fix(installer): pull images before the first start (#3248 )

fix(schema): keep template topics optional after trimming (#3247 )
docs(self-hosting): fix LiveKit CSP and backup guidance (#3246 )
2026-10-08 19:52:13 +09:00 · 2026-10-07 02:37:35 +02:00 · 2026-10-07 01:42:37 +02:00 · 2026-10-07 00:09:39 +02:00 · 2026-10-06 23:25:53 +02:00 · 2026-10-06 22:46:47 +02:00
7161 changed files with 926778 additions and 728065 deletions
@@ -1,22 +1,21 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG HELM_VERSION=4.2.0
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.122
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=11.27.0
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends \
+		acl \
 		bash \
-		brotli \
 		build-essential \
 		ca-certificates \
 		clang \
@@ -33,6 +32,7 @@ RUN apt-get update \
 		jq \
 		libasound2 \
 		libatk-bridge2.0-0 \
+		libaom-dev \
 		libavcodec-dev \
 		libavfilter-dev \
 		libavformat-dev \
@@ -42,19 +42,25 @@ RUN apt-get update \
 		libfido2-dev \
 		libgbm1 \
 		libgtk-3-0 \
+		libimage-exiftool-perl \
 		libnotify4 \
 		libnss3 \
 		libpipewire-0.3-dev \
 		libpulse-dev \
 		libsecret-1-0 \
 		libudev-dev \
-		libuv1-dev \
 		libcurl4-openssl-dev \
 		libswresample-dev \
 		libswscale-dev \
+		libdav1d-dev \
+		libde265-dev \
+		liblcms2-dev \
 		libvips-dev \
+		libyuv-dev \
 		libwayland-dev \
 		libwebp-dev \
+		nasm \
+		yasm \
 		libssl-dev \
 		libx11-xcb1 \
 		libxcb-dri3-0 \
@@ -71,16 +77,15 @@ RUN apt-get update \
 		ninja-build \
 		openssh-client \
 		pkg-config \
-		protobuf-compiler \
 		python3 \
 		python3-pip \
-		rsync \
+		python3-venv \
 		sudo \
 		rpm \
 		unzip \
-		webp \
 		xz-utils \
 		xdg-utils \
+		zlib1g-dev \
 		zstd \
 	&& rm -rf /var/lib/apt/lists/*

@@ -90,6 +95,7 @@ RUN apt-get update \
 		bat \
 		btop \
 		docker-cli \
+		docker-compose \
 		dnsutils \
 		fd-find \
 		gdb \
@@ -122,24 +128,33 @@ RUN apt-get update \
 	&& ln -sf /usr/bin/batcat /usr/local/bin/bat \
 	&& rm -rf /var/lib/apt/lists/*

-RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

-RUN ARCH="$(dpkg --print-architecture)" \
-	&& case "$ARCH" in \
-		amd64) HELM_ARCH="amd64" ;; \
-		arm64) HELM_ARCH="arm64" ;; \
-		*) echo "Unsupported architecture for Helm: $ARCH" >&2; exit 1 ;; \
-	esac \
-	&& curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${HELM_ARCH}.tar.gz" -o /tmp/helm.tgz \
-	&& tar -C /tmp -xzf /tmp/helm.tgz "linux-${HELM_ARCH}/helm" \
-	&& mv "/tmp/linux-${HELM_ARCH}/helm" /usr/local/bin/helm \
-	&& chmod +x /usr/local/bin/helm \
-	&& rm -rf /tmp/helm.tgz "/tmp/linux-${HELM_ARCH}"
+RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

-RUN python3 -m pip install --break-system-packages --no-cache-dir awscli cqlsh
+COPY fluxer_media_proxy/tools/install-native-deps.sh /tmp/fluxer-install-native-deps.sh
+RUN /tmp/fluxer-install-native-deps.sh /usr/local \
+	&& rm /tmp/fluxer-install-native-deps.sh
+
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+RUN printf '%s\n' \
+		'#include <libheif/heif.h>' \
+		'#include <string.h>' \
+		'#if !LIBHEIF_HAVE_VERSION(1, 23, 0)' \
+		'#error the source-built libheif headers must win the include search' \
+		'#endif' \
+		'int main(void) { return strcmp(heif_get_version(), LIBHEIF_VERSION) != 0; }' \
+		>/tmp/fluxer-heif-probe.c \
+	&& cc /tmp/fluxer-heif-probe.c $(pkg-config --cflags --libs libheif) -o /tmp/fluxer-heif-probe \
+	&& /tmp/fluxer-heif-probe \
+	&& [ "$(pkg-config --variable=prefix libheif)" = /usr/local ] \
+	&& rm /tmp/fluxer-heif-probe.c /tmp/fluxer-heif-probe

 COPY tools/fonts/requirements.txt /tmp/fluxer-fonts-requirements.txt
 RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer-fonts-requirements.txt \
@@ -147,18 +162,13 @@ RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer
 	&& pyftsubset --help >/dev/null \
 	&& python3 -c "import fontTools, brotli"

-RUN if ! command -v rebar3 >/dev/null 2>&1; then \
-		curl -fsSL https://s3.amazonaws.com/rebar3/rebar3 -o /usr/local/bin/rebar3 \
-		&& chmod +x /usr/local/bin/rebar3; \
-	fi
-
 RUN ARCH="$(dpkg --print-architecture)" \
 	&& case "$ARCH" in \
 		amd64) ELP_ARCH="x86_64" ;; \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -179,16 +189,10 @@ ENV DOCKER_HOST="unix:///var/run/docker.sock" \
 ENV CC_wasm32_unknown_unknown="clang" \
 	AR_wasm32_unknown_unknown="llvm-ar"

-RUN curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile default --component clippy,rustfmt \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --component clippy,rustfmt \
 	&& rustup target add wasm32-unknown-unknown \
 	&& cargo install cargo-watch --locked \
-	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked
-
-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
-RUN sudo apt-get update \
-	&& sudo apt-get install -y --no-install-recommends python3-venv \
-	&& sudo rm -rf /var/lib/apt/lists/*
+	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
+	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

 WORKDIR /workspaces/fluxer
@@ -5,20 +5,17 @@
 	"workspaceFolder": "/workspaces/fluxer",
 	"shutdownAction": "stopCompose",
 	"remoteUser": "vscode",
+	"hostRequirements": {
+		"cpus": 4,
+		"memory": "8gb",
+		"storage": "32gb"
+	},
 	"remoteEnv": {
 		"DOCKER_HOST": "unix:///var/run/docker.sock"
 	},
 	"runServices": ["workspace", "postgres", "valkey", "nats", "livekit", "meilisearch", "mailpit"],
-	"forwardPorts": [
-		3000, 8088, 8080, 8771, 8082, 3010, 3020, 8100, 8101, 8102, 8103, 8104, 8105, 8106, 8107, 8108, 8109, 8110, 8111,
-		8112, 8113, 8114, 8115, 8116, 8117, 8118, 8119, 8120, 8121, 8122, 8123, 8124, 8125, 3900, 8888, 9333, 9340, 23646,
-		4222, 7700, 7880, 7900, 9200, 8000
-	],
+	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3020, 8333],
 	"portsAttributes": {
-		"8000": {
-			"label": "Zensical docs",
-			"onAutoForward": "openBrowserOnce"
-		},
 		"8088": {
 			"label": "Fluxer dev proxy",
 			"onAutoForward": "notify"
@@ -29,40 +26,23 @@
 		"3020": {
 			"label": "Fluxer admin"
 		},
-		"8100": {
-			"label": "Fluxer Rust service health"
-		},
-		"3900": {
+		"8333": {
 			"label": "SeaweedFS S3"
 		},
-		"8888": {
-			"label": "SeaweedFS filer"
-		},
-		"9333": {
-			"label": "SeaweedFS master"
-		},
-		"9340": {
-			"label": "SeaweedFS volume"
-		},
-		"23646": {
-			"label": "SeaweedFS admin"
-		},
-		"7880": {
-			"label": "LiveKit"
-		},
-		"7700": {
-			"label": "Meilisearch"
-		},
-		"9200": {
-			"label": "Elasticsearch"
+		"8773": {
+			"label": "Fluxer app proxy"
 		}
 	},
-	"postCreateCommand": "sudo chown -R vscode:vscode /workspaces/fluxer/target && find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -exec sudo chown -R vscode:vscode {} + && sudo chown -R vscode:vscode /home/vscode/.local/share/pnpm && cargo run -p fluxer-dev -- bootstrap",
-	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && cargo run -p fluxer-dev -- post-start && bash /workspaces/fluxer/fluxer_docs/serve.sh --daemon",
+	"postCreateCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- bootstrap",
+	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- post-start",
 	"customizations": {
 		"vscode": {
 			"settings": {
-				"editor.defaultFormatter": "biomejs.biome"
+				"editor.defaultFormatter": "biomejs.biome",
+				"erlang.includePaths": ["."],
+				"search.exclude": {
+					"**/_build/default/lib/fluxer_gateway": true
+				}
 			},
 			"extensions": [
 				"biomejs.biome",
@@ -7,15 +7,28 @@ services:
      dockerfile: .devcontainer/Dockerfile
    command: sleep infinity
    init: true
-    env_file:
-      - ../config/env/development.env
    environment:
-      FLUXER_SEARCH_ENGINE: meilisearch
-      FLUXER_SEARCH_URL: http://meilisearch:7700
-      FLUXER_SEARCH_API_KEY: fluxer-dev-meilisearch
-      FLUXER_POSTGRES_HOST: postgres
-      FLUXER_SELF_HOSTED: "true"
      DOCKER_HOST: unix:///var/run/docker.sock
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_API_CLIENT_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_APP_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_GATEWAY_ENDPOINT: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/gateway"
+      FLUXER_MEDIA_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_S3_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_LIVEKIT_URL: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/livekit"
+      FLUXER_LIVEKIT_INTERNAL_URL: "http://livekit:7880"
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin/oauth2_callback"
+      FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: "http://localhost,http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
    volumes:
      - ..:/workspaces/fluxer:cached
      - type: volume
@@ -188,11 +201,6 @@ services:
        target: /workspaces/fluxer/fluxer_api/pkgs/rate_limit/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-api-sms-node-modules
-        target: /workspaces/fluxer/fluxer_api/pkgs/sms/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-api-virus-scan-node-modules
        target: /workspaces/fluxer/fluxer_api/pkgs/virus_scan/node_modules
@@ -236,45 +244,30 @@ services:
        source: ${FLUXER_DOCKER_SOCKET:-/var/run/docker.sock}
        target: /var/run/docker.sock
    ports:
-      - "${FLUXER_DEV_DOCS_PORT:-8000}:8000"
-      - "${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
-      - "${FLUXER_DEV_PROXY_PORT:-8088}:8088"
-      - "${FLUXER_DEV_APP_PROXY_PORT:-8080}:8080"
-      - "${FLUXER_DEV_API_PORT:-8771}:8771"
-      - "${FLUXER_DEV_GATEWAY_PORT:-8082}:8082"
-      - "${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
-      - "${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
-      - "${FLUXER_DEV_RUST_SERVICE_PORTS:-8100-8125}:8100-8125"
-      - "${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
-      - "${FLUXER_DEV_SEAWEEDFS_FILER_PORT:-8888}:8888"
-      - "${FLUXER_DEV_SEAWEEDFS_MASTER_PORT:-9333}:9333"
-      - "${FLUXER_DEV_SEAWEEDFS_VOLUME_PORT:-9340}:9340"
-      - "${FLUXER_DEV_SEAWEEDFS_ADMIN_PORT:-23646}:23646"
+      - "127.0.0.1:${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
+      - "127.0.0.1:${FLUXER_DEV_PROXY_PORT:-8088}:8088"
+      - "127.0.0.1:${FLUXER_DEV_API_PORT:-8080}:8080"
+      - "127.0.0.1:${FLUXER_DEV_GATEWAY_PORT:-8771}:8771"
+      - "127.0.0.1:${FLUXER_DEV_MEDIA_PROXY_PORT:-8082}:8082"
+      - "127.0.0.1:${FLUXER_DEV_APP_PROXY_PORT:-8773}:8773"
+      - "127.0.0.1:${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
+      - "127.0.0.1:${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
    depends_on:
-      - postgres
-      - valkey
-      - nats
-      - livekit
-      - meilisearch
-      - mailpit
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_started
+      nats:
+        condition: service_started
+      livekit:
+        condition: service_started
+      meilisearch:
+        condition: service_healthy
+      mailpit:
+        condition: service_started
    extra_hosts:
      - "host.docker.internal:host-gateway"

-  cassandra:
-    image: cassandra:5.0.8
-    profiles:
-      - full
-    environment:
-      CASSANDRA_CLUSTER_NAME: fluxer-dev
-      CASSANDRA_DC: datacenter1
-      CASSANDRA_ENDPOINT_SNITCH: GossipingPropertyFileSnitch
-      HEAP_NEWSIZE: 128M
-      MAX_HEAP_SIZE: 768M
-    volumes:
-      - cassandra-data:/var/lib/cassandra
-    ports:
-      - "${FLUXER_DEV_CASSANDRA_PORT:-9042}:9042"
-
  postgres:
    image: postgres:16-alpine
    environment:
@@ -284,60 +277,62 @@ services:
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
-      - "${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+      - "127.0.0.1:${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U fluxer -d fluxer"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
-      - "${FLUXER_DEV_VALKEY_PORT:-6379}:6379"
+      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
    ports:
-      - "${FLUXER_DEV_NATS_PORT:-4222}:4222"
-      - "${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_PORT:-4222}:4222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"

  livekit:
    image: livekit/livekit-server:v1.12.0
    command: ["--config", "/etc/livekit.yaml", "--bind", "0.0.0.0"]
+    environment:
+      LIVEKIT_RTC_TCP_PORT: "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      LIVEKIT_RTC_UDP_PORT_START: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
+      LIVEKIT_RTC_UDP_PORT_END: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml:ro
    ports:
-      - "${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
-      - "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:7881"
-      - "${FLUXER_DEV_LIVEKIT_UDP_PORTS:-7882-7892}:7882-7892/udp"
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:9.3.2
-    profiles:
-      - full
-    environment:
-      discovery.type: single-node
-      xpack.security.enabled: "true"
-      xpack.security.http.ssl.enabled: "false"
-      ELASTIC_PASSWORD: fluxer-dev-elasticsearch
-      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
-    volumes:
-      - elasticsearch-data:/usr/share/elasticsearch/data
-    ports:
-      - "${FLUXER_DEV_ELASTICSEARCH_PORT:-9200}:9200"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
    ports:
-      - "${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+      - "127.0.0.1:${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:7700/health"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -383,7 +378,6 @@ volumes:
  fluxer-api-mime-utils-node-modules:
  fluxer-api-nats-node-modules:
  fluxer-api-rate-limit-node-modules:
-  fluxer-api-sms-node-modules:
  fluxer-api-virus-scan-node-modules:
  fluxer-api-worker-node-modules:
  fluxer-app-list-utils-node-modules:
@@ -394,9 +388,7 @@ volumes:
  cargo-registry:
  cargo-git:
  rust-target:
-  cassandra-data:
  nats-data:
-  elasticsearch-data:
  meilisearch-data:
  mailpit-data:
  postgres-data:
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: AGPL-3.0-or-later

-set -uo pipefail
+set -euo pipefail

 SOCKET="${DOCKER_SOCKET:-/var/run/docker.sock}"
-USER_NAME="${USER:-vscode}"
+USER_NAME="$(id -un)"

 if [ ! -S "$SOCKET" ]; then
 	echo "fix-docker-socket: no socket at $SOCKET; skipping (Docker-in-devcontainer will not work)"
@@ -16,31 +16,11 @@ if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
 	exit 0
 fi

-socket_gid="$(stat -c '%g' "$SOCKET" 2>/dev/null || echo "")"
-if [ -z "$socket_gid" ]; then
-	echo "fix-docker-socket: could not stat $SOCKET; skipping" >&2
-	exit 0
-fi
-
-sudo sh -c '
-	set -e
-	gid="$1"
-	user="$2"
-	socket="$3"
-	if ! getent group "$gid" >/dev/null 2>&1; then
-		groupadd --gid "$gid" docker-host
-	fi
-	group_name="$(getent group "$gid" | cut -d: -f1)"
-	usermod --append --groups "$group_name" "$user"
-	chgrp "$gid" "$socket"
-	chmod g+rw "$socket"
-' sh "$socket_gid" "$USER_NAME" "$SOCKET" || {
-	echo "fix-docker-socket: could not adjust $SOCKET; run docker with sudo" >&2
-	exit 0
-}
+sudo setfacl --modify "user:${USER_NAME}:rw" "$SOCKET"

 if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
-	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME (gid $socket_gid)"
+	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME"
 else
-	echo "fix-docker-socket: $SOCKET still unreachable as $USER_NAME; run docker with sudo" >&2
+	echo "fix-docker-socket: $SOCKET is still unreachable as $USER_NAME" >&2
+	exit 1
 fi
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -euo pipefail
+
+owner="$(id -u):$(id -g)"
+
+repair_tree() {
+	local path="$1"
+	local unwritable
+	if [ ! -d "$path" ]; then
+		echo "fix-workspace-permissions: expected mount is missing: $path" >&2
+		exit 1
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		sudo find "$path" -xdev \( -type d -o -type f \) -exec chown "$owner" {} +
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		echo "fix-workspace-permissions: $path is not writable as $(id -un)" >&2
+		exit 1
+	fi
+}
+
+for path in \
+	/workspaces/fluxer/target \
+	/home/vscode/.cargo/registry \
+	/home/vscode/.cargo/git \
+	/home/vscode/.local \
+	/home/vscode/.local/share/pnpm/store; do
+	repair_tree "$path"
+done
+
+while IFS= read -r -d '' path; do
+	if mountpoint -q "$path"; then
+		repair_tree "$path"
+	fi
+done < <(find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -print0)
@@ -1,11 +1,10 @@
 port: 7880

 keys:
-  devkey: secret
+  devkey: fluxer-livekit-development-secret

 rtc:
  tcp_port: 7881
-  udp_port: 7882-7892
  node_ip: 127.0.0.1
  use_mdns: true
  stun_servers:
@@ -7,10 +7,16 @@ QUICK=0
 SKIP_INSTALL=0
 for arg in "$@"; do
 	case "$arg" in
-		--quick) QUICK=1 ;;
-		--skip-install) SKIP_INSTALL=1 ;;
-		-h|--help) sed -n '2,25p' "$0"; exit 0 ;;
-		*) echo "unknown argument: $arg" >&2; exit 2 ;;
+	--quick) QUICK=1 ;;
+	--skip-install) SKIP_INSTALL=1 ;;
+	-h | --help)
+		sed -n '2,25p' "$0"
+		exit 0
+		;;
+	*)
+		echo "unknown argument: $arg" >&2
+		exit 2
+		;;
 	esac
 done

@@ -64,6 +70,7 @@ stage "app: typecheck" pnpm --filter fluxer_app typecheck
 stage "app: unit tests" pnpm --filter fluxer_app exec vitest run

 if [ "$QUICK" -eq 0 ]; then
+	stage "desktop: typecheck" pnpm --filter fluxer_desktop typecheck
 	stage "app: production build" pnpm --filter fluxer_app build
 fi

@@ -9,7 +9,6 @@
 **/.git/**
 /.github/
 /.pnpm-store/
-/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -29,9 +28,11 @@
 **/node_modules/
 **/target/
 **/test-results.json
-/fluxer_docs/site/
+/fluxer_docs/dist/
+/fluxer_docs/.astro/
 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
+/fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
@@ -52,8 +53,6 @@
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 /fluxer_desktop/

@@ -2,3 +2,5 @@
 fluxer_static/** -text -diff
 fluxer_static/**/*.md text diff
 packages/fonts/files/** -text -diff
+fluxer_app/src/features/voice/utils/noise_suppression/deepfilternet3/*.wasm -text -diff
+fluxer_app/src/features/voice/utils/noise_suppression/deepfilternet3/*.tar.gz -text -diff
@@ -1,7 +1,2 @@
 /.github/CODEOWNERS @fluxerapp/developers
 /.github/workflows/ @fluxerapp/developers
-/fluxer_marketing @fluxerapp/developers
-/.gitmodules @fluxerapp/developers
-/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
-/packages/i18n/marketing/ @fluxerapp/developers
-/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -1,24 +1,24 @@
 # Contributing to Fluxer

-This policy applies to all issues, discussions, commits and pull requests.
+This policy applies to all commits and pull requests.

