feat(auth): make passkey two-factor authentication opt-in (#2857 )

refactor(app-proxy): remove the stable time freeze (#2856 )
docs(downloads): one pacman repository holds both channels (#2855 )
2026-10-08 03:32:27 +09:00 · 2026-09-20 05:06:50 +02:00 · 2026-09-20 04:02:47 +02:00 · 2026-09-20 02:50:08 +02:00 · 2026-09-20 01:24:43 +02:00 · 2026-09-20 01:20:30 +02:00
6449 changed files with 731531 additions and 677762 deletions
@@ -1,22 +1,21 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG HELM_VERSION=4.2.0
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.122
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=12.4.2
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends \
+		acl \
 		bash \
-		brotli \
 		build-essential \
 		ca-certificates \
 		clang \
@@ -33,6 +32,7 @@ RUN apt-get update \
 		jq \
 		libasound2 \
 		libatk-bridge2.0-0 \
+		libaom-dev \
 		libavcodec-dev \
 		libavfilter-dev \
 		libavformat-dev \
@@ -42,19 +42,25 @@ RUN apt-get update \
 		libfido2-dev \
 		libgbm1 \
 		libgtk-3-0 \
+		libimage-exiftool-perl \
 		libnotify4 \
 		libnss3 \
 		libpipewire-0.3-dev \
 		libpulse-dev \
 		libsecret-1-0 \
 		libudev-dev \
-		libuv1-dev \
 		libcurl4-openssl-dev \
 		libswresample-dev \
 		libswscale-dev \
+		libdav1d-dev \
+		libde265-dev \
+		liblcms2-dev \
 		libvips-dev \
+		libyuv-dev \
 		libwayland-dev \
 		libwebp-dev \
+		nasm \
+		yasm \
 		libssl-dev \
 		libx11-xcb1 \
 		libxcb-dri3-0 \
@@ -71,16 +77,15 @@ RUN apt-get update \
 		ninja-build \
 		openssh-client \
 		pkg-config \
-		protobuf-compiler \
 		python3 \
 		python3-pip \
-		rsync \
+		python3-venv \
 		sudo \
 		rpm \
 		unzip \
-		webp \
 		xz-utils \
 		xdg-utils \
+		zlib1g-dev \
 		zstd \
 	&& rm -rf /var/lib/apt/lists/*

@@ -90,6 +95,7 @@ RUN apt-get update \
 		bat \
 		btop \
 		docker-cli \
+		docker-compose \
 		dnsutils \
 		fd-find \
 		gdb \
@@ -122,24 +128,33 @@ RUN apt-get update \
 	&& ln -sf /usr/bin/batcat /usr/local/bin/bat \
 	&& rm -rf /var/lib/apt/lists/*

-RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

-RUN ARCH="$(dpkg --print-architecture)" \
-	&& case "$ARCH" in \
-		amd64) HELM_ARCH="amd64" ;; \
-		arm64) HELM_ARCH="arm64" ;; \
-		*) echo "Unsupported architecture for Helm: $ARCH" >&2; exit 1 ;; \
-	esac \
-	&& curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${HELM_ARCH}.tar.gz" -o /tmp/helm.tgz \
-	&& tar -C /tmp -xzf /tmp/helm.tgz "linux-${HELM_ARCH}/helm" \
-	&& mv "/tmp/linux-${HELM_ARCH}/helm" /usr/local/bin/helm \
-	&& chmod +x /usr/local/bin/helm \
-	&& rm -rf /tmp/helm.tgz "/tmp/linux-${HELM_ARCH}"
+RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

-RUN python3 -m pip install --break-system-packages --no-cache-dir awscli cqlsh
+COPY fluxer_media_proxy/tools/install-native-deps.sh /tmp/fluxer-install-native-deps.sh
+RUN /tmp/fluxer-install-native-deps.sh /usr/local \
+	&& rm /tmp/fluxer-install-native-deps.sh
+
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+RUN printf '%s\n' \
+		'#include <libheif/heif.h>' \
+		'#include <string.h>' \
+		'#if !LIBHEIF_HAVE_VERSION(1, 23, 0)' \
+		'#error the source-built libheif headers must win the include search' \
+		'#endif' \
+		'int main(void) { return strcmp(heif_get_version(), LIBHEIF_VERSION) != 0; }' \
+		>/tmp/fluxer-heif-probe.c \
+	&& cc /tmp/fluxer-heif-probe.c $(pkg-config --cflags --libs libheif) -o /tmp/fluxer-heif-probe \
+	&& /tmp/fluxer-heif-probe \
+	&& [ "$(pkg-config --variable=prefix libheif)" = /usr/local ] \
+	&& rm /tmp/fluxer-heif-probe.c /tmp/fluxer-heif-probe

 COPY tools/fonts/requirements.txt /tmp/fluxer-fonts-requirements.txt
 RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer-fonts-requirements.txt \
@@ -147,18 +162,13 @@ RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer
 	&& pyftsubset --help >/dev/null \
 	&& python3 -c "import fontTools, brotli"

-RUN if ! command -v rebar3 >/dev/null 2>&1; then \
-		curl -fsSL https://s3.amazonaws.com/rebar3/rebar3 -o /usr/local/bin/rebar3 \
-		&& chmod +x /usr/local/bin/rebar3; \
-	fi
-
 RUN ARCH="$(dpkg --print-architecture)" \
 	&& case "$ARCH" in \
 		amd64) ELP_ARCH="x86_64" ;; \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -179,16 +189,10 @@ ENV DOCKER_HOST="unix:///var/run/docker.sock" \
 ENV CC_wasm32_unknown_unknown="clang" \
 	AR_wasm32_unknown_unknown="llvm-ar"

-RUN curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile default --component clippy,rustfmt \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --component clippy,rustfmt \
 	&& rustup target add wasm32-unknown-unknown \
 	&& cargo install cargo-watch --locked \
-	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked
-
-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
-RUN sudo apt-get update \
-	&& sudo apt-get install -y --no-install-recommends python3-venv \
-	&& sudo rm -rf /var/lib/apt/lists/*
+	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
+	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

 WORKDIR /workspaces/fluxer
@@ -5,20 +5,17 @@
 	"workspaceFolder": "/workspaces/fluxer",
 	"shutdownAction": "stopCompose",
 	"remoteUser": "vscode",
+	"hostRequirements": {
+		"cpus": 4,
+		"memory": "8gb",
+		"storage": "32gb"
+	},
 	"remoteEnv": {
 		"DOCKER_HOST": "unix:///var/run/docker.sock"
 	},
 	"runServices": ["workspace", "postgres", "valkey", "nats", "livekit", "meilisearch", "mailpit"],
-	"forwardPorts": [
-		3000, 8088, 8080, 8771, 8082, 3010, 3020, 8100, 8101, 8102, 8103, 8104, 8105, 8106, 8107, 8108, 8109, 8110, 8111,
-		8112, 8113, 8114, 8115, 8116, 8117, 8118, 8119, 8120, 8121, 8122, 8123, 8124, 8125, 3900, 8888, 9333, 9340, 23646,
-		4222, 7700, 7880, 7900, 9200, 8000
-	],
+	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3020, 8333],
 	"portsAttributes": {
-		"8000": {
-			"label": "Zensical docs",
-			"onAutoForward": "openBrowserOnce"
-		},
 		"8088": {
 			"label": "Fluxer dev proxy",
 			"onAutoForward": "notify"
@@ -29,36 +26,15 @@
 		"3020": {
 			"label": "Fluxer admin"
 		},
-		"8100": {
-			"label": "Fluxer Rust service health"
-		},
-		"3900": {
+		"8333": {
 			"label": "SeaweedFS S3"
 		},
-		"8888": {
-			"label": "SeaweedFS filer"
-		},
-		"9333": {
-			"label": "SeaweedFS master"
-		},
-		"9340": {
-			"label": "SeaweedFS volume"
-		},
-		"23646": {
-			"label": "SeaweedFS admin"
-		},
-		"7880": {
-			"label": "LiveKit"
-		},
-		"7700": {
-			"label": "Meilisearch"
-		},
-		"9200": {
-			"label": "Elasticsearch"
+		"8773": {
+			"label": "Fluxer app proxy"
 		}
 	},
-	"postCreateCommand": "sudo chown -R vscode:vscode /workspaces/fluxer/target && find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -exec sudo chown -R vscode:vscode {} + && sudo chown -R vscode:vscode /home/vscode/.local/share/pnpm && cargo run -p fluxer-dev -- bootstrap",
-	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && cargo run -p fluxer-dev -- post-start && bash /workspaces/fluxer/fluxer_docs/serve.sh --daemon",
+	"postCreateCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- bootstrap",
+	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- post-start",
 	"customizations": {
 		"vscode": {
 			"settings": {
@@ -7,15 +7,29 @@ services:
      dockerfile: .devcontainer/Dockerfile
    command: sleep infinity
    init: true
-    env_file:
-      - ../config/env/development.env
    environment:
-      FLUXER_SEARCH_ENGINE: meilisearch
-      FLUXER_SEARCH_URL: http://meilisearch:7700
-      FLUXER_SEARCH_API_KEY: fluxer-dev-meilisearch
-      FLUXER_POSTGRES_HOST: postgres
-      FLUXER_SELF_HOSTED: "true"
      DOCKER_HOST: unix:///var/run/docker.sock
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_API_CLIENT_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_APP_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_GATEWAY_ENDPOINT: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/gateway"
+      FLUXER_MEDIA_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_S3_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_LIVEKIT_URL: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/livekit"
+      FLUXER_LIVEKIT_INTERNAL_URL: "http://livekit:7880"
+      FLUXER_LIVEKIT_WEBHOOK_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api/webhooks/livekit"
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin/oauth2_callback"
+      FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: "http://localhost,http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
    volumes:
      - ..:/workspaces/fluxer:cached
      - type: volume
@@ -236,45 +250,30 @@ services:
        source: ${FLUXER_DOCKER_SOCKET:-/var/run/docker.sock}
        target: /var/run/docker.sock
    ports:
-      - "${FLUXER_DEV_DOCS_PORT:-8000}:8000"
-      - "${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
-      - "${FLUXER_DEV_PROXY_PORT:-8088}:8088"
-      - "${FLUXER_DEV_APP_PROXY_PORT:-8080}:8080"
-      - "${FLUXER_DEV_API_PORT:-8771}:8771"
-      - "${FLUXER_DEV_GATEWAY_PORT:-8082}:8082"
-      - "${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
-      - "${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
-      - "${FLUXER_DEV_RUST_SERVICE_PORTS:-8100-8125}:8100-8125"
-      - "${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
-      - "${FLUXER_DEV_SEAWEEDFS_FILER_PORT:-8888}:8888"
-      - "${FLUXER_DEV_SEAWEEDFS_MASTER_PORT:-9333}:9333"
-      - "${FLUXER_DEV_SEAWEEDFS_VOLUME_PORT:-9340}:9340"
-      - "${FLUXER_DEV_SEAWEEDFS_ADMIN_PORT:-23646}:23646"
+      - "127.0.0.1:${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
+      - "127.0.0.1:${FLUXER_DEV_PROXY_PORT:-8088}:8088"
+      - "127.0.0.1:${FLUXER_DEV_API_PORT:-8080}:8080"
+      - "127.0.0.1:${FLUXER_DEV_GATEWAY_PORT:-8771}:8771"
+      - "127.0.0.1:${FLUXER_DEV_MEDIA_PROXY_PORT:-8082}:8082"
+      - "127.0.0.1:${FLUXER_DEV_APP_PROXY_PORT:-8773}:8773"
+      - "127.0.0.1:${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
+      - "127.0.0.1:${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
    depends_on:
-      - postgres
-      - valkey
-      - nats
-      - livekit
-      - meilisearch
-      - mailpit
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_started
+      nats:
+        condition: service_started
+      livekit:
+        condition: service_started
+      meilisearch:
+        condition: service_healthy
+      mailpit:
+        condition: service_started
    extra_hosts:
      - "host.docker.internal:host-gateway"

-  cassandra:
-    image: cassandra:5.0.8
-    profiles:
-      - full
-    environment:
-      CASSANDRA_CLUSTER_NAME: fluxer-dev
-      CASSANDRA_DC: datacenter1
-      CASSANDRA_ENDPOINT_SNITCH: GossipingPropertyFileSnitch
-      HEAP_NEWSIZE: 128M
-      MAX_HEAP_SIZE: 768M
-    volumes:
-      - cassandra-data:/var/lib/cassandra
-    ports:
-      - "${FLUXER_DEV_CASSANDRA_PORT:-9042}:9042"
-
  postgres:
    image: postgres:16-alpine
    environment:
@@ -284,60 +283,62 @@ services:
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
-      - "${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+      - "127.0.0.1:${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U fluxer -d fluxer"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
-      - "${FLUXER_DEV_VALKEY_PORT:-6379}:6379"
+      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
    ports:
-      - "${FLUXER_DEV_NATS_PORT:-4222}:4222"
-      - "${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_PORT:-4222}:4222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"

  livekit:
    image: livekit/livekit-server:v1.12.0
    command: ["--config", "/etc/livekit.yaml", "--bind", "0.0.0.0"]
+    environment:
+      LIVEKIT_RTC_TCP_PORT: "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      LIVEKIT_RTC_UDP_PORT_START: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
+      LIVEKIT_RTC_UDP_PORT_END: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml:ro
    ports:
-      - "${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
-      - "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:7881"
-      - "${FLUXER_DEV_LIVEKIT_UDP_PORTS:-7882-7892}:7882-7892/udp"
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:9.3.2
-    profiles:
-      - full
-    environment:
-      discovery.type: single-node
-      xpack.security.enabled: "true"
-      xpack.security.http.ssl.enabled: "false"
-      ELASTIC_PASSWORD: fluxer-dev-elasticsearch
-      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
-    volumes:
-      - elasticsearch-data:/usr/share/elasticsearch/data
-    ports:
-      - "${FLUXER_DEV_ELASTICSEARCH_PORT:-9200}:9200"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
    ports:
-      - "${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+      - "127.0.0.1:${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:7700/health"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -394,9 +395,7 @@ volumes:
  cargo-registry:
  cargo-git:
  rust-target:
-  cassandra-data:
  nats-data:
-  elasticsearch-data:
  meilisearch-data:
  mailpit-data:
  postgres-data:
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: AGPL-3.0-or-later

