fix(api): keep premium through cancellation and refund pix exactly (#1995 )

chore(deploy): remove the outdated helm charts and cluster manifests (#1994 )
fix(api): stop exporting the pix refund shortfall constant (#1993 )
2026-10-11 05:02:24 +09:00 · 2026-08-25 00:57:09 +02:00 · 2026-08-25 00:19:07 +02:00 · 2026-08-24 23:48:49 +02:00 · 2026-08-24 23:40:41 +02:00 · 2026-08-24 23:32:09 +02:00
2905 changed files with 164155 additions and 566134 deletions
@@ -61,6 +61,9 @@
 	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && cargo run -p fluxer-dev -- post-start && bash /workspaces/fluxer/fluxer_docs/serve.sh --daemon",
 	"customizations": {
 		"vscode": {
+			"settings": {
+				"editor.defaultFormatter": "biomejs.biome"
+			},
 			"extensions": [
 				"biomejs.biome",
 				"rust-lang.rust-analyzer",
@@ -68,7 +71,8 @@
 				"TypeScriptTeam.native-preview",
 				"unifiedjs.vscode-mdx",
 				"pgourlain.erlang",
-				"clinyong.vscode-css-modules"
+				"clinyong.vscode-css-modules",
+				"EditorConfig.EditorConfig"
 			]
 		}
 	}
@@ -38,11 +38,6 @@ services:
        target: /workspaces/fluxer/fluxer_desktop/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-marketing-node-modules
-        target: /workspaces/fluxer/fluxer_marketing/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-admin-node-modules
        target: /workspaces/fluxer/fluxer_admin/node_modules
@@ -358,7 +353,6 @@ volumes:
  fluxer-api-node-modules:
  fluxer-app-node-modules:
  fluxer-desktop-node-modules:
-  fluxer-marketing-node-modules:
  fluxer-admin-node-modules:
  package-config-node-modules:
  package-constants-node-modules:
@@ -71,7 +71,7 @@ stage "rust: fmt" cargo fmt --all -- --check
 if [ "$QUICK" -eq 0 ]; then
 	stage "rust: clippy (workspace)" cargo clippy --workspace --all-targets -- -D warnings
 else
-	stage "rust: clippy (servers)" cargo clippy -p fluxer_app_proxy -p fluxer_admin -p fluxer_marketing --all-targets -- -D warnings
+	stage "rust: clippy (servers)" cargo clippy -p fluxer_app_proxy -p fluxer_admin --all-targets -- -D warnings
 fi
 stage "rust: app proxy tests" cargo test -p fluxer_app_proxy

@@ -5,8 +5,11 @@
 /.direnv/
 /.fluxer/
 /.git/
+**/.git
+**/.git/**
 /.github/
 /.pnpm-store/
+/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -46,13 +49,9 @@

 /app-dist-output/
 /artifacts/
-/release-input/
-/release-out/
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 /fluxer_desktop/

@@ -0,0 +1,7 @@
+/.github/CODEOWNERS @fluxerapp/developers
+/.github/workflows/ @fluxerapp/developers
+/fluxer_marketing @fluxerapp/developers
+/.gitmodules @fluxerapp/developers
+/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
+/packages/i18n/marketing/ @fluxerapp/developers
+/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -25,7 +25,7 @@ Closes #456

 You must understand every line you submit and be able to explain why the change is correct.

-The [LLM usage policy](LLM_USAGE_POLICY.md) defines the authorship requirements for contributors who do not have write access.
+The [LLM usage policy](https://github.com/fluxerapp/fluxer/blob/main/.github/LLM_USAGE_POLICY.md) defines the authorship requirements for contributors who do not have write access.

 Each contribution must contain one coherent change. Do not include unrelated fixes, refactoring or formatting changes.

@@ -80,12 +80,30 @@ Complete every section of the pull request template. Clearly describe:

 Use the [bug report form](https://github.com/fluxerapp/fluxer/issues/new?template=bug-report.yaml) to report reproducible defects.

-Report security vulnerabilities privately through the channels specified in the [security policy](SECURITY.md). Do not report vulnerabilities in public issues or discussions.
+Report security vulnerabilities privately through the channels specified in the [security policy](https://github.com/fluxerapp/fluxer/blob/main/.github/SECURITY.md). Do not report vulnerabilities in public issues or discussions.

 Use [discussions](https://github.com/orgs/fluxerapp/discussions) for feature proposals and self-hosting questions.

 Submit translations through [Weblate](https://weblate.fluxer.tools), not through pull requests.

-All repository activity is governed by the [Code of Conduct](CODE_OF_CONDUCT.md).
+All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

-Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](../LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
+Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
+
+## Private marketing project
+
+The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
+
+Authorized maintainers can initialize only that submodule and install its independent dependencies:
+
+```sh
+./scripts/setup-private-marketing.sh
+pnpm --dir fluxer_marketing install --frozen-lockfile
+cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
+```
+
+To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
+
+```sh
+FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
+```
@@ -8,11 +8,11 @@ External contributions do not grant voting rights, commit access, employment or

 ## Licence and contributor rights

-Source code owned by Fluxer Platform AB in this repository is distributed under the [GNU Affero General Public License, version 3.0 or later](../LICENSE). The licence permits its use, modification and redistribution subject to its terms.
+Source code owned by Fluxer Platform AB in this repository is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). The licence permits its use, modification and redistribution subject to its terms.

 Fluxer Platform AB does not require contributors to sign a contributor licence agreement or assign their copyright. Contributors retain the copyright in their work.

-Every commit made by a contributor must include the [Developer Certificate of Origin](https://developercertificate.org) sign-off required by the [contributing guidelines](CONTRIBUTING.md). Pull requests opened by Fluxer repository automation are exempt from this requirement.
+Every commit made by a contributor must include the [Developer Certificate of Origin](https://developercertificate.org) sign-off required by the [contributing guidelines](https://github.com/fluxerapp/fluxer/blob/main/.github/CONTRIBUTING.md). Pull requests opened by Fluxer repository automation are exempt from this requirement.

 ## Name and marks

@@ -129,7 +129,7 @@ Deliberately submitting a fabricated security report MAY result in an immediate

 Maintainers are not required to investigate possible LLM use proactively. Writing style alone is not evidence of a violation.

-A person MUST NOT publicly accuse or harass a contributor because of suspected LLM use. All discussion, review and enforcement under this policy MUST comply with the [Code of Conduct](CODE_OF_CONDUCT.md).
+A person MUST NOT publicly accuse or harass a contributor because of suspected LLM use. All discussion, review and enforcement under this policy MUST comply with the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 ## 11. Normative References

@@ -1,10 +1,5 @@
 self-hosted-runner:
  labels:
-    - blacksmith-4vcpu-ubuntu-2404
-    - blacksmith-4vcpu-ubuntu-2404-arm
-    - blacksmith-32vcpu-ubuntu-2404
-    - blacksmith-32vcpu-ubuntu-2404-arm
-    - blacksmith-32vcpu-windows-2025
    - fluxer-desktop-macos-arm64

 config-variables: null
@@ -24,7 +24,9 @@ f:gateway:
    - any-glob-to-any-file: fluxer_gateway/**/*
 f:marketing:
  - changed-files:
-    - any-glob-to-any-file: fluxer_marketing/**/*
+    - any-glob-to-any-file:
+      - fluxer_marketing
+      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
@@ -32,17 +32,15 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this image fragment is uploaded. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-
 permissions:
  actions: read
  contents: write
  packages: write

+concurrency:
+  group: publish-${{ inputs.image }}
+  cancel-in-progress: false
+
 defaults:
  run:
    shell: bash
@@ -55,6 +53,8 @@ jobs:
    name: resolve metadata
    runs-on: ubuntu-24.04
    timeout-minutes: 5
+    permissions:
+      contents: read
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
@@ -65,13 +65,22 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
      - name: set variables
        id: vars
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
+          tools/ci/run.sh resolve-calver
          --github-output

  build:
@@ -79,14 +88,18 @@ jobs:
    needs: meta
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: amd64
-            runner: blacksmith-4vcpu-ubuntu-2404
+            runner: ubuntu-24.04
          - platform: arm64
-            runner: blacksmith-4vcpu-ubuntu-2404-arm
+            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -96,7 +109,7 @@ jobs:
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}
      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
        with:
          context: ${{ inputs.context }}
@@ -108,8 +121,8 @@ jobs:
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
            ${{ inputs.extra-build-args }}
-          cache-from: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }}
-          cache-to: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }},mode=max,ignore-error=true
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -119,6 +132,9 @@ jobs:
    needs: [meta, build]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
+    permissions:
+      contents: write
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -132,71 +148,54 @@ jobs:
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}
      - name: create and push multi-arch manifest
+        env:
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component "${{ inputs.image }}"
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"
+
+      - name: Advance moving image tags
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
          VERSION: ${{ needs.meta.outputs.build_version }}
          MOVING_TAGS: ${{ inputs.moving-tags }}
        run: |
          set -euo pipefail
-          tag_args=( "-t" "${IMAGE}:${VERSION}" )
+          tag_args=()
          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
          for raw in "${moving[@]}"; do
-            t="$(echo "$raw" | xargs)"
-            [ -n "$t" ] && tag_args+=( "-t" "${IMAGE}:${t}" )
+            tag="$(echo "$raw" | xargs)"
+            [ -n "$tag" ] && tag_args+=( "-t" "${IMAGE}:${tag}" )
          done
-          docker buildx imagetools create "${tag_args[@]}" \
-            "${IMAGE}:${VERSION}-amd64" \
-            "${IMAGE}:${VERSION}-arm64"
-          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
-
-      - name: Write GitHub release image fragment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_REF: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
-          MOVING_TAGS: ${{ inputs.moving-tags }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-image
-          --build-version "${VERSION}"
-          --image "${{ inputs.image }}"
-          --image-ref "${IMAGE_REF}"
-          --moving-tags "${MOVING_TAGS}"
-      - name: Upload GitHub release fragment
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: release-fragment-${{ inputs.image }}
-          path: release-out/fragments/fluxer-release-fragment-image-${{ inputs.image }}.json
-          if-no-files-found: error
-          retention-days: 14
-
-  finalise:
-    name: finalise GitHub release
-    if: ${{ inputs['finalise-release'] }}
-    needs: [meta, merge]
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-      - name: finalise GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${VERSION}"
+          if (( ${#tag_args[@]} > 0 )); then
+            docker buildx imagetools create "${tag_args[@]}" "${IMAGE}:${VERSION}"
+          fi
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-admin
      dockerfile: fluxer_admin/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-api
      dockerfile: fluxer_api/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,12 +28,11 @@ jobs:

  build:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-app-proxy-self-hosted
      dockerfile: fluxer_app_proxy/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
      extra-build-args: |
        FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
@@ -9,41 +9,23 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy
+  cancel-in-progress: false
+
 env:
  GHCR_OWNER: ${{ github.repository_owner }}

 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -54,9 +36,10 @@ jobs:
  meta:
    name: resolve metadata
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    runs-on: ubuntu-24.04
    timeout-minutes: 5
+    permissions:
+      contents: read
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
@@ -70,15 +53,19 @@ jobs:
      - name: set variables
        id: vars
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step set_metadata
          --build-version "${{ inputs['build-version'] }}"

  build:
    name: build app-proxy (amd64)
    needs: meta
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -89,7 +76,7 @@ jobs:
          toolchain: "1.93.0"
      - name: prepare docker config
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
      - name: configure ghcr auth
@@ -97,48 +84,45 @@ jobs:
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step configure_ghcr_auth

      - name: build and push image + extract assets
        env:
          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
-          CACHE_FROM: type=gha,scope=fluxer-app-proxy
-          CACHE_TO: type=gha,scope=fluxer-app-proxy,mode=max
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step build_and_extract

      - name: generate asset manifest
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step generate_asset_manifest

-      - name: Upload asset manifest handoff
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: app-proxy-assets-manifest
-          path: app-dist-output/dist/assets-manifest.txt
-          if-no-files-found: error
-
      - name: upload assets to S3 static bucket
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_ENDPOINT: https://ewr1.vultrobjects.com
-          STATIC_BUCKET: fluxer-static
+          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
+          S3_ENDPOINT: ${{ vars.STATIC_S3_ENDPOINT }}
+          STATIC_BUCKET: ${{ vars.STATIC_S3_BUCKET }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step upload_assets

  build-arm64:
    name: build app-proxy (arm64)
    needs: meta
-    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
+    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -161,8 +145,8 @@ jobs:
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
            BUNDLE_LOCAL_ASSETS=false
-          cache-from: type=gha,scope=fluxer-app-proxy-arm64
-          cache-to: type=gha,scope=fluxer-app-proxy-arm64,mode=max,ignore-error=true
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -172,6 +156,9 @@ jobs:
    needs: [meta, build, build-arm64]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
+    permissions:
+      contents: write
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -180,11 +167,6 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
-      - name: Download app-proxy asset manifest
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          name: app-proxy-assets-manifest
-          path: release-input/app-proxy
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
        with:
@@ -201,58 +183,39 @@ jobs:
          echo "amd64 digest: ${amd64_digest}"
          docker buildx imagetools create \
            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:v1" \
-            -t "${IMAGE}:latest" \
            "${IMAGE}@${amd64_digest}" \
            "${IMAGE}:${VERSION}-arm64"
          docker buildx imagetools inspect "${IMAGE}:${VERSION}"

-      - name: Write GitHub release app-proxy fragment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-app-proxy
-          --build-version "${VERSION}"
-          --image fluxer-app-proxy
-          --image-ref "${IMAGE_REF}"
-          --moving-tags "v1,latest"
-          --asset-manifest release-input/app-proxy/assets-manifest.txt
-      - name: Upload GitHub release fragment
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
-          name: release-fragment-fluxer-app-proxy
-          path: release-out/fragments/fluxer-release-fragment-app-proxy.json
-          if-no-files-found: error
-          retention-days: 14
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"

-  finalise:
-    name: finalise GitHub release
-    if: ${{ inputs['finalise-release'] != false }}
-    needs: [meta, merge]
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - name: Advance moving image tags
        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-      - name: finalise GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${VERSION}"
+          docker buildx imagetools create
+          -t "${IMAGE}:v1"
+          -t "${IMAGE}:latest"
+          "${IMAGE}:${VERSION}"
@@ -22,7 +22,7 @@ on:
        default: ""
        type: string
      skip_targets:
-        description: Comma-separated platforms or targets to skip, such as windows, macos-arm64, linux-x64.
+        description: Comma-separated platforms or targets to skip, such as windows, macos, linux-x64.
        required: false
        default: ""
        type: string
@@ -46,6 +46,8 @@ jobs:
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
    timeout-minutes: 25
+    permissions:
+      contents: read
    outputs:
      version: ${{ steps.meta.outputs.version }}
      pub_date: ${{ steps.meta.outputs.pub_date }}
@@ -65,10 +67,19 @@ jobs:
        with:
          toolchain: "1.93.0"

+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
      - name: Set metadata
        id: meta
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
          FLUXER_BUILD_VERSION: ${{ inputs.build_version }}
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
@@ -81,6 +92,8 @@ jobs:
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
    timeout-minutes: 25
+    permissions:
+      contents: read
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
@@ -106,7 +119,11 @@ jobs:
      - matrix
    runs-on: ${{ matrix.os }}
    environment: desktop-releases
-    timeout-minutes: 60
+    timeout-minutes: 180
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
@@ -122,10 +139,10 @@ jobs:
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_BUCKET: fluxer-downloads
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
+      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
@@ -233,7 +250,7 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
-          targets: ${{ matrix.platform == 'macos' && (matrix.arch == 'arm64' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin') || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}
+          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
        if: matrix.platform == 'windows' && matrix.arch == 'arm64'
@@ -460,8 +477,8 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