 ## Scope

 To prevent spam, only approved contributors may submit pull requests.

-To request approval, comment on an existing issue and ask to implement it. For work that extends beyond a defect fix, open a [discussion](https://github.com/orgs/fluxerapp/discussions) first.
+To request approval, comment on the [feedback.fluxer.com](https://feedback.fluxer.com) post you want to implement and ask to work on it. For work that extends beyond a defect fix, post a feature request there first.

 Every pull request must:

 - Target the repository's default branch.
- Include a closing reference for each repository issue it resolves.
+- Link each feedback.fluxer.com post it resolves.
 - Receive approval from a maintainer before it is merged.

-Place each closing reference on a separate line:
+Place each link on a separate line:

 ```text
-Closes #123
-Closes #456
+Resolves https://feedback.fluxer.com/p/123
+Resolves https://feedback.fluxer.com/p/456
 ```

 ## Authorship
@@ -78,32 +78,14 @@ Complete every section of the pull request template. Clearly describe:

 ## Reports and other contributions

-Use the [bug report form](https://github.com/fluxerapp/fluxer/issues/new?template=bug-report.yaml) to report reproducible defects.
+Report bugs and request features at [feedback.fluxer.com](https://feedback.fluxer.com).

-Report security vulnerabilities privately through the channels specified in the [security policy](https://github.com/fluxerapp/fluxer/blob/main/.github/SECURITY.md). Do not report vulnerabilities in public issues or discussions.
+Report security vulnerabilities privately through [fluxer.app/security](https://fluxer.app/security). Never post them publicly.

-Use [discussions](https://github.com/orgs/fluxerapp/discussions) for feature proposals and self-hosting questions.
+Read the [operator documentation](https://fluxer.dev) for self-hosting questions.

 Submit translations through [Weblate](https://weblate.fluxer.tools), not through pull requests.

 All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
-
-## Private marketing project
-
-The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
-
-Authorized maintainers can initialize only that submodule and install its independent dependencies:
-
-```sh
-./scripts/setup-private-marketing.sh
-pnpm --dir fluxer_marketing install --frozen-lockfile
-cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
-```
-
-To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
-
-```sh
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
-```
@@ -1,41 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-discussion.json
-
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Search existing discussions before posting a feature proposal.
-
-        Report vulnerabilities through the [private form](https://github.com/fluxerapp/fluxer/security/advisories/new) or <[email protected]>.
-
-  - type: textarea
-    id: problem
-    attributes:
-      label: Current problem
-      description: State what you are trying to do and what prevents it.
-    validations:
-      required: true
-
-  - type: textarea
-    id: proposal
-    attributes:
-      label: Proposed change
-      description: State the expected behaviour.
-    validations:
-      required: true
-
-  - type: textarea
-    id: notes
-    attributes:
-      label: Additional information
-      description: Optional. Include constraints, trade-offs, related discussions, screenshots or mockups.
-    validations:
-      required: false
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Acknowledgements
-      options:
-        - label: I searched existing discussions.
-          required: true
@@ -16,4 +16,10 @@ Every commit made by a contributor must include the [Developer Certificate of Or

 ## Name and marks

-The AGPL does not grant permission to use the Fluxer name, logo or other branding. Forks must use a distinct name and branding unless Fluxer Platform AB grants permission otherwise.
+Fluxer and the Fluxer logo are trademarks of Fluxer Platform AB. Neither the AGPL nor the CC BY-SA 4.0 licence on Fluxer artwork grants trademark rights. Fluxer Platform AB grants everyone the following permissions.
+
+- You may distribute unmodified builds of Fluxer, or builds with light patches, under the Fluxer name and logo. Light patches are changes for packaging, portability, security and bug fixes, configuration defaults and translations. Linux distributions, nixpkgs, Flathub and container images are all covered.
+- A self-hosted instance running such a build may show the Fluxer name and logo under the instance's own name and domain, as long as it does not imply affiliation with or endorsement by Fluxer Platform AB.
+- You may refer to Fluxer by name to describe compatibility, for example "works with Fluxer".
+
+Forks with substantive functional changes must use their own name and logo. Any other use needs permission from Fluxer Platform AB. Contact support@fluxer.com.
@@ -1,84 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-issue-forms.json
-name: Bug report
-description: Report a reproducible defect in Fluxer.
-type: Bug
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Search [open and closed issues](https://github.com/fluxerapp/fluxer/issues?q=is%3Aissue) before filing a report.
-
-        Report vulnerabilities through the [private form](https://github.com/fluxerapp/fluxer/security/advisories/new) or <[email protected]>. Send account and billing requests to <[email protected]>.
-
-  - type: textarea
-    id: summary
-    attributes:
-      label: Observed behaviour
-      description: State what happened and what you expected.
-    validations:
-      required: true
-
-  - type: textarea
-    id: steps
-    attributes:
-      label: Reproduction steps
-      description: Give numbered steps starting from a fresh app or session.
-      placeholder: |
-        1. Go to ...
-        2. Select ...
-        3. Observe ...
-    validations:
-      required: true
-
-  - type: input
-    id: build
-    attributes:
-      label: Build information
-      description: >-
-        Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard. On mobile,
-        select the build information at the bottom of the settings list.
-    validations:
-      required: true
-
-  - type: dropdown
-    id: surface
-    attributes:
-      label: Affected surface
-      multiple: true
-      options:
-        - Desktop app
-        - Web app
-        - Voice, video, or Go Live
-        - Self-hosted instance
-        - HTTP API or Gateway
-        - Documentation site
-    validations:
-      required: true
-
-  - type: input
-    id: instance
-    attributes:
-      label: Instance
-      description: For a self-hosted instance, include the release tag and database backend.
-      placeholder: fluxer.app
-    validations:
-      required: false
-
-  - type: textarea
-    id: evidence
-    attributes:
-      label: Evidence
-      description: Attach relevant logs, screenshots or recordings. Remove tokens, keys, private messages and other personal data. Configuration files may contain secrets.
-    validations:
-      required: false
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Acknowledgements
-      options:
-        - label: I searched open and closed issues.
-          required: true
-        - label: I removed secrets and unrelated personal data from the report.
-          required: true
@@ -1,18 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
-blank_issues_enabled: false
-contact_links:
-  - name: Account and billing support
-    url: https://fluxer.app/help
-    about: Find account help and support contact details.
-  - name: Feature proposals
-    url: https://github.com/orgs/fluxerapp/discussions
-    about: Propose a feature in a discussion.
-  - name: Security vulnerabilities
-    url: https://github.com/fluxerapp/fluxer/security/advisories/new
-    about: Submit a private vulnerability report.
-  - name: Translations
-    url: https://weblate.fluxer.tools
-    about: Improve an existing locale or start a new one.
-  - name: Self-hosting support
-    url: https://fluxer.dev
-    about: Read the operator documentation, then open a discussion if the problem remains.
@@ -1,44 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-issue-forms.json
-name: Documentation
-description: Report incorrect, missing or unclear documentation.
-type: Task
-labels:
-  - docs
-body:
-  - type: markdown
-    attributes:
-      value: |
-        This form covers <https://fluxer.dev> and operator documentation.
-
-  - type: textarea
-    id: issue
-    attributes:
-      label: Documentation defect
-      description: State what the page says and what is correct. For missing content, state what information you needed.
-    validations:
-      required: true
-
-  - type: input
-    id: location
-    attributes:
-      label: Location
-      description: Provide the page URL or file path and heading.
-      placeholder: https://fluxer.dev/gateway/overview/
-    validations:
-      required: false
-
-  - type: textarea
-    id: suggestion
-    attributes:
-      label: Proposed wording
-      description: Optional.
-    validations:
-      required: false
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Acknowledgements
-      options:
-        - label: I searched open and closed issues.
-          required: true
@@ -1,7 +1,7 @@
 # Security policy

-Do not report a vulnerability in an issue, pull request, or discussion.
+Do not report a vulnerability in a pull request, on feedback.fluxer.com, in a Fluxer community, or in a direct message to staff.

-Submit a report through [GitHub private vulnerability reporting](https://github.com/fluxerapp/fluxer/security/advisories/new) or email <security@fluxer.com>. Include the affected component, impact, reproduction steps, and supporting evidence. Remove unrelated personal data and secrets.
+Submit a report through <https://fluxer.app/security> or email <security@fluxer.com>. Include the affected component, impact, reproduction steps, and supporting evidence. Remove unrelated personal data and secrets.

 The programme scope, testing rules, safe harbour, disclosure process, and reward terms are published at <https://fluxer.app/security>. That page is authoritative.
@@ -22,17 +22,15 @@ f:docs:
 f:gateway:
  - changed-files:
    - any-glob-to-any-file: fluxer_gateway/**/*
-f:marketing:
-  - changed-files:
-    - any-glob-to-any-file:
-      - fluxer_marketing
-      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
 f:messages:
  - changed-files:
    - any-glob-to-any-file: fluxer_messages/**/*
+f:push:
+  - changed-files:
+    - any-glob-to-any-file: fluxer_push/**/*
 f:snowflakes:
  - changed-files:
    - any-glob-to-any-file: fluxer_snowflakes/**/*
@@ -1,6 +1,6 @@
-Closes #
+Resolves https://feedback.fluxer.com/p/

-<!-- Repeat this line for each resolved issue, up to 20. Remove the placeholder only if no issue is resolved and the approval gate does not apply. -->
+<!-- Repeat this line for each feedback.fluxer.com post this resolves, up to 20. Remove the placeholder only if no post is resolved and the approval gate does not apply. -->

 ## Summary

@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -101,25 +101,30 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
-          provenance: false
+          provenance: mode=min
          platforms: linux/${{ matrix.platform }}
          tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
            ${{ inputs.extra-build-args }}
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
@@ -136,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -185,17 +190,12 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
          MOVING_TAGS: ${{ inputs.moving-tags }}
-        run: |
-          set -euo pipefail
-          tag_args=()
-          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
-          for raw in "${moving[@]}"; do
-            tag="$(echo "$raw" | xargs)"
-            [ -n "$tag" ] && tag_args+=( "-t" "${IMAGE}:${tag}" )
-          done
-          if (( ${#tag_args[@]} > 0 )); then
-            docker buildx imagetools create "${tag_args[@]}" "${IMAGE}:${VERSION}"
-          fi
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component "${{ inputs.image }}"
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags "${MOVING_TAGS}"
@@ -15,6 +15,13 @@ permissions:
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy-self-hosted
+  cancel-in-progress: false
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
 jobs:
  approve:
    name: approve build release
@@ -26,13 +33,207 @@ jobs:
      - name: approved
        run: echo "Build release approved."

-  build:
+  meta:
+    name: resolve metadata
    needs: approve
-    uses: ./.github/workflows/_build-image.yaml
-    secrets: inherit
-    with:
-      image: fluxer-app-proxy-self-hosted
-      dockerfile: fluxer_app_proxy/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      extra-build-args: |
-        FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      build_version: ${{ steps.vars.outputs.build_version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: set variables
+        id: vars
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step set_metadata
+          --build-version "${{ inputs['build-version'] }}"
+
+  dist:
+    name: build the canonical asset tree
+    needs: meta
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    env:
+      IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/fluxer-app-proxy-self-hosted
+      BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+      PUBLIC_ASSET_BASE_URL: ""
+      BUNDLE_LOCAL_ASSETS: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build the dist once and publish it as the canonical asset image
+        env:
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_dist
+
+      - name: generate asset manifest
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step generate_asset_manifest
+
+      - name: verify every manifest asset ships in the image
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build ${{ matrix.platform }}
+    needs: [meta, dist]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: amd64
+            runner: ubuntu-24.04
+          - platform: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
+        with:
+          context: .
+          file: fluxer_app_proxy/Dockerfile
+          push: true
+          provenance: false
+          platforms: linux/${{ matrix.platform }}
+          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
+          build-args: |
+            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+
+  merge:
+    name: merge multi-arch manifest
+    needs: [meta, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-amd64
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
+      - name: create and push multi-arch manifest
+        env:
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"
+
+      - name: Advance moving image tags
+        env:
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -57,28 +57,28 @@ jobs:
          --step set_metadata
          --build-version "${{ inputs['build-version'] }}"

-  build:
-    name: build app-proxy (amd64)
+  dist:
+    name: build and publish the canonical asset tree
    needs: meta
    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -87,17 +87,17 @@ jobs:
          tools/ci/run.sh build-app-proxy
          --step configure_ghcr_auth

-      - name: build and push image + extract assets
+      - name: build the dist once and publish it as the canonical asset image
        env:
          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
-          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
-          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
        run: >-
          tools/ci/run.sh build-app-proxy
-          --step build_and_extract
+          --step build_dist

      - name: generate asset manifest
        run: >-
@@ -114,9 +114,63 @@ jobs:
          tools/ci/run.sh build-app-proxy
          --step upload_assets

+      - name: verify every uploaded asset is readable
+        env:
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build app-proxy (amd64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build and push image
+        env:
+          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+          SOURCE_SHA: ${{ github.sha }}
+          SOURCE_DATE: ${{ steps.source.outputs.date }}
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_image
+
  build-arm64:
    name: build app-proxy (arm64)
-    needs: meta
+    needs: [meta, dist]
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    permissions:
@@ -124,16 +178,19 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -143,8 +200,10 @@ jobs:
          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
-            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
-            BUNDLE_LOCAL_ASSETS=false
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
@@ -155,24 +214,33 @@ jobs:
    name: merge multi-arch manifest
    needs: [meta, build, build-arm64]
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 20
    permissions:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
      - name: fuse amd64 + arm64 into a multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
@@ -212,10 +280,11 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          docker buildx imagetools create
-          -t "${IMAGE}:v1"
-          -t "${IMAGE}:latest"
-          "${IMAGE}:${VERSION}"
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -11,11 +11,6 @@ on:
          - stable
          - canary
        default: stable
-      test_build:
-        description: Stash artifacts under desktop-test/ instead of desktop/ (API will not pick these up as a release).
-        required: false
-        default: false
-        type: boolean
      build_version:
        description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
        required: false
@@ -32,13 +27,12 @@ permissions:
  actions: read

 concurrency:
-  group: desktop-${{ inputs.channel }}-${{ inputs.test_build && 'test' || 'release' }}
+  group: desktop-${{ inputs.channel }}
  cancel-in-progress: true

 env:
  CHANNEL: ${{ inputs.channel }}
  BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
-  TEST_BUILD: ${{ inputs.test_build && 'true' || 'false' }}

 jobs:
  meta:
@@ -53,19 +47,17 @@ jobs:
      pub_date: ${{ steps.meta.outputs.pub_date }}
      channel: ${{ steps.meta.outputs.channel }}
      build_channel: ${{ steps.meta.outputs.build_channel }}
-      test_build: ${{ steps.meta.outputs.test_build }}
-      s3_prefix: ${{ steps.meta.outputs.s3_prefix }}
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -85,7 +77,6 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step set_metadata
          --channel "${{ inputs.channel }}"
-          --test-build "${{ inputs.test_build }}"

  matrix:
    name: Resolve build matrix
@@ -98,12 +89,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -113,7 +104,7 @@ jobs:
          --skip-targets "${{ inputs.skip_targets }}"

  build:
-    name: Build ${{ matrix.platform }} (${{ matrix.arch }}, ${{ matrix.desktop_variant }})
+    name: Build ${{ matrix.platform }} (${{ matrix.arch }})
    needs:
      - meta
      - matrix
@@ -137,41 +128,34 @@ jobs:
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
-      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
      PLATFORM: ${{ matrix.platform }}
      ARCH: ${{ matrix.arch }}
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +180,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +231,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +244,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +286,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +347,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -477,6 +461,12 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

+      - name: Build AppImage update feed (Linux)
+        if: matrix.platform == 'linux'
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_appimage_update_feed
+
      - name: Normalize updater YAML (macOS)
        if: matrix.platform == 'macos'
        run: >-
@@ -495,13 +485,23 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step generate_checksums_windows

-      - name: Upload artifacts to S3 handoff
+      - name: Stage build artifacts
+        id: handoff
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step upload_handoff
+          --step stage_handoff
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: ${{ steps.handoff.outputs.artifact_name }}
+          path: upload_staging
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

  upload:
-    name: Upload to S3
+    name: Assemble desktop release assets
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    needs:
      - meta
@@ -520,32 +520,26 @@ jobs:
      BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
-      TEST_BUILD: ${{ needs.meta.outputs.test_build }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

-      - name: Download S3 handoff artifacts
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_handoff
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: artifacts
+          pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-*

-      - name: Build S3 payload layout (+ manifest.json)
+      - name: Build payload layout (+ manifest.json)
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          PUB_DATE: ${{ needs.meta.outputs.pub_date }}
@@ -553,43 +547,56 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_payload