-set -uo pipefail
+set -euo pipefail

 SOCKET="${DOCKER_SOCKET:-/var/run/docker.sock}"
-USER_NAME="${USER:-vscode}"
+USER_NAME="$(id -un)"

 if [ ! -S "$SOCKET" ]; then
 	echo "fix-docker-socket: no socket at $SOCKET; skipping (Docker-in-devcontainer will not work)"
@@ -16,31 +16,11 @@ if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
 	exit 0
 fi

-socket_gid="$(stat -c '%g' "$SOCKET" 2>/dev/null || echo "")"
-if [ -z "$socket_gid" ]; then
-	echo "fix-docker-socket: could not stat $SOCKET; skipping" >&2
-	exit 0
-fi
-
-sudo sh -c '
-	set -e
-	gid="$1"
-	user="$2"
-	socket="$3"
-	if ! getent group "$gid" >/dev/null 2>&1; then
-		groupadd --gid "$gid" docker-host
-	fi
-	group_name="$(getent group "$gid" | cut -d: -f1)"
-	usermod --append --groups "$group_name" "$user"
-	chgrp "$gid" "$socket"
-	chmod g+rw "$socket"
-' sh "$socket_gid" "$USER_NAME" "$SOCKET" || {
-	echo "fix-docker-socket: could not adjust $SOCKET; run docker with sudo" >&2
-	exit 0
-}
+sudo setfacl --modify "user:${USER_NAME}:rw" "$SOCKET"

 if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
-	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME (gid $socket_gid)"
+	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME"
 else
-	echo "fix-docker-socket: $SOCKET still unreachable as $USER_NAME; run docker with sudo" >&2
+	echo "fix-docker-socket: $SOCKET is still unreachable as $USER_NAME" >&2
+	exit 1
 fi
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -euo pipefail
+
+owner="$(id -u):$(id -g)"
+
+repair_tree() {
+	local path="$1"
+	local unwritable
+	if [ ! -d "$path" ]; then
+		echo "fix-workspace-permissions: expected mount is missing: $path" >&2
+		exit 1
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		sudo find "$path" -xdev \( -type d -o -type f \) -exec chown "$owner" {} +
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		echo "fix-workspace-permissions: $path is not writable as $(id -un)" >&2
+		exit 1
+	fi
+}
+
+for path in \
+	/workspaces/fluxer/target \
+	/home/vscode/.cargo/registry \
+	/home/vscode/.cargo/git \
+	/home/vscode/.local \
+	/home/vscode/.local/share/pnpm/store; do
+	repair_tree "$path"
+done
+
+while IFS= read -r -d '' path; do
+	if mountpoint -q "$path"; then
+		repair_tree "$path"
+	fi
+done < <(find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -print0)
@@ -1,11 +1,10 @@
 port: 7880

 keys:
-  devkey: secret
+  devkey: fluxer-livekit-development-secret

 rtc:
  tcp_port: 7881
-  udp_port: 7882-7892
  node_ip: 127.0.0.1
  use_mdns: true
  stun_servers:
@@ -7,10 +7,16 @@ QUICK=0
 SKIP_INSTALL=0
 for arg in "$@"; do
 	case "$arg" in
-		--quick) QUICK=1 ;;
-		--skip-install) SKIP_INSTALL=1 ;;
-		-h|--help) sed -n '2,25p' "$0"; exit 0 ;;
-		*) echo "unknown argument: $arg" >&2; exit 2 ;;
+	--quick) QUICK=1 ;;
+	--skip-install) SKIP_INSTALL=1 ;;
+	-h | --help)
+		sed -n '2,25p' "$0"
+		exit 0
+		;;
+	*)
+		echo "unknown argument: $arg" >&2
+		exit 2
+		;;
 	esac
 done

@@ -64,6 +70,7 @@ stage "app: typecheck" pnpm --filter fluxer_app typecheck
 stage "app: unit tests" pnpm --filter fluxer_app exec vitest run

 if [ "$QUICK" -eq 0 ]; then
+	stage "desktop: typecheck" pnpm --filter fluxer_desktop typecheck
 	stage "app: production build" pnpm --filter fluxer_app build
 fi

@@ -9,7 +9,6 @@
 **/.git/**
 /.github/
 /.pnpm-store/
-/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -29,7 +28,8 @@
 **/node_modules/
 **/target/
 **/test-results.json
-/fluxer_docs/site/
+/fluxer_docs/dist/
+/fluxer_docs/.astro/
 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
@@ -52,8 +52,6 @@
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 /fluxer_desktop/

@@ -1,7 +1,2 @@
 /.github/CODEOWNERS @fluxerapp/developers
 /.github/workflows/ @fluxerapp/developers
-/fluxer_marketing @fluxerapp/developers
-/.gitmodules @fluxerapp/developers
-/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
-/packages/i18n/marketing/ @fluxerapp/developers
-/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -25,7 +25,7 @@ Closes #456

 You must understand every line you submit and be able to explain why the change is correct.

-The [LLM usage policy](LLM_USAGE_POLICY.md) defines the authorship requirements for contributors who do not have write access.
+The [LLM usage policy](https://github.com/fluxerapp/fluxer/blob/main/.github/LLM_USAGE_POLICY.md) defines the authorship requirements for contributors who do not have write access.

 Each contribution must contain one coherent change. Do not include unrelated fixes, refactoring or formatting changes.

@@ -80,30 +80,12 @@ Complete every section of the pull request template. Clearly describe:

 Use the [bug report form](https://github.com/fluxerapp/fluxer/issues/new?template=bug-report.yaml) to report reproducible defects.

-Report security vulnerabilities privately through the channels specified in the [security policy](SECURITY.md). Do not report vulnerabilities in public issues or discussions.
+Report security vulnerabilities privately through the channels specified in the [security policy](https://github.com/fluxerapp/fluxer/blob/main/.github/SECURITY.md). Do not report vulnerabilities in public issues or discussions.

 Use [discussions](https://github.com/orgs/fluxerapp/discussions) for feature proposals and self-hosting questions.

 Submit translations through [Weblate](https://weblate.fluxer.tools), not through pull requests.

-All repository activity is governed by the [Code of Conduct](CODE_OF_CONDUCT.md).
+All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

-Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](../LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
-
-## Private marketing project
-
-The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
-
-Authorized maintainers can initialize only that submodule and install its independent dependencies:
-
-```sh
-./scripts/setup-private-marketing.sh
-pnpm --dir fluxer_marketing install --frozen-lockfile
-cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
-```
-
-To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
-
-```sh
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
-```
+Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
@@ -8,11 +8,11 @@ External contributions do not grant voting rights, commit access, employment or

 ## Licence and contributor rights

-Source code owned by Fluxer Platform AB in this repository is distributed under the [GNU Affero General Public License, version 3.0 or later](../LICENSE). The licence permits its use, modification and redistribution subject to its terms.
+Source code owned by Fluxer Platform AB in this repository is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). The licence permits its use, modification and redistribution subject to its terms.

 Fluxer Platform AB does not require contributors to sign a contributor licence agreement or assign their copyright. Contributors retain the copyright in their work.

-Every commit made by a contributor must include the [Developer Certificate of Origin](https://developercertificate.org) sign-off required by the [contributing guidelines](CONTRIBUTING.md). Pull requests opened by Fluxer repository automation are exempt from this requirement.
+Every commit made by a contributor must include the [Developer Certificate of Origin](https://developercertificate.org) sign-off required by the [contributing guidelines](https://github.com/fluxerapp/fluxer/blob/main/.github/CONTRIBUTING.md). Pull requests opened by Fluxer repository automation are exempt from this requirement.

 ## Name and marks

@@ -36,8 +36,7 @@ body:
      label: Build information
      description: >-
        Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard. On mobile,
-        select the build information at the bottom of the settings list.
+        the build information. Fluxer copies it to the clipboard.
    validations:
      required: true

@@ -1,15 +1,15 @@
 # yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
 blank_issues_enabled: false
 contact_links:
+  - name: Mobile client bugs
+    url: https://github.com/fluxerapp/flutter_client#bug-reporting
+    about: Read the reporting instructions for the Fluxer mobile client.
  - name: Account and billing support
    url: https://fluxer.app/help
    about: Find account help and support contact details.
  - name: Feature proposals
    url: https://github.com/orgs/fluxerapp/discussions
    about: Propose a feature in a discussion.
-  - name: Security vulnerabilities
-    url: https://github.com/fluxerapp/fluxer/security/advisories/new
-    about: Submit a private vulnerability report.
  - name: Translations
    url: https://weblate.fluxer.tools
    about: Improve an existing locale or start a new one.
@@ -129,7 +129,7 @@ Deliberately submitting a fabricated security report MAY result in an immediate

 Maintainers are not required to investigate possible LLM use proactively. Writing style alone is not evidence of a violation.

-A person MUST NOT publicly accuse or harass a contributor because of suspected LLM use. All discussion, review and enforcement under this policy MUST comply with the [Code of Conduct](CODE_OF_CONDUCT.md).
+A person MUST NOT publicly accuse or harass a contributor because of suspected LLM use. All discussion, review and enforcement under this policy MUST comply with the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 ## 11. Normative References

@@ -1,10 +1,5 @@
 self-hosted-runner:
  labels:
-    - blacksmith-4vcpu-ubuntu-2404
-    - blacksmith-4vcpu-ubuntu-2404-arm
-    - blacksmith-32vcpu-ubuntu-2404
-    - blacksmith-32vcpu-ubuntu-2404-arm
-    - blacksmith-32vcpu-windows-2025
    - fluxer-desktop-macos-arm64

 config-variables: null
@@ -22,11 +22,6 @@ f:docs:
 f:gateway:
  - changed-files:
    - any-glob-to-any-file: fluxer_gateway/**/*
-f:marketing:
-  - changed-files:
-    - any-glob-to-any-file:
-      - fluxer_marketing
-      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -80,7 +80,7 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
+          tools/ci/run.sh resolve-calver
          --github-output

  build:
@@ -97,32 +97,37 @@ jobs:
      matrix:
        include:
          - platform: amd64
-            runner: blacksmith-4vcpu-ubuntu-2404
+            runner: ubuntu-24.04
          - platform: arm64
-            runner: blacksmith-4vcpu-ubuntu-2404-arm
+            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
-          provenance: false
+          provenance: mode=min
          platforms: linux/${{ matrix.platform }}
          tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
            ${{ inputs.extra-build-args }}
-          cache-from: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }}
-          cache-to: type=gha,scope=${{ inputs.image }}-${{ matrix.platform }},mode=max,ignore-error=true
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -136,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -176,7 +181,7 @@ jobs:
          VERSION: ${{ needs.meta.outputs.build_version }}
          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
+          tools/ci/run.sh release
          publish
          --component "${{ inputs.image }}"
          --build-version "${VERSION}"
@@ -185,17 +190,12 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
          MOVING_TAGS: ${{ inputs.moving-tags }}
-        run: |
-          set -euo pipefail
-          tag_args=()
-          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
-          for raw in "${moving[@]}"; do
-            tag="$(echo "$raw" | xargs)"
-            [ -n "$tag" ] && tag_args+=( "-t" "${IMAGE}:${tag}" )
-          done
-          if (( ${#tag_args[@]} > 0 )); then
-            docker buildx imagetools create "${tag_args[@]}" "${IMAGE}:${VERSION}"
-          fi
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component "${{ inputs.image }}"
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags "${MOVING_TAGS}"
@@ -15,6 +15,13 @@ permissions:
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy-self-hosted
+  cancel-in-progress: false
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
 jobs:
  approve:
    name: approve build release
@@ -26,13 +33,207 @@ jobs:
      - name: approved
        run: echo "Build release approved."

-  build:
+  meta:
+    name: resolve metadata
    needs: approve
-    uses: ./.github/workflows/_build-image.yaml
-    secrets: inherit
-    with:
-      image: fluxer-app-proxy-self-hosted
-      dockerfile: fluxer_app_proxy/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      extra-build-args: |
-        FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      build_version: ${{ steps.vars.outputs.build_version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: set variables
+        id: vars
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step set_metadata
+          --build-version "${{ inputs['build-version'] }}"
+
+  dist:
+    name: build the canonical asset tree
+    needs: meta
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    env:
+      IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/fluxer-app-proxy-self-hosted
+      BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+      PUBLIC_ASSET_BASE_URL: ""
+      BUNDLE_LOCAL_ASSETS: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build the dist once and publish it as the canonical asset image
+        env:
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_dist
+
+      - name: generate asset manifest
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step generate_asset_manifest
+
+      - name: verify every manifest asset ships in the image
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build ${{ matrix.platform }}
+    needs: [meta, dist]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: amd64
+            runner: ubuntu-24.04
+          - platform: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
+        with:
+          context: .
+          file: fluxer_app_proxy/Dockerfile
+          push: true
+          provenance: false
+          platforms: linux/${{ matrix.platform }}
+          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
+          build-args: |
+            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+
+  merge:
+    name: merge multi-arch manifest
+    needs: [meta, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-amd64
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
+      - name: create and push multi-arch manifest
+        env:
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"
+
+      - name: Advance moving image tags
+        env:
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -43,97 +43,154 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
+          tools/ci/run.sh build-app-proxy
          --step set_metadata
          --build-version "${{ inputs['build-version'] }}"

