Add package workflow.

Signed-off-by: Jason Volk <jason@zemos.net>
2025-05-07 05:42:37 +00:00
parent de1e37f5ae
commit 8bfe63d45f
22 changed files with 626 additions and 168 deletions
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -6,39 +6,39 @@ on:
      bake_targets:
        type: string
        default: '["default"]'
-        description: Bake targets
+        description: Bake Matrix
      cargo_profiles:
        type: string
-        default: ${{vars.CARGO_PROFILES || '["test", "bench", "release"]'}}
        description: Cargo profiles
      feat_sets:
        type: string
-        default: ${{vars.FEAT_SETS || '["none", "default", "all"]'}}
        description: Cargo feature groups
-      machines:
-        type: string
-        default: ${{vars.MACHINES || '["x86_64"]'}}
-        description: Hardware platform vector
      rust_targets:
        type: string
-        default: ${{vars.RUST_TARGETS || '["x86_64-unknown-linux-gnu"]'}}
        description: Rust targets
      rust_toolchains:
        type: string
-        default: ${{vars.RUST_TOOLCHAINS || '["nightly", "stable"]'}}
        description: Rust toolchains
      sys_names:
        type: string
-        default: ${{vars.SYS_NAMES || '["debian"]'}}
        description: System names
      sys_targets:
        type: string
-        default: ${{vars.SYS_TARGETS || '["x86_64-linux-gnu"]'}}
        description: System targets
      sys_versions:
        type: string
-        default: ${{vars.SYS_VERSIONS || '["testing-slim"]'}}
        description: System versions
+      machines:
+        type: string
+        description: Hardware platforms
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
      verbose_env:
        type: string
        default: ${{vars.CI_VERBOSE_ENV || false}}
@@ -54,34 +54,38 @@ on:

 jobs:
  bake:
-    name: Bake
+    name: ${{matrix.bake_target}} ${{matrix.cargo_profile}} ${{matrix.rust_toolchain}} ${{matrix.feat_set}} ${{matrix.sys_name}} ${{matrix.sys_version}} ${{matrix.sys_target}}
    runs-on: ${{matrix.machine}}
    strategy:
-      fail-fast: false
+      fail-fast: true
      matrix:
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}
        bake_target: ${{fromJSON(inputs.bake_targets)}}
        cargo_profile: ${{fromJSON(inputs.cargo_profiles)}}
        feat_set: ${{fromJSON(inputs.feat_sets)}}
-        machine: ${{fromJSON(inputs.machines)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
        rust_toolchain: ${{fromJSON(inputs.rust_toolchains)}}
        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}

    steps:
    - uses: actions/checkout@v3
-    - name: Execute
+    - name: Bake
      env:
        bake_target: ${{matrix.bake_target}}
        cargo_profile: ${{matrix.cargo_profile}}
-        feat_set: ${{matrix.feat_set}}
-        machine: ${{matrix.machine}}
-        rust_target: ${{matrix.rust_target}}
        rust_toolchain: ${{matrix.rust_toolchain}}
+        rust_target: ${{matrix.rust_target}}
+        feat_set: ${{matrix.feat_set}}
        sys_name: ${{matrix.sys_name}}
-        sys_target: ${{matrix.sys_target}}
        sys_version: ${{matrix.sys_version}}
+        sys_target: ${{matrix.sys_target}}
+        machine: ${{matrix.machine}}
+        acct: ${{github.actor}}
+        repo: ${{github.repository}}
        CI_VERBOSE_ENV: ${{inputs.verbose_env}}
        CI_SILENT_BAKE: ${{inputs.silent_bake}}
        CI_PRINT_BAKE: ${{inputs.print_bake}}
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,18 +0,0 @@
-name: Build
-
-on:
-  workflow_call:
-
-jobs:
-  install:
-    name: Install
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["install"]'
-
-  complement:
-    name: Complement Testee
-    uses: ./.github/workflows/bake.yml
-    needs: [install]
-    with:
-      bake_targets: '["complement-testee"]'
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -2,45 +2,142 @@ name: Dependencies

 on:
  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      show_systems:
+        type: boolean
+        default: true
+        description: Pre-build systems dependency targets
+      show_sources:
+        type: boolean
+        default: true
+        description: Pre-build sources dependency targets
+      show_rocksdb:
+        type: boolean
+        default: true
+        description: Pre-build rocksdb dependency targets
+      show_cargo:
+        type: boolean
+        default: true
+        description: Pre-build cargo dependency targets