-      - name: Upload payload to S3
+      - name: Prepare GitHub release assets
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_payload
+          --step prepare_release_assets
+
+      - name: Upload GitHub release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

      - name: Build summary
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Cleanup S3 handoff
-        if: ${{ success() }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step cleanup_handoff
-
  publish_release:
    name: Publish GitHub desktop release
-    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
+    if: ${{ !cancelled() && needs.upload.result == 'success' }}
    needs:
      - meta
      - upload
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 10
+    timeout-minutes: 60
    permissions:
      contents: write
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
+
+      - name: Download GitHub release assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -614,6 +621,7 @@ jobs:
            --build-version "${VERSION}"
            --source-sha "${SOURCE_SHA}"
            --previous-sha "${RELEASE_BASELINE_SHA}"
+            --asset-dir release_assets
          )
          if [[ "${CHANNEL}" == "canary" ]]; then
            release_args+=(--prerelease)
@@ -33,5 +33,4 @@ jobs:
    with:
      image: fluxer-docs
      dockerfile: fluxer_docs/Dockerfile
-      context: fluxer_docs
      build-version: ${{ inputs['build-version'] }}
@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: build push
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: write
+
+jobs:
+  approve:
+    name: approve build release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
+  image:
+    needs: approve
+    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
+    with:
+      image: fluxer-push
+      dockerfile: fluxer_push/Dockerfile
+      build-version: ${{ inputs['build-version'] }}
@@ -19,22 +19,22 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -1,230 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: Dispatch private marketing build
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - fluxer_marketing
-      - Cargo.toml
-      - fluxer_common/**
-      - packages/fonts/manifest.json
-      - packages/fonts/NOTICE.md
-      - packages/fonts/LICENSE-IBM-PLEX.txt
-      - packages/fonts/css/locale-fallbacks.css
-      - packages/fonts/files/FluxerSans/**
-      - packages/fonts/files/FluxerMono/**
-      - packages/fonts/marketing/**
-      - packages/i18n/marketing/**
-      - fluxer_static/marketing/branding/**
-      - .github/workflows/dispatch-private-marketing-build.yaml
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: private-marketing-dispatch
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    name: resolve exact private build metadata
-    if: github.repository == 'fluxerapp/fluxer'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
-      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
-      build_version: ${{ steps.inputs.outputs.build_version }}
-      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
-    steps:
-      - name: Create token
-        id: create-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: fluxer
-          permission-contents: read
-      - name: Resolve trusted build inputs
-        id: inputs
-        env:
-          EVENT_AFTER: ${{ github.event.after }}
-          GH_TOKEN: ${{ steps.create-token.outputs.token }}
-          PARENT_SHA: ${{ github.sha }}
-          PUBLIC_REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
-          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
-          (( 10#$RUN_ATTEMPT <= 10 ))
-
-          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
-          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
-          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
-          main_status="$(jq -r .status <<<"$main_comparison")"
-          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
-          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
-
-          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
-          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
-          tree_sha="$(jq -r .tree.sha <<<"$commit")"
-          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
-          entry="$(
-            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
-              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
-          )"
-          mode="$(jq -r .mode <<<"$entry")"
-          type="$(jq -r .type <<<"$entry")"
-          gitlink_sha="$(jq -r .sha <<<"$entry")"
-          path="$(jq -r .path <<<"$entry")"
-          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
-            exit 1
-          fi
-
-          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
-          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
-          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
-          [[ "$(jq -r .event <<<"$run")" == "push" ]]
-          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
-          run_created_at="$(jq -r .created_at <<<"$run")"
-          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
-          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
-          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
-          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
-          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
-          month="$((10#$month))"
-          micro="$((10#$time_segment))"
-          build_version="$year.$month$day.$micro"
-          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
-          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          {
-            echo "parent_sha=$PARENT_SHA"
-            echo "gitlink_sha=$gitlink_sha"
-            echo "build_version=$build_version"
-            echo "correlation_id=$correlation_id"
-          } >>"$GITHUB_OUTPUT"
-
-  dispatch:
-    name: dispatch exact private build
-    needs: metadata
-    runs-on: ubuntu-24.04
-    timeout-minutes: 65
-    environment: private-marketing-dispatch
-    permissions: {}
-    steps:
-      - name: Validate trusted build inputs
-        env:
-          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
-          EXPECTED_PARENT_SHA: ${{ github.sha }}
-          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
-          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
-            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
-            exit 1
-          fi
-
-      - name: Create private dispatch token
-        id: private-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: marketing
-          permission-actions: write
-
-      - name: Dispatch exact private build
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
-            --field ref=main \
-            --field "inputs[parent_sha]=$PARENT_SHA" \
-            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
-            --field "inputs[build_version]=$BUILD_VERSION" \
-            --field "inputs[correlation_id]=$CORRELATION_ID"
-
-      - name: Wait for private build conclusion
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
-          deadline=$((SECONDS + 3600))
-          run_id=""
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            count="$(jq 'length' <<<"$matches")"
-            if [[ "$count" == "1" ]]; then
-              run_id="$(jq -r '.[0].id' <<<"$matches")"
-              break
-            fi
-            if [[ "$count" != "0" ]]; then
-              echo "::error::Private build correlation matched multiple workflow runs."
-              exit 1
-            fi
-            sleep 10
-          done
-          if [[ -z "$run_id" ]]; then
-            echo "::error::Timed out waiting for the private build dispatch to appear."
-            exit 1
-          fi
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
-              echo "::error::Private build correlation is missing or ambiguous."
-              exit 1
-            fi
-            run="$(jq '.[0]' <<<"$matches")"
-            status="$(jq -r '.status' <<<"$run")"
-            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
-            if [[ "$status" == "completed" ]]; then
-              if [[ "$conclusion" != "success" ]]; then
-                echo "::error::Private marketing build concluded with $conclusion."
-                exit 1
-              fi
-              echo "Private marketing build completed successfully."
-              exit 0
-            fi
-            sleep 15
-          done
-          echo "::error::Timed out waiting for the private marketing build."
-          exit 1
@@ -35,24 +35,24 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,17 +48,17 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: release image set
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+      from-tag:
+        description: "Image tag every component is read from (v1 snapshots today's moving tags, a CalVer pins a coordinated build)"
+        type: string
+        required: false
+        default: "v1"
+      component-versions:
+        description: "Per-component overrides, one <image>=<version> entry per line (for example fluxer-api=2026.830.191141)"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: read
+
+concurrency:
+  group: release-image-set
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
+jobs:
+  approve:
+    name: approve image set release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Image set release approved."
+
+  manifest:
+    name: resolve and publish the image set
+    needs: approve
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+          permission-packages: read
+
+      - name: set variables
+        id: vars
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
+        run: >-
+          tools/ci/run.sh resolve-calver
+          --github-output
+
+      - name: resolve release image set
+        id: resolve
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          FROM_TAG: ${{ inputs['from-tag'] }}
+          COMPONENT_VERSIONS: ${{ inputs['component-versions'] }}
+        run: |
+          set -euo pipefail
+          args=(
+            image-set resolve
+            --version "${VERSION}"
+            --registry "ghcr.io/${GHCR_OWNER}"
+            --from-tag "${FROM_TAG}"
+            --out-dir release-out
+            --github-output
+          )
+          while IFS= read -r entry; do
+            entry="$(echo "$entry" | xargs)"
+            if [ -n "$entry" ]; then
+              args+=( --component-version "$entry" )
+            fi
+          done <<< "${COMPONENT_VERSIONS}"
+          tools/ci/run.sh "${args[@]}"
+
+      - name: verify release image set
+        env:
+          VERSION: ${{ steps.vars.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set verify
+          --manifest "release-out/fluxer-release-${VERSION}.json"
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          BUNDLE_COMMIT: ${{ steps.resolve.outputs.bundle_commit }}
+        run: |
+          set -euo pipefail
+          if [ -z "${BUNDLE_COMMIT}" ]; then
+            echo "image-set resolve reported no bundle commit" >&2
+            exit 1
+          fi
+          gh release create "fluxer-release@${VERSION}" \
+            --repo fluxerapp/fluxer \
+            --target "${BUNDLE_COMMIT}" \
+            --title "fluxer-release ${VERSION}" \
+            --latest=true \
+            --notes "Immutable image set for ${VERSION}. Every image in the set contains ${BUNDLE_COMMIT}, the commit this tag points at, so the bundle here is never newer than the images. Pin with: docker compose -f docker-compose.yml -f fluxer-release-${VERSION}.yml up -d" \
+            "release-out/fluxer-release-${VERSION}.json" \
+            "release-out/fluxer-release-${VERSION}.yml"
@@ -28,12 +28,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -42,7 +42,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -55,16 +55,16 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -97,7 +97,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -105,12 +105,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -123,12 +123,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -142,56 +146,106 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

  rust:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
-          workspaces: |
-            . -> target
-            fluxer_desktop/native/rust -> target
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version 0.20.2 --locked
+
+      - name: Check Rust dependencies
+        run: cargo deny --locked check -D warnings
+
+      - name: Check libfluxwebp dependencies
+        run: cargo deny --manifest-path fluxer_app/rust/libfluxwebp/Cargo.toml --config deny.toml --locked check licenses bans sources
+
+      - name: Check desktop native dependencies
+        run: tools/ci/check-desktop-native-workspaces.sh dependencies
+
+      - name: Cache native media dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: /opt/fluxer-native
+          key: media-native-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
-            pkg-config \
            build-essential \
-            libcurl4-openssl-dev \
-            libvips-dev \
+            binutils \
+            clang \
+            cmake \
+            curl \
+            libaom-dev \
            libavfilter-dev \
+            libclang-dev \
+            libcurl4-openssl-dev \
+            libdav1d-dev \
+            libde265-dev \
+            libfido2-dev \
            libheif-dev \
-            libwebp-dev
+            liblcms2-dev \
+            libpipewire-0.3-dev \
+            libspa-0.2-dev \
+            libssl-dev \
+            libudev-dev \
+            libvips-dev \
+            libwebp-dev \
+            libyuv-dev \
+            meson \
+            nasm \
+            ninja-build \
+            pkg-config \
+            xz-utils \
+            yasm \
+            zlib1g-dev
+          sudo fluxer_media_proxy/tools/install-native-deps.sh /opt/fluxer-native
+          echo "PKG_CONFIG_PATH=/opt/fluxer-native/lib/pkgconfig:/opt/fluxer-native/lib64/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=/opt/fluxer-native/lib:/opt/fluxer-native/lib64" >> "$GITHUB_ENV"
+          echo "/opt/fluxer-native/bin" >> "$GITHUB_PATH"

      - name: Install Node.js dependencies
        run: pnpm --filter fluxer_admin install
@@ -199,17 +253,32 @@ jobs:
      - name: Check formatting
        run: cargo fmt --all -- --check

-      - name: Check formatting (desktop native)
-        run: cargo fmt --manifest-path fluxer_desktop/native/rust/Cargo.toml --all -- --check
+      - name: Check formatting (libfluxwebp)
+        run: cargo fmt --manifest-path fluxer_app/rust/libfluxwebp/Cargo.toml -- --check
+
+      - name: Check formatting (desktop native workspaces)
+        run: tools/ci/check-desktop-native-workspaces.sh fmt

      - name: Clippy (warnings as errors)
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: Clippy (desktop native workspaces on Linux, warnings as errors)
+        run: tools/ci/check-desktop-native-workspaces.sh clippy
+
+      - name: Verify the source-built ffmpeg CLI is on PATH
+        run: |
+          set -euo pipefail
+          command -v ffmpeg
+          test "$(command -v ffmpeg)" = /opt/fluxer-native/bin/ffmpeg
+          ffmpeg -hide_banner -version

      - name: Run tests
-        run: cargo test --workspace
+        env:
+          FLUXER_REQUIRE_MEDIA_FIXTURES: "1"
+        run: cargo test --workspace --all-features --locked

-      - name: Run desktop native tests
-        run: cargo test --manifest-path fluxer_desktop/native/rust/Cargo.toml
+      - name: Run desktop native workspace tests on Linux
+        run: tools/ci/check-desktop-native-workspaces.sh test

  gateway:
    runs-on: ubuntu-24.04
@@ -218,12 +287,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Cache cargo (gateway NIFs)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
@@ -239,7 +308,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -250,7 +319,7 @@ jobs:
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

      - name: Restore rebar3 dependencies
        id: rebar3-cache
@@ -259,13 +328,16 @@ jobs:
          path: |
            ~/.cache/rebar3
            fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-
+
+      - name: Drop restored gateway build output
+        run: rm -rf fluxer_gateway/_build/default/lib/fluxer_gateway fluxer_gateway/_build/test/lib/fluxer_gateway

      - name: Check formatting
        run: |
@@ -290,10 +362,10 @@ jobs:
          path: |
            ~/.cache/rebar3
            fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}

  knip:
@@ -303,12 +375,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -317,7 +389,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -325,12 +397,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -343,12 +415,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -362,29 +438,58 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting and lint
+        run: pnpm exec biome ci .
+
+      - name: Lint JSX for browser-translation safety
+        run: pnpm exec eslint . --max-warnings 0
+
  i18n:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -405,122 +510,45 @@ jobs:
            exit 1
          fi

+  docs:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --filter fluxer_docs...
+
+      - name: Verify documentation matches the live API
+        run: pnpm --filter fluxer_docs verify
+
+      - name: Build documentation
+        run: pnpm --filter fluxer_docs build
+
  fonts:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt

      - name: Verify shipped fonts match the lockfile
        run: python3 tools/fonts/build_fonts.py --verify
-
-  helm-and-scripts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Install helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
-
-      - name: Resolve Helm test build version
-        run: |
-          set -euo pipefail
-          read -r YEAR MONTH DAY TIME <<<"$(date -u '+%Y %m %d %H%M%S')"
-          echo "HELM_TEST_BUILD_VERSION=${YEAR}.$((10#$MONTH))${DAY}.$((10#$TIME))" >> "$GITHUB_ENV"
-
-      - name: Helm dependency update (all charts)
-        run: |
-          set -euo pipefail
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              helm dependency update "$chart_dir"
-            fi
-          done
-
-      - name: Helm lint (all charts)
-        run: |
-          set -euo pipefail
-          FAILED=0
-          for chart_dir in deploy/helm/*/; do
-            if [[ -f "${chart_dir}Chart.yaml" ]]; then
-              echo "--- Linting ${chart_dir} ---"
-              VALUES_ARGS=()
-              if [[ -f "${chart_dir}values.yaml" ]]; then
-                VALUES_ARGS=(-f "${chart_dir}values.yaml")
-              fi
-              EXTRA_SETS=(--set-string "global.registry=${GHCR_REGISTRY}")
-              case "${chart_dir}" in
-                *gateway*)
-                  EXTRA_SETS+=(--set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *api*)
-                  EXTRA_SETS+=(--set-string app.name=api --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *app-proxy*)
-                  EXTRA_SETS+=(--set-string app.name=app-proxy --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *admin*)
-                  EXTRA_SETS+=(--set-string app.name=admin --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *marketing*)
-                  EXTRA_SETS+=(--set-string app.name=marketing --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *docs*)
-                  EXTRA_SETS+=(--set-string app.name=docs --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *media-proxy*)
-                  EXTRA_SETS+=(--set-string "mediaProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "mediaProxy.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *uploads*)
-                  EXTRA_SETS+=(--set-string app.name=uploads --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *worker*)
-                  EXTRA_SETS+=(--set-string "workerRealtime.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerRealtime.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.build.version=${HELM_TEST_BUILD_VERSION}")
-                  ;;
-                *gifs*|*messages*|*snowflakes*|*unfurl*|*users*)
-                  EXTRA_SETS+=(--set-string "svc.tag=${HELM_TEST_BUILD_VERSION}" --set-string "svc.build.version=${HELM_TEST_BUILD_VERSION}" --set-string svc.build.channel=stable)
-                  ;;
-              esac
-              if ! helm lint "$chart_dir" "${VALUES_ARGS[@]}" "${EXTRA_SETS[@]}" --strict; then
-                FAILED=1
-              fi
-            fi
-          done
-          if [[ "$FAILED" -ne 0 ]]; then
-            echo "::error::One or more Helm charts failed linting"
-            exit 1
-          fi
-
-      - name: Helm template (gateway)
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer > /dev/null
-          echo "Gateway chart templates render successfully."
-
-      - name: Validate gateway manifests with kubeconform
-        run: |
-          set -euo pipefail
-          helm template fluxer-gateway deploy/helm/gateway \
-            -f deploy/helm/gateway/values.yaml \
-            --set-string "global.registry=${GHCR_REGISTRY}" \
-            --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \
-            --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \
-            -n fluxer \
-            | docker run -i --rm ghcr.io/yannh/kubeconform:v0.6.7 \
-                -strict -summary -kubernetes-version 1.31.0
@@ -10,6 +10,7 @@
 /.direnv/
 /.fluxer/
 /.pnpm-store/
+/.vscode/

 **/*.css.d.ts
 **/*.tsbuildinfo
@@ -25,6 +26,7 @@

 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
+/fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
@@ -45,8 +47,6 @@
 /s3_payload/
 /upload_staging/

-/deploy/helm/**/Chart.lock
-/deploy/helm/**/charts/

 **/.idea/
 **/*.iml
@@ -1,4 +0,0 @@
-[submodule "fluxer_marketing"]
-	path = fluxer_marketing
-	url = https://github.com/fluxerapp/marketing.git
-	update = none
@@ -7,9 +7,9 @@ members = [
 	"fluxer_gifs",
 	"fluxer_svc",
 	"fluxer_messages",
+	"fluxer_push",
 	"fluxer_snowflakes",
 	"tools/ci",
-	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
 	"fluxer_users",
@@ -17,7 +17,6 @@ members = [
 	"packages/markdown_parser/rust",
 ]
 exclude = [
-	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
 ]
 resolver = "2"
@@ -25,3 +24,8 @@ resolver = "2"
 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
@@ -1,15 +1,3 @@
-> [!CAUTION]
-> As of this writing (15 June 2026), we are working to finalise the API and self-hosting documentation over the next few days.
->
-> We apologise for the brief delay in open-source releases. We paused after spam waves created safety concerns while we built out Fluxer's trust and safety infrastructure. During that same stretch, we have been fixing hundreds of bugs, adding new features, and preparing a much improved audio and video system.
->
-> You can already try that work in the Fluxer Canary client: [download Canary](https://canary.fluxer.app/download) or [open Canary on the web](https://web.canary.fluxer.app). The latest stable client remains out of date for now, but over the coming weeks we are finalising the remaining work needed to stabilise the current latest code out in the open.
-
-> [!NOTE]
-> Learn about the developer behind Fluxer, the goals of the project, the tech stack, and what's coming next.
->
-> [Read the launch blog post](https://blog.fluxer.app/how-i-built-fluxer-a-discord-like-chat-app/) | [View full roadmap](https://blog.fluxer.app/roadmap-2026/)
-
 <p align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./fluxer_static/marketing/branding/logo-white.svg">
@@ -18,18 +6,175 @@
 </p>