-  build:
-    name: build app-proxy (amd64)
+  dist:
+    name: build and publish the canonical asset tree
    needs: meta
-    runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 45
-    permissions:
-      actions: read
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        env:
-          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-      - name: prepare docker config
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
-          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - name: configure ghcr auth
-        env:
-          GHCR_USERNAME: ${{ github.actor }}
-          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
-          --step configure_ghcr_auth
-
-      - name: build and push image + extract assets
-        env:
-          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
-          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
-          CACHE_FROM: type=gha,scope=fluxer-app-proxy
-          CACHE_TO: type=gha,scope=fluxer-app-proxy,mode=max
-          DOCKER_BUILD_SUMMARY: false
-          DOCKER_BUILD_RECORD_UPLOAD: false
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
-          --step build_and_extract
-
-      - name: generate asset manifest
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
-          --step generate_asset_manifest
-
-      - name: upload assets to S3 static bucket
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_ENDPOINT: https://ewr1.vultrobjects.com
-          STATIC_BUCKET: fluxer-static
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
-          --step upload_assets
-
-  build-arm64:
-    name: build app-proxy (arm64)
-    needs: meta
-    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
+    runs-on: ubuntu-24.04
    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build the dist once and publish it as the canonical asset image
+        env:
+          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_dist
+
+      - name: generate asset manifest
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step generate_asset_manifest
+
+      - name: upload assets to S3 static bucket
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
+          S3_ENDPOINT: ${{ vars.STATIC_S3_ENDPOINT }}
+          STATIC_BUCKET: ${{ vars.STATIC_S3_BUCKET }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step upload_assets
+
+      - name: verify every uploaded asset is readable
+        env:
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build app-proxy (amd64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build and push image
+        env:
+          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+          SOURCE_SHA: ${{ github.sha }}
+          SOURCE_DATE: ${{ steps.source.outputs.date }}
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_image
+
+  build-arm64:
+    name: build app-proxy (arm64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -143,10 +200,12 @@ jobs:
          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
-            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
-            BUNDLE_LOCAL_ASSETS=false
-          cache-from: type=gha,scope=fluxer-app-proxy-arm64
-          cache-to: type=gha,scope=fluxer-app-proxy-arm64,mode=max,ignore-error=true
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -155,24 +214,33 @@ jobs:
    name: merge multi-arch manifest
    needs: [meta, build, build-arm64]
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 20
    permissions:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
      - name: fuse amd64 + arm64 into a multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
@@ -203,7 +271,7 @@ jobs:
          VERSION: ${{ needs.meta.outputs.build_version }}
          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- release
+          tools/ci/run.sh release
          publish
          --component fluxer-app-proxy
          --build-version "${VERSION}"
@@ -212,10 +280,11 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          docker buildx imagetools create
-          -t "${IMAGE}:v1"
-          -t "${IMAGE}:latest"
-          "${IMAGE}:${VERSION}"
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -11,11 +11,6 @@ on:
          - stable
          - canary
        default: stable
-      test_build:
-        description: Stash artifacts under desktop-test/ instead of desktop/ (API will not pick these up as a release).
-        required: false
-        default: false
-        type: boolean
      build_version:
        description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
        required: false
@@ -32,13 +27,12 @@ permissions:
  actions: read

 concurrency:
-  group: desktop-${{ inputs.channel }}-${{ inputs.test_build && 'test' || 'release' }}
+  group: desktop-${{ inputs.channel }}
  cancel-in-progress: true

 env:
  CHANNEL: ${{ inputs.channel }}
  BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
-  TEST_BUILD: ${{ inputs.test_build && 'true' || 'false' }}

 jobs:
  meta:
@@ -53,19 +47,17 @@ jobs:
      pub_date: ${{ steps.meta.outputs.pub_date }}
      channel: ${{ steps.meta.outputs.channel }}
      build_channel: ${{ steps.meta.outputs.build_channel }}
-      test_build: ${{ steps.meta.outputs.test_build }}
-      s3_prefix: ${{ steps.meta.outputs.s3_prefix }}
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -85,7 +77,6 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step set_metadata
          --channel "${{ inputs.channel }}"
-          --test-build "${{ inputs.test_build }}"

  matrix:
    name: Resolve build matrix
@@ -98,12 +89,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -113,13 +104,13 @@ jobs:
          --skip-targets "${{ inputs.skip_targets }}"

  build:
-    name: Build ${{ matrix.platform }} (${{ matrix.arch }}, ${{ matrix.desktop_variant }})
+    name: Build ${{ matrix.platform }} (${{ matrix.arch }})
    needs:
      - meta
      - matrix
    runs-on: ${{ matrix.os }}
    environment: desktop-releases
-    timeout-minutes: 60
+    timeout-minutes: 180
    permissions:
      actions: read
      contents: read
@@ -137,41 +128,34 @@ jobs:
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_BUCKET: fluxer-downloads
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
-      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
      PLATFORM: ${{ matrix.platform }}
      ARCH: ${{ matrix.arch }}
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +180,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +231,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +244,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +286,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +347,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -477,6 +461,12 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

+      - name: Build AppImage update feed (Linux)
+        if: matrix.platform == 'linux'
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_appimage_update_feed
+
      - name: Normalize updater YAML (macOS)
        if: matrix.platform == 'macos'
        run: >-
@@ -495,20 +485,30 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step generate_checksums_windows

-      - name: Upload artifacts to S3 handoff
+      - name: Stage build artifacts
+        id: handoff
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step upload_handoff
+          --step stage_handoff
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: ${{ steps.handoff.outputs.artifact_name }}
+          path: upload_staging
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

  upload:
-    name: Upload to S3
+    name: Assemble desktop release assets
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    needs:
      - meta
      - build
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 60
+    timeout-minutes: 180
    permissions:
      contents: read
    env:
@@ -520,32 +520,26 @@ jobs:
      BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
-      TEST_BUILD: ${{ needs.meta.outputs.test_build }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_BUCKET: fluxer-downloads
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

-      - name: Download S3 handoff artifacts
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_handoff
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: artifacts
+          pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-*

-      - name: Build S3 payload layout (+ manifest.json)
+      - name: Build payload layout (+ manifest.json)
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          PUB_DATE: ${{ needs.meta.outputs.pub_date }}
@@ -553,43 +547,56 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_payload

-      - name: Upload payload to S3
+      - name: Prepare GitHub release assets
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_payload
+          --step prepare_release_assets
+
+      - name: Upload GitHub release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

      - name: Build summary
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Cleanup S3 handoff
-        if: ${{ success() }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step cleanup_handoff
-
  publish_release:
    name: Publish GitHub desktop release
-    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
+    if: ${{ !cancelled() && needs.upload.result == 'success' }}
    needs:
      - meta
      - upload
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 10
+    timeout-minutes: 60
    permissions:
      contents: write
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
+
+      - name: Download GitHub release assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -614,6 +621,7 @@ jobs:
            --build-version "${VERSION}"
            --source-sha "${SOURCE_SHA}"
            --previous-sha "${RELEASE_BASELINE_SHA}"
+            --asset-dir release_assets
          )
          if [[ "${CHANNEL}" == "canary" ]]; then
            release_args+=(--prerelease)
@@ -33,5 +33,4 @@ jobs:
    with:
      image: fluxer-docs
      dockerfile: fluxer_docs/Dockerfile
-      context: fluxer_docs
      build-version: ${{ inputs['build-version'] }}
@@ -19,27 +19,27 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Generate OpenAPI schemas
@@ -1,230 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: Dispatch private marketing build
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - fluxer_marketing
-      - Cargo.toml
-      - fluxer_common/**
-      - packages/fonts/manifest.json
-      - packages/fonts/NOTICE.md
-      - packages/fonts/LICENSE-IBM-PLEX.txt
-      - packages/fonts/css/locale-fallbacks.css
-      - packages/fonts/files/FluxerSans/**
-      - packages/fonts/files/FluxerMono/**
-      - packages/fonts/marketing/**
-      - packages/i18n/marketing/**
-      - fluxer_static/marketing/branding/**
-      - .github/workflows/dispatch-private-marketing-build.yaml
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: private-marketing-dispatch
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    name: resolve exact private build metadata
-    if: github.repository == 'fluxerapp/fluxer'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
-      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
-      build_version: ${{ steps.inputs.outputs.build_version }}
-      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
-    steps:
-      - name: Create token
-        id: create-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: fluxer
-          permission-contents: read
-      - name: Resolve trusted build inputs
-        id: inputs
-        env:
-          EVENT_AFTER: ${{ github.event.after }}
-          GH_TOKEN: ${{ steps.create-token.outputs.token }}
-          PARENT_SHA: ${{ github.sha }}
-          PUBLIC_REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
-          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
-          (( 10#$RUN_ATTEMPT <= 10 ))
-
-          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
-          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
-          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
-          main_status="$(jq -r .status <<<"$main_comparison")"
-          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
-          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
-
-          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
-          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
-          tree_sha="$(jq -r .tree.sha <<<"$commit")"
-          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
-          entry="$(
-            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
-              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
-          )"
-          mode="$(jq -r .mode <<<"$entry")"
-          type="$(jq -r .type <<<"$entry")"
-          gitlink_sha="$(jq -r .sha <<<"$entry")"
-          path="$(jq -r .path <<<"$entry")"
-          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
-            exit 1
-          fi
-
-          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
-          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
-          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
-          [[ "$(jq -r .event <<<"$run")" == "push" ]]
-          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
-          run_created_at="$(jq -r .created_at <<<"$run")"
-          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
-          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
-          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
-          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
-          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
-          month="$((10#$month))"
-          micro="$((10#$time_segment))"
-          build_version="$year.$month$day.$micro"
-          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
-          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          {
-            echo "parent_sha=$PARENT_SHA"
-            echo "gitlink_sha=$gitlink_sha"
-            echo "build_version=$build_version"
-            echo "correlation_id=$correlation_id"
-          } >>"$GITHUB_OUTPUT"
-
-  dispatch:
-    name: dispatch exact private build
-    needs: metadata
-    runs-on: ubuntu-24.04
-    timeout-minutes: 65
-    environment: private-marketing-dispatch
-    permissions: {}
-    steps:
-      - name: Validate trusted build inputs
-        env:
-          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
-          EXPECTED_PARENT_SHA: ${{ github.sha }}
-          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
-          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
-            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
-            exit 1
-          fi
-
-      - name: Create private dispatch token
-        id: private-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: marketing
-          permission-actions: write
-
-      - name: Dispatch exact private build
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
-            --field ref=main \
-            --field "inputs[parent_sha]=$PARENT_SHA" \
-            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
-            --field "inputs[build_version]=$BUILD_VERSION" \
-            --field "inputs[correlation_id]=$CORRELATION_ID"
-
-      - name: Wait for private build conclusion
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
-          deadline=$((SECONDS + 3600))
-          run_id=""
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            count="$(jq 'length' <<<"$matches")"
-            if [[ "$count" == "1" ]]; then
-              run_id="$(jq -r '.[0].id' <<<"$matches")"
-              break
-            fi
-            if [[ "$count" != "0" ]]; then
-              echo "::error::Private build correlation matched multiple workflow runs."
-              exit 1
-            fi
-            sleep 10
-          done
-          if [[ -z "$run_id" ]]; then
-            echo "::error::Timed out waiting for the private build dispatch to appear."
-            exit 1
-          fi
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
-              echo "::error::Private build correlation is missing or ambiguous."
-              exit 1
-            fi
-            run="$(jq '.[0]' <<<"$matches")"
-            status="$(jq -r '.status' <<<"$run")"
-            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
-            if [[ "$status" == "completed" ]]; then
-              if [[ "$conclusion" != "success" ]]; then
-                echo "::error::Private marketing build concluded with $conclusion."
-                exit 1
-              fi
-              echo "Private marketing build completed successfully."
-              exit 0
-            fi
-            sleep 15
-          done
-          echo "::error::Timed out waiting for the private marketing build."
-          exit 1
@@ -35,29 +35,29 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Refresh source catalogs
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,22 +48,22 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
+          tools/ci/run.sh ci
          --step install_dependencies

      - name: Compile translated catalogs
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: release image set
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+      from-tag:
+        description: "Image tag every component is read from (v1 snapshots today's moving tags, a CalVer pins a coordinated build)"
+        type: string
+        required: false
+        default: "v1"
+      component-versions:
+        description: "Per-component overrides, one <image>=<version> entry per line (for example fluxer-api=2026.830.191141)"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: read
+
+concurrency:
+  group: release-image-set
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
+jobs:
+  approve:
+    name: approve image set release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Image set release approved."
+
+  manifest:
+    name: resolve and publish the image set
+    needs: approve
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+          permission-packages: read
+
+      - name: set variables
+        id: vars
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
+        run: >-
+          tools/ci/run.sh resolve-calver
+          --github-output
+
+      - name: resolve release image set
+        id: resolve
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          FROM_TAG: ${{ inputs['from-tag'] }}
+          COMPONENT_VERSIONS: ${{ inputs['component-versions'] }}
+        run: |
+          set -euo pipefail
+          args=(
+            image-set resolve
+            --version "${VERSION}"
+            --registry "ghcr.io/${GHCR_OWNER}"
+            --from-tag "${FROM_TAG}"
+            --out-dir release-out
+            --github-output
+          )
+          while IFS= read -r entry; do
+            entry="$(echo "$entry" | xargs)"
+            if [ -n "$entry" ]; then
+              args+=( --component-version "$entry" )
+            fi
+          done <<< "${COMPONENT_VERSIONS}"
+          tools/ci/run.sh "${args[@]}"
+
+      - name: verify release image set
+        env:
+          VERSION: ${{ steps.vars.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set verify
+          --manifest "release-out/fluxer-release-${VERSION}.json"
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          BUNDLE_COMMIT: ${{ steps.resolve.outputs.bundle_commit }}
+        run: |
+          set -euo pipefail
+          if [ -z "${BUNDLE_COMMIT}" ]; then
+            echo "image-set resolve reported no bundle commit" >&2
+            exit 1
+          fi
+          gh release create "fluxer-release@${VERSION}" \
+            --repo fluxerapp/fluxer \
+            --target "${BUNDLE_COMMIT}" \
+            --title "fluxer-release ${VERSION}" \
+            --latest=true \
+            --notes "Immutable image set for ${VERSION}. Every image in the set contains ${BUNDLE_COMMIT}, the commit this tag points at, so the bundle here is never newer than the images. Pin with: docker compose -f docker-compose.yml -f fluxer-release-${VERSION}.yml up -d" \
+            "release-out/fluxer-release-${VERSION}.json" \
+            "release-out/fluxer-release-${VERSION}.yml"
@@ -3,102 +3,174 @@ name: Tests

 on:
  pull_request:
+  push:
+    branches:
+      - main

 permissions:
  contents: read

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 env:
  GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  CARGO_PROFILE_DEV_DEBUG: none
+  CARGO_PROFILE_TEST_DEBUG: none
+  CARGO_INCREMENTAL: '0'

 jobs:
  typecheck:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
+      - name: Save ci helper
+        if: github.ref == 'refs/heads/main' && steps.ci-helper.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies

      - name: Run typecheck
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step typecheck
+        run: |
+          "$FLUXER_CI_BIN" ci --step typecheck

  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
+      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies
+
+      - name: Restore fluxer_app wasm artifacts
+        id: app-wasm
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

