-
-on:
-  push:
-    branches:
-      - "**"
-    tags:
-      - "v*"
-  pull_request:
-    branches:
-      - "**"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{github.workflow}}-${{github.ref}}
-  cancel-in-progress: false
-
-jobs:
-  init:
-    name: Init
-    runs-on: ${{matrix.runner}}
-    env:
-      default_cargo_profiles: '["test", "bench", "release"]'
-      default_feat_sets: '["none", "default", "all"]'
-      default_rust_toolchains: '["nightly", "stable"]'
-      default_sys_names: '["debian"]'
-      default_sys_versions: '["testing-slim"]'
-      default_rust_targets: '["x86_64-unknown-linux-gnu"]'
-      default_sys_targets: '["x86_64-v1-linux-gnu", "x86_64-v3-linux-gnu"]'
-      default_machines: '["X64"]'
-
-    outputs:
-      cargo_profiles: ${{vars.CARGO_PROFILES || env.default_cargo_profiles}}
-      feat_sets: ${{vars.FEAT_SETS || env.default_feat_sets}}
-      rust_toolchains: ${{vars.RUST_TOOLCHAINS || env.default_rust_toolchains}}
-      rust_targets: ${{vars.RUST_TARGETS || env.default_rust_targets}}
-      sys_names: ${{vars.SYS_NAMES || env.default_sys_names}}
-      sys_targets: ${{vars.SYS_TARGETS || env.default_sys_targets}}
-      sys_versions: ${{vars.SYS_VERSIONS || env.default_sys_versions}}
-      machines: ${{vars.MACHINES || env.default_machines}}
-      package: ${{vars.PACKAGE != 'false'}}
-      publish: ${{vars.PUBLISH != 'false'}}
-      build_nix: ${{vars.BUILD_NIX != 'false'}}
-      build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/test' || contains(github.ref, 'tags/v')}}
-      check_pkgs: ${{vars.CHECK_PKGS || 'false'}}
-      complement: ${{vars.COMPLEMENT != 'false'}}
-      complement_runner: 'het'
-      docker_repo: ${{vars.DOCKER_REPO}}
-      release_url: ${{steps.release.outputs.upload_url}}
-      pages_url: 'https://matrix-construct.github.io/tuwunel/'
-      rust_sdk_integ: ${{vars.RUST_SDK_INTEGRATION != 'false'}}
-      head_msg: ${{github.event.head_commit.message || github.event.workflow_run.head_commit.message}}
-
-    strategy:
-      fail-fast: true
-      matrix:
-        runner: ${{fromJSON(vars.RUNNERS || '["het"]')}}
-        machine: ${{fromJSON(vars.MACHINES || '["X64"]')}}
-        exclude: ${{fromJSON(vars.RUNNERS_EXCLUDES || '[]')}}
-
-    steps:
-    - name: Initialize Builder
-      env:
-        runner: ${{matrix.runner}}
-        reserved_space: '{"het": "192GB", "aws": "48GB", "gcp": "160GB"}'
-        max_used_space: '{"het": "384GB", "aws": "64GB", "gcp": "192GB"}'
-      run: |
-        set +e
-        docker buildx inspect "${GITHUB_ACTOR}"
-        if test x"$?" = x"0"; then
-          exit 0
-        fi
-
-        set -eux
-        reserved_space=$(echo -n "$reserved_space" | jq -r ".$runner")
-        max_used_space=$(echo -n "$max_used_space" | jq -r ".$runner")
-        cat <<EOF > ./buildkitd.toml
-        [system]
-          platformsCacheMaxAge = "504h"
-        [worker.oci]
-          enabled = true
-          rootless = false
-          gc = true
-          reservedSpace = "${reserved_space}"
-          maxUsedSpace = "${max_used_space}"
-        [[worker.oci.gcpolicy]]
-          reservedSpace = "${reserved_space}"
-          maxUsedSpace = "${max_used_space}"
-          filters = ["label!=cache==pin"]
-          all = true
-        EOF
-
-        docker buildx create \
-          --bootstrap \
-          --driver docker-container \
-          --buildkitd-config ./buildkitd.toml \
-          --name "${GITHUB_ACTOR}" \
-          --buildkitd-flags "--allow-insecure-entitlement network.host"
-
-    - if: >
-        !failure() && !cancelled()
-        && contains(github.ref, 'refs/tags/v')
-        && matrix.runner == 'het'
-
-      id: release
-      name: Create Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-      with:
-        release_name: Release ${{github.ref_name}}
-        tag_name: ${{github.ref}}
-        body_path: RELEASE.md
-        draft: ${{ contains(github.ref, '-draft') }}
-        prerelease: ${{ contains(github.ref, '-rc') }}
-
-  lint:
-    if: >
-      !failure() && !cancelled()
-      && !contains(github.ref, 'refs/tags/v')
-      && !contains(needs.init.outputs.head_msg, '[ci no lint]')
-      && !contains(needs.init.outputs.head_msg, '[ci only it]')
-
-    name: Lint
-    needs: [init] #needs: [init, deps]
-    uses: ./.github/workflows/lint.yml
-    with:
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"cargo_profile": "test", "feat_set": "logging"},
-          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "none"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "default"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "logging"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native", "feat_set": "none"},
-          {"cargo_profile": "release-native", "feat_set": "default"},
-          {"cargo_profile": "release-native", "feat_set": "logging"},
-          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
-          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu"},
-          {"sys_target": "x86_64-v3-linux-gnu"},
-          {"sys_target": "x86_64-v4-linux-gnu"},
-        ]
-
-  test:
-    if: >
-      !failure() && !cancelled()
-      && !contains(github.ref, 'refs/tags/v')
-      && !contains(needs.init.outputs.head_msg, '[ci no test]')
-
-    name: Test
-    needs: [init, lint]
-    uses: ./.github/workflows/test.yml
-    with:
-      head_msg: ${{needs.init.outputs.head_msg}}
-      build_nix: ${{fromJSON(needs.init.outputs.build_nix)}}
-      rust_sdk_integ: ${{fromJSON(needs.init.outputs.rust_sdk_integ)}}
-      complement: ${{fromJSON(needs.init.outputs.complement)}}
-      complement_runner: ${{needs.init.outputs.complement_runner}}
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native", "feat_set": "none"},
-          {"cargo_profile": "release-native", "feat_set": "default"},
-          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
-          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
-        ]
-
-  package:
-    if: >
-      !failure() && !cancelled()
-      && needs.init.outputs.package
-      && !contains(github.ref, 'refs/pull')
-      && !contains(needs.init.outputs.head_msg, '[ci only it]')
-      && !contains(needs.init.outputs.head_msg, '[ci no build]')
-      && !contains(needs.init.outputs.head_msg, '[ci no package]')
-
-    name: Package
-    needs: [init, test]
-    uses: ./.github/workflows/package.yml
-    with:
-      release_url: ${{needs.init.outputs.release_url}}
-      check_pkgs: ${{needs.init.outputs.check_pkgs}}
-      build_pkgs: ${{needs.init.outputs.build_pkgs}}
-      build_nix: ${{fromJSON(needs.init.outputs.build_nix)}}
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"feat_set": "none"},
-          {"cargo_profile": "test"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release-native"},
-          {"cargo_profile": "release-debuginfo", "feat_set": "default"},
-          {"cargo_profile": "release-debuginfo", "feat_set": "logging"},
-          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
-          {"cargo_profile": "release-debuginfo", "bake_target": "oci"},
-          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v4-linux-gnu"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "bake_target": "nix"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v2-linux-gnu", "bake_target": "nix"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "bake_target": "nix"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v4-linux-gnu", "bake_target": "nix"},
-        ]
-
-  publish:
-    if: >
-      !failure() && !cancelled()
-      && needs.init.outputs.publish
-      && !contains(github.ref, 'refs/pull')
-      && !contains(needs.init.outputs.head_msg, '[ci only it]')
-      && !contains(needs.init.outputs.head_msg, '[ci no build]')
-      && !contains(needs.init.outputs.head_msg, '[ci no package]')
-      && !contains(needs.init.outputs.head_msg, '[ci no publish]')
-
-    name: Publish
-    needs: [init, test, package]
-    uses: ./.github/workflows/publish.yml
-    with:
-      docker_repo: ${{needs.init.outputs.docker_repo}}
-      release_url: ${{needs.init.outputs.release_url}}
-      pages_url: ${{needs.init.outputs.pages_url}}
-      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
-      feat_sets: ${{needs.init.outputs.feat_sets}}
-      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
-      rust_targets: ${{needs.init.outputs.rust_targets}}
-      sys_names: ${{needs.init.outputs.sys_names}}
-      sys_targets: ${{needs.init.outputs.sys_targets}}
-      sys_versions: ${{needs.init.outputs.sys_versions}}
-      machines: ${{needs.init.outputs.machines}}
-      excludes: >
-        [
-          {"feat_set": "none"},
-          {"feat_set": "default"},
-          {"cargo_profile": "test"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native"},
-          {"rust_toolchain": "nightly"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
-        ]
-
-    secrets:
-      ghcr_token: ${{ secrets.GHCR_TOKEN }}
-      dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/package.yml

@@ -1,213 +0,0 @@
-name: Package
-
-on:
-  workflow_call:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      release_url:
-        type: string
-        description: For release assets
-      build_pkgs:
-        type: string
-        default: 'true'
-      check_pkgs:
-        type: string
-        default: 'false'
-      build_nix:
-        type: string
-        default: 'true'
-
-jobs:
-  book:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["default"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Book
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["book"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["default"]'
-      rust_toolchains: '["stable"]'
-      rust_targets: ${{inputs.rust_targets}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      runner: 'het'
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "book": {
-            "dst": "book",
-            "src": "/book",
-            "pages": true
-          }
-        }
-
-  binary:
-    if: >
-      !failure() && !cancelled()
-
-    name: Binaries
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["static"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "static": {
-            "dst": "tuwunel.zst",
-            "src": "/usr/bin/tuwunel",
-            "mime": "application/zstd",
-            "zstd": 11,
-            "chmod": "a+x"
-          }
-        }
-
-  container:
-    if: >
-      !failure() && !cancelled()
-
-    name: Containers
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["docker", "oci"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "docker": {
-            "dst": "tuwunel-docker.tar.gz",
-            "img": true,
-            "mime": "application/gzip",
-            "gzip": 7
-          },
-          "oci": {
-            "dst": "tuwunel-oci.tar.zst",
-            "runner": true,
-            "mime": "application/zstd",
-            "zstd": 11
-          }
-        }
-
-  pkgs:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && fromJSON(inputs.build_pkgs)
-
-    name: Distro Packages
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["deb", "rpm", "nix"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["stable"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-      release_url: ${{inputs.release_url}}
-      artifact: >
-        {
-          "deb": {
-            "dst": "tuwunel.deb",
-            "mime": "application/vnd.debian.binary-package"
-          },
-          "rpm": {
-            "dst": "tuwunel.rpm",
-            "mime": "application/x-rpm"
-          },
-          "nix": {
-            "dst": "tuwunel.nix.tar.zst",
-            "src": "/opt/tuwunel.nix.tar",
-            "mime": "application/zstd",
-            "zstd": 11
-          }
-        }
-
-  check_pkgs:
-    if: >
-      !failure() && !cancelled()
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && fromJSON(inputs.check_pkgs)
-
-    name: Check Packages
-    needs: [pkgs]
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["deb-install", "rpm-install"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["stable"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}

.github/workflows/publish.yml

@@ -1,328 +0,0 @@
-name: Publish
-
-on:
-  workflow_call:
-    secrets:
-      ghcr_token:
-      dockerhub_token:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      docker_repo:
-        type: string
-        description: DockerHub Repository
-      release_url:
-        type: string
-        description: For release assets
-      pages_url:
-        type: string
-        description: For pages deployment
-
-jobs:
-  documents:
-    if: >
-      !failure() && !cancelled()
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-      && !contains(github.ref, '-draft')
-
-    name: Documents
-    runs-on: ['X64', 'het']
-    permissions:
-      contents: read
-      id-token: write
-      pages: write
-
-    environment:
-      name: github-pages
-      url: ${{inputs.pages_url}}
-
-    steps:
-      - id: book
-        name: Book
-        uses: actions/deploy-pages@v4
-
-  containers:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && inputs.docker_repo != ''
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-    name: Containers
-    runs-on: ${{matrix.machine}}
-    permissions: write-all
-    strategy:
-      fail-fast: true
-      matrix:
-        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
-        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
-        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
-        feat_set: ${{fromJSON(inputs.feat_sets)}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: GitHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.ghcr_token }}
-
-      - name: DockerHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.dockerhub_token }}
-
-      - name: Bake
-        env:
-          bake_target: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          rust_toolchain: ${{matrix.rust_toolchain}}
-          rust_target: ${{matrix.rust_target}}
-          feat_set: ${{matrix.feat_set}}
-          sys_name: ${{matrix.sys_name}}
-          sys_version: ${{matrix.sys_version}}
-          sys_target: ${{matrix.sys_target}}
-          machine: ${{matrix.machine}}
-          acct: ${{github.actor}}
-          repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker/bake.sh "${{matrix.bake_target}}"
-
-  bundles:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && inputs.docker_repo != ''
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-    name: Bundles
-    needs: [containers]
-    runs-on: 'het'
-    permissions: write-all
-    strategy:
-      fail-fast: true
-      matrix:
-        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
-        cargo_profile: ${{fromJSON('["release"]')}}
-        feat_set: ${{fromJSON('["all"]')}}
-        rust_toolchain: ${{fromJSON('["stable"]')}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-
-    steps:
-      - name: GitHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.ghcr_token }}
-
-      - name: DockerHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.dockerhub_token }}
-
-      - name: Release Branch
-        if: >
-          !failure() && !cancelled()
-          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-        env:
-          acct: ${{github.actor}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-          registry: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          feat_set: ${{matrix.feat_set}}
-          sys_target: ${{matrix.sys_target}}
-          ref_name: ${{github.ref_name}}
-
-        run: |
-          registry="$(echo -n $registry | sed s/_/./)"
-          if test "$registry" = "ghcr.io"; then
-            repo="$ghcr_repo"
-          else
-            repo="$docker_repo"
-          fi
-
-          docker manifest create "${registry}/${repo}:${ref_name}" \
-            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
-
-      - name: Release Preview
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-
-        env:
-          acct: ${{github.actor}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-          registry: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          feat_set: ${{matrix.feat_set}}
-          sys_target: ${{matrix.sys_target}}
-          ref_name: ${{github.ref_name}}
-
-        run: |
-          registry="$(echo -n $registry | sed s/_/./)"
-          if test "$registry" = "ghcr.io"; then
-            repo="$ghcr_repo"
-          else
-            repo="$docker_repo"
-          fi
-
-          docker manifest create "${registry}/${repo}:preview" \
-            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
-
-      - name: Release Latest
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-          && !contains(github.ref, '-rc')
-
-        env:
-          acct: ${{github.actor}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-          registry: ${{matrix.bake_target}}
-          cargo_profile: ${{matrix.cargo_profile}}
-          feat_set: ${{matrix.feat_set}}
-          sys_target: ${{matrix.sys_target}}
-          ref_name: ${{github.ref_name}}
-
-        run: |
-          registry="$(echo -n $registry | sed s/_/./)"
-          if test "$registry" = "ghcr.io"; then
-            repo="$ghcr_repo"
-          else
-            repo="$docker_repo"
-          fi
-
-          docker manifest create "${registry}/${repo}:latest" \
-            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
-
-  delivery:
-    if: >
-      !failure() && !cancelled()
-      && inputs.machines
-      && inputs.docker_repo != ''
-      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-    name: Delivery
-    needs: [bundles, documents]
-    runs-on: 'het'
-    permissions: write-all
-    steps:
-      - name: GitHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.ghcr_token }}
-
-      - name: DockerHub Login
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.dockerhub_token }}
-
-      - name: Push Branch
-        if: >
-          !failure() && !cancelled()
-          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
-
-        env:
-          ref_name: ${{github.ref_name}}
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker manifest push -p "ghcr.io/${ghcr_repo}:${ref_name}"
-          docker manifest push -p "docker.io/${docker_repo}:${ref_name}"
-
-      - name: Push Preview
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-
-        env:
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker manifest push -p "ghcr.io/${ghcr_repo}:preview"
-          docker manifest push -p "docker.io/${docker_repo}:preview"
-
-      - name: Push Latest
-        if: >
-          !failure() && !cancelled()
-          && contains(github.ref, 'refs/tags/v')
-          && !contains(github.ref, '-draft')
-          && !contains(github.ref, '-rc')
-
-        env:
-          ghcr_repo: ${{github.repository}}
-          docker_repo: ${{inputs.docker_repo}}
-
-        run: |
-          docker manifest push -p "ghcr.io/${ghcr_repo}:latest"
-          docker manifest push -p "docker.io/${docker_repo}:latest"

