fix(admin): omit synthetic accounts from user lookup and search (#2705 )

fix(app): never lower the read-state unread watermark (#2704 )
feat(voice): add audio bitrate guild features and 96 kbps cap (#2703 )
2026-10-10 04:32:34 +09:00 · 2026-09-11 22:06:29 +02:00 · 2026-09-11 22:02:24 +02:00 · 2026-09-11 22:00:15 +02:00 · 2026-09-11 21:28:26 +02:00 · 2026-09-11 21:06:00 +02:00
5900 changed files with 544022 additions and 796992 deletions
@@ -7,16 +7,15 @@ ARG USER_UID=1000
 ARG USER_GID=1000
 ARG NODE_MAJOR=24
 ARG ELP_VERSION=2026-02-27
-ARG HELM_VERSION=4.2.0
 ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.122
+ARG WASM_BINDGEN_VERSION=0.2.123

 ENV DEBIAN_FRONTEND=noninteractive

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends \
+		acl \
 		bash \
-		brotli \
 		build-essential \
 		ca-certificates \
 		clang \
@@ -33,6 +32,7 @@ RUN apt-get update \
 		jq \
 		libasound2 \
 		libatk-bridge2.0-0 \
+		libaom-dev \
 		libavcodec-dev \
 		libavfilter-dev \
 		libavformat-dev \
@@ -42,19 +42,25 @@ RUN apt-get update \
 		libfido2-dev \
 		libgbm1 \
 		libgtk-3-0 \
+		libimage-exiftool-perl \
 		libnotify4 \
 		libnss3 \
 		libpipewire-0.3-dev \
 		libpulse-dev \
 		libsecret-1-0 \
 		libudev-dev \
-		libuv1-dev \
 		libcurl4-openssl-dev \
 		libswresample-dev \
 		libswscale-dev \
+		libdav1d-dev \
+		libde265-dev \
+		liblcms2-dev \
 		libvips-dev \
+		libyuv-dev \
 		libwayland-dev \
 		libwebp-dev \
+		nasm \
+		yasm \
 		libssl-dev \
 		libx11-xcb1 \
 		libxcb-dri3-0 \
@@ -71,16 +77,15 @@ RUN apt-get update \
 		ninja-build \
 		openssh-client \
 		pkg-config \
-		protobuf-compiler \
 		python3 \
 		python3-pip \
-		rsync \
+		python3-venv \
 		sudo \
 		rpm \
 		unzip \
-		webp \
 		xz-utils \
 		xdg-utils \
+		zlib1g-dev \
 		zstd \
 	&& rm -rf /var/lib/apt/lists/*

@@ -90,6 +95,7 @@ RUN apt-get update \
 		bat \
 		btop \
 		docker-cli \
+		docker-compose \
 		dnsutils \
 		fd-find \
 		gdb \
@@ -122,24 +128,32 @@ RUN apt-get update \
 	&& ln -sf /usr/bin/batcat /usr/local/bin/bat \
 	&& rm -rf /var/lib/apt/lists/*

-RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
 	&& corepack enable

-RUN ARCH="$(dpkg --print-architecture)" \
-	&& case "$ARCH" in \
-		amd64) HELM_ARCH="amd64" ;; \
-		arm64) HELM_ARCH="arm64" ;; \
-		*) echo "Unsupported architecture for Helm: $ARCH" >&2; exit 1 ;; \
-	esac \
-	&& curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${HELM_ARCH}.tar.gz" -o /tmp/helm.tgz \
-	&& tar -C /tmp -xzf /tmp/helm.tgz "linux-${HELM_ARCH}/helm" \
-	&& mv "/tmp/linux-${HELM_ARCH}/helm" /usr/local/bin/helm \
-	&& chmod +x /usr/local/bin/helm \
-	&& rm -rf /tmp/helm.tgz "/tmp/linux-${HELM_ARCH}"
+RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

-RUN python3 -m pip install --break-system-packages --no-cache-dir awscli cqlsh
+COPY fluxer_media_proxy/tools/install-native-deps.sh /tmp/fluxer-install-native-deps.sh
+RUN /tmp/fluxer-install-native-deps.sh /usr/local \
+	&& rm /tmp/fluxer-install-native-deps.sh
+
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+RUN printf '%s\n' \
+		'#include <libheif/heif.h>' \
+		'#include <string.h>' \
+		'#if !LIBHEIF_HAVE_VERSION(1, 23, 0)' \
+		'#error the source-built libheif headers must win the include search' \
+		'#endif' \
+		'int main(void) { return strcmp(heif_get_version(), LIBHEIF_VERSION) != 0; }' \
+		>/tmp/fluxer-heif-probe.c \
+	&& cc /tmp/fluxer-heif-probe.c $(pkg-config --cflags --libs libheif) -o /tmp/fluxer-heif-probe \
+	&& /tmp/fluxer-heif-probe \
+	&& [ "$(pkg-config --variable=prefix libheif)" = /usr/local ] \
+	&& rm /tmp/fluxer-heif-probe.c /tmp/fluxer-heif-probe

 COPY tools/fonts/requirements.txt /tmp/fluxer-fonts-requirements.txt
 RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer-fonts-requirements.txt \
@@ -147,18 +161,13 @@ RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer
 	&& pyftsubset --help >/dev/null \
 	&& python3 -c "import fontTools, brotli"

-RUN if ! command -v rebar3 >/dev/null 2>&1; then \
-		curl -fsSL https://s3.amazonaws.com/rebar3/rebar3 -o /usr/local/bin/rebar3 \
-		&& chmod +x /usr/local/bin/rebar3; \
-	fi
-
 RUN ARCH="$(dpkg --print-architecture)" \
 	&& case "$ARCH" in \
 		amd64) ELP_ARCH="x86_64" ;; \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -179,16 +188,13 @@ ENV DOCKER_HOST="unix:///var/run/docker.sock" \
 ENV CC_wasm32_unknown_unknown="clang" \
 	AR_wasm32_unknown_unknown="llvm-ar"

-RUN curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile default --component clippy,rustfmt \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --component clippy,rustfmt \
 	&& rustup target add wasm32-unknown-unknown \
 	&& cargo install cargo-watch --locked \
-	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked
+	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
+	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

 RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
 	&& pnpm --version

-RUN sudo apt-get update \
-	&& sudo apt-get install -y --no-install-recommends python3-venv \
-	&& sudo rm -rf /var/lib/apt/lists/*
-
 WORKDIR /workspaces/fluxer
@@ -5,20 +5,17 @@
 	"workspaceFolder": "/workspaces/fluxer",
 	"shutdownAction": "stopCompose",
 	"remoteUser": "vscode",
+	"hostRequirements": {
+		"cpus": 4,
+		"memory": "8gb",
+		"storage": "32gb"
+	},
 	"remoteEnv": {
 		"DOCKER_HOST": "unix:///var/run/docker.sock"
 	},
 	"runServices": ["workspace", "postgres", "valkey", "nats", "livekit", "meilisearch", "mailpit"],
-	"forwardPorts": [
-		3000, 8088, 8080, 8771, 8082, 3010, 3020, 8100, 8101, 8102, 8103, 8104, 8105, 8106, 8107, 8108, 8109, 8110, 8111,
-		8112, 8113, 8114, 8115, 8116, 8117, 8118, 8119, 8120, 8121, 8122, 8123, 8124, 8125, 3900, 8888, 9333, 9340, 23646,
-		4222, 7700, 7880, 7900, 9200, 8000
-	],
+	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3010, 3020, 8333],
 	"portsAttributes": {
-		"8000": {
-			"label": "Zensical docs",
-			"onAutoForward": "openBrowserOnce"
-		},
 		"8088": {
 			"label": "Fluxer dev proxy",
 			"onAutoForward": "notify"
@@ -29,38 +26,20 @@
 		"3020": {
 			"label": "Fluxer admin"
 		},
-		"8100": {
-			"label": "Fluxer Rust service health"
-		},
-		"3900": {
+		"8333": {
 			"label": "SeaweedFS S3"
 		},
-		"8888": {
-			"label": "SeaweedFS filer"
-		},
-		"9333": {
-			"label": "SeaweedFS master"
-		},
-		"9340": {
-			"label": "SeaweedFS volume"
-		},
-		"23646": {
-			"label": "SeaweedFS admin"
-		},
-		"7880": {
-			"label": "LiveKit"
-		},
-		"7700": {
-			"label": "Meilisearch"
-		},
-		"9200": {
-			"label": "Elasticsearch"
+		"8773": {
+			"label": "Fluxer app proxy"
 		}
 	},
-	"postCreateCommand": "sudo chown -R vscode:vscode /workspaces/fluxer/target && find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -exec sudo chown -R vscode:vscode {} + && sudo chown -R vscode:vscode /home/vscode/.local/share/pnpm && cargo run -p fluxer-dev -- bootstrap",
-	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && cargo run -p fluxer-dev -- post-start && bash /workspaces/fluxer/fluxer_docs/serve.sh --daemon",
+	"postCreateCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- bootstrap",
+	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- post-start",
 	"customizations": {
 		"vscode": {
+			"settings": {
+				"editor.defaultFormatter": "biomejs.biome"
+			},
 			"extensions": [
 				"biomejs.biome",
 				"rust-lang.rust-analyzer",
@@ -68,7 +47,8 @@
 				"TypeScriptTeam.native-preview",
 				"unifiedjs.vscode-mdx",
 				"pgourlain.erlang",
-				"clinyong.vscode-css-modules"
+				"clinyong.vscode-css-modules",
+				"EditorConfig.EditorConfig"
 			]
 		}
 	}
@@ -7,15 +7,29 @@ services:
      dockerfile: .devcontainer/Dockerfile
    command: sleep infinity
    init: true
-    env_file:
-      - ../config/env/development.env
    environment:
-      FLUXER_SEARCH_ENGINE: meilisearch
-      FLUXER_SEARCH_URL: http://meilisearch:7700
-      FLUXER_SEARCH_API_KEY: fluxer-dev-meilisearch
-      FLUXER_POSTGRES_HOST: postgres
-      FLUXER_SELF_HOSTED: "true"
      DOCKER_HOST: unix:///var/run/docker.sock
+      npm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_API_CLIENT_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_APP_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_GATEWAY_ENDPOINT: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/gateway"
+      FLUXER_MEDIA_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_S3_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_LIVEKIT_URL: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/livekit"
+      FLUXER_LIVEKIT_INTERNAL_URL: "http://livekit:7880"
+      FLUXER_LIVEKIT_WEBHOOK_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api/webhooks/livekit"
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin/oauth2_callback"
+      FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: "http://localhost,http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
    volumes:
      - ..:/workspaces/fluxer:cached
      - type: volume
@@ -38,11 +52,6 @@ services:
        target: /workspaces/fluxer/fluxer_desktop/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-marketing-node-modules
-        target: /workspaces/fluxer/fluxer_marketing/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-admin-node-modules
        target: /workspaces/fluxer/fluxer_admin/node_modules
@@ -241,45 +250,31 @@ services:
        source: ${FLUXER_DOCKER_SOCKET:-/var/run/docker.sock}
        target: /var/run/docker.sock
    ports:
-      - "${FLUXER_DEV_DOCS_PORT:-8000}:8000"
-      - "${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
-      - "${FLUXER_DEV_PROXY_PORT:-8088}:8088"
-      - "${FLUXER_DEV_APP_PROXY_PORT:-8080}:8080"
-      - "${FLUXER_DEV_API_PORT:-8771}:8771"
-      - "${FLUXER_DEV_GATEWAY_PORT:-8082}:8082"
-      - "${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
-      - "${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
-      - "${FLUXER_DEV_RUST_SERVICE_PORTS:-8100-8125}:8100-8125"
-      - "${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
-      - "${FLUXER_DEV_SEAWEEDFS_FILER_PORT:-8888}:8888"
-      - "${FLUXER_DEV_SEAWEEDFS_MASTER_PORT:-9333}:9333"
-      - "${FLUXER_DEV_SEAWEEDFS_VOLUME_PORT:-9340}:9340"
-      - "${FLUXER_DEV_SEAWEEDFS_ADMIN_PORT:-23646}:23646"
+      - "127.0.0.1:${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
+      - "127.0.0.1:${FLUXER_DEV_PROXY_PORT:-8088}:8088"
+      - "127.0.0.1:${FLUXER_DEV_API_PORT:-8080}:8080"
+      - "127.0.0.1:${FLUXER_DEV_GATEWAY_PORT:-8771}:8771"
+      - "127.0.0.1:${FLUXER_DEV_MEDIA_PROXY_PORT:-8082}:8082"
+      - "127.0.0.1:${FLUXER_DEV_APP_PROXY_PORT:-8773}:8773"
+      - "127.0.0.1:${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
+      - "127.0.0.1:${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
+      - "127.0.0.1:${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
    depends_on:
-      - postgres
-      - valkey
-      - nats
-      - livekit
-      - meilisearch
-      - mailpit
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_started
+      nats:
+        condition: service_started
+      livekit:
+        condition: service_started
+      meilisearch:
+        condition: service_healthy
+      mailpit:
+        condition: service_started
    extra_hosts:
      - "host.docker.internal:host-gateway"

-  cassandra:
-    image: cassandra:5.0.8
-    profiles:
-      - full
-    environment:
-      CASSANDRA_CLUSTER_NAME: fluxer-dev
-      CASSANDRA_DC: datacenter1
-      CASSANDRA_ENDPOINT_SNITCH: GossipingPropertyFileSnitch
-      HEAP_NEWSIZE: 128M
-      MAX_HEAP_SIZE: 768M
-    volumes:
-      - cassandra-data:/var/lib/cassandra
-    ports:
-      - "${FLUXER_DEV_CASSANDRA_PORT:-9042}:9042"
-
  postgres:
    image: postgres:16-alpine
    environment:
@@ -289,13 +284,19 @@ services:
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
-      - "${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+      - "127.0.0.1:${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U fluxer -d fluxer"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  valkey:
    image: valkey/valkey:8.1.7-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
-      - "${FLUXER_DEV_VALKEY_PORT:-6379}:6379"
+      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
    image: nats:2.14.2-alpine
@@ -303,33 +304,22 @@ services:
    volumes:
      - nats-data:/data
    ports:
-      - "${FLUXER_DEV_NATS_PORT:-4222}:4222"
-      - "${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_PORT:-4222}:4222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"

  livekit:
    image: livekit/livekit-server:v1.12.0
    command: ["--config", "/etc/livekit.yaml", "--bind", "0.0.0.0"]
+    environment:
+      LIVEKIT_RTC_TCP_PORT: "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      LIVEKIT_RTC_UDP_PORT_START: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
+      LIVEKIT_RTC_UDP_PORT_END: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml:ro
    ports:
-      - "${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
-      - "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:7881"
-      - "${FLUXER_DEV_LIVEKIT_UDP_PORTS:-7882-7892}:7882-7892/udp"
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:9.3.2
-    profiles:
-      - full
-    environment:
-      discovery.type: single-node
-      xpack.security.enabled: "true"
-      xpack.security.http.ssl.enabled: "false"
-      ELASTIC_PASSWORD: fluxer-dev-elasticsearch
-      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
-    volumes:
-      - elasticsearch-data:/usr/share/elasticsearch/data
-    ports:
-      - "${FLUXER_DEV_ELASTICSEARCH_PORT:-9200}:9200"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
    image: getmeili/meilisearch:v1.12
@@ -339,7 +329,13 @@ services:
    volumes:
      - meilisearch-data:/meili_data
    ports:
-      - "${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+      - "127.0.0.1:${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:7700/health"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  mailpit:
    image: axllent/mailpit:v1.30
@@ -358,7 +354,6 @@ volumes:
  fluxer-api-node-modules:
  fluxer-app-node-modules:
  fluxer-desktop-node-modules:
-  fluxer-marketing-node-modules:
  fluxer-admin-node-modules:
  package-config-node-modules:
  package-constants-node-modules:
@@ -400,9 +395,7 @@ volumes:
  cargo-registry:
  cargo-git:
  rust-target:
-  cassandra-data:
  nats-data:
-  elasticsearch-data:
  meilisearch-data:
  mailpit-data:
  postgres-data:
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: AGPL-3.0-or-later

-set -uo pipefail
+set -euo pipefail

 SOCKET="${DOCKER_SOCKET:-/var/run/docker.sock}"
-USER_NAME="${USER:-vscode}"
+USER_NAME="$(id -un)"

 if [ ! -S "$SOCKET" ]; then
 	echo "fix-docker-socket: no socket at $SOCKET; skipping (Docker-in-devcontainer will not work)"
@@ -16,31 +16,11 @@ if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
 	exit 0
 fi