 <p align="center">
-  <a href="https://fluxer.app/donate">
-    <img src="https://img.shields.io/badge/Donate-fluxer.app%2Fdonate-brightgreen" alt="Donate" /></a>
+  <a href="https://fluxer.app/download">
+    <img src="https://img.shields.io/badge/Download-fluxer.app-4641D9" alt="Download" /></a>
  <a href="https://docs.fluxer.app">
    <img src="https://img.shields.io/badge/Docs-docs.fluxer.app-blue" alt="Documentation" /></a>
+  <a href="https://fluxer.app/donate">
+    <img src="https://img.shields.io/badge/Donate-fluxer.app%2Fdonate-brightgreen" alt="Donate" /></a>
  <a href="./LICENSE">
    <img src="https://img.shields.io/badge/License-AGPLv3-purple" alt="AGPLv3 License" /></a>
 </p>

+<p align="center">
+  <a href="https://flathub.org/apps/app.fluxer.Fluxer">
+    <img src="https://dl.flathub.org/assets/badges/flathub-badge-en.svg" alt="Get it on Flathub" height="60" /></a>
+</p>
+
 # Fluxer

+> [!IMPORTANT]
+> Bug reports and feature requests have moved to [feedback.fluxer.com](https://feedback.fluxer.com). Sign in with your Fluxer account to post, vote and follow updates. GitHub Issues and Discussions are closed. Report security vulnerabilities privately through [fluxer.app/security](https://fluxer.app/security).
+
 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer app showcase" width="900">
+  <img src="https://fluxer.app/static/img/screenshots-desktop-readme-1920w.70cb6ce340007e0a.png" alt="Fluxer running side by side on a desktop monitor and a phone" width="640">
 </p>
+
+## Download
+
+| Windows | macOS | Linux | Android | iOS |
+| --- | --- | --- | --- | --- |
+| [Installer (x64)][win-setup-x64] | [Disk image][mac-dmg] | [Flathub][flathub] | [Google Play (beta)][android-play] | [TestFlight][ios-testflight] |
+| [Installer (ARM64)][win-setup-arm64] | | [deb (x64)][linux-deb-x64] | [APK (beta)][android-apk] | |
+| [Portable (x64)][win-portable-x64] | | [deb (ARM64)][linux-deb-arm64] | [Obtainium (beta)][obtainium] | |
+| [Portable (ARM64)][win-portable-arm64] | | [rpm (x64)][linux-rpm-x64] | | |
+| | | [rpm (ARM64)][linux-rpm-arm64] | | |
+| | | [AppImage (x64)][linux-appimage-x64] | | |
+| | | [AppImage (ARM64)][linux-appimage-arm64] | | |
+| | | [tar.gz (x64)][linux-targz-x64] | | |
+| | | [tar.gz (ARM64)][linux-targz-arm64] | | |
+
+The macOS disk image runs on both Apple silicon and Intel. Windows and Linux need the build matching your processor.
+
+On Linux, prefer a repository over a single file so Fluxer updates with the rest of your system.
+
+## Linux package repositories
+
+The package is `fluxer` for stable and `fluxer-canary` for canary. apt and dnf subscribe to one channel per entry file. pacman and Flatpak serve both from one repository.
+
+### Flatpak
+
+Stable is on [Flathub][flathub], the easiest route on most desktops:
+
+```sh
+flatpak install flathub app.fluxer.Fluxer
+```
+
+Flathub has stable only. To use Fluxer's own repository, open [the stable][flatpak-ref] or [the canary][flatpak-canary-ref] reference file and your software manager takes over. Some desktops also accept `flatpak+https://pkgs.fluxer.com/flatpak/fluxer.flatpakref` in the address bar.
+
+From a terminal:
+
+```sh
+flatpak install https://pkgs.fluxer.com/flatpak/fluxer.flatpakref
+```
+
+### Debian and Ubuntu
+
+```sh
+sudo install -d -m 0755 /etc/apt/keyrings
+sudo curl -fsSL -o /etc/apt/keyrings/fluxer-archive-keyring.gpg https://pkgs.fluxer.com/keys/fluxer-archive-keyring.gpg
+sudo curl -fsSL -o /etc/apt/sources.list.d/fluxer.sources https://pkgs.fluxer.com/deb/fluxer.sources
+sudo apt update && sudo apt install fluxer
+```
+
+For canary, use the canary entry file and package.
+
+```sh
+sudo curl -fsSL -o /etc/apt/sources.list.d/fluxer-canary.sources https://pkgs.fluxer.com/deb/fluxer-canary.sources
+sudo apt update && sudo apt install fluxer-canary
+```
+
+A `.deb` installed from a download only updates once its channel's entry is added.
+
+### Fedora and RHEL
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/fluxer.repo https://pkgs.fluxer.com/rpm/fluxer.repo
+sudo dnf install fluxer
+```
+
+For canary, use the canary entry file and package.
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/fluxer-canary.repo https://pkgs.fluxer.com/rpm/fluxer-canary.repo
+sudo dnf install fluxer-canary
+```
+
+RHEL, Rocky, Alma and CentOS Stream need `sudo dnf install epel-release` first, because their base repositories lack `libXScrnSaver`. Fedora does not.
+
+### Arch Linux
+
+The repository is signed, so pacman needs the key once:
+
+```sh
+sudo pacman-key --init
+curl -fsSL -o /tmp/fluxer-archive-keyring.asc https://pkgs.fluxer.com/keys/fluxer-archive-keyring.asc
+sudo pacman-key --add /tmp/fluxer-archive-keyring.asc
+sudo pacman-key --lsign-key 09D01339EE128925F75E675C855C5BDE34D205D2
+```
+
+`--lsign-key` is what makes pacman trust it. Then add the repository:
+
+```sh
+sudo tee -a /etc/pacman.conf >/dev/null <<'REPO'
+
+[fluxer]
+SigLevel = Required TrustedOnly
+Server = https://pkgs.fluxer.com/arch/$repo/os/$arch
+REPO
+sudo pacman -Syu fluxer
+```
+
+Write `$repo` and `$arch` literally. Both are pacman variables, not shell ones, hence the quoted heredoc.
+
+Full setup notes, including canary, are in the [Linux repositories documentation][docs-linux].
+
+## Other ways to run it
+
+- [Open Fluxer in a browser](https://web.fluxer.app), no install needed.
+- [Host your own instance][docs-selfhost] from this repository.
+
+## Documentation
+
+- [Documentation home][docs]
+- [Downloads][docs-downloads]
+- [Self-hosting][docs-selfhost]
+
+## License
+
+The source is licensed under the [AGPL-3.0-or-later](./LICENSE) license.
+
+Fluxer artwork, such as the logo, icons, badges and default avatars, is
+licensed under [CC BY-SA 4.0](./fluxer_static/LICENSE). Third-party material
+keeps its own terms, listed in
+[fluxer_static/THIRD_PARTY_LICENSES.md](./fluxer_static/THIRD_PARTY_LICENSES.md).
+
+Use of the Fluxer name and logo is covered by the
+[name and marks policy](./.github/GOVERNANCE.md#name-and-marks).
+
+[win-setup-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/setup
+[win-setup-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/setup
+[win-portable-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/portable
+[win-portable-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/portable
+[mac-dmg]: https://pkgs.fluxer.com/desktop/stable/darwin/arm64/latest/dmg
+[linux-deb-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/deb
+[linux-deb-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/deb
+[linux-rpm-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/rpm
+[linux-rpm-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/rpm
+[linux-appimage-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/appimage
+[linux-appimage-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/appimage
+[linux-targz-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/tar_gz
+[linux-targz-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/tar_gz
+[flatpak-ref]: https://pkgs.fluxer.com/flatpak/fluxer.flatpakref
+[flatpak-canary-ref]: https://pkgs.fluxer.com/flatpak/fluxer-canary.flatpakref
+[flathub]: https://flathub.org/apps/app.fluxer.Fluxer
+[android-play]: https://play.google.com/store/apps/details?id=com.fluxer
+[android-apk]: https://github.com/fluxerapp/flutter_client/releases
+[obtainium]: https://obtainium.imranr.dev/
+[ios-testflight]: https://testflight.apple.com/join/PKZR6pK9
+[docs]: https://docs.fluxer.app
+[docs-downloads]: https://docs.fluxer.app/downloads/overview/
+[docs-linux]: https://docs.fluxer.app/downloads/linux-repositories/
+[docs-selfhost]: https://docs.fluxer.app/operator/get-started/
@@ -20,7 +20,7 @@
 			"bracketSpacing": false,
 			"bracketSameLine": false
 		},
-		"globals": ["React"]
+		"globals": ["React", "__webpack_base_uri__"]
 	},
 	"json": {
 		"formatter": {
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,11 +83,23 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noRestrictedImports": {
+					"level": "error",
+					"options": {
+						"paths": {
+							"@lingui/react": {
+								"importNames": ["I18nProvider"],
+								"message": "Use AppI18nProvider from @app/features/i18n/components/AppI18nProvider so <Trans> output stays safe under page translation."
+							}
+						}
+					}
+				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -115,6 +127,32 @@
 		}
 	},
 	"assist": {"actions": {"source": {"organizeImports": "on"}}},
+	"overrides": [
+		{
+			"includes": ["fluxer_app/src/**/*.tsx"],
+			"plugins": ["./tools/lint/no-adjacent-jsx-text.grit"]
+		},
+		{
+			"includes": ["fluxer_docs/scripts/VerifyDocsCoverage.ts"],
+			"linter": {"rules": {"suspicious": {"noTemplateCurlyInString": "off"}}}
+		},
+		{
+			"includes": [
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.tsx",
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.test.tsx"
+			],
+			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
+		},
+		{
+			"includes": ["fluxer_app/src/**/*.worklet.js"],
+			"javascript": {"globals": ["AudioWorkletProcessor", "registerProcessor", "sampleRate", "currentTime"]}
+		},
+		{
+			"includes": ["**/*.astro"],
+			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},
+			"assist": {"actions": {"source": {"organizeImports": "off"}}}
+		}
+	],
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
@@ -30,17 +30,10 @@ FLUXER_POSTGRES_PASSWORD=fluxer
 FLUXER_POSTGRES_SSL=false
 FLUXER_POSTGRES_MAX_CONNECTIONS=20
 FLUXER_POSTGRES_KV_TABLE=fluxer_kv
-FLUXER_CASSANDRA_HOSTS=cassandra
-FLUXER_CASSANDRA_PORT=9042
-FLUXER_CASSANDRA_KEYSPACE=fluxer
-FLUXER_CASSANDRA_LOCAL_DC=datacenter1
-FLUXER_CASSANDRA_USERNAME=fluxer
-FLUXER_CASSANDRA_PASSWORD=fluxer
 FLUXER_KV_URL=redis://valkey:6379/0
 FLUXER_NATS_URL=nats://nats:4222
 FLUXER_NATS_JETSTREAM_URL=nats://nats:4222
 FLUXER_INTERNAL_API_ENDPOINT=http://127.0.0.1:8080
-FLUXER_INTERNAL_GATEWAY_ENDPOINT=http://127.0.0.1:8771
 FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT=http://127.0.0.1:8082
 FLUXER_MEDIA_PROXY_ENDPOINT=http://127.0.0.1:8082
 FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=http://localhost:8088/media
@@ -48,8 +41,6 @@ FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=http://localhost:8088/media
 FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
-FLUXER_SVC_CACHE_HARD_TTL_MS=600000
-FLUXER_SVC_MAX_CONCURRENT_REQUESTS=64

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -59,22 +50,20 @@ FLUXER_S3_SECRET_ACCESS_KEY=fluxer-secret
 FLUXER_S3_FORCE_PATH_STYLE=true
 FLUXER_S3_BUCKET_CDN=fluxer
 FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
-FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
 FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
 FLUXER_S3_BUCKET_STATIC=fluxer-static

 FLUXER_LIVEKIT_ENABLED=true
 FLUXER_LIVEKIT_URL=ws://localhost:8088/livekit
+FLUXER_LIVEKIT_INTERNAL_URL=http://localhost:7880
 FLUXER_LIVEKIT_API_KEY=devkey
-FLUXER_LIVEKIT_API_SECRET=secret
-FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
+FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

 FLUXER_API_PORT=8080
 FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
 FLUXER_API_WORKER_MODE=all_lanes
-FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION=true
 FLUXER_APP_DEV_PORT=3000
 FLUXER_APP_PROXY_PORT=8773
 FLUXER_STATIC_DIR=fluxer_app/dist
@@ -95,18 +84,14 @@ FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
 FLUXER_ADMIN_PORT=3020
 FLUXER_ADMIN_BASE_PATH=/admin
 FLUXER_ADMIN_SECRET_KEY_BASE=dev-admin-secret-key-base
-FLUXER_ADMIN_OAUTH_CLIENT_ID=1234567890123456789
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=dev-admin-oauth-secret
 FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback
-FLUXER_MARKETING_PORT=3010
-FLUXER_MARKETING_HOST=0.0.0.0
-FLUXER_MARKETING_BASE_PATH=/marketing
-FLUXER_MARKETING_SECRET_KEY_BASE=dev-marketing-secret-key-base

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
-FLUXER_VAPID_PUBLIC_KEY=dev-vapid-public-key
-FLUXER_VAPID_PRIVATE_KEY=dev-vapid-private-key
+FLUXER_PROFILE_PSEUDONYM_SECRET=fluxer-dev-profile-pseudonym-secret
+FLUXER_VAPID_PUBLIC_KEY=BHIbdKs24FdPkOQS7hbeg3adceLS0IqlKsn71ywEe6kbeopeFFiG3lkvJac7BVqkuk7mxwEa555O2FXV3HLt56w
+FLUXER_VAPID_PRIVATE_KEY=cs24JvXSxHiqJQgkJNocJFAdzJpPmpfU9xD-fDpn3tw
 FLUXER_VAPID_EMAIL=dev@localhost
 FLUXER_PASSKEY_RP_NAME='Fluxer Dev'
 FLUXER_PASSKEY_RP_ID=localhost
@@ -120,9 +105,6 @@ FLUXER_EMAIL_SMTP_PORT=1025
 FLUXER_EMAIL_SMTP_USERNAME=dev
 FLUXER_EMAIL_SMTP_PASSWORD=dev
 FLUXER_EMAIL_SMTP_SECURE=false
-FLUXER_SMS_ENABLED=false
-FLUXER_CAPTCHA_ENABLED=false
-FLUXER_CAPTCHA_PROVIDER=none
 FLUXER_SEARCH_ENGINE=meilisearch
 FLUXER_SEARCH_URL=http://meilisearch:7700
 FLUXER_SEARCH_API_KEY=fluxer-dev-meilisearch
@@ -142,7 +124,5 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
-AWS_ACCESS_KEY_ID=fluxer
-AWS_SECRET_ACCESS_KEY=fluxer-secret
-AWS_DEFAULT_REGION=us-east-1
@@ -1,13 +1,9 @@
 # cargo-deny configuration for the Fluxer workspace.
 #
-# Applies to the root workspace (Cargo.toml at the repo root) AND to every
-# per-addon crate under fluxer_desktop/native/* (each addon has its own
-# [workspace], so we invoke cargo-deny with --config pointing here).
-#
-# Used by the native desktop security gate in CI.
+# Applies to the root workspace (Cargo.toml at the repo root).

 [graph]
-all-features = false
+all-features = true
 no-default-features = false

 [output]
@@ -44,13 +40,11 @@ allow = [
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
-    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "AGPL-3.0-or-later",
    "BSL-1.0",
-    "OpenSSL",
    "CDLA-Permissive-2.0",
 ]
 # Explicitly deny GPL-only / strong-copyleft licenses that don't compose with
@@ -72,21 +66,56 @@ license-files = [
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# Per-addon crates path-depend on ../rust (the shared `fluxer_desktop_native`
-# crate) without a version. cargo-deny flags that as a wildcard; we allow it
-# because path deps can't realistically pin a SemVer range, and this only
-# affects intra-repo workspace links (registry wildcards remain denied).
+# Internal workspace crates use path dependencies without registry versions.
+# Registry wildcards remain denied.
 allow-wildcard-paths = true
 highlight = "all"
 workspace-default-features = "allow"
 external-default-features = "allow"
-# Keep desktop packaging and native addons away from the obsolete libfuse2 stack.
+# Keep workspace artifacts away from the obsolete libfuse2 stack.
 # AppImage packaging must use the static electron-builder runtime instead.
 deny = [
    { crate = "fuse", reason = "libfuse2-based Rust wrapper; use a maintained FUSE3-native crate only if Fluxer ever needs FUSE directly" },
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
-skip = []
+skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
+]
 skip-tree = []