.github/workflows/test.yml

@@ -1,404 +0,0 @@
-name: Testing
-
-on:
-  workflow_call:
-    inputs:
-      cargo_profiles:
-        type: string
-        description: Cargo profiles
-      feat_sets:
-        type: string
-        description: Cargo feature groups
-      rust_toolchains:
-        type: string
-        description: Rust toolchains
-      sys_names:
-        type: string
-        description: System names
-      sys_versions:
-        type: string
-        description: System versions
-      rust_targets:
-        type: string
-        description: Rust targets
-      sys_targets:
-        type: string
-        description: System targets
-      machines:
-        type: string
-        description: Hardware platform vector
-      excludes:
-        type: string
-        default: '[]'
-        description: Matrix exclusions
-      includes:
-        type: string
-        default: '[]'
-        description: Matrix inclusions
-      complement:
-        type: boolean
-        default: true
-      complement_runner:
-        type: string
-      rust_sdk_integ:
-        type: boolean
-        default: true
-      build_nix:
-        type: boolean
-        default: true
-      head_msg:
-        type: string
-
-jobs:
-  docs:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Docs
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["docs"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  unit:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-
-    name: Module
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["unit", "integ"]'
-      cargo_profiles: '["test"]'
-      feat_sets: '["all"]'
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  bench:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
-
-    name: Bench
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["unit", "integ"]'
-      cargo_profiles: '["bench"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v3-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  memcheck:
-    if: >
-      !contains(inputs.head_msg, '[ci only it]')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
-
-    name: Memcheck
-    uses: ./.github/workflows/bake.yml
-    with:
-      #bake_targets: '["unit-valgrind", "integ-valgrind"]'
-      bake_targets: '["integ-valgrind"]'
-      cargo_profiles: '["bench"]' # use bench not release for debug syms
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v3-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      includes: ${{inputs.includes}}
-      excludes: ${{inputs.excludes}}
-
-  smoke:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci only it]')
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.cargo_profiles
-      && inputs.machines
-
-    name: Smoke
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["smoke", "smoke-valgrind"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: ${{inputs.feat_sets}}
-      rust_toolchains: ${{inputs.rust_toolchains}}
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: ${{inputs.sys_targets}}
-      machines: ${{inputs.machines}}
-      includes: ${{inputs.includes}}
-      excludes: >
-        [
-          {"cargo_profile": "test", "feat_set": "default"},
-          {"cargo_profile": "test", "feat_set": "logging"},
-          {"cargo_profile": "test", "feat_set": "none", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "test", "rust_toolchain": "stable"},
-          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "test", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "bench"},
-          {"cargo_profile": "release", "rust_toolchain": "nightly"},
-          {"cargo_profile": "release", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "release", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "release-debuginfo", "feat_set": "logging"},
-          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
-          {"cargo_profile": "release-debuginfo", "rust_toolchain": "stable", "feat_set": "none"},
-          {"cargo_profile": "release-debuginfo", "bake_target": "smoke"},
-          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
-          {"cargo_profile": "release-native", "feat_set": "none"},
-          {"cargo_profile": "release-native", "feat_set": "default"},
-          {"cargo_profile": "release-native", "feat_set": "logging"},
-          {"cargo_profile": "release-native", "bake_target": "smoke-valgrind"},
-          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
-          {"cargo_profile": "release-native", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "release-native", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "release-native", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
-          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
-          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v3-linux-gnu", "bake_target": "smoke-valgrind"},
-          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
-          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
-          {"sys_target": "x86_64-v4-linux-gnu", "bake_target": "smoke-valgrind"},
-        ]
-
-  nix:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci only it]')
-      && !contains(inputs.head_msg, '[ci no build]')
-      && !contains(github.ref, 'refs/pull')
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
-      && fromJSON(inputs.build_nix)
-
-    name: Smoke NixOS
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["smoke-nix"]'
-      cargo_profiles: '["release"]'
-      feat_sets: '["all"]'
-      rust_toolchains: '["stable"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v1-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  rust-sdk-integ:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.rust_sdk_integ
-      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.rust_targets), fromJSON('["x86_64-unknown-linux-gnu"]')[0])
-
-    name: Matrix SDK Integration
-    needs: [smoke]
-    uses: ./.github/workflows/bake.yml
-    with:
-      #bake_targets: '["rust-sdk-integ", "rust-sdk-valgrind"]'
-      bake_targets: '["rust-sdk-integ"]'
-      cargo_profiles: ${{inputs.cargo_profiles}}
-      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: '["x86_64-unknown-linux-gnu"]'
-      sys_targets: ${{inputs.sys_targets}}
-      machines: '["X64"]'
-      runner: ${{inputs.complement_runner}}
-      includes: ${{inputs.includes}}
-      artifact: >
-        {
-          "rust-sdk-integ": {
-            "src": "/var/log/tuwunel.log",
-            "dst": "rust-sdk-integ.tuwunel.log",
-          },
-          "rust-sdk-valgrind": {
-            "src": "/var/log/tuwunel.log",
-            "dst": "rust-sdk-valgrind.tuwunel.log",
-          }
-        }
-      excludes: >
-        [
-          {"bake_target": "rust-sdk-valgrind", "cargo_profile": "test"},
-          {"feat_set": "none"},
-          {"feat_set": "logging"},
-          {"cargo_profile": "release"},
-          {"cargo_profile": "release-debuginfo"},
-          {"cargo_profile": "release-native"},
-          {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
-          {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
-          {"cargo_profile": "bench", "sys_target": "x86_64-v1-linux-gnu"},
-          {"cargo_profile": "bench", "sys_target": "x86_64-v2-linux-gnu"},
-          {"rust_target": "aarch64-unknown-linux-gnu"},
-          {"sys_target": "aarch64-v8-linux-gnu"},
-        ]
-
-  complement:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.complement
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
-
-    name: Complement
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["complement-tester", "complement-testee"]'
-      cargo_profiles: '["bench"]'
-      feat_sets: '["logging"]'
-      rust_toolchains: '["nightly"]'
-      sys_names: ${{inputs.sys_names}}
-      sys_versions: ${{inputs.sys_versions}}
-      rust_targets: ${{inputs.rust_targets}}
-      sys_targets: '["x86_64-v3-linux-gnu"]'
-      machines: ${{inputs.machines}}
-      runner: ${{inputs.complement_runner}}
-      excludes: ${{inputs.excludes}}
-      includes: ${{inputs.includes}}
-
-  compliance:
-    if: >
-      !failure() && !cancelled()
-      && !contains(inputs.head_msg, '[ci no build]')
-      && inputs.complement
-      && inputs.machines
-      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
-      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
-      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
-
-    name: Matrix Compliance
-    needs: [complement, smoke]
-    runs-on: ["${{matrix.machine}}", "${{inputs.complement_runner}}"]
-    concurrency:
-      group: complement-cant-walk-and-chew-bubblegum
-      cancel-in-progress: false
-
-    strategy:
-      fail-fast: false
-      matrix:
-        cargo_profile: ${{fromJSON('["bench"]')}}
-        feat_set: ${{fromJSON('["logging"]')}}
-        rust_toolchain: ${{fromJSON('["nightly"]')}}
-        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_version: ${{fromJSON(inputs.sys_versions)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
-        sys_target: ${{fromJSON('["x86_64-v3-linux-gnu"]')}}
-        machine: ${{fromJSON(inputs.machines)}}
-        exclude: ${{fromJSON(inputs.excludes)}}
-        include: ${{fromJSON(inputs.includes)}}
-
-    steps:
-    - uses: actions/checkout@v3
-    - name: Execute
-      id: execute
-      env:
-        cargo_profile: ${{matrix.cargo_profile}}
-        rust_toolchain: ${{matrix.rust_toolchain}}
-        rust_target: ${{matrix.rust_target}}
-        feat_set: ${{matrix.feat_set}}
-        sys_name: ${{matrix.sys_name}}
-        sys_target: ${{matrix.sys_target}}
-        sys_version: ${{matrix.sys_version}}
-        machine: ${{matrix.machine}}
-
-      run: |
-        docker/complement.sh
-
-    - if: success() || failure() && steps.execute.outcome == 'failure'
-      name: Extract
-      id: extract
-      env:
-        name: complement_tester__${{matrix.sys_name}}__${{matrix.sys_version}}__${{matrix.sys_target}}
-        tag: latest
-
-      run: |
-        cid=$(cat "$name")
-        docker cp "$cid:/usr/src/complement/new_results.jsonl" tests/complement/results.jsonl
-
-    - if: success() || failure() && steps.execute.outcome == 'failure'
-      name: Upload New Results
-      id: upload-result
-      uses: actions/upload-artifact@v4
-      with:
-        name: complement_results-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
-        path: ./tests/complement/results.jsonl
-
-    - if: failure() && steps.execute.outcome == 'failure'
-      name: Upload Failure Output
-      id: upload-output
-      uses: actions/upload-artifact@v4
-      with:
-        name: complement_output-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
-        path: ./complement.jsonl
-        if-no-files-found: ignore
-
-    - name: Accept
-      id: accept
-      run: |
-        git diff --exit-code --color --color-moved

.gitignore

@@ -79,7 +79,7 @@ test-conduit.toml
 /.gitlab-ci.d
 
 # mdbook output
-public/
+/public/
 
 # macOS
 .DS_Store
@@ -96,9 +96,9 @@ rustc-ice-*
 # complement test logs are huge
 tests/test_results/complement/test_logs.jsonl
 
-# cargo profiles from -Z self-profile
-*.mm_profdata
+# Node
+node_modules/
 
-# Editor crashfiles
-*.save
-*.swp
+# Rspress
+doc_build/
+.rspress/

.gitlab/merge_request_templates/MR.md

@@ -1,8 +0,0 @@
-
-<!-- Please describe your changes here -->
-
------------------------------------------------------------------------------
-
-- [ ] I ran `cargo fmt`, `cargo clippy`, and `cargo test`
-- [ ] I agree to release my code and all other changes of this MR under the Apache-2.0 license
-

.gitlab/route-map.yml

@@ -1,3 +0,0 @@
-# Docs: Map markdown to html files
-- source: /docs/(.+)\.md/
-  public: '\1.html'

.mailmap

@@ -0,0 +1,18 @@
+AlexPewMaster <git@alex.unbox.at> <68469103+AlexPewMaster@users.noreply.github.com>
+Daniel Wiesenberg <weasy@hotmail.de> <weasy666@gmail.com>
+Devin Ragotzy <devin.ragotzy@gmail.com> <d6ragotzy@wmich.edu>
+Devin Ragotzy <devin.ragotzy@gmail.com> <dragotzy7460@mail.kvcc.edu>
+Ginger <ginger@gingershaped.computer> <75683114+gingershaped@users.noreply.github.com>
+Jonas Platte <jplatte+git@posteo.de> <jplatte+gitlab@posteo.de>
+Jonas Zohren <git-pbkyr@jzohren.de> <gitlab-jfowl-0ux98@sh14.de>
+Jonathan de Jong <jonathan@automatia.nl> <jonathandejong02@gmail.com>
+June Clementine Strawberry <june@3.dog> <june@girlboss.ceo>
+June Clementine Strawberry <june@3.dog> <strawberry@pupbrain.dev>
+June Clementine Strawberry <june@3.dog> <strawberry@puppygock.gay>
+Olivia Lee <olivia@computer.surgery> <benjamin@computer.surgery>
+Rudi Floren <rudi.floren@gmail.com> <rudi.floren@googlemail.com>
+Tamara Schmitz <tamara.zoe.schmitz@posteo.de> <15906939+tamara-schmitz@users.noreply.github.com>
+Timo Kösters <timo@koesters.xyz>
+nexy7574 <git@nexy7574.co.uk> <nex@noreply.forgejo.ellis.link>
+nexy7574 <git@nexy7574.co.uk> <nex@noreply.localhost>
+x4u <xi.zhu@protonmail.ch> <14617923-x4u@users.noreply.gitlab.com>

.pre-commit-config.yaml

@@ -0,0 +1,71 @@
+default_install_hook_types:
+  - pre-commit
+  - pre-push
+  - commit-msg
+default_stages:
+  - pre-commit
+  - manual
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+        - id: fix-byte-order-marker
+        - id: check-case-conflict
+        - id: check-symlinks
+        - id: destroyed-symlinks
+        - id: check-yaml
+        - id: check-json
+        - id: check-toml
+        - id: end-of-file-fixer
+        - id: trailing-whitespace
+        - id: mixed-line-ending
+        - id: check-merge-conflict
+        - id: check-added-large-files
+
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.49.0
+    hooks:
+      - id: typos
+      - id: typos
+        name: commit-msg-typos
+        stages: [commit-msg]
+
+  - repo: https://github.com/crate-ci/committed
+    rev: v1.1.11
+    hooks:
+    - id: committed
+
+  - repo: local
+    hooks:
+      - id: cargo-fmt
+        name: cargo fmt
+        entry: cargo +nightly fmt --
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages:
+            - pre-commit
+
+  - repo: local
+    hooks:
+      - id: cargo-clippy
+        name: cargo clippy
+        entry: cargo clippy -- -D warnings
+        language: system
+        pass_filenames: false
+        types: [rust]
+        stages:
+          - pre-push
+
+  - repo: local
+    hooks:
+      - id: docs-build
+        name: docs build
+        entry: npm run docs:build
+        language: system
+        pass_filenames: false
+        files: docs/
+        types: [mdx]
+        stages:
+          - pre-commit

.typos.toml

@@ -1,6 +1,28 @@
+[files]
+extend-exclude = ["*.csr", "*.lock", "pnpm-lock.yaml"]
+
+[default]
+
+extend-ignore-re = [
+    "(?Rm)^.*(#|//|<!--)\\s*spellchecker:disable-line(\\s*-->)$", # Ignore a line by making it trail with a `spellchecker:disable-line` comment
+    "^[0-9a-f]{7,}$", # Commit hashes
+    "4BA7",
+    # some heuristics for base64 strings
+    "[A-Za-z0-9+=]{72,}",
+    "([A-Za-z0-9+=]|\\\\\\s\\*){72,}",
+    "[0-9+][A-Za-z0-9+]{30,}[a-z0-9+]",
+    "\\$[A-Z0-9+][A-Za-z0-9+]{6,}[a-z0-9+]",
+    "\\b[a-z0-9+/=][A-Za-z0-9+/=]{7,}[a-z0-9+/=][A-Z]\\b",
+    # In the renovate config
+    ".ontainer"
+]
+
 [default.extend-words]
 "allocatedp" = "allocatedp"
 "conduwuit" = "conduwuit"
+"continuwuity" = "continuwuity"
+"continuwity" = "continuwuity"
 "execuse" = "execuse"
-"leafs" = "leafs"
-"serialize" = "serialize"
+"oltp" = "OTLP"
+
+rememvering = "remembering"

.vscode/settings.json

@@ -0,0 +1,11 @@
+{
+    "cSpell.words": [
+        "Forgejo",
+        "appservice",
+        "appservices",
+        "conduwuit",
+        "continuwuity",
+        "homeserver",
+        "homeservers"
+    ]
+}