      - name: Run tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step test
+        run: |
+          "$FLUXER_CI_BIN" ci --step test
+
+      - name: Save fluxer_app wasm artifacts
+        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

  rust:
    runs-on: blacksmith-4vcpu-ubuntu-2404
-    timeout-minutes: 30
+    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: stable
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
@@ -108,21 +180,61 @@ jobs:
            ~/.cargo/registry
            ~/.cargo/git
            target
-          key: rust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          key: rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-${{ hashFiles('Cargo.lock') }}
          restore-keys: |
-            rust-${{ runner.os }}-
+            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version 0.20.2 --locked
+
+      - name: Check Rust dependencies
+        run: cargo deny --locked check -D warnings
+
+      - name: Check desktop native dependencies
+        run: tools/ci/check-desktop-native-workspaces.sh dependencies
+
+      - name: Cache native media dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: /opt/fluxer-native
+          key: media-native-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
-            pkg-config \
            build-essential \
-            libcurl4-openssl-dev \
-            libvips-dev \
+            binutils \
+            clang \
+            cmake \
+            curl \
+            libaom-dev \
            libavfilter-dev \
+            libclang-dev \
+            libcurl4-openssl-dev \
+            libdav1d-dev \
+            libde265-dev \
+            libfido2-dev \
            libheif-dev \
-            libwebp-dev
+            liblcms2-dev \
+            libpipewire-0.3-dev \
+            libspa-0.2-dev \
+            libssl-dev \
+            libudev-dev \
+            libvips-dev \
+            libwebp-dev \
+            libyuv-dev \
+            meson \
+            nasm \
+            ninja-build \
+            pkg-config \
+            xz-utils \
+            yasm \
+            zlib1g-dev
+          sudo fluxer_media_proxy/tools/install-native-deps.sh /opt/fluxer-native
+          echo "PKG_CONFIG_PATH=/opt/fluxer-native/lib/pkgconfig:/opt/fluxer-native/lib64/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=/opt/fluxer-native/lib:/opt/fluxer-native/lib64" >> "$GITHUB_ENV"
+          echo "/opt/fluxer-native/bin" >> "$GITHUB_PATH"

      - name: Install Node.js dependencies
        run: pnpm --filter fluxer_admin install
@@ -130,118 +242,233 @@ jobs:
      - name: Check formatting
        run: cargo fmt --all -- --check

+      - name: Check formatting (desktop native workspaces)
+        run: tools/ci/check-desktop-native-workspaces.sh fmt
+
      - name: Clippy (warnings as errors)
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: Clippy (desktop native workspaces on Linux, warnings as errors)
+        run: tools/ci/check-desktop-native-workspaces.sh clippy
+
+      - name: Verify the source-built ffmpeg CLI is on PATH
+        run: |
+          set -euo pipefail
+          command -v ffmpeg
+          test "$(command -v ffmpeg)" = /opt/fluxer-native/bin/ffmpeg
+          ffmpeg -hide_banner -version

      - name: Run tests
-        run: cargo test --workspace
+        env:
+          FLUXER_REQUIRE_MEDIA_FIXTURES: "1"
+        run: cargo test --workspace --all-features --locked
+
+      - name: Run desktop native workspace tests on Linux
+        run: tools/ci/check-desktop-native-workspaces.sh test

  gateway:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
+
+      - name: Cache cargo (gateway NIFs)
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        with:
+          workspaces: |
+            fluxer_gateway/native/guild_member_list_oset_nif -> target
+            fluxer_gateway/native/push_markdown_plaintext_nif -> target
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci

      - name: Set up Erlang
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

-      - name: Cache rebar3 dependencies
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      - name: Restore rebar3 dependencies
+        id: rebar3-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: |
-            fluxer_gateway/_build
            ~/.cache/rebar3
-          key: rebar3-${{ runner.os }}-${{ hashFiles('fluxer_gateway/rebar.lock') }}
+            fluxer_gateway/_build
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
+          key: >-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-

      - name: Check formatting
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_fmt
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_fmt

      - name: Compile
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_compile
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_compile

      - name: Run dialyzer
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_dialyzer
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_dialyzer

      - name: Run eunit tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step gateway_eunit
+        run: |
+          "$FLUXER_CI_BIN" ci --step gateway_eunit
+
+      - name: Save rebar3 dependencies
+        if: always() && github.ref == 'refs/heads/main' && steps.rebar3-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cache/rebar3
+            fluxer_gateway/_build
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
+          key: >-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            'fluxer_gateway/rebar.config') }}

  knip:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
+    env:
+      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

+      - name: Restore ci helper
+        id: ci-helper
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: target/debug/fluxer-ci
+          key: >-
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+
+      - name: Build ci helper
+        if: steps.ci-helper.outputs.cache-hit != 'true'
+        run: cargo build --locked --package fluxer-ci
+
      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: |
+          "$FLUXER_CI_BIN" ci --step install_dependencies
+
+      - name: Restore fluxer_app wasm artifacts
+        id: app-wasm
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}

      - name: Run knip
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step knip
+        run: |
+          "$FLUXER_CI_BIN" ci --step knip
+
+      - name: Save fluxer_app wasm artifacts
+        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            fluxer_app/pkgs/libfluxcore
+            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+          key: >-
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
+            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
+            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
+            'packages/markdown_parser/rust/src/**') }}
+
+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting and lint
+        run: pnpm exec biome ci .
+
+      - name: Lint JSX for browser-translation safety
+        run: pnpm exec eslint . --max-warnings 0

  i18n:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-          targets: wasm32-unknown-unknown
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
-          --step install_dependencies
+        run: pnpm install --frozen-lockfile

      - name: Compile locale catalogs
        run: pnpm i18n:compile
@@ -258,150 +485,45 @@ jobs:
            exit 1
          fi

+  docs:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --filter fluxer_docs...
+
+      - name: Verify documentation matches the live API
+        run: pnpm --filter fluxer_docs verify
+
+      - name: Build documentation
+        run: pnpm --filter fluxer_docs build
+
  fonts:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt

      - name: Verify shipped fonts match the lockfile
        run: python3 tools/fonts/build_fonts.py --verify
-
-  ci-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 25
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: stable
-          components: rustfmt
-
-      - name: Sync ci helper dependencies
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci-scripts
-          --step sync
-
-      - name: Run ci helper tests
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci-scripts
-          --step test
-
-  helm-and-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: "1.93.0"
-
-      - name: Install helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-
-      - name: Resolve Helm test build version
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver
-          --github-env
-          --env-name HELM_TEST_BUILD_VERSION
-
-      - name: Helm dependency update (all charts)
-        run: |
-          set -euo pipefail
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              helm dependency update "$chart_dir"
-            fi
-          done
-
-      - name: Helm lint (all charts)
-        run: |
-          set -euo pipefail
-          FAILED=0
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              echo "--- Linting ${chart_dir} ---"
-              VALUES_ARGS=()
-              if [[ -f "${chart_dir}values.yaml" ]]; then
-                VALUES_ARGS=(-f "${chart_dir}values.yaml")
-              fi
-              EXTRA_SETS=(--set-string "global.registry=${GHCR_REGISTRY}")
-              case "${chart_dir}" in
-                *gateway*)
-                  EXTRA_SETS+=(--set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *api*)
-                  EXTRA_SETS+=(--set-string app.name=api --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *app-proxy*)
-                  EXTRA_SETS+=(--set-string app.name=app-proxy --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *admin*)
-                  EXTRA_SETS+=(--set-string app.name=admin --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *marketing*)
-                  EXTRA_SETS+=(--set-string app.name=marketing --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *docs*)
-                  EXTRA_SETS+=(--set-string app.name=docs --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *media-proxy*)
-                  EXTRA_SETS+=(--set-string "mediaProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "mediaProxy.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *uploads*)
-                  EXTRA_SETS+=(--set-string app.name=uploads --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *worker*)
-                  EXTRA_SETS+=(--set-string "workerRealtime.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerRealtime.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *gifs*|*messages*|*snowflakes*|*unfurl*|*users*)
-                  EXTRA_SETS+=(--set-string "svc.tag=${HELM_TEST_BUILD_VERSION}" --set-string "svc.build.version=${HELM_TEST_BUILD_VERSION}" --set-string svc.build.channel=stable)
-                  ;;
-              esac
-              if ! helm lint "$chart_dir" "${VALUES_ARGS[@]}" "${EXTRA_SETS[@]}" --strict; then
-                FAILED=1
-              fi
-            fi
-          done
-          if [[ "$FAILED" -ne 0 ]]; then
-            echo "::error::One or more Helm charts failed linting"
-            exit 1
-          fi
-
-      - name: Helm template (gateway)
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer > /dev/null
-          echo "Gateway chart templates render successfully."
-
-      - name: Validate gateway manifests with kubeconform
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer \
-            | docker run -i --rm ghcr.io/yannh/kubeconform:v0.6.7 \
-                -strict -summary -kubernetes-version 1.31.0
@@ -45,8 +45,6 @@
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 **/.idea/
 **/*.iml
@@ -1,4 +0,0 @@
-[submodule "fluxer_marketing"]
-	path = fluxer_marketing
-	url = https://github.com/fluxerapp/marketing.git
-	update = none
@@ -9,7 +9,6 @@ members = [
 	"fluxer_messages",
 	"fluxer_snowflakes",
 	"tools/ci",
-	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
 	"fluxer_users",
@@ -17,7 +16,6 @@ members = [
 	"packages/markdown_parser/rust",
 ]
 exclude = [
-	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
 ]
 resolver = "2"
@@ -25,3 +23,8 @@ resolver = "2"
 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
@@ -1,15 +1,3 @@
-> [!CAUTION]
-> As of this writing (15 June 2026), we are working to finalise the API and self-hosting documentation over the next few days.
->
-> We apologise for the brief delay in open-source releases. We paused after spam waves created safety concerns while we built out Fluxer's trust and safety infrastructure. During that same stretch, we have been fixing hundreds of bugs, adding new features, and preparing a much improved audio and video system.
->
-> You can already try that work in the Fluxer Canary client: [download Canary](https://canary.fluxer.app/download) or [open Canary on the web](https://web.canary.fluxer.app). The latest stable client remains out of date for now, but over the coming weeks we are finalising the remaining work needed to stabilise the current latest code out in the open.
-
-> [!NOTE]
-> Learn about the developer behind Fluxer, the goals of the project, the tech stack, and what's coming next.
->
-> [Read the launch blog post](https://blog.fluxer.app/how-i-built-fluxer-a-discord-like-chat-app/) | [View full roadmap](https://blog.fluxer.app/roadmap-2026/)
-
 <p align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./fluxer_static/marketing/branding/logo-white.svg">
@@ -31,5 +19,5 @@
 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-1920w.png" alt="Fluxer app showcase" width="900">
+  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer app showcase" width="900">
 </p>
@@ -20,7 +20,7 @@
 			"bracketSpacing": false,
 			"bracketSameLine": false
 		},
-		"globals": ["React"]
+		"globals": ["React", "__webpack_base_uri__"]
 	},
 	"json": {
 		"formatter": {
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,11 +83,23 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noRestrictedImports": {
+					"level": "error",
+					"options": {
+						"paths": {
+							"@lingui/react": {
+								"importNames": ["I18nProvider"],
+								"message": "Use AppI18nProvider from @app/features/i18n/components/AppI18nProvider so <Trans> output stays safe under page translation."
+							}
+						}
+					}
+				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -115,6 +127,28 @@
 		}
 	},
 	"assist": {"actions": {"source": {"organizeImports": "on"}}},
+	"overrides": [
+		{
+			"includes": ["fluxer_app/src/**/*.tsx"],
+			"plugins": ["./tools/lint/no-adjacent-jsx-text.grit"]
+		},
+		{
+			"includes": ["fluxer_docs/scripts/VerifyDocsCoverage.ts"],
+			"linter": {"rules": {"suspicious": {"noTemplateCurlyInString": "off"}}}
+		},
+		{
+			"includes": [
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.tsx",
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.test.tsx"
+			],
+			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
+		},
+		{
+			"includes": ["**/*.astro"],
+			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},
+			"assist": {"actions": {"source": {"organizeImports": "off"}}}
+		}
+	],
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
@@ -145,7 +179,14 @@
 			"!fluxer_static",
 			"!packages/fonts",
 			"!fluxer_admin/static/htmx.min.js",
-			"!fluxer_api/src/api/openapi/openapi.json"
+			"!fluxer_api/src/api/openapi/openapi.json",
+			"!fluxer_api/pkgs/email/src/email_i18n/locales",
+			"!fluxer_api/pkgs/email/src/email_i18n/weblate",
+			"!fluxer_api/src/api/content_i18n/locales",
+			"!fluxer_api/src/api/content_i18n/weblate",
+			"!packages/errors/src/i18n/locales",
+			"!packages/errors/src/i18n/weblate",
+			"!**/auto-i18n-reviewed-unchanged.json"
 		],
 		"ignoreUnknown": true
 	}
@@ -30,12 +30,6 @@ FLUXER_POSTGRES_PASSWORD=fluxer
 FLUXER_POSTGRES_SSL=false
 FLUXER_POSTGRES_MAX_CONNECTIONS=20
 FLUXER_POSTGRES_KV_TABLE=fluxer_kv
-FLUXER_CASSANDRA_HOSTS=cassandra
-FLUXER_CASSANDRA_PORT=9042
-FLUXER_CASSANDRA_KEYSPACE=fluxer
-FLUXER_CASSANDRA_LOCAL_DC=datacenter1
-FLUXER_CASSANDRA_USERNAME=fluxer
-FLUXER_CASSANDRA_PASSWORD=fluxer
 FLUXER_KV_URL=redis://valkey:6379/0
 FLUXER_NATS_URL=nats://nats:4222
 FLUXER_NATS_JETSTREAM_URL=nats://nats:4222
@@ -49,7 +43,6 @@ FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
 FLUXER_SVC_CACHE_HARD_TTL_MS=600000
-FLUXER_SVC_MAX_CONCURRENT_REQUESTS=64

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -59,22 +52,21 @@ FLUXER_S3_SECRET_ACCESS_KEY=fluxer-secret
 FLUXER_S3_FORCE_PATH_STYLE=true
 FLUXER_S3_BUCKET_CDN=fluxer
 FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
-FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
 FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
 FLUXER_S3_BUCKET_STATIC=fluxer-static

 FLUXER_LIVEKIT_ENABLED=true
 FLUXER_LIVEKIT_URL=ws://localhost:8088/livekit
+FLUXER_LIVEKIT_INTERNAL_URL=http://localhost:7880
 FLUXER_LIVEKIT_API_KEY=devkey
-FLUXER_LIVEKIT_API_SECRET=secret
+FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
 FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

 FLUXER_API_PORT=8080
 FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
 FLUXER_API_WORKER_MODE=all_lanes
-FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION=true
 FLUXER_APP_DEV_PORT=3000
 FLUXER_APP_PROXY_PORT=8773
 FLUXER_STATIC_DIR=fluxer_app/dist
@@ -95,18 +87,13 @@ FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
 FLUXER_ADMIN_PORT=3020
 FLUXER_ADMIN_BASE_PATH=/admin
 FLUXER_ADMIN_SECRET_KEY_BASE=dev-admin-secret-key-base
-FLUXER_ADMIN_OAUTH_CLIENT_ID=1234567890123456789
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=dev-admin-oauth-secret
 FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback
-FLUXER_MARKETING_PORT=3010
-FLUXER_MARKETING_HOST=0.0.0.0
-FLUXER_MARKETING_BASE_PATH=/marketing
-FLUXER_MARKETING_SECRET_KEY_BASE=dev-marketing-secret-key-base

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
-FLUXER_VAPID_PUBLIC_KEY=dev-vapid-public-key
-FLUXER_VAPID_PRIVATE_KEY=dev-vapid-private-key
+FLUXER_VAPID_PUBLIC_KEY=BHIbdKs24FdPkOQS7hbeg3adceLS0IqlKsn71ywEe6kbeopeFFiG3lkvJac7BVqkuk7mxwEa555O2FXV3HLt56w
+FLUXER_VAPID_PRIVATE_KEY=cs24JvXSxHiqJQgkJNocJFAdzJpPmpfU9xD-fDpn3tw
 FLUXER_VAPID_EMAIL=dev@localhost
 FLUXER_PASSKEY_RP_NAME='Fluxer Dev'
 FLUXER_PASSKEY_RP_ID=localhost
@@ -142,6 +129,7 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
 AWS_ACCESS_KEY_ID=fluxer
 AWS_SECRET_ACCESS_KEY=fluxer-secret
@@ -1,13 +1,9 @@
 # cargo-deny configuration for the Fluxer workspace.
 #
-# Applies to the root workspace (Cargo.toml at the repo root) AND to every
-# per-addon crate under fluxer_desktop/native/* (each addon has its own
-# [workspace], so we invoke cargo-deny with --config pointing here).
-#
-# Used by the native desktop security gate in CI.
+# Applies to the root workspace (Cargo.toml at the repo root).

