Bump 1.4.2

Signed-off-by: Jason Volk <jason@zemos.net>

.cargo/config.toml

@@ -1,2 +1,2 @@
-[alias]
-xtask = "run --package xtask --"
+[env]
+RUMA_UNSTABLE_EXHAUSTIVE_TYPES = "true"

.dockerignore

@@ -1,28 +1,31 @@
 # Local build and dev artifacts
 target/
-!target/debug/conduwuit
+#tests
 
 # Docker files
 Dockerfile*
+docker/
 
 # IDE files
 .vscode
 .idea
 *.iml
 
+.
+
 # Git folder
-# .git
-.gitea
-.gitlab
-.github
-.forgejo
+#.git
+#.gitea
+#.gitlab
+#.github
 
 # Dot files
 .env
-.gitignore
+#.gitignore
 
 # Toml files
-rustfmt.toml
+#rustfmt.toml
 
 # Documentation
 #*.md
+*.hcl

.editorconfig

@@ -22,11 +22,3 @@ indent_size = 2
 [*.rs]
 indent_style = tab
 max_line_length = 98
-
-[*.yml]
-indent_size = 2
-indent_style = space
-
-[*.json]
-indent_size = 4
-indent_style = space

.envrc

@@ -2,8 +2,6 @@
 
 dotenv_if_exists
 
-if command -v nix >/dev/null 2>&1; then
-    use flake ".#${DIRENV_DEVSHELL:-default}"
-fi
+use flake ".#${DIRENV_DEVSHELL:-default}"
 
 PATH_add bin

.forgejo/actions/create-docker-manifest/action.yml

@@ -1,110 +0,0 @@
-name: create-manifest
-description: |
-  Create and push a multi-platform Docker manifest from individual platform digests.
-  Handles downloading digests, creating manifest lists, and pushing to registry.
-
-inputs:
-  digest_pattern:
-    description: Glob pattern to match digest artifacts (e.g. "digests-linux-{amd64,arm64}")
-    required: true
-  tag_suffix:
-    description: Suffix to add to all Docker tags (e.g. "-maxperf")
-    required: false
-    default: ""
-  images:
-    description: Container registry images (newline-separated)
-    required: true
-  registry_user:
-    description: Registry username for authentication
-    required: false
-  registry_password:
-    description: Registry password for authentication
-    required: false
-
-outputs:
-  version:
-    description: The version tag created for the manifest
-    value: ${{ steps.meta.outputs.version }}
-  tags:
-    description: All tags created for the manifest
-    value: ${{ steps.meta.outputs.tags }}
-
-runs:
-  using: composite
-  steps:
-    - run: mkdir -p digests
-      shell: bash
-    - name: Download digests
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: forgejo/download-artifact@v4
-      with:
-        path: digests
-        pattern: ${{ inputs.digest_pattern }}
-        merge-multiple: true
-
-    - name: Login to builtin registry
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
-      with:
-        registry: ${{ env.BUILTIN_REGISTRY }}
-        username: ${{ inputs.registry_user }}
-        password: ${{ inputs.registry_password }}
-
-    - name: Set up Docker Buildx
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
-      with:
-        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
-        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
-        endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
-
-    - name: Extract metadata (tags) for Docker
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      id: meta
-      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
-      with:
-        flavor: |
-          latest=auto
-          suffix=${{ inputs.tag_suffix }},onlatest=true
-        tags: |
-          type=semver,pattern={{version}},prefix=v
-          type=semver,pattern={{major}}.{{minor}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.0.') }},prefix=v
-          type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v
-          type=ref,event=branch,prefix=${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref && 'branch-' || '' }},
-          type=ref,event=pr
-          type=sha,format=short
-        images: ${{ inputs.images }}
-        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
-      env:
-        DOCKER_METADATA_ANNOTATIONS_LEVELS: index
-
-    - name: Create manifest list and push
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      working-directory: digests
-      shell: bash
-      env:
-        IMAGES: ${{ inputs.images }}
-      run: |
-        set -o xtrace
-        IFS=$'\n'
-        IMAGES_LIST=($IMAGES)
-        ANNOTATIONS_LIST=($DOCKER_METADATA_OUTPUT_ANNOTATIONS)
-        TAGS_LIST=($DOCKER_METADATA_OUTPUT_TAGS)
-        for REPO in "${IMAGES_LIST[@]}"; do
-            docker buildx imagetools create \
-              $(for tag in "${TAGS_LIST[@]}"; do echo "--tag"; echo "$tag"; done) \
-              $(for annotation in "${ANNOTATIONS_LIST[@]}"; do echo "--annotation"; echo "$annotation"; done) \
-              $(for reference in *; do printf "$REPO@sha256:%s\n" $reference; done)
-        done
-
-    - name: Inspect image
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      shell: bash
-      env:
-        IMAGES: ${{ inputs.images }}
-      run: |
-        set -o xtrace
-        IMAGES_LIST=($IMAGES)
-        for REPO in "${IMAGES_LIST[@]}"; do
-          docker buildx imagetools inspect $REPO:${{ steps.meta.outputs.version }}
-        done

.forgejo/actions/prepare-docker-build/action.yml

@@ -1,113 +0,0 @@
-name: prepare-docker-build
-description: |
-  Prepare the Docker build environment for Continuwuity builds.
-  Sets up Rust toolchain, Docker Buildx, caching, and extracts metadata for Docker builds.
-
-inputs:
-  platform:
-    description: Target platform (e.g. linux/amd64, linux/arm64)
-    required: true
-  slug:
-    description: Platform slug for artifact naming (e.g. linux-amd64, linux-arm64)
-    required: true
-  target_cpu:
-    description: Target CPU architecture (e.g. haswell, empty for base)
-    required: false
-    default: ""
-  profile:
-    description: Cargo build profile (release or release-max-perf)
-    required: true
-  images:
-    description: Container registry images (newline-separated)
-    required: true
-  registry_user:
-    description: Registry username for authentication
-    required: false
-  registry_password:
-    description: Registry password for authentication
-    required: false
-
-outputs:
-  cpu_suffix:
-    description: CPU suffix for artifact naming
-    value: ${{ steps.cpu-suffix.outputs.suffix }}
-  metadata_labels:
-    description: Docker labels for the image
-    value: ${{ steps.meta.outputs.labels }}
-  metadata_annotations:
-    description: Docker annotations for the image
-    value: ${{ steps.meta.outputs.annotations }}
-
-runs:
-  using: composite
-  steps:
-    - name: Set CPU suffix variable
-      id: cpu-suffix
-      shell: bash
-      run: |
-        if [[ -n "${{ inputs.target_cpu }}" ]]; then
-          echo "suffix=-${{ inputs.target_cpu }}" >> $GITHUB_OUTPUT
-          echo "CPU_SUFFIX=-${{ inputs.target_cpu }}" >> $GITHUB_ENV
-        else
-          echo "suffix=" >> $GITHUB_OUTPUT
-          echo "CPU_SUFFIX=" >> $GITHUB_ENV
-        fi
-
-    - name: Echo matrix configuration
-      shell: bash
-      run: |
-        echo "Platform: ${{ inputs.platform }}"
-        echo "Slug: ${{ inputs.slug }}"
-        echo "Target CPU: ${{ inputs.target_cpu }}"
-        echo "Profile: ${{ inputs.profile }}"
-
-    - name: Install rust
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      id: rust-toolchain
-      uses: ./.forgejo/actions/rust-toolchain
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
-      with:
-        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
-        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
-        endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
-
-    - name: Set up QEMU
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
-
-    - name: Login to builtin registry
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
-      with:
-        registry: ${{ env.BUILTIN_REGISTRY }}
-        username: ${{ inputs.registry_user }}
-        password: ${{ inputs.registry_password }}
-
-    - name: Extract metadata (labels, annotations) for Docker
-      id: meta
-      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
-      with:
-        images: ${{ inputs.images }}
-        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
-      env:
-        DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
-
-    - name: Get short git commit SHA
-      id: sha
-      shell: bash
-      run: |
-        calculatedSha=$(git rev-parse --short ${{ github.sha }})
-        echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
-        echo "Short SHA: $calculatedSha"
-
-    - name: Get Git commit timestamps
-      shell: bash
-      run: |
-        timestamp=$(git log -1 --pretty=%ct)
-        echo "TIMESTAMP=$timestamp" >> $GITHUB_ENV
-        echo "Commit timestamp: $timestamp"
-
-    - uses: ./.forgejo/actions/timelord
-      id: timelord

.forgejo/actions/rust-toolchain/action.yml

@@ -1,63 +0,0 @@
-name: rust-toolchain
-description: |
-  Install a Rust toolchain using rustup.
-  See https://rust-lang.github.io/rustup/concepts/toolchains.html#toolchain-specification
-  for more information about toolchains.
-inputs:
-  toolchain:
-    description: |
-      Rust toolchain name.
-      See https://rust-lang.github.io/rustup/concepts/toolchains.html#toolchain-specification
-    required: false
-  target:
-    description: Target triple to install for this toolchain
-    required: false
-  components:
-    description: Space-separated list of components to be additionally installed for a new toolchain
-    required: false
-outputs:
-  rustc_version:
-    description: The rustc version installed
-    value: ${{ steps.rustc-version.outputs.version }}
-  rustup_version:
-    description: The rustup version installed
-    value: ${{ steps.rustup-version.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - name: Check if rustup is already installed
-      shell: bash
-      id: rustup-version
-      run: |
-        echo "version=$(rustup --version)" >> $GITHUB_OUTPUT
-    - name: Cache rustup toolchains
-      if: steps.rustup-version.outputs.version == ''
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: |
-          ~/.rustup
-          !~/.rustup/tmp
-          !~/.rustup/downloads
-        # Requires repo to be cloned if toolchain is not specified
-        key: continuwuity-${{ runner.os }}-rustup-${{ inputs.toolchain || hashFiles('**/rust-toolchain.toml') }}
-    - name: Install Rust toolchain
-      if: steps.rustup-version.outputs.version == ''
-      shell: bash
-      run: |
-        if ! command -v rustup &> /dev/null ; then
-            curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused -fsSL "https://sh.rustup.rs" | sh -s -- --default-toolchain none -y
-            echo "${CARGO_HOME:-$HOME/.cargo}/bin" >> $GITHUB_PATH
-        fi
-    - shell: bash
-      run: |
-        set -x
-        ${{ inputs.toolchain && format('rustup override set {0}', inputs.toolchain) }}
-        ${{ inputs.target && format('rustup target add {0}', inputs.target) }}
-        ${{ inputs.components && format('rustup component add {0}', inputs.components) }}
-        cargo --version
-        rustc --version
-    - id: rustc-version
-      shell: bash
-      run: |
-        echo "version=$(rustc --version)" >> $GITHUB_OUTPUT

.forgejo/actions/sccache/action.yml

@@ -1,23 +0,0 @@
-name: sccache
-description: |
-  Install sccache for caching builds in GitHub Actions.
-
-
-runs:
-  using: composite
-  steps:
-  - name: Install sccache
-    uses: https://git.tomfos.tr/tom/sccache-action@v1
-  - name: Configure sccache
-    uses: https://github.com/actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-    with:
-      script: |
-        core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
-        core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-  - shell: bash
-    run: |
-      echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
-      echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-      echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-      echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-      echo "CMAKE_CUDA_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV

.forgejo/actions/setup-llvm-with-apt/action.yml

@@ -1,167 +0,0 @@
-name: setup-llvm-with-apt
-description: |
-  Set up LLVM toolchain with APT package management and smart caching.
-  Supports cross-compilation architectures and additional package installation.
-
-  Creates symlinks in /usr/bin: clang, clang++, lld, llvm-ar, llvm-ranlib
-
-inputs:
-  dpkg-arch:
-    description: 'Debian architecture for cross-compilation (e.g. arm64)'
-    required: false
-    default: ''
-  extra-packages:
-    description: 'Additional APT packages to install (space-separated)'
-    required: false
-    default: ''
-  llvm-version:
-    description: 'LLVM version to install'
-    required: false
-    default: '21'
-
-outputs:
-  llvm-version:
-    description: 'Installed LLVM version'
-    value: ${{ steps.configure.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - name: Detect runner OS
-      id: runner-os
-      uses: https://git.tomfos.tr/actions/detect-versions@v1
-
-    - name: Configure cross-compilation architecture
-      if: inputs.dpkg-arch != ''
-      shell: bash
-      run: |
-        echo "🏗️ Adding ${{ inputs.dpkg-arch }} architecture"
-        sudo dpkg --add-architecture ${{ inputs.dpkg-arch }}
-
-        # Restrict default sources to amd64
-        sudo sed -i 's/^deb http/deb [arch=amd64] http/g' /etc/apt/sources.list
-        sudo sed -i 's/^deb https/deb [arch=amd64] https/g' /etc/apt/sources.list
-
-        # Add ports sources for foreign architecture
-        sudo tee /etc/apt/sources.list.d/${{ inputs.dpkg-arch }}.list > /dev/null <<EOF
-        deb [arch=${{ inputs.dpkg-arch }}] http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe multiverse
-        deb [arch=${{ inputs.dpkg-arch }}] http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe multiverse
-        deb [arch=${{ inputs.dpkg-arch }}] http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse
-        EOF
-
-        echo "✅ Architecture ${{ inputs.dpkg-arch }} configured"
-
-    - name: Start LLVM cache group
-      shell: bash
-      run: echo "::group::📦 Restoring LLVM cache"
-
-    - name: Check for LLVM cache
-      id: cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: |
-          /usr/bin/clang-*
-          /usr/bin/clang++-*
-          /usr/bin/lld-*
-          /usr/bin/llvm-*
-          /usr/lib/llvm-*/
-          /usr/lib/x86_64-linux-gnu/libLLVM*.so*
-          /usr/lib/x86_64-linux-gnu/libclang*.so*
-          /etc/apt/sources.list.d/archive_uri-*
-          /etc/apt/trusted.gpg.d/apt.llvm.org.asc
-        key: continuwuity-llvm-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-v${{ inputs.llvm-version }}-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
-
-    - name: End LLVM cache group
-      shell: bash
-      run: echo "::endgroup::"
-
-    - name: Check and install LLVM if needed
-      id: llvm-setup
-      shell: bash
-      run: |
-        echo "🔍 Checking for LLVM ${{ inputs.llvm-version }}..."
-
-        # Check both binaries and libraries exist
-        if [ -f "/usr/bin/clang-${{ inputs.llvm-version }}" ] && \
-           [ -f "/usr/bin/clang++-${{ inputs.llvm-version }}" ] && \
-           [ -f "/usr/bin/lld-${{ inputs.llvm-version }}" ] && \
-           ([ -f "/usr/lib/x86_64-linux-gnu/libLLVM.so.${{ inputs.llvm-version }}.1" ] || \
-            [ -f "/usr/lib/x86_64-linux-gnu/libLLVM-${{ inputs.llvm-version }}.so.1" ] || \
-            [ -f "/usr/lib/llvm-${{ inputs.llvm-version }}/lib/libLLVM.so" ]); then
-          echo "✅ LLVM ${{ inputs.llvm-version }} found and verified"
-          echo "needs-install=false" >> $GITHUB_OUTPUT
-        else
-          echo "📦 LLVM ${{ inputs.llvm-version }} not found or incomplete - installing..."
-
-          echo "::group::🔧 Installing LLVM ${{ inputs.llvm-version }}"
-          wget -O - https://apt.llvm.org/llvm.sh | bash -s -- ${{ inputs.llvm-version }}
-          echo "::endgroup::"
-
-          if [ ! -f "/usr/bin/clang-${{ inputs.llvm-version }}" ]; then
-            echo "❌ Failed to install LLVM ${{ inputs.llvm-version }}"
-            exit 1
-          fi
-
-          echo "✅ Installed LLVM ${{ inputs.llvm-version }}"
-          echo "needs-install=true" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Prepare for additional packages
-      if: inputs.extra-packages != ''
-      shell: bash
-      run: |
-        # Update APT if LLVM was cached (installer script already does apt-get update)
-        if [[ "${{ steps.llvm-setup.outputs.needs-install }}" != "true" ]]; then
-          echo "::group::📦 Running apt-get update (LLVM cached, extra packages needed)"
-          sudo apt-get update
-          echo "::endgroup::"
-        fi
-        echo "::group::📦 Installing additional packages"
-
-    - name: Install additional packages
-      if: inputs.extra-packages != ''
-      uses: https://github.com/awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
-      with:
-        packages: ${{ inputs.extra-packages }}
-        version: 1.0
-
-    - name: End package installation group
-      if: inputs.extra-packages != ''
-      shell: bash
-      run: echo "::endgroup::"
-
-    - name: Configure LLVM environment
-      id: configure
-      shell: bash
-      run: |
-        echo "::group::🔧 Configuring LLVM ${{ inputs.llvm-version }} environment"
-
-        # Create symlinks
-        sudo ln -sf "/usr/bin/clang-${{ inputs.llvm-version }}" /usr/bin/clang
-        sudo ln -sf "/usr/bin/clang++-${{ inputs.llvm-version }}" /usr/bin/clang++
-        sudo ln -sf "/usr/bin/lld-${{ inputs.llvm-version }}" /usr/bin/lld
-        sudo ln -sf "/usr/bin/llvm-ar-${{ inputs.llvm-version }}" /usr/bin/llvm-ar
-        sudo ln -sf "/usr/bin/llvm-ranlib-${{ inputs.llvm-version }}" /usr/bin/llvm-ranlib
-        echo "  ✓ Created symlinks"
-
-        # Setup library paths
-        LLVM_LIB_PATH="/usr/lib/llvm-${{ inputs.llvm-version }}/lib"
-        if [ -d "$LLVM_LIB_PATH" ]; then
-          echo "LD_LIBRARY_PATH=${LLVM_LIB_PATH}:${LD_LIBRARY_PATH:-}" >> $GITHUB_ENV
-          echo "LIBCLANG_PATH=${LLVM_LIB_PATH}" >> $GITHUB_ENV
-
-          echo "$LLVM_LIB_PATH" | sudo tee "/etc/ld.so.conf.d/llvm-${{ inputs.llvm-version }}.conf" > /dev/null
-          sudo ldconfig
-          echo "  ✓ Configured library paths"
-        else
-          # Fallback to standard library location
-          if [ -d "/usr/lib/x86_64-linux-gnu" ]; then
-            echo "LIBCLANG_PATH=/usr/lib/x86_64-linux-gnu" >> $GITHUB_ENV
-            echo "  ✓ Using fallback library path"
-          fi
-        fi
-
-        # Set output
-        echo "version=${{ inputs.llvm-version }}" >> $GITHUB_OUTPUT
-        echo "::endgroup::"
-        echo "✅ LLVM ready: $(clang --version | head -1)"