CHANGELOG.md

@@ -0,0 +1,355 @@
+# Continuwuity v26.7.2 (2026-07-30)
+
+## Bugfixes
+
+- Sliding sync no longer continues streaming data to a user after they are removed from a room. Contributed by @eleboucher. (SEC10)
+- Valid redaction events no longer arbitrarily soft-fail and are applied correctly as expected.
+- Fixed a regression that caused the server to process events for rooms it no longer has any local users in, which caused users to be reset back *into* rooms.
+
+# Continuwuity 26.7.0 (2026-07-27)
+
+## Features
+
+- Build and publish arm64 .deb packages alongside amd64 for all supported Debian and Ubuntu releases. (#1235)
+- Dehydrated devices are now visible in the account panel. Contributed by @ginger. (#1970)
+- Introduce `accepted_ip_sources` as a multiple options variant of `request_ip_source`, allowing for more advanced deployments and making fallbacks an explicit choice. Contributed by @Omar007 (#1985)
+- Added an admin command to issue an access token for a bot account, to allow legacy bots to function while legacy authentication is disabled. Contributed by @ginger (#2044)
+- Added support for the OAuth2 device authorization flow. Contributed by @ginger
+- Added support for the stable mutual rooms query endpoint. Contributed by @ginger
+- Fetch the joined member count once per event instead of once per notified user.
+
+## Bugfixes
+
+- Fix joining restricted rooms over federation failing with signature verification error. (fix-federation-signature)
+- Fixed the client space hierarchy endpoint returning a 500 "Space hierarchy is unreasonably large" error for cyclic space graphs (e.g. a space containing itself). Rooms are now deduplicated during
+  traversal as required by the spec, and the traversal depth is bounded even when the client does not specify `max_depth`. (space-hierarchy-cycle)
+- Fixed simplified sliding sync holding account data for up to 30 seconds, which made encryption setup and cross-signing resets appear to hang. (sss-account-data-longpoll)
+- Fixed local invites and invite acceptances not being reflected in sync promptly. Contributed by @eleboucher (wake-local-member-sync)
+- Fixed the deeplink redirect for deleting devices. Contributed by @koen (#1965)
+- Fix status code for oauth registration. Contributed by @n00byking (#1984)
+- Exempt m.room.create from auth_events check. Contributed by @eleboucher (#1987)
+- Fixed `create` being returned as a supported prompt value regardless of if registration is enabled or not. Contributed by @ginger (#1994)
+- Fixed high CPU usage when multiple clients from the same account were connected at once. Each sync woke the account's other sync loops, causing them to wake each other in a loop. (#2006)
+- Fixed MSC4190 appservice device creation registering a random device ID instead of the requested one (and dropping the requested display name), which prevented encrypted mautrix bridges from
+  starting on OIDC-enabled servers and leaked an orphan device on the bridge bot per startup attempt. (#2015)
+- Deactivated users and appservice puppets are no longer counted by `/_continuwuity/local_user_count`. Contributed by @ginger. (#2040)
+- Re-introduced admin room registration alerts that were accidentally removed in the OAuth2 update. (#2057)
+- Appservices are now properly able to create devices for E2EE.
+- Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
+- Fixed `roomuserid_lastnotificationread` being aliased to the highlight count table, which clobbered highlight counts when setting a read marker. Contributed by @eleboucher
+- Fixed freshly left room failing to sync.
+- Fixed newly created rooms failing to sync properly in clients using legacy sync.
+- Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.
+- Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on
+  internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher
+- Resolve alias service by correct name for auto-join. Contributed by @eleboucher
+
+## Improved Documentation
+
+- Updated an out-of-date statement about Oracle Linux release cadences. (#1999)
+
+# Continuwuity 26.6.2 (2026-07-12)
+
+## Bugfixes
+
+- Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
+- Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
+- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue,
+  use `!admin users reset-password --convert-to-local-account` to reactivate them.
+
+# Continuwuity 26.6.1 (2026-07-12)
+
+## Features
+
+- Added enforcement for new federated invite checks and corrected a bunch of related spec compliance issues along the way. Contributed by @nex. (#1952)
+
+## Bugfixes
+
+- Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`. (#1942)
+- Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint. (#1953)
+- Fixed newly created rooms failing to sync properly in clients using legacy sync.
+- Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
+- Whitespace will now automatically be trimmed from the start and end of the `global.oauth.oidc.client_secret_file`.
+
+# Continuwuity 26.6.0 (2026-07-10)
+
+## Features
+
+- Added support for linking an external identity provider with OIDC. Contributed by @ginger. (#765)
+- Updated [MSC4284: Policy Servers](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) implementation to support the newly stabilised proposal. Contributed by @nex. (#1487)
+- Added config option for default room ACLs. Contributed by @eve. (#1691)
+- Added support for fallback encryption keys. (#1710)
+- Add `!admin users reject-all-invites` to clean invite spam (#1741)
+- Implemented event rejection, which should resolve and prevent future netsplits of the kinds observed within some Continuwuity rooms. Also resolved several bugs related to both soft-failing events,
+  and event backfilling, which should improve state resolution stability. The `!admin debug get-pdu` command was updated to disambiguate event acceptance status, and
+  `!admin debug show-auth-chain` was added to visually display event auth chains, which may assist developers in debugging strangely complex events.
+
+  Contributed by @nex. (#1747)
+- Added full support for [MSC4168: Update `m.space.*` state on room upgrade](https://github.com/matrix-org/matrix-spec-proposals/pull/4168). Contributed by @nex. (#1807)
+- Improved the performance and reliability of fetching missing events, improving network partition recovery. Contributed by @nex. (#1818)
+- Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you
+  are on NixOS. Contributed by @Henry-Hiles (QuadRadical). (#1853)
+- Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex. (#1875)
+- Added `!admin debug get-state-at` command (#1877)
+- Added a configuration option to allow choosing a client IP source that is not the TCP connecting IP. Contributed by @nex. (#1931)
+- Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.
+- Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
+- Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.
+- Appservice device management as outlined in MSC4190 (part of Matrix 1.17) is now fully supported. Contributed by @ginger.
+- Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
+
+## Bugfixes
+
+- Adjusted legacy sync logic to allow the `roomsynctoken_shortstatehash` database column to be dropped, massively reducing database sizes, especially for old deployments. Contributed by @ginger.
+  (#917)
+- Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex. (#1711)
+- fix `!admin query account-data account-data-get` not returning the content (#1742)
+- Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles
+  (QuadRadical) (#1752)
+- Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz. (#1804)
+- Fixed several bugs in the `POST /_matrix/client/v3/rooms/{roomId}/upgrade` endpoint. Contributed by @nex. (#1807)
+- Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout.
+- Improved invite and join reliability in clients using legacy sync. Contributed by @ginger
+- The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger
+
+## Improved Documentation
+
+- Add performance tuning documentation. Contributed by @stratself. (#1498)
+- Explain accessing Continuwuity's server console when deployed via Docker. (#1671)
+- Clarified in the config that `max_request_size` affects federated media as well. (#1706)
+- Added example configuration using caddy-docker-proxy in the livekit setup section of the docs. Contributed by @Cease (#1762)
+- Updated deployment docs to account for new RPM package availability across more distros. Contributed by @julian45. (#1912)
+
+## Deprecations and Removals
+
+- Removed support for LDAP. (#1701)
+- Removed support for guest user registration, a little-used and deprecated approach to room previews.
+- Removed the `/_conduwuit/` versions of the `local_user_count` and `version` routes. These routes are still accessible under the `/_continuwuity` prefix.
+- Support for server-side blurhashing (part of MSC2448) has been removed.
+- The deprecated `well_known.rtc_focus_server_urls` config option has been removed. MatrixRTC foci should be configured using the `matrix_rtc.foci` config option.
+
+## Misc
+
+- #1505, #1829, #1927, #1933, #1934
+- Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger.
+- The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used
+  on distro versions from before 2025-01-30
+
+# Continuwuity 0.5.8 (2026-04-24)
+
+## Features
+
+- LDAP can now optionally be connected to using StartTLS, and you may unsafely skip verification. Contributed by @getz (#1389)
+- Users will now be prevented from removing their email if the server is configured to require an email when registering an account.
+
+## Bugfixes
+
+- Fixed a situation where multiple email addresses could be associated with one user when that user changes their email address.
+
+## Improved Documentation
+
+- Updated config docs to state we support room version 12, and set it as default. Contributed by @ezera. (#1622)
+- Improve instructions for generic deployments, removing unnecessary parts and documenting the new initial registration token flow. Contributed by @stratself (#1677)
+
+# Continuwuity v0.5.7 (2026-04-17)
+
+## Features
+
+- Re-added support for reading registration tokens from a file. Contributed by @ginger and @benbot. (#1371)
+- Add new config option to allow or disallow search engine indexing through a `<meta ../>` tag. Defaults to blocking indexing (`content="noindex"`). Contributed by @s1lv3r and @ginger. (#1527)
+- Add new config option for [MSC4439](https://github.com/matrix-org/matrix-spec-proposals/pull/4439)
+  PGP key URIs. Contributed by LogN. (#1609)
+- Added `!admin users reset-push-rules` command to reset the notification settings of users. Contributed by @nex. (#1613)
+- Notification pushers are now automatically removed when their associated device is. Admin commands now exist for manual cleanup too. Contributed by @nex. (#1614)
+- Implemented option to deprioritize servers for room join requests. Contributed by @ezera. (#1624)
+- Added admin commands to get build information and features. Contributed by @Jade (#1629)
+- Added support for associating email addresses with accounts, requiring email addresses for registration, and resetting passwords via email. Contributed by @ginger
+- Added support for requiring users to accept terms and conditions when registering.
+- Added support for using an admin command to issue self-service password reset links.
+
+## Bugfixes
+
+- Fixed corrupted appservice registrations causing the server to enter a crash loop. Contributed by @nex. (#1265)
+- Prevent removing the admin room alias (`#admins`) to avoid accidentally breaking admin room functionality. Contributed by @0xnim (#1448)
+- Stripped `join_authorised_via_users_server` from json if user is already in room (@partha:cxy.run) (#1542)
+- Fixed internal server errors for fetching thumbnails. Contributed by @PerformativeJade (#1572)
+- Fixed error 500 when joining non-existent rooms. Contributed by @ezera. (#1579)
+- Refactored nix package. Breaking, since `all-features` package no longer exists. Continuwuity is now built with jemalloc and liburing by default. Contributed by @Henry-Hiles (QuadRadical). (#1596)
+- Fixed resolving IP of servers that only use SRV delegation. Contributed by @tulir. (#1615)
+- Fixed "Sender must be a local user" error for make_join, make_knock, and make_leave federation routes. Contributed by @nex. (#1623)
+- Fixed restricted joins not being signed when we are being used as an authorising server. Contributed by @nex, reported by [vel](matrix:u/vel:nhjkl.com?action=chat). (#1630)
+- Fixed room alias deletion so removing one local alias no longer removes other aliases from room alias listings.
+- Stopped left rooms from being unconditionally sent on initial sync, hopefully fixing spurious appearances of left rooms in some clients (and making sync faster as a bonus). Contributed by @ginger
+- Correct the response field name for MatrixRTC transports. Contributed by @spaetz
+
+## Improved Documentation
+
+- Added Testing and Troubleshooting instructions for Livekit documentation. Contributed by @stratself. (#1429)
+- Refactored docker docs to include new initial token workflow, and add Caddyfile example. Contributed by @stratself. (#1594)
+- Add DNS tuning guide for Continuwuity. Users are recommended to set up a local caching resolver following the guide's advice. Contributed by @stratself (#1601)
+
+## Misc
+
+- Fixed compiler warning in cf_opts.rs when building in release. Contributed by @ezera. (#1620)
+
+# Continuwuity 0.5.6 (2026-03-03)
+
+## Security
+
+- Admin escape commands received over federation will never be executed, as this is never valid in a genuine situation. Contributed by @Jade.
+- Fixed data amplification vulnerability (CWE-409) that affected configurations with server-side compression enabled (non-default). Contributed by @nex.
+
+## Features
+
+- Outgoing presence is now disabled by default, and the config option documentation has been adjusted to more accurately represent the weight of presence, typing indicators, and read receipts.
+  Contributed by @nex. ([#1399](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1399))
+- Improved the concurrency handling of federation transactions, vastly improving performance and reliability by more accurately handling inbound transactions and reducing the amount of repeated wasted
+  work. Contributed by @nex and @Jade. ([#1428](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1428))
+- Added [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202) Device masquerading (not all of MSC3202). This should fix issues with
+  enabling [MSC4190](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) for some Mautrix bridges. Contributed by @Jade
+  ([#1435](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1435))
+- Added [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814) Dehydrated Devices - you can now decrypt messages sent while all devices were logged out.
+  ([#1436](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1436))
+- Implement [MSC4143](https://github.com/matrix-org/matrix-spec-proposals/pull/4143) MatrixRTC transport discovery endpoint. Move RTC foci configuration from `[global.well_known]` to a new
+  `[global.matrix_rtc]` section with a `foci` field. Contributed by @0xnim ([#1442](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1442))
+- Updated `list-backups` admin command to output one backup per line. ([#1394](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1394))
+- Improved URL preview fetching with a more compatible user agent for sites like YouTube Music. Added `!admin media delete-url-preview <url>` command to clear cached URL previews that were stuck and
+  broken. ([#1434](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1434))
+
+## Bugfixes
+
+- Removed non-compliant nor functional room alias lookups over federation. Contributed by @nex ([#1393](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1393))
+- Removed ability to set rocksdb as read only. Doing so would cause unintentional and buggy behaviour. Contributed by @Terryiscool160.
+  ([#1418](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1418))
+- Fixed a startup crash in the sender service if we can't detect the number of CPU cores, even if the `sender_workers` config option is set correctly. Contributed by @katie.
+  ([#1421](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1421))
+- Removed the `allow_public_room_directory_without_auth` config option. Contributed by @0xnim. ([#1441](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1441))
+- Fixed sliding sync v5 list ranges always starting from 0, causing extra rooms to be unnecessarily processed and returned. Contributed by @0xnim
+  ([#1445](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1445))
+- Fixed a bug that (repairably) caused a room split between continuwuity and non-continuwuity servers when the room had both `m.room.policy` and `org.matrix.msc4284.policy` in its room state.
+  Contributed by @nex ([#1481](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1481))
+- Fixed `!admin media delete --mxc <url>` responding with an error message when the media was deleted successfully. Contributed by @lynxize
+- Fixed spurious 404 media errors in the logs. Contributed by @benbot.
+- Fixed spurious warn about needed backfill via federation for non-federated rooms. Contributed by @kraem.
+
+# Continuwuity v0.5.5 (2026-02-15)
+
+## Features
+
+- Added unstable support for [MSC4406:
+  `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406). Contributed by @nex ([#1308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1308))
+- Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by @Omar007
+  ([#1349](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1349))
+- Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by @nex. ([#1368](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1368))
+- You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be rejected. Contributed by @trashpanda
+  ([#1372](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1372))
+- Improved the first-time setup experience for new homeserver administrators:
+    - Account registration is disabled on the first run, except for with a new special registration token that is logged to the console.
+    - Other helpful information is logged to the console as well, including a giant warning if open registration is enabled.
+    - The default index page now says to check the console for setup instructions if no accounts have been created.
+    - Once the first admin account is created, an improved welcome message is sent to the admin room.
+
+  Contributed by @ginger.
+
+## Bugfixes
+
+- Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or broken invites should clear their client caches after updating to make them appear.
+  ([#1249](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1249))
+- LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured. Contributed by @Jade
+  ([#1307](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1307))
+- Fixed sliding sync not resolving wildcard state key requests, enabling Video/Audio calls in Element X. ([#1370](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1370))
+
+## Misc
+
+- #1344
+
+# Continuwuity v0.5.4 (2026-02-08)
+
+## Features
+
+- The announcement checker will now announce errors it encounters in the first run to the admin room, plus a few other misc improvements. Contributed by @Jade
+  ([#1288](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1288))
+- Drastically improved the performance and reliability of account deactivations. Contributed by @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314))
+- Refuse to process requests for and events in rooms that we no longer have any local users in (reduces state resets and improves performance). Contributed by @nex
+  ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316))
+- Added server-specific admin API routes to ban and unban rooms, for use with moderation bots. Contributed by @nex ([#1301](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1301))
+
+## Bugfixes
+
+- Fix the generated configuration containing uncommented optional sections. Contributed by @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290))
+- Fixed specification non-compliance when handling remote media errors. Contributed by @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298))
+- UIAA requests which check for out-of-band success (sent by matrix-js-sdk) will no longer create unhelpful errors in the logs. Contributed by @ginger
+  ([#1305](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1305))
+- Use exists instead of contains to save writing to a buffer in `src/service/users/mod.rs`: `is_login_disabled`. Contributed by @aprilgrimoire.
+  ([#1340](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1340))
+- Fixed backtraces being swallowed during panics. Contributed by @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337))
+- Fixed a potential vulnerability that could allow an evil remote server to return malicious events during the room join and knock process. Contributed by @nex, reported by
+  violet & [mat](https://matdoes.dev).
+- Fixed a race condition that could result in outlier PDUs being incorrectly marked as visible to a remote server. Contributed by @nex, reported by violet & [mat](https://matdoes.dev).
+- ACLs are no longer case-sensitive. Contributed by @nex, reported by [vel](matrix:u/vel:nhjkl.com?action=chat).
+
+## Docs
+
+- Fixed Fedora install instructions. Contributed by @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342))
+
+# Continuwuity 0.5.3 (2026-01-12)
+
+## Features
+
+- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279))
+
+## Bugfixes
+
+- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286))
+
+## Docs
+
+- Improve admin command documentation generation. Contributed by @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280))
+
+## Misc
+
+- Improve timeout-related code for federation and URL previews. Contributed by @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278))
+
+# Continuwuity 0.5.2 (2026-01-09)
+
+## Features
+
+- Added support for issuing additional registration tokens, stored in the database, which supplement the existing registration token hardcoded in the config file. These tokens may optionally expire
+  after a certain number of uses or after a certain amount of time has passed. Additionally, the `registration_token_file` configuration option is superseded by this feature and **has been removed**.
+  Use the new `!admin token` command family to manage registration tokens. Contributed by @ginger (#783).
+- Implemented a configuration defined admin list independent of the admin room. Contributed by @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253))
+- Added support for invite and join anti-spam via Draupnir and Meowlnir, similar to that of synapse-http-antispam. Contributed by @nex.
+  ([#1263](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1263))
+- Implemented account locking functionality, to complement user suspension. Contributed by @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266))
+- Added admin command to forcefully log out all of a user's existing sessions. Contributed by @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271))
+- Implemented toggling the ability for an account to log in without mutating any of its data. Contributed by @nex. (
+  [#1272](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1272))
+- Add support for custom room create event timestamps, to allow generating custom prefixes in hashed room IDs. Contributed by @nex.
+  ([#1277](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1277))
+- Certain potentially dangerous admin commands are now restricted to only be usable in the admin room and server console. Contributed by @ginger.
+
+## Bugfixes
+
+- Fixed unreliable room summary fetching and improved error messages. Contributed by @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257))
+- Client requested timeout parameter is now applied to e2ee key lookups and claims. Related federation requests are now also concurrent. Contributed by @nex.
+  ([#1261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1261))
+- Fixed the whoami endpoint returning HTTP 404 instead of HTTP 403, which confused some appservices. Contributed by @nex. ([#1276](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1276))
+
+## Misc
+
+- The `console` feature is now enabled by default, allowing the server console to be used for running admin commands directly. To automatically open the console on startup, set the
+  `admin_console_automatic` config option to `true`. Contributed by @ginger.
+- We now (finally) document our container image mirrors. Contributed by @Jade
+
+# Continuwuity 0.5.0 (2025-12-30)
+
+**This release contains a CRITICAL vulnerability patch, and you must update as soon as possible**
+
+## Features
+
+- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (@Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251))
+
+## Bug Fixes
+
+- Don't allow admin room upgrades, as this can break the admin room (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
+- Fix invalid creators in power levels during upgrade to v12 (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))

CODE_OF_CONDUCT.md

@@ -1,132 +1 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, caste, color, religion, or sexual
-identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people.
-* Being respectful of differing opinions, viewpoints, and experiences.
-* Giving and gracefully accepting constructive feedback.
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience.
-* Focusing on what is best not just for us as individuals, but for the overall
-  community.
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or advances of
-  any kind.
-* Trolling, insulting or derogatory comments, and personal or political attacks.
-* Public or private harassment.
-* Publishing others' private information, such as a physical or email address,
-  without their explicit permission.
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting.
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement over email at
-<abuse@tuwunel.chat> or over Matrix at @abuse:tuwunel.chat.
-
-All complaints will be reviewed and investigated promptly and fairly. All
-community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series of
-actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or permanent
-ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within the
-community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.1, available at
-[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
-
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
-
-For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
-[https://www.contributor-covenant.org/translations][translations].
-
-[homepage]: https://www.contributor-covenant.org
-[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
-[Mozilla CoC]: https://github.com/mozilla/diversity
-[FAQ]: https://www.contributor-covenant.org/faq
-[translations]: https://www.contributor-covenant.org/translations
+Contributors are expected to follow the [Continuwuity Community Guidelines](https://continuwuity.org/community/guidelines).

CONTRIBUTING.md

@@ -1,125 +1,209 @@
 # Contributing guide
 
-This page is for about contributing to Tuwunel. The
-[development](./development.md) page may be of interest for you as well.
+This page is about contributing to Continuwuity. The
+[development](/development/index.mdx) and [code style guide](/development/code_style.mdx) pages may be of interest for you as well.
 
 If you would like to work on an [issue][issues] that is not assigned, preferably
-ask in the Matrix room first at [#tuwunel:tuwunel.chat][tuwunel-chat],
+ask in the Matrix room first at [#continuwuity:continuwuity.org][continuwuity-matrix],
 and comment on it.
 
-### Linting and Formatting
+### Code Style
 
-It is mandatory all your changes satisfy the lints (clippy, rustc, rustdoc, etc)
-and your code is formatted via the **nightly** `cargo fmt`. A lot of the
-`rustfmt.toml` features depend on nightly toolchain. It would be ideal if they
-weren't nightly-exclusive features, but they currently still are. CI's rustfmt
-uses nightly.
+Please review and follow the [code style guide](/development/code_style.mdx) for formatting, linting, naming conventions, and other code standards.
 
-If you need to allow a lint, please make sure it's either obvious as to why
-(e.g. clippy saying redundant clone but it's actually required) or it has a
-comment saying why. Do not write inefficient code for the sake of satisfying
-lints. If a lint is wrong and provides a more inefficient solution or
-suggestion, allow the lint and mention that in a comment.
+### Pre-commit Checks
 
-### Running CI tests locally
+Continuwuity uses pre-commit hooks to enforce various coding standards and catch common issues before they're committed. These checks include:
 
-<sub>TODO: docker bake matrix</sub>
+- Code formatting and linting
+- Typo detection (both in code and commit messages)
+- Checking for large files
+- Ensuring proper line endings and no trailing whitespace
+- Validating YAML, JSON, and TOML files
+- Checking for merge conflicts
+
+You can run these checks locally by installing [prek](https://github.com/j178/prek):
+
+
+```bash
+# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
+cargo binstall prek
+
+# Install git hooks to run checks automatically
+prek install
+
+# Run all checks
+prek --all-files
+```
+
+Alternatively, you can use [pre-commit][pre-commit]:
+```bash
+# Requires python
+
+# Install pre-commit
+pip install pre-commit
+
+# Install the hooks
+pre-commit install
+
+# Run all checks manually
+pre-commit run --all-files
+```
+
+These same checks are run in CI via the prek-checks workflow to ensure consistency. These must pass before the PR is merged.
+
+[pre-commit]: https://pre-commit.com/
+
+### Running tests locally
+
+Tests, compilation, and linting can be run with standard Cargo commands:
+
+```bash
+# Run tests
+cargo test
+
+# Check compilation
+cargo check --workspace --features full
+
+# Run lints
+cargo clippy --workspace --features full
+# Auto-fix: cargo clippy --workspace --features full --fix --allow-staged;
+
+# Format code (must use nightly)
+cargo +nightly fmt
+```
 
 ### Matrix tests
 
-CI runs [Complement][complement], but currently does not fail if results from
-the checked-in results differ with the new results. If your changes are done to
-fix Matrix tests, note that in your pull request. If more Complement tests start
-failing from your changes, please review the logs (they are uploaded as
-artifacts) and determine if they're intended or not.
+Continuwuity uses [Complement][complement] for Matrix protocol compliance testing. Complement tests are run manually by developers, and documentation on how to run these tests locally is currently being developed.
 
-If you'd like to run Complement locally using Nix, see the
-[testing](development/testing.md) page.
+If your changes are done to fix Matrix tests, please note that in your pull request. If more Complement tests start failing from your changes, please review the logs and determine if they're intended or not.
 
-[Sytest][sytest] support will come soon.
+[Sytest][sytest] is currently unsupported.
 
 ### Writing documentation
 
-Tuwunel's website uses [`mdbook`][mdbook] and deployed via CI using GitHub
-Pages in the [`documentation.yml`][documentation.yml] workflow file with Nix's
-mdbook in the devshell. All documentation is in the `docs/` directory at the top
-level. The compiled mdbook website is also uploaded as an artifact.
+Continuwuity's website uses [`rspress`][rspress] and is deployed via CI using Cloudflare Pages
+in the [`documentation.yml`][documentation.yml] workflow file. All documentation is in the `docs/`
+directory at the top level.
 
-To build the documentation using Nix, run: `bin/nix-build-and-cache just .#book`
+To load the documentation locally:
 
-The output of the mdbook generation is in `result/`. mdbooks can be opened in
-your browser from the individual HTML files without any web server needed.
+1. Install NodeJS and npm from their [official website][nodejs-download] or via your package manager of choice
 
-### Inclusivity and Diversity
+2. From the project's root directory, install the relevant npm modules
 
-All **MUST** code and write with inclusivity and diversity in mind. See the
-[following page by Google on writing inclusive code and
-documentation](https://developers.google.com/style/inclusive-documentation).
+   ```bash
+   npm ci
+   ```
 
-This **EXPLICITLY** forbids usage of terms like "blacklist"/"whitelist" and
-"master"/"slave", [forbids gender-specific words and
-phrases](https://developers.google.com/style/pronouns#gender-neutral-pronouns),
-forbids ableist language like "sanity-check", "cripple", or "insane", and
-forbids culture-specific language (e.g. US-only holidays or cultures).
+3. Make changes to the document pages as you see fit
 
-No exceptions are allowed. Dependencies that may use these terms are allowed but
-[do not replicate the name in your functions or
-variables](https://developers.google.com/style/inclusive-documentation#write-around).
+4. Generate a live preview of the documentation
 
-In addition to language, write and code with the user experience in mind. This
-is software that intends to be used by everyone, so make it easy and comfortable
-for everyone to use. 🏳️‍⚧️
+   ```bash
+   npm run docs:dev
+   ```
 
-### Variable, comment, function, etc standards
+   A webserver for the docs will be spun up for you (e.g. at `http://localhost:3000`). Any changes you make to the documentation will be live-reloaded on the webpage.
 
-Rust's default style and standards with regards to [function names, variable
-names, comments](https://rust-lang.github.io/api-guidelines/naming.html), etc
-applies here.
+Alternatively, you can build the documentation using `npm run docs:build` - the output of this will be in the `/doc_build` directory. Once you're happy with your documentation updates, you can commit the changes.
+
+### Commit Messages
+
+Continuwuity follows the [Conventional Commits][conventional-commits] specification for commit messages. This provides a standardized format that makes the commit history more readable and enables automated tools to generate changelogs.
+
+The basic structure is:
+
+```
+<type>[(optional scope)]: <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+The allowed types for commits are:
+- `fix`: Bug fixes
+- `feat`: New features
+- `docs`: Documentation changes
+- `style`: Changes that don't affect the meaning of the code (formatting, etc.)
+- `refactor`: Code changes that neither fix bugs nor add features
+- `perf`: Performance improvements
+- `test`: Adding or fixing tests
+- `build`: Changes to the build system or dependencies
+- `ci`: Changes to CI configuration
+- `chore`: Other changes that don't modify source or test files
+
+Examples:
+```
+feat: Add user authentication
+fix(database): Resolve connection pooling issue
+docs: Update installation instructions
+```
+
+The project uses the `committed` hook to validate commit messages in pre-commit. This ensures all commits follow the conventional format.
 
 ### Creating pull requests
 
-Please try to keep contributions to the GitHub. While the mirrors of Tuwunel
-allow for pull/merge requests, there is no guarantee I will see them in a timely
+Please try to keep contributions to the Forgejo Instance. While the mirrors of continuwuity
+allow for pull/merge requests, there is no guarantee the maintainers will see them in a timely
 manner. Additionally, please mark WIP or unfinished or incomplete PRs as drafts.
-This prevents me from having to ping once in a while to double check the status
+This prevents us from having to ping once in a while to double check the status
 of it, especially when the CI completed successfully and everything so it
 *looks* done.
 