-socket_gid="$(stat -c '%g' "$SOCKET" 2>/dev/null || echo "")"
-if [ -z "$socket_gid" ]; then
-	echo "fix-docker-socket: could not stat $SOCKET; skipping" >&2
-	exit 0
-fi
-
-sudo sh -c '
-	set -e
-	gid="$1"
-	user="$2"
-	socket="$3"
-	if ! getent group "$gid" >/dev/null 2>&1; then
-		groupadd --gid "$gid" docker-host
-	fi
-	group_name="$(getent group "$gid" | cut -d: -f1)"
-	usermod --append --groups "$group_name" "$user"
-	chgrp "$gid" "$socket"
-	chmod g+rw "$socket"
-' sh "$socket_gid" "$USER_NAME" "$SOCKET" || {
-	echo "fix-docker-socket: could not adjust $SOCKET; run docker with sudo" >&2
-	exit 0
-}
+sudo setfacl --modify "user:${USER_NAME}:rw" "$SOCKET"

 if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
-	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME (gid $socket_gid)"
+	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME"
 else
-	echo "fix-docker-socket: $SOCKET still unreachable as $USER_NAME; run docker with sudo" >&2
+	echo "fix-docker-socket: $SOCKET is still unreachable as $USER_NAME" >&2
+	exit 1
 fi
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -euo pipefail
+
+owner="$(id -u):$(id -g)"
+
+repair_tree() {
+	local path="$1"
+	local unwritable
+	if [ ! -d "$path" ]; then
+		echo "fix-workspace-permissions: expected mount is missing: $path" >&2
+		exit 1
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		sudo find "$path" -xdev \( -type d -o -type f \) -exec chown "$owner" {} +
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		echo "fix-workspace-permissions: $path is not writable as $(id -un)" >&2
+		exit 1
+	fi
+}
+
+for path in \
+	/workspaces/fluxer/target \
+	/home/vscode/.cargo/registry \
+	/home/vscode/.cargo/git \
+	/home/vscode/.local \
+	/home/vscode/.local/share/pnpm/store; do
+	repair_tree "$path"
+done
+
+while IFS= read -r -d '' path; do
+	if mountpoint -q "$path"; then
+		repair_tree "$path"
+	fi
+done < <(find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -print0)
@@ -1,11 +1,10 @@
 port: 7880

 keys:
-  devkey: secret
+  devkey: fluxer-livekit-development-secret

 rtc:
  tcp_port: 7881
-  udp_port: 7882-7892
  node_ip: 127.0.0.1
  use_mdns: true
  stun_servers:
@@ -7,10 +7,16 @@ QUICK=0
 SKIP_INSTALL=0
 for arg in "$@"; do
 	case "$arg" in
-		--quick) QUICK=1 ;;
-		--skip-install) SKIP_INSTALL=1 ;;
-		-h|--help) sed -n '2,25p' "$0"; exit 0 ;;
-		*) echo "unknown argument: $arg" >&2; exit 2 ;;
+	--quick) QUICK=1 ;;
+	--skip-install) SKIP_INSTALL=1 ;;
+	-h | --help)
+		sed -n '2,25p' "$0"
+		exit 0
+		;;
+	*)
+		echo "unknown argument: $arg" >&2
+		exit 2
+		;;
 	esac
 done

@@ -64,6 +70,7 @@ stage "app: typecheck" pnpm --filter fluxer_app typecheck
 stage "app: unit tests" pnpm --filter fluxer_app exec vitest run

 if [ "$QUICK" -eq 0 ]; then
+	stage "desktop: typecheck" pnpm --filter fluxer_desktop typecheck
 	stage "app: production build" pnpm --filter fluxer_app build
 fi

@@ -71,7 +78,7 @@ stage "rust: fmt" cargo fmt --all -- --check
 if [ "$QUICK" -eq 0 ]; then
 	stage "rust: clippy (workspace)" cargo clippy --workspace --all-targets -- -D warnings
 else
-	stage "rust: clippy (servers)" cargo clippy -p fluxer_app_proxy -p fluxer_admin -p fluxer_marketing --all-targets -- -D warnings
+	stage "rust: clippy (servers)" cargo clippy -p fluxer_app_proxy -p fluxer_admin --all-targets -- -D warnings
 fi
 stage "rust: app proxy tests" cargo test -p fluxer_app_proxy

@@ -5,8 +5,11 @@
 /.direnv/
 /.fluxer/
 /.git/
+**/.git
+**/.git/**
 /.github/
 /.pnpm-store/
+/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -26,7 +29,8 @@
 **/node_modules/
 **/target/
 **/test-results.json
-/fluxer_docs/site/
+/fluxer_docs/dist/
+/fluxer_docs/.astro/
 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
@@ -46,13 +50,9 @@

 /app-dist-output/
 /artifacts/
-/release-input/
-/release-out/
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 /fluxer_desktop/

@@ -0,0 +1,7 @@
+/.github/CODEOWNERS @fluxerapp/developers
+/.github/workflows/ @fluxerapp/developers
+/fluxer_marketing @fluxerapp/developers
+/.gitmodules @fluxerapp/developers
+/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
+/packages/i18n/marketing/ @fluxerapp/developers
+/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -25,7 +25,7 @@ Closes #456

 You must understand every line you submit and be able to explain why the change is correct.

-The [LLM usage policy](LLM_USAGE_POLICY.md) defines the authorship requirements for contributors who do not have write access.
+The [LLM usage policy](https://github.com/fluxerapp/fluxer/blob/main/.github/LLM_USAGE_POLICY.md) defines the authorship requirements for contributors who do not have write access.

 Each contribution must contain one coherent change. Do not include unrelated fixes, refactoring or formatting changes.

@@ -80,12 +80,30 @@ Complete every section of the pull request template. Clearly describe:

 Use the [bug report form](https://github.com/fluxerapp/fluxer/issues/new?template=bug-report.yaml) to report reproducible defects.

-Report security vulnerabilities privately through the channels specified in the [security policy](SECURITY.md). Do not report vulnerabilities in public issues or discussions.
+Report security vulnerabilities privately through the channels specified in the [security policy](https://github.com/fluxerapp/fluxer/blob/main/.github/SECURITY.md). Do not report vulnerabilities in public issues or discussions.

 Use [discussions](https://github.com/orgs/fluxerapp/discussions) for feature proposals and self-hosting questions.

 Submit translations through [Weblate](https://weblate.fluxer.tools), not through pull requests.

-All repository activity is governed by the [Code of Conduct](CODE_OF_CONDUCT.md).
+All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

-Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](../LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
+Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
+
+## Private marketing project
+
+The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
+
+Authorized maintainers can initialize only that submodule and install its independent dependencies:
+
+```sh
+./scripts/setup-private-marketing.sh
+pnpm --dir fluxer_marketing install --frozen-lockfile
+cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
+```
+
+To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
+
+```sh
+FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
+```
@@ -8,11 +8,11 @@ External contributions do not grant voting rights, commit access, employment or

 ## Licence and contributor rights

-Source code owned by Fluxer Platform AB in this repository is distributed under the [GNU Affero General Public License, version 3.0 or later](../LICENSE). The licence permits its use, modification and redistribution subject to its terms.
+Source code owned by Fluxer Platform AB in this repository is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). The licence permits its use, modification and redistribution subject to its terms.

 Fluxer Platform AB does not require contributors to sign a contributor licence agreement or assign their copyright. Contributors retain the copyright in their work.

-Every commit made by a contributor must include the [Developer Certificate of Origin](https://developercertificate.org) sign-off required by the [contributing guidelines](CONTRIBUTING.md). Pull requests opened by Fluxer repository automation are exempt from this requirement.
+Every commit made by a contributor must include the [Developer Certificate of Origin](https://developercertificate.org) sign-off required by the [contributing guidelines](https://github.com/fluxerapp/fluxer/blob/main/.github/CONTRIBUTING.md). Pull requests opened by Fluxer repository automation are exempt from this requirement.

 ## Name and marks

@@ -36,8 +36,7 @@ body:
      label: Build information
      description: >-
        Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard. On mobile,
-        select the build information at the bottom of the settings list.
+        the build information. Fluxer copies it to the clipboard.
    validations:
      required: true

@@ -1,15 +1,15 @@
 # yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
 blank_issues_enabled: false
 contact_links:
+  - name: Mobile client bugs
+    url: https://github.com/fluxerapp/flutter_client#bug-reporting
+    about: Read the reporting instructions for the Fluxer mobile client.
  - name: Account and billing support
    url: https://fluxer.app/help
    about: Find account help and support contact details.
  - name: Feature proposals
    url: https://github.com/orgs/fluxerapp/discussions
    about: Propose a feature in a discussion.
-  - name: Security vulnerabilities
-    url: https://github.com/fluxerapp/fluxer/security/advisories/new
-    about: Submit a private vulnerability report.
  - name: Translations
    url: https://weblate.fluxer.tools
    about: Improve an existing locale or start a new one.
@@ -129,7 +129,7 @@ Deliberately submitting a fabricated security report MAY result in an immediate

 Maintainers are not required to investigate possible LLM use proactively. Writing style alone is not evidence of a violation.

-A person MUST NOT publicly accuse or harass a contributor because of suspected LLM use. All discussion, review and enforcement under this policy MUST comply with the [Code of Conduct](CODE_OF_CONDUCT.md).
+A person MUST NOT publicly accuse or harass a contributor because of suspected LLM use. All discussion, review and enforcement under this policy MUST comply with the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 ## 11. Normative References

@@ -1,10 +1,5 @@
 self-hosted-runner:
  labels:
-    - blacksmith-4vcpu-ubuntu-2404
-    - blacksmith-4vcpu-ubuntu-2404-arm
-    - blacksmith-32vcpu-ubuntu-2404
-    - blacksmith-32vcpu-ubuntu-2404-arm
-    - blacksmith-32vcpu-windows-2025
    - fluxer-desktop-macos-arm64

 config-variables: null
@@ -24,7 +24,9 @@ f:gateway:
    - any-glob-to-any-file: fluxer_gateway/**/*
 f:marketing:
  - changed-files:
-    - any-glob-to-any-file: fluxer_marketing/**/*
+    - any-glob-to-any-file:
+      - fluxer_marketing
+      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
@@ -32,17 +32,15 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this image fragment is uploaded. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-
 permissions:
  actions: read
  contents: write
  packages: write

+concurrency:
+  group: publish-${{ inputs.image }}
+  cancel-in-progress: false
+
 defaults:
  run:
    shell: bash
@@ -55,6 +53,8 @@ jobs:
    name: resolve metadata
    runs-on: ubuntu-24.04
    timeout-minutes: 5
+    permissions:
+      contents: read
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
@@ -65,13 +65,22 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
      - name: set variables
        id: vars
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
+          tools/ci/run.sh resolve-calver
          --github-output

  build:
@@ -79,37 +88,46 @@ jobs:
    needs: meta
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: amd64
-            runner: blacksmith-4vcpu-ubuntu-2404
+            runner: ubuntu-24.04
          - platform: arm64
-            runner: blacksmith-4vcpu-ubuntu-2404-arm
+            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}
      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
-          provenance: false
+          provenance: mode=min
          platforms: linux/${{ matrix.platform }}
          tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
            ${{ inputs.extra-build-args }}
-          cache-from: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }}
-          cache-to: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }},mode=max,ignore-error=true
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -119,6 +137,9 @@ jobs:
    needs: [meta, build]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
+    permissions:
+      contents: write
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -132,71 +153,49 @@ jobs:
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}
      - name: create and push multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
          VERSION: ${{ needs.meta.outputs.build_version }}
-          MOVING_TAGS: ${{ inputs.moving-tags }}
        run: |
          set -euo pipefail
-          tag_args=( "-t" "${IMAGE}:${VERSION}" )
-          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
-          for raw in "${moving[@]}"; do
-            t="$(echo "$raw" | xargs)"
-            [ -n "$t" ] && tag_args+=( "-t" "${IMAGE}:${t}" )
-          done
-          docker buildx imagetools create "${tag_args[@]}" \
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
            "${IMAGE}:${VERSION}-amd64" \
            "${IMAGE}:${VERSION}-arm64"
          docker buildx imagetools inspect "${IMAGE}:${VERSION}"

-      - name: Write GitHub release image fragment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_REF: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
-          MOVING_TAGS: ${{ inputs.moving-tags }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-image
-          --build-version "${VERSION}"
-          --image "${{ inputs.image }}"
-          --image-ref "${IMAGE_REF}"
-          --moving-tags "${MOVING_TAGS}"
-      - name: Upload GitHub release fragment
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
-          name: release-fragment-${{ inputs.image }}
-          path: release-out/fragments/fluxer-release-fragment-image-${{ inputs.image }}.json
-          if-no-files-found: error
-          retention-days: 14
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component "${{ inputs.image }}"
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"

-  finalise:
-    name: finalise GitHub release
-    if: ${{ inputs['finalise-release'] }}
-    needs: [meta, merge]
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - name: Advance moving image tags
        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-      - name: finalise GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
+          MOVING_TAGS: ${{ inputs.moving-tags }}
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
+          tools/ci/run.sh image-set
+          promote
+          --component "${{ inputs.image }}"
          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags "${MOVING_TAGS}"
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-admin
      dockerfile: fluxer_admin/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-api
      dockerfile: fluxer_api/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,38 +9,23 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy-self-hosted
+  cancel-in-progress: false
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -48,14 +33,209 @@ jobs:
      - name: approved
        run: echo "Build release approved."

-  build:
+  meta:
+    name: resolve metadata
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
-    uses: ./.github/workflows/_build-image.yaml
-    with:
-      image: fluxer-app-proxy-self-hosted
-      dockerfile: fluxer_app_proxy/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-      extra-build-args: |
-        FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      build_version: ${{ steps.vars.outputs.build_version }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: "1.93.0"
+      - name: set variables
+        id: vars
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step set_metadata
+          --build-version "${{ inputs['build-version'] }}"
+
+  dist:
+    name: build the canonical asset tree
+    needs: meta
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    env:
+      IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/fluxer-app-proxy-self-hosted
+      BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+      PUBLIC_ASSET_BASE_URL: ""
+      BUNDLE_LOCAL_ASSETS: "true"
+      FLUXER_APP_PROXY_TIME_FREEZE_ENABLED: "false"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: "1.93.0"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build the dist once and publish it as the canonical asset image
+        env:
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_dist
+
+      - name: generate asset manifest
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step generate_asset_manifest
+
+      - name: verify every manifest asset ships in the image
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build ${{ matrix.platform }}
+    needs: [meta, dist]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: amd64
+            runner: ubuntu-24.04
+          - platform: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+        with:
+          context: .
+          file: fluxer_app_proxy/Dockerfile
+          push: true
+          provenance: false
+          platforms: linux/${{ matrix.platform }}
+          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
+          build-args: |
+            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+
+  merge:
+    name: merge multi-arch manifest
+    needs: [meta, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: "1.93.0"
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-amd64
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
+      - name: create and push multi-arch manifest
+        env:
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"
+
+      - name: Advance moving image tags
+        env:
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -9,41 +9,23 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy
+  cancel-in-progress: false
+
 env:
  GHCR_OWNER: ${{ github.repository_owner }}

 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -54,9 +36,10 @@ jobs:
  meta:
    name: resolve metadata
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    runs-on: ubuntu-24.04
    timeout-minutes: 5
+    permissions:
+      contents: read
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
@@ -70,15 +53,19 @@ jobs:
      - name: set variables
        id: vars
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step set_metadata
          --build-version "${{ inputs['build-version'] }}"

-  build:
-    name: build app-proxy (amd64)
+  dist:
+    name: build and publish the canonical asset tree
    needs: meta
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 45
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -89,7 +76,7 @@ jobs:
          toolchain: "1.93.0"
      - name: prepare docker config
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
      - name: configure ghcr auth
@@ -97,52 +84,106 @@ jobs:
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step configure_ghcr_auth

-      - name: build and push image + extract assets
+      - name: build the dist once and publish it as the canonical asset image
        env:
          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
-          CACHE_FROM: type=gha,scope=fluxer-app-proxy
-          CACHE_TO: type=gha,scope=fluxer-app-proxy,mode=max
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
-          --step build_and_extract
+          tools/ci/run.sh build-app-proxy
+          --step build_dist

      - name: generate asset manifest
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step generate_asset_manifest

-      - name: Upload asset manifest handoff
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: app-proxy-assets-manifest
-          path: app-dist-output/dist/assets-manifest.txt
-          if-no-files-found: error
-
      - name: upload assets to S3 static bucket
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_ENDPOINT: https://ewr1.vultrobjects.com
-          STATIC_BUCKET: fluxer-static
+          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
+          S3_ENDPOINT: ${{ vars.STATIC_S3_ENDPOINT }}
+          STATIC_BUCKET: ${{ vars.STATIC_S3_BUCKET }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step upload_assets

-  build-arm64:
-    name: build app-proxy (arm64)
-    needs: meta
-    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
-    timeout-minutes: 60
+      - name: verify every uploaded asset is readable
+        env:
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build app-proxy (amd64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: "1.93.0"
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build and push image
+        env:
+          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+          SOURCE_SHA: ${{ github.sha }}
+          SOURCE_DATE: ${{ steps.source.outputs.date }}
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_image
+
+  build-arm64:
+    name: build app-proxy (arm64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
        with:
@@ -159,10 +200,12 @@ jobs:
          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
-            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
-            BUNDLE_LOCAL_ASSETS=false
-          cache-from: type=gha,scope=fluxer-app-proxy-arm64
-          cache-to: type=gha,scope=fluxer-app-proxy-arm64,mode=max,ignore-error=true
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -171,7 +214,10 @@ jobs:
    name: merge multi-arch manifest
    needs: [meta, build, build-arm64]
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        env:
@@ -180,17 +226,21 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
-      - name: Download app-proxy asset manifest
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          name: app-proxy-assets-manifest
-          path: release-input/app-proxy
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
      - name: fuse amd64 + arm64 into a multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
@@ -201,58 +251,40 @@ jobs:
          echo "amd64 digest: ${amd64_digest}"
          docker buildx imagetools create \
            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:v1" \
-            -t "${IMAGE}:latest" \
            "${IMAGE}@${amd64_digest}" \
            "${IMAGE}:${VERSION}-arm64"
          docker buildx imagetools inspect "${IMAGE}:${VERSION}"

-      - name: Write GitHub release app-proxy fragment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-app-proxy
-          --build-version "${VERSION}"
-          --image fluxer-app-proxy
-          --image-ref "${IMAGE_REF}"
-          --moving-tags "v1,latest"
-          --asset-manifest release-input/app-proxy/assets-manifest.txt
-      - name: Upload GitHub release fragment
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
-          name: release-fragment-fluxer-app-proxy
-          path: release-out/fragments/fluxer-release-fragment-app-proxy.json
-          if-no-files-found: error
-          retention-days: 14
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"