 jobs:
  systems:
+    if: inputs.show_systems
    name: System
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["systems"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  buildsys:
+    if: inputs.show_systems
    name: Builder
    needs: [systems]
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["buildsys"]'
-
-  tester:
-    name: Tester
-    needs: [systems]
-    uses: ./.github/workflows/bake.yml
-    with:
-      bake_targets: '["complement-tester"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  sources:
+    if: inputs.show_sources
    name: Acquire
    needs: [buildsys]
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["sources"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  rocksdb:
+    if: inputs.show_rocksdb
    name: RocksDB
    needs: [sources]
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["rocksdb"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  deps:
+    if: inputs.show_cargo
    name: Build
    needs: [rocksdb]
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["deps-clippy", "deps-build-tests", "deps-build-bins"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,9 +2,43 @@ name: Linting

 on:
  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions

 jobs:
  fmt:
+    if: ${{contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["none"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
    name: Format
    uses: ./.github/workflows/bake.yml
    with:
@@ -12,8 +46,16 @@ jobs:
      cargo_profiles: '["test"]'
      feat_sets: '["none"]'
      rust_toolchains: '["nightly"]'
+      rust_targets: ${{inputs.rust_targets}}
+      sys_names: ${{inputs.sys_names}}
+      sys_targets: ${{inputs.sys_targets}}
+      sys_versions: ${{inputs.sys_versions}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  audit:
+    if: ${{contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["none"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
    name: Audit
    uses: ./.github/workflows/bake.yml
    with:
@@ -21,8 +63,16 @@ jobs:
      cargo_profiles: '["test"]'
      feat_sets: '["none"]'
      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  lychee:
+    if: ${{contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["none"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
    name: Lychee
    uses: ./.github/workflows/bake.yml
    with:
@@ -30,18 +80,46 @@ jobs:
      cargo_profiles: '["test"]'
      feat_sets: '["none"]'
      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  clippy:
+    if: ${{ always() }}
    name: Clippy
+    needs: [fmt, audit, lychee]
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["clippy"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  doc:
+    if: ${{contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
    name: Docs
    needs: [clippy]
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["docs"]'
      cargo_profiles: '["test"]'
+      feat_sets: ${{inputs.feat_sets}}
      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -18,20 +18,61 @@ env:

 jobs:
  deps:
+    if: ${{vars.CI_VERBOSE_DEPS || false}}
    name: Deps
    uses: ./.github/workflows/deps.yml
+    with:
+      cargo_profiles: ${{vars.CARGO_PROFILES}}
+      feat_sets: ${{vars.FEAT_SETS}}
+      rust_toolchains: ${{vars.RUST_TOOLCHAINS}}
+      rust_targets: ${{vars.RUST_TARGETS}}
+      sys_names: ${{vars.SYS_NAMES}}
+      sys_targets: ${{vars.sys_TARGETS}}
+      sys_versions: ${{vars.SYS_VERSIONS}}
+      machines: ${{vars.MACHINES}}

  lint:
+    if: ${{ always() && !cancelled() }}
    name: Lint
+    needs: [deps]
    uses: ./.github/workflows/lint.yml
-    needs: [deps]
-
-  build:
-    name: Build
-    uses: ./.github/workflows/build.yml
-    needs: [deps]
+    with:
+      cargo_profiles: ${{vars.CARGO_PROFILES}}
+      feat_sets: ${{vars.FEAT_SETS}}
+      rust_toolchains: ${{vars.RUST_TOOLCHAINS}}
+      rust_targets: ${{vars.RUST_TARGETS}}
+      sys_names: ${{vars.SYS_NAMES}}
+      sys_targets: ${{vars.sys_TARGETS}}
+      sys_versions: ${{vars.SYS_VERSIONS}}
+      machines: ${{vars.MACHINES}}