-If you open a pull request on one of the mirrors, it is your responsibility to
-inform me about its existence. In the future I may try to solve this with more
-repo bots in the Tuwunel Matrix room. There is no mailing list or email-patch
-support on the sr.ht mirror, but if you'd like to email me a git patch you can
-do so at `maintainer@tuwunel.chat`.
+Before submitting a pull request, please ensure:
+1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
+2. Your code follows the [code style guide](docs/development/code_style.mdx)
+3. Your commit messages follow the conventional commits format
+4. Tests are added for new functionality
+5. Documentation is updated if needed
 
 Direct all PRs/MRs to the `main` branch.
 
 By sending a pull request or patch, you are agreeing that your changes are
 allowed to be licenced under the Apache-2.0 licence and all of your conduct is
-in line with the Contributor's Covenant, and Tuwunel's Code of Conduct.
+in line with the Contributor's Covenant, and continuwuity's Code of Conduct.
 
-Contribution by users who violate either of these code of conducts will not have
+Contribution by users who violate either of these code of conducts may not have
 their contributions accepted. This includes users who have been banned from
-Tuwunel Matrix rooms for Code of Conduct violations.
+continuwuity Matrix rooms for Code of Conduct violations.
 
-### Branch Policy
-
-##### This section applies to Matrix-Construct members and Tuwunel maintainers
-
-All branches on the matrix-construct/tuwunel repository are _centrally
-maintained_. They may be rebased without your consent. Trivial conflicts may be
-resolved by another maintainer. Please resolve more difficult conflicts as soon
-as possible. Personal forks are advised to reduce the workload on other
-maintainers. Stale branches will be deleted to reduce the effort for this
-policy.
-
-[issues]: https://github.com/matrix-construct/tuwunel/issues
-[tuwunel-chat]: https://matrix.to/#/#tuwunel:tuwunel.chat
+[conventional-commits]: https://www.conventionalcommits.org/
+[issues]: https://forgejo.ellis.link/continuwuation/continuwuity/issues
+[continuwuity-matrix]: https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org
 [complement]: https://github.com/matrix-org/complement/
 [sytest]: https://github.com/matrix-org/sytest/
-[cargo-deb]: https://github.com/kornelski/cargo-deb
-[lychee]: https://github.com/lycheeverse/lychee
-[markdownlint-cli]: https://github.com/igorshubovych/markdownlint-cli
-[cargo-audit]: https://github.com/RustSec/rustsec/tree/main/cargo-audit
-[direnv]: https://direnv.net/
-[mdbook]: https://rust-lang.github.io/mdBook/
-[documentation.yml]: https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/docs.yml
+[nodejs-download]: https://nodejs.org/en/download
+[rspress]: https://rspress.rs/
+[documentation.yml]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/.forgejo/workflows/documentation.yml
+
+#### Writing news fragments
+
+In order to make writing our changelogs easier, we make use of [Towncrier]. Towncrier builds changelogs based on
+"news fragments", which are little markdown files in the `changelog.d/` directory that describe individual changes.
+
+When you make a pull request that changes functionality, fixes a bug, or adds documentation, please add a news fragment
+describing your change. The file name *MUST* be in the format of `{pull_request_number}.{type}`, where `{type}` is one
+of the following:
+
+- `feature` - for new features
+- `bugfix` - for bug fixes
+- `doc` - for documentation changes
+- `misc` - for other changes that don't fit the above categories
+
+For example:
+
+```bash
+$ echo "Fixed the quantum flux stabiliser. Contributed by @alice." > changelog.d/42.bugfix
+```
+
+(Note: If you want to credit yourself, you should reference your forgejo handle, however links to other platforms are also acceptable.)
+
+When the next release is made, Towncrier will automatically include your news fragment in the changelog.
+
+You can read more about writing news fragments in the [Towncrier tutorial][tt].
+
+[Towncrier]: https://towncrier.readthedocs.io/
+[tt]: https://towncrier.readthedocs.io/en/stable/tutorial.html#creating-news-fragments

LICENSE

@@ -1,4 +1,3 @@
-
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -187,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2023 June
+   Copyright 2023 Continuwuity Team and contributors
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -1,157 +1,129 @@
-# Tuwunel<sup>💕</sup>
-
-![GitHub License](https://img.shields.io/github/license/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
-![GitHub Created At](https://img.shields.io/github/created-at/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
-![GitHub Commit Activity](https://img.shields.io/github/commit-activity/m/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel%2Fpulse%2Fmonthly&color=%238A2BE2)
-![Docker Pulls](https://img.shields.io/docker/pulls/jevolk/tuwunel?style=flat&color=8A2BE2)
-![GitHub Repo Stars](https://img.shields.io/github/stars/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel&color=%238A2BE2)
-[![CI/CD](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml/badge.svg?branch=main&style=flat)](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml)
+# continuwuity
 
 <!-- ANCHOR: catchphrase -->
 
-## High Performance Matrix Homeserver in Rust!
+## A community-driven [Matrix](https://matrix.org/) homeserver in Rust
+
+[![Chat on Matrix](https://img.shields.io/matrix/continuwuity%3Acontinuwuity.org?server_fqdn=matrix.continuwuity.org&fetchMode=summary&logo=matrix)](https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org) [![Join the space](https://img.shields.io/matrix/space%3Acontinuwuity.org?server_fqdn=matrix.continuwuity.org&fetchMode=summary&logo=matrix&label=space)](https://matrix.to/#/#space:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org)
+
+
 
 <!-- ANCHOR_END: catchphrase -->
 
+[continuwuity] is a Matrix homeserver written in Rust.
+It's the official community continuation of the [conduwuit](https://github.com/girlbossceo/conduwuit) homeserver.
+
 <!-- ANCHOR: body -->
 
-Tuwunel is a featureful [Matrix](https://matrix.org/) homeserver you can use instead of Synapse
-with your favorite [client](https://matrix.org/ecosystem/clients/),
-[bridge](https://matrix.org/ecosystem/bridges/) or
-[bot](https://matrix.org/ecosystem/integrations/). It is written entirely in Rust to be a scalable,
-lightweight, low-cost, community-driven alternative covering all but the most niche uses.
+[![forgejo.ellis.link](https://img.shields.io/badge/Ellis%20Git-main+packages-green?style=flat&logo=forgejo&labelColor=fff)](https://forgejo.ellis.link/continuwuation/continuwuity) [![Stars](https://forgejo.ellis.link/continuwuation/continuwuity/badges/stars.svg?style=flat)](https://forgejo.ellis.link/continuwuation/continuwuity/stars) [![Issues](https://forgejo.ellis.link/continuwuation/continuwuity/badges/issues/open.svg?style=flat)](https://forgejo.ellis.link/continuwuation/continuwuity/issues?state=open) [![Pull Requests](https://forgejo.ellis.link/continuwuation/continuwuity/badges/pulls/open.svg?style=flat)](https://forgejo.ellis.link/continuwuation/continuwuity/pulls?state=open)
 
-This project is the official successor to conduwuit, which
-was a featureful and high-performance fork of [Conduit](https://gitlab.com/famedly/conduit), all
-community-lead homeservers implementing the compatible
-[Matrix Specification](https://spec.matrix.org/latest/).
+[![GitHub](https://img.shields.io/badge/GitHub-mirror-blue?style=flat&logo=github&labelColor=fff&logoColor=24292f)](https://github.com/continuwuity/continuwuity) [![Stars](https://img.shields.io/github/stars/continuwuity/continuwuity?style=flat)](https://github.com/continuwuity/continuwuity/stargazers)
 
-Tuwunel is operated by enterprise users with a vested interest in sponsoring its continued
-development. It is now maintained by full-time staff.
+[![GitLab](https://img.shields.io/badge/GitLab-mirror-blue?style=flat&logo=gitlab&labelColor=fff)](https://gitlab.com/continuwuity/continuwuity) [![Stars](https://img.shields.io/gitlab/stars/continuwuity/continuwuity?style=flat)](https://gitlab.com/continuwuity/continuwuity/-/starrers)
 
-### Getting Started
+[![Codeberg](https://img.shields.io/badge/Codeberg-mirror-2185D0?style=flat&logo=codeberg&labelColor=fff)](https://codeberg.org/continuwuity/continuwuity) [![Stars](https://codeberg.org/continuwuity/continuwuity/badges/stars.svg?style=flat)](https://codeberg.org/continuwuity/continuwuity/stars)
 
-- [GitHub Releases](https://github.com/matrix-construct/tuwunel/releases)
-- [Sourcecode](https://github.com/matrix-construct/tuwunel/) `git clone https://github.com/matrix-construct/tuwunel.git`
-- [DockerHub](https://hub.docker.com/r/jevolk/tuwunel) or `docker pull jevolk/tuwunel:latest`
-- [GHCR](https://github.com/matrix-construct/tuwunel/pkgs/container/tuwunel) or `docker pull ghcr.io/matrix-construct/tuwunel:latest`
-- Static binaries available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
-- Deb and RPM packages available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
-- Arch package available as [tuwunel](https://aur.archlinux.org/packages/tuwunel) or [tuwunel-git](https://aur.archlinux.org/packages/tuwunel-git).
-- Nix package still [needs some love](https://github.com/NixOS/nixpkgs/issues/415469).
+### Why does this exist?
 
-**1.** [Configure](https://matrix-construct.github.io/tuwunel/configuration.html) by
-copying and editing the `tuwunel-example.toml`. The `server_name` and `database_path` must be
-configured. **Most users deploy via docker or a distribution package and should follow the
-[appropriate guide](https://matrix-construct.github.io/tuwunel/deploying.html) instead.**
-This is just a summary for the impatient. See the full
-[documentation](https://matrix-construct.github.io/tuwunel/).
+The original conduwuit project has been archived and is no longer maintained. Rather than letting this Rust-based Matrix homeserver disappear, a group of community contributors have forked the project to continue its development, fix outstanding issues, and add new features.
 
-> [!TIP]
-> Avoid using a sub-domain for your `server_name`. You can always delegate later with a [`.well-known`](https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-well-known.md)
-> file, but you can never change your `server_name`.
+We aim to provide a stable, well-maintained alternative for current conduwuit users and welcome newcomers seeking a lightweight, efficient Matrix homeserver.
 
-**2.** Setup TLS certificates. Most users enjoy the [Caddy](https://caddyserver.com/) reverse-proxy
-which automates their certificate renewal. Advanced users can load their own TLS certificates
-using the configuration and Tuwunel can be deployed without a reverse proxy. Example
-`/etc/caddy/Caddyfile` configuration with [Element](https://github.com/element-hq/element-web/releases)
-unzipped to `/var/www/element`:
-```
-tuwunel.me, tuwunel.me:8448 {
-    reverse_proxy localhost:8008
-}
-web.tuwunel.me {
-    root * /var/www/element/
-    file_server
-}
-```
-`caddy reload --config /etc/caddy/Caddyfile`
+### Who are we?
 
-**3.** Start the server, connect your client and register your username. The first registration is
-granted server admin.
+We are a group of Matrix enthusiasts, developers and system administrators who have used conduwuit and believe in its potential. Our team includes both previous
+contributors to the original project and new developers who want to help maintain and improve this important piece of Matrix infrastructure.
 
-> [!TIP]
-> Configure a secret `registration_token` and set `allow_registration = true`
+We operate as an open community project, welcoming contributions from anyone interested in improving continuwuity.
 
- 🤗 Did you find this and other documentation helpful? We would love to hear feedback about setting
- up Tuwunel.
+### What is Matrix?
 
+[Matrix](https://matrix.org) is an open, federated, and extensible network for
+decentralized communication. Users from any Matrix homeserver can chat with users from all
+other homeservers over federation. Matrix is designed to be extensible and built on top of.
+You can even use bridges such as Matrix Appservices to communicate with users outside of Matrix, like a community on Discord.
 
-### Migrating to Tuwunel
+### What are the project's goals?
 
-| Can I migrate from | |
-|-----------------|-----------|
-| conduwuit? | ✅ Yes. This will be supported at a minimum for one year, but likely indefinitely. |
-| Synapse? | ❌ Not yet, but this is planned and an important issue. Subscribe to [#2](https://github.com/matrix-construct/tuwunel/issues/2). |
-| Conduit? | ❌ Not right now, but this is planned for the near future. Subscribe to [#41](https://github.com/matrix-construct/tuwunel/issues/41). |
-| Any other fork of Conduit? | ❌ No. The migration must be explicitly listed in this table. |
-> [!CAUTION]
-> **Never switch between different forks of Conduit or you will corrupt your database.**
-> All derivatives of Conduit share the same linear database version without any awareness of other
-> forks. The database will permanently corrupt and we will not be able to help you.
+Continuwuity aims to:
 
-#### Migrating from conduwuit
+- Maintain a stable, reliable Matrix homeserver implementation in Rust
+- Improve compatibility and specification compliance with the Matrix protocol
+- Fix bugs and performance issues from the original conduwuit
+- Add missing features needed by homeserver administrators
+- Provide comprehensive documentation and easy deployment options
+- Create a sustainable development model for long-term maintenance
+- Keep a lightweight, efficient codebase that can run on modest hardware
 
-Migrating from conduwuit to Tuwunel _just works_. In technical parlance it is a "binary swap."
-All you have to do is update to the latest Tuwunel and change the path to the executable from
-`conduwuit` to `tuwunel`.
+### Can I try it out?
 
-Anything else named "conduwuit" is still recognized, this includes environment variables with prefixes
-such as `CONDUWUIT_`. In fact, `CONDUIT_` is still recognized for our legacy users. You may have
-noticed that various configs, yamls, services, users, and other items were renamed, but if you
-were a conduwuit user we recommend against changing anything at all. This will keep things simple.
-If you are not sure please ask. If you found out that something did in fact need to be changed
-please open an issue immediately.
+Check out the [documentation](https://continuwuity.org) for installation instructions.
 
+If you want to try it out as a user, we have some partnered homeservers you can use:
+* You can head over to [https://federated.nexus](https://federated.nexus/) in your browser.
+  * Hit the `Apply to Join` button. Once your request has been accepted, you will receive an email with your username and password.
+  * Head over to [https://app.federated.nexus](https://app.federated.nexus/) and you can sign in there, or use any other matrix chat client you wish elsewhere.
+  * Your username for matrix will be in the form of `@username:federated.nexus`, however you can simply use the `username` part to log in. Your password is your password.
 
-### Upgrading & Downgrading Tuwunel
+* There's also [https://continuwuity.rocks/](https://continuwuity.rocks/). You can register a new account using Cinny via [this convenient link](https://app.cinny.in/register/continuwuity.rocks), or you can use Element or another matrix client *that supports registration*.
 
-We strive to make moving between versions of Tuwunel safe and easy. Downgrading Tuwunel is always
-safe but often prevented by a guard. An error will indicate the downgrade is not possible and a
-newer version which does not error must be sought.
+### What are we working on?
 
-#### Branches
+We're working our way through all of the issues in the [Forgejo project](https://forgejo.ellis.link/continuwuation/continuwuity/issues).
 
-The main branch is always _reasonably safe_ to run. We understand the propensity for users to simply clone
-the main branch to get up and running, and we're obliged to ensure it's always viable. Nevertheless, only
-tagged releases are true releases.
+- [Packaging & availability in more places](https://forgejo.ellis.link/continuwuation/continuwuity/issues/747)
+- [Appservices bugs & features](https://forgejo.ellis.link/continuwuation/continuwuity/issues?q=&type=all&state=open&labels=178&milestone=0&assignee=0&poster=0)
+- [Improving compatibility and spec compliance](https://forgejo.ellis.link/continuwuation/continuwuity/issues?labels=119)
+- Automated testing
+- [Admin API](https://forgejo.ellis.link/continuwuation/continuwuity/issues/748)
+- [Policy-list controlled moderation](https://forgejo.ellis.link/continuwuation/continuwuity/issues/750)
 
-#### Container Tracking
+### Can I migrate my data from x?
 
-> [!IMPORTANT]
-> **We strongly advise tracking the `:latest` tag when automatically updating.**
+- Conduwuit: Yes
+- Conduit: No, database is now incompatible
+- Grapevine: No, database is now incompatible
+- Dendrite: No
+- Synapse: No
 
-Tracking `:latest` gives us the necessary discretion to keep you on the appropriate stable version.
-We discourage tracking the main branch unless frequent restarts are acceptable. Alternatively,
-tracking the `:preview` tag provides the latest release-candidate becoming equivalent to `:latest`
-after a release. Tracking the `:preview` tag is a worthy alternative to the main branch, with
-turbulence limited to release-time.
-
-### Getting Help & Support
-
-If you are opposed to using github, or if private discussion is required such as for security
-disclosures, or for any other reason, I would be happy to receive your DM at
-[@jason:tuwunel.me](https://matrix.to/#/@jason:tuwunel.me). This will not be bothering me as it would
-be my pleasure to help you when possible. As an emergency contact you can send an email to
-jasonzemos@gmail.com.
-
-##### Tuwunel Fanclub
-
-We have an unofficial community-run chat which is publicly accessible at
-[#tuwunel:matrix.org](https://matrix.to/#/#tuwunel:matrix.org). The members, content, or moderation
-decisions of this room are not in any way related or endorsed by this project or its sponsors,
-and not all project staff will be present there. There will be at least some presence by staff to
-offer assistance so long as the room remains in minimally good standing.
-
-
-## Tuwunel<sup>💕</sup>
-
-Tuwunel's theme is **empathy** in communication defined by the works of
-[Edith Stein](https://plato.stanford.edu/entries/stein/). Empathy is the basis for how we approach
-every message and our responsibility to the other in every conversation.
+We haven't written up a guide on migrating from incompatible homeservers yet. Reach out to us if you need to do this!
 
 <!-- ANCHOR_END: body -->
 
+## Contribution
+
+### Development flow
+
+- Features / changes must developed in a separate branch
+- For each change, create a descriptive PR
+- Your code will be reviewed by one or more of the continuwuity developers
+- The branch will be deployed live on multiple tester's matrix servers to shake out bugs
+- Once all testers and reviewers have agreed, the PR will be merged to the main branch
+- The main branch will have nightly builds deployed to users on the cutting edge
+- Every week or two, a new release is cut.
+
+The main branch is always green!
+
+
+### Policy on pulling from other forks
+
+We welcome contributions from other forks of conduwuit, subject to our review process.
+When incorporating code from other forks:
+
+- All external contributions must go through our standard PR process
+- Code must meet our quality standards and pass tests
+- Code changes will require testing on multiple test servers before merging
+- Attribution will be given to original authors and forks
+- We prioritize stability and compatibility when evaluating external contributions
+- Features that align with our project goals will be given priority consideration
+
 <!-- ANCHOR: footer -->
 
+#### Contact
+
+Join our [Matrix room](https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org) and [space](https://matrix.to/#/#space:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org) to chat with us about the project!
+
 <!-- ANCHOR_END: footer -->
+
+
+[continuwuity]: https://forgejo.ellis.link/continuwuation/continuwuity

RELEASE.md

@@ -1,47 +0,0 @@
-# Tuwunel 1.4.6
-
-November 6, 2025
-
-### New Features
-
-- Element Call discovery support was implemented by @tototomate123 in (#209). Adding a `[[global.well_known.rtc_transports]]` section in your [config file](https://github.com/matrix-construct/tuwunel/blob/e1f89b69ea117f166be423f035a5a34f4c0e7366/tuwunel-example.toml#L1835-L1851) enables discovery. More information on setting up Element Call can be found at [Spaetzblog](https://sspaeth.de/2024/11/sfu/), skipping step one, and performing step three in your Tuwunel config.
-
-- Dehydrated Device support (MSC3814) is now available (#200). This feature allows users to receive encrypted messages without being logged in. Supporting clients will setup the dehydrated device automatically and it will "just work" behind the scenes; in fact, these clients will also hide it from the sessions list to avoid confusion. Support is not widespread yet but it has been tested with matrix-js-sdk clients such as Element-web. This feature was commissioned and made public by an enterprise sponsor.
-
-- Notification panel (the 🔔 button) has been implemented in (#201). Even though Element-web now requires enabling it in the Labs menu, the underlying support (`GET /_matrix/client/v3/notifications`) enhances the push-notification handling of other clients.
-
-- Live room previews are now available. This support (`GET /_matrix/client/v3/events`) allows users, including guests, to sync updates for a public room without joining (4afd6f347b1).
-
-- Thanks to a suggestion by @cyberdoors in (#29), the configuration option `encryption_enabled_by_default_for_room_type` is now available. This feature can enable encryption for a room even when the client does not. The values `all` or `invite` are accepted, the latter roughly meaning DM's only. Neither are enabled by default.
-
-### Enhancements
-
-- Thank you @tototomate123 for improving the reverse-proxy docs, adding dedicated pages for both [Caddy](https://github.com/matrix-construct/tuwunel/blob/e0a997c22784b453735b24907e607412b153ba56/docs/deploying/reverse-proxy-caddy.md) and [Nginx](https://github.com/matrix-construct/tuwunel/blob/e0a997c22784b453735b24907e607412b153ba56/docs/deploying/reverse-proxy-nginx.md) in (#209). Thanks to @tycode for pointing out the docs were missing for alternative proxies in (#197).
-
-- Thanks to an observation by @iwalkalone69 in (#40), the last-seen time for a device in the session list is now updated acceptably. This function piggybacks on the presence system to prevent writing too frequently; testing has never shown it more than a minute or few out of date.
-
-- Thanks to an inquiry by @EntityinArray in (#189) guest-accounts can now be enabled while registration tokens are also enabled to prevent fully open account registration. Note that registration tokens don't apply to guest-accounts and those are still fully open.
-
-- Courtesy of @dasha-uwu the list of servers attempted when joining a room is now properly shuffled to increase the odds of finding a viable server, especially if an additional join attempt is made.
-
-### Bug Fixes
-
-- Special thanks to @BVollmerhaus for finding the TURN secret file configured by `turn_secret_file` was broken in (#211), forcing users to configure `turn_secret` directly. Thank you for fixing this in (#212).
-
-- Thank you @scvalex for updating the nix build for Tuwunel's integration tests and re-enabling all checks. (#215)
-
-- Thanks to a report by @Anagastes in (#146) **Nheko and NeoChat users can now enjoy properly verified devices.** Special thanks for the assistance of @deepbluev7 with diagnosing the cross-signing signature issue.
-
-- Database columns intended for deletion, notably `roomsynctoken_shortstatehash`, never had the deletion command actually invoked on them 😭 explaining the lack of enthusiasm after the 1.4.3 release introduced stateless sync. **Users will now see the free disk space they were promised.** This was uncovered during an unrelated issue investigation courtesy of @frebib.
-
-- Thanks to investigation by @dasha-uwu the pagination tokens in the `/relations` endpoint were buggy and now operate correctly.
-
-- Thanks to @Polve for identifying the `DynamicUser=yes` directive in the systemd files was invalid and advising a replacement in (#207).
-
-- Thanks to @daudix for reporting an edge-case where the server will refuse to start rather than robustly reporting errors during startup checks and recreate a missing media directory (#213).
-
-- Push rule evaluation was never implemented for invites arriving over federation. Notifications are now properly sent in this case.
-
-- Sliding-sync handlers were susceptible to errors under rare circumstances escaping to cause an HTTP 500, which wreaks havoc on the rust-sdk. This has now been prevented.
-
-- Federating with Conduit over several non-essential endpoints was broken. It is unclear whether this affected an actual Conduit release version, but thanks to @kladki a fix is scheduled and we have included a workaround now on this end.