.forgejo/actions/setup-rust/action.yml

@@ -1,216 +0,0 @@
-name: setup-rust
-description: |
-  Set up Rust toolchain with sccache for compilation caching.
-  Respects rust-toolchain.toml by default or accepts explicit version override.
-
-inputs:
-  cache-key-suffix:
-    description: 'Optional suffix for cache keys (e.g. platform identifier)'
-    required: false
-    default: ''
-  rust-components:
-    description: 'Additional Rust components to install (space-separated)'
-    required: false
-    default: ''
-  rust-target:
-    description: 'Rust target triple (e.g. x86_64-unknown-linux-gnu)'
-    required: false
-    default: ''
-  rust-version:
-    description: 'Rust version to install (e.g. nightly). Defaults to the version specified in rust-toolchain.toml'
-    required: false
-    default: ''
-  sccache-cache-limit:
-    description: 'Maximum size limit for sccache local cache (e.g. 2G, 500M)'
-    required: false
-    default: '2G'
-  github-token:
-    description: 'GitHub token for downloading sccache from GitHub releases'
-    required: false
-    default: ''
-
-outputs:
-  rust-version:
-    description: 'Installed Rust version'
-    value: ${{ steps.rust-setup.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - name: Detect runner OS
-      id: runner-os
-      uses: https://git.tomfos.tr/actions/detect-versions@v1
-
-    - name: Configure Cargo environment
-      shell: bash
-      run: |
-        # Use workspace-relative paths for better control and consistency
-        echo "CARGO_HOME=${{ github.workspace }}/.cargo" >> $GITHUB_ENV
-        echo "CARGO_TARGET_DIR=${{ github.workspace }}/target" >> $GITHUB_ENV
-        echo "SCCACHE_DIR=${{ github.workspace }}/.sccache" >> $GITHUB_ENV
-        echo "RUSTUP_HOME=${{ github.workspace }}/.rustup" >> $GITHUB_ENV
-
-        # Limit binstall resolution timeout to avoid GitHub rate limit delays
-        echo "BINSTALL_MAXIMUM_RESOLUTION_TIMEOUT=10" >> $GITHUB_ENV
-
-        # Ensure directories exist for first run
-        mkdir -p "${{ github.workspace }}/.cargo"
-        mkdir -p "${{ github.workspace }}/.sccache"
-        mkdir -p "${{ github.workspace }}/target"
-        mkdir -p "${{ github.workspace }}/.rustup"
-
-    - name: Start registry/toolchain restore group
-      shell: bash
-      run: echo "::group::📦 Restoring registry and toolchain caches"
-
-    - name: Cache toolchain binaries
-      id: toolchain-cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: |
-          .cargo/bin
-          .rustup/toolchains
-          .rustup/update-hashes
-        # Shared toolchain cache across all Rust versions
-        key: continuwuity-toolchain-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}
-
-    - name: Cache Cargo registry and git
-      id: registry-cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: |
-          .cargo/registry/index
-          .cargo/registry/cache
-          .cargo/git/db
-        # Registry cache saved per workflow, restored from any workflow's cache
-        # Each workflow maintains its own registry that accumulates its needed crates
-        key: continuwuity-cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ github.workflow }}
-        restore-keys: |
-          continuwuity-cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-
-
-    - name: End registry/toolchain restore group
-      shell: bash
-      run: echo "::endgroup::"
-
-    - name: Setup Rust toolchain
-      shell: bash
-      id: rust-setup
-      run: |
-        # Install rustup if not already cached
-        if ! command -v rustup &> /dev/null; then
-          echo "::group::📦 Installing rustup"
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --default-toolchain none
-          source "$CARGO_HOME/env"
-          echo "::endgroup::"
-        else
-          echo "✅ rustup already available"
-        fi
-
-        # Setup the appropriate Rust version
-        if [[ -n "${{ inputs.rust-version }}" ]]; then
-          echo "::group::📦 Setting up Rust ${{ inputs.rust-version }}"
-          # Set override first to prevent rust-toolchain.toml from auto-installing
-          rustup override set ${{ inputs.rust-version }} 2>/dev/null || true
-
-          # Check if we need to install/update the toolchain
-          if rustup toolchain list | grep -q "^${{ inputs.rust-version }}-"; then
-            rustup update ${{ inputs.rust-version }}
-          else
-            rustup toolchain install ${{ inputs.rust-version }} --profile minimal -c cargo,clippy,rustfmt
-          fi
-        else
-          echo "::group::📦 Setting up Rust from rust-toolchain.toml"
-          rustup show
-        fi
-
-        RUST_VERSION=$(rustc --version | cut -d' ' -f2)
-        echo "version=$RUST_VERSION" >> $GITHUB_OUTPUT
-
-        echo "::endgroup::"
-
-    - name: Install Rust components
-      if: inputs.rust-components != ''
-      shell: bash
-      run: |
-        echo "📦 Installing components: ${{ inputs.rust-components }}"
-        rustup component add ${{ inputs.rust-components }}
-
-    - name: Install Rust target
-      if: inputs.rust-target != ''
-      shell: bash
-      run: |
-        echo "📦 Installing target: ${{ inputs.rust-target }}"
-        rustup target add ${{ inputs.rust-target }}
-
-    - name: Start build cache restore group
-      shell: bash
-      run: echo "::group::📦 Restoring build cache"
-
-    - name: Setup sccache
-      uses: https://git.tomfos.tr/tom/sccache-action@v1
-
-    - name: End build cache restore group
-      shell: bash
-      run: echo "::endgroup::"
-
-    - name: Configure PATH and install tools
-      shell: bash
-      env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
-      run: |
-        # Add .cargo/bin to PATH permanently for all subsequent steps
-        echo "${{ github.workspace }}/.cargo/bin" >> $GITHUB_PATH
-
-        # For this step only, we need to add it to PATH since GITHUB_PATH takes effect in the next step
-        export PATH="${{ github.workspace }}/.cargo/bin:$PATH"
-
-        # Install cargo-binstall for fast binary installations
-        if command -v cargo-binstall &> /dev/null; then
-          echo "✅ cargo-binstall already available"
-        else
-          echo "::group::📦 Installing cargo-binstall"
-          curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
-          echo "::endgroup::"
-        fi
-
-        if command -v prek &> /dev/null; then
-          echo "✅ prek already available"
-        else
-          echo "::group::📦 Installing prek"
-          # prek isn't regularly published to crates.io, so we use git source
-          cargo-binstall -y --no-symlinks --git https://github.com/j178/prek prek
-          echo "::endgroup::"
-        fi
-
-        if command -v timelord &> /dev/null; then
-          echo "✅ timelord already available"
-        else
-          echo "::group::📦 Installing timelord"
-          cargo-binstall -y --no-symlinks timelord-cli
-          echo "::endgroup::"
-        fi
-
-    - name: Configure sccache environment
-      shell: bash
-      run: |
-        echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-        echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-        echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-        echo "CMAKE_CUDA_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-        echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
-
-        # Configure incremental compilation GC
-        # If we restored from old cache (partial hit), clean up aggressively
-        if [[ "${{ steps.build-cache.outputs.cache-hit }}" != "true" ]]; then
-          echo "♻️ Partial cache hit - enabling cache cleanup"
-          echo "CARGO_INCREMENTAL_GC_THRESHOLD=5" >> $GITHUB_ENV
-        fi
-
-    - name: Output version and summary
-      shell: bash
-      run: |
-        echo "📋 Setup complete:"
-        echo "  Rust: $(rustc --version)"
-        echo "  Cargo: $(cargo --version)"
-        echo "  prek: $(prek --version 2>/dev/null || echo 'installed')"
-        echo "  timelord: $(timelord --version 2>/dev/null || echo 'installed')"

.forgejo/actions/timelord/action.yml

@@ -1,120 +0,0 @@
-name: timelord
-description: |
-  Use timelord to set file timestamps with git-warp-time fallback for cache misses
-inputs:
-  key:
-    description: |
-      The key to use for caching the timelord data.
-    required: false
-    default: ''
-  path:
-    description: |
-      The path to the directory to be timestamped.
-    required: false
-    default: ''
-
-outputs:
-  database-path:
-    description: Path to timelord database
-    value: '${{ env.TIMELORD_CACHE_PATH }}'
-
-runs:
-  using: composite
-  steps:
-    - name: Set defaults
-      shell: bash
-      run: |
-        echo "TIMELORD_KEY=${{ inputs.key || format('timelord-v1-{0}-{1}', github.repository, hashFiles('**/*.rs', '**/Cargo.toml', '**/Cargo.lock')) }}" >> $GITHUB_ENV
-        echo "TIMELORD_PATH=${{ inputs.path || '.' }}" >> $GITHUB_ENV
-        echo "TIMELORD_CACHE_PATH=$HOME/.cache/timelord" >> $GITHUB_ENV
-        echo "PATH=$HOME/.cargo/bin:/usr/share/rust/.cargo/bin:$PATH" >> $GITHUB_ENV
-
-    - name: Restore binary cache
-      id: binary-cache
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: |
-          /usr/share/rust/.cargo/bin
-          ~/.cargo/bin
-        key: continuwuity-timelord-binaries
-
-    - name: Check if binaries need installation
-      shell: bash
-      id: check-binaries
-      run: |
-        NEED_INSTALL=false
-
-        # Ensure ~/.cargo/bin exists
-        mkdir -p ~/.cargo/bin
-
-        # Check and move timelord if needed
-        if [ -f /usr/share/rust/.cargo/bin/timelord ] && [ ! -f ~/.cargo/bin/timelord ]; then
-          echo "Moving timelord from /usr/share/rust/.cargo/bin to ~/.cargo/bin"
-          mv /usr/share/rust/.cargo/bin/timelord ~/.cargo/bin/
-        fi
-        if [ ! -f ~/.cargo/bin/timelord ]; then
-          echo "timelord-cli not found, needs installation"
-          NEED_INSTALL=true
-        fi
-
-        # Check and move git-warp-time if needed
-        if [ -f /usr/share/rust/.cargo/bin/git-warp-time ] && [ ! -f ~/.cargo/bin/git-warp-time ]; then
-          echo "Moving git-warp-time from /usr/share/rust/.cargo/bin to ~/.cargo/bin"
-          mv /usr/share/rust/.cargo/bin/git-warp-time ~/.cargo/bin/
-        fi
-        if [ ! -f ~/.cargo/bin/git-warp-time ]; then
-          echo "git-warp-time not found, needs installation"
-          NEED_INSTALL=true
-        fi
-
-        echo "need-install=$NEED_INSTALL" >> $GITHUB_OUTPUT
-
-    - name: Install timelord-cli and git-warp-time
-      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
-      with:
-        tool: git-warp-time,timelord-cli@3.0.1
-
-    - name: Save binary cache
-      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: |
-          /usr/share/rust/.cargo/bin
-          ~/.cargo/bin
-        key: continuwuity-timelord-binaries
-
-
-    - name: Restore timelord cache with fallbacks
-      id: timelord-restore
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: ${{ env.TIMELORD_CACHE_PATH }}
-        key: ${{ env.TIMELORD_KEY }}
-        restore-keys: |
-          continuwuity-timelord-${{ github.repository }}-
-
-    - name: Initialize timestamps on complete cache miss
-      if: steps.timelord-restore.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        echo "Complete timelord cache miss - running git-warp-time"
-        git fetch --unshallow
-        if [ "${{ env.TIMELORD_PATH }}" = "." ]; then
-          git-warp-time --quiet
-        else
-          git-warp-time --quiet ${{ env.TIMELORD_PATH }}
-        fi
-        echo "Git timestamps restored"
-
-    - name: Run timelord sync
-      shell: bash
-      run: |
-        mkdir -p ${{ env.TIMELORD_CACHE_PATH }}
-        timelord sync --source-dir ${{ env.TIMELORD_PATH }} --cache-dir ${{ env.TIMELORD_CACHE_PATH }}
-
-    - name: Save updated timelord cache immediately
-      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-      with:
-        path: ${{ env.TIMELORD_CACHE_PATH }}
-        key: ${{ env.TIMELORD_KEY }}

.forgejo/actions/upload-docker-artifacts/action.yml

@@ -1,70 +0,0 @@
-name: upload-docker-artifacts
-description: |
-  Upload Docker build artifacts including binary and digest files.
-  Handles artifact naming and conditional digest uploads for registry publishing.
-
-inputs:
-  slug:
-    description: Platform slug for artifact naming (e.g. linux-amd64, linux-arm64)
-    required: true
-  cpu_suffix:
-    description: CPU suffix for artifact naming (e.g. -haswell)
-    required: false
-    default: ""
-  artifact_suffix:
-    description: Suffix for binary artifacts (e.g. -maxperf)
-    required: false
-    default: ""
-  digest_suffix:
-    description: Suffix for digest artifacts (e.g. -maxperf)
-    required: false
-    default: ""
-  digest:
-    description: The digest of the built Docker image
-    required: true
-
-outputs:
-  binary_artifact_name:
-    description: The name of the uploaded binary artifact
-    value: conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-
-runs:
-  using: composite
-  steps:
-    - name: Export digest
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      shell: bash
-      run: |
-        mkdir -p /tmp/digests
-        digest="${{ inputs.digest }}"
-        echo "🔍 Build step digest output: '$digest'"
-        if [[ -z "$digest" ]]; then
-          echo "❌ ERROR: No digest found from build step"
-          exit 1
-        fi
-        digest_file="/tmp/digests/${digest#sha256:}"
-        echo "📁 Creating digest file: $digest_file"
-        touch "$digest_file"
-        echo "✅ Digest file created successfully"
-        echo "📋 Contents of /tmp/digests:"
-        ls -la /tmp/digests/
-
-    - name: Rename extracted binary
-      shell: bash
-      run: mv /tmp/binaries/sbin/conduwuit /tmp/binaries/conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-
-    - name: Upload binary artifact
-      uses: forgejo/upload-artifact@v4
-      with:
-        name: conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-        path: /tmp/binaries/conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-        if-no-files-found: error
-
-    - name: Upload digest
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: forgejo/upload-artifact@v4
-      with:
-        name: digests${{ inputs.digest_suffix }}-${{ inputs.slug }}${{ inputs.cpu_suffix }}
-        path: /tmp/digests/*
-        if-no-files-found: error
-        retention-days: 5

.forgejo/pull_request_template.md

@@ -1,80 +0,0 @@
----
-name: 'New pull request'
-about: 'Open a new pull request to contribute to continuwuity'
-ref: 'main'
----
-
-<!--
-In order to help reviewers know what your pull request does at a glance, you should ensure that
-
-1. Your PR title is a short, single sentence describing what you changed
-2. You have described in more detail what you have changed, why you have changed it, what the
-   intended effect is, and why you think this will be beneficial to the project.
-
-If you have made any potentially strange/questionable design choices, but didn't feel they'd benefit
-from code comments, please don't mention them here - after opening your pull request,
-go to "files changed", and click on the "+" symbol in the line number gutter,
-and attach comments to the lines that you think would benefit from some clarification.
--->
-
-This pull request...
-
-<!-- Example:
-This pull request allows us to warp through time and space ten times faster than before by
-double-inverting the warp drive with hyperheated jump fluid, both making the drive faster and more
-efficient. This resolves the common issue where we have to wait more than 10 milliseconds to
-engage, use, and disengage the warp drive when travelling between galaxies.
--->
-
-<!-- Closes: #... -->
-<!-- Fixes: #...  -->
-<!-- Uncomment the above line(s) if your pull request fixes an issue or closes another pull request
-by superseding it. Replace `#...` with the issue/pr number, such as `#123`. -->
-
-**Pull request checklist:**
-
-<!-- You need to complete these before your PR can be considered.
-If you aren't sure about some, feel free to ask for clarification in #dev:continuwuity.org. -->
-- [ ] This pull request targets the `main` branch, and the branch is named something other than
-      `main`.
-- [ ] I have written an appropriate pull request title and my description is clear.
-- [ ] I understand I am responsible for the contents of this pull request.
-- I have followed the [contributing guidelines][c1]:
-  - [ ] My contribution follows the [code style][c2], if applicable.
-  - [ ] I ran [pre-commit checks][c1pc] before opening/drafting this pull request.
-  - [ ] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes)
-        myself, if applicable. This includes ensuring code compiles.
-  - [ ] My commit messages follow the [commit message format][c1cm] and are descriptive.
-
-<!--
-Notes on these requirements:
-
-- While not required, we encourage you to sign your commits with GPG or SSH to attest the
-  authenticity of your changes.
-- While we allow LLM-assisted contributions, we do not appreciate contributions that are
-  low quality, which is typical of machine-generated contributions that have not had a lot of love
-  and care from a human. Please do not open a PR if all you have done is asked ChatGPT to tidy up
-  the codebase with a +-100,000 diff.
-- In the case of code style violations, reviewers may leave review comments/change requests
-  indicating what the ideal change would look like. For example, a reviewer may suggest you lower
-  a log level, or use `match` instead of `if/else` etc.
-- In the case of code style violations, pre-commit check failures, minor things like typos/spelling
-  errors, and in some cases commit format violations, reviewers may modify your branch directly,
-  typically by making changes and adding a commit. Particularly in the latter case, a reviewer may
-  rebase your commits to squash "spammy" ones (like "fix", "fix", "actually fix"), and reword
-  commit messages that don't satisfy the format.
-- Pull requests MUST pass the `Checks` CI workflows to be capable of being merged. This can only be
-  bypassed in exceptional circumstances.
-  If your CI flakes, let us know in matrix:r/dev:continuwuity.org.
-- Pull requests have to be based on the latest `main` commit before being merged. If the main branch
-  changes while you're making your changes, you should make sure you rebase on main before
-  opening a PR. Your branch will be rebased on main before it is merged if it has fallen behind.
-- We typically only do fast-forward merges, so your entire commit log will be included. Once in
-  main, it's difficult to get out cleanly, so put on your best dress, smile for the cameras!
--->
-
-[c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md
-[c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx
-[c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks
-[c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally
-[c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages

.forgejo/regsync/regsync.yml

@@ -1,72 +0,0 @@
-version: 1
-
-x-source: &source forgejo.ellis.link/continuwuation/continuwuity
-
-x-tags:
-  releases: &tags-releases
-    tags:
-      allow:
-      - "latest"
-      - "v[0-9]+\\.[0-9]+\\.[0-9]+(-[a-z0-9\\.]+)?"
-      - "v[0-9]+\\.[0-9]+"
-      - "v[0-9]+"
-  main: &tags-main
-    tags:
-      allow:
-      - "latest"
-      - "v[0-9]+\\.[0-9]+\\.[0-9]+(-[a-z0-9\\.]+)?"
-      - "v[0-9]+\\.[0-9]+"
-      - "v[0-9]+"
-      - "main"
-  commits: &tags-commits
-    tags:
-      allow:
-      - "latest"
-      - "v[0-9]+\\.[0-9]+\\.[0-9]+(-[a-z0-9\\.]+)?"
-      - "v[0-9]+\\.[0-9]+"
-      - "v[0-9]+"
-      - "main"
-      - "sha-[a-f0-9]+"
-  all: &tags-all
-    tags:
-      allow:
-      - ".*"
-
-# Registry credentials
-creds:
-  - registry: forgejo.ellis.link
-    user: "{{env \"BUILTIN_REGISTRY_USER\"}}"
-    pass: "{{env \"BUILTIN_REGISTRY_PASSWORD\"}}"
-  - registry: registry.gitlab.com
-    user: "{{env \"GITLAB_USERNAME\"}}"
-    pass: "{{env \"GITLAB_TOKEN\"}}"
-  - registry: git.nexy7574.co.uk
-    user: "{{env \"N7574_GIT_USERNAME\"}}"
-    pass: "{{env \"N7574_GIT_TOKEN\"}}"
-  - registry: ghcr.io
-    user: "{{env \"GH_PACKAGES_USER\"}}"
-    pass: "{{env \"GH_PACKAGES_TOKEN\"}}"
-  - registry: docker.io
-    user: "{{env \"DOCKER_MIRROR_USER\"}}"
-    pass: "{{env \"DOCKER_MIRROR_TOKEN\"}}"
-
-# Global defaults
-defaults:
-  parallel: 3
-  interval: 2h
-  digestTags: true
-
-# Sync configuration - each registry gets different image sets
-sync:
-  - source: *source
-    target: registry.gitlab.com/continuwuity/continuwuity
-    type: repository
-    <<: *tags-main
-  - source: *source
-    target: ghcr.io/continuwuity/continuwuity
-    type: repository
-    <<: *tags-main
-  - source: *source
-    target: docker.io/jadedblueeyes/continuwuity
-    type: repository
-    <<: *tags-main

.forgejo/workflows/auto-labeler.yml

@@ -1,56 +0,0 @@
-name: Auto Labeler
-
-on:
-  pull_request_target:
-    types: [opened, reopened]
-
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
-jobs:
-  auto-label:
-    name: Apply labels based on changed files
-    runs-on: ubuntu-latest
-    steps:
-      - name: Apply PR Labels
-        uses: https://github.com/actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const allFiles = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-
-            const fileNames = allFiles.map(f => f.filename);
-            const labelsToAdd = new Set();
-
-            for (const file of fileNames) {
-              if (file.startsWith('docs/') || file.startsWith('theme/') || (file.endsWith('.md') && !file.startsWith('changelog.d/')) || file == 'rspress.config.ts') {
-                labelsToAdd.add('Documentation');
-              }
-              if (file.startsWith('.forgejo/')) {
-                labelsToAdd.add('Meta/CI');
-              }
-              if (file.startsWith('pkg/') || file.startsWith('nix/') || file === 'flake.nix' || file === 'flake.lock' || file.startsWith('docker/')) {
-                labelsToAdd.add('Meta/Packaging');
-              }
-              if (file === 'Cargo.lock') {
-                labelsToAdd.add('Dependencies');
-              }
-            }
-
-            if (labelsToAdd.size > 0) {
-              const labelsArray = Array.from(labelsToAdd);
-              console.log('Adding labels:', labelsArray);
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                labels: labelsArray,
-              });
-            } else {
-              console.log('No files changed that require auto-labeling.');
-            }

.forgejo/workflows/build-debian.yml

@@ -1,162 +0,0 @@
-name: Build / Debian DEB
-
-concurrency:
-  group: "build-debian-${{ forge.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
-  schedule:
-    - cron: '30 0 * * 1'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        container: [ "ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable" ]
-    container:
-      image: "ghcr.io/tcpipuk/act-runner:${{ matrix.container }}"
-
-    steps:
-      - name: Get Debian version
-        id: debian-version
-        run: |
-          VERSION=$(cat /etc/debian_version)
-          DISTRIBUTION=$(lsb_release -sc 2>/dev/null)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
-          echo "Debian distribution: $DISTRIBUTION ($VERSION)"
-      #- name: Work around llvm-project#153385
-      #  id: llvm-workaround
-      #  run: |
-      #    if [ -f /usr/share/apt/default-sequoia.config ]; then
-      #      echo "Applying workaround for llvm-project#153385"
-      #      mkdir -p /etc/crypto-policies/back-ends/
-      #      cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
-      #      sed -i 's/\(sha1\.second_preimage_resistance = \)2026-02-01/\12026-06-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
-      #    else
-      #      echo "No workaround needed for llvm-project#153385"
-      #    fi
-
-      - name: Checkout repository with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref_name }}
-
-      - name: Cache Cargo registry
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-debian-${{ steps.debian-version.outputs.distribution }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            cargo-debian-${{ steps.debian-version.outputs.distribution }}-
-
-      - name: Setup sccache
-        uses: https://git.tomfos.tr/tom/sccache-action@v1
-
-      - name: Configure sccache environment
-        run: |
-          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
-          # Aggressive GC since cache restores don't increment counter
-          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
-
-      - name: Setup Rust
-        uses: ./.forgejo/actions/setup-rust
-        with:
-          github-token: ${{ secrets.GH_PUBLIC_RO }}
-
-      - name: Get package version and component
-        id: package-meta
-        run: |
-          BASE_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r ".packages[] | select(.name == \"conduwuit\").version" | sed 's/[^a-zA-Z0-9.+]/~/g')
-          # VERSION is the package version, COMPONENT is used in
-          # apt's repository config like a git repo branch
-          VERSION=$BASE_VERSION
-          if [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+$ ]]; then
-            # Use the "stable" component for tagged semver releases
-            COMPONENT="stable"
-          elif [[ ${{ forge.ref_name }} =~ ^v+[0-9]+\.+[0-9]+\.+[0-9]+ ]]; then
-            # Use the "unstable" component for tagged semver pre-releases
-            COMPONENT="unstable"
-          else
-            # Use the "dev" component for development builds
-            SHA=$(echo "${{ forge.sha }}" | cut -c1-7)
-            DATE=$(date +%Y%m%d)
-            if [ "${{ forge.ref_name }}" = "main" ]; then
-              COMPONENT="dev"
-            else
-              # Use the sanitized ref name as the component for feature branches
-              COMPONENT="dev-$(echo '${{ forge.ref_name }}' | sed 's/[^a-zA-Z0-9.+]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)"
-            fi
-            CLEAN_COMPONENT=$(echo $COMPONENT | sed 's/[^a-zA-Z0-9.+]/~/g')
-            VERSION="$BASE_VERSION~git$DATE.$SHA-$CLEAN_COMPONENT"
-          fi
-          echo "component=$COMPONENT" >> $GITHUB_OUTPUT
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Component: $COMPONENT"
-          echo "Version: $VERSION"
-
-      - name: Install cargo-deb
-        run: |
-          if command -v cargo-deb &> /dev/null; then
-            echo "cargo-deb already available"
-          else
-            echo "Installing cargo-deb"
-            cargo-binstall -y --no-symlinks cargo-deb
-          fi
-
-      - name: Install build dependencies
-        run: |
-          apt-get update -y
-          # Build dependencies for rocksdb
-          apt-get install -y liburing-dev clang
-
-      - name: Run cargo-deb
-        id: cargo-deb
-        run: |
-          DEB_PATH=$(cargo deb --deb-version ${{ steps.package-meta.outputs.version }})
-          echo "path=$DEB_PATH" >> $GITHUB_OUTPUT
-
-      - name: Test deb installation
-        run: |
-          echo "Installing: ${{ steps.cargo-deb.outputs.path }}"
-
-          apt-get install -y ${{ steps.cargo-deb.outputs.path }}
-
-          dpkg -s continuwuity
-
-          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
-          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
-          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
-
-      - name: Upload deb artifact
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: continuwuity-${{ steps.debian-version.outputs.distribution }}
-          path: ${{ steps.cargo-deb.outputs.path }}
-
-      - name: Publish to Forgejo package registry
-        if: ${{ forge.event_name == 'push' || forge.event_name == 'workflow_dispatch' || forge.event_name == 'schedule' }}
-        run: |
-          OWNER="continuwuation"
-          DISTRIBUTION=${{ steps.debian-version.outputs.distribution }}
-          COMPONENT=${{ steps.package-meta.outputs.component }}
-          DEB=${{ steps.cargo-deb.outputs.path }}
-
-          echo "Publishing: $DEB in component $COMPONENT for distribution $DISTRIBUTION"
-
-          curl --fail-with-body \
-            -X PUT \
-            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-            --upload-file "$DEB" \
-            "${{ forge.server_url }}/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"