  test:
+    if: ${{ always() && !cancelled() }}
    name: Test
+    needs: [lint]
    uses: ./.github/workflows/test.yml
-    needs: [build]
+    with:
+      cargo_profiles: ${{vars.CARGO_PROFILES}}
+      feat_sets: ${{vars.FEAT_SETS}}
+      rust_toolchains: ${{vars.RUST_TOOLCHAINS}}
+      rust_targets: ${{vars.RUST_TARGETS}}
+      sys_names: ${{vars.SYS_NAMES}}
+      sys_targets: ${{vars.sys_TARGETS}}
+      sys_versions: ${{vars.SYS_VERSIONS}}
+      machines: ${{vars.MACHINES}}
+      complement: true
+
+  package:
+    if: ${{ always() && !cancelled() }}
+    name: Package
+    needs: [test]
+    uses: ./.github/workflows/package.yml
+    with:
+      cargo_profiles: '["release"]'
+      feat_sets: ${{vars.FEAT_SETS}}
+      rust_toolchains: '["stable"]'
+      sys_names: ${{vars.SYS_NAMES}}
+      sys_versions: ${{vars.SYS_VERSIONS}}
+      rust_targets: ${{vars.RUST_TARGETS}}
+      sys_targets: ${{vars.sys_TARGETS}}
+      machines: ${{vars.MACHINES}}
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -0,0 +1,89 @@
+name: Package
+
+on:
+  workflow_call:
+    inputs:
+      cargo_profiles:
+        type: string
+        default: '["release"]'
+        description: Cargo profiles
+      feat_sets:
+        type: string
+        description: Cargo feature groups
+      rust_toolchains:
+        type: string
+        description: Rust toolchains
+      sys_names:
+        type: string
+        description: System names
+      sys_versions:
+        type: string
+        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+
+jobs:
+  deb:
+    name: Deb
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["pkg-deb-install"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  rpm:
+    if: false
+    name: RPM
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["pkg-rpm-install"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  dockerhub:
+    if: ${{github.ref == 'refs/heads/main'}}
+    name: DockerHub
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["dockerhub"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,82 +5,143 @@ on:
    inputs:
      cargo_profiles:
        type: string
-        default: ${{vars.CARGO_PROFILES || '["test", "bench", "release"]'}}
        description: Cargo profiles
      feat_sets:
        type: string
-        default: ${{vars.FEAT_SETS || '["none", "default", "all"]'}}
        description: Cargo feature groups
-      machines:
-        type: string
-        default: ${{vars.MACHINES || '["x86_64"]'}}
-        description: Hardware platform vector
-      rust_targets:
-        type: string
-        default: ${{vars.RUST_TARGETS || '["x86_64-unknown-linux-gnu"]'}}
-        description: Rust targets
      rust_toolchains:
        type: string
-        default: ${{vars.RUST_TOOLCHAINS || '["nightly", "stable"]'}}
        description: Rust toolchains
      sys_names:
        type: string
-        default: ${{vars.SYS_NAMES || '["debian"]'}}
        description: System names
-      sys_targets:
-        type: string
-        default: ${{vars.SYS_TARGETS || '["x86_64-linux-gnu"]'}}
-        description: System targets
      sys_versions:
        type: string
-        default: ${{vars.SYS_VERSIONS || '["testing-slim"]'}}
        description: System versions
+      rust_targets:
+        type: string
+        description: Rust targets
+      sys_targets:
+        type: string
+        description: System targets
+      machines:
+        type: string
+        description: Hardware platform vector
+      excludes:
+        type: string
+        default: '[]'
+        description: Matrix exclusions
+      includes:
+        type: string
+        default: '[]'
+        description: Matrix inclusions
+      complement:
+        type: boolean
+        default: true

 jobs:
  unit:
+    if: ${{contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
    name: Unit
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["tests-unit"]'
-      cargo_profiles: '["test", "bench"]'
+      cargo_profiles: '["test"]'
      feat_sets: '["all"]'
-      rust_toolchains: '["nightly"]'
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  smoke:
    name: Smoke
    uses: ./.github/workflows/bake.yml
    with:
      bake_targets: '["tests-smoke"]'
+      cargo_profiles: ${{inputs.cargo_profiles}}
+      feat_sets: ${{inputs.feat_sets}}
+      rust_toolchains: ${{inputs.rust_toolchains}}
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: '[{"cargo_profile": "release", "rust_toolchain": "nightly"}, {"feat_set": "default"}]'
+      includes: ${{inputs.includes}}
+
+  complement_tester:
+    if: ${{inputs.complement && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
+    name: Complement Tester
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["complement-tester"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
+  complement_testee:
+    if: ${{inputs.complement && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
+    name: Complement Testee
+    uses: ./.github/workflows/bake.yml
+    needs: [smoke]
+    with:
+      bake_targets: '["complement-testee"]'
+      cargo_profiles: '["test"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: ${{inputs.sys_targets}}
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}