 [graph]
-all-features = false
+all-features = true
 no-default-features = false

 [output]
@@ -44,13 +40,11 @@ allow = [
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
-    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "AGPL-3.0-or-later",
    "BSL-1.0",
-    "OpenSSL",
    "CDLA-Permissive-2.0",
 ]
 # Explicitly deny GPL-only / strong-copyleft licenses that don't compose with
@@ -72,21 +66,56 @@ license-files = [
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# Per-addon crates path-depend on ../rust (the shared `fluxer_desktop_native`
-# crate) without a version. cargo-deny flags that as a wildcard; we allow it
-# because path deps can't realistically pin a SemVer range, and this only
-# affects intra-repo workspace links (registry wildcards remain denied).
+# Internal workspace crates use path dependencies without registry versions.
+# Registry wildcards remain denied.
 allow-wildcard-paths = true
 highlight = "all"
 workspace-default-features = "allow"
 external-default-features = "allow"
-# Keep desktop packaging and native addons away from the obsolete libfuse2 stack.
+# Keep workspace artifacts away from the obsolete libfuse2 stack.
 # AppImage packaging must use the static electron-builder runtime instead.
 deny = [
    { crate = "fuse", reason = "libfuse2-based Rust wrapper; use a maintained FUSE3-native crate only if Fluxer ever needs FUSE directly" },
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
-skip = []
+skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
+]
 skip-tree = []