.forgejo/workflows/build-nix.yml

@@ -1,71 +0,0 @@
-name: Build / Static via Nix
-
-concurrency:
-  group: "build-nix-${{ forge.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
-  schedule:
-    - cron: '30 0 * * 3'
-
-jobs:
-  build:
-    name: "Build ${{ matrix.filename }} Binary"
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        include:
-          - package: default-static-x86_64
-            filename: conduwuit-linux-static-amd64
-          - package: default-static-aarch64
-            filename: conduwuit-linux-static-arm64
-
-          - package: max-perf-static-aarch64
-            filename: conduwuit-linux-static-arm64-maxperf
-          - package: max-perf-haswell-static-x86_64
-            filename: conduwuit-haswell-linux-static-amd64-maxperf
-
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
-
-      - name: Install Lix
-        uses: https://github.com/samueldr/lix-gha-installer-action@a0fee77b2a98bb7c5c0ed7ae6d6ad4903dbdad0d
-        with:
-          extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
-
-      - name: Build static binary
-        run: |
-          nix build .#${{ matrix.package }}
-          install -D result/bin/conduwuit /tmp/binaries/${{ matrix.filename }}
-
-      - name: Upload binary artifact
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: ${{ matrix.filename }}
-          path: /tmp/binaries/${{ matrix.filename }}
-
-  release-binaries:
-    name: "Release Binaries"
-    runs-on: ubuntu-latest
-    needs:
-      - build
-    permissions:
-      contents: write
-    if: startsWith(github.ref, 'refs/tags/')
-    steps:
-      - name: Download binary artifacts
-        uses: forgejo/download-artifact@v4
-        with:
-          pattern: conduwuit*
-          path: binaries
-          merge-multiple: true
-      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
-        with:
-          draft: true
-          files: binaries/*

.forgejo/workflows/check-changelog.yml

@@ -1,90 +0,0 @@
-name: Checks / Changelog
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
-
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
-jobs:
-  check-changelog:
-    name: Check changelog is added
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check for changelog entry
-        id: check_files
-        run: |
-          AUTH=$(echo -n "x-access-token:${{ secrets.GITHUB_TOKEN }}" | base64 -w 0)
-          git config --global http.${{ github.server_url }}/.extraheader "Authorization: basic $AUTH"
-          git clone "${{ github.event.repository.clone_url }}" repo.git --bare
-
-          git -C repo.git fetch origin pull/${{ github.event.pull_request.number }}/head
-
-          # Check for Added (A) or Modified (M) files in changelog.d
-          CHANGELOG_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- changelog.d/)
-
-          SRC_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- src/)
-
-          echo "Changes in changelog.d/:"
-          echo "$CHANGELOG_CHANGES"
-          echo "Changes in src/:"
-          echo "$SRC_CHANGES"
-
-          if echo "$CHANGELOG_CHANGES" | grep -q "^[AM]"; then
-            echo "has_changelog=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_changelog=false" >> $GITHUB_OUTPUT
-          fi
-
-          if [ -n "$SRC_CHANGES" ]; then
-            echo "src_changed=true" >> $GITHUB_OUTPUT
-          else
-            echo "src_changed=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Manage PR Labels
-        uses: https://github.com/actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        env:
-          HAS_CHANGELOG: ${{ steps.check_files.outputs.has_changelog }}
-          SRC_CHANGED: ${{ steps.check_files.outputs.src_changed }}
-        with:
-          script: |
-            const hasChangelog = process.env.HAS_CHANGELOG === 'true';
-            const srcChanged = process.env.SRC_CHANGED === 'true';
-
-            const { data: pullRequest } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-
-            const currentLabels = pullRequest.labels.map(l => l.name);
-
-            if (hasChangelog) {
-              console.log('PR has changelog');
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                labels: ['Changelog/Added'],
-              });
-            } else if (currentLabels.includes('Changelog/None')) {
-              console.log('PR has Changelog/None label, skipping.');
-            } else if (srcChanged) {
-              console.log('PR is missing changelog');
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                labels: ['Changelog/Missing'],
-              });
-              core.setFailed("Missing changelog entry (detected)");
-            } else if (currentLabels.includes('Changelog/Missing')) {
-              core.setFailed("Missing changelog entry (label)");
-            } else {
-              console.log('Changelog not needed');
-              // Changelog is probably not needed
-            }

.forgejo/workflows/documentation.yml

@@ -1,71 +0,0 @@
-name: Documentation
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-concurrency:
-  group: "pages-${{ github.ref }}"
-  cancel-in-progress: true
-
-jobs:
-  docs:
-    name: Build and Deploy Documentation
-    runs-on: ubuntu-latest
-    if: secrets.CLOUDFLARE_API_TOKEN != ''
-
-    steps:
-      - name: Sync repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
-      - name: Detect runner environment
-        id: runner-env
-        uses: https://git.tomfos.tr/actions/detect-versions@v1
-
-      - name: Setup Node.js
-        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 22
-
-      - name: Cache npm dependencies
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.npm
-          key: continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-${{ steps.runner-env.outputs.node_version }}-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-${{ steps.runner-env.outputs.node_version }}-
-            continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build Rspress documentation
-        run: npm run docs:build
-
-      - name: Install Wrangler
-        run: npm install --save-dev wrangler@latest
-
-      - name: Deploy to Cloudflare Pages (Production)
-        if: github.ref == 'refs/heads/main' && vars.CLOUDFLARE_PROJECT_NAME != ''
-        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
-        with:
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          command: pages deploy ./doc_build --branch="main" --commit-dirty=true --project-name="${{ vars.CLOUDFLARE_PROJECT_NAME }}"
-
-      - name: Deploy to Cloudflare Pages (Preview)
-        if: github.ref != 'refs/heads/main' && vars.CLOUDFLARE_PROJECT_NAME != ''
-        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
-        with:
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          command: pages deploy ./doc_build --branch="${{ github.head_ref || github.ref_name }}" --commit-dirty=true --project-name="${{ vars.CLOUDFLARE_PROJECT_NAME }}"

.forgejo/workflows/element.yml

@@ -1,132 +0,0 @@
-name: Deploy Element Web
-
-on:
-  schedule:
-    - cron: "0 0 * * *"
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - ".forgejo/workflows/element.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - ".forgejo/workflows/element.yml"
-
-concurrency:
-  group: "element-${{ github.ref }}"
-  cancel-in-progress: true
-
-jobs:
-  build-and-deploy:
-    name: 🏗️ Build and Deploy
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: "22"
-
-      - name: 🔨 Clone, setup, and build Element Web
-        run: |
-          echo "Cloning Element Web..."
-          git clone https://github.com/maunium/element-web
-          cd element-web
-          git checkout develop
-          git pull
-
-          echo "Cloning matrix-js-sdk..."
-          git clone https://github.com/matrix-org/matrix-js-sdk.git
-
-          echo "Installing Yarn..."
-          npm install -g yarn
-
-          echo "Installing dependencies..."
-          yarn install
-
-          echo "Preparing build environment..."
-          mkdir -p .home
-
-          echo "Cleaning up specific node_modules paths..."
-          rm -rf node_modules/@types/eslint-scope/ matrix-*-sdk/node_modules/@types/eslint-scope || echo "Cleanup paths not found, continuing."
-
-          echo "Getting matrix-js-sdk commit hash..."
-          cd matrix-js-sdk
-          jsver=$(git rev-parse HEAD)
-          jsver=${jsver:0:12}
-          cd ..
-          echo "matrix-js-sdk version hash: $jsver"
-
-          echo "Getting element-web commit hash..."
-          ver=$(git rev-parse HEAD)
-          ver=${ver:0:12}
-          echo "element-web version hash: $ver"
-
-          chmod +x ./build-sh
-
-          export VERSION="$ver-js-$jsver"
-          echo "Building Element Web version: $VERSION"
-          ./build-sh
-
-          echo "Checking for build output..."
-          ls -la webapp/
-
-      - name: ⚙️ Create config.json
-        run: |
-          cat <<EOF > ./element-web/webapp/config.json
-          {
-            "default_server_name": "continuwuity.org",
-            "default_server_config": {
-              "m.homeserver": {
-                "base_url": "https://matrix.continuwuity.org"
-              }
-            },
-            "default_country_code": "GB",
-            "default_theme": "dark",
-            "mobile_guide_toast": false,
-            "show_labs_settings": true,
-            "room_directory": [
-              "continuwuity.org",
-              "matrixrooms.info"
-            ],
-            "settings_defaults": {
-              "UIFeature.urlPreviews": true,
-              "UIFeature.feedback": false,
-              "UIFeature.voip": false,
-              "UIFeature.shareQrCode": false,
-              "UIFeature.shareSocial": false,
-              "UIFeature.locationSharing": false,
-              "enableSyntaxHighlightLanguageDetection": true
-            },
-            "features": {
-              "feature_pinning": true,
-              "feature_custom_themes": true
-            }
-          }
-          EOF
-          echo "Created ./element-web/webapp/config.json"
-          cat ./element-web/webapp/config.json
-
-      - name: 📤 Upload Artifact
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: element-web
-          path: ./element-web/webapp/
-          retention-days: 14
-
-      - name: 🛠️ Install Wrangler
-        run: npm install --save-dev wrangler@latest
-
-      - name: 🚀 Deploy to Cloudflare Pages
-        if: vars.CLOUDFLARE_PROJECT_NAME != ''
-        id: deploy
-        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
-        with:
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          command: >-
-            pages deploy ./element-web/webapp
-            --branch="${{ github.ref == 'refs/heads/main' && 'main' || github.head_ref || github.ref_name }}"
-            --commit-dirty=true
-            --project-name="${{ vars.CLOUDFLARE_PROJECT_NAME }}-element"

.forgejo/workflows/mirror-images.yml

@@ -1,69 +0,0 @@
-name: Mirror Container Images
-
-on:
-  schedule:
-    # Run nightly
-    - cron: "25 2 * * *"
-
-  workflow_call:
-
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Dry run (check only, no actual mirroring)'
-        required: false
-        default: false
-        type: boolean
-  push:
-    branches:
-      - main
-    paths:
-      # Re-run when config changes
-      - '.forgejo/regsync/regsync.yml'
-      - '.forgejo/workflows/mirror-images.yml'
-concurrency:
-  group: "mirror-images"
-  cancel-in-progress: true
-
-jobs:
-  mirror-images:
-    runs-on: ubuntu-latest
-    env:
-      BUILTIN_REGISTRY_USER: ${{ vars.BUILTIN_REGISTRY_USER }}
-      BUILTIN_REGISTRY_PASSWORD: ${{ secrets.BUILTIN_REGISTRY_PASSWORD }}
-      GITLAB_USERNAME: ${{ vars.GITLAB_USERNAME }}
-      GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-      N7574_GIT_USERNAME: ${{ vars.N7574_GIT_USERNAME }}
-      N7574_GIT_TOKEN: ${{ secrets.N7574_GIT_TOKEN }}
-      GH_PACKAGES_USER: ${{ vars.GH_PACKAGES_USER }}
-      GH_PACKAGES_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
-      DOCKER_MIRROR_USER: ${{ vars.DOCKER_MIRROR_USER }}
-      DOCKER_MIRROR_TOKEN: ${{ secrets.DOCKER_MIRROR_TOKEN }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      # - uses: https://github.com/actions/create-github-app-token@v2
-      #   id: app-token
-      #   with:
-      #     app-id: ${{ vars.GH_APP_ID }}
-      #     private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      #     github-api-url: https://api.github.com
-      #     owner: continuwuity
-      #     repositories: continuwuity
-
-      - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@39bf30ced4be9d147faaabbde2682e9725fb8bd1 # main
-
-      - name: Check what images need mirroring
-        run: |
-          echo "Checking images that need mirroring..."
-          regsync check -c .forgejo/regsync/regsync.yml -v info
-
-      - name: Mirror images
-        if: ${{ !inputs.dry_run }}
-        run: |
-          echo "Starting image mirroring..."
-          regsync once -c .forgejo/regsync/regsync.yml -v info

.forgejo/workflows/prek-checks.yml

@@ -1,106 +0,0 @@
-name: Checks / Prek
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  fast-checks:
-    name: Pre-commit & Formatting
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup Rust nightly
-        uses: ./.forgejo/actions/setup-rust
-        with:
-          rust-version: nightly
-          github-token: ${{ secrets.GH_PUBLIC_RO }}
-
-      - name: Run prek
-        run: |
-          prek run \
-            --all-files \
-            --hook-stage manual \
-            --show-diff-on-failure \
-            --color=always \
-            -v
-
-      - name: Check Rust formatting
-        run: |
-          cargo +nightly fmt --all -- --check && \
-            echo "✅ Formatting check passed" || \
-            exit 1
-  check-changes:
-    name: Check changed files
-    runs-on: ubuntu-latest
-    outputs:
-      rust: ${{ steps.filter.outputs.rust }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Check for file changes
-        uses: https://github.com/dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
-        id: filter
-        with:
-          filters: |
-            rust:
-              - '**/*.rs'
-              - '**/Cargo.toml'
-              - '**/Cargo.lock'
-
-  clippy-and-tests:
-    name: Clippy and Cargo Tests
-    runs-on: ubuntu-latest
-    needs: check-changes
-    if: needs.check-changes.outputs.rust == 'true'
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - name: Setup LLVM
-        uses: ./.forgejo/actions/setup-llvm-with-apt
-        with:
-          extra-packages: liburing-dev liburing2
-
-      - name: Setup Rust with caching
-        uses: ./.forgejo/actions/setup-rust
-        with:
-          github-token: ${{ secrets.GH_PUBLIC_RO }}
-
-      - name: Run Clippy lints
-        run: |
-          cargo clippy \
-            --workspace \
-            --features full \
-            --locked \
-            --no-deps \
-            --profile test \
-            -- \
-            -D warnings
-
-      - name: Run Cargo tests
-        run: |
-          cargo test \
-            --workspace \
-            --features full \
-            --locked \
-            --profile test \
-            --all-targets \
-            --no-fail-fast

.forgejo/workflows/release-image.yml

@@ -1,231 +0,0 @@
-name: Release Docker Image
-concurrency:
-  group: "release-image-${{ github.ref }}"
-
-on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "*.md"
-      - "**/*.md"
-      - "*.mdx"
-      - "**/*.mdx"
-      - "changelog.d/**"
-      - ".gitlab-ci.yml"
-      - ".gitignore"
-      - "renovate.json"
-      - "pkg/**"
-      - "docs/**"
-    tags:
-      - "v*.*.*"
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-env:
-  BUILTIN_REGISTRY: forgejo.ellis.link
-  BUILTIN_REGISTRY_ENABLED: "${{ ((vars.BUILTIN_REGISTRY_USER && secrets.BUILTIN_REGISTRY_PASSWORD) || (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)) && 'true' || 'false' }}"
-  IMAGE_PATH: forgejo.ellis.link/continuwuation/continuwuity
-
-jobs:
-  build-release:
-    name: "Build ${{ matrix.slug }} (release)"
-    runs-on: dind
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    strategy:
-      matrix:
-        include:
-          - platform: "linux/amd64"
-            slug: "linux-amd64"
-          - platform: "linux/arm64"
-            slug: "linux-arm64"
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Prepare Docker build environment
-        id: prepare
-        uses: ./.forgejo/actions/prepare-docker-build
-        with:
-          platform: ${{ matrix.platform }}
-          slug: ${{ matrix.slug }}
-          target_cpu: ""
-          profile: "release"
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
-      - name: Build and push Docker image by digest
-        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
-        with:
-          context: .
-          file: "docker/Dockerfile"
-          build-args: |
-            GIT_COMMIT_HASH=${{ github.sha }}
-            GIT_COMMIT_HASH_SHORT=${{ env.COMMIT_SHORT_SHA }}
-            GIT_REMOTE_URL=${{github.event.repository.html_url }}
-            GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
-            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
-            TARGET_CPU=
-            RUST_PROFILE=release
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.prepare.outputs.metadata_labels }}
-          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
-          cache-from: type=gha
-          # cache-to: type=gha,mode=max
-          sbom: true
-          outputs: |
-            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', env.IMAGE_PATH) || format('type=image,"name={0}",push=false', env.IMAGE_PATH) }}
-            type=local,dest=/tmp/binaries
-        env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-      - name: Upload Docker artifacts
-        uses: ./.forgejo/actions/upload-docker-artifacts
-        with:
-          slug: ${{ matrix.slug }}
-          cpu_suffix: ${{ steps.prepare.outputs.cpu_suffix }}
-          artifact_suffix: ""
-          digest_suffix: ""
-          digest: ${{ steps.build.outputs.digest }}
-
-  merge-release:
-    name: "Create Multi-arch Release Manifest"
-    runs-on: dind
-    needs: build-release
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Create multi-platform manifest
-        uses: ./.forgejo/actions/create-docker-manifest
-        with:
-          digest_pattern: "digests-linux-{amd64,arm64}"
-          tag_suffix: ""
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
-
-  build-maxperf:
-    name: "Build ${{ matrix.slug }} (max-perf)"
-    runs-on: dind
-    needs: build-release
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    strategy:
-      matrix:
-        include:
-          - platform: "linux/amd64"
-            slug: "linux-amd64"
-            target_cpu: "haswell"
-          - platform: "linux/arm64"
-            slug: "linux-arm64"
-            target_cpu: ""
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Prepare max-perf Docker build environment
-        id: prepare
-        uses: ./.forgejo/actions/prepare-docker-build
-        with:
-          platform: ${{ matrix.platform }}
-          slug: ${{ matrix.slug }}
-          target_cpu: ${{ matrix.target_cpu }}
-          profile: "release-max-perf"
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
-      - name: Build and push max-perf Docker image by digest
-        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
-        with:
-          context: .
-          file: "docker/Dockerfile"
-          build-args: |
-            GIT_COMMIT_HASH=${{ github.sha }}
-            GIT_COMMIT_HASH_SHORT=${{ env.COMMIT_SHORT_SHA }}
-            GIT_REMOTE_URL=${{github.event.repository.html_url }}
-            GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
-            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
-            TARGET_CPU=${{ matrix.target_cpu }}
-            RUST_PROFILE=release-max-perf
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.prepare.outputs.metadata_labels }}
-          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
-          cache-from: type=gha
-          # cache-to: type=gha,mode=max
-          sbom: true
-          outputs: |
-            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', env.IMAGE_PATH) || format('type=image,"name={0}",push=false', env.IMAGE_PATH) }}
-            type=local,dest=/tmp/binaries
-        env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-      - name: Upload max-perf Docker artifacts
-        uses: ./.forgejo/actions/upload-docker-artifacts
-        with:
-          slug: ${{ matrix.slug }}
-          cpu_suffix: ${{ steps.prepare.outputs.cpu_suffix }}
-          artifact_suffix: "-maxperf"
-          digest_suffix: "-maxperf"
-          digest: ${{ steps.build.outputs.digest }}
-
-  merge-maxperf:
-    name: "Create Max-Perf Manifest"
-    runs-on: dind
-    needs: build-maxperf
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-      - name: Create max-perf manifest
-        uses: ./.forgejo/actions/create-docker-manifest
-        with:
-          digest_pattern: "digests-maxperf-linux-{amd64-haswell,arm64}"
-          tag_suffix: "-maxperf"
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
-
-  release-binaries:
-    name: "Release Binaries"
-    runs-on: ubuntu-latest
-    needs:
-      - build-release
-      - build-maxperf
-    permissions:
-      contents: write
-    if: startsWith(github.ref, 'refs/tags/')
-    steps:
-      - name: Download binary artifacts
-        uses: forgejo/download-artifact@v4
-        with:
-          pattern: conduwuit*
-          path: binaries
-          merge-multiple: true
-      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
-        with:
-          draft: true
-          files: binaries/*
-
-  mirror_images:
-    name: "Mirror Images"
-    runs-on: ubuntu-latest
-    needs:
-      - merge-maxperf
-      - merge-release
-    secrets: inherit
-    uses: ./.forgejo/workflows/mirror-images.yml