  complement:
-    name: Compliance
-    needs: [smoke]
+    if: ${{inputs.complement && contains(fromJSON(inputs.cargo_profiles), fromJSON('["test"]')[0]) && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0]) && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])}}
+    name: Matrix Compliance
+    needs: [complement_tester, complement_testee]
    runs-on: ${{matrix.machine}}
-    #concurrency: ${{matrix.feat_set}}-${{matrix.sys_name}}-${{matrix.sys_target}}-${{matrix.sys_version}}
-    concurrency: complement-cant-walk-and-chew-bubblegum
+    concurrency:
+      group: complement-cant-walk-and-chew-bubblegum
+      cancel-in-progress: false
+
    strategy:
      fail-fast: false
      matrix:
        cargo_profile: ${{fromJSON('["test"]')}}
-        feat_set: ${{fromJSON('["all"]')}}
-        machine: ${{fromJSON(inputs.machines)}}
-        rust_target: ${{fromJSON(inputs.rust_targets)}}
        rust_toolchain: ${{fromJSON('["nightly"]')}}
+        feat_set: ${{fromJSON('["all"]')}}
        sys_name: ${{fromJSON(inputs.sys_names)}}
-        sys_target: ${{fromJSON(inputs.sys_targets)}}
        sys_version: ${{fromJSON(inputs.sys_versions)}}
+        rust_target: ${{fromJSON(inputs.rust_targets)}}
+        sys_target: ${{fromJSON(inputs.sys_targets)}}
+        machine: ${{fromJSON(inputs.machines)}}
+        exclude: ${{fromJSON(inputs.excludes)}}
+        include: ${{fromJSON(inputs.includes)}}

    steps:
    - name: Complement
      env:
        cargo_profile: ${{matrix.cargo_profile}}
-        feat_set: ${{matrix.feat_set}}
-        machine: ${{matrix.machine}}
-        rust_target: ${{matrix.rust_target}}
        rust_toolchain: ${{matrix.rust_toolchain}}
+        rust_target: ${{matrix.rust_target}}
+        feat_set: ${{matrix.feat_set}}
        sys_name: ${{matrix.sys_name}}
        sys_target: ${{matrix.sys_target}}
        sys_version: ${{matrix.sys_version}}
+        machine: ${{matrix.machine}}

      run: |
        docker/complement.sh
--- a/docker/Dockerfile.cargo
+++ b/docker/Dockerfile.cargo
@@ -20,9 +20,8 @@ WORKDIR /usr/src/tuwunel
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
--mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=shared \
+--mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup run ${rust_toolchain} \
        cargo ${cargo_cmd} \
--- a/docker/Dockerfile.cargo.audit
+++ b/docker/Dockerfile.cargo.audit
@@ -12,7 +12,6 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup run ${rust_toolchain} \
        cargo audit \
--- a/docker/Dockerfile.cargo.deb
+++ b/docker/Dockerfile.cargo.deb
@@ -0,0 +1,59 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS debuild
+ARG sys_target
+ARG rust_toolchain
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG CARGO_TARGET
+ARG CARGO_TARGET_DIR
+ARG cargo_profile
+ARG cargo_features
+ARG cargo_spec_features
+ARG pkg_dir
+ARG deb_args=""
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME},sharing=locked \
+--mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=locked \
+<<EOF
+    set -eux
+    mkdir -p "${pkg_dir}"
+    rustup run ${rust_toolchain} \
+        cargo deb \
+            --frozen \
+            --no-build \
+            "${cargo_spec_features}" \
+            --features "${cargo_features}" \
+            --profile "${cargo_profile}" \
+            --target "${CARGO_TARGET}" \
+            --manifest-path Cargo.toml \
+            --multiarch same \
+            --compress-type gz \
+            --output "${pkg_dir}" \
+            ${deb_args}
+
+	dpkg --info ${pkg_dir}/*
+	dpkg --contents ${pkg_dir}/*
+EOF
+
+
+FROM scratch AS package
+ARG pkg_dir
+
+COPY --from=debuild ${pkg_dir}/* .
+
+
+FROM input AS package-install
+ARG pkg_dir
+
+WORKDIR ${pkg_dir}
+COPY --from=package . .
+RUN <<EOF
+	set -eux
+	dpkg --info *
+	dpkg --contents *
+	dpkg --install *
+EOF
--- a/docker/Dockerfile.cargo.deps
+++ b/docker/Dockerfile.cargo.deps
@@ -24,7 +24,6 @@ RUN \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup run ${rust_toolchain} \
        cargo chef cook ${cook_args} \
--- a/docker/Dockerfile.cargo.fmt
+++ b/docker/Dockerfile.cargo.fmt
@@ -12,7 +12,6 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup run ${rust_toolchain} \
        cargo fmt \
--- a/docker/Dockerfile.cargo.install
+++ b/docker/Dockerfile.cargo.install
@@ -22,9 +22,8 @@ WORKDIR /usr/src/tuwunel
 RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
--mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=shared \
+--mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=locked \
 <<EOF
-    env
    set -eux
    case "$cargo_profile" in
            "dev") profile_dir="debug";;
@@ -63,7 +62,6 @@ WORKDIR /
 RUN \
 --mount=type=bind,from=output,src=${install_temp},dst=/mnt/install \
 <<EOF
-    env
    set -eux
    cp -ndR --preserve=all -t ${CARGO_INSTALL_ROOT} /mnt/install/*
 EOF
--- a/docker/Dockerfile.cargo.lychee
+++ b/docker/Dockerfile.cargo.lychee
@@ -14,7 +14,6 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup run ${rust_toolchain} \
        lychee \
--- a/docker/Dockerfile.cookware
+++ b/docker/Dockerfile.cookware
@@ -12,7 +12,6 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 <<EOF
-    env
    set -eux