SECURITY.md

@@ -0,0 +1,108 @@
+# Security Policy for Continuwuity
+
+This document outlines the security policy for Continuwuity. Our goal is to maintain a secure platform for all users,
+and we take security matters seriously.
+
+## Supported Versions
+
+We provide security updates for the following versions of Continuwuity:
+
+| Version        | Supported |
+|----------------|:---------:|
+| Latest release |     ✅     |
+| Main branch    |     ✅     |
+| Older releases |     ❌     |
+
+We may backport fixes to the previous release at our discretion, but we don't guarantee this; our versioning is designed
+to encourage users to stay up-to-date with the latest release, and we have no concept of "long term support".
+
+## Reporting a Vulnerability
+
+### Responsible Disclosure
+
+We appreciate the efforts of security researchers and the community in identifying and reporting vulnerabilities. To
+ensure that potential vulnerabilities are addressed properly, please follow these guidelines:
+
+1. **Contact members of the team directly** over E2EE private message.
+    - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
+    - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
+    - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
+2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so
+   don't include sensitive details.
+3. **Do not disclose the vulnerability publicly** until a fix has been pushed to the main branch.
+4. **Provide detailed information** about the vulnerability, including:
+    - A clear description of the issue
+    - Steps to reproduce
+    - Potential impact
+    - Any possible mitigations
+    - Version(s) affected, including specific commits if possible
+    - How you want to be attributed if your report is accepted (website, social media handle, Matrix user ID, etc).
+      **Please state explicitly if you wish to remain anonymous.**
+
+If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that
+you bother us, instead of having a vulnerability disclosed without a fix.
+
+### Terms for credit
+
+Before reporting a vulnerability, please remember that we are a small team maintaining a large codebase depended upon by
+a vast unknown number of users in our free time. While we always investigate *all* security reports, we may not
+acknowledge or credit your report under certain circumstances.
+
+#### Following the security policy
+
+If you do not report the vulnerability following this security policy, your report may be ignored and/or may not be
+credited if fixed. This includes filing for GitHub security advisories without contacting us directly first (we do not
+get notified about these!).
+
+#### Automation-assisted reports
+
+Reports assisted by automatic tooling such as LLMs MUST disclose such in the report.
+Assisted reports must also produce a working proof-of-concept (PoC) demonstrating the vulnerability against the latest
+release and/or main commit with no modifications to the codebase. This is to demonstrate that not only does
+the author understand the vulnerability that they are reporting, but also that the vulnerability is reproducible
+and not a false positive.
+
+#### Reports for known issues
+
+Reports for issues we are already aware of will only be credited if subsequent reporters provide new information.
+
+#### Audits and CVE farming
+
+Sweeping audits (vulnerability hunting) **must** be coordinated with the team first - receiving a rapsheet of new
+vulnerabilities is explicitly not helpful to us and only harms the project. If you are interested in performing a
+security audit, please contact us first to discuss the scope and methodology.
+
+Likewise, CVE farming (reporting vulnerabilities with the primary intent to get a CVE number) is actively harmful to the
+project, and will not be credited. Severe violations of this policy will result in a permanent ban from collaborating
+with the project in any capacity. We are attempting to build high quality free software, not flesh out your CV/resume.
+
+### What to expect
+
+When you report a security vulnerability:
+
+1. **Acknowledgment**: We will acknowledge receipt of your report. We may ask for further information.
+2. **Triage**: The report will be triaged into our internal tracker, and you will be provided with a reference number (
+   in case you end up with multiple reports). An ETA for a fix will be provided if feasible.
+3. **Updates**: We will provide updates on our progress in addressing the vulnerability, including a heads-up for when
+   we plan to release a fix.
+4. **Resolution**: Once resolved, we will notify you and discuss coordinated disclosure
+5. **Credit**: We will recognize your contribution (unless you prefer to remain anonymous)
+
+## Security Update Process
+
+When security vulnerabilities are identified:
+
+1. We will develop and test fixes in a private fork
+2. Security updates will be released as soon as possible
+3. Release notes will include information about the vulnerabilities, avoiding details that could facilitate exploitation
+   where possible
+4. Critical security updates may be backported to the previous stable release
+
+## Additional Resources
+
+- [Matrix Security Disclosure Policy](https://matrix.org/security-disclosure-policy/)
+- [Continuwuity Documentation](https://continuwuity.org/introduction)
+
+---
+
+This security policy was last updated on May 25, 2025.

bin/complement

@@ -2,20 +2,19 @@
 
 set -euo pipefail
 
-# Path to Complement's source code
-#
-# The `COMPLEMENT_SRC` environment variable is set in the Nix dev shell, which
-# points to a store path containing the Complement source code. It's likely you
-# want to just pass that as the first argument to use it here.
+# The root path where complement is available.
 COMPLEMENT_SRC="${COMPLEMENT_SRC:-$1}"
 
 # A `.jsonl` file to write test logs to
-LOG_FILE="${2:-complement_test_logs.jsonl}"
+LOG_FILE="${2:-tests/test_results/complement/test_logs.jsonl}"
 
 # A `.jsonl` file to write test results to
-RESULTS_FILE="${3:-complement_test_results.jsonl}"
+RESULTS_FILE="${3:-tests/test_results/complement/test_results.jsonl}"
 
-COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-complement-tuwunel:main}"
+# The base docker image to use for complement tests
+# You can build the default with `docker build -t continuwuity:complement -f ./docker/complement.Dockerfile .`
+# after running `cargo build`. Only the debug binary is used.
+COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-continuwuity:complement}"
 
 # Complement tests that are skipped due to flakiness/reliability issues or we don't implement such features and won't for a long time
 SKIPPED_COMPLEMENT_TESTS='TestPartialStateJoin.*|TestRoomDeleteAlias/Parallel/Regular_users_can_add_and_delete_aliases_when_m.*|TestRoomDeleteAlias/Parallel/Can_delete_canonical_alias|TestUnbanViaInvite.*|TestRoomState/Parallel/GET_/publicRooms_lists.*"|TestRoomDeleteAlias/Parallel/Users_with_sufficient_power-level_can_delete_other.*'
@@ -34,25 +33,6 @@ toplevel="$(git rev-parse --show-toplevel)"
 
 pushd "$toplevel" > /dev/null
 
-if [ ! -f "complement_oci_image.tar.gz" ]; then
-    echo "building complement tuwunel image"
-
-    # if using macOS, use linux-complement
-    #bin/nix-build-and-cache just .#linux-complement
-    bin/nix-build-and-cache just .#complement
-    #nix build -L .#complement
-
-    echo "complement tuwunel image tar.gz built at \"result\""
-
-    echo "loading into docker"
-    docker load < result
-    popd > /dev/null
-else
-    echo "skipping building a complement tuwunel image as complement_oci_image.tar.gz was already found, loading this"
-
-    docker load < complement_oci_image.tar.gz
-    popd > /dev/null
-fi
 
 echo ""
 echo "running go test with:"
@@ -72,24 +52,16 @@ env \
 set -o pipefail
 
 # Post-process the results into an easy-to-compare format, sorted by Test name for reproducible results
-cat "$LOG_FILE" | jq -s -c 'sort_by(.Test)[]' | jq -c '
+jq -s -c 'sort_by(.Test)[]' < "$LOG_FILE" | jq -c '
     select(
         (.Action == "pass" or .Action == "fail" or .Action == "skip")
         and .Test != null
     ) | {Action: .Action, Test: .Test}
     ' > "$RESULTS_FILE"
 
-#if command -v gotestfmt &> /dev/null; then
-#    echo "using gotestfmt on $LOG_FILE"
-#    grep '{"Time":' "$LOG_FILE" | gotestfmt > "complement_test_logs_gotestfmt.log"
-#fi
-
 echo ""
 echo ""
 echo "complement logs saved at $LOG_FILE"
 echo "complement results saved at $RESULTS_FILE"
-#if command -v gotestfmt &> /dev/null; then
-#    echo "complement logs in gotestfmt pretty format outputted at complement_test_logs_gotestfmt.log (use an editor/terminal/pager that interprets ANSI colours and UTF-8 emojis)"
-#fi
 echo ""
 echo ""

bin/nix-build-and-cache

@@ -18,7 +18,7 @@ just() {
         return
     fi
 
-    # historical "conduit" store for compatibility purposes, same as tuwunel
+    # historical "conduit" store for compatibility purposes, same as conduwuit
     nix run --inputs-from "$toplevel" attic -- \
         login \
         conduit \
@@ -52,26 +52,26 @@ just() {
         withattic conduit || withattic conduit || withattic conduit || true
     )
 
-    # main "tuwunel" store
+    # main "conduwuit" store
     nix run --inputs-from "$toplevel" attic -- \
         login \
-        tuwunel \
-        "${ATTIC_ENDPOINT:-https://attic.kennel.juneis.dog/tuwunel}" \
+        conduwuit \
+        "${ATTIC_ENDPOINT:-https://attic.kennel.juneis.dog/conduwuit}" \
         "$ATTIC_TOKEN"
 
-    # Upload them to Attic (tuwunel store) and Cachix
+    # Upload them to Attic (conduwuit store) and Cachix
     #
     # Use `xargs` and a here-string because something would probably explode if
     # several thousand arguments got passed to a command at once. Hopefully no
     # store paths include a newline in them.
     (
         IFS=$'\n'
-        withattic tuwunel || withattic tuwunel || withattic tuwunel || true
+        withattic conduwuit || withattic conduwuit || withattic conduwuit || true
 
         # push to cachix if available
         if [ "$CACHIX_AUTH_TOKEN" ]; then
             nix shell --inputs-from "$toplevel" cachix -c xargs \
-            cachix push tuwunel <<< "${cache[*]}"
+            cachix push conduwuit <<< "${cache[*]}"
         fi
     )
 }

book.toml

@@ -1,30 +0,0 @@
-[book]
-authors = [
-	"girlbossceo",
-	"jevolk"
-]
-description = "Tuwunel, a high performance successor to Conduit and Conduwuit"
-language = "en"
-multilingual = false
-src = "docs"
-title = "Tuwunel One"
-text-direction = "ltr"
-
-[build]
-build-dir = "public"
-create-missing = true
-extra-watch-dirs = [
-	"debian",
-	"docs",
-]
-
-[rust]
-edition = "2024"
-
-[output.html]
-git-repository-url = "https://github.com/matrix-construct/tuwunel"
-edit-url-template = "https://github.com/matrix-construct/tuwunel/edit/main/{path}"
-git-repository-icon = "fa-github-square"
-
-[output.html.search]
-limit-results = 15

changelog.d/+18458843.doc.md

@@ -0,0 +1 @@
+Update backup instructions: the right paths for `.sst` files are now in `$DATABASE_BACKUP_PATH/private/<number>` path instead of `$DATABASE_BACKUP_PATH/<number>`. Contributed by @stratself

changelog.d/+3ec50619.feature.md

@@ -0,0 +1 @@
+Added MSC4480 sticky events to simplified sliding sync. Contributed by @eleboucher.

changelog.d/+68544237.doc.md

@@ -0,0 +1 @@
+Replace deprecated `docker-compose` commands with `docker compose` to reflect latest Docker changes.

changelog.d/+7fd21c4a.bugfix.md

@@ -0,0 +1 @@
+Fixed typing notifications not interrupting a sync long poll. Contributed by @eleboucher.

changelog.d/+9026b8d6.misc.md

@@ -0,0 +1 @@
+Updated Ruma dependencies. Contributed by @eleboucher.

changelog.d/+98192112.bugfix.md

@@ -0,0 +1 @@
+Fixed missed wake-ups and stale responses in legacy and sliding sync long polls. Contributed by @eleboucher.

changelog.d/+c648d687.doc.md

@@ -0,0 +1 @@
+Livekit docs: `room.auto_create: false` is now included in default `livekit.yaml`, following `lk-jwt-service` recommendation.

changelog.d/+c9e34885.doc.md

@@ -0,0 +1 @@
+Add caveat and workaround for container resolution (e.g. for dockerized appservices) when using mounted `/etc/resolv.conf`. Contributed by @stratself

changelog.d/+cf65f70c.feature.md

@@ -0,0 +1 @@
+Added MSC4354 sticky events, behind the `allow_sticky_events` config option. Contributed by @eleboucher.

changelog.d/+ee3b3204.bugfix.md

@@ -0,0 +1 @@
+Added MSC4186 direct, encrypted, and room-type list filters, resolving invited rooms from their stripped invite state. Contributed by @eleboucher.

changelog.d/+receipt-packing.bugfix.md

@@ -0,0 +1 @@
+Preserve all users' read receipts when batching room receipt updates.

changelog.d/1740.doc

@@ -0,0 +1 @@
+Refactor TURN docs and remove unsafe setups. Polish LiveKit docs. Add guidance for TURNS-over-443 multiplexing for both LiveKit and legacy calls. Contributed by @stratself

changelog.d/2033.misc

@@ -0,0 +1 @@
+Updated admin command names (list-users -> list, list-rooms -> list, and reload-mods -> reload), old names are now aliases. Contributed by @PerformativeJade

changelog.d/2079.doc

@@ -0,0 +1 @@
+Updated the docs to reflect the current default User-Agent for URL previews

changelog.d/2082.bugfix.md

@@ -0,0 +1 @@
+Resolve membership service by correct name for auto-join. Contributed by @Aranjedeath

changelog.d/2106.bugfix.md

@@ -0,0 +1 @@
+Plugged a logic gap that may have been allowing Continuwuity to process events with incorrect room versions under certain conditions. Contributed by @nex.

changelog.d/2107.doc.md

@@ -0,0 +1 @@
+Added missing documentation to config parameters. Contributed by @renegadespork

changelog.d/2110.bugfix.md

@@ -0,0 +1 @@
+The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. The token endpoint now returns the `unauthorized_client` error code when a client requests a grant type it did not register, instead of `invalid_grant`. Contributed by @mmaudet.

clippy.toml

@@ -1,20 +1,32 @@
 array-size-threshold = 4096
-cognitive-complexity-threshold = 100        # TODO reduce me ALARA
-excessive-nesting-threshold = 8
-future-size-threshold = 8192
+cognitive-complexity-threshold = 94         # TODO reduce me ALARA
+excessive-nesting-threshold = 11            # TODO reduce me to 4 or 5
+future-size-threshold = 7745                # TODO reduce me ALARA
 stack-size-threshold = 196608               # TODO reduce me ALARA
 too-many-lines-threshold = 780              # TODO reduce me to <= 100
 type-complexity-threshold = 250             # reduce me to ~200
 large-error-threshold = 256                 # TODO reduce me ALARA
 
-#disallowed-macros = [
-#	{ path = "log::error", reason = "use tuwunel_core::error" },
-#	{ path = "log::warn", reason = "use tuwunel_core::warn" },
-#	{ path = "log::info", reason = "use tuwunel_core::info" },
-#	{ path = "log::debug", reason = "use tuwunel_core::debug" },
-#	{ path = "log::trace", reason = "use tuwunel_core::trace" },
-#]
+disallowed-macros = [
+	{ path = "log::error", reason = "use conduwuit_core::error" },
+	{ path = "log::warn", reason = "use conduwuit_core::warn" },
+	{ path = "log::info", reason = "use conduwuit_core::info" },
+	{ path = "log::debug", reason = "use conduwuit_core::debug" },
+	{ path = "log::trace", reason = "use conduwuit_core::trace" },
+]
 
