feat(setup): add a setup token for first-run setup (#3437 )

feat(deploy): add a complete fluxer helm chart (#3436 )
fix(app): lock out Dark Reader on the app and docs (#3435 )
2026-10-22 07:24:30 +09:00 · 2026-10-13 00:17:24 +02:00 · 2026-10-13 00:03:55 +02:00 · 2026-10-12 23:58:09 +02:00 · 2026-10-12 21:39:10 +02:00 · 2026-10-12 20:30:16 +02:00
7472 changed files with 838593 additions and 8150332 deletions
@@ -23,13 +23,11 @@ services:
      FLUXER_S3_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_LIVEKIT_URL: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/livekit"
      FLUXER_LIVEKIT_INTERNAL_URL: "http://livekit:7880"
-      FLUXER_LIVEKIT_WEBHOOK_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api/webhooks/livekit"
      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_ADMIN_OAUTH_REDIRECT_URI: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin/oauth2_callback"
      FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: "http://localhost,http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
-      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
    volumes:
      - ..:/workspaces/fluxer:cached
      - type: volume
@@ -87,11 +85,6 @@ services:
        target: /workspaces/fluxer/packages/hono/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: package-hono-types-node-modules
-        target: /workspaces/fluxer/packages/hono_types/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: package-i18n-node-modules
        target: /workspaces/fluxer/packages/i18n/node_modules
@@ -167,21 +160,11 @@ services:
        target: /workspaces/fluxer/fluxer_api/pkgs/http_client/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-api-initialization-node-modules
-        target: /workspaces/fluxer/fluxer_api/pkgs/initialization/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-api-kv-client-node-modules
        target: /workspaces/fluxer/fluxer_api/pkgs/kv_client/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-api-locale-node-modules
-        target: /workspaces/fluxer/fluxer_api/pkgs/locale/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-api-media-proxy-utils-node-modules
        target: /workspaces/fluxer/fluxer_api/pkgs/media_proxy_utils/node_modules
@@ -202,11 +185,6 @@ services:
        target: /workspaces/fluxer/fluxer_api/pkgs/rate_limit/node_modules
        volume:
          nocopy: true
-      - type: volume
-        source: fluxer-api-sms-node-modules
-        target: /workspaces/fluxer/fluxer_api/pkgs/sms/node_modules
-        volume:
-          nocopy: true
      - type: volume
        source: fluxer-api-virus-scan-node-modules
        target: /workspaces/fluxer/fluxer_api/pkgs/virus_scan/node_modules
@@ -361,7 +339,6 @@ volumes:
  package-errors-node-modules:
  package-geo-utils-node-modules:
  package-hono-node-modules:
-  package-hono-types-node-modules:
  package-i18n-node-modules:
  package-instance-bootstrap-node-modules:
  package-ip-utils-node-modules:
@@ -377,14 +354,11 @@ volumes:
  fluxer-api-email-node-modules:
  fluxer-api-geoip-node-modules:
  fluxer-api-http-client-node-modules:
-  fluxer-api-initialization-node-modules:
  fluxer-api-kv-client-node-modules:
-  fluxer-api-locale-node-modules:
  fluxer-api-media-proxy-utils-node-modules:
  fluxer-api-mime-utils-node-modules:
  fluxer-api-nats-node-modules:
  fluxer-api-rate-limit-node-modules:
-  fluxer-api-sms-node-modules:
  fluxer-api-virus-scan-node-modules:
  fluxer-api-worker-node-modules:
  fluxer-app-list-utils-node-modules:
@@ -38,6 +38,9 @@
 /fluxer_app/src/features/theme/styles/generated/
 /fluxer_app/src/features/ui/components/SVGMasks.tsx
 /fluxer_app/src/features/ui/constants/AvatarStatusGeometry.ts
+/fluxer_static/desktop/spellcheck/dictionaries/*/*
+!/fluxer_static/desktop/spellcheck/dictionaries/[email protected]/LICENSE
+!/fluxer_static/desktop/spellcheck/dictionaries/[email protected]/LICENSE
 /fluxer_gateway/priv/

 /fluxer_media_proxy/fuzz/artifacts/
@@ -45,11 +48,10 @@
 /packages/markdown_parser/rust/fuzz/artifacts/
 /packages/markdown_parser/rust/fuzz/corpus/

-/fluxer_media_proxy/.benchmark-cache/
-/fluxer_media_proxy/bench-results/
-
 /app-dist-output/
 /artifacts/
+/desktop-shared-assets/
+/desktop-modules/
 /s3_payload/
 /upload_staging/

@@ -9,6 +9,33 @@ max_line_length = 120
 indent_style = tab
 indent_size = 2

+[*.rs]
+indent_style = space
+indent_size = 4
+max_line_length = 100
+
+[*.{erl,hrl,app.src,escript}]
+indent_style = space
+indent_size = 4
+max_line_length = 96
+
+[fluxer_gateway/{rebar.config,elvis.config,.erlfmt}]
+indent_style = space
+indent_size = 4
+max_line_length = 96
+
+[*.{c,h,py}]
+indent_style = space
+indent_size = 4
+
+[fluxer_app/rust/libfluxwebp/**.{c,h}]
+indent_style = space
+indent_size = 2
+
+[*.{md,mdx,proto,tpl}]
+indent_style = space
+indent_size = 2
+
 [*.{yml,yaml,Dockerfile}]
 indent_style = space
 indent_size = 2
@@ -1,4 +1,12 @@
 * text=auto
 fluxer_static/** -text -diff
 fluxer_static/**/*.md text diff
+fluxer_static/*.sh text eol=lf diff
+fluxer_static/*.sha256 text eol=lf diff
 packages/fonts/files/** -text -diff
+fluxer_app/src/features/voice/utils/noise_suppression/deepfilternet3/*.wasm -text -diff
+fluxer_app/src/features/voice/utils/noise_suppression/deepfilternet3/*.tar.gz -text -diff
+fluxer_app/src/features/i18n/locales/** linguist-generated
+**/weblate/locales/** linguist-generated
+fluxer_api/src/api/openapi/openapi.json linguist-generated
+fluxer_admin/openapi-admin.json linguist-generated
@@ -1,24 +1,24 @@
 # Contributing to Fluxer

-This policy applies to all issues, discussions, commits and pull requests.
+This policy applies to all commits and pull requests.

 ## Scope

 To prevent spam, only approved contributors may submit pull requests.

-To request approval, comment on an existing issue and ask to implement it. For work that extends beyond a defect fix, open a [discussion](https://github.com/orgs/fluxerapp/discussions) first.
+To request approval, comment on the [feedback.fluxer.com](https://feedback.fluxer.com) post you want to implement and ask to work on it. For work that extends beyond a defect fix, post a feature request there first.

 Every pull request must:

 - Target the repository's default branch.
- Include a closing reference for each repository issue it resolves.
+- Link each feedback.fluxer.com post it resolves.
 - Receive approval from a maintainer before it is merged.

-Place each closing reference on a separate line:
+Place each link on a separate line:

 ```text
-Closes #123
-Closes #456
+Resolves https://feedback.fluxer.com/p/123
+Resolves https://feedback.fluxer.com/p/456
 ```

 ## Authorship
@@ -78,11 +78,11 @@ Complete every section of the pull request template. Clearly describe:

 ## Reports and other contributions

-Use the [bug report form](https://github.com/fluxerapp/fluxer/issues/new?template=bug-report.yaml) to report reproducible defects.
+Report bugs and request features at [feedback.fluxer.com](https://feedback.fluxer.com).

-Report security vulnerabilities privately through the channels specified in the [security policy](https://github.com/fluxerapp/fluxer/blob/main/.github/SECURITY.md). Do not report vulnerabilities in public issues or discussions.
+Report security vulnerabilities privately through [fluxer.app/security](https://fluxer.app/security). Never post them publicly.

-Use [discussions](https://github.com/orgs/fluxerapp/discussions) for feature proposals and self-hosting questions.
+Read the [operator documentation](https://fluxer.dev) for self-hosting questions.

 Submit translations through [Weblate](https://weblate.fluxer.tools), not through pull requests.

@@ -1,41 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-discussion.json
-
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Search existing discussions before posting a feature proposal.
-
-        Report vulnerabilities through the [private form](https://github.com/fluxerapp/fluxer/security/advisories/new) or <[email protected]>.
-
-  - type: textarea
-    id: problem
-    attributes:
-      label: Current problem
-      description: State what you are trying to do and what prevents it.
-    validations:
-      required: true
-
-  - type: textarea
-    id: proposal
-    attributes:
-      label: Proposed change
-      description: State the expected behaviour.
-    validations:
-      required: true
-
-  - type: textarea
-    id: notes
-    attributes:
-      label: Additional information
-      description: Optional. Include constraints, trade-offs, related discussions, screenshots or mockups.
-    validations:
-      required: false
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Acknowledgements
-      options:
-        - label: I searched existing discussions.
-          required: true
@@ -16,4 +16,10 @@ Every commit made by a contributor must include the [Developer Certificate of Or

 ## Name and marks

-The AGPL does not grant permission to use the Fluxer name, logo or other branding. Forks must use a distinct name and branding unless Fluxer Platform AB grants permission otherwise.
+Fluxer and the Fluxer logo are trademarks of Fluxer Platform AB. Neither the AGPL nor the CC BY-SA 4.0 licence on Fluxer artwork grants trademark rights. Fluxer Platform AB grants everyone the following permissions.
+
+- You may distribute unmodified builds of Fluxer, or builds with light patches, under the Fluxer name and logo. Light patches are changes for packaging, portability, security and bug fixes, configuration defaults and translations. Linux distributions, nixpkgs, Flathub and container images are all covered.
+- A self-hosted instance running such a build may show the Fluxer name and logo under the instance's own name and domain, as long as it does not imply affiliation with or endorsement by Fluxer Platform AB.
+- You may refer to Fluxer by name to describe compatibility, for example "works with Fluxer".
+
+Forks with substantive functional changes must use their own name and logo. Any other use needs permission from Fluxer Platform AB. Contact support@fluxer.com.
@@ -1,83 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-issue-forms.json
-name: Bug report
-description: Report a reproducible defect in Fluxer.
-type: Bug
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Search [open and closed issues](https://github.com/fluxerapp/fluxer/issues?q=is%3Aissue) before filing a report.
-
-        Report vulnerabilities through the [private form](https://github.com/fluxerapp/fluxer/security/advisories/new) or <[email protected]>. Send account and billing requests to <[email protected]>.
-
-  - type: textarea
-    id: summary
-    attributes:
-      label: Observed behaviour
-      description: State what happened and what you expected.
-    validations:
-      required: true
-
-  - type: textarea
-    id: steps
-    attributes:
-      label: Reproduction steps
-      description: Give numbered steps starting from a fresh app or session.
-      placeholder: |
-        1. Go to ...
-        2. Select ...
-        3. Observe ...
-    validations:
-      required: true
-
-  - type: input
-    id: build
-    attributes:
-      label: Build information
-      description: >-
-        Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard.
-    validations:
-      required: true
-
-  - type: dropdown
-    id: surface
-    attributes:
-      label: Affected surface
-      multiple: true
-      options:
-        - Desktop app
-        - Web app
-        - Voice, video, or Go Live
-        - Self-hosted instance
-        - HTTP API or Gateway
-        - Documentation site
-    validations:
-      required: true
-
-  - type: input
-    id: instance
-    attributes:
-      label: Instance
-      description: For a self-hosted instance, include the release tag and database backend.
-      placeholder: fluxer.app
-    validations:
-      required: false
-
-  - type: textarea
-    id: evidence
-    attributes:
-      label: Evidence
-      description: Attach relevant logs, screenshots or recordings. Remove tokens, keys, private messages and other personal data. Configuration files may contain secrets.
-    validations:
-      required: false
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Acknowledgements
-      options:
-        - label: I searched open and closed issues.
-          required: true
-        - label: I removed secrets and unrelated personal data from the report.
-          required: true
@@ -1,18 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
-blank_issues_enabled: false
-contact_links:
-  - name: Mobile client bugs
-    url: https://github.com/fluxerapp/flutter_client#bug-reporting
-    about: Read the reporting instructions for the Fluxer mobile client.
-  - name: Account and billing support
-    url: https://fluxer.app/help
-    about: Find account help and support contact details.
-  - name: Feature proposals
-    url: https://github.com/orgs/fluxerapp/discussions
-    about: Propose a feature in a discussion.
-  - name: Translations
-    url: https://weblate.fluxer.tools
-    about: Improve an existing locale or start a new one.
-  - name: Self-hosting support
-    url: https://fluxer.dev
-    about: Read the operator documentation, then open a discussion if the problem remains.
@@ -1,44 +0,0 @@
-# yaml-language-server: $schema=https://www.schemastore.org/github-issue-forms.json
-name: Documentation
-description: Report incorrect, missing or unclear documentation.
-type: Task
-labels:
-  - docs
-body:
-  - type: markdown
-    attributes:
-      value: |
-        This form covers <https://fluxer.dev> and operator documentation.
-
-  - type: textarea
-    id: issue
-    attributes:
-      label: Documentation defect
-      description: State what the page says and what is correct. For missing content, state what information you needed.
-    validations:
-      required: true
-
-  - type: input
-    id: location
-    attributes:
-      label: Location
-      description: Provide the page URL or file path and heading.
-      placeholder: https://fluxer.dev/gateway/overview/
-    validations:
-      required: false
-
-  - type: textarea
-    id: suggestion
-    attributes:
-      label: Proposed wording
-      description: Optional.
-    validations:
-      required: false
-
-  - type: checkboxes
-    id: checks
-    attributes:
-      label: Acknowledgements
-      options:
-        - label: I searched open and closed issues.
-          required: true
@@ -1,7 +1,7 @@
 # Security policy

-Do not report a vulnerability in an issue, pull request, or discussion.
+Do not report a vulnerability in a pull request, on feedback.fluxer.com, in a Fluxer community, or in a direct message to staff.

-Submit a report through [GitHub private vulnerability reporting](https://github.com/fluxerapp/fluxer/security/advisories/new) or email <security@fluxer.com>. Include the affected component, impact, reproduction steps, and supporting evidence. Remove unrelated personal data and secrets.
+Submit a report through <https://fluxer.app/security> or email <security@fluxer.com>. Include the affected component, impact, reproduction steps, and supporting evidence. Remove unrelated personal data and secrets.

 The programme scope, testing rules, safe harbour, disclosure process, and reward terms are published at <https://fluxer.app/security>. That page is authoritative.
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: App Wasm cache
+description: Restore or save the shared application Wasm artifacts
+inputs:
+  mode:
+    description: Cache operation (restore or save)
+    required: true
+outputs:
+  cache-hit:
+    description: Whether the restore found the exact artifact key
+    value: ${{ steps.cache.outputs.cache-hit }}
+runs:
+  using: composite
+  steps:
+    - name: Resolve artifact key
+      id: key
+      if: always()
+      shell: bash
+      run: echo "key=app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs', 'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock', 'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**', 'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock', 'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**', 'fluxer_app/rust/libfluxwebp/simd/**', 'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml', 'packages/markdown_parser/rust/src/**') }}" >> "$GITHUB_OUTPUT"
+    - name: Restore artifacts
+      id: cache
+      if: inputs.mode == 'restore'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: |
+          fluxer_app/pkgs/libfluxcore
+          fluxer_app/pkgs/libfluxwebp
+          fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+        key: ${{ steps.key.outputs.key }}
+    - name: Save artifacts
+      if: always() && inputs.mode == 'save'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: |
+          fluxer_app/pkgs/libfluxcore
+          fluxer_app/pkgs/libfluxwebp
+          fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
+        key: ${{ steps.key.outputs.key }}
@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: CI helper
+description: Restore or build the shared Rust CI helper
+inputs:
+  save:
+    description: Save a missing helper cache on main
+    required: false
+    default: 'false'
+runs:
+  using: composite
+  steps:
+    - name: Restore ci helper
+      id: cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: target/debug/fluxer-ci
+        key: >-
+          fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+          'tools/ci/Cargo.toml', 'tools/ci/src/**') }}
+    - name: Build ci helper
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: cargo build --locked --package fluxer-ci
+    - name: Save ci helper
+      if: inputs.save == 'true' && github.ref == 'refs/heads/main' && steps.cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: target/debug/fluxer-ci
+        key: ${{ steps.cache.outputs.cache-primary-key }}
@@ -67,9 +67,6 @@ p:geo-utils:
 p:hono:
  - changed-files:
    - any-glob-to-any-file: packages/hono/**/*
-p:hono-types:
-  - changed-files:
-    - any-glob-to-any-file: packages/hono_types/**/*
 p:i18n:
  - changed-files:
    - any-glob-to-any-file: packages/i18n/**/*
@@ -1,6 +1,6 @@
-Closes #
+Resolves https://feedback.fluxer.com/p/

-<!-- Repeat this line for each resolved issue, up to 20. Remove the placeholder only if no issue is resolved and the approval gate does not apply. -->
+<!-- Repeat this line for each feedback.fluxer.com post this resolves, up to 20. Remove the placeholder only if no post is resolved and the approval gate does not apply. -->

 ## Summary

@@ -12,26 +12,11 @@ on:
        description: "Path to the Dockerfile to build"
        type: string
        required: true
-      context:
-        description: "Docker build context"
-        type: string
-        required: false
-        default: "."
      build-version:
        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
        type: string
        required: false
        default: ""
-      moving-tags:
-        description: "Comma-separated moving tags to repoint at this build"
-        type: string
-        required: false
-        default: "v1,latest"
-      extra-build-args:
-        description: "Additional Docker build args, one KEY=VALUE entry per line"
-        type: string
-        required: false
-        default: ""
 permissions:
  actions: read
  contents: write
@@ -115,7 +100,7 @@ jobs:
          password: ${{ github.token }}
      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
-          context: ${{ inputs.context }}
+          context: .
          file: ${{ inputs.dockerfile }}
          push: true
          provenance: mode=min
@@ -125,7 +110,6 @@ jobs:
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
            SOURCE_SHA=${{ github.sha }}
            SOURCE_DATE=${{ steps.source.outputs.date }}
-            ${{ inputs.extra-build-args }}
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
@@ -190,7 +174,7 @@ jobs:

      - name: Advance moving image tags
        env:
-          MOVING_TAGS: ${{ inputs.moving-tags }}
+          MOVING_TAGS: v1,latest
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
          tools/ci/run.sh image-set
@@ -154,6 +154,7 @@ jobs:
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
            SOURCE_SHA=${{ github.sha }}
            SOURCE_DATE=${{ steps.source.outputs.date }}
+            FLUXER_SELF_HOSTED=true
            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
            APP_ASSETS_PLATFORM=linux/amd64
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
@@ -200,6 +200,7 @@ jobs:
          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
            SOURCE_SHA=${{ github.sha }}
            SOURCE_DATE=${{ steps.source.outputs.date }}
            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
@@ -0,0 +1,350 @@
+name: build desktop modules
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: Release channel to ship renderer modules on. The live shell on that channel stays as it is.
+        required: true
+        type: choice
+        options:
+          - canary
+          - stable
+        default: canary
+      build_version:
+        description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
+        required: false
+        default: ""
+        type: string
+      allow_shell_drift:
+        description: Publish even though shell sources changed since the live shell was built. Only when the renderer does not depend on those changes.
+        required: false
+        default: false
+        type: boolean
+permissions:
+  contents: write
+  id-token: write
+  actions: read
+
+concurrency:
+  group: desktop-modules-${{ inputs.channel }}
+  cancel-in-progress: false
+
+env:
+  CHANNEL: ${{ inputs.channel }}
+  BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
+
+jobs:
+  meta:
+    name: Resolve build metadata
+    runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.meta.outputs.version }}
+      pub_date: ${{ steps.meta.outputs.pub_date }}
+      channel: ${{ steps.meta.outputs.channel }}
+      build_channel: ${{ steps.meta.outputs.build_channel }}
+      source_sha: ${{ steps.meta.outputs.source_sha }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: main
+
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
+      - name: Set metadata
+        id: meta
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          FLUXER_BUILD_VERSION: ${{ inputs.build_version }}
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step set_metadata
+          --channel "${{ inputs.channel }}"
+
+  shared_assets:
+    name: Build shared renderer assets
+    needs:
+      - meta
+    runs-on: ubuntu-24.04
+    environment: desktop-releases
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      CHANNEL: ${{ needs.meta.outputs.channel }}
+      BUILD_CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      PUBLIC_RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
+      BUILD_VERSION: ${{ needs.meta.outputs.version }}
+      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
+      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+    steps:
+      - name: Checkout CI helpers
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+          path: _ci
+
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+          path: source
+
+      - name: Set up Rust toolchain (renderer wasm)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+          targets: wasm32-unknown-unknown
+
+      - name: Set workdir (Unix)
+        env:
+          SUBST_TARGET: ${{ github.workspace }}/source
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step set_workdir_unix
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 26
+
+      - name: Set up pnpm
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step setup_pnpm
+
+      - name: Resolve pnpm store path (Unix)
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step resolve_pnpm_store_unix
+
+      - name: Cache pnpm store
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: ${{ env.PNPM_STORE_PATH }}
+          key: ${{ runner.os }}-shared-renderer-pnpm-store-${{ hashFiles('source/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-shared-renderer-pnpm-store-
+
+      - name: Cache cargo registry
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-shared-renderer-cargo-registry-${{ hashFiles('source/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-shared-renderer-cargo-registry-
+
+      - name: Install dependencies
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step install_dependencies
+
+      - name: Update version
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step update_version
+
+      - name: Set build channel
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step set_build_channel
+
+      - name: Build shared renderer assets
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_shared_assets
+
+      - name: Prepare shared renderer artifact
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step prepare_shared_assets
+
+      - name: Upload shared renderer artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: desktop-shared-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: source/desktop-shared-assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Split renderer into desktop modules
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step split_modules
+
+      - name: Pack desktop modules
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step pack_modules
+
+      - name: Upload desktop module packages
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: desktop-modules-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: |
+            source/desktop-modules/classification.json
+            source/desktop-modules/*/module.json
+            source/desktop-modules/*/package.br
+            source/desktop-modules/*/package.br.sha256
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+  assemble:
+    name: Assemble the modules-only release
+    if: ${{ !cancelled() && needs.shared_assets.result == 'success' }}
+    needs:
+      - meta
+      - shared_assets
+    runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
+      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
+      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+          fetch-depth: 0
+
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+
+      - name: Download desktop module packages
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: desktop-modules-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: desktop-modules
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: read
+      - name: Check the live shell runs these modules
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          ALLOW_SHELL_DRIFT: ${{ inputs.allow_shell_drift }}
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step check_shell_drift
+
+      - name: Build the modules-only manifests
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step build_modules_only_manifest
+
+      - name: Prepare GitHub release assets
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step prepare_modules_release_assets
+
+      - name: Upload GitHub release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fluxer-desktop-modules-release-assets
+          path: release_assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+  publish_release:
+    name: Publish GitHub modules-only release
+    if: ${{ !cancelled() && needs.assemble.result == 'success' }}
+    needs:
+      - meta
+      - assemble
+    runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
+    timeout-minutes: 60
+    permissions:
+      contents: write
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+
+      - name: Download GitHub release assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: fluxer-desktop-modules-release-assets
+          path: release_assets
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub modules-only release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          CHANNEL: ${{ needs.meta.outputs.build_channel }}
+          VERSION: ${{ needs.meta.outputs.version }}
+          SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: |
+          set -euo pipefail
+          release_args=(
+            release publish
+            --component "fluxer-desktop-${CHANNEL}"
+            --build-version "${VERSION}"
+            --source-sha "${SOURCE_SHA}"
+            --previous-sha "${RELEASE_BASELINE_SHA}"
+            --asset-dir release_assets
+          )
+          if [[ "${CHANNEL}" == "canary" ]]; then
+            release_args+=(--prerelease)
+          fi
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- "${release_args[@]}"
@@ -103,11 +103,150 @@ jobs:
          --step set_matrix
          --skip-targets "${{ inputs.skip_targets }}"

+  shared_assets:
+    name: Build shared renderer assets
+    needs:
+      - meta
+    runs-on: ubuntu-24.04
+    environment: desktop-releases
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      CHANNEL: ${{ needs.meta.outputs.channel }}
+      BUILD_CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      PUBLIC_RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
+      BUILD_VERSION: ${{ needs.meta.outputs.version }}
+      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
+      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
+    steps:
+      - name: Checkout CI helpers
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+          path: _ci
+
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+          path: source
+
+      - name: Set up Rust toolchain (renderer wasm)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+          targets: wasm32-unknown-unknown
+
+      - name: Set workdir (Unix)
+        env:
+          SUBST_TARGET: ${{ github.workspace }}/source
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step set_workdir_unix
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 26
+
+      - name: Set up pnpm
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step setup_pnpm
+
+      - name: Resolve pnpm store path (Unix)
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step resolve_pnpm_store_unix
+
+      - name: Cache pnpm store
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: ${{ env.PNPM_STORE_PATH }}
+          key: ${{ runner.os }}-shared-renderer-pnpm-store-${{ hashFiles('source/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-shared-renderer-pnpm-store-
+
+      - name: Cache cargo registry
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-shared-renderer-cargo-registry-${{ hashFiles('source/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-shared-renderer-cargo-registry-
+
+      - name: Install dependencies
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step install_dependencies
+
+      - name: Update version
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step update_version
+
+      - name: Set build channel
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step set_build_channel
+
+      - name: Build shared renderer assets
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_shared_assets
+
+      - name: Prepare shared renderer artifact
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step prepare_shared_assets
+
+      - name: Upload shared renderer artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: desktop-shared-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: source/desktop-shared-assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Split renderer into desktop modules
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step split_modules
+
+      - name: Pack desktop modules
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step pack_modules
+
+      - name: Upload desktop module packages
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: desktop-modules-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: |
+            source/desktop-modules/classification.json
+            source/desktop-modules/*/module.json
+            source/desktop-modules/*/package.br
+            source/desktop-modules/*/package.br.sha256
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
  build:
    name: Build ${{ matrix.platform }} (${{ matrix.arch }})
    needs:
      - meta
      - matrix
+      - shared_assets
    runs-on: ${{ matrix.os }}
    environment: desktop-releases
    timeout-minutes: 180
@@ -130,6 +269,7 @@ jobs:
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
+      FLUXER_MODULES: "1"
      PLATFORM: ${{ matrix.platform }}
      ARCH: ${{ matrix.arch }}
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
@@ -276,6 +416,17 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step set_build_channel

+      - name: Download shared renderer artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: desktop-shared-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: source/desktop-shared-assets
+
+      - name: Restore shared renderer assets
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step restore_shared_assets
+
      - name: Build Electron main process
        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
        env:
@@ -400,6 +551,16 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step verify_windows_unpacked_signatures

+      - name: Verify the packaged shell starts and boots its bundled renderer (Windows)
+        if: matrix.platform == 'windows' && matrix.arch == 'x64'
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        env:
+          BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
+          BUILD_VERSION: ${{ env.VERSION }}
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step verify_bundled_renderer_windows
+
      - name: Create portable ZIP (Windows)
        if: matrix.platform == 'windows'
        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
@@ -440,6 +601,16 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step build_app_linux

+      - name: Verify the packaged shell boots its bundled renderer (Linux)
+        if: matrix.platform == 'linux' && matrix.arch == 'x64'
+        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
+        env:
+          BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
+          BUILD_VERSION: ${{ env.VERSION }}
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step verify_bundled_renderer_linux
+
      - name: Verify signed Windows artifacts
        if: matrix.platform == 'windows'
        working-directory: ${{ env.WORKDIR }}/fluxer_desktop
@@ -500,16 +671,64 @@ jobs:
          retention-days: 1
          compression-level: 0

-  upload:
-    name: Assemble desktop release assets
+  verify_windows_arm64:
+    name: Verify windows (arm64)
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    needs:
      - meta
      - build
+    runs-on: windows-11-arm
+    timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ needs.meta.outputs.source_sha }}
+          sparse-checkout: fluxer_desktop/scripts
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 24
+
+      - name: Download windows arm64 build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: artifacts
+          pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-windows-arm64*
+
+      - name: Verify the packaged shell starts and boots its bundled renderer
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $zip = Get-ChildItem -Path artifacts -Recurse -Filter "*-$env:VERSION-portable-win-arm64.zip" | Select-Object -First 1
+          if ($null -eq $zip) { Write-Host 'This build has no windows arm64 portable zip'; exit 0 }
+          $app = Join-Path $env:RUNNER_TEMP 'app'
+          Expand-Archive -Path $zip.FullName -DestinationPath $app
+          $exe = Get-ChildItem -Path $app -Recurse -Filter 'Fluxer*.exe' | Where-Object { $_.Name -notlike '*_ExecutionStub.exe' } | Select-Object -First 1
+          if ($null -eq $exe) { throw "$($zip.Name) holds no Fluxer executable" }
+          node fluxer_desktop/scripts/release-check.mjs --app $exe.DirectoryName --channel $env:CHANNEL --expect-renderer $env:VERSION --expect-source bundled --package-origin http://127.0.0.1:9 --app-arg=--disable-gpu --workdir (Join-Path $env:RUNNER_TEMP 'runs') --timeout-seconds 240
+          if ($LASTEXITCODE -ne 0) { throw "The windows arm64 build fails its release check" }
+
+  upload:
+    name: Assemble desktop release assets
+    if: ${{ !cancelled() && needs.build.result == 'success' && needs.verify_windows_arm64.result == 'success' }}
+    needs:
+      - meta
+      - shared_assets
+      - build
+      - verify_windows_arm64
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
    timeout-minutes: 180
    permissions:
+      actions: read
      contents: read
    env:
      CHANNEL: ${{ needs.meta.outputs.build_channel }}
@@ -521,7 +740,6 @@ jobs:
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      PUBLIC_DL_BASE: https://api.fluxer.app/dl
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
@@ -547,6 +765,17 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_payload

+      - name: Download desktop module packages
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: desktop-modules-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
+          path: desktop-modules
+
+      - name: Build desktop module manifest
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step build_module_manifest
+
      - name: Prepare GitHub release assets
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
@@ -0,0 +1,152 @@
+name: desktop windows release check
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: Release channel
+        type: choice
+        options:
+          - canary
+          - stable
+        default: canary
+      version:
+        description: Published version to check
+        required: true
+        type: string
+      expect_failure:
+        description: Pass only when the published build fails to start
+        type: boolean
+        default: false
+      update_from:
+        description: Comma-separated published versions to install with Setup and update to the version above from the live feed
+        required: false
+        type: string
+        default: ""
+      stale_apply_record:
+        description: Before each update, leave behind an hour-old record of an update that never installed (passes only when the installed versions retry it)
+        type: boolean
+        default: false
+  pull_request:
+    paths:
+      - .github/workflows/desktop-windows-release-check.yaml
+      - fluxer_desktop/scripts/release-check.mjs
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-windows-release-check-${{ github.ref }}-${{ inputs.version || 'pr' }}
+  cancel-in-progress: false
+
+jobs:
+  check:
+    name: Check windows (${{ matrix.arch }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x64
+            os: windows-2025
+          - arch: arm64
+            os: windows-11-arm
+    env:
+      CHANNEL: ${{ inputs.channel || 'canary' }}
+      VERSION: ${{ inputs.version || '2026.1009.20411' }}
+      EXPECT_FAILURE: ${{ github.event_name == 'pull_request' && 'true' || inputs.expect_failure }}
+      UPDATE_FROM: ${{ inputs.update_from || '' }}
+      STALE_APPLY_RECORD: ${{ inputs.stale_apply_record && 'true' || 'false' }}
+      ARCH: ${{ matrix.arch }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          sparse-checkout: fluxer_desktop/scripts
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 24
+
+      - name: Check the portable build
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $work = Join-Path $env:RUNNER_TEMP 'portable'
+          New-Item -ItemType Directory -Force -Path $work | Out-Null
+          $zip = Join-Path $work 'portable.zip'
+          Invoke-WebRequest -Uri "https://pkgs.fluxer.com/desktop/$env:CHANNEL/win32/$env:ARCH/$env:VERSION/portable" -OutFile $zip
+          Expand-Archive -Path $zip -DestinationPath (Join-Path $work 'app')
+          $exe = Get-ChildItem -Path (Join-Path $work 'app') -Recurse -Filter 'Fluxer*.exe' | Where-Object { $_.Name -notlike '*_ExecutionStub.exe' } | Select-Object -First 1
+          if ($null -eq $exe) { throw "The portable build holds no Fluxer executable" }
+          $output = & node fluxer_desktop/scripts/release-check.mjs --app $exe.DirectoryName --channel $env:CHANNEL --expect-renderer $env:VERSION --expect-source bundled --app-arg=--disable-gpu --workdir (Join-Path $work 'runs') --timeout-seconds 240 2>&1
+          $code = $LASTEXITCODE
+          $output | ForEach-Object { Write-Host $_ }
+          if ($env:EXPECT_FAILURE -eq 'true') {
+            if ($code -eq 0) { throw "Expected $env:VERSION to fail its release check, it passed" }
+            Write-Host "$env:VERSION fails its release check on windows $env:ARCH as expected"
+            exit 0
+          }
+          if ($code -ne 0) { throw "The release check failed for $env:VERSION on windows $env:ARCH" }
+
+      - name: Update installed builds from the live feed
+        if: env.UPDATE_FROM != ''
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $channelDirs = @{ canary = 'fluxer_desktop_canary'; stable = 'fluxer_desktop' }
+          $dataDirs = @{ canary = 'fluxercanary'; stable = 'fluxer' }
+          $installRoot = Join-Path $env:LOCALAPPDATA $channelDirs[$env:CHANNEL]
+          $logPath = Join-Path (Join-Path $env:APPDATA $dataDirs[$env:CHANNEL]) 'logs\main.log'
+          $failures = @()
+          foreach ($from in ($env:UPDATE_FROM -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ })) {
+            Write-Host "== install $from, then update to $env:VERSION"
+            Get-Process | Where-Object { $_.Path -like "$installRoot*" } | Stop-Process -Force -ErrorAction SilentlyContinue
+            if (Test-Path $installRoot) { Remove-Item -Recurse -Force $installRoot }
+            Remove-Item -Recurse -Force (Split-Path (Split-Path $logPath -Parent) -Parent) -ErrorAction SilentlyContinue
+            $setup = Join-Path $env:RUNNER_TEMP "setup-$from.exe"
+            Invoke-WebRequest -Uri "https://pkgs.fluxer.com/desktop/$env:CHANNEL/win32/$env:ARCH/$from/setup" -OutFile $setup
+            Start-Process -FilePath $setup -ArgumentList '--silent' -Wait
+            Start-Sleep -Seconds 5
+            Get-Process | Where-Object { $_.Path -like "$installRoot*" } | Stop-Process -Force -ErrorAction SilentlyContinue
+            $exe = Get-ChildItem -Path (Join-Path $installRoot 'current') -Filter 'Fluxer*.exe' | Where-Object { $_.Name -notlike '*_ExecutionStub.exe' } | Select-Object -First 1
+            if ($null -eq $exe) { $failures += "$from did not install"; continue }
+            if ($env:STALE_APPLY_RECORD -eq 'true') {
+              $dataRoot = Split-Path (Split-Path $logPath -Parent) -Parent
+              New-Item -ItemType Directory -Force -Path $dataRoot | Out-Null
+              $attemptedAt = [DateTimeOffset]::UtcNow.AddHours(-1).ToUnixTimeMilliseconds()
+              Set-Content -Path (Join-Path $dataRoot 'update-apply-state.json') -Value "{`"version`":`"$env:VERSION`",`"attemptedAt`":$attemptedAt}" -NoNewline
+              Write-Host "left a stale apply record for $env:VERSION"
+            }
+            Start-Process -FilePath $exe.FullName -ArgumentList '--disable-gpu'
+            $deadline = (Get-Date).AddMinutes(8)
+            $reported = $null
+            while ((Get-Date) -lt $deadline) {
+              Start-Sleep -Seconds 10
+              if (Test-Path $logPath) {
+                $line = Select-String -Path $logPath -Pattern "The renderer reported its build: .*Desktop $([regex]::Escape($env:VERSION)), Web $([regex]::Escape($env:VERSION))" | Select-Object -Last 1
+                if ($null -ne $line) { $reported = $line.Line; break }
+              }
+            }
+            $installed = Get-Content (Join-Path $installRoot 'current\sq.version') -Raw -ErrorAction SilentlyContinue
+            Write-Host "installed package after update: $installed"
+            $logs = Join-Path $env:RUNNER_TEMP "logs\$from"
+            New-Item -ItemType Directory -Force -Path $logs | Out-Null
+            if (Test-Path $logPath) { Copy-Item $logPath $logs }
+            Get-ChildItem -Path $installRoot -Filter '*.log' -ErrorAction SilentlyContinue | Copy-Item -Destination $logs
+            if (Test-Path $logPath) { Get-Content $logPath | Select-String -Pattern 'Bootstrap|ShellSelfUpdate|Velopack|velopack|NativeModulePreflight|reported its build' | Select-Object -Last 40 | ForEach-Object { Write-Host $_.Line } }
+            if ($null -eq $reported) { $failures += "$from did not reach Desktop and Web $env:VERSION" } else { Write-Host "$from updated: $reported" }
+            Get-Process | Where-Object { $_.Path -like "$installRoot*" } | Stop-Process -Force -ErrorAction SilentlyContinue
+          }
+          if ($failures.Count -gt 0) { throw ($failures -join "`n") }
+
+      - name: Upload update logs
+        if: always() && env.UPDATE_FROM != ''
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: update-logs-${{ matrix.arch }}
+          path: ${{ runner.temp }}/logs
+          if-no-files-found: ignore
+          retention-days: 7
@@ -0,0 +1,183 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Helm chart
+
+on:
+  pull_request:
+    paths:
+      - deploy/helm/**
+      - deploy/self-hosting/Caddyfile
+      - .github/workflows/helm.yaml
+  push:
+    branches: [main]
+    paths:
+      - deploy/helm/**
+      - deploy/self-hosting/Caddyfile
+      - .github/workflows/helm.yaml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  render:
+    name: Lint and render with Helm ${{ matrix.helm }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - helm: v3.19.0
+            sha256: a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496
+          - helm: v4.2.4
+            sha256: c306b46f719b0a4da32d0f78ee21bf90ce8d602f15b22ab753f0674d1670a7f3
+    env:
+      CHART: deploy/helm/fluxer
+      KUBECONFORM_VERSION: v0.7.0
+      KUBECONFORM_SHA256: c31518ddd122663b3f3aa874cfe8178cb0988de944f29c74a0b9260920d115d3
+      CRD_CATALOG: https://raw.githubusercontent.com/datreeio/CRDs-catalog/63669a570e231d4f1f8396d229a1de512bcf0a34/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json
+    steps:
+      - name: Checkout fluxer
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+
+      - name: Install Helm and kubeconform
+        env:
+          HELM_VERSION: ${{ matrix.helm }}
+          HELM_SHA256: ${{ matrix.sha256 }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/bin"
+          cd "$RUNNER_TEMP"
+          curl -fsSLo helm.tgz "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
+          echo "${HELM_SHA256}  helm.tgz" | sha256sum -c -
+          tar -xzf helm.tgz linux-amd64/helm
+          mv linux-amd64/helm bin/helm
+          curl -fsSLo kubeconform.tgz "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz"
+          echo "${KUBECONFORM_SHA256}  kubeconform.tgz" | sha256sum -c -
+          tar -xzf kubeconform.tgz kubeconform
+          mv kubeconform bin/kubeconform
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Lint, render and validate every CI values file
+        run: |
+          set -euo pipefail
+          command -v helm kubeconform python3
+          python3 -c 'import yaml'
+          helm version --short
+          shopt -s nullglob
+          files=("$CHART"/ci/*.yaml)
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "::error::no values files under $CHART/ci"
+            exit 1
+          fi
+          for values in "${files[@]}"; do
+            echo "::group::$values"
+            helm lint --strict "$CHART" -f "$values"
+            helm template fluxer "$CHART" -n fluxer -f "$values" \
+              --api-versions cert-manager.io/v1 --api-versions gateway.networking.k8s.io/v1 > rendered.yaml
+            kubeconform -strict -summary -kubernetes-version 1.29.0 \
+              -schema-location default -schema-location "$CRD_CATALOG" rendered.yaml
+            if grep -qi 'example\.com' rendered.yaml; then
+              echo "::error::$values renders example.com"
+              exit 1
+            fi
+            if grep -Eqi 'change_?me' rendered.yaml; then
+              echo "::error::$values renders a CHANGE_ME placeholder"
+              exit 1
+            fi
+            echo "::endgroup::"
+          done
+
+      - name: Check the guards
+        run: |
+          set -euo pipefail
+          expect_failure() {
+            local message=$1
+            shift
+            if output=$(helm template fluxer "$CHART" "$@" 2>&1); then
+              echo "::error::rendered with $*"
+              exit 1
+            fi
+            if ! grep -qF "$message" <<<"$output"; then
+              echo "::error::expected \"$message\" for $*, got: $output"
+              exit 1
+            fi
+          }
+          d=domain=chat.example.test
+          expect_failure "domain must be set"
+          expect_failure "is a placeholder" --set $d --set secrets.values.FLUXER_SUDO_MODE_SECRET=CHANGE_ME
+          expect_failure "is a placeholder" --set $d --set-string 'secrets.extra.FLUXER_STRIPE_SECRET_KEY=<change-me>'
+          expect_failure "at least 32 characters" --set $d --set secrets.values.FLUXER_GATEWAY_RPC_AUTH_TOKEN=short
+          expect_failure "letters and digits only" --set $d --set-string 'secrets.values.FLUXER_VALKEY_PASSWORD=0123456789abcdef0123456789abcd:@'
+          expect_failure "worker.replicas must be 1" --set $d --set worker.replicas=2
+          expect_failure "at least 32 bytes" --set $d --set secrets.values.FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=c2hvcnQ=
+          expect_failure "set postgres.external.host" --set $d --set postgres.enabled=false
+          expect_failure "set together" --set $d --set secrets.values.FLUXER_VAPID_PUBLIC_KEY=abc
+          expect_failure "is a secret and would be stored in plain text" --set $d --set env.FLUXER_EMAIL_SMTP_PASSWORD=not-a-real-password
+          expect_failure "is a secret and would be stored in plain text" --set $d --set api.env.FLUXER_STRIPE_SECRET_KEY=not-a-real-key
+          expect_failure "holds a password" --set $d --set-string 'env.FLUXER_SEARCH_URL=https://user:[email protected]'
+          expect_failure "Set livekit.nodeCIDRs" --set $d --set networkPolicy.ingressNamespaceSelector.matchLabels.name=ingress
+          expect_failure "set livekit.external.publicUrl" --set $d --set livekit.enabled=false --set livekit.external.url=http://livekit.voice.svc:7880
+          expect_failure "reserve a public address" --set $d --set livekit.expose=loadBalancer
+
+      - name: Check that a chart version bump restarts nothing
+        run: |
+          set -euo pipefail
+          cp -R "$CHART" "$RUNNER_TEMP/bumped"
+          sed -e 's/^version: .*/version: 99.0.0/' -e 's/^appVersion: .*/appVersion: "bumped"/' "$CHART/Chart.yaml" > "$RUNNER_TEMP/bumped/Chart.yaml"
+          helm template fluxer "$CHART" -n fluxer -f "$CHART/ci/existing-secret-values.yaml" > before.yaml
+          helm template fluxer "$RUNNER_TEMP/bumped" -n fluxer -f "$CHART/ci/existing-secret-values.yaml" > after.yaml
+          python3 - before.yaml after.yaml <<'PY'
+          import sys, yaml
+          def pods(path):
+              out = {}
+              for doc in yaml.safe_load_all(open(path)):
+                  if doc and doc.get('kind') in ('Deployment', 'StatefulSet'):
+                      spec = doc['spec']
+                      out[f"{doc['kind']}/{doc['metadata']['name']}"] = (spec['template'], spec['selector'], spec.get('volumeClaimTemplates'))
+              return out
+          before, after = pods(sys.argv[1]), pods(sys.argv[2])
+          if len(before) < 20:
+              sys.exit(f'only {len(before)} workloads rendered')
+          changed = sorted(name for name in before.keys() | after.keys() if before.get(name) != after.get(name))
+          if changed:
+              sys.exit('a chart version bump changes the pod template of: ' + ', '.join(changed))
+          print(f'{len(before)} workloads keep their pod template across a chart version bump')
+          PY
+
+      - name: Check the default resource requests
+        run: |
+          set -euo pipefail
+          helm template fluxer "$CHART" -n fluxer -f "$CHART/ci/default-values.yaml" > rendered.yaml
+          python3 - rendered.yaml <<'PY'
+          import sys, yaml
+          def cpu(v):
+              v = str(v)
+              return float(v[:-1]) if v.endswith('m') else float(v) * 1000
+          units = {'Ki': 2**10, 'Mi': 2**20, 'Gi': 2**30}
+          def mem(v):
+              v = str(v)
+              for unit, factor in units.items():
+                  if v.endswith(unit):
+                      return float(v[:-len(unit)]) * factor
+              return float(v)
+          total_cpu = total_mem = 0
+          for doc in yaml.safe_load_all(open(sys.argv[1])):
+              if not doc or doc.get('kind') not in ('Deployment', 'StatefulSet'):
+                  continue
+              replicas = doc['spec'].get('replicas', 1)
+              for container in doc['spec']['template']['spec']['containers']:
+                  requests = (container.get('resources') or {}).get('requests') or {}
+                  if 'cpu' not in requests or 'memory' not in requests:
+                      sys.exit(f"{doc['kind']}/{doc['metadata']['name']} has a container without cpu and memory requests")
+                  total_cpu += replicas * cpu(requests['cpu'])
+                  total_mem += replicas * mem(requests['memory'])
+          print(f"requests: {total_cpu:.0f}m cpu, {total_mem / 2**30:.2f}Gi memory")
+          if total_cpu > 1200 or total_mem > 4.5 * 2**30:
+              sys.exit('the default install requests more than 1200m cpu or 4.5Gi memory')
+          PY
@@ -61,6 +61,8 @@ jobs:
          --step install_dependencies

      - name: Refresh source catalogs
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
        run: pnpm i18n:source-sync

      - name: Format generated catalogs
@@ -67,7 +67,7 @@ jobs:
          --step install_dependencies

      - name: Compile translated catalogs
-        run: pnpm i18n:weblate-compile
+        run: pnpm i18n:compile