    url="https://static.rust-lang.org/rustup/archive/${rustup_version}/${CARGO_TARGET}/rustup-init"
@@ -34,7 +33,6 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup component add \
        --toolchain ${rust_toolchain} \
@@ -55,7 +53,6 @@ RUN \
 --mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 <<EOF
-    env
    set -eux
    rustup run --install ${rust_toolchain} \
        cargo install \
@@ -64,6 +61,8 @@ RUN \
            cargo-chef \
            cargo-audit \
            cargo-deb \
+            cargo-arch \
+            cargo-generate-rpm \
            lychee \
            ;
 EOF
--- a/docker/Dockerfile.ingredients
+++ b/docker/Dockerfile.ingredients
@@ -6,7 +6,6 @@ ARG git_checkout
 ADD --keep-git-dir . /usr/src/tuwunel
 WORKDIR /usr/src/tuwunel
 RUN <<EOF
-    env
    set -eux
    git reset \
        --hard \
@@ -31,7 +30,6 @@ RUN \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=locked \
 <<EOF
-    env
    set -eux
    git submodule update \
        --remote \
@@ -60,7 +58,6 @@ RUN \
 --mount=type=cache,dst=${CARGO_HOME},sharing=locked \
 --mount=type=cache,dst=${CARGO_TARGET_DIR},sharing=locked \
 <<EOF
-    env
    set -euxo pipefail
    rustup run ${rust_toolchain} \
        cargo chef prepare \
--- a/docker/Dockerfile.rocksdb
+++ b/docker/Dockerfile.rocksdb
@@ -36,7 +36,9 @@ ENV CC="clang"
 ENV CXX="clang++"
 WORKDIR /usr/src/rocksdb/librocksdb-sys/rocksdb
 ENV nprocs=${nprocs}
-RUN <<EOF
+RUN \
+--mount=type=cache,dst=/var/lock/uwu/${rocksdb_jemalloc}/${rocksdb_iouring},sharing=locked \
+<<EOF
    set -eux

    LDFLAGS="-Wl,--strip-all" \
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -1,5 +1,8 @@
 variable "acct" {}
 variable "repo" {}
+variable GITHUB_REF {}
+variable GITHUB_REF_SHA {}
+variable GITHUB_REF_NAME {}

 cargo_feat_sets = {
    none = ""
@@ -74,7 +77,7 @@ variable "package_authors" {
    default = "Jason Volk <jason@zemos.net>"
 }
 variable "package_version" {
-    default = "0.5"
+    default = "1.0"
 }
 variable "package_revision" {
    default = ""
@@ -177,6 +180,43 @@ sys = {
    sys_target = jsondecode(sys_targets)
 }