-  finalise:
-    name: finalise GitHub release
-    if: ${{ inputs['finalise-release'] != false }}
-    needs: [meta, merge]
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - name: Advance moving image tags
        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-      - name: finalise GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy
          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -22,7 +22,7 @@ on:
        default: ""
        type: string
      skip_targets:
-        description: Comma-separated platforms or targets to skip, such as windows, macos-arm64, linux-x64.
+        description: Comma-separated platforms or targets to skip, such as windows, macos, linux-x64.
        required: false
        default: ""
        type: string
@@ -46,6 +46,8 @@ jobs:
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
    timeout-minutes: 25
+    permissions:
+      contents: read
    outputs:
      version: ${{ steps.meta.outputs.version }}
      pub_date: ${{ steps.meta.outputs.pub_date }}
@@ -65,10 +67,19 @@ jobs:
        with:
          toolchain: "1.93.0"

+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
      - name: Set metadata
        id: meta
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
          FLUXER_BUILD_VERSION: ${{ inputs.build_version }}
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
@@ -81,6 +92,8 @@ jobs:
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
    timeout-minutes: 25
+    permissions:
+      contents: read
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
@@ -106,7 +119,11 @@ jobs:
      - matrix
    runs-on: ${{ matrix.os }}
    environment: desktop-releases
-    timeout-minutes: 60
+    timeout-minutes: 180
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
@@ -122,10 +139,10 @@ jobs:
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_BUCKET: fluxer-downloads
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
+      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
@@ -233,7 +250,7 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
-          targets: ${{ matrix.platform == 'macos' && (matrix.arch == 'arm64' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin') || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}
+          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
        if: matrix.platform == 'windows' && matrix.arch == 'arm64'
@@ -460,8 +477,8 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

-      - name: Normalize updater YAML (arm64)
-        if: matrix.arch == 'arm64'
+      - name: Normalize updater YAML (macOS)
+        if: matrix.platform == 'macos'
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step normalise_updater_yaml
@@ -491,7 +508,9 @@ jobs:
      - build
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 60
+    timeout-minutes: 180
+    permissions:
+      contents: read
    env:
      CHANNEL: ${{ needs.meta.outputs.build_channel }}
      DISPLAY_CHANNEL: ${{ needs.meta.outputs.channel }}
@@ -505,11 +524,13 @@ jobs:
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_BUCKET: fluxer-downloads
+      DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
+      DESKTOP_METADATA_PREFIX: _handoff/desktop-metadata/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
+      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
+      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -534,51 +555,61 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_payload

+      - name: Prepare GitHub release assets
+        if: needs.meta.outputs.test_build != 'true'
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step prepare_release_assets
+
+      - name: Publish GitHub release descriptor
+        if: needs.meta.outputs.test_build != 'true'
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step publish_release_descriptor
+
      - name: Upload payload to S3
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step upload_payload

+      - name: Upload GitHub release asset handoff
+        if: needs.meta.outputs.test_build != 'true'
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step upload_release_assets
+
      - name: Build summary
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Write GitHub release desktop fragment
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-desktop
-          --build-version "${{ needs.meta.outputs.version }}"
-          --channel "${{ needs.meta.outputs.build_channel }}"
-          --test-build "${{ needs.meta.outputs.test_build }}"
-          --s3-prefix "${{ needs.meta.outputs.s3_prefix }}"
-          --payload-root s3_payload
-          --source-sha "${{ needs.meta.outputs.source_sha }}"
-      - name: Upload GitHub release fragment
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: release-fragment-desktop
-          path: release-out/fragments/fluxer-release-fragment-desktop-${{ needs.meta.outputs.build_channel }}.json
-          if-no-files-found: error
-          retention-days: 14
-
      - name: Cleanup S3 handoff
        if: ${{ success() }}
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step cleanup_handoff

-  finalise_release:
-    name: Finalise GitHub desktop release
+  publish_release:
+    name: Publish GitHub desktop release
    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
    needs:
      - meta
      - upload
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 10
+    timeout-minutes: 60
+    permissions:
+      contents: write
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
+      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
+      DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
+      DESKTOP_METADATA_PREFIX: _handoff/desktop-metadata/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
+      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
+      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -589,18 +620,51 @@ jobs:
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true

-      - name: Finalise GitHub desktop release
-        env:
-          GH_TOKEN: ${{ github.token }}
+      - name: Download GitHub release assets
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${{ needs.meta.outputs.version }}"
-          --source-sha "${{ needs.meta.outputs.source_sha }}"
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step download_release_assets
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub desktop release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          CHANNEL: ${{ needs.meta.outputs.build_channel }}
+          VERSION: ${{ needs.meta.outputs.version }}
+          SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: |
+          set -euo pipefail
+          release_args=(
+            release publish
+            --component "fluxer-desktop-${CHANNEL}"
+            --build-version "${VERSION}"
+            --source-sha "${SOURCE_SHA}"
+            --previous-sha "${RELEASE_BASELINE_SHA}"
+            --asset-dir release_assets
+          )
+          if [[ "${CHANNEL}" == "canary" ]]; then
+            release_args+=(--prerelease)
+          fi
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- "${release_args[@]}"
+
+      - name: Publish GitHub release readiness marker
+        env:
+          SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step publish_release_marker
+
+      - name: Publish payload metadata to S3
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step publish_payload_metadata
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,12 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-docs
      dockerfile: fluxer_docs/Dockerfile
-      context: fluxer_docs
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-gateway
      dockerfile: fluxer_gateway/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-gifs
      dockerfile: fluxer_gifs/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -1,60 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: build marketing
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true
-
-permissions:
-  actions: read
-  contents: write
-  packages: write
-
-jobs:
-  approve:
-    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 5
-    steps:
-      - name: approved
-        run: echo "Build release approved."
-
-  image:
-    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
-    uses: ./.github/workflows/_build-image.yaml
-    with:
-      image: fluxer-marketing
-      dockerfile: fluxer_marketing/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-media-proxy
      dockerfile: fluxer_media_proxy/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-messages
      dockerfile: fluxer_messages/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-snowflakes
      dockerfile: fluxer_snowflakes/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-static
      dockerfile: fluxer_static/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-unfurl
      dockerfile: fluxer_unfurl/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -9,28 +9,6 @@ on:
        type: string
        required: false
        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-  workflow_call:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-      finalise-release:
-        description: "Publish the GitHub Release after this workflow completes. Set false when an orchestrator will finalise the release."
-        type: boolean
-        required: false
-        default: true
-      approval-required:
-        description: "Require the protected builds environment approval before this build runs."
-        type: boolean
-        required: false
-        default: true

 permissions:
  actions: read
@@ -40,7 +18,7 @@ permissions:
 jobs:
  approve:
    name: approve build release
-    if: ${{ format('{0}', inputs['approval-required']) != 'false' }}
+    permissions: {}
    runs-on: ubuntu-24.04
    environment: builds
    timeout-minutes: 5
@@ -50,11 +28,9 @@ jobs:

  image:
    needs: approve
-    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
    with:
      image: fluxer-users
      dockerfile: fluxer_users/Dockerfile
      build-version: ${{ inputs['build-version'] }}
-      finalise-release: ${{ inputs['finalise-release'] != false }}
-    secrets: inherit
@@ -39,7 +39,7 @@ jobs:

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Generate OpenAPI schemas
@@ -1,473 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: deploy service
-
-on:
-  workflow_dispatch:
-    inputs:
-      service:
-        description: "Helm chart name to deploy"
-        type: choice
-        required: true
-        options:
-          - api
-          - app-proxy
-          - admin
-          - docs
-          - marketing
-          - media-proxy
-          - gateway
-          - messages
-          - search
-          - snowflakes
-          - users
-          - unfurl
-          - uploads
-          - worker
-      channel:
-        description: "Release channel (stable or canary)"
-        type: choice
-        required: true
-        options:
-          - stable
-          - canary
-      image-tag:
-        description: "Docker image tag to deploy (Fluxer CalVer: YYYY.MDD.MICRO)"
-        type: string
-        required: true
-      build-version:
-        description: "Fluxer CalVer build version to inject into runtime env vars"
-        type: string
-        required: false
-        default: ""
-      allow-rollback:
-        description: "Allow deploying an older image tag than the newest GHCR tag"
-        type: boolean
-        required: false
-        default: false
-  workflow_call:
-    inputs:
-      service:
-        description: "Helm chart name to deploy"
-        type: string
-        required: true
-      channel:
-        description: "Release channel (stable or canary)"
-        type: string
-        required: true
-      image-tag:
-        description: "Docker image tag to deploy (Fluxer CalVer: YYYY.MDD.MICRO)"
-        type: string
-        required: true
-      build-version:
-        description: "Fluxer CalVer build version to inject into runtime env vars"
-        type: string
-        required: false
-        default: ""
-      allow-rollback:
-        description: "Allow deploying an older image tag than the newest GHCR tag"
-        type: boolean
-        required: false
-        default: false
-    secrets:
-      KUBE_CONFIG:
-        required: true
-      GHCR_USERNAME:
-        required: false
-      GHCR_TOKEN:
-        required: false
-
-env:
-  GHCR_OWNER: ${{ github.repository_owner }}
-  GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
-
-jobs:
-  deploy:
-    name: deploy ${{ inputs.service }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    environment: ${{ inputs.channel }}
-    permissions:
-      contents: read
-      packages: read
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: install helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-
-      - name: configure kubectl
-        shell: bash
-        env:
-          KUBE_CONFIG_B64: ${{ secrets.KUBE_CONFIG }}
-        run: |
-          mkdir -p "$HOME/.kube"
-          printf '%s' "$KUBE_CONFIG_B64" | base64 -d > "$HOME/.kube/config"
-          chmod 600 "$HOME/.kube/config"
-
-      - name: resolve helm args
-        id: helm
-        shell: bash
-        env:
-          INPUT_SERVICE: ${{ inputs.service }}
-          INPUT_CHANNEL: ${{ inputs.channel }}
-          INPUT_IMAGE_TAG: ${{ inputs['image-tag'] }}
-          INPUT_BUILD_VERSION: ${{ inputs['build-version'] }}
-        run: |
-          SERVICE="$INPUT_SERVICE"
-          CHANNEL="$INPUT_CHANNEL"
-          TAG="$INPUT_IMAGE_TAG"
-          BUILD_VERSION="$INPUT_BUILD_VERSION"
-          GHCR_REGISTRY="${GHCR_REGISTRY:?GHCR_REGISTRY is required}"
-          if [[ -z "$BUILD_VERSION" ]]; then
-            BUILD_VERSION="$TAG"
-          fi
-          CALVER_RE='^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.(0|[1-9][0-9]{0,5})$'
-          if [[ ! "$TAG" =~ $CALVER_RE ]]; then
-            echo "::error::image-tag must be a Fluxer CalVer tag (YYYY.MDD.MICRO). Channel tags, latest tags, and suffixed tags are not deployable."
-            exit 1
-          fi
-          if [[ ! "$BUILD_VERSION" =~ $CALVER_RE ]]; then
-            echo "::error::build-version must be a Fluxer CalVer value (YYYY.MDD.MICRO)."
-            exit 1
-          fi
-          CHART_DIR="./deploy/helm/${SERVICE}"
-          VALUES_ARGS="-f ${CHART_DIR}/values.yaml"
-          SETS=""
-          BUILD_PATHS=""
-          DEPLOY_IMAGE=""
-          SYNC_WORKER_RELEASE=""
-          SYNC_WORKER_CHART_DIR=""
-          SYNC_WORKER_VALUES_ARGS=""
-          SYNC_WORKER_SETS=""
-          case "$SERVICE" in
-            uploads)
-
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::uploads deployments are stable-only (single relay serves both channels)."
-                exit 1
-              fi
-              RELEASE="fluxer-uploads"
-              DEPLOY_IMAGE="fluxer-media-proxy"
-              SETS="--set-string app.name=uploads --set-string app.image=fluxer-media-proxy --set-string app.tag=${TAG} --set-string app.config=stable"
-              SETS="${SETS} --set-string app.build.version=${BUILD_VERSION}"
-              SETS="${SETS} --set-string app.build.channel=stable"
-              ;;
-            api|app-proxy|admin|docs|marketing)
-              BASE_IMAGE="fluxer-${SERVICE}"
-              if [[ "$SERVICE" == "docs" && "$CHANNEL" != "stable" ]]; then
-                echo "::error::docs deployments are stable-only."
-                exit 1
-              fi
-              if [[ "$CHANNEL" == "canary" ]]; then
-                NAME="${SERVICE}-canary"
-              else
-                NAME="${SERVICE}"
-              fi
-              DEPLOY_IMAGE="${BASE_IMAGE}"
-              RELEASE="fluxer-${SERVICE}-${CHANNEL}"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.${CHANNEL}.prod.yaml"
-              SETS="--set-string app.name=${NAME} --set-string app.image=${DEPLOY_IMAGE} --set-string app.tag=${TAG}"
-              SETS="${SETS} --set-string app.build.version=${BUILD_VERSION}"
-              SETS="${SETS} --set-string app.build.channel=${CHANNEL}"
-              ;;
-            media-proxy)
-              if [[ "$CHANNEL" != "canary" ]]; then
-                echo "::error::Media-proxy deployments are only supported on the canary lane."
-                exit 1
-              fi
-              RELEASE="fluxer-${SERVICE}"
-              DEPLOY_IMAGE="fluxer-media-proxy"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string mediaProxy.image=fluxer-media-proxy --set-string staticProxy.image=fluxer-media-proxy --set-string mediaProxy.tag=${TAG} --set-string staticProxy.tag=${TAG} --set mediaProxy.replicas=16 --set staticProxy.replicas=4 --set-string mediaProxy.nsfwServiceEndpoint=http://int.flx-nyc-misc1.srv.fluxer.dev:8000"
-              BUILD_PATHS="mediaProxy staticProxy"
-              ;;
-            gateway)
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::gateway deployments are stable-only."
-                exit 1
-              fi
-              RELEASE="fluxer-${SERVICE}"
-              DEPLOY_IMAGE="fluxer-gateway"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string gateway.image=${DEPLOY_IMAGE} --set-string gateway.tag=${TAG}"
-              BUILD_PATHS="gateway"
-              ;;
-            worker)
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::Worker deployments are only supported on the stable lane."
-                exit 1
-              fi
-              RELEASE="fluxer-${SERVICE}"
-              DEPLOY_IMAGE="fluxer-api"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string workerRealtime.image=fluxer-api --set-string workerUnfurl.image=fluxer-api --set-string workerLifecycle.image=fluxer-api --set-string workerBatch.image=fluxer-api --set-string workerRealtime.tag=${TAG} --set-string workerUnfurl.tag=${TAG} --set-string workerLifecycle.tag=${TAG} --set-string workerBatch.tag=${TAG}"
-              BUILD_PATHS="workerRealtime workerUnfurl workerLifecycle workerBatch"
-              ;;
-            messages|search|snowflakes|users|unfurl)
-              if [[ "$CHANNEL" != "stable" ]]; then
-                echo "::error::Shared microservice deployments are stable-only; canary traffic selection is done by the callers."
-                exit 1
-              fi
-              DEPLOY_IMAGE="fluxer-${SERVICE}"
-              RELEASE="fluxer-${SERVICE}"
-              VALUES_ARGS="${VALUES_ARGS} -f ${CHART_DIR}/values.prod.yaml"
-              SETS="--set-string svc.image=${DEPLOY_IMAGE} --set-string svc.tag=${TAG}"
-              SETS="${SETS} --set-string svc.build.version=${BUILD_VERSION}"
-              SETS="${SETS} --set-string svc.build.channel=stable"
-              ;;
-            *)
-              echo "::error::Unknown service chart: ${SERVICE}"
-              exit 1
-              ;;
-          esac
-          for BUILD_PATH in $BUILD_PATHS; do
-            SETS="${SETS} --set-string ${BUILD_PATH}.build.version=${BUILD_VERSION}"
-            SETS="${SETS} --set-string ${BUILD_PATH}.build.channel=${CHANNEL}"
-          done
-          SETS="--set-string global.registry=${GHCR_REGISTRY} ${SETS}"
-          if [[ "$SERVICE" == "api" && "$CHANNEL" == "canary" ]]; then
-            SYNC_WORKER_RELEASE="fluxer-worker"
-            SYNC_WORKER_CHART_DIR="./deploy/helm/worker"
-            SYNC_WORKER_VALUES_ARGS="-f ${SYNC_WORKER_CHART_DIR}/values.yaml -f ${SYNC_WORKER_CHART_DIR}/values.prod.yaml"
-            SYNC_WORKER_SETS="--set-string workerRealtime.image=fluxer-api --set-string workerUnfurl.image=fluxer-api --set-string workerLifecycle.image=fluxer-api --set-string workerBatch.image=fluxer-api"
-            SYNC_WORKER_SETS="${SYNC_WORKER_SETS} --set-string workerRealtime.tag=${TAG} --set-string workerUnfurl.tag=${TAG} --set-string workerLifecycle.tag=${TAG} --set-string workerBatch.tag=${TAG}"
-            for BUILD_PATH in workerRealtime workerUnfurl workerLifecycle workerBatch; do
-              SYNC_WORKER_SETS="${SYNC_WORKER_SETS} --set-string ${BUILD_PATH}.build.version=${BUILD_VERSION}"
-              SYNC_WORKER_SETS="${SYNC_WORKER_SETS} --set-string ${BUILD_PATH}.build.channel=${CHANNEL}"
-            done
-            SYNC_WORKER_SETS="--set-string global.registry=${GHCR_REGISTRY} ${SYNC_WORKER_SETS}"
-          fi
-          {
-            echo "chart-dir=${CHART_DIR}"
-            echo "release=${RELEASE}"
-            echo "values-args=${VALUES_ARGS}"
-            echo "sets=${SETS}"
-            echo "deploy-image=${DEPLOY_IMAGE}"
-            echo "deploy-tag=${TAG}"
-            echo "sync-worker-release=${SYNC_WORKER_RELEASE}"
-            echo "sync-worker-chart-dir=${SYNC_WORKER_CHART_DIR}"
-            echo "sync-worker-values-args=${SYNC_WORKER_VALUES_ARGS}"
-            echo "sync-worker-sets=${SYNC_WORKER_SETS}"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: helm dependency update
-        shell: bash
-        run: |
-          helm dependency update "${{ steps.helm.outputs.chart-dir }}"
-          if [[ -n "${{ steps.helm.outputs.sync-worker-chart-dir }}" ]]; then
-            helm dependency update "${{ steps.helm.outputs.sync-worker-chart-dir }}"
-          fi
-
-      - name: prepare docker config
-        if: steps.helm.outputs.deploy-image != ''
-        shell: bash
-        run: |
-          echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config" >> "$GITHUB_ENV"
-          mkdir -p "${RUNNER_TEMP}/docker-config"
-
-      - name: configure ghcr auth
-        if: steps.helm.outputs.deploy-image != ''
-        shell: bash
-        env:
-          GHCR_USERNAME: ${{ github.actor }}
-          GHCR_TOKEN: ${{ github.token }}
-        run: |
-          auth="$(printf '%s:%s' "$GHCR_USERNAME" "$GHCR_TOKEN" | base64 | tr -d '\n')"
-          printf '{"auths":{"ghcr.io":{"auth":"%s"}}}\n' "$auth" > "$DOCKER_CONFIG/config.json"
-
-      - name: verify deploy image exists
-        if: steps.helm.outputs.deploy-image != ''
-        shell: bash
-        run: |
-          IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
-          echo "Verifying ${IMAGE_REF}"
-          docker manifest inspect "${IMAGE_REF}" > /dev/null
-        env:
-          DOCKER_CLI_EXPERIMENTAL: enabled
-
-      - name: verify api deploy uses latest image
-        if: ${{ steps.helm.outputs.deploy-image == 'fluxer-api' && !inputs['allow-rollback'] }}
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GHCR_OWNER: ${{ env.GHCR_OWNER }}
-          DEPLOY_TAG: ${{ steps.helm.outputs.deploy-tag }}
-        run: |
-          set -euo pipefail
-
-          CALVER_RE='^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.(0|[1-9][0-9]{0,5})$'
-          OWNER_TYPE="$(
-            curl -fsS \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${GITHUB_API_URL:-https://api.github.com}/repos/${GITHUB_REPOSITORY}" \
-              | jq -r '.owner.type'
-          )"
-          case "$OWNER_TYPE" in
-            Organization) PACKAGE_OWNER_PATH="orgs/${GHCR_OWNER}" ;;
-            User) PACKAGE_OWNER_PATH="users/${GHCR_OWNER}" ;;
-            *)
-              echo "::error::Unsupported GitHub owner type for package lookup: ${OWNER_TYPE}"
-              exit 1
-              ;;
-          esac
-          LATEST_TAG="$(
-            curl -fsS \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${GITHUB_API_URL:-https://api.github.com}/${PACKAGE_OWNER_PATH}/packages/container/fluxer-api/versions?per_page=100" \
-              | jq -r --arg re "$CALVER_RE" '
-                  [.[].metadata.container.tags[]? |
-                    select(test($re)) |
-                    {tag: ., parts: (split(".") | map(tonumber))}
-                  ] | max_by(.parts) | .tag // empty
-                '
-          )"
-
-          if [[ -z "$LATEST_TAG" ]]; then
-            echo "::error::Could not resolve the latest fluxer-api CalVer tag from GHCR."
-            exit 1
-          fi
-
-          if [[ "$DEPLOY_TAG" != "$LATEST_TAG" ]]; then
-            echo "::error::Refusing to deploy fluxer-api:${DEPLOY_TAG}; latest GHCR tag is fluxer-api:${LATEST_TAG}. Re-run with allow-rollback=true only for an intentional rollback."
-            exit 1
-          fi
-
-      - name: approve api image for admission policy
-        if: ${{ inputs.service == 'api' }}
-        shell: bash
-        env:
-          INPUT_CHANNEL: ${{ inputs.channel }}
-        run: |
-          DEPLOYMENT="api"
-          if [[ "$INPUT_CHANNEL" == "canary" ]]; then
-            DEPLOYMENT="api-canary"
-          fi
-          IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
-          PREVIOUS_IMAGE="$(kubectl -n fluxer get deployment "$DEPLOYMENT" -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null || true)"
-          PREVIOUS_TAG=""
-          if [[ -n "$PREVIOUS_IMAGE" && "$PREVIOUS_IMAGE" != "$IMAGE_REF" && "$PREVIOUS_IMAGE" == *:* ]]; then
-            PREVIOUS_TAG="${PREVIOUS_IMAGE##*:}"
-          else
-            PREVIOUS_IMAGE=""
-          fi
-          kubectl -n fluxer create configmap fluxer-api-approved-image \
-            --from-literal=tag="${{ steps.helm.outputs.deploy-tag }}" \
-            --from-literal=image="${IMAGE_REF}" \
-            --from-literal=previousTag="${PREVIOUS_TAG}" \
-            --from-literal=previousImage="${PREVIOUS_IMAGE}" \
-            --dry-run=client -o yaml \
-            | kubectl apply -f -
-
-      - name: ensure api admission policy
-        if: ${{ inputs.service == 'api' }}
-        shell: bash
-        run: kubectl apply -f deploy/k8s/fluxer-api-approved-image-policy.yaml
-
-      - name: helm upgrade
-        shell: bash
-        run: |
-          RELEASE="${{ steps.helm.outputs.release }}"
-          CHART_DIR="${{ steps.helm.outputs.chart-dir }}"
-          VALUES_ARGS="${{ steps.helm.outputs.values-args }}"
-          SETS="${{ steps.helm.outputs.sets }}"
-          wait_for_release_idle() {
-            local release="$1"
-            local max_checks="$2"
-            local check=0
-            local status="unknown"
-            while (( check < max_checks )); do
-              check=$((check + 1))
-              status=$(helm status "$release" -n fluxer -o json 2>/dev/null | jq -r '.info.status // "unknown"' || echo "unknown")
-              if [[ "$status" != pending-* ]]; then
-                echo "Release ${release} is ${status}; continuing."
-                return 0
-              fi
-              echo "Release ${release} is ${status}; waiting 10s (${check}/${max_checks})."
-              sleep 10
-            done
-            echo "::warning::Release ${release} still ${status} after ${max_checks} checks; forcing rollback."
-            if helm rollback "$release" -n fluxer --wait --timeout 5m 2>&1; then
-              echo "Rollback succeeded; continuing."
-              return 0
-            fi
-            echo "::error::Release ${release} is stuck in ${status} and rollback failed."
-            return 1
-          }
-          helm_upgrade_with_retries() {
-            local release="$1"
-            local chart_dir="$2"
-            local values_args="$3"
-            local sets="$4"
-            local values_args_array=()
-            local sets_array=()
-            read -r -a values_args_array <<< "$values_args"
-            read -r -a sets_array <<< "$sets"
-            wait_for_release_idle "$release" 18
-            local max_attempts=4
-            for attempt in $(seq 1 "$max_attempts"); do
-              echo "Running helm upgrade for ${release}, attempt ${attempt}/${max_attempts}."
-              set +e
-              upgrade_output=$(helm upgrade --install "$release" \
-                "$chart_dir" \
-                "${values_args_array[@]}" \
-                -n fluxer \
-                "${sets_array[@]}" \
-                --wait --timeout 20m --atomic --history-max 10 2>&1)
-              exit_code=$?
-              set -e
-              printf '%s\n' "$upgrade_output"
-              if [[ $exit_code -eq 0 ]]; then
-                return 0
-              fi
-              if ! grep -q "another operation (install/upgrade/rollback) is in progress" <<< "$upgrade_output"; then
-                return "$exit_code"
-              fi
-              if [[ $attempt -eq $max_attempts ]]; then
-                echo "::error::Helm upgrade failed for ${release} after ${max_attempts} attempts because another operation remained in progress."
-                return "$exit_code"
-              fi
-              wait_for_release_idle "$release" 18
-            done
-          }
-          helm_upgrade_with_retries "$RELEASE" "$CHART_DIR" "$VALUES_ARGS" "$SETS"
-          if [[ -n "${{ steps.helm.outputs.sync-worker-release }}" ]]; then
-            helm_upgrade_with_retries \
-              "${{ steps.helm.outputs.sync-worker-release }}" \
-              "${{ steps.helm.outputs.sync-worker-chart-dir }}" \
-              "${{ steps.helm.outputs.sync-worker-values-args }}" \
-              "${{ steps.helm.outputs.sync-worker-sets }}"
-          fi
-
-      - name: seal api admission approved image
-        if: ${{ success() && inputs.service == 'api' }}
-        shell: bash
-        run: |
-          IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
-          kubectl -n fluxer create configmap fluxer-api-approved-image \
-            --from-literal=tag="${{ steps.helm.outputs.deploy-tag }}" \
-            --from-literal=image="${IMAGE_REF}" \
-            --from-literal=previousTag="" \
-            --from-literal=previousImage="" \
-            --dry-run=client -o yaml \
-            | kubectl apply -f -
-
-      - name: recover stuck release on failure
-        if: failure() || cancelled()
-        shell: bash
-        run: |
-          RELEASE="${{ steps.helm.outputs.release }}"
-          for RELEASE in "$RELEASE" "${{ steps.helm.outputs.sync-worker-release }}"; do
-            if [[ -z "$RELEASE" ]]; then
-              continue
-            fi
-            STATUS=$(helm status "$RELEASE" -n fluxer -o json 2>/dev/null | jq -r '.info.status' 2>/dev/null || echo "unknown")
-            if [[ "$STATUS" == "pending-upgrade" || "$STATUS" == "pending-install" || "$STATUS" == "pending-rollback" ]]; then
-              echo "::warning::Release ${RELEASE} stuck in ${STATUS}, rolling back..."
-              helm rollback "$RELEASE" -n fluxer --wait --timeout 5m || true
-            fi
-          done
@@ -17,6 +17,7 @@ concurrency:
 jobs:
  dispatch:
    name: Dispatch regeneration
+    if: github.repository == 'fluxerapp/fluxer'
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -0,0 +1,230 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Dispatch private marketing build
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - fluxer_marketing
+      - Cargo.toml
+      - fluxer_common/**
+      - packages/fonts/manifest.json
+      - packages/fonts/NOTICE.md
+      - packages/fonts/LICENSE-IBM-PLEX.txt
+      - packages/fonts/css/locale-fallbacks.css
+      - packages/fonts/files/FluxerSans/**
+      - packages/fonts/files/FluxerMono/**
+      - packages/fonts/marketing/**
+      - packages/i18n/marketing/**
+      - fluxer_static/marketing/branding/**
+      - .github/workflows/dispatch-private-marketing-build.yaml
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: private-marketing-dispatch
+  cancel-in-progress: false
+
+jobs:
+  metadata:
+    name: resolve exact private build metadata
+    if: github.repository == 'fluxerapp/fluxer'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
+      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
+      build_version: ${{ steps.inputs.outputs.build_version }}
+      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
+    steps:
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
+      - name: Resolve trusted build inputs
+        id: inputs
+        env:
+          EVENT_AFTER: ${{ github.event.after }}
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          PARENT_SHA: ${{ github.sha }}
+          PUBLIC_REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_EVENT_NAME" == "push" ]]
+          [[ "$GITHUB_REF" == "refs/heads/main" ]]
+          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
+          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
+          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
+          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
+          (( 10#$RUN_ATTEMPT <= 10 ))
+
+          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
+          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
+          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
+          main_status="$(jq -r .status <<<"$main_comparison")"
+          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
+          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
+
+          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
+          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
+          tree_sha="$(jq -r .tree.sha <<<"$commit")"
+          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
+          entry="$(
+            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
+              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
+          )"
+          mode="$(jq -r .mode <<<"$entry")"
+          type="$(jq -r .type <<<"$entry")"
+          gitlink_sha="$(jq -r .sha <<<"$entry")"
+          path="$(jq -r .path <<<"$entry")"
+          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
+            exit 1
+          fi
+
+          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
+          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
+          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
+          [[ "$(jq -r .event <<<"$run")" == "push" ]]
+          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
+          run_created_at="$(jq -r .created_at <<<"$run")"
+          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
+          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
+          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
+          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
+          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
+          month="$((10#$month))"
+          micro="$((10#$time_segment))"
+          build_version="$year.$month$day.$micro"
+          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
+          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
+          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
+          {
+            echo "parent_sha=$PARENT_SHA"
+            echo "gitlink_sha=$gitlink_sha"
+            echo "build_version=$build_version"
+            echo "correlation_id=$correlation_id"
+          } >>"$GITHUB_OUTPUT"
+
+  dispatch:
+    name: dispatch exact private build
+    needs: metadata
+    runs-on: ubuntu-24.04
+    timeout-minutes: 65
+    environment: private-marketing-dispatch
+    permissions: {}
+    steps:
+      - name: Validate trusted build inputs
+        env:
+          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
+          EXPECTED_PARENT_SHA: ${{ github.sha }}
+          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
+          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
+          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
+          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
+          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_EVENT_NAME" == "push" ]]
+          [[ "$GITHUB_REF" == "refs/heads/main" ]]
+          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
+          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
+          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
+          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
+          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
+          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
+            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
+            exit 1
+          fi
+
+      - name: Create private dispatch token
+        id: private-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: marketing
+          permission-actions: write
+
+      - name: Dispatch exact private build
+        env:
+          GH_TOKEN: ${{ steps.private-token.outputs.token }}
+          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
+          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
+          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
+          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
+        run: |
+          set -euo pipefail
+          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
+            --field ref=main \
+            --field "inputs[parent_sha]=$PARENT_SHA" \
+            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
+            --field "inputs[build_version]=$BUILD_VERSION" \
+            --field "inputs[correlation_id]=$CORRELATION_ID"
+
+      - name: Wait for private build conclusion
+        env:
+          GH_TOKEN: ${{ steps.private-token.outputs.token }}
+          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
+          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
+          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
+          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
+        run: |
+          set -euo pipefail
+          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
+          deadline=$((SECONDS + 3600))
+          run_id=""
+          while (( SECONDS < deadline )); do
+            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
+            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
+            count="$(jq 'length' <<<"$matches")"
+            if [[ "$count" == "1" ]]; then
+              run_id="$(jq -r '.[0].id' <<<"$matches")"
+              break
+            fi
+            if [[ "$count" != "0" ]]; then
+              echo "::error::Private build correlation matched multiple workflow runs."
+              exit 1
+            fi
+            sleep 10
+          done
+          if [[ -z "$run_id" ]]; then
+            echo "::error::Timed out waiting for the private build dispatch to appear."
+            exit 1
+          fi
+          while (( SECONDS < deadline )); do
+            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
+            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
+            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
+              echo "::error::Private build correlation is missing or ambiguous."
+              exit 1
+            fi
+            run="$(jq '.[0]' <<<"$matches")"
+            status="$(jq -r '.status' <<<"$run")"
+            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
+            if [[ "$status" == "completed" ]]; then
+              if [[ "$conclusion" != "success" ]]; then
+                echo "::error::Private marketing build concluded with $conclusion."
+                exit 1
+              fi
+              echo "Private marketing build completed successfully."
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "::error::Timed out waiting for the private marketing build."
+          exit 1
@@ -1,51 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: finalise release
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes)"
-        type: string
-        required: true
-      fragment-run-id:
-        description: "Workflow run id that produced the release-fragment-* artifacts"
-        type: string
-        required: true
-
-permissions:
-  actions: read
-  contents: write
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  finalise:
-    name: finalise GitHub release manifest
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          gh run download "${{ inputs.fragment-run-id }}"
-          --pattern "release-fragment-*"
-          --dir release-out/fragments
-      - name: Finalise release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${{ inputs.build-version }}"
@@ -57,7 +57,7 @@ jobs:

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Refresh source catalogs
@@ -71,7 +71,7 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales fluxer_marketing/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No source catalog changes."
            exit 0
          fi
@@ -79,7 +79,7 @@ jobs:
          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
          git switch -c "$SOURCE_BRANCH"
-          git add fluxer_app/src/features/i18n/locales fluxer_marketing/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "chore(i18n): refresh source catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git fetch origin "$SOURCE_BRANCH" || true
@@ -63,7 +63,7 @@ jobs:

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Compile translated catalogs
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -5,6 +5,7 @@ permissions: {}
 jobs:
  label:
    name: Label
+    if: github.repository == 'fluxerapp/fluxer'
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -41,7 +41,7 @@ concurrency:
 jobs:
  automatic:
    name: Lock closed conversation
-    if: github.event_name != 'workflow_dispatch' && github.event_name != 'schedule'
+    if: github.repository == 'fluxerapp/fluxer' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule'
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -155,7 +155,7 @@ jobs:

  retroactive:
    name: Lock closed conversations retroactively
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    if: github.repository == 'fluxerapp/fluxer' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
    runs-on: ubuntu-latest
    steps:
      - name: Create token
@@ -1,282 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: release all builds
-
-on:
-  workflow_dispatch:
-    inputs:
-      build-version:
-        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
-        type: string
-        required: false
-        default: ""
-
-permissions:
-  actions: read
-  contents: write
-  packages: write
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: release-all-${{ inputs['build-version'] || github.run_id }}
-  cancel-in-progress: false
-
-jobs:
-  approve:
-    name: approve release build
-    runs-on: ubuntu-24.04
-    environment: builds
-    timeout-minutes: 5
-    steps:
-      - name: approved
-        run: echo "Release build approved."
-
-  meta:
-    name: resolve metadata
-    needs: approve
-    if: ${{ !failure() && !cancelled() }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      build_version: ${{ steps.vars.outputs.build_version }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: set variables
-        id: vars
-        env:
-          GH_TOKEN: ${{ github.token }}
-          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
-          --github-output
-
-  build_admin:
-    needs: meta
-    uses: ./.github/workflows/build-admin.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_api:
-    needs: meta
-    uses: ./.github/workflows/build-api.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_app_proxy:
-    needs: meta
-    uses: ./.github/workflows/build-app-proxy.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_app_proxy_self_hosted:
-    needs: meta
-    uses: ./.github/workflows/build-app-proxy-self-hosted.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_docs:
-    needs: meta
-    uses: ./.github/workflows/build-docs.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_gateway:
-    needs: meta
-    uses: ./.github/workflows/build-gateway.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_gifs:
-    needs: meta
-    uses: ./.github/workflows/build-gifs.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_marketing:
-    needs: meta
-    uses: ./.github/workflows/build-marketing.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_media_proxy:
-    needs: meta
-    uses: ./.github/workflows/build-media-proxy.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_messages:
-    needs: meta
-    uses: ./.github/workflows/build-messages.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_snowflakes:
-    needs: meta
-    uses: ./.github/workflows/build-snowflakes.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_static:
-    needs: meta
-    uses: ./.github/workflows/build-static.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_unfurl:
-    needs: meta
-    uses: ./.github/workflows/build-unfurl.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  build_users:
-    needs: meta
-    uses: ./.github/workflows/build-users.yaml
-    with:
-      build-version: ${{ needs.meta.outputs.build_version }}
-      finalise-release: false
-      approval-required: false
-    secrets: inherit
-
-  release_assets:
-    name: package Helm/self-hosting
-    if: ${{ !failure() && !cancelled() }}
-    needs:
-      - meta
-      - build_admin
-      - build_api
-      - build_app_proxy
-      - build_app_proxy_self_hosted
-      - build_docs
-      - build_gateway
-      - build_gifs
-      - build_marketing
-      - build_media_proxy
-      - build_messages
-      - build_snowflakes
-      - build_static
-      - build_unfurl
-      - build_users
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Set up Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-      - name: Publish self-hosting bundle
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-self-hosting
-          --build-version "${{ needs.meta.outputs.build_version }}"
-      - name: Publish Helm chart bundle
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          publish-helm
-          --build-version "${{ needs.meta.outputs.build_version }}"
-      - name: Upload release asset fragments
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
-        with:
-          name: release-fragment-release-assets
-          path: release-out/fragments/*.json
-          if-no-files-found: error
-          retention-days: 14
-
-  finalise:
-    name: finalise GitHub release manifest
-    if: ${{ !failure() && !cancelled() }}
-    needs:
-      - meta
-      - build_admin
-      - build_api
-      - build_app_proxy
-      - build_app_proxy_self_hosted
-      - build_docs
-      - build_gateway
-      - build_gifs
-      - build_marketing
-      - build_media_proxy
-      - build_messages
-      - build_snowflakes
-      - build_static
-      - build_unfurl
-      - build_users
-      - release_assets
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: Download GitHub release fragments
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
-        with:
-          pattern: release-fragment-*
-          path: release-out/fragments
-          merge-multiple: true
-      - name: Finalise GitHub release manifest
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
-          finalise
-          --build-version "${{ needs.meta.outputs.build_version }}"
@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: release image set
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+      from-tag:
+        description: "Image tag every component is read from (v1 snapshots today's moving tags, a CalVer pins a coordinated build)"
+        type: string
+        required: false
+        default: "v1"
+      component-versions:
+        description: "Per-component overrides, one <image>=<version> entry per line (for example fluxer-api=2026.830.191141)"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: read
+
+concurrency:
+  group: release-image-set
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
+jobs:
+  approve:
+    name: approve image set release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Image set release approved."
+
+  manifest:
+    name: resolve and publish the image set
+    needs: approve
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: "1.93.0"
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+          permission-packages: read
+
+      - name: set variables
+        id: vars
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
+        run: >-
+          tools/ci/run.sh resolve-calver
+          --github-output
+
+      - name: resolve release image set
+        id: resolve
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          FROM_TAG: ${{ inputs['from-tag'] }}
+          COMPONENT_VERSIONS: ${{ inputs['component-versions'] }}
+        run: |
+          set -euo pipefail
+          args=(
+            image-set resolve
+            --version "${VERSION}"
+            --registry "ghcr.io/${GHCR_OWNER}"
+            --from-tag "${FROM_TAG}"
+            --out-dir release-out
+            --github-output
+          )
+          while IFS= read -r entry; do
+            entry="$(echo "$entry" | xargs)"
+            if [ -n "$entry" ]; then
+              args+=( --component-version "$entry" )
+            fi
+          done <<< "${COMPONENT_VERSIONS}"
+          tools/ci/run.sh "${args[@]}"
+
+      - name: verify release image set
+        env:
+          VERSION: ${{ steps.vars.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set verify
+          --manifest "release-out/fluxer-release-${VERSION}.json"
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          BUNDLE_COMMIT: ${{ steps.resolve.outputs.bundle_commit }}
+        run: |
+          set -euo pipefail
+          if [ -z "${BUNDLE_COMMIT}" ]; then
+            echo "image-set resolve reported no bundle commit" >&2
+            exit 1
+          fi
+          gh release create "fluxer-release@${VERSION}" \
+            --repo fluxerapp/fluxer \
+            --target "${BUNDLE_COMMIT}" \
+            --title "fluxer-release ${VERSION}" \
+            --latest=true \
+            --notes "Immutable image set for ${VERSION}. Every image in the set contains ${BUNDLE_COMMIT}, the commit this tag points at, so the bundle here is never newer than the images. Pin with: docker compose -f docker-compose.yml -f fluxer-release-${VERSION}.yml up -d" \
+            "release-out/fluxer-release-${VERSION}.json" \
+            "release-out/fluxer-release-${VERSION}.yml"
@@ -3,21 +3,29 @@ name: Tests

 on:
  pull_request:
+  push:
+    branches:
+      - main

 permissions:
  contents: read

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 env:
  GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  CARGO_PROFILE_DEV_DEBUG: none
+  CARGO_PROFILE_TEST_DEBUG: none
+  CARGO_INCREMENTAL: '0'

 jobs:
  typecheck:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -28,6 +36,28 @@ jobs:
          toolchain: "1.93.0"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
+      - name: Save ci helper
+        if: github.ref == 'refs/heads/main' && steps.ci-helper.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271

@@ -38,18 +68,19 @@ jobs:
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies

      - name: Run typecheck
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step typecheck
+        run: |
+          "$FLUXER_CI_BIN" ci --step typecheck

  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
+      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -60,6 +91,19 @@ jobs:
          toolchain: "1.93.0"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271

@@ -70,18 +114,46 @@ jobs:
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies
+
+      - name: Restore fluxer_app wasm artifacts
+        id: app-wasm
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

      - name: Run tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step test
+        run: |
+          "$FLUXER_CI_BIN" ci --step test
+
+      - name: Save fluxer_app wasm artifacts
+        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

  rust:
    runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 30
+    timeout-minutes: 45
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -89,7 +161,7 @@ jobs:
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
-          toolchain: stable
+          toolchain: "1.93.0"
          components: clippy, rustfmt

      - name: Install pnpm
@@ -108,37 +180,97 @@ jobs:
            ~/.cargo/registry
            ~/.cargo/git
            target
-          key: rust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          key: rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
-            rust-${{ runner.os }}-
+            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version 0.19.6 --locked
+
+      - name: Check Rust dependencies
+        run: cargo deny --locked check -D warnings
+
+      - name: Check desktop native dependencies
+        run: tools/ci/check-desktop-native-workspaces.sh dependencies
+
+      - name: Cache native media dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: /opt/fluxer-native
+          key: media-native-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
-            pkg-config \
            build-essential \
-            libcurl4-openssl-dev \
-            libvips-dev \
+            binutils \
+            clang \
+            cmake \
+            curl \
+            libaom-dev \
            libavfilter-dev \
+            libclang-dev \
+            libcurl4-openssl-dev \
+            libdav1d-dev \
+            libde265-dev \
+            libfido2-dev \
            libheif-dev \
-            libwebp-dev
+            liblcms2-dev \
+            libpipewire-0.3-dev \
+            libspa-0.2-dev \
+            libssl-dev \
+            libudev-dev \
+            libvips-dev \
+            libwebp-dev \
+            libyuv-dev \
+            meson \
+            nasm \
+            ninja-build \
+            pkg-config \
+            xz-utils \
+            yasm \
+            zlib1g-dev
+          sudo fluxer_media_proxy/tools/install-native-deps.sh /opt/fluxer-native
+          echo "PKG_CONFIG_PATH=/opt/fluxer-native/lib/pkgconfig:/opt/fluxer-native/lib64/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=/opt/fluxer-native/lib:/opt/fluxer-native/lib64" >> "$GITHUB_ENV"
+          echo "/opt/fluxer-native/bin" >> "$GITHUB_PATH"

      - name: Install Node.js dependencies
-        run: pnpm --filter fluxer_admin --filter fluxer_marketing install
+        run: pnpm --filter fluxer_admin install

      - name: Check formatting
        run: cargo fmt --all -- --check

+      - name: Check formatting (desktop native workspaces)
+        run: tools/ci/check-desktop-native-workspaces.sh fmt
+
      - name: Clippy (warnings as errors)
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: Clippy (desktop native workspaces on Linux, warnings as errors)
+        run: tools/ci/check-desktop-native-workspaces.sh clippy
+
+      - name: Verify the source-built ffmpeg CLI is on PATH
+        run: |
+          set -euo pipefail
+          command -v ffmpeg
+          test "$(command -v ffmpeg)" = /opt/fluxer-native/bin/ffmpeg
+          ffmpeg -hide_banner -version

      - name: Run tests
-        run: cargo test --workspace
+        env:
+          FLUXER_REQUIRE_MEDIA_FIXTURES: "1"
+        run: cargo test --workspace --all-features --locked
+
+      - name: Run desktop native workspace tests on Linux
+        run: tools/ci/check-desktop-native-workspaces.sh test

  gateway:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -148,45 +280,82 @@ jobs:
        with:
          toolchain: "1.93.0"

+      - name: Cache cargo (gateway NIFs)
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        with:
+          workspaces: |
+            fluxer_gateway/native/guild_member_list_oset_nif -> target
+            fluxer_gateway/native/push_markdown_plaintext_nif -> target
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Set up Erlang
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
          rebar3-version: '3.24.0'

-      - name: Cache rebar3 dependencies
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      - name: Restore rebar3 dependencies
+        id: rebar3-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: |
-            fluxer_gateway/_build
            ~/.cache/rebar3
-          key: rebar3-${{ runner.os }}-${{ hashFiles('fluxer_gateway/rebar.lock') }}
+            fluxer_gateway/_build
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
+          key: >-
+            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-
+            rebar3-${{ runner.os }}-otp28-rebar3.24.0-

      - name: Check formatting
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_fmt
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_fmt

      - name: Compile
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_compile
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_compile

      - name: Run dialyzer
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_dialyzer
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_dialyzer

      - name: Run eunit tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_eunit
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_eunit
+
+      - name: Save rebar3 dependencies
+        if: always() && github.ref == 'refs/heads/main' && steps.rebar3-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cache/rebar3
+            fluxer_gateway/_build
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
+          key: >-
+            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            'fluxer_gateway/rebar.config') }}

  knip:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -197,6 +366,19 @@ jobs:
          toolchain: "1.93.0"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271

@@ -207,14 +389,126 @@ jobs:
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies
+
+      - name: Restore fluxer_app wasm artifacts
+        id: app-wasm
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

      - name: Run knip
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step knip
+        run: |
+          "$FLUXER_CI_BIN" ci --step knip
+
+      - name: Save fluxer_app wasm artifacts
+        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}
+
+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting and lint
+        run: pnpm exec biome ci .
+
+      - name: Lint JSX for browser-translation safety
+        run: pnpm exec eslint . --max-warnings 0
+
+  i18n:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Compile locale catalogs
+        run: pnpm i18n:compile
+
+      - name: Check drift of compiled locale modules
+        run: |
+          if ! git diff --exit-code -- \
+            packages/errors/src/i18n/locales \
+            packages/errors/src/i18n/ErrorI18nTypes.generated.ts \
+            fluxer_api/pkgs/email/src/email_i18n/locales \
+            fluxer_api/pkgs/email/src/email_i18n/EmailI18nTypes.generated.ts \
+            fluxer_api/src/api/content_i18n/locales; then
+            echo "::error::Compiled locale modules are outdated. Run 'pnpm i18n:compile' and commit the result. Translations belong in the weblate/ catalogs, not in the generated locales/ modules."
+            exit 1
+          fi
+
+  docs:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --filter fluxer_docs...
+
+      - name: Verify documentation matches the live API
+        run: pnpm --filter fluxer_docs verify
+
+      - name: Build documentation
+        run: pnpm --filter fluxer_docs build

  fonts:
    runs-on: ubuntu-24.04
@@ -233,133 +527,3 @@ jobs:

      - name: Verify shipped fonts match the lockfile
        run: python3 tools/fonts/build_fonts.py --verify
-
-  ci-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 25
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: stable
-          components: rustfmt
-
-      - name: Sync ci helper dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci-scripts
-          --step sync
-
-      - name: Run ci helper tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci-scripts
-          --step test
-
-  helm-and-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-
-      - name: Install helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-
-      - name: Resolve Helm test build version
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
-          --github-env
-          --env-name HELM_TEST_BUILD_VERSION
-
-      - name: Helm dependency update (all charts)
-        run: |
-          set -euo pipefail
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              helm dependency update "$chart_dir"
-            fi
-          done
-
-      - name: Helm lint (all charts)
-        run: |
-          set -euo pipefail
-          FAILED=0
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              echo "--- Linting ${chart_dir} ---"
-              VALUES_ARGS=()
-              if [[ -f "${chart_dir}values.yaml" ]]; then
-                VALUES_ARGS=(-f "${chart_dir}values.yaml")
-              fi
-              EXTRA_SETS=(--set-string "global.registry=${GHCR_REGISTRY}")
-              case "${chart_dir}" in
-                *gateway*)
-                  EXTRA_SETS+=(--set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *api*)
-                  EXTRA_SETS+=(--set-string app.name=api --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *app-proxy*)
-                  EXTRA_SETS+=(--set-string app.name=app-proxy --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *admin*)
-                  EXTRA_SETS+=(--set-string app.name=admin --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *marketing*)
-                  EXTRA_SETS+=(--set-string app.name=marketing --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *docs*)
-                  EXTRA_SETS+=(--set-string app.name=docs --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *media-proxy*)
-                  EXTRA_SETS+=(--set-string "mediaProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "mediaProxy.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *uploads*)
-                  EXTRA_SETS+=(--set-string app.name=uploads --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *worker*)
-                  EXTRA_SETS+=(--set-string "workerRealtime.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerRealtime.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *gifs*|*messages*|*snowflakes*|*unfurl*|*users*)
-                  EXTRA_SETS+=(--set-string "svc.tag=${HELM_TEST_BUILD_VERSION}" --set-string "svc.build.version=${HELM_TEST_BUILD_VERSION}" --set-string svc.build.channel=stable)
-                  ;;
-              esac
-              if ! helm lint "$chart_dir" "${VALUES_ARGS[@]}" "${EXTRA_SETS[@]}" --strict; then
-                FAILED=1
-              fi
-            fi
-          done
-          if [[ "$FAILED" -ne 0 ]]; then
-            echo "::error::One or more Helm charts failed linting"
-            exit 1
-          fi
-
-      - name: Helm template (gateway)
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer > /dev/null
-          echo "Gateway chart templates render successfully."
-
-      - name: Validate gateway manifests with kubeconform
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer \
-            | docker run -i --rm ghcr.io/yannh/kubeconform:v0.6.7 \
-                -strict -summary -kubernetes-version 1.31.0
@@ -14,6 +14,7 @@
 **/*.css.d.ts
 **/*.tsbuildinfo
 **/.cache/
+**/.swc/
 **/__pycache__/
 **/_build/
 **/coverage/
@@ -41,13 +42,9 @@

 /app-dist-output/
 /artifacts/
-/release-input/
-/release-out/
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 **/.idea/
 **/*.iml
@@ -0,0 +1,4 @@
+[submodule "fluxer_marketing"]
+	path = fluxer_marketing
+	url = https://github.com/fluxerapp/marketing.git
+	update = none
@@ -3,7 +3,6 @@ members = [
 	"fluxer_admin",
 	"fluxer_app_proxy",
 	"fluxer_common",
-	"fluxer_marketing",
 	"fluxer_media_proxy",
 	"fluxer_gifs",
 	"fluxer_svc",
@@ -13,18 +12,21 @@ members = [
 	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
-	"tools/marketing/update-gettext-catalogs",
 	"fluxer_users",
 	"fluxer_unfurl",
 	"packages/markdown_parser/rust",
 ]
 exclude = [
+	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
-	"fluxer_desktop/native/webrtc-sender/vendor/tract-linalg-0.19.16",
-	"fluxer_desktop/native/webrtc-sender/vendor/tract-linalg-0.23.1",
 ]
 resolver = "2"