      - name: Format generated catalogs
        run: pnpm biome format --write package.json packages/i18n/package.json packages/i18n/scripts/SyncStaticI18nCatalogs.ts packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
@@ -15,7 +15,6 @@ concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 env:
-  GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
  CARGO_PROFILE_DEV_DEBUG: none
  CARGO_PROFILE_TEST_DEBUG: none
  CARGO_INCREMENTAL: '0'
@@ -36,27 +35,10 @@ jobs:
          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

-      - name: Restore ci helper
-        id: ci-helper
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      - name: Set up ci helper
+        uses: ./.github/actions/ci-helper
        with:
-          path: target/debug/fluxer-ci
-          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
-            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
-
-      - name: Build ci helper
-        if: steps.ci-helper.outputs.cache-hit != 'true'
-        run: cargo build --locked --package fluxer-ci
-
-      - name: Save ci helper
-        if: github.ref == 'refs/heads/main' && steps.ci-helper.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: target/debug/fluxer-ci
-          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
-            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
+          save: 'true'

      - name: Install pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
@@ -91,18 +73,8 @@ jobs:
          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

-      - name: Restore ci helper
-        id: ci-helper
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: target/debug/fluxer-ci
-          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
-            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
-
-      - name: Build ci helper
-        if: steps.ci-helper.outputs.cache-hit != 'true'
-        run: cargo build --locked --package fluxer-ci
+      - name: Set up ci helper
+        uses: ./.github/actions/ci-helper

      - name: Install pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
@@ -119,22 +91,9 @@ jobs:

      - name: Restore fluxer_app wasm artifacts
        id: app-wasm
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        uses: ./.github/actions/app-wasm-cache
        with:
-          path: |
-            fluxer_app/pkgs/libfluxcore
-            fluxer_app/pkgs/libfluxwebp
-            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
-          key: >-
-            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
-            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
-            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
-            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
-            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
-            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
-            'fluxer_app/rust/libfluxwebp/simd/**',
-            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
-            'packages/markdown_parser/rust/src/**') }}
+          mode: restore

      - name: Run tests
        run: |
@@ -142,22 +101,9 @@ jobs:

      - name: Save fluxer_app wasm artifacts
        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        uses: ./.github/actions/app-wasm-cache
        with:
-          path: |
-            fluxer_app/pkgs/libfluxcore
-            fluxer_app/pkgs/libfluxwebp
-            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
-          key: >-
-            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
-            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
-            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
-            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
-            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
-            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
-            'fluxer_app/rust/libfluxwebp/simd/**',
-            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
-            'packages/markdown_parser/rust/src/**') }}
+          mode: save

  rust:
    runs-on: blacksmith-4vcpu-ubuntu-2404
@@ -277,6 +223,9 @@ jobs:
          FLUXER_REQUIRE_MEDIA_FIXTURES: "1"
        run: cargo test --workspace --all-features --locked

+      - name: Run tests (libfluxcore)
+        run: cargo test --locked --manifest-path fluxer_app/rust/libfluxcore/Cargo.toml
+
      - name: Run desktop native workspace tests on Linux
        run: tools/ci/check-desktop-native-workspaces.sh test

@@ -302,18 +251,8 @@ jobs:
            fluxer_gateway/native/push_markdown_plaintext_nif -> target
          save-if: ${{ github.ref == 'refs/heads/main' }}

-      - name: Restore ci helper
-        id: ci-helper
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: target/debug/fluxer-ci
-          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
-            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
-
-      - name: Build ci helper
-        if: steps.ci-helper.outputs.cache-hit != 'true'
-        run: cargo build --locked --package fluxer-ci
+      - name: Set up ci helper
+        uses: ./.github/actions/ci-helper

      - name: Set up Erlang
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
@@ -383,18 +322,8 @@ jobs:
          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

-      - name: Restore ci helper
-        id: ci-helper
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: target/debug/fluxer-ci
-          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
-            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}
-
-      - name: Build ci helper
-        if: steps.ci-helper.outputs.cache-hit != 'true'
-        run: cargo build --locked --package fluxer-ci
+      - name: Set up ci helper
+        uses: ./.github/actions/ci-helper

      - name: Install pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
@@ -411,22 +340,9 @@ jobs:

      - name: Restore fluxer_app wasm artifacts
        id: app-wasm
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        uses: ./.github/actions/app-wasm-cache
        with:
-          path: |
-            fluxer_app/pkgs/libfluxcore
-            fluxer_app/pkgs/libfluxwebp
-            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
-          key: >-
-            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
-            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
-            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
-            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
-            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
-            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
-            'fluxer_app/rust/libfluxwebp/simd/**',
-            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
-            'packages/markdown_parser/rust/src/**') }}
+          mode: restore

      - name: Run knip
        run: |
@@ -434,22 +350,9 @@ jobs:

      - name: Save fluxer_app wasm artifacts
        if: always() && github.ref == 'refs/heads/main' && steps.app-wasm.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        uses: ./.github/actions/app-wasm-cache
        with:
-          path: |
-            fluxer_app/pkgs/libfluxcore
-            fluxer_app/pkgs/libfluxwebp
-            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
-          key: >-
-            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
-            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
-            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
-            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
-            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
-            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
-            'fluxer_app/rust/libfluxwebp/simd/**',
-            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
-            'packages/markdown_parser/rust/src/**') }}
+          mode: save

  lint:
    runs-on: ubuntu-24.04
@@ -476,6 +379,9 @@ jobs:
      - name: Lint JSX for browser-translation safety
        run: pnpm exec eslint . --max-warnings 0

+      - name: Check data-flx attributes
+        run: pnpm --filter fluxer_app theming:data-flx:check
+
  i18n:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
@@ -498,15 +404,14 @@ jobs:
      - name: Compile locale catalogs
        run: pnpm i18n:compile

-      - name: Check drift of compiled locale modules
+      - name: Check drift of synced catalogs
        run: |
          if ! git diff --exit-code -- \
-            packages/errors/src/i18n/locales \
-            packages/errors/src/i18n/ErrorI18nTypes.generated.ts \
-            fluxer_api/pkgs/email/src/email_i18n/locales \
+            packages/errors/src/i18n/weblate \
+            fluxer_api/pkgs/email/src/email_i18n/weblate \
            fluxer_api/pkgs/email/src/email_i18n/EmailI18nTypes.generated.ts \
-            fluxer_api/src/api/content_i18n/locales; then
-            echo "::error::Compiled locale modules are outdated. Run 'pnpm i18n:compile' and commit the result. Translations belong in the weblate/ catalogs, not in the generated locales/ modules."
+            fluxer_api/src/api/content_i18n/weblate; then
+            echo "::error::Static catalogs are out of sync with their sources. Run 'pnpm i18n:compile' and commit the result."
            exit 1
          fi

@@ -28,22 +28,24 @@
 /fluxer_app/pkgs/libfluxcore/
 /fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
+**/auto-i18n-reviewed-unchanged.json.lock
+**/weblate/locales/auto-i18n-reviewed-unchanged.json
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
 /fluxer_app/src/features/ui/components/SVGMasks.tsx
 /fluxer_app/src/features/ui/constants/AvatarStatusGeometry.ts
 /fluxer_gateway/priv/
+/fluxer_static/desktop/spellcheck/dictionaries/*/*
+!/fluxer_static/desktop/spellcheck/dictionaries/[email protected]/LICENSE
+!/fluxer_static/desktop/spellcheck/dictionaries/[email protected]/LICENSE

-/fluxer_desktop/native/rust/fuzz/artifacts/
-/fluxer_desktop/native/rust/fuzz/corpus/
 /packages/markdown_parser/rust/fuzz/artifacts/
 /packages/markdown_parser/rust/fuzz/corpus/

-/fluxer_media_proxy/.benchmark-cache/
-/fluxer_media_proxy/bench-results/
-
 /app-dist-output/
 /artifacts/
+/desktop-shared-assets/
+/desktop-modules/
 /s3_payload/
 /upload_staging/

@@ -49,9 +49,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

 [[package]]
 name = "ammonia"
-version = "4.2.0"
+version = "4.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f7ed3ac4252be4d3e36fb589ed5659356842587b21a31596a9dc89d3b2f5e2a"
+checksum = "061e83b03c2681c18a6787d956e355c74e0b98ba7ba3d69b0822ade1e6f1d716"
 dependencies = [
 "cssparser 0.38.0",
 "html5ever 0.40.1",
@@ -863,24 +863,12 @@ version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"

-[[package]]
-name = "bytemuck"
-version = "1.25.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
-
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

-[[package]]
-name = "byteorder-lite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
-
 [[package]]
 name = "bytes"
 version = "1.12.1"
@@ -1048,12 +1036,6 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"

-[[package]]
-name = "color_quant"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
-
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -1100,16 +1082,6 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"

-[[package]]
-name = "cookie"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
-dependencies = [
- "time",
- "version_check",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -1185,8 +1157,6 @@ dependencies = [
 "num-traits",
 "oorandom",
 "page_size",
- "plotters",
- "rayon",
 "regex",
 "serde",
 "serde_json",
@@ -1213,16 +1183,6 @@ dependencies = [
 "crossbeam-utils",
 ]

-[[package]]
-name = "crossbeam-deque"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-epoch"
 version = "0.9.21"
@@ -1306,7 +1266,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
 dependencies = [
 "quote",
- "syn 3.0.6",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -1685,15 +1645,6 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"

-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -1710,6 +1661,16 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"

+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.12"
@@ -1729,7 +1690,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
 "crc32fast",
- "miniz_oxide 0.9.1",
+ "miniz_oxide",
 "zlib-rs",
 ]

@@ -1741,7 +1702,7 @@ dependencies = [
 "aws-config",
 "aws-sdk-s3",
 "base64 0.23.1",
- "bytes",
+ "brotli",
 "chrono",
 "clap",
 "hex",
@@ -1750,6 +1711,7 @@ dependencies = [
 "serde",
 "serde_json",
 "sha2 0.11.0",
+ "tar",
 "tempfile",
 "tokio",
 "walkdir",
@@ -1762,12 +1724,11 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "axum",
+ "chrono",
 "clap",
- "fluxer_common",
- "hmac 0.13.0",
+ "hex",
 "hyper",
 "hyper-util",
- "image",
 "libc",
 "regex",
 "reqwest",
@@ -1785,14 +1746,14 @@ name = "fluxer-gifs"
 version = "0.1.0"
 dependencies = [
 "anyhow",
+ "axum",
 "fluxer-svc",
 "fluxer_common",
- "hmac 0.13.0",
+ "futures",
 "moka",
 "reqwest",
 "serde",
 "serde_json",
- "sha2 0.11.0",
 "tokio",
 "tracing",
 "url",
@@ -1809,7 +1770,6 @@ dependencies = [
 "reqwest",
 "serde",
 "serde_json",
- "tempfile",
 ]

 [[package]]
@@ -1822,7 +1782,7 @@ dependencies = [
 "bytes",
 "cc",
 "clap",
- "criterion",
+ "flate2",
 "fluxer_common",
 "futures-util",
 "hex",
@@ -1832,6 +1792,7 @@ dependencies = [
 "http-body-util",
 "hyper",
 "libc",
+ "memmap2",
 "moka",
 "parking_lot",
 "percent-encoding",
@@ -1848,8 +1809,8 @@ dependencies = [
 "tempfile",
 "thiserror",
 "tokio",
- "tokio-util",
 "tower",
+ "tower-http 0.7.1",
 "tracing",
 "tracing-subscriber",
 "url",
@@ -1863,20 +1824,16 @@ dependencies = [
 "anyhow",
 "base64 0.23.1",
 "chrono",
- "criterion",
 "fluxer-svc",
 "fluxer_common",
 "fluxer_markdown_parser",
 "futures",
- "hmac 0.13.0",
 "linkify",
 "mime_guess",
- "moka",
 "rmp-serde",
 "scylla",
 "serde",
 "serde_json",
- "sha2 0.11.0",
 "tokio",
 "tracing",
 "url",
@@ -1891,6 +1848,7 @@ dependencies = [
 "base64 0.23.1",
 "clap",
 "fluxer-svc",
+ "fluxer_common",
 "futures",
 "hmac 0.13.0",
 "p256",
@@ -1904,7 +1862,6 @@ dependencies = [
 "thiserror",
 "tokio",
 "tracing",
- "tracing-subscriber",
 "url",
 ]

@@ -1932,15 +1889,14 @@ dependencies = [
 "bytes",
 "chrono",
 "deadpool-postgres",
+ "fluxer_common",
 "futures",
 "libc",
- "moka",
 "rmp-serde",
 "rustls",
 "scylla",
 "serde",
 "serde_json",
- "thiserror",
 "tokio",
 "tokio-postgres",
 "tokio-postgres-rustls",
@@ -1959,7 +1915,6 @@ dependencies = [
 "entities",
 "fluxer-svc",
 "fluxer_common",
- "hmac 0.13.0",
 "infer",
 "moka",
 "regex",
@@ -1967,7 +1922,6 @@ dependencies = [
 "scraper",
 "serde",
 "serde_json",
- "sha2 0.11.0",
 "tokio",
 "tracing",
 "url",
@@ -1983,11 +1937,12 @@ dependencies = [
 "fluxer-svc",
 "fluxer_common",
 "futures",
+ "hmac 0.13.0",
 "moka",
- "rmp-serde",
 "scylla",
 "serde",
 "serde_json",
+ "sha2 0.11.0",
 "tokio",
 "tracing",
 ]
@@ -2000,7 +1955,6 @@ dependencies = [
 "axum",
 "base64 0.23.1",
 "chrono",
- "cookie",
 "fluxer_common",
 "hmac 0.13.0",
 "maud",
@@ -2037,8 +1991,8 @@ dependencies = [
 "hex",
 "rand 0.10.2",
 "reqwest",
- "serde",
 "serde_json",
+ "sha2 0.11.0",
 "tokio",
 "tokio-util",
 "tower",
@@ -2052,23 +2006,21 @@ name = "fluxer_common"
 version = "0.1.0"
 dependencies = [
 "anyhow",
- "aws-credential-types",
- "aws-sigv4",
- "axum",
 "base64 0.23.1",
 "hex",
 "hmac 0.13.0",
- "maxminddb",
- "moka",
+ "http 1.5.0",
+ "libc",
 "reqwest",
+ "serde",
 "serde_json",
 "sha2 0.11.0",
 "tempfile",
 "thiserror",
- "time",
+ "tokio",
 "tracing",
+ "tracing-subscriber",
 "url",
- "urlencoding",
 ]

 [[package]]
@@ -2255,16 +2207,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "gif"
-version = "0.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8cfcc411d9adbbaba82fb72661cc1bcca13e8bba98b364e62b2dba8f960159"
-dependencies = [
- "color_quant",
- "weezl",
-]
-
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -2654,34 +2596,6 @@ dependencies = [
 "icu_properties",
 ]

-[[package]]
-name = "image"
-version = "0.25.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
-dependencies = [
- "bytemuck",
- "byteorder-lite",
- "color_quant",
- "gif",
- "image-webp",
- "moxcms",
- "num-traits",
- "png",
- "zune-core",
- "zune-jpeg",
-]
-
-[[package]]
-name = "image-webp"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
-dependencies = [
- "byteorder-lite",
- "quick-error 2.0.1",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.14.2"
@@ -2709,12 +2623,6 @@ version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"

-[[package]]
-name = "ipnetwork"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf370abdafd54d13e54a620e8c3e1145f28e46cc9d704bc6d94414559df41763"
-
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -2963,18 +2871,6 @@ dependencies = [
 "syn 2.0.119",
 ]

-[[package]]
-name = "maxminddb"
-version = "0.32.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b43d2458d977b610b04a3858e6504f06133663d303a1a0606601b530bfc9bc6"
-dependencies = [
- "ipnetwork",
- "memchr",
- "serde",
- "thiserror",
-]
-
 [[package]]
 name = "md-5"
 version = "0.11.0"
@@ -2991,6 +2887,15 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -3007,16 +2912,6 @@ dependencies = [
 "unicase",
 ]

-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
 [[package]]
 name = "miniz_oxide"
 version = "0.9.1"
@@ -3058,16 +2953,6 @@ dependencies = [
 "uuid",
 ]

-[[package]]
-name = "moxcms"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
-dependencies = [
- "num-traits",
- "pxfm",
-]
-
 [[package]]
 name = "multiversion"
 version = "0.9.0"
@@ -3423,47 +3308,6 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"

-[[package]]
-name = "plotters"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
-dependencies = [
- "num-traits",
- "plotters-backend",
- "plotters-svg",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "plotters-backend"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
-
-[[package]]
-name = "plotters-svg"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
-dependencies = [
- "plotters-backend",
-]
-
-[[package]]
-name = "png"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
-dependencies = [
- "bitflags",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
 [[package]]
 name = "portable-atomic"
 version = "1.15.0"
@@ -3636,24 +3480,12 @@ dependencies = [
 "unarray",
 ]

-[[package]]
-name = "pxfm"
-version = "0.1.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
-
 [[package]]
 name = "quick-error"
 version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"

-[[package]]
-name = "quick-error"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
-
 [[package]]
 name = "quinn"
 version = "0.11.12"
@@ -3845,26 +3677,6 @@ dependencies = [
 "rand_core 0.9.5",
 ]

-[[package]]
-name = "rayon"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -4166,7 +3978,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2"
 dependencies = [
 "fnv",
- "quick-error 1.2.3",
+ "quick-error",
 "tempfile",
 "wait-timeout",
 ]
@@ -4783,6 +4595,17 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"

+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -5587,12 +5410,6 @@ dependencies = [
 "rustls-pki-types",
 ]

-[[package]]
-name = "weezl"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
-
 [[package]]
 name = "whoami"
 version = "2.1.3"
@@ -5811,6 +5628,16 @@ dependencies = [
 "tls_codec",
 ]

+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
 [[package]]
 name = "xmlparser"
 version = "0.13.6"
@@ -5830,9 +5657,9 @@ dependencies = [

 [[package]]
 name = "yoke-derive"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -5971,18 +5798,3 @@ dependencies = [
 "log",
 "simd-adler32",
 ]
-
-[[package]]
-name = "zune-core"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56377fd46368984a170bc5aac5567e52ca5da874caa60bea39fcbca78fb658b"
-
-[[package]]
-name = "zune-jpeg"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
-dependencies = [
- "zune-core",
-]
@@ -23,10 +23,13 @@

 # Fluxer

+> [!IMPORTANT]
+> Bug reports and feature requests have moved to [feedback.fluxer.com](https://feedback.fluxer.com). Sign in with your Fluxer account to post, vote and follow updates. GitHub Issues and Discussions are closed. Report security vulnerabilities privately through [fluxer.app/security](https://fluxer.app/security).
+
 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer running side by side on a desktop monitor and a phone" width="640">
+  <img src="https://fluxer.app/static/img/screenshots-desktop-readme-1920w.70cb6ce340007e0a.png" alt="Fluxer running side by side on a desktop monitor and a phone" width="640">
 </p>

 ## Download
@@ -143,14 +146,13 @@ Full setup notes, including canary, are in the [Linux repositories documentation

 The source is licensed under the [AGPL-3.0-or-later](./LICENSE) license.

-Fluxer branding, icons, default avatars, badge artwork, screenshots and marketing
-imagery are copyright Fluxer, all rights reserved, as set out in
-[fluxer_static/LICENSE](./fluxer_static/LICENSE). Third-party material keeps its own
-terms, listed in
+Fluxer artwork, such as the logo, icons, badges and default avatars, is
+licensed under [CC BY-SA 4.0](./fluxer_static/LICENSE). Third-party material
+keeps its own terms, listed in
 [fluxer_static/THIRD_PARTY_LICENSES.md](./fluxer_static/THIRD_PARTY_LICENSES.md).

-Public availability of this repository does not grant trademark, brand, or
-endorsement rights.
+Use of the Fluxer name and logo is covered by the
+[name and marks policy](./.github/GOVERNANCE.md#name-and-marks).

 [win-setup-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/setup
 [win-setup-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/setup
@@ -143,6 +143,10 @@
 			],
 			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
 		},
+		{
+			"includes": ["fluxer_app/src/**/*.worklet.js"],
+			"javascript": {"globals": ["AudioWorkletProcessor", "registerProcessor", "sampleRate", "currentTime"]}
+		},
 		{
 			"includes": ["**/*.astro"],
 			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},
@@ -159,7 +163,6 @@
 			"**",
 			"!**/.git",
 			"!**/app.css",
-			"!fluxer_admin/public/static/app.css",
 			"!**/build",
 			"fluxer_app/scripts/build",
 			"!**/dist",
@@ -180,11 +183,8 @@
 			"!packages/fonts",
 			"!fluxer_admin/static/htmx.min.js",
 			"!fluxer_api/src/api/openapi/openapi.json",
-			"!fluxer_api/pkgs/email/src/email_i18n/locales",
 			"!fluxer_api/pkgs/email/src/email_i18n/weblate",
-			"!fluxer_api/src/api/content_i18n/locales",
 			"!fluxer_api/src/api/content_i18n/weblate",
-			"!packages/errors/src/i18n/locales",
 			"!packages/errors/src/i18n/weblate",
 			"!**/auto-i18n-reviewed-unchanged.json"
 		],
@@ -34,7 +34,6 @@ FLUXER_KV_URL=redis://valkey:6379/0
 FLUXER_NATS_URL=nats://nats:4222
 FLUXER_NATS_JETSTREAM_URL=nats://nats:4222
 FLUXER_INTERNAL_API_ENDPOINT=http://127.0.0.1:8080
-FLUXER_INTERNAL_GATEWAY_ENDPOINT=http://127.0.0.1:8771
 FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT=http://127.0.0.1:8082
 FLUXER_MEDIA_PROXY_ENDPOINT=http://127.0.0.1:8082
 FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=http://localhost:8088/media
@@ -42,7 +41,6 @@ FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=http://localhost:8088/media
 FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
-FLUXER_SVC_CACHE_HARD_TTL_MS=600000

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -61,7 +59,6 @@ FLUXER_LIVEKIT_URL=ws://localhost:8088/livekit
 FLUXER_LIVEKIT_INTERNAL_URL=http://localhost:7880
 FLUXER_LIVEKIT_API_KEY=devkey
 FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
-FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

 FLUXER_API_PORT=8080
@@ -92,6 +89,7 @@ FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
+FLUXER_PROFILE_PSEUDONYM_SECRET=fluxer-dev-profile-pseudonym-secret
 FLUXER_VAPID_PUBLIC_KEY=BHIbdKs24FdPkOQS7hbeg3adceLS0IqlKsn71ywEe6kbeopeFFiG3lkvJac7BVqkuk7mxwEa555O2FXV3HLt56w
 FLUXER_VAPID_PRIVATE_KEY=cs24JvXSxHiqJQgkJNocJFAdzJpPmpfU9xD-fDpn3tw
 FLUXER_VAPID_EMAIL=dev@localhost
@@ -106,10 +104,7 @@ FLUXER_EMAIL_SMTP_HOST=mailpit
 FLUXER_EMAIL_SMTP_PORT=1025
 FLUXER_EMAIL_SMTP_USERNAME=dev
 FLUXER_EMAIL_SMTP_PASSWORD=dev
-FLUXER_EMAIL_SMTP_SECURE=false
-FLUXER_SMS_ENABLED=false
-FLUXER_CAPTCHA_ENABLED=false
-FLUXER_CAPTCHA_PROVIDER=none
+FLUXER_EMAIL_SMTP_TLS_MODE=none
 FLUXER_SEARCH_ENGINE=meilisearch
 FLUXER_SEARCH_URL=http://meilisearch:7700
 FLUXER_SEARCH_API_KEY=fluxer-dev-meilisearch
@@ -117,7 +112,6 @@ FLUXER_SEARCH_USERNAME=
 FLUXER_SEARCH_PASSWORD=
 FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED=false
 FLUXER_STRIPE_ENABLED=false
-FLUXER_NCMEC_ENABLED=false
 FLUXER_CLAMAV_ENABLED=false
 FLUXER_DISCOVERY_ENABLED=true
 FLUXER_SELF_HOSTED=true
@@ -126,11 +120,6 @@ FLUXER_TEST_MODE_ENABLED=false