+#
+# Publish
+#
+
+group "publish" {
+    targets = [
+        "dockerhub",
+    ]
+}
+
+target "dockerhub" {
+    name = elem("dockerhub", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        "${repo}:${cargo_profile}-${feat_set}-${sys_target}",
+        (GITHUB_REF_NAME == "main" && cargo_profile == "release" && feat_set == "all")?
+            "${repo}:main": "",
+        (GITHUB_REF_NAME == "main" && cargo_profile == "release" && feat_set == "all")?
+            "${repo}:${GITHUB_REF_NAME}": "",
+        (GITHUB_REF_NAME == "main" && cargo_profile == "release" && feat_set == "all")?
+            "${repo}:latest": "",
+    ]
+    output = ["type=registry,compression=zstd,mode=min"]
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    }
+    target = "dockerhub"
+    dockerfile-inline =<<EOF
+        FROM input AS dockerhub
+        EXPOSE 8008 8448
+        ENTRYPOINT ["${cargo_install_root}/bin/tuwunel"]
+EOF
+}
+
 #
 # Complement tests
 #
@@ -222,12 +262,9 @@ target "complement-testee" {
        elem_tag("complement-testee", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
    target = "complement-testee"
+    output = ["type=docker,compression=zstd,mode=min"]
    entitlements = ["network.host"]
    dockerfile = "docker/Dockerfile.complement"
-    labels = {
-        "_group" = "complement"
-        "_cache" = "leaf"
-    }
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
@@ -299,10 +336,6 @@ target "complement-config" {
    ]
    target = "complement-config"
    dockerfile = "docker/Dockerfile.complement"
-    labels = {
-        "_group" = "complement"
-        "_cache" = "trunk"
-    }
    matrix = feat_sys
    inherits = [
        elem("source", [feat_set, sys_name, sys_version, sys_target])
@@ -388,12 +421,8 @@ target "smoketest" {
    tags = [
        elem_tag("smoketest", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
-    output = ["type=docker,compression=zstd,mode=min"]
+    output = ["type=cacheonly,compression=zstd,mode=min"]
    dockerfile = "docker/Dockerfile.smoketest"
-    labels = {
-        "_group" = "smoketest"
-        "_cache" = "leaf"
-    }
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
@@ -410,7 +439,7 @@ target "smoketest" {
 install_labels = {
    "org.opencontainers.image.authors" = "${package_authors}"
    "org.opencontainers.image.created" ="${package_last_modified}"
-    "org.opencontainers.image.description" = "Enterprise Matrix Chat Server in Rust"
+    "org.opencontainers.image.description" = "Matrix Chat Server in Rust"
    "org.opencontainers.image.documentation" = "https://github.com/matrix-construct/tuwunel/tree/main/docs/"
    "org.opencontainers.image.licenses" = "Apache-2.0"
    "org.opencontainers.image.revision" = "${package_revision}"
@@ -447,10 +476,6 @@ target "installer" {
    ]
    target = "installer"
    dockerfile = "docker/Dockerfile.cargo.install"
-    labels = {
-        "_group" = "install"
-        "_cache" = "trunk"
-    }
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("deps-build-bins", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
@@ -465,6 +490,68 @@ target "installer" {
    }
 }