-#disallowed-methods = [
-#	{ path = "tokio::spawn", reason = "use and pass tuwunel_core::server::Server::runtime() to spawn from" },
-#]
+[[disallowed-methods]]
+path = "tokio::spawn"
+reason = "use and pass conduwuit_core::server::Server::runtime() to spawn from"
+
+[[disallowed-methods]]
+path = "reqwest::Response::bytes"
+reason = "bytes is unsafe, use limit_read via the conduwuit_core::utils::LimitReadExt trait instead"
+
+[[disallowed-methods]]
+path = "reqwest::Response::text"
+reason = "text is unsafe, use limit_read_text via the conduwuit_core::utils::LimitReadExt trait instead"
+
+[[disallowed-methods]]
+path = "reqwest::Response::json"
+reason = "json is unsafe, use limit_read_text via the conduwuit_core::utils::LimitReadExt trait instead"

committed.toml

@@ -0,0 +1,3 @@
+style = "conventional"
+subject_length = 72
+allowed_types = ["ci", "build", "fix", "feat", "chore", "docs", "style", "refactor", "perf", "test"]

complement/complement-entrypoint.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -xe
+# If we have no $SERVER_NAME set, abort
+if [ -z "$SERVER_NAME" ]; then
+  echo "SERVER_NAME is not set, aborting"
+  exit 1
+fi
+
+# If /complement/ca/ca.crt or /complement/ca/ca.key are missing, abort
+if [ ! -f /complement/ca/ca.crt ] || [ ! -f /complement/ca/ca.key ]; then
+  echo "/complement/ca/ca.crt or /complement/ca/ca.key is missing, aborting"
+  exit 1
+fi
+
+# Add the root cert to the local trust store
+echo 'Installing Complement CA certificate to local trust store'
+cp /complement/ca/ca.crt /usr/local/share/ca-certificates/complement-ca.crt
+update-ca-certificates
+
+# Sign a certificate for our $SERVER_NAME
+echo "Generating and signing certificate for $SERVER_NAME"
+openssl genrsa -out "/$SERVER_NAME.key" 2048
+
+echo "Generating CSR for $SERVER_NAME"
+openssl req -new -sha256 \
+  -key "/$SERVER_NAME.key" \
+  -out "/$SERVER_NAME.csr" \
+  -subj "/C=US/ST=CA/O=Continuwuity, Inc./CN=$SERVER_NAME"\
+  -addext "subjectAltName=DNS:$SERVER_NAME"
+openssl req -in "$SERVER_NAME.csr" -noout -text
+
+echo "Signing certificate for $SERVER_NAME with Complement CA"
+cat <<EOF > ./cert.ext
+authorityKeyIdentifier=keyid,issuer
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment, dataEncipherment, nonRepudiation
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = *.docker.internal
+DNS.2 = hs1
+DNS.3 = hs2
+DNS.4 = hs3
+DNS.5 = hs4
+DNS.6 = $SERVER_NAME
+IP.1 = 127.0.0.1
+EOF
+openssl x509 \
+  -req \
+  -in "/$SERVER_NAME.csr" \
+  -CA /complement/ca/ca.crt \
+  -CAkey /complement/ca/ca.key \
+  -CAcreateserial \
+  -out "/$SERVER_NAME.crt" \
+  -days 1 \
+  -sha256 \
+  -extfile ./cert.ext
+
+# Tell continuwuity where to find the certs
+export CONTINUWUITY_TLS__KEY="/$SERVER_NAME.key"
+export CONTINUWUITY_TLS__CERTS="/$SERVER_NAME.crt"
+# And who it is
+export CONTINUWUITY_SERVER_NAME="$SERVER_NAME"
+
+echo "Starting Continuwuity with SERVER_NAME=$SERVER_NAME"
+# Start continuwuity
+/usr/local/bin/conduwuit --config /etc/continuwuity/config.toml

complement/complement.config.toml

@@ -1,12 +1,16 @@
+# ============================================= #
+# Complement pre-filled configuration file      #
+#
+# DANGER: THIS FILE FORCES INSECURE VALUES.     #
+# DO NOT USE OUTSIDE THE TEST SUITE ENV!        #
+# ============================================= #
 [global]
 address = "0.0.0.0"
 allow_device_name_federation = true
-allow_guest_registration = true
 allow_public_room_directory_over_federation = true
-allow_public_room_directory_without_auth = true
 allow_registration = true
 database_path = "/database"
-log = "trace,h2=debug,hyper=debug"
+log = "trace,h2=debug,hyper=debug,conduwuit_database=warn,conduwuit_service::manager=info,conduwuit_api::router=error,conduwuit_router=error,tower_http=error"
 port = [8008, 8448]
 trusted_servers = []
 only_query_trusted_key_servers = false
@@ -19,7 +23,7 @@ url_preview_domain_explicit_denylist = ["*"]
 media_compat_file_link = false
 media_startup_check = true
 prune_missing_media = true
-log_colors = true
+log_colors = false
 admin_room_notices = false
 allow_check_for_updates = false
 intentionally_unknown_config_option_for_testing = true
@@ -27,14 +31,10 @@ rocksdb_log_level = "info"
 rocksdb_max_log_files = 1
 rocksdb_recovery_mode = 0
 rocksdb_paranoid_file_checks = true
-log_guest_registrations = false
 allow_legacy_media = true
 startup_netburst = true
 startup_netburst_keep = -1
-
 allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure = true
-
-# valgrind makes things so slow
 dns_timeout = 60
 dns_attempts = 20
 request_conn_timeout = 60
@@ -45,6 +45,7 @@ federation_idle_timeout = 300
 sender_timeout = 300
 sender_idle_timeout = 300
 sender_retry_backoff_limit = 300
+force_disable_first_run_mode = true
 
 [global.tls]
 dual_protocol = true

debian/README.md

@@ -1,36 +0,0 @@
-# Tuwunel for Debian
-
-Information about downloading and deploying the Debian package. This may also be
-referenced for other `apt`-based distros such as Ubuntu.
-
-### Installation
-
-It is recommended to see the [generic deployment guide](../deploying/generic.md)
-for further information if needed as usage of the Debian package is generally
-related.
-
-No `apt` repository is currently offered yet, it is in the works/development.
-
-### Configuration
-
-When installed, the example config is placed at `/etc/tuwunel/tuwunel.toml`
-as the default config. The config mentions things required to be changed before
-starting.
-
-You can tweak more detailed settings by uncommenting and setting the config
-options in `/etc/tuwunel/tuwunel.toml`.
-
-### Running
-
-The package uses the [`tuwunel.service`](../configuration/examples.md#example-systemd-unit-file)
-systemd unit file to start and stop Tuwunel. The binary is installed at `/usr/sbin/tuwunel`.
-
-This package assumes by default that Tuwunel will be placed behind a reverse
-proxy. The default config options apply (listening on `localhost` and TCP port
-`6167`). Matrix federation requires a valid domain name and TLS, so you will
-need to set up TLS certificates and renewal for it to work properly if you
-intend to federate.
-
-Consult various online documentation and guides on setting up a reverse proxy
-and TLS. Caddy is documented at the [generic deployment guide](../deploying/generic.md#setting-up-the-reverse-proxy)
-as it's the easiest and most user friendly.

debian/postinst

@@ -1,47 +0,0 @@
-#!/bin/sh
-set -e
-
-# TODO: implement debconf support that is maintainable without duplicating the config
-#. /usr/share/debconf/confmodule
-
-TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
-TUWUNEL_CONFIG_PATH=/etc/tuwunel
-
-case "$1" in
-  configure)
-    # Create the `tuwunel` user if it does not exist yet.
-    if ! getent passwd tuwunel > /dev/null ; then
-      echo 'Adding system user for the tuwunel Matrix homeserver' 1>&2
-      adduser --system --group --quiet \
-        --home "$TUWUNEL_DATABASE_PATH" \
-        --disabled-login \
-        --shell "/usr/sbin/nologin" \
-        tuwunel
-    fi
-
-    # Create the database path if it does not exist yet and fix up ownership
-    # and permissions for the config.
-    mkdir -v -p "$TUWUNEL_DATABASE_PATH"
-
-    # symlink the previous location for compatibility if it does not exist yet.
-    if ! test -L "/var/lib/matrix-conduit" ; then
-        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/matrix-conduit"
-    fi
-    if ! test -L "/var/lib/conduwuit" ; then
-        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/conduwuit"
-    fi
-
-    chown -v tuwunel:tuwunel -R "$TUWUNEL_DATABASE_PATH"
-    chown -v tuwunel:tuwunel -R "$TUWUNEL_CONFIG_PATH"
-
-    chmod -v 740 "$TUWUNEL_DATABASE_PATH"
-
-    echo ''
-    echo 'Make sure you edit the example config at /etc/tuwunel/tuwunel.toml before starting!'
-    echo 'To start the server, run: systemctl start tuwunel.service'
-    echo ''
-
-    ;;
-esac
-
-#DEBHELPER#

debian/postrm

@@ -1,52 +0,0 @@
-#!/bin/sh
-set -e
-
-#. /usr/share/debconf/confmodule
-
-TUWUNEL_CONFIG_PATH=/etc/tuwunel
-TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
-CONDUIT_DATABASE_PATH_SYMLINK=/var/lib/matrix-conduit
-CONDUWUIT_DATABASE_PATH_SYMLINK=/var/lib/conduwuit
-
-case $1 in
-  purge)
-    # Remove debconf changes from the db
-    #db_purge
-
-    # Per https://www.debian.org/doc/debian-policy/ch-files.html#behavior
-    # "configuration files must be preserved when the package is removed, and
-    #  only deleted when the package is purged."
-
-    #
-
-    if [ -d "$TUWUNEL_CONFIG_PATH" ]; then
-      if test -L "$TUWUNEL_CONFIG_PATH"; then
-        echo "Deleting tuwunel configuration files"
-        rm -v -r "$TUWUNEL_CONFIG_PATH"
-      fi
-    fi
-
-    if [ -d "$TUWUNEL_DATABASE_PATH" ]; then
-      if test -L "$TUWUNEL_DATABASE_PATH"; then
-        echo "Deleting tuwunel database directory"
-        rm -r "$TUWUNEL_DATABASE_PATH"
-      fi
-    fi
-
-    if [ -d "$CONDUIT_DATABASE_PATH_SYMLINK" ]; then
-      if test -L "$CONDUIT_DATABASE_SYMLINK"; then
-        echo "Removing matrix-conduit symlink"
-        rm -r "$CONDUIT_DATABASE_PATH_SYMLINK"
-      fi
-    fi
-
-    if [ -d "$CONDUWUIT_DATABASE_PATH_SYMLINK" ]; then
-      if test -L "$CONDUWUIT_DATABASE_SYMLINK"; then
-        echo "Removing conduwuit symlink"
-        rm -r "$CONDUWUIT_DATABASE_PATH_SYMLINK"
-      fi
-    fi
-    ;;
-esac
-
-#DEBHELPER#

debian/tuwunel.service

@@ -1,65 +0,0 @@
-[Unit]
-Description=Tuwunel Matrix homeserver
-Wants=network-online.target
-After=network-online.target
-Documentation=https://tuwunel.chat/
-
-[Service]
-User=tuwunel
-Group=tuwunel
-Type=notify
-
-Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
-
-ExecStart=/usr/sbin/tuwunel
-
-ReadWritePaths=/var/lib/tuwunel /etc/tuwunel
-
-AmbientCapabilities=
-CapabilityBoundingSet=
-
-DevicePolicy=closed
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-NoNewPrivileges=yes
-#ProcSubset=pid
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=yes
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectProc=invisible
-ProtectSystem=strict
-PrivateDevices=yes
-PrivateMounts=yes
-PrivateTmp=yes
-PrivateUsers=yes
-PrivateIPC=yes
-RemoveIPC=yes
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native
-SystemCallFilter=@system-service @resources
-SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
-SystemCallErrorNumber=EPERM
-#StateDirectory=tuwunel
-
-RuntimeDirectory=tuwunel
-RuntimeDirectoryMode=0750
-
-Restart=on-failure
-RestartSec=5
-
-TimeoutStopSec=2m
-TimeoutStartSec=2m
-
-StartLimitInterval=1m
-StartLimitBurst=5
-
-[Install]
-WantedBy=multi-user.target
-Alias=matrix-tuwunel.service

development.md

@@ -1 +1 @@
-docs/development.md
+docs/development/index.mdx

docker/Dockerfile

@@ -0,0 +1,288 @@
+ARG RUST_VERSION=1
+ARG DEBIAN_VERSION=trixie
+
+FROM --platform=$BUILDPLATFORM docker.io/tonistiigi/xx AS xx
+FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-slim-${DEBIAN_VERSION} AS base
+FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-slim-${DEBIAN_VERSION} AS toolchain
+
+# Prevent deletion of apt cache
+RUN rm -f /etc/apt/apt.conf.d/docker-clean
+
+# Match Rustc version as close as possible
+# rustc -vV
+ARG LLVM_VERSION=22
+# ENV RUSTUP_TOOLCHAIN=${RUST_VERSION}
+
+# Install repo tools
+# Line one: compiler tools
+# Line two: curl, for downloading binaries and wget because llvm.sh is broken with curl
+# Line three: for xx-verify
+# golang, cmake: For aws-lc-rs bindgen
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y \
+    pkg-config make jq \
+    wget curl git lsb-release gpg \
+    file
+    # golang cmake
+
+# LLVM packages
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    curl https://apt.llvm.org/llvm.sh > llvm.sh && \
+    chmod +x llvm.sh && \
+    ./llvm.sh ${LLVM_VERSION} && \
+    rm llvm.sh
+
+# Create symlinks for LLVM tools
+RUN <<EOF
+    set -o xtrace
+    # clang
+    ln -s /usr/bin/clang-${LLVM_VERSION} /usr/bin/clang
+    ln -s "/usr/bin/clang++-${LLVM_VERSION}" "/usr/bin/clang++"
+    # lld
+    ln -s /usr/bin/ld64.lld-${LLVM_VERSION} /usr/bin/ld64.lld
+    ln -s /usr/bin/ld.lld-${LLVM_VERSION} /usr/bin/ld.lld
+    ln -s /usr/bin/lld-${LLVM_VERSION} /usr/bin/lld
+    ln -s /usr/bin/lld-link-${LLVM_VERSION} /usr/bin/lld-link
+    ln -s /usr/bin/wasm-ld-${LLVM_VERSION} /usr/bin/wasm-ld
+EOF
+
+# Developer tool versions
+# renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
+ENV BINSTALL_VERSION=1.21.1
+# renovate: datasource=github-releases depName=psastras/sbom-rs
+ENV CARGO_SBOM_VERSION=0.9.1
+# renovate: datasource=crate depName=lddtree
+ENV LDDTREE_VERSION=0.5.0
+# renovate: datasource=crate depName=timelord-cli
+ENV TIMELORD_VERSION=3.0.1
+
+# Install unpackaged tools
+RUN <<EOF
+    set -o xtrace
+    curl --retry 5 -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+    cargo binstall --no-confirm cargo-sbom --version $CARGO_SBOM_VERSION
+    cargo binstall --no-confirm lddtree --version $LDDTREE_VERSION
+    cargo binstall --no-confirm timelord-cli --version $TIMELORD_VERSION
+EOF
+
+# Set up xx (cross-compilation scripts)
+COPY --from=xx / /
+ARG TARGETPLATFORM
+
+# Install libraries linked by the binary
+# xx-* are xx-specific meta-packages
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    xx-apt-get install -y \
+    xx-c-essentials xx-cxx-essentials pkg-config \
+    liburing-dev
+
+# Set up Rust toolchain
+WORKDIR /app
+COPY ./rust-toolchain.toml .
+RUN rustc --version \
+    && xx-cargo --setup-target-triple
+
+# Build binary
+# Configure incremental compilation based on build context
+ARG CARGO_INCREMENTAL=0
+RUN echo "CARGO_INCREMENTAL=${CARGO_INCREMENTAL}" >> /etc/environment
+
+# Configure pkg-config
+RUN <<EOF
+    set -o xtrace
+    if command -v "$(xx-info)-pkg-config" >/dev/null 2>/dev/null; then
+        echo "PKG_CONFIG_LIBDIR=/usr/lib/$(xx-info)/pkgconfig" >> /etc/environment
+        echo "PKG_CONFIG=/usr/bin/$(xx-info)-pkg-config" >> /etc/environment
+    fi
+    echo "PKG_CONFIG_ALLOW_CROSS=true" >> /etc/environment
+EOF
+
+# Configure cc to use clang version
+RUN <<EOF
+    set -o xtrace
+    echo "CC=clang" >> /etc/environment
+    echo "CXX=clang++" >> /etc/environment
+EOF
+
+# Cross-language LTO
+RUN <<EOF
+    set -o xtrace
+    echo "CFLAGS=-flto" >> /etc/environment
+    echo "CXXFLAGS=-flto" >> /etc/environment
+    # Linker is set to target-compatible clang by xx
+    echo "RUSTFLAGS='-Clinker-plugin-lto -Clink-arg=-fuse-ld=lld'" >> /etc/environment
+EOF
+
+# Apply CPU-specific optimizations if TARGET_CPU is provided
+ARG TARGET_CPU
+
+RUN <<EOF
+    set -o allexport
+    set -o xtrace
+    . /etc/environment
+    if [ -n "${TARGET_CPU}" ]; then
+        echo "CFLAGS='${CFLAGS} -march=${TARGET_CPU}'" >> /etc/environment
+        echo "CXXFLAGS='${CXXFLAGS} -march=${TARGET_CPU}'" >> /etc/environment
+        echo "RUSTFLAGS='${RUSTFLAGS} -C target-cpu=${TARGET_CPU}'" >> /etc/environment
+    fi
+EOF
+
+# Prepare output directories
+RUN mkdir /out
+
+FROM toolchain AS builder
+
+
+# Get source
+COPY . .
+
+# Restore timestamps from timelord cache if available
+RUN --mount=type=cache,target=/timelord/ \
+    echo "Restoring timestamps from timelord cache"; \
+    timelord sync --source-dir /app --cache-dir /timelord;
+
+ARG TARGETPLATFORM
+
+# Verify environment configuration
+RUN xx-cargo --print-target-triple
+
+# Conduwuit version info
+ARG GIT_COMMIT_HASH
+ARG GIT_COMMIT_HASH_SHORT
+ARG GIT_REMOTE_URL
+ARG GIT_REMOTE_COMMIT_URL
+ARG CONDUWUIT_VERSION_EXTRA
+ARG CONTINUWUITY_VERSION_EXTRA
+ENV GIT_COMMIT_HASH=$GIT_COMMIT_HASH
+ENV GIT_COMMIT_HASH_SHORT=$GIT_COMMIT_HASH_SHORT
+ENV GIT_REMOTE_URL=$GIT_REMOTE_URL
+ENV GIT_REMOTE_COMMIT_URL=$GIT_REMOTE_COMMIT_URL
+ENV CONDUWUIT_VERSION_EXTRA=$CONDUWUIT_VERSION_EXTRA
+ENV CONTINUWUITY_VERSION_EXTRA=$CONTINUWUITY_VERSION_EXTRA
+
+ARG RUST_PROFILE=release
+ARG CARGO_FEATURES="default"
+
+# Build the binary
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git/db \
+    --mount=type=cache,target=/app/target,id=continuwuity-cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-${RUST_PROFILE} \
+    bash <<'EOF'
+    set -euo pipefail
+    set -o allexport
+    set -o xtrace
+    . /etc/environment
+
+    # Check if http3 feature is enabled and set appropriate RUSTFLAGS
+    if echo "${CARGO_FEATURES}" | grep -q "http3"; then
+        export RUSTFLAGS="${RUSTFLAGS} --cfg reqwest_unstable"
+    else
+        export RUSTFLAGS="${RUSTFLAGS}"
+    fi
+
+    RUST_PROFILE_DIR="${RUST_PROFILE}"
+    if [[ "${RUST_PROFILE}" == "dev" ]]; then
+        RUST_PROFILE_DIR="debug"
+    fi
+
+    TARGET_DIR=($(cargo metadata --no-deps --format-version 1 | \
+            jq -r ".target_directory"))
+    mkdir /out/sbin
+    PACKAGE=conduwuit
+    CARGO_LOG=debug xx-cargo build --locked --profile ${RUST_PROFILE} \
+        --no-default-features --features ${CARGO_FEATURES} \
+        -p $PACKAGE;
+    BINARIES=($(cargo metadata --no-deps --format-version 1 | \
+        jq -r ".packages[] | select(.name == \"$PACKAGE\") | .targets[] | select( .kind | map(. == \"bin\") | any ) | .name"))
+    for BINARY in "${BINARIES[@]}"; do
+        echo $BINARY
+        xx-verify $TARGET_DIR/$(xx-cargo --print-target-triple)/${RUST_PROFILE_DIR}/$BINARY
+        cp $TARGET_DIR/$(xx-cargo --print-target-triple)/${RUST_PROFILE_DIR}/$BINARY /out/sbin/$BINARY
+    done
+EOF
+
+# Generate Software Bill of Materials (SBOM)
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git/db \
+    bash <<'EOF'
+    set -euo pipefail
+    set -o xtrace
+    mkdir /out/sbom
+    typeset -A PACKAGES
+    for BINARY in /out/sbin/*; do
+        BINARY_BASE=$(basename ${BINARY})
+        package=$(cargo metadata --no-deps --format-version 1 | jq -r ".packages[] | select(.targets[] | select( .kind | map(. == \"bin\") | any ) | .name == \"$BINARY_BASE\") | .name")
+        if [ -z "$package" ]; then
+            continue
+        fi
+        PACKAGES[$package]=1
+    done
+    for PACKAGE in $(echo ${!PACKAGES[@]}); do
+        echo $PACKAGE
+        cargo sbom --cargo-package $PACKAGE > /out/sbom/$PACKAGE.spdx.json
+    done
+EOF
+
+# Extract dynamically linked dependencies
+RUN <<'DEPS_EOF'
+    set -o xtrace
+    mkdir /out/libs /out/libs-root
+
+    # Process each binary
+    for BINARY in /out/sbin/*; do
+        if lddtree_output=$(lddtree "$BINARY" 2>/dev/null) && [ -n "$lddtree_output" ]; then
+            echo "$lddtree_output" | awk '{print $(NF-0) " " $1}' | sort -u -k 1,1 | \
+                awk '{dest = ($2 ~ /^\//) ? "/out/libs-root" $2 : "/out/libs/" $2; print "install -D " $1 " " dest}' | \
+                while read cmd; do eval "$cmd"; done
+        fi
+    done
+
+    # Show what will be copied to runtime
+    echo "=== Libraries being copied to runtime image:"
+    find /out/libs* -type f 2>/dev/null | sort || echo "No libraries found"
+DEPS_EOF
+
+FROM ubuntu:latest AS prepper
+
+# Create layer structure
+RUN mkdir -p /layer1/etc/ssl/certs \
+             /layer2/usr/lib \
+             /layer3/sbin /layer3/sbom
+
+# Copy SSL certs and root-path libraries to layer1 (ultra-stable)
+COPY --from=base /etc/ssl/certs /layer1/etc/ssl/certs
+COPY --from=builder /out/libs-root/ /layer1/
+
+# Copy application libraries to layer2 (semi-stable)
+COPY --from=builder /out/libs/ /layer2/usr/lib/
+
+# Copy binaries and SBOM to layer3 (volatile)
+COPY --from=builder /out/sbin/ /layer3/sbin/
+COPY --from=builder /out/sbom/ /layer3/sbom/
+
+# Fix permissions after copying
+RUN chmod -R 755 /layer1 /layer2 /layer3
+
+FROM scratch
+
+WORKDIR /
+
+# Copy ultra-stable layer (SSL certs, system libraries)
+COPY --from=prepper /layer1/ /
+
+# Copy semi-stable layer (application libraries)
+COPY --from=prepper /layer2/ /
+
+# Copy volatile layer (binaries, SBOM)
+COPY --from=prepper /layer3/ /
+
+# Inform linker where to find libraries
+ENV LD_LIBRARY_PATH=/usr/lib
+
+# Continuwuity default port
+EXPOSE 8008
+
+CMD ["/sbin/conduwuit"]