 # ---------------------------------------------------------------------------
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: admin
-description: Fluxer admin service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-canary release as of 2026-05-17T20:42:36Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-canary
-# Apply with:    helm upgrade fluxer-admin-canary deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  image: fluxer-admin
-  name: admin-canary
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-stable
-# Apply with:    helm upgrade fluxer-admin-stable deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-admin
-  name: admin
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,34 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: api
-description: Fluxer API service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,105 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-canary release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-api-canary
-# Apply with:    helm upgrade fluxer-api-canary deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api-canary
-  port: 8080
-  replicas: 4
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 75%
@@ -1,107 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-api-stable
-# Apply with:    helm upgrade fluxer-api-stable deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_USERS_SERVICE_TIMEOUT_MS
-    value: "6000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api
-  port: 8080
-  replicas: 31
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 75%
@@ -1,98 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-canary:
-  image: fluxer-api
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-pdb:
-  minAvailable: '75%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: app-proxy
-description: Fluxer app proxy service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-canary release as of 2026-05-17T20:42:38Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-canary
-# Apply with:    helm upgrade fluxer-app-proxy-canary deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.canary.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy-canary
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-stable release as of 2026-05-17T20:42:39Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-stable
-# Apply with:    helm upgrade fluxer-app-proxy-stable deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,31 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-
-
-
-
-  env:
-    - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-      value: '/api'
-
-pdb:
-  minAvailable: '50%'
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: common
-description: Shared Helm templates for Fluxer services
-type: library
-version: 0.1.0
@@ -1,356 +0,0 @@
-{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}}
-{{- define "fluxer.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.labels" -}}
-helm.sh/chart: {{ include "fluxer.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/part-of: fluxer
-{{- end }}
-
-{{- define "fluxer.selectorLabels" -}}
-app.kubernetes.io/name: {{ .name }}
-app.kubernetes.io/instance: {{ .context.Release.Name }}
-{{- end }}
-
-{{- define "fluxer.imagePullSecrets" -}}
-imagePullSecrets:
-  - name: {{ .Values.global.imagePullSecret }}
-{{- end }}
-
-{{- define "fluxer.image" -}}
-{{- $tag := required (printf ".tag is required (image: %s)" .image) .tag -}}
-{{- $registry := required "global.registry is required" .context.Values.global.registry -}}
-{{ $registry }}/{{ .image }}:{{ $tag }}
-{{- end }}
-
-{{- define "fluxer.replicas" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $desired := int (required (printf ".replicas is required for %s" $name) $v.replicas) -}}
-{{- $preserveLiveReplicas := dig "preserveLiveReplicas" true $v -}}
-{{- if not $preserveLiveReplicas -}}
-{{- $desired -}}
-{{- else -}}
-{{- $existing := lookup "apps/v1" "Deployment" $ctx.Values.global.namespace $name -}}
-{{- if $existing -}}
-{{- $current := int (dig "spec" "replicas" 0 $existing) -}}
-{{- if gt $current 0 -}}
-{{- $current -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- end -}}
-{{- end }}
-
-{{- define "fluxer.deployment" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $isGateway := eq $name "gateway" -}}
-{{- $defaultMaxSurge := 1 -}}
-{{- $defaultMaxUnavailable := 0 -}}
-{{- $defaultMinReadySeconds := 10 -}}
-{{- $defaultTerminationGracePeriodSeconds := ternary 90 60 $isGateway -}}
-{{- $defaultReadinessPath := ternary "/_health/ready" "/_health" $isGateway -}}
-{{- $defaultReadinessTimeoutSeconds := ternary 5 2 $isGateway -}}
-{{- $configuredMaxSurge := dig "rollingUpdate" "maxSurge" $defaultMaxSurge $v -}}
-{{- $configuredMaxUnavailable := dig "rollingUpdate" "maxUnavailable" $defaultMaxUnavailable $v -}}
-{{- $maxSurge := $configuredMaxSurge -}}
-{{- $maxUnavailable := $configuredMaxUnavailable -}}
-{{- $minReadySeconds := int (dig "minReadySeconds" $defaultMinReadySeconds $v) -}}
-{{- $terminationGracePeriodSeconds := int (dig "terminationGracePeriodSeconds" $defaultTerminationGracePeriodSeconds $v) -}}
-{{- $readinessPath := dig "readinessProbe" "path" $defaultReadinessPath $v -}}
-{{- $readinessExecEnabled := dig "readinessProbe" "execEnabled" $isGateway $v -}}
-{{- $readinessTimeoutSeconds := int (dig "readinessProbe" "timeoutSeconds" $defaultReadinessTimeoutSeconds $v) -}}
-{{- $readinessExecCommand := printf "curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 || exit 1" $readinessTimeoutSeconds (int $v.port) $readinessPath -}}
-{{- $readinessInitialDelaySeconds := int (dig "readinessProbe" "initialDelaySeconds" 5 $v) -}}
-{{- $readinessPeriodSeconds := int (dig "readinessProbe" "periodSeconds" 5 $v) -}}
-{{- $readinessFailureThreshold := int (dig "readinessProbe" "failureThreshold" 2 $v) -}}
-{{- $livenessPath := dig "livenessProbe" "path" "/_health" $v -}}
-{{- $livenessInitialDelaySeconds := int (dig "livenessProbe" "initialDelaySeconds" 10 $v) -}}
-{{- $livenessPeriodSeconds := int (dig "livenessProbe" "periodSeconds" 15 $v) -}}
-{{- $livenessFailureThreshold := int (dig "livenessProbe" "failureThreshold" 3 $v) -}}
-{{- $livenessTimeoutSeconds := int (dig "livenessProbe" "timeoutSeconds" 5 $v) -}}
-{{- $startupProbeEnabled := dig "startupProbe" "enabled" $isGateway $v -}}
-{{- $startupProbePath := dig "startupProbe" "path" "/_health" $v -}}
-{{- $startupProbeInitialDelaySeconds := int (dig "startupProbe" "initialDelaySeconds" 0 $v) -}}
-{{- $startupProbePeriodSeconds := int (dig "startupProbe" "periodSeconds" 5 $v) -}}
-{{- $startupProbeFailureThreshold := int (dig "startupProbe" "failureThreshold" 30 $v) -}}
-{{- $startupProbeTimeoutSeconds := int (dig "startupProbe" "timeoutSeconds" 5 $v) -}}
-{{- $preStopDrainEnabled := dig "preStopDrain" "enabled" $isGateway $v -}}
-{{- $preStopDrainPath := dig "preStopDrain" "path" "/_health/drain" $v -}}
-{{- $preStopDrainSleepSeconds := int (dig "preStopDrain" "sleepSeconds" 20 $v) -}}
-{{- $preStopDrainTimeoutSeconds := int (dig "preStopDrain" "timeoutSeconds" 2 $v) -}}
-{{- $preStopDrainRetryCount := int (dig "preStopDrain" "retryCount" 6 $v) -}}
-{{- $preStopDrainRetryIntervalSeconds := int (dig "preStopDrain" "retryIntervalSeconds" 1 $v) -}}
-{{- $preStopDrainCommand := printf "attempt=0; while [ \"$attempt\" -lt %d ]; do curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 && break; attempt=$((attempt+1)); sleep %d; done; sleep %d" $preStopDrainRetryCount $preStopDrainTimeoutSeconds (int $v.port) $preStopDrainPath $preStopDrainRetryIntervalSeconds $preStopDrainSleepSeconds -}}
-{{- $build := get $v "build" | default (dict) -}}
-{{- $buildVersion := get $build "version" | default $v.tag -}}
-{{- $buildSha := get $build "sha" | default "" -}}
-{{- $buildChannel := get $build "channel" | default "" -}}
-{{- $nsfwServiceEndpoint := get $v "nsfwServiceEndpoint" | default "" -}}
-{{- $cluster := get $ctx.Values "cluster" | default (dict) -}}
-{{- $gatewayClusterEnabled := and $isGateway (eq (get $cluster "enabled" | default false) true) -}}
-{{- $erlangDistribution := get $cluster "erlangDistribution" | default (dict) -}}
-{{- $erlangDistPort := int (get $erlangDistribution "port" | default 8081) -}}
-{{- $erlangEpmdPort := int (get $erlangDistribution "epmdPort" | default 4369) -}}
-{{- $erlangCookieSecret := get $cluster "erlangCookieSecret" | default (dict) -}}
-{{- $erlangCookieSecretName := get $erlangCookieSecret "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $erlangCookieSecretKey := get $erlangCookieSecret "key" | default "cookie" -}}
-{{- $gatewayNodeBasename := get $cluster "discoveryNodeBasename" | default "fluxer_gateway" -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  replicas: {{ include "fluxer.replicas" (dict "name" $name "values" $v "context" $ctx) }}
-  minReadySeconds: {{ $minReadySeconds }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 6 }}
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: {{ $maxSurge | toJson }}
-      maxUnavailable: {{ $maxUnavailable | toJson }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ctx | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 8 }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ctx | nindent 6 }}
-      terminationGracePeriodSeconds: {{ $terminationGracePeriodSeconds }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $v.affinity }}
-      affinity:
-        {{- toYaml $v.affinity | nindent 8 }}
-      {{- else if $isGateway }}
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: gateway
-                    app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-                topologyKey: kubernetes.io/hostname
-      {{- end }}
-      {{- if $v.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $v.topologySpreadConstraints | nindent 8 }}
-      {{- else if $isGateway }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: gateway
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          nodeAffinityPolicy: Honor
-          nodeTaintsPolicy: Honor
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- end }}
-      {{- if $v.nodeSelector }}
-      nodeSelector:
-        {{- toYaml $v.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $v.tolerations }}
-      tolerations:
-        {{- toYaml $v.tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: {{ $name }}
-          image: {{ include "fluxer.image" (dict "image" $v.image "tag" $v.tag "context" $ctx) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          {{- if $v.command }}
-          command: {{ $v.command | toJson }}
-          {{- end }}
-          ports:
-            - name: http
-              containerPort: {{ $v.port }}
-              protocol: TCP
-            {{- if $gatewayClusterEnabled }}
-            - name: epmd
-              containerPort: {{ $erlangEpmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $erlangDistPort }}
-              protocol: TCP
-            {{- end }}
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            {{- if $gatewayClusterEnabled }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $gatewayNodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $erlangDistPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $erlangCookieSecretName }}
-                  key: {{ $erlangCookieSecretKey }}
-            {{- end }}
-            {{- if $buildVersion }}
-            - name: BUILD_VERSION
-              value: {{ $buildVersion | quote }}
-            {{- end }}
-            {{- if $buildSha }}
-            - name: BUILD_SHA
-              value: {{ $buildSha | quote }}
-            {{- end }}
-            {{- if $buildChannel }}
-            - name: RELEASE_CHANNEL
-              value: {{ $buildChannel | quote }}
-            {{- end }}
-            {{- if $nsfwServiceEndpoint }}
-            - name: FLUXER_NSFW_SERVICE_ENDPOINT
-              value: {{ $nsfwServiceEndpoint | quote }}
-            {{- end }}
-            {{- if $ctx.Values.global.env }}
-            {{- toYaml $ctx.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $v.env }}
-            {{- toYaml $v.env | nindent 12 }}
-            {{- end }}
-          {{- if or $ctx.Values.global.envFrom $v.envFrom }}
-          envFrom:
-            {{- if $ctx.Values.global.envFrom }}
-            {{- toYaml $ctx.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $v.envFrom }}
-            {{- toYaml $v.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          {{- if $preStopDrainEnabled }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ $preStopDrainCommand | quote }}
-          {{- end }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          {{- if not $v.noHealthCheck }}
-          livenessProbe:
-            httpGet:
-              path: {{ $livenessPath | quote }}
-              port: http
-            initialDelaySeconds: {{ $livenessInitialDelaySeconds }}
-            periodSeconds: {{ $livenessPeriodSeconds }}
-            timeoutSeconds: {{ $livenessTimeoutSeconds }}
-            failureThreshold: {{ $livenessFailureThreshold }}
-          readinessProbe:
-            {{- if $readinessExecEnabled }}
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ $readinessExecCommand | quote }}
-            {{- else }}
-            httpGet:
-              path: {{ $readinessPath | quote }}
-              port: http
-            {{- end }}
-            initialDelaySeconds: {{ $readinessInitialDelaySeconds }}
-            periodSeconds: {{ $readinessPeriodSeconds }}
-            timeoutSeconds: {{ $readinessTimeoutSeconds }}
-            failureThreshold: {{ $readinessFailureThreshold }}
-          {{- if $startupProbeEnabled }}
-          startupProbe:
-            httpGet:
-              path: {{ $startupProbePath | quote }}
-              port: http
-            initialDelaySeconds: {{ $startupProbeInitialDelaySeconds }}
-            periodSeconds: {{ $startupProbePeriodSeconds }}
-            timeoutSeconds: {{ $startupProbeTimeoutSeconds }}
-            failureThreshold: {{ $startupProbeFailureThreshold }}
-          {{- end }}
-          {{- end }}
-          resources:
-            {{- toYaml $v.resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{- end }}
-
-{{- define "fluxer.service" -}}
-{{- $name := .name -}}
-{{- $selectorName := .selectorName | default $name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  type: ClusterIP
-  ports:
-    - port: {{ $v.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fluxer.selectorLabels" (dict "name" $selectorName "context" $ctx) | nindent 4 }}
-{{- end }}
-
-{{- define "fluxer.pdb" -}}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ .name }}-pdb
-  namespace: {{ .context.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" .context | nindent 4 }}
-spec:
-  minAvailable: {{ .minAvailable }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" .name "context" .context) | nindent 6 }}
-{{- end }}
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: docs
-description: Fluxer documentation service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,23 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-docs
-  name: docs
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 128Mi
-    requests:
-      cpu: 50m
-      memory: 64Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-pdb:
-  minAvailable: 50%
@@ -1,22 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  resources:
-    requests:
-      cpu: 50m
-      memory: 64Mi
-    limits:
-      memory: 128Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: gateway
-description: Fluxer WebSocket gateway service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ $gatewayValues := .Values.gateway -}}
-{{- $cluster := .Values.cluster | default dict -}}
-{{- if dig "enabled" false $cluster -}}
-{{- $clusterEnv := list
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_ENABLED" "value" "true")
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME" "value" (dig "discoveryDnsName" "" $cluster))
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME" "value" (dig "discoveryNodeBasename" "fluxer_gateway" $cluster))
-  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS" "value" (printf "%d" (int (dig "discoveryPollIntervalMs" 5000 $cluster))))
-}}
-{{- if dig "enabled" false .Values.roles -}}
-{{- $clusterEnv = concat (list (dict "name" "FLUXER_GATEWAY_ROLE" "value" (dig "websocket" "role" "websocket" .Values.roles))) $clusterEnv -}}
-{{- end -}}
-{{- $gatewayValues = mergeOverwrite (deepCopy .Values.gateway) (dict "env" (concat $clusterEnv (get .Values.gateway "env" | default (list)))) -}}
-{{- end }}
-{{- $hotpatch := get .Values.gateway "hotpatch" | default dict -}}
-{{- if dig "enabled" false $hotpatch -}}
-{{- $hotpatchEnv := list
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_ENABLED" "value" "true")
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT" "value" (printf "%d" (int (get $hotpatch "cassandraPort" | default 9042))))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE" "value" (get $hotpatch "cassandraKeyspace" | default "fluxer"))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS" "value" (printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000))))
-  (dict "name" "FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS" "value" (printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000))))
-}}
-{{- if get $hotpatch "cassandraHosts" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS" "value" (get $hotpatch "cassandraHosts")) -}}
-{{- end -}}
-{{- $publicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}}
-{{- if get $publicKeysSecret "name" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS" "valueFrom" (dict "secretKeyRef" (dict "name" (get $publicKeysSecret "name") "key" (get $publicKeysSecret "key" | default "public_keys")))) -}}
-{{- end -}}
-{{- $credentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}}
-{{- if get $credentialsSecret "name" -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "usernameKey" | default "username")))) -}}
-{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "passwordKey" | default "password")))) -}}
-{{- end -}}
-{{- $gatewayValues = mergeOverwrite (deepCopy $gatewayValues) (dict "env" (concat $hotpatchEnv (get $gatewayValues "env" | default (list)))) -}}
-{{- end }}
-{{ include "fluxer.deployment" (dict "name" "gateway" "values" $gatewayValues "context" .) }}
@@ -1,70 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) }}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) }}
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: gateway
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-spec:
-  podSelector:
-    matchLabels:
-      {{- if dig "enabled" false .Values.roles }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
-      app.kubernetes.io/part-of: fluxer
-      {{- else }}
-      {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 6 }}
-      {{- end }}
-  policyTypes:
-    - Ingress
-    - Egress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: ingress-nginx
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: api
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: api-canary
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-realtime
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-lifecycle
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: worker-batch
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              {{- if dig "enabled" false .Values.roles }}
-              app.kubernetes.io/instance: {{ .Release.Name }}
-              app.kubernetes.io/part-of: fluxer
-              {{- else }}
-              {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 14 }}
-              {{- end }}
-      ports:
-        - port: {{.Values.gateway.port}}
-          protocol: TCP
-        {{- if $clusterEnabled }}
-        - port: {{ $epmdPort }}
-          protocol: TCP
-        - port: {{ $distPort }}
-          protocol: TCP
-        {{- end }}
-  egress:
-    - {}
@@ -1,5 +0,0 @@
-{{- if and .Values.pdb.enabled (gt (int .Values.gateway.replicas) 1) }}
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ include "fluxer.pdb" (dict "name" "gateway" "minAvailable" .Values.pdb.minAvailable "context" .) }}
-{{- end }}
@@ -1,40 +0,0 @@
-{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) -}}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) -}}