-      - name: Normalize updater YAML (arm64)
-        if: matrix.arch == 'arm64'
+      - name: Normalize updater YAML (macOS)
+        if: matrix.platform == 'macos'
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step normalise_updater_yaml
@@ -491,7 +508,9 @@ jobs:
      - build
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 60
+    timeout-minutes: 180
+    permissions:
+      contents: read
    env:
      CHANNEL: ${{ needs.meta.outputs.build_channel }}
      DISPLAY_CHANNEL: ${{ needs.meta.outputs.channel }}
@@ -505,11 +524,11 @@ jobs:
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_BUCKET: fluxer-downloads
+      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
+      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -544,34 +563,14 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Write GitHub release desktop fragment
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-desktop
-          --build-version "${{ needs.meta.outputs.version }}"
-          --channel "${{ needs.meta.outputs.build_channel }}"
-          --test-build "${{ needs.meta.outputs.test_build }}"
-          --s3-prefix "${{ needs.meta.outputs.s3_prefix }}"
-          --payload-root s3_payload
-          --source-sha "${{ needs.meta.outputs.source_sha }}"
-      - name: Upload GitHub release fragment
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: release-fragment-desktop
-          path: release-out/fragments/fluxer-release-fragment-desktop-${{ needs.meta.outputs.build_channel }}.json
-          if-no-files-found: error
-          retention-days: 14
-
      - name: Cleanup S3 handoff
        if: ${{ success() }}
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step cleanup_handoff

-  finalise_release:
-    name: Finalise GitHub desktop release
+  publish_release:
+    name: Publish GitHub desktop release
    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
    needs:
      - meta
@@ -579,6 +578,8 @@ jobs:
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
    timeout-minutes: 10
+    permissions:
+      contents: write
    steps:
      - name: Checkout source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -589,18 +590,32 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-
-      - name: Finalise GitHub desktop release
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub desktop release
        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${{ needs.meta.outputs.version }}"
-          --source-sha "${{ needs.meta.outputs.source_sha }}"
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          CHANNEL: ${{ needs.meta.outputs.build_channel }}
+          VERSION: ${{ needs.meta.outputs.version }}
+          SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: |
+          set -euo pipefail
+          release_args=(
+            release publish
+            --component "fluxer-desktop-${CHANNEL}"
+            --build-version "${VERSION}"
+            --source-sha "${SOURCE_SHA}"
+            --previous-sha "${RELEASE_BASELINE_SHA}"
+          )
+          if [[ "${CHANNEL}" == "canary" ]]; then
+            release_args+=(--prerelease)
+          fi
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- "${release_args[@]}"
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,12 +28,10 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-docs
      dockerfile: fluxer_docs/Dockerfile
      context: fluxer_docs
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-gateway
      dockerfile: fluxer_gateway/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-gifs
      dockerfile: fluxer_gifs/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -1,60 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: build marketing
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true
-
-permissions:
-  actions: read
-  contents: write
-  packages: write
-
-jobs:
-  approve:
-    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 5
-    steps:
-      - name: approved
-        run: echo "Build release approved."
-
-  image:
-    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
-    uses: ./.github/workflows/_build-image.yaml
-    with:
-      image: fluxer-marketing
-      dockerfile: fluxer_marketing/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-media-proxy
      dockerfile: fluxer_media_proxy/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-messages
      dockerfile: fluxer_messages/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-snowflakes
      dockerfile: fluxer_snowflakes/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-static
      dockerfile: fluxer_static/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-unfurl
      dockerfile: fluxer_unfurl/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-users
      dockerfile: fluxer_users/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -39,7 +39,7 @@ jobs:

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Generate OpenAPI schemas
@@ -1,473 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: deploy service
-
-on:
-  workflow_dispatch:
-    inputs:
-      service:
-        description: "Helm chart name to deploy"
-        type: choice
-        required: true
-        options:
-          - api
-          - app-proxy
-          - admin
-          - docs
-          - marketing
-          - media-proxy
-          - gateway
-          - messages
-          - search
-          - snowflakes
-          - users
-          - unfurl
-          - uploads
-          - worker
-      channel:
-        description: "Release channel (stable or canary)"
-        type: choice
-        required: true
-        options:
-          - stable
-          - canary
-      image-tag:
-        description: "Docker image tag to deploy (Fluxer CalVer: YYYY.MDD.MICRO)"
-        type: string
-        required: true
-      build-version:
-        description: "Fluxer CalVer build version to inject into runtime env vars"
-        type: string
-        required: false
-        default: ""
-      allow-rollback:
-        description: "Allow deploying an older image tag than the newest GHCR tag"
-        type: boolean
-        required: false
-        default: false
-  workflow_call:
-    inputs:
-      service:
-        description: "Helm chart name to deploy"
-        type: string
-        required: true
-      channel:
-        description: "Release channel (stable or canary)"
-        type: string
-        required: true
-      image-tag:
-        description: "Docker image tag to deploy (Fluxer CalVer: YYYY.MDD.MICRO)"
-        type: string
-        required: true
-      build-version:
-        description: "Fluxer CalVer build version to inject into runtime env vars"
-        type: string
-        required: false
-        default: ""
-      allow-rollback:
-        description: "Allow deploying an older image tag than the newest GHCR tag"
-        type: boolean
-        required: false
-        default: false
-    secrets:
-      KUBE_CONFIG:
-        required: true
-      GHCR_USERNAME:
-        required: false
-      GHCR_TOKEN:
-        required: false
-
-env:
-  GHCR_OWNER: ${{ github.repository_owner }}
-  GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
-
-jobs:
-  deploy:
-    name: deploy ${{ inputs.service }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    environment: ${{ inputs.channel }}
-    permissions:
-      contents: read
-      packages: read
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: install helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-
-      - name: configure kubectl
-        shell: bash
-        env:
-          KUBE_CONFIG_B64: ${{ secrets.KUBE_CONFIG }}
-        run: |
-          mkdir -p "$HOME/.kube"
-          printf '%s' "$KUBE_CONFIG_B64" | base64 -d > "$HOME/.kube/config"
-          chmod 600 "$HOME/.kube/config"
-
-      - name: resolve helm args
-        id: helm
-        shell: bash
-        env:
-          INPUT_SERVICE: ${{ inputs.service }}
-          INPUT_CHANNEL: ${{ inputs.channel }}
-          INPUT_IMAGE_TAG: ${{ inputs['image-tag'] }}
-          INPUT_BUILD_VERSION: ${{ inputs['build-version'] }}
-        run: |
-          SERVICE="$INPUT_SERVICE"
-          CHANNEL="$INPUT_CHANNEL"
-          TAG="$INPUT_IMAGE_TAG"
-          BUILD_VERSION="$INPUT_BUILD_VERSION"
-          GHCR_REGISTRY="${GHCR_REGISTRY:?GHCR_REGISTRY is required}"
-          if [[ -z "$BUILD_VERSION" ]]; then
-            BUILD_VERSION="$TAG"
-          fi
-          CALVER_RE='^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.(0|[1-9][0-9]{0,5})$'
-          if [[ ! "$TAG" =~ $CALVER_RE ]]; then
-            echo "::error::image-tag must be a Fluxer CalVer tag (YYYY.MDD.MICRO). Channel tags, latest tags, and suffixed tags are not deployable."
-            exit 1
-          fi
-          if [[ ! "$BUILD_VERSION" =~ $CALVER_RE ]]; then
-            echo "::error::build-version must be a Fluxer CalVer value (YYYY.MDD.MICRO)."
-            exit 1
-          fi
-          CHART_DIR="./deploy/helm/${SERVICE}"
-          VALUES_ARGS="-f ${CHART_DIR}/values.yaml"
-          SETS=""
-          BUILD_PATHS=""
-          DEPLOY_IMAGE=""
-          SYNC_WORKER_RELEASE=""
-          SYNC_WORKER_CHART_DIR=""
-          SYNC_WORKER_VALUES_ARGS=""
-          SYNC_WORKER_SETS=""
-          case "$SERVICE" in
-            uploads)
-
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::uploads deployments are stable-only (single relay serves both channels)."
-                exit 1
-              fi
-              RELEASE="fluxer-uploads"
-              DEPLOY_IMAGE="fluxer-media-proxy"
-              SETS="--set-string app.name=uploads --set-string app.image=fluxer-media-proxy --set-string app.tag=${TAG} --set-string app.config=stable"
-              SETS="${SETS} --set-string app.build.version=${BUILD_VERSION}"
-              SETS="${SETS} --set-string app.build.channel=stable"
-              ;;
-            api|app-proxy|admin|docs|marketing)
-              BASE_IMAGE="fluxer-${SERVICE}"
-              if [[ "$SERVICE" == "docs" && "$CHANNEL" != "stable" ]]; then
-                echo "::error::docs deployments are stable-only."
-                exit 1
-              fi
-              if [[ "$CHANNEL" == "canary" ]]; then
-                NAME="${SERVICE}-canary"
-              else
-                NAME="${SERVICE}"
-              fi
-              DEPLOY_IMAGE="${BASE_IMAGE}"
-              RELEASE="fluxer-${SERVICE}-${CHANNEL}"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.${CHANNEL}.prod.yaml"
-              SETS="--set-string app.name=${NAME} --set-string app.image=${DEPLOY_IMAGE} --set-string app.tag=${TAG}"
-              SETS="${SETS} --set-string app.build.version=${BUILD_VERSION}"
-              SETS="${SETS} --set-string app.build.channel=${CHANNEL}"
-              ;;
-            media-proxy)
-              if [[ "$CHANNEL" != "canary" ]]; then
-                echo "::error::Media-proxy deployments are only supported on the canary lane."
-                exit 1
-              fi
-              RELEASE="fluxer-${SERVICE}"
-              DEPLOY_IMAGE="fluxer-media-proxy"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string mediaProxy.image=fluxer-media-proxy --set-string staticProxy.image=fluxer-media-proxy --set-string mediaProxy.tag=${TAG} --set-string staticProxy.tag=${TAG} --set mediaProxy.replicas=16 --set staticProxy.replicas=4 --set-string mediaProxy.nsfwServiceEndpoint=http://int.flx-nyc-misc1.srv.fluxer.dev:8000"
-              BUILD_PATHS="mediaProxy staticProxy"
-              ;;
-            gateway)
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::gateway deployments are stable-only."
-                exit 1
-              fi
-              RELEASE="fluxer-${SERVICE}"
-              DEPLOY_IMAGE="fluxer-gateway"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string gateway.image=${DEPLOY_IMAGE} --set-string gateway.tag=${TAG}"
-              BUILD_PATHS="gateway"
-              ;;
-            worker)
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::Worker deployments are only supported on the stable lane."
-                exit 1
-              fi
-              RELEASE="fluxer-${SERVICE}"
-              DEPLOY_IMAGE="fluxer-api"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string workerRealtime.image=fluxer-api --set-string workerUnfurl.image=fluxer-api --set-string workerLifecycle.image=fluxer-api --set-string workerBatch.image=fluxer-api --set-string workerRealtime.tag=${TAG} --set-string workerUnfurl.tag=${TAG} --set-string workerLifecycle.tag=${TAG} --set-string workerBatch.tag=${TAG}"
-              BUILD_PATHS="workerRealtime workerUnfurl workerLifecycle workerBatch"
-              ;;
-            messages|search|snowflakes|users|unfurl)
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::Shared microservice deployments are stable-only; canary traffic selection is done by the callers."
-                exit 1
-              fi
-              DEPLOY_IMAGE="fluxer-${SERVICE}"
-              RELEASE="fluxer-${SERVICE}"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string svc.image=${DEPLOY_IMAGE} --set-string svc.tag=${TAG}"
-              SETS="${SETS} --set-string svc.build.version=${BUILD_VERSION}"
-              SETS="${SETS} --set-string svc.build.channel=stable"
-              ;;
-            *)
-              echo "::error::Unknown service chart: ${SERVICE}"
-              exit 1
-              ;;
-          esac
-          for BUILD_PATH in $BUILD_PATHS; do
-            SETS="${SETS} --set-string ${BUILD_PATH}.build.version=${BUILD_VERSION}"
-            SETS="${SETS} --set-string ${BUILD_PATH}.build.channel=${CHANNEL}"
-          done
-          SETS="--set-string global.registry=${GHCR_REGISTRY} ${SETS}"
-          if [[ "$SERVICE" == "api" && "$CHANNEL" == "canary" ]]; then
-            SYNC_WORKER_RELEASE="fluxer-worker"
-            SYNC_WORKER_CHART_DIR="./deploy/helm/worker"
-            SYNC_WORKER_VALUES_ARGS="-f ${SYNC_WORKER_CHART_DIR}/values.yaml -f ${SYNC_WORKER_CHART_DIR}/values.prod.yaml"
-            SYNC_WORKER_SETS="--set-string workerRealtime.image=fluxer-api --set-string workerUnfurl.image=fluxer-api --set-string workerLifecycle.image=fluxer-api --set-string workerBatch.image=fluxer-api"
-            SYNC_WORKER_SETS="${SYNC_WORKER_SETS} --set-string workerRealtime.tag=${TAG} --set-string workerUnfurl.tag=${TAG} --set-string workerLifecycle.tag=${TAG} --set-string workerBatch.tag=${TAG}"
-            for BUILD_PATH in workerRealtime workerUnfurl workerLifecycle workerBatch; do
-              SYNC_WORKER_SETS="${SYNC_WORKER_SETS} --set-string ${BUILD_PATH}.build.version=${BUILD_VERSION}"
-              SYNC_WORKER_SETS="${SYNC_WORKER_SETS} --set-string ${BUILD_PATH}.build.channel=${CHANNEL}"
-            done
-            SYNC_WORKER_SETS="--set-string global.registry=${GHCR_REGISTRY} ${SYNC_WORKER_SETS}"
-          fi
-          {
-            echo "chart-dir=${CHART_DIR}"
-            echo "release=${RELEASE}"
-            echo "values-args=${VALUES_ARGS}"
-            echo "sets=${SETS}"
-            echo "deploy-image=${DEPLOY_IMAGE}"
-            echo "deploy-tag=${TAG}"
-            echo "sync-worker-release=${SYNC_WORKER_RELEASE}"
-            echo "sync-worker-chart-dir=${SYNC_WORKER_CHART_DIR}"
-            echo "sync-worker-values-args=${SYNC_WORKER_VALUES_ARGS}"
-            echo "sync-worker-sets=${SYNC_WORKER_SETS}"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: helm dependency update
-        shell: bash
-        run: |
-          helm dependency update "${{ steps.helm.outputs.chart-dir }}"
-          if [[ -n "${{ steps.helm.outputs.sync-worker-chart-dir }}" ]]; then
-            helm dependency update "${{ steps.helm.outputs.sync-worker-chart-dir }}"
-          fi
-
-      - name: prepare docker config
-        if: steps.helm.outputs.deploy-image != ''
-        shell: bash
-        run: |
-          echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config" >> "$GITHUB_ENV"
-          mkdir -p "${RUNNER_TEMP}/docker-config"
-
-      - name: configure ghcr auth
-        if: steps.helm.outputs.deploy-image != ''
-        shell: bash
-        env:
-          GHCR_USERNAME: ${{ github.actor }}
-          GHCR_TOKEN: ${{ github.token }}
-        run: |
-          auth="$(printf '%s:%s' "$GHCR_USERNAME" "$GHCR_TOKEN" | base64 | tr -d '\n')"
-          printf '{"auths":{"ghcr.io":{"auth":"%s"}}}\n' "$auth" > "$DOCKER_CONFIG/config.json"
-
-      - name: verify deploy image exists
-        if: steps.helm.outputs.deploy-image != ''
-        shell: bash
-        run: |
-          IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
-          echo "Verifying ${IMAGE_REF}"
-          docker manifest inspect "${IMAGE_REF}" > /dev/null
-        env:
-          DOCKER_CLI_EXPERIMENTAL: enabled
-
-      - name: verify api deploy uses latest image
-        if: ${{ steps.helm.outputs.deploy-image == 'fluxer-api' && !inputs['allow-rollback'] }}
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GHCR_OWNER: ${{ env.GHCR_OWNER }}
-          DEPLOY_TAG: ${{ steps.helm.outputs.deploy-tag }}
-        run: |
-          set -euo pipefail
-
-          CALVER_RE='^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.(0|[1-9][0-9]{0,5})$'
-          OWNER_TYPE="$(
-            curl -fsS \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${GITHUB_API_URL:-https://api.github.com}/repos/${GITHUB_REPOSITORY}" \
-              | jq -r '.owner.type'
-          )"
-          case "$OWNER_TYPE" in
-            Organization) PACKAGE_OWNER_PATH="orgs/${GHCR_OWNER}" ;;
-            User) PACKAGE_OWNER_PATH="users/${GHCR_OWNER}" ;;
-            *)
-              echo "::error::Unsupported GitHub owner type for package lookup: ${OWNER_TYPE}"
-              exit 1
-              ;;
-          esac
-          LATEST_TAG="$(
-            curl -fsS \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${GITHUB_API_URL:-https://api.github.com}/${PACKAGE_OWNER_PATH}/packages/container/fluxer-api/versions?per_page=100" \
-              | jq -r --arg re "$CALVER_RE" '
-                  [.[].metadata.container.tags[]? |
-                    select(test($re)) |
-                    {tag: ., parts: (split(".") | map(tonumber))}
-                  ] | max_by(.parts) | .tag // empty
-                '
-          )"
-
-          if [[ -z "$LATEST_TAG" ]]; then
-            echo "::error::Could not resolve the latest fluxer-api CalVer tag from GHCR."
-            exit 1
-          fi
-
-          if [[ "$DEPLOY_TAG" != "$LATEST_TAG" ]]; then
-            echo "::error::Refusing to deploy fluxer-api:${DEPLOY_TAG}; latest GHCR tag is fluxer-api:${LATEST_TAG}. Re-run with allow-rollback=true only for an intentional rollback."
-            exit 1
-          fi
-
-      - name: approve api image for admission policy
-        if: ${{ inputs.service == 'api' }}
-        shell: bash
-        env:
-          INPUT_CHANNEL: ${{ inputs.channel }}
-        run: |
-          DEPLOYMENT="api"
-          if [[ "$INPUT_CHANNEL" == "canary" ]]; then
-            DEPLOYMENT="api-canary"
-          fi
-          IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
-          PREVIOUS_IMAGE="$(kubectl -n fluxer get deployment "$DEPLOYMENT" -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null || true)"
-          PREVIOUS_TAG=""
-          if [[ -n "$PREVIOUS_IMAGE" && "$PREVIOUS_IMAGE" != "$IMAGE_REF" && "$PREVIOUS_IMAGE" == *:* ]]; then
-            PREVIOUS_TAG="${PREVIOUS_IMAGE##*:}"
-          else
-            PREVIOUS_IMAGE=""
-          fi
-          kubectl -n fluxer create configmap fluxer-api-approved-image \
-            --from-literal=tag="${{ steps.helm.outputs.deploy-tag }}" \
-            --from-literal=image="${IMAGE_REF}" \
-            --from-literal=previousTag="${PREVIOUS_TAG}" \
-            --from-literal=previousImage="${PREVIOUS_IMAGE}" \
-            --dry-run=client -o yaml \
-            | kubectl apply -f -
-
-      - name: ensure api admission policy
-        if: ${{ inputs.service == 'api' }}
-        shell: bash
-        run: kubectl apply -f deploy/k8s/fluxer-api-approved-image-policy.yaml
-
-      - name: helm upgrade
-        shell: bash
-        run: |
-          RELEASE="${{ steps.helm.outputs.release }}"
-          CHART_DIR="${{ steps.helm.outputs.chart-dir }}"
-          VALUES_ARGS="${{ steps.helm.outputs.values-args }}"
-          SETS="${{ steps.helm.outputs.sets }}"
-          wait_for_release_idle() {
-            local release="$1"
-            local max_checks="$2"
-            local check=0
-            local status="unknown"
-            while (( check < max_checks )); do
-              check=$((check + 1))
-              status=$(helm status "$release" -n fluxer -o json 2>/dev/null | jq -r '.info.status // "unknown"' || echo "unknown")
-              if [[ "$status" != pending-* ]]; then
-                echo "Release ${release} is ${status}; continuing."
-                return 0
-              fi
-              echo "Release ${release} is ${status}; waiting 10s (${check}/${max_checks})."
-              sleep 10
-            done
-            echo "::warning::Release ${release} still ${status} after ${max_checks} checks; forcing rollback."
-            if helm rollback "$release" -n fluxer --wait --timeout 5m 2>&1; then
-              echo "Rollback succeeded; continuing."
-              return 0
-            fi
-            echo "::error::Release ${release} is stuck in ${status} and rollback failed."
-            return 1
-          }
-          helm_upgrade_with_retries() {
-            local release="$1"
-            local chart_dir="$2"
-            local values_args="$3"
-            local sets="$4"
-            local values_args_array=()
-            local sets_array=()
-            read -r -a values_args_array <<< "$values_args"
-            read -r -a sets_array <<< "$sets"
-            wait_for_release_idle "$release" 18
-            local max_attempts=4
-            for attempt in $(seq 1 "$max_attempts"); do
-              echo "Running helm upgrade for ${release}, attempt ${attempt}/${max_attempts}."
-              set +e
-              upgrade_output=$(helm upgrade --install "$release" \
-                "$chart_dir" \
-                "${values_args_array[@]}" \
-                -n fluxer \
-                "${sets_array[@]}" \
-                --wait --timeout 20m --atomic --history-max 10 2>&1)
-              exit_code=$?
-              set -e
-              printf '%s\n' "$upgrade_output"
-              if [[ $exit_code -eq 0 ]]; then
-                return 0
-              fi
-              if ! grep -q "another operation (install/upgrade/rollback) is in progress" <<< "$upgrade_output"; then
-                return "$exit_code"
-              fi
-              if [[ $attempt -eq $max_attempts ]]; then
-                echo "::error::Helm upgrade failed for ${release} after ${max_attempts} attempts because another operation remained in progress."
-                return "$exit_code"
-              fi
-              wait_for_release_idle "$release" 18
-            done
-          }
-          helm_upgrade_with_retries "$RELEASE" "$CHART_DIR" "$VALUES_ARGS" "$SETS"
-          if [[ -n "${{ steps.helm.outputs.sync-worker-release }}" ]]; then
-            helm_upgrade_with_retries \
-              "${{ steps.helm.outputs.sync-worker-release }}" \
-              "${{ steps.helm.outputs.sync-worker-chart-dir }}" \
-              "${{ steps.helm.outputs.sync-worker-values-args }}" \
-              "${{ steps.helm.outputs.sync-worker-sets }}"
-          fi
-
-      - name: seal api admission approved image
-        if: ${{ success() && inputs.service == 'api' }}
-        shell: bash
-        run: |
-          IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
-          kubectl -n fluxer create configmap fluxer-api-approved-image \
-            --from-literal=tag="${{ steps.helm.outputs.deploy-tag }}" \
-            --from-literal=image="${IMAGE_REF}" \
-            --from-literal=previousTag="" \
-            --from-literal=previousImage="" \
-            --dry-run=client -o yaml \
-            | kubectl apply -f -
-
-      - name: recover stuck release on failure
-        if: failure() || cancelled()
-        shell: bash
-        run: |
-          RELEASE="${{ steps.helm.outputs.release }}"
-          for RELEASE in "$RELEASE" "${{ steps.helm.outputs.sync-worker-release }}"; do
-            if [[ -z "$RELEASE" ]]; then
-              continue
-            fi
-            STATUS=$(helm status "$RELEASE" -n fluxer -o json 2>/dev/null | jq -r '.info.status' 2>/dev/null || echo "unknown")
-            if [[ "$STATUS" == "pending-upgrade" || "$STATUS" == "pending-install" || "$STATUS" == "pending-rollback" ]]; then
-              echo "::warning::Release ${RELEASE} stuck in ${STATUS}, rolling back..."
-              helm rollback "$RELEASE" -n fluxer --wait --timeout 5m || true
-            fi
-          done
@@ -17,6 +17,7 @@ concurrency:
 jobs:
  dispatch:
    name: Dispatch regeneration
+    if: github.repository == 'fluxerapp/fluxer'
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -0,0 +1,230 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Dispatch private marketing build
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - fluxer_marketing
+      - Cargo.toml
+      - fluxer_common/**
+      - packages/fonts/manifest.json
+      - packages/fonts/NOTICE.md
+      - packages/fonts/LICENSE-IBM-PLEX.txt
+      - packages/fonts/css/locale-fallbacks.css
+      - packages/fonts/files/FluxerSans/**
+      - packages/fonts/files/FluxerMono/**
+      - packages/fonts/marketing/**
+      - packages/i18n/marketing/**
+      - fluxer_static/marketing/branding/**
+      - .github/workflows/dispatch-private-marketing-build.yaml
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: private-marketing-dispatch
+  cancel-in-progress: false
+
+jobs:
+  metadata:
+    name: resolve exact private build metadata
+    if: github.repository == 'fluxerapp/fluxer'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
+      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
+      build_version: ${{ steps.inputs.outputs.build_version }}
+      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
+    steps:
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
+      - name: Resolve trusted build inputs
+        id: inputs
+        env:
+          EVENT_AFTER: ${{ github.event.after }}
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          PARENT_SHA: ${{ github.sha }}
+          PUBLIC_REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_EVENT_NAME" == "push" ]]
+          [[ "$GITHUB_REF" == "refs/heads/main" ]]
+          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
+          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
+          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
+          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
+          (( 10#$RUN_ATTEMPT <= 10 ))
+
+          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
+          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
+          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
+          main_status="$(jq -r .status <<<"$main_comparison")"
+          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
+          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
+
+          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
+          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
+          tree_sha="$(jq -r .tree.sha <<<"$commit")"
+          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
+          entry="$(
+            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
+              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
+          )"
+          mode="$(jq -r .mode <<<"$entry")"
+          type="$(jq -r .type <<<"$entry")"
+          gitlink_sha="$(jq -r .sha <<<"$entry")"
+          path="$(jq -r .path <<<"$entry")"
+          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
+            exit 1
+          fi
+
+          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
+          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
+          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
+          [[ "$(jq -r .event <<<"$run")" == "push" ]]
+          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
+          run_created_at="$(jq -r .created_at <<<"$run")"
+          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
+          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
+          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
+          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
+          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
+          month="$((10#$month))"
+          micro="$((10#$time_segment))"
+          build_version="$year.$month$day.$micro"
+          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
+          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
+          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
+          {
+            echo "parent_sha=$PARENT_SHA"
+            echo "gitlink_sha=$gitlink_sha"
+            echo "build_version=$build_version"
+            echo "correlation_id=$correlation_id"
+          } >>"$GITHUB_OUTPUT"
+
+  dispatch:
+    name: dispatch exact private build
+    needs: metadata
+    runs-on: ubuntu-24.04
+    timeout-minutes: 65
+    environment: private-marketing-dispatch
+    permissions: {}
+    steps:
+      - name: Validate trusted build inputs
+        env:
+          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
+          EXPECTED_PARENT_SHA: ${{ github.sha }}
+          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
+          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
+          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
+          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
+          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_EVENT_NAME" == "push" ]]
+          [[ "$GITHUB_REF" == "refs/heads/main" ]]
+          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
+          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
+          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
+          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
+          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
+          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
+            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
+            exit 1
+          fi
+
+      - name: Create private dispatch token
+        id: private-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: marketing
+          permission-actions: write
+
+      - name: Dispatch exact private build
+        env:
+          GH_TOKEN: ${{ steps.private-token.outputs.token }}
+          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
+          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
+          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
+          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
+        run: |
+          set -euo pipefail
+          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
+            --field ref=main \
+            --field "inputs[parent_sha]=$PARENT_SHA" \
+            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
+            --field "inputs[build_version]=$BUILD_VERSION" \
+            --field "inputs[correlation_id]=$CORRELATION_ID"
+
+      - name: Wait for private build conclusion
+        env:
+          GH_TOKEN: ${{ steps.private-token.outputs.token }}
+          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
+          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
+          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
+          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
+        run: |
+          set -euo pipefail
+          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
+          deadline=$((SECONDS + 3600))
+          run_id=""
+          while (( SECONDS < deadline )); do
+            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
+            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
+            count="$(jq 'length' <<<"$matches")"
+            if [[ "$count" == "1" ]]; then
+              run_id="$(jq -r '.[0].id' <<<"$matches")"
+              break
+            fi
+            if [[ "$count" != "0" ]]; then
+              echo "::error::Private build correlation matched multiple workflow runs."
+              exit 1
+            fi
+            sleep 10
+          done
+          if [[ -z "$run_id" ]]; then
+            echo "::error::Timed out waiting for the private build dispatch to appear."
+            exit 1
+          fi
+          while (( SECONDS < deadline )); do
+            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
+            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
+            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
+              echo "::error::Private build correlation is missing or ambiguous."
+              exit 1
+            fi
+            run="$(jq '.[0]' <<<"$matches")"
+            status="$(jq -r '.status' <<<"$run")"
+            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
+            if [[ "$status" == "completed" ]]; then
+              if [[ "$conclusion" != "success" ]]; then
+                echo "::error::Private marketing build concluded with $conclusion."
+                exit 1
+              fi
+              echo "Private marketing build completed successfully."
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "::error::Timed out waiting for the private marketing build."
+          exit 1
@@ -1,51 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: finalise release
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes)"
-        type: string
-        required: true
-      fragment-run-id:
-        description: "Workflow run id that produced the release-fragment-* artifacts"
-        type: string
-        required: true
-
-permissions:
-  actions: read
-  contents: write
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  finalise:
-    name: finalise GitHub release manifest
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          gh run download "${{ inputs.fragment-run-id }}"
-          --pattern "release-fragment-*"
-          --dir release-out/fragments
-      - name: Finalise release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${{ inputs.build-version }}"
@@ -57,7 +57,7 @@ jobs:

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Refresh source catalogs
@@ -71,7 +71,7 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales fluxer_marketing/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No source catalog changes."
            exit 0
          fi
@@ -79,7 +79,7 @@ jobs:
          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
          git switch -c "$SOURCE_BRANCH"
-          git add fluxer_app/src/features/i18n/locales fluxer_marketing/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "chore(i18n): refresh source catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git fetch origin "$SOURCE_BRANCH" || true
@@ -63,7 +63,7 @@ jobs:

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Compile translated catalogs
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -5,6 +5,7 @@ permissions: {}
 jobs:
  label:
    name: Label
+    if: github.repository == 'fluxerapp/fluxer'
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -41,7 +41,7 @@ concurrency:
 jobs:
  automatic:
    name: Lock closed conversation
-    if: github.event_name != 'workflow_dispatch' && github.event_name != 'schedule'
+    if: github.repository == 'fluxerapp/fluxer' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule'
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -155,7 +155,7 @@ jobs:

  retroactive:
    name: Lock closed conversations retroactively
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    if: github.repository == 'fluxerapp/fluxer' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -1,282 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: release all builds
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-
-permissions:
-  actions: read
-  contents: write
-  packages: write
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: release-all-${{ inputs['build-version'] || github.run_id }}
-  cancel-in-progress: false
-
-jobs:
-  approve:
-    name: approve release build
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 5
-    steps:
-      - name: approved
-        run: echo "Release build approved."
-
-  meta:
-    name: resolve metadata
-    needs: approve
-    if: ${{ !failure() && !cancelled() }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      build_version: ${{ steps.vars.outputs.build_version }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: set variables
-        id: vars
-        env:
-          GH_TOKEN: ${{ github.token }}
-          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
-          --github-output
-
-  build_admin:
-    needs: meta
-    uses: ./.github/workflows/build-admin.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_api:
-    needs: meta
-    uses: ./.github/workflows/build-api.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_app_proxy:
-    needs: meta
-    uses: ./.github/workflows/build-app-proxy.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_app_proxy_self_hosted:
-    needs: meta
-    uses: ./.github/workflows/build-app-proxy-self-hosted.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_docs:
-    needs: meta
-    uses: ./.github/workflows/build-docs.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_gateway:
-    needs: meta
-    uses: ./.github/workflows/build-gateway.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_gifs:
-    needs: meta
-    uses: ./.github/workflows/build-gifs.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_marketing:
-    needs: meta
-    uses: ./.github/workflows/build-marketing.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_media_proxy:
-    needs: meta
-    uses: ./.github/workflows/build-media-proxy.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_messages:
-    needs: meta
-    uses: ./.github/workflows/build-messages.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_snowflakes:
-    needs: meta
-    uses: ./.github/workflows/build-snowflakes.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_static:
-    needs: meta
-    uses: ./.github/workflows/build-static.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_unfurl:
-    needs: meta
-    uses: ./.github/workflows/build-unfurl.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_users:
-    needs: meta
-    uses: ./.github/workflows/build-users.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  release_assets:
-    name: package Helm/self-hosting
-    if: ${{ !failure() && !cancelled() }}
-    needs:
-      - meta
-      - build_admin
-      - build_api
-      - build_app_proxy
-      - build_app_proxy_self_hosted
-      - build_docs
-      - build_gateway
-      - build_gifs
-      - build_marketing
-      - build_media_proxy
-      - build_messages
-      - build_snowflakes
-      - build_static
-      - build_unfurl
-      - build_users
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Set up Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-      - name: Publish self-hosting bundle
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-self-hosting
-          --build-version "${{ needs.meta.outputs.build_version }}"
-      - name: Publish Helm chart bundle
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-helm
-          --build-version "${{ needs.meta.outputs.build_version }}"
-      - name: Upload release asset fragments
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: release-fragment-release-assets
-          path: release-out/fragments/*.json
-          if-no-files-found: error
-          retention-days: 14
-
-  finalise:
-    name: finalise GitHub release manifest
-    if: ${{ !failure() && !cancelled() }}
-    needs:
-      - meta
-      - build_admin
-      - build_api
-      - build_app_proxy
-      - build_app_proxy_self_hosted
-      - build_docs
-      - build_gateway
-      - build_gifs
-      - build_marketing
-      - build_media_proxy
-      - build_messages
-      - build_snowflakes
-      - build_static
-      - build_unfurl
-      - build_users
-      - release_assets
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-      - name: Finalise GitHub release manifest
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${{ needs.meta.outputs.build_version }}"
@@ -3,21 +3,29 @@ name: Tests

 on:
  pull_request:
+  push:
+    branches:
+      - main

 permissions:
  contents: read

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 env:
  GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  CARGO_PROFILE_DEV_DEBUG: none
+  CARGO_PROFILE_TEST_DEBUG: none
+  CARGO_INCREMENTAL: '0'

 jobs:
  typecheck:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -28,6 +36,28 @@ jobs:
          toolchain: "1.93.0"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
+      - name: Save ci helper
+        if: github.ref == 'refs/heads/main' && steps.ci-helper.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271

@@ -38,18 +68,19 @@ jobs:
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies

      - name: Run typecheck
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step typecheck
+        run: |
+          "$FLUXER_CI_BIN" ci --step typecheck

  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
+      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -60,6 +91,19 @@ jobs:
          toolchain: "1.93.0"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271

@@ -70,17 +114,45 @@ jobs:
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies
+
+      - name: Restore fluxer_app wasm artifacts
+        id: app-wasm
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

      - name: Run tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step test
+        run: |
+          "$FLUXER_CI_BIN" ci --step test
+
+      - name: Save fluxer_app wasm artifacts
+        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

  rust:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout code
@@ -89,7 +161,7 @@ jobs:
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
-          toolchain: stable
+          toolchain: "1.93.0"
          components: clippy, rustfmt

      - name: Install pnpm
@@ -102,15 +174,12 @@ jobs:
          cache: 'pnpm'

      - name: Cache cargo
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: rust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
-          restore-keys: |
-            rust-${{ runner.os }}-
+          workspaces: |
+            . -> target
+            fluxer_desktop/native/rust -> target
+          save-if: ${{ github.ref == 'refs/heads/main' }}

      - name: Install native dependencies
        run: |
@@ -125,20 +194,28 @@ jobs:
            libwebp-dev

      - name: Install Node.js dependencies
-        run: pnpm --filter fluxer_admin --filter fluxer_marketing install
+        run: pnpm --filter fluxer_admin install

      - name: Check formatting
        run: cargo fmt --all -- --check

+      - name: Check formatting (desktop native)
+        run: cargo fmt --manifest-path fluxer_desktop/native/rust/Cargo.toml --all -- --check
+
      - name: Clippy (warnings as errors)
        run: cargo clippy --workspace -- -D warnings

      - name: Run tests
        run: cargo test --workspace

+      - name: Run desktop native tests
+        run: cargo test --manifest-path fluxer_desktop/native/rust/Cargo.toml
+
  gateway:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -148,45 +225,82 @@ jobs:
        with:
          toolchain: "1.93.0"

+      - name: Cache cargo (gateway NIFs)
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        with:
+          workspaces: |
+            fluxer_gateway/native/guild_member_list_oset_nif -> target
+            fluxer_gateway/native/push_markdown_plaintext_nif -> target
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Set up Erlang
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
          rebar3-version: '3.24.0'

-      - name: Cache rebar3 dependencies
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      - name: Restore rebar3 dependencies
+        id: rebar3-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: |
-            fluxer_gateway/_build
            ~/.cache/rebar3
-          key: rebar3-${{ runner.os }}-${{ hashFiles('fluxer_gateway/rebar.lock') }}
+            fluxer_gateway/_build
+            !fluxer_gateway/_build/default/lib/fluxer_gateway
+            !fluxer_gateway/_build/test/lib/fluxer_gateway
+          key: >-
+            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-
+            rebar3-${{ runner.os }}-otp28-rebar3.24.0-

      - name: Check formatting
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_fmt
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_fmt

      - name: Compile
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_compile
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_compile

      - name: Run dialyzer
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_dialyzer
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_dialyzer

      - name: Run eunit tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_eunit
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_eunit
+
+      - name: Save rebar3 dependencies
+        if: always() && github.ref == 'refs/heads/main' && steps.rebar3-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cache/rebar3
+            fluxer_gateway/_build
+            !fluxer_gateway/_build/default/lib/fluxer_gateway
+            !fluxer_gateway/_build/test/lib/fluxer_gateway
+          key: >-
+            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            'fluxer_gateway/rebar.config') }}

  knip:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -197,6 +311,19 @@ jobs:
          toolchain: "1.93.0"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271

@@ -207,14 +334,76 @@ jobs:
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies
+
+      - name: Restore fluxer_app wasm artifacts
+        id: app-wasm
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

      - name: Run knip
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step knip
+        run: |
+          "$FLUXER_CI_BIN" ci --step knip
+
+      - name: Save fluxer_app wasm artifacts
+        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}
+
+  i18n:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Compile locale catalogs
+        run: pnpm i18n:compile
+
+      - name: Check drift of compiled locale modules
+        run: |
+          if ! git diff --exit-code -- \
+            packages/errors/src/i18n/locales \
+            packages/errors/src/i18n/ErrorI18nTypes.generated.ts \
+            fluxer_api/pkgs/email/src/email_i18n/locales \
+            fluxer_api/pkgs/email/src/email_i18n/EmailI18nTypes.generated.ts \
+            fluxer_api/src/api/content_i18n/locales; then
+            echo "::error::Compiled locale modules are outdated. Run 'pnpm i18n:compile' and commit the result. Translations belong in the weblate/ catalogs, not in the generated locales/ modules."
+            exit 1
+          fi

  fonts:
    runs-on: ubuntu-24.04
@@ -233,133 +422,3 @@ jobs:

      - name: Verify shipped fonts match the lockfile
        run: python3 tools/fonts/build_fonts.py --verify
-
-  ci-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 25
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: stable
-          components: rustfmt
-
-      - name: Sync ci helper dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci-scripts
-          --step sync
-
-      - name: Run ci helper tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci-scripts
-          --step test
-
-  helm-and-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-
-      - name: Install helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-
-      - name: Resolve Helm test build version
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
-          --github-env
-          --env-name HELM_TEST_BUILD_VERSION
-
-      - name: Helm dependency update (all charts)
-        run: |
-          set -euo pipefail
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              helm dependency update "$chart_dir"
-            fi
-          done
-
-      - name: Helm lint (all charts)
-        run: |
-          set -euo pipefail
-          FAILED=0
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              echo "--- Linting ${chart_dir} ---"
-              VALUES_ARGS=()
-              if [[ -f "${chart_dir}values.yaml" ]]; then
-                VALUES_ARGS=(-f "${chart_dir}values.yaml")
-              fi
-              EXTRA_SETS=(--set-string "global.registry=${GHCR_REGISTRY}")
-              case "${chart_dir}" in
-                *gateway*)
-                  EXTRA_SETS+=(--set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *api*)
-                  EXTRA_SETS+=(--set-string app.name=api --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *app-proxy*)
-                  EXTRA_SETS+=(--set-string app.name=app-proxy --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *admin*)
-                  EXTRA_SETS+=(--set-string app.name=admin --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *marketing*)
-                  EXTRA_SETS+=(--set-string app.name=marketing --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *docs*)
-                  EXTRA_SETS+=(--set-string app.name=docs --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *media-proxy*)
-                  EXTRA_SETS+=(--set-string "mediaProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "mediaProxy.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *uploads*)
-                  EXTRA_SETS+=(--set-string app.name=uploads --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *worker*)
-                  EXTRA_SETS+=(--set-string "workerRealtime.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerRealtime.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *gifs*|*messages*|*snowflakes*|*unfurl*|*users*)
-                  EXTRA_SETS+=(--set-string "svc.tag=${HELM_TEST_BUILD_VERSION}" --set-string "svc.build.version=${HELM_TEST_BUILD_VERSION}" --set-string svc.build.channel=stable)
-                  ;;
-              esac
-              if ! helm lint "$chart_dir" "${VALUES_ARGS[@]}" "${EXTRA_SETS[@]}" --strict; then
-                FAILED=1
-              fi
-            fi
-          done
-          if [[ "$FAILED" -ne 0 ]]; then
-            echo "::error::One or more Helm charts failed linting"
-            exit 1
-          fi
-
-      - name: Helm template (gateway)
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer > /dev/null
-          echo "Gateway chart templates render successfully."
-
-      - name: Validate gateway manifests with kubeconform
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer \
-            | docker run -i --rm ghcr.io/yannh/kubeconform:v0.6.7 \
-                -strict -summary -kubernetes-version 1.31.0
@@ -14,6 +14,7 @@
 **/*.css.d.ts
 **/*.tsbuildinfo
 **/.cache/
+**/.swc/
 **/__pycache__/
 **/_build/
 **/coverage/
@@ -41,13 +42,9 @@

 /app-dist-output/
 /artifacts/
-/release-input/
-/release-out/
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 **/.idea/
 **/*.iml
@@ -0,0 +1,4 @@
+[submodule "fluxer_marketing"]
+	path = fluxer_marketing
+	url = https://github.com/fluxerapp/marketing.git
+	update = none
@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 4

-[[package]]
-name = "accept-language"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f27d075294830fcab6f66e320dab524bc6d048f4a151698e153205559113772"
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -896,25 +890,6 @@ dependencies = [
 "either",
 ]

-[[package]]
-name = "calendrical_calculations"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5abbd6eeda6885048d357edc66748eea6e0268e3dd11f326fff5bd248d779c26"
-dependencies = [
- "core_maths",
- "displaydoc",
-]
-
-[[package]]
-name = "caseless"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6fd507454086c8edfd769ca6ada439193cdb209c7681712ef6275cccbfe5d8"
-dependencies = [
- "unicode-normalization",
-]
-
 [[package]]
 name = "cast"
 version = "0.3.0"
@@ -1103,29 +1078,6 @@ version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"

-[[package]]
-name = "comrak"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aac0b255932a9cd52fbfd664b67957f9f2e095ae4711cb0e41b4e291edef94c2"
-dependencies = [
- "caseless",
- "entities",
- "finl_unicode",
- "jetscii",
- "phf 0.13.1",
- "phf_codegen 0.13.1",
- "rustc-hash",
- "smallvec",
- "typed-arena",
-]
-
-[[package]]
-name = "concat-string"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7439becb5fafc780b6f4de382b1a7a3e70234afe783854a4702ee8adbb838609"
-
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -1173,15 +1125,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"

-[[package]]
-name = "core_maths"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
-dependencies = [
- "libm",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1682,78 +1625,14 @@ dependencies = [
 ]

 [[package]]
-name = "email_address"
-version = "0.2.9"
+name = "encoding_rs"
+version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
- "serde",
+ "cfg-if",
 ]

-[[package]]
-name = "encoding"
-version = "0.2.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b0d943856b990d12d3b55b359144ff341533e516d94098b1d3fc1ac666d36ec"
-dependencies = [
- "encoding-index-japanese",
- "encoding-index-korean",
- "encoding-index-simpchinese",
- "encoding-index-singlebyte",
- "encoding-index-tradchinese",
-]
-
-[[package]]
-name = "encoding-index-japanese"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04e8b2ff42e9a05335dbf8b5c6f7567e5591d0d916ccef4e0b1710d32a0d0c91"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-korean"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dc33fb8e6bcba213fe2f14275f0963fd16f0a02c878e3095ecfdf5bee529d81"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-simpchinese"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d87a7194909b9118fc707194baa434a4e3b0fb6a5a757c73c3adb07aa25031f7"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-singlebyte"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3351d5acffb224af9ca265f435b859c7c01537c0849754d3db3fdf2bfe2ae84a"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding-index-tradchinese"
-version = "1.20141219.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd0e20d5688ce3cab59eb3ef3a2083a5c77bf496cb798dc6fcdb75f323890c18"
-dependencies = [
- "encoding_index_tests",
-]
-
-[[package]]
-name = "encoding_index_tests"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
-
 [[package]]
 name = "entities"
 version = "1.0.1"
@@ -1834,39 +1713,12 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"

-[[package]]
-name = "filetime"
-version = "0.2.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
-dependencies = [
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"