 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
@@ -1,15 +1,3 @@
-> [!CAUTION]
-> As of this writing (15 June 2026), we are working to finalise the API and self-hosting documentation over the next few days.
->
-> We apologise for the brief delay in open-source releases. We paused after spam waves created safety concerns while we built out Fluxer's trust and safety infrastructure. During that same stretch, we have been fixing hundreds of bugs, adding new features, and preparing a much improved audio and video system.
->
-> You can already try that work in the Fluxer Canary client: [download Canary](https://canary.fluxer.app/download) or [open Canary on the web](https://web.canary.fluxer.app). The latest stable client remains out of date for now, but over the coming weeks we are finalising the remaining work needed to stabilise the current latest code out in the open.
-
-> [!NOTE]
-> Learn about the developer behind Fluxer, the goals of the project, the tech stack, and what's coming next.
->
-> [Read the launch blog post](https://blog.fluxer.app/how-i-built-fluxer-a-discord-like-chat-app/) | [View full roadmap](https://blog.fluxer.app/roadmap-2026/)
-
 <p align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./fluxer_static/marketing/branding/logo-white.svg">
@@ -31,5 +19,5 @@
 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-1920w.png" alt="Fluxer app showcase" width="900">
+  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer app showcase" width="900">
 </p>
@@ -20,7 +20,7 @@
 			"bracketSpacing": false,
 			"bracketSameLine": false
 		},
-		"globals": ["React"]
+		"globals": ["React", "__webpack_base_uri__"]
 	},
 	"json": {
 		"formatter": {
@@ -84,7 +84,18 @@
 				},
 				"useConst": "error",
 				"noNonNullAssertion": "off",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noRestrictedImports": {
+					"level": "error",
+					"options": {
+						"paths": {
+							"@lingui/react": {
+								"importNames": ["I18nProvider"],
+								"message": "Use AppI18nProvider from @app/features/i18n/components/AppI18nProvider so <Trans> output stays safe under page translation."
+							}
+						}
+					}
+				}
 			},
 			"a11y": {
 				"recommended": true,
@@ -115,6 +126,28 @@
 		}
 	},
 	"assist": {"actions": {"source": {"organizeImports": "on"}}},
+	"overrides": [
+		{
+			"includes": ["fluxer_app/src/**/*.tsx"],
+			"plugins": ["./tools/lint/no-adjacent-jsx-text.grit"]
+		},
+		{
+			"includes": ["fluxer_docs/scripts/VerifyDocsCoverage.ts"],
+			"linter": {"rules": {"suspicious": {"noTemplateCurlyInString": "off"}}}
+		},
+		{
+			"includes": [
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.tsx",
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.test.tsx"
+			],
+			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
+		},
+		{
+			"includes": ["**/*.astro"],
+			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},
+			"assist": {"actions": {"source": {"organizeImports": "off"}}}
+		}
+	],
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
@@ -145,8 +178,14 @@
 			"!fluxer_static",
 			"!packages/fonts",
 			"!fluxer_admin/static/htmx.min.js",
-			"!fluxer_marketing/static/htmx.min.js",
-			"!fluxer_api/src/api/openapi/openapi.json"
+			"!fluxer_api/src/api/openapi/openapi.json",
+			"!fluxer_api/pkgs/email/src/email_i18n/locales",
+			"!fluxer_api/pkgs/email/src/email_i18n/weblate",
+			"!fluxer_api/src/api/content_i18n/locales",
+			"!fluxer_api/src/api/content_i18n/weblate",
+			"!packages/errors/src/i18n/locales",
+			"!packages/errors/src/i18n/weblate",
+			"!**/auto-i18n-reviewed-unchanged.json"
 		],
 		"ignoreUnknown": true
 	}
@@ -17,7 +17,7 @@ FLUXER_GATEWAY_ENDPOINT=ws://localhost:8088/gateway
 FLUXER_MEDIA_ENDPOINT=http://localhost:8088/media
 FLUXER_STATIC_CDN_ENDPOINT=http://localhost:8088
 FLUXER_ADMIN_ENDPOINT=http://localhost:8088/admin
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
+FLUXER_MARKETING_ENDPOINT=https://fluxer.app
 FLUXER_TRUST_CLIENT_IP_HEADER=true
 FLUXER_CLIENT_IP_HEADER_NAME=x-forwarded-for

@@ -30,12 +30,6 @@ FLUXER_POSTGRES_PASSWORD=fluxer
 FLUXER_POSTGRES_SSL=false
 FLUXER_POSTGRES_MAX_CONNECTIONS=20
 FLUXER_POSTGRES_KV_TABLE=fluxer_kv
-FLUXER_CASSANDRA_HOSTS=cassandra
-FLUXER_CASSANDRA_PORT=9042
-FLUXER_CASSANDRA_KEYSPACE=fluxer
-FLUXER_CASSANDRA_LOCAL_DC=datacenter1
-FLUXER_CASSANDRA_USERNAME=fluxer
-FLUXER_CASSANDRA_PASSWORD=fluxer
 FLUXER_KV_URL=redis://valkey:6379/0
 FLUXER_NATS_URL=nats://nats:4222
 FLUXER_NATS_JETSTREAM_URL=nats://nats:4222
@@ -49,7 +43,6 @@ FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
 FLUXER_SVC_CACHE_HARD_TTL_MS=600000
-FLUXER_SVC_MAX_CONCURRENT_REQUESTS=64

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -66,8 +59,9 @@ FLUXER_S3_BUCKET_STATIC=fluxer-static

 FLUXER_LIVEKIT_ENABLED=true
 FLUXER_LIVEKIT_URL=ws://localhost:8088/livekit
+FLUXER_LIVEKIT_INTERNAL_URL=http://localhost:7880
 FLUXER_LIVEKIT_API_KEY=devkey
-FLUXER_LIVEKIT_API_SECRET=secret
+FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
 FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

@@ -95,7 +89,6 @@ FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
 FLUXER_ADMIN_PORT=3020
 FLUXER_ADMIN_BASE_PATH=/admin
 FLUXER_ADMIN_SECRET_KEY_BASE=dev-admin-secret-key-base
-FLUXER_ADMIN_OAUTH_CLIENT_ID=1234567890123456789
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=dev-admin-oauth-secret
 FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback
 FLUXER_MARKETING_PORT=3010
@@ -105,8 +98,8 @@ FLUXER_MARKETING_SECRET_KEY_BASE=dev-marketing-secret-key-base

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
-FLUXER_VAPID_PUBLIC_KEY=dev-vapid-public-key
-FLUXER_VAPID_PRIVATE_KEY=dev-vapid-private-key
+FLUXER_VAPID_PUBLIC_KEY=BHIbdKs24FdPkOQS7hbeg3adceLS0IqlKsn71ywEe6kbeopeFFiG3lkvJac7BVqkuk7mxwEa555O2FXV3HLt56w
+FLUXER_VAPID_PRIVATE_KEY=cs24JvXSxHiqJQgkJNocJFAdzJpPmpfU9xD-fDpn3tw
 FLUXER_VAPID_EMAIL=dev@localhost
 FLUXER_PASSKEY_RP_NAME='Fluxer Dev'
 FLUXER_PASSKEY_RP_ID=localhost
@@ -1,13 +1,9 @@
 # cargo-deny configuration for the Fluxer workspace.
 #
-# Applies to the root workspace (Cargo.toml at the repo root) AND to every
-# per-addon crate under fluxer_desktop/native/* (each addon has its own
-# [workspace], so we invoke cargo-deny with --config pointing here).
-#
-# Used by the native desktop security gate in CI.
+# Applies to the root workspace (Cargo.toml at the repo root).

 [graph]
-all-features = false
+all-features = true
 no-default-features = false

 [output]
@@ -44,13 +40,11 @@ allow = [
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
-    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "AGPL-3.0-or-later",
    "BSL-1.0",
-    "OpenSSL",
    "CDLA-Permissive-2.0",
 ]
 # Explicitly deny GPL-only / strong-copyleft licenses that don't compose with
@@ -72,21 +66,48 @@ license-files = [
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# Per-addon crates path-depend on ../rust (the shared `fluxer_desktop_native`
-# crate) without a version. cargo-deny flags that as a wildcard; we allow it
-# because path deps can't realistically pin a SemVer range, and this only
-# affects intra-repo workspace links (registry wildcards remain denied).
+# Internal workspace crates use path dependencies without registry versions.
+# Registry wildcards remain denied.
 allow-wildcard-paths = true
 highlight = "all"
 workspace-default-features = "allow"
 external-default-features = "allow"
-# Keep desktop packaging and native addons away from the obsolete libfuse2 stack.
+# Keep workspace artifacts away from the obsolete libfuse2 stack.
 # AppImage packaging must use the static electron-builder runtime instead.
 deny = [
    { crate = "fuse", reason = "libfuse2-based Rust wrapper; use a maintained FUSE3-native crate only if Fluxer ever needs FUSE directly" },
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
-skip = []
+skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older socket API" },
+    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior Windows API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older WASI binding API" },
+]
 skip-tree = []