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" "gateway" "values" .Values.gateway "context" .)}}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: fluxer-gateway-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }}
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - port: {{ .Values.gateway.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-    {{- if $clusterEnabled }}
-    - port: {{ $epmdPort }}
-      targetPort: epmd
-      protocol: TCP
-      name: epmd
-    - port: {{ $distPort }}
-      targetPort: erl-dist
-      protocol: TCP
-      name: erl-dist
-    {{- end }}
-  selector:
-    {{- if dig "enabled" false .Values.roles }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: fluxer
-    {{- else }}
-    {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }}
-    {{- end }}
@@ -1,255 +0,0 @@
-{{- if dig "enabled" false .Values.roles }}
-{{- $cluster := .Values.cluster | default dict -}}
-{{- $distPort := int (dig "erlangDistribution" "port" 8081 $cluster) -}}
-{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 $cluster) -}}
-{{- $cookie := dig "erlangCookieSecret" (dict) $cluster -}}
-{{- $cookieName := get $cookie "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $cookieKey := get $cookie "key" | default "cookie" -}}
-{{- $nodeBasename := dig "discoveryNodeBasename" "fluxer_gateway" $cluster -}}
-{{- $dnsName := dig "discoveryDnsName" "" $cluster -}}
-{{- if not $dnsName }}
-{{- fail "cluster.discoveryDnsName is required when roles.enabled=true" }}
-{{- end }}
-{{- $pollIntervalMs := int (dig "discoveryPollIntervalMs" 5000 $cluster) -}}
-{{- $gateway := .Values.gateway -}}
-{{- $common := .Values.roles.common | default dict -}}
-{{- $build := get $gateway "build" | default dict -}}
-{{- $hotpatch := get $gateway "hotpatch" | default dict -}}
-{{- $hotpatchPublicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}}
-{{- $hotpatchCredentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}}
-{{- $roles := list "sessions" "presence" "guilds" "calls" "push" -}}
-{{- range $role := $roles }}
-{{- $roleValues := get $.Values.roles $role | default dict -}}
-{{- if dig "enabled" true $roleValues }}
-{{- $name := printf "gateway-%s" $role -}}
-{{- $replicas := int (dig "replicas" (dig "replicas" 1 $common) $roleValues) -}}
-{{- $resources := get $roleValues "resources" | default (get $common "resources" | default $gateway.resources) -}}
-{{- $nodeSelector := get $roleValues "nodeSelector" | default (get $common "nodeSelector" | default $gateway.nodeSelector) -}}
-{{- $tolerations := get $roleValues "tolerations" | default (get $common "tolerations" | default $gateway.tolerations) -}}
-{{- $affinity := get $roleValues "affinity" | default (get $common "affinity" | default dict) -}}
-{{- $topologySpreadConstraints := get $roleValues "topologySpreadConstraints" | default (get $common "topologySpreadConstraints" | default list) -}}
---
-# SPDX-License-Identifier: AGPL-3.0-or-later
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: {{ $name }}
-  namespace: {{ $.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 4 }}
-spec:
-  serviceName: fluxer-gateway-headless
-  replicas: {{ $replicas }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 6 }}
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 8 }}
-        app.kubernetes.io/gateway-role: {{ $role | quote }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ | nindent 6 }}
-      terminationGracePeriodSeconds: {{ int (dig "terminationGracePeriodSeconds" 45 $roleValues) }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $affinity }}
-      affinity:
-        {{- toYaml $affinity | nindent 8 }}
-      {{- end }}
-      {{- if $topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $topologySpreadConstraints | nindent 8 }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $.Release.Name }}
-      {{- end }}
-      {{- if $nodeSelector }}
-      nodeSelector:
-        {{- toYaml $nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $tolerations }}
-      tolerations:
-        {{- toYaml $tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: gateway
-          image: {{ include "fluxer.image" (dict "image" $gateway.image "tag" $gateway.tag "context" $) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          ports:
-            - name: http
-              containerPort: {{ $gateway.port }}
-              protocol: TCP
-            - name: epmd
-              containerPort: {{ $epmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $distPort }}
-              protocol: TCP
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            - name: FLUXER_GATEWAY_ROLE
-              value: {{ $role | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_ENABLED
-              value: "true"
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME
-              value: {{ $dnsName | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME
-              value: {{ $nodeBasename | quote }}
-            - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS
-              value: {{ printf "%d" $pollIntervalMs | quote }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $nodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $distPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $cookieName }}
-                  key: {{ $cookieKey }}
-            {{- if get $build "sha" }}
-            - name: BUILD_SHA
-              value: {{ get $build "sha" | quote }}
-            {{- end }}
-            {{- if get $build "number" }}
-            - name: BUILD_NUMBER
-              value: {{ get $build "number" | quote }}
-            {{- end }}
-            {{- if get $build "timestamp" }}
-            - name: BUILD_TIMESTAMP
-              value: {{ get $build "timestamp" | quote }}
-            {{- end }}
-            {{- if get $build "channel" }}
-            - name: RELEASE_CHANNEL
-              value: {{ get $build "channel" | quote }}
-            {{- end }}
-            {{- if dig "enabled" false $hotpatch }}
-            - name: FLUXER_GATEWAY_HOTPATCH_ENABLED
-              value: "true"
-            {{- if get $hotpatch "cassandraHosts" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS
-              value: {{ get $hotpatch "cassandraHosts" | quote }}
-            {{- end }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT
-              value: {{ printf "%d" (int (get $hotpatch "cassandraPort" | default 9042)) | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE
-              value: {{ get $hotpatch "cassandraKeyspace" | default "fluxer" | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS
-              value: {{ printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000)) | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS
-              value: {{ printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000)) | quote }}
-            {{- if get $hotpatchPublicKeysSecret "name" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchPublicKeysSecret "name" | quote }}
-                  key: {{ get $hotpatchPublicKeysSecret "key" | default "public_keys" | quote }}
-            {{- end }}
-            {{- if get $hotpatchCredentialsSecret "name" }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchCredentialsSecret "name" | quote }}
-                  key: {{ get $hotpatchCredentialsSecret "usernameKey" | default "username" | quote }}
-            - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ get $hotpatchCredentialsSecret "name" | quote }}
-                  key: {{ get $hotpatchCredentialsSecret "passwordKey" | default "password" | quote }}
-            {{- end }}
-            {{- end }}
-            {{- if $.Values.global.env }}
-            {{- toYaml $.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $gateway.env }}
-            {{- toYaml $gateway.env | nindent 12 }}
-            {{- end }}
-            {{- if $common.env }}
-            {{- toYaml $common.env | nindent 12 }}
-            {{- end }}
-            {{- if $roleValues.env }}
-            {{- toYaml $roleValues.env | nindent 12 }}
-            {{- end }}
-          {{- if or $.Values.global.envFrom $gateway.envFrom $common.envFrom $roleValues.envFrom }}
-          envFrom:
-            {{- if $.Values.global.envFrom }}
-            {{- toYaml $.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $gateway.envFrom }}
-            {{- toYaml $gateway.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $common.envFrom }}
-            {{- toYaml $common.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $roleValues.envFrom }}
-            {{- toYaml $roleValues.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ printf "curl -fsS --max-time 2 http://127.0.0.1:%d/_health/drain >/dev/null 2>&1 || true; sleep 20" (int $gateway.port) | quote }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: "/_health"
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 15
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ printf "curl -fsS --max-time 5 http://127.0.0.1:%d/_health/ready >/dev/null 2>&1 || exit 1" (int $gateway.port) | quote }}
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 3
-          startupProbe:
-            httpGet:
-              path: "/_health"
-              port: http
-            initialDelaySeconds: 0
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 30
-          resources:
-            {{- toYaml $resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{ end }}
-{{ end }}
-{{ end }}
@@ -1,164 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-gateway release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-gateway
-# Apply with:    helm upgrade fluxer-gateway deploy/helm/gateway -f deploy/helm/gateway/values.yaml -f deploy/helm/gateway/values.prod.yaml
-
-cluster:
-  discoveryDnsName: fluxer-gateway-headless.fluxer.svc.cluster.local
-  discoveryNodeBasename: fluxer_gateway
-  discoveryPollIntervalMs: 5000
-  enabled: true
-  erlangCookieSecret:
-    key: cookie
-    name: fluxer-gateway-erlang-cookie
-  erlangDistribution:
-    epmdPort: 4369
-    port: 8081
-
-gateway:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT
-    value: "https://fluxerstatic.com"
-  - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES
-    value: "128"
-  - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES
-    value: "1048576"
-  image: fluxer-gateway
-  hotpatch:
-    enabled: true
-    cassandraHosts: int.flx-nyc-db1.srv.fluxer.dev
-    cassandraPort: 9041
-    cassandraKeyspace: fluxer
-    pollIntervalMs: 5000
-    startupSyncTimeoutMs: 30000
-    publicKeysSecret:
-      name: fluxer-gateway-hotpatch-public-keys
-      key: public_keys
-    cassandraCredentialsSecret:
-      name: fluxer-runtime-env-shared
-      usernameKey: FLUXER_CASSANDRA_USERNAME
-      passwordKey: FLUXER_CASSANDRA_PASSWORD
-  livenessProbe:
-    timeoutSeconds: 5
-  minReadySeconds: 0
-  nodeSelector: null
-  port: 8080
-  preStopDrain:
-    enabled: true
-    retryCount: 6
-    retryIntervalSeconds: 1
-    sleepSeconds: 30
-    timeoutSeconds: 2
-  preserveLiveReplicas: false
-  readinessProbe:
-    execEnabled: true
-    failureThreshold: 3
-    initialDelaySeconds: 5
-    path: /_health/ready
-    periodSeconds: 5
-    timeoutSeconds: 5
-  replicas: 16
-  resources:
-    limits:
-      memory: 16Gi
-    requests:
-      cpu: 500m
-      memory: 512Mi
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  startupProbe:
-    enabled: true
-    failureThreshold: 30
-    initialDelaySeconds: 0
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 5
-  tag: ""
-  terminationGracePeriodSeconds: 45
-  tolerations:
-  - effect: NoSchedule
-    key: dedicated
-    operator: Equal
-    value: gateway
-roles:
-  enabled: true
-  websocket:
-    role: websocket
-  common:
-    nodeSelector: null
-    resources:
-      requests:
-        cpu: 500m
-        memory: 768Mi
-      limits:
-        memory: 12Gi
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 60
-          preference:
-            matchExpressions:
-            - key: node.kubernetes.io/instance-type
-              operator: In
-              values:
-              - vhf-16c-58gb
-  sessions:
-    enabled: true
-    replicas: 12
-    resources:
-      requests:
-        cpu: 750m
-        memory: 2Gi
-      limits:
-        memory: 16Gi
-  presence:
-    enabled: true
-    replicas: 6
-    resources:
-      requests:
-        cpu: 500m
-        memory: 768Mi
-      limits:
-        memory: 6Gi
-  guilds:
-    enabled: true
-    replicas: 12
-    resources:
-      requests:
-        cpu: 750m
-        memory: 1Gi
-      limits:
-        memory: 8Gi
-  calls:
-    enabled: true
-    replicas: 4
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 4Gi
-  push:
-    enabled: true
-    replicas: 4
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 4Gi
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-shared
-pdb:
-  enabled: false
-  minAvailable: 1
@@ -1,118 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-gateway:
-  image: fluxer-gateway
-  tag: ''
-  replicas: 1
-  preserveLiveReplicas: false
-  port: 8080
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  minReadySeconds: 0
-  terminationGracePeriodSeconds: 45
-  readinessProbe:
-    path: /_health/ready
-    execEnabled: true
-    timeoutSeconds: 5
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    failureThreshold: 3
-  livenessProbe:
-    timeoutSeconds: 5
-  startupProbe:
-    enabled: true
-    path: /_health
-    initialDelaySeconds: 0
-    periodSeconds: 5
-    failureThreshold: 30
-    timeoutSeconds: 5
-  preStopDrain:
-    enabled: true
-    sleepSeconds: 30
-    timeoutSeconds: 2
-    retryCount: 6
-    retryIntervalSeconds: 1
-  nodeSelector:
-    kubernetes.io/hostname: flx-nyc-k8s-worker-efd1167e6219
-  tolerations:
-    - key: dedicated
-      operator: Equal
-      value: gateway
-      effect: NoSchedule
-  resources:
-    requests:
-      cpu: 500m
-      memory: 512Mi
-    limits:
-      memory: 16Gi
-  env:
-    - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT
-      value: "https://fluxerstatic.com"
-    - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES
-      value: "128"
-    - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES
-      value: "1048576"
-  hotpatch:
-    enabled: false
-    cassandraHosts: ''
-    cassandraPort: 9042
-    cassandraKeyspace: fluxer
-    pollIntervalMs: 5000
-    startupSyncTimeoutMs: 30000
-    publicKeysSecret:
-      name: ''
-      key: public_keys
-    cassandraCredentialsSecret:
-      name: ''
-      usernameKey: username
-      passwordKey: password
-
-cluster:
-  enabled: false
-  discoveryDnsName: ''
-  discoveryNodeBasename: fluxer_gateway
-  discoveryPollIntervalMs: 5000
-  erlangDistribution:
-    port: 8081
-    epmdPort: 4369
-  erlangCookieSecret:
-    name: fluxer-gateway-erlang-cookie
-    key: cookie
-
-roles:
-  enabled: false
-  websocket:
-    role: websocket
-  common:
-    replicas: 1
-    resources:
-      requests:
-        cpu: 500m
-        memory: 512Mi
-      limits:
-        memory: 8Gi
-  sessions:
-    enabled: true
-    replicas: 1
-  presence:
-    enabled: true
-    replicas: 1
-  guilds:
-    enabled: true
-    replicas: 1
-  calls:
-    enabled: true
-    replicas: 1
-  push:
-    enabled: true
-    replicas: 1
-
-pdb:
-  enabled: false
-  minAvailable: 1
@@ -1,9 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: gifs
-version: 0.1.0
-dependencies:
-  - name: svc-common
-    version: 0.1.0
-    repository: file://../svc-common
@@ -1,13 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ include "svc-common.statefulset" . }}
---
-{{ include "svc-common.deployment" . }}
---
-{{ include "svc-common.headless-service" . }}
---
-{{ include "svc-common.service" . }}
---
-{{ include "svc-common.pdb" . }}
---
-{{ include "svc-common.router-pdb" . }}
@@ -1,32 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-svc:
-  shard:
-    replicas: 4
-    resources:
-      requests:
-        cpu: 100m
-        memory: 512Mi
-      limits:
-        memory: 1Gi
-  router:
-    replicas: 3
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        memory: 512Mi
-  cache:
-    maxEntries: 500000
-    ttlMs: '30000'
-  extraEnv:
-    - name: FLUXER_MEDIA_PROXY_ENDPOINT
-      value: http://media-proxy:8080
-    - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT
-      value: https://fluxerusercontent.com
-    - name: FLUXER_MEDIA_PROXY_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-media-proxy-v2-env
-          key: FLUXER_MEDIA_PROXY_SECRET_KEY
@@ -1,55 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-svc:
-  name: gifs
-  image: fluxer-gifs
-  tag: ''
-  shard:
-    replicas: 2
-    port: 8090
-    minReadySeconds: 10
-    terminationGracePeriodSeconds: 60
-    resources:
-      requests:
-        cpu: 100m
-        memory: 256Mi
-      limits:
-        memory: 512Mi
-  router:
-    replicas: 2
-    port: 8090
-    minReadySeconds: 10
-    maxSurge: 1
-    maxUnavailable: 0
-    terminationGracePeriodSeconds: 60
-    resources:
-      requests:
-        cpu: 100m
-        memory: 128Mi
-      limits:
-        memory: 256Mi
-  nats:
-    url: nats://nats-core:4222
-  cache:
-    maxEntries: 250000
-    ttlMs: '30000'
-  extraEnv:
-    - name: FLUXER_MEDIA_PROXY_ENDPOINT
-      value: http://media-proxy:8080
-    - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT
-      value: https://fluxerusercontent.com
-    - name: FLUXER_MEDIA_PROXY_SECRET_KEY
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-media-proxy-v2-env
-          key: FLUXER_MEDIA_PROXY_SECRET_KEY
-  nodeSelector: {}
-  tolerations: []
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: infra
-description: Fluxer infrastructure (NATS, Valkey, Ingress)
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,133 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Daily sync of the MaxMind GeoLite2 City and ASN MMDB files into S3.
-# Runtime services read these out of the CDN bucket. Adopted into helm
-# from a previously hand-applied kubectl manifest.
-
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: geoip-sync
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    app.kubernetes.io/name: geoip-sync
-    {{- include "fluxer.labels" . | nindent 4 }}
-spec:
-  schedule: {{ .Values.geoipSync.schedule | quote }}
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      activeDeadlineSeconds: {{ .Values.geoipSync.activeDeadlineSeconds }}
-      backoffLimit: {{ .Values.geoipSync.backoffLimit }}
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/name: geoip-sync
-            app.kubernetes.io/part-of: fluxer
-        spec:
-          restartPolicy: OnFailure
-          terminationGracePeriodSeconds: 60
-          imagePullSecrets:
-            - name: {{ .Values.global.imagePullSecret }}
-          containers:
-            - name: sync
-              image: {{ .Values.geoipSync.image }}
-              imagePullPolicy: IfNotPresent
-              securityContext:
-                allowPrivilegeEscalation: false
-                readOnlyRootFilesystem: false
-                runAsNonRoot: true
-                runAsUser: 1000
-                runAsGroup: 1000
-                capabilities:
-                  drop: ["ALL"]
-                seccompProfile:
-                  type: RuntimeDefault
-              env:
-                - name: GEOIP_BUCKET
-                  value: {{ .Values.geoipSync.bucket | quote }}
-                - name: GEOIP_CITY_UPSTREAM_URL
-                  value: {{ .Values.geoipSync.cityUpstreamUrl | quote }}
-                - name: GEOIP_ASN_UPSTREAM_URL
-                  value: {{ .Values.geoipSync.asnUpstreamUrl | quote }}
-              envFrom:
-                - secretRef:
-                    name: {{ .Values.geoipSync.envSecret }}
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 256Mi
-                limits:
-                  memory: 512Mi
-              command:
-                - sh
-                - -c
-                - |
-                  set -eu
-
-                  : "${GEOIP_BUCKET:?missing GEOIP_BUCKET}"
-                  : "${GEOIP_CITY_UPSTREAM_URL:?missing GEOIP_CITY_UPSTREAM_URL}"
-                  : "${GEOIP_ASN_UPSTREAM_URL:?missing GEOIP_ASN_UPSTREAM_URL}"