 PUBLIC_BUILD_VERSION=dev
 PUBLIC_RELEASE_CHANNEL=canary
-PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
-PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
 FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
-AWS_ACCESS_KEY_ID=fluxer
-AWS_SECRET_ACCESS_KEY=fluxer-secret
-AWS_DEFAULT_REGION=us-east-1
@@ -94,7 +94,6 @@ skip = [
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
@@ -0,0 +1,11 @@
+.DS_Store
+.git/
+.gitignore
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+.idea/
+.vscode/
+ci/
@@ -0,0 +1,13 @@
+apiVersion: v2
+name: fluxer
+description: A complete Fluxer instance on Kubernetes, at parity with the self-hosted Docker Compose stack.
+type: application
+version: 0.1.0
+appVersion: "v1"
+kubeVersion: ">=1.29.0-0"
+home: https://docs.fluxer.app/operator/kubernetes/
+sources:
+  - https://github.com/fluxerapp/fluxer/tree/main/deploy/helm/fluxer
+keywords:
+  - fluxer
+  - chat
@@ -0,0 +1 @@
+domain: chat.example.test
@@ -0,0 +1,3 @@
+domain: chat.example.test
+secrets:
+  existingSecret: fluxer-ci-secret
@@ -0,0 +1,38 @@
+domain: chat.example.test
+postgres:
+  enabled: false
+  external:
+    host: db.example.test
+    ssl: "true"
+valkey:
+  enabled: false
+nats:
+  enabled: false
+  external:
+    url: nats://mq.example.test:4222
+meilisearch:
+  enabled: false
+  external:
+    url: https://search.example.test
+seaweedfs:
+  enabled: false
+s3:
+  endpoint: https://s3.example.test
+  publicEndpoint: https://cdn.example.test
+  region: eu-central-1
+  forcePathStyle: false
+livekit:
+  enabled: false
+  external:
+    url: http://livekit.voice.svc:7880
+    publicUrl: wss://livekit.example.test
+secrets:
+  values:
+    FLUXER_POSTGRES_PASSWORD: ci-postgres-password
+    FLUXER_SEARCH_API_KEY: ci-search-key
+    FLUXER_S3_SECRET_ACCESS_KEY: ci-s3-secret
+    FLUXER_NATS_AUTH_TOKEN: ci-nats-token
+    FLUXER_LIVEKIT_API_KEY: ci-livekit-key
+    FLUXER_LIVEKIT_API_SECRET: ci-livekit-secret-of-at-least-32-characters
+  extra:
+    FLUXER_KV_URL: redis://:[email protected]:6379/0
@@ -0,0 +1,11 @@
+domain: chat.example.test
+edge:
+  expose: gateway
+  gateway:
+    parentRefs:
+      - name: shared
+        namespace: gateway-system
+    timeouts:
+      request: 0s
+livekit:
+  expose: nodePort
@@ -0,0 +1,10 @@
+domain: chat.example.test
+email: [email protected]
+edge:
+  expose: loadBalancer
+  loadBalancer:
+    http3: true
+livekit:
+  expose: loadBalancer
+  nodeIP: 203.0.113.10
+  loadBalancerIP: 203.0.113.10
@@ -0,0 +1,15 @@
+domain: chat.example.test
+networkPolicy:
+  enabled: false
+livekit:
+  enabled: false
+nats:
+  replicas: 3
+initImage:
+  repository: registry.example.test/busybox
+  digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+postgres:
+  image:
+    repository: registry.example.test/postgres
+    tag: "16"
+  runAsUser: 999
@@ -0,0 +1,13 @@
+domain: chat.example.test
+networkPolicy:
+  ingressNamespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: ingress-nginx
+edge:
+  ingress:
+    className: nginx
+livekit:
+  nodeSelector:
+    kubernetes.io/hostname: voice-1
+  nodeCIDRs:
+    - 10.0.0.12/32
@@ -0,0 +1,64 @@
+{
+	servers {
+		trusted_proxies static {$FLUXER_EDGE_TRUSTED_PROXIES:private_ranges}
+		trusted_proxies_strict
+	}
+	{$FLUXER_EDGE_GLOBAL_OPTIONS}
+}
+
+{$FLUXER_EDGE_SITE_ADDRESS} {
+	encode {$FLUXER_EDGE_ENCODE:zstd gzip}
+
+	handle /_health {
+		respond "OK" 200
+	}
+
+	handle_path /api/* {
+		reverse_proxy api:8080
+	}
+
+	handle /gateway {
+		rewrite * /
+		reverse_proxy gateway:8080
+	}
+
+	handle_path /gateway/* {
+		reverse_proxy gateway:8080
+	}
+
+	handle_path /media/* {
+		reverse_proxy media-proxy:8080
+	}
+
+	handle_path /livekit/* {
+		reverse_proxy livekit:7880
+	}
+
+	handle {$FLUXER_ADMIN_BASE_PATH:/admin} {
+		rewrite * /
+		reverse_proxy admin:8080
+	}
+
+	handle_path {$FLUXER_ADMIN_BASE_PATH:/admin}/* {
+		reverse_proxy admin:8080
+	}
+
+	@staticAssets path /web/* /emoji/* /libs/* /avatars/* /badges/* /desktop/*
+	handle @staticAssets {
+		reverse_proxy static-proxy:8080
+	}
+
+	handle /.well-known/fluxer {
+		reverse_proxy api:8080
+	}
+
+	handle {
+		reverse_proxy app-proxy:8080
+	}
+}
+
+:8088 {
+	handle /.well-known/fluxer {
+		reverse_proxy api:8080
+	}
+}
@@ -0,0 +1,32 @@
+trap 'exit 0' TERM INT
+buckets="$FLUXER_S3_BUCKET_CDN $FLUXER_S3_BUCKET_UPLOADS $FLUXER_S3_BUCKET_REPORTS $FLUXER_S3_BUCKET_HARVESTS"
+missing="$buckets"
+for attempt in $(seq 1 "$FLUXER_SEAWEEDFS_INIT_ATTEMPTS"); do
+  if ! nc -z 127.0.0.1 9333 2>/dev/null; then
+    sleep 2
+    continue
+  fi
+  listed=$(echo "s3.bucket.list" | timeout 10 weed shell -master=127.0.0.1:9333 2>&1)
+  missing=""
+  for b in $buckets; do
+    echo "$listed" | grep -q "^[[:space:]]*$b[[:space:]]" || missing="${missing:+$missing }$b"
+  done
+  if [ -z "$missing" ]; then
+    if ! echo "s3.configure -user=fluxer -access_key=$FLUXER_S3_ACCESS_KEY -secret_key=$FLUXER_S3_SECRET_KEY -actions=Admin,Read,Write,List,Tagging -apply" | timeout 10 weed shell -master=127.0.0.1:9333 >/dev/null 2>&1; then
+      echo "seaweedfs-init could not configure the S3 identity" >&2
+      exit 1
+    fi
+    echo "buckets ready"
+    touch /tmp/fluxer-buckets-ready
+    while :; do
+      sleep 86400 &
+      wait $!
+    done
+  fi
+  for b in $missing; do
+    echo "s3.bucket.create -name $b" | timeout 10 weed shell -master=127.0.0.1:9333 >/dev/null 2>&1
+  done
+  sleep 2
+done
+echo "seaweedfs-init could not verify buckets: $missing" >&2
+exit 1
@@ -0,0 +1,72 @@
+{{- include "fluxer.validate" . }}
+{{- $v := .Values }}
+{{- $o := include "fluxer.origin" . }}
+Fluxer is installing in namespace {{ .Release.Namespace }}. Run one release per namespace.
+
+Open {{ $o }} once every pod is ready:
+
+  kubectl -n {{ .Release.Namespace }} get pods
+
+The admin panel is at {{ $o }}{{ $v.adminBasePath }}.
+
+The setup wizard asks for the setup token before it creates the admin account:
+
+  kubectl -n {{ .Release.Namespace }} get secret {{ include "fluxer.secretName" . }} -o jsonpath='{.data.FLUXER_SETUP_TOKEN}' | base64 -d
+
+A Secret with no FLUXER_SETUP_TOKEN has a token the API wrote to its log once:
+
+  kubectl -n {{ .Release.Namespace }} logs deployment/api | grep -i 'setup token'
+{{- if eq $v.edge.expose "loadBalancer" }}
+
+Point DNS for {{ $v.domain }} at the external address of the edge-public Service:
+
+  kubectl -n {{ .Release.Namespace }} get service edge-public
+{{- else if eq $v.edge.expose "none" }}
+
+Nothing exposes the instance yet. Send your proxy or tunnel to the Service edge
+on port 8080, with the Host header {{ $v.domain }}.
+{{- else }}
+
+Point DNS for {{ $v.domain }} at your {{ ternary "ingress controller" "gateway" (eq $v.edge.expose "ingress") }}. Its Service needs
+externalTrafficPolicy Local or the PROXY protocol, or every client shares one IP
+and registration hits its per-IP limit.
+{{- end }}
+{{- if $v.livekit.external.url }}
+
+Voice uses your LiveKit server at {{ $v.livekit.external.publicUrl }}. Point its webhook at
+{{ $o }}/api/webhooks/livekit, signed with the key in FLUXER_LIVEKIT_API_KEY.
+{{- end }}
+{{- if $v.livekit.enabled }}
+
+Voice media does not pass through the edge. Open these ports to the internet:
+{{- if eq $v.livekit.expose "hostNetwork" }}
+  {{ $v.livekit.tcpPort }}/tcp and {{ $v.livekit.udpPort }}/udp on the node that runs the livekit pod.
+  hostNetwork needs a namespace that allows privileged pods. Keep 7880 closed.
+{{- else if eq $v.livekit.expose "nodePort" }}
+  {{ $v.livekit.nodePorts.tcp }}/tcp and {{ $v.livekit.nodePorts.udp }}/udp on the node that runs the livekit pod.
+{{- else }}
+  {{ $v.livekit.tcpPort }}/tcp and {{ $v.livekit.udpPort }}/udp on the load balancer of the Service livekit-rtc,
+  whose public IP must be {{ $v.livekit.nodeIP }}.
+{{- end }}
+{{- end }}
+
+Back up the Secret {{ include "fluxer.secretName" . }}{{ if $v.postgres.enabled }}, the database in postgres-0{{ end }}{{ if $v.seaweedfs.enabled }} and the uploads on the volume data-seaweedfs-0{{ end }}.
+{{- if $v.secrets.existingSecret }}
+After editing the Secret {{ $v.secrets.existingSecret }}, restart the release:
+
+  kubectl -n {{ .Release.Namespace }} rollout restart deployment,statefulset -l app.kubernetes.io/instance={{ .Release.Name }}
+{{- end }}
+{{- if and $v.secrets.generate (not $v.secrets.existingSecret) }}
+
+Argo CD and helm template cannot read the existing Secret and would generate
+new secrets on every render. Under them, set secrets.generate=false and use
+secrets.existingSecret or give every key in secrets.values.
+{{- end }}
+
+To move to the latest v1 images, pull the repository and upgrade with your values file:
+
+  helm upgrade {{ .Release.Name }} <chart> -n {{ .Release.Namespace }} -f <your values file> --set-string image.revision=$(date +%s)
+
+Leave out --reuse-values, which keeps the defaults of the old chart version.
+
+Documentation: https://docs.fluxer.app/operator/kubernetes/
@@ -0,0 +1,109 @@
+{{- define "fluxer.s3Endpoint" -}}
+{{- .Values.s3.endpoint | default (ternary "http://seaweedfs:8333" "" .Values.seaweedfs.enabled) }}
+{{- end }}
+
+{{- define "fluxer.configData" -}}
+{{- $v := .Values }}
+{{- $o := include "fluxer.origin" . }}
+{{- $hostOrigin := include "fluxer.hostOrigin" . }}
+{{- $media := printf "%s/media" $o }}
+{{- $s3 := include "fluxer.s3Endpoint" . }}
+{{- $c := dict }}
+{{- $_ := set $c "FLUXER_ENV" "production" }}
+{{- $_ := set $c "FLUXER_SELF_HOSTED" "true" }}
+{{- $_ := set $c "FLUXER_DATABASE_BACKEND" "postgres" }}
+{{- $_ := set $c "FLUXER_TRUST_CLIENT_IP_HEADER" "true" }}
+{{- $_ := set $c "FLUXER_BASE_DOMAIN" $v.domain }}
+{{- $_ := set $c "FLUXER_PUBLIC_SCHEME" $v.scheme }}
+{{- $_ := set $c "FLUXER_PUBLIC_PORT" (include "fluxer.string" $v.port) }}
+{{- $_ := set $c "FLUXER_PUBLIC_ORIGIN" (trimSuffix "/" ($v.publicOrigin | default "")) }}
+{{- $_ := set $c "FLUXER_APP_ENDPOINT" $o }}
+{{- $_ := set $c "FLUXER_MARKETING_ENDPOINT" $o }}
+{{- $_ := set $c "FLUXER_MEDIA_ENDPOINT" $media }}
+{{- $_ := set $c "FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT" $media }}
+{{- $_ := set $c "FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT" $media }}
+{{- $_ := set $c "FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT" $media }}
+{{- $_ := set $c "FLUXER_ADMIN_ENDPOINT" (printf "%s%s" $o $v.adminBasePath) }}
+{{- $_ := set $c "FLUXER_GATEWAY_STATIC_CDN_ENDPOINT" $o }}
+{{- $_ := set $c "FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS" $hostOrigin }}
+{{- $_ := set $c "FLUXER_PASSKEY_RP_ID" $v.domain }}
+{{- $_ := set $c "FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS" $o }}
+{{- if $v.postgres.enabled }}
+{{- $_ := set $c "FLUXER_POSTGRES_HOST" "postgres" }}
+{{- $_ := set $c "FLUXER_POSTGRES_PORT" "5432" }}
+{{- $_ := set $c "FLUXER_POSTGRES_DATABASE" $v.postgres.database }}
+{{- $_ := set $c "FLUXER_POSTGRES_USERNAME" $v.postgres.username }}
+{{- else }}
+{{- with $v.postgres.external }}
+{{- $_ := set $c "FLUXER_POSTGRES_HOST" (.host | default "") }}
+{{- $_ := set $c "FLUXER_POSTGRES_PORT" (include "fluxer.string" (.port | default "")) }}
+{{- $_ := set $c "FLUXER_POSTGRES_DATABASE" (.database | default "") }}
+{{- $_ := set $c "FLUXER_POSTGRES_USERNAME" (.username | default "") }}
+{{- $_ := set $c "FLUXER_POSTGRES_SSL" (include "fluxer.string" (.ssl | default "")) }}
+{{- end }}
+{{- end }}
+{{- if not $v.valkey.enabled }}
+{{- $_ := set $c "FLUXER_KV_URL" ($v.valkey.external.url | default "") }}
+{{- end }}
+{{- $nats := ternary "nats://nats:4222" ($v.nats.external.url | default "") $v.nats.enabled }}
+{{- $_ := set $c "FLUXER_NATS_URL" $nats }}
+{{- $_ := set $c "FLUXER_NATS_JETSTREAM_URL" $nats }}
+{{- $_ := set $c "FLUXER_SVC_NATS_URL" $nats }}
+{{- $_ := set $c "FLUXER_SEARCH_ENGINE" "meilisearch" }}
+{{- $_ := set $c "FLUXER_SEARCH_URL" (ternary "http://meilisearch:7700" ($v.meilisearch.external.url | default "") $v.meilisearch.enabled) }}
+{{- $_ := set $c "FLUXER_S3_ENDPOINT" $s3 }}
+{{- $_ := set $c "FLUXER_S3_PUBLIC_ENDPOINT" ($v.s3.publicEndpoint | default $s3) }}
+{{- $_ := set $c "FLUXER_S3_REGION" $v.s3.region }}
+{{- $_ := set $c "FLUXER_S3_FORCE_PATH_STYLE" (toString $v.s3.forcePathStyle) }}
+{{- $_ := set $c "FLUXER_S3_BUCKET_CDN" $v.s3.buckets.cdn }}
+{{- $_ := set $c "FLUXER_S3_BUCKET_UPLOADS" $v.s3.buckets.uploads }}
+{{- $_ := set $c "FLUXER_S3_BUCKET_REPORTS" $v.s3.buckets.reports }}
+{{- $_ := set $c "FLUXER_S3_BUCKET_HARVESTS" $v.s3.buckets.harvests }}
+{{- $livekit := include "fluxer.livekitMode" . }}
+{{- $_ := set $c "FLUXER_LIVEKIT_ENABLED" (toString (ne $livekit "off")) }}
+{{- if eq $livekit "bundled" }}
+{{- $_ := set $c "FLUXER_LIVEKIT_INTERNAL_URL" "http://livekit:7880" }}
+{{- $_ := set $c "FLUXER_LIVEKIT_DEFAULT_REGION" $v.livekit.defaultRegion }}
+{{- $_ := set $c "FLUXER_LIVEKIT_URL" (printf "%s/livekit" $hostOrigin) }}
+{{- else if eq $livekit "external" }}
+{{- $_ := set $c "FLUXER_LIVEKIT_INTERNAL_URL" $v.livekit.external.url }}
+{{- $_ := set $c "FLUXER_LIVEKIT_DEFAULT_REGION" $v.livekit.defaultRegion }}
+{{- $_ := set $c "FLUXER_LIVEKIT_URL" $v.livekit.external.publicUrl }}
+{{- end }}
+{{- $_ := set $c "FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED" "false" }}
+{{- $_ := set $c "FLUXER_EMAIL_FROM_EMAIL" "noreply@localhost" }}
+{{- $_ := set $c "FLUXER_VAPID_EMAIL" ($v.email | default (printf "admin@%s" $v.domain)) }}
+{{- $_ := set $c "FLUXER_INTERNAL_API_ENDPOINT" "http://api:8080" }}
+{{- $_ := set $c "FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT" "http://media-proxy:8080" }}
+{{- range $k, $val := $v.env | default dict }}
+{{- $_ := set $c $k (include "fluxer.string" ($val | default "")) }}
+{{- end }}
+{{- $out := dict }}
+{{- range $k, $val := $c }}
+{{- if $val }}
+{{- $_ := set $out $k $val }}
+{{- end }}
+{{- end }}
+{{- toYaml $out }}
+{{- end }}
+
+{{- define "fluxer.appProxyConfigData" -}}
+{{- $v := .Values }}
+{{- $s3 := include "fluxer.s3Endpoint" . }}
+{{- $c := dict }}
+{{- $_ := set $c "FLUXER_APP_PROXY_PORT" "8080" }}
+{{- $_ := set $c "DISCOVERY_UPSTREAM_URL" "http://api:8080/.well-known/fluxer" }}
+{{- $_ := set $c "FLUXER_S3_PUBLIC_ENDPOINT" ($v.s3.publicEndpoint | default $s3) }}
+{{- $_ := set $c "FLUXER_S3_BUCKET_UPLOADS" $v.s3.buckets.uploads }}
+{{- $_ := set $c "FLUXER_MEDIA_ENDPOINT" (printf "%s/media" (include "fluxer.origin" .)) }}
+{{- range $k, $val := $v.appProxy.config | default dict }}
+{{- $_ := set $c $k (include "fluxer.string" ($val | default "")) }}
+{{- end }}
+{{- $out := dict }}
+{{- range $k, $val := $c }}
+{{- if $val }}
+{{- $_ := set $out $k $val }}
+{{- end }}
+{{- end }}
+{{- toYaml $out }}
+{{- end }}
@@ -0,0 +1,375 @@
+{{- define "fluxer.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{- define "fluxer.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "fluxer.podLabels" -}}
+{{ include "fluxer.selectorLabels" . }}
+{{- with .component }}
+app.kubernetes.io/component: {{ . }}
+{{- end }}
+app.kubernetes.io/part-of: fluxer
+{{- end }}
+
+{{- define "fluxer.labels" -}}
+{{ include "fluxer.podLabels" . }}
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+app.kubernetes.io/version: {{ .root.Chart.AppVersion | quote }}
+helm.sh/chart: {{ include "fluxer.chart" .root }}
+{{- end }}
+
+{{- define "fluxer.string" -}}
+{{- if and (kindIs "float64" .) (eq . (float64 (int64 .))) }}
+{{- int64 . | toString }}
+{{- else }}
+{{- toString . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.origin" -}}
+{{- $v := .Values }}
+{{- if $v.publicOrigin }}
+{{- trimSuffix "/" $v.publicOrigin }}
+{{- else }}
+{{- $default := ternary 443 80 (eq $v.scheme "https") }}
+{{- if eq (int $v.port) $default }}
+{{- printf "%s://%s" $v.scheme $v.domain }}
+{{- else }}
+{{- printf "%s://%s:%d" $v.scheme $v.domain (int $v.port) }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.hostOrigin" -}}
+{{- $v := .Values }}
+{{- if $v.publicOrigin }}
+{{- trimSuffix "/" $v.publicOrigin }}
+{{- else }}
+{{- printf "%s://%s:%d" $v.scheme $v.domain (int $v.port) }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.secretName" -}}
+{{- .Values.secrets.existingSecret | default "fluxer-env" }}
+{{- end }}
+
+{{- define "fluxer.thirdPartyImage" -}}
+{{- $ref := printf "%s:%s" .repository (include "fluxer.string" .tag) }}
+{{- with .digest }}
+{{- $ref = printf "%s@%s" $ref . }}
+{{- end }}
+{{- $ref | quote }}
+{{- end }}
+
+{{- define "fluxer.image" -}}
+{{- $v := .root.Values.image }}
+{{- $img := (.w | default dict).image | default dict }}
+{{- $registry := $img.registry | default $v.registry }}
+{{- $tag := $img.tag | default (get ($v.tags | default dict) .image) | default $v.tag }}
+{{- $ref := printf "%s/%s:%s" $registry .image (include "fluxer.string" $tag) }}
+{{- with $img.digest | default (get ($v.digests | default dict) .image) }}
+{{- $ref = printf "%s@%s" $ref . }}
+{{- end }}
+{{- $ref | quote }}
+{{- end }}
+
+{{- define "fluxer.pullPolicy" -}}
+{{- (((.w | default dict).image | default dict).pullPolicy) | default .root.Values.image.pullPolicy }}
+{{- end }}
+
+{{- define "fluxer.pullSecrets" -}}
+{{- with .Values.image.pullSecrets }}
+imagePullSecrets:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.podSecurityContext" -}}
+runAsNonRoot: true
+{{- with .uid }}
+runAsUser: {{ . }}
+runAsGroup: {{ $.gid | default . }}
+fsGroup: {{ $.gid | default . }}
+fsGroupChangePolicy: OnRootMismatch
+{{- end }}
+seccompProfile:
+  type: RuntimeDefault
+{{- end }}
+
+{{- define "fluxer.containerSecurityContext" -}}
+allowPrivilegeEscalation: false
+capabilities:
+  drop:
+    - ALL
+{{- end }}
+
+{{- define "fluxer.scheduling" -}}
+{{- $w := .w | default dict }}
+{{- with $w.nodeSelector }}
+nodeSelector:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with $w.tolerations }}
+tolerations:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with $w.affinity }}
+affinity:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- $spread := list }}
+{{- range $w.topologySpreadConstraints }}
+{{- $c := deepCopy . }}
+{{- if not (hasKey $c "labelSelector") }}
+{{- $_ := set $c "labelSelector" (dict "matchLabels" (include "fluxer.selectorLabels" $ | fromYaml)) }}
+{{- end }}
+{{- $spread = append $spread $c }}
+{{- end }}
+{{- with $spread }}
+topologySpreadConstraints:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.pvc" -}}
+- metadata:
+    name: data
+  spec:
+    accessModes:
+      - ReadWriteOnce
+    {{- with .storageClassName }}
+    storageClassName: {{ . }}
+    {{- end }}
+    resources:
+      requests:
+        storage: {{ .size }}
+{{- end }}
+
+{{- define "fluxer.vapidPair" -}}
+{{- $der := genPrivateKey "ecdsa" | replace "-----BEGIN EC PRIVATE KEY-----" "" | replace "-----END EC PRIVATE KEY-----" "" | nospace | b64dec -}}
+private: {{ substr 7 39 $der | b64enc | replace "+" "-" | replace "/" "_" | trimAll "=" }}
+public: {{ substr 56 121 $der | b64enc | replace "+" "-" | replace "/" "_" | trimAll "=" }}
+{{- end }}
+
+{{- define "fluxer.livekitMode" -}}
+{{- if .Values.livekit.enabled }}bundled{{ else if .Values.livekit.external.url }}external{{ else }}off{{ end }}
+{{- end }}
+
+{{- define "fluxer.noGenerateKeys" -}}
+{{- $keys := list }}
+{{- $extra := .Values.secrets.extra | default dict }}
+{{- if and (not .Values.postgres.enabled) (not (get $extra "FLUXER_POSTGRES_URL")) }}
+{{- $keys = append $keys "FLUXER_POSTGRES_PASSWORD" }}
+{{- end }}
+{{- if not .Values.meilisearch.enabled }}
+{{- $keys = append $keys "FLUXER_SEARCH_API_KEY" }}
+{{- end }}
+{{- if not .Values.seaweedfs.enabled }}
+{{- $keys = append $keys "FLUXER_S3_SECRET_ACCESS_KEY" }}
+{{- end }}
+{{- if eq (include "fluxer.livekitMode" .) "external" }}
+{{- $keys = append $keys "FLUXER_LIVEKIT_API_SECRET" }}
+{{- end }}
+{{- toJson $keys }}
+{{- end }}
+
+{{- define "fluxer.requiredSecretKeys" -}}
+{{- $keys := list }}
+{{- $extra := .Values.secrets.extra | default dict }}
+{{- range $k, $_ := .Values.secrets.values }}
+{{- if and (eq $k "FLUXER_POSTGRES_PASSWORD") (get $extra "FLUXER_POSTGRES_URL") }}
+{{- else if and (hasPrefix "FLUXER_LIVEKIT_" $k) (eq (include "fluxer.livekitMode" $) "off") }}
+{{- else if and (eq $k "FLUXER_VALKEY_PASSWORD") (not $.Values.valkey.enabled) }}
+{{- else if and (eq $k "FLUXER_NATS_AUTH_TOKEN") (not $.Values.nats.enabled) }}
+{{- else if and (eq $k "FLUXER_SETUP_TOKEN") (or $.Values.secrets.existingSecret (and (not $.Values.secrets.generate) (not (include "fluxer.string" (get $.Values.secrets.values $k | default ""))))) }}
+{{- else }}
+{{- $keys = append $keys $k }}
+{{- end }}
+{{- end }}
+{{- toJson $keys }}
+{{- end }}
+
+{{- define "fluxer.resolveSecrets" -}}
+{{- $v := .Values }}
+{{- $existing := dict }}
+{{- $found := lookup "v1" "Secret" .Release.Namespace (include "fluxer.secretName" .) }}
+{{- range $k, $val := ($found.data | default dict) }}
+{{- $_ := set $existing $k (b64dec $val) }}
+{{- end }}
+{{- $out := dict }}
+{{- if $v.secrets.existingSecret }}
+{{- $out = $existing }}
+{{- else }}
+{{- $noGenerate := include "fluxer.noGenerateKeys" . | fromJsonArray }}
+{{- $explicit := $v.secrets.values | default dict }}
+{{- $vapidPublic := include "fluxer.string" (get $explicit "FLUXER_VAPID_PUBLIC_KEY" | default "") }}
+{{- $vapidPrivate := include "fluxer.string" (get $explicit "FLUXER_VAPID_PRIVATE_KEY" | default "") }}
+{{- if and $vapidPublic $vapidPrivate }}
+{{- else if or $vapidPublic $vapidPrivate }}
+{{- fail "secrets.values.FLUXER_VAPID_PUBLIC_KEY and secrets.values.FLUXER_VAPID_PRIVATE_KEY must be set together, or both left empty to generate a pair" }}
+{{- else if and (get $existing "FLUXER_VAPID_PUBLIC_KEY") (get $existing "FLUXER_VAPID_PRIVATE_KEY") }}
+{{- $vapidPublic = get $existing "FLUXER_VAPID_PUBLIC_KEY" }}
+{{- $vapidPrivate = get $existing "FLUXER_VAPID_PRIVATE_KEY" }}
+{{- else if $v.secrets.generate }}
+{{- $pair := include "fluxer.vapidPair" . | fromYaml }}
+{{- $vapidPublic = $pair.public }}
+{{- $vapidPrivate = $pair.private }}
+{{- else }}
+{{- fail "secrets.values.FLUXER_VAPID_PUBLIC_KEY and secrets.values.FLUXER_VAPID_PRIVATE_KEY are empty and secrets.generate is false" }}
+{{- end }}
+{{- $_ := set $out "FLUXER_VAPID_PUBLIC_KEY" $vapidPublic }}
+{{- $_ := set $out "FLUXER_VAPID_PRIVATE_KEY" $vapidPrivate }}
+{{- $required := include "fluxer.requiredSecretKeys" . | fromJsonArray }}
+{{- $outsideToken := include "fluxer.string" (get $explicit "FLUXER_NATS_AUTH_TOKEN" | default "") }}
+{{- if and $outsideToken (not $v.nats.enabled) }}
+{{- $_ := set $out "FLUXER_NATS_AUTH_TOKEN" $outsideToken }}
+{{- end }}
+{{- range $k := $required }}
+{{- if not (hasPrefix "FLUXER_VAPID_" $k) }}
+{{- $given := include "fluxer.string" (get $explicit $k | default "") }}
+{{- if $given }}
+{{- $_ := set $out $k $given }}
+{{- else if has $k $noGenerate }}
+{{- fail (printf "secrets.values.%s is required when the matching service is not bundled" $k) }}
+{{- else if get $existing $k }}
+{{- $_ := set $out $k (get $existing $k) }}
+{{- else if $v.secrets.generate }}
+{{- if eq $k "FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64" }}
+{{- $_ := set $out $k (randBytes 32) }}
+{{- else }}
+{{- $_ := set $out $k (randAlphaNum 64) }}
+{{- end }}
+{{- else }}
+{{- fail (printf "secrets.values.%s is empty and secrets.generate is false" $k) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- range $k, $val := $v.secrets.extra | default dict }}
+{{- $s := include "fluxer.string" ($val | default "") }}
+{{- if $s }}
+{{- $_ := set $out $k $s }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- toJson $out }}
+{{- end }}
+
+{{- define "fluxer.secretData" -}}
+{{- if not (hasKey .Values "fluxerResolvedSecrets") }}
+{{- $_ := set .Values "fluxerResolvedSecrets" (include "fluxer.resolveSecrets" . | fromJson) }}
+{{- end }}
+{{- toJson (get .Values "fluxerResolvedSecrets") }}
+{{- end }}
+
+{{- define "fluxer.secretEnv" -}}
+- name: {{ .name }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "fluxer.secretName" .root }}
+      key: {{ .key }}
+{{- end }}
+
+{{- define "fluxer.instanceChecksum" -}}
+{{- $parts := list (include "fluxer.configData" .) (include "fluxer.appProxyConfigData" .) (toJson .Values.secrets.values) (toJson (.Values.secrets.extra | default dict)) (include "fluxer.string" .Values.image.revision) (include "fluxer.secretData" .) }}
+{{- join "\n" $parts | sha256sum }}
+{{- end }}
+
+{{- define "fluxer.envList" -}}
+{{- $w := .w | default dict }}
+{{- $own := $w.env | default dict }}
+{{- $base := .env | default list }}
+{{- $names := list }}
+{{- range $base }}
+{{- $names = append $names .name }}
+{{- end }}
+{{- $out := list }}
+{{- range $base }}
+{{- if hasKey $own .name }}
+{{- $val := get $own .name }}
+{{- if not (kindIs "invalid" $val) }}
+{{- $out = append $out (dict "name" .name "value" (include "fluxer.string" $val)) }}
+{{- end }}
+{{- else }}
+{{- $out = append $out . }}
+{{- end }}
+{{- end }}
+{{- range $k := keys $own | sortAlpha }}
+{{- $val := get $own $k }}
+{{- if and (not (has $k $names)) (not (kindIs "invalid" $val)) }}
+{{- $out = append $out (dict "name" $k "value" (include "fluxer.string" $val)) }}
+{{- end }}
+{{- end }}
+{{- $out = concat $out ($w.extraEnv | default list) }}
+{{- with $out }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.probes" -}}
+{{- $own := (.w | default dict).probes | default dict }}
+{{- range $probe := list "startup" "liveness" "readiness" }}
+{{- $p := get ($.probes | default dict) $probe }}
+{{- if hasKey $own $probe }}
+{{- $p = get $own $probe }}
+{{- end }}
+{{- with $p }}
+{{ $probe }}Probe:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.waitFor" -}}
+{{- with .waitFor }}
+initContainers:
+  - name: wait-for-dependencies
+    image: {{ include "fluxer.thirdPartyImage" $.root.Values.initImage }}
+    imagePullPolicy: {{ $.root.Values.initImage.pullPolicy }}
+    command:
+      - sh
+      - -c
+      - {{ printf "for t in %s; do until nc -z -w 2 ${t%%:*} ${t##*:}; do echo waiting for $t; sleep 2; done; done" (join " " .) | quote }}
+    resources:
+      requests:
+        cpu: 10m
+        memory: 16Mi
+      limits:
+        memory: 32Mi
+    securityContext:
+      runAsUser: 65532
+      runAsGroup: 65532
+      {{- include "fluxer.containerSecurityContext" . | nindent 6 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.appWaitFor" -}}
+{{- $out := list }}
+{{- if and .usesNats .root.Values.nats.enabled }}
+{{- $out = append $out "nats:4222" }}
+{{- end }}
+{{- if and .usesPostgres .root.Values.postgres.enabled }}
+{{- $out = append $out "postgres:5432" }}
+{{- end }}
+{{- if and .usesS3 .root.Values.seaweedfs.enabled }}
+{{- $out = append $out "seaweedfs:8333" }}
+{{- end }}
+{{- if and .usesKv .root.Values.valkey.enabled }}
+{{- $out = append $out "valkey:6379" }}
+{{- end }}
+{{- if .usesSvc }}
+{{- range $name := list "gifs" "messages" "snowflakes" "unfurl" "users" }}
+{{- $svc := get $.root.Values.svc $name | default dict }}
+{{- if gt (int (include "fluxer.replicas" (dict "w" ($svc.router | default dict)))) 0 }}
+{{- $out = append $out (printf "%s:8090" $name) }}
+{{- end }}
+{{- if gt (int (include "fluxer.replicas" (dict "w" ($svc.shard | default dict)))) 0 }}
+{{- $out = append $out (printf "%s-shard:8090" $name) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- toJson $out }}
+{{- end }}
@@ -0,0 +1,245 @@
+{{- define "fluxer.validate" -}}
+{{- if not (hasKey .Values "fluxerValidated") }}
+{{- $_ := set .Values "fluxerValidated" true }}
+{{- $v := .Values }}
+{{- if not (regexMatch "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$" ($v.domain | default "")) }}
+{{- fail "domain must be set to the lowercase public hostname of the instance, for example --set domain=chat.example.com" }}
+{{- end }}
+{{- if not (has $v.scheme (list "http" "https")) }}
+{{- fail "scheme must be http or https" }}
+{{- end }}
+{{- if and $v.publicOrigin (not (regexMatch "^https?://[^/]+$" (trimSuffix "/" $v.publicOrigin))) }}
+{{- fail "publicOrigin must be a scheme, host and optional port, for example https://chat.example.com" }}
+{{- end }}
+{{- if not (regexMatch "^/[^/].*[^/]$|^/[^/]$" $v.adminBasePath) }}
+{{- fail "adminBasePath must start with a slash and must not end with one, for example /admin" }}
+{{- end }}
+{{- $extra := $v.secrets.extra | default dict }}
+{{- if and (not $v.postgres.enabled) (not $v.postgres.external.host) (not (get $extra "FLUXER_POSTGRES_URL")) (not $v.secrets.existingSecret) }}
+{{- fail "postgres.enabled is false, so set postgres.external.host or secrets.extra.FLUXER_POSTGRES_URL" }}
+{{- end }}
+{{- if and (not $v.valkey.enabled) (not $v.valkey.external.url) (not (get $extra "FLUXER_KV_URL")) (not $v.secrets.existingSecret) }}
+{{- fail "valkey.enabled is false, so set valkey.external.url or secrets.extra.FLUXER_KV_URL" }}
+{{- end }}
+{{- if and (not $v.nats.enabled) (not $v.nats.external.url) }}
+{{- fail "nats.enabled is false, so set nats.external.url" }}
+{{- end }}
+{{- if and (not $v.meilisearch.enabled) (not $v.meilisearch.external.url) }}
+{{- fail "meilisearch.enabled is false, so set meilisearch.external.url" }}
+{{- end }}
+{{- if and (not $v.seaweedfs.enabled) (not $v.s3.endpoint) }}
+{{- fail "seaweedfs.enabled is false, so set s3.endpoint to your S3 store" }}
+{{- end }}
+{{- if gt (int $v.nats.replicas) 1 }}
+{{- if lt (int $v.nats.replicas) 3 }}
+{{- fail "nats.replicas must be 1, or 3 or more for a JetStream cluster" }}
+{{- end }}
+{{- end }}
+{{- if gt (int (include "fluxer.replicas" (dict "w" $v.worker))) 1 }}
+{{- fail "worker.replicas must be 1, because the worker runs the cron scheduler" }}
+{{- end }}
+{{- if not (has $v.livekit.expose (list "hostNetwork" "loadBalancer" "nodePort")) }}
+{{- fail "livekit.expose must be hostNetwork, loadBalancer or nodePort" }}
+{{- end }}
+{{- if and $v.livekit.enabled $v.livekit.external.url }}
+{{- fail "livekit.external.url names a LiveKit server of your own, so set livekit.enabled to false" }}
+{{- end }}
+{{- if and $v.livekit.external.url (not (regexMatch "^(wss?|https?)://[^/]+" ($v.livekit.external.publicUrl | default ""))) }}
+{{- fail "livekit.external.url is set, so set livekit.external.publicUrl to the address browsers use to reach that LiveKit server, for example wss://livekit.example.com" }}
+{{- end }}
+{{- if and $v.livekit.enabled (eq $v.livekit.expose "loadBalancer") (not $v.livekit.nodeIP) }}
+{{- fail "livekit.expose is loadBalancer, so reserve a public address before installing, set livekit.nodeIP to it, and pin the Service livekit-rtc to it with livekit.loadBalancerIP or livekit.serviceAnnotations. Use hostNetwork or nodePort where a load balancer cannot serve TCP and UDP on one address" }}
+{{- end }}
+{{- if not (has $v.edge.expose (list "ingress" "gateway" "loadBalancer" "none")) }}
+{{- fail "edge.expose must be ingress, gateway, loadBalancer or none" }}
+{{- end }}
+{{- if not (has $v.edge.ingress.tls.mode (list "certManager" "existingSecret" "none")) }}
+{{- fail "edge.ingress.tls.mode must be certManager, existingSecret or none" }}
+{{- end }}
+{{- if and (eq $v.edge.expose "gateway") (not $v.edge.gateway.parentRefs) }}
+{{- fail "edge.expose is gateway, so set edge.gateway.parentRefs to the Gateway the route attaches to" }}
+{{- end }}
+{{- if and (eq $v.edge.expose "loadBalancer") (ne $v.scheme "https") }}
+{{- fail "edge.expose loadBalancer serves HTTPS itself, so scheme must be https" }}
+{{- end }}
+{{- if and $v.networkPolicy.enabled $v.networkPolicy.ingressNamespaceSelector $v.livekit.enabled (eq $v.livekit.expose "hostNetwork") (not $v.livekit.nodeCIDRs) }}
+{{- fail "networkPolicy.ingressNamespaceSelector limits who reaches the edge, and LiveKit on the host network sends its webhook to the edge from a node address. Set livekit.nodeCIDRs to the address of the LiveKit node, for example 10.0.0.12/32" }}
+{{- end }}
+
+{{- $placeholder := "(?i)change[_-]?me" }}
+{{- $secretName := "_(PASSWORD|SECRET|TOKEN|COOKIE|KEY|KEYS|KEY_BASE|SECRETS?_BASE64)$" }}
+{{- $credentialUrl := "://[^/@ ]*:[^/@ ]*@" }}
+{{- $plain := dict "env" ($v.env | default dict) "appProxy.config" ($v.appProxy.config | default dict) "edge.env" ($v.edge.env | default dict) }}
+{{- range $name := list "api" "worker" "gateway" "mediaProxy" "push" "admin" "appProxy" "staticProxy" }}
+{{- $_ := set $plain (printf "%s.env" $name) ((get $v $name).env | default dict) }}
+{{- end }}
+{{- range $name, $svc := $v.svc }}
+{{- range $part := list "router" "shard" }}
+{{- $_ := set $plain (printf "svc.%s.%s.env" $name $part) ((get ($svc | default dict) $part | default dict).env | default dict) }}
+{{- end }}
+{{- end }}
+{{- range $where, $map := $plain }}
+{{- range $k, $val := $map }}
+{{- $s := include "fluxer.string" ($val | default "") }}
+{{- if regexMatch $placeholder $s }}
+{{- fail (printf "%s.%s is a placeholder. Remove it or set a real value" $where $k) }}
+{{- end }}
+{{- if or (hasKey $v.secrets.values $k) (regexMatch $secretName $k) }}
+{{- fail (printf "%s.%s is a secret and would be stored in plain text. Set it in secrets.extra instead, or reference a Secret of your own from extraEnv" $where $k) }}
+{{- end }}
+{{- if regexMatch $credentialUrl $s }}
+{{- fail (printf "%s.%s is a URL that holds a password and would be stored in plain text. Set it in secrets.extra instead" $where $k) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- range $k, $val := $v.secrets.values }}
+{{- if regexMatch $placeholder (include "fluxer.string" ($val | default "")) }}
+{{- fail (printf "secrets.values.%s is a placeholder. Leave it empty to generate a value, or set a real one" $k) }}
+{{- end }}
+{{- end }}
+{{- range $k, $val := $extra }}
+{{- if regexMatch $placeholder (include "fluxer.string" ($val | default "")) }}
+{{- fail (printf "secrets.extra.%s is a placeholder. Remove it or set a real value" $k) }}
+{{- end }}
+{{- end }}
+
+{{- $connected := false }}
+{{- if $v.clusterChecks }}
+{{- $connected = or (lookup "v1" "Namespace" "" .Release.Namespace) (lookup "v1" "Namespace" "" "kube-system") | not | not }}
+{{- end }}
+{{- $data := include "fluxer.secretData" . | fromJson }}
+{{- $secret := include "fluxer.secretName" . }}
+{{- if $v.secrets.existingSecret }}
+{{- if and $connected (not $data) }}
+{{- fail (printf "secrets.existingSecret names the Secret %s, which does not exist in namespace %s. Create it first with every key listed under secrets.values" $secret .Release.Namespace) }}
+{{- end }}
+{{- if $data }}
+{{- $missing := list }}
+{{- range $k := include "fluxer.requiredSecretKeys" . | fromJsonArray }}
+{{- if not (get $data $k) }}
+{{- $missing = append $missing $k }}
+{{- end }}
+{{- end }}
+{{- with $missing }}
+{{- fail (printf "Secret %s is missing these keys: %s" $secret (join ", " .)) }}
+{{- end }}
+{{- $config := include "fluxer.configData" . | fromYaml }}
+{{- if $v.valkey.enabled }}
+{{- $_ := set $config "FLUXER_KV_URL" "the bundled Valkey" }}
+{{- end }}
+{{- $shadowed := list }}
+{{- range $k := keys $config | sortAlpha }}
+{{- if and (hasKey $data $k) (ne (get $data $k) (get $config $k)) }}
+{{- $shadowed = append $shadowed $k }}
+{{- end }}
+{{- end }}
+{{- with $shadowed }}
+{{- fail (printf "Secret %s holds settings the chart sets itself, and the two disagree: %s. Remove them from the Secret. To keep an outside service, turn the bundled one off, as the External services section of the Kubernetes page describes" $secret (join ", " .)) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if $data }}
+{{- range $k, $val := $data }}
+{{- if regexMatch $placeholder $val }}
+{{- fail (printf "%s in the Secret %s is a placeholder. Set a real value" $k $secret) }}
+{{- end }}
+{{- end }}
+{{- with get $data "FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64" }}
+{{- if or (not (regexMatch "^[A-Za-z0-9+/]+={0,2}$" .)) (lt (len (b64dec .)) 32) }}
+{{- fail "FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 must be standard base64 of at least 32 bytes, for example the output of openssl rand -base64 32" }}
+{{- end }}
+{{- end }}
+{{- $long := list "FLUXER_SUDO_MODE_SECRET" "FLUXER_CONNECTION_INITIATION_SECRET" "FLUXER_PROFILE_PSEUDONYM_SECRET" "FLUXER_GATEWAY_RPC_AUTH_TOKEN" "FLUXER_ERLANG_COOKIE" "FLUXER_MEDIA_PROXY_SECRET_KEY" "FLUXER_ADMIN_SECRET_KEY_BASE" "FLUXER_ADMIN_OAUTH_CLIENT_SECRET" "FLUXER_SETUP_TOKEN" }}
+{{- if ne (include "fluxer.livekitMode" .) "off" }}
+{{- $long = append $long "FLUXER_LIVEKIT_API_SECRET" }}
+{{- end }}
+{{- if $v.valkey.enabled }}
+{{- $long = append $long "FLUXER_VALKEY_PASSWORD" }}
+{{- end }}
+{{- if $v.nats.enabled }}
+{{- $long = append $long "FLUXER_NATS_AUTH_TOKEN" }}
+{{- end }}
+{{- range $k := $long }}
+{{- if and (hasKey $data $k) (lt (len (get $data $k)) 32) }}
+{{- fail (printf "%s must be at least 32 characters, for example the output of openssl rand -hex 32" $k) }}
+{{- end }}
+{{- end }}
+{{- if and $v.meilisearch.enabled (hasKey $data "FLUXER_SEARCH_API_KEY") (lt (len (get $data "FLUXER_SEARCH_API_KEY")) 16) }}
+{{- fail "FLUXER_SEARCH_API_KEY must be at least 16 characters, or the bundled Meilisearch refuses to start" }}
+{{- end }}
+{{- if eq (get $data "FLUXER_POSTGRES_PASSWORD" | default "") "fluxer" }}
+{{- fail "FLUXER_POSTGRES_PASSWORD must not be fluxer, which the services refuse in production" }}
+{{- end }}
+{{- $plainOnly := list }}
+{{- if $v.seaweedfs.enabled }}
+{{- $plainOnly = concat $plainOnly (list "FLUXER_S3_ACCESS_KEY_ID" "FLUXER_S3_SECRET_ACCESS_KEY") }}
+{{- end }}
+{{- if $v.valkey.enabled }}
+{{- $plainOnly = append $plainOnly "FLUXER_VALKEY_PASSWORD" }}
+{{- end }}
+{{- if $v.nats.enabled }}
+{{- $plainOnly = append $plainOnly "FLUXER_NATS_AUTH_TOKEN" }}
+{{- end }}
+{{- range $k := $plainOnly }}
+{{- if and (hasKey $data $k) (not (regexMatch "^[A-Za-z0-9]+$" (get $data $k))) }}
+{{- fail (printf "%s must contain letters and digits only, because the bundled service takes it on a command line or in a URL" $k) }}
+{{- end }}
+{{- end }}
+{{- $pub := get $data "FLUXER_VAPID_PUBLIC_KEY" | default "" }}
+{{- $priv := get $data "FLUXER_VAPID_PRIVATE_KEY" | default "" }}
+{{- if or $pub $priv }}
+{{- if or (not (regexMatch "^[A-Za-z0-9_-]{87}$" $pub)) (not (regexMatch "^[A-Za-z0-9_-]{43}$" $priv)) }}
+{{- fail "FLUXER_VAPID_PUBLIC_KEY and FLUXER_VAPID_PRIVATE_KEY must be an unpadded base64url P-256 pair of 87 and 43 characters" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- if $connected }}
+{{- if and (eq $v.edge.expose "ingress") (eq $v.edge.ingress.tls.mode "certManager") (not (.Capabilities.APIVersions.Has "cert-manager.io/v1")) }}
+{{- fail "edge.ingress.tls.mode is certManager, but cert-manager is not installed. Install cert-manager, or set edge.ingress.tls.mode to existingSecret or none, or set edge.expose to loadBalancer so the edge obtains its own certificate" }}
+{{- end }}
+{{- if and (eq $v.edge.expose "gateway") (not (.Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1")) }}
+{{- fail "edge.expose is gateway, but the Gateway API is not installed in the cluster" }}
+{{- end }}
+{{- $emptyClass := and (eq $v.edge.expose "loadBalancer") (not $v.edge.loadBalancer.persistence.storageClassName) }}
+{{- range $c := list $v.postgres $v.valkey $v.nats $v.meilisearch $v.seaweedfs }}
+{{- if and $c.enabled (not $c.persistence.storageClassName) }}
+{{- $emptyClass = true }}
+{{- end }}
+{{- end }}
+{{- if $emptyClass }}
+{{- $default := false }}
+{{- range (lookup "storage.k8s.io/v1" "StorageClass" "" "").items | default list }}
+{{- if eq (get (.metadata.annotations | default dict) "storageclass.kubernetes.io/is-default-class") "true" }}
+{{- $default = true }}
+{{- end }}
+{{- end }}
+{{- if not $default }}
+{{- fail "The cluster has no default StorageClass, so the volumes would never bind. Install a storage provisioner and mark its class as default, or set persistence.storageClassName on postgres, valkey, nats, meilisearch and seaweedfs" }}
+{{- end }}
+{{- end }}
+{{- if and (eq $v.edge.expose "ingress") (not $v.edge.ingress.className) }}
+{{- $classes := (lookup "networking.k8s.io/v1" "IngressClass" "" "").items | default list }}
+{{- if not $classes }}
+{{- fail "The cluster has no IngressClass, so nothing would serve the Ingress. Install an ingress controller, or set edge.expose to loadBalancer, gateway or none. Set clusterChecks to false if your controller serves an Ingress without a class" }}
+{{- end }}
+{{- $defaults := list }}
+{{- range $classes }}
+{{- if eq (get (.metadata.annotations | default dict) "ingressclass.kubernetes.io/is-default-class") "true" }}
+{{- $defaults = append $defaults .metadata.name }}
+{{- end }}
+{{- end }}
+{{- if not $defaults }}
+{{- $names := list }}
+{{- range $classes }}
+{{- $names = append $names .metadata.name }}
+{{- end }}
+{{- fail (printf "The cluster has no default IngressClass. Set edge.ingress.className to one of: %s" (join ", " $names)) }}
+{{- end }}
+{{- if gt (len $defaults) 1 }}
+{{- fail (printf "The cluster marks more than one IngressClass as default (%s), so the Ingress may land on the wrong controller. Set edge.ingress.className" (join ", " $defaults)) }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,188 @@
+{{- define "fluxer.replicas" -}}
+{{- $w := .w | default dict }}
+{{- if kindIs "invalid" $w.replicas }}1{{ else }}{{ $w.replicas | int }}{{ end }}
+{{- end }}
+
+{{- define "fluxer.appPod" -}}
+{{- $root := .root }}
+{{- $w := .w | default dict }}
+{{- $readsSecret := and (not .noEnvFrom) (not .configMapOnly) }}
+{{- $env := .env | default list }}
+{{- if and $readsSecret $root.Values.valkey.enabled }}
+{{- $env = prepend $env (dict "name" "FLUXER_KV_URL" "value" "redis://:$(FLUXER_VALKEY_PASSWORD)@valkey:6379/0") }}
+{{- end }}
+metadata:
+  labels:
+    {{- include "fluxer.podLabels" . | nindent 4 }}
+  annotations:
+    checksum/instance: {{ include "fluxer.instanceChecksum" $root }}
+    {{- with $w.podAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  automountServiceAccountToken: false
+  enableServiceLinks: false
+  {{- include "fluxer.pullSecrets" $root | nindent 2 }}
+  securityContext:
+    {{- include "fluxer.podSecurityContext" (dict) | nindent 4 }}
+  {{- include "fluxer.scheduling" . | nindent 2 }}
+  {{- with $w.terminationGracePeriodSeconds }}
+  terminationGracePeriodSeconds: {{ . }}
+  {{- end }}
+  {{- include "fluxer.waitFor" . | nindent 2 }}
+  containers:
+    - name: {{ .containerName | default .name }}
+      image: {{ include "fluxer.image" . }}
+      imagePullPolicy: {{ include "fluxer.pullPolicy" . }}
+      {{- with .command }}
+      command:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with include "fluxer.envList" (dict "w" $w "env" $env) }}
+      env:
+        {{- . | nindent 8 }}
+      {{- end }}
+      {{- if not .noEnvFrom }}
+      envFrom:
+        {{- if .configMapOnly }}
+        - configMapRef:
+            name: {{ .configMapOnly }}
+        {{- else }}
+        - configMapRef:
+            name: fluxer-config
+        - secretRef:
+            name: {{ include "fluxer.secretName" $root }}
+        {{- end }}
+      {{- end }}
+      ports:
+        - name: http
+          containerPort: {{ .port }}
+          protocol: TCP
+        {{- range .extraPorts }}
+        - name: {{ .name }}
+          containerPort: {{ .port }}
+          protocol: TCP
+        {{- end }}
+      {{- with include "fluxer.probes" . | trim }}
+      {{- . | nindent 6 }}
+      {{- end }}
+      {{- with .lifecycle }}
+      lifecycle:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $w.resources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- include "fluxer.containerSecurityContext" . | nindent 8 }}
+      {{- with concat (.volumeMounts | default list) ($w.extraVolumeMounts | default list) }}
+      volumeMounts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- with concat (.volumes | default list) ($w.extraVolumes | default list) }}
+  volumes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+
+{{- define "fluxer.app" -}}
+{{- $root := .root }}
+{{- $w := .w | default dict }}
+---
+apiVersion: apps/v1
+kind: {{ .kind | default "Deployment" }}
+metadata:
+  name: {{ .name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" . | nindent 4 }}
+spec:
+  {{- if not (and $w.hpa $w.hpa.maxReplicas) }}
+  replicas: {{ include "fluxer.replicas" . }}
+  {{- end }}
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" . | nindent 6 }}
+  {{- if eq (.kind | default "Deployment") "StatefulSet" }}
+  serviceName: {{ .serviceName }}
+  podManagementPolicy: Parallel
+  {{- else if .strategy }}
+  strategy:
+    {{- toYaml .strategy | nindent 4 }}
+  {{- end }}
+  template:
+    {{- include "fluxer.appPod" . | nindent 4 }}
+{{- if not .noService }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  {{- if .headless }}
+  clusterIP: None
+  publishNotReadyAddresses: true
+  {{- end }}
+  selector:
+    {{- include "fluxer.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .servicePort | default .port }}
+      targetPort: http
+      protocol: TCP
+{{- end }}
+{{- with $w.pdb }}
+{{- if or (not (kindIs "invalid" .minAvailable)) (not (kindIs "invalid" .maxUnavailable)) }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $.name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ | nindent 4 }}
+spec:
+  {{- if not (kindIs "invalid" .minAvailable) }}
+  minAvailable: {{ .minAvailable }}
+  {{- end }}
+  {{- if not (kindIs "invalid" .maxUnavailable) }}
+  maxUnavailable: {{ .maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ | nindent 6 }}
+{{- end }}
+{{- end }}
+{{- with $w.hpa }}
+{{- if .maxReplicas }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $.name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: {{ $.kind | default "Deployment" }}
+    name: {{ $.name }}
+  minReplicas: {{ .minReplicas | default 1 }}
+  maxReplicas: {{ .maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .targetCPUUtilizationPercentage | default 80 }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,90 @@
+{{- include "fluxer.validate" . }}
+{{- $v := .Values }}
+{{- $o := include "fluxer.origin" . }}
+{{- $http := dict "port" "http" }}
+{{- $start := dict "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 30 }}
+{{- $check := dict "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 3 }}
+{{- $health := merge (dict "path" "/_health") $http }}
+{{- $healthProbes := dict "startup" (merge (dict "httpGet" $health) $start) "liveness" (merge (dict "httpGet" $health) $check) "readiness" (merge (dict "httpGet" $health) $check) }}
+{{- $nodeEnv := list (dict "name" "NODE_ENV" "value" "production") (dict "name" "NODE_OPTIONS" "value" "--enable-source-maps") (dict "name" "NODE_EXTRA_CA_CERTS" "value" "/etc/ssl/certs/ca-certificates.crt") (dict "name" "FLUXER_POSTGRES_MAX_CONNECTIONS" "value" "25") }}
+
+{{- include "fluxer.app" (dict "root" . "name" "api" "component" "api" "w" $v.api "image" "fluxer-api" "port" 8080
+  "env" (concat (list (dict "name" "FLUXER_API_PORT" "value" "8080") (dict "name" "FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED" "value" "true")) $nodeEnv)
+  "probes" $healthProbes
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" . "usesNats" true "usesPostgres" true "usesS3" true "usesKv" true "usesSvc" true) | fromJsonArray)) }}
+
+{{- $heartbeat := dict "exec" (dict "command" (list "node" "-e" "const age=Date.now()-require('node:fs').statSync('/tmp/fluxer-worker-heartbeat').mtimeMs;if(age>30000){console.error('worker heartbeat is '+Math.round(age)+'ms old');process.exit(1)}")) "initialDelaySeconds" 90 "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 3 }}
+{{- include "fluxer.app" (dict "root" . "name" "worker" "component" "worker" "w" $v.worker "image" "fluxer-api" "port" 8080 "noService" true
+  "command" (list "node" "dist/WorkerEntrypoint.js")
+  "env" (concat (list (dict "name" "FLUXER_API_WORKER_MODE" "value" "all_lanes") (dict "name" "FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER" "value" "true")) $nodeEnv)
+  "probes" (dict "liveness" $heartbeat)
+  "strategy" (dict "type" "Recreate")
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" . "usesNats" true "usesPostgres" true "usesS3" true "usesKv" true "usesSvc" true) | fromJsonArray)) }}
+
+{{- $gatewayEnv := list
+  (dict "name" "FLUXER_GATEWAY_PORT" "value" "8080")
+  (dict "name" "FLUXER_GATEWAY_ROLE" "value" "all")
+  (dict "name" "POD_IP" "valueFrom" (dict "fieldRef" (dict "apiVersion" "v1" "fieldPath" "status.podIP")))
+  (dict "name" "FLUXER_ERLANG_NODE_NAME" "value" "fluxer_gateway@$(POD_IP)")
+  (dict "name" "FLUXER_ERLANG_DIST_PORT" "value" "8081")
+  (dict "name" "FLUXER_GATEWAY_CLUSTER_ENABLED" "value" "true")
+  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME" "value" (printf "gateway-headless.%s.svc.%s" .Release.Namespace $v.clusterDomain))
+  (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME" "value" "fluxer_gateway") }}
+{{- $gatewayReady := dict "exec" (dict "command" (list "curl" "-fsS" "-o" "/dev/null" "--max-time" "4" "http://127.0.0.1:8080/_health/ready")) "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 3 }}
+{{- $gatewayCtx := dict "root" . "name" "gateway" "component" "gateway" "w" $v.gateway "image" "fluxer-gateway" "port" 8080
+  "extraPorts" (list (dict "name" "epmd" "port" 4369) (dict "name" "erl-dist" "port" 8081))
+  "env" $gatewayEnv
+  "probes" (dict "startup" (merge (dict "httpGet" $health) $start) "liveness" (merge (dict "httpGet" $health) $check) "readiness" $gatewayReady)
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" . "usesNats" true) | fromJsonArray)
+  "lifecycle" (dict "preStop" (dict "exec" (dict "command" (list "/bin/sh" "-c" "curl -fsS -o /dev/null --max-time 2 http://127.0.0.1:8080/_health/drain; sleep 5")))) }}
+{{- include "fluxer.app" $gatewayCtx }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gateway-headless
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $gatewayCtx | nindent 4 }}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector:
+    {{- include "fluxer.selectorLabels" $gatewayCtx | nindent 4 }}
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+    - name: epmd
+      port: 4369
+      targetPort: epmd
+      protocol: TCP
+    - name: erl-dist
+      port: 8081
+      targetPort: erl-dist
+      protocol: TCP
+
+{{- include "fluxer.app" (dict "root" . "name" "media-proxy" "component" "media" "w" $v.mediaProxy "image" "fluxer-media-proxy" "port" 8080
+  "env" (list (dict "name" "FLUXER_MEDIA_PROXY_PORT" "value" "8080") (dict "name" "FLUXER_MEDIA_PROXY_MODE" "value" "upload") (dict "name" "FLUXER_MEDIA_PROXY_STORAGE_BACKEND" "value" "s3") (dict "name" "FLUXER_S3_READ_SIGNED" "value" "true"))
+  "probes" $healthProbes
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" . "usesNats" true "usesS3" true) | fromJsonArray)) }}
+
+{{- $pushCheck := dict "exec" (dict "command" (list "/usr/local/bin/fluxer-push" "healthcheck")) }}
+{{- include "fluxer.app" (dict "root" . "name" "push" "component" "push" "w" $v.push "image" "fluxer-push" "port" 8126
+  "env" (list (dict "name" "FLUXER_PUSH_SERVICE_PORT" "value" "8126"))
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" . "usesNats" true) | fromJsonArray)
+  "probes" (dict "startup" (merge (deepCopy $pushCheck) (dict "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 12)) "liveness" (merge (deepCopy $pushCheck) $check) "readiness" (merge (deepCopy $pushCheck) $check))) }}
+
+{{- include "fluxer.app" (dict "root" . "name" "admin" "component" "admin" "w" $v.admin "image" "fluxer-admin" "port" 8080
+  "env" (list (dict "name" "FLUXER_ADMIN_PORT" "value" "8080") (dict "name" "FLUXER_ADMIN_BASE_PATH" "value" $v.adminBasePath) (dict "name" "FLUXER_API_ENDPOINT" "value" "http://api:8080") (dict "name" "FLUXER_STATIC_CDN_ENDPOINT" "value" $o))
+  "probes" $healthProbes) }}
+
+{{- $ready := merge (dict "path" "/_ready") $http }}
+{{- include "fluxer.app" (dict "root" . "name" "app-proxy" "component" "web" "w" $v.appProxy "image" "fluxer-app-proxy-self-hosted" "port" 8080 "configMapOnly" "fluxer-app-proxy"
+  "probes" (dict "startup" (merge (dict "httpGet" $health) $start) "liveness" (merge (dict "httpGet" $health) $check) "readiness" (merge (dict "httpGet" $ready) $check))) }}
+
+{{- $avatar := merge (dict "path" "/avatars/0.png") $http }}
+{{- include "fluxer.app" (dict "root" . "name" "static-proxy" "component" "web" "w" $v.staticProxy "image" "fluxer-static" "port" 8080 "noEnvFrom" true
+  "probes" (dict "startup" (merge (dict "httpGet" $avatar) $start) "liveness" (merge (dict "httpGet" $avatar) $check) "readiness" (merge (dict "httpGet" $avatar) $check))) }}
@@ -0,0 +1,20 @@
+{{- include "fluxer.validate" . }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fluxer-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-config" "component" "config") | nindent 4 }}
+data:
+  {{- include "fluxer.configData" . | nindent 2 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fluxer-app-proxy
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-app-proxy" "component" "config") | nindent 4 }}
+data:
+  {{- include "fluxer.appProxyConfigData" . | nindent 2 }}
@@ -0,0 +1,296 @@
+{{- include "fluxer.validate" . }}
+{{- $v := .Values }}
+{{- $e := $v.edge }}
+{{- $ctx := dict "root" . "name" "edge" "component" "edge" "w" $e }}
+{{- $lb := eq $e.expose "loadBalancer" }}
+{{- $caddyfile := .Files.Get "files/Caddyfile" }}
+{{- $globalOptions := ternary (printf "email %s" $v.email) "" (and $lb (ne $v.email "")) }}
+{{- $siteAddress := ternary (printf "https://%s, :8080" $v.domain) ":8080" $lb }}
+{{- $trusted := ternary "127.0.0.1/32" "private_ranges" $lb }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: edge-caddyfile
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+data:
+  Caddyfile: {{ $caddyfile | quote }}
+{{- if $lb }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: edge-data
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- with $e.loadBalancer.persistence.storageClassName }}
+  storageClassName: {{ . }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ $e.loadBalancer.persistence.size }}
+{{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: edge
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: {{ ternary 1 ($e.replicas | int) $lb }}
+  revisionHistoryLimit: 3
+  {{- if $lb }}
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+      annotations:
+        checksum/config: {{ printf "%s\n%s\n%s\n%s" $caddyfile $siteAddress $globalOptions (toJson (list $e.env $e.extraEnv)) | sha256sum }}
+        {{- with $e.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      {{- include "fluxer.pullSecrets" . | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" 65532) | nindent 8 }}
+        {{- if $lb }}
+        sysctls:
+          - name: net.ipv4.ip_unprivileged_port_start
+            value: "0"
+        {{- end }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      containers:
+        - name: edge
+          image: {{ include "fluxer.thirdPartyImage" $e.image }}
+          imagePullPolicy: {{ $e.image.pullPolicy }}
+          {{- $edgeEnv := list (dict "name" "FLUXER_EDGE_SITE_ADDRESS" "value" $siteAddress) (dict "name" "FLUXER_EDGE_TRUSTED_PROXIES" "value" $trusted) (dict "name" "FLUXER_EDGE_GLOBAL_OPTIONS" "value" $globalOptions) (dict "name" "FLUXER_ADMIN_BASE_PATH" "value" $v.adminBasePath) }}
+          env:
+            {{- include "fluxer.envList" (dict "w" $e "env" $edgeEnv) | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+            {{- if $lb }}
+            - name: public-http
+              containerPort: 80
+              protocol: TCP
+            - name: public-https
+              containerPort: 443
+              protocol: TCP
+            - name: public-quic
+              containerPort: 443
+              protocol: UDP
+            {{- end }}
+          startupProbe:
+            exec:
+              command: ["wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+            periodSeconds: 5
+            failureThreshold: 24
+          livenessProbe:
+            exec:
+              command: ["wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command: ["wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+            periodSeconds: 10
+            timeoutSeconds: 5
+          {{- with $e.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_BIND_SERVICE
+          volumeMounts:
+            - name: caddyfile
+              mountPath: /etc/caddy
+              readOnly: true
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: caddyfile
+          configMap:
+            name: edge-caddyfile
+        - name: config
+          emptyDir: {}
+        - name: data
+          {{- if $lb }}
+          persistentVolumeClaim:
+            claimName: edge-data
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: edge
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+{{- if $lb }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: edge-public
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+  {{- with $e.loadBalancer.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: http
+      port: 80
+      targetPort: public-http
+      protocol: TCP
+    - name: https
+      port: 443
+      targetPort: public-https
+      protocol: TCP
+    {{- if $e.loadBalancer.http3 }}
+    - name: quic
+      port: 443
+      targetPort: public-quic
+      protocol: UDP
+    {{- end }}
+{{- end }}
+{{- if eq $e.expose "ingress" }}
+{{- $tls := $e.ingress.tls }}
+{{- $annotations := dict
+  "nginx.ingress.kubernetes.io/proxy-body-size" "512m"
+  "nginx.ingress.kubernetes.io/proxy-read-timeout" "3600"
+  "nginx.ingress.kubernetes.io/proxy-send-timeout" "3600" }}
+{{- if eq $tls.mode "certManager" }}
+{{- $_ := set $annotations "cert-manager.io/issuer" "fluxer-acme" }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: fluxer-acme
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  acme:
+    server: {{ $tls.acmeServer }}
+    {{- with $v.email }}
+    email: {{ . }}
+    {{- end }}
+    privateKeySecretRef:
+      name: fluxer-acme-account
+    solvers:
+      - http01:
+          {{- with $e.ingress.className }}
+          ingress:
+            ingressClassName: {{ . }}
+          {{- else }}
+          ingress: {}
+          {{- end }}
+{{- end }}
+{{- $annotations = merge (deepCopy ($e.ingress.annotations | default dict)) $annotations }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: fluxer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+  {{- with $annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with $e.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if ne $tls.mode "none" }}
+  tls:
+    - hosts:
+        - {{ $v.domain }}
+      secretName: {{ $tls.secretName }}
+  {{- end }}
+  rules:
+    - host: {{ $v.domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: edge
+                port:
+                  name: http
+{{- end }}
+{{- if eq $e.expose "gateway" }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: fluxer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  parentRefs:
+    {{- toYaml $e.gateway.parentRefs | nindent 4 }}
+  hostnames:
+    - {{ $v.domain }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: edge
+          port: 8080
+      {{- with $e.gateway.timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
@@ -0,0 +1,156 @@
+{{- include "fluxer.validate" . }}
+{{- with .Values.livekit }}
+{{- if .enabled }}
+{{- $ctx := dict "root" $ "name" "livekit" "component" "voice" "w" . }}
+{{- $tcp := .tcpPort | int }}
+{{- $udp := .udpPort | int }}
+{{- if eq .expose "nodePort" }}
+{{- $tcp = .nodePorts.tcp | int }}
+{{- $udp = .nodePorts.udp | int }}
+{{- end }}
+{{- $useExternal := and .useExternalIP (ne .expose "loadBalancer") }}
+{{- $secrets := include "fluxer.secretData" $ | fromJson }}
+{{- $config := dict
+  "port" 7880
+  "log_level" .logLevel
+  "rtc" (dict "tcp_port" $tcp "udp_port" $udp "use_external_ip" $useExternal "node_ip" (.nodeIP | default "") "stun_servers" .stunServers) }}
+{{- $config = mergeOverwrite $config (deepCopy (.extraConfig | default dict)) }}
+{{- $configYaml := toYaml $config }}
+{{- $root := dict "path" "/" "port" "http" }}
+{{- $webhook := ternary "http://edge:8080/api/webhooks/livekit" "http://api:8080/webhooks/livekit" (eq .expose "hostNetwork") }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: livekit
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: http
+      port: 7880
+      targetPort: 7880
+      protocol: TCP
+{{- if ne .expose "hostNetwork" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: livekit-rtc
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+  {{- with .serviceAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ ternary "LoadBalancer" "NodePort" (eq .expose "loadBalancer") }}
+  externalTrafficPolicy: Local
+  {{- if and (eq .expose "loadBalancer") .loadBalancerIP }}
+  loadBalancerIP: {{ .loadBalancerIP }}
+  {{- end }}
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: rtc-tcp
+      port: {{ $tcp }}
+      targetPort: rtc-tcp
+      protocol: TCP
+      {{- if eq .expose "nodePort" }}
+      nodePort: {{ $tcp }}
+      {{- end }}
+    - name: rtc-udp
+      port: {{ $udp }}
+      targetPort: rtc-udp
+      protocol: UDP
+      {{- if eq .expose "nodePort" }}
+      nodePort: {{ $udp }}
+      {{- end }}
+{{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: livekit
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+      annotations:
+        checksum/config: {{ list $configYaml $webhook (get $secrets "FLUXER_LIVEKIT_API_KEY" | default "") (get $secrets "FLUXER_LIVEKIT_API_SECRET" | default "") | toJson | sha256sum }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      {{- if eq .expose "hostNetwork" }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      {{- end }}
+      {{- include "fluxer.pullSecrets" $ | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" 65532) | nindent 8 }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      containers:
+        - name: livekit
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          command:
+            - /bin/sh
+            - -c
+            - |
+              export LIVEKIT_KEYS="${LIVEKIT_API_KEY}: ${LIVEKIT_API_SECRET}"
+              export LIVEKIT_CONFIG="$(printf '%s\nwebhook:\n  api_key: %s\n  urls:\n    - %s\n' "$LIVEKIT_CONFIG" "$LIVEKIT_API_KEY" "$LIVEKIT_WEBHOOK_URL")"
+              exec /livekit-server
+          env:
+            - name: LIVEKIT_CONFIG
+              value: {{ $configYaml | quote }}
+            - name: LIVEKIT_WEBHOOK_URL
+              value: {{ $webhook }}
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "LIVEKIT_API_KEY" "key" "FLUXER_LIVEKIT_API_KEY") | nindent 12 }}
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "LIVEKIT_API_SECRET" "key" "FLUXER_LIVEKIT_API_SECRET") | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 7880
+              protocol: TCP
+            - name: rtc-tcp
+              containerPort: {{ $tcp }}
+              protocol: TCP
+            - name: rtc-udp
+              containerPort: {{ $udp }}
+              protocol: UDP
+          startupProbe:
+            httpGet: {{ toJson $root }}
+            periodSeconds: 5
+            failureThreshold: 60
+          livenessProbe:
+            httpGet: {{ toJson $root }}
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet: {{ toJson $root }}
+            periodSeconds: 10
+            timeoutSeconds: 5
+          {{- with .resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,97 @@
+{{- include "fluxer.validate" . }}
+{{- with .Values.meilisearch }}
+{{- if .enabled }}
+{{- $ctx := dict "root" $ "name" "meilisearch" "component" "search" "w" . }}
+{{- $health := dict "path" "/health" "port" "http" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: meilisearch
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: http
+      port: 7700
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: meilisearch
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: 1
+  serviceName: meilisearch
+  podManagementPolicy: Parallel
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      {{- include "fluxer.pullSecrets" $ | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" 65532) | nindent 8 }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      containers:
+        - name: meilisearch
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          env:
+            - name: MEILI_ENV
+              value: production
+            - name: MEILI_NO_ANALYTICS
+              value: "true"
+            - name: MEILI_UPGRADE_DB
+              value: "true"
+            - name: MEILI_MAX_INDEXING_MEMORY
+              value: {{ .maxIndexingMemory | quote }}
+            - name: MEILI_MAX_INDEXING_THREADS
+              value: {{ include "fluxer.string" .maxIndexingThreads | quote }}
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "MEILI_MASTER_KEY" "key" "FLUXER_SEARCH_API_KEY") | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 7700
+              protocol: TCP
+          startupProbe:
+            httpGet: {{ toJson $health }}
+            periodSeconds: 5
+            failureThreshold: 120
+          livenessProbe:
+            httpGet: {{ toJson $health }}
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet: {{ toJson $health }}
+            periodSeconds: 10
+            timeoutSeconds: 5
+          {{- with .resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /meili_data
+  volumeClaimTemplates:
+    {{- include "fluxer.pvc" .persistence | nindent 4 }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,169 @@
+{{- include "fluxer.validate" . }}
+{{- with .Values.nats }}
+{{- if .enabled }}
+{{- $ctx := dict "root" $ "name" "nats" "component" "messaging" "w" . }}
+{{- $replicas := .replicas | int }}
+{{- $conf := include "fluxer.natsConf" (dict "root" $ "replicas" $replicas) }}
+{{- $secrets := include "fluxer.secretData" $ | fromJson }}
+{{- $healthz := dict "exec" (dict "command" (list "wget" "-q" "-O" "/dev/null" "http://127.0.0.1:8222/healthz")) }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nats-config
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+data:
+  nats.conf: {{ $conf | quote }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nats
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: client
+      port: 4222
+      targetPort: client
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nats-headless
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: client
+      port: 4222
+      targetPort: client
+      protocol: TCP
+    - name: cluster
+      port: 6222
+      targetPort: cluster
+      protocol: TCP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: nats
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: {{ $replicas }}
+  serviceName: nats-headless
+  podManagementPolicy: Parallel
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+      annotations:
+        checksum/config: {{ printf "%s\n%s" $conf (get $secrets "FLUXER_NATS_AUTH_TOKEN" | default "") | sha256sum }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      {{- include "fluxer.pullSecrets" $ | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" 65534) | nindent 8 }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      containers:
+        - name: nats
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          command:
+            - sh
+            - -c
+            - sed "s/__FLUXER_NATS_AUTH_TOKEN__/$FLUXER_NATS_AUTH_TOKEN/g" /etc/nats/nats.conf > /run/nats/nats.conf && exec nats-server --config /run/nats/nats.conf
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "FLUXER_NATS_AUTH_TOKEN" "key" "FLUXER_NATS_AUTH_TOKEN") | nindent 12 }}
+          ports:
+            - name: client
+              containerPort: 4222
+              protocol: TCP
+            - name: cluster
+              containerPort: 6222
+              protocol: TCP
+          startupProbe:
+            {{- toYaml (merge (dict "periodSeconds" 5 "timeoutSeconds" 5 "failureThreshold" 60) $healthz) | nindent 12 }}
+          livenessProbe:
+            {{- toYaml (merge (dict "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 6) $healthz) | nindent 12 }}
+          readinessProbe:
+            {{- toYaml (merge (dict "periodSeconds" 10 "timeoutSeconds" 5) $healthz) | nindent 12 }}
+          {{- with .resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/nats
+              readOnly: true
+            - name: rendered
+              mountPath: /run/nats
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          configMap:
+            name: nats-config
+        - name: rendered
+          emptyDir:
+            medium: Memory
+  volumeClaimTemplates:
+    {{- include "fluxer.pvc" .persistence | nindent 4 }}
+{{- end }}
+{{- end }}
+
+{{- define "fluxer.natsConf" -}}
+server_name: $POD_NAME
+listen: 0.0.0.0:4222
+http: 127.0.0.1:8222
+authorization {
+  token: "__FLUXER_NATS_AUTH_TOKEN__"
+}
+jetstream {
+  store_dir: /data
+}
+{{- if gt .replicas 1 }}
+cluster {
+  name: fluxer
+  listen: 0.0.0.0:6222
+  authorization {
+    user: fluxer
+    password: "__FLUXER_NATS_AUTH_TOKEN__"
+  }
+  routes: [
+    {{- range $i := until .replicas }}
+    nats://fluxer:__FLUXER_NATS_AUTH_TOKEN__@nats-{{ $i }}.nats-headless.{{ $.root.Release.Namespace }}.svc.{{ $.root.Values.clusterDomain }}:6222
+    {{- end }}
+  ]
+}
+{{- end }}
+{{- end }}
@@ -0,0 +1,83 @@
+{{- include "fluxer.validate" . }}
+{{- if .Values.networkPolicy.enabled }}
+{{- $v := .Values }}
+{{- $release := dict "app.kubernetes.io/instance" .Release.Name }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: fluxer
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer" "component" "network") | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- toYaml $release | nindent 6 }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              {{- toYaml $release | nindent 14 }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: fluxer-edge
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-edge" "component" "network") | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" (dict "root" . "name" "edge") | nindent 6 }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: 8080
+          protocol: TCP
+      {{- with $v.networkPolicy.ingressNamespaceSelector }}
+      from:
+        - namespaceSelector:
+            {{- toYaml . | nindent 12 }}
+        {{- if and $v.livekit.enabled (eq $v.livekit.expose "hostNetwork") }}
+        {{- range $v.livekit.nodeCIDRs }}
+        - ipBlock:
+            cidr: {{ . }}
+        {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- if eq $v.edge.expose "loadBalancer" }}
+    - ports:
+        - port: 80
+          protocol: TCP
+        - port: 443
+          protocol: TCP
+        - port: 443
+          protocol: UDP
+    {{- end }}
+{{- if and $v.livekit.enabled (ne $v.livekit.expose "hostNetwork") }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: fluxer-livekit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-livekit" "component" "network") | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" (dict "root" . "name" "livekit") | nindent 6 }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: {{ ternary $v.livekit.nodePorts.tcp $v.livekit.tcpPort (eq $v.livekit.expose "nodePort") }}
+          protocol: TCP
+        - port: {{ ternary $v.livekit.nodePorts.udp $v.livekit.udpPort (eq $v.livekit.expose "nodePort") }}
+          protocol: UDP
+{{- end }}
+{{- end }}
@@ -0,0 +1,147 @@
+{{- include "fluxer.validate" . }}
+{{- with .Values.postgres }}
+{{- if .enabled }}
+{{- $ctx := dict "root" $ "name" "postgres" "component" "database" "w" . }}
+{{- $args := list }}
+{{- range $k := keys .parameters | sortAlpha }}
+{{- $args = concat $args (list "-c" (printf "%s=%s" $k (include "fluxer.string" (get $.Values.postgres.parameters $k)))) }}
+{{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: 1
+  serviceName: postgres
+  podManagementPolicy: Parallel
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+      annotations:
+        checksum/config: {{ toJson $args | sha256sum }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      terminationGracePeriodSeconds: 60
+      {{- include "fluxer.pullSecrets" $ | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" (.runAsUser | int)) | nindent 8 }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      initContainers:
+        - name: version-guard
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          command:
+            - sh
+            - -c
+            - |
+              want=$(postgres --version | sed -E 's/[^0-9]*([0-9]+).*/\1/')
+              if [ -s "$PGDATA/PG_VERSION" ]; then
+                have=$(cat "$PGDATA/PG_VERSION")
+                if [ "$have" != "$want" ]; then
+                  echo "The data directory was created by Postgres $have and this image runs Postgres $want. Set postgres.image.tag back to the $have image, or dump the database and restore it into a fresh volume. See the Kubernetes page of the operator docs." >&2
+                  exit 1
+                fi
+              fi
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+      containers:
+        - name: postgres
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          args:
+            {{- toYaml $args | nindent 12 }}
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+            - name: POSTGRES_DB
+              value: {{ .database | quote }}
+            - name: POSTGRES_USER
+              value: {{ .username | quote }}
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "POSTGRES_PASSWORD" "key" "FLUXER_POSTGRES_PASSWORD") | nindent 12 }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          startupProbe:
+            exec:
+              command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
+          livenessProbe:
+            exec:
+              command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          {{- with .resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: shm
+              mountPath: /dev/shm
+            - name: run
+              mountPath: /var/run/postgresql
+      volumes:
+        - name: shm
+          emptyDir:
+            medium: Memory
+            sizeLimit: {{ .shmSize }}
+        - name: run
+          emptyDir: {}
+  volumeClaimTemplates:
+    {{- include "fluxer.pvc" .persistence | nindent 4 }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,136 @@
+{{- include "fluxer.validate" . }}
+{{- with .Values.seaweedfs }}
+{{- if .enabled }}
+{{- $ctx := dict "root" $ "name" "seaweedfs" "component" "storage" "w" . }}
+{{- $healthz := dict "path" "/healthz" "port" "s3" }}
+{{- $secrets := include "fluxer.secretData" $ | fromJson }}
+{{- $init := $.Files.Get "files/seaweedfs-init.sh" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: seaweedfs
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: s3
+      port: 8333
+      targetPort: s3
+      protocol: TCP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: seaweedfs
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: 1
+  serviceName: seaweedfs
+  podManagementPolicy: Parallel
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+      annotations:
+        checksum/init: {{ list $init (get $secrets "FLUXER_S3_ACCESS_KEY_ID" | default "") (get $secrets "FLUXER_S3_SECRET_ACCESS_KEY" | default "") $.Values.s3.buckets | toJson | sha256sum }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      {{- include "fluxer.pullSecrets" $ | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" 1000) | nindent 8 }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      containers:
+        - name: seaweedfs
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          args:
+            - server
+            - -s3
+            - -dir=/data
+            - -master.telemetry=false
+            - -ip=127.0.0.1
+            - -ip.bind=127.0.0.1
+            - -s3.ip.bind=0.0.0.0
+          env:
+            - name: GOMEMLIMIT
+              value: {{ .gomemlimit | quote }}
+            - name: WEED_MASTER_VOLUME_GROWTH_COPY_1
+              value: {{ include "fluxer.string" .volumeGrowth | quote }}
+          ports:
+            - name: s3
+              containerPort: 8333
+              protocol: TCP
+          startupProbe:
+            httpGet: {{ toJson $healthz }}
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+          livenessProbe:
+            httpGet: {{ toJson $healthz }}
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          readinessProbe:
+            httpGet: {{ toJson $healthz }}
+            periodSeconds: 10
+            timeoutSeconds: 5
+          {{- with .resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+        - name: seaweedfs-init
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          command:
+            - /bin/sh
+            - -c
+            - {{ $init | quote }}
+          env:
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "FLUXER_S3_ACCESS_KEY" "key" "FLUXER_S3_ACCESS_KEY_ID") | nindent 12 }}
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "FLUXER_S3_SECRET_KEY" "key" "FLUXER_S3_SECRET_ACCESS_KEY") | nindent 12 }}
+            - name: FLUXER_S3_BUCKET_CDN
+              value: {{ $.Values.s3.buckets.cdn | quote }}
+            - name: FLUXER_S3_BUCKET_UPLOADS
+              value: {{ $.Values.s3.buckets.uploads | quote }}
+            - name: FLUXER_S3_BUCKET_REPORTS
+              value: {{ $.Values.s3.buckets.reports | quote }}
+            - name: FLUXER_S3_BUCKET_HARVESTS
+              value: {{ $.Values.s3.buckets.harvests | quote }}
+            - name: FLUXER_SEAWEEDFS_INIT_ATTEMPTS
+              value: {{ include "fluxer.string" .initAttempts | quote }}
+          readinessProbe:
+            exec:
+              command: ["test", "-f", "/tmp/fluxer-buckets-ready"]
+            periodSeconds: 5
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+  volumeClaimTemplates:
+    {{- include "fluxer.pvc" .persistence | nindent 4 }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,17 @@
+{{- include "fluxer.validate" . }}
+{{- if not .Values.secrets.existingSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: fluxer-env
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-env" "component" "config") | nindent 4 }}
+  annotations:
+    helm.sh/resource-policy: keep
+type: Opaque
+data:
+  {{- range $k, $val := include "fluxer.secretData" . | fromJson }}
+  {{ $k }}: {{ $val | b64enc | quote }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,31 @@
+{{- include "fluxer.validate" . }}
+{{- $healthz := dict "path" "/_healthz" "port" "http" }}
+{{- $health := dict "path" "/_health" "port" "http" }}
+{{- $probes := dict
+  "startup" (dict "httpGet" $healthz "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 12)
+  "liveness" (dict "httpGet" $healthz "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 3)
+  "readiness" (dict "httpGet" $health "periodSeconds" 10 "timeoutSeconds" 5 "failureThreshold" 3) }}
+{{- range $name := list "gifs" "messages" "snowflakes" "unfurl" "users" }}
+{{- $svc := get $.Values.svc $name | default dict }}
+{{- $router := $svc.router | default dict }}
+{{- $shard := $svc.shard | default dict }}
+{{- $count := include "fluxer.replicas" (dict "w" $shard) }}
+{{- $common := list (dict "name" "FLUXER_SVC_NAME" "value" $name) (dict "name" "FLUXER_SVC_PORT" "value" "8090") (dict "name" "FLUXER_SVC_SHARD_COUNT" "value" $count) }}
+{{- $shardEnv := concat $common (list (dict "name" "FLUXER_SVC_MODE" "value" "shard") (dict "name" "FLUXER_SVC_SHARD_ID" "valueFrom" (dict "fieldRef" (dict "apiVersion" "v1" "fieldPath" "metadata.labels['apps.kubernetes.io/pod-index']"))) (dict "name" "POD_NAME" "valueFrom" (dict "fieldRef" (dict "apiVersion" "v1" "fieldPath" "metadata.name")))) }}
+{{- $usesPostgres := has $name (list "users" "messages") }}
+{{- if $usesPostgres }}
+{{- $shardEnv = append $shardEnv (dict "name" "FLUXER_POSTGRES_MAX_CONNECTIONS" "value" "20") }}
+{{- end }}
+{{- if eq $name "unfurl" }}
+{{- $shardEnv = append $shardEnv (dict "name" "FLUXER_MEDIA_PROXY_ENDPOINT" "value" "http://media-proxy:8080") }}
+{{- end }}
+{{- include "fluxer.app" (dict "root" $ "name" $name "component" "svc" "w" $router "image" (printf "fluxer-%s" $name) "port" 8090 "containerName" "router"
+  "env" (append $common (dict "name" "FLUXER_SVC_MODE" "value" "router"))
+  "probes" $probes
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" $ "usesNats" true) | fromJsonArray)) }}
+{{- include "fluxer.app" (dict "root" $ "name" (printf "%s-shard" $name) "component" "svc" "w" $shard "image" (printf "fluxer-%s" $name) "port" 8090 "containerName" "shard"
+  "kind" "StatefulSet" "serviceName" (printf "%s-shard" $name) "headless" true
+  "env" $shardEnv
+  "probes" $probes
+  "waitFor" (include "fluxer.appWaitFor" (dict "root" $ "usesNats" true "usesPostgres" $usesPostgres) | fromJsonArray)) }}
+{{- end }}
@@ -0,0 +1,46 @@
+{{- include "fluxer.validate" . }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: fluxer-test-edge
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" (dict "root" . "name" "fluxer-test" "component" "test") | nindent 4 }}
+  annotations:
+    helm.sh/hook: test
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  restartPolicy: Never
+  automountServiceAccountToken: false
+  enableServiceLinks: false
+  {{- include "fluxer.pullSecrets" . | nindent 2 }}
+  securityContext:
+    {{- include "fluxer.podSecurityContext" (dict "uid" 65532) | nindent 4 }}
+  containers:
+    - name: check
+      image: {{ include "fluxer.thirdPartyImage" .Values.edge.image }}
+      imagePullPolicy: {{ .Values.edge.image.pullPolicy }}
+      command:
+        - sh
+        - -c
+        - |
+          for i in $(seq 1 30); do
+            if wget -q -O /dev/null http://edge:8080/_health && wget -q -O - --header "Host: $DOMAIN" http://edge:8080/.well-known/fluxer > /tmp/discovery && grep -q "$DOMAIN" /tmp/discovery; then
+              echo "edge and discovery answer for $DOMAIN"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "edge or discovery did not answer for $DOMAIN within 60 seconds" >&2
+          exit 1
+      env:
+        - name: DOMAIN
+          value: {{ .Values.domain | quote }}
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          memory: 64Mi
+      securityContext:
+        {{- include "fluxer.containerSecurityContext" . | nindent 8 }}
@@ -0,0 +1,84 @@
+{{- include "fluxer.validate" . }}
+{{- with .Values.valkey }}
+{{- if .enabled }}
+{{- $ctx := dict "root" $ "name" "valkey" "component" "cache" "w" . }}
+{{- $args := list "valkey-server" "--appendonly" "yes" "--appendfsync" .appendfsync "--dir" "/data" "--maxmemory" .maxmemory "--maxmemory-policy" .maxmemoryPolicy "--requirepass" "$(REDISCLI_AUTH)" }}
+{{- $ping := dict "exec" (dict "command" (list "sh" "-c" "valkey-cli ping | grep -q PONG")) "periodSeconds" 10 "timeoutSeconds" 5 }}
+{{- $secrets := include "fluxer.secretData" $ | fromJson }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: valkey
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer.selectorLabels" $ctx | nindent 4 }}
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: redis
+      protocol: TCP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: valkey
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer.labels" $ctx | nindent 4 }}
+spec:
+  replicas: 1
+  serviceName: valkey
+  podManagementPolicy: Parallel
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      {{- include "fluxer.selectorLabels" $ctx | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluxer.podLabels" $ctx | nindent 8 }}
+      annotations:
+        checksum/config: {{ printf "%s\n%s" (toJson $args) (get $secrets "FLUXER_VALKEY_PASSWORD" | default "") | sha256sum }}
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      {{- include "fluxer.pullSecrets" $ | nindent 6 }}
+      securityContext:
+        {{- include "fluxer.podSecurityContext" (dict "uid" 999 "gid" 1000) | nindent 8 }}
+      {{- include "fluxer.scheduling" $ctx | nindent 6 }}
+      containers:
+        - name: valkey
+          image: {{ include "fluxer.thirdPartyImage" .image }}
+          imagePullPolicy: {{ .image.pullPolicy }}
+          command:
+            {{- toYaml $args | nindent 12 }}
+          env:
+            {{- include "fluxer.secretEnv" (dict "root" $ "name" "REDISCLI_AUTH" "key" "FLUXER_VALKEY_PASSWORD") | nindent 12 }}
+          ports:
+            - name: redis
+              containerPort: 6379
+              protocol: TCP
+          livenessProbe:
+            {{- toYaml (merge (dict "failureThreshold" 6 "initialDelaySeconds" 10) $ping) | nindent 12 }}
+          readinessProbe:
+            {{- toYaml (merge (dict "failureThreshold" 3) $ping) | nindent 12 }}
+          {{- with .resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- include "fluxer.containerSecurityContext" . | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+  volumeClaimTemplates:
+    {{- include "fluxer.pvc" .persistence | nindent 4 }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,710 @@
+# The public hostname of the instance, lowercase, for example chat.example.com.
+# Required. Point DNS for it at your ingress controller or at the edge load balancer.
+domain: ""
+
+# The scheme browsers use to reach the instance.
+scheme: https
+
+# The port browsers use to reach the instance.
+port: 443
+
+# The origin browsers see, with no trailing slash. Set it only when browsers
+# reach the instance on an origin that domain, scheme and port do not describe.
+# It wins over those three in every derived URL.
+publicOrigin: ""
+
+# The path the admin panel is served under, with a leading slash and no
+# trailing slash.
+adminBasePath: /admin
+
+# A contact address. It becomes FLUXER_VAPID_EMAIL for web push and the ACME
+# account email. Empty uses admin@<domain> for web push and no ACME email.
+email: ""
+
+# The cluster DNS suffix, used in the gateway discovery name.
+clusterDomain: cluster.local
+
+# Look up namespaces, StorageClasses, IngressClasses and installed APIs before
+# installing, to fail early on a cluster that cannot run the release. Set false
+# when your account cannot read those cluster-scoped objects.
+clusterChecks: true
+
+image:
+  # The registry and owner the Fluxer images come from.
+  registry: ghcr.io/fluxerapp
+  # The tag for every Fluxer image. v1 moves with each release.
+  tag: v1
+  # Always pulls the moving tag whenever a pod starts, including a pod that
+  # restarts by itself. Pin with digests for rollouts you control.
+  pullPolicy: Always
+  # Per-image tag overrides, keyed by image name, for example fluxer-api: 2026.1012.120000.
+  tags: {}
+  # Per-image digests, keyed by image name, for example fluxer-api: sha256:0123.
+  # A digest pins the image whatever the tag.
+  digests: {}
+  # Image pull secrets for every pod, as a list of {name: <secret>}.
+  pullSecrets: []
+  # Any new value restarts every Fluxer pod, which pulls the moving tag again.
+  # Add --set-string image.revision=$(date +%s) to a helm upgrade that passes
+  # your values file to move to the latest v1.
+  revision: ""
+
+# The image of the init container that waits for the backing services.
+initImage:
+  repository: busybox
+  tag: "1.37"
+  # A digest pins the image whatever the tag.
+  digest: ""
+  pullPolicy: IfNotPresent
+
+secrets:
+  # The name of a Secret you manage yourself. The chart then renders no Secret
+  # and never changes this one. It needs every key listed under values below.
+  # After editing it, run kubectl rollout restart for the deployments and
+  # statefulsets of the release.
+  existingSecret: ""
+  # Generate every empty key below on first install and keep it on upgrade.
+  # Set false under Argo CD or helm template, which cannot read the existing
+  # Secret, and give every key here or use existingSecret.
+  generate: true
+  # Keys of the fluxer-env Secret. Empty means generate once, then keep.
+  # Generated values are never rotated by an upgrade. Back up the Secret.
+  values:
+    # Password of the bundled Postgres role. Changing it after the first install
+    # does not change the stored role password.
+    FLUXER_POSTGRES_PASSWORD: ""
+    # Meilisearch master key.
+    FLUXER_SEARCH_API_KEY: ""
+    # S3 access key id. The bundled store installs it on every upgrade.
+    FLUXER_S3_ACCESS_KEY_ID: fluxer
+    # S3 secret key. Letters and digits only for the bundled store.
+    FLUXER_S3_SECRET_ACCESS_KEY: ""
+    # Signs sudo mode tokens.
+    FLUXER_SUDO_MODE_SECRET: ""
+    # Signs connection initiation tokens.
+    FLUXER_CONNECTION_INITIATION_SECRET: ""
+    # Derives hidden profile names. Changing it renames every hidden profile.
+    FLUXER_PROFILE_PSEUDONYM_SECRET: ""
+    # Authenticates RPC between the gateway, push and the api.
+    FLUXER_GATEWAY_RPC_AUTH_TOKEN: ""
+    # Password of the bundled Valkey. Letters and digits only.
+    FLUXER_VALKEY_PASSWORD: ""
+    # Token of the bundled NATS, letters and digits only. With an outside NATS,
+    # its token if it has one.
+    FLUXER_NATS_AUTH_TOKEN: ""
+    # Erlang distribution cookie of the gateway.
+    FLUXER_ERLANG_COOKIE: ""
+    # Signs media proxy URLs.
+    FLUXER_MEDIA_PROXY_SECRET_KEY: ""
+    # Standard base64 of at least 32 random bytes. Signs upload relay tokens.
+    FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ""
+    # Signs admin panel sessions.
+    FLUXER_ADMIN_SECRET_KEY_BASE: ""
+    # Client secret of the built-in admin OAuth application.
+    FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ""
+    # Setup token the wizard asks for before the first admin account. With
+    # existingSecret, or with generate false and no value here, the API makes
+    # one on its first start and writes it to its log once.
+    FLUXER_SETUP_TOKEN: ""
+    # LiveKit API key.
+    FLUXER_LIVEKIT_API_KEY: fluxer
+    # LiveKit API secret, at least 32 characters.
+    FLUXER_LIVEKIT_API_SECRET: ""
+    # Web push key pair, base64url. Set both or neither.
+    FLUXER_VAPID_PUBLIC_KEY: ""
+    FLUXER_VAPID_PRIVATE_KEY: ""
+  # Optional secret-bearing settings, added to the Secret as given. The keys are
+  # the variable names on the configuration page of the operator docs.
+  extra: {}
+    # A full Postgres URL. Wins over the host, port, database and password.
+    # FLUXER_POSTGRES_URL: postgres://fluxer:[email protected]:5432/fluxer
+    # PEM text of the CA that signed the Postgres server certificate.
+    # FLUXER_POSTGRES_SSL_CA: ""
+    # The URL of an outside key-value store that holds a password.
+    # FLUXER_KV_URL: redis://:[email protected]:6379/0
+    # The password of an outside search server.
+    # FLUXER_SEARCH_PASSWORD: ""
+    # A temporary S3 session token.
+    # FLUXER_S3_SESSION_TOKEN: ""
+    # Comma-separated base64 secrets that sign attachment URLs.
+    # FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64: ""
+    # SMTP password for outgoing email.
+    # FLUXER_EMAIL_SMTP_PASSWORD: ""
+    # Secret that authenticates email provider webhooks.
+    # FLUXER_EMAIL_WEBHOOK_SECRET: ""
+    # Stripe secret key.
+    # FLUXER_STRIPE_SECRET_KEY: ""
+    # Stripe webhook signing secret.
+    # FLUXER_STRIPE_WEBHOOK_SECRET: ""
+    # Key of the donation proxy.
+    # FLUXER_API_DONATION_PROXY_KEY: ""
+    # Bearer token of the HTTP cache purge endpoint.
+    # FLUXER_CACHE_PURGE_HTTP_TOKEN: ""
+    # Klipy GIF API key.
+    # FLUXER_KLIPY_API_KEY: ""
+    # YouTube Data API key.
+    # FLUXER_YOUTUBE_API_KEY: ""
+    # Bluesky OAuth signing keys.
+    # FLUXER_AUTH_BLUESKY_KEYS: ""
+    # APNs private key for iOS push.
+    # FLUXER_PUSH_APNS_PRIVATE_KEY: ""
+    # FCM private key for Android push.
+    # FLUXER_PUSH_FCM_PRIVATE_KEY: ""
+
+# Extra non-secret settings for every Fluxer service, as NAME: value. The names
+# and meanings are on the configuration page of the operator docs. An empty
+# value is left out. The chart refuses a secret here. Secrets belong in
+# secrets.extra.
+env: {}
+
+postgres:
+  # Run Postgres in the release. Set false to use your own server.
+  enabled: true
+  image:
+    repository: postgres
+    # A new major needs a dump and restore. The pod refuses a data directory
+    # from another major.
+    tag: 16-alpine
+    digest: ""
+    pullPolicy: IfNotPresent
+  # The user and group id of the postgres user in the image. 70 in the Alpine
+  # images, 999 in the Debian ones.
+  runAsUser: 70
+  # Your own server, used when enabled is false. Its password goes in
+  # secrets.values.FLUXER_POSTGRES_PASSWORD, or a URL in secrets.extra.FLUXER_POSTGRES_URL.
+  # The database and the role have to exist already.
+  external:
+    host: ""
+    port: 5432
+    database: fluxer
+    username: fluxer
+    # true or false. Empty keeps the service default.
+    ssl: ""
+  # The database and role the bundled server creates.
+  database: fluxer
+  username: fluxer
+  # Server settings, passed as -c name=value.
+  parameters:
+    max_connections: "150"
+    shared_buffers: 512MB
+    effective_cache_size: 2GB
+    work_mem: 8MB
+    maintenance_work_mem: 256MB
+    autovacuum_work_mem: 128MB
+    random_page_cost: "1.1"
+    effective_io_concurrency: "200"
+    default_statistics_target: "200"
+    jit: "off"
+    min_wal_size: 512MB
+    max_wal_size: 2GB
+    checkpoint_completion_target: "0.9"
+    wal_buffers: 16MB
+    wal_compression: zstd
+    bgwriter_delay: 50ms
+    bgwriter_lru_maxpages: "1000"
+    autovacuum_vacuum_scale_factor: "0.05"
+    autovacuum_analyze_scale_factor: "0.02"
+    autovacuum_vacuum_cost_limit: "2000"
+    track_io_timing: "on"
+    shared_preload_libraries: pg_stat_statements
+  # Size of the in-memory /dev/shm. Parallel vacuum needs it.
+  shmSize: 1Gi
+  # The size and the class are fixed once the volume exists. To grow a volume
+  # later, edit the PersistentVolumeClaim, not this value.
+  persistence:
+    size: 20Gi
+    # Empty uses the cluster default StorageClass.
+    storageClassName: ""
+  resources:
+    requests:
+      cpu: 100m
+      memory: 1Gi
+    limits:
+      memory: 5Gi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+valkey:
+  # Run Valkey in the release. Set false and give external.url to use your own.
+  enabled: true
+  image:
+    repository: valkey/valkey
+    tag: 9.1-alpine
+    digest: ""
+    pullPolicy: IfNotPresent
+  external:
+    # A URL without a password. One with a password goes in secrets.extra.FLUXER_KV_URL.
+    url: ""
+  maxmemory: 192mb
+  maxmemoryPolicy: noeviction
+  appendfsync: everysec
+  persistence:
+    size: 1Gi
+    storageClassName: ""
+  resources:
+    requests:
+      cpu: 20m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+nats:
+  # Run NATS with JetStream in the release. Set false and give external.url to use your own.
+  enabled: true
+  image:
+    repository: nats
+    tag: 2.14-alpine
+    digest: ""
+    pullPolicy: IfNotPresent
+  external:
+    # Its token, if any, goes in secrets.values.FLUXER_NATS_AUTH_TOKEN.
+    url: ""
+  # 1, or 3 or more for a JetStream cluster.
+  replicas: 1
+  persistence:
+    size: 10Gi
+    storageClassName: ""
+  resources:
+    requests:
+      cpu: 20m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+meilisearch:
+  # Run Meilisearch in the release. Set false and give external.url to use your own.
+  enabled: true
+  image:
+    repository: getmeili/meilisearch
+    tag: v1.53
+    digest: ""
+    pullPolicy: IfNotPresent
+  external:
+    # Its key goes in secrets.values.FLUXER_SEARCH_API_KEY.
+    url: ""
+  maxIndexingMemory: 256mb
+  maxIndexingThreads: 2
+  persistence:
+    size: 10Gi
+    storageClassName: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
+    limits:
+      memory: 1536Mi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+seaweedfs:
+  # Run SeaweedFS as the S3 store and create the buckets. Only its S3 port
+  # listens outside the pod. Set false and give s3.endpoint to use your own
+  # store, with the buckets already created.
+  enabled: true
+  image:
+    repository: chrislusf/seaweedfs
+    tag: "4.47"
+    digest: ""
+    pullPolicy: IfNotPresent
+  # Volumes grown per bucket. 1 keeps the store usable on small disks.
+  volumeGrowth: 1
+  gomemlimit: 1536MiB
+  # Tries, 2 seconds apart, the bucket setup makes before it starts over.
+  initAttempts: 60
+  persistence:
+    size: 20Gi
+    storageClassName: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
+    limits:
+      memory: 2Gi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+s3:
+  # The S3 endpoint the services use. Empty uses the bundled SeaweedFS.
+  endpoint: ""
+  # The S3 endpoint browsers use for direct uploads. Empty uses endpoint.
+  publicEndpoint: ""
+  region: us-east-1
+  forcePathStyle: true
+  buckets:
+    cdn: fluxer
+    uploads: fluxer-uploads
+    reports: fluxer-reports
+    harvests: fluxer-harvests
+
+livekit:
+  # Run LiveKit for voice and video. false with no external.url turns voice off.
+  enabled: true
+  # A LiveKit server of your own, used when enabled is false. Its key and
+  # secret go in secrets.values.FLUXER_LIVEKIT_API_KEY and FLUXER_LIVEKIT_API_SECRET.
+  # Point its webhook at <origin>/api/webhooks/livekit, signed with the same key.
+  external:
+    # The address the api uses to reach it, for example http://livekit.voice.svc:7880.
+    url: ""
+    # The address browsers use to reach it, for example wss://livekit.example.com.
+    publicUrl: ""
+  image:
+    repository: livekit/livekit-server
+    tag: v1.12.0
+    digest: ""
+    pullPolicy: IfNotPresent
+  # How clients reach the media ports. hostNetwork binds them on the node and
+  # needs a privileged namespace. loadBalancer and nodePort use the Service
+  # livekit-rtc, which serves TCP and UDP on one address.
+  expose: hostNetwork
+  # The public IP LiveKit advertises. Required for loadBalancer, where it is the
+  # address of the load balancer. Empty finds it over STUN.
+  nodeIP: ""
+  # The address the loadBalancer Service asks for. Reserve it with your
+  # provider first. Some providers take it from an annotation instead.
+  loadBalancerIP: ""
+  # Find the public IP over STUN.
+  useExternalIP: true
+  tcpPort: 7881
+  udpPort: 7882
+  # The node ports in nodePort mode. LiveKit advertises these too.
+  nodePorts:
+    tcp: 30881
+    udp: 30882
+  stunServers:
+    - stun.l.google.com:19302
+    - stun1.l.google.com:19302
+  logLevel: info
+  # More LiveKit configuration, merged over the chart's, for example
+  # {rtc: {ips: {includes: [10.0.0.0/8]}}} to advertise only the node network.
+  extraConfig: {}
+  # The voice region seeded on every api start, as JSON.
+  defaultRegion: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
+  # Node addresses allowed to reach the edge in hostNetwork mode, for the
+  # LiveKit webhook. Needed only with networkPolicy.ingressNamespaceSelector.
+  # Keep it as narrow as the LiveKit node, for example 10.0.0.12/32 together
+  # with nodeSelector.
+  nodeCIDRs: []
+  # Annotations for the Service livekit-rtc.
+  serviceAnnotations: {}
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      memory: 512Mi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+# Every Fluxer workload below takes the same keys:
+# replicas, image (registry, tag, digest, pullPolicy), resources, env (NAME: value),
+# extraEnv (a list of Kubernetes env entries), probes (startup, liveness or
+# readiness, each replacing the default probe whole), podAnnotations,
+# nodeSelector, tolerations, affinity, topologySpreadConstraints, pdb
+# (minAvailable or maxUnavailable), hpa (minReplicas, maxReplicas,
+# targetCPUUtilizationPercentage), extraVolumes and extraVolumeMounts.
+
+api:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 100m
+      memory: 768Mi
+    limits:
+      memory: 2560Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+worker:
+  # Must stay 1. The worker runs the cron scheduler.
+  replicas: 1
+  resources:
+    requests:
+      cpu: 100m
+      memory: 768Mi
+    limits:
+      memory: 2560Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+gateway:
+  replicas: 1
+  terminationGracePeriodSeconds: 30
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
+    limits:
+      memory: 1Gi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+mediaProxy:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      memory: 512Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+push:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi
+    limits:
+      memory: 256Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+admin:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 10m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+appProxy:
+  replicas: 1
+  # Settings for app-proxy only: branding, CSP extras, the index upstream,
+  # same-origin hosts and manifest scope, as NAME: value. For example
+  # FLUXER_APP_PRODUCT_NAME, FLUXER_CSP_EXTRA_CONNECT_SRC or RUST_LOG.
+  config: {}
+  resources:
+    requests:
+      cpu: 20m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+staticProxy:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 10m
+      memory: 32Mi
+    limits:
+      memory: 256Mi
+  env: {}
+  extraEnv: []
+  probes: {}
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  pdb: {}
+  hpa: {}
+  extraVolumes: []
+  extraVolumeMounts: []
+
+# The internal services. Each runs a router Deployment and a shard StatefulSet.
+# router and shard take the workload keys above. shard.replicas sets the shard count.
+svc:
+  gifs:
+    router:
+      replicas: 1
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {memory: 128Mi}
+    shard:
+      replicas: 1
+      resources:
+        requests: {cpu: 20m, memory: 64Mi}
+        limits: {memory: 256Mi}
+  messages:
+    router:
+      replicas: 1
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {memory: 128Mi}
+    shard:
+      replicas: 1
+      resources:
+        requests: {cpu: 20m, memory: 64Mi}
+        limits: {memory: 256Mi}
+  snowflakes:
+    router:
+      replicas: 1
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {memory: 128Mi}
+    shard:
+      replicas: 1
+      resources:
+        requests: {cpu: 20m, memory: 64Mi}
+        limits: {memory: 256Mi}
+  unfurl:
+    router:
+      replicas: 1
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {memory: 128Mi}
+    shard:
+      replicas: 1
+      resources:
+        requests: {cpu: 20m, memory: 64Mi}
+        limits: {memory: 256Mi}
+  users:
+    router:
+      replicas: 1
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {memory: 128Mi}
+    shard:
+      replicas: 1
+      resources:
+        requests: {cpu: 20m, memory: 64Mi}
+        limits: {memory: 256Mi}
+
+edge:
+  image:
+    repository: caddy
+    tag: 2.11-alpine
+    digest: ""
+    pullPolicy: IfNotPresent
+  # How traffic reaches the edge. ingress puts an Ingress in front of it,
+  # gateway an HTTPRoute, loadBalancer a LoadBalancer Service with its own TLS,
+  # and none leaves only the ClusterIP Service edge on port 8080.
+  expose: ingress
+  ingress:
+    # The IngressClass. Empty uses the cluster default.
+    className: ""
+    # Extra annotations. The chart always adds the ingress-nginx body size and
+    # timeout annotations, which other controllers ignore.
+    annotations: {}
+    tls:
+      # certManager issues a certificate through a namespaced ACME Issuer.
+      # existingSecret uses secretName. none serves plain HTTP behind the controller.
+      mode: certManager
+      secretName: fluxer-tls
+      acmeServer: https://acme-v02.api.letsencrypt.org/directory
+  gateway:
+    # The Gateway the HTTPRoute attaches to, as Gateway API parentRefs.
+    parentRefs: []
+    # HTTPRoute timeouts, for example {request: 0s}. Envoy-based gateways cut
+    # requests at 15 seconds without it.
+    timeouts: {}
+  loadBalancer:
+    # Also publish UDP 443 for HTTP/3. Some clouds cannot mix TCP and UDP on one Service.
+    http3: false
+    annotations: {}
+    # Size of the volume that keeps the certificates.
+    persistence:
+      size: 1Gi
+      storageClassName: ""
+  replicas: 1
+  # Edge settings as NAME: value, overriding the chart's, for example
+  # FLUXER_EDGE_GLOBAL_OPTIONS or FLUXER_EDGE_ENCODE.
+  env: {}
+  extraEnv: []
+  resources:
+    requests:
+      cpu: 20m
+      memory: 64Mi
+    limits:
+      memory: 256Mi
+  podAnnotations: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+networkPolicy:
+  # Admit traffic to the release pods only from the release itself, to the edge
+  # from anywhere, and to the LiveKit media ports. Network plugins without
+  # NetworkPolicy support ignore it. Add a NetworkPolicy of your own to let
+  # another namespace in, for example a metrics scraper.
+  enabled: true
+  # Namespaces allowed to reach the edge on port 8080, as a namespaceSelector,
+  # for example {matchLabels: {kubernetes.io/metadata.name: ingress-nginx}}.
+  # Empty allows any source.
+  ingressNamespaceSelector: {}
@@ -1,6 +1,8 @@
-# Every variable docker-compose.yml reads, uncommented when it has no default and
-# commented with its default when it has one. Compose expands top to bottom, so a
-# line using ${...} must sit below every name it reads.
+# Every variable docker-compose.yml reads. A value an install must set is
+# uncommented. A commented line shows the default, or an example where its comment
+# says so, and nothing after = means the service decides. An empty value keeps the
+# default too. Compose expands top to bottom, so a line using ${...} must sit below
+# every name it reads.