docker/Dockerfile.cargo

@@ -1,105 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS cargo
-ARG sys_triple
-ARG rust_target
-ARG rust_toolchain
-ARG RUST_HOME
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG cargo_share
-ARG CARGO_TERM_VERBOSE=0
-ARG RUST_BACKTRACE
-ARG JEMALLOC_OVERRIDE
-ARG ROCKSDB_LIB_DIR
-ARG VALGRINDFLAGS=""
-ARG CARGO_BUILD_RUSTFLAGS
-ARG CARGO_PROFILE_TEST_DEBUG
-ARG CARGO_PROFILE_TEST_INCREMENTAL
-ARG CARGO_PROFILE_BENCH_DEBUG
-ARG CARGO_PROFILE_BENCH_LTO
-ARG CARGO_PROFILE_RELEASE_LTO
-ARG CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG
-ARG CARGO_PROFILE_RELEASE_DEBUGINFO_LTO
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG cargo_cmd
-ARG color_args="--color always"
-ARG recipe_args=""
-ARG cargo_args=""
-ARG git_checkout
-ARG targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ARG targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
-
-WORKDIR /
-COPY --link --from=input . .
-COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
-COPY --link --from=deps /usr/src/tuwunel /usr/src/tuwunel
-
-WORKDIR /usr/lib/${sys_triple}
-COPY --link --from=rocksdb . .
-
-WORKDIR /usr/src/tuwunel
-SHELL ["/bin/bash", "-c"]
-ENV PATH="${CARGO_HOME}/bin:$PATH"
-ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
-ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
-ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
-ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
-ENV VALGRINDFLAGS="${VALGRINDFLAGS}"
-ENV CARGO_PROFILE_TEST_DEBUG="${CARGO_PROFILE_TEST_DEBUG}"
-ENV CARGO_PROFILE_TEST_INCREMENTAL="${CARGO_PROFILE_TEST_INCREMENTAL}"
-ENV CARGO_PROFILE_BENCH_DEBUG="${CARGO_PROFILE_BENCH_DEBUG}"
-ENV CARGO_PROFILE_BENCH_LTO="${CARGO_PROFILE_BENCH_LTO}"
-ENV CARGO_PROFILE_RELEASE_LTO="${CARGO_PROFILE_RELEASE_LTO}"
-ENV CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG="${CARGO_PROFILE_RELEASE_DEBUGINFO_DEBUG}"
-ENV CARGO_PROFILE_RELEASE_DEBUGINFO_LTO="${CARGO_PROFILE_RELEASE_DEBUGINFO_LTO}"
-ENV CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}"
-ENV CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-    set -eux
-    ulimit -n 65535
-
-    rustup run "${rust_toolchain}" \
-        cargo ${cargo_cmd} \
-            --verbose \
-            --locked \
-            --workspace \
-            "${cargo_spec_features}" \
-            "--features=${cargo_features}" \
-            "--profile=${cargo_profile}" \
-            "--target=${CARGO_TARGET}" \
-            "--target-dir=${CARGO_TARGET_DIR}" \
-            "--manifest-path=Cargo.toml" \
-            ${recipe_args} \
-            ${color_args} \
-            ${cargo_args}
-
-    # If this image is further reused with other cargo commands, all
-    # modifications made by cargo chef cook outside of target-dir have to be
-    # cleared. If not, resulting build artifacts will link incorrectly, even
-    # without error. For example, a target executable may be produced which
-    # does nothing except exit(0). If you have observed a smoketest failing in
-    # such a manner, investigate this as a cause of the issue.
-    git restore -W -S --source=${git_checkout} .
-EOF

docker/Dockerfile.cargo.audit

@@ -1,28 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS audit
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG audit_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        cargo audit \
-            --stale \
-            --deny yanked \
-            --deny unsound \
-            --deny unmaintained \
-            --deny warnings \
-            --color=always \
-            ${audit_args}
-EOF

docker/Dockerfile.cargo.deb

@@ -1,83 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS build-deb
-ARG rust_target
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG cargo_share
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ARG targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
-ARG pkg_dir
-ARG deb_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-    set -eux
-    mkdir -p "${pkg_dir}"
-    rustup run ${rust_toolchain} \
-        cargo deb \
-            --verbose \
-            --locked \
-            --no-build \
-            "${cargo_spec_features}" \
-            --features "${cargo_features}" \
-            --profile "${cargo_profile}" \
-            --target "${CARGO_TARGET}" \
-            --manifest-path Cargo.toml \
-            --multiarch same \
-            --compress-type gz \
-            --output "${pkg_dir}" \
-            ${deb_args}
-
-	mv ${pkg_dir}/* "${pkg_dir}/tuwunel.deb"
-	dpkg --info "${pkg_dir}/tuwunel.deb"
-	dpkg --contents "${pkg_dir}/tuwunel.deb"
-EOF
-
-
-FROM scratch AS deb
-ARG pkg_dir
-
-COPY --from=input ${pkg_dir}/tuwunel.deb .
-
-
-FROM input AS deb-install
-ARG pkg_dir
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${pkg_dir}
-COPY --from=deb . .
-RUN <<EOF
-	set -eux
-	dpkg --info tuwunel.deb
-	dpkg --contents tuwunel.deb
-	dpkg --install tuwunel.deb
-EOF

docker/Dockerfile.cargo.fmt

@@ -1,25 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS fmt
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG fmt_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        cargo fmt \
-            --all \
-            --check \
-            --manifest-path Cargo.toml \
-            ${fmt_args}
-EOF

docker/Dockerfile.cargo.lychee

@@ -1,36 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS lychee
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG lychee_cache_age="7d"
-ARG lychee_mode="color"
-# .lycheecache is hardcoded as path to reg file in the cwd so we execute lychee
-# in cache directory itself. all paths here should be absolute paths
-ARG lychee_args="/usr/src/tuwunel/docs /usr/src/tuwunel/*.md"
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=lychee,sharing=locked \
-<<EOF
-    set -eux
-    cd lychee
-    rustup run ${rust_toolchain} \
-        lychee \
-            --verbose \
-            --no-progress \
-            --offline \
-            --cache \
-            --max-cache-age "${lychee_cache_age}" \
-            --mode "${lychee_mode}" \
-            --exclude /usr/src/tuwunel/contributing.md \
-            --exclude /usr/src/tuwunel/development/testing.md \
-            ${lychee_args}
-EOF

docker/Dockerfile.cargo.rpm

@@ -1,76 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS build-rpm
-ARG rust_target
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG cargo_target_artifact
-ARG cargo_target_share
-ARG cargo_share
-ARG cargo_profile
-ARG cargo_features
-ARG cargo_spec_features
-ARG targ_dir="${CARGO_TARGET_DIR}/${cargo_target_profile}"
-ARG targ_targ_dir="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}"
-ARG pkg_dir
-ARG gen_rpm_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${targ_dir}/deps,id=${cargo_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_dir}/build,id=${cargo_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_dir}/examples,id=${cargo_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_dir}/incremental,id=${cargo_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_dir}/.fingerprint,id=${cargo_share}/fingerprint,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/deps,id=${cargo_target_share}/deps,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/build,id=${cargo_target_share}/build,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/examples,id=${cargo_target_share}/examples,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/incremental,id=${cargo_target_share}/incremental,sharing=locked \
---mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
-<<EOF
-	set -eux
-	mkdir -p "${pkg_dir}"
-	rustup run ${rust_toolchain} \
-		cargo generate-rpm \
-			--package src/main \
-			--auto-req auto \
-			--target "${CARGO_TARGET}" \
-			--target-dir "${CARGO_TARGET_DIR}" \
-			--profile "${cargo_profile}" \
-			--payload-compress zstd \
-			--output "${pkg_dir}" \
-			${gen_rpm_args}
-
-	mv ${pkg_dir}/* "${pkg_dir}/tuwunel.rpm"
-EOF
-
-
-FROM scratch AS rpm
-ARG pkg_dir
-
-COPY --from=input ${pkg_dir}/tuwunel.rpm .
-
-
-FROM input AS rpm-install
-ARG pkg_dir
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${pkg_dir}
-COPY --link --from=rpm . .
-RUN <<EOF
-	set -eux
-	rpm -i --test tuwunel.rpm
-	rpm -i tuwunel.rpm
-EOF

docker/Dockerfile.cargo.typos

@@ -1,25 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS typos
-ARG rust_toolchain="nightly"
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG typos_args=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
-<<EOF
-    set -eux
-    rustup run ${rust_toolchain} \
-        typos \
-            --color always \
-            --exclude docker \
-            --exclude nix \
-            ${typos_args}
-EOF

docker/Dockerfile.complement

@@ -1,210 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS key-gen
-
-WORKDIR /complement
-COPY <<EOF v3.ext
-    authorityKeyIdentifier=keyid,issuer
-    basicConstraints=CA:FALSE
-    keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
-    subjectAltName = @alt_names
-    [alt_names]
-    DNS.0 = *.docker.internal
-    DNS.1 = hs1
-    DNS.2 = hs2
-    DNS.3 = hs3
-    DNS.4 = hs4
-    IP.1 = 127.0.0.1
-EOF
-RUN <<EOF
-    set -eux
-    mkdir ca
-    openssl genrsa \
-        -out private_key.pem \
-        2048
-
-    openssl req \
-        -new \
-        -sha256 \
-        -key private_key.pem \
-        -subj "/C=US/ST=CA/O=MyOrg, Inc./CN=hs1" \
-        -addext "subjectAltName = DNS:*.docker.internal DNS:hs1, DNS:hs2, DNS:hs3, DNS:hs4, IP:127.0.0.1" \
-        -out signing_request.csr
-
-    openssl x509 \
-        -req \
-        -extfile v3.ext \
-        -in signing_request.csr \
-        -key private_key.pem \
-        -out certificate.crt \
-        -days 1 \
-        -sha256
-EOF
-RUN [ -f certificate.crt ] && [ -f private_key.pem ]
-
-
-FROM scratch AS complement-config
-WORKDIR /complement
-COPY --from=key-gen /complement/* .
-COPY --from=source /usr/src/tuwunel/tests/complement/results.jsonl old_results.jsonl
-COPY <<EOF complement.toml
-    [global]
-    address = "0.0.0.0"
-    admin_room_notices = false
-    allow_device_name_federation = true
-    allow_guest_registration = true
-    allow_invalid_tls_certificates = true
-    allow_legacy_media = true
-    allow_public_room_directory_over_federation = true
-    allow_public_room_directory_without_auth = true
-    allow_registration = true
-    create_admin_room = false
-    database_path = "/database"
-    dns_attempts = 20
-    dns_timeout = 60
-    federation_idle_timeout = 300
-    intentionally_unknown_config_option_for_testing = true
-    ip_range_denylist = []
-    log = "debug,tuwunel=trace,h2=warn,hyper=warn"
-    log_colors = false
-    log_guest_registrations = false
-    log_span_events = "NONE"
-    log_thread_ids = true
-    media_compat_file_link = false
-    media_startup_check = true
-    port = [8008, 8448]
-    prune_missing_media = true
-    query_trusted_key_servers_first = false
-    query_trusted_key_servers_first_on_join = false
-    request_conn_timeout = 60
-    request_timeout = 120
-    rocksdb_log_level = "debug"
-    rocksdb_max_log_files = 1
-    rocksdb_paranoid_file_checks = true
-    rocksdb_recovery_mode = 0
-    sender_idle_timeout = 300
-    sender_retry_backoff_limit = 300
-    sender_timeout = 300
-    startup_netburst = true
-    startup_netburst_keep = -1
-    trusted_servers = []
-    url_preview_domain_contains_allowlist = ["*"]
-    url_preview_domain_explicit_denylist = ["*"]
-    well_known_conn_timeout = 60
-    well_known_timeout = 60
-    yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true
-
-    [global.tls]
-    certs = "/complement/certificate.crt"
-    dual_protocol = true
-    key = "/complement/private_key.pem"
-EOF
-
-
-FROM input AS complement-testee
-
-EXPOSE 8008 8448
-RUN mkdir /database
-COPY --from=complement-config * /complement/
-ENV TUWUNEL_CONFIG="/complement/complement.toml"
-ENTRYPOINT tuwunel -Oserver_name=\""$SERVER_NAME\""
-
-
-FROM input AS complement-testee-valgrind
-
-EXPOSE 8008 8448
-RUN mkdir /database
-COPY --from=complement-config * /complement/
-ENV TUWUNEL_CONFIG="/complement/complement.toml"
-ENTRYPOINT valgrind \
-    --leak-check=no \
-    --undef-value-errors=no \
-    --exit-on-first-error=yes \
-    --error-exitcode=1 \
-    tuwunel \
-        -Oserver_name=\""$SERVER_NAME\""
-
-
-FROM input AS complement-base
-ARG var_cache
-ARG var_lib_apt
-ARG complement_ref="426bc3458e5287398ec39ab7d2b8f2e3103dcf39"
-ARG complement_tags="conduwuit_blacklist"
-ARG complement_tests="./tests/..."
-ARG complement_run=".*"
-
-WORKDIR /usr/src
-ADD https://github.com/matrix-construct/complement.git#${complement_ref} complement
-
-WORKDIR /usr/src/complement
-ENV COMPLEMENT_BASE_IMAGE="complement-testee"
-RUN \
---mount=type=cache,dst=/go/pkg/mod/cache,sharing=locked \
-<<EOF
-    env
-    set -eux
-    go test -tags="$complement_tags" -list="$complement_run" $complement_tests
-EOF
-
-
-FROM input AS complement-tester
-ARG complement_verbose=0
-ARG complement_debug=0
-ARG complement_dirty=0
-ARG complement_count=1
-ARG complement_parallel=1
-ARG complement_shuffle=1337
-ARG complement_timeout="1h"
-ARG complement_run=".*"
-ARG complement_skip=""
-ARG complement_tags="conduwuit_blacklist"
-ARG complement_tests="./tests/..."
-ARG complement_base_image
-
-WORKDIR /usr/src/complement
-ENV COMPLEMENT_DEBUG=$complement_debug
-ENV complement_parallel="$complement_parallel"
-ENV complement_shuffle="$complement_shuffle"
-ENV complement_tags="$complement_tags"
-ENV complement_timeout="$complement_timeout"
-ENV complement_count="$complement_count"
-ENV complement_tests="$complement_tests"
-ENV complement_skip="$complement_skip"
-ENV complement_run="$complement_run"
-ENV complement_tests="$complement_tests"
-ENV COMPLEMENT_ENABLE_DIRTY_RUNS="$complement_dirty"
-ENV COMPLEMENT_ALWAYS_PRINT_SERVER_LOGS="$complement_verbose"
-ENV COMPLEMENT_HOSTNAME_RUNNING_COMPLEMENT="host.docker.internal"
-ENV COMPLEMENT_HOST_MOUNTS="/var/run/docker.sock:/var/run/docker.sock"
-ENV jq_res='{Action: .Action, Test: .Test}'
-ENV jq_sel='select((.Action == \"pass\" or .Action == \"fail\" or .Action == \"skip\") and .Test != null)'
-ENV jq_tab='[.Action, .Test] | @tsv'
-ENV jq_out='select(.Test != null) | {Test: .Test, Output: .Output}'
-COPY --from=complement-config /complement/old_results.jsonl .
-COPY <<EOF uwu.sh
-    env;
-    set -eux;
-
-    COMPLEMENT_BASE_IMAGE="\${1:-$complement_base_image}"
-    go test
-        -json
-        "-shuffle=\$complement_shuffle"
-        "-parallel=\$complement_parallel"
-        "-timeout=\$complement_timeout"
-        "-count=\$complement_count"
-        "-tags=\$complement_tags"
-        "-skip=\$complement_skip"
-        "-run=\$complement_run"
-        "\$complement_tests"
-    | jq --unbuffered -c "."
-    | tee output.jsonl
-    | jq --unbuffered -c "$jq_sel | $jq_res"
-    | tee results.jsonl
-    | jq --unbuffered -r "$jq_tab"
-    ;
-
-    jq -s -c "sort_by(.Test)[]" < results.jsonl | uniq > new_results.jsonl;
-    jq -s -c "sort_by(.Test, .Timestamp)[] | $jq_out" < output.jsonl > full_output.jsonl;
-EOF
-RUN echo $(tr -d '\n' < uwu.sh) > uwu.sh && chmod a+x uwu.sh
-ENTRYPOINT ["/bin/bash", "/usr/src/complement/uwu.sh"]

docker/Dockerfile.install

@@ -1,29 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS install
-ARG rust_target
-ARG CARGO_TARGET_DIR
-ARG cargo_target_profile
-ARG install_prefix
-ARG assert_linkage=""
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR ${install_prefix}
-ENV src_path="${CARGO_TARGET_DIR}/${rust_target}/${cargo_target_profile}/tuwunel"
-ENV dst_path="${install_prefix}/bin/tuwunel"
-COPY --from=bins $src_path $dst_path
-RUN <<EOF
-    ret=$(ldd "${dst_path}")
-    if [ "$ret" = "0" ] && [ "$assert_linkage" = "static" ]; then
-        exit 1
-    elif [ "$ret" != "0" ] && [ "$assert_linkage" = "dynamic" ]; then
-        exit 1
-    fi
-
-    set -eux
-    ldd -v ${dst_path} || true
-    du -h ${dst_path}
-    sha1sum ${dst_path}
-EOF