 # ---------------------------------------------------------------------------
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: admin
-description: Fluxer admin service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-canary release as of 2026-05-17T20:42:36Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-canary
-# Apply with:    helm upgrade fluxer-admin-canary deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  image: fluxer-admin
-  name: admin-canary
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,41 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-admin-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-admin-stable
-# Apply with:    helm upgrade fluxer-admin-stable deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-admin
-  name: admin
-  port: 8080
-  replicas: 2
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,34 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  minReadySeconds: 10
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 60
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-pdb:
-  minAvailable: '50%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: api
-description: Fluxer API service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,105 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-canary release as of 2026-05-23T21:25:52Z.
-# Captured via:  helm -n fluxer get values fluxer-api-canary
-# Apply with:    helm upgrade fluxer-api-canary deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api-canary
-  port: 8080
-  replicas: 4
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 75%
@@ -1,107 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-api-stable release as of 2026-06-03T19:37:50Z.
-# Captured via:  helm -n fluxer get values fluxer-api-stable
-# Apply with:    helm upgrade fluxer-api-stable deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_USERS_SERVICE_TIMEOUT_MS
-    value: "6000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  name: api
-  port: 8080
-  replicas: 31
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-  tag: ""
-canary:
-  env:
-  - name: NODE_TLS_REJECT_UNAUTHORIZED
-    value: "0"
-  - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-    value: "128"
-  - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-    value: "32"
-  - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-    value: "5000"
-  - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-    valueFrom:
-      secretKeyRef:
-        key: relay_secret_base64
-        name: fluxer-upload-relay
-  image: fluxer-api
-  port: 8080
-  replicas: 2
-  minReadySeconds: 15
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  resources:
-    limits:
-      memory: 4Gi
-    requests:
-      cpu: 200m
-      memory: 512Mi
-  startupProbe:
-    enabled: true
-    failureThreshold: 24
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 75%
@@ -1,98 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-canary:
-  image: fluxer-api
-  tag: ''
-  replicas: 2
-  port: 8080
-  minReadySeconds: 15
-  rollingUpdate:
-    maxSurge: 1
-    maxUnavailable: 0
-  terminationGracePeriodSeconds: 90
-  preStopDrain:
-    enabled: true
-    path: /_health
-    sleepSeconds: 25
-    timeoutSeconds: 2
-    retryCount: 3
-    retryIntervalSeconds: 1
-  startupProbe:
-    enabled: true
-    path: /_health
-    periodSeconds: 5
-    timeoutSeconds: 2
-    failureThreshold: 24
-  env:
-    - name: NODE_TLS_REJECT_UNAUTHORIZED
-      value: '0'
-    - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE
-      value: '128'
-    - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK
-      value: '32'
-    - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS
-      value: '5000'
-    - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64
-      valueFrom:
-        secretKeyRef:
-          name: fluxer-upload-relay
-          key: relay_secret_base64
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      memory: 4Gi
-
-pdb:
-  minAvailable: '75%'
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: app-proxy
-description: Fluxer app proxy service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-canary release as of 2026-05-17T20:42:38Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-canary
-# Apply with:    helm upgrade fluxer-app-proxy-canary deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.canary.prod.yaml
-
-app:
-  build:
-    channel: canary
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.canary.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy-canary
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-canary
-pdb:
-  minAvailable: 50%
@@ -1,35 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Live user-supplied values for the fluxer-app-proxy-stable release as of 2026-05-17T20:42:39Z.
-# Captured via:  helm -n fluxer get values fluxer-app-proxy-stable
-# Apply with:    helm upgrade fluxer-app-proxy-stable deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.stable.prod.yaml
-
-app:
-  build:
-    channel: stable
-    version: ""
-  env:
-  - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-    value: /api
-  - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT
-    value: https://api.fluxer.app
-  image: fluxer-app-proxy
-  name: app-proxy
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-  envFrom:
-  - secretRef:
-      name: fluxer-runtime-env-stable
-pdb:
-  minAvailable: 50%
@@ -1,31 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  config: ''
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      memory: 512Mi
-
-
-
-
-
-  env:
-    - name: PUBLIC_BOOTSTRAP_API_ENDPOINT
-      value: '/api'
-
-pdb:
-  minAvailable: '50%'
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: common
-description: Shared Helm templates for Fluxer services
-type: library
-version: 0.1.0
@@ -1,356 +0,0 @@
-{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}}
-{{- define "fluxer.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "fluxer.labels" -}}
-helm.sh/chart: {{ include "fluxer.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/part-of: fluxer
-{{- end }}
-
-{{- define "fluxer.selectorLabels" -}}
-app.kubernetes.io/name: {{ .name }}
-app.kubernetes.io/instance: {{ .context.Release.Name }}
-{{- end }}
-
-{{- define "fluxer.imagePullSecrets" -}}
-imagePullSecrets:
-  - name: {{ .Values.global.imagePullSecret }}
-{{- end }}
-
-{{- define "fluxer.image" -}}
-{{- $tag := required (printf ".tag is required (image: %s)" .image) .tag -}}
-{{- $registry := required "global.registry is required" .context.Values.global.registry -}}
-{{ $registry }}/{{ .image }}:{{ $tag }}
-{{- end }}
-
-{{- define "fluxer.replicas" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $desired := int (required (printf ".replicas is required for %s" $name) $v.replicas) -}}
-{{- $preserveLiveReplicas := dig "preserveLiveReplicas" true $v -}}
-{{- if not $preserveLiveReplicas -}}
-{{- $desired -}}
-{{- else -}}
-{{- $existing := lookup "apps/v1" "Deployment" $ctx.Values.global.namespace $name -}}
-{{- if $existing -}}
-{{- $current := int (dig "spec" "replicas" 0 $existing) -}}
-{{- if gt $current 0 -}}
-{{- $current -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- else -}}
-{{- $desired -}}
-{{- end -}}
-{{- end -}}
-{{- end }}
-
-{{- define "fluxer.deployment" -}}
-{{- $name := .name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-{{- $isGateway := eq $name "gateway" -}}
-{{- $defaultMaxSurge := 1 -}}
-{{- $defaultMaxUnavailable := 0 -}}
-{{- $defaultMinReadySeconds := 10 -}}
-{{- $defaultTerminationGracePeriodSeconds := ternary 90 60 $isGateway -}}
-{{- $defaultReadinessPath := ternary "/_health/ready" "/_health" $isGateway -}}
-{{- $defaultReadinessTimeoutSeconds := ternary 5 2 $isGateway -}}
-{{- $configuredMaxSurge := dig "rollingUpdate" "maxSurge" $defaultMaxSurge $v -}}
-{{- $configuredMaxUnavailable := dig "rollingUpdate" "maxUnavailable" $defaultMaxUnavailable $v -}}
-{{- $maxSurge := $configuredMaxSurge -}}
-{{- $maxUnavailable := $configuredMaxUnavailable -}}
-{{- $minReadySeconds := int (dig "minReadySeconds" $defaultMinReadySeconds $v) -}}
-{{- $terminationGracePeriodSeconds := int (dig "terminationGracePeriodSeconds" $defaultTerminationGracePeriodSeconds $v) -}}
-{{- $readinessPath := dig "readinessProbe" "path" $defaultReadinessPath $v -}}
-{{- $readinessExecEnabled := dig "readinessProbe" "execEnabled" $isGateway $v -}}
-{{- $readinessTimeoutSeconds := int (dig "readinessProbe" "timeoutSeconds" $defaultReadinessTimeoutSeconds $v) -}}
-{{- $readinessExecCommand := printf "curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 || exit 1" $readinessTimeoutSeconds (int $v.port) $readinessPath -}}
-{{- $readinessInitialDelaySeconds := int (dig "readinessProbe" "initialDelaySeconds" 5 $v) -}}
-{{- $readinessPeriodSeconds := int (dig "readinessProbe" "periodSeconds" 5 $v) -}}
-{{- $readinessFailureThreshold := int (dig "readinessProbe" "failureThreshold" 2 $v) -}}
-{{- $livenessPath := dig "livenessProbe" "path" "/_health" $v -}}
-{{- $livenessInitialDelaySeconds := int (dig "livenessProbe" "initialDelaySeconds" 10 $v) -}}
-{{- $livenessPeriodSeconds := int (dig "livenessProbe" "periodSeconds" 15 $v) -}}
-{{- $livenessFailureThreshold := int (dig "livenessProbe" "failureThreshold" 3 $v) -}}
-{{- $livenessTimeoutSeconds := int (dig "livenessProbe" "timeoutSeconds" 5 $v) -}}
-{{- $startupProbeEnabled := dig "startupProbe" "enabled" $isGateway $v -}}
-{{- $startupProbePath := dig "startupProbe" "path" "/_health" $v -}}
-{{- $startupProbeInitialDelaySeconds := int (dig "startupProbe" "initialDelaySeconds" 0 $v) -}}
-{{- $startupProbePeriodSeconds := int (dig "startupProbe" "periodSeconds" 5 $v) -}}
-{{- $startupProbeFailureThreshold := int (dig "startupProbe" "failureThreshold" 30 $v) -}}
-{{- $startupProbeTimeoutSeconds := int (dig "startupProbe" "timeoutSeconds" 5 $v) -}}
-{{- $preStopDrainEnabled := dig "preStopDrain" "enabled" $isGateway $v -}}
-{{- $preStopDrainPath := dig "preStopDrain" "path" "/_health/drain" $v -}}
-{{- $preStopDrainSleepSeconds := int (dig "preStopDrain" "sleepSeconds" 20 $v) -}}
-{{- $preStopDrainTimeoutSeconds := int (dig "preStopDrain" "timeoutSeconds" 2 $v) -}}
-{{- $preStopDrainRetryCount := int (dig "preStopDrain" "retryCount" 6 $v) -}}
-{{- $preStopDrainRetryIntervalSeconds := int (dig "preStopDrain" "retryIntervalSeconds" 1 $v) -}}
-{{- $preStopDrainCommand := printf "attempt=0; while [ \"$attempt\" -lt %d ]; do curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 && break; attempt=$((attempt+1)); sleep %d; done; sleep %d" $preStopDrainRetryCount $preStopDrainTimeoutSeconds (int $v.port) $preStopDrainPath $preStopDrainRetryIntervalSeconds $preStopDrainSleepSeconds -}}
-{{- $build := get $v "build" | default (dict) -}}
-{{- $buildVersion := get $build "version" | default $v.tag -}}
-{{- $buildSha := get $build "sha" | default "" -}}
-{{- $buildChannel := get $build "channel" | default "" -}}
-{{- $nsfwServiceEndpoint := get $v "nsfwServiceEndpoint" | default "" -}}
-{{- $cluster := get $ctx.Values "cluster" | default (dict) -}}
-{{- $gatewayClusterEnabled := and $isGateway (eq (get $cluster "enabled" | default false) true) -}}
-{{- $erlangDistribution := get $cluster "erlangDistribution" | default (dict) -}}
-{{- $erlangDistPort := int (get $erlangDistribution "port" | default 8081) -}}
-{{- $erlangEpmdPort := int (get $erlangDistribution "epmdPort" | default 4369) -}}
-{{- $erlangCookieSecret := get $cluster "erlangCookieSecret" | default (dict) -}}
-{{- $erlangCookieSecretName := get $erlangCookieSecret "name" | default "fluxer-gateway-erlang-cookie" -}}
-{{- $erlangCookieSecretKey := get $erlangCookieSecret "key" | default "cookie" -}}
-{{- $gatewayNodeBasename := get $cluster "discoveryNodeBasename" | default "fluxer_gateway" -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  replicas: {{ include "fluxer.replicas" (dict "name" $name "values" $v "context" $ctx) }}
-  minReadySeconds: {{ $minReadySeconds }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 6 }}
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: {{ $maxSurge | toJson }}
-      maxUnavailable: {{ $maxUnavailable | toJson }}
-  template:
-    metadata:
-      labels:
-        {{- include "fluxer.labels" $ctx | nindent 8 }}
-        {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 8 }}
-    spec:
-      {{- include "fluxer.imagePullSecrets" $ctx | nindent 6 }}
-      terminationGracePeriodSeconds: {{ $terminationGracePeriodSeconds }}
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      {{- if $v.affinity }}
-      affinity:
-        {{- toYaml $v.affinity | nindent 8 }}
-      {{- else if $isGateway }}
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: gateway
-                    app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-                topologyKey: kubernetes.io/hostname
-      {{- end }}
-      {{- if $v.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml $v.topologySpreadConstraints | nindent 8 }}
-      {{- else if $isGateway }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: gateway
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- else }}
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: ScheduleAnyway
-          nodeAffinityPolicy: Honor
-          nodeTaintsPolicy: Honor
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ $name }}
-              app.kubernetes.io/instance: {{ $ctx.Release.Name }}
-      {{- end }}
-      {{- if $v.nodeSelector }}
-      nodeSelector:
-        {{- toYaml $v.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if $v.tolerations }}
-      tolerations:
-        {{- toYaml $v.tolerations | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: {{ $name }}
-          image: {{ include "fluxer.image" (dict "image" $v.image "tag" $v.tag "context" $ctx) }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          {{- if $v.command }}
-          command: {{ $v.command | toJson }}
-          {{- end }}
-          ports:
-            - name: http
-              containerPort: {{ $v.port }}
-              protocol: TCP
-            {{- if $gatewayClusterEnabled }}
-            - name: epmd
-              containerPort: {{ $erlangEpmdPort }}
-              protocol: TCP
-            - name: erl-dist
-              containerPort: {{ $erlangDistPort }}
-              protocol: TCP
-            {{- end }}
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: FLUXER_ENV
-              value: production
-            {{- if $gatewayClusterEnabled }}
-            - name: POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: FLUXER_ERLANG_NODE_NAME
-              value: {{ printf "%s@$(POD_IP)" $gatewayNodeBasename | quote }}
-            - name: FLUXER_ERLANG_DIST_PORT
-              value: {{ printf "%d" $erlangDistPort | quote }}
-            - name: FLUXER_ERLANG_COOKIE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $erlangCookieSecretName }}
-                  key: {{ $erlangCookieSecretKey }}
-            {{- end }}
-            {{- if $buildVersion }}
-            - name: BUILD_VERSION
-              value: {{ $buildVersion | quote }}
-            {{- end }}
-            {{- if $buildSha }}
-            - name: BUILD_SHA
-              value: {{ $buildSha | quote }}
-            {{- end }}
-            {{- if $buildChannel }}
-            - name: RELEASE_CHANNEL
-              value: {{ $buildChannel | quote }}
-            {{- end }}
-            {{- if $nsfwServiceEndpoint }}
-            - name: FLUXER_NSFW_SERVICE_ENDPOINT
-              value: {{ $nsfwServiceEndpoint | quote }}
-            {{- end }}
-            {{- if $ctx.Values.global.env }}
-            {{- toYaml $ctx.Values.global.env | nindent 12 }}
-            {{- end }}
-            {{- if $v.env }}
-            {{- toYaml $v.env | nindent 12 }}
-            {{- end }}
-          {{- if or $ctx.Values.global.envFrom $v.envFrom }}
-          envFrom:
-            {{- if $ctx.Values.global.envFrom }}
-            {{- toYaml $ctx.Values.global.envFrom | nindent 12 }}
-            {{- end }}
-            {{- if $v.envFrom }}
-            {{- toYaml $v.envFrom | nindent 12 }}
-            {{- end }}
-          {{- end }}
-          {{- if $preStopDrainEnabled }}
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - {{ $preStopDrainCommand | quote }}
-          {{- end }}
-          volumeMounts:
-            - name: keys
-              mountPath: /etc/fluxer/keys
-              readOnly: true
-          {{- if not $v.noHealthCheck }}
-          livenessProbe:
-            httpGet:
-              path: {{ $livenessPath | quote }}
-              port: http
-            initialDelaySeconds: {{ $livenessInitialDelaySeconds }}
-            periodSeconds: {{ $livenessPeriodSeconds }}
-            timeoutSeconds: {{ $livenessTimeoutSeconds }}
-            failureThreshold: {{ $livenessFailureThreshold }}
-          readinessProbe:
-            {{- if $readinessExecEnabled }}
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - {{ $readinessExecCommand | quote }}
-            {{- else }}
-            httpGet:
-              path: {{ $readinessPath | quote }}
-              port: http
-            {{- end }}
-            initialDelaySeconds: {{ $readinessInitialDelaySeconds }}
-            periodSeconds: {{ $readinessPeriodSeconds }}
-            timeoutSeconds: {{ $readinessTimeoutSeconds }}
-            failureThreshold: {{ $readinessFailureThreshold }}
-          {{- if $startupProbeEnabled }}
-          startupProbe:
-            httpGet:
-              path: {{ $startupProbePath | quote }}
-              port: http
-            initialDelaySeconds: {{ $startupProbeInitialDelaySeconds }}
-            periodSeconds: {{ $startupProbePeriodSeconds }}
-            timeoutSeconds: {{ $startupProbeTimeoutSeconds }}
-            failureThreshold: {{ $startupProbeFailureThreshold }}
-          {{- end }}
-          {{- end }}
-          resources:
-            {{- toYaml $v.resources | nindent 12 }}
-      volumes:
-        - name: keys
-          secret:
-            secretName: fluxer-keys
-            optional: true
-{{- end }}
-
-{{- define "fluxer.service" -}}
-{{- $name := .name -}}
-{{- $selectorName := .selectorName | default $name -}}
-{{- $v := .values -}}
-{{- $ctx := .context -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ $name }}
-  namespace: {{ $ctx.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" $ctx | nindent 4 }}
-    {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }}
-spec:
-  type: ClusterIP
-  ports:
-    - port: {{ $v.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fluxer.selectorLabels" (dict "name" $selectorName "context" $ctx) | nindent 4 }}
-{{- end }}
-
-{{- define "fluxer.pdb" -}}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ .name }}-pdb
-  namespace: {{ .context.Values.global.namespace }}
-  labels:
-    {{- include "fluxer.labels" .context | nindent 4 }}
-spec:
-  minAvailable: {{ .minAvailable }}
-  selector:
-    matchLabels:
-      {{- include "fluxer.selectorLabels" (dict "name" .name "context" .context) | nindent 6 }}
-{{- end }}
@@ -1,11 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-apiVersion: v2
-name: docs
-description: Fluxer documentation service
-type: application
-version: 0.1.0
-dependencies:
-  - name: common
-    version: 0.1.0
-    repository: file://../common
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}}
@@ -1,3 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}}
@@ -1,23 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-app:
-  build:
-    channel: stable
-    version: ""
-  image: fluxer-docs
-  name: docs
-  port: 8080
-  replicas: 2
-  resources:
-    limits:
-      memory: 128Mi
-    requests:
-      cpu: 50m
-      memory: 64Mi
-  tag: ""
-global:
-  imagePullSecret: ghcr-pull-secret
-  namespace: fluxer
-  registry: ""
-pdb:
-  minAvailable: 50%
@@ -1,22 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-global:
-  namespace: fluxer
-  imagePullSecret: ghcr-pull-secret
-  registry: ""
-
-app:
-  name: ''
-  image: ''
-  tag: ''
-  replicas: 2
-  port: 8080
-  resources:
-    requests:
-      cpu: 50m
-      memory: 64Mi
-    limits:
-      memory: 128Mi
-
-pdb:
-  minAvailable: '50%'
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-api
+description: Fluxer HTTP API and background job workers
+type: application
+version: 0.1.0
+appVersion: "v1"
@@ -0,0 +1,244 @@
+{{- define "fluxer-api.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "fluxer-api.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "fluxer-api.labels" -}}
+{{ include "fluxer-api.selectorLabels" . }}
+app.kubernetes.io/component: {{ .component }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+helm.sh/chart: {{ include "fluxer-api.chart" .root }}
+{{- end }}
+
+{{- define "fluxer-api.image" -}}
+{{- $g := .root.Values.image | default dict -}}
+{{- $i := .w.image | default dict -}}
+{{- $repo := $i.repository -}}
+{{- if not $repo -}}
+{{- $repo = printf "%s/%s" (required "image.registry is required" $g.registry) ($i.name | default "fluxer-api") -}}
+{{- end -}}
+{{- $tag := required "image.tag is required" ($i.tag | default $g.tag) -}}
+{{- if $i.digest -}}
+{{- printf "%s:%s@%s" $repo $tag $i.digest | quote -}}
+{{- else -}}
+{{- printf "%s:%s" $repo $tag | quote -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-api.pick" -}}
+{{- $v := ternary (get .w .key) (get .root.Values .key) (hasKey .w .key) -}}
+{{- if $v }}
+{{- toYaml $v }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-api.str" -}}
+{{- if and (kindIs "float64" .) (eq . (floor .)) -}}
+{{- int64 . | toString | quote -}}
+{{- else -}}
+{{- toString . | quote -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-api.env" -}}
+{{- $env := dict -}}
+{{- range $k, $val := .root.Values.env | default dict }}
+{{- $_ := set $env $k $val }}
+{{- end }}
+{{- range $k, $val := .w.env | default dict }}
+{{- $_ := set $env $k $val }}
+{{- end }}
+{{- range $k, $val := $env }}
+{{- if not (kindIs "invalid" $val) }}
+- name: {{ $k }}
+  value: {{ include "fluxer-api.str" $val }}
+{{- end }}
+{{- end }}
+{{- with .w.buildVersion }}
+- name: BUILD_VERSION
+  value: {{ include "fluxer-api.str" . }}
+{{- end }}
+{{- with concat (.root.Values.extraEnv | default list) (.w.extraEnv | default list) }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-api.topologySpread" -}}
+{{- $tscs := ternary .w.topologySpreadConstraints .root.Values.topologySpreadConstraints (hasKey .w "topologySpreadConstraints") -}}
+{{- range $tscs }}
+{{- $c := deepCopy . }}
+{{- if not $c.labelSelector }}
+{{- $_ := set $c "labelSelector" (dict "matchLabels" (include "fluxer-api.selectorLabels" $ | fromYaml)) }}
+{{- end }}
+- {{- toYaml $c | nindent 2 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-api.pdb" -}}
+{{- with .w.pdb }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $.name }}-pdb
+  namespace: {{ $.root.Release.Namespace }}
+  labels:
+    {{- include "fluxer-api.labels" $ | nindent 4 }}
+spec:
+  {{- toYaml . | nindent 2 }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-api.selectorLabels" $ | nindent 6 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-api.hpa" -}}
+{{- with .w.hpa }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $.name }}
+  namespace: {{ $.root.Release.Namespace }}
+  labels:
+    {{- include "fluxer-api.labels" $ | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ $.name }}
+  minReplicas: {{ required (printf "%s.hpa.minReplicas is required" $.name) .minReplicas }}
+  maxReplicas: {{ required (printf "%s.hpa.maxReplicas is required" $.name) .maxReplicas }}
+  {{- with .targetCPUUtilizationPercentage }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ . }}
+  {{- end }}
+  {{- with .behavior }}
+  behavior:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-api.deployment" -}}
+{{- $root := .root -}}
+{{- $v := $root.Values -}}
+{{- $w := .w -}}
+{{- $envFrom := concat ($v.envFrom | default list) ($w.envFrom | default list) -}}
+{{- $podAnnotations := merge (dict) ($w.podAnnotations | default dict) ($v.podAnnotations | default dict) -}}
+{{- $wProbes := $w.probes | default dict -}}
+{{- $gProbes := .probes | default dict -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    {{- include "fluxer-api.labels" . | nindent 4 }}
+spec:
+  {{- if not $w.hpa }}
+  replicas: {{ if kindIs "invalid" $w.replicas }}1{{ else }}{{ int $w.replicas }}{{ end }}
+  {{- end }}
+  {{- if not (kindIs "invalid" $w.minReadySeconds) }}
+  minReadySeconds: {{ int $w.minReadySeconds }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-api.selectorLabels" . | nindent 6 }}
+  {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "strategy") }}
+  strategy:
+    {{- . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer-api.labels" . | nindent 8 }}
+      {{- with $podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "imagePullSecrets") }}
+      imagePullSecrets:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "podSecurityContext") }}
+      securityContext:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- if not (kindIs "invalid" $w.terminationGracePeriodSeconds) }}
+      terminationGracePeriodSeconds: {{ int $w.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "nodeSelector") }}
+      nodeSelector:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "affinity") }}
+      affinity:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "tolerations") }}
+      tolerations:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-api.topologySpread" . | trim }}
+      topologySpreadConstraints:
+        {{- . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .name }}
+          image: {{ include "fluxer-api.image" . }}
+          imagePullPolicy: {{ ($w.image | default dict).pullPolicy | default ($v.image | default dict).pullPolicy | default "IfNotPresent" }}
+          {{- with .command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with include "fluxer-api.env" . | trim }}
+          env:
+            {{- . | nindent 12 }}
+          {{- end }}
+          {{- with $envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: 8080
+          {{- with $w.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- range $probe := list "startup" "liveness" "readiness" }}
+          {{- with hasKey $wProbes $probe | ternary (get $wProbes $probe) (get $gProbes $probe) }}
+          {{ $probe }}Probe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          {{- with $w.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with include "fluxer-api.pick" (dict "root" $root "w" $w "key" "securityContext") }}
+          securityContext:
+            {{- . | nindent 12 }}
+          {{- end }}
+          {{- with $w.extraVolumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with $w.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
@@ -0,0 +1,24 @@
+{{- range $name, $w := .Values.api }}
+{{- if not (kindIs "invalid" $w) }}
+{{- $ctx := dict "root" $ "name" $name "w" $w "component" "api" "probes" ($.Values.probes | default dict) }}
+{{ include "fluxer-api.deployment" $ctx }}
+{{ include "fluxer-api.hpa" $ctx }}
+{{ include "fluxer-api.pdb" $ctx }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-api.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer-api.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+{{- end }}
+{{- end }}
@@ -0,0 +1,8 @@
+{{- range $name, $w := .Values.workers }}
+{{- if not (kindIs "invalid" $w) }}
+{{- $ctx := dict "root" $ "name" $name "w" $w "component" "worker" "command" (list "node" "dist/WorkerEntrypoint.js") "probes" (dict) }}
+{{ include "fluxer-api.deployment" $ctx }}
+{{ include "fluxer-api.hpa" $ctx }}
+{{ include "fluxer-api.pdb" $ctx }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,86 @@
+image:
+  registry: ghcr.io/fluxerapp
+  tag: v1
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+env:
+  NODE_ENV: production
+  FLUXER_ENV: production
+  FLUXER_PUBLIC_ORIGIN: https://web.example.com
+  FLUXER_API_ENDPOINT: https://api.example.com
+  FLUXER_GATEWAY_ENDPOINT: wss://gateway.example.com
+  FLUXER_MEDIA_ENDPOINT: https://media.example.com
+  FLUXER_ADMIN_ENDPOINT: https://admin.example.com
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: https://uploads.example.com
+  FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
+  FLUXER_KV_URL: redis://valkey:6379/0
+  FLUXER_NATS_URL: nats://nats:4222
+  FLUXER_NATS_JETSTREAM_URL: nats://nats:4222
+
+extraEnv: []
+
+envFrom:
+  - secretRef:
+      name: fluxer-env
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+
+probes:
+  startup:
+    httpGet:
+      path: /_health
+      port: http
+    periodSeconds: 10
+    failureThreshold: 30
+  liveness:
+    httpGet:
+      path: /_health
+      port: http
+  readiness:
+    httpGet:
+      path: /_health
+      port: http
+
+strategy:
+  type: RollingUpdate
+
+topologySpreadConstraints: []
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+api:
+  api:
+    replicas: 1
+    resources:
+      requests:
+        cpu: 250m
+        memory: 1Gi
+      limits:
+        memory: 2560Mi
+
+workers:
+  worker:
+    replicas: 1
+    env:
+      FLUXER_API_WORKER_MODE: all_lanes
+      FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER: "true"
+    resources:
+      requests:
+        cpu: 250m
+        memory: 1Gi
+      limits:
+        memory: 2560Mi
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-gateway
+description: A Helm chart for the Fluxer realtime gateway.
+type: application
+version: 0.1.0
+appVersion: "v1"
@@ -0,0 +1,280 @@
+{{- define "gateway.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "gateway.labels" -}}
+{{ include "gateway.selectorLabels" . }}
+{{- with .component }}
+app.kubernetes.io/component: {{ . }}
+{{- end }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .root.Chart.Name .root.Chart.Version | replace "+" "_" }}
+{{- end }}
+
+{{- define "gateway.headlessName" -}}
+{{ printf "%s-headless" .Release.Name }}
+{{- end }}
+
+{{- define "gateway.pick" -}}
+{{- $v := get .root.Values .key }}
+{{- if hasKey .w .key }}
+{{- $v = get .w .key }}
+{{- end }}
+{{- with $v }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.string" -}}
+{{- if and (kindIs "float64" .) (eq . (float64 (int64 .))) }}
+{{- int64 . | toString }}
+{{- else }}
+{{- toString . }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.envList" -}}
+{{- $env := deepCopy (.root.Values.env | default dict) }}
+{{- range $k, $v := .w.env | default dict }}
+{{- if kindIs "invalid" $v }}
+{{- $_ := unset $env $k }}
+{{- else }}
+{{- $_ := set $env $k $v }}
+{{- end }}
+{{- end }}
+{{- range $k, $v := $env }}
+{{- if not (kindIs "invalid" $v) }}
+- name: {{ $k }}
+  value: {{ include "gateway.string" $v | quote }}
+{{- end }}
+{{- end }}
+{{- with concat (.root.Values.extraEnv | default list) (.w.extraEnv | default list) }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.envFrom" -}}
+{{- with concat (.root.Values.envFrom | default list) (.w.envFrom | default list) }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.podAnnotations" -}}
+{{- with merge (deepCopy (.w.podAnnotations | default dict)) (deepCopy (.root.Values.podAnnotations | default dict)) }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.probes" -}}
+{{- $global := .root.Values.probes | default dict }}
+{{- $own := .w.probes | default dict }}
+{{- range $probe := list "startup" "liveness" "readiness" }}
+{{- $p := get $global $probe }}
+{{- if hasKey $own $probe }}
+{{- $p = get $own $probe }}
+{{- end }}
+{{- with $p }}
+{{ $probe }}Probe:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.topologySpreadConstraints" -}}
+{{- $out := list }}
+{{- range include "gateway.pick" (dict "root" .root "w" .w "key" "topologySpreadConstraints") | fromYamlArray }}
+{{- $c := deepCopy . }}
+{{- if not (hasKey $c "labelSelector") }}
+{{- $_ := set $c "labelSelector" (dict "matchLabels" (include "gateway.selectorLabels" $ | fromYaml)) }}
+{{- end }}
+{{- $out = append $out $c }}
+{{- end }}
+{{- with $out }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.image" -}}
+{{- $img := .w.image | default dict }}
+{{- $v := .root.Values.image }}
+{{- $repo := $img.repository | default (printf "%s/%s" $v.registry ($img.name | default "fluxer-gateway")) }}
+{{- $ref := printf "%s:%s" $repo ($img.tag | default $v.tag) }}
+{{- with $img.digest }}
+{{- $ref = printf "%s@%s" $ref . }}
+{{- end }}
+{{- $ref | quote }}
+{{- end }}
+
+{{- define "gateway.replicas" -}}
+{{- if kindIs "invalid" .w.replicas }}1{{ else }}{{ .w.replicas }}{{ end }}
+{{- end }}
+
+{{- define "gateway.env" -}}
+{{- $root := .root }}
+{{- $w := .w -}}
+{{- with $w.role }}
+- name: FLUXER_GATEWAY_ROLE
+  value: {{ . | quote }}
+{{- end }}
+{{- if not (kindIs "invalid" $w.buildVersion) }}
+- name: BUILD_VERSION
+  value: {{ include "gateway.string" $w.buildVersion | quote }}
+{{- end }}
+- name: POD_IP
+  valueFrom:
+    fieldRef:
+      apiVersion: v1
+      fieldPath: status.podIP
+- name: FLUXER_ERLANG_NODE_NAME
+  value: fluxer_gateway@$(POD_IP)
+- name: FLUXER_ERLANG_DIST_PORT
+  value: "8081"
+- name: FLUXER_GATEWAY_CLUSTER_ENABLED
+  value: "true"
+- name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME
+  value: {{ printf "%s.%s.svc.%s" (include "gateway.headlessName" $root) $root.Release.Namespace $root.Values.clusterDomain | quote }}
+- name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME
+  value: fluxer_gateway
+{{- include "gateway.envList" . }}
+{{- end }}
+
+{{- define "gateway.pod" -}}
+{{- $root := .root }}
+{{- $w := .w -}}
+metadata:
+  labels:
+    {{- include "gateway.labels" . | nindent 4 }}
+  {{- with include "gateway.podAnnotations" . }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with include "gateway.pick" (dict "root" $root "w" $w "key" "affinity") }}
+  affinity:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with include "gateway.pick" (dict "root" $root "w" $w "key" "imagePullSecrets") }}
+  imagePullSecrets:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with include "gateway.pick" (dict "root" $root "w" $w "key" "nodeSelector") }}
+  nodeSelector:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with include "gateway.pick" (dict "root" $root "w" $w "key" "tolerations") }}
+  tolerations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with include "gateway.topologySpreadConstraints" . }}
+  topologySpreadConstraints:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with include "gateway.pick" (dict "root" $root "w" $w "key" "podSecurityContext") }}
+  securityContext:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- if not (kindIs "invalid" $w.terminationGracePeriodSeconds) }}
+  terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds }}
+  {{- end }}
+  containers:
+  - name: gateway
+    image: {{ include "gateway.image" . }}
+    imagePullPolicy: {{ ($w.image | default dict).pullPolicy | default $root.Values.image.pullPolicy }}
+    env:
+      {{- include "gateway.env" . | trim | nindent 6 }}
+    {{- with include "gateway.envFrom" . }}
+    envFrom:
+      {{- . | nindent 6 }}
+    {{- end }}
+    {{- with $w.lifecycle }}
+    lifecycle:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    ports:
+    - name: http
+      containerPort: 8080
+      protocol: TCP
+    - name: epmd
+      containerPort: 4369
+      protocol: TCP
+    - name: erl-dist
+      containerPort: 8081
+      protocol: TCP
+    {{- with include "gateway.probes" . | trim }}
+    {{- . | nindent 4 }}
+    {{- end }}
+    {{- with $w.resources }}
+    resources:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with include "gateway.pick" (dict "root" $root "w" $w "key" "securityContext") }}
+    securityContext:
+      {{- . | nindent 6 }}
+    {{- end }}
+    {{- with $w.extraVolumeMounts }}
+    volumeMounts:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- with $w.extraVolumes }}
+  volumes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+
+{{- define "gateway.pdb" -}}
+{{- with .w.pdb }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $.name }}-pdb
+  namespace: {{ $.root.Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" $ | nindent 4 }}
+spec:
+  {{- if not (kindIs "invalid" .minAvailable) }}
+  minAvailable: {{ .minAvailable }}
+  {{- end }}
+  {{- if not (kindIs "invalid" .maxUnavailable) }}
+  maxUnavailable: {{ .maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" $ | nindent 6 }}
+{{- end }}
+{{- end }}
+
+{{- define "gateway.hpa" -}}
+{{- with .w.hpa }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $.name }}
+  namespace: {{ $.root.Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" $ | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ $.name }}
+  minReplicas: {{ required (printf "%s.hpa.minReplicas is required" $.name) .minReplicas }}
+  maxReplicas: {{ required (printf "%s.hpa.maxReplicas is required" $.name) .maxReplicas }}
+  {{- if not (kindIs "invalid" .targetCPUUtilizationPercentage) }}
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: {{ .targetCPUUtilizationPercentage }}
+  {{- end }}
+  {{- with .behavior }}
+  behavior:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,48 @@
+{{- range $name, $w := .Values.deployments }}
+{{- if not (kindIs "invalid" $w) }}
+{{- $ctx := dict "root" $ "name" $name "component" $w.role "w" $w }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" $ctx | nindent 4 }}
+spec:
+  {{- if not $w.hpa }}
+  replicas: {{ include "gateway.replicas" $ctx }}
+  {{- end }}
+  {{- if not (kindIs "invalid" $w.minReadySeconds) }}
+  minReadySeconds: {{ $w.minReadySeconds }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" $ctx | nindent 6 }}
+  {{- with include "gateway.pick" (dict "root" $ "w" $w "key" "strategy") }}
+  strategy:
+    {{- . | nindent 4 }}
+  {{- end }}
+  template:
+    {{- include "gateway.pod" $ctx | nindent 4 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: http
+  selector:
+    {{- include "gateway.selectorLabels" $ctx | nindent 4 }}
+{{- include "gateway.hpa" $ctx }}
+{{- include "gateway.pdb" $ctx }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.headlessName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" (dict "root" . "name" "gateway" "component" "discovery") | nindent 4 }}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: http
+  - name: epmd
+    port: 4369
+    protocol: TCP
+    targetPort: epmd
+  - name: erl-dist
+    port: 8081
+    protocol: TCP
+    targetPort: erl-dist
+  selector:
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: fluxer
@@ -0,0 +1,53 @@
+{{- $np := .Values.networkPolicy | default dict }}
+{{- if $np.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: gateway
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" (dict "root" . "name" "gateway") | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/part-of: fluxer
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - {}
+  ingress:
+  {{- with $np.ingressNamespace }}
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: {{ . }}
+    ports:
+    - port: 8080