 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
@@ -68,7 +70,9 @@ FLUXER_IMAGE_TAG=v1
 POSTGRES_PASSWORD=CHANGE_ME
 MEILI_MASTER_KEY=CHANGE_ME
 # Set these to run Postgres or the object store outside the stack. Backing up a
-# store you moved out is yours to arrange, and an upgrade skips it.
+# store you moved out is yours to arrange. An upgrade dumps the bundled postgres
+# service and skips the dump only when the stack defines none. The values below
+# are examples.
 #FLUXER_POSTGRES_HOST=db.example.com
 #FLUXER_POSTGRES_PORT=5432
 #FLUXER_POSTGRES_DATABASE=fluxer
@@ -78,50 +82,101 @@ MEILI_MASTER_KEY=CHANGE_ME
 #FLUXER_S3_PUBLIC_ENDPOINT=https://cdn.example.com
 #FLUXER_S3_REGION=eu-central-1
 #FLUXER_S3_FORCE_PATH_STYLE=false
+
 # Bucket names. The bundled store creates these. An outside store needs them to
 # exist already.
 #FLUXER_S3_BUCKET_CDN=fluxer
 #FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
 #FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 #FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
+# With the object store outside the stack, add this overlay to COMPOSE_FILE and
+# the bundled seaweedfs no longer starts. Put it after any other overlay, such as
+# docker-compose.yml:docker-compose.proxy.yml:external-object-store.compose.yml.
+# Needs Compose 2.24.4 or newer.
+#COMPOSE_FILE=docker-compose.yml:external-object-store.compose.yml
+
+# A full connection URL wins over the host, port and database above. The URL is an
+# example. The CA is the PEM text of the certificate, with \n for line breaks.
+#FLUXER_POSTGRES_URL=postgres://fluxer:[email protected]:5432/fluxer
+#FLUXER_POSTGRES_SSL_CA=
+# The Postgres table that holds the key-value store.
+#FLUXER_POSTGRES_KV_TABLE=fluxer_kv
+# media-proxy reads through these when the store serves reads from another
+# address or bucket.
+#FLUXER_S3_READ_ENDPOINT=
+#FLUXER_S3_READ_BUCKET=
+#FLUXER_S3_READ_BUCKET_STYLE=
+# A temporary S3 session token, read by media-proxy only.
+#FLUXER_S3_SESSION_TOKEN=
+# The bundled store refuses unsigned reads. Set false only for a public-read bucket.
+#FLUXER_S3_READ_SIGNED=true