.forgejo/workflows/renovate.yml

@@ -1,132 +0,0 @@
-name: Maintenance / Renovate
-
-enable-email-notifications: true
-
-on:
-  schedule:
-    # Run at 5am UTC daily to avoid late-night dev
-    - cron: '0 5 * * *'
-
-  workflow_dispatch:
-    inputs:
-      dryRun:
-        description: 'Dry run mode'
-        required: false
-        default: ''
-        type: choice
-        options:
-          - ''
-          - 'extract'
-          - 'lookup'
-          - 'full'
-      logLevel:
-        description: 'Log level'
-        required: false
-        default: 'info'
-        type: choice
-        options:
-          - 'debug'
-          - 'info'
-          - 'warning'
-          - 'critical'
-
-  push:
-    branches:
-      - main
-    paths:
-      # Re-run when config changes
-      - '.forgejo/workflows/renovate.yml'
-      - 'renovate.json'
-
-jobs:
-  renovate:
-    name: Renovate
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
-      options: --tmpfs /tmp:exec
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          show-progress: false
-
-      - name: print node heap
-        run: /usr/local/renovate/node -e 'console.log(`node heap limit = ${require("v8").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'
-
-      - name: Restore renovate repo cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            /tmp/renovate/cache/renovate/repository
-          key: renovate-repo-cache-${{ github.run_id }}
-          restore-keys: |
-            renovate-repo-cache-
-
-      - name: Restore renovate package cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            /tmp/renovate/cache/renovate/renovate-cache-sqlite
-          key: renovate-package-cache-${{ github.run_id }}
-          restore-keys: |
-            renovate-package-cache-
-
-      - name: Restore renovate OSV cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            /tmp/osv
-          key: renovate-osv-cache-${{ github.run_id }}
-          restore-keys: |
-            renovate-osv-cache-
-
-      - name: Self-hosted Renovate
-        run: renovate
-        env:
-          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
-          RENOVATE_DRY_RUN: ${{ inputs.dryRun || 'false' }}
-
-          RENOVATE_PLATFORM: forgejo
-          RENOVATE_ENDPOINT: ${{ github.server_url }}
-          RENOVATE_AUTODISCOVER: 'false'
-          RENOVATE_REPOSITORIES: '["${{ github.repository }}", "continuwuation/resolvematrix"]'
-
-          RENOVATE_GIT_TIMEOUT: 60000
-
-          RENOVATE_REQUIRE_CONFIG: 'required'
-          # RENOVATE_ONBOARDING: 'false'
-          RENOVATE_INHERIT_CONFIG: 'true'
-
-          RENOVATE_GITHUB_TOKEN_WARN: 'false'
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          GITHUB_COM_TOKEN: ${{ secrets.GH_PUBLIC_RO || secrets.GH_TOKEN }}
-
-          RENOVATE_REPOSITORY_CACHE: 'enabled'
-          RENOVATE_X_SQLITE_PACKAGE_CACHE: 'true'
-          OSV_OFFLINE_ROOT_DIR: /tmp/osv
-
-      - name: Save renovate repo cache
-        if: always()
-        uses:
-          actions/cache/save@v5
-        with:
-          path: |
-            /tmp/renovate/cache/renovate/repository
-          key: renovate-repo-cache-${{ github.run_id }}
-
-      - name: Save renovate package cache
-        if: always()
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            /tmp/renovate/cache/renovate/renovate-cache-sqlite
-          key: renovate-package-cache-${{ github.run_id }}
-
-      - name: Save renovate OSV cache
-        if: always()
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            /tmp/osv
-          key: renovate-osv-cache-${{ github.run_id }}

.forgejo/workflows/update-flake-hashes.yml

@@ -1,73 +0,0 @@
-name: Update flake hashes
-
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "rust-toolchain.toml"
-      - "nix/**/*"
-      - ".forgejo/workflows/update-flake-hashes.yml"
-
-jobs:
-  update-flake-hashes:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: true
-          token: ${{ secrets.FORGEJO_TOKEN }}
-
-      - name: Install Lix
-        uses: https://github.com/samueldr/lix-gha-installer-action@f5e94192f565f53d84f41a056956dc0d3183b343
-        with:
-          extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
-
-      - name: Get new toolchain hash
-        run: |
-          # Set the current sha256 to an empty hash to make `nix build` calculate a new one
-          awk '/fromToolchainName *\{/{found=1; print; next} found && /sha256 =/{sub(/sha256 = .*/, "sha256 = lib.fakeSha256;"); found=0} 1' nix/rust.nix > temp.nix
-          mv temp.nix nix/rust.nix
-
-          # Build continuwuity and filter for the new hash
-          # We do `|| true` because we want this to fail without stopping the workflow
-          nix build .#default 2>&1 | tee >(grep 'got:' | awk '{print $2}' > new_toolchain_hash.txt) || true
-
-          # Place the new hash in place of the empty hash
-          new_hash=$(cat new_toolchain_hash.txt)
-          sed -i "s|lib.fakeSha256|\"$new_hash\"|" nix/rust.nix
-
-          echo "New hash:"
-          awk -F'"' '/fromToolchainName/{found=1; next} found && /sha256 =/{print $2; found=0}' nix/rust.nix
-          echo "Expected new hash:"
-          cat new_toolchain_hash.txt
-
-          rm new_toolchain_hash.txt
-
-      - name: Update rocksdb
-        run: nix run .#update-rocksdb
-
-      - name: Show diff
-        run: git diff flake.nix nix
-
-      - name: Push changes
-        run: |
-          set -euo pipefail
-
-          if git diff --quiet --exit-code; then
-            echo "No changes to commit."
-            exit 0
-          fi
-
-          git config user.email "renovate@mail.ellis.link"
-          git config user.name "renovate"
-
-          REF="${{ github.head_ref }}"
-
-          git fetch origin "$REF"
-          git checkout "$REF"
-
-          git commit -a -m "chore(Nix): Updated flake hashes"
-
-          git push origin HEAD:refs/heads/"$REF"

.git-blame-ignore-revs

@@ -5,5 +5,3 @@ f419c64aca300a338096b4e0db4c73ace54f23d0
 # use chain_width 60
 162948313c212193965dece50b816ef0903172ba
 5998a0d883d31b866f7c8c46433a8857eae51a89
-# trailing whitespace and newlines
-46c193e74b2ce86c48ce802333a0aabce37fd6e9

.gitattributes

@@ -84,4 +84,4 @@ Cargo.lock text
 *.zst      binary
 
 # Text files where line endings should be preserved
-*.patch    -text
+*.patch    -text

.github/FUNDING.yml

@@ -1,4 +0,0 @@
-github: [JadedBlueEyes, timedoutuk, gingershaped]
-custom:
-  - https://timedout.uk/donate.html
-  - https://jade.ellis.link/sponsors

.github/workflows/README.md

@@ -0,0 +1,13 @@
+## Overview
+
+The release pipeline `Main` (main.yml) and its subroutines defined in the other yamls form a high-level
+description for the underlying self-hosted build system in  `/docker`. In other words, this is a sort of
+terminal, a "thin-client" with a display and a keyboard for our docker mainframe. We minimize
+vendor-lockin and duplication with other services by limiting everything here to only what is
+essential for driving the docker builder.
+
+Though we slightly relax the above by specifying details of the actual CI pipeline, the 
+control-flow logic to go from some input event to some output or release here. This gives us
+better integration  with github, like granular progress indications by breaking up operations
+as individual jobs and workflows within the pipeline. This means we'll have duplicate logic
+with other services, but only as it relates to high-level control flow.

.github/workflows/bake.yml

@@ -0,0 +1,252 @@
+name: Bakery
+
+on:
+  workflow_call:
+    inputs:
+      bake_targets:
+        type: string
+        description: Bake Matrix
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_targets:
+        type: string
+        description: Rust targets
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_targets:
+        type: string
+        description: System targets
+      sys_versions:
+        type: string
+        description: System versions
+      machines:
+        type: string
+        description: Hardware platforms
+      runner:
+        type: string
+        description: Runner mask
+        default: 'self-hosted'
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      max-parallel:
+        type: number
+        default: 128
+        description: Limit number of concurrent jobs.
+      verbose_env:
+        type: string
+        default: ${{vars.CI_VERBOSE_ENV || false}}
+        description: Print the bake environment.
+      silent_bake:
+        type: string
+        default: ${{vars.CI_SILENT_BAKE || false}}
+        description: Print as little as possible.
+      print_bake:
+        type: string
+        default: ${{vars.CI_PRINT_BAKE || false}}
+        description: Print the computed receipe.
+      fail_fast:
+        type: boolean
+        default: false
+        description: Fail-fast for the underlying matrix.
+      release_url:
+        type: string
+        description: Upload url for created release.
+      artifact:
+        type: string
+        default: '{}'
+        description: >
+          Map of targets to artifact files to upload. Key is bake target (image prefix),
+          value is a JSON object containing keys 'src' and 'dst'. dst is the artifact name,
+          src is optional path inside image, defaulting to dst.
+
+jobs:
+  bake:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && fromJSON(inputs.machines)[0] != null
+      && fromJSON(inputs.bake_targets)[0] != null
+
+    name: >
+      ${{matrix.bake_target}}
+      ${{matrix.cargo_profile}}
+      ${{matrix.rust_toolchain}}
+      ${{matrix.feat_set}}
+      ${{matrix.sys_name}}
+      ${{matrix.sys_version}}
+      ${{matrix.sys_target}}
+
+    runs-on: ["${{matrix.machine}}", "${{inputs.runner}}"]
+    strategy:
+      fail-fast: ${{inputs.fail_fast}}
+      max-parallel: ${{inputs.max-parallel}}
+      matrix:
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+        bake_target: ${{fromJSON(inputs.bake_targets)}}
+        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
+        feat_set: ${{fromJSON(inputs.feat_sets)}}
+        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+
+    # Call docker
+    - name: Bake ${{matrix.bake_target}}
+      env:
+        bake_target: ${{matrix.bake_target}}
+        cargo_profile: ${{matrix.cargo_profile}}
+        rust_toolchain: ${{matrix.rust_toolchain}}
+        rust_target: ${{matrix.rust_target}}
+        feat_set: ${{matrix.feat_set}}
+        sys_name: ${{matrix.sys_name}}
+        sys_version: ${{matrix.sys_version}}
+        sys_target: ${{matrix.sys_target}}
+        machine: ${{matrix.machine}}
+        acct: ${{github.actor}}
+        repo: ${{github.repository}}
+        CI_VERBOSE_ENV: ${{inputs.verbose_env}}
+        CI_SILENT_BAKE: ${{inputs.silent_bake}}
+        CI_PRINT_BAKE: ${{inputs.print_bake}}
+
+      run: |
+        docker/bake.sh "${{matrix.bake_target}}"
+
+    # Optionally extract an inner artifact
+    - name: Extract Inner Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].img == null
+        && fromJSON(inputs.artifact)[matrix.bake_target].runner != true
+
+      env:
+        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
+
+      run: |
+        cid=$(docker create "$iid" /)
+        rm -rf _artifact
+        mkdir -p "_artifact"
+        docker cp "$cid:$src" "_artifact/$dst"
+        chmod "$mod" "_artifact/$dst"
+
+    # Optionally extract the image itself as an artifact.
+    - name: Extract Image Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].img != null
+
+      env:
+        iid: ${{matrix.bake_target}}--${{matrix.cargo_profile}}--${{matrix.rust_toolchain}}--${{matrix.rust_target}}--${{matrix.feat_set}}--${{matrix.sys_name}}--${{matrix.sys_version}}--${{matrix.sys_target}}
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+
+      run: |
+        rm -rf _artifact
+        mkdir -p "_artifact"
+        docker save -o "_artifact/$dst" "$iid"
+
+    # Optionally extract a runner artifact
+    - name: Extract Outer Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].runner == true
+
+      env:
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        src: ${{ fromJSON(inputs.artifact)[matrix.bake_target].src || fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        mod: ${{ fromJSON(inputs.artifact)[matrix.bake_target].chmod || 'u+r' }}
+
+      run: |
+        rm -rf _artifact
+        mkdir -p "_artifact"
+        mv "$src" "_artifact/$dst"
+        chmod "$mod" "_artifact/$dst"
+
+    # Optionally compress extracted artifact
+    - name: Compress Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && (fromJSON(inputs.artifact)[matrix.bake_target].gzip || fromJSON(inputs.artifact)[matrix.bake_target].zstd)
+
+      env:
+        dst: ${{ fromJSON(inputs.artifact)[matrix.bake_target].dst }}
+        gzlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].gzip }}
+        zstlev: ${{ fromJSON(inputs.artifact)[matrix.bake_target].zstd }}
+
+      run: |
+        if test -n "$gzlev"; then
+          mv "_artifact/$dst" "_artifact/$dst.artifact"
+          gzip "-$gzlev" "_artifact/$dst.artifact"
+          mv "_artifact/$dst.artifact.gz" "_artifact/$dst"
+        elif test -n "$zstlev"; then
+          zstd "-$zstlev" "_artifact/$dst"
+          mv "_artifact/$dst.zst" "_artifact/$dst"
+        fi
+
+    # Upload either artifact
+    - name: Upload Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+
+      uses: actions/upload-artifact@v4
+      with:
+        path: _artifact/*
+        name: ${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+
+    # Optionally upload artifact as pages-artifact
+    - name: Upload Pages Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].pages == true
+
+      uses: actions/upload-pages-artifact@v3
+      with:
+        path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+        name: github-pages
+
+    # Optionally upload artifact as release-artifact
+    - name: Upload Release Artifact
+      if: >
+        !failure() && !cancelled()
+        && fromJSON(inputs.artifact)[matrix.bake_target].dst
+        && fromJSON(inputs.artifact)[matrix.bake_target].mime
+        && contains(github.ref, 'refs/tags/v')
+        && inputs.release_url
+
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      with:
+        upload_url: ${{inputs.release_url}}
+        asset_path: _artifact/${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+        asset_name: ${{github.ref_name}}-${{matrix.cargo_profile}}-${{matrix.feat_set}}-${{matrix.sys_target}}-${{fromJSON(inputs.artifact)[matrix.bake_target].dst}}
+        asset_content_type: ${{fromJSON(inputs.artifact)[matrix.bake_target].mime || 'application/octet-stream'}}

.github/workflows/lint.yml

@@ -0,0 +1,175 @@
+name: Linting
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+
+jobs:
+  fmt:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Format
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["fmt"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      rust_targets: ${{inputs.rust_targets}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  typos:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Typos
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["typos"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  audit:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Audit
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["audit"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  # disabled due to excessive build time issue installing cargo lychee
+  lychee:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+      && false
+
+    name: Lychee
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["lychee"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  check:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Check
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["check"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  clippy:
+    if: >
+      !failure() && !cancelled()
+      && inputs.cargo_profiles
+
+    name: Clippy
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["clippy"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

.github/workflows/main.yml

@@ -0,0 +1,310 @@
+name: Main
+
+on:
+  push:
+    branches:
+      - "**"
+    tags:
+      - "v*"
+  pull_request:
+    branches:
+      - "**"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{github.workflow}}-${{github.ref}}
+  cancel-in-progress: false
+
+jobs:
+  init:
+    name: Init
+    runs-on: ${{matrix.runner}}
+    env:
+      default_cargo_profiles: '["test", "release"]'
+      default_feat_sets: '["none", "default", "all"]'
+      default_rust_toolchains: '["nightly", "stable"]'
+      default_sys_names: '["debian"]'
+      default_sys_versions: '["testing-slim"]'
+      default_rust_targets: '["x86_64-unknown-linux-gnu"]'
+      default_sys_targets: '["x86_64-v1-linux-gnu"]'
+      default_machines: '["X64"]'
+
+    outputs:
+      cargo_profiles: ${{vars.CARGO_PROFILES || env.default_cargo_profiles}}
+      feat_sets: ${{vars.FEAT_SETS || env.default_feat_sets}}
+      rust_toolchains: ${{vars.RUST_TOOLCHAINS || env.default_rust_toolchains}}
+      rust_targets: ${{vars.RUST_TARGETS || env.default_rust_targets}}
+      sys_names: ${{vars.SYS_NAMES || env.default_sys_names}}
+      sys_targets: ${{vars.SYS_TARGETS || env.default_sys_targets}}
+      sys_versions: ${{vars.SYS_VERSIONS || env.default_sys_versions}}
+      machines: ${{vars.MACHINES || env.default_machines}}
+      package: ${{vars.PACKAGE || !contains(github.ref, 'refs/pull/')}}
+      publish: ${{vars.PUBLISH || !contains(github.ref, 'refs/pull/')}}
+      build_pkgs: ${{vars.BUILD_PKGS || github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')}}
+      check_pkgs: ${{vars.CHECK_PKGS || 'false'}}
+      complement: ${{vars.COMPLEMENT || 'true'}}
+      complement_runner: 'het'
+      docker_repo: ${{vars.DOCKER_REPO}}
+      release_url: ${{steps.release.outputs.upload_url}}
+
+    strategy:
+      fail-fast: true
+      matrix:
+        runner: ${{fromJSON(vars.RUNNERS || '["het"]')}}
+        machine: ${{fromJSON(vars.MACHINES || '["X64"]')}}
+        exclude: ${{fromJSON(vars.RUNNERS_EXCLUDES || '[]')}}
+
+    steps:
+    - name: Initialize Builder
+      env:
+        runner: ${{matrix.runner}}
+        reserved_space: '{"het": "128GB", "aws": "48GB", "gcp": "160GB"}'
+        max_used_space: '{"het": "256GB", "aws": "64GB", "gcp": "192GB"}'
+      run: |
+        set +e
+        docker buildx inspect "${GITHUB_ACTOR}"
+        if test x"$?" = x"0"; then
+          exit 0
+        fi
+
+        set -eux
+        reserved_space=$(echo -n "$reserved_space" | jq -r ".$runner")
+        max_used_space=$(echo -n "$max_used_space" | jq -r ".$runner")
+        cat <<EOF > ./buildkitd.toml
+        [system]
+          platformsCacheMaxAge = "504h"
+        [worker.oci]
+          enabled = true
+          rootless = false
+          gc = true
+          reservedSpace = "${reserved_space}"
+          maxUsedSpace = "${max_used_space}"
+        [[worker.oci.gcpolicy]]
+          reservedSpace = "${reserved_space}"
+          maxUsedSpace = "${max_used_space}"
+          filters = ["label!=cache==pin"]
+          all = true
+        EOF
+
+        docker buildx create \
+          --bootstrap \
+          --driver docker-container \
+          --buildkitd-config ./buildkitd.toml \
+          --name "${GITHUB_ACTOR}" \
+          --buildkitd-flags "--allow-insecure-entitlement network.host"
+
+    - if: >
+        !failure() && !cancelled()
+        && contains(github.ref, 'refs/tags/v')
+        && matrix.runner == 'het'
+
+      id: release
+      name: Create Release
+      uses: actions/create-release@v1
+      env:
+        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      with:
+        release_name: Release ${{github.ref_name}}
+        tag_name: ${{github.ref}}
+        body_path: RELEASE.md
+        draft: ${{ contains(github.ref, '-draft') }}
+        prerelease: ${{ contains(github.ref, '-rc') }}
+
+  lint:
+    if: >
+      !failure() && !cancelled()
+      && !contains(github.ref, 'refs/tags/v')
+
+    name: Lint
+    needs: [init] #needs: [init, deps]
+    uses: ./.github/workflows/lint.yml
+    with:
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"cargo_profile": "test", "feat_set": "logging"},
+          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "none"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "default"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly", "feat_set": "logging"},
+          {"cargo_profile": "release-debuginfo"},
+          {"cargo_profile": "release-native", "feat_set": "none"},
+          {"cargo_profile": "release-native", "feat_set": "default"},
+          {"cargo_profile": "release-native", "feat_set": "logging"},
+          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
+          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu"},
+          {"sys_target": "x86_64-v3-linux-gnu"},
+          {"sys_target": "x86_64-v4-linux-gnu"},
+        ]
+
+  test:
+    if: >
+      !failure() && !cancelled()
+      && !contains(github.ref, 'refs/tags/v')
+
+    name: Test
+    needs: [init, lint]
+    uses: ./.github/workflows/test.yml
+    with:
+      complement: ${{fromJSON(needs.init.outputs.complement)}}
+      complement_runner: ${{needs.init.outputs.complement_runner}}
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"feat_set": "logging"},
+          {"cargo_profile": "test", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-debuginfo"},
+          {"cargo_profile": "release-native", "feat_set": "none"},
+          {"cargo_profile": "release-native", "feat_set": "default"},
+          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
+          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+        ]
+
+  package:
+    if: >
+      !failure() && !cancelled()
+      && needs.init.outputs.package
+
+    name: Package
+    needs: [init, lint]
+    uses: ./.github/workflows/package.yml
+    with:
+      release_url: ${{needs.init.outputs.release_url}}
+      check_pkgs: ${{needs.init.outputs.check_pkgs}}
+      build_pkgs: ${{needs.init.outputs.build_pkgs}}
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"feat_set": "none"},
+          {"cargo_profile": "test"},
+          {"cargo_profile": "release-native"},
+          {"cargo_profile": "release-debuginfo", "feat_set": "default"},
+          {"cargo_profile": "release-debuginfo", "feat_set": "logging"},
+          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release-debuginfo", "bake_target": "oci"},
+          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "release-debuginfo", "sys_target": "x86_64-v4-linux-gnu"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
+        ]
+
+  publish:
+    if: >
+      !failure() && !cancelled()
+      && needs.init.outputs.publish
+
+    name: Publish
+    needs: [init, test, package]
+    uses: ./.github/workflows/publish.yml
+    with:
+      docker_repo: ${{needs.init.outputs.docker_repo}}
+      release_url: ${{needs.init.outputs.release_url}}
+      cargo_profiles: ${{needs.init.outputs.cargo_profiles}}
+      feat_sets: ${{needs.init.outputs.feat_sets}}
+      rust_toolchains: ${{needs.init.outputs.rust_toolchains}}
+      rust_targets: ${{needs.init.outputs.rust_targets}}
+      sys_names: ${{needs.init.outputs.sys_names}}
+      sys_targets: ${{needs.init.outputs.sys_targets}}
+      sys_versions: ${{needs.init.outputs.sys_versions}}
+      machines: ${{needs.init.outputs.machines}}
+      excludes: >
+        [
+          {"feat_set": "none"},
+          {"feat_set": "logging"},
+          {"cargo_profile": "test"},
+          {"cargo_profile": "release-debuginfo"},
+          {"cargo_profile": "release-native"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+        ]
+
+    secrets:
+      ghcr_token: ${{ secrets.GHCR_TOKEN }}
+      dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/package.yml