+      protocol: TCP
+  {{- end }}
+  {{- with $np.clients }}
+  - from:
+    {{- range . }}
+    - podSelector:
+        matchLabels:
+          {{- toYaml . | nindent 10 }}
+    {{- end }}
+    ports:
+    - port: 8080
+      protocol: TCP
+  {{- end }}
+  - from:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/instance: {{ .Release.Name }}
+          app.kubernetes.io/part-of: fluxer
+    ports:
+    - port: 8080
+      protocol: TCP
+    - port: 4369
+      protocol: TCP
+    - port: 8081
+      protocol: TCP
+{{- end }}
@@ -0,0 +1,29 @@
+{{- range $name, $w := .Values.statefulsets }}
+{{- if not (kindIs "invalid" $w) }}
+{{- $ctx := dict "root" $ "name" $name "component" $w.role "w" $w }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" $ctx | nindent 4 }}
+spec:
+  replicas: {{ include "gateway.replicas" $ctx }}
+  {{- if not (kindIs "invalid" $w.minReadySeconds) }}
+  minReadySeconds: {{ $w.minReadySeconds }}
+  {{- end }}
+  serviceName: {{ include "gateway.headlessName" $ }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" $ctx | nindent 6 }}
+  {{- with include "gateway.pick" (dict "root" $ "w" $w "key" "updateStrategy") }}
+  updateStrategy:
+    {{- . | nindent 4 }}
+  {{- end }}
+  template:
+    {{- include "gateway.pod" $ctx | nindent 4 }}
+{{- include "gateway.pdb" $ctx }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,86 @@
+image:
+  registry: ghcr.io/fluxerapp
+  tag: v1
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+clusterDomain: cluster.local
+
+env:
+  FLUXER_ENV: production
+  FLUXER_GATEWAY_PORT: "8080"
+  FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: https://media.example.com
+  FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
+
+extraEnv: []
+
+envFrom:
+- secretRef:
+    name: fluxer-env
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+
+probes:
+  startup:
+    httpGet:
+      path: /_health
+      port: http
+    failureThreshold: 30
+  liveness:
+    httpGet:
+      path: /_health
+      port: http
+  readiness:
+    exec:
+      command:
+      - curl
+      - -fsS
+      - -o
+      - /dev/null
+      - --max-time
+      - "2"
+      - http://127.0.0.1:8080/_health/ready
+    timeoutSeconds: 3
+
+strategy: {}
+updateStrategy: {}
+
+topologySpreadConstraints: []
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+networkPolicy:
+  enabled: false
+  ingressNamespace: ingress-nginx
+  clients:
+  - app.kubernetes.io/part-of: fluxer
+
+deployments:
+  gateway:
+    role: all
+    replicas: 1
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - /bin/sh
+          - -c
+          - curl -fsS -o /dev/null --max-time 2 http://127.0.0.1:8080/_health/drain; sleep 5
+    resources:
+      requests:
+        cpu: 100m
+        memory: 384Mi
+      limits:
+        memory: 1Gi
+
+statefulsets: {}
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-infra
+description: NATS and Valkey for a Fluxer installation.
+type: application
+version: 0.1.0
+appVersion: "v1"
@@ -0,0 +1,282 @@
+{{- define "fluxer-infra.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "fluxer-infra.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "fluxer-infra.labels" -}}
+{{ include "fluxer-infra.selectorLabels" . }}
+app.kubernetes.io/component: {{ .component }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+helm.sh/chart: {{ include "fluxer-infra.chart" .root }}
+{{- end }}
+
+{{- define "fluxer-infra.pick" -}}
+{{- $v := get .root.Values .key }}
+{{- if hasKey .w .key }}
+{{- $v = get .w .key }}
+{{- end }}
+{{- with $v }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.string" -}}
+{{- if and (kindIs "float64" .) (eq . (float64 (int64 .))) }}
+{{- int64 . | toString }}
+{{- else }}
+{{- toString . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.envList" -}}
+{{- $env := deepCopy (.root.Values.env | default dict) }}
+{{- range $k, $v := .w.env | default dict }}
+{{- if kindIs "invalid" $v }}
+{{- $_ := unset $env $k }}
+{{- else }}
+{{- $_ := set $env $k $v }}
+{{- end }}
+{{- end }}
+{{- range $k, $v := $env }}
+{{- if not (kindIs "invalid" $v) }}
+- name: {{ $k }}
+  value: {{ include "fluxer-infra.string" $v | quote }}
+{{- end }}
+{{- end }}
+{{- with concat (.root.Values.extraEnv | default list) (.w.extraEnv | default list) }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.envFrom" -}}
+{{- with concat (.root.Values.envFrom | default list) (.w.envFrom | default list) }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.probes" -}}
+{{- $global := .root.Values.probes | default dict }}
+{{- $own := .w.probes | default dict }}
+{{- range $probe := list "startup" "liveness" "readiness" }}
+{{- $p := get $global $probe }}
+{{- if hasKey $own $probe }}
+{{- $p = get $own $probe }}
+{{- end }}
+{{- with $p }}
+{{ $probe }}Probe:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.topologySpreadConstraints" -}}
+{{- $out := list }}
+{{- range include "fluxer-infra.pick" (dict "root" .root "w" .w "key" "topologySpreadConstraints") | fromYamlArray }}
+{{- $c := deepCopy . }}
+{{- if not (hasKey $c "labelSelector") }}
+{{- $_ := set $c "labelSelector" (dict "matchLabels" (include "fluxer-infra.selectorLabels" $ | fromYaml)) }}
+{{- end }}
+{{- $out = append $out $c }}
+{{- end }}
+{{- with $out }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.replicas" -}}
+{{- if kindIs "invalid" .w.replicas }}1{{ else }}{{ .w.replicas }}{{ end }}
+{{- end }}
+
+{{- define "fluxer-infra.image" -}}
+{{- $ref := printf "%s:%s" .repository .tag }}
+{{- with .digest }}
+{{- $ref = printf "%s@%s" $ref . }}
+{{- end }}
+{{- $ref | quote }}
+{{- end }}
+
+{{- define "fluxer-infra.podAnnotations" -}}
+{{- with merge (deepCopy (.extra | default dict)) (deepCopy (.w.podAnnotations | default dict)) (deepCopy (.root.Values.podAnnotations | default dict)) }}
+annotations:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.podSpec" -}}
+{{- $root := .root }}
+{{- $w := .w }}
+{{- with include "fluxer-infra.pick" (dict "root" $root "w" $w "key" "affinity") }}
+affinity:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with include "fluxer-infra.pick" (dict "root" $root "w" $w "key" "imagePullSecrets") }}
+imagePullSecrets:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with include "fluxer-infra.pick" (dict "root" $root "w" $w "key" "nodeSelector") }}
+nodeSelector:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with include "fluxer-infra.pick" (dict "root" $root "w" $w "key" "tolerations") }}
+tolerations:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with include "fluxer-infra.topologySpreadConstraints" . }}
+topologySpreadConstraints:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with include "fluxer-infra.pick" (dict "root" $root "w" $w "key" "podSecurityContext") }}
+securityContext:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- if not (kindIs "invalid" $w.terminationGracePeriodSeconds) }}
+terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.containerCommon" -}}
+{{- $root := .root }}
+{{- $w := .w }}
+{{- $img := $w.image | default dict }}
+image: {{ include "fluxer-infra.image" $img }}
+imagePullPolicy: {{ $img.pullPolicy }}
+{{- $env := include "fluxer-infra.envList" . | trim }}
+{{- if or .env $env }}
+env:
+{{- with .env }}
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with $env }}
+  {{- . | nindent 2 }}
+{{- end }}
+{{- end }}
+{{- with include "fluxer-infra.envFrom" . }}
+envFrom:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with $w.lifecycle }}
+lifecycle:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- include "fluxer-infra.probes" . }}
+{{- with $w.resources }}
+resources:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with include "fluxer-infra.pick" (dict "root" $root "w" $w "key" "securityContext") }}
+securityContext:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- with concat .mounts ($w.extraVolumeMounts | default list) }}
+volumeMounts:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.statefulSetSpec" -}}
+{{- $w := .w }}
+{{- with include "fluxer-infra.pick" (dict "root" .root "w" $w "key" "updateStrategy") }}
+updateStrategy:
+  {{- . | nindent 2 }}
+{{- end }}
+{{- if not (kindIs "invalid" $w.minReadySeconds) }}
+minReadySeconds: {{ $w.minReadySeconds }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.volumeClaim" -}}
+- metadata:
+    name: data
+  spec:
+    accessModes:
+      - ReadWriteOnce
+    {{- with .storageClassName }}
+    storageClassName: {{ . | quote }}
+    {{- end }}
+    resources:
+      requests:
+        storage: {{ .size }}
+{{- end }}
+
+{{- define "fluxer-infra.pdb" -}}
+{{- with .w.pdb }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $.name }}-pdb
+  namespace: {{ $.root.Release.Namespace }}
+  labels:
+    {{- include "fluxer-infra.labels" $ | nindent 4 }}
+spec:
+  {{- if not (kindIs "invalid" .minAvailable) }}
+  minAvailable: {{ .minAvailable }}
+  {{- end }}
+  {{- if not (kindIs "invalid" .maxUnavailable) }}
+  maxUnavailable: {{ .maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-infra.selectorLabels" $ | nindent 6 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.service" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .svcName }}
+  namespace: {{ .root.Release.Namespace }}
+  labels:
+    {{- include "fluxer-infra.labels" . | nindent 4 }}
+spec:
+  {{- if .headless }}
+  clusterIP: None
+  {{- end }}
+  {{- if .publishNotReady }}
+  publishNotReadyAddresses: true
+  {{- end }}
+  selector:
+    {{- include "fluxer-infra.selectorLabels" . | nindent 4 }}
+  ports:
+    {{- range .ports }}
+    - name: {{ index . 0 }}
+      port: {{ index . 1 }}
+      targetPort: {{ index . 0 }}
+    {{- end }}
+{{- end }}
+
+{{- define "fluxer-infra.natsConf" -}}
+{{- $w := .Values.nats -}}
+{{- with $w.config -}}
+listen: 0.0.0.0:4222
+http: 0.0.0.0:8222
+max_payload: {{ .maxPayload }}
+max_pending: {{ .maxPending }}
+max_connections: {{ .maxConnections }}
+{{- if $w.jetstream.enabled }}
+server_name: $POD_NAME
+
+jetstream {
+  store_dir: /data
+}
+{{- end }}
+
+cluster {
+  name: {{ .clusterName }}
+  listen: 0.0.0.0:6222
+
+  routes = [
+{{- range $i := until (int (include "fluxer-infra.replicas" (dict "w" $w))) }}
+    nats-route://nats-{{ $i }}.nats-headless.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}:6222
+{{- end }}
+  ]
+}
+{{ end }}
+{{- end }}
@@ -0,0 +1,71 @@
+{{- with .Values.nats }}
+{{- $ctx := dict "root" $ "w" . "name" "nats" "component" "messaging" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nats-config
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-infra.labels" $ctx | nindent 4 }}
+data:
+  nats.conf: {{ include "fluxer-infra.natsConf" $ | toJson }}
+{{- include "fluxer-infra.pdb" $ctx }}
+{{- include "fluxer-infra.service" (merge (dict "svcName" "nats" "ports" (list (list "client" 4222))) $ctx) }}
+{{- include "fluxer-infra.service" (merge (dict "svcName" "nats-headless" "headless" true "ports" (list (list "client" 4222) (list "cluster" 6222) (list "monitor" 8222))) $ctx) }}
+{{- $mounts := list (dict "name" "config" "mountPath" "/etc/nats") }}
+{{- $env := list }}
+{{- if .jetstream.enabled }}
+{{- $mounts = append $mounts (dict "name" "data" "mountPath" "/data") }}
+{{- $env = append $env (dict "name" "POD_NAME" "valueFrom" (dict "fieldRef" (dict "fieldPath" "metadata.name"))) }}
+{{- end }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: nats
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-infra.labels" $ctx | nindent 4 }}
+spec:
+  replicas: {{ include "fluxer-infra.replicas" $ctx }}
+  serviceName: nats-headless
+  {{- with include "fluxer-infra.statefulSetSpec" $ctx | trim }}
+  {{- . | nindent 2 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-infra.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer-infra.labels" $ctx | nindent 8 }}
+      {{- with include "fluxer-infra.podAnnotations" (merge (dict "extra" (dict "checksum/config" (include "fluxer-infra.natsConf" $ | sha256sum))) $ctx) | trim }}
+      {{- . | nindent 6 }}
+      {{- end }}
+    spec:
+      {{- include "fluxer-infra.podSpec" $ctx | trim | nindent 6 }}
+      containers:
+        - name: nats
+          {{- include "fluxer-infra.containerCommon" (merge (dict "env" $env "mounts" $mounts) $ctx) | trim | nindent 10 }}
+          args:
+            - -c
+            - /etc/nats/nats.conf
+          ports:
+            - name: client
+              containerPort: 4222
+            - name: cluster
+              containerPort: 6222
+            - name: monitor
+              containerPort: 8222
+      volumes:
+        - name: config
+          configMap:
+            name: nats-config
+        {{- with .extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+  {{- if .jetstream.enabled }}
+  volumeClaimTemplates:
+    {{- include "fluxer-infra.volumeClaim" .jetstream.storage | nindent 4 }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,67 @@
+{{- with .Values.valkey }}
+{{- $ctx := dict "root" $ "w" . "name" "valkey" "component" "cache" }}
+{{- include "fluxer-infra.pdb" $ctx }}
+{{- include "fluxer-infra.service" (merge (dict "svcName" "valkey" "ports" (list (list "valkey" 6379))) $ctx) }}
+{{- include "fluxer-infra.service" (merge (dict "svcName" "valkey-headless" "headless" true "publishNotReady" true "ports" (list (list "valkey" 6379))) $ctx) }}
+{{- $mounts := list }}
+{{- if .persistence.enabled }}
+{{- $mounts = append $mounts (dict "name" "data" "mountPath" "/data") }}
+{{- end }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: valkey
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-infra.labels" $ctx | nindent 4 }}
+spec:
+  replicas: 1
+  serviceName: valkey-headless
+  {{- with include "fluxer-infra.statefulSetSpec" $ctx | trim }}
+  {{- . | nindent 2 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-infra.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer-infra.labels" $ctx | nindent 8 }}
+      {{- with include "fluxer-infra.podAnnotations" $ctx | trim }}
+      {{- . | nindent 6 }}
+      {{- end }}
+    spec:
+      {{- include "fluxer-infra.podSpec" $ctx | trim | nindent 6 }}
+      containers:
+        - name: valkey
+          {{- include "fluxer-infra.containerCommon" (merge (dict "env" list "mounts" $mounts) $ctx) | trim | nindent 10 }}
+          command:
+            - valkey-server
+            {{- if .persistence.enabled }}
+            - --appendonly
+            - "yes"
+            - --dir
+            - /data
+            {{- else }}
+            - --save
+            - ""
+            - --appendonly
+            - "no"
+            {{- end }}
+            - --maxmemory
+            - {{ .maxmemory | quote }}
+            - --maxmemory-policy
+            - {{ .maxmemoryPolicy | quote }}
+          ports:
+            - name: valkey
+              containerPort: 6379
+      {{- with .extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- if .persistence.enabled }}
+  volumeClaimTemplates:
+    {{- include "fluxer-infra.volumeClaim" .persistence | nindent 4 }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,108 @@
+imagePullSecrets: []
+
+clusterDomain: cluster.local
+
+env: {}
+
+extraEnv: []
+
+envFrom: []
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+
+probes: {}
+
+updateStrategy: {}
+
+topologySpreadConstraints: []
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+nats:
+  image:
+    repository: nats
+    tag: 2.14-alpine
+    pullPolicy: IfNotPresent
+  replicas: 3
+  config:
+    clusterName: nats
+    maxPayload: 1MB
+    maxPending: 64MB
+    maxConnections: 65536
+  jetstream:
+    enabled: true
+    storage:
+      size: 10Gi
+      storageClassName: ""
+  podSecurityContext:
+    fsGroup: 65534
+    runAsGroup: 65534
+    runAsNonRoot: true
+    runAsUser: 65534
+    seccompProfile:
+      type: RuntimeDefault
+  probes:
+    liveness:
+      httpGet:
+        path: /healthz
+        port: monitor
+      initialDelaySeconds: 10
+    readiness:
+      httpGet:
+        path: /healthz?js-enabled-only=true
+        port: monitor
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      memory: 512Mi
+
+valkey:
+  image:
+    repository: valkey/valkey
+    tag: 9.1-alpine
+    pullPolicy: IfNotPresent
+  maxmemory: 192mb
+  maxmemoryPolicy: noeviction
+  persistence:
+    enabled: true
+    size: 1Gi
+    storageClassName: ""
+  podSecurityContext:
+    fsGroup: 999
+    runAsGroup: 999
+    runAsNonRoot: true
+    runAsUser: 999
+    seccompProfile:
+      type: RuntimeDefault
+  probes:
+    liveness:
+      exec:
+        command:
+          - valkey-cli
+          - ping
+      initialDelaySeconds: 10
+    readiness:
+      exec:
+        command:
+          - valkey-cli
+          - ping
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-ingress
+description: Ingress routing for the public Fluxer endpoints.
+type: application
+version: 0.1.0
+appVersion: "v1"
@@ -0,0 +1,27 @@
+{{- define "fluxer-ingress.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "fluxer-ingress.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ include "fluxer-ingress.chart" . }}
+{{- end }}
+
+{{- define "fluxer-ingress.annotationKey" -}}
+{{- if or (contains "/" .key) (not .prefix) -}}
+{{- .key -}}
+{{- else -}}
+{{- printf "%s/%s" .prefix .key -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-ingress.string" -}}
+{{- if and (kindIs "float64" .) (eq . (floor .)) -}}
+{{- . | int64 | toString -}}
+{{- else -}}
+{{- . | toString -}}
+{{- end -}}
+{{- end }}
@@ -0,0 +1,20 @@
+{{- with .Values.clusterIssuer }}
+{{- if .enabled }}
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ required "clusterIssuer.name is required" .name }}
+  labels:
+    {{- include "fluxer-ingress.labels" $ | nindent 4 }}
+spec:
+  acme:
+    email: {{ required "clusterIssuer.email is required" .email | quote }}
+    privateKeySecretRef:
+      name: {{ required "clusterIssuer.privateKeySecretName is required" .privateKeySecretName }}
+    server: {{ required "clusterIssuer.server is required" .server }}
+    solvers:
+      - http01:
+          ingress:
+            class: {{ required "clusterIssuer.solverIngressClass is required" .solverIngressClass }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,58 @@
+{{- $v := .Values }}
+{{- $presets := $v.annotationPresets | default dict }}
+{{- $issuer := $v.clusterIssuer | default dict }}
+{{- range $name, $spec := ($v.ingresses | default dict) }}
+{{- if not (kindIs "invalid" $spec) }}
+{{- $ann := deepCopy ($v.commonAnnotations | default dict) }}
+{{- range ($spec.presets | default list) }}
+{{- $ann = mergeOverwrite $ann (deepCopy (required (printf "unknown annotation preset %s" .) (index $presets .))) }}
+{{- end }}
+{{- if and $spec.tls $issuer.enabled }}
+{{- $_ := set $ann "cert-manager.io/cluster-issuer" (required "clusterIssuer.name is required" $issuer.name) }}
+{{- end }}
+{{- $ann = mergeOverwrite $ann (deepCopy ($spec.annotations | default dict)) }}
+{{- range $k, $val := $ann }}
+{{- if kindIs "invalid" $val }}
+{{- $_ := unset $ann $k }}
+{{- end }}
+{{- end }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-ingress.labels" $ | nindent 4 }}
+  {{- with $ann }}
+  annotations:
+    {{- range $k, $val := . }}
+    {{ include "fluxer-ingress.annotationKey" (dict "key" $k "prefix" $v.annotationPrefix) }}: {{ include "fluxer-ingress.string" $val | quote }}
+    {{- end }}
+  {{- end }}
+spec:
+  {{- with $spec.ingressClassName | default $v.ingressClassName }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with $spec.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range $rule := required (printf "ingress %s needs rules" $name) $spec.rules }}