 # The other bundled services, pointed elsewhere. Removing a service from the
 # stack belongs in an override file, since an upgrade replaces docker-compose.yml.
+# The URLs below are examples.
 #FLUXER_KV_URL=redis://cache.example.com:6379/0
 #FLUXER_NATS_URL=nats://mq.example.com:4222
 #FLUXER_NATS_JETSTREAM_URL=nats://mq.example.com:4222
 #FLUXER_SVC_NATS_URL=nats://mq.example.com:4222
 #FLUXER_SEARCH_URL=https://search.example.com
 #FLUXER_LIVEKIT_INTERNAL_URL=http://livekit.example.com:7880
+# How the stack talks to those services.
+#FLUXER_KV_MODE=standalone
+#FLUXER_SEARCH_ENGINE=meilisearch
+#FLUXER_SEARCH_USERNAME=
+#FLUXER_SEARCH_PASSWORD=
+#FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED=true

 # Voice off. The livekit service still runs until an override removes it.
 #FLUXER_LIVEKIT_ENABLED=false

 # Optional systems, each off unless configured.
-#FLUXER_SMS_ENABLED=false
 #FLUXER_STRIPE_ENABLED=false
-#FLUXER_NCMEC_ENABLED=false
-#FLUXER_CLAMAV_ENABLED=false
+#FLUXER_STRIPE_SECRET_KEY=
+#FLUXER_STRIPE_WEBHOOK_SECRET=
+# Stripe prices as one JSON object. The admin dashboard can set them instead.
+#FLUXER_STRIPE_PRICES={}
+#FLUXER_STRIPE_LEGACY_PRICES={}
+#FLUXER_API_DONATION_PROXY_KEY=
+#FLUXER_API_TRUSTED_CALLERS=[]
+#FLUXER_VISIONARIES_GUILD_ID=
+#FLUXER_VISIONARIES_GUILD_VISIONARY_ROLE_ID=

-# Outside lookups, off unless turned on. The Tor exit list comes from
-# onionoo.torproject.org and the breached password check asks
+# Upload virus scanning, off by default. No ClamAV container ships, so point
+# this at your own. The values below are examples.
+#FLUXER_CLAMAV_ENABLED=true
+#FLUXER_CLAMAV_HOST=clamav
+#FLUXER_CLAMAV_PORT=3310
+#FLUXER_CLAMAV_FAIL_OPEN=false
+
+# Outside lookups, off unless turned on. The breached password check asks
 # api.pwnedpasswords.com.
-#FLUXER_TOR_EXIT_LIST_ENABLED=true
-#FLUXER_BREACHED_PASSWORD_CHECK_ENABLED=true
+#FLUXER_BREACHED_PASSWORD_CHECK_ENABLED=false
+#FLUXER_BLOCKLIST_FEEDS_ENABLED=false
+# A local path, or an s3:// URL read with the S3 credentials of this file.
+#FLUXER_GEOIP_DB_PATH=

-# The client address. Name the header your proxy actually writes, and turn the
-# trust off when nothing sits in front.
-#FLUXER_CLIENT_IP_HEADER_NAME=cf-connecting-ip
+# The client address. The edge sets X-Forwarded-For on every hop, so keep the
+# trust on and the default header. Turning the trust off makes the api ignore
+# the header and use the connection's peer address, which here is the edge.
+#FLUXER_CLIENT_IP_HEADER_NAME=x-forwarded-for
 #FLUXER_TRUST_CLIENT_IP_HEADER=true

-# How much the services write. trace, debug, info, warn, error or fatal.
-#LOG_LEVEL=debug
+# How much the services write. LOG_LEVEL covers the api and worker and takes trace,
+# debug, info, warn, error or fatal. RUST_LOG covers the Rust services and takes
+# an EnvFilter such as debug. The gateway takes an Erlang level such as notice,
+# and LOGGER_LEVEL beats FLUXER_GATEWAY_LOGGER_LEVEL.
+#LOG_LEVEL=info
+#RUST_LOG=info
+#FLUXER_GATEWAY_LOGGER_LEVEL=info
+#LOGGER_LEVEL=

 FLUXER_S3_ACCESS_KEY=fluxer
 FLUXER_S3_SECRET_KEY=CHANGE_ME

 FLUXER_SUDO_MODE_SECRET=CHANGE_ME
 FLUXER_CONNECTION_INITIATION_SECRET=CHANGE_ME
+FLUXER_PROFILE_PSEUDONYM_SECRET=CHANGE_ME
 FLUXER_GATEWAY_RPC_AUTH_TOKEN=CHANGE_ME
 FLUXER_ERLANG_COOKIE=CHANGE_ME
 FLUXER_MEDIA_PROXY_SECRET_KEY=CHANGE_ME
@@ -140,7 +195,7 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 # exist.
 #[email protected]

-# Passkeys follow FLUXER_DOMAIN. Set these only if browsers use another host.
+# The passkey RP ID defaults to FLUXER_DOMAIN, whatever FLUXER_PUBLIC_ORIGIN says.
 # Changing the RP ID invalidates every passkey registered against the old value.
 #FLUXER_PASSKEY_RP_ID=chat.example.com
 #FLUXER_PASSKEY_RP_NAME=Fluxer
@@ -151,21 +206,48 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 #FLUXER_PUSH_SERVICE_QUEUE_CAPACITY=10000
 # Provider requests the push container sends at once, 1 to 65536.
 #FLUXER_PUSH_SERVICE_SEND_CONCURRENCY=256
+# The push container's provider addresses and relay hosts.
+#FLUXER_PUSH_SERVICE_APNS_BASE_URL=
+#FLUXER_PUSH_SERVICE_FCM_BASE_URL=https://fcm.googleapis.com
+#FLUXER_PUSH_SERVICE_MANAGED_RELAY_HOSTS=push.fluxer.com
+#FLUXER_PUSH_SERVICE_OWN_RELAY_HOSTS=
+# Push hosts on your own network, such as a ntfy server, that may resolve to
+# private addresses. Comma separated.
+#FLUXER_PUSH_SERVICE_PRIVATE_HOSTS=ntfy.example.com
+#FLUXER_PUSH_SERVICE_RELAY_CONSENT_ACCEPTED=false
+
+# Direct mobile push through your own APNs and FCM credentials, off by default.
+#FLUXER_PUSH_APNS_ENABLED=false
+#FLUXER_PUSH_APNS_TEAM_ID=
+#FLUXER_PUSH_APNS_KEY_ID=
+#FLUXER_PUSH_APNS_PRIVATE_KEY=
+#FLUXER_PUSH_APNS_PRIVATE_KEY_PATH=
+#FLUXER_PUSH_APNS_APPS=
+#FLUXER_PUSH_APNS_DEFAULT_ENVIRONMENT=production
+#FLUXER_PUSH_FCM_ENABLED=false
+#FLUXER_PUSH_FCM_PROJECT_ID=
+#FLUXER_PUSH_FCM_CLIENT_EMAIL=
+#FLUXER_PUSH_FCM_PRIVATE_KEY=
+#FLUXER_PUSH_FCM_PRIVATE_KEY_PATH=
+#FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH=
+#FLUXER_PUSH_FCM_TOKEN_URI=https://oauth2.googleapis.com/token
+#FLUXER_PUSH_FCM_APPS=


 # Optional media policies, both off by default. See the operator docs.
 #
-# CORS limits which web origins may read media. A request with no Origin is
-# always served. Add https://web.fluxer.app if people use the hosted client.
+# CORS limits which web origins may read media. A request with no Origin, or
+# from the desktop app, is always served.
 #
 # Signatures make an attachment read need a signed URL, so a copied link stops
 # working. Needs a secret from openssl rand -base64 32, first entry signs and
 # every entry verifies.
 #
-# Each mode is off, report or enforce. Start at report. media-proxy reads these
-# at start, so apply with docker compose up -d media-proxy.
+# Each mode is off, report or enforce, and off is the default. Start at report.
+# media-proxy reads these at start, so apply with docker compose up -d
+# media-proxy. The values below are examples.
 #FLUXER_MEDIA_PROXY_CORS_MODE=enforce
-#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com,https://web.fluxer.app
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com
 #FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=
 #FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE=enforce

@@ -173,7 +255,7 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 # only when a browser must reach an origin the defaults do not cover. Separate
 # several with spaces or commas. The three values below are illustrations.
 #FLUXER_CSP_EXTRA_DEFAULT_SRC=
-#FLUXER_CSP_EXTRA_CONNECT_SRC=wss://livekit.example.com:7881
+#FLUXER_CSP_EXTRA_CONNECT_SRC=wss://livekit.example.com
 #FLUXER_CSP_EXTRA_IMG_SRC=https://cdn.example.com
 #FLUXER_CSP_EXTRA_MEDIA_SRC=
 #FLUXER_CSP_EXTRA_FONT_SRC=
@@ -188,7 +270,7 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME

 # Let the SSO provider resolve to a private address. Off by default, so a
 # misconfigured provider URL cannot reach internal services. Turn it on only for
-# a provider on your own network.
+# a provider on your own network. The value below is an example.
 #FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES=true

 # These reach both LiveKit and the api. Change them together.
@@ -205,32 +287,153 @@ LIVEKIT_API_SECRET=CHANGE_ME

 # LiveKit finds its public address over STUN. A host that cannot reach one stops
 # with "could not resolve external IP", so set the address by hand instead, or
-# point STUN elsewhere.
+# point STUN elsewhere. The values below are examples.
 #FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
 #FLUXER_LIVEKIT_NODE_IP=203.0.113.10
 #FLUXER_LIVEKIT_STUN_PRIMARY=stun.l.google.com:19302
 #FLUXER_LIVEKIT_STUN_SECONDARY=stun1.l.google.com:19302

-FLUXER_KLIPY_API_KEY=
+# The voice region users see, and how much LiveKit logs.
+#FLUXER_LIVEKIT_DEFAULT_REGION={"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}
+#FLUXER_LIVEKIT_LOG_LEVEL=info

+# STUN servers for peer-to-peer calls, which need the voice_p2p experiment turned
+# on in the admin panel. STUN finds each peer's public address. The value below
+# is an example.
+#FLUXER_VOICE_P2P_STUN_URLS=stun:stun.example.com:3478
+
+FLUXER_KLIPY_API_KEY=
+#FLUXER_YOUTUBE_API_KEY=
+# Hosts the api never unfurls, comma separated.
+#FLUXER_API_UNFURL_IGNORED_HOSTS=
+
+# Email delivery. Only an instance where members sign in with email needs it.
 FLUXER_EMAIL_ENABLED=false
 FLUXER_EMAIL_PROVIDER=none
 FLUXER_EMAIL_FROM_EMAIL=[email protected]
-FLUXER_EMAIL_FROM_NAME=Fluxer
+FLUXER_EMAIL_FROM_NAME=
+#[email protected]
 FLUXER_EMAIL_APP_BASE_URL=
 FLUXER_EMAIL_SMTP_HOST=
 FLUXER_EMAIL_SMTP_PORT=587
 FLUXER_EMAIL_SMTP_USERNAME=
 FLUXER_EMAIL_SMTP_PASSWORD=
-FLUXER_EMAIL_SMTP_SECURE=true
+# How the SMTP connection is encrypted: implicit, starttls, opportunistic or
+# none. Leave it empty for implicit TLS on port 465 and required STARTTLS on any
+# other port.
+FLUXER_EMAIL_SMTP_TLS_MODE=
+# The older switch, read only while the mode above is empty. true is implicit
+# and false is opportunistic.
+#FLUXER_EMAIL_SMTP_SECURE=false
+#FLUXER_EMAIL_WEBHOOK_SECRET=

-FLUXER_CAPTCHA_ENABLED=false
-FLUXER_CAPTCHA_PROVIDER=none
-FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY=
-FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY=
-FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
-FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true
+#FLUXER_DISCOVERY_MIN_MEMBER_COUNT=1
+
+# Instance identity and account policy. The terms, privacy and community
+# guidelines links have no variable here. Set them in the admin panel under
+# Instance Config. Until a guidelines link is set, the clients, report forms and
+# enforcement emails show none.
+#FLUXER_APP_PRODUCT_NAME=Fluxer
+#FLUXER_APP_ICON_URL=
+#FLUXER_APP_SYMBOL_URL=
+#FLUXER_APP_LOGO_URL=
+#FLUXER_APP_WORDMARK_URL=
+#FLUXER_APP_FAVICON_URL=
+#FLUXER_APP_THEME_COLOR=
+#FLUXER_APP_STATUS_PAGE_URL=
+#FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL=
+#FLUXER_INSTANCE_SETUP_CONFIGURED=false
+# Setup token the wizard asks for before the first admin account. 32 to 256 characters. Unset means the API generates one on the first start and writes it to its log once.
+#FLUXER_SETUP_TOKEN=
+# How members sign in on a new instance, username or email. Unset means username. Read only on the first start.
+#FLUXER_ACCOUNT_IDENTITY=
+# Username tags on a new email instance. none gives unique names with no tag, random gives name#4821. Unset means none. A username instance always uses none. Read only on the first start.
+#FLUXER_TAG_STYLE=
+#FLUXER_AUTO_JOIN_INVITE_CODE=
+#FLUXER_DELETION_GRACE_PERIOD_HOURS=336
+
+# Report retention. A daily job deletes each report this many days after it was
+# filed, with its evidence copies and search entry, unless a legal hold is set.
+#FLUXER_REPORT_RETENTION_DAYS=365
+# Delete resolved reports this many days after they were resolved, when that
+# comes first. Unset leaves them to FLUXER_REPORT_RETENTION_DAYS.
+#FLUXER_RESOLVED_REPORT_RETENTION_DAYS=
+# true only logs what the job would delete. Deleted evidence cannot be
+# restored, so check the "Processed report retention" log line of the worker
+# in a dry run first if you are unsure.
+#FLUXER_REPORT_RETENTION_DRY_RUN=false
+
+# Sign in with Bluesky, off unless turned on.
+#FLUXER_AUTH_BLUESKY_ENABLED=false
+#FLUXER_AUTH_BLUESKY_CLIENT_NAME=Fluxer
+#FLUXER_AUTH_BLUESKY_CLIENT_URI=
+#FLUXER_AUTH_BLUESKY_LOGO_URI=
+#FLUXER_AUTH_BLUESKY_TOS_URI=
+#FLUXER_AUTH_BLUESKY_POLICY_URI=
+#FLUXER_AUTH_BLUESKY_KEYS=
+
+# Public addresses. Each follows the public origin unless set here.
+#FLUXER_API_ENDPOINT=
+#FLUXER_API_CLIENT_ENDPOINT=
+#FLUXER_APP_ENDPOINT=
+#FLUXER_GATEWAY_ENDPOINT=
+#FLUXER_MEDIA_ENDPOINT=
+#FLUXER_STATIC_CDN_ENDPOINT=
+#FLUXER_ADMIN_ENDPOINT=
+#FLUXER_MARKETING_ENDPOINT=
+#FLUXER_INVITE_ENDPOINT=
+#FLUXER_GIFT_ENDPOINT=
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT=
+# This follows FLUXER_STATIC_CDN_ENDPOINT first, then the public origin.
+#FLUXER_GATEWAY_STATIC_CDN_ENDPOINT=
+# These follow FLUXER_MEDIA_ENDPOINT first, then the public origin.
+#FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT=
+#FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT=
+
+# Extra hosts for static assets, invites, gifts and the web app. Empty by default.
+#FLUXER_STATIC_CDN_DOMAIN=
+#FLUXER_INVITE_DOMAIN=
+#FLUXER_GIFT_DOMAIN=
+#FLUXER_APP_ORIGIN_ALIASES=
+
+# The path the admin panel is served under. The edge and the admin service read
+# it. The api follows it through the default FLUXER_ADMIN_ENDPOINT, and not when
+# FLUXER_ADMIN_ENDPOINT is set. Write it with a leading slash and no trailing
+# slash.
+#FLUXER_ADMIN_BASE_PATH=/admin
+
+# The compression the edge offers, as Caddy encode arguments.
+#FLUXER_EDGE_ENCODE=zstd gzip
+
+# Extra Caddy global options, one line, added to the global block of the edge
+# Caddyfile. Empty adds nothing. Example: email [email protected]
+#FLUXER_EDGE_GLOBAL_OPTIONS=
+
+# Images of the bundled services, for a mirror or another tag. A new Postgres
+# major needs a dump and restore, as the upgrade guide describes.
+#FLUXER_CADDY_IMAGE=caddy:2.11-alpine
+#FLUXER_POSTGRES_IMAGE=postgres:16-alpine
+#FLUXER_VALKEY_IMAGE=valkey/valkey:9.1-alpine
+#FLUXER_NATS_IMAGE=nats:2.14-alpine
+#FLUXER_MEILISEARCH_IMAGE=getmeili/meilisearch:v1.53
+#FLUXER_SEAWEEDFS_IMAGE=chrislusf/seaweedfs:4.47
+#FLUXER_LIVEKIT_IMAGE=livekit/livekit-server:v1.12.0
+
+# Restart policy for every long-running service.
+#FLUXER_RESTART_POLICY=unless-stopped
+
+# Health checks. Raise the retries or start periods on a slow host.
+#FLUXER_HEALTHCHECK_INTERVAL=10s
+#FLUXER_HEALTHCHECK_TIMEOUT=5s
+#FLUXER_HEALTHCHECK_RETRIES=10
+#FLUXER_APP_HEALTHCHECK_RETRIES=30
+#FLUXER_APP_HEALTHCHECK_START_PERIOD=90s
+#FLUXER_SVC_HEALTHCHECK_START_PERIOD=60s
+#FLUXER_WORKER_HEALTHCHECK_RETRIES=3
+#FLUXER_SEAWEEDFS_HEALTHCHECK_RETRIES=20
+#FLUXER_SEAWEEDFS_HEALTHCHECK_START_PERIOD=60s
+#FLUXER_SEAWEEDFS_INIT_ATTEMPTS=60

 # Container memory. These are ceilings, not allocations, and the defaults suit a
 # 16 GB host. The reservations bias the kernel away from reclaiming from services
@@ -240,7 +443,7 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_POSTGRES_MEMORY_RESERVATION=3gb
 #FLUXER_VALKEY_MEMORY_LIMIT=256mb
 #FLUXER_NATS_MEMORY_LIMIT=256mb
-#FLUXER_MEILISEARCH_MEMORY_LIMIT=768mb
+#FLUXER_MEILISEARCH_MEMORY_LIMIT=1536mb
 #FLUXER_SEAWEEDFS_MEMORY_LIMIT=2gb
 #FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT=128mb
 #FLUXER_LIVEKIT_MEMORY_LIMIT=512mb
@@ -266,20 +469,41 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_UNFURL_SHARD_MEMORY_LIMIT=256mb
 #FLUXER_ADMIN_MEMORY_LIMIT=256mb

-# Meilisearch indexing memory. Keep it well under the container limit above.
-#FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=384mb
+# Meilisearch indexing memory and threads. Each indexing thread needs its own
+# buffers on top of the indexing memory, so raise the threads only together with
+# the container limit above.
+#FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=256mb
+#FLUXER_MEILISEARCH_MAX_INDEXING_THREADS=2
+#FLUXER_MEILISEARCH_ENV=production
+#FLUXER_MEILISEARCH_NO_ANALYTICS=true

 # SeaweedFS heap ceiling. Go cannot see the container limit, so without this an
 # upload burst gets the container OOM-killed. Keep it near three quarters of
 # FLUXER_SEAWEEDFS_MEMORY_LIMIT and raise both together.
 #FLUXER_SEAWEEDFS_GOMEMLIMIT=1536MiB
+#FLUXER_SEAWEEDFS_TELEMETRY=false
+
+# Volumes SeaweedFS creates at once when a bucket needs space. Each reserves 1 GB
+# of free disk from the start, and SeaweedFS's own default of 7 fills a small
+# disk before every bucket has one, so uploads fail with no free volumes left.
+#FLUXER_SEAWEEDFS_VOLUME_GROWTH=1

 # Node sizes its heap from the container limit by default. Leave these unset
 # unless you need to pin it. A heap ceiling above the container limit gets the
-# container OOM-killed instead of reporting a heap error.
+# container OOM-killed instead of reporting a heap error. The values below are
+# examples.
 #FLUXER_API_NODE_HEAP_MB=1792
 #FLUXER_WORKER_NODE_HEAP_MB=1792

+# Extra Node flags for api and worker, appended to NODE_OPTIONS. Empty by
+# default. The value below is an example.
+#FLUXER_API_NODE_OPTIONS=--heapsnapshot-near-heap-limit=1
+#FLUXER_WORKER_NODE_OPTIONS=--heapsnapshot-near-heap-limit=1
+
+# Extra CA certificates api and worker trust, as a PEM bundle path inside the
+# container. The default is the image's system bundle.
+#FLUXER_NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
+
 # Bundled Postgres tuning. Keep it consistent with the memory limit above. This
 # is the server setting, not the per-service pool sizes.
 #FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS=150
@@ -289,23 +513,81 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_POSTGRES_MAINTENANCE_WORK_MEM=256MB
 #FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM=128MB
 #FLUXER_POSTGRES_SHM_SIZE=1gb
+#FLUXER_POSTGRES_RANDOM_PAGE_COST=1.1
+#FLUXER_POSTGRES_EFFECTIVE_IO_CONCURRENCY=200
+#FLUXER_POSTGRES_DEFAULT_STATISTICS_TARGET=200
+#FLUXER_POSTGRES_JIT=off
+#FLUXER_POSTGRES_MIN_WAL_SIZE=512MB
+#FLUXER_POSTGRES_MAX_WAL_SIZE=2GB
+#FLUXER_POSTGRES_CHECKPOINT_COMPLETION_TARGET=0.9
+#FLUXER_POSTGRES_WAL_BUFFERS=16MB
+#FLUXER_POSTGRES_WAL_COMPRESSION=zstd
+#FLUXER_POSTGRES_BGWRITER_DELAY=50ms
+#FLUXER_POSTGRES_BGWRITER_LRU_MAXPAGES=1000
+#FLUXER_POSTGRES_AUTOVACUUM_VACUUM_SCALE_FACTOR=0.05
+#FLUXER_POSTGRES_AUTOVACUUM_ANALYZE_SCALE_FACTOR=0.02
+#FLUXER_POSTGRES_AUTOVACUUM_VACUUM_COST_LIMIT=2000
+#FLUXER_POSTGRES_TRACK_IO_TIMING=on
+#FLUXER_POSTGRES_SHARED_PRELOAD_LIBRARIES=pg_stat_statements
+
+# Postgres pool size of each service that opens a pool.
+#FLUXER_API_POSTGRES_MAX_CONNECTIONS=25
+#FLUXER_WORKER_POSTGRES_MAX_CONNECTIONS=25
+#FLUXER_USERS_SHARD_POSTGRES_MAX_CONNECTIONS=20
+#FLUXER_MESSAGES_SHARD_POSTGRES_MAX_CONNECTIONS=20

 # The bundled Valkey holds durable state as well as cache, so it runs with an
 # append-only file and with noeviction, which fails an over-limit write instead
-# of dropping queued work. Change the policy only if that state lives elsewhere.
+# of dropping queued work. Change the policy only if that state is kept elsewhere.
 #FLUXER_VALKEY_MAXMEMORY=192mb
 #FLUXER_VALKEY_MAXMEMORY_POLICY=noeviction
+#FLUXER_VALKEY_APPENDFSYNC=everysec

 # The gateway derives its scheduler count from the CPU quota, clamped here. One
 # scheduler lets a single blocking operation stall every websocket on the node.
 #FLUXER_ERLANG_SCHEDULERS_MIN=2
 #FLUXER_ERLANG_SCHEDULERS_MAX=16
+# A fixed scheduler count skips the clamp. Dirty CPU schedulers default to two
+# thirds of it.
+#FLUXER_ERLANG_SCHEDULERS=
+#FLUXER_ERLANG_DIRTY_CPU_SCHEDULERS=

-# In-flight request ceiling for the users and messages routers and their shards.
-# One value replaces the built-in default on all of them, so size it for the
-# busiest. Too low a value rejects requests rather than slowing them, and the api
-# turns that into a 503.
-#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=192
+# Gateway push and RPC tuning.
+#FLUXER_GATEWAY_PUSH_ENABLED=true
+#FLUXER_GATEWAY_PUSH_ENROLLED_CLEAR_NOTIFICATIONS_ENABLED=true
+#FLUXER_GATEWAY_PUSH_OUTBOX_REQUEST_TIMEOUT_MS=100000
+#FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES=128
+#FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
+#FLUXER_GATEWAY_HTTP_RPC_MAX_CONCURRENCY=512
+#FLUXER_GATEWAY_NATS_RPC_MAX_HANDLERS=512
+#FLUXER_GATEWAY_HTTP_FAILURE_THRESHOLD=6
+#FLUXER_GATEWAY_HTTP_RECOVERY_TIMEOUT_MS=15000
+
+# In-flight request ceiling for every svc router and shard. Unset, each keeps its
+# own default: 192 for messages, 320 for snowflakes and 64 for the rest. One value
+# replaces all of them, so size it for the busiest. Too low a value rejects
+# requests rather than slowing them, and the api turns that into a 503. The value
+# below is an example.
+#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=320
+
+# svc caches, and how the api calls the svc services over NATS.
+#FLUXER_SVC_CACHE_MAX_ENTRIES=100000
+#FLUXER_SVC_CACHE_TTL_MS=30000
+#FLUXER_GIFS_SHARD_CACHE_MAX_BYTES=536870912
+#FLUXER_GIF_SERVICE_NATS_CLIENT_NAME=fluxer-api-gifs
+#FLUXER_GIF_SERVICE_TIMEOUT_MS=12000
+#FLUXER_GIF_SERVICE_REGISTER_SHARE_TIMEOUT_MS=3000
+#FLUXER_USERS_SERVICE_NATS_CLIENT_NAME=fluxer-api-users
+#FLUXER_USERS_SERVICE_TIMEOUT_MS=6000
+#FLUXER_USERS_SERVICE_INFLIGHT_MAX_ENTRIES=10000
+#FLUXER_SNOWFLAKE_SERVICE_NATS_CLIENT_NAME=fluxer-api-snowflakes
+#FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE=128
+#FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK=
+#FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS=5000
+#FLUXER_SNOWFLAKE_SERVICE_REQUEST_TIMEOUT_MS=6000
+
+# Worker concurrency per lane, as a JSON object keyed by lane.
+#FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES=

 # Named prepared statements need a session that outlives the transaction, so set
 # this to false behind a transaction-pooling connection pooler. The bundled
@@ -317,3 +599,51 @@ FLUXER_DISCOVERY_ENABLED=true
 # is clamped down to the second. Milliseconds, 1000 to 3600000.
 #FLUXER_API_HEADERS_TIMEOUT_MS=30000
 #FLUXER_API_REQUEST_TIMEOUT_MS=120000
+
+# api request limits and IP bans. A refresh interval of 0 stops the periodic
+# ban reload.
+#FLUXER_API_MAX_INFLIGHT_REQUESTS=512
+#FLUXER_API_IP_BAN_EXEMPT_IPS=
+#FLUXER_IP_BAN_REFRESH_INTERVAL_MS=300000
+
+# Uploads and data exports. Presigned exports link to FLUXER_S3_PUBLIC_ENDPOINT,
+# so turn them on only once browsers can reach it.
+#FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
+#FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED=false
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_MAX_BODY_BYTES=524288000
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_TOKEN_TTL_SECS=900
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_KEEP_DIRECT_COUNTRIES=
+#FLUXER_API_STORAGE_CHANGE_FEED_ENABLED=false
+#FLUXER_API_STORAGE_CHANGE_FEED_STREAM=STORAGE_CHANGES
+#FLUXER_API_STORAGE_CHANGE_FEED_SKIP_BUCKETS=
+#FLUXER_CACHE_PURGE_ADAPTER=none
+#FLUXER_CACHE_PURGE_HTTP_ENDPOINT=
+#FLUXER_CACHE_PURGE_HTTP_TOKEN=
+#FLUXER_CACHE_PURGE_HTTP_TIMEOUT_MS=10000
+
+# media-proxy limits and timeouts.
+#FLUXER_MEDIA_PROXY_READ_ONLY=false
+#FLUXER_MEDIA_PROXY_NSFW_THRESHOLD=0.85
+#FLUXER_NSFW_SERVICE_ENDPOINT=
+#FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS=
+#FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY=
+#FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS=30000
+#FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES=20000
+#FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS=15000
+#FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES=268435456
+#FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES=67108864
+#FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS=120000
+#FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS=30000
+#FLUXER_MEDIA_PROXY_SHUTDOWN_GRACE_MS=30000
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS=900000
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES=33554432
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES=536870912
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_DIR=
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_CHUNK_BYTES=1048576
+#FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_MAX_TOTAL_BYTES=8589934592
+
+# app-proxy discovery refresh, index upstream and manifest scope.
+#DISCOVERY_REFRESH_INTERVAL_MS=60000
+#FLUXER_APP_PROXY_INDEX_UPSTREAM_URL=
+#FLUXER_APP_PROXY_SAME_ORIGIN_HOSTS=
+#FLUXER_APP_PROXY_MANIFEST_SCOPE_EXTENSIONS=
@@ -3,10 +3,11 @@
 		trusted_proxies static {$FLUXER_EDGE_TRUSTED_PROXIES:private_ranges}
 		trusted_proxies_strict
 	}
+	{$FLUXER_EDGE_GLOBAL_OPTIONS}
 }

 {$FLUXER_EDGE_SITE_ADDRESS} {
-	encode zstd gzip
+	encode {$FLUXER_EDGE_ENCODE:zstd gzip}

 	handle /_health {
 		respond "OK" 200
@@ -33,16 +34,16 @@
 		reverse_proxy livekit:7880
 	}

-	handle /admin {
+	handle {$FLUXER_ADMIN_BASE_PATH:/admin} {
 		rewrite * /
 		reverse_proxy admin:8080
 	}

-	handle_path /admin/* {
+	handle_path {$FLUXER_ADMIN_BASE_PATH:/admin}/* {
 		reverse_proxy admin:8080
 	}

-	@staticAssets path /web/* /emoji/* /libs/* /avatars/* /badges/* /desktop/* /embeds/*
+	@staticAssets path /web/* /emoji/* /libs/* /avatars/* /badges/* /desktop/*
 	handle @staticAssets {
 		reverse_proxy static-proxy:8080
 	}
@@ -3,40 +3,81 @@ name: fluxer
 x-fluxer-postgres-env: &fluxer-postgres-env
  FLUXER_DATABASE_BACKEND: postgres
  FLUXER_POSTGRES_HOST: ${FLUXER_POSTGRES_HOST:-postgres}
-  FLUXER_POSTGRES_PORT: "${FLUXER_POSTGRES_PORT:-5432}"
-  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-fluxer}
-  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-fluxer}
+  FLUXER_POSTGRES_PORT: ${FLUXER_POSTGRES_PORT:-}
+  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-}
+  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-}
  FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-  FLUXER_POSTGRES_SSL: "${FLUXER_POSTGRES_SSL:-false}"
-  FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-true}
+  FLUXER_POSTGRES_URL: ${FLUXER_POSTGRES_URL:-}
+  FLUXER_POSTGRES_SSL: ${FLUXER_POSTGRES_SSL:-}
+  FLUXER_POSTGRES_SSL_CA: ${FLUXER_POSTGRES_SSL_CA:-}
+  FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-}
+  FLUXER_POSTGRES_KV_TABLE: ${FLUXER_POSTGRES_KV_TABLE:-}

 x-fluxer-env: &fluxer-env
  <<: *fluxer-postgres-env
  FLUXER_ENV: production
-  NODE_ENV: production
-  LOG_LEVEL: ${LOG_LEVEL:-info}
+  LOG_LEVEL: ${LOG_LEVEL:-}
+  RUST_LOG: ${RUST_LOG:-}
  FLUXER_SELF_HOSTED: "true"
  FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
  FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
  FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
  FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
  FLUXER_TRUST_CLIENT_IP_HEADER: "${FLUXER_TRUST_CLIENT_IP_HEADER:-true}"
-  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-x-forwarded-for}
-  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
-  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-120000}
-  FLUXER_TOR_EXIT_LIST_ENABLED: "${FLUXER_TOR_EXIT_LIST_ENABLED:-false}"
-  FLUXER_BREACHED_PASSWORD_CHECK_ENABLED: "${FLUXER_BREACHED_PASSWORD_CHECK_ENABLED:-false}"
+  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-}
+  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-}
+  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-}
+  FLUXER_API_MAX_INFLIGHT_REQUESTS: ${FLUXER_API_MAX_INFLIGHT_REQUESTS:-}
+  FLUXER_API_IP_BAN_EXEMPT_IPS: ${FLUXER_API_IP_BAN_EXEMPT_IPS:-}
+  FLUXER_IP_BAN_REFRESH_INTERVAL_MS: ${FLUXER_IP_BAN_REFRESH_INTERVAL_MS:-}
+  FLUXER_APP_ORIGIN_ALIASES: ${FLUXER_APP_ORIGIN_ALIASES:-}
+  FLUXER_BREACHED_PASSWORD_CHECK_ENABLED: ${FLUXER_BREACHED_PASSWORD_CHECK_ENABLED:-}
+  FLUXER_BLOCKLIST_FEEDS_ENABLED: ${FLUXER_BLOCKLIST_FEEDS_ENABLED:-}
+  FLUXER_GEOIP_DB_PATH: ${FLUXER_GEOIP_DB_PATH:-}
+
+  FLUXER_API_ENDPOINT: ${FLUXER_API_ENDPOINT:-}
+  FLUXER_API_CLIENT_ENDPOINT: ${FLUXER_API_CLIENT_ENDPOINT:-}
+  FLUXER_APP_ENDPOINT: ${FLUXER_APP_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
+  FLUXER_GATEWAY_ENDPOINT: ${FLUXER_GATEWAY_ENDPOINT:-}
+  FLUXER_MEDIA_ENDPOINT: ${FLUXER_MEDIA_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}
+  FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT:-${FLUXER_MEDIA_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}}
+  FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-}
+  FLUXER_ADMIN_ENDPOINT: ${FLUXER_ADMIN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}${FLUXER_ADMIN_BASE_PATH:-/admin}}
+  FLUXER_MARKETING_ENDPOINT: ${FLUXER_MARKETING_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
+  FLUXER_INVITE_ENDPOINT: ${FLUXER_INVITE_ENDPOINT:-}
+  FLUXER_GIFT_ENDPOINT: ${FLUXER_GIFT_ENDPOINT:-}
+  FLUXER_STATIC_CDN_DOMAIN: ${FLUXER_STATIC_CDN_DOMAIN:-}
+  FLUXER_INVITE_DOMAIN: ${FLUXER_INVITE_DOMAIN:-}
+  FLUXER_GIFT_DOMAIN: ${FLUXER_GIFT_DOMAIN:-}

  FLUXER_KV_URL: ${FLUXER_KV_URL:-redis://valkey:6379/0}
+  FLUXER_KV_MODE: ${FLUXER_KV_MODE:-}
  FLUXER_NATS_URL: ${FLUXER_NATS_URL:-nats://nats:4222}
  FLUXER_NATS_JETSTREAM_URL: ${FLUXER_NATS_JETSTREAM_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
  FLUXER_NATS_AUTH_TOKEN: ${FLUXER_NATS_AUTH_TOKEN:-}
  FLUXER_SVC_NATS_URL: ${FLUXER_SVC_NATS_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
  FLUXER_SVC_SHARD_COUNT: "1"
+  FLUXER_SVC_MAX_CONCURRENT_REQUESTS: ${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}
+  FLUXER_SVC_CACHE_MAX_ENTRIES: ${FLUXER_SVC_CACHE_MAX_ENTRIES:-}
+  FLUXER_SVC_CACHE_TTL_MS: ${FLUXER_SVC_CACHE_TTL_MS:-}
+  FLUXER_GIF_SERVICE_NATS_CLIENT_NAME: ${FLUXER_GIF_SERVICE_NATS_CLIENT_NAME:-}
+  FLUXER_GIF_SERVICE_TIMEOUT_MS: ${FLUXER_GIF_SERVICE_TIMEOUT_MS:-}
+  FLUXER_GIF_SERVICE_REGISTER_SHARE_TIMEOUT_MS: ${FLUXER_GIF_SERVICE_REGISTER_SHARE_TIMEOUT_MS:-}
+  FLUXER_USERS_SERVICE_NATS_CLIENT_NAME: ${FLUXER_USERS_SERVICE_NATS_CLIENT_NAME:-}
+  FLUXER_USERS_SERVICE_TIMEOUT_MS: ${FLUXER_USERS_SERVICE_TIMEOUT_MS:-}
+  FLUXER_USERS_SERVICE_INFLIGHT_MAX_ENTRIES: ${FLUXER_USERS_SERVICE_INFLIGHT_MAX_ENTRIES:-}
+  FLUXER_SNOWFLAKE_SERVICE_NATS_CLIENT_NAME: ${FLUXER_SNOWFLAKE_SERVICE_NATS_CLIENT_NAME:-}
+  FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE: ${FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE:-}
+  FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK: ${FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK:-}
+  FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS: ${FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS:-}
+  FLUXER_SNOWFLAKE_SERVICE_REQUEST_TIMEOUT_MS: ${FLUXER_SNOWFLAKE_SERVICE_REQUEST_TIMEOUT_MS:-}

-  FLUXER_SEARCH_ENGINE: meilisearch
+  FLUXER_SEARCH_ENGINE: ${FLUXER_SEARCH_ENGINE:-meilisearch}
  FLUXER_SEARCH_URL: ${FLUXER_SEARCH_URL:-http://meilisearch:7700}
  FLUXER_SEARCH_API_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
+  FLUXER_SEARCH_USERNAME: ${FLUXER_SEARCH_USERNAME:-}
+  FLUXER_SEARCH_PASSWORD: ${FLUXER_SEARCH_PASSWORD:-}
+  FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED: ${FLUXER_SEARCH_TLS_REJECT_UNAUTHORIZED:-}

  FLUXER_S3_ENDPOINT: ${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}
  FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}}
@@ -48,52 +89,101 @@ x-fluxer-env: &fluxer-env
  FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
  FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
  FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
-  AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
-  AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
-  AWS_DEFAULT_REGION: ${FLUXER_S3_REGION:-us-east-1}
-  AWS_EC2_METADATA_DISABLED: "true"
+  FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED: "${FLUXER_API_PRESIGNED_HARVEST_DOWNLOADS_ENABLED:-false}"
+  FLUXER_API_STORAGE_CHANGE_FEED_ENABLED: ${FLUXER_API_STORAGE_CHANGE_FEED_ENABLED:-}
+  FLUXER_API_STORAGE_CHANGE_FEED_STREAM: ${FLUXER_API_STORAGE_CHANGE_FEED_STREAM:-}
+  FLUXER_API_STORAGE_CHANGE_FEED_SKIP_BUCKETS: ${FLUXER_API_STORAGE_CHANGE_FEED_SKIP_BUCKETS:-}
+  FLUXER_CACHE_PURGE_ADAPTER: ${FLUXER_CACHE_PURGE_ADAPTER:-}
+  FLUXER_CACHE_PURGE_HTTP_ENDPOINT: ${FLUXER_CACHE_PURGE_HTTP_ENDPOINT:-}
+  FLUXER_CACHE_PURGE_HTTP_TOKEN: ${FLUXER_CACHE_PURGE_HTTP_TOKEN:-}
+  FLUXER_CACHE_PURGE_HTTP_TIMEOUT_MS: ${FLUXER_CACHE_PURGE_HTTP_TIMEOUT_MS:-}

  FLUXER_LIVEKIT_ENABLED: "${FLUXER_LIVEKIT_ENABLED:-true}"
  FLUXER_LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
  FLUXER_LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}
  FLUXER_LIVEKIT_INTERNAL_URL: ${FLUXER_LIVEKIT_INTERNAL_URL:-http://livekit:7880}
-  FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
-  FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
+  FLUXER_LIVEKIT_DEFAULT_REGION: '${FLUXER_LIVEKIT_DEFAULT_REGION:-{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}}'
  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}/livekit}
+  FLUXER_VOICE_P2P_STUN_URLS: ${FLUXER_VOICE_P2P_STUN_URLS:-}

  FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}
+  FLUXER_YOUTUBE_API_KEY: ${FLUXER_YOUTUBE_API_KEY:-}
+  FLUXER_API_UNFURL_IGNORED_HOSTS: ${FLUXER_API_UNFURL_IGNORED_HOSTS:-}

-  FLUXER_EMAIL_ENABLED: ${FLUXER_EMAIL_ENABLED:-false}
-  FLUXER_EMAIL_PROVIDER: ${FLUXER_EMAIL_PROVIDER:-none}
+  FLUXER_EMAIL_ENABLED: ${FLUXER_EMAIL_ENABLED:-}
+  FLUXER_EMAIL_PROVIDER: ${FLUXER_EMAIL_PROVIDER:-}
  FLUXER_EMAIL_FROM_EMAIL: ${FLUXER_EMAIL_FROM_EMAIL:-noreply@localhost}
-  FLUXER_EMAIL_FROM_NAME: ${FLUXER_EMAIL_FROM_NAME:-Fluxer}
+  FLUXER_EMAIL_FROM_NAME: ${FLUXER_EMAIL_FROM_NAME:-}
+  FLUXER_EMAIL_REPLY_TO_EMAIL: ${FLUXER_EMAIL_REPLY_TO_EMAIL:-}
  FLUXER_EMAIL_APP_BASE_URL: ${FLUXER_EMAIL_APP_BASE_URL:-}
+  FLUXER_EMAIL_WEBHOOK_SECRET: ${FLUXER_EMAIL_WEBHOOK_SECRET:-}
  FLUXER_EMAIL_SMTP_HOST: ${FLUXER_EMAIL_SMTP_HOST:-}
-  FLUXER_EMAIL_SMTP_PORT: ${FLUXER_EMAIL_SMTP_PORT:-587}
+  FLUXER_EMAIL_SMTP_PORT: ${FLUXER_EMAIL_SMTP_PORT:-}
  FLUXER_EMAIL_SMTP_USERNAME: ${FLUXER_EMAIL_SMTP_USERNAME:-}
  FLUXER_EMAIL_SMTP_PASSWORD: ${FLUXER_EMAIL_SMTP_PASSWORD:-}
-  FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-true}
+  FLUXER_EMAIL_SMTP_TLS_MODE: ${FLUXER_EMAIL_SMTP_TLS_MODE:-}
+  FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-}

-  FLUXER_SMS_ENABLED: "${FLUXER_SMS_ENABLED:-false}"
-  FLUXER_CAPTCHA_ENABLED: ${FLUXER_CAPTCHA_ENABLED:-false}
-  FLUXER_CAPTCHA_PROVIDER: ${FLUXER_CAPTCHA_PROVIDER:-none}
-  FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY:-}
-  FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY:-}
-  FLUXER_CAPTCHA_TURNSTILE_SITE_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SITE_KEY:-}
-  FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY:-}
-  FLUXER_STRIPE_ENABLED: "${FLUXER_STRIPE_ENABLED:-false}"
-  FLUXER_NCMEC_ENABLED: "${FLUXER_NCMEC_ENABLED:-false}"
-  FLUXER_CLAMAV_ENABLED: "${FLUXER_CLAMAV_ENABLED:-false}"
-  FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-true}
+  FLUXER_STRIPE_ENABLED: ${FLUXER_STRIPE_ENABLED:-}
+  FLUXER_STRIPE_SECRET_KEY: ${FLUXER_STRIPE_SECRET_KEY:-}
+  FLUXER_STRIPE_WEBHOOK_SECRET: ${FLUXER_STRIPE_WEBHOOK_SECRET:-}
+  FLUXER_STRIPE_PRICES: ${FLUXER_STRIPE_PRICES:-}
+  FLUXER_STRIPE_LEGACY_PRICES: ${FLUXER_STRIPE_LEGACY_PRICES:-}
+  FLUXER_API_DONATION_PROXY_KEY: ${FLUXER_API_DONATION_PROXY_KEY:-}
+  FLUXER_API_TRUSTED_CALLERS: ${FLUXER_API_TRUSTED_CALLERS:-}
+  FLUXER_VISIONARIES_GUILD_ID: ${FLUXER_VISIONARIES_GUILD_ID:-}
+  FLUXER_VISIONARIES_GUILD_VISIONARY_ROLE_ID: ${FLUXER_VISIONARIES_GUILD_VISIONARY_ROLE_ID:-}
+
+  FLUXER_CLAMAV_ENABLED: ${FLUXER_CLAMAV_ENABLED:-}
+  FLUXER_CLAMAV_HOST: ${FLUXER_CLAMAV_HOST:-}
+  FLUXER_CLAMAV_PORT: ${FLUXER_CLAMAV_PORT:-}
+  FLUXER_CLAMAV_FAIL_OPEN: ${FLUXER_CLAMAV_FAIL_OPEN:-}
+
+  FLUXER_APP_PRODUCT_NAME: ${FLUXER_APP_PRODUCT_NAME:-}
+  FLUXER_APP_ICON_URL: ${FLUXER_APP_ICON_URL:-}
+  FLUXER_APP_SYMBOL_URL: ${FLUXER_APP_SYMBOL_URL:-}
+  FLUXER_APP_LOGO_URL: ${FLUXER_APP_LOGO_URL:-}
+  FLUXER_APP_WORDMARK_URL: ${FLUXER_APP_WORDMARK_URL:-}
+  FLUXER_APP_FAVICON_URL: ${FLUXER_APP_FAVICON_URL:-}
+  FLUXER_APP_THEME_COLOR: ${FLUXER_APP_THEME_COLOR:-}
+  FLUXER_APP_STATUS_PAGE_URL: ${FLUXER_APP_STATUS_PAGE_URL:-}
+  FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL: ${FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL:-}
+  FLUXER_INSTANCE_SETUP_CONFIGURED: ${FLUXER_INSTANCE_SETUP_CONFIGURED:-}
+  FLUXER_ACCOUNT_IDENTITY: ${FLUXER_ACCOUNT_IDENTITY:-}
+  FLUXER_TAG_STYLE: ${FLUXER_TAG_STYLE:-}
+  FLUXER_AUTO_JOIN_INVITE_CODE: ${FLUXER_AUTO_JOIN_INVITE_CODE:-}
+  FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-}
+  FLUXER_DISCOVERY_MIN_MEMBER_COUNT: ${FLUXER_DISCOVERY_MIN_MEMBER_COUNT:-}
+  FLUXER_DELETION_GRACE_PERIOD_HOURS: ${FLUXER_DELETION_GRACE_PERIOD_HOURS:-}
+  FLUXER_REPORT_RETENTION_DAYS: ${FLUXER_REPORT_RETENTION_DAYS:-}
+  FLUXER_RESOLVED_REPORT_RETENTION_DAYS: ${FLUXER_RESOLVED_REPORT_RETENTION_DAYS:-}
+  FLUXER_REPORT_RETENTION_DRY_RUN: ${FLUXER_REPORT_RETENTION_DRY_RUN:-}
+  FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES: ${FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES:-}
+
+  FLUXER_AUTH_BLUESKY_ENABLED: ${FLUXER_AUTH_BLUESKY_ENABLED:-}
+  FLUXER_AUTH_BLUESKY_CLIENT_NAME: ${FLUXER_AUTH_BLUESKY_CLIENT_NAME:-}
+  FLUXER_AUTH_BLUESKY_CLIENT_URI: ${FLUXER_AUTH_BLUESKY_CLIENT_URI:-}
+  FLUXER_AUTH_BLUESKY_LOGO_URI: ${FLUXER_AUTH_BLUESKY_LOGO_URI:-}
+  FLUXER_AUTH_BLUESKY_TOS_URI: ${FLUXER_AUTH_BLUESKY_TOS_URI:-}
+  FLUXER_AUTH_BLUESKY_POLICY_URI: ${FLUXER_AUTH_BLUESKY_POLICY_URI:-}
+  FLUXER_AUTH_BLUESKY_KEYS: ${FLUXER_AUTH_BLUESKY_KEYS:-}
+
+  FLUXER_PUSH_APNS_ENABLED: ${FLUXER_PUSH_APNS_ENABLED:-}
+  FLUXER_PUSH_APNS_TEAM_ID: ${FLUXER_PUSH_APNS_TEAM_ID:-}
+  FLUXER_PUSH_APNS_KEY_ID: ${FLUXER_PUSH_APNS_KEY_ID:-}
+  FLUXER_PUSH_APNS_PRIVATE_KEY: ${FLUXER_PUSH_APNS_PRIVATE_KEY:-}
+  FLUXER_PUSH_APNS_PRIVATE_KEY_PATH: ${FLUXER_PUSH_APNS_PRIVATE_KEY_PATH:-}
+  FLUXER_PUSH_APNS_APPS: ${FLUXER_PUSH_APNS_APPS:-}