-                  : "${FLUXER_S3_ACCESS_KEY_ID:?missing FLUXER_S3_ACCESS_KEY_ID}"
-                  : "${FLUXER_S3_SECRET_ACCESS_KEY:?missing FLUXER_S3_SECRET_ACCESS_KEY}"
-                  : "${FLUXER_S3_ENDPOINT:?missing FLUXER_S3_ENDPOINT}"
-                  : "${FLUXER_S3_REGION:?missing FLUXER_S3_REGION}"
-
-                  export AWS_ACCESS_KEY_ID="$FLUXER_S3_ACCESS_KEY_ID"
-                  export AWS_SECRET_ACCESS_KEY="$FLUXER_S3_SECRET_ACCESS_KEY"
-                  export AWS_DEFAULT_REGION="$FLUXER_S3_REGION"
-
-                  WORKDIR=$(mktemp -d)
-                  trap 'rm -rf "$WORKDIR"' EXIT
-
-                  # MMDB files end with the ASCII string "MaxMind.com" after
-                  # their metadata marker. Verifying this tail before upload
-                  # catches the case where an upstream returns an HTML error
-                  # page or a zero-byte body.
-                  fetch_and_verify() {
-                    local url="$1"
-                    local dest="$2"
-                    echo "-> fetching $url"
-                    curl --fail --location --silent --show-error \
-                         --user-agent 'fluxer-geoip-sync/1.0' \
-                         --max-time 120 \
-                         --output "$dest" \
-                         "$url"
-                    local size
-                    size=$(wc -c < "$dest")
-                    if [ "$size" -lt 1024 ]; then
-                      echo "refusing to upload ${dest}: file is ${size} bytes, too small" >&2
-                      return 1
-                    fi
-                    if ! tail -c 2048 "$dest" | grep -q "MaxMind.com"; then
-                      echo "refusing to upload ${dest}: MaxMind.com marker not found in trailer" >&2
-                      return 1
-                    fi
-                    echo "   ok (${size} bytes)"
-                  }
-
-                  fetch_and_verify "$GEOIP_CITY_UPSTREAM_URL" "$WORKDIR/GeoLite2-City.mmdb"
-                  fetch_and_verify "$GEOIP_ASN_UPSTREAM_URL"  "$WORKDIR/GeoLite2-ASN.mmdb"
-
-                  # Atomic-ish replacement: upload to a versioned side-key
-                  # first, then copy to the canonical key. If the final copy
-                  # fails the previous canonical file is untouched.
-                  STAMP=$(date -u +%Y%m%dT%H%M%SZ)
-
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-City.mmdb" \
-                      "s3://${GEOIP_BUCKET}/archive/GeoLite2-City-${STAMP}.mmdb"
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-ASN.mmdb" \
-                      "s3://${GEOIP_BUCKET}/archive/GeoLite2-ASN-${STAMP}.mmdb"
-
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-City.mmdb" \
-                      "s3://${GEOIP_BUCKET}/GeoLite2-City.mmdb"
-                  aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \
-                      "$WORKDIR/GeoLite2-ASN.mmdb" \
-                      "s3://${GEOIP_BUCKET}/GeoLite2-ASN.mmdb"
-
-                  echo "geoip-sync complete: city=${STAMP} asn=${STAMP}"
@@ -1,278 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{ $hosts := .Values.ingress.hosts -}}
-{{ $ports := .Values.ports -}}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.api }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api
-                port:
-                  number: {{ $ports.api }}
-
-    - host: {{ $hosts.apiCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: api-canary
-                port:
-                  number: {{ $ports.apiCanary }}
-
-    - host: {{ $hosts.appProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: app-proxy
-                port:
-                  number: {{ $ports.appProxy }}
-
-    - host: {{ $hosts.appProxyCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: app-proxy-canary
-                port:
-                  number: {{ $ports.appProxyCanary }}
-
-    - host: {{ $hosts.admin }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: admin
-                port:
-                  number: {{ $ports.admin }}
-
-    - host: {{ $hosts.adminCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: admin-canary
-                port:
-                  number: {{ $ports.adminCanary }}
-
-    - host: {{ $hosts.marketing }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- with $hosts.help }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-{{- with $hosts.blog }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-{{- with $hosts.docs }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: docs
-                port:
-                  number: {{ $ports.docs }}
-
-{{- end }}
-{{- range $hosts.marketingAliases }}
-    - host: {{ . }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing
-                port:
-                  number: {{ $ports.marketing }}
-
-{{- end }}
-    - host: {{ $hosts.marketingCanary }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: marketing-canary
-                port:
-                  number: {{ $ports.marketingCanary }}
-
-    - host: {{ $hosts.mediaProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: media-proxy
-                port:
-                  number: {{ $ports.mediaProxy }}
-
-    - host: {{ $hosts.staticProxy }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: static-proxy
-                port:
-                  number: {{ $ports.staticProxy }}
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-gateway
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/websocket-services: gateway
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.gateway }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gateway
-                port:
-                  number: {{ $ports.gateway }}
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-api-proxy
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/use-regex: "true"
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-    - host: {{ $hosts.appProxy }}
-      http:
-        paths:
-          - path: /api(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: api
-                port:
-                  number: {{ $ports.api }}
-
-    - host: {{ $hosts.appProxyCanary }}
-      http:
-        paths:
-          - path: /api(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: api-canary
-                port:
-                  number: {{ $ports.apiCanary }}
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fluxer-ingress-uploads
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "500m"
-    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "900"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "900"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: "1m"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  rules:
-
-    - host: {{ $hosts.uploads }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: uploads
-                port:
-                  number: {{ $ports.uploads }}
@@ -1,26 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nats-config
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-data:
-  nats.conf: |
-    listen: 0.0.0.0:{{ .Values.nats.clientPort }}
-    http: 0.0.0.0:{{ .Values.nats.monitorPort }}
-    max_payload: {{ .Values.nats.maxPayload | default "64MB" }}
-    max_pending: {{ .Values.nats.maxPending | default "128MB" }}
-    max_connections: {{ .Values.nats.maxConnections | default 2048 }}
-
-    cluster {
-      name: fluxer-nats
-      listen: 0.0.0.0:{{ .Values.nats.clusterPort }}
-
-      routes = [
-        {{- range $i := until (int .Values.nats.replicas) }}
-        nats-route://nats-{{ $i }}.nats-headless.{{ $.Values.global.namespace }}.svc.cluster.local:{{ $.Values.nats.clusterPort }}
-        {{- end }}
-      ]
-    }
@@ -1,44 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: nats-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - name: client
-      port: {{ .Values.nats.clientPort }}
-      targetPort: client
-    - name: cluster
-      port: {{ .Values.nats.clusterPort }}
-      targetPort: cluster
-    - name: monitor
-      port: {{ .Values.nats.monitorPort }}
-      targetPort: monitor
-  selector:
-    app.kubernetes.io/name: nats
-    app.kubernetes.io/instance: {{ .Release.Name }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: nats-core
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  type: ClusterIP
-  ports:
-    - name: client
-      port: {{ .Values.nats.clientPort }}
-      targetPort: client
-  selector:
-    app.kubernetes.io/name: nats
-    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -1,63 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: nats
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: nats
-spec:
-  serviceName: nats-headless
-  replicas: {{ .Values.nats.replicas }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: nats
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" . | nindent 8 }}
-        app.kubernetes.io/name: nats
-        app.kubernetes.io/instance: {{ .Release.Name }}
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/nats-configmap.yaml") . | sha256sum }}
-    spec:
-      terminationGracePeriodSeconds: 30
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: nats
-          image: {{ .Values.nats.image }}:{{ .Values.nats.tag }}
-          args: ["-c", "/etc/nats/nats.conf"]
-          ports:
-            - name: client
-              containerPort: {{ .Values.nats.clientPort }}
-            - name: cluster
-              containerPort: {{ .Values.nats.clusterPort }}
-            - name: monitor
-              containerPort: {{ .Values.nats.monitorPort }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: monitor
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /healthz?js-enabled-only=true
-              port: monitor
-            initialDelaySeconds: 5
-            periodSeconds: 5
-          volumeMounts:
-            - name: config
-              mountPath: /etc/nats
-          resources:
-            {{- toYaml .Values.nats.resources | nindent 12 }}
-      volumes:
-        - name: config
-          configMap:
-            name: nats-config
@@ -1,14 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: nats-pdb
-  namespace: {{.Values.global.namespace}}
-  labels: {{- include "fluxer.labels" . | nindent 4}}
-spec:
-  minAvailable: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: nats
-      app.kubernetes.io/instance: {{.Release.Name}}
@@ -1,39 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: valkey-headless
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: valkey
-spec:
-  type: ClusterIP
-  clusterIP: None
-  publishNotReadyAddresses: true
-  ports:
-    - name: valkey
-      port: {{ .Values.valkey.port }}
-      targetPort: valkey
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: {{ .Release.Name }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: valkey
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: valkey
-spec:
-  type: ClusterIP
-  ports:
-    - name: valkey
-      port: {{ .Values.valkey.port }}
-      targetPort: valkey
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: {{ .Release.Name }}
@@ -1,60 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: valkey
-  namespace: {{ .Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" . | nindent 4 }}
-    app.kubernetes.io/name: valkey
-spec:
-  serviceName: valkey-headless
-  replicas: {{ .Values.valkey.replicas }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: valkey
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" . | nindent 8 }}
-        app.kubernetes.io/name: valkey
-        app.kubernetes.io/instance: {{ .Release.Name }}
-    spec:
-      terminationGracePeriodSeconds: 15
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: valkey
-          image: {{ .Values.valkey.image }}:{{ .Values.valkey.tag }}
-          command:
-            - valkey-server
-            - --save
-            - ""
-            - --appendonly
-            - "no"
-            - --maxmemory
-            - {{ .Values.valkey.maxmemory | quote }}
-            - --maxmemory-policy
-            - allkeys-lru
-          ports:
-            - name: valkey
-              containerPort: {{ .Values.valkey.port }}
-          livenessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 3
-            periodSeconds: 5
-          resources:
-            {{- toYaml .Values.valkey.resources | nindent 12 }}
@@ -1,74 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the infra release as of 2026-05-17T20:42:44Z.
-# Captured via:  helm -n fluxer get values infra
-# Apply with:    helm upgrade infra deploy/helm/infra -f deploy/helm/infra/values.yaml -f deploy/helm/infra/values.prod.yaml
-
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-ingress:
-  className: nginx
-  hosts:
-    admin: admin.fluxer.app
-    adminCanary: admin.canary.fluxer.app
-    api: api.fluxer.app
-    apiCanary: api.canary.fluxer.app
-    appProxy: web.fluxer.app
-    appProxyCanary: web.canary.fluxer.app
-    gateway: gateway.fluxer.app
-    help: help.fluxer.app
-    blog: blog.fluxer.app
-    docs: docs.fluxer.app
-    marketing: fluxer.app
-    marketingAliases:
-      - www.fluxer.app
-      - fluxerapp.com
-      - www.fluxerapp.com
-      - fluxer.gg
-      - fluxer.gift
-      - fluxer.dev
-      - www.fluxer.dev
-      - every.day.im.fluxer.ing
-    marketingCanary: canary.fluxer.app
-    mediaProxy: fluxerusercontent.com
-    staticProxy: fluxerstatic.com
-nats:
-  clientPort: 4222
-  clusterPort: 6222
-  image: nats
-  maxConnections: 2048
-  monitorPort: 8222
-  replicas: 5
-  resources:
-    limits:
-      memory: 2Gi
-    requests:
-      cpu: 100m
-      memory: 512Mi
-  tag: 2-alpine
-ports:
-  admin: 8080
-  adminCanary: 8080
-  api: 8080
-  apiCanary: 8080
-  appProxy: 8080
-  appProxyCanary: 8080
-  gateway: 8080
-  marketing: 8080
-  marketingCanary: 8080
-  docs: 8080
-  mediaProxy: 8080
-  staticProxy: 8080
-valkey:
-  image: valkey/valkey
-  port: 6379
-  replicas: 1
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 128Mi
-  tag: 8-alpine
@@ -1,91 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-nats:
-  replicas: 3
-  image: nats
-  tag: 2-alpine
-  clientPort: 4222
-  clusterPort: 6222
-  monitorPort: 8222
-  maxPayload: 64MB
-  maxPending: 128MB
-  maxConnections: 2048
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      memory: 2Gi
-
-valkey:
-  replicas: 1
-  image: valkey/valkey
-  tag: 8-alpine
-  port: 6379
-  maxmemory: 1600mb
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      memory: 2Gi
-
-ingress:
-  className: nginx
-  hosts:
-    api: api.fluxer.app
-    apiCanary: api.canary.fluxer.app
-    appProxy: web.fluxer.app
-    appProxyCanary: web.canary.fluxer.app
-    admin: admin.fluxer.app
-    adminCanary: admin.canary.fluxer.app
-    marketing: fluxer.app
-    marketingCanary: canary.fluxer.app
-    mediaProxy: fluxerusercontent.com
-    staticProxy: fluxerstatic.com
-    gateway: gateway.fluxer.app
-    help: help.fluxer.app
-    blog: blog.fluxer.app
-    docs: docs.fluxer.app
-    marketingAliases:
-      - www.fluxer.app
-      - fluxerapp.com
-      - www.fluxerapp.com
-      - fluxer.gg
-      - fluxer.gift
-      - fluxer.dev
-      - www.fluxer.dev
-      - every.day.im.fluxer.ing
-    uploads: uploads.fluxer.app
-
-ports:
-  api: 8080
-  apiCanary: 8080
-  appProxy: 8080
-  appProxyCanary: 8080
-  admin: 8080
-  adminCanary: 8080
-  marketing: 8080
-  marketingCanary: 8080
-  docs: 8080
-  mediaProxy: 8080
-  staticProxy: 8080
-  gateway: 8080
-  uploads: 8080
-
-# MaxMind GeoLite2 sync — daily at 05:17 UTC. Runtime services read
-# these mmdb files out of the CDN bucket.
-geoipSync:
-  image: amazon/aws-cli:2.17.12
-  schedule: '17 5 * * *'
-  activeDeadlineSeconds: 1800
-  backoffLimit: 2
-  bucket: fluxer-geoip
-  cityUpstreamUrl: https://git.io/GeoLite2-City.mmdb
-  asnUpstreamUrl: https://git.io/GeoLite2-ASN.mmdb
-  envSecret: fluxer-env-shared
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: marketing
-description: Fluxer marketing service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,30 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-marketing-canary release as of 2026-05-17T20:42:39Z.
-# Captured via:  helm -n fluxer get values fluxer-marketing-canary
-# Apply with:    helm upgrade fluxer-marketing-canary deploy/helm/marketing -f deploy/helm/marketing/values.yaml -f deploy/helm/marketing/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  image: fluxer-marketing
-  name: marketing-canary
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,30 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-marketing-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-marketing-stable
-# Apply with:    helm upgrade fluxer-marketing-stable deploy/helm/marketing -f deploy/helm/marketing/values.yaml -f deploy/helm/marketing/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-marketing
-  name: marketing
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,23 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: media-proxy
-description: Fluxer media proxy and static proxy services
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,5 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" "media-proxy" "values" .Values.mediaProxy "context" .)}}
---
-{{include "fluxer.deployment" (dict "name" "static-proxy" "values" .Values.staticProxy "context" .)}}
@@ -1,20 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{- range $name, $cfg := .Values.pdb }}
-{{- if (dig "enabled" true $cfg) }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ $name }}-pdb
-  namespace: {{ $.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 4 }}
-spec:
-  minAvailable: {{ $cfg.minAvailable | quote }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 6 }}
---
-{{- end }}
-{{- end }}
@@ -1,5 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" "media-proxy" "values" .Values.mediaProxy "context" .)}}
---
-{{include "fluxer.service" (dict "name" "static-proxy" "values" .Values.staticProxy "context" .)}}
@@ -1,88 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-media-proxy release as of 2026-05-17T20:42:42Z.
-# Captured via:  helm -n fluxer get values fluxer-media-proxy
-# Apply with:    helm upgrade fluxer-media-proxy deploy/helm/media-proxy -f deploy/helm/media-proxy/values.yaml -f deploy/helm/media-proxy/values.prod.yaml
-
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-shared
-mediaProxy:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: FLUXER_MEDIA_PROXY_MODE
-    value: mp
-  - name: FLUXER_MEDIA_PROXY_NSFW_THRESHOLD
-    value: "0.95"
-  - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND
-    value: s3
-  - name: FLUXER_MEDIA_PROXY_READ_ONLY
-    value: "true"
-  - name: FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS
-    value: "4"
-  - name: FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY
-    value: "128"
-  - name: FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS
-    value: "30000"
-  - name: FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES
-    value: "4096"
-  - name: FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS
-    value: "30000"
-  - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES
-    value: "1073741824"
-  - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES
-    value: "134217728"
-  - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS
-    value: "1800000"
-  - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS
-    value: "30000"
-  image: fluxer-media-proxy
-  nsfwServiceEndpoint: http://int.flx-nyc-misc1.srv.fluxer.dev:8000
-  port: 8080
-  preserveLiveReplicas: false
-  replicas: 16
-  resources:
-    limits:
-      cpu: 4000m
-      memory: 4Gi
-    requests:
-      cpu: 300m
-      memory: 768Mi
-  tag: ""
-pdb:
-  media-proxy:
-    enabled: true
-    minAvailable: 50%
-  static-proxy:
-    enabled: true
-    minAvailable: 50%
-staticProxy:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: FLUXER_MEDIA_PROXY_MODE
-    value: static
-  - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND
-    value: s3
-  - name: FLUXER_MEDIA_PROXY_READ_ONLY
-    value: "true"
-  - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS
-    value: "30000"
-  image: fluxer-media-proxy
-  port: 8080
-  preserveLiveReplicas: false
-  replicas: 4
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 256Mi
-  tag: ""
--- a/Show More
+++ b/Show More