+#
+# Package
+#
+
+group "pkg" {
+    targets = [
+        "pkg-deb-install",
+    ]
+}
+
+target "pkg-deb-install" {
+    name = elem("pkg-deb-install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("pkg-deb-install", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    target = "package-install"
+    output = ["type=cacheonly,compression=zstd,mode=min"]
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("pkg-deb", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:diner", [feat_set, sys_name, sys_version, sys_target])
+        package = elem("target:pkg-deb", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    }
+}
+
+target "pkg-deb" {
+    name = elem("pkg-deb", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("pkg-deb", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    target = "package"
+    output = ["type=docker,compression=zstd,mode=min"]
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("debuild", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        debuild = elem("target:debuild", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    }
+}
+
+target "debuild" {
+    name = elem("debuild", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("debuild", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    target = "debuild"
+    dockerfile = "docker/Dockerfile.cargo.deb"
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("build-bins", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:build-bins", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    }
+    args = {
+        pkg_dir = "/opt/tuwunel/deb"
+    }
+}
+
 #
 # Unit tests
 #
@@ -485,11 +572,6 @@ target "tests-bench" {
        elem_tag("tests-bench", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
    target = "cargo"
-    output = ["type=docker,compression=zstd,mode=min"]
-    labels = {
-        "_group" = "tests"
-        "_cache" = "leaf"
-    }
    matrix = cargo_bench_matrix
    inherits = [
        elem("build-bench", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
@@ -509,11 +591,6 @@ target "tests-unit" {
        elem_tag("tests-unit", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
    target = "cargo"
-    output = ["type=docker,compression=zstd,mode=min"]
-    labels = {
-        "_group" = "tests"
-        "_cache" = "leaf"
-    }
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("build-tests", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
@@ -743,13 +820,9 @@ target "fmt" {
 target "cargo" {
    name = elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
    target = "cargo"
-    output = ["type=docker,compression=zstd,mode=min"]
+    output = ["type=cacheonly,compression=zstd,mode=min"]
    cache_to = ["type=local,compression=zstd,mode=min"]
    dockerfile = "docker/Dockerfile.cargo"
-    labels = {
-        "_group" = "cargo"
-        "_cache" = "trunk"
-    }
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
@@ -861,13 +934,9 @@ target "deps-base" {
        elem_tag("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest")
    ]
    target = "deps"
-    output = ["type=docker,compression=zstd,mode=min"]
+    output = ["type=cacheonly,compression=zstd,mode=min"]
    cache_to = ["type=local,compression=zstd,mode=min"]
    dockerfile = "docker/Dockerfile.cargo.deps"
-    labels = {
-        "_group" = "deps"
-        "_cache" = "trunk"
-    }
    matrix = cargo_rust_feat_sys
    inherits = [
        elem("recipe", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
@@ -893,7 +962,7 @@ target "rocksdb" {
        elem_tag("rocksdb", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
    target = "rocksdb"
-    output = ["type=docker,compression=zstd,mode=min"]
+    output = ["type=cacheonly,compression=zstd,mode=min"]
    matrix = rust_feat_sys
    inherits = [
        elem("rocksdb-build", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
@@ -934,10 +1003,6 @@ target "rocksdb-fetch" {
    ]
    target = "rocksdb-fetch"
    dockerfile = "docker/Dockerfile.rocksdb"
-    labels = {
-        "_group" = "rocksdb"
-        "_cache" = "trunk"
-    }
    matrix = rust_feat_sys
    inherits = [
        elem("recipe", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
@@ -968,7 +1033,7 @@ target "recipe" {
        elem_tag("recipe", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest")
    ]
    target =  "recipe"
-    output = ["type=docker,compression=zstd,mode=min"]
+    output = ["type=cacheonly,compression=zstd,mode=min"]
    matrix = rust_feat_sys
    inherits = [
        elem("preparing", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
@@ -1043,10 +1108,6 @@ target "source" {
    ]
    target =  "source"
    dockerfile = "docker/Dockerfile.ingredients"
-    labels = {
-        "_group" = "sources"
-        "_cache" = "trunk"
-    }
    matrix = feat_sys
    inherits = [
        elem("kitchen", [feat_set, sys_name, sys_version, sys_target])
@@ -1126,10 +1187,6 @@ target "kitchen" {
    ]
    target = "kitchen"
    dockerfile = "docker/Dockerfile.kitchen"
-    labels = {
-        "_group" = "buildsys"
-        "_cache" = "trunk"
-    }
    matrix = feat_sys
    inherits = [
        elem("diner", [feat_set, sys_name, sys_version, sys_target])
@@ -1211,7 +1268,6 @@ target "diner" {
        elem_tag("diner", [feat_set, sys_name, sys_version, sys_target], "latest"),
    ]
    target = "diner"
-    output = ["type=docker,compression=zstd,mode=min"]
    dockerfile = "docker/Dockerfile.diner"
    matrix = feat_sys
    variable "cargo_feat_set" {
@@ -1231,6 +1287,9 @@ target "diner" {
        var_lib_apt = "/var/lib/apt"
        var_cache = "/var/cache"
        packages = join(" ", [
+            "adduser",
+            "bzip2",
+            "gzip",
            contains(split(",", cargo_feat_sets[feat_set]), "io_uring")? "liburing2": "",
            contains(split(",", cargo_feat_sets[feat_set]), "zstd_compression")? "libzstd1": "",
            contains(split(",", cargo_feat_sets[feat_set]), "jemalloc")? "libjemalloc2": "",
@@ -1249,14 +1308,10 @@ target "system" {
        elem_tag("system", [sys_name, sys_version, sys_target], "latest"),
    ]
    target = "system"
-    output = ["type=docker,compression=zstd,mode=min"]
+    output = ["type=cacheonly,compression=zstd,mode=min"]
    cache_to = ["type=local,compression=zstd,mode=max"]
    cache_from = ["type=local"]
    dockerfile = "docker/Dockerfile.diner"
-    labels = {
-        "_group" = "systems"
-        "_cache" = "trunk"
-    }
    matrix = sys
    context = "."
    args = {
--- a/docker/bake.sh
+++ b/docker/bake.sh
@@ -9,9 +9,9 @@ CI_VERBOSE_ENV="${CI_VERBOSE_ENV:-$CI_VERBOSE}"
 CI_SILENT_BAKE="${CI_SILENT_BAKE:-false}"
 CI_PRINT_BAKE="${CI_PRINT_BAKE:-$CI_VERBOSE}"