 # ---------------------------------------------------------------------------
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: admin
-description: Fluxer admin service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-canary release as of 2026-05-17T20:42:36Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-canary
-# Apply with:    helm upgrade fluxer-admin-canary deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  image: fluxer-admin
-  name: admin-canary
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-stable
-# Apply with:    helm upgrade fluxer-admin-stable deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-admin
-  name: admin
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,34 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: api
-description: Fluxer API service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,105 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-canary release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-api-canary
-# Apply with:    helm upgrade fluxer-api-canary deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api-canary
-  port: 8080
-  replicas: 4
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 75%
@@ -1,107 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-api-stable
-# Apply with:    helm upgrade fluxer-api-stable deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_USERS_SERVICE_TIMEOUT_MS
-    value: "6000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api
-  port: 8080
-  replicas: 31
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 75%
@@ -1,98 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-canary:
-  image: fluxer-api
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-pdb:
-  minAvailable: '75%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: app-proxy
-description: Fluxer app proxy service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-canary release as of 2026-05-17T20:42:38Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-canary
-# Apply with:    helm upgrade fluxer-app-proxy-canary deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.canary.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy-canary
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-stable release as of 2026-05-17T20:42:39Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-stable
-# Apply with:    helm upgrade fluxer-app-proxy-stable deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,31 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-
-
-
-
-  env:
-    - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-      value: '/api'
-
-pdb:
-  minAvailable: '50%'
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: common
-description: Shared Helm templates for Fluxer services
-type: library
-version: 0.1.0
@@ -1,356 +0,0 @@
-{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}}
-{{- define "fluxer.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.labels" -}}
-helm.sh/chart: {{ include "fluxer.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/part-of: fluxer
-{{- end }}
-
-{{- define "fluxer.selectorLabels" -}}
-app.kubernetes.io/name: {{ .name }}
-app.kubernetes.io/instance: {{ .context.Release.Name }}
-{{- end }}
-
-{{- define "fluxer.imagePullSecrets" -}}
-imagePullSecrets:
-  - name: {{ .Values.global.imagePullSecret }}
-{{- end }}
-
-{{- define "fluxer.image" -}}
-{{- $tag := required (printf ".tag is required (image: %s)" .image) .tag -}}
-{{- $registry := required "global.registry is required" .context.Values.global.registry -}}
-{{ $registry }}/{{ .image }}:{{ $tag }}
-{{- end }}
-
-{{- define "fluxer.replicas" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $desired := int (required (printf ".replicas is required for %s" $name) $v.replicas) -}}
-{{- $preserveLiveReplicas := dig "preserveLiveReplicas" true $v -}}
-{{- if not $preserveLiveReplicas -}}
-{{- $desired -}}
-{{- else -}}
-{{- $existing := lookup "apps/v1" "Deployment" $ctx.Values.global.namespace $name -}}
-{{- if $existing -}}
-{{- $current := int (dig "spec" "replicas" 0 $existing) -}}
-{{- if gt $current 0 -}}
-{{- $current -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- end -}}
-{{- end }}
-
-{{- define "fluxer.deployment" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $isGateway := eq $name "gateway" -}}
-{{- $defaultMaxSurge := 1 -}}
-{{- $defaultMaxUnavailable := 0 -}}
-{{- $defaultMinReadySeconds := 10 -}}
-{{- $defaultTerminationGracePeriodSeconds := ternary 90 60 $isGateway -}}
-{{- $defaultReadinessPath := ternary "/_health/ready" "/_health" $isGateway -}}
-{{- $defaultReadinessTimeoutSeconds := ternary 5 2 $isGateway -}}
-{{- $configuredMaxSurge := dig "rollingUpdate" "maxSurge" $defaultMaxSurge $v -}}
-{{- $configuredMaxUnavailable := dig "rollingUpdate" "maxUnavailable" $defaultMaxUnavailable $v -}}
-{{- $maxSurge := $configuredMaxSurge -}}
-{{- $maxUnavailable := $configuredMaxUnavailable -}}
-{{- $minReadySeconds := int (dig "minReadySeconds" $defaultMinReadySeconds $v) -}}
-{{- $terminationGracePeriodSeconds := int (dig "terminationGracePeriodSeconds" $defaultTerminationGracePeriodSeconds $v) -}}
-{{- $readinessPath := dig "readinessProbe" "path" $defaultReadinessPath $v -}}
-{{- $readinessExecEnabled := dig "readinessProbe" "execEnabled" $isGateway $v -}}
-{{- $readinessTimeoutSeconds := int (dig "readinessProbe" "timeoutSeconds" $defaultReadinessTimeoutSeconds $v) -}}
-{{- $readinessExecCommand := printf "curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 || exit 1" $readinessTimeoutSeconds (int $v.port) $readinessPath -}}
-{{- $readinessInitialDelaySeconds := int (dig "readinessProbe" "initialDelaySeconds" 5 $v) -}}
-{{- $readinessPeriodSeconds := int (dig "readinessProbe" "periodSeconds" 5 $v) -}}
-{{- $readinessFailureThreshold := int (dig "readinessProbe" "failureThreshold" 2 $v) -}}
-{{- $livenessPath := dig "livenessProbe" "path" "/_health" $v -}}
-{{- $livenessInitialDelaySeconds := int (dig "livenessProbe" "initialDelaySeconds" 10 $v) -}}
-{{- $livenessPeriodSeconds := int (dig "livenessProbe" "periodSeconds" 15 $v) -}}
-{{- $livenessFailureThreshold := int (dig "livenessProbe" "failureThreshold" 3 $v) -}}
-{{- $livenessTimeoutSeconds := int (dig "livenessProbe" "timeoutSeconds" 5 $v) -}}
-{{- $startupProbeEnabled := dig "startupProbe" "enabled" $isGateway $v -}}
-{{- $startupProbePath := dig "startupProbe" "path" "/_health" $v -}}
-{{- $startupProbeInitialDelaySeconds := int (dig "startupProbe" "initialDelaySeconds" 0 $v) -}}
-{{- $startupProbePeriodSeconds := int (dig "startupProbe" "periodSeconds" 5 $v) -}}
-{{- $startupProbeFailureThreshold := int (dig "startupProbe" "failureThreshold" 30 $v) -}}
-{{- $startupProbeTimeoutSeconds := int (dig "startupProbe" "timeoutSeconds" 5 $v) -}}
-{{- $preStopDrainEnabled := dig "preStopDrain" "enabled" $isGateway $v -}}
-{{- $preStopDrainPath := dig "preStopDrain" "path" "/_health/drain" $v -}}
-{{- $preStopDrainSleepSeconds := int (dig "preStopDrain" "sleepSeconds" 20 $v) -}}
-{{- $preStopDrainTimeoutSeconds := int (dig "preStopDrain" "timeoutSeconds" 2 $v) -}}
-{{- $preStopDrainRetryCount := int (dig "preStopDrain" "retryCount" 6 $v) -}}
-{{- $preStopDrainRetryIntervalSeconds := int (dig "preStopDrain" "retryIntervalSeconds" 1 $v) -}}
-{{- $preStopDrainCommand := printf "attempt=0; while [ \"$attempt\" -lt %d ]; do curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 && break; attempt=$((attempt+1)); sleep %d; done; sleep %d" $preStopDrainRetryCount $preStopDrainTimeoutSeconds (int $v.port) $preStopDrainPath $preStopDrainRetryIntervalSeconds $preStopDrainSleepSeconds -}}
-{{- $build := get $v "build" | default (dict) -}}
-{{- $buildVersion := get $build "version" | default $v.tag -}}
-{{- $buildSha := get $build "sha" | default "" -}}
-{{- $buildChannel := get $build "channel" | default "" -}}
-{{- $nsfwServiceEndpoint := get $v "nsfwServiceEndpoint" | default "" -}}
-{{- $cluster := get $ctx.Values "cluster" | default (dict) -}}
-{{- $gatewayClusterEnabled := and $isGateway (eq (get $cluster "enabled" | default false) true) -}}
-{{- $erlangDistribution := get $cluster "erlangDistribution" | default (dict) -}}
-{{- $erlangDistPort := int (get $erlangDistribution "port" | default 8081) -}}
-{{- $erlangEpmdPort := int (get $erlangDistribution "epmdPort" | default 4369) -}}
-{{- $erlangCookieSecret := get $cluster "erlangCookieSecret" | default (dict) -}}
-{{- $erlangCookieSecretName := get $erlangCookieSecret "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $erlangCookieSecretKey := get $erlangCookieSecret "key" | default "cookie" -}}
-{{- $gatewayNodeBasename := get $cluster "discoveryNodeBasename" | default "fluxer_gateway" -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  replicas: {{ include "fluxer.replicas" (dict "name" $name "values" $v "context" $ctx) }}
-  minReadySeconds: {{ $minReadySeconds }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 6 }}
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: {{ $maxSurge | toJson }}
-      maxUnavailable: {{ $maxUnavailable | toJson }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ctx | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 8 }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ctx | nindent 6 }}
-      terminationGracePeriodSeconds: {{ $terminationGracePeriodSeconds }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $v.affinity }}
-      affinity:
-        {{- toYaml $v.affinity | nindent 8 }}
-      {{- else if $isGateway }}
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: gateway
-                    app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-                topologyKey: kubernetes.io/hostname
-      {{- end }}
-      {{- if $v.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $v.topologySpreadConstraints | nindent 8 }}
-      {{- else if $isGateway }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: gateway
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          nodeAffinityPolicy: Honor
-          nodeTaintsPolicy: Honor
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- end }}
-      {{- if $v.nodeSelector }}
-      nodeSelector:
-        {{- toYaml $v.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $v.tolerations }}
-      tolerations:
-        {{- toYaml $v.tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: {{ $name }}
-          image: {{ include "fluxer.image" (dict "image" $v.image "tag" $v.tag "context" $ctx) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          {{- if $v.command }}
-          command: {{ $v.command | toJson }}
-          {{- end }}
-          ports:
-            - name: http
-              containerPort: {{ $v.port }}
-              protocol: TCP
-            {{- if $gatewayClusterEnabled }}
-            - name: epmd
-              containerPort: {{ $erlangEpmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $erlangDistPort }}
-              protocol: TCP
-            {{- end }}
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            {{- if $gatewayClusterEnabled }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $gatewayNodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $erlangDistPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $erlangCookieSecretName }}
-                  key: {{ $erlangCookieSecretKey }}
-            {{- end }}
-            {{- if $buildVersion }}
-            - name: BUILD_VERSION
-              value: {{ $buildVersion | quote }}
-            {{- end }}
-            {{- if $buildSha }}
-            - name: BUILD_SHA
-              value: {{ $buildSha | quote }}
-            {{- end }}
-            {{- if $buildChannel }}
-            - name: RELEASE_CHANNEL
-              value: {{ $buildChannel | quote }}
-            {{- end }}
-            {{- if $nsfwServiceEndpoint }}
-            - name: FLUXER_NSFW_SERVICE_ENDPOINT
-              value: {{ $nsfwServiceEndpoint | quote }}
-            {{- end }}
-            {{- if $ctx.Values.global.env }}
-            {{- toYaml $ctx.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $v.env }}
-            {{- toYaml $v.env | nindent 12 }}
-            {{- end }}
-          {{- if or $ctx.Values.global.envFrom $v.envFrom }}
-          envFrom:
-            {{- if $ctx.Values.global.envFrom }}
-            {{- toYaml $ctx.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $v.envFrom }}
-            {{- toYaml $v.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          {{- if $preStopDrainEnabled }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ $preStopDrainCommand | quote }}
-          {{- end }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          {{- if not $v.noHealthCheck }}
-          livenessProbe:
-            httpGet:
-              path: {{ $livenessPath | quote }}
-              port: http
-            initialDelaySeconds: {{ $livenessInitialDelaySeconds }}
-            periodSeconds: {{ $livenessPeriodSeconds }}
-            timeoutSeconds: {{ $livenessTimeoutSeconds }}
-            failureThreshold: {{ $livenessFailureThreshold }}
-          readinessProbe:
-            {{- if $readinessExecEnabled }}
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ $readinessExecCommand | quote }}
-            {{- else }}
-            httpGet:
-              path: {{ $readinessPath | quote }}
-              port: http
-            {{- end }}
-            initialDelaySeconds: {{ $readinessInitialDelaySeconds }}
-            periodSeconds: {{ $readinessPeriodSeconds }}
-            timeoutSeconds: {{ $readinessTimeoutSeconds }}
-            failureThreshold: {{ $readinessFailureThreshold }}
-          {{- if $startupProbeEnabled }}
-          startupProbe:
-            httpGet:
-              path: {{ $startupProbePath | quote }}
-              port: http
-            initialDelaySeconds: {{ $startupProbeInitialDelaySeconds }}
-            periodSeconds: {{ $startupProbePeriodSeconds }}
-            timeoutSeconds: {{ $startupProbeTimeoutSeconds }}
-            failureThreshold: {{ $startupProbeFailureThreshold }}
-          {{- end }}
-          {{- end }}
-          resources:
-            {{- toYaml $v.resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{- end }}
-
-{{- define "fluxer.service" -}}
-{{- $name := .name -}}
-{{- $selectorName := .selectorName | default $name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  type: ClusterIP
-  ports:
-    - port: {{ $v.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fluxer.selectorLabels" (dict "name" $selectorName "context" $ctx) | nindent 4 }}
-{{- end }}
-
-{{- define "fluxer.pdb" -}}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ .name }}-pdb
-  namespace: {{ .context.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" .context | nindent 4 }}
-spec:
-  minAvailable: {{ .minAvailable }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" .name "context" .context) | nindent 6 }}
-{{- end }}
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: docs
-description: Fluxer documentation service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,23 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-docs
-  name: docs
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 128Mi
-    requests:
-      cpu: 50m
-      memory: 64Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-pdb:
-  minAvailable: 50%
@@ -1,22 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  resources:
-    requests:
-      cpu: 50m
-      memory: 64Mi
-    limits:
-      memory: 128Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: gateway
-description: Fluxer WebSocket gateway service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ $gatewayValues := .Values.gateway -}}
-{{- $cluster := .Values.cluster | default dict -}}
-{{- if dig "enabled" false $cluster -}}
-{{- $clusterEnv := list
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_ENABLED" "value" "true")
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME" "value" (dig "discoveryDnsName" "" $cluster))
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME" "value" (dig "discoveryNodeBasename" "fluxer_gateway" $cluster))
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS" "value" (printf "%d" (int (dig "discoveryPollIntervalMs" 5000 $cluster))))
-}}
-{{- if dig "enabled" false .Values.roles -}}
-{{- $clusterEnv = concat (list (dict "name" "FLUXER_GATEWAY_ROLE" "value" (dig "websocket" "role" "websocket" .Values.roles))) $clusterEnv -}}
-{{- end -}}
-{{- $gatewayValues = mergeOverwrite (deepCopy .Values.gateway) (dict "env" (concat $clusterEnv (get .Values.gateway "env" | default (list)))) -}}
-{{- end }}
-{{- $hotpatch := get .Values.gateway "hotpatch" | default dict -}}
-{{- if dig "enabled" false $hotpatch -}}
-{{- $hotpatchEnv := list
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_ENABLED" "value" "true")
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT" "value" (printf "%d" (int (get $hotpatch "cassandraPort" | default 9042))))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE" "value" (get $hotpatch "cassandraKeyspace" | default "fluxer"))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS" "value" (printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000))))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS" "value" (printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000))))
-}}
-{{- if get $hotpatch "cassandraHosts" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS" "value" (get $hotpatch "cassandraHosts")) -}}
-{{- end -}}
-{{- $publicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}}
-{{- if get $publicKeysSecret "name" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS" "valueFrom" (dict "secretKeyRef" (dict "name" (get $publicKeysSecret "name") "key" (get $publicKeysSecret "key" | default "public_keys")))) -}}
-{{- end -}}
-{{- $credentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}}
-{{- if get $credentialsSecret "name" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "usernameKey" | default "username")))) -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "passwordKey" | default "password")))) -}}
-{{- end -}}
-{{- $gatewayValues = mergeOverwrite (deepCopy $gatewayValues) (dict "env" (concat $hotpatchEnv (get $gatewayValues "env" | default (list)))) -}}
-{{- end }}
-{{ include "fluxer.deployment" (dict "name" "gateway" "values" $gatewayValues "context" .) }}
@@ -1,70 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) }}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) }}
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: gateway
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-spec:
-  podSelector:
-    matchLabels:
-      {{- if dig "enabled" false .Values.roles }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
-      app.kubernetes.io/part-of: fluxer
-      {{- else }}
-      {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 6 }}
-      {{- end }}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: ingress-nginx
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: api
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: api-canary
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-realtime
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-lifecycle
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-batch
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              {{- if dig "enabled" false .Values.roles }}
-              app.kubernetes.io/instance: {{ .Release.Name }}
-              app.kubernetes.io/part-of: fluxer
-              {{- else }}
-              {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 14 }}
-              {{- end }}
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-        {{- if $clusterEnabled }}
-        - port: {{ $epmdPort }}
-          protocol: TCP
-        - port: {{ $distPort }}
-          protocol: TCP
-        {{- end }}
-  egress:
-    - {}
@@ -1,5 +0,0 @@
-{{- if and .Values.pdb.enabled (gt (int .Values.gateway.replicas) 1) }}
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ include "fluxer.pdb" (dict "name" "gateway" "minAvailable" .Values.pdb.minAvailable "context" .) }}
-{{- end }}
@@ -1,40 +0,0 @@
-{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) -}}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) -}}
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" "gateway" "values" .Values.gateway "context" .)}}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: fluxer-gateway-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }}
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - port: {{ .Values.gateway.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-    {{- if $clusterEnabled }}
-    - port: {{ $epmdPort }}
-      targetPort: epmd
-      protocol: TCP
-      name: epmd
-    - port: {{ $distPort }}
-      targetPort: erl-dist
-      protocol: TCP
-      name: erl-dist
-    {{- end }}
-  selector:
-    {{- if dig "enabled" false .Values.roles }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: fluxer
-    {{- else }}
-    {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }}
-    {{- end }}
@@ -1,255 +0,0 @@
-{{- if dig "enabled" false .Values.roles }}
-{{- $cluster := .Values.cluster | default dict -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 $cluster) -}}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 $cluster) -}}
-{{- $cookie := dig "erlangCookieSecret" (dict) $cluster -}}
-{{- $cookieName := get $cookie "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $cookieKey := get $cookie "key" | default "cookie" -}}
-{{- $nodeBasename := dig "discoveryNodeBasename" "fluxer_gateway" $cluster -}}
-{{- $dnsName := dig "discoveryDnsName" "" $cluster -}}
-{{- if not $dnsName }}
-{{- fail "cluster.discoveryDnsName is required when roles.enabled=true" }}
-{{- end }}
-{{- $pollIntervalMs := int (dig "discoveryPollIntervalMs" 5000 $cluster) -}}
-{{- $gateway := .Values.gateway -}}
-{{- $common := .Values.roles.common | default dict -}}
-{{- $build := get $gateway "build" | default dict -}}
-{{- $hotpatch := get $gateway "hotpatch" | default dict -}}
-{{- $hotpatchPublicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}}
-{{- $hotpatchCredentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}}
-{{- $roles := list "sessions" "presence" "guilds" "calls" "push" -}}
-{{- range $role := $roles }}
-{{- $roleValues := get $.Values.roles $role | default dict -}}
-{{- if dig "enabled" true $roleValues }}
-{{- $name := printf "gateway-%s" $role -}}
-{{- $replicas := int (dig "replicas" (dig "replicas" 1 $common) $roleValues) -}}
-{{- $resources := get $roleValues "resources" | default (get $common "resources" | default $gateway.resources) -}}
-{{- $nodeSelector := get $roleValues "nodeSelector" | default (get $common "nodeSelector" | default $gateway.nodeSelector) -}}
-{{- $tolerations := get $roleValues "tolerations" | default (get $common "tolerations" | default $gateway.tolerations) -}}
-{{- $affinity := get $roleValues "affinity" | default (get $common "affinity" | default dict) -}}
-{{- $topologySpreadConstraints := get $roleValues "topologySpreadConstraints" | default (get $common "topologySpreadConstraints" | default list) -}}
---
-# SPDX-License-Identifier: AGPL-3.0-or-later
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: {{ $name }}
-  namespace: {{ $.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 4 }}
-spec:
-  serviceName: fluxer-gateway-headless
-  replicas: {{ $replicas }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 6 }}
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 8 }}
-        app.kubernetes.io/gateway-role: {{ $role | quote }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ | nindent 6 }}
-      terminationGracePeriodSeconds: {{ int (dig "terminationGracePeriodSeconds" 45 $roleValues) }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $affinity }}
-      affinity:
-        {{- toYaml $affinity | nindent 8 }}
-      {{- end }}
-      {{- if $topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $topologySpreadConstraints | nindent 8 }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $.Release.Name }}
-      {{- end }}
-      {{- if $nodeSelector }}
-      nodeSelector:
-        {{- toYaml $nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $tolerations }}
-      tolerations:
-        {{- toYaml $tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: gateway
-          image: {{ include "fluxer.image" (dict "image" $gateway.image "tag" $gateway.tag "context" $) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          ports:
-            - name: http
-              containerPort: {{ $gateway.port }}
-              protocol: TCP
-            - name: epmd
-              containerPort: {{ $epmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $distPort }}
-              protocol: TCP
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            - name: FLUXER_GATEWAY_ROLE
-              value: {{ $role | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_ENABLED
-              value: "true"
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME
-              value: {{ $dnsName | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME
-              value: {{ $nodeBasename | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS
-              value: {{ printf "%d" $pollIntervalMs | quote }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $nodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $distPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $cookieName }}
-                  key: {{ $cookieKey }}
-            {{- if get $build "sha" }}
-            - name: BUILD_SHA
-              value: {{ get $build "sha" | quote }}
-            {{- end }}
-            {{- if get $build "number" }}
-            - name: BUILD_NUMBER
-              value: {{ get $build "number" | quote }}
-            {{- end }}
-            {{- if get $build "timestamp" }}
-            - name: BUILD_TIMESTAMP
-              value: {{ get $build "timestamp" | quote }}
-            {{- end }}
-            {{- if get $build "channel" }}
-            - name: RELEASE_CHANNEL
-              value: {{ get $build "channel" | quote }}
-            {{- end }}
-            {{- if dig "enabled" false $hotpatch }}
-            - name: FLUXER_GATEWAY_HOTPATCH_ENABLED
-              value: "true"
-            {{- if get $hotpatch "cassandraHosts" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS
-              value: {{ get $hotpatch "cassandraHosts" | quote }}
-            {{- end }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT
-              value: {{ printf "%d" (int (get $hotpatch "cassandraPort" | default 9042)) | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE
-              value: {{ get $hotpatch "cassandraKeyspace" | default "fluxer" | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS
-              value: {{ printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000)) | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS
-              value: {{ printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000)) | quote }}
-            {{- if get $hotpatchPublicKeysSecret "name" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchPublicKeysSecret "name" | quote }}
-                  key: {{ get $hotpatchPublicKeysSecret "key" | default "public_keys" | quote }}
-            {{- end }}
-            {{- if get $hotpatchCredentialsSecret "name" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchCredentialsSecret "name" | quote }}
-                  key: {{ get $hotpatchCredentialsSecret "usernameKey" | default "username" | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchCredentialsSecret "name" | quote }}
-                  key: {{ get $hotpatchCredentialsSecret "passwordKey" | default "password" | quote }}
-            {{- end }}
-            {{- end }}
-            {{- if $.Values.global.env }}
-            {{- toYaml $.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $gateway.env }}
-            {{- toYaml $gateway.env | nindent 12 }}
-            {{- end }}
-            {{- if $common.env }}
-            {{- toYaml $common.env | nindent 12 }}
-            {{- end }}
-            {{- if $roleValues.env }}
-            {{- toYaml $roleValues.env | nindent 12 }}
-            {{- end }}
-          {{- if or $.Values.global.envFrom $gateway.envFrom $common.envFrom $roleValues.envFrom }}
-          envFrom:
-            {{- if $.Values.global.envFrom }}
-            {{- toYaml $.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $gateway.envFrom }}
-            {{- toYaml $gateway.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $common.envFrom }}
-            {{- toYaml $common.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $roleValues.envFrom }}
-            {{- toYaml $roleValues.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ printf "curl -fsS --max-time 2 http://127.0.0.1:%d/_health/drain >/dev/null 2>&1 || true; sleep 20" (int $gateway.port) | quote }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: "/_health"
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ printf "curl -fsS --max-time 5 http://127.0.0.1:%d/_health/ready >/dev/null 2>&1 || exit 1" (int $gateway.port) | quote }}
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 3
-          startupProbe:
-            httpGet:
-              path: "/_health"
-              port: http
-            initialDelaySeconds: 0
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 30
-          resources:
-            {{- toYaml $resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{ end }}
-{{ end }}
-{{ end }}
@@ -1,164 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-gateway release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-gateway
-# Apply with:    helm upgrade fluxer-gateway deploy/helm/gateway -f deploy/helm/gateway/values.yaml -f deploy/helm/gateway/values.prod.yaml
-
-cluster:
-  discoveryDnsName: fluxer-gateway-headless.fluxer.svc.cluster.local
-  discoveryNodeBasename: fluxer_gateway
-  discoveryPollIntervalMs: 5000
-  enabled: true
-  erlangCookieSecret:
-    key: cookie
-    name: fluxer-gateway-erlang-cookie
-  erlangDistribution:
-    epmdPort: 4369
-    port: 8081
-
-gateway:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT
-    value: "https://fluxerstatic.com"
-  - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES
-    value: "128"
-  - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES
-    value: "1048576"
-  image: fluxer-gateway
-  hotpatch:
-    enabled: true
-    cassandraHosts: int.flx-nyc-db1.srv.fluxer.dev
-    cassandraPort: 9041
-    cassandraKeyspace: fluxer
-    pollIntervalMs: 5000
-    startupSyncTimeoutMs: 30000
-    publicKeysSecret:
-      name: fluxer-gateway-hotpatch-public-keys
-      key: public_keys
-    cassandraCredentialsSecret:
-      name: fluxer-runtime-env-shared
-      usernameKey: FLUXER_CASSANDRA_USERNAME
-      passwordKey: FLUXER_CASSANDRA_PASSWORD
-  livenessProbe:
-    timeoutSeconds: 5
-  minReadySeconds: 0
-  nodeSelector: null
-  port: 8080
-  preStopDrain:
-    enabled: true
-    retryCount: 6
-    retryIntervalSeconds: 1
-    sleepSeconds: 30
-    timeoutSeconds: 2
-  preserveLiveReplicas: false
-  readinessProbe:
-    execEnabled: true
-    failureThreshold: 3
-    initialDelaySeconds: 5
-    path: /_health/ready
-    periodSeconds: 5
-    timeoutSeconds: 5
-  replicas: 16
-  resources:
-    limits:
-      memory: 16Gi
-    requests:
-      cpu: 500m
-      memory: 512Mi
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  startupProbe:
-    enabled: true
-    failureThreshold: 30
-    initialDelaySeconds: 0
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 5
-  tag: ""
-  terminationGracePeriodSeconds: 45
-  tolerations:
-  - effect: NoSchedule
-    key: dedicated
-    operator: Equal
-    value: gateway
-roles:
-  enabled: true
-  websocket:
-    role: websocket
-  common:
-    nodeSelector: null
-    resources:
-      requests:
-        cpu: 500m
-        memory: 768Mi
-      limits:
-        memory: 12Gi
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 60
-          preference:
-            matchExpressions:
-            - key: node.kubernetes.io/instance-type
-              operator: In
-              values:
-              - vhf-16c-58gb
-  sessions:
-    enabled: true
-    replicas: 12
-    resources:
-      requests:
-        cpu: 750m
-        memory: 2Gi
-      limits:
-        memory: 16Gi
-  presence:
-    enabled: true
-    replicas: 6
-    resources:
-      requests:
-        cpu: 500m
-        memory: 768Mi
-      limits:
-        memory: 6Gi
-  guilds:
-    enabled: true
-    replicas: 12
-    resources:
-      requests:
-        cpu: 750m
-        memory: 1Gi
-      limits:
-        memory: 8Gi
-  calls:
-    enabled: true
-    replicas: 4
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 4Gi
-  push:
-    enabled: true
-    replicas: 4
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 4Gi
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-shared
-pdb:
-  enabled: false
-  minAvailable: 1
@@ -1,118 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-gateway:
-  image: fluxer-gateway
-  tag: ''
-  replicas: 1
-  preserveLiveReplicas: false
-  port: 8080
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  minReadySeconds: 0
-  terminationGracePeriodSeconds: 45
-  readinessProbe:
-    path: /_health/ready
-    execEnabled: true
-    timeoutSeconds: 5
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    failureThreshold: 3
-  livenessProbe:
-    timeoutSeconds: 5
-  startupProbe:
-    enabled: true
-    path: /_health
-    initialDelaySeconds: 0
-    periodSeconds: 5
-    failureThreshold: 30
-    timeoutSeconds: 5
-  preStopDrain:
-    enabled: true
-    sleepSeconds: 30
-    timeoutSeconds: 2
-    retryCount: 6
-    retryIntervalSeconds: 1
-  nodeSelector:
-    kubernetes.io/hostname: flx-nyc-k8s-worker-efd1167e6219
-  tolerations:
-    - key: dedicated
-      operator: Equal
-      value: gateway
-      effect: NoSchedule
-  resources:
-    requests:
-      cpu: 500m
-      memory: 512Mi
-    limits:
-      memory: 16Gi
-  env:
-    - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT
-      value: "https://fluxerstatic.com"
-    - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES
-      value: "128"
-    - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES
-      value: "1048576"
-  hotpatch:
-    enabled: false
-    cassandraHosts: ''
-    cassandraPort: 9042
-    cassandraKeyspace: fluxer
-    pollIntervalMs: 5000
-    startupSyncTimeoutMs: 30000
-    publicKeysSecret:
-      name: ''
-      key: public_keys
-    cassandraCredentialsSecret:
-      name: ''
-      usernameKey: username
-      passwordKey: password
-
-cluster:
-  enabled: false
-  discoveryDnsName: ''
-  discoveryNodeBasename: fluxer_gateway
-  discoveryPollIntervalMs: 5000
-  erlangDistribution:
-    port: 8081
-    epmdPort: 4369
-  erlangCookieSecret:
-    name: fluxer-gateway-erlang-cookie
-    key: cookie
-
-roles:
-  enabled: false
-  websocket:
-    role: websocket
-  common:
-    replicas: 1
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 8Gi
-  sessions:
-    enabled: true
-    replicas: 1
-  presence:
-    enabled: true
-    replicas: 1
-  guilds:
-    enabled: true
-    replicas: 1
-  calls:
-    enabled: true
-    replicas: 1
-  push:
-    enabled: true
-    replicas: 1
-
-pdb:
-  enabled: false
-  minAvailable: 1
@@ -1,9 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: gifs
-version: 0.1.0
-dependencies:
-  - name: svc-common
-    version: 0.1.0
-    repository: file://../svc-common
@@ -1,13 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ include "svc-common.statefulset" . }}
---
-{{ include "svc-common.deployment" . }}
---
-{{ include "svc-common.headless-service" . }}
---
-{{ include "svc-common.service" . }}
---
-{{ include "svc-common.pdb" . }}
---
-{{ include "svc-common.router-pdb" . }}
@@ -1,32 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-svc:
-  shard:
-    replicas: 4
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        memory: 1Gi
-  router:
-    replicas: 3
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        memory: 512Mi
-  cache:
-    maxEntries: 500000
-    ttlMs: '30000'
-  extraEnv:
-    - name: FLUXER_MEDIA_PROXY_ENDPOINT
-      value: http://media-proxy:8080
-    - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT
-      value: https://fluxerusercontent.com
-    - name: FLUXER_MEDIA_PROXY_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-media-proxy-v2-env
-          key: FLUXER_MEDIA_PROXY_SECRET_KEY
@@ -1,55 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-svc:
-  name: gifs
-  image: fluxer-gifs
-  tag: ''
-  shard:
-    replicas: 2
-    port: 8090
-    minReadySeconds: 10
-    terminationGracePeriodSeconds: 60
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        memory: 512Mi
-  router:
-    replicas: 2
-    port: 8090
-    minReadySeconds: 10
-    maxSurge: 1
-    maxUnavailable: 0
-    terminationGracePeriodSeconds: 60
-    resources:
-      requests:
-        cpu: 100m
-        memory: 128Mi
-      limits:
-        memory: 256Mi
-  nats:
-    url: nats://nats-core:4222
-  cache:
-    maxEntries: 250000
-    ttlMs: '30000'
-  extraEnv:
-    - name: FLUXER_MEDIA_PROXY_ENDPOINT
-      value: http://media-proxy:8080
-    - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT
-      value: https://fluxerusercontent.com
-    - name: FLUXER_MEDIA_PROXY_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-media-proxy-v2-env
-          key: FLUXER_MEDIA_PROXY_SECRET_KEY
-  nodeSelector: {}
-  tolerations: []
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: infra
-description: Fluxer infrastructure (NATS, Valkey, Ingress)
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,133 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Daily sync of the MaxMind GeoLite2 City and ASN MMDB files into S3.
-# Runtime services read these out of the CDN bucket. Adopted into helm
-# from a previously hand-applied kubectl manifest.
-
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: geoip-sync
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    app.kubernetes.io/name: geoip-sync
-    {{- include "fluxer.labels" . | nindent 4 }}
-spec:
-  schedule: {{ .Values.geoipSync.schedule | quote }}
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      activeDeadlineSeconds: {{ .Values.geoipSync.activeDeadlineSeconds }}
-      backoffLimit: {{ .Values.geoipSync.backoffLimit }}
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/name: geoip-sync
-            app.kubernetes.io/part-of: fluxer
-        spec:
-          restartPolicy: OnFailure
-          terminationGracePeriodSeconds: 60
-          imagePullSecrets:
-            - name: {{ .Values.global.imagePullSecret }}
-          containers:
-            - name: sync
-              image: {{ .Values.geoipSync.image }}
-              imagePullPolicy: IfNotPresent
-              securityContext:
-                allowPrivilegeEscalation: false
-                readOnlyRootFilesystem: false
-                runAsNonRoot: true
-                runAsUser: 1000
-                runAsGroup: 1000
-                capabilities:
-                  drop: ["ALL"]
-                seccompProfile:
-                  type: RuntimeDefault
-              env:
-                - name: GEOIP_BUCKET
-                  value: {{ .Values.geoipSync.bucket | quote }}
-                - name: GEOIP_CITY_UPSTREAM_URL
-                  value: {{ .Values.geoipSync.cityUpstreamUrl | quote }}
-                - name: GEOIP_ASN_UPSTREAM_URL
-                  value: {{ .Values.geoipSync.asnUpstreamUrl | quote }}
-              envFrom:
-                - secretRef:
-                    name: {{ .Values.geoipSync.envSecret }}
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 256Mi
-                limits:
-                  memory: 512Mi
-              command:
-                - sh
-                - -c
-                - |
-                  set -eu
-
-                  : "${GEOIP_BUCKET:?missing GEOIP_BUCKET}"
-                  : "${GEOIP_CITY_UPSTREAM_URL:?missing GEOIP_CITY_UPSTREAM_URL}"
-                  : "${GEOIP_ASN_UPSTREAM_URL:?missing GEOIP_ASN_UPSTREAM_URL}"
-                  : "${FLUXER_S3_ACCESS_KEY_ID:?missing FLUXER_S3_ACCESS_KEY_ID}"
-                  : "${FLUXER_S3_SECRET_ACCESS_KEY:?missing FLUXER_S3_SECRET_ACCESS_KEY}"
-                  : "${FLUXER_S3_ENDPOINT:?missing FLUXER_S3_ENDPOINT}"
-                  : "${FLUXER_S3_REGION:?missing FLUXER_S3_REGION}"
-
-                  export AWS_ACCESS_KEY_ID="$FLUXER_S3_ACCESS_KEY_ID"
-                  export AWS_SECRET_ACCESS_KEY="$FLUXER_S3_SECRET_ACCESS_KEY"
-                  export AWS_DEFAULT_REGION="$FLUXER_S3_REGION"
-
-                  WORKDIR=$(mktemp -d)
-                  trap 'rm -rf "$WORKDIR"' EXIT
-
-                  # MMDB files end with the ASCII string "MaxMind.com" after
-                  # their metadata marker. Verifying this tail before upload
-                  # catches the case where an upstream returns an HTML error
-                  # page or a zero-byte body.
-                  fetch_and_verify() {
-                    local url="$1"
-                    local dest="$2"
-                    echo "-> fetching $url"
-                    curl --fail --location --silent --show-error \
-                         --user-agent 'fluxer-geoip-sync/1.0' \
-                         --max-time 120 \
-                         --output "$dest" \
-                         "$url"
-                    local size
-                    size=$(wc -c < "$dest")
-                    if [ "$size" -lt 1024 ]; then
-                      echo "refusing to upload ${dest}: file is ${size} bytes, too small" >&2
-                      return 1
-                    fi
-                    if ! tail -c 2048 "$dest" | grep -q "MaxMind.com"; then
-                      echo "refusing to upload ${dest}: MaxMind.com marker not found in trailer" >&2
-                      return 1
-                    fi
-                    echo "   ok (${size} bytes)"
-                  }
-
-                  fetch_and_verify "$GEOIP_CITY_UPSTREAM_URL" "$WORKDIR/GeoLite2-City.mmdb"
-                  fetch_and_verify "$GEOIP_ASN_UPSTREAM_URL"  "$WORKDIR/GeoLite2-ASN.mmdb"
-
-                  # Atomic-ish replacement: upload to a versioned side-key
-                  # first, then copy to the canonical key. If the final copy
-                  # fails the previous canonical file is untouched.
-                  STAMP=$(date -u +%Y%m%dT%H%M%SZ)
-
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-City.mmdb" \
-                      "s3://${GEOIP_BUCKET}/archive/GeoLite2-City-${STAMP}.mmdb"
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-ASN.mmdb" \
-                      "s3://${GEOIP_BUCKET}/archive/GeoLite2-ASN-${STAMP}.mmdb"
-
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-City.mmdb" \
-                      "s3://${GEOIP_BUCKET}/GeoLite2-City.mmdb"
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-ASN.mmdb" \
-                      "s3://${GEOIP_BUCKET}/GeoLite2-ASN.mmdb"
-
-                  echo "geoip-sync complete: city=${STAMP} asn=${STAMP}"
@@ -1,278 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ $hosts := .Values.ingress.hosts -}}
-{{ $ports := .Values.ports -}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.api }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api
-                port:
-                  number: {{ $ports.api }}
-
-    - host: {{ $hosts.apiCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api-canary
-                port:
-                  number: {{ $ports.apiCanary }}
-
-    - host: {{ $hosts.appProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: app-proxy
-                port:
-                  number: {{ $ports.appProxy }}
-
-    - host: {{ $hosts.appProxyCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: app-proxy-canary
-                port:
-                  number: {{ $ports.appProxyCanary }}
-
-    - host: {{ $hosts.admin }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: admin
-                port:
-                  number: {{ $ports.admin }}
-
-    - host: {{ $hosts.adminCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: admin-canary
-                port:
-                  number: {{ $ports.adminCanary }}
-
-    - host: {{ $hosts.marketing }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- with $hosts.help }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-{{- with $hosts.blog }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-{{- with $hosts.docs }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: docs
-                port:
-                  number: {{ $ports.docs }}
-
-{{- end }}
-{{- range $hosts.marketingAliases }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-    - host: {{ $hosts.marketingCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing-canary
-                port:
-                  number: {{ $ports.marketingCanary }}
-
-    - host: {{ $hosts.mediaProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: media-proxy
-                port:
-                  number: {{ $ports.mediaProxy }}
-
-    - host: {{ $hosts.staticProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: static-proxy
-                port:
-                  number: {{ $ports.staticProxy }}
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-gateway
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: gateway
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.gateway }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gateway
-                port:
-                  number: {{ $ports.gateway }}
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-api-proxy
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/use-regex: "true"
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.appProxy }}
-      http:
-        paths:
-          - path: /api(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: api
-                port:
-                  number: {{ $ports.api }}
-
-    - host: {{ $hosts.appProxyCanary }}
-      http:
-        paths:
-          - path: /api(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: api-canary
-                port:
-                  number: {{ $ports.apiCanary }}
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-uploads
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "500m"
-    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "900"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: "1m"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-
-    - host: {{ $hosts.uploads }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: uploads
-                port:
-                  number: {{ $ports.uploads }}
@@ -1,26 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nats-config
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-data:
-  nats.conf: |
-    listen: 0.0.0.0:{{ .Values.nats.clientPort }}
-    http: 0.0.0.0:{{ .Values.nats.monitorPort }}
-    max_payload: {{ .Values.nats.maxPayload | default "64MB" }}
-    max_pending: {{ .Values.nats.maxPending | default "128MB" }}
-    max_connections: {{ .Values.nats.maxConnections | default 2048 }}
-
-    cluster {
-      name: fluxer-nats
-      listen: 0.0.0.0:{{ .Values.nats.clusterPort }}
-
-      routes = [
-        {{- range $i := until (int .Values.nats.replicas) }}
-        nats-route://nats-{{ $i }}.nats-headless.{{ $.Values.global.namespace }}.svc.cluster.local:{{ $.Values.nats.clusterPort }}
-        {{- end }}
-      ]
-    }
@@ -1,44 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: nats-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - name: client
-      port: {{ .Values.nats.clientPort }}
-      targetPort: client
-    - name: cluster
-      port: {{ .Values.nats.clusterPort }}
-      targetPort: cluster
-    - name: monitor
-      port: {{ .Values.nats.monitorPort }}
-      targetPort: monitor
-  selector:
-    app.kubernetes.io/name: nats
-    app.kubernetes.io/instance: {{ .Release.Name }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: nats-core
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  type: ClusterIP
-  ports:
-    - name: client
-      port: {{ .Values.nats.clientPort }}
-      targetPort: client
-  selector:
-    app.kubernetes.io/name: nats
-    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -1,63 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: nats
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  serviceName: nats-headless
-  replicas: {{ .Values.nats.replicas }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: nats
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" . | nindent 8 }}
-        app.kubernetes.io/name: nats
-        app.kubernetes.io/instance: {{ .Release.Name }}
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/nats-configmap.yaml") . | sha256sum }}
-    spec:
-      terminationGracePeriodSeconds: 30
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: nats
-          image: {{ .Values.nats.image }}:{{ .Values.nats.tag }}
-          args: ["-c", "/etc/nats/nats.conf"]
-          ports:
-            - name: client
-              containerPort: {{ .Values.nats.clientPort }}
-            - name: cluster
-              containerPort: {{ .Values.nats.clusterPort }}
-            - name: monitor
-              containerPort: {{ .Values.nats.monitorPort }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: monitor
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /healthz?js-enabled-only=true
-              port: monitor
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          volumeMounts:
-            - name: config
-              mountPath: /etc/nats
-          resources:
-            {{- toYaml .Values.nats.resources | nindent 12 }}
-      volumes:
-        - name: config
-          configMap:
-            name: nats-config
@@ -1,14 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: nats-pdb
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-spec:
-  minAvailable: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: nats
-      app.kubernetes.io/instance: {{.Release.Name}}
--- a/Show More
+++ b/Show More