@@ -0,0 +1,204 @@
+name: Package
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      release_url:
+        type: string
+        description: For release assets
+      build_pkgs:
+        type: string
+        default: 'true'
+      check_pkgs:
+        type: string
+        default: 'false'
+
+jobs:
+  book:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["default"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Book
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["book"]'
+      cargo_profiles: '["release"]'
+      feat_sets: '["default"]'
+      rust_toolchains: '["stable"]'
+      rust_targets: ${{inputs.rust_targets}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      runner: 'het'
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "book": {
+            "dst": "book",
+            "src": "/book",
+            "pages": true
+          }
+        }
+
+  binary:
+    if: >
+      !failure() && !cancelled()
+
+    name: Binaries
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["static"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "static": {
+            "dst": "tuwunel.zst",
+            "src": "/usr/bin/tuwunel",
+            "mime": "application/zstd",
+            "zstd": 11,
+            "chmod": "a+x"
+          }
+        }
+
+  container:
+    if: >
+      !failure() && !cancelled()
+
+    name: Containers
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["docker", "oci"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "docker": {
+            "dst": "tuwunel-docker.tar.gz",
+            "img": true,
+            "mime": "application/gzip",
+            "gzip": 7
+          },
+          "oci": {
+            "dst": "tuwunel-oci.tar.zst",
+            "runner": true,
+            "mime": "application/zstd",
+            "zstd": 11
+          }
+        }
+
+  pkgs:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && fromJSON(inputs.build_pkgs)
+
+    name: Distro Packages
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["deb", "rpm"]'
+      cargo_profiles: '["release"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["stable"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+      release_url: ${{inputs.release_url}}
+      artifact: >
+        {
+          "deb": {
+            "dst": "tuwunel.deb",
+            "mime": "application/vnd.debian.binary-package"
+          },
+          "rpm": {
+            "dst": "tuwunel.rpm",
+            "mime": "application/x-rpm"
+          }
+        }
+
+  check_pkgs:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && fromJSON(inputs.check_pkgs)
+
+    name: Check Packages
+    needs: [pkgs]
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["deb-install", "rpm-install"]'
+      cargo_profiles: '["release"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["stable"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

.github/workflows/publish.yml

@@ -0,0 +1,321 @@
+name: Publish
+
+on:
+  workflow_call:
+    secrets:
+      ghcr_token:
+      dockerhub_token:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      docker_repo:
+        type: string
+        description: DockerHub Repository
+      release_url:
+        type: string
+        description: For release assets
+
+jobs:
+  documents:
+    if: >
+      !failure() && !cancelled()
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["X64"]')[0])
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+      && !contains(github.ref, '-draft')
+
+    name: Documents
+    runs-on: ['X64', 'het']
+    permissions:
+      pages: write
+      id-token: write
+
+    steps:
+      - id: book
+        name: Book
+        uses: actions/deploy-pages@v4
+
+  containers:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && inputs.docker_repo != ''
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+    name: Containers
+    runs-on: ${{matrix.machine}}
+    permissions: write-all
+    strategy:
+      fail-fast: true
+      matrix:
+        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
+        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
+        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
+        feat_set: ${{fromJSON(inputs.feat_sets)}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: GitHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr_token }}
+
+      - name: DockerHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Bake
+        env:
+          bake_target: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          rust_toolchain: ${{matrix.rust_toolchain}}
+          rust_target: ${{matrix.rust_target}}
+          feat_set: ${{matrix.feat_set}}
+          sys_name: ${{matrix.sys_name}}
+          sys_version: ${{matrix.sys_version}}
+          sys_target: ${{matrix.sys_target}}
+          machine: ${{matrix.machine}}
+          acct: ${{github.actor}}
+          repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker/bake.sh "${{matrix.bake_target}}"
+
+  bundles:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && inputs.docker_repo != ''
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["release"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["stable"]')[0])
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+    name: Bundles
+    needs: [containers]
+    runs-on: 'het'
+    permissions: write-all
+    strategy:
+      fail-fast: true
+      matrix:
+        bake_target: ${{fromJSON('["docker_io", "ghcr_io"]')}}
+        cargo_profile: ${{fromJSON('["release"]')}}
+        feat_set: ${{fromJSON('["all"]')}}
+        rust_toolchain: ${{fromJSON('["stable"]')}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+
+    steps:
+      - name: GitHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr_token }}
+
+      - name: DockerHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Release Branch
+        if: >
+          !failure() && !cancelled()
+          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+        env:
+          acct: ${{github.actor}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+          registry: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          feat_set: ${{matrix.feat_set}}
+          sys_target: ${{matrix.sys_target}}
+          ref_name: ${{github.ref_name}}
+
+        run: |
+          registry="$(echo -n $registry | sed s/_/./)"
+          if test "$registry" = "ghcr.io"; then
+            repo="$ghcr_repo"
+          else
+            repo="$docker_repo"
+          fi
+
+          docker manifest create "${registry}/${repo}:${ref_name}" \
+            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
+
+      - name: Release Preview
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+
+        env:
+          acct: ${{github.actor}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+          registry: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          feat_set: ${{matrix.feat_set}}
+          sys_target: ${{matrix.sys_target}}
+          ref_name: ${{github.ref_name}}
+
+        run: |
+          registry="$(echo -n $registry | sed s/_/./)"
+          if test "$registry" = "ghcr.io"; then
+            repo="$ghcr_repo"
+          else
+            repo="$docker_repo"
+          fi
+
+          docker manifest create "${registry}/${repo}:preview" \
+            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
+
+      - name: Release Latest
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+          && !contains(github.ref, '-rc')
+
+        env:
+          acct: ${{github.actor}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+          registry: ${{matrix.bake_target}}
+          cargo_profile: ${{matrix.cargo_profile}}
+          feat_set: ${{matrix.feat_set}}
+          sys_target: ${{matrix.sys_target}}
+          ref_name: ${{github.ref_name}}
+
+        run: |
+          registry="$(echo -n $registry | sed s/_/./)"
+          if test "$registry" = "ghcr.io"; then
+            repo="$ghcr_repo"
+          else
+            repo="$docker_repo"
+          fi
+
+          docker manifest create "${registry}/${repo}:latest" \
+            --amend "${registry}/${repo}:${ref_name}-${cargo_profile}-${feat_set}-${sys_target}"
+
+  delivery:
+    if: >
+      !failure() && !cancelled()
+      && inputs.machines
+      && inputs.docker_repo != ''
+      && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+    name: Delivery
+    needs: [bundles, documents]
+    runs-on: 'het'
+    permissions: write-all
+    steps:
+      - name: GitHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr_token }}
+
+      - name: DockerHub Login
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.dockerhub_token }}
+
+      - name: Push Branch
+        if: >
+          !failure() && !cancelled()
+          && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/v'))
+
+        env:
+          ref_name: ${{github.ref_name}}
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker manifest push -p "ghcr.io/${ghcr_repo}:${ref_name}"
+          docker manifest push -p "docker.io/${docker_repo}:${ref_name}"
+
+      - name: Push Preview
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+
+        env:
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker manifest push -p "ghcr.io/${ghcr_repo}:preview"
+          docker manifest push -p "docker.io/${docker_repo}:preview"
+
+      - name: Push Latest
+        if: >
+          !failure() && !cancelled()
+          && contains(github.ref, 'refs/tags/v')
+          && !contains(github.ref, '-draft')
+          && !contains(github.ref, '-rc')
+
+        env:
+          ghcr_repo: ${{github.repository}}
+          docker_repo: ${{inputs.docker_repo}}
+
+        run: |
+          docker manifest push -p "ghcr.io/${ghcr_repo}:latest"
+          docker manifest push -p "docker.io/${docker_repo}:latest"

.github/workflows/test.yml

@@ -0,0 +1,267 @@
+name: Testing
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      complement:
+        type: boolean
+        default: true
+      complement_feat_sets:
+        type: string
+        default: '["all"]'
+      complement_runner:
+        type: string
+
+jobs:
+  docs:
+    if: >
+      contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Docs
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["docs"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  unit:
+    if: >
+      contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Unit
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["unit"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  smoke:
+    if: >
+      !failure() && !cancelled()
+      && inputs.cargo_profiles
+      && inputs.machines
+
+    name: Smoke
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["smoke", "smoke-valgrind"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      includes: ${{inputs.includes}}
+      excludes: >
+        [
+          {"cargo_profile": "test", "feat_set": "default"},
+          {"cargo_profile": "test", "feat_set": "logging"},
+          {"cargo_profile": "test", "feat_set": "none", "bake_target": "smoke-valgrind"},
+          {"cargo_profile": "test", "rust_toolchain": "stable"},
+          {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "release", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "release", "bake_target": "smoke-valgrind"},
+          {"cargo_profile": "release-debuginfo", "feat_set": "logging"},
+          {"cargo_profile": "release-debuginfo", "rust_toolchain": "nightly"},
+          {"cargo_profile": "release-debuginfo", "rust_toolchain": "stable", "feat_set": "none"},
+          {"cargo_profile": "release-debuginfo", "bake_target": "smoke"},
+          {"cargo_profile": "release-debuginfo", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-native", "rust_toolchain": "stable"},
+          {"cargo_profile": "release-native", "feat_set": "none"},
+          {"cargo_profile": "release-native", "feat_set": "default"},
+          {"cargo_profile": "release-native", "feat_set": "logging"},
+          {"cargo_profile": "release-native", "bake_target": "smoke-valgrind"},
+          {"cargo_profile": "release-native", "rust_target": "aarch64-unknown-linux-gnu"},
+          {"cargo_profile": "release-native", "sys_target": "x86_64-v2-linux-gnu"},
+          {"cargo_profile": "release-native", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "release-native", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "none"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "default"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "feat_set": "logging"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v1-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v2-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v3-linux-gnu"},
+          {"rust_target": "aarch64-unknown-linux-gnu", "sys_target": "x86_64-v4-linux-gnu"},
+          {"rust_target": "x86_64-unknown-linux-gnu", "sys_target": "aarch64-v8-linux-gnu"},
+          {"sys_target": "aarch64-v8-linux-gnu", "machine": "X64"},
+          {"sys_target": "x86_64-v1-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v2-linux-gnu", "feat_set": "logging"},
+          {"sys_target": "x86_64-v3-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v3-linux-gnu", "feat_set": "logging"},
+          {"sys_target": "x86_64-v3-linux-gnu", "bake_target": "smoke-valgrind"},
+          {"sys_target": "x86_64-v4-linux-gnu", "machine": "ARM64"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "none"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "default"},
+          {"sys_target": "x86_64-v4-linux-gnu", "feat_set": "logging"},
+          {"sys_target": "x86_64-v4-linux-gnu", "bake_target": "smoke-valgrind"},
+        ]
+
+  complement:
+    if: >
+      !failure() && !cancelled()
+      && inputs.complement
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.complement_feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Complement
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["complement-tester", "complement-testee"]'
+      cargo_profiles: '["test"]'
+      feat_sets: ${{inputs.complement_feat_sets}}
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v1-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      runner: ${{inputs.complement_runner}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  compliance:
+    if: >
+      !failure() && !cancelled()
+      && inputs.complement
+      && inputs.machines
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v1-linux-gnu"]')[0])
+
+    name: Matrix Compliance
+    needs: [complement]
+    runs-on: ["${{matrix.machine}}", "${{inputs.complement_runner}}"]
+    concurrency:
+      group: complement-cant-walk-and-chew-bubblegum
+      cancel-in-progress: false
+
+    strategy:
+      fail-fast: false
+      matrix:
+        cargo_profile: ${{fromJSON('["test"]')}}
+        feat_set: ${{fromJSON(inputs.complement_feat_sets)}}
+        rust_toolchain: ${{fromJSON('["nightly"]')}}
+        sys_name: ${{fromJSON(inputs.sys_names)}}
+        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON('["x86_64-v1-linux-gnu"]')}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Execute
+      id: execute
+      env:
+        cargo_profile: ${{matrix.cargo_profile}}
+        rust_toolchain: ${{matrix.rust_toolchain}}
+        rust_target: ${{matrix.rust_target}}
+        feat_set: ${{matrix.feat_set}}
+        sys_name: ${{matrix.sys_name}}
+        sys_target: ${{matrix.sys_target}}
+        sys_version: ${{matrix.sys_version}}
+        machine: ${{matrix.machine}}
+
+      run: |
+        docker/complement.sh
+
+    - if: success() || failure() && steps.execute.outcome == 'failure'
+      name: Extract
+      id: extract
+      env:
+        name: complement_tester__${{matrix.sys_name}}__${{matrix.sys_version}}__${{matrix.sys_target}}
+        tag: latest
+
+      run: |
+        cid=$(cat "$name")
+        docker cp "$cid:/usr/src/complement/new_results.jsonl" tests/test_results/complement/test_results.jsonl
+
+    - if: success() || failure() && steps.execute.outcome == 'failure'
+      name: Upload New Results
+      id: upload-result
+      uses: actions/upload-artifact@v4
+      with:
+        name: complement_results-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
+        path: ./tests/test_results/complement/test_results.jsonl
+
+    - if: failure() && steps.execute.outcome == 'failure'
+      name: Upload Failure Output
+      id: upload-output
+      uses: actions/upload-artifact@v4
+      with:
+        name: complement_output-${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}.jsonl
+        path: ./complement.jsonl
+        if-no-files-found: ignore
+
+    - name: Accept
+      id: accept
+      run: |
+        git diff --exit-code --color --color-moved

.gitignore

@@ -79,7 +79,7 @@ test-conduit.toml
 /.gitlab-ci.d
 
 # mdbook output
-/public/
+public/
 
 # macOS
 .DS_Store
@@ -96,9 +96,9 @@ rustc-ice-*
 # complement test logs are huge
 tests/test_results/complement/test_logs.jsonl
 
-# Node
-node_modules/
+# cargo profiles from -Z self-profile
+*.mm_profdata
 
-# Rspress
-doc_build/
-.rspress/
+# Editor crashfiles
+*.save
+*.swp

.gitlab/merge_request_templates/MR.md

@@ -0,0 +1,8 @@
+
+<!-- Please describe your changes here -->
+
+-----------------------------------------------------------------------------
+
+- [ ] I ran `cargo fmt`, `cargo clippy`, and `cargo test`
+- [ ] I agree to release my code and all other changes of this MR under the Apache-2.0 license
+

.gitlab/route-map.yml

@@ -0,0 +1,3 @@
+# Docs: Map markdown to html files
+- source: /docs/(.+)\.md/
+  public: '\1.html'

.mailmap

@@ -1,18 +0,0 @@
-AlexPewMaster <git@alex.unbox.at> <68469103+AlexPewMaster@users.noreply.github.com>
-Daniel Wiesenberg <weasy@hotmail.de> <weasy666@gmail.com>
-Devin Ragotzy <devin.ragotzy@gmail.com> <d6ragotzy@wmich.edu>
-Devin Ragotzy <devin.ragotzy@gmail.com> <dragotzy7460@mail.kvcc.edu>
-Ginger <ginger@gingershaped.computer> <75683114+gingershaped@users.noreply.github.com>
-Jonas Platte <jplatte+git@posteo.de> <jplatte+gitlab@posteo.de>
-Jonas Zohren <git-pbkyr@jzohren.de> <gitlab-jfowl-0ux98@sh14.de>
-Jonathan de Jong <jonathan@automatia.nl> <jonathandejong02@gmail.com>
-June Clementine Strawberry <june@3.dog> <june@girlboss.ceo>
-June Clementine Strawberry <june@3.dog> <strawberry@pupbrain.dev>
-June Clementine Strawberry <june@3.dog> <strawberry@puppygock.gay>
-Olivia Lee <olivia@computer.surgery> <benjamin@computer.surgery>
-Rudi Floren <rudi.floren@gmail.com> <rudi.floren@googlemail.com>
-Tamara Schmitz <tamara.zoe.schmitz@posteo.de> <15906939+tamara-schmitz@users.noreply.github.com>
-Timo Kösters <timo@koesters.xyz>
-nexy7574 <git@nexy7574.co.uk> <nex@noreply.forgejo.ellis.link>
-nexy7574 <git@nexy7574.co.uk> <nex@noreply.localhost>
-x4u <xi.zhu@protonmail.ch> <14617923-x4u@users.noreply.gitlab.com>

.pre-commit-config.yaml

@@ -1,71 +0,0 @@
-default_install_hook_types:
-  - pre-commit
-  - pre-push
-  - commit-msg
-default_stages:
-  - pre-commit
-  - manual
-
-repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
-    hooks:
-        - id: fix-byte-order-marker
-        - id: check-case-conflict
-        - id: check-symlinks
-        - id: destroyed-symlinks
-        - id: check-yaml
-        - id: check-json
-        - id: check-toml
-        - id: end-of-file-fixer
-        - id: trailing-whitespace
-        - id: mixed-line-ending
-        - id: check-merge-conflict
-        - id: check-added-large-files
-
-  - repo: https://github.com/crate-ci/typos
-    rev: v1.48.0
-    hooks:
-      - id: typos
-      - id: typos
-        name: commit-msg-typos
-        stages: [commit-msg]
-
-  - repo: https://github.com/crate-ci/committed
-    rev: v1.1.11
-    hooks:
-    - id: committed
-
-  - repo: local
-    hooks:
-      - id: cargo-fmt
-        name: cargo fmt
-        entry: cargo +nightly fmt --
-        language: system
-        types: [rust]
-        pass_filenames: false
-        stages:
-            - pre-commit
-
-  - repo: local
-    hooks:
-      - id: cargo-clippy
-        name: cargo clippy
-        entry: cargo clippy -- -D warnings
-        language: system
-        pass_filenames: false
-        types: [rust]
-        stages:
-          - pre-push
-
-  - repo: local
-    hooks:
-      - id: docs-build
-        name: docs build
-        entry: npm run docs:build
-        language: system
-        pass_filenames: false
-        files: docs/
-        types: [mdx]
-        stages:
-          - pre-commit

.typos.toml

@@ -1,28 +1,6 @@
-[files]
-extend-exclude = ["*.csr", "*.lock", "pnpm-lock.yaml"]
-
-[default]
-
-extend-ignore-re = [
-    "(?Rm)^.*(#|//|<!--)\\s*spellchecker:disable-line(\\s*-->)$", # Ignore a line by making it trail with a `spellchecker:disable-line` comment
-    "^[0-9a-f]{7,}$", # Commit hashes
-    "4BA7",
-    # some heuristics for base64 strings
-    "[A-Za-z0-9+=]{72,}",
-    "([A-Za-z0-9+=]|\\\\\\s\\*){72,}",
-    "[0-9+][A-Za-z0-9+]{30,}[a-z0-9+]",
-    "\\$[A-Z0-9+][A-Za-z0-9+]{6,}[a-z0-9+]",
-    "\\b[a-z0-9+/=][A-Za-z0-9+/=]{7,}[a-z0-9+/=][A-Z]\\b",
-    # In the renovate config
-    ".ontainer"
-]
-
 [default.extend-words]
 "allocatedp" = "allocatedp"
 "conduwuit" = "conduwuit"
-"continuwuity" = "continuwuity"
-"continuwity" = "continuwuity"
 "execuse" = "execuse"
-"oltp" = "OTLP"
-
-rememvering = "remembering"
+"leafs" = "leafs"
+"serialize" = "serialize"

.vscode/settings.json

@@ -1,11 +0,0 @@
-{
-    "cSpell.words": [
-        "Forgejo",
-        "appservice",
-        "appservices",
-        "conduwuit",
-        "continuwuity",
-        "homeserver",
-        "homeservers"
-    ]
-}