-default_cargo_profiles='["test", "bench"]'
-default_feat_sets='["none", "default", "all"]'
-default_rust_toolchains='["nightly", "stable"]'
+default_cargo_profiles='["release"]'
+default_feat_sets='["all"]'
+default_rust_toolchains='["stable"]'
 default_rust_targets='["x86_64-unknown-linux-gnu"]'
 default_sys_names='["debian"]'
 default_sys_targets='["x86_64-linux-gnu"]'
@@ -79,6 +79,7 @@ if test "$CI" = "true"; then
 fi

 args=""
+args="$args --allow=network.host"
 args="$args --builder ${builder_name}"
 #args="$args --set *.platform=${sys_platform}"

--- a/docker/complement.sh
+++ b/docker/complement.sh
@@ -44,7 +44,7 @@ if test "$CI_VERBOSE_ENV" = "true"; then
 fi

 set -x -e
-cid=$(docker run -d $arg)
+cid=$(docker run $arg)
 set +x

 trap 'docker container stop $cid; set +x; date; echo -e "\033[1;41;37mFAIL\033[0m"' INT
--- a/docs/deploying/docker.md
+++ b/docs/deploying/docker.md
@@ -12,10 +12,10 @@ OCI images for tuwunel are available in the registries listed below.
 | Registry        | Image                                                           | Size                          | Notes                  |
 | --------------- | --------------------------------------------------------------- | ----------------------------- | ---------------------- |
 | GitHub Registry | [ghcr.io/jevolk/tuwunel:latest][gh] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
-| GitLab Registry | [registry.gitlab.com/tuwunel/tuwunel:latest][gl] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
+| GitLab Registry | [registry.gitlab.com/jevolk/tuwunel:latest][gl] | ![Image Size][shield-latest]  | Stable latest tagged image.          |
 | Docker Hub      | [docker.io/jevolk/tuwunel:latest][dh]             | ![Image Size][shield-latest]  | Stable latest tagged image.          |
 | GitHub Registry | [ghcr.io/jevolk/tuwunel:main][gh]   | ![Image Size][shield-main]    | Stable main branch.   |
-| GitLab Registry | [registry.gitlab.com/tuwunel/tuwunel:main][gl]   | ![Image Size][shield-main]    | Stable main branch.   |
+| GitLab Registry | [registry.gitlab.com/jevolk/tuwunel:main][gl]   | ![Image Size][shield-main]    | Stable main branch.   |
 | Docker Hub      | [docker.io/jevolk/tuwunel:main][dh]               | ![Image Size][shield-main]    | Stable main branch.   |

 [dh]: https://hub.docker.com/r/jevolk/tuwunel
@@ -42,8 +42,8 @@ When you have the image you can simply run it with
 ```bash
 docker run -d -p 8448:6167 \
    -v db:/var/lib/tuwunel/ \
-    -e tuwunel_SERVER_NAME="your.server.name" \
-    -e tuwunel_ALLOW_REGISTRATION=false \
+    -e TUWUNEL_SERVER_NAME="your.server.name" \
+    -e TUWUNEL_ALLOW_REGISTRATION=false \
    --name tuwunel $LINK
 ```

--- a/src/main/Cargo.toml
+++ b/src/main/Cargo.toml
@@ -30,7 +30,7 @@ systemd-units = { unit-name = "tuwunel", start = false }
 assets = [
 	["../../debian/README.md", "usr/share/doc/tuwunel/README.Debian", "644"],
 	["../../README.md", "usr/share/doc/tuwunel/", "644"],
-	["../../target/release/tuwunel", "usr/sbin/tuwunel", "755"],
+	["target/release/tuwunel", "usr/sbin/tuwunel", "755"],
 	["../../tuwunel-example.toml", "etc/tuwunel/tuwunel.toml", "640"],
 ]