  FLUXER_SUDO_MODE_SECRET: ${FLUXER_SUDO_MODE_SECRET:?set FLUXER_SUDO_MODE_SECRET in .env}
  FLUXER_CONNECTION_INITIATION_SECRET: ${FLUXER_CONNECTION_INITIATION_SECRET:?set FLUXER_CONNECTION_INITIATION_SECRET in .env}
-  FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES: ${FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES:-false}
+  FLUXER_PROFILE_PSEUDONYM_SECRET: ${FLUXER_PROFILE_PSEUDONYM_SECRET:?set FLUXER_PROFILE_PSEUDONYM_SECRET in .env}
+  FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES: ${FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES:-}
  FLUXER_VAPID_PUBLIC_KEY: ${FLUXER_VAPID_PUBLIC_KEY:?set FLUXER_VAPID_PUBLIC_KEY in .env}
  FLUXER_VAPID_PRIVATE_KEY: ${FLUXER_VAPID_PRIVATE_KEY:?set FLUXER_VAPID_PRIVATE_KEY in .env}
  FLUXER_VAPID_EMAIL: ${FLUXER_VAPID_EMAIL:-admin@${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_ID: ${FLUXER_PASSKEY_RP_ID:-${FLUXER_DOMAIN}}
-  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-Fluxer}
+  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-}
  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
@@ -103,34 +193,36 @@ x-fluxer-env: &fluxer-env
  FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ${FLUXER_ADMIN_OAUTH_CLIENT_SECRET:?set FLUXER_ADMIN_OAUTH_CLIENT_SECRET in .env}

  FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
-  FLUXER_INTERNAL_GATEWAY_ENDPOINT: http://gateway:8080
  FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-  FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_MAX_BODY_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_MAX_BODY_BYTES:-}
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_TOKEN_TTL_SECS: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_TOKEN_TTL_SECS:-}
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_KEEP_DIRECT_COUNTRIES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_KEEP_DIRECT_COUNTRIES:-}

 x-fluxer-service: &fluxer-service
-  restart: unless-stopped
+  restart: ${FLUXER_RESTART_POLICY:-unless-stopped}
  networks: [fluxer]

-x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
-  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
-  interval: 10s
-  timeout: 5s
-  retries: 30
-  start_period: 60s
+x-fluxer-app-healthcheck: &fluxer-app-healthcheck
+  interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+  timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+  retries: ${FLUXER_APP_HEALTHCHECK_RETRIES:-30}
+  start_period: ${FLUXER_APP_HEALTHCHECK_START_PERIOD:-90s}
  start_interval: 1s

+x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
+  <<: *fluxer-app-healthcheck
+  start_period: ${FLUXER_SVC_HEALTHCHECK_START_PERIOD:-60s}
+  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+
 services:
  edge:
-    image: caddy:2.11-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_CADDY_IMAGE:-caddy:2.11-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_CADDY_MEMORY_LIMIT:-256mb}
-    restart: unless-stopped
-    networks: [fluxer]
    ports:
      - "${FLUXER_HTTP_PORT:-80}:80"
      - "${FLUXER_HTTPS_PORT:-443}:443"
@@ -138,15 +230,18 @@ services:
    environment:
      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
      FLUXER_EDGE_TRUSTED_PROXIES: ${FLUXER_EDGE_TRUSTED_PROXIES:-private_ranges}
+      FLUXER_EDGE_ENCODE: ${FLUXER_EDGE_ENCODE:-zstd gzip}
+      FLUXER_EDGE_GLOBAL_OPTIONS: ${FLUXER_EDGE_GLOBAL_OPTIONS:-}
+      FLUXER_ADMIN_BASE_PATH: ${FLUXER_ADMIN_BASE_PATH:-/admin}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - edge-data:/data
      - edge-config:/config
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}
    depends_on:
      api: {condition: service_started}
      gateway: {condition: service_healthy}
@@ -155,15 +250,14 @@ services:
      admin: {condition: service_started}

  postgres:
-    image: postgres:16-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_POSTGRES_IMAGE:-postgres:16-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_POSTGRES_MEMORY_LIMIT:-5gb}
        reservations:
          memory: ${FLUXER_POSTGRES_MEMORY_RESERVATION:-3gb}
-    restart: unless-stopped
-    networks: [fluxer]
    command: >
      postgres
      -c max_connections=${FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS:-150}
@@ -172,115 +266,113 @@ services:
      -c work_mem=${FLUXER_POSTGRES_WORK_MEM:-8MB}
      -c maintenance_work_mem=${FLUXER_POSTGRES_MAINTENANCE_WORK_MEM:-256MB}
      -c autovacuum_work_mem=${FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM:-128MB}
-      -c random_page_cost=1.1
-      -c effective_io_concurrency=200
-      -c default_statistics_target=200
-      -c jit=off
-      -c min_wal_size=512MB
-      -c max_wal_size=2GB
-      -c checkpoint_completion_target=0.9
-      -c wal_buffers=16MB
-      -c wal_compression=zstd
-      -c bgwriter_delay=50ms
-      -c bgwriter_lru_maxpages=1000
-      -c autovacuum_vacuum_scale_factor=0.05
-      -c autovacuum_analyze_scale_factor=0.02
-      -c autovacuum_vacuum_cost_limit=2000
-      -c track_io_timing=on
-      -c shared_preload_libraries=pg_stat_statements
+      -c random_page_cost=${FLUXER_POSTGRES_RANDOM_PAGE_COST:-1.1}
+      -c effective_io_concurrency=${FLUXER_POSTGRES_EFFECTIVE_IO_CONCURRENCY:-200}
+      -c default_statistics_target=${FLUXER_POSTGRES_DEFAULT_STATISTICS_TARGET:-200}
+      -c jit=${FLUXER_POSTGRES_JIT:-off}
+      -c min_wal_size=${FLUXER_POSTGRES_MIN_WAL_SIZE:-512MB}
+      -c max_wal_size=${FLUXER_POSTGRES_MAX_WAL_SIZE:-2GB}
+      -c checkpoint_completion_target=${FLUXER_POSTGRES_CHECKPOINT_COMPLETION_TARGET:-0.9}
+      -c wal_buffers=${FLUXER_POSTGRES_WAL_BUFFERS:-16MB}
+      -c wal_compression=${FLUXER_POSTGRES_WAL_COMPRESSION:-zstd}
+      -c bgwriter_delay=${FLUXER_POSTGRES_BGWRITER_DELAY:-50ms}
+      -c bgwriter_lru_maxpages=${FLUXER_POSTGRES_BGWRITER_LRU_MAXPAGES:-1000}
+      -c autovacuum_vacuum_scale_factor=${FLUXER_POSTGRES_AUTOVACUUM_VACUUM_SCALE_FACTOR:-0.05}
+      -c autovacuum_analyze_scale_factor=${FLUXER_POSTGRES_AUTOVACUUM_ANALYZE_SCALE_FACTOR:-0.02}
+      -c autovacuum_vacuum_cost_limit=${FLUXER_POSTGRES_AUTOVACUUM_VACUUM_COST_LIMIT:-2000}
+      -c track_io_timing=${FLUXER_POSTGRES_TRACK_IO_TIMING:-on}
+      -c shared_preload_libraries=${FLUXER_POSTGRES_SHARED_PRELOAD_LIBRARIES:-pg_stat_statements}
    shm_size: ${FLUXER_POSTGRES_SHM_SIZE:-1gb}
    environment:
-      POSTGRES_DB: fluxer
-      POSTGRES_USER: fluxer
+      POSTGRES_DB: ${FLUXER_POSTGRES_DATABASE:-fluxer}
+      POSTGRES_USER: ${FLUXER_POSTGRES_USERNAME:-fluxer}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U fluxer -d fluxer"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  valkey:
-    image: valkey/valkey:9.1-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_VALKEY_IMAGE:-valkey/valkey:9.1-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_VALKEY_MEMORY_LIMIT:-256mb}
-    restart: unless-stopped
-    networks: [fluxer]
-    command: ["valkey-server", "--appendonly", "yes", "--appendfsync", "everysec", "--dir", "/data",
+    command: ["valkey-server", "--appendonly", "yes", "--appendfsync", "${FLUXER_VALKEY_APPENDFSYNC:-everysec}", "--dir", "/data",
              "--maxmemory", "${FLUXER_VALKEY_MAXMEMORY:-192mb}",
              "--maxmemory-policy", "${FLUXER_VALKEY_MAXMEMORY_POLICY:-noeviction}"]
    volumes:
      - valkey-data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  nats:
-    image: nats:2.14-alpine
+    <<: *fluxer-service
+    image: ${FLUXER_NATS_IMAGE:-nats:2.14-alpine}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_NATS_MEMORY_LIMIT:-256mb}
-    restart: unless-stopped
-    networks: [fluxer]
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8222/healthz"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  meilisearch:
-    image: getmeili/meilisearch:v1.53
+    <<: *fluxer-service
+    image: ${FLUXER_MEILISEARCH_IMAGE:-getmeili/meilisearch:v1.53}
    deploy:
      resources:
        limits:
-          memory: ${FLUXER_MEILISEARCH_MEMORY_LIMIT:-768mb}
-    restart: unless-stopped
-    networks: [fluxer]
+          memory: ${FLUXER_MEILISEARCH_MEMORY_LIMIT:-1536mb}
    environment:
-      MEILI_ENV: production
-      MEILI_NO_ANALYTICS: "true"
+      MEILI_ENV: ${FLUXER_MEILISEARCH_ENV:-production}
+      MEILI_NO_ANALYTICS: "${FLUXER_MEILISEARCH_NO_ANALYTICS:-true}"
      MEILI_UPGRADE_DB: "true"
-      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-384mb}
+      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-256mb}
+      MEILI_MAX_INDEXING_THREADS: ${FLUXER_MEILISEARCH_MAX_INDEXING_THREADS:-2}
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
      - meilisearch-data:/meili_data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7700/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  seaweedfs:
-    image: chrislusf/seaweedfs:4.47
+    <<: *fluxer-service
+    image: ${FLUXER_SEAWEEDFS_IMAGE:-chrislusf/seaweedfs:4.47}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_SEAWEEDFS_MEMORY_LIMIT:-2gb}
-    restart: unless-stopped
-    networks: [fluxer]
    environment:
      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
-    command: ["server", "-s3", "-dir=/data", "-master.telemetry=false"]
+      WEED_MASTER_VOLUME_GROWTH_COPY_1: ${FLUXER_SEAWEEDFS_VOLUME_GROWTH:-1}
+    command: ["server", "-s3", "-dir=/data", "-master.telemetry=${FLUXER_SEAWEEDFS_TELEMETRY:-false}"]
    volumes:
      - seaweedfs-data:/data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8333/healthz"]
-      interval: 10s
-      timeout: 5s
-      retries: 20
-      start_period: 60s
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_SEAWEEDFS_HEALTHCHECK_RETRIES:-20}
+      start_period: ${FLUXER_SEAWEEDFS_HEALTHCHECK_START_PERIOD:-60s}

  seaweedfs-init:
-    image: chrislusf/seaweedfs:4.47
+    image: ${FLUXER_SEAWEEDFS_IMAGE:-chrislusf/seaweedfs:4.47}
    deploy:
      resources:
        limits:
@@ -296,13 +388,14 @@ services:
      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
      FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
      FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
+      FLUXER_SEAWEEDFS_INIT_ATTEMPTS: ${FLUXER_SEAWEEDFS_INIT_ATTEMPTS:-60}
    entrypoint:
      - /bin/sh
      - -c
      - >
        buckets="$$FLUXER_S3_BUCKET_CDN $$FLUXER_S3_BUCKET_UPLOADS $$FLUXER_S3_BUCKET_REPORTS $$FLUXER_S3_BUCKET_HARVESTS";
        missing="$$buckets";
-        for attempt in $$(seq 1 60); do
+        for attempt in $$(seq 1 $$FLUXER_SEAWEEDFS_INIT_ATTEMPTS); do
          if ! nc -z seaweedfs 9333 2>/dev/null; then
            sleep 2;
            continue;
@@ -329,18 +422,17 @@ services:
        exit 1;

  livekit:
-    image: livekit/livekit-server:v1.12.0
+    <<: *fluxer-service
+    image: ${FLUXER_LIVEKIT_IMAGE:-livekit/livekit-server:v1.12.0}
    deploy:
      resources:
        limits:
          memory: ${FLUXER_LIVEKIT_MEMORY_LIMIT:-512mb}
-    restart: unless-stopped
-    networks: [fluxer]
    environment:
      LIVEKIT_KEYS: "${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}"
      LIVEKIT_CONFIG: |
        port: 7880
-        log_level: info
+        log_level: ${FLUXER_LIVEKIT_LOG_LEVEL:-info}
        rtc:
          tcp_port: ${FLUXER_LIVEKIT_TCP_PORT:-7881}
          udp_port: ${FLUXER_LIVEKIT_UDP_PORT:-7882}
@@ -358,9 +450,9 @@ services:
      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:${FLUXER_LIVEKIT_UDP_PORT:-7882}/udp"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7880/"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  api:
    <<: *fluxer-service
@@ -374,16 +466,14 @@ services:
    environment:
      <<: *fluxer-env
      FLUXER_API_PORT: "8080"
-      NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}
-      FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED: "true"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
+      FLUXER_SETUP_TOKEN: ${FLUXER_SETUP_TOKEN:-}
+      NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}${FLUXER_API_NODE_OPTIONS:+ $FLUXER_API_NODE_OPTIONS}
+      NODE_EXTRA_CA_CERTS: ${FLUXER_NODE_EXTRA_CA_CERTS:-/etc/ssl/certs/ca-certificates.crt}
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_API_POSTGRES_MAX_CONNECTIONS:-25}"
+      FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED: "${FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED:-true}"
    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:8080/_health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 90s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
@@ -408,21 +498,18 @@ services:
          memory: ${FLUXER_WORKER_MEMORY_LIMIT:-2560mb}
        reservations:
          memory: ${FLUXER_WORKER_MEMORY_RESERVATION:-1gb}
-    working_dir: /usr/src/app/fluxer_api
-    command: ["sh", "-c", "if [ -f dist/WorkerEntrypoint.js ]; then exec node dist/WorkerEntrypoint.js; else exec ./node_modules/.bin/tsx src/WorkerEntrypoint.ts; fi"]
+    command: ["node", "dist/WorkerEntrypoint.js"]
    environment:
      <<: *fluxer-env
-      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}
+      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}${FLUXER_WORKER_NODE_OPTIONS:+ $FLUXER_WORKER_NODE_OPTIONS}
+      NODE_EXTRA_CA_CERTS: ${FLUXER_NODE_EXTRA_CA_CERTS:-/etc/ssl/certs/ca-certificates.crt}
      FLUXER_API_WORKER_MODE: all_lanes
      FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER: "true"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_WORKER_POSTGRES_MAX_CONNECTIONS:-25}"
    healthcheck:
      test: ["CMD", "node", "-e", "const age=Date.now()-require('node:fs').statSync('/tmp/fluxer-worker-heartbeat').mtimeMs;if(age>30000){console.error('worker heartbeat is '+Math.round(age)+'ms old');process.exit(1)}"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 90s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
+      retries: ${FLUXER_WORKER_HEALTHCHECK_RETRIES:-3}
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
@@ -444,18 +531,30 @@ services:
    environment:
      <<: *fluxer-env
      FLUXER_GATEWAY_PORT: "8080"
-      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-      FLUXER_GATEWAY_LOGGER_LEVEL: info
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT:-${FLUXER_MEDIA_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media}}
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_GATEWAY_STATIC_CDN_ENDPOINT:-${FLUXER_STATIC_CDN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}}
+      FLUXER_GATEWAY_LOGGER_LEVEL: ${FLUXER_GATEWAY_LOGGER_LEVEL:-}
+      LOGGER_LEVEL: ${LOGGER_LEVEL:-}
+      FLUXER_GATEWAY_PUSH_ENABLED: ${FLUXER_GATEWAY_PUSH_ENABLED:-}
+      FLUXER_GATEWAY_PUSH_ENROLLED_CLEAR_NOTIFICATIONS_ENABLED: ${FLUXER_GATEWAY_PUSH_ENROLLED_CLEAR_NOTIFICATIONS_ENABLED:-}
+      FLUXER_GATEWAY_PUSH_OUTBOX_REQUEST_TIMEOUT_MS: ${FLUXER_GATEWAY_PUSH_OUTBOX_REQUEST_TIMEOUT_MS:-}
+      FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES: ${FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES:-}
+      FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES: ${FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES:-}
+      FLUXER_GATEWAY_HTTP_RPC_MAX_CONCURRENCY: ${FLUXER_GATEWAY_HTTP_RPC_MAX_CONCURRENCY:-}
+      FLUXER_GATEWAY_NATS_RPC_MAX_HANDLERS: ${FLUXER_GATEWAY_NATS_RPC_MAX_HANDLERS:-}
+      FLUXER_GATEWAY_HTTP_FAILURE_THRESHOLD: ${FLUXER_GATEWAY_HTTP_FAILURE_THRESHOLD:-}
+      FLUXER_GATEWAY_HTTP_RECOVERY_TIMEOUT_MS: ${FLUXER_GATEWAY_HTTP_RECOVERY_TIMEOUT_MS:-}
      FLUXER_ERLANG_COOKIE: ${FLUXER_ERLANG_COOKIE:?set FLUXER_ERLANG_COOKIE in .env}
-      FLUXER_ERLANG_SCHEDULERS_MIN: "${FLUXER_ERLANG_SCHEDULERS_MIN:-2}"
-      FLUXER_ERLANG_SCHEDULERS_MAX: "${FLUXER_ERLANG_SCHEDULERS_MAX:-16}"
+      FLUXER_ERLANG_SCHEDULERS: ${FLUXER_ERLANG_SCHEDULERS:-}
+      FLUXER_ERLANG_SCHEDULERS_MIN: ${FLUXER_ERLANG_SCHEDULERS_MIN:-}
+      FLUXER_ERLANG_SCHEDULERS_MAX: ${FLUXER_ERLANG_SCHEDULERS_MAX:-}
+      FLUXER_ERLANG_DIRTY_CPU_SCHEDULERS: ${FLUXER_ERLANG_DIRTY_CPU_SCHEDULERS:-}
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/_health/ready"]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 90s
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_APP_HEALTHCHECK_RETRIES:-30}
+      start_period: ${FLUXER_APP_HEALTHCHECK_START_PERIOD:-90s}
    depends_on:
      nats: {condition: service_healthy}
      valkey: {condition: service_healthy}
@@ -469,15 +568,36 @@ services:
          memory: ${FLUXER_MEDIA_PROXY_MEMORY_LIMIT:-512mb}
    environment:
      <<: *fluxer-env
-      FLUXER_MEDIA_PROXY_HOST: 0.0.0.0
      FLUXER_MEDIA_PROXY_PORT: "8080"
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-off}
+      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-}
      FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS: ${FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}}
-      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-off}
-      FLUXER_S3_READ_SIGNED: "true"
+      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-}
+      FLUXER_MEDIA_PROXY_READ_ONLY: ${FLUXER_MEDIA_PROXY_READ_ONLY:-}
+      FLUXER_MEDIA_PROXY_NSFW_THRESHOLD: ${FLUXER_MEDIA_PROXY_NSFW_THRESHOLD:-}
+      FLUXER_NSFW_SERVICE_ENDPOINT: ${FLUXER_NSFW_SERVICE_ENDPOINT:-}
+      FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS: ${FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS:-}
+      FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY: ${FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY:-}
+      FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS: ${FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS:-}
+      FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES: ${FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS: ${FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES: ${FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES: ${FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES:-}
+      FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS: ${FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS:-}
+      FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS: ${FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS:-}
+      FLUXER_MEDIA_PROXY_SHUTDOWN_GRACE_MS: ${FLUXER_MEDIA_PROXY_SHUTDOWN_GRACE_MS:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_DIR: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_DIR:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_CHUNK_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_CHUNK_BYTES:-}
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_MAX_TOTAL_BYTES: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SPOOL_MAX_TOTAL_BYTES:-}
+      FLUXER_S3_SESSION_TOKEN: ${FLUXER_S3_SESSION_TOKEN:-}
+      FLUXER_S3_READ_ENDPOINT: ${FLUXER_S3_READ_ENDPOINT:-}
+      FLUXER_S3_READ_BUCKET: ${FLUXER_S3_READ_BUCKET:-}
+      FLUXER_S3_READ_BUCKET_STYLE: ${FLUXER_S3_READ_BUCKET_STYLE:-}
+      FLUXER_S3_READ_SIGNED: "${FLUXER_S3_READ_SIGNED:-true}"
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
      nats: {condition: service_healthy}
@@ -491,17 +611,27 @@ services:
          memory: ${FLUXER_PUSH_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
-      FLUXER_PUSH_SERVICE_HOST: 0.0.0.0
-      FLUXER_PUSH_SERVICE_PORT: "8126"
-      FLUXER_PUSH_SERVICE_QUEUE_CAPACITY: "${FLUXER_PUSH_SERVICE_QUEUE_CAPACITY:-}"
-      FLUXER_PUSH_SERVICE_SEND_CONCURRENCY: "${FLUXER_PUSH_SERVICE_SEND_CONCURRENCY:-}"
+      FLUXER_PUSH_SERVICE_QUEUE_CAPACITY: ${FLUXER_PUSH_SERVICE_QUEUE_CAPACITY:-}
+      FLUXER_PUSH_SERVICE_SEND_CONCURRENCY: ${FLUXER_PUSH_SERVICE_SEND_CONCURRENCY:-}
+      FLUXER_PUSH_SERVICE_APNS_BASE_URL: ${FLUXER_PUSH_SERVICE_APNS_BASE_URL:-}
+      FLUXER_PUSH_SERVICE_FCM_BASE_URL: ${FLUXER_PUSH_SERVICE_FCM_BASE_URL:-}
+      FLUXER_PUSH_SERVICE_MANAGED_RELAY_HOSTS: ${FLUXER_PUSH_SERVICE_MANAGED_RELAY_HOSTS:-}
+      FLUXER_PUSH_SERVICE_OWN_RELAY_HOSTS: ${FLUXER_PUSH_SERVICE_OWN_RELAY_HOSTS:-}
+      FLUXER_PUSH_SERVICE_PRIVATE_HOSTS: ${FLUXER_PUSH_SERVICE_PRIVATE_HOSTS:-}
+      FLUXER_PUSH_SERVICE_RELAY_CONSENT_ACCEPTED: ${FLUXER_PUSH_SERVICE_RELAY_CONSENT_ACCEPTED:-}
+      FLUXER_PUSH_APNS_DEFAULT_ENVIRONMENT: ${FLUXER_PUSH_APNS_DEFAULT_ENVIRONMENT:-}
+      FLUXER_PUSH_FCM_ENABLED: ${FLUXER_PUSH_FCM_ENABLED:-}
+      FLUXER_PUSH_FCM_PROJECT_ID: ${FLUXER_PUSH_FCM_PROJECT_ID:-}
+      FLUXER_PUSH_FCM_CLIENT_EMAIL: ${FLUXER_PUSH_FCM_CLIENT_EMAIL:-}
+      FLUXER_PUSH_FCM_PRIVATE_KEY: ${FLUXER_PUSH_FCM_PRIVATE_KEY:-}
+      FLUXER_PUSH_FCM_PRIVATE_KEY_PATH: ${FLUXER_PUSH_FCM_PRIVATE_KEY_PATH:-}
+      FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH: ${FLUXER_PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH:-}
+      FLUXER_PUSH_FCM_TOKEN_URI: ${FLUXER_PUSH_FCM_TOKEN_URI:-}
+      FLUXER_PUSH_FCM_APPS: ${FLUXER_PUSH_FCM_APPS:-}
    healthcheck:
      test: ["CMD", "/usr/local/bin/fluxer-push", "healthcheck"]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 60s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
+      start_period: ${FLUXER_SVC_HEALTHCHECK_START_PERIOD:-60s}
    depends_on:
      nats: {condition: service_healthy}
      api: {condition: service_healthy}
@@ -515,9 +645,9 @@ services:
          memory: ${FLUXER_STATIC_PROXY_MEMORY_LIMIT:-256mb}
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/avatars/0.png"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      interval: ${FLUXER_HEALTHCHECK_INTERVAL:-10s}
+      timeout: ${FLUXER_HEALTHCHECK_TIMEOUT:-5s}
+      retries: ${FLUXER_HEALTHCHECK_RETRIES:-10}

  app-proxy:
    <<: *fluxer-service
@@ -527,15 +657,24 @@ services:
        limits:
          memory: ${FLUXER_APP_PROXY_MEMORY_LIMIT:-256mb}
    environment:
-      FLUXER_APP_PROXY_HOST: 0.0.0.0
+      RUST_LOG: ${RUST_LOG:-}
      FLUXER_APP_PROXY_PORT: "8080"
-      FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
-      FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
-      FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
-      FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+      FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-}
+      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-}
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-}
+      FLUXER_MEDIA_ENDPOINT: ${FLUXER_MEDIA_ENDPOINT:-}
+      FLUXER_APP_PRODUCT_NAME: ${FLUXER_APP_PRODUCT_NAME:-}
+      FLUXER_APP_ICON_URL: ${FLUXER_APP_ICON_URL:-}
+      FLUXER_APP_SYMBOL_URL: ${FLUXER_APP_SYMBOL_URL:-}
+      FLUXER_APP_LOGO_URL: ${FLUXER_APP_LOGO_URL:-}
+      FLUXER_APP_WORDMARK_URL: ${FLUXER_APP_WORDMARK_URL:-}
+      FLUXER_APP_FAVICON_URL: ${FLUXER_APP_FAVICON_URL:-}
+      FLUXER_APP_THEME_COLOR: ${FLUXER_APP_THEME_COLOR:-}
      DISCOVERY_UPSTREAM_URL: http://edge:8088/.well-known/fluxer
-      PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
-      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
+      DISCOVERY_REFRESH_INTERVAL_MS: ${DISCOVERY_REFRESH_INTERVAL_MS:-}
+      FLUXER_APP_PROXY_INDEX_UPSTREAM_URL: ${FLUXER_APP_PROXY_INDEX_UPSTREAM_URL:-}
+      FLUXER_APP_PROXY_SAME_ORIGIN_HOSTS: ${FLUXER_APP_PROXY_SAME_ORIGIN_HOSTS:-}
+      FLUXER_APP_PROXY_MANIFEST_SCOPE_EXTENSIONS: ${FLUXER_APP_PROXY_MANIFEST_SCOPE_EXTENSIONS:-}
      FLUXER_CSP_EXTRA_DEFAULT_SRC: ${FLUXER_CSP_EXTRA_DEFAULT_SRC:-}
      FLUXER_CSP_EXTRA_CONNECT_SRC: ${FLUXER_CSP_EXTRA_CONNECT_SRC:-}
      FLUXER_CSP_EXTRA_IMG_SRC: ${FLUXER_CSP_EXTRA_IMG_SRC:-}
@@ -593,7 +732,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: router
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -610,8 +748,7 @@ services:
      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_USERS_SHARD_POSTGRES_MAX_CONNECTIONS:-20}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -628,7 +765,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -645,7 +781,7 @@ services:
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_GIFS_SHARD_CACHE_MAX_BYTES: ${FLUXER_GIFS_SHARD_CACHE_MAX_BYTES:-}
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -661,7 +797,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: router
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -678,8 +813,7 @@ services:
      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_MESSAGES_SHARD_POSTGRES_MAX_CONNECTIONS:-20}"
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -696,8 +830,6 @@ services:
      <<: *fluxer-env
      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -714,8 +846,7 @@ services:
      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
    healthcheck: *fluxer-svc-healthcheck
    depends_on:
      nats: {condition: service_healthy}
@@ -729,22 +860,14 @@ services:
          memory: ${FLUXER_ADMIN_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
-      FLUXER_ADMIN_HOST: 0.0.0.0
      FLUXER_ADMIN_PORT: "8080"
-      FLUXER_ADMIN_BASE_PATH: /admin
+      FLUXER_ADMIN_BASE_PATH: ${FLUXER_ADMIN_BASE_PATH:-/admin}
      FLUXER_API_ENDPOINT: http://api:8080
-      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin
-      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
-      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin/oauth2_callback
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_STATIC_CDN_ENDPOINT:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
    healthcheck:
      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
-      interval: 10s
-      timeout: 5s
-      retries: 30
-      start_period: 60s
-      start_interval: 1s
+      <<: *fluxer-app-healthcheck
+      start_period: ${FLUXER_SVC_HEALTHCHECK_START_PERIOD:-60s}
    depends_on:
      api: {condition: service_healthy}

@@ -0,0 +1,14 @@
+services:
+  seaweedfs:
+    profiles: [bundled-object-store]
+  seaweedfs-init:
+    profiles: [bundled-object-store]
+  api:
+    depends_on:
+      seaweedfs-init: !reset null
+  worker:
+    depends_on:
+      seaweedfs-init: !reset null
+  media-proxy:
+    depends_on:
+      seaweedfs-init: !reset null
@@ -11,7 +11,6 @@ anyhow = "1.0.104"
 axum = { version = "0.8.9", features = ["macros"] }
 base64 = "0.23.1"
 chrono = { version = "0.4", default-features = false, features = ["serde"] }
-cookie = "0.18.2"
 fluxer_common = { path = "../fluxer_common" }
 hmac = "0.13.0"
 maud = { version = "0.27.0", features = ["axum"] }
@@ -26,7 +25,7 @@ tokio = { version = "1.53.1", features = ["macros", "net", "rt-multi-thread", "s
 tower = { version = "0.5.3", features = ["util"] }
 tower-http = { version = "0.7.1", features = ["compression-gzip", "trace"] }
 tracing = "0.1.44"
-tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
+tracing-subscriber = "0.3.23"
 url = "2.5"
 urlencoding = "2.1.3"
 progenitor-client = { version = "0.15.0", default-features = false }
@@ -2,7 +2,6 @@

 FROM rust:1-trixie AS builder

-ARG BUILD_VERSION=""
 ARG TARGETARCH

 WORKDIR /usr/src/app
@@ -45,8 +44,6 @@ RUN printf '%s\n' \
 	'strip = "symbols"' \
 	> Cargo.toml

-ENV FLUXER_BUILD_VERSION="${BUILD_VERSION}"
-
 RUN cargo build --release -p fluxer_admin \
 	&& cp target/release/fluxer_admin /usr/local/bin/fluxer-admin

@@ -40,6 +40,7 @@ fn generate_admin_api(manifest_dir: &Path, out_dir: &Path) {
    adapt_progenitor_throttled_errors(&mut spec);
    relax_guild_audit_log_schemas(&mut spec);
    relax_progenitor_schema_strictness(&mut spec);
+    relax_integer_enums(&mut spec);

    let mut settings = progenitor::GenerationSettings::new();
    settings.with_interface(progenitor::InterfaceStyle::Positional);
@@ -174,6 +175,29 @@ fn relax_guild_audit_log_schemas(spec: &mut openapiv3::OpenAPI) {
    }
 }

+const OPEN_INTEGER_ENUMS: &[&str] = &[
+    "ChannelType",
+    "MessageType",
+    "ReportStatus",
+    "ReportType",
+    "WebhookType",
+];
+
+fn relax_integer_enums(spec: &mut openapiv3::OpenAPI) {
+    let components = spec.components.as_mut().expect("missing API components");
+    for name in OPEN_INTEGER_ENUMS {
+        let Some(openapiv3::ReferenceOr::Item(schema)) = components.schemas.get_mut(*name) else {
+            panic!("missing inline {name} schema");
+        };
+        let openapiv3::SchemaKind::Type(openapiv3::Type::Integer(integer)) =
+            &mut schema.schema_kind
+        else {
+            panic!("{name} must be an integer schema");
+        };
+        integer.enumeration.clear();
+    }
+}
+
 fn object_schema_mut<'a>(
    components: &'a mut openapiv3::Components,
    name: &str,
@@ -582,7 +606,7 @@ fn select_faces(package_dir: &Path) -> Vec<Face> {
            }
            assert!(
                face["unicodeRange"].is_null(),
-                "{wanted} face {} carries a unicode-range; Latin-core faces must not",
+                "{wanted} face {} has a unicode-range; Latin-core faces must not",
                face["file"]
            );
            faces.push(Face {
@@ -17,9 +17,6 @@ pub const JOBS_CANCEL: &str = "jobs:cancel";
 pub const BAN_EMAIL_ADD: &str = "ban:email:add";
 pub const BAN_EMAIL_CHECK: &str = "ban:email:check";
 pub const BAN_EMAIL_REMOVE: &str = "ban:email:remove";
-pub const SUSPICIOUS_EMAIL_DOMAIN_ADD: &str = "suspicious_email_domain:add";
-pub const SUSPICIOUS_EMAIL_DOMAIN_CHECK: &str = "suspicious_email_domain:check";
-pub const SUSPICIOUS_EMAIL_DOMAIN_REMOVE: &str = "suspicious_email_domain:remove";
 pub const BAN_PHRASE_ADD: &str = "ban:phrase:add";
 pub const BAN_PHRASE_CHECK: &str = "ban:phrase:check";
 pub const BAN_PHRASE_REMOVE: &str = "ban:phrase:remove";
@@ -45,9 +42,7 @@ pub const BULK_ADD_GUILD_MEMBERS: &str = "bulk:add:guild_members";
 pub const BULK_DELETE_USERS: &str = "bulk:delete:users";
 pub const BULK_DELETE_USER_MESSAGES: &str = "bulk:delete:user_messages";
 pub const BULK_UPDATE_GUILD_FEATURES: &str = "bulk:update:guild_features";
-pub const BULK_UPDATE_SUSPICIOUS_ACTIVITY: &str = "bulk:update:suspicious_activity";
 pub const BULK_UPDATE_USER_FLAGS: &str = "bulk:update:user_flags";
-pub const CSAM_SUBMIT_NCMEC: &str = "csam:submit_ncmec";
 pub const DISCOVERY_REMOVE: &str = "discovery:remove";
 pub const DISCOVERY_REVIEW: &str = "discovery:review";
 pub const GATEWAY_MEMORY_STATS: &str = "gateway:memory_stats";
@@ -75,13 +70,15 @@ pub const MESSAGE_DELETE_ALL: &str = "message:delete_all";
 pub const MESSAGE_DELETE: &str = "message:delete";
 pub const MESSAGE_LOOKUP: &str = "message:lookup";
 pub const MESSAGE_SHRED: &str = "message:shred";
+pub const REPORT_DELETE: &str = "report:delete";
 pub const REPORT_RESOLVE: &str = "report:resolve";
 pub const REPORT_VIEW: &str = "report:view";
 pub const REPORT_VIEW_REPORTER_PII: &str = "report:view:reporter_pii";
 pub const SYSTEM_DM_SEND: &str = "system_dm:send";
 pub const USER_CANCEL_BULK_MESSAGE_DELETION: &str = "user:cancel:bulk_message_deletion";
+pub const USER_CREATE_PASSWORD_RESET_LINK: &str = "user:create:password_reset_link";
+pub const USER_DELETE_RECOVERY_KIT: &str = "user:delete:recovery_kit";
 pub const USER_DELETE: &str = "user:delete";
-pub const USER_DISABLE_SUSPICIOUS: &str = "user:disable:suspicious";
 pub const USER_LIST_DM_CHANNELS: &str = "user:list:dm_channels";
 pub const USER_LIST_GUILDS: &str = "user:list:guilds";
 pub const USER_LIST_RELATIONSHIPS: &str = "user:list:relationships";
@@ -98,9 +95,7 @@ pub const USER_UPDATE_DOB: &str = "user:update:dob";
 pub const USER_UPDATE_EMAIL: &str = "user:update:email";
 pub const USER_UPDATE_FLAGS: &str = "user:update:flags";
 pub const USER_UPDATE_MFA: &str = "user:update:mfa";
-pub const USER_UPDATE_PHONE: &str = "user:update:phone";
 pub const USER_UPDATE_PROFILE: &str = "user:update:profile";
-pub const USER_UPDATE_SUSPICIOUS_ACTIVITY: &str = "user:update:suspicious_activity";
 pub const USER_UPDATE_TRAITS: &str = "user:update:traits";
 pub const USER_UPDATE_USERNAME: &str = "user:update:username";
 pub const VOICE_REGION_CREATE: &str = "voice:region:create";
@@ -129,9 +124,6 @@ pub const ALL_ACLS: &[&str] = &[
    BAN_EMAIL_ADD,
    BAN_EMAIL_CHECK,
    BAN_EMAIL_REMOVE,
-    SUSPICIOUS_EMAIL_DOMAIN_ADD,
-    SUSPICIOUS_EMAIL_DOMAIN_CHECK,
-    SUSPICIOUS_EMAIL_DOMAIN_REMOVE,
    BAN_PHRASE_ADD,
    BAN_PHRASE_CHECK,
    BAN_PHRASE_REMOVE,
@@ -157,9 +149,7 @@ pub const ALL_ACLS: &[&str] = &[
    BULK_DELETE_USERS,
    BULK_DELETE_USER_MESSAGES,
    BULK_UPDATE_GUILD_FEATURES,
-    BULK_UPDATE_SUSPICIOUS_ACTIVITY,
    BULK_UPDATE_USER_FLAGS,
-    CSAM_SUBMIT_NCMEC,
    DISCOVERY_REMOVE,
    DISCOVERY_REVIEW,
    GATEWAY_MEMORY_STATS,
@@ -187,13 +177,15 @@ pub const ALL_ACLS: &[&str] = &[
    MESSAGE_DELETE,
    MESSAGE_LOOKUP,
    MESSAGE_SHRED,
+    REPORT_DELETE,
    REPORT_RESOLVE,
    REPORT_VIEW,
    REPORT_VIEW_REPORTER_PII,
    SYSTEM_DM_SEND,
    USER_CANCEL_BULK_MESSAGE_DELETION,
+    USER_CREATE_PASSWORD_RESET_LINK,
+    USER_DELETE_RECOVERY_KIT,
    USER_DELETE,
-    USER_DISABLE_SUSPICIOUS,
    USER_LIST_DM_CHANNELS,
    USER_LIST_GUILDS,
    USER_LIST_RELATIONSHIPS,
@@ -210,9 +202,7 @@ pub const ALL_ACLS: &[&str] = &[
    USER_UPDATE_EMAIL,
    USER_UPDATE_FLAGS,
    USER_UPDATE_MFA,
-    USER_UPDATE_PHONE,
    USER_UPDATE_PROFILE,
-    USER_UPDATE_SUSPICIOUS_ACTIVITY,
    USER_UPDATE_TRAITS,
    USER_UPDATE_USERNAME,
    VOICE_REGION_CREATE,
@@ -17,21 +17,21 @@ pub mod user_flag_bits {
    pub const FRIENDLY_BOT: u64 = 1 << 4;
    pub const FRIENDLY_BOT_MANUAL_APPROVAL: u64 = 1 << 5;
    pub const SPAMMER: u64 = 1 << 6;
+    pub const PROFILE_HIDDEN: u64 = 1 << 7;
    pub const HIGH_GLOBAL_RATE_LIMIT: u64 = 1 << 33;
    pub const DELETED: u64 = 1 << 34;
-    pub const DISABLED_SUSPICIOUS_ACTIVITY: u64 = 1 << 35;
    pub const SELF_DELETED: u64 = 1 << 36;
    pub const DISABLED: u64 = 1 << 38;
    pub const HAS_SESSION_STARTED: u64 = 1 << 39;
    pub const RATE_LIMIT_BYPASS: u64 = 1 << 47;
    pub const REPORT_BANNED: u64 = 1 << 48;
    pub const VERIFIED_NOT_UNDERAGE: u64 = 1 << 49;
+    pub const ACCOUNT_LIMITED: u64 = 1 << 50;
    pub const HAS_DISMISSED_PREMIUM_ONBOARDING: u64 = 1 << 51;
    pub const APP_STORE_REVIEWER: u64 = 1 << 53;
    pub const STAFF_HIDDEN: u64 = 1 << 57;
    pub const AGE_VERIFIED_ADULT: u64 = 1 << 60;
-    pub const FORCE_INBOUND_PHONE_VERIFICATION: u64 = 1 << 61;
-    pub const NOT_SUSPICIOUS: u64 = 1 << 62;
+    pub const LIMIT_EXEMPT: u64 = 1 << 62;
 }

 pub const USER_FLAGS: &[U64Flag] = &[
@@ -59,6 +59,10 @@ pub const USER_FLAGS: &[U64Flag] = &[
        name: "SPAMMER",
        value: user_flag_bits::SPAMMER,
    },
+    U64Flag {
+        name: "PROFILE_HIDDEN",
+        value: user_flag_bits::PROFILE_HIDDEN,
+    },
    U64Flag {
        name: "HIGH_GLOBAL_RATE_LIMIT",
        value: user_flag_bits::HIGH_GLOBAL_RATE_LIMIT,
@@ -67,10 +71,6 @@ pub const USER_FLAGS: &[U64Flag] = &[
        name: "DELETED",
        value: user_flag_bits::DELETED,
    },
-    U64Flag {
-        name: "DISABLED_SUSPICIOUS_ACTIVITY",
-        value: user_flag_bits::DISABLED_SUSPICIOUS_ACTIVITY,
-    },
    U64Flag {
        name: "SELF_DELETED",
        value: user_flag_bits::SELF_DELETED,
@@ -95,6 +95,10 @@ pub const USER_FLAGS: &[U64Flag] = &[
        name: "VERIFIED_NOT_UNDERAGE",
        value: user_flag_bits::VERIFIED_NOT_UNDERAGE,
    },
+    U64Flag {
+        name: "ACCOUNT_LIMITED",
+        value: user_flag_bits::ACCOUNT_LIMITED,
+    },
    U64Flag {
        name: "HAS_DISMISSED_PREMIUM_ONBOARDING",
        value: user_flag_bits::HAS_DISMISSED_PREMIUM_ONBOARDING,
@@ -112,12 +116,8 @@ pub const USER_FLAGS: &[U64Flag] = &[
        value: user_flag_bits::AGE_VERIFIED_ADULT,
    },
    U64Flag {
-        name: "FORCE_INBOUND_PHONE_VERIFICATION",
-        value: user_flag_bits::FORCE_INBOUND_PHONE_VERIFICATION,
-    },
-    U64Flag {
-        name: "NOT_SUSPICIOUS",
-        value: user_flag_bits::NOT_SUSPICIOUS,
+        name: "LIMIT_EXEMPT",
+        value: user_flag_bits::LIMIT_EXEMPT,
    },
 ];

@@ -160,41 +160,95 @@ pub const PREMIUM_FLAGS: &[I32Flag] = &[
    },
 ];