CHANGELOG.md

@@ -1,238 +0,0 @@
-# Continuwuity 0.5.8 (2026-04-24)
-
-## Features
-
-- LDAP can now optionally be connected to using StartTLS, and you may unsafely skip verification. Contributed by @getz (#1389)
-- Users will now be prevented from removing their email if the server is configured to require an email when registering an account.
-
-## Bugfixes
-
-- Fixed a situation where multiple email addresses could be associated with one user when that user changes their email address.
-
-## Improved Documentation
-
-- Updated config docs to state we support room version 12, and set it as default. Contributed by @ezera. (#1622)
-- Improve instructions for generic deployments, removing unnecessary parts and documenting the new initial registration token flow. Contributed by @stratself (#1677)
-
-
-# Continuwuity v0.5.7 (2026-04-17)
-
-## Features
-
-- Re-added support for reading registration tokens from a file. Contributed by @ginger and @benbot. (#1371)
-- Add new config option to allow or disallow search engine indexing through a `<meta ../>` tag. Defaults to blocking indexing (`content="noindex"`). Contributed by @s1lv3r and @ginger. (#1527)
-- Add new config option for [MSC4439](https://github.com/matrix-org/matrix-spec-proposals/pull/4439)
-  PGP key URIs. Contributed by LogN. (#1609)
-- Added `!admin users reset-push-rules` command to reset the notification settings of users. Contributed by @nex. (#1613)
-- Notification pushers are now automatically removed when their associated device is. Admin commands now exist for manual cleanup too. Contributed by @nex. (#1614)
-- Implemented option to deprioritize servers for room join requests. Contributed by @ezera. (#1624)
-- Added admin commands to get build information and features. Contributed by @Jade (#1629)
-- Added support for associating email addresses with accounts, requiring email addresses for registration, and resetting passwords via email. Contributed by @ginger
-- Added support for requiring users to accept terms and conditions when registering.
-- Added support for using an admin command to issue self-service password reset links.
-
-## Bugfixes
-
-- Fixed corrupted appservice registrations causing the server to enter a crash loop. Contributed by @nex. (#1265)
-- Prevent removing the admin room alias (`#admins`) to avoid accidentally breaking admin room functionality. Contributed by @0xnim (#1448)
-- Stripped `join_authorised_via_users_server` from json if user is already in room (@partha:cxy.run) (#1542)
-- Fixed internal server errors for fetching thumbnails. Contributed by @PerformativeJade (#1572)
-- Fixed error 500 when joining non-existent rooms. Contributed by @ezera. (#1579)
-- Refactored nix package. Breaking, since `all-features` package no longer exists. Continuwuity is now built with jemalloc and liburing by default. Contributed by @Henry-Hiles (QuadRadical). (#1596)
-- Fixed resolving IP of servers that only use SRV delegation. Contributed by @tulir. (#1615)
-- Fixed "Sender must be a local user" error for make_join, make_knock, and make_leave federation routes. Contributed by @nex. (#1623)
-- Fixed restricted joins not being signed when we are being used as an authorising server. Contributed by @nex, reported by [vel](matrix:u/vel:nhjkl.com?action=chat). (#1630)
-- Fixed room alias deletion so removing one local alias no longer removes other aliases from room alias listings.
-- Stopped left rooms from being unconditionally sent on initial sync, hopefully fixing spurious appearances of left rooms in some clients (and making sync faster as a bonus). Contributed by @ginger
-- Correct the response field name for MatrixRTC transports. Contributed by @spaetz
-
-## Improved Documentation
-
-- Added Testing and Troubleshooting instructions for Livekit documentation. Contributed by @stratself. (#1429)
-- Refactored docker docs to include new initial token workflow, and add Caddyfile example. Contributed by @stratself. (#1594)
-- Add DNS tuning guide for Continuwuity. Users are recommended to set up a local caching resolver following the guide's advice. Contributed by @stratself (#1601)
-
-## Misc
-
-- Fixed compiler warning in cf_opts.rs when building in release. Contributed by @ezera. (#1620)
-
-
-# Continuwuity 0.5.6 (2026-03-03)
-
-## Security
-
-- Admin escape commands received over federation will never be executed, as this is never valid in a genuine situation. Contributed by @Jade.
-- Fixed data amplification vulnerability (CWE-409) that affected configurations with server-side compression enabled (non-default). Contributed by @nex.
-
-## Features
-
-- Outgoing presence is now disabled by default, and the config option documentation has been adjusted to more accurately represent the weight of presence, typing indicators, and read receipts. Contributed by @nex. ([#1399](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1399))
-- Improved the concurrency handling of federation transactions, vastly improving performance and reliability by more accurately handling inbound transactions and reducing the amount of repeated wasted work. Contributed by @nex and @Jade. ([#1428](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1428))
-- Added [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202) Device masquerading (not all of MSC3202). This should fix issues with enabling [MSC4190](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) for some Mautrix bridges. Contributed by @Jade ([#1435](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1435))
-- Added [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814) Dehydrated Devices - you can now decrypt messages sent while all devices were logged out. ([#1436](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1436))
-- Implement [MSC4143](https://github.com/matrix-org/matrix-spec-proposals/pull/4143) MatrixRTC transport discovery endpoint. Move RTC foci configuration from `[global.well_known]` to a new `[global.matrix_rtc]` section with a `foci` field. Contributed by @0xnim ([#1442](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1442))
-- Updated `list-backups` admin command to output one backup per line. ([#1394](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1394))
-- Improved URL preview fetching with a more compatible user agent for sites like YouTube Music. Added `!admin media delete-url-preview <url>` command to clear cached URL previews that were stuck and broken. ([#1434](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1434))
-
-## Bugfixes
-
-- Removed non-compliant nor functional room alias lookups over federation. Contributed by @nex ([#1393](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1393))
-- Removed ability to set rocksdb as read only. Doing so would cause unintentional and buggy behaviour. Contributed by @Terryiscool160. ([#1418](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1418))
-- Fixed a startup crash in the sender service if we can't detect the number of CPU cores, even if the `sender_workers` config option is set correctly. Contributed by @katie. ([#1421](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1421))
-- Removed the `allow_public_room_directory_without_auth` config option. Contributed by @0xnim. ([#1441](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1441))
-- Fixed sliding sync v5 list ranges always starting from 0, causing extra rooms to be unnecessarily processed and returned. Contributed by @0xnim ([#1445](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1445))
-- Fixed a bug that (repairably) caused a room split between continuwuity and non-continuwuity servers when the room had both `m.room.policy` and `org.matrix.msc4284.policy` in its room state. Contributed by @nex ([#1481](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1481))
-- Fixed `!admin media delete --mxc <url>` responding with an error message when the media was deleted successfully. Contributed by @lynxize
-- Fixed spurious 404 media errors in the logs. Contributed by @benbot.
-- Fixed spurious warn about needed backfill via federation for non-federated rooms. Contributed by @kraem.
-
-# Continuwuity v0.5.5 (2026-02-15)
-
-## Features
-
-- Added unstable support for [MSC4406:
-  `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406).
-  Contributed by @nex ([#1308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1308))
-- Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by
-  @Omar007 ([#1349](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1349))
-- Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by
-  @nex. ([#1368](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1368))
-- You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be
-  rejected. Contributed by @trashpanda ([#1372](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1372))
-- Improved the first-time setup experience for new homeserver administrators:
-    - Account registration is disabled on the first run, except for with a new special registration token that is logged
-      to the console.
-    - Other helpful information is logged to the console as well, including a giant warning if open registration is
-      enabled.
-    - The default index page now says to check the console for setup instructions if no accounts have been created.
-    - Once the first admin account is created, an improved welcome message is sent to the admin room.
-
-  Contributed by @ginger.
-
-## Bugfixes
-
-- Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or
-  broken invites should clear their client caches after updating to make them appear. ([#1249](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1249))
-- LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured.
-  Contributed by @Jade ([#1307](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1307))
-- Fixed sliding sync not resolving wildcard state key requests, enabling Video/Audio calls in Element X. ([#1370](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1370))
-
-## Misc
-
-- #1344
-
-# Continuwuity v0.5.4 (2026-02-08)
-
-## Features
-
-- The announcement checker will now announce errors it encounters in the first run to the admin room, plus a few other
-  misc improvements. Contributed by @Jade ([#1288](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1288))
-- Drastically improved the performance and reliability of account deactivations. Contributed by
-  @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314))
-- Refuse to process requests for and events in rooms that we no longer have any local users in (reduces state resets
-  and improves performance). Contributed by
-  @nex ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316))
-- Added server-specific admin API routes to ban and unban rooms, for use with moderation bots. Contributed by @nex
-  ([#1301](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1301))
-
-## Bugfixes
-
-- Fix the generated configuration containing uncommented optional sections. Contributed by
-  @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290))
-- Fixed specification non-compliance when handling remote media errors. Contributed by
-  @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298))
-- UIAA requests which check for out-of-band success (sent by matrix-js-sdk) will no longer create unhelpful errors in
-  the logs. Contributed by @ginger ([#1305](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1305))
-- Use exists instead of contains to save writing to a buffer in `src/service/users/mod.rs`: `is_login_disabled`.
-  Contributed
-  by @aprilgrimoire. ([#1340](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1340))
-- Fixed backtraces being swallowed during panics. Contributed by
-  @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337))
-- Fixed a potential vulnerability that could allow an evil remote server to return malicious events during the room join
-  and knock process. Contributed by @nex, reported by violet & [mat](https://matdoes.dev).
-- Fixed a race condition that could result in outlier PDUs being incorrectly marked as visible to a remote server.
-  Contributed by @nex, reported by violet & [mat](https://matdoes.dev).
-- ACLs are no longer case-sensitive. Contributed by @nex, reported by [vel](matrix:u/vel:nhjkl.com?action=chat).
-
-## Docs
-
-- Fixed Fedora install instructions. Contributed by
-  @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342))
-
-# Continuwuity 0.5.3 (2026-01-12)
-
-## Features
-
-- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by
-  @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279))
-
-## Bugfixes
-
-- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by
-  @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286))
-
-## Docs
-
-- Improve admin command documentation generation. Contributed by
-  @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280))
-
-## Misc
-
-- Improve timeout-related code for federation and URL previews. Contributed by
-  @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278))
-
-# Continuwuity 0.5.2 (2026-01-09)
-
-## Features
-
-- Added support for issuing additional registration tokens, stored in the database, which supplement the existing
-  registration token hardcoded in the config file. These tokens may optionally expire after a certain number of uses or
-  after a certain amount of time has passed. Additionally, the `registration_token_file` configuration option is
-  superseded by this feature and **has been removed**. Use the new `!admin token` command family to manage registration
-  tokens. Contributed by @ginger (#783).
-- Implemented a configuration defined admin list independent of the admin room. Contributed by
-  @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253))
-- Added support for invite and join anti-spam via Draupnir and Meowlnir, similar to that of synapse-http-antispam.
-  Contributed by @nex. ([#1263](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1263))
-- Implemented account locking functionality, to complement user suspension. Contributed by
-  @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266))
-- Added admin command to forcefully log out all of a user's existing sessions. Contributed by
-  @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271))
-- Implemented toggling the ability for an account to log in without mutating any of its data. Contributed by @nex. (
-  [#1272](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1272))
-- Add support for custom room create event timestamps, to allow generating custom prefixes in hashed room IDs.
-  Contributed by @nex. ([#1277](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1277))
-- Certain potentially dangerous admin commands are now restricted to only be usable in the admin room and server
-  console. Contributed by @ginger.
-
-## Bugfixes
-
-- Fixed unreliable room summary fetching and improved error messages. Contributed by
-  @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257))
-- Client requested timeout parameter is now applied to e2ee key lookups and claims. Related federation requests are now
-  also concurrent. Contributed by @nex. ([#1261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1261))
-- Fixed the whoami endpoint returning HTTP 404 instead of HTTP 403, which confused some appservices. Contributed by
-  @nex. ([#1276](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1276))
-
-## Misc
-
-- The `console` feature is now enabled by default, allowing the server console to be used for running admin commands
-  directly. To automatically open the console on startup, set the `admin_console_automatic` config option to `true`.
-  Contributed by @ginger.
-- We now (finally) document our container image mirrors. Contributed by @Jade
-
-# Continuwuity 0.5.0 (2025-12-30)
-
-**This release contains a CRITICAL vulnerability patch, and you must update as soon as possible**
-
-## Features
-
-- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (
-  @Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251))
-
-## Bug Fixes
-
-- Don't allow admin room upgrades, as this can break the admin room (
-  @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))
-- Fix invalid creators in power levels during upgrade to v12 (
-  @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245))

CODE_OF_CONDUCT.md

@@ -1 +1,132 @@
-Contributors are expected to follow the [Continuwuity Community Guidelines](https://continuwuity.org/community/guidelines).
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people.
+* Being respectful of differing opinions, viewpoints, and experiences.
+* Giving and gracefully accepting constructive feedback.
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience.
+* Focusing on what is best not just for us as individuals, but for the overall
+  community.
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind.
+* Trolling, insulting or derogatory comments, and personal or political attacks.
+* Public or private harassment.
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission.
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting.
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement over email at
+<abuse@tuwunel.chat> or over Matrix at @abuse:tuwunel.chat.
+
+All complaints will be reviewed and investigated promptly and fairly. All
+community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -1,209 +1,125 @@
 # Contributing guide
 
-This page is about contributing to Continuwuity. The
-[development](/development/index.mdx) and [code style guide](/development/code_style.mdx) pages may be of interest for you as well.
+This page is for about contributing to Tuwunel. The
+[development](./development.md) page may be of interest for you as well.
 
 If you would like to work on an [issue][issues] that is not assigned, preferably
-ask in the Matrix room first at [#continuwuity:continuwuity.org][continuwuity-matrix],
+ask in the Matrix room first at [#tuwunel:tuwunel.chat][tuwunel-chat],
 and comment on it.
 
-### Code Style
+### Linting and Formatting
 
-Please review and follow the [code style guide](/development/code_style.mdx) for formatting, linting, naming conventions, and other code standards.
+It is mandatory all your changes satisfy the lints (clippy, rustc, rustdoc, etc)
+and your code is formatted via the **nightly** `cargo fmt`. A lot of the
+`rustfmt.toml` features depend on nightly toolchain. It would be ideal if they
+weren't nightly-exclusive features, but they currently still are. CI's rustfmt
+uses nightly.
 
-### Pre-commit Checks
+If you need to allow a lint, please make sure it's either obvious as to why
+(e.g. clippy saying redundant clone but it's actually required) or it has a
+comment saying why. Do not write inefficient code for the sake of satisfying
+lints. If a lint is wrong and provides a more inefficient solution or
+suggestion, allow the lint and mention that in a comment.
 
-Continuwuity uses pre-commit hooks to enforce various coding standards and catch common issues before they're committed. These checks include:
+### Running CI tests locally
 
-- Code formatting and linting
-- Typo detection (both in code and commit messages)
-- Checking for large files
-- Ensuring proper line endings and no trailing whitespace
-- Validating YAML, JSON, and TOML files
-- Checking for merge conflicts
-
-You can run these checks locally by installing [prek](https://github.com/j178/prek):
-
-
-```bash
-# Install prek using cargo-binstall
-cargo binstall prek
-
-# Install git hooks to run checks automatically
-prek install
-
-# Run all checks
-prek --all-files
-```
-
-Alternatively, you can use [pre-commit][pre-commit]:
-```bash
-# Requires python
-
-# Install pre-commit
-pip install pre-commit
-
-# Install the hooks
-pre-commit install
-
-# Run all checks manually
-pre-commit run --all-files
-```
-
-These same checks are run in CI via the prek-checks workflow to ensure consistency. These must pass before the PR is merged.
-
-[pre-commit]: https://pre-commit.com/
-
-### Running tests locally
-
-Tests, compilation, and linting can be run with standard Cargo commands:
-
-```bash
-# Run tests
-cargo test
-
-# Check compilation
-cargo check --workspace --features full
-
-# Run lints
-cargo clippy --workspace --features full
-# Auto-fix: cargo clippy --workspace --features full --fix --allow-staged;
-
-# Format code (must use nightly)
-cargo +nightly fmt
-```
+<sub>TODO: docker bake matrix</sub>
 
 ### Matrix tests
 
-Continuwuity uses [Complement][complement] for Matrix protocol compliance testing. Complement tests are run manually by developers, and documentation on how to run these tests locally is currently being developed.
+CI runs [Complement][complement], but currently does not fail if results from
+the checked-in results differ with the new results. If your changes are done to
+fix Matrix tests, note that in your pull request. If more Complement tests start
+failing from your changes, please review the logs (they are uploaded as
+artifacts) and determine if they're intended or not.
 
-If your changes are done to fix Matrix tests, please note that in your pull request. If more Complement tests start failing from your changes, please review the logs and determine if they're intended or not.
+If you'd like to run Complement locally using Nix, see the
+[testing](development/testing.md) page.
 
-[Sytest][sytest] is currently unsupported.
+[Sytest][sytest] support will come soon.
 
 ### Writing documentation
 
-Continuwuity's website uses [`rspress`][rspress] and is deployed via CI using Cloudflare Pages
-in the [`documentation.yml`][documentation.yml] workflow file. All documentation is in the `docs/`
-directory at the top level.
+Tuwunel's website uses [`mdbook`][mdbook] and deployed via CI using GitHub
+Pages in the [`documentation.yml`][documentation.yml] workflow file with Nix's
+mdbook in the devshell. All documentation is in the `docs/` directory at the top
+level. The compiled mdbook website is also uploaded as an artifact.
 
-To load the documentation locally:
+To build the documentation using Nix, run: `bin/nix-build-and-cache just .#book`
 
-1. Install NodeJS and npm from their [official website][nodejs-download] or via your package manager of choice
+The output of the mdbook generation is in `result/`. mdbooks can be opened in
+your browser from the individual HTML files without any web server needed.
 
-2. From the project's root directory, install the relevant npm modules
+### Inclusivity and Diversity
 
-   ```bash
-   npm ci
-   ```
+All **MUST** code and write with inclusivity and diversity in mind. See the
+[following page by Google on writing inclusive code and
+documentation](https://developers.google.com/style/inclusive-documentation).
 
-3. Make changes to the document pages as you see fit
+This **EXPLICITLY** forbids usage of terms like "blacklist"/"whitelist" and
+"master"/"slave", [forbids gender-specific words and
+phrases](https://developers.google.com/style/pronouns#gender-neutral-pronouns),
+forbids ableist language like "sanity-check", "cripple", or "insane", and
+forbids culture-specific language (e.g. US-only holidays or cultures).
 
-4. Generate a live preview of the documentation
+No exceptions are allowed. Dependencies that may use these terms are allowed but
+[do not replicate the name in your functions or
+variables](https://developers.google.com/style/inclusive-documentation#write-around).
 
-   ```bash
-   npm run docs:dev
-   ```
+In addition to language, write and code with the user experience in mind. This
+is software that intends to be used by everyone, so make it easy and comfortable
+for everyone to use. 🏳️‍⚧️
 
-   A webserver for the docs will be spun up for you (e.g. at `http://localhost:3000`). Any changes you make to the documentation will be live-reloaded on the webpage.
+### Variable, comment, function, etc standards
 
-Alternatively, you can build the documentation using `npm run docs:build` - the output of this will be in the `/doc_build` directory. Once you're happy with your documentation updates, you can commit the changes.
-
-### Commit Messages
-
-Continuwuity follows the [Conventional Commits][conventional-commits] specification for commit messages. This provides a standardized format that makes the commit history more readable and enables automated tools to generate changelogs.
-
-The basic structure is:
-
-```
-<type>[(optional scope)]: <description>
-
-[optional body]
-
-[optional footer(s)]
-```
-
-The allowed types for commits are:
-- `fix`: Bug fixes
-- `feat`: New features
-- `docs`: Documentation changes
-- `style`: Changes that don't affect the meaning of the code (formatting, etc.)
-- `refactor`: Code changes that neither fix bugs nor add features
-- `perf`: Performance improvements
-- `test`: Adding or fixing tests
-- `build`: Changes to the build system or dependencies
-- `ci`: Changes to CI configuration
-- `chore`: Other changes that don't modify source or test files
-
-Examples:
-```
-feat: Add user authentication
-fix(database): Resolve connection pooling issue
-docs: Update installation instructions
-```
-
-The project uses the `committed` hook to validate commit messages in pre-commit. This ensures all commits follow the conventional format.
+Rust's default style and standards with regards to [function names, variable
+names, comments](https://rust-lang.github.io/api-guidelines/naming.html), etc
+applies here.
 
 ### Creating pull requests
 
-Please try to keep contributions to the Forgejo Instance. While the mirrors of continuwuity
-allow for pull/merge requests, there is no guarantee the maintainers will see them in a timely
+Please try to keep contributions to the GitHub. While the mirrors of Tuwunel
+allow for pull/merge requests, there is no guarantee I will see them in a timely
 manner. Additionally, please mark WIP or unfinished or incomplete PRs as drafts.
-This prevents us from having to ping once in a while to double check the status
+This prevents me from having to ping once in a while to double check the status
 of it, especially when the CI completed successfully and everything so it
 *looks* done.
 
-Before submitting a pull request, please ensure:
-1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](/development/code_style.md)
-3. Your commit messages follow the conventional commits format
-4. Tests are added for new functionality
-5. Documentation is updated if needed
+If you open a pull request on one of the mirrors, it is your responsibility to
+inform me about its existence. In the future I may try to solve this with more
+repo bots in the Tuwunel Matrix room. There is no mailing list or email-patch
+support on the sr.ht mirror, but if you'd like to email me a git patch you can
+do so at `maintainer@tuwunel.chat`.
 
 Direct all PRs/MRs to the `main` branch.
 
 By sending a pull request or patch, you are agreeing that your changes are
 allowed to be licenced under the Apache-2.0 licence and all of your conduct is
-in line with the Contributor's Covenant, and continuwuity's Code of Conduct.
+in line with the Contributor's Covenant, and Tuwunel's Code of Conduct.
 
-Contribution by users who violate either of these code of conducts may not have
+Contribution by users who violate either of these code of conducts will not have
 their contributions accepted. This includes users who have been banned from
-continuwuity Matrix rooms for Code of Conduct violations.
+Tuwunel Matrix rooms for Code of Conduct violations.
 