-[[package]]
-name = "finl_unicode"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5"
-
-[[package]]
-name = "fixed_decimal"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79c3c892f121fff406e5dd6b28c1b30096b95111c30701a899d4f2b18da6d1bd"
-dependencies = [
- "displaydoc",
- "smallvec",
- "writeable",
-]
-
 [[package]]
 name = "flagset"
 version = "0.4.7"
@@ -1895,14 +1747,12 @@ dependencies = [
 "bytes",
 "chrono",
 "clap",
- "flate2",
 "hex",
 "md-5",
 "reqwest",
 "serde",
 "serde_json",
 "sha2 0.11.0",
- "tar",
 "tempfile",
 "tokio",
 "walkdir",
@@ -1927,6 +1777,7 @@ dependencies = [
 "axum",
 "base64",
 "clap",
+ "fluxer_common",
 "hmac 0.13.0",
 "hyper 1.10.1",
 "hyper-util",
@@ -1950,6 +1801,7 @@ dependencies = [
 "anyhow",
 "base64",
 "fluxer-svc",
+ "fluxer_common",
 "hmac 0.13.0",
 "moka",
 "reqwest",
@@ -1975,17 +1827,6 @@ dependencies = [
 "tempfile",
 ]

-[[package]]
-name = "fluxer-marketing-update-gettext-catalogs"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "chrono",
- "serde_json",
- "syn",
- "tempfile",
-]
-
 [[package]]
 name = "fluxer-media-proxy"
 version = "0.1.0"
@@ -1997,6 +1838,7 @@ dependencies = [
 "cc",
 "clap",
 "criterion",
+ "fluxer_common",
 "hex",
 "hmac 0.13.0",
 "http 1.4.2",
@@ -2036,6 +1878,7 @@ dependencies = [
 "chrono",
 "criterion",
 "fluxer-svc",
+ "fluxer_common",
 "fluxer_markdown_parser",
 "futures",
 "hmac 0.13.0",
@@ -2101,8 +1944,10 @@ dependencies = [
 "anyhow",
 "base64",
 "chrono",
+ "encoding_rs",
 "entities",
 "fluxer-svc",
+ "fluxer_common",
 "hmac 0.13.0",
 "infer",
 "moka",
@@ -2198,12 +2043,17 @@ dependencies = [
 "aws-credential-types",
 "aws-sigv4",
 "axum",
+ "base64",
+ "hmac 0.13.0",
 "maxminddb",
 "moka",
 "reqwest",
 "serde_json",
+ "sha2 0.11.0",
+ "thiserror",
 "time",
 "tracing",
+ "url",
 "urlencoding",
 ]

@@ -2217,42 +2067,6 @@ dependencies = [
 "serde_json",
 ]

-[[package]]
-name = "fluxer_marketing"
-version = "0.1.0"
-dependencies = [
- "accept-language",
- "ammonia",
- "anyhow",
- "axum",
- "base64",
- "comrak",
- "cookie",
- "email_address",
- "fluxer_common",
- "gettext",
- "hmac 0.13.0",
- "http-body-util",
- "icu_datetime",
- "icu_locale",
- "maud",
- "mime_guess",
- "moka",
- "polib",
- "reqwest",
- "serde",
- "serde_json",
- "sha2 0.11.0",
- "syn",
- "time",
- "tokio",
- "tower",
- "tower-http",
- "tracing",
- "tracing-subscriber",
- "urlencoding",
-]
-
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -2445,16 +2259,6 @@ dependencies = [
 "wasip3",
 ]

-[[package]]
-name = "gettext"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ebb594e753d5997e4be036e5a8cf048ab9414352870fb45c779557bbc9ba971"
-dependencies = [
- "byteorder",
- "encoding",
-]
-
 [[package]]
 name = "gif"
 version = "0.14.2"
@@ -2816,29 +2620,6 @@ dependencies = [
 "cc",
 ]

-[[package]]
-name = "icu_calendar"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b2acc6263f494f1df50685b53ff8e57869e47d5c6fe39c23d518ae9a4f3e45"
-dependencies = [
- "calendrical_calculations",
- "displaydoc",
- "icu_calendar_data",
- "icu_locale",
- "icu_locale_core",
- "icu_provider",
- "ixdtf",
- "tinystr",
- "zerovec",
-]
-
-[[package]]
-name = "icu_calendar_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "118577bcf3a0fa7c6ac0a7d6e951814da84ee56b9b1f68fb4d8d10b08cefaf4d"
-
 [[package]]
 name = "icu_collections"
 version = "2.2.0"
@@ -2853,73 +2634,6 @@ dependencies = [
 "zerovec",
 ]

-[[package]]
-name = "icu_datetime"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "989d56ea5bbc43ae2b4e0388874b002884eaf4ed3a76c84a6c8c5ad575e04d72"
-dependencies = [
- "displaydoc",
- "fixed_decimal",
- "icu_calendar",
- "icu_datetime_data",
- "icu_decimal",
- "icu_locale",
- "icu_locale_core",
- "icu_pattern",
- "icu_plurals",
- "icu_provider",
- "icu_time",
- "potential_utf",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_datetime_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40d3cc1b690d9703202bc319692ac8a1f3a6390686f0930ff40542450fa34f0b"
-
-[[package]]
-name = "icu_decimal"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "288247df2e32aa776ac54fdd64de552149ac43cb840f2761811f0e8d09719dd4"
-dependencies = [
- "displaydoc",
- "fixed_decimal",
- "icu_decimal_data",
- "icu_locale",
- "icu_locale_core",
- "icu_plurals",
- "icu_provider",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_decimal_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f14a5ca9e8af29eef62064f269078424283d90dbaffeac5225addf62aaabc22"
-
-[[package]]
-name = "icu_locale"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5a396343c7208121dc86e35623d3dfe19814a7613cfd14964994cdc9c9a2e26"
-dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_locale_data",
- "icu_provider",
- "potential_utf",
- "tinystr",
- "zerovec",
-]
-
 [[package]]
 name = "icu_locale_core"
 version = "2.2.0"
@@ -2928,18 +2642,11 @@ checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
 "displaydoc",
 "litemap",
- "serde",
 "tinystr",
 "writeable",
 "zerovec",
 ]

-[[package]]
-name = "icu_locale_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fdcc9ac77c6d74ff5cf6e65ef3181d6af32003b16fce3a77fb451d2f695993"
-
 [[package]]
 name = "icu_normalizer"
 version = "2.2.0"
@@ -2960,38 +2667,6 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"

-[[package]]
-name = "icu_pattern"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c4c568054ffe735398a9f4c55aec37ad7c768844553cc0978f09cc9b933a1fb"
-dependencies = [
- "displaydoc",
- "either",
- "serde",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_plurals"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a50023f1d49ad5c4333380328a0d4a19e4b9d6d842ec06639affd5ba47c8103"
-dependencies = [
- "fixed_decimal",
- "icu_locale",
- "icu_plurals_data",
- "icu_provider",
- "zerovec",
-]
-
-[[package]]
-name = "icu_plurals_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8485497155dc865f901decb93ecc20d3e467df67bfeceb91e3ba34e2b11e8e1d"
-
 [[package]]
 name = "icu_properties"
 version = "2.2.0"
@@ -3020,8 +2695,6 @@ checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
 "displaydoc",
 "icu_locale_core",
- "serde",
- "stable_deref_trait",
 "writeable",
 "yoke",
 "zerofrom",
@@ -3029,30 +2702,6 @@ dependencies = [
 "zerovec",
 ]

-[[package]]
-name = "icu_time"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3af0c141da0a61d4f6970cd1d5f4b388b17ea22f8124f8f6049d3d5147586a"
-dependencies = [
- "calendrical_calculations",
- "displaydoc",
- "icu_calendar",
- "icu_locale_core",
- "icu_provider",
- "icu_time_data",
- "ixdtf",
- "serde",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_time_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f2f8aeca682d874a5247084aa4fb7d1cef9ba45d889c21209a8818dcaaa0ec9"
-
 [[package]]
 name = "id-arena"
 version = "2.3.0"
@@ -3177,18 +2826,6 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

-[[package]]
-name = "ixdtf"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ceaf4c6c48465bead8cb6a0b7c4ee0c86ecbb31239032b9c66ab9a08d2f3ee1"
-
-[[package]]
-name = "jetscii"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"
-
 [[package]]
 name = "jni"
 version = "0.22.4"
@@ -3278,12 +2915,6 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"

-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
 [[package]]
 name = "libredox"
 version = "0.1.17"
@@ -3293,15 +2924,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "linereader"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d921fea6860357575519aca014c6e22470585accdd543b370c404a8a72d0dd1d"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "linkify"
 version = "0.11.0"
@@ -3934,16 +3556,6 @@ dependencies = [
 "miniz_oxide",
 ]

-[[package]]
-name = "polib"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee83e5a284d919e51b071969bbf2d12d6943857aab02d84c5cc449373c9f3b7b"
-dependencies = [
- "concat-string",
- "linereader",
-]
-
 [[package]]
 name = "portable-atomic"
 version = "1.13.1"
@@ -3987,8 +3599,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
- "serde_core",
- "writeable",
 "zerovec",
 ]

@@ -5284,17 +4894,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"

-[[package]]
-name = "tar"
-version = "0.4.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
-dependencies = [
- "filetime",
- "libc",
- "xattr",
-]
-
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -5396,7 +4995,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
 "displaydoc",
- "serde_core",
 "zerovec",
 ]

@@ -5728,12 +5326,6 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"

-[[package]]
-name = "typed-arena"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
-
 [[package]]
 name = "typed-path"
 version = "0.12.3"
@@ -6471,9 +6063,6 @@ name = "writeable"
 version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
-dependencies = [
- "either",
-]

 [[package]]
 name = "wyhash"
@@ -6496,16 +6085,6 @@ dependencies = [
 "tls_codec",
 ]

-[[package]]
-name = "xattr"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
-dependencies = [
- "libc",
- "rustix",
-]
-
 [[package]]
 name = "xmlparser"
 version = "0.13.6"
@@ -6605,7 +6184,6 @@ dependencies = [
 "displaydoc",
 "yoke",
 "zerofrom",
- "zerovec",
 ]

 [[package]]
@@ -6614,7 +6192,6 @@ version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
- "serde",
 "yoke",
 "zerofrom",
 "zerovec-derive",
@@ -3,7 +3,6 @@ members = [
 	"fluxer_admin",
 	"fluxer_app_proxy",
 	"fluxer_common",
-	"fluxer_marketing",
 	"fluxer_media_proxy",
 	"fluxer_gifs",
 	"fluxer_svc",
@@ -13,15 +12,13 @@ members = [
 	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
-	"tools/marketing/update-gettext-catalogs",
 	"fluxer_users",
 	"fluxer_unfurl",
 	"packages/markdown_parser/rust",
 ]
 exclude = [
+	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
-	"fluxer_desktop/native/webrtc-sender/vendor/tract-linalg-0.19.16",
-	"fluxer_desktop/native/webrtc-sender/vendor/tract-linalg-0.23.1",
 ]
 resolver = "2"

@@ -31,5 +31,5 @@
 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-1920w.png" alt="Fluxer app showcase" width="900">
+  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer app showcase" width="900">
 </p>
@@ -145,8 +145,14 @@
 			"!fluxer_static",
 			"!packages/fonts",
 			"!fluxer_admin/static/htmx.min.js",
-			"!fluxer_marketing/static/htmx.min.js",
-			"!fluxer_api/src/api/openapi/openapi.json"
+			"!fluxer_api/src/api/openapi/openapi.json",
+			"!fluxer_api/pkgs/email/src/email_i18n/locales",
+			"!fluxer_api/pkgs/email/src/email_i18n/weblate",
+			"!fluxer_api/src/api/content_i18n/locales",
+			"!fluxer_api/src/api/content_i18n/weblate",
+			"!packages/errors/src/i18n/locales",
+			"!packages/errors/src/i18n/weblate",
+			"!**/auto-i18n-reviewed-unchanged.json"
 		],
 		"ignoreUnknown": true
 	}
@@ -17,7 +17,7 @@ FLUXER_GATEWAY_ENDPOINT=ws://localhost:8088/gateway
 FLUXER_MEDIA_ENDPOINT=http://localhost:8088/media
 FLUXER_STATIC_CDN_ENDPOINT=http://localhost:8088
 FLUXER_ADMIN_ENDPOINT=http://localhost:8088/admin
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
+FLUXER_MARKETING_ENDPOINT=https://fluxer.app
 FLUXER_TRUST_CLIENT_IP_HEADER=true
 FLUXER_CLIENT_IP_HEADER_NAME=x-forwarded-for