-pub const SUSPICIOUS_ACTIVITY_FLAGS: &[I32Flag] = &[
-    I32Flag {
-        name: "REQUIRE_VERIFIED_EMAIL",
-        value: 1 << 0,
-    },
-    I32Flag {
-        name: "REQUIRE_REVERIFIED_EMAIL",
-        value: 1 << 1,
-    },
-    I32Flag {
-        name: "REQUIRE_VERIFIED_PHONE",
-        value: 1 << 2,
-    },
-    I32Flag {
-        name: "REQUIRE_REVERIFIED_PHONE",
-        value: 1 << 3,
-    },
-    I32Flag {
-        name: "REQUIRE_VERIFIED_EMAIL_OR_VERIFIED_PHONE",
-        value: 1 << 4,
-    },
-    I32Flag {
-        name: "REQUIRE_REVERIFIED_EMAIL_OR_VERIFIED_PHONE",
-        value: 1 << 5,
-    },
-    I32Flag {
-        name: "REQUIRE_VERIFIED_EMAIL_OR_REVERIFIED_PHONE",
-        value: 1 << 6,
-    },
-    I32Flag {
-        name: "REQUIRE_REVERIFIED_EMAIL_OR_REVERIFIED_PHONE",
-        value: 1 << 7,
-    },
-    I32Flag {
-        name: "REQUIRE_INBOUND_PHONE_VERIFICATION",
-        value: 1 << 8,
-    },
+pub const DELETION_REASONS: &[(&str, &str)] = &[
+    ("1", "User requested"),
+    ("2", "Other"),
+    ("3", "Spam"),
+    ("4", "Cheating or exploitation"),
+    ("5", "Coordinated raiding or manipulation"),
+    ("6", "Automation or self-bot usage"),
+    ("7", "Nonconsensual sexual content"),
+    ("8", "Scam or social engineering"),
+    ("9", "Child sexual content"),
+    ("10", "Privacy violation or doxxing"),
+    ("11", "Harassment or bullying"),
+    ("12", "Payment fraud"),
+    ("13", "Child safety violation"),
+    ("14", "Billing dispute or abuse"),
+    ("15", "Unsolicited explicit content"),
+    ("16", "Graphic violence"),
+    ("17", "Ban evasion"),
+    ("18", "Token or credential scam"),
+    ("19", "Inactivity"),
+    ("20", "Hate speech or extremist content"),
+    ("21", "Malicious links or malware distribution"),
+    ("22", "Impersonation or fake identity"),
 ];
+
+pub const GUILD_FEATURES: &[&str] = &[
+    "ANIMATED_ICON",
+    "ANIMATED_BANNER",
+    "AUDIO_BITRATE_128_KBPS",
+    "AUDIO_BITRATE_256_KBPS",
+    "AUDIO_BITRATE_384_KBPS",
+    "BANNER",
+    "CLONE_EMOJI_DISABLED",
+    "CLONE_EMOJI_ENABLED",
+    "CLONE_STICKER_DISABLED",
+    "CLONE_STICKER_ENABLED",
+    "DETACHED_BANNER",
+    "INVITE_SPLASH",
+    "INVITES_DISABLED",
+    "RAID_DETECTED",
+    "TEXT_CHANNEL_FLEXIBLE_NAMES",
+    "HIDE_OWNER_CROWN",
+    "MORE_EMOJI",
+    "MORE_STICKERS",
+    "UNLIMITED_EMOJI",
+    "UNLIMITED_STICKERS",
+    "EXPRESSION_PURGE_ALLOWED",
+    "VANITY_URL",
+    "DISCOVERABLE",
+    "PARTNERED",
+    "VERIFIED",
+    "VIP_VOICE",
+    "VOICE_E2EE",
+    "UNAVAILABLE_FOR_EVERYONE",
+    "UNAVAILABLE_FOR_EVERYONE_BUT_STAFF",
+    "UNAVAILABLE_HIDDEN",
+    "VISIONARY",
+    "LARGE_GUILD_OVERRIDE",
+    "VERY_LARGE_GUILD",
+    "ANNOUNCEMENT_CHANNELS_DISABLED",
+];
+
+pub const DEPRECATED_GUILD_FEATURES: &[&str] = &["CLONE_EMOJI_DISABLED", "CLONE_STICKER_DISABLED"];
+
+#[cfg(test)]
+mod tests {
+    use super::USER_FLAGS;
+
+    #[test]
+    fn user_flags_cover_every_flag_in_the_admin_spec() {
+        let spec: serde_json::Value =
+            serde_json::from_str(include_str!("../openapi-admin.json")).expect("admin spec");
+        let values = spec["components"]["schemas"]["UserFlags"]["x-bitflagValues"]
+            .as_array()
+            .expect("UserFlags bitflag values");
+        assert!(!values.is_empty());
+        for entry in values {
+            let name = entry["name"].as_str().expect("flag name");
+            let value: u64 = entry["value"]
+                .as_str()
+                .expect("flag value")
+                .parse()
+                .expect("numeric flag value");
+            assert!(
+                USER_FLAGS
+                    .iter()
+                    .any(|flag| flag.name == name && flag.value == value),
+                "{name} ({value}) is missing from USER_FLAGS"
+            );
+        }
+    }
+}
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use crate::templates::components::tooltip::{Hint, HintLink};
+
+pub fn limit_key_hint(key: &str) -> Option<Hint<'static>> {
+    match key {
+        "feature_guild_create" => Some(Hint {
+            name: Some("Community Creation Access"),
+            body: "Admins with the wildcard ACL can always create communities.",
+            link: Some(HintLink::new(
+                "/instance-config#community-creation",
+                "Community creation policy",
+            )),
+        }),
+        "max_screen_share_bitrate" => Some(Hint {
+            name: Some("Max Screen Share Bitrate"),
+            body: "In bits per second, so 9000000 is 9 Mbps. Raising it also raises the automatic bitrate of every screen share quality. Accounts with Higher Video Quality can pick their own bitrate up to this value.",
+            link: None,
+        }),
+        _ => None,
+    }
+}
@@ -12,7 +12,7 @@ impl AdminApiClient {
        acls: &[String],
    ) -> ApiResult<CreateAdminApiKeyResponse> {
        let body = generated_types::CreateAdminApiKeyRequest {
-            acls: parse_acls(acls)?,
+            acls: parse_acls(acls),
            expires_in_days: None,
            name: generated_types::CreateAdminApiKeyRequestName::try_from(name)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
@@ -44,11 +44,8 @@ impl AdminApiClient {
    }
 }

-pub(super) fn parse_acls(acls: &[String]) -> ApiResult<Vec<generated_types::AdminAclType>> {
+pub(super) fn parse_acls(acls: &[String]) -> Vec<generated_types::AdminAclType> {
    acls.iter()
-        .map(|acl| {
-            generated_types::AdminAclType::try_from(acl.as_str())
-                .map_err(|e| ApiError::Parse(e.to_string()))
-        })
+        .filter_map(|acl| generated_types::AdminAclType::try_from(acl.as_str()).ok())
        .collect()
 }
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use reqwest::Method;
+
 use super::client::{AdminApiClient, ApiResult};
 use super::types::{Application, ApplicationUpdateResponse, LookupApplicationResponse};
 use serde::Serialize;
@@ -43,12 +45,13 @@ impl AdminApiClient {
        new_owner_id: &str,
    ) -> ApiResult<ApplicationUpdateResponse> {
        let body = TransferApplicationOwnershipRequest { new_owner_id };
-        self.patch_typed_with_reason(
+        self.send(
+            Method::PATCH,
            &format!(
                "/admin/applications/{}",
                urlencoding::encode(application_id)
            ),
-            &body,
+            Some(&body),
            None,
        )
        .await
@@ -1,20 +1,21 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::{snowflake, types as generated_types};
+use reqwest::Method;
+
+use crate::api::generated::types as generated_types;

 use super::client::{AdminApiClient, ApiError, ApiResult};
-use super::types::{BanAvatarResult, BanCheckResult, BulkBanResult};
+use super::types::{BanCheckResult, BlocklistEntryPage, BulkBanResult};

 impl AdminApiClient {
    pub async fn ban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "email",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_1: Some(generated_types::BanEmailRequest {
-                    email: generated_types::EmailType::from(email.to_owned()),
-                }),
-                ..Default::default()
-            },
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanEmailRequest {
+                    email: generated_types::EmailBlocklistEntryType::from(email.to_owned()),
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -29,13 +30,24 @@ impl AdminApiClient {
        self.check_blocklist_entry("email", email, None).await
    }

-    pub async fn ban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+    pub async fn ban_ip(
+        &self,
+        ip: &str,
+        duration_hours: u32,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            "ip",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_0: Some(generated_types::BanIpRequest { ip: ip.to_owned() }),
-                ..Default::default()
-            },
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanIpRequest {
+                    duration_hours: Some(
+                        i32::try_from(duration_hours)
+                            .map_err(|e| ApiError::Parse(e.to_string()))?
+                            .into(),
+                    ),
+                    ip: ip.to_owned(),
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -50,45 +62,14 @@ impl AdminApiClient {
        self.check_blocklist_entry("ip", ip, None).await
    }

-    pub async fn add_suspicious_email_domain(
-        &self,
-        domain: &str,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<()> {
-        self.create_blocklist_entry(
-            SUSPICIOUS_EMAIL_DOMAIN_LIST,
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_2: Some(suspicious_email_domain_request(domain)?),
-                ..Default::default()
-            },
-            audit_log_reason,
-        )
-        .await
-    }
-
-    pub async fn remove_suspicious_email_domain(
-        &self,
-        domain: &str,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<()> {
-        self.delete_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None, audit_log_reason)
-            .await
-    }
-
-    pub async fn check_suspicious_email_domain(&self, domain: &str) -> ApiResult<BanCheckResult> {
-        self.check_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None)
-            .await
-    }
-
    pub async fn ban_phrase(&self, phrase: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "phrase",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_3: Some(generated_types::BanPhraseRequest {
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanPhraseRequest {
                    phrase: phrase.to_owned(),
-                }),
-                ..Default::default()
-            },
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -110,16 +91,15 @@ impl AdminApiClient {
    pub async fn ban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
        self.create_blocklist_entry(
            "url",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_4: Some(generated_types::BanUrlRequest {
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanUrlRequest {
                    category: None,
                    notes: None,
                    severity: None,
                    source_url: None,
                    url: url.to_owned(),
-                }),
-                ..Default::default()
-            },
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -142,17 +122,16 @@ impl AdminApiClient {
    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            "url-domain",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_5: Some(generated_types::BanUrlDomainRequest {
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanUrlDomainRequest {
                    category: None,
                    domain: domain.to_owned(),
                    match_subdomains,
                    notes: None,
                    severity: None,
                    source_url: None,
-                }),
-                ..Default::default()
-            },
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -171,6 +150,19 @@ impl AdminApiClient {
        self.check_blocklist_entry("url-domain", domain, None).await
    }

+    pub async fn list_url_domain_entries(
+        &self,
+        after: Option<&str>,
+    ) -> ApiResult<BlocklistEntryPage> {
+        let list_type = blocklist_list_type("url-domain")?;
+        let response = self
+            .generated()
+            .list_admin_blocklist_entries(list_type, after, Some(BLOCKLIST_PAGE_SIZE), None)
+            .await
+            .map_err(|e| self.generated_error(e))?;
+        self.generated_value(response.into_inner())
+    }
+
    pub async fn ban_file_sha(
        &self,
        sha256_hex: &str,
@@ -178,17 +170,16 @@ impl AdminApiClient {
    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            "file-sha",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_6: Some(generated_types::BanFileShaRequest {
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanFileShaRequest {
                    category: None,
                    content_type: None,
                    notes: None,
                    severity: None,
                    sha256_hex: sha256_hex.to_owned(),
                    source_url: None,
-                }),
-                ..Default::default()
-            },
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -216,9 +207,10 @@ impl AdminApiClient {
        let body = generated_types::BulkBanFileShasRequest {
            sha256_list: sha256_list.to_vec(),
        };
-        self.put_typed_with_reason(
+        self.send(
+            Method::PUT,
            "/admin/blocklists/file-sha/entries",
-            &body,
+            Some(&body),
            audit_log_reason,
        )
        .await
@@ -231,17 +223,16 @@ impl AdminApiClient {
    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            "avatar-hash",
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_7: Some(generated_types::BanAvatarHashRequest {
+            generated_types::AdminBlocklistEntryCreateRequest::from(
+                generated_types::BanAvatarHashRequest {
                    category: None,
                    hashes: vec![hash_short.to_owned()],
                    notes: None,
                    reason: None,
                    severity: None,
                    source_url: None,
-                }),
-                ..Default::default()
-            },
+                },
+            ),
            audit_log_reason,
        )
        .await
@@ -261,16 +252,6 @@ impl AdminApiClient {
            .await
    }

-    pub async fn ban_user_avatar(&self, user_id: &str) -> ApiResult<BanAvatarResult> {
-        let body = generated_types::BanUserAvatarRequest::default();
-        let response = self
-            .generated()
-            .ban_admin_user_avatar(&snowflake(user_id), &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
    pub async fn ban_profile_substring(
        &self,
        scope: &str,
@@ -279,10 +260,9 @@ impl AdminApiClient {
    ) -> ApiResult<()> {
        self.create_blocklist_entry(
            PROFILE_SUBSTRING_LIST,
-            generated_types::AdminBlocklistEntryCreateRequest {
-                subtype_8: Some(profile_substring_request(scope, substring)?),
-                ..Default::default()
-            },
+            generated_types::AdminBlocklistEntryCreateRequest::from(profile_substring_request(
+                scope, substring,
+            )?),
            audit_log_reason,
        )
        .await
@@ -359,10 +339,10 @@ impl AdminApiClient {
    }
 }

-const SUSPICIOUS_EMAIL_DOMAIN_LIST: &str = "email-domain-suspicious";
-
 const PROFILE_SUBSTRING_LIST: &str = "profile-substring";

+const BLOCKLIST_PAGE_SIZE: &str = "200";
+
 fn blocklist_list_type(list_type: &str) -> ApiResult<generated_types::AdminBlocklistListType> {
    generated_types::AdminBlocklistListType::try_from(list_type)
        .map_err(|e| ApiError::Parse(e.to_string()))
@@ -380,15 +360,6 @@ fn blocklist_delete_scope(
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn suspicious_email_domain_request(
-    domain: &str,
-) -> ApiResult<generated_types::SuspiciousEmailDomainRequest> {
-    Ok(generated_types::SuspiciousEmailDomainRequest {
-        domain: generated_types::SuspiciousEmailDomainRequestDomain::try_from(domain)
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
-    })
-}
-
 fn profile_substring_request(
    scope: &str,
    substring: &str,
@@ -1,5 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::{guild_features, user_flags};
+
+use reqwest::Method;
+
 use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
@@ -18,24 +22,13 @@ impl AdminApiClient {
            remove_flags: user_flags(remove_flags)?,
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
-            .await
-    }
-
-    pub async fn bulk_update_suspicious_activity_flags(
-        &self,
-        user_ids: &[String],
-        add_flags: &[String],
-        remove_flags: &[String],
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::AdminBulkJobCreateRequest::UpdateSuspiciousActivityFlags {
-            add_flags: add_flags.to_vec(),
-            remove_flags: remove_flags.to_vec(),
-            user_ids: snowflakes(user_ids),
-        };
-        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/bulk-jobs",
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn bulk_update_guild_features(
@@ -50,8 +43,13 @@ impl AdminApiClient {
            guild_ids: snowflakes(guild_ids),
            remove_features: guild_features(remove_features),
        };
-        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/bulk-jobs",
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn bulk_add_guild_members(
@@ -64,8 +62,13 @@ impl AdminApiClient {
            guild_id: snowflake(guild_id),
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/bulk-jobs",
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn bulk_delete_user_messages(
@@ -76,8 +79,13 @@ impl AdminApiClient {
        let body = generated_types::AdminBulkJobCreateRequest::DeleteUserMessages {
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/bulk-jobs",
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn bulk_schedule_user_deletion(
@@ -86,6 +94,7 @@ impl AdminApiClient {
        reason_code: u32,
        days_until_deletion: u32,
        public_reason: Option<&str>,
+        notify_user: bool,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
        let body = generated_types::AdminBulkJobCreateRequest::ScheduleUserDeletion {
@@ -95,6 +104,7 @@ impl AdminApiClient {
            )
            .map_err(ApiError::Parse)?
            .into(),
+            notify_user,
            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
            reason_code: crate::api::generated::deletion_reason_code(
                i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
@@ -103,29 +113,16 @@ impl AdminApiClient {
            .map_err(ApiError::Parse)?,
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/bulk-jobs",
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }
 }

 fn snowflakes(values: &[String]) -> Vec<generated_types::SnowflakeType> {
    values.iter().map(|value| snowflake(value)).collect()
 }
-
-fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
-    values
-        .iter()
-        .map(|value| {
-            generated_types::UserFlags::try_from(value.as_str())
-                .map_err(|error| ApiError::Parse(error.to_string()))
-        })
-        .collect()
-}
-
-fn guild_features(values: &[String]) -> Vec<generated_types::GuildFeatureSchema> {
-    values
-        .iter()
-        .cloned()
-        .map(generated_types::GuildFeatureSchema::from)
-        .collect()
-}
@@ -49,6 +49,15 @@ impl AdminApiClient {
        Self { generated }
    }

+    pub fn anonymous(http_client: &reqwest::Client, config: &AdminConfig) -> Self {
+        let generated = GeneratedClient::new_with_client(
+            &config.api_endpoint,
+            http_client.clone(),
+            build_proxy_client_ip_headers(config),
+        );
+        Self { generated }
+    }
+
    fn build_url(&self, path: &str, query_params: Option<&[(&str, &str)]>) -> String {
        let mut url = format!("{}{}", self.generated.baseurl(), path);
        let query = query_params
@@ -90,10 +99,7 @@ impl AdminApiClient {
    fn headers_with_reason(&self, audit_log_reason: Option<&str>) -> ApiResult<HeaderMap> {
        let mut headers = self.generated.inner().clone();
        if let Some(reason) = audit_log_reason {
-            let mut value = HeaderValue::from_str(reason)
-                .map_err(|_| ApiError::Parse("invalid audit log reason header".to_owned()))?;
-            value.set_sensitive(true);
-            headers.insert("x-audit-log-reason", value);
+            headers.insert("x-audit-log-reason", audit_log_reason_header(reason)?);
        }
        Ok(headers)
    }
@@ -130,170 +136,32 @@ impl AdminApiClient {
        Self::parse_response(response).await
    }

-    pub async fn post<T: DeserializeOwned>(
+    pub async fn send<T, B>(
        &self,
+        method: Method,
        path: &str,
-        body: Option<&serde_json::Value>,
-    ) -> ApiResult<T> {
-        self.post_with_reason(path, body, None).await
-    }
-
-    pub async fn post_typed<T, B>(&self, path: &str, body: &B) -> ApiResult<T>
-    where
-        T: DeserializeOwned,
-        B: Serialize + ?Sized,
-    {
-        self.post_typed_with_reason(path, body, None).await
-    }
-
-    pub async fn post_typed_with_reason<T, B>(
-        &self,
-        path: &str,
-        body: &B,
+        body: Option<&B>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T>
    where
        T: DeserializeOwned,
        B: Serialize + ?Sized,
    {
-        let response = self
-            .send_json(Method::POST, path, Some(body), audit_log_reason)
-            .await?;
+        let response = self.send_json(method, path, body, audit_log_reason).await?;
        Self::parse_response(response).await
    }

-    pub async fn post_with_reason<T: DeserializeOwned>(
+    pub async fn send_void<B: Serialize + ?Sized>(
        &self,
+        method: Method,
        path: &str,
-        body: Option<&serde_json::Value>,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<T> {
-        let response = self
-            .send_json(Method::POST, path, body, audit_log_reason)
-            .await?;
-        Self::parse_response(response).await
-    }
-
-    pub async fn post_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
-        self.post_void_with_reason(path, body, None).await
-    }
-
-    pub async fn post_void_with_reason(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
+        body: Option<&B>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let response = self
-            .send_json(Method::POST, path, body, audit_log_reason)
-            .await?;
+        let response = self.send_json(method, path, body, audit_log_reason).await?;
        Self::parse_void_response(response).await
    }

-    pub async fn patch<T: DeserializeOwned>(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
-    ) -> ApiResult<T> {
-        self.patch_with_reason(path, body, None).await
-    }
-
-    pub async fn patch_with_reason<T: DeserializeOwned>(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<T> {
-        let response = self
-            .send_json(Method::PATCH, path, body, audit_log_reason)
-            .await?;
-        Self::parse_response(response).await
-    }
-
-    pub async fn patch_typed_with_reason<T, B>(
-        &self,
-        path: &str,
-        body: &B,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<T>
-    where
-        T: DeserializeOwned,
-        B: Serialize + ?Sized,
-    {
-        let response = self
-            .send_json(Method::PATCH, path, Some(body), audit_log_reason)
-            .await?;
-        Self::parse_response(response).await
-    }
-
-    pub async fn put_with_reason<T: DeserializeOwned>(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<T> {
-        let response = self
-            .send_json(Method::PUT, path, body, audit_log_reason)
-            .await?;
-        Self::parse_response(response).await
-    }
-
-    pub async fn put_typed_with_reason<T, B>(
-        &self,
-        path: &str,
-        body: &B,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<T>
-    where
-        T: DeserializeOwned,
-        B: Serialize + ?Sized,
-    {
-        let response = self
-            .send_json(Method::PUT, path, Some(body), audit_log_reason)
-            .await?;
-        Self::parse_response(response).await
-    }
-
-    pub async fn put_void_with_reason(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<()> {
-        let response = self
-            .send_json(Method::PUT, path, body, audit_log_reason)
-            .await?;
-        Self::parse_void_response(response).await
-    }
-
-    pub async fn delete_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
-        self.delete_void_with_reason(path, body, None).await
-    }
-
-    pub async fn delete_void_with_reason(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<()> {
-        let response = self
-            .send_json(Method::DELETE, path, body, audit_log_reason)
-            .await?;
-        Self::parse_void_response(response).await
-    }
-
-    pub async fn delete_with_reason<T: DeserializeOwned>(
-        &self,
-        path: &str,
-        body: Option<&serde_json::Value>,
-        audit_log_reason: Option<&str>,
-    ) -> ApiResult<T> {
-        let response = self
-            .send_json(Method::DELETE, path, body, audit_log_reason)
-            .await?;
-        Self::parse_response(response).await
-    }
-
    async fn parse_void_response(response: reqwest::Response) -> ApiResult<()> {
        Self::check_response_status(response).await.map(drop)
    }
@@ -422,11 +290,27 @@ impl std::fmt::Display for ApiError {
    }
 }

+fn audit_log_reason_header(reason: &str) -> ApiResult<HeaderValue> {
+    let mut value = HeaderValue::from_bytes(reason.as_bytes())
+        .map_err(|_| ApiError::Parse("invalid audit log reason header".to_owned()))?;
+    value.set_sensitive(true);
+    Ok(value)
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
    use serde_json::{Value, json};

+    #[test]
+    fn audit_log_reason_header_keeps_utf8_bytes() {
+        let reason = "§ 3 Regel – wiederholt 日本";
+        let value = audit_log_reason_header(reason).expect("valid reason header");
+        assert_eq!(value.as_bytes(), reason.as_bytes());
+        assert!(value.is_sensitive());
+        assert!(audit_log_reason_header("line one\nline two").is_err());
+    }
+
    fn response(status: u16, body: &'static str) -> reqwest::Response {
        axum::http::Response::builder()
            .status(status)
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::float_to_u64;
+
 use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
@@ -144,10 +146,6 @@ fn listed_guild(
    })
 }

-fn float_to_u64(value: f64, field: &str) -> ApiResult<u64> {
-    crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)
-}
-
 fn float_to_i32(value: f64, field: &str) -> ApiResult<i32> {
    let parsed = crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)?;
    i32::try_from(parsed).map_err(|_| ApiError::Parse(format!("{field} is out of range: {value}")))
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use self::types as generated_types;
+use crate::api::client::{ApiError, ApiResult};
+
 use progenitor_client::{ClientHooks, ClientInfo, Error, OperationInfo};
 use reqwest::header::HeaderMap;

@@ -61,97 +64,35 @@ pub(crate) fn deletion_reason_code(
        .map_err(|_| format!("{field} is not a deletion reason code: {value}"))
 }

+pub(crate) fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
+    values
+        .iter()
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
+        .collect()
+}
+
+pub(crate) fn guild_features(values: &[String]) -> Vec<generated_types::GuildFeatureSchema> {
+    values
+        .iter()
+        .cloned()
+        .map(generated_types::GuildFeatureSchema::from)
+        .collect()
+}
+
+pub(crate) fn bool_param(value: bool) -> &'static str {
+    if value { "true" } else { "false" }
+}
+
+pub(crate) fn float_to_u64(value: f64, field: &str) -> ApiResult<u64> {
+    crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)
+}
+
 #[cfg(test)]
 mod tests {
-    use super::{number_to_u64, types::*};
-
-    #[test]
-    fn deserialize_admin_users_me() {
-        let json = serde_json::json!({
-            "user": {
-                "id": "123456789012345678",
-                "username": "testadmin",
-                "discriminator": 1,
-                "global_name": "Test Admin",
-                "bot": false,
-                "system": false,
-                "flags": "131141",
-                "premium_flags": 0,
-                "avatar": "abc123def456",
-                "banner": null,
-                "bio": "Hello world",
-                "pronouns": null,
-                "accent_color": null,
-                "email": "[email protected]",
-                "email_verified": true,
-                "email_bounced": false,
-                "has_verified_phone": false,
-                "date_of_birth": "2000-01-15",
-                "locale": "en-US",
-                "premium_type": 2,
-                "premium_since": "2024-01-01T00:00:00.000Z",
-                "premium_until": null,
-                "premium_grace_ends_at": null,
-                "premium_lifetime_sequence": null,
-                "suspicious_activity_flags": 0,
-                "phone_verification_deferred": false,
-                "temp_banned_until": null,
-                "pending_deletion_at": null,
-                "pending_bulk_message_deletion_at": null,
-                "deletion_reason_code": null,
-                "deletion_public_reason": null,
-                "acls": ["MANAGE_USERS", "VIEW_AUDIT_LOG"],
-                "traits": ["STAFF"],
-                "has_totp": true,
-                "authenticator_types": [0],
-                "last_active_at": "2026-05-26T12:00:00.000Z",
-                "last_active_ip": "203.0.113.1",
-                "last_active_ip_reverse": "1.113.0.203.in-addr.arpa",
-                "last_active_location": "New York, US"
-            }
-        });
-
-        let response: AdminUsersMeResponse =
-            serde_json::from_value(json).expect("failed to deserialize AdminUsersMeResponse");
-
-        assert_eq!(response.user.id.to_string(), "123456789012345678");
-        assert_eq!(response.user.username, "testadmin");
-        assert!(!response.user.bot);
-        assert!(response.user.email_verified);
-        assert_eq!(response.user.acls.len(), 2);
-        assert_eq!(response.user.global_name, Some("Test Admin".to_string()));
-        assert!(response.user.banner.is_none());
-        assert!(response.user.has_totp);
-    }
-
-    #[test]
-    fn deserialize_search_guilds_response() {
-        let json = serde_json::json!({
-            "guilds": [
-                {
-                    "id": "987654321098765432",
-                    "name": "Test Guild",
-                    "icon": "def456abc123",
-                    "banner": null,
-                    "owner_id": "123456789012345678",
-                    "owner_username": "guildowner",
-                    "owner_global_name": "Guild Owner",
-                    "owner_discriminator": "0001",
-                    "member_count": 42,
-                    "features": ["COMMUNITY", "NEWS"]
-                }
-            ],
-            "total": 1
-        });
-
-        let response: SearchGuildsResponse =
-            serde_json::from_value(json).expect("failed to deserialize SearchGuildsResponse");
-
-        assert_eq!(response.total, 1.0);
-        assert_eq!(response.guilds.len(), 1);
-        assert_eq!(response.guilds[0].name, "Test Guild");
-        assert_eq!(*response.guilds[0].member_count, 42);
-    }
+    use super::number_to_u64;

    #[test]
    fn reject_lossy_generated_number_count() {
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use crate::api::generated::snowflake;
+
+use super::client::{AdminApiClient, ApiResult};
+use super::types::ListGuildThreadsResponse;
+
+impl AdminApiClient {
+    pub async fn list_guild_threads(&self, guild_id: &str) -> ApiResult<ListGuildThreadsResponse> {
+        let response = self
+            .generated()
+            .list_admin_guild_threads(&snowflake(guild_id))
+            .await
+            .map_err(|e| self.generated_error(e))?;
+        self.generated_value(response.into_inner())
+    }
+
+    pub async fn delete_thread_channel(&self, channel_id: &str) -> ApiResult<()> {
+        self.generated()
+            .delete_admin_thread_channel(&snowflake(channel_id))
+            .await
+            .map_err(|e| self.generated_error(e))?;
+        Ok(())
+    }
+}
@@ -1,14 +1,17 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::guild_features;
+
+use reqwest::Method;
+
 use crate::api::generated::{snowflake, types as generated_types};
 use serde::Deserialize;

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::reports::SearchReportsParams;
 use super::types::{
-    GuildAuditLogResponse, GuildDetailInfo, GuildInfo, GuildUpdateResponse,
-    ListGuildMembersResponse, LookupGuildResponse, SearchGuildsResponse, SearchReportsResponse,
-    SuccessResponse,
+    GuildAuditLogResponse, GuildDetailInfo, GuildInfo, ListGuildMembersResponse,
+    LookupGuildResponse, SearchGuildsResponse, SearchReportsResponse, SuccessResponse,
 };

 impl AdminApiClient {
@@ -53,18 +56,17 @@ impl AdminApiClient {
        guild_id: &str,
        add_features: &[String],
        remove_features: &[String],
-    ) -> ApiResult<GuildUpdateResponse> {
+    ) -> ApiResult<()> {
        let body = generated_types::UpdateGuildRequest {
            add_features: guild_features(add_features),
            remove_features: guild_features(remove_features),
            ..Default::default()
        };
-        let response = self
-            .generated()
+        self.generated()
            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        Ok(())
    }

    pub async fn delete_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
@@ -80,17 +82,16 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        new_owner_id: &str,
-    ) -> ApiResult<GuildUpdateResponse> {
+    ) -> ApiResult<()> {
        let body = generated_types::UpdateGuildRequest {
            new_owner_id: Some(snowflake(new_owner_id)),
            ..Default::default()
        };
-        let response = self
-            .generated()
+        self.generated()
            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        Ok(())
    }

    pub async fn list_guild_members(
@@ -177,44 +178,37 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        settings: &serde_json::Value,
-    ) -> ApiResult<GuildUpdateResponse> {
+    ) -> ApiResult<()> {
        let body = guild_settings_request(settings)?;
-        let response = self
-            .generated()
+        self.generated()
            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
-        guild_update_response(response.into_inner())
+        Ok(())
    }

-    pub async fn update_guild_name(
-        &self,
-        guild_id: &str,
-        name: &str,
-    ) -> ApiResult<GuildUpdateResponse> {
+    pub async fn update_guild_name(&self, guild_id: &str, name: &str) -> ApiResult<()> {
        let body = generated_types::UpdateGuildRequest {
            name: Some(name.to_owned()),
            ..Default::default()
        };
-        let response = self
-            .generated()
+        self.generated()
            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        Ok(())
    }

-    pub async fn update_guild_vanity(
-        &self,
-        guild_id: &str,
-        vanity: Option<&str>,
-    ) -> ApiResult<GuildUpdateResponse> {
+    pub async fn update_guild_vanity(&self, guild_id: &str, vanity: Option<&str>) -> ApiResult<()> {
        let body = serde_json::json!({"vanity_url_code": vanity});
-        self.patch(
+        self.send::<serde::de::IgnoredAny, _>(
+            Method::PATCH,
            &format!("/admin/guilds/{}", urlencoding::encode(guild_id)),
            Some(&body),
+            None,
        )
        .await
+        .map(drop)
    }

    pub async fn reload_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
@@ -316,36 +310,6 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
    })
 }

-fn guild_update_response(
-    response: generated_types::GuildUpdateResponse,
-) -> ApiResult<GuildUpdateResponse> {
-    let guild = response.guild;
-    Ok(GuildUpdateResponse {
-        guild: GuildInfo {
-            id: String::from(guild.id),
-            name: String::from(guild.name),
-            icon: guild.icon.map(String::from),
-            banner: guild.banner.map(String::from),
-            owner_id: String::from(guild.owner_id),
-            owner_username: None,
-            owner_global_name: None,
-            owner_discriminator: None,
-            member_count: crate::api::generated::i64_to_u64(
-                i64::from(i32::from(guild.member_count)),
-                "member_count",
-            )
-            .map_err(ApiError::Parse)?,
-            features: guild.features.into_iter().map(String::from).collect(),
-            nsfw_level: guild.nsfw_level.map(i32::from),
-            nsfw: guild.nsfw,
-            content_warning_level: guild.content_warning_level.map(i32::from),
-            content_warning_text: guild.content_warning_text.map(String::from),
-            description: None,
-            vanity_url_code: None,
-        },
-    })
-}
-
 fn guild_settings_request(
    settings: &serde_json::Value,
 ) -> ApiResult<generated_types::UpdateGuildRequest> {
@@ -365,14 +329,6 @@ fn guild_settings_request(
    })
 }

-fn guild_features(values: &[String]) -> Vec<generated_types::GuildFeatureSchema> {
-    values
-        .iter()
-        .cloned()
-        .map(generated_types::GuildFeatureSchema::from)
-        .collect()
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -1,9 +1,12 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use reqwest::Method;
+
 use super::client::{AdminApiClient, ApiResult};
 use super::types::{
-    CreateRegistrationUrlRequest, CreateRegistrationUrlResponse, InstanceConfigResponse,
-    InstanceConfigUpdateRequest, InstanceEmailSmtpTestRequest, InstanceEmailSmtpTestResponse,
+    AccountIdentitySettings, CreateRegistrationUrlRequest, CreateRegistrationUrlResponse,
+    InstanceAccountIdentityDiscovery, InstanceConfigResponse, InstanceConfigUpdateRequest,
+    InstanceEmailSmtpTestResponse, InstancePremiumDiscovery,
 };

 impl AdminApiClient {
@@ -11,37 +14,61 @@ impl AdminApiClient {
        self.get("/admin/instance/config", None).await
    }

+    pub async fn get_instance_premium_discovery(&self) -> ApiResult<InstancePremiumDiscovery> {
+        self.get("/.well-known/fluxer", None).await
+    }
+
+    pub async fn get_instance_account_identity(&self) -> ApiResult<AccountIdentitySettings> {
+        let discovery: InstanceAccountIdentityDiscovery =
+            self.get("/.well-known/fluxer", None).await?;
+        let mode = discovery.features.account_identity;
+        Ok(AccountIdentitySettings {
+            mode,
+            tag_style: discovery.features.tag_style,
+        })
+    }
+
    pub async fn update_instance_config(
        &self,
        update: &InstanceConfigUpdateRequest,
    ) -> ApiResult<InstanceConfigResponse> {
-        self.patch_typed_with_reason("/admin/instance/config", update, None)
+        self.send(Method::PATCH, "/admin/instance/config", Some(update), None)
            .await
    }

-    pub async fn test_instance_smtp_config(
+    pub async fn test_saved_instance_smtp_config(
        &self,
-        request: &InstanceEmailSmtpTestRequest,
    ) -> ApiResult<InstanceEmailSmtpTestResponse> {
-        self.post_typed("/admin/instance/config/smtp-tests", request)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/instance/config/smtp-tests",
+            Some(&serde_json::json!({})),
+            None,
+        )
+        .await
    }

    pub async fn create_registration_url(
        &self,
        request: &CreateRegistrationUrlRequest,
    ) -> ApiResult<CreateRegistrationUrlResponse> {
-        self.post_typed("/admin/instance/registration-urls", request)
-            .await
+        self.send(
+            Method::POST,
+            "/admin/instance/registration-urls",
+            Some(request),
+            None,
+        )
+        .await
    }

    pub async fn revoke_registration_url(&self, id: &str) -> ApiResult<InstanceConfigResponse> {
-        self.delete_with_reason(
+        self.send(
+            Method::DELETE,
            &format!(
                "/admin/instance/registration-urls/{}",
                urlencoding::encode(id)
            ),
-            None,
+            None::<&serde_json::Value>,
            None,
        )
        .await
@@ -67,7 +94,8 @@ impl AdminApiClient {
        status: &str,
    ) -> ApiResult<InstanceConfigResponse> {
        let body = serde_json::json!({"status": status});
-        self.patch_with_reason(
+        self.send(
+            Method::PATCH,
            &format!(
                "/admin/instance/pending-registrations/{}",
                urlencoding::encode(user_id)
@@ -1,9 +1,11 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use reqwest::Method;
+
 use crate::api::generated::snowflake;

 use super::client::{AdminApiClient, ApiResult};
-use super::types::{ActiveJobsResponse, CancelJobResponse, GetJobResponse, ListJobsResponse};
+use super::types::{CancelJobResponse, GetJobResponse, ListJobsResponse};

 pub struct ListJobsParams {
    pub limit: u32,
@@ -52,22 +54,14 @@ impl AdminApiClient {
        job_id: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<CancelJobResponse> {
-        self.put_with_reason(
+        self.send(
+            Method::PUT,
            &format!("/admin/jobs/{}/cancellation", urlencoding::encode(job_id)),
-            None,
+            None::<&serde_json::Value>,
            audit_log_reason,
        )
        .await
    }
-
-    pub async fn list_active_jobs(&self) -> ApiResult<ActiveJobsResponse> {
-        let response = self
-            .generated()
-            .list_admin_active_jobs()
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
 }

 fn cursor_field<'a>(cursor: Option<&'a serde_json::Value>, field: &str) -> &'a str {
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use reqwest::Method;
+
 use super::client::{AdminApiClient, ApiResult};
 use super::types::{LimitConfigResponse, LimitConfigUpdateRequest};

@@ -12,7 +14,7 @@ impl AdminApiClient {
        &self,
        request: &LimitConfigUpdateRequest,
    ) -> ApiResult<LimitConfigResponse> {
-        self.put_typed_with_reason("/admin/limit-config", request, None)
+        self.send(Method::PUT, "/admin/limit-config", Some(request), None)
            .await
    }
 }
@@ -1,12 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use reqwest::Method;
+
 use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
    BrowseChannelResponse, DeleteAllUserMessagesResponse, LookupMessageResponse,
-    MessageShredResponse, MessageShredStatusResponse, NcmecAttachmentSubmitResult,
-    SearchChannelMessagesResponse,
+    MessageShredResponse, MessageShredStatusResponse, SearchChannelMessagesResponse,
 };

 impl AdminApiClient {
@@ -17,50 +18,20 @@ impl AdminApiClient {
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
        let _: serde_json::Value = self
-            .delete_with_reason(
+            .send(
+                Method::DELETE,
                &format!(
                    "/admin/channels/{}/messages/{}",
                    urlencoding::encode(channel_id),
                    urlencoding::encode(message_id)
                ),
-                None,
+                None::<&serde_json::Value>,
                audit_log_reason,
            )
            .await?;
        Ok(())
    }

-    pub async fn report_attachment_to_ncmec(
-        &self,
-        channel_id: &str,
-        message_id: &str,
-        attachment_id: &str,
-        filename: &str,
-        reporter_full_name: &str,
-        source_report_id: Option<&str>,
-    ) -> ApiResult<NcmecAttachmentSubmitResult> {
-        let body = generated_types::ReportAttachmentToNcmecRequest {
-            attachment_id: snowflake(attachment_id),
-            channel_id: snowflake(channel_id),
-            confirmed_viewed: true,
-            filename: generated_types::ReportAttachmentToNcmecRequestFilename::try_from(filename)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            message_id: snowflake(message_id),
-            reporter_full_name:
-                generated_types::ReportAttachmentToNcmecRequestReporterFullName::try_from(
-                    reporter_full_name,
-                )
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            source_report_id: source_report_id.map(snowflake),
-        };
-        let response = self
-            .generated()
-            .create_admin_ncmec_report(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
    pub async fn lookup_message(
        &self,
        channel_id: &str,
@@ -13,6 +13,7 @@ pub mod client;
 pub mod codes;
 pub mod discovery;
 pub mod guild_assets;
+pub mod guild_threads;
 pub mod guilds;
 pub mod instance_config;
 pub mod jobs;
@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::snowflake;
+use reqwest::Method;
+
+use crate::api::generated::{snowflake, types::UpdateReportRequestResolution};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
-    ListReportsResponse, ReportEntry, ResolveReportResponse, SearchReportsResponse,
+    ReportEntry, ReportLegalHoldResponse, ReportReasonListResponse, ResolveReportResponse,
+    SearchReportsResponse,
 };

 #[derive(Default)]
@@ -13,8 +16,10 @@ pub struct SearchReportsParams<'a> {
    pub status: Option<i32>,
    pub report_type: Option<i32>,
    pub category: Option<&'a str>,
+    pub reason: Option<&'a str>,
    pub reporter_id: Option<&'a str>,
    pub reported_user_id: Option<&'a str>,
+    pub reported_webhook_id: Option<&'a str>,
    pub reported_guild_id: Option<&'a str>,
    pub reported_channel_id: Option<&'a str>,
    pub guild_context_id: Option<&'a str>,
@@ -26,23 +31,6 @@ pub struct SearchReportsParams<'a> {
 }

 impl AdminApiClient {
-    pub async fn list_reports(
-        &self,
-        status: Option<i32>,
-        limit: u32,
-        offset: Option<u32>,
-    ) -> ApiResult<ListReportsResponse> {
-        let status = status.map(report_status).transpose()?.unwrap_or_default();
-        let limit = limit.to_string();
-        let offset = offset.map(|value| value.to_string()).unwrap_or_default();
-        let query_params = [
-            ("status", status),
-            ("limit", limit.as_str()),
-            ("offset", offset.as_str()),
-        ];
-        self.get("/admin/reports", Some(&query_params)).await
-    }
-
    pub async fn get_report(&self, report_id: &str) -> ApiResult<ReportEntry> {
        let response = self
            .generated()
@@ -55,14 +43,18 @@ impl AdminApiClient {
    pub async fn resolve_report(
        &self,
        report_id: &str,
+        resolution: UpdateReportRequestResolution,
        public_comment: Option<&str>,
+        notify_reporter: bool,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<ResolveReportResponse> {
-        let mut body = serde_json::json!({"status": "resolved"});
+        let mut body = serde_json::json!({"status": "resolved", "resolution": resolution});
        if let Some(public_comment) = public_comment {
            body["public_comment"] = serde_json::Value::from(public_comment);
        }
-        self.patch_with_reason(
+        body["notify_reporter"] = serde_json::Value::from(notify_reporter);
+        self.send(
+            Method::PATCH,
            &format!("/admin/reports/{}", urlencoding::encode(report_id)),
            Some(&body),
            audit_log_reason,
@@ -70,6 +62,42 @@ impl AdminApiClient {
        .await
    }

+    pub async fn set_report_legal_hold(
+        &self,
+        report_id: &str,
+        legal_hold_until: Option<&str>,
+        legal_hold_reason: Option<&str>,
+    ) -> ApiResult<ReportLegalHoldResponse> {
+        let body = serde_json::json!({
+            "legal_hold_until": legal_hold_until,
+            "legal_hold_reason": legal_hold_until.and(legal_hold_reason),
+        });
+        self.send(
+            Method::POST,
+            &format!(
+                "/admin/reports/{}/legal-hold",
+                urlencoding::encode(report_id)
+            ),
+            Some(&body),
+            None,
+        )
+        .await
+    }
+
+    pub async fn delete_report(
+        &self,
+        report_id: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.send_void(
+            Method::DELETE,
+            &format!("/admin/reports/{}", urlencoding::encode(report_id)),
+            None::<&serde_json::Value>,
+            audit_log_reason,
+        )
+        .await
+    }
+
    pub async fn search_reports(
        &self,
        params: &SearchReportsParams<'_>,
@@ -96,11 +124,16 @@ impl AdminApiClient {
            ("status", status),
            ("report_type", report_type),
            ("category", params.category.unwrap_or_default()),
+            ("reason", params.reason.unwrap_or_default()),
            ("reporter_id", params.reporter_id.unwrap_or_default()),
            (
                "reported_user_id",
                params.reported_user_id.unwrap_or_default(),
            ),
+            (
+                "reported_webhook_id",
+                params.reported_webhook_id.unwrap_or_default(),
+            ),
            (
                "reported_guild_id",
                params.reported_guild_id.unwrap_or_default(),
@@ -125,6 +158,10 @@ impl AdminApiClient {
        self.get("/admin/reports", Some(&query_params)).await
    }

+    pub async fn list_report_reasons(&self) -> ApiResult<ReportReasonListResponse> {
+        self.get("/admin/report-reasons", None).await
+    }
+
    pub async fn search_reports_by_reporter(
        &self,
        reporter_id: &str,
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::float_to_u64;
+
 use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
@@ -74,10 +76,6 @@ fn index_refresh_status(
    }
 }

-fn float_to_u64(value: f64, field: &str) -> ApiResult<u64> {
-    crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -8,13 +8,18 @@ use super::types::SendSystemDmResponse;
 impl AdminApiClient {
    pub async fn send_system_dm(
        &self,
-        user_ids: &[String],
+        user_ids: Option<&[String]>,
        content: &str,
    ) -> ApiResult<SendSystemDmResponse> {
        let body = generated_types::SendSystemDmRequest {
            content: generated_types::SendSystemDmRequestContent::try_from(content)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_ids: user_ids.iter().map(|id| snowflake(id)).collect(),
+            user_ids: user_ids
+                .unwrap_or_default()
+                .iter()
+                .map(|id| snowflake(id))
+                .collect(),
+            all_users: user_ids.is_none().then_some(true),
        };
        let response = self
            .generated()
@@ -61,11 +61,6 @@ pub struct LookupGuildResponse {
    pub guild: Option<GuildDetailInfo>,
 }

-#[derive(Clone, Debug, Deserialize)]
-pub struct GuildUpdateResponse {
-    pub guild: GuildInfo,
-}
-
 #[derive(Clone, Debug, Deserialize)]
 pub struct ListUserGuildsResponse {
    pub guilds: Vec<GuildInfo>,
@@ -108,20 +103,20 @@ pub struct AdminUser {
    pub premium_grace_ends_at: Option<String>,
    pub premium_lifetime_sequence: Option<i32>,
    #[serde(default)]
-    pub suspicious_activity_flags: i32,
-    #[serde(default)]
-    pub phone_verification_deferred: bool,
-    #[serde(default)]
    pub has_totp: bool,
    #[serde(default)]
    pub authenticator_types: Vec<i32>,
-    #[serde(default)]
-    pub has_verified_phone: bool,
    pub temp_banned_until: Option<String>,
    pub pending_deletion_at: Option<String>,
    pub pending_bulk_message_deletion_at: Option<String>,
    pub deletion_reason_code: Option<i32>,
    pub deletion_public_reason: Option<String>,
+    #[serde(default)]
+    pub deletion_audit_log_reason: Option<String>,
+    #[serde(default)]
+    pub deletion_scheduled_by: Option<String>,
+    #[serde(default)]
+    pub deletion_scheduled_at: Option<String>,
    pub last_active_at: Option<String>,
    pub last_active_ip: Option<String>,
    pub last_active_ip_reverse: Option<String>,
@@ -255,19 +250,35 @@ pub enum FlashLevel {
 pub struct BanCheckResult {
    pub banned: bool,
    #[serde(default)]
+    pub expires_at: Option<String>,
+    #[serde(default)]
    pub entries: Vec<serde_json::Value>,
 }