-[conventional-commits]: https://www.conventionalcommits.org/
-[issues]: https://forgejo.ellis.link/continuwuation/continuwuity/issues
-[continuwuity-matrix]: https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org
+### Branch Policy
+
+##### This section applies to Matrix-Construct members and Tuwunel maintainers
+
+All branches on the matrix-construct/tuwunel repository are _centrally
+maintained_. They may be rebased without your consent. Trivial conflicts may be
+resolved by another maintainer. Please resolve more difficult conflicts as soon
+as possible. Personal forks are advised to reduce the workload on other
+maintainers. Stale branches will be deleted to reduce the effort for this
+policy.
+
+[issues]: https://github.com/matrix-construct/tuwunel/issues
+[tuwunel-chat]: https://matrix.to/#/#tuwunel:tuwunel.chat
 [complement]: https://github.com/matrix-org/complement/
 [sytest]: https://github.com/matrix-org/sytest/
-[nodejs-download]: https://nodejs.org/en/download
-[rspress]: https://rspress.rs/
-[documentation.yml]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/.forgejo/workflows/documentation.yml
-
-#### Writing news fragments
-
-In order to make writing our changelogs easier, we make use of [Towncrier]. Towncrier builds changelogs based on
-"news fragments", which are little markdown files in the `changelog.d/` directory that describe individual changes.
-
-When you make a pull request that changes functionality, fixes a bug, or adds documentation, please add a news fragment
-describing your change. The file name *MUST* be in the format of `{pull_request_number}.{type}`, where `{type}` is one
-of the following:
-
-- `feature` - for new features
-- `bugfix` - for bug fixes
-- `doc` - for documentation changes
-- `misc` - for other changes that don't fit the above categories
-
-For example:
-
-```bash
-$ echo "Fixed the quantum flux stabiliser. Contributed by @alice." > changelog.d/42.bugfix
-```
-
-(Note: If you want to credit yourself, you should reference your forgejo handle, however links to other platforms are also acceptable.)
-
-When the next release is made, Towncrier will automatically include your news fragment in the changelog.
-
-You can read more about writing news fragments in the [Towncrier tutorial][tt].
-
-[Towncrier]: https://towncrier.readthedocs.io/
-[tt]: https://towncrier.readthedocs.io/en/stable/tutorial.html#creating-news-fragments
+[cargo-deb]: https://github.com/kornelski/cargo-deb
+[lychee]: https://github.com/lycheeverse/lychee
+[markdownlint-cli]: https://github.com/igorshubovych/markdownlint-cli
+[cargo-audit]: https://github.com/RustSec/rustsec/tree/main/cargo-audit
+[direnv]: https://direnv.net/
+[mdbook]: https://rust-lang.github.io/mdBook/
+[documentation.yml]: https://github.com/matrix-construct/tuwunel/blob/main/.github/workflows/docs.yml

LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2023 Continuwuity Team and contributors
+   Copyright 2023 June
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -1,129 +1,157 @@
-# continuwuity
+# Tuwunel<sup>💕</sup>
+
+![GitHub License](https://img.shields.io/github/license/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
+![GitHub Created At](https://img.shields.io/github/created-at/matrix-construct/tuwunel?style=flat&color=%238A2BE2)
+![GitHub Commit Activity](https://img.shields.io/github/commit-activity/m/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel%2Fpulse%2Fmonthly&color=%238A2BE2)
+![Docker Pulls](https://img.shields.io/docker/pulls/jevolk/tuwunel?style=flat&color=8A2BE2)
+![GitHub Repo Stars](https://img.shields.io/github/stars/matrix-construct/tuwunel?style=flat&link=https%3A%2F%2Fgithub.com%2Fmatrix-construct%2Ftuwunel&color=%238A2BE2)
+[![CI/CD](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml/badge.svg?branch=main&style=flat)](https://github.com/matrix-construct/tuwunel/actions/workflows/main.yml)
 
 <!-- ANCHOR: catchphrase -->
 
-## A community-driven [Matrix](https://matrix.org/) homeserver in Rust
-
-[![Chat on Matrix](https://img.shields.io/matrix/continuwuity%3Acontinuwuity.org?server_fqdn=matrix.continuwuity.org&fetchMode=summary&logo=matrix)](https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org) [![Join the space](https://img.shields.io/matrix/space%3Acontinuwuity.org?server_fqdn=matrix.continuwuity.org&fetchMode=summary&logo=matrix&label=space)](https://matrix.to/#/#space:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org)
-
-
+## High Performance Matrix Homeserver in Rust!
 
 <!-- ANCHOR_END: catchphrase -->
 
-[continuwuity] is a Matrix homeserver written in Rust.
-It's the official community continuation of the [conduwuit](https://github.com/girlbossceo/conduwuit) homeserver.
-
 <!-- ANCHOR: body -->
 
-[![forgejo.ellis.link](https://img.shields.io/badge/Ellis%20Git-main+packages-green?style=flat&logo=forgejo&labelColor=fff)](https://forgejo.ellis.link/continuwuation/continuwuity) [![Stars](https://forgejo.ellis.link/continuwuation/continuwuity/badges/stars.svg?style=flat)](https://forgejo.ellis.link/continuwuation/continuwuity/stars) [![Issues](https://forgejo.ellis.link/continuwuation/continuwuity/badges/issues/open.svg?style=flat)](https://forgejo.ellis.link/continuwuation/continuwuity/issues?state=open) [![Pull Requests](https://forgejo.ellis.link/continuwuation/continuwuity/badges/pulls/open.svg?style=flat)](https://forgejo.ellis.link/continuwuation/continuwuity/pulls?state=open)
+Tuwunel is a featureful [Matrix](https://matrix.org/) homeserver you can use instead of Synapse
+with your favorite [client](https://matrix.org/ecosystem/clients/),
+[bridge](https://matrix.org/ecosystem/bridges/) or
+[bot](https://matrix.org/ecosystem/integrations/). It is written entirely in Rust to be a scalable,
+lightweight, low-cost, community-driven alternative covering all but the most niche uses.
 
-[![GitHub](https://img.shields.io/badge/GitHub-mirror-blue?style=flat&logo=github&labelColor=fff&logoColor=24292f)](https://github.com/continuwuity/continuwuity) [![Stars](https://img.shields.io/github/stars/continuwuity/continuwuity?style=flat)](https://github.com/continuwuity/continuwuity/stargazers)
+This project is the official successor to conduwuit, which
+was a featureful and high-performance fork of [Conduit](https://gitlab.com/famedly/conduit), all
+community-lead homeservers implementing the compatible
+[Matrix Specification](https://spec.matrix.org/latest/).
 
-[![GitLab](https://img.shields.io/badge/GitLab-mirror-blue?style=flat&logo=gitlab&labelColor=fff)](https://gitlab.com/continuwuity/continuwuity) [![Stars](https://img.shields.io/gitlab/stars/continuwuity/continuwuity?style=flat)](https://gitlab.com/continuwuity/continuwuity/-/starrers)
+Tuwunel is operated by enterprise users with a vested interest in sponsoring its continued
+development. It is now maintained by full-time staff.
 
-[![Codeberg](https://img.shields.io/badge/Codeberg-mirror-2185D0?style=flat&logo=codeberg&labelColor=fff)](https://codeberg.org/continuwuity/continuwuity) [![Stars](https://codeberg.org/continuwuity/continuwuity/badges/stars.svg?style=flat)](https://codeberg.org/continuwuity/continuwuity/stars)
+### Getting Started
 
-### Why does this exist?
+- [GitHub Releases](https://github.com/matrix-construct/tuwunel/releases)
+- [Sourcecode](https://github.com/matrix-construct/tuwunel/) `git clone https://github.com/matrix-construct/tuwunel.git`
+- [DockerHub](https://hub.docker.com/r/jevolk/tuwunel) or `docker pull jevolk/tuwunel:latest`
+- [GHCR](https://github.com/matrix-construct/tuwunel/pkgs/container/tuwunel) or `docker pull ghcr.io/matrix-construct/tuwunel:latest`
+- Static binaries available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
+- Deb and RPM packages available as [releases](https://github.com/matrix-construct/tuwunel/releases) or [build artifacts](https://github.com/matrix-construct/tuwunel/actions?query=branch%3Amain).
+- Arch package available as [tuwunel](https://aur.archlinux.org/packages/tuwunel) or [tuwunel-git](https://aur.archlinux.org/packages/tuwunel-git).
+- Nix package still [needs some love](https://github.com/NixOS/nixpkgs/issues/415469).
 
-The original conduwuit project has been archived and is no longer maintained. Rather than letting this Rust-based Matrix homeserver disappear, a group of community contributors have forked the project to continue its development, fix outstanding issues, and add new features.
+**1.** [Configure](https://matrix-construct.github.io/tuwunel/configuration.html) by
+copying and editing the `tuwunel-example.toml`. The `server_name` and `database_path` must be
+configured. **Most users deploy via docker or a distribution package and should follow the
+[appropriate guide](https://matrix-construct.github.io/tuwunel/deploying.html) instead.**
+This is just a summary for the impatient. See the full
+[documentation](https://matrix-construct.github.io/tuwunel/).
 
-We aim to provide a stable, well-maintained alternative for current conduwuit users and welcome newcomers seeking a lightweight, efficient Matrix homeserver.
+> [!TIP]
+> Avoid using a sub-domain for your `server_name`. You can always delegate later with a [`.well-known`](https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-well-known.md)
+> file, but you can never change your `server_name`.
 
-### Who are we?
+**2.** Setup TLS certificates. Most users enjoy the [Caddy](https://caddyserver.com/) reverse-proxy
+which automates their certificate renewal. Advanced users can load their own TLS certificates
+using the configuration and Tuwunel can be deployed without a reverse proxy. Example
+`/etc/caddy/Caddyfile` configuration with [Element](https://github.com/element-hq/element-web/releases)
+unzipped to `/var/www/element`:
+```
+tuwunel.me, tuwunel.me:8448 {
+    reverse_proxy localhost:8008
+}
+web.tuwunel.me {
+    root * /var/www/element/
+    file_server
+}
+```
+`caddy reload --config /etc/caddy/Caddyfile`
 
-We are a group of Matrix enthusiasts, developers and system administrators who have used conduwuit and believe in its potential. Our team includes both previous
-contributors to the original project and new developers who want to help maintain and improve this important piece of Matrix infrastructure.
+**3.** Start the server, connect your client and register your username. The first registration is
+granted server admin.
 
-We operate as an open community project, welcoming contributions from anyone interested in improving continuwuity.
+> [!TIP]
+> Configure a secret `registration_token` and set `allow_registration = true`
 
-### What is Matrix?
+ 🤗 Did you find this and other documentation helpful? We would love to hear feedback about setting
+ up Tuwunel.
 
-[Matrix](https://matrix.org) is an open, federated, and extensible network for
-decentralized communication. Users from any Matrix homeserver can chat with users from all
-other homeservers over federation. Matrix is designed to be extensible and built on top of.
-You can even use bridges such as Matrix Appservices to communicate with users outside of Matrix, like a community on Discord.
 
-### What are the project's goals?
+### Migrating to Tuwunel
 
-Continuwuity aims to:
+| Can I migrate from | |
+|-----------------|-----------|
+| conduwuit? | ✅ Yes. This will be supported at a minimum for one year, but likely indefinitely. |
+| Synapse? | ❌ Not yet, but this is planned and an important issue. Subscribe to [#2](https://github.com/matrix-construct/tuwunel/issues/2). |
+| Conduit? | ❌ Not right now, but this is planned for the near future. Subscribe to [#41](https://github.com/matrix-construct/tuwunel/issues/41). |
+| Any other fork of Conduit? | ❌ No. The migration must be explicitly listed in this table. |
+> [!CAUTION]
+> **Never switch between different forks of Conduit or you will corrupt your database.**
+> All derivatives of Conduit share the same linear database version without any awareness of other
+> forks. The database will permanently corrupt and we will not be able to help you.
 
-- Maintain a stable, reliable Matrix homeserver implementation in Rust
-- Improve compatibility and specification compliance with the Matrix protocol
-- Fix bugs and performance issues from the original conduwuit
-- Add missing features needed by homeserver administrators
-- Provide comprehensive documentation and easy deployment options
-- Create a sustainable development model for long-term maintenance
-- Keep a lightweight, efficient codebase that can run on modest hardware
+#### Migrating from conduwuit
 
-### Can I try it out?
+Migrating from conduwuit to Tuwunel _just works_. In technical parlance it is a "binary swap."
+All you have to do is update to the latest Tuwunel and change the path to the executable from
+`conduwuit` to `tuwunel`.
 
-Check out the [documentation](https://continuwuity.org) for installation instructions.
+Anything else named "conduwuit" is still recognized, this includes environment variables with prefixes
+such as `CONDUWUIT_`. In fact, `CONDUIT_` is still recognized for our legacy users. You may have
+noticed that various configs, yamls, services, users, and other items were renamed, but if you
+were a conduwuit user we recommend against changing anything at all. This will keep things simple.
+If you are not sure please ask. If you found out that something did in fact need to be changed
+please open an issue immediately.
 
-If you want to try it out as a user, we have some partnered homeservers you can use:
-* You can head over to [https://federated.nexus](https://federated.nexus/) in your browser.
-  * Hit the `Apply to Join` button. Once your request has been accepted, you will receive an email with your username and password.
-  * Head over to [https://app.federated.nexus](https://app.federated.nexus/) and you can sign in there, or use any other matrix chat client you wish elsewhere.
-  * Your username for matrix will be in the form of `@username:federated.nexus`, however you can simply use the `username` part to log in. Your password is your password.
 
-* There's also [https://continuwuity.rocks/](https://continuwuity.rocks/). You can register a new account using Cinny via [this convenient link](https://app.cinny.in/register/continuwuity.rocks), or you can use Element or another matrix client *that supports registration*.
+### Upgrading & Downgrading Tuwunel
 
-### What are we working on?
+We strive to make moving between versions of Tuwunel safe and easy. Downgrading Tuwunel is always
+safe but often prevented by a guard. An error will indicate the downgrade is not possible and a
+newer version which does not error must be sought.
 
-We're working our way through all of the issues in the [Forgejo project](https://forgejo.ellis.link/continuwuation/continuwuity/issues).
+#### Branches
 
-- [Packaging & availability in more places](https://forgejo.ellis.link/continuwuation/continuwuity/issues/747)
-- [Appservices bugs & features](https://forgejo.ellis.link/continuwuation/continuwuity/issues?q=&type=all&state=open&labels=178&milestone=0&assignee=0&poster=0)
-- [Improving compatibility and spec compliance](https://forgejo.ellis.link/continuwuation/continuwuity/issues?labels=119)
-- Automated testing
-- [Admin API](https://forgejo.ellis.link/continuwuation/continuwuity/issues/748)
-- [Policy-list controlled moderation](https://forgejo.ellis.link/continuwuation/continuwuity/issues/750)
+The main branch is always _reasonably safe_ to run. We understand the propensity for users to simply clone
+the main branch to get up and running, and we're obliged to ensure it's always viable. Nevertheless, only
+tagged releases are true releases.
 
-### Can I migrate my data from x?
+#### Container Tracking
 
-- Conduwuit: Yes
-- Conduit: No, database is now incompatible
-- Grapevine: No, database is now incompatible
-- Dendrite: No
-- Synapse: No
+> [!IMPORTANT]
+> **We strongly advise tracking the `:latest` tag when automatically updating.**
 
-We haven't written up a guide on migrating from incompatible homeservers yet. Reach out to us if you need to do this!
+Tracking `:latest` gives us the necessary discretion to keep you on the appropriate stable version.
+We discourage tracking the main branch unless frequent restarts are acceptable. Alternatively,
+tracking the `:preview` tag provides the latest release-candidate becoming equivalent to `:latest`
+after a release. Tracking the `:preview` tag is a worthy alternative to the main branch, with
+turbulence limited to release-time.
+
+### Getting Help & Support
+
+If you are opposed to using github, or if private discussion is required such as for security
+disclosures, or for any other reason, I would be happy to receive your DM at
+[@jason:tuwunel.me](https://matrix.to/#/@jason:tuwunel.me). This will not be bothering me as it would
+be my pleasure to help you when possible. As an emergency contact you can send an email to
+jasonzemos@gmail.com.
+
+##### Tuwunel Fanclub
+
+We have an unofficial community-run chat which is publicly accessible at
+[#tuwunel:matrix.org](https://matrix.to/#/#tuwunel:matrix.org). The members, content, or moderation
+decisions of this room are not in any way related or endorsed by this project or its sponsors,
+and not all project staff will be present there. There will be at least some presence by staff to
+offer assistance so long as the room remains in minimally good standing.
+
+
+## Tuwunel<sup>💕</sup>
+
+Tuwunel's theme is **empathy** in communication defined by the works of
+[Edith Stein](https://plato.stanford.edu/entries/stein/). Empathy is the basis for how we approach
+every message and our responsibility to the other in every conversation.
 
 <!-- ANCHOR_END: body -->
 
-## Contribution
-
-### Development flow
-
-- Features / changes must developed in a separate branch
-- For each change, create a descriptive PR
-- Your code will be reviewed by one or more of the continuwuity developers
-- The branch will be deployed live on multiple tester's matrix servers to shake out bugs
-- Once all testers and reviewers have agreed, the PR will be merged to the main branch
-- The main branch will have nightly builds deployed to users on the cutting edge
-- Every week or two, a new release is cut.
-
-The main branch is always green!
-
-
-### Policy on pulling from other forks
-
-We welcome contributions from other forks of conduwuit, subject to our review process.
-When incorporating code from other forks:
-
-- All external contributions must go through our standard PR process
-- Code must meet our quality standards and pass tests
-- Code changes will require testing on multiple test servers before merging
-- Attribution will be given to original authors and forks
-- We prioritize stability and compatibility when evaluating external contributions
-- Features that align with our project goals will be given priority consideration
-
 <!-- ANCHOR: footer -->
 
-#### Contact
-
-Join our [Matrix room](https://matrix.to/#/#continuwuity:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org) and [space](https://matrix.to/#/#space:continuwuity.org?via=continuwuity.org&via=ellis.link&via=explodie.org&via=matrix.org) to chat with us about the project!
-
 <!-- ANCHOR_END: footer -->
-
-
-[continuwuity]: https://forgejo.ellis.link/continuwuation/continuwuity

RELEASE.md

@@ -0,0 +1,57 @@
+# Tuwunel 1.4.2
+
+September 12, 2025
+
+Users running maubot, neochat, or any client or bridge not excluded below should update to this patch as soon as possible to reduce unnecessary resource consumption. (see: Bug Fixes)
+
+### New Features
+
+- Requested by @alaviss an alternative DNS resolver has been implemented for use with appservices and other configured targets intended for local networks. This passthru performs minimal caching and cannot be used for federation. Enable with `dns_passthru_appservices = true` or specifying hosts in `dns_passthru_domains` (#158)
+
+- Contributed by @tototomate123 a nifty experimental feature can disable push notifications when you're active on one device from being sent to others. This can be enabled with `suppress_push_when_active`. Please thank them when your pocket stops vibrating while chatting on your desktop! (#150)
+
+- Thanks to a report by @DetermineAbsurd the `m.federate` field can be defaulted to false when creating a room using the new `federate_created_rooms` config option. (#151)
+
+- At the request of @grinapo verbose logging builds are now bundled with this release. These builds are found with the feature-set `-logging-` which is otherwise similar to `-all-`. This contains more messages at all levels optimized away in other release modes; it comes at some performance penalty.
+
+- JWT tokens can now be used for authentication on any endpoint which supports UIA. For example: an external forgot-password service can send a token to the `client/account/password` endpoint to reset a user's password. This feature was commissioned and made public by an enterprise sponsor.
+
+### Enhancements
+
+- Sliding-sync has been significantly refactored. Performance has massively increased with many bugs and compliance issues also fixed. Please be aware we are tracking an issue related to read-marker behavior in Element X. The 🟢 dot does not unconditionally clear at every touch. Whether this is a feature or a bug, or both, is being investigated for v1.5.
+
+- Hydra backports are now enabled by default. The change should be completely transparent. If you do notice any increased load try to increase the `cache_capacity_modifier` above default.
+
+- Room deletions now also purge synctokens which can be significant to the overall storage consumed by a room. Users who have already deleted rooms please be assured an update planned for v1.5 will deal with cleansing synctokens in general.
+
+- Room version 1 and 2 support took a step forward, possibly working for some rooms but is not yet considered adequately supported and the ticket remains open. (#12)
+
+- Thanks to @AreYouLoco for contributing an updated Kubernetes [Helm Chart](https://github.com/AreYouLoco/tuwunel-helm); link added to docs.
+
+### Bug Fixes
+
+- **Special thanks to @frebib for investigating a bug which triggers the uploading of unnecessary encryption one-time-keys.** Running over ten maubot instances it became obvious after observing increased resources and laggy bot response. This update removes any excess keys for a device. Thanks to @duckbuster for confirming neochat is affected. Clients confirmed unaffected include: Element, Element X, Nheko. Fractal, Cinny, matrix-rust-sdk and matrix-js-sdk clients and bots are probably unaffected. Mautrix-based bridges are probably affected. Users of unaffected clients should still upgrade.
+
+- Thanks @dasha_uwu for refactoring alias resolution logic with fixes to remain compatible with the upcoming element-web release. This was an incredibly valuable contribution which will spare all of us from impending grief; the kind of ahead-of-the-game initiative I don't think a project like this could exist without. (adadafa88f3)
+
+- Room deletions now preserve a small number of records to properly synchronize with local clients and remote servers after the room vanishes. Prior behavior is maintained with a `--force` flag added to the command.
+
+- Thanks @scvalex for once again cleaning up our mess after Nix found the github CI was not running doctests. Thank you for contributing the patch 🙏  (#152).
+
+- Thanks @Tronde for reporting a broken link to the CoC in the mdbook documentation. (#155)
+
+- Specification compliance required the `/joined_rooms` endpoint be restricted to current members rather than including past members. (4b49aaad53a)
+
+- Specification compliance required state events be made visible to prior members of a room where `history_visibility=shared`. (86781522b68)
+
+- The `limit` parameter to the `/context` endpoint is now divided with de facto compatibility (matrix-org/matrix-spec#2202)
+
+- The room avatar in sliding sync is now computed with greater compliance to the specification (3deebeab78f). This builds off earlier work done by @tmayoff in (a340e6786db).
+
+- The canonical alias for a room is considered invalid if the primary alias is missing or removed (7221d466ce8). This is a T&S concern and we encourage reports for any other contexts where this condition should be applied.
+
+- Presence is no longer updated by the private read-receipt or read-marker paths, only public receipts.
+
+### Deprecations
+
+- Hardened Malloc support had to be removed after the build broke. We will gladly add support back upon request or contribution.