+    - host: {{ required (printf "ingress %s has a rule without a host" $name) $rule.host | quote }}
+      http:
+        paths:
+          {{- range $p := $rule.paths | default (list dict) }}
+          {{- $p = $p | default dict }}
+          - path: {{ $p.path | default "/" | quote }}
+            pathType: {{ $p.pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ required (printf "ingress %s host %s needs a service" $name $rule.host) ($p.service | default $rule.service) }}
+                port:
+                  number: {{ required (printf "ingress %s host %s needs a port or servicePort" $name $rule.host) ($p.port | default $rule.port | default $v.servicePort) | int64 }}
+          {{- end }}
+    {{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,53 @@
+ingressClassName: nginx
+annotationPrefix: nginx.ingress.kubernetes.io
+servicePort: 8080
+
+commonAnnotations: {}
+
+annotationPresets:
+  websocket:
+    proxy-read-timeout: "3600"
+    proxy-send-timeout: "3600"
+  stripPrefix:
+    use-regex: "true"
+    rewrite-target: /$2
+
+ingresses:
+  fluxer:
+    rules:
+      - host: web.example.com
+        service: app-proxy
+      - host: api.example.com
+        service: api
+      - host: admin.example.com
+        service: admin
+      - host: media.example.com
+        service: media-proxy
+  fluxer-web-api:
+    presets: [stripPrefix]
+    rules:
+      - host: web.example.com
+        service: api
+        paths:
+          - path: /api(/(.*))?$
+            pathType: ImplementationSpecific
+  fluxer-gateway:
+    presets: [websocket]
+    rules:
+      - host: gateway.example.com
+        service: gateway
+  fluxer-uploads:
+    annotations:
+      proxy-body-size: 100m
+      proxy-request-buffering: "off"
+    rules:
+      - host: uploads.example.com
+        service: uploads
+
+clusterIssuer:
+  enabled: false
+  name: letsencrypt
+  email: ""
+  server: https://acme-v02.api.letsencrypt.org/directory
+  privateKeySecretName: letsencrypt-account-key
+  solverIngressClass: nginx
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-media-proxy
+description: Fluxer media proxy and upload relay workloads.
+type: application
+version: 0.1.0
+appVersion: "v1"
@@ -0,0 +1,87 @@
+{{- define "fluxer-media-proxy.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "fluxer-media-proxy.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "fluxer-media-proxy.labels" -}}
+{{ include "fluxer-media-proxy.selectorLabels" . }}
+app.kubernetes.io/component: {{ include "fluxer-media-proxy.mode" . }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+helm.sh/chart: {{ include "fluxer-media-proxy.chart" .root }}
+{{- end }}
+
+{{- define "fluxer-media-proxy.image" -}}
+{{- $g := .root.Values.image -}}
+{{- $i := .w.image | default dict -}}
+{{- $repo := $i.repository | default (printf "%s/%s" $g.registry ($i.name | default "fluxer-media-proxy")) -}}
+{{- $tag := $i.tag | default $g.tag -}}
+{{- if $i.digest -}}
+{{- printf "%s:%s@%s" $repo $tag $i.digest | quote -}}
+{{- else -}}
+{{- printf "%s:%s" $repo $tag | quote -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-media-proxy.pick" -}}
+{{- $v := ternary (get .w .key) (get .root.Values .key) (hasKey .w .key) -}}
+{{- if $v }}
+{{- toYaml $v }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer-media-proxy.mode" -}}
+{{- $mode := required (printf "workloads.%s.mode is required" .name) .w.mode -}}
+{{- if not (has $mode (list "mp" "static" "upload" "relay")) -}}
+{{- fail (printf "workloads.%s.mode must be mp, static, upload or relay" .name) -}}
+{{- end -}}
+{{- $mode -}}
+{{- end }}
+
+{{- define "fluxer-media-proxy.envValue" -}}
+{{- if and (kindIs "float64" .) (eq . (float64 (int64 .))) -}}
+{{- int64 . | toString -}}
+{{- else -}}
+{{- toString . -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-media-proxy.mergeEnv" -}}
+{{- $out := dict -}}
+{{- range $layer := . -}}
+{{- range $k, $v := ($layer | default dict) -}}
+{{- if kindIs "invalid" $v -}}
+{{- $_ := unset $out $k -}}
+{{- else -}}
+{{- $_ := set $out $k $v -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end }}
+
+{{- define "fluxer-media-proxy.topologySpreadConstraints" -}}
+{{- $out := list -}}
+{{- range .constraints -}}
+{{- if .labelSelector -}}
+{{- $out = append $out . -}}
+{{- else -}}
+{{- $out = append $out (merge (dict "labelSelector" (dict "matchLabels" $.selector)) .) -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end }}
+
+{{- define "fluxer-media-proxy.pdb" -}}
+{{- $out := dict -}}
+{{- range $k := list "minAvailable" "maxUnavailable" -}}
+{{- if and (hasKey $ $k) (not (kindIs "invalid" (index $ $k))) -}}
+{{- $_ := set $out $k (index $ $k) -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end }}
@@ -0,0 +1,191 @@
+{{- range $name, $w := .Values.workloads }}
+{{- if not (kindIs "invalid" $w) }}
+{{- $ctx := dict "root" $ "name" $name "w" $w }}
+{{- $mode := include "fluxer-media-proxy.mode" $ctx }}
+{{- $sel := include "fluxer-media-proxy.selectorLabels" $ctx | fromYaml }}
+{{- $env := include "fluxer-media-proxy.mergeEnv" (list $.Values.env $w.env) | fromYaml }}
+{{- $extraEnv := concat ($.Values.extraEnv | default list) ($w.extraEnv | default list) }}
+{{- $envFrom := concat ($.Values.envFrom | default list) ($w.envFrom | default list) }}
+{{- $podAnnotations := merge (dict) ($w.podAnnotations | default dict) ($.Values.podAnnotations | default dict) }}
+{{- $probes := dict }}
+{{- range $k, $v := ($.Values.probes | default dict) }}
+{{- $_ := set $probes $k $v }}
+{{- end }}
+{{- range $k, $v := ($w.probes | default dict) }}
+{{- $_ := set $probes $k $v }}
+{{- end }}
+{{- $pick := dict "root" $ "w" $w }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-media-proxy.labels" $ctx | nindent 4 }}
+spec:
+  {{- if not $w.hpa }}
+  replicas: {{ ternary $w.replicas 1 (hasKey $w "replicas") | int64 }}
+  {{- end }}
+  {{- if not (kindIs "invalid" $w.minReadySeconds) }}
+  minReadySeconds: {{ $w.minReadySeconds | int64 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- toYaml $sel | nindent 6 }}
+  {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "strategy") }}
+  strategy:
+    {{- . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      {{- with $podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "fluxer-media-proxy.labels" $ctx | nindent 8 }}
+    spec:
+      {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "imagePullSecrets") }}
+      imagePullSecrets:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "podSecurityContext") }}
+      securityContext:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- if not (kindIs "invalid" $w.terminationGracePeriodSeconds) }}
+      terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds | int64 }}
+      {{- end }}
+      {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "nodeSelector") }}
+      nodeSelector:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "tolerations") }}
+      tolerations:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "affinity") }}
+      affinity:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "topologySpreadConstraints") | fromYamlArray }}
+      topologySpreadConstraints:
+        {{- include "fluxer-media-proxy.topologySpreadConstraints" (dict "constraints" . "selector" $sel) | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ $name }}
+          image: {{ include "fluxer-media-proxy.image" $ctx }}
+          imagePullPolicy: {{ ($w.image | default dict).pullPolicy | default $.Values.image.pullPolicy }}
+          env:
+            {{- if not (kindIs "invalid" $w.buildVersion) }}
+            - name: BUILD_VERSION
+              value: {{ include "fluxer-media-proxy.envValue" $w.buildVersion | quote }}
+            {{- end }}
+            - name: FLUXER_MEDIA_PROXY_MODE
+              value: {{ $mode | quote }}
+            {{- range $k, $v := $env }}
+            - name: {{ $k }}
+              value: {{ include "fluxer-media-proxy.envValue" $v | quote }}
+            {{- end }}
+            {{- with $extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with $envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          {{- with $w.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- range $k := list "startup" "liveness" "readiness" }}
+          {{- with get $probes $k }}
+          {{ $k }}Probe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          {{- with $w.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with include "fluxer-media-proxy.pick" (set (deepCopy $pick) "key" "securityContext") }}
+          securityContext:
+            {{- . | nindent 12 }}
+          {{- end }}
+          {{- with $w.extraVolumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with $w.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-media-proxy.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- toYaml $sel | nindent 4 }}
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+{{- with include "fluxer-media-proxy.pdb" ($w.pdb | default dict) | fromYaml }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $name }}-pdb
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-media-proxy.labels" $ctx | nindent 4 }}
+spec:
+  {{- toYaml . | nindent 2 }}
+  selector:
+    matchLabels:
+      {{- toYaml $sel | nindent 6 }}
+{{- end }}
+{{- with $w.hpa }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-media-proxy.labels" $ctx | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ $name }}
+  minReplicas: {{ required (printf "workloads.%s.hpa.minReplicas is required" $name) .minReplicas | int64 }}
+  maxReplicas: {{ required (printf "workloads.%s.hpa.maxReplicas is required" $name) .maxReplicas | int64 }}
+  {{- if not (kindIs "invalid" .targetCPUUtilizationPercentage) }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .targetCPUUtilizationPercentage | int64 }}
+  {{- end }}
+  {{- with .behavior }}
+  behavior:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,72 @@
+image:
+  registry: ghcr.io/fluxerapp
+  tag: v1
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+env: {}
+
+extraEnv: []
+
+envFrom:
+  - secretRef:
+      name: fluxer-env
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+probes:
+  liveness:
+    httpGet:
+      path: /_health
+      port: http
+  readiness:
+    httpGet:
+      path: /_health
+      port: http
+
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 25%
+    maxUnavailable: 25%
+
+topologySpreadConstraints: []
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+workloads:
+  media-proxy:
+    mode: mp
+    replicas: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        memory: 1Gi
+
+  uploads:
+    mode: relay
+    replicas: 1
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        memory: 512Mi
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-push
+description: Fluxer push notification delivery service
+type: application
+version: 0.1.0
+appVersion: "v1"
@@ -0,0 +1,71 @@
+{{- define "fluxer-push.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "fluxer-push.labels" -}}
+{{ include "fluxer-push.selectorLabels" . }}
+app.kubernetes.io/component: {{ include "fluxer-push.mode" . }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .root.Chart.Name .root.Chart.Version | replace "+" "_" }}
+{{- end }}
+
+{{- define "fluxer-push.mode" -}}
+{{- $mode := .w.mode | default "delivery" -}}
+{{- if not (has $mode (list "delivery" "relay")) -}}
+{{- fail (printf "workloads.%s.mode must be delivery or relay" .name) -}}
+{{- end -}}
+{{- $mode -}}
+{{- end }}
+
+{{- define "fluxer-push.port" -}}
+{{- .w.port | default (ternary 8127 8126 (eq (include "fluxer-push.mode" .) "relay")) -}}
+{{- end }}
+
+{{- define "fluxer-push.image" -}}
+{{- $global := .root.Values.image | default dict -}}
+{{- $img := .w.image | default dict -}}
+{{- $repo := $img.repository -}}
+{{- if not $repo -}}
+{{- $repo = printf "%s/%s" (required "image.registry is required" $global.registry) ($img.name | default "fluxer-push") -}}
+{{- end -}}
+{{- $ref := printf "%s:%s" $repo (include "fluxer-push.string" (required "image.tag is required" ($img.tag | default $global.tag))) -}}
+{{- with $img.digest }}{{ $ref = printf "%s@%s" $ref . }}{{ end -}}
+{{- $ref -}}
+{{- end }}
+
+{{- define "fluxer-push.string" -}}
+{{- if and (kindIs "float64" .) (eq . (floor .)) -}}
+{{- . | int64 | toString -}}
+{{- else -}}
+{{- . | toString -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-push.env" -}}
+{{- $env := deepCopy (.root.Values.env | default dict) -}}
+{{- range $k, $v := (.w.env | default dict) -}}
+{{- if kindIs "invalid" $v -}}
+{{- $_ := unset $env $k -}}
+{{- else -}}
+{{- $_ := set $env $k $v -}}
+{{- end -}}
+{{- end -}}
+{{- if not (kindIs "invalid" .w.port) -}}
+{{- $_ := set $env "FLUXER_PUSH_SERVICE_PORT" .w.port -}}
+{{- end -}}
+{{- if not (kindIs "invalid" .w.buildVersion) }}
+- name: BUILD_VERSION
+  value: {{ include "fluxer-push.string" .w.buildVersion | quote }}
+{{- end }}
+{{- range $k, $v := $env }}
+{{- if not (kindIs "invalid" $v) }}
+- name: {{ $k }}
+  value: {{ include "fluxer-push.string" $v | quote }}
+{{- end }}
+{{- end }}
+{{- with concat (.root.Values.extraEnv | default list) (.w.extraEnv | default list) }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,205 @@
+{{- range $name, $w := .Values.workloads }}
+{{- if not (kindIs "invalid" $w) }}
+{{- $ctx := dict "root" $ "name" $name "w" $w }}
+{{- $mode := include "fluxer-push.mode" $ctx }}
+{{- $port := include "fluxer-push.port" $ctx | int }}
+{{- $globalProbes := $.Values.probes | default dict }}
+{{- $workloadProbes := $w.probes | default dict }}
+{{- $probes := dict }}
+{{- range $probe := list "startup" "liveness" "readiness" }}
+{{- $_ := set $probes $probe (ternary (index $workloadProbes $probe) (index $globalProbes $probe) (hasKey $workloadProbes $probe)) }}
+{{- end }}
+{{- $annotations := mergeOverwrite (deepCopy ($.Values.podAnnotations | default dict)) (deepCopy ($w.podAnnotations | default dict)) }}
+{{- $pullSecrets := ternary $w.imagePullSecrets $.Values.imagePullSecrets (hasKey $w "imagePullSecrets") }}
+{{- $podSecurityContext := ternary $w.podSecurityContext $.Values.podSecurityContext (hasKey $w "podSecurityContext") }}
+{{- $securityContext := ternary $w.securityContext $.Values.securityContext (hasKey $w "securityContext") }}
+{{- $strategy := ternary $w.strategy $.Values.strategy (hasKey $w "strategy") }}
+{{- $tsc := ternary $w.topologySpreadConstraints $.Values.topologySpreadConstraints (hasKey $w "topologySpreadConstraints") }}
+{{- $nodeSelector := ternary $w.nodeSelector $.Values.nodeSelector (hasKey $w "nodeSelector") }}
+{{- $tolerations := ternary $w.tolerations $.Values.tolerations (hasKey $w "tolerations") }}
+{{- $affinity := ternary $w.affinity $.Values.affinity (hasKey $w "affinity") }}
+{{- $envFrom := concat ($.Values.envFrom | default list) ($w.envFrom | default list) }}
+{{- $env := include "fluxer-push.env" $ctx }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-push.labels" $ctx | nindent 4 }}
+spec:
+  {{- if not $w.hpa }}
+  replicas: {{ ternary $w.replicas 1 (hasKey $w "replicas") | int }}
+  {{- end }}
+  {{- if hasKey $w "minReadySeconds" }}
+  minReadySeconds: {{ $w.minReadySeconds | int }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-push.selectorLabels" $ctx | nindent 6 }}
+  {{- with $strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      {{- with $annotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "fluxer-push.labels" $ctx | nindent 8 }}
+    spec:
+      {{- with $pullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if hasKey $w "terminationGracePeriodSeconds" }}
+      terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds | int }}
+      {{- end }}
+      {{- with $nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $tsc }}
+      topologySpreadConstraints:
+        {{- range . }}
+        {{- $c := deepCopy . }}
+        {{- if not $c.labelSelector }}
+        {{- $_ := set $c "labelSelector" (dict "matchLabels" (include "fluxer-push.selectorLabels" $ctx | fromYaml)) }}
+        {{- end }}
+        {{- toYaml (list $c) | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: {{ $name }}
+          image: {{ include "fluxer-push.image" $ctx | quote }}
+          imagePullPolicy: {{ ($w.image | default dict).pullPolicy | default ($.Values.image | default dict).pullPolicy | default "IfNotPresent" }}
+          command:
+            - /usr/local/bin/fluxer-push
+          {{- if eq $mode "relay" }}
+          args:
+            - --mode
+            - relay
+          {{- end }}
+          {{- with trim $env }}
+          env:
+            {{- . | nindent 12 }}
+          {{- end }}
+          {{- with $envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ $port }}
+              protocol: TCP
+          {{- with $probes.startup }}
+          startupProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $probes.liveness }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $probes.readiness }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $w.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $w.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $w.extraVolumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with $w.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-push.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer-push.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ $port }}
+      protocol: TCP
+      targetPort: http
+{{- with $w.pdb }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $name }}-pdb
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-push.labels" $ctx | nindent 4 }}
+spec:
+  {{- toYaml . | nindent 2 }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-push.selectorLabels" $ctx | nindent 6 }}
+{{- end }}
+{{- with $w.hpa }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-push.labels" $ctx | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ $name }}
+  minReplicas: {{ required (printf "workloads.%s.hpa.minReplicas is required" $name) .minReplicas | int }}
+  maxReplicas: {{ required (printf "workloads.%s.hpa.maxReplicas is required" $name) .maxReplicas | int }}
+  {{- if not (kindIs "invalid" .targetCPUUtilizationPercentage) }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .targetCPUUtilizationPercentage | int }}
+  {{- end }}
+  {{- with .behavior }}
+  behavior:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,65 @@
+image:
+  registry: ghcr.io/fluxerapp
+  tag: v1
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+env: {}
+
+extraEnv: []
+
+envFrom:
+  - secretRef:
+      name: fluxer-env
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+probes:
+  liveness:
+    httpGet:
+      path: /_healthz
+      port: http
+  readiness:
+    httpGet:
+      path: /_healthz
+      port: http
+
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 25%
+    maxUnavailable: 25%
+
+topologySpreadConstraints: []
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+workloads:
+  push:
+    mode: delivery
+    replicas: 1
+    env:
+      FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
+      FLUXER_SVC_NATS_URL: nats://nats:4222
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        memory: 256Mi
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-svc
+description: Fluxer internal services, each a router Deployment and a shard StatefulSet
+type: application
+version: 0.1.0
+appVersion: v1
--- a/Show More
+++ b/Show More