+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct BlocklistEntry {
+    pub value: String,
+    #[serde(default)]
+    pub match_subdomains: Option<bool>,
+    #[serde(default)]
+    pub category: Option<String>,
+    #[serde(default)]
+    pub created_at: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct BlocklistEntryPage {
+    pub items: Vec<BlocklistEntry>,
+    pub has_more: bool,
+    #[serde(default)]
+    pub next_after: Option<String>,
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct BulkBanResult {
    pub job_id: String,
 }

-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct BanAvatarResult {
-    pub hash_short: String,
-}
-
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct SuccessResponse {
    pub success: bool,
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct GuildThreadMetadata {
+    pub archived: bool,
+    pub locked: bool,
+    pub auto_archive_duration: i32,
+    pub archive_timestamp: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct GuildThreadItem {
+    pub id: String,
+    #[serde(rename = "type")]
+    pub channel_type: i32,
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub parent_id: Option<String>,
+    #[serde(default)]
+    pub owner_id: Option<String>,
+    #[serde(default)]
+    pub member_count: Option<i32>,
+    #[serde(default)]
+    pub message_count: Option<i32>,
+    #[serde(default)]
+    pub thread_metadata: Option<GuildThreadMetadata>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ListGuildThreadsResponse {
+    pub threads: Vec<GuildThreadItem>,
+}
@@ -0,0 +1,391 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use super::{InstanceConfigResponse, PremiumMode};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+pub const BILLING_MAX_CURRENCIES: usize = 64;
+pub const BILLING_MAX_COUNTRY_CURRENCIES: usize = 300;
+pub const BILLING_MAX_LEGACY_SLOTS: usize = 256;
+pub const BILLING_MAX_LEGACY_PRICES_PER_SLOT: usize = 32;
+pub const BILLING_PRICE_SLOTS: [&str; 4] = ["monthly", "yearly", "gift_1_month", "gift_1_year"];
+pub const PREMIUM_PRODUCT_NAME_MAX_CHARS: usize = 40;
+pub const TRI_STATE_DEFAULT: &str = "default";
+pub const TRI_STATE_ON: &str = "on";
+pub const TRI_STATE_OFF: &str = "off";
+
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum BillingCatalogMode {
+    #[default]
+    Env,
+    Operator,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct BillingPriceSet {
+    pub monthly: Option<String>,
+    pub yearly: Option<String>,
+    pub gift_1_month: Option<String>,
+    pub gift_1_year: Option<String>,
+}
+
+impl BillingPriceSet {
+    pub fn has_recurring_pair(&self) -> bool {
+        self.monthly.is_some() && self.yearly.is_some()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.monthly.is_none()
+            && self.yearly.is_none()
+            && self.gift_1_month.is_none()
+            && self.gift_1_year.is_none()
+    }
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct InstanceBillingResponse {
+    pub enabled: Option<bool>,
+    #[serde(default)]
+    pub effective_enabled: bool,
+    #[serde(default)]
+    pub stripe_secret_key_set: bool,
+    #[serde(default)]
+    pub stripe_webhook_secret_set: bool,
+    #[serde(default)]
+    pub stripe_secret_key_stored: bool,
+    #[serde(default)]
+    pub stripe_webhook_secret_stored: bool,
+    pub default_currency: Option<String>,
+    pub prices: Option<BTreeMap<String, BillingPriceSet>>,
+    pub country_currencies: Option<BTreeMap<String, String>>,
+    pub legacy_prices: Option<BTreeMap<String, Vec<String>>>,
+    #[serde(default)]
+    pub billing_active: bool,
+    #[serde(default)]
+    pub stripe_serviceable: bool,
+    #[serde(default)]
+    pub catalog_mode: BillingCatalogMode,
+    #[serde(default)]
+    pub webhook_url: String,
+    pub automatic_tax: Option<bool>,
+    pub tax_id_collection: Option<bool>,
+    pub terms_consent_required: Option<bool>,
+    #[serde(default)]
+    pub effective_automatic_tax: bool,
+    #[serde(default)]
+    pub effective_tax_id_collection: bool,
+    #[serde(default)]
+    pub effective_terms_consent_required: bool,
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct InstanceBillingUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<Option<bool>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stripe_secret_key: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stripe_webhook_secret: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_currency: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub prices: Option<Option<BTreeMap<String, BillingPriceSet>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub country_currencies: Option<Option<BTreeMap<String, String>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub legacy_prices: Option<Option<BTreeMap<String, Vec<String>>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub automatic_tax: Option<Option<bool>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tax_id_collection: Option<Option<bool>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub terms_consent_required: Option<Option<bool>>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscovery {
+    #[serde(default)]
+    pub app_public: InstancePremiumDiscoveryAppPublic,
+    #[serde(default)]
+    pub features: InstancePremiumDiscoveryFeatures,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscoveryAppPublic {
+    #[serde(default)]
+    pub branding: InstancePremiumDiscoveryBranding,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscoveryBranding {
+    pub product_name: Option<String>,
+    pub icon_url: Option<String>,
+    pub favicon_url: Option<String>,
+    pub premium_product_name: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstancePremiumDiscoveryFeatures {
+    #[serde(default)]
+    pub premium_enabled: bool,
+}
+
+impl InstancePremiumDiscovery {
+    pub fn premium_product_name(&self) -> Option<&str> {
+        non_blank(self.app_public.branding.premium_product_name.as_deref())
+    }
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct PremiumBranding {
+    pub name: Option<String>,
+    pub premium_enabled: bool,
+    pub product_name: Option<String>,
+    pub favicon_url: Option<String>,
+}
+
+impl PremiumBranding {
+    pub fn from_discovery(discovery: &InstancePremiumDiscovery) -> Self {
+        let branding = &discovery.app_public.branding;
+        Self {
+            name: discovery.premium_product_name().map(str::to_owned),
+            premium_enabled: discovery.features.premium_enabled,
+            product_name: non_blank(branding.product_name.as_deref()).map(str::to_owned),
+            favicon_url: favicon_url(
+                branding.favicon_url.as_deref(),
+                branding.icon_url.as_deref(),
+            ),
+        }
+    }
+
+    pub fn from_instance_config(config: &InstanceConfigResponse) -> Self {
+        let branding = &config.app_public.branding;
+        Self {
+            product_name: non_blank(Some(&branding.product_name)).map(str::to_owned),
+            favicon_url: favicon_url(
+                branding.favicon_url.as_deref(),
+                branding.icon_url.as_deref(),
+            ),
+            ..Self::from_config_parts(
+                config.self_hosted,
+                &branding.premium_product_name,
+                config.policy.premium_mode,
+            )
+        }
+    }
+
+    fn from_config_parts(self_hosted: bool, name: &str, premium_mode: PremiumMode) -> Self {
+        Self {
+            name: non_blank(Some(name)).map(str::to_owned),
+            premium_enabled: !self_hosted || matches!(premium_mode, PremiumMode::Mirror),
+            ..Self::default()
+        }
+    }
+}
+
+fn non_blank(value: Option<&str>) -> Option<&str> {
+    value.map(str::trim).filter(|value| !value.is_empty())
+}
+
+fn favicon_url(favicon_url: Option<&str>, icon_url: Option<&str>) -> Option<String> {
+    non_blank(favicon_url)
+        .or_else(|| non_blank(icon_url))
+        .map(str::to_owned)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::generated::types as generated_types;
+    use serde_json::json;
+
+    #[test]
+    fn billing_response_round_trips_through_the_generated_contract() {
+        let value = json!({
+            "enabled": true,
+            "effective_enabled": true,
+            "stripe_secret_key_set": true,
+            "stripe_webhook_secret_set": false,
+            "stripe_secret_key_stored": true,
+            "stripe_webhook_secret_stored": false,
+            "default_currency": "GBP",
+            "prices": {
+                "GBP": {
+                    "monthly": "price_1Monthly",
+                    "yearly": "price_1Yearly",
+                    "gift_1_month": null,
+                    "gift_1_year": null
+                }
+            },
+            "country_currencies": {"GB": "GBP"},
+            "legacy_prices": {"monthly_GBP": ["price_1Old"]},
+            "billing_active": false,
+            "stripe_serviceable": false,
+            "catalog_mode": "operator",
+            "webhook_url": "https://api.example.com/stripe/webhook",
+            "automatic_tax": null,
+            "tax_id_collection": false,
+            "terms_consent_required": true,
+            "effective_automatic_tax": false,
+            "effective_tax_id_collection": false,
+            "effective_terms_consent_required": true
+        });
+        let generated: generated_types::InstanceBillingResponse =
+            serde_json::from_value(value.clone()).expect("generated billing response");
+        let ours: InstanceBillingResponse =
+            serde_json::from_value(value.clone()).expect("hand-written billing response");
+        assert_eq!(ours.catalog_mode, BillingCatalogMode::Operator);
+        assert!(ours.stripe_secret_key_stored);
+        assert_eq!(ours.automatic_tax, None);
+        assert_eq!(ours.tax_id_collection, Some(false));
+        assert!(ours.effective_terms_consent_required);
+        assert!(ours.prices.as_ref().expect("prices")["GBP"].has_recurring_pair());
+        assert_eq!(serde_json::to_value(&ours).expect("serializable"), value);
+        assert_eq!(
+            serde_json::to_value(generated).expect("serializable generated"),
+            value
+        );
+    }
+
+    #[test]
+    fn default_billing_response_matches_the_generated_contract() {
+        let value = serde_json::to_value(InstanceBillingResponse::default()).expect("serializable");
+        serde_json::from_value::<generated_types::InstanceBillingResponse>(value.clone())
+            .expect("generated billing response");
+        assert_eq!(value["catalog_mode"], json!("env"));
+        assert_eq!(value["prices"], json!(null));
+    }
+
+    #[test]
+    fn billing_update_preserves_explicit_nulls_and_omits_untouched_fields() {
+        let mut prices = BTreeMap::new();
+        prices.insert(
+            "SEK".to_owned(),
+            BillingPriceSet {
+                monthly: Some("price_1Monthly".to_owned()),
+                yearly: Some("price_1Yearly".to_owned()),
+                ..Default::default()
+            },
+        );
+        let update = InstanceBillingUpdateRequest {
+            enabled: Some(None),
+            stripe_secret_key: Some(None),
+            default_currency: Some(None),
+            prices: Some(Some(prices)),
+            country_currencies: Some(None),
+            legacy_prices: Some(Some(BTreeMap::new())),
+            automatic_tax: Some(None),
+            tax_id_collection: Some(Some(true)),
+            terms_consent_required: Some(Some(false)),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::InstanceBillingUpdateRequest>(value.clone())
+            .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({
+                "enabled": null,
+                "stripe_secret_key": null,
+                "default_currency": null,
+                "prices": {
+                    "SEK": {
+                        "monthly": "price_1Monthly",
+                        "yearly": "price_1Yearly",
+                        "gift_1_month": null,
+                        "gift_1_year": null
+                    }
+                },
+                "country_currencies": null,
+                "legacy_prices": {},
+                "automatic_tax": null,
+                "tax_id_collection": true,
+                "terms_consent_required": false
+            })
+        );
+        assert_eq!(
+            serde_json::to_value(InstanceBillingUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
+
+    #[test]
+    fn premium_discovery_reads_the_name_and_feature_flag() {
+        let discovery: InstancePremiumDiscovery = serde_json::from_value(json!({
+            "app_public": {"branding": {"product_name": "Example", "premium_product_name": " Gold "}},
+            "features": {"premium_enabled": true, "stripe_enabled": false}
+        }))
+        .expect("discovery");
+        assert_eq!(discovery.premium_product_name(), Some("Gold"));
+        assert!(discovery.features.premium_enabled);
+        let empty: InstancePremiumDiscovery =
+            serde_json::from_value(json!({})).expect("empty discovery");
+        assert_eq!(empty.premium_product_name(), None);
+        assert!(!empty.features.premium_enabled);
+        assert_eq!(
+            PremiumBranding::from_discovery(&discovery),
+            PremiumBranding {
+                name: Some("Gold".to_owned()),
+                premium_enabled: true,
+                product_name: Some("Example".to_owned()),
+                favicon_url: None,
+            }
+        );
+    }
+
+    #[test]
+    fn instance_branding_prefers_the_favicon_and_falls_back_to_the_icon() {
+        let discovery = |branding| -> InstancePremiumDiscovery {
+            serde_json::from_value(json!({"app_public": {"branding": branding}}))
+                .expect("discovery")
+        };
+        let both = discovery(json!({
+            "favicon_url": "https://media.example/favicon.png",
+            "icon_url": "https://media.example/icon.png"
+        }));
+        assert_eq!(
+            PremiumBranding::from_discovery(&both)
+                .favicon_url
+                .as_deref(),
+            Some("https://media.example/favicon.png")
+        );
+        let icon_only =
+            discovery(json!({"favicon_url": " ", "icon_url": "https://media.example/icon.png"}));
+        assert_eq!(
+            PremiumBranding::from_discovery(&icon_only)
+                .favicon_url
+                .as_deref(),
+            Some("https://media.example/icon.png")
+        );
+        let neither = discovery(json!({"product_name": "  "}));
+        assert_eq!(
+            PremiumBranding::from_discovery(&neither),
+            PremiumBranding::default()
+        );
+    }
+
+    #[test]
+    fn premium_branding_from_instance_config_matches_discovery_rules() {
+        assert_eq!(
+            PremiumBranding::from_config_parts(true, " Gold ", PremiumMode::Everyone),
+            PremiumBranding {
+                name: Some("Gold".to_owned()),
+                premium_enabled: false,
+                ..PremiumBranding::default()
+            }
+        );
+        assert!(
+            PremiumBranding::from_config_parts(true, "Gold", PremiumMode::Mirror).premium_enabled
+        );
+        assert_eq!(
+            PremiumBranding::from_config_parts(false, "  ", PremiumMode::Everyone),
+            PremiumBranding {
+                name: None,
+                premium_enabled: true,
+                ..PremiumBranding::default()
+            }
+        );
+    }
+}
@@ -2,7 +2,7 @@

 use serde::{Deserialize, Serialize};

-pub use crate::api::generated::types::VoiceNoiseSuppressionBackendSchema as NoiseSuppressionBackend;
+use super::{InstanceBillingResponse, InstanceBillingUpdateRequest};

 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceConfigResponse {
@@ -13,6 +13,8 @@ pub struct InstanceConfigResponse {
    #[serde(default)]
    pub self_hosted: bool,
    #[serde(default)]
+    pub account_identity: AccountIdentityConfigResponse,
+    #[serde(default)]
    pub app_public: AppPublicConfigResponse,
    #[serde(default)]
    pub policy: InstancePolicyResponse,
@@ -21,17 +23,90 @@ pub struct InstanceConfigResponse {
    #[serde(default)]
    pub media: InstanceMediaResponse,
    #[serde(default)]
-    pub voice_noise_suppression: VoiceNoiseSuppressionConfigResponse,
-    #[serde(default)]
    pub push_relay: PushRelayConfigResponse,
    #[serde(default)]
    pub domain_migration: DomainMigrationConfigResponse,
    #[serde(default)]
-    pub altcha_captcha: AltchaCaptchaConfigResponse,
+    pub voice_p2p: VoiceP2pConfigResponse,
    #[serde(default)]
-    pub profile_timezone: ProfileTimezoneConfigResponse,
+    pub captcha: CaptchaConfigResponse,
    #[serde(default)]
    pub experiment_delivery: ExperimentDeliveryConfigResponse,
+    #[serde(default)]
+    pub billing: InstanceBillingResponse,
+}
+
+#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AccountIdentityMode {
+    #[default]
+    Email,
+    Username,
+}
+
+impl AccountIdentityMode {
+    pub fn is_username(self) -> bool {
+        matches!(self, Self::Username)
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Email => "Email",
+            Self::Username => "Username",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, Deserialize, Serialize, Eq, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum TagStyle {
+    None,
+    #[default]
+    #[serde(other)]
+    Random,
+}
+
+impl TagStyle {
+    pub fn is_none(self) -> bool {
+        matches!(self, Self::None)
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::None => "No tags",
+            Self::Random => "Random tags",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, Deserialize, Serialize)]
+pub struct AccountIdentityConfigResponse {
+    #[serde(default)]
+    pub mode: AccountIdentityMode,
+    #[serde(default)]
+    pub locked: Option<bool>,
+    #[serde(default)]
+    pub tag_style: TagStyle,
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct AccountIdentitySettings {
+    pub mode: AccountIdentityMode,
+    pub tag_style: TagStyle,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstanceAccountIdentityDiscovery {
+    #[serde(default)]
+    pub features: InstanceAccountIdentityDiscoveryFeatures,
+}
+
+#[derive(Clone, Debug, Default, Deserialize)]
+pub struct InstanceAccountIdentityDiscoveryFeatures {
+    #[serde(default)]
+    pub account_identity: AccountIdentityMode,
+    #[serde(default)]
+    pub tag_style: TagStyle,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -45,34 +120,18 @@ pub struct InstancePolicyResponse {
    pub direct_messages_locked: bool,
    #[serde(default)]
    pub premium_mode: PremiumMode,
+    #[serde(default = "default_guild_create_access")]
+    pub guild_create_access: bool,
    #[serde(default)]
    pub services: InstanceServicesOverrides,
    #[serde(default)]
    pub services_resolved: InstanceServicesResolved,
    #[serde(default)]
    pub services_available: InstanceServicesAvailable,
-    #[serde(default)]
-    pub deferred_phone_gate: DeferredPhoneGateResponse,
 }

-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct DeferredPhoneGateResponse {
-    #[serde(default)]
-    pub enabled: bool,
-    #[serde(default)]
-    pub window_hours: f64,
-    #[serde(default)]
-    pub member_threshold: i64,
-}
-
-impl Default for DeferredPhoneGateResponse {
-    fn default() -> Self {
-        Self {
-            enabled: true,
-            window_hours: 6.0,
-            member_threshold: 50,
-        }
-    }
+fn default_guild_create_access() -> bool {
+    true
 }

 impl Default for InstancePolicyResponse {
@@ -83,10 +142,10 @@ impl Default for InstancePolicyResponse {
            direct_messages_disabled: false,
            direct_messages_locked: false,
            premium_mode: PremiumMode::Everyone,
+            guild_create_access: default_guild_create_access(),
            services: InstanceServicesOverrides::default(),
            services_resolved: InstanceServicesResolved::default(),
            services_available: InstanceServicesAvailable::default(),
-            deferred_phone_gate: DeferredPhoneGateResponse::default(),
        }
    }
 }
@@ -125,8 +184,6 @@ pub struct InstanceIntegrationsResponse {
    #[serde(default)]
    pub youtube: InstanceYoutubeIntegrationResponse,
    #[serde(default)]
-    pub captcha: InstanceCaptchaIntegrationResponse,
-    #[serde(default)]
    pub email: InstanceEmailIntegrationResponse,
    #[serde(default)]
    pub bluesky: InstanceBlueskyIntegrationResponse,
@@ -147,21 +204,6 @@ pub struct InstanceYoutubeIntegrationResponse {
    pub effective_available: bool,
 }

-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub struct InstanceCaptchaIntegrationResponse {
-    pub provider: Option<String>,
-    #[serde(default)]
-    pub effective_provider: String,
-    pub hcaptcha_site_key: Option<String>,
-    #[serde(default)]
-    pub hcaptcha_secret_key_set: bool,
-    pub turnstile_site_key: Option<String>,
-    #[serde(default)]
-    pub turnstile_secret_key_set: bool,
-    #[serde(default)]
-    pub effective_enabled: bool,
-}
-
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct InstanceEmailIntegrationResponse {
    pub enabled: Option<bool>,
@@ -187,7 +229,8 @@ pub struct InstanceEmailSmtpIntegrationResponse {
    pub username: Option<String>,
    #[serde(default)]
    pub password_set: bool,
-    pub secure: Option<bool>,
+    pub tls_mode: Option<String>,
+    pub effective_tls_mode: Option<String>,
 }

 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
@@ -336,6 +379,9 @@ pub struct AppBrandingConfigResponse {
    pub theme_color: Option<String>,
    pub status_page_url: Option<String>,
    pub status_page_incident_history_url: Option<String>,
+    #[serde(default = "default_premium_product_name")]
+    pub premium_product_name: String,
+    pub premium_info_url: Option<String>,
 }

 impl Default for AppBrandingConfigResponse {
@@ -350,6 +396,8 @@ impl Default for AppBrandingConfigResponse {
            theme_color: None,
            status_page_url: None,
            status_page_incident_history_url: None,
+            premium_product_name: default_premium_product_name(),
+            premium_info_url: None,
        }
    }
 }
@@ -358,6 +406,10 @@ fn default_product_name() -> String {
    "Fluxer".to_owned()
 }

+fn default_premium_product_name() -> String {
+    "Premium".to_owned()
+}
+
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct AppSetupConfigResponse {
    #[serde(default)]
@@ -368,6 +420,8 @@ pub struct AppSetupConfigResponse {
 pub struct AppLegalConfigResponse {
    pub terms_url: Option<String>,
    pub privacy_url: Option<String>,
+    #[serde(default)]
+    pub guidelines_url: Option<String>,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -455,108 +509,12 @@ impl VoiceE2eeScope {
 }

 pub const EXPERIMENT_MAX_TARGETED_USERS: usize = 1_000;
+pub const EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES: usize = 250;
 pub const DOMAIN_MIGRATION_DEFAULT_SALT: &str = "domain-migration-v1";
-pub const ALTCHA_CAPTCHA_DEFAULT_SALT: &str = "altcha-captcha-v1";
-pub const ALTCHA_CAPTCHA_COST_RANGE: std::ops::RangeInclusive<u32> = 1_000..=100_000;
-pub const ALTCHA_CAPTCHA_MAX_COUNTER_RANGE: std::ops::RangeInclusive<u32> = 100..=1_000_000;
-pub const PROFILE_TIMEZONE_DEFAULT_SALT: &str = "profile-timezone-v1";
-pub const VOICE_NS_MAX_GUILD_OVERRIDES: usize = 200;
-
-impl NoiseSuppressionBackend {
-    pub const ALL: [Self; 7] = [
-        Self::None,
-        Self::Standard,
-        Self::Gate,
-        Self::Speex,
-        Self::Rnnoise,
-        Self::Gtcrn,
-        Self::DeepFilter,
-    ];
-
-    pub fn label(&self) -> &'static str {
-        match self {
-            Self::None => "None (pass-through)",
-            Self::Standard => "Standard (WebRTC)",
-            Self::Gate => "Noise gate",
-            Self::Speex => "Speex",
-            Self::Rnnoise => "RNNoise",
-            Self::Gtcrn => "GTCRN",
-            Self::DeepFilter => "DeepFilterNet",
-        }
-    }
-}
-
-#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
-pub struct VoiceNoiseSuppressionGuildOverride {
-    pub guild_id: String,
-    pub backend: NoiseSuppressionBackend,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(default)]
-pub struct VoiceNoiseSuppressionConfigResponse {
-    pub enabled: bool,
-    pub config_version: u64,
-    pub default_backend: NoiseSuppressionBackend,
-    pub enabled_backends: Vec<NoiseSuppressionBackend>,
-    pub allow_user_override: bool,
-    pub rollout_basis_points: u32,
-    pub rollout_salt: String,
-    pub included_user_ids: Vec<String>,
-    pub included_guild_ids: Vec<String>,
-    pub include_premium_users: bool,
-    pub excluded_user_ids: Vec<String>,
-    pub guild_overrides: Vec<VoiceNoiseSuppressionGuildOverride>,
-    pub suppression_strength: u32,
-}
-
-impl Default for VoiceNoiseSuppressionConfigResponse {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            config_version: 0,
-            default_backend: NoiseSuppressionBackend::Standard,
-            enabled_backends: NoiseSuppressionBackend::ALL.to_vec(),
-            allow_user_override: true,
-            rollout_basis_points: 0,
-            rollout_salt: "voice-ns-v1".to_owned(),
-            included_user_ids: Vec::new(),
-            included_guild_ids: Vec::new(),
-            include_premium_users: false,
-            excluded_user_ids: Vec::new(),
-            guild_overrides: Vec::new(),
-            suppression_strength: 80,
-        }
-    }
-}
-
-#[derive(Clone, Debug, Default, Serialize)]
-pub struct VoiceNoiseSuppressionConfigUpdateRequest {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default_backend: Option<NoiseSuppressionBackend>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled_backends: Option<Vec<NoiseSuppressionBackend>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_user_override: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub rollout_basis_points: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub rollout_salt: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub included_user_ids: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub included_guild_ids: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_premium_users: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub excluded_user_ids: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub guild_overrides: Option<Vec<VoiceNoiseSuppressionGuildOverride>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub suppression_strength: Option<u32>,
-}
+pub const VOICE_P2P_DEFAULT_SALT: &str = "voice-p2p-v1";
+pub const VOICE_P2P_MAX_PARTICIPANTS_RANGE: std::ops::RangeInclusive<u32> = 2..=4;
+pub const CAPTCHA_COST_RANGE: std::ops::RangeInclusive<u32> = 1_000..=20_000;
+pub const CAPTCHA_MAX_COUNTER_RANGE: std::ops::RangeInclusive<u32> = 100..=20_000;

 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 #[serde(default)]
@@ -578,6 +536,7 @@ pub struct DomainMigrationConfigResponse {
    pub enabled: bool,
    pub config_version: u64,
    pub rollout_basis_points: u32,
+    pub rollout_country_codes: Vec<String>,
    pub rollout_salt: String,
    pub included_user_ids: Vec<String>,
    pub included_guild_ids: Vec<String>,
@@ -593,6 +552,7 @@ impl Default for DomainMigrationConfigResponse {
            enabled: false,
            config_version: 0,
            rollout_basis_points: 0,
+            rollout_country_codes: Vec::new(),
            rollout_salt: DOMAIN_MIGRATION_DEFAULT_SALT.to_owned(),
            included_user_ids: Vec::new(),
            included_guild_ids: Vec::new(),
@@ -611,6 +571,8 @@ pub struct DomainMigrationConfigUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub rollout_basis_points: Option<u32>,
    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_country_codes: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
    pub rollout_salt: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub included_user_ids: Option<Vec<String>>,
@@ -628,45 +590,45 @@ pub struct DomainMigrationConfigUpdateRequest {

 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(default)]
-pub struct AltchaCaptchaConfigResponse {
+pub struct VoiceP2pConfigResponse {
    pub enabled: bool,
    pub config_version: u64,
    pub rollout_basis_points: u32,
+    pub rollout_country_codes: Vec<String>,
    pub rollout_salt: String,
    pub included_user_ids: Vec<String>,
    pub included_guild_ids: Vec<String>,
    pub include_premium_users: bool,
    pub excluded_user_ids: Vec<String>,
-    pub anonymous_enabled: bool,
-    pub cost: u32,
-    pub max_counter: u32,
+    pub max_participants: u32,
 }

-impl Default for AltchaCaptchaConfigResponse {
+impl Default for VoiceP2pConfigResponse {
    fn default() -> Self {
        Self {
            enabled: false,
            config_version: 0,
            rollout_basis_points: 0,
-            rollout_salt: ALTCHA_CAPTCHA_DEFAULT_SALT.to_owned(),
+            rollout_country_codes: Vec::new(),
+            rollout_salt: VOICE_P2P_DEFAULT_SALT.to_owned(),
            included_user_ids: Vec::new(),
            included_guild_ids: Vec::new(),
            include_premium_users: false,
            excluded_user_ids: Vec::new(),
-            anonymous_enabled: false,
-            cost: 5_000,
-            max_counter: 10_000,
+            max_participants: *VOICE_P2P_MAX_PARTICIPANTS_RANGE.start(),
        }
    }
 }

 #[derive(Clone, Debug, Default, Serialize)]
-pub struct AltchaCaptchaConfigUpdateRequest {
+pub struct VoiceP2pConfigUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub enabled: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub rollout_basis_points: Option<u32>,
    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_country_codes: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
    pub rollout_salt: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub included_user_ids: Option<Vec<String>>,
@@ -677,57 +639,35 @@ pub struct AltchaCaptchaConfigUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub excluded_user_ids: Option<Vec<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub anonymous_enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cost: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_counter: Option<u32>,
+    pub max_participants: Option<u32>,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(default)]
-pub struct ProfileTimezoneConfigResponse {
+pub struct CaptchaConfigResponse {
    pub enabled: bool,
-    pub config_version: u64,
-    pub rollout_basis_points: u32,
-    pub rollout_salt: String,
-    pub included_user_ids: Vec<String>,
-    pub included_guild_ids: Vec<String>,
-    pub include_premium_users: bool,
-    pub excluded_user_ids: Vec<String>,
+    pub cost: u32,
+    pub max_counter: u32,
 }

-impl Default for ProfileTimezoneConfigResponse {
+impl Default for CaptchaConfigResponse {
    fn default() -> Self {
        Self {
-            enabled: false,
-            config_version: 0,
-            rollout_basis_points: 0,
-            rollout_salt: PROFILE_TIMEZONE_DEFAULT_SALT.to_owned(),
-            included_user_ids: Vec::new(),
-            included_guild_ids: Vec::new(),
-            include_premium_users: false,
-            excluded_user_ids: Vec::new(),
+            enabled: true,
+            cost: 5_000,
+            max_counter: 1_000,
        }
    }
 }

 #[derive(Clone, Debug, Default, Serialize)]
-pub struct ProfileTimezoneConfigUpdateRequest {
+pub struct CaptchaConfigUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub enabled: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub rollout_basis_points: Option<u32>,
+    pub cost: Option<u32>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub rollout_salt: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub included_user_ids: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub included_guild_ids: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_premium_users: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub excluded_user_ids: Option<Vec<String>>,
+    pub max_counter: Option<u32>,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -844,17 +784,17 @@ pub struct InstanceConfigUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub media: Option<InstanceMediaUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub voice_noise_suppression: Option<VoiceNoiseSuppressionConfigUpdateRequest>,
-    #[serde(skip_serializing_if = "Option::is_none")]
    pub push_relay: Option<PushRelayConfigUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub domain_migration: Option<DomainMigrationConfigUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub altcha_captcha: Option<AltchaCaptchaConfigUpdateRequest>,
+    pub voice_p2p: Option<VoiceP2pConfigUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub profile_timezone: Option<ProfileTimezoneConfigUpdateRequest>,
+    pub captcha: Option<CaptchaConfigUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub experiment_delivery: Option<ExperimentDeliveryConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billing: Option<InstanceBillingUpdateRequest>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -866,21 +806,11 @@ pub struct InstancePolicyUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub direct_messages_disabled: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guild_create_access: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
    pub premium_mode: Option<PremiumMode>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub services: Option<InstanceServicesUpdateRequest>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deferred_phone_gate: Option<DeferredPhoneGateUpdateRequest>,
-}
-
-#[derive(Clone, Debug, Default, Serialize)]
-pub struct DeferredPhoneGateUpdateRequest {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub window_hours: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub member_threshold: Option<i64>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -900,8 +830,6 @@ pub struct InstanceIntegrationsUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub youtube: Option<InstanceYoutubeIntegrationUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub captcha: Option<InstanceCaptchaIntegrationUpdateRequest>,
-    #[serde(skip_serializing_if = "Option::is_none")]
    pub email: Option<InstanceEmailIntegrationUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub bluesky: Option<InstanceBlueskyIntegrationUpdateRequest>,
@@ -919,20 +847,6 @@ pub struct InstanceYoutubeIntegrationUpdateRequest {
    pub api_key: Option<String>,
 }

-#[derive(Clone, Debug, Default, Serialize)]
-pub struct InstanceCaptchaIntegrationUpdateRequest {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub provider: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hcaptcha_site_key: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hcaptcha_secret_key: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub turnstile_site_key: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub turnstile_secret_key: Option<String>,
-}
-
 #[derive(Clone, Debug, Default, Serialize)]
 pub struct InstanceEmailIntegrationUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -960,7 +874,7 @@ pub struct InstanceEmailSmtpIntegrationUpdateRequest {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub password: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub secure: Option<bool>,
+    pub tls_mode: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -1015,15 +929,6 @@ pub struct InstanceAttachmentDecayUpdateRequest {
    pub renew_window_days: Option<u32>,
 }

-#[derive(Clone, Debug, Default, Serialize)]
-pub struct InstanceEmailSmtpTestRequest {
-    pub host: String,
-    pub port: u16,
-    pub username: String,
-    pub password: String,
-    pub secure: bool,
-}
-
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct InstanceEmailSmtpTestResponse {
    #[serde(default)]
@@ -1063,6 +968,10 @@ pub struct AppBrandingConfigUpdateRequest {
    pub status_page_url: Option<Option<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub status_page_incident_history_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub premium_product_name: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub premium_info_url: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -1077,6 +986,8 @@ pub struct AppLegalConfigUpdateRequest {
    pub terms_url: Option<Option<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub privacy_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guidelines_url: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -1168,76 +1079,45 @@ mod tests {
    use serde_json::json;

    #[test]
-    fn noise_suppression_backend_choices_use_the_generated_wire_contract() {
-        assert_eq!(
-            serde_json::to_value(NoiseSuppressionBackend::ALL).expect("serializable backends"),
-            json!([
-                "none",
-                "standard",
-                "gate",
-                "speex",
-                "rnnoise",
-                "gtcrn",
-                "deep_filter"
-            ])
-        );
-        assert!(serde_json::from_value::<NoiseSuppressionBackend>(json!("deepfilter")).is_err());
-    }
-
-    #[test]
-    fn default_instance_experiment_config_matches_the_published_contract() {
+    fn default_instance_config_sections_match_the_published_contract() {
        let schema: serde_json::Value =
            serde_json::from_str(include_str!("../../../openapi-admin.json"))
                .expect("admin schema");
-        let noise = serde_json::from_value::<VoiceNoiseSuppressionConfigResponse>(json!({}))
-            .expect("default noise config");
        let domain_migration = serde_json::from_value::<DomainMigrationConfigResponse>(json!({}))
            .expect("default domain migration config");
-        let altcha_captcha = serde_json::from_value::<AltchaCaptchaConfigResponse>(json!({}))
-            .expect("default altcha captcha config");
-        let profile_timezone = serde_json::from_value::<ProfileTimezoneConfigResponse>(json!({}))
-            .expect("default profile timezone config");
+        let voice_p2p = serde_json::from_value::<VoiceP2pConfigResponse>(json!({}))
+            .expect("default voice p2p config");
+        let captcha = serde_json::from_value::<CaptchaConfigResponse>(json!({}))
+            .expect("default captcha config");
        let delivery = serde_json::from_value::<ExperimentDeliveryConfigResponse>(json!({}))
            .expect("default delivery config");
-        let noise = serde_json::to_value(noise).expect("serializable noise config");
        let domain_migration =
            serde_json::to_value(domain_migration).expect("serializable domain migration config");
-        let altcha_captcha =
-            serde_json::to_value(altcha_captcha).expect("serializable altcha captcha config");
-        let profile_timezone =
-            serde_json::to_value(profile_timezone).expect("serializable profile timezone config");
+        let voice_p2p = serde_json::to_value(voice_p2p).expect("serializable voice p2p config");
+        let captcha = serde_json::to_value(captcha).expect("serializable captcha config");
        let delivery = serde_json::to_value(delivery).expect("serializable delivery config");
-        let generated_noise: generated_types::VoiceNoiseSuppressionConfigResponse =
-            serde_json::from_value(noise.clone()).expect("generated noise config contract");
        let generated_domain_migration: generated_types::DomainMigrationConfigResponse =
            serde_json::from_value(domain_migration.clone())
                .expect("generated domain migration config contract");
-        let generated_altcha_captcha: generated_types::AltchaCaptchaConfigResponse =
-            serde_json::from_value(altcha_captcha.clone())
-                .expect("generated altcha captcha config contract");
-        let generated_profile_timezone: generated_types::ProfileTimezoneConfigResponse =
-            serde_json::from_value(profile_timezone.clone())
-                .expect("generated profile timezone config contract");
+        let generated_voice_p2p: generated_types::VoiceP2pConfigResponse =
+            serde_json::from_value(voice_p2p.clone()).expect("generated voice p2p config contract");
+        let generated_captcha: generated_types::CaptchaConfigResponse =
+            serde_json::from_value(captcha.clone()).expect("generated captcha config contract");
        let generated_delivery: generated_types::ExperimentDeliveryConfigResponse =
            serde_json::from_value(delivery.clone()).expect("generated delivery config contract");
-        assert_eq!(
-            serde_json::to_value(generated_noise).expect("serializable generated noise config"),
-            noise
-        );
        assert_eq!(
            serde_json::to_value(generated_domain_migration)
                .expect("serializable generated domain migration config"),
            domain_migration
        );
        assert_eq!(
-            serde_json::to_value(generated_altcha_captcha)
-                .expect("serializable generated altcha captcha config"),
-            altcha_captcha
+            serde_json::to_value(generated_voice_p2p)
+                .expect("serializable generated voice p2p config"),
+            voice_p2p
        );
        assert_eq!(
-            serde_json::to_value(generated_profile_timezone)
-                .expect("serializable generated profile timezone config"),
-            profile_timezone
+            serde_json::to_value(generated_captcha).expect("serializable generated captcha config"),
+            captcha
        );
        assert_eq!(
            serde_json::to_value(generated_delivery)
@@ -1245,10 +1125,9 @@ mod tests {
            delivery
        );
        for (name, value) in [
-            ("VoiceNoiseSuppressionConfigResponse", noise),
            ("DomainMigrationConfigResponse", domain_migration),
-            ("AltchaCaptchaConfigResponse", altcha_captcha),
-            ("ProfileTimezoneConfigResponse", profile_timezone),
+            ("VoiceP2pConfigResponse", voice_p2p),
+            ("CaptchaConfigResponse", captcha),
            ("ExperimentDeliveryConfigResponse", delivery),
        ] {
            for (field, value) in value.as_object().expect("config object") {
@@ -1260,31 +1139,6 @@ mod tests {
        }
    }

-    #[test]
-    fn noise_suppression_update_preserves_empty_lists_and_omitted_fields() {
-        let update = VoiceNoiseSuppressionConfigUpdateRequest {
-            enabled_backends: Some(Vec::new()),
-            included_user_ids: Some(Vec::new()),
-            excluded_user_ids: Some(Vec::new()),
-            guild_overrides: Some(Vec::new()),
-            ..Default::default()
-        };
-        let value = serde_json::to_value(update).expect("serializable update");
-        serde_json::from_value::<generated_types::VoiceNoiseSuppressionConfigUpdateRequest>(
-            value.clone(),
-        )
-        .expect("generated update contract");
-        assert_eq!(
-            value,
-            json!({"enabled_backends": [], "included_user_ids": [], "excluded_user_ids": [], "guild_overrides": []})
-        );
-        assert_eq!(
-            serde_json::to_value(VoiceNoiseSuppressionConfigUpdateRequest::default())
-                .expect("serializable update"),
-            json!({})
-        );
-    }
-
    #[test]
    fn domain_migration_update_preserves_empty_lists_and_omitted_fields() {
        let update = DomainMigrationConfigUpdateRequest {
@@ -1307,4 +1161,25 @@ mod tests {
            json!({})
        );
    }
+
+    #[test]
+    fn voice_p2p_update_preserves_empty_lists_and_omitted_fields() {
+        let update = VoiceP2pConfigUpdateRequest {
+            included_user_ids: Some(Vec::new()),
+            excluded_user_ids: Some(Vec::new()),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::VoiceP2pConfigUpdateRequest>(value.clone())
+            .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({"included_user_ids": [], "excluded_user_ids": []})
+        );
+        assert_eq!(
+            serde_json::to_value(VoiceP2pConfigUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
 }
@@ -21,8 +21,3 @@ pub struct GetJobResponse {
 pub struct CancelJobResponse {
    pub cancelled: bool,
 }
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct ActiveJobsResponse {
-    pub jobs: Vec<serde_json::Value>,
-}
@@ -34,12 +34,6 @@ pub struct DeleteAllUserMessagesResponse {
    pub extra: serde_json::Value,
 }

-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct NcmecAttachmentSubmitResult {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct BrowseChannelResponse {
    #[serde(flatten)]
@@ -9,6 +9,8 @@ mod codes;
 mod common;
 mod discovery;
 mod guild_assets;
+mod guild_threads;
+mod instance_billing;
 mod instance_config;
 mod jobs;
 mod limit_config;
@@ -28,6 +30,8 @@ pub use codes::*;
 pub use common::*;
 pub use discovery::*;
 pub use guild_assets::*;
+pub use guild_threads::*;
+pub use instance_billing::*;
 pub use instance_config::*;
 pub use jobs::*;
 pub use limit_config::*;
@@ -4,5 +4,5 @@ use serde::{Deserialize, Serialize};

 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct SendSystemDmResponse {
-    pub recipient_count: i64,
+    pub recipient_count: Option<i64>,
 }
@@ -98,6 +98,38 @@ pub struct ReportEntry {
    pub reported_user_global_name: Option<String>,
    pub reported_user_discriminator: Option<String>,
    pub reported_user_avatar_hash: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_id: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_name: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_avatar_hash: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_default_name: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_default_avatar_hash: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_type: Option<i32>,
+    #[serde(default)]
+    pub reported_webhook_application_id: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_channel_id: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_guild_id: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_created_at: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_creator_id: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_creator_tag: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_creator_username: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_creator_global_name: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_creator_discriminator: Option<String>,
+    #[serde(default)]
+    pub reported_webhook_creator_avatar_hash: Option<String>,
    pub reported_guild_id: Option<String>,
    pub reported_guild_name: Option<String>,
    pub reported_guild_icon_hash: Option<String>,
@@ -121,6 +153,148 @@ pub struct ReportEntry {
    pub public_comment: Option<String>,
    pub mutual_dm_channel_id: Option<String>,
    pub message_context: Option<Vec<serde_json::Value>>,
+    #[serde(default)]
+    pub reason: Option<String>,
+    #[serde(default)]
+    pub reason_label: Option<String>,
+    #[serde(default)]
+    pub reason_highest_priority: Option<bool>,
+    #[serde(default)]
+    pub flow: Option<ReportFlowAnswersEntry>,
+    #[serde(default)]
+    pub reporter_good_faith_confirmed: Option<bool>,
+    #[serde(default)]
+    pub reported_user_bot: Option<bool>,
+    #[serde(default)]
+    pub reported_profile_snapshot: Option<ReportProfileSnapshot>,
+    #[serde(default)]
+    pub legal_hold_until: Option<String>,
+    #[serde(default)]
+    pub legal_hold_reason: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct ReportProfileSnapshot {
+    #[serde(default)]
+    pub captured_at: Option<String>,
+    #[serde(default)]
+    pub user: Option<ReportProfileSnapshotUser>,
+    #[serde(default)]
+    pub member: Option<ReportProfileSnapshotMember>,
+    #[serde(default)]
+    pub guild: Option<ReportProfileSnapshotGuild>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct ReportProfileSnapshotUser {
+    pub id: String,
+    #[serde(default)]
+    pub username: Option<String>,
+    #[serde(default)]
+    pub discriminator: Option<String>,
+    #[serde(default)]
+    pub global_name: Option<String>,
+    #[serde(default)]
+    pub bio: Option<String>,
+    #[serde(default)]
+    pub pronouns: Option<String>,
+    #[serde(default)]
+    pub avatar: Option<ReportProfileSnapshotAsset>,
+    #[serde(default)]
+    pub banner: Option<ReportProfileSnapshotAsset>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct ReportProfileSnapshotMember {
+    pub guild_id: String,
+    #[serde(default)]
+    pub nick: Option<String>,
+    #[serde(default)]
+    pub bio: Option<String>,
+    #[serde(default)]
+    pub pronouns: Option<String>,
+    #[serde(default)]
+    pub joined_at: Option<String>,
+    #[serde(default)]
+    pub avatar: Option<ReportProfileSnapshotAsset>,
+    #[serde(default)]
+    pub banner: Option<ReportProfileSnapshotAsset>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct ReportProfileSnapshotGuild {
+    pub id: String,
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub vanity_url_code: Option<String>,
+    #[serde(default)]
+    pub icon: Option<ReportProfileSnapshotAsset>,
+    #[serde(default)]
+    pub banner: Option<ReportProfileSnapshotAsset>,
+    #[serde(default)]
+    pub splash: Option<ReportProfileSnapshotAsset>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct ReportProfileSnapshotAsset {
+    pub hash: String,
+    #[serde(default)]
+    pub url: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ReportLegalHoldResponse {
+    pub report_id: String,
+    pub legal_hold_until: Option<String>,
+    pub legal_hold_reason: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ReportFlowAnswersEntry {
+    pub revision_hash: String,
+    pub surface: String,
+    #[serde(default)]
+    pub locale: Option<String>,
+    #[serde(default)]
+    pub steps: Vec<ReportFlowAnswerStepEntry>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ReportFlowAnswerStepEntry {
+    pub screen_id: String,
+    pub screen_title: String,
+    #[serde(default)]
+    pub option_id: Option<String>,
+    #[serde(default)]
+    pub option_label: Option<String>,
+    #[serde(default)]
+    pub items: Vec<ReportFlowAnswerItemEntry>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ReportFlowAnswerItemEntry {
+    pub id: String,
+    pub label: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ReportReasonEntry {
+    pub key: String,
+    pub label: String,
+    #[serde(default)]
+    pub highest_priority: bool,
+    #[serde(default)]
+    pub legacy_category_message: Option<String>,
+    #[serde(default)]
+    pub legacy_category_user: Option<String>,
+    #[serde(default)]
+    pub legacy_category_guild: Option<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct ReportReasonListResponse {
+    pub reasons: Vec<ReportReasonEntry>,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -131,11 +305,6 @@ pub struct SearchReportsResponse {
    pub limit: u64,
 }

-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct ListReportsResponse {
-    pub reports: Vec<ReportEntry>,
-}
-
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct ResolveReportResponse {
    pub report_id: String,
@@ -232,3 +401,9 @@ pub struct WebAuthnCredential {
 }

 pub type WebAuthnCredentialListResponse = Vec<WebAuthnCredential>;
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub struct PasswordResetLinkResponse {
+    pub url: String,
+    pub expires_at: String,
+}
@@ -78,8 +78,3 @@ pub struct CreateVoiceServerResponse {
 pub struct UpdateVoiceServerResponse {
    pub server: VoiceServer,
 }
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct GetVoiceServerResponse {
-    pub server: Option<VoiceServer>,
-}