SECURITY.md

@@ -1,64 +0,0 @@
-# Security Policy for Continuwuity
-
-This document outlines the security policy for Continuwuity. Our goal is to maintain a secure platform for all users, and we take security matters seriously.
-
-## Supported Versions
-
-We provide security updates for the following versions of Continuwuity:
-
-| Version        | Supported        |
-| -------------- |:----------------:|
-| Latest release |        ✅        |
-| Main branch    |        ✅        |
-| Older releases |        ❌        |
-
-We may backport fixes to the previous release at our discretion, but we don't guarantee this.
-
-## Reporting a Vulnerability
-
-### Responsible Disclosure
-
-We appreciate the efforts of security researchers and the community in identifying and reporting vulnerabilities. To ensure that potential vulnerabilities are addressed properly, please follow these guidelines:
-
-1. **Contact members of the team directly** over E2EE private message.
-   - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
-   - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
-   - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
-2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so don't include sensitive details.
-3. **Do not disclose the vulnerability publicly** until it has been addressed
-4. **Provide detailed information** about the vulnerability, including:
-   - A clear description of the issue
-   - Steps to reproduce
-   - Potential impact
-   - Any possible mitigations
-   - Version(s) affected, including specific commits if possible
-
-If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that you bother us, instead of having a vulnerability disclosed without a fix.
-
-### What to Expect
-
-When you report a security vulnerability:
-
-1. **Acknowledgment**: We will acknowledge receipt of your report.
-2. **Assessment**: We will assess the vulnerability and determine its impact on our users
-3. **Updates**: We will provide updates on our progress in addressing the vulnerability, and may request you help test mitigations
-4. **Resolution**: Once resolved, we will notify you and discuss coordinated disclosure
-5. **Credit**: We will recognize your contribution (unless you prefer to remain anonymous)
-
-## Security Update Process
-
-When security vulnerabilities are identified:
-
-1. We will develop and test fixes in a private fork
-2. Security updates will be released as soon as possible
-3. Release notes will include information about the vulnerabilities, avoiding details that could facilitate exploitation where possible
-4. Critical security updates may be backported to the previous stable release
-
-## Additional Resources
-
-- [Matrix Security Disclosure Policy](https://matrix.org/security-disclosure-policy/)
-- [Continuwuity Documentation](https://continuwuity.org/introduction)
-
----
-
-This security policy was last updated on May 25, 2025.

arch/tuwunel.service

@@ -1,26 +1,27 @@
 [Unit]
-Description=Continuwuity - Matrix homeserver
-Documentation=https://continuwuity.org/
+Description=Tuwunel Matrix homeserver
 Wants=network-online.target
 After=network-online.target
-Alias=matrix-conduwuit.service
+Documentation=https://tuwunel.chat/
+RequiresMountsFor=/var/lib/private/tuwunel
+Alias=matrix-tuwunel.service
 
 [Service]
 DynamicUser=yes
-User=conduwuit
-Group=conduwuit
 Type=notify-reload
 ReloadSignal=SIGUSR1
 
-Environment="CONTINUWUITY_LOG_TO_JOURNALD=true"
-Environment="CONTINUWUITY_JOURNALD_IDENTIFIER=%N"
-Environment="CONTINUWUITY_DATABASE_PATH=%S/conduwuit"
-Environment="CONTINUWUITY_CONFIG_RELOAD_SIGNAL=true"
+TTYPath=/dev/tty25
+DeviceAllow=char-tty
+StandardInput=tty-force
+StandardOutput=tty
+StandardError=journal+console
+TTYReset=yes
+# uncomment to allow buffer to be cleared every restart
+TTYVTDisallocate=no
 
-LoadCredential=conduwuit.toml:/etc/conduwuit/conduwuit.toml
-RefreshOnReload=yes
-
-ExecStart=/usr/bin/conduwuit --config ${CREDENTIALS_DIRECTORY}/conduwuit.toml
+TTYColumns=120
+TTYRows=40
 
 AmbientCapabilities=
 CapabilityBoundingSet=
@@ -53,18 +54,23 @@ SystemCallArchitectures=native
 SystemCallFilter=@system-service @resources
 SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
 SystemCallErrorNumber=EPERM
+StateDirectory=tuwunel
 
-# ConfigurationDirectory isn't specified here because it's created by
-# the distro's package manager.
-StateDirectory=conduwuit
-RuntimeDirectory=conduwuit
+RuntimeDirectory=tuwunel
 RuntimeDirectoryMode=0750
 
+Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
+BindPaths=/var/lib/private/tuwunel:/var/lib/conduwuit
+BindPaths=/var/lib/private/tuwunel:/var/lib/private/conduwuit
+BindPaths=/var/lib/private/tuwunel:/var/lib/matrix-conduit
+BindPaths=/var/lib/private/tuwunel:/var/lib/private/matrix-conduit
+
+ExecStart=/usr/bin/tuwunel
 Restart=on-failure
 RestartSec=5
 
 TimeoutStopSec=4m
-TimeoutStartSec=10m
+TimeoutStartSec=4m
 
 StartLimitInterval=1m
 StartLimitBurst=5

book.toml

@@ -0,0 +1,30 @@
+[book]
+authors = [
+	"girlbossceo",
+	"jevolk"
+]
+description = "Tuwunel, a high performance successor to Conduit and Conduwuit"
+language = "en"
+multilingual = false
+src = "docs"
+title = "Tuwunel One"
+text-direction = "ltr"
+
+[build]
+build-dir = "public"
+create-missing = true
+extra-watch-dirs = [
+	"debian",
+	"docs",
+]
+
+[rust]
+edition = "2024"
+
+[output.html]
+git-repository-url = "https://github.com/matrix-construct/tuwunel"
+edit-url-template = "https://github.com/matrix-construct/tuwunel/edit/main/{path}"
+git-repository-icon = "fa-github-square"
+
+[output.html.search]
+limit-results = 15

changelog.d/+12935c96.feature.md

@@ -1 +0,0 @@
-Appservice device management as outlined in MSC4190 (part of Matrix 1.17) is now fully supported. Contributed by @ginger.

changelog.d/+32bb7e0d.bugfix.md

@@ -1 +0,0 @@
-Improved invite and join reliability in clients using legacy sync. Contributed by @ginger

changelog.d/+3a1a284e.removal.md

@@ -1 +0,0 @@
-Removed the `/_conduwuit/` versions of the `local_user_count` and `version` routes. These routes are still accessible under the `/_continuwuity` prefix.

changelog.d/+48bfd52a.bugfix.md

@@ -1 +0,0 @@
-The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger

changelog.d/+75749b75.misc.md

@@ -1 +0,0 @@
-Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger.

changelog.d/+7865cde6.feature.md

@@ -1 +0,0 @@
-Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.

changelog.d/+85568e80.feature.md

@@ -1 +0,0 @@
-Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.

changelog.d/+98691708.feature.md

@@ -1 +0,0 @@
-Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.

changelog.d/+a4f10a9b.feature.md

@@ -1 +0,0 @@
-Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.

changelog.d/+bf00f682.bugfix.md

@@ -1 +0,0 @@
-Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout.

changelog.d/+cb8b2b10.removal.md

@@ -1 +0,0 @@
-Removed support for guest user registration, a little-used and deprecated approach to room previews.

changelog.d/+cbef004c.removal.md

@@ -1 +0,0 @@
-The deprecated `well_known.rtc_focus_server_urls` config option has been removed. MatrixRTC foci should be configured using the `matrix_rtc.foci` config option.

changelog.d/+f7afb79b.misc.md

@@ -1 +0,0 @@
-The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used on distro versions from before 2025-01-30

changelog.d/+fe90cdea.removal.md

@@ -1 +0,0 @@
-Support for server-side blurhashing (part of MSC2448) has been removed.

changelog.d/1487.feature

@@ -1 +0,0 @@
-Updated [MSC4284: Policy Servers](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) implementation to support the newly stabilised proposal. Contributed by @nex.

changelog.d/1498.doc

@@ -1 +0,0 @@
-Add performance tuning documentation. Contributed by @stratself.

changelog.d/1505.refactor.md

@@ -1 +0,0 @@
-Rewrite the resolver service to use [resolvematrix](https://forgejo.ellis.link/continuwuation/resolvematrix) for server resolution. Rewrite by @s1lv3r, crate by @Jade

changelog.d/1671.docs

@@ -1 +0,0 @@
-Explain accessing Continuwuity's server console when deployed via Docker.

changelog.d/1691.feature

@@ -1 +0,0 @@
-Added config option for default room ACLs. Contributed by @eve.

changelog.d/1701.removal.md

@@ -1 +0,0 @@
-Removed support for LDAP.

changelog.d/1706.docs

@@ -1 +0,0 @@
-Clarified in the config that `max_request_size` affects federated media as well.

changelog.d/1710.feature

@@ -1 +0,0 @@
-Added support for fallback encryption keys.

changelog.d/1711.bugfix

@@ -1 +0,0 @@
-Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex.

changelog.d/1741.feature

@@ -1 +0,0 @@
-Add `!admin users reject-all-invites` to clean invite spam

changelog.d/1742.bugfix

@@ -1 +0,0 @@
-fix `!admin query account-data account-data-get` not returning the content

changelog.d/1747.feature.md

@@ -1,9 +0,0 @@
-Implemented event rejection, which should resolve and prevent future netsplits of the kinds observed
-within some Continuwuity rooms.
-Also resolved several bugs related to both soft-failing events, and event backfilling, which should
-improve state resolution stability.
-The `!admin debug get-pdu` command was updated to disambiguate event acceptance status, and
-`!admin debug show-auth-chain` was added to visually display event auth chains, which may assist
-developers in debugging strangely complex events.
-
-Contributed by @nex.

changelog.d/1752.bugfix

@@ -1 +0,0 @@
-Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles (QuadRadical)

changelog.d/1762.doc

@@ -1 +0,0 @@
-Added example configuration using caddy-docker-proxy in the livekit setup section of the docs. Contributed by @Cease

changelog.d/1804.bugfix

@@ -1 +0,0 @@
-Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz.

changelog.d/1807.bugfix.md

@@ -1 +0,0 @@
-Fixed several bugs in the `POST /_matrix/client/v3/rooms/{roomId}/upgrade` endpoint. Contributed by @nex.

changelog.d/1807.feature.md

@@ -1 +0,0 @@
-Added full support for [MSC4168: Update `m.space.*` state on room upgrade](https://github.com/matrix-org/matrix-spec-proposals/pull/4168). Contributed by @nex.

changelog.d/1818.feature.md

@@ -1,2 +0,0 @@
-Improved the performance and reliability of fetching missing events, improving network partition recovery. Contributed
-by @nex.

changelog.d/1829.misc

@@ -1 +0,0 @@
-Remove support for MSC4373, as the MSC is now closed. Contributed by @vel.

changelog.d/1853.feature

@@ -1 +0,0 @@
-Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical).

changelog.d/1875.feature

@@ -1 +0,0 @@
-Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex.

changelog.d/1877.feature

@@ -1 +0,0 @@
-Added `!admin debug get-state-at` command

changelog.d/1912.doc.md

@@ -1 +0,0 @@
-Updated deployment docs to account for new RPM package availability across more distros. Contributed by @julian45.

changelog.d/1927.refactor.md

@@ -1 +0,0 @@
-Move resolver service into client service, and remove deprecated and unused code. Contributed by @s1lv3r.

changelog.d/765.feature.md

@@ -1 +0,0 @@
-Added support for linking an external identity provider with OIDC. Contributed by @ginger.

changelog.d/917.bugfix.md

@@ -1 +0,0 @@
-Adjusted legacy sync logic to no longer use the `roomsynctoken_shortstatehash` database column. Once this change has been confirmed to be stable and reliable, a future update will remove it entirely, significantly decreasing database sizes. Contributed by @ginger.

clippy.toml

@@ -1,32 +1,20 @@
 array-size-threshold = 4096
-cognitive-complexity-threshold = 94         # TODO reduce me ALARA
-excessive-nesting-threshold = 11            # TODO reduce me to 4 or 5
-future-size-threshold = 7745                # TODO reduce me ALARA
+cognitive-complexity-threshold = 100        # TODO reduce me ALARA
+excessive-nesting-threshold = 8
+future-size-threshold = 8192
 stack-size-threshold = 196608               # TODO reduce me ALARA
 too-many-lines-threshold = 780              # TODO reduce me to <= 100
 type-complexity-threshold = 250             # reduce me to ~200
 large-error-threshold = 256                 # TODO reduce me ALARA
 
-disallowed-macros = [
-	{ path = "log::error", reason = "use conduwuit_core::error" },
-	{ path = "log::warn", reason = "use conduwuit_core::warn" },
-	{ path = "log::info", reason = "use conduwuit_core::info" },
-	{ path = "log::debug", reason = "use conduwuit_core::debug" },
-	{ path = "log::trace", reason = "use conduwuit_core::trace" },
-]
+#disallowed-macros = [
+#	{ path = "log::error", reason = "use tuwunel_core::error" },
+#	{ path = "log::warn", reason = "use tuwunel_core::warn" },
+#	{ path = "log::info", reason = "use tuwunel_core::info" },
+#	{ path = "log::debug", reason = "use tuwunel_core::debug" },
+#	{ path = "log::trace", reason = "use tuwunel_core::trace" },
+#]
 
-[[disallowed-methods]]
-path = "tokio::spawn"
-reason = "use and pass conduwuit_core::server::Server::runtime() to spawn from"
-
-[[disallowed-methods]]
-path = "reqwest::Response::bytes"
-reason = "bytes is unsafe, use limit_read via the conduwuit_core::utils::LimitReadExt trait instead"
-
-[[disallowed-methods]]
-path = "reqwest::Response::text"
-reason = "text is unsafe, use limit_read_text via the conduwuit_core::utils::LimitReadExt trait instead"
-
-[[disallowed-methods]]
-path = "reqwest::Response::json"
-reason = "json is unsafe, use limit_read_text via the conduwuit_core::utils::LimitReadExt trait instead"
+#disallowed-methods = [
+#	{ path = "tokio::spawn", reason = "use and pass tuwunel_core::server::Server::runtime() to spawn from" },
+#]

committed.toml

@@ -1,3 +0,0 @@
-style = "conventional"
-subject_length = 72
-allowed_types = ["ci", "build", "fix", "feat", "chore", "docs", "style", "refactor", "perf", "test"]

complement/complement-entrypoint.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-set -xe
-# If we have no $SERVER_NAME set, abort
-if [ -z "$SERVER_NAME" ]; then
-  echo "SERVER_NAME is not set, aborting"
-  exit 1
-fi
-
-# If /complement/ca/ca.crt or /complement/ca/ca.key are missing, abort
-if [ ! -f /complement/ca/ca.crt ] || [ ! -f /complement/ca/ca.key ]; then
-  echo "/complement/ca/ca.crt or /complement/ca/ca.key is missing, aborting"
-  exit 1
-fi
-
-# Add the root cert to the local trust store
-echo 'Installing Complement CA certificate to local trust store'
-cp /complement/ca/ca.crt /usr/local/share/ca-certificates/complement-ca.crt
-update-ca-certificates
-
-# Sign a certificate for our $SERVER_NAME
-echo "Generating and signing certificate for $SERVER_NAME"
-openssl genrsa -out "/$SERVER_NAME.key" 2048
-
-echo "Generating CSR for $SERVER_NAME"
-openssl req -new -sha256 \
-  -key "/$SERVER_NAME.key" \
-  -out "/$SERVER_NAME.csr" \
-  -subj "/C=US/ST=CA/O=Continuwuity, Inc./CN=$SERVER_NAME"\
-  -addext "subjectAltName=DNS:$SERVER_NAME"
-openssl req -in "$SERVER_NAME.csr" -noout -text
-
-echo "Signing certificate for $SERVER_NAME with Complement CA"
-cat <<EOF > ./cert.ext
-authorityKeyIdentifier=keyid,issuer
-basicConstraints = CA:FALSE
-keyUsage = digitalSignature, keyEncipherment, dataEncipherment, nonRepudiation
-extendedKeyUsage = serverAuth
-subjectAltName = @alt_names
-[alt_names]
-DNS.1 = *.docker.internal
-DNS.2 = hs1
-DNS.3 = hs2
-DNS.4 = hs3
-DNS.5 = hs4
-DNS.6 = $SERVER_NAME
-IP.1 = 127.0.0.1
-EOF
-openssl x509 \
-  -req \
-  -in "/$SERVER_NAME.csr" \
-  -CA /complement/ca/ca.crt \
-  -CAkey /complement/ca/ca.key \
-  -CAcreateserial \
-  -out "/$SERVER_NAME.crt" \
-  -days 1 \
-  -sha256 \
-  -extfile ./cert.ext
-
-# Tell continuwuity where to find the certs
-export CONTINUWUITY_TLS__KEY="/$SERVER_NAME.key"
-export CONTINUWUITY_TLS__CERTS="/$SERVER_NAME.crt"
-# And who it is
-export CONTINUWUITY_SERVER_NAME="$SERVER_NAME"
-
-echo "Starting Continuwuity with SERVER_NAME=$SERVER_NAME"
-# Start continuwuity
-/usr/local/bin/conduwuit --config /etc/continuwuity/config.toml

debian/README.md

@@ -0,0 +1,36 @@
+# Tuwunel for Debian
+
+Information about downloading and deploying the Debian package. This may also be
+referenced for other `apt`-based distros such as Ubuntu.
+
+### Installation
+
+It is recommended to see the [generic deployment guide](../deploying/generic.md)
+for further information if needed as usage of the Debian package is generally
+related.
+
+No `apt` repository is currently offered yet, it is in the works/development.
+
+### Configuration
+
+When installed, the example config is placed at `/etc/tuwunel/tuwunel.toml`
+as the default config. The config mentions things required to be changed before
+starting.
+
+You can tweak more detailed settings by uncommenting and setting the config
+options in `/etc/tuwunel/tuwunel.toml`.
+
+### Running
+
+The package uses the [`tuwunel.service`](../configuration/examples.md#example-systemd-unit-file)
+systemd unit file to start and stop Tuwunel. The binary is installed at `/usr/sbin/tuwunel`.
+
+This package assumes by default that Tuwunel will be placed behind a reverse
+proxy. The default config options apply (listening on `localhost` and TCP port
+`6167`). Matrix federation requires a valid domain name and TLS, so you will
+need to set up TLS certificates and renewal for it to work properly if you
+intend to federate.
+
+Consult various online documentation and guides on setting up a reverse proxy
+and TLS. Caddy is documented at the [generic deployment guide](../deploying/generic.md#setting-up-the-reverse-proxy)
+as it's the easiest and most user friendly.

debian/config

@@ -6,13 +6,13 @@ set -e
 #. /usr/share/debconf/confmodule
 #
 ## Ask for the Matrix homeserver name, address and port.
-#db_input high conduwuit/hostname || true
+#db_input high tuwunel/hostname || true
 #db_go
 #
-#db_input low conduwuit/address || true
+#db_input low tuwunel/address || true
 #db_go
 #
-#db_input medium conduwuit/port || true
+#db_input medium tuwunel/port || true
 #db_go
 
 exit 0

debian/postinst

@@ -0,0 +1,47 @@
+#!/bin/sh
+set -e
+
+# TODO: implement debconf support that is maintainable without duplicating the config
+#. /usr/share/debconf/confmodule
+
+TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
+TUWUNEL_CONFIG_PATH=/etc/tuwunel
+
+case "$1" in
+  configure)
+    # Create the `tuwunel` user if it does not exist yet.
+    if ! getent passwd tuwunel > /dev/null ; then
+      echo 'Adding system user for the tuwunel Matrix homeserver' 1>&2
+      adduser --system --group --quiet \
+        --home "$TUWUNEL_DATABASE_PATH" \
+        --disabled-login \
+        --shell "/usr/sbin/nologin" \
+        tuwunel
+    fi
+
+    # Create the database path if it does not exist yet and fix up ownership
+    # and permissions for the config.
+    mkdir -v -p "$TUWUNEL_DATABASE_PATH"
+
+    # symlink the previous location for compatibility if it does not exist yet.
+    if ! test -L "/var/lib/matrix-conduit" ; then
+        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/matrix-conduit"
+    fi
+    if ! test -L "/var/lib/conduwuit" ; then
+        ln -s -v "$TUWUNEL_DATABASE_PATH" "/var/lib/conduwuit"
+    fi
+
+    chown -v tuwunel:tuwunel -R "$TUWUNEL_DATABASE_PATH"
+    chown -v tuwunel:tuwunel -R "$TUWUNEL_CONFIG_PATH"
+
+    chmod -v 740 "$TUWUNEL_DATABASE_PATH"
+
+    echo ''
+    echo 'Make sure you edit the example config at /etc/tuwunel/tuwunel.toml before starting!'
+    echo 'To start the server, run: systemctl start tuwunel.service'
+    echo ''
+
+    ;;
+esac
+
+#DEBHELPER#

debian/postrm

@@ -0,0 +1,52 @@
+#!/bin/sh
+set -e
+
+#. /usr/share/debconf/confmodule
+
+TUWUNEL_CONFIG_PATH=/etc/tuwunel
+TUWUNEL_DATABASE_PATH=/var/lib/tuwunel
+CONDUIT_DATABASE_PATH_SYMLINK=/var/lib/matrix-conduit
+CONDUWUIT_DATABASE_PATH_SYMLINK=/var/lib/conduwuit
+
+case $1 in
+  purge)
+    # Remove debconf changes from the db
+    #db_purge
+
+    # Per https://www.debian.org/doc/debian-policy/ch-files.html#behavior
+    # "configuration files must be preserved when the package is removed, and
+    #  only deleted when the package is purged."
+
+    #
+
+    if [ -d "$TUWUNEL_CONFIG_PATH" ]; then
+      if test -L "$TUWUNEL_CONFIG_PATH"; then
+        echo "Deleting tuwunel configuration files"
+        rm -v -r "$TUWUNEL_CONFIG_PATH"
+      fi
+    fi
+
+    if [ -d "$TUWUNEL_DATABASE_PATH" ]; then
+      if test -L "$TUWUNEL_DATABASE_PATH"; then
+        echo "Deleting tuwunel database directory"
+        rm -r "$TUWUNEL_DATABASE_PATH"
+      fi
+    fi
+
+    if [ -d "$CONDUIT_DATABASE_PATH_SYMLINK" ]; then
+      if test -L "$CONDUIT_DATABASE_SYMLINK"; then
+        echo "Removing matrix-conduit symlink"
+        rm -r "$CONDUIT_DATABASE_PATH_SYMLINK"
+      fi
+    fi
+
+    if [ -d "$CONDUWUIT_DATABASE_PATH_SYMLINK" ]; then
+      if test -L "$CONDUWUIT_DATABASE_SYMLINK"; then
+        echo "Removing conduwuit symlink"
+        rm -r "$CONDUWUIT_DATABASE_PATH_SYMLINK"
+      fi
+    fi
+    ;;
+esac
+
+#DEBHELPER#