docker/Dockerfile.matrix-rust-sdk

@@ -1,100 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS rust-sdk-integration
-ARG sys_name
-ARG sys_version
-ARG feat_set
-ARG rust_target
-ARG rust_toolchain
-ARG cargo_profile
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG MRSDK_TARGET_DIR="/usr/src/matrix-rust-sdk/target"
-ARG mrsdk_target_share
-#ARG mrsdk_ref="integration"
-ARG mrsdk_ref="tuwunel-changes"
-ARG mrsdk_test_args=""
-ARG mrsdk_test_opts=""
-ARG mrsdk_skip_list=""
-ARG mrsdk_parallel=2
-ARG mrsdk_startup_delay="10s"
-ARG mrsdk_testee="/usr/bin/tuwunel"
-
-WORKDIR /usr/src
-ADD --link https://github.com/matrix-construct/matrix-rust-sdk.git#${mrsdk_ref} matrix-rust-sdk
-
-WORKDIR /etc
-COPY <<EOF tuwunel.toml
-    [global]
-    admin_room_notices = false
-    allow_device_name_federation = true
-    allow_guest_registration = true
-    allow_legacy_media = true
-    allow_public_room_directory_over_federation = true
-    allow_public_room_directory_without_auth = true
-    allow_registration = true
-    create_admin_room = false
-    ip_range_denylist = []
-    log = "debug,tuwunel=trace,h2=warn,hyper=warn"
-    log_colors = false
-    log_guest_registrations = false
-    log_span_events = "NONE"
-    log_thread_ids = true
-    media_compat_file_link = false
-    media_startup_check = true
-    query_trusted_key_servers_first = false
-    query_trusted_key_servers_first_on_join = false
-    rocksdb_log_level = "debug"
-    rocksdb_max_log_files = 1
-    rocksdb_paranoid_file_checks = true
-    rocksdb_recovery_mode = 0
-    trusted_servers = []
-    url_preview_domain_contains_allowlist = ["*"]
-    url_preview_domain_explicit_denylist = ["*"]
-    yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true
-EOF
-
-WORKDIR /usr/lib
-COPY --link --from=install /usr/lib .
-
-WORKDIR /usr/bin
-COPY --link --from=install /usr/bin/tuwunel .
-
-WORKDIR /usr/src/matrix-rust-sdk
-SHELL ["/bin/bash", "-c"]
-ENV RUST_BACKTRACE="full"
-ENV TUWUNEL_CONFIG="/etc/tuwunel.toml"
-ENV TUWUNEL_DATABASE_PATH="/var/db/tuwunel"
-ENV TUWUNEL_SERVER_NAME="localhost"
-ENV TUWUNEL_PORT="[8448]"
-ENV HOMESERVER_URL="http://localhost:8448"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=shared \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=shared \
---mount=type=cache,dst=${MRSDK_TARGET_DIR},id=${mrsdk_target_share},sharing=locked \
-<<EOF
-    set -eux
-
-    nohup ${mrsdk_testee[@]} 1> /var/log/tuwunel.log &
-    PID=$!; trap "sleep 10s; set +e; kill -QUIT ${PID}; wait ${PID}" EXIT
-    sleep "${mrsdk_startup_delay}"
-
-    rustup run ${rust_toolchain} \
-        cargo test \
-            --locked \
-            --release \
-            "--color=always" \
-            "--features=default" \
-            "--target=${rust_target}" \
-            "--target-dir=${MRSDK_TARGET_DIR}" \
-            "--package=matrix-sdk-integration-testing" \
-            ${mrsdk_test_args[@]} \
-            -- \
-            "--color=always" \
-            "--test-threads=${mrsdk_parallel}" \
-            ${mrsdk_skip_list[@]} \
-            ${mrsdk_test_opts[@]} \
-            ;
-EOF

docker/Dockerfile.nix

@@ -1,91 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS nix-base
-
-WORKDIR /
-COPY --link --from=input . .
-
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-	set -eux
-	curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install > nix-install
-	sh ./nix-install --daemon
-	rm nix-install
-EOF
-
-
-FROM nix-base AS build-nix
-
-WORKDIR /usr/src/tuwunel
-COPY --link --from=source /usr/src/tuwunel .
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-	set -eux
-
-	nix-build \
-		--verbose \
-		--cores 0 \
-		--max-jobs $(nproc) \
-		--log-format raw \
-		.
-
-	cp -afRL --copy-contents result /opt/tuwunel
-EOF
-
-
-FROM input AS smoke-nix
-
-WORKDIR /
-COPY --link --from=nix-base . .
-
-WORKDIR /usr/src/tuwunel
-COPY --link --from=source /usr/src/tuwunel .
-ENV TUWUNEL_DATABASE_PATH="/tmp/tuwunel/smoketest.db"
-ENV TUWUNEL_LOG="info"
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-    set -eux
-    alias nix="nix --extra-experimental-features nix-command --extra-experimental-features flakes"
-
-    nix run \
-        --verbose \
-        --cores 0 \
-        --max-jobs $(nproc) \
-        --log-format raw \
-        .#all-features \
-            -- \
-            -Otest='["smoke", "fresh"]' \
-            -Oserver_name=\"localhost\" \
-EOF
-
-
-FROM input AS nix-pkg
-
-WORKDIR /
-COPY --link --from=nix-base . .
-
-WORKDIR /usr/src/tuwunel
-COPY --link --from=source /usr/src/tuwunel .
-RUN \
---mount=type=cache,dst=/nix,sharing=shared \
---mount=type=cache,dst=/root/.cache/nix,sharing=shared \
---mount=type=cache,dst=/root/.local/state/nix,sharing=shared \
-<<EOF
-    set -eux
-    alias nix="nix --extra-experimental-features nix-command --extra-experimental-features flakes"
-
-    ID=$(nix-store --realise $(nix path-info --derivation))
-
-    mkdir -p tuwunel
-    nix-store --export $ID > tuwunel/tuwunel.drv
-    tar -cvf /opt/tuwunel.nix.tar tuwunel
-EOF

docker/Dockerfile.rocksdb

@@ -1,93 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS rocksdb-fetch
-ARG rocksdb_branch="tuwunel-changes"
-ARG rust_rocksdb_branch="conduwuit-changes"
-ARG librocksdb_submodule="librocksdb-sys/rocksdb"
-
-WORKDIR /
-COPY --link --from=input . .
-
-WORKDIR /usr/src
-COPY --link --from=recipe rocksdb.url .
-
-RUN <<EOF
-    set -eux
-    rocksdb_url="$(cat rocksdb.url)"
-    git clone \
-        --depth 1 \
-        --single-branch \
-        --branch "${rust_rocksdb_branch}" \
-        "--recurse-submodules=${librocksdb_submodule}" \
-        "${rocksdb_url}" \
-        /usr/src/rocksdb
-EOF
-
-
-FROM input AS rocksdb-build
-ARG rocksdb_shared=0
-ARG rocksdb_portable="1"
-ARG rocksdb_opt_level="3"
-ARG rocksdb_build_type="Release"
-ARG rocksdb_cxx_flags="-ftls-model=initial-exec"
-ARG rocksdb_make_verbose="ON"
-ARG rocksdb_make_rule_messages="OFF"
-ARG rocksdb_jemalloc=1
-ARG rocksdb_iouring=1
-ARG rocksdb_zstd=1
-ARG rocksdb_lz4=0
-ARG rocksdb_bz2=0
-ARG rocksdb_zlib=0
-ARG rocksdb_snappy=0
-ARG nprocs
-
-WORKDIR /
-COPY --link --from=input . .
-COPY --link --from=rocksdb-fetch /usr/src/rocksdb /usr/src/rocksdb
-
-WORKDIR /usr/src/rocksdb/librocksdb-sys/rocksdb
-ENV CC="clang"
-ENV CXX="clang++"
-ENV nprocs=${nprocs}
-RUN <<EOF
-    set -eux
-
-    cmake -H. -Bbuild \
-        "-DCMAKE_RULE_MESSAGES:BOOL=${rocksdb_make_rule_messages}" \
-        "-DCMAKE_VERBOSE_MAKEFILE:BOOL=${rocksdb_make_verbose}" \
-        "-DCMAKE_BUILD_TYPE=${rocksdb_build_type}" \
-        "-DBUILD_SHARED_LIBS=${rocksdb_shared}" \
-        "-DROCKSDB_BUILD_SHARED=${rocksdb_shared}" \
-        "-DCMAKE_CXX_FLAGS:STRING=${rocksdb_cxx_flags}" \
-        "-DCMAKE_CXX_FLAGS_RELEASE:STRING=-g0 -O${rocksdb_opt_level} -DNDEBUG" \
-        "-DPORTABLE=${rocksdb_portable}" \
-        "-DFAIL_ON_WARNINGS=0" \
-        "-DUSE_RTTI=0" \
-        "-DWITH_RUNTIME_DEBUG=0" \
-        "-DWITH_JNI=0" \
-        "-DWITH_EXAMPLES=0" \
-        "-DWITH_BENCHMARK=0" \
-        "-DWITH_BENCHMARK_TOOLS=0" \
-        "-DWITH_TRACE_TOOLS=0" \
-        "-DWITH_CORE_TOOLS=0" \
-        "-DWITH_TOOLS=0" \
-        "-DWITH_TESTS=0" \
-        "-DWITH_GFLAGS=0" \
-        "-DWITH_LIBURING=${rocksdb_iouring}" \
-        "-DWITH_JEMALLOC=${rocksdb_jemalloc}" \
-        "-DWITH_ZSTD=${rocksdb_zstd}" \
-        "-DWITH_LZ4=${rocksdb_lz4}" \
-        "-DWITH_BZ2=${rocksdb_bz2}" \
-        "-DWITH_ZLIB=${rocksdb_zlib}" \
-        "-DWITH_SNAPPY=${rocksdb_snappy}"
-
-    nprocs=${nprocs:=$(nproc)}
-    cmake \
-        --build build \
-        --target install \
-        --parallel "${nprocs}"
-EOF
-
-
-FROM scratch AS rocksdb
-COPY --from=input /usr/src/rocksdb/librocksdb-sys/rocksdb/build/librocksdb.* .

docker/Dockerfile.rust

@@ -1,66 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS rustup
-ARG RUST_HOME
-ARG rust_target
-ARG rustup_version="1.28.2"
-ARG rustup_profile="minimal"
-
-WORKDIR ${RUST_HOME}
-RUN <<EOF
-    set -eux
-
-    var="${rustup_version}/${rust_target}"
-    url="https://static.rust-lang.org/rustup/archive/$var/rustup-init"
-    curl -S -O -s "$url"
-    chmod a+rx rustup-init
-EOF
-
-FROM input AS rust
-ARG rust_toolchain
-ARG rust_target
-ARG RUST_HOME
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG rustup_version="1.28.1"
-ARG rustup_profile="minimal"
-ARG CARGO_TERM_VERBOSE
-ARG rustup_components
-ARG cargo_installs
-
-WORKDIR ${RUST_HOME}
-ENV CARGO_TARGET="${rust_target}"
-ENV RUSTUP_HOME="${RUSTUP_HOME}"
-ENV CARGO_HOME="${CARGO_HOME}"
-ENV PATH="${CARGO_HOME}/bin:$PATH"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
-<<EOF
-    set -eux
-    ./rustup-init -y \
-        --quiet \
-        --profile "${rustup_profile}" \
-        --default-host "${CARGO_TARGET}" \
-        --default-toolchain "${rust_toolchain}" \
-        --no-update-default-toolchain \
-        --no-modify-path
-
-    chmod -R a+rw $CARGO_HOME $RUSTUP_HOME
-    rm rustup-init
-
-    rustup component add \
-        --toolchain ${rust_toolchain} \
-        --target ${rust_target} \
-        ${rustup_components} \
-        ;
-
-    rustup run --install ${rust_toolchain} \
-        cargo install \
-            --locked \
-            --target ${rust_target} \
-            ${cargo_installs} \
-            ;
-EOF

docker/Dockerfile.smoketest

@@ -1,66 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS smoke-version
-COPY --link --from=input . .
-RUN <<EOF
-    set -eux
-    tuwunel -V
-    version=$(tuwunel -V)
-    /bin/test -n "$version"
-EOF
-
-
-FROM input AS smoke-startup
-COPY --link --from=input . .
-ENV TUWUNEL_LOG="info"
-ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
-RUN <<EOF
-    set -eux
-    tuwunel \
-        -Otest='["smoke"]' \
-        -Oserver_name=\"localhost\" \
-        -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
-
-    rm -rf "${TUWUNEL_DATABASE_PATH}"
-EOF
-
-
-FROM input AS smoke-valgrind
-ARG leak_check="no"
-ARG undef_value_errors="no"
-COPY --link --from=input . .
-ENV TUWUNEL_LOG="info"
-ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
-RUN <<EOF
-    set -eux
-    ulimit -n 65535
-    valgrind \
-        --leak-check=${leak_check} \
-        --undef-value-errors=${undef_value_errors} \
-        --exit-on-first-error=yes \
-        --error-exitcode=1 \
-        tuwunel \
-            -Otest='["smoke"]' \
-            -Oserver_name=\"localhost\" \
-            -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
-
-    rm -rf "${TUWUNEL_DATABASE_PATH}"
-EOF
-
-
-FROM input AS smoke-perf
-COPY --link --from=input . .
-ENV TUWUNEL_LOG="error"
-ENV TUWUNEL_DATABASE_PATH="/tmp/smoketest.db"
-RUN <<EOF
-    set -eux
-    perf stat \
-        -j \
-        -ddd \
-        tuwunel \
-            -Otest='["smoke"]' \
-            -Oserver_name=\"localhost\" \
-            -Odatabase_path=\"${TUWUNEL_DATABASE_PATH}\"
-
-    rm -rf "${TUWUNEL_DATABASE_PATH}"
-EOF

docker/Dockerfile.source

@@ -1,92 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-FROM input AS source
-ARG git_checkout
-
-ADD --link --keep-git-dir . /usr/src/tuwunel
-WORKDIR /usr/src/tuwunel
-RUN <<EOF
-    set -eux
-    git reset \
-        --hard \
-        --no-recurse-submodules \
-        ${git_checkout}
-EOF
-
-
-FROM input AS ingredients
-ARG rust_target
-ARG rust_toolchain
-ARG RUST_HOME
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-ARG CARGO_TERM_VERBOSE=0
-ARG RUST_BACKTRACE
-ARG JEMALLOC_OVERRIDE
-ARG ROCKSDB_LIB_DIR
-
-WORKDIR /
-COPY --link --from=rust ${RUST_HOME} ${RUST_HOME}
-COPY --link --from=source /usr/src/tuwunel /usr/src/tuwunel
-
-WORKDIR /usr/src/tuwunel
-ENV PATH="${CARGO_HOME}/bin:$PATH"
-ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
-ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
-ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
-ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
-<<EOF
-    set -eux
-    git submodule update \
-        --remote \
-        --no-fetch \
-        --recursive \
-        --checkout \
-        --init
-
-    rustup run ${rust_toolchain} \
-        cargo fetch \
-            --locked \
-            --target ${CARGO_TARGET}
-EOF
-
-
-FROM input AS preparing
-ARG rust_target
-ARG rust_toolchain
-ARG RUSTUP_HOME
-ARG CARGO_HOME
-ARG CARGO_TARGET
-
-WORKDIR /usr/src/tuwunel
-RUN \
---mount=type=cache,dst=${RUSTUP_HOME}/downloads,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/registry,sharing=locked \
---mount=type=cache,dst=${CARGO_HOME}/git,sharing=locked \
-<<EOF
-    set -euxo pipefail
-    rustup run ${rust_toolchain} \
-        cargo chef prepare \
-            --recipe-path recipe.json
-
-    manifest="Cargo.toml"
-    package="rust-librocksdb-sys"
-    cmd="cargo tree --manifest-path ${manifest} -f {r} -p ${package}"
-    url="$(rustup run ${rust_toolchain} ${cmd} | head -n 1)"
-    url="https://github.com/matrix-construct/rust-rocksdb" #TODO fixme
-    echo "$url" > rocksdb.url
-
-    sha1sum recipe.json rocksdb.url
-EOF
-
-
-FROM scratch AS recipe
-
-WORKDIR /
-COPY --from=preparing /usr/src/tuwunel/recipe.json .
-COPY --from=preparing /usr/src/tuwunel/rocksdb.url .

docker/Dockerfile.system

@@ -1,28 +0,0 @@
-# syntax = docker/dockerfile:1.11-labs
-
-ARG sys_name=debian
-ARG sys_version=testing-slim
-
-FROM ${sys_name}:${sys_version} AS system
-
-
-FROM input AS runtime
-ARG var_cache
-ARG var_lib_apt
-ARG packages
-ARG DEBIAN_FRONTEND
-
-ENV DEBIAN_FRONTEND="${DEBIAN_FRONTEND}"
-RUN \
---mount=type=cache,dst=/var/cache,id=${var_cache},sharing=locked \
---mount=type=cache,dst=/var/lib/apt,id=${var_lib_apt},sharing=locked \
-<<EOF
-    echo $(uname -a) $0 $-
-    set -eux
-
-    keep_downloaded='Binary::apt::APT::Keep-Downloaded-Packages "true";'
-    echo "$keep_downloaded" > /etc/apt/apt.conf.d/keep-downloaded
-    rm -f /etc/apt/apt.conf.d/docker-clean
-
-    apt-get -y -U install --no-install-recommends ${packages}
-EOF

docker/README.md

@@ -1,106 +0,0 @@
-# Docker Builder
-
-> [!NOTE]
-> This directory is for building docker images. For [deploying](https://github.com/matrix-construct/tuwunel/tree/main/docs/deploying)
-> [docker](https://github.com/matrix-construct/tuwunel/blob/main/docs/deploying/docker.md) visit
-> the appropriate documentation instead.
-
-All Docker images for the project are built here. All images are
-[Docker Bake](https://docs.docker.com/build/bake/) targets. All targets are leaves and
-branches of a unified tree leading to a single root. It is a combinatorial matrix
-of images from shared intermediate layers with a huge ever-growing pulsating cache.
-
-The result is the ability to run continuous integration for a number of build
-variations while only paying the cost of rebuilding the last layer for each one.
-
-
-### Layout
-
-This directory is made up of three types of files:
-
-- Shell scripts are the user interface. Use this system through one of the shell scripts. The
-bake files can still be docker'ed directly but it's recommended to run the script.
-
-- The `.hcl` files specify the targets of the tree. This is all standard
-[docker bake](https://docs.docker.com/build/bake/reference/). All targets are ordered where each
-depends on one or more below it. The root of the tree is at the bottom. At the time of this
-writing there is only one `bake.hcl` file but this might be broken up; in any case there will
-always be a single unified tree.
-
-- The `Dockerfile.*` files are like "library functions" and provide definition for targets.
-These are written generically in the style of "template functions" with many variables allowing
-many targets to create many variations using the same Dockerfile.
-
-
-### Getting started
-
-1. You will need to install docker buildx/buildkit and maybe a couple other related things.
-
-	`apt-get install docker-buildx`
-
-2. You will need to create a builder. There are a few complications that must be explained here
-so please be patient.
-
-	- Some unsavory options are required for some targets. It might be possible to omit these if
-	you're not building the full tree. Otherwise I've included them in the create command below.
-
-		- To run the complement compliance suite we need the `--allow-insecure-entitlement network.host`.
-		This requirement is probably a defect in Complement.
-
-	- The default cache policies are usually insufficient and custom values should be used,
-	 though the ones below are probably too much for a single or simple build.
-
-	Finally create:
-	
-	```
-	cat <<EOF > ./buildkitd.toml
-		[system]
-		  platformsCacheMaxAge = "504h"
-		[worker.oci]
-		  enabled = true
-		  gc = true
-		  reservedSpace = "64GB"
-		  maxUsedSpace = "128GB"
-		[[worker.oci.gcpolicy]]
-		  reservedSpace = "64GB"
-		  maxUsedSpace = "128GB"
-		  all = true
-	EOF
-
-	BKD_FLAGS="--allow-insecure-entitlement network.host"
-	docker buildx create \
-		--name owo \
-		--bootstrap \
-		--buildkitd-config ./buildkitd.toml \
-		--driver docker-container \
-		--buildkitd-flags "$BKD_FLAGS"
-	```
-
-3. Build something simple. The usage is `./bake.sh [target]` which defaults to building all
-elements for one vector of the full matrix. You can start smaller though by running
-`docker/bake.sh system` which is the root target. You can browse the `bake.hcl` from the bottom
-and progressively build targets, or build one or more leaf targets directly. For example try
-to run a smoketest: `./bake.sh tests-smoke`.
-
-4. Build something more complicated. Set environment variables or just edit the default vectors
-near the top of in the `bake.sh` with multiple elements (they are JSON arrays). You can take
-cues from the primary user of this system, the [GitHub CI](https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/main.yml#L32)
-
-5. Defeat the final boss by building and running complement to completion. This will involve
-building the targets for `complement-tester` and `complement-testee` using `bake.sh` and then
-invoking `complement.sh`. You can take cues again from another user of this in the
-[GitHub CI](https://github.com/matrix-construct/tuwunel/blob/7e8c4c8883ca17de91c3323d329541342366ee0c/.github/workflows/test.yml#L140).
-
-## Notes
-
-- For CI our builders are more persistent rather than being created and destroyed for
-each invocation. The builder is meant to be safely reused across operations, but
-for concurrent operations this is tricky, see the next point.
-
-- For CI our builders are isolated only by actor/user. This will probably change to
-`actor/repo/branch` as it's easy to cause issues with concurrent builds right now.
-However we can't accept destroying the builder after each use, so we'll likely
-choose `actor/repo/branch` with the expectation of one build at a time under those
-constraints. Some external caching might need to be contrived between builders for
-deduplication but with care such that malicious actors cannot poison data used
-by other actors, otherwise it defeats the purpose of builder isolation.