@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: admin
-description: Fluxer admin service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-canary release as of 2026-05-17T20:42:36Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-canary
-# Apply with:    helm upgrade fluxer-admin-canary deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  image: fluxer-admin
-  name: admin-canary
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-stable
-# Apply with:    helm upgrade fluxer-admin-stable deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-admin
-  name: admin
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,34 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: api
-description: Fluxer API service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,105 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-canary release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-api-canary
-# Apply with:    helm upgrade fluxer-api-canary deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api-canary
-  port: 8080
-  replicas: 4
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 75%
@@ -1,107 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-api-stable
-# Apply with:    helm upgrade fluxer-api-stable deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_USERS_SERVICE_TIMEOUT_MS
-    value: "6000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api
-  port: 8080
-  replicas: 31
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 75%
@@ -1,98 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-canary:
-  image: fluxer-api
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-pdb:
-  minAvailable: '75%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: app-proxy
-description: Fluxer app proxy service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-canary release as of 2026-05-17T20:42:38Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-canary
-# Apply with:    helm upgrade fluxer-app-proxy-canary deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.canary.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy-canary
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-stable release as of 2026-05-17T20:42:39Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-stable
-# Apply with:    helm upgrade fluxer-app-proxy-stable deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,31 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-
-
-
-
-  env:
-    - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-      value: '/api'
-
-pdb:
-  minAvailable: '50%'
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: common
-description: Shared Helm templates for Fluxer services
-type: library
-version: 0.1.0
@@ -1,356 +0,0 @@
-{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}}
-{{- define "fluxer.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.labels" -}}
-helm.sh/chart: {{ include "fluxer.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/part-of: fluxer
-{{- end }}
-
-{{- define "fluxer.selectorLabels" -}}
-app.kubernetes.io/name: {{ .name }}
-app.kubernetes.io/instance: {{ .context.Release.Name }}
-{{- end }}
-
-{{- define "fluxer.imagePullSecrets" -}}
-imagePullSecrets:
-  - name: {{ .Values.global.imagePullSecret }}
-{{- end }}
-
-{{- define "fluxer.image" -}}
-{{- $tag := required (printf ".tag is required (image: %s)" .image) .tag -}}
-{{- $registry := required "global.registry is required" .context.Values.global.registry -}}
-{{ $registry }}/{{ .image }}:{{ $tag }}
-{{- end }}
-
-{{- define "fluxer.replicas" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $desired := int (required (printf ".replicas is required for %s" $name) $v.replicas) -}}
-{{- $preserveLiveReplicas := dig "preserveLiveReplicas" true $v -}}
-{{- if not $preserveLiveReplicas -}}
-{{- $desired -}}
-{{- else -}}
-{{- $existing := lookup "apps/v1" "Deployment" $ctx.Values.global.namespace $name -}}
-{{- if $existing -}}
-{{- $current := int (dig "spec" "replicas" 0 $existing) -}}
-{{- if gt $current 0 -}}
-{{- $current -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- end -}}
-{{- end }}
-
-{{- define "fluxer.deployment" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $isGateway := eq $name "gateway" -}}
-{{- $defaultMaxSurge := 1 -}}
-{{- $defaultMaxUnavailable := 0 -}}
-{{- $defaultMinReadySeconds := 10 -}}
-{{- $defaultTerminationGracePeriodSeconds := ternary 90 60 $isGateway -}}
-{{- $defaultReadinessPath := ternary "/_health/ready" "/_health" $isGateway -}}
-{{- $defaultReadinessTimeoutSeconds := ternary 5 2 $isGateway -}}
-{{- $configuredMaxSurge := dig "rollingUpdate" "maxSurge" $defaultMaxSurge $v -}}
-{{- $configuredMaxUnavailable := dig "rollingUpdate" "maxUnavailable" $defaultMaxUnavailable $v -}}
-{{- $maxSurge := $configuredMaxSurge -}}
-{{- $maxUnavailable := $configuredMaxUnavailable -}}
-{{- $minReadySeconds := int (dig "minReadySeconds" $defaultMinReadySeconds $v) -}}
-{{- $terminationGracePeriodSeconds := int (dig "terminationGracePeriodSeconds" $defaultTerminationGracePeriodSeconds $v) -}}
-{{- $readinessPath := dig "readinessProbe" "path" $defaultReadinessPath $v -}}
-{{- $readinessExecEnabled := dig "readinessProbe" "execEnabled" $isGateway $v -}}
-{{- $readinessTimeoutSeconds := int (dig "readinessProbe" "timeoutSeconds" $defaultReadinessTimeoutSeconds $v) -}}
-{{- $readinessExecCommand := printf "curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 || exit 1" $readinessTimeoutSeconds (int $v.port) $readinessPath -}}
-{{- $readinessInitialDelaySeconds := int (dig "readinessProbe" "initialDelaySeconds" 5 $v) -}}
-{{- $readinessPeriodSeconds := int (dig "readinessProbe" "periodSeconds" 5 $v) -}}
-{{- $readinessFailureThreshold := int (dig "readinessProbe" "failureThreshold" 2 $v) -}}
-{{- $livenessPath := dig "livenessProbe" "path" "/_health" $v -}}
-{{- $livenessInitialDelaySeconds := int (dig "livenessProbe" "initialDelaySeconds" 10 $v) -}}
-{{- $livenessPeriodSeconds := int (dig "livenessProbe" "periodSeconds" 15 $v) -}}
-{{- $livenessFailureThreshold := int (dig "livenessProbe" "failureThreshold" 3 $v) -}}
-{{- $livenessTimeoutSeconds := int (dig "livenessProbe" "timeoutSeconds" 5 $v) -}}
-{{- $startupProbeEnabled := dig "startupProbe" "enabled" $isGateway $v -}}
-{{- $startupProbePath := dig "startupProbe" "path" "/_health" $v -}}
-{{- $startupProbeInitialDelaySeconds := int (dig "startupProbe" "initialDelaySeconds" 0 $v) -}}
-{{- $startupProbePeriodSeconds := int (dig "startupProbe" "periodSeconds" 5 $v) -}}
-{{- $startupProbeFailureThreshold := int (dig "startupProbe" "failureThreshold" 30 $v) -}}
-{{- $startupProbeTimeoutSeconds := int (dig "startupProbe" "timeoutSeconds" 5 $v) -}}
-{{- $preStopDrainEnabled := dig "preStopDrain" "enabled" $isGateway $v -}}
-{{- $preStopDrainPath := dig "preStopDrain" "path" "/_health/drain" $v -}}
-{{- $preStopDrainSleepSeconds := int (dig "preStopDrain" "sleepSeconds" 20 $v) -}}
-{{- $preStopDrainTimeoutSeconds := int (dig "preStopDrain" "timeoutSeconds" 2 $v) -}}
-{{- $preStopDrainRetryCount := int (dig "preStopDrain" "retryCount" 6 $v) -}}
-{{- $preStopDrainRetryIntervalSeconds := int (dig "preStopDrain" "retryIntervalSeconds" 1 $v) -}}
-{{- $preStopDrainCommand := printf "attempt=0; while [ \"$attempt\" -lt %d ]; do curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 && break; attempt=$((attempt+1)); sleep %d; done; sleep %d" $preStopDrainRetryCount $preStopDrainTimeoutSeconds (int $v.port) $preStopDrainPath $preStopDrainRetryIntervalSeconds $preStopDrainSleepSeconds -}}
-{{- $build := get $v "build" | default (dict) -}}
-{{- $buildVersion := get $build "version" | default $v.tag -}}
-{{- $buildSha := get $build "sha" | default "" -}}
-{{- $buildChannel := get $build "channel" | default "" -}}
-{{- $nsfwServiceEndpoint := get $v "nsfwServiceEndpoint" | default "" -}}
-{{- $cluster := get $ctx.Values "cluster" | default (dict) -}}
-{{- $gatewayClusterEnabled := and $isGateway (eq (get $cluster "enabled" | default false) true) -}}
-{{- $erlangDistribution := get $cluster "erlangDistribution" | default (dict) -}}
-{{- $erlangDistPort := int (get $erlangDistribution "port" | default 8081) -}}
-{{- $erlangEpmdPort := int (get $erlangDistribution "epmdPort" | default 4369) -}}
-{{- $erlangCookieSecret := get $cluster "erlangCookieSecret" | default (dict) -}}
-{{- $erlangCookieSecretName := get $erlangCookieSecret "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $erlangCookieSecretKey := get $erlangCookieSecret "key" | default "cookie" -}}
-{{- $gatewayNodeBasename := get $cluster "discoveryNodeBasename" | default "fluxer_gateway" -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  replicas: {{ include "fluxer.replicas" (dict "name" $name "values" $v "context" $ctx) }}
-  minReadySeconds: {{ $minReadySeconds }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 6 }}
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: {{ $maxSurge | toJson }}
-      maxUnavailable: {{ $maxUnavailable | toJson }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ctx | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 8 }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ctx | nindent 6 }}
-      terminationGracePeriodSeconds: {{ $terminationGracePeriodSeconds }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $v.affinity }}
-      affinity:
-        {{- toYaml $v.affinity | nindent 8 }}
-      {{- else if $isGateway }}
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: gateway
-                    app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-                topologyKey: kubernetes.io/hostname
-      {{- end }}
-      {{- if $v.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $v.topologySpreadConstraints | nindent 8 }}
-      {{- else if $isGateway }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: gateway
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          nodeAffinityPolicy: Honor
-          nodeTaintsPolicy: Honor
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- end }}
-      {{- if $v.nodeSelector }}
-      nodeSelector:
-        {{- toYaml $v.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $v.tolerations }}
-      tolerations:
-        {{- toYaml $v.tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: {{ $name }}
-          image: {{ include "fluxer.image" (dict "image" $v.image "tag" $v.tag "context" $ctx) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          {{- if $v.command }}
-          command: {{ $v.command | toJson }}
-          {{- end }}
-          ports:
-            - name: http
-              containerPort: {{ $v.port }}
-              protocol: TCP
-            {{- if $gatewayClusterEnabled }}
-            - name: epmd
-              containerPort: {{ $erlangEpmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $erlangDistPort }}
-              protocol: TCP
-            {{- end }}
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            {{- if $gatewayClusterEnabled }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $gatewayNodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $erlangDistPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $erlangCookieSecretName }}
-                  key: {{ $erlangCookieSecretKey }}
-            {{- end }}
-            {{- if $buildVersion }}
-            - name: BUILD_VERSION
-              value: {{ $buildVersion | quote }}
-            {{- end }}
-            {{- if $buildSha }}
-            - name: BUILD_SHA
-              value: {{ $buildSha | quote }}
-            {{- end }}
-            {{- if $buildChannel }}
-            - name: RELEASE_CHANNEL
-              value: {{ $buildChannel | quote }}
-            {{- end }}
-            {{- if $nsfwServiceEndpoint }}
-            - name: FLUXER_NSFW_SERVICE_ENDPOINT
-              value: {{ $nsfwServiceEndpoint | quote }}
-            {{- end }}
-            {{- if $ctx.Values.global.env }}
-            {{- toYaml $ctx.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $v.env }}
-            {{- toYaml $v.env | nindent 12 }}
-            {{- end }}
-          {{- if or $ctx.Values.global.envFrom $v.envFrom }}
-          envFrom:
-            {{- if $ctx.Values.global.envFrom }}
-            {{- toYaml $ctx.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $v.envFrom }}
-            {{- toYaml $v.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          {{- if $preStopDrainEnabled }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ $preStopDrainCommand | quote }}
-          {{- end }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          {{- if not $v.noHealthCheck }}
-          livenessProbe:
-            httpGet:
-              path: {{ $livenessPath | quote }}
-              port: http
-            initialDelaySeconds: {{ $livenessInitialDelaySeconds }}
-            periodSeconds: {{ $livenessPeriodSeconds }}
-            timeoutSeconds: {{ $livenessTimeoutSeconds }}
-            failureThreshold: {{ $livenessFailureThreshold }}
-          readinessProbe:
-            {{- if $readinessExecEnabled }}
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ $readinessExecCommand | quote }}
-            {{- else }}
-            httpGet:
-              path: {{ $readinessPath | quote }}
-              port: http
-            {{- end }}
-            initialDelaySeconds: {{ $readinessInitialDelaySeconds }}
-            periodSeconds: {{ $readinessPeriodSeconds }}
-            timeoutSeconds: {{ $readinessTimeoutSeconds }}
-            failureThreshold: {{ $readinessFailureThreshold }}
-          {{- if $startupProbeEnabled }}
-          startupProbe:
-            httpGet:
-              path: {{ $startupProbePath | quote }}
-              port: http
-            initialDelaySeconds: {{ $startupProbeInitialDelaySeconds }}
-            periodSeconds: {{ $startupProbePeriodSeconds }}
-            timeoutSeconds: {{ $startupProbeTimeoutSeconds }}
-            failureThreshold: {{ $startupProbeFailureThreshold }}
-          {{- end }}
-          {{- end }}
-          resources:
-            {{- toYaml $v.resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{- end }}
-
-{{- define "fluxer.service" -}}
-{{- $name := .name -}}
-{{- $selectorName := .selectorName | default $name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  type: ClusterIP
-  ports:
-    - port: {{ $v.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fluxer.selectorLabels" (dict "name" $selectorName "context" $ctx) | nindent 4 }}
-{{- end }}
-
-{{- define "fluxer.pdb" -}}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ .name }}-pdb
-  namespace: {{ .context.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" .context | nindent 4 }}
-spec:
-  minAvailable: {{ .minAvailable }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" .name "context" .context) | nindent 6 }}
-{{- end }}
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: docs
-description: Fluxer documentation service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,23 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-docs
-  name: docs
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 128Mi
-    requests:
-      cpu: 50m
-      memory: 64Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-pdb:
-  minAvailable: 50%
@@ -1,22 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  resources:
-    requests:
-      cpu: 50m
-      memory: 64Mi
-    limits:
-      memory: 128Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: gateway
-description: Fluxer WebSocket gateway service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ $gatewayValues := .Values.gateway -}}
-{{- $cluster := .Values.cluster | default dict -}}
-{{- if dig "enabled" false $cluster -}}
-{{- $clusterEnv := list
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_ENABLED" "value" "true")
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME" "value" (dig "discoveryDnsName" "" $cluster))
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME" "value" (dig "discoveryNodeBasename" "fluxer_gateway" $cluster))
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS" "value" (printf "%d" (int (dig "discoveryPollIntervalMs" 5000 $cluster))))
-}}
-{{- if dig "enabled" false .Values.roles -}}
-{{- $clusterEnv = concat (list (dict "name" "FLUXER_GATEWAY_ROLE" "value" (dig "websocket" "role" "websocket" .Values.roles))) $clusterEnv -}}
-{{- end -}}
-{{- $gatewayValues = mergeOverwrite (deepCopy .Values.gateway) (dict "env" (concat $clusterEnv (get .Values.gateway "env" | default (list)))) -}}
-{{- end }}
-{{- $hotpatch := get .Values.gateway "hotpatch" | default dict -}}
-{{- if dig "enabled" false $hotpatch -}}
-{{- $hotpatchEnv := list
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_ENABLED" "value" "true")
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT" "value" (printf "%d" (int (get $hotpatch "cassandraPort" | default 9042))))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE" "value" (get $hotpatch "cassandraKeyspace" | default "fluxer"))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS" "value" (printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000))))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS" "value" (printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000))))
-}}
-{{- if get $hotpatch "cassandraHosts" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS" "value" (get $hotpatch "cassandraHosts")) -}}
-{{- end -}}
-{{- $publicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}}
-{{- if get $publicKeysSecret "name" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS" "valueFrom" (dict "secretKeyRef" (dict "name" (get $publicKeysSecret "name") "key" (get $publicKeysSecret "key" | default "public_keys")))) -}}
-{{- end -}}
-{{- $credentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}}
-{{- if get $credentialsSecret "name" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "usernameKey" | default "username")))) -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "passwordKey" | default "password")))) -}}
-{{- end -}}
-{{- $gatewayValues = mergeOverwrite (deepCopy $gatewayValues) (dict "env" (concat $hotpatchEnv (get $gatewayValues "env" | default (list)))) -}}
-{{- end }}
-{{ include "fluxer.deployment" (dict "name" "gateway" "values" $gatewayValues "context" .) }}
@@ -1,70 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) }}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) }}
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: gateway
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-spec:
-  podSelector:
-    matchLabels:
-      {{- if dig "enabled" false .Values.roles }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
-      app.kubernetes.io/part-of: fluxer
-      {{- else }}
-      {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 6 }}
-      {{- end }}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: ingress-nginx
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: api
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: api-canary
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-realtime
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-lifecycle
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-batch
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              {{- if dig "enabled" false .Values.roles }}
-              app.kubernetes.io/instance: {{ .Release.Name }}
-              app.kubernetes.io/part-of: fluxer
-              {{- else }}
-              {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 14 }}
-              {{- end }}
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-        {{- if $clusterEnabled }}
-        - port: {{ $epmdPort }}
-          protocol: TCP
-        - port: {{ $distPort }}
-          protocol: TCP
-        {{- end }}
-  egress:
-    - {}
@@ -1,5 +0,0 @@
-{{- if and .Values.pdb.enabled (gt (int .Values.gateway.replicas) 1) }}
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ include "fluxer.pdb" (dict "name" "gateway" "minAvailable" .Values.pdb.minAvailable "context" .) }}
-{{- end }}
@@ -1,40 +0,0 @@
-{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) -}}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) -}}
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" "gateway" "values" .Values.gateway "context" .)}}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: fluxer-gateway-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }}
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - port: {{ .Values.gateway.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-    {{- if $clusterEnabled }}
-    - port: {{ $epmdPort }}
-      targetPort: epmd
-      protocol: TCP
-      name: epmd
-    - port: {{ $distPort }}
-      targetPort: erl-dist
-      protocol: TCP
-      name: erl-dist
-    {{- end }}
-  selector:
-    {{- if dig "enabled" false .Values.roles }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: fluxer
-    {{- else }}
-    {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }}
-    {{- end }}
@@ -1,255 +0,0 @@
-{{- if dig "enabled" false .Values.roles }}
-{{- $cluster := .Values.cluster | default dict -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 $cluster) -}}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 $cluster) -}}
-{{- $cookie := dig "erlangCookieSecret" (dict) $cluster -}}
-{{- $cookieName := get $cookie "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $cookieKey := get $cookie "key" | default "cookie" -}}
-{{- $nodeBasename := dig "discoveryNodeBasename" "fluxer_gateway" $cluster -}}
-{{- $dnsName := dig "discoveryDnsName" "" $cluster -}}
-{{- if not $dnsName }}
-{{- fail "cluster.discoveryDnsName is required when roles.enabled=true" }}
-{{- end }}
-{{- $pollIntervalMs := int (dig "discoveryPollIntervalMs" 5000 $cluster) -}}
-{{- $gateway := .Values.gateway -}}
-{{- $common := .Values.roles.common | default dict -}}
-{{- $build := get $gateway "build" | default dict -}}
-{{- $hotpatch := get $gateway "hotpatch" | default dict -}}
-{{- $hotpatchPublicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}}
-{{- $hotpatchCredentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}}
-{{- $roles := list "sessions" "presence" "guilds" "calls" "push" -}}
-{{- range $role := $roles }}
-{{- $roleValues := get $.Values.roles $role | default dict -}}
-{{- if dig "enabled" true $roleValues }}
-{{- $name := printf "gateway-%s" $role -}}
-{{- $replicas := int (dig "replicas" (dig "replicas" 1 $common) $roleValues) -}}
-{{- $resources := get $roleValues "resources" | default (get $common "resources" | default $gateway.resources) -}}
-{{- $nodeSelector := get $roleValues "nodeSelector" | default (get $common "nodeSelector" | default $gateway.nodeSelector) -}}
-{{- $tolerations := get $roleValues "tolerations" | default (get $common "tolerations" | default $gateway.tolerations) -}}
-{{- $affinity := get $roleValues "affinity" | default (get $common "affinity" | default dict) -}}
-{{- $topologySpreadConstraints := get $roleValues "topologySpreadConstraints" | default (get $common "topologySpreadConstraints" | default list) -}}
---
-# SPDX-License-Identifier: AGPL-3.0-or-later
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: {{ $name }}
-  namespace: {{ $.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 4 }}
-spec:
-  serviceName: fluxer-gateway-headless
-  replicas: {{ $replicas }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 6 }}
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 8 }}
-        app.kubernetes.io/gateway-role: {{ $role | quote }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ | nindent 6 }}
-      terminationGracePeriodSeconds: {{ int (dig "terminationGracePeriodSeconds" 45 $roleValues) }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $affinity }}
-      affinity:
-        {{- toYaml $affinity | nindent 8 }}
-      {{- end }}
-      {{- if $topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $topologySpreadConstraints | nindent 8 }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $.Release.Name }}
-      {{- end }}
-      {{- if $nodeSelector }}
-      nodeSelector:
-        {{- toYaml $nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $tolerations }}
-      tolerations:
-        {{- toYaml $tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: gateway
-          image: {{ include "fluxer.image" (dict "image" $gateway.image "tag" $gateway.tag "context" $) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          ports:
-            - name: http
-              containerPort: {{ $gateway.port }}
-              protocol: TCP
-            - name: epmd
-              containerPort: {{ $epmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $distPort }}
-              protocol: TCP
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            - name: FLUXER_GATEWAY_ROLE
-              value: {{ $role | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_ENABLED
-              value: "true"
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME
-              value: {{ $dnsName | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME
-              value: {{ $nodeBasename | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS
-              value: {{ printf "%d" $pollIntervalMs | quote }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $nodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $distPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $cookieName }}
-                  key: {{ $cookieKey }}
-            {{- if get $build "sha" }}
-            - name: BUILD_SHA
-              value: {{ get $build "sha" | quote }}
-            {{- end }}
-            {{- if get $build "number" }}
-            - name: BUILD_NUMBER
-              value: {{ get $build "number" | quote }}
-            {{- end }}
-            {{- if get $build "timestamp" }}
-            - name: BUILD_TIMESTAMP
-              value: {{ get $build "timestamp" | quote }}
-            {{- end }}
-            {{- if get $build "channel" }}
-            - name: RELEASE_CHANNEL
-              value: {{ get $build "channel" | quote }}
-            {{- end }}
-            {{- if dig "enabled" false $hotpatch }}
-            - name: FLUXER_GATEWAY_HOTPATCH_ENABLED
-              value: "true"
-            {{- if get $hotpatch "cassandraHosts" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS
-              value: {{ get $hotpatch "cassandraHosts" | quote }}
-            {{- end }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT
-              value: {{ printf "%d" (int (get $hotpatch "cassandraPort" | default 9042)) | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE
-              value: {{ get $hotpatch "cassandraKeyspace" | default "fluxer" | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS
-              value: {{ printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000)) | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS
-              value: {{ printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000)) | quote }}
-            {{- if get $hotpatchPublicKeysSecret "name" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchPublicKeysSecret "name" | quote }}
-                  key: {{ get $hotpatchPublicKeysSecret "key" | default "public_keys" | quote }}
-            {{- end }}
-            {{- if get $hotpatchCredentialsSecret "name" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchCredentialsSecret "name" | quote }}
-                  key: {{ get $hotpatchCredentialsSecret "usernameKey" | default "username" | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchCredentialsSecret "name" | quote }}
-                  key: {{ get $hotpatchCredentialsSecret "passwordKey" | default "password" | quote }}
-            {{- end }}
-            {{- end }}
-            {{- if $.Values.global.env }}
-            {{- toYaml $.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $gateway.env }}
-            {{- toYaml $gateway.env | nindent 12 }}
-            {{- end }}
-            {{- if $common.env }}
-            {{- toYaml $common.env | nindent 12 }}
-            {{- end }}
-            {{- if $roleValues.env }}
-            {{- toYaml $roleValues.env | nindent 12 }}
-            {{- end }}
-          {{- if or $.Values.global.envFrom $gateway.envFrom $common.envFrom $roleValues.envFrom }}
-          envFrom:
-            {{- if $.Values.global.envFrom }}
-            {{- toYaml $.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $gateway.envFrom }}
-            {{- toYaml $gateway.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $common.envFrom }}
-            {{- toYaml $common.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $roleValues.envFrom }}
-            {{- toYaml $roleValues.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ printf "curl -fsS --max-time 2 http://127.0.0.1:%d/_health/drain >/dev/null 2>&1 || true; sleep 20" (int $gateway.port) | quote }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: "/_health"
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ printf "curl -fsS --max-time 5 http://127.0.0.1:%d/_health/ready >/dev/null 2>&1 || exit 1" (int $gateway.port) | quote }}
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 3
-          startupProbe:
-            httpGet:
-              path: "/_health"
-              port: http
-            initialDelaySeconds: 0
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 30
-          resources:
-            {{- toYaml $resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{ end }}
-{{ end }}
-{{ end }}
@@ -1,164 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-gateway release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-gateway
-# Apply with:    helm upgrade fluxer-gateway deploy/helm/gateway -f deploy/helm/gateway/values.yaml -f deploy/helm/gateway/values.prod.yaml
-
-cluster:
-  discoveryDnsName: fluxer-gateway-headless.fluxer.svc.cluster.local
-  discoveryNodeBasename: fluxer_gateway
-  discoveryPollIntervalMs: 5000
-  enabled: true
-  erlangCookieSecret:
-    key: cookie
-    name: fluxer-gateway-erlang-cookie
-  erlangDistribution:
-    epmdPort: 4369
-    port: 8081
-
-gateway:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT
-    value: "https://fluxerstatic.com"
-  - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES
-    value: "128"
-  - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES
-    value: "1048576"
-  image: fluxer-gateway
-  hotpatch:
-    enabled: true
-    cassandraHosts: int.flx-nyc-db1.srv.fluxer.dev
-    cassandraPort: 9041
-    cassandraKeyspace: fluxer
-    pollIntervalMs: 5000
-    startupSyncTimeoutMs: 30000
-    publicKeysSecret:
-      name: fluxer-gateway-hotpatch-public-keys
-      key: public_keys
-    cassandraCredentialsSecret:
-      name: fluxer-runtime-env-shared
-      usernameKey: FLUXER_CASSANDRA_USERNAME
-      passwordKey: FLUXER_CASSANDRA_PASSWORD
-  livenessProbe:
-    timeoutSeconds: 5
-  minReadySeconds: 0
-  nodeSelector: null
-  port: 8080
-  preStopDrain:
-    enabled: true
-    retryCount: 6
-    retryIntervalSeconds: 1
-    sleepSeconds: 30
-    timeoutSeconds: 2
-  preserveLiveReplicas: false
-  readinessProbe:
-    execEnabled: true
-    failureThreshold: 3
-    initialDelaySeconds: 5
-    path: /_health/ready
-    periodSeconds: 5
-    timeoutSeconds: 5
-  replicas: 16
-  resources:
-    limits:
-      memory: 16Gi
-    requests:
-      cpu: 500m
-      memory: 512Mi
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  startupProbe:
-    enabled: true
-    failureThreshold: 30
-    initialDelaySeconds: 0
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 5
-  tag: ""
-  terminationGracePeriodSeconds: 45
-  tolerations:
-  - effect: NoSchedule
-    key: dedicated
-    operator: Equal
-    value: gateway
-roles:
-  enabled: true
-  websocket:
-    role: websocket
-  common:
-    nodeSelector: null
-    resources:
-      requests:
-        cpu: 500m
-        memory: 768Mi
-      limits:
-        memory: 12Gi
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 60
-          preference:
-            matchExpressions:
-            - key: node.kubernetes.io/instance-type
-              operator: In
-              values:
-              - vhf-16c-58gb
-  sessions:
-    enabled: true
-    replicas: 12
-    resources:
-      requests:
-        cpu: 750m
-        memory: 2Gi
-      limits:
-        memory: 16Gi
-  presence:
-    enabled: true
-    replicas: 6
-    resources:
-      requests:
-        cpu: 500m
-        memory: 768Mi
-      limits:
-        memory: 6Gi
-  guilds:
-    enabled: true
-    replicas: 12
-    resources:
-      requests:
-        cpu: 750m
-        memory: 1Gi
-      limits:
-        memory: 8Gi
-  calls:
-    enabled: true
-    replicas: 4
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 4Gi
-  push:
-    enabled: true
-    replicas: 4
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 4Gi
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-shared
-pdb:
-  enabled: false
-  minAvailable: 1
@@ -1,118 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-gateway:
-  image: fluxer-gateway
-  tag: ''
-  replicas: 1
-  preserveLiveReplicas: false
-  port: 8080
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  minReadySeconds: 0
-  terminationGracePeriodSeconds: 45
-  readinessProbe:
-    path: /_health/ready
-    execEnabled: true
-    timeoutSeconds: 5
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    failureThreshold: 3
-  livenessProbe:
-    timeoutSeconds: 5
-  startupProbe:
-    enabled: true
-    path: /_health
-    initialDelaySeconds: 0
-    periodSeconds: 5
-    failureThreshold: 30
-    timeoutSeconds: 5
-  preStopDrain:
-    enabled: true
-    sleepSeconds: 30
-    timeoutSeconds: 2
-    retryCount: 6
-    retryIntervalSeconds: 1
-  nodeSelector:
-    kubernetes.io/hostname: flx-nyc-k8s-worker-efd1167e6219
-  tolerations:
-    - key: dedicated
-      operator: Equal
-      value: gateway
-      effect: NoSchedule
-  resources:
-    requests:
-      cpu: 500m
-      memory: 512Mi
-    limits:
-      memory: 16Gi
-  env:
-    - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT
-      value: "https://fluxerstatic.com"
-    - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES
-      value: "128"
-    - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES
-      value: "1048576"
-  hotpatch:
-    enabled: false
-    cassandraHosts: ''
-    cassandraPort: 9042
-    cassandraKeyspace: fluxer
-    pollIntervalMs: 5000
-    startupSyncTimeoutMs: 30000
-    publicKeysSecret:
-      name: ''
-      key: public_keys
-    cassandraCredentialsSecret:
-      name: ''
-      usernameKey: username
-      passwordKey: password
-
-cluster:
-  enabled: false
-  discoveryDnsName: ''
-  discoveryNodeBasename: fluxer_gateway
-  discoveryPollIntervalMs: 5000
-  erlangDistribution:
-    port: 8081
-    epmdPort: 4369
-  erlangCookieSecret:
-    name: fluxer-gateway-erlang-cookie
-    key: cookie
-
-roles:
-  enabled: false
-  websocket:
-    role: websocket
-  common:
-    replicas: 1
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 8Gi
-  sessions:
-    enabled: true
-    replicas: 1
-  presence:
-    enabled: true
-    replicas: 1
-  guilds:
-    enabled: true
-    replicas: 1
-  calls:
-    enabled: true
-    replicas: 1
-  push:
-    enabled: true
-    replicas: 1
-
-pdb:
-  enabled: false
-  minAvailable: 1
@@ -1,9 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: gifs
-version: 0.1.0
-dependencies:
-  - name: svc-common
-    version: 0.1.0
-    repository: file://../svc-common
@@ -1,13 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ include "svc-common.statefulset" . }}
---
-{{ include "svc-common.deployment" . }}
---
-{{ include "svc-common.headless-service" . }}
---
-{{ include "svc-common.service" . }}
---
-{{ include "svc-common.pdb" . }}
---
-{{ include "svc-common.router-pdb" . }}
@@ -1,32 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-svc:
-  shard:
-    replicas: 4
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        memory: 1Gi
-  router:
-    replicas: 3
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        memory: 512Mi
-  cache:
-    maxEntries: 500000
-    ttlMs: '30000'
-  extraEnv:
-    - name: FLUXER_MEDIA_PROXY_ENDPOINT
-      value: http://media-proxy:8080
-    - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT
-      value: https://fluxerusercontent.com
-    - name: FLUXER_MEDIA_PROXY_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-media-proxy-v2-env
-          key: FLUXER_MEDIA_PROXY_SECRET_KEY
@@ -1,55 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-svc:
-  name: gifs
-  image: fluxer-gifs
-  tag: ''
-  shard:
-    replicas: 2
-    port: 8090
-    minReadySeconds: 10
-    terminationGracePeriodSeconds: 60
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        memory: 512Mi
-  router:
-    replicas: 2
-    port: 8090
-    minReadySeconds: 10
-    maxSurge: 1
-    maxUnavailable: 0
-    terminationGracePeriodSeconds: 60
-    resources:
-      requests:
-        cpu: 100m
-        memory: 128Mi
-      limits:
-        memory: 256Mi
-  nats:
-    url: nats://nats-core:4222
-  cache:
-    maxEntries: 250000
-    ttlMs: '30000'
-  extraEnv:
-    - name: FLUXER_MEDIA_PROXY_ENDPOINT
-      value: http://media-proxy:8080
-    - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT
-      value: https://fluxerusercontent.com
-    - name: FLUXER_MEDIA_PROXY_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-media-proxy-v2-env
-          key: FLUXER_MEDIA_PROXY_SECRET_KEY
-  nodeSelector: {}
-  tolerations: []
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: infra
-description: Fluxer infrastructure (NATS, Valkey, Ingress)
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,133 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Daily sync of the MaxMind GeoLite2 City and ASN MMDB files into S3.
-# Runtime services read these out of the CDN bucket. Adopted into helm
-# from a previously hand-applied kubectl manifest.
-
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: geoip-sync
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    app.kubernetes.io/name: geoip-sync
-    {{- include "fluxer.labels" . | nindent 4 }}
-spec:
-  schedule: {{ .Values.geoipSync.schedule | quote }}
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      activeDeadlineSeconds: {{ .Values.geoipSync.activeDeadlineSeconds }}
-      backoffLimit: {{ .Values.geoipSync.backoffLimit }}
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/name: geoip-sync
-            app.kubernetes.io/part-of: fluxer
-        spec:
-          restartPolicy: OnFailure
-          terminationGracePeriodSeconds: 60
-          imagePullSecrets:
-            - name: {{ .Values.global.imagePullSecret }}
-          containers:
-            - name: sync
-              image: {{ .Values.geoipSync.image }}
-              imagePullPolicy: IfNotPresent
-              securityContext:
-                allowPrivilegeEscalation: false
-                readOnlyRootFilesystem: false
-                runAsNonRoot: true
-                runAsUser: 1000
-                runAsGroup: 1000
-                capabilities:
-                  drop: ["ALL"]
-                seccompProfile:
-                  type: RuntimeDefault
-              env:
-                - name: GEOIP_BUCKET
-                  value: {{ .Values.geoipSync.bucket | quote }}
-                - name: GEOIP_CITY_UPSTREAM_URL
-                  value: {{ .Values.geoipSync.cityUpstreamUrl | quote }}
-                - name: GEOIP_ASN_UPSTREAM_URL
-                  value: {{ .Values.geoipSync.asnUpstreamUrl | quote }}
-              envFrom:
-                - secretRef:
-                    name: {{ .Values.geoipSync.envSecret }}
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 256Mi
-                limits:
-                  memory: 512Mi
-              command:
-                - sh
-                - -c
-                - |
-                  set -eu
-
-                  : "${GEOIP_BUCKET:?missing GEOIP_BUCKET}"
-                  : "${GEOIP_CITY_UPSTREAM_URL:?missing GEOIP_CITY_UPSTREAM_URL}"
-                  : "${GEOIP_ASN_UPSTREAM_URL:?missing GEOIP_ASN_UPSTREAM_URL}"
-                  : "${FLUXER_S3_ACCESS_KEY_ID:?missing FLUXER_S3_ACCESS_KEY_ID}"
-                  : "${FLUXER_S3_SECRET_ACCESS_KEY:?missing FLUXER_S3_SECRET_ACCESS_KEY}"
-                  : "${FLUXER_S3_ENDPOINT:?missing FLUXER_S3_ENDPOINT}"
-                  : "${FLUXER_S3_REGION:?missing FLUXER_S3_REGION}"
-
-                  export AWS_ACCESS_KEY_ID="$FLUXER_S3_ACCESS_KEY_ID"
-                  export AWS_SECRET_ACCESS_KEY="$FLUXER_S3_SECRET_ACCESS_KEY"
-                  export AWS_DEFAULT_REGION="$FLUXER_S3_REGION"
-
-                  WORKDIR=$(mktemp -d)
-                  trap 'rm -rf "$WORKDIR"' EXIT
-
-                  # MMDB files end with the ASCII string "MaxMind.com" after
-                  # their metadata marker. Verifying this tail before upload
-                  # catches the case where an upstream returns an HTML error
-                  # page or a zero-byte body.
-                  fetch_and_verify() {
-                    local url="$1"
-                    local dest="$2"
-                    echo "-> fetching $url"
-                    curl --fail --location --silent --show-error \
-                         --user-agent 'fluxer-geoip-sync/1.0' \
-                         --max-time 120 \
-                         --output "$dest" \
-                         "$url"
-                    local size
-                    size=$(wc -c < "$dest")
-                    if [ "$size" -lt 1024 ]; then
-                      echo "refusing to upload ${dest}: file is ${size} bytes, too small" >&2
-                      return 1
-                    fi
-                    if ! tail -c 2048 "$dest" | grep -q "MaxMind.com"; then
-                      echo "refusing to upload ${dest}: MaxMind.com marker not found in trailer" >&2
-                      return 1
-                    fi
-                    echo "   ok (${size} bytes)"
-                  }
-
-                  fetch_and_verify "$GEOIP_CITY_UPSTREAM_URL" "$WORKDIR/GeoLite2-City.mmdb"
-                  fetch_and_verify "$GEOIP_ASN_UPSTREAM_URL"  "$WORKDIR/GeoLite2-ASN.mmdb"
-
-                  # Atomic-ish replacement: upload to a versioned side-key
-                  # first, then copy to the canonical key. If the final copy
-                  # fails the previous canonical file is untouched.
-                  STAMP=$(date -u +%Y%m%dT%H%M%SZ)
-
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-City.mmdb" \
-                      "s3://${GEOIP_BUCKET}/archive/GeoLite2-City-${STAMP}.mmdb"
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-ASN.mmdb" \
-                      "s3://${GEOIP_BUCKET}/archive/GeoLite2-ASN-${STAMP}.mmdb"
-
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-City.mmdb" \
-                      "s3://${GEOIP_BUCKET}/GeoLite2-City.mmdb"
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-ASN.mmdb" \
-                      "s3://${GEOIP_BUCKET}/GeoLite2-ASN.mmdb"
-
-                  echo "geoip-sync complete: city=${STAMP} asn=${STAMP}"
@@ -1,278 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ $hosts := .Values.ingress.hosts -}}
-{{ $ports := .Values.ports -}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.api }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api
-                port:
-                  number: {{ $ports.api }}
-
-    - host: {{ $hosts.apiCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api-canary
-                port:
-                  number: {{ $ports.apiCanary }}
-
-    - host: {{ $hosts.appProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: app-proxy
-                port:
-                  number: {{ $ports.appProxy }}
-
-    - host: {{ $hosts.appProxyCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: app-proxy-canary
-                port:
-                  number: {{ $ports.appProxyCanary }}
-
-    - host: {{ $hosts.admin }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: admin
-                port:
-                  number: {{ $ports.admin }}
-
-    - host: {{ $hosts.adminCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: admin-canary
-                port:
-                  number: {{ $ports.adminCanary }}
-
-    - host: {{ $hosts.marketing }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- with $hosts.help }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-{{- with $hosts.blog }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-{{- with $hosts.docs }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: docs
-                port:
-                  number: {{ $ports.docs }}
-
-{{- end }}
-{{- range $hosts.marketingAliases }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-    - host: {{ $hosts.marketingCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing-canary
-                port:
-                  number: {{ $ports.marketingCanary }}
-
-    - host: {{ $hosts.mediaProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: media-proxy
-                port:
-                  number: {{ $ports.mediaProxy }}
-
-    - host: {{ $hosts.staticProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: static-proxy
-                port:
-                  number: {{ $ports.staticProxy }}
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-gateway
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: gateway
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.gateway }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gateway
-                port:
-                  number: {{ $ports.gateway }}
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-api-proxy
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/use-regex: "true"
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.appProxy }}
-      http:
-        paths:
-          - path: /api(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: api
-                port:
-                  number: {{ $ports.api }}
-
-    - host: {{ $hosts.appProxyCanary }}
-      http:
-        paths:
-          - path: /api(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: api-canary
-                port:
-                  number: {{ $ports.apiCanary }}
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-uploads
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "500m"
-    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "900"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: "1m"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-
-    - host: {{ $hosts.uploads }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: uploads
-                port:
-                  number: {{ $ports.uploads }}
@@ -1,26 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nats-config
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-data:
-  nats.conf: |
-    listen: 0.0.0.0:{{ .Values.nats.clientPort }}
-    http: 0.0.0.0:{{ .Values.nats.monitorPort }}
-    max_payload: {{ .Values.nats.maxPayload | default "64MB" }}
-    max_pending: {{ .Values.nats.maxPending | default "128MB" }}
-    max_connections: {{ .Values.nats.maxConnections | default 2048 }}
-
-    cluster {
-      name: fluxer-nats
-      listen: 0.0.0.0:{{ .Values.nats.clusterPort }}
-
-      routes = [
-        {{- range $i := until (int .Values.nats.replicas) }}
-        nats-route://nats-{{ $i }}.nats-headless.{{ $.Values.global.namespace }}.svc.cluster.local:{{ $.Values.nats.clusterPort }}
-        {{- end }}
-      ]
-    }
@@ -1,44 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: nats-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - name: client
-      port: {{ .Values.nats.clientPort }}
-      targetPort: client
-    - name: cluster
-      port: {{ .Values.nats.clusterPort }}
-      targetPort: cluster
-    - name: monitor
-      port: {{ .Values.nats.monitorPort }}
-      targetPort: monitor
-  selector:
-    app.kubernetes.io/name: nats
-    app.kubernetes.io/instance: {{ .Release.Name }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: nats-core
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  type: ClusterIP
-  ports:
-    - name: client
-      port: {{ .Values.nats.clientPort }}
-      targetPort: client
-  selector:
-    app.kubernetes.io/name: nats
-    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -1,63 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: nats
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  serviceName: nats-headless
-  replicas: {{ .Values.nats.replicas }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: nats
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" . | nindent 8 }}
-        app.kubernetes.io/name: nats
-        app.kubernetes.io/instance: {{ .Release.Name }}
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/nats-configmap.yaml") . | sha256sum }}
-    spec:
-      terminationGracePeriodSeconds: 30
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: nats
-          image: {{ .Values.nats.image }}:{{ .Values.nats.tag }}
-          args: ["-c", "/etc/nats/nats.conf"]
-          ports:
-            - name: client
-              containerPort: {{ .Values.nats.clientPort }}
-            - name: cluster
-              containerPort: {{ .Values.nats.clusterPort }}
-            - name: monitor
-              containerPort: {{ .Values.nats.monitorPort }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: monitor
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /healthz?js-enabled-only=true
-              port: monitor
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          volumeMounts:
-            - name: config
-              mountPath: /etc/nats
-          resources:
-            {{- toYaml .Values.nats.resources | nindent 12 }}
-      volumes:
-        - name: config
-          configMap:
-            name: nats-config
@@ -1,14 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: nats-pdb
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-spec:
-  minAvailable: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: nats
-      app.kubernetes.io/instance: {{.Release.Name}}
@@ -1,39 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: valkey-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: valkey
-spec:
-  type: ClusterIP
-  clusterIP: None
-  publishNotReadyAddresses: true
-  ports:
-    - name: valkey
-      port: {{ .Values.valkey.port }}
-      targetPort: valkey
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: {{ .Release.Name }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: valkey
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: valkey
-spec:
-  type: ClusterIP
-  ports:
-    - name: valkey
-      port: {{ .Values.valkey.port }}
-      targetPort: valkey
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -1,60 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: valkey
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: valkey
-spec:
-  serviceName: valkey-headless
-  replicas: {{ .Values.valkey.replicas }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: valkey
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" . | nindent 8 }}
-        app.kubernetes.io/name: valkey
-        app.kubernetes.io/instance: {{ .Release.Name }}
-    spec:
-      terminationGracePeriodSeconds: 15
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: valkey
-          image: {{ .Values.valkey.image }}:{{ .Values.valkey.tag }}
-          command:
-            - valkey-server
-            - --save
-            - ""
-            - --appendonly
-            - "no"
-            - --maxmemory
-            - {{ .Values.valkey.maxmemory | quote }}
-            - --maxmemory-policy
-            - allkeys-lru
-          ports:
-            - name: valkey
-              containerPort: {{ .Values.valkey.port }}
-          livenessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 3
-            periodSeconds: 5
-          resources:
-            {{- toYaml .Values.valkey.resources | nindent 12 }}
@@ -1,74 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the infra release as of 2026-05-17T20:42:44Z.
-# Captured via:  helm -n fluxer get values infra
-# Apply with:    helm upgrade infra deploy/helm/infra -f deploy/helm/infra/values.yaml -f deploy/helm/infra/values.prod.yaml
-
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-ingress:
-  className: nginx
-  hosts:
-    admin: admin.fluxer.app
-    adminCanary: admin.canary.fluxer.app
-    api: api.fluxer.app
-    apiCanary: api.canary.fluxer.app
-    appProxy: web.fluxer.app
-    appProxyCanary: web.canary.fluxer.app
-    gateway: gateway.fluxer.app
-    help: help.fluxer.app
-    blog: blog.fluxer.app
-    docs: docs.fluxer.app
-    marketing: fluxer.app
-    marketingAliases:
-      - www.fluxer.app
-      - fluxerapp.com
-      - www.fluxerapp.com
-      - fluxer.gg
-      - fluxer.gift
-      - fluxer.dev
-      - www.fluxer.dev
-      - every.day.im.fluxer.ing
-    marketingCanary: canary.fluxer.app
-    mediaProxy: fluxerusercontent.com
-    staticProxy: fluxerstatic.com
-nats:
-  clientPort: 4222
-  clusterPort: 6222
-  image: nats
-  maxConnections: 2048
-  monitorPort: 8222
-  replicas: 5
-  resources:
-    limits:
-      memory: 2Gi
-    requests:
-      cpu: 100m
-      memory: 512Mi
-  tag: 2-alpine
-ports:
-  admin: 8080
-  adminCanary: 8080
-  api: 8080
-  apiCanary: 8080
-  appProxy: 8080
-  appProxyCanary: 8080
-  gateway: 8080
-  marketing: 8080
-  marketingCanary: 8080
-  docs: 8080
-  mediaProxy: 8080
-  staticProxy: 8080
-valkey:
-  image: valkey/valkey
-  port: 6379
-  replicas: 1
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 128Mi
-  tag: 8-alpine
@@ -1,91 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-nats:
-  replicas: 3
-  image: nats
-  tag: 2-alpine
-  clientPort: 4222
-  clusterPort: 6222
-  monitorPort: 8222
-  maxPayload: 64MB
-  maxPending: 128MB
-  maxConnections: 2048
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      memory: 2Gi
-
-valkey:
-  replicas: 1
-  image: valkey/valkey
-  tag: 8-alpine
-  port: 6379
-  maxmemory: 1600mb
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      memory: 2Gi
-
-ingress:
-  className: nginx
-  hosts:
-    api: api.fluxer.app
-    apiCanary: api.canary.fluxer.app
-    appProxy: web.fluxer.app
-    appProxyCanary: web.canary.fluxer.app
-    admin: admin.fluxer.app
-    adminCanary: admin.canary.fluxer.app
-    marketing: fluxer.app
-    marketingCanary: canary.fluxer.app
-    mediaProxy: fluxerusercontent.com
-    staticProxy: fluxerstatic.com
-    gateway: gateway.fluxer.app
-    help: help.fluxer.app
-    blog: blog.fluxer.app
-    docs: docs.fluxer.app
-    marketingAliases:
-      - www.fluxer.app
-      - fluxerapp.com
-      - www.fluxerapp.com
-      - fluxer.gg
-      - fluxer.gift
-      - fluxer.dev
-      - www.fluxer.dev
-      - every.day.im.fluxer.ing
-    uploads: uploads.fluxer.app
-
-ports:
-  api: 8080
-  apiCanary: 8080
-  appProxy: 8080
-  appProxyCanary: 8080
-  admin: 8080
-  adminCanary: 8080
-  marketing: 8080
-  marketingCanary: 8080
-  docs: 8080
-  mediaProxy: 8080
-  staticProxy: 8080
-  gateway: 8080
-  uploads: 8080
-
-# MaxMind GeoLite2 sync — daily at 05:17 UTC. Runtime services read
-# these mmdb files out of the CDN bucket.
-geoipSync:
-  image: amazon/aws-cli:2.17.12
-  schedule: '17 5 * * *'
-  activeDeadlineSeconds: 1800
-  backoffLimit: 2
-  bucket: fluxer-geoip
-  cityUpstreamUrl: https://git.io/GeoLite2-City.mmdb
-  asnUpstreamUrl: https://git.io/GeoLite2-ASN.mmdb
-  envSecret: fluxer-env-shared
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: marketing
-description: Fluxer marketing service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
--- a/Show More
+++ b/Show More