Trigger reconcile webhook once build is done

Use reusable workflow
Clarified password env variable missing error
2025-04-23 21:00:02 +02:00 · 2025-04-23 14:08:42 +02:00 · 2025-04-22 10:47:18 +02:00 · 2025-04-22 00:42:56 +02:00 · 2025-04-22 00:42:33 +02:00 · 2025-04-21 03:22:34 +02:00
23 changed files with 1311 additions and 220 deletions
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@ -0,0 +1,2 @@
+[env]
+RUSTC_BOOTSTRAP = "1"
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,4 @@
+*
+!src
+!Cargo.*
+!.cargo/config.toml
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@ -7,80 +7,9 @@ on:
    tags:
      - v*.*.*

-env:
-  OCI_REPO: git.huizinga.dev/dreaded_x/${{ gitea.event.repository.name}}
-
 jobs:
  build:
-    name: Build container and manifests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+    uses: dreaded_x/workflows/.gitea/workflows/rust-kubernetes.yaml@66ab50c3ac239dbdd1e42e6276ec2e65b6a79379
    with:
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Get Git commit timestamps
-        run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
-
-      - name: Login to registry
-        uses: docker/login-action@v3
-        with:
-          registry: git.huizinga.dev
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Install kustomize
-        run: |
-          curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
-
-      - name: Setup Flux CLI
-        uses: https://github.com/fluxcd/flux2/action@main
-        with:
-          version: v2.5.0
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.OCI_REPO }}
-          tags: |
-            type=edge
-            type=ref,event=branch
-            type=semver,pattern=v{{version}}
-            type=semver,pattern=v{{major}}.{{minor}}
-            type=semver,pattern=v{{major}}
-
-      - name: Build container
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          sbom: true
-          provenance: mode=max
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-        env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-
-      - name: Kustomize manifests
-        run: |
-          ./kustomize build ./manifests | sed "s/\${DIGEST}/${{ steps.build.outputs.digest }}/" > ./manifests.yaml
-
-      - name: Push manifests
-        run: |
-          flux push artifact oci://$OCI_REPO/manifests:${{ gitea.head_ref || gitea.ref_name }} \
-            --path="./manifests.yaml" \
-            --source="$(git config --get remote.origin.url)" \
-            --revision="$(git rev-parse HEAD)" \
-            $(echo "${{ steps.meta.outputs.labels }}" | sed -e 's/^/-a /')
-
-          flux tag artifact oci://$OCI_REPO/manifests:${{ gitea.head_ref || gitea.ref_name }} \
-            $(echo "${{ steps.meta.outputs.tags }}" | sed -e 's/^.*:/--tag /')
+      webhook_url: ${{ secrets.WEBHOOK_URL }}
+    secrets: inherit
--- a/Cargo.lock
+++ b/Cargo.lock
@ -173,6 +173,60 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"

+[[package]]
+name = "axum"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de45108900e1f9b9242f7f2e254aa3e2c029c921c258fe9e6b4217eeebd54288"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.71"
@ -304,9 +358,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.17"
+version = "1.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fcb57c740ae1daf453ae85f16e37396f672b039e00d9d866e07ddb24e328e3a"
+checksum = "8e3a13707ac958681c13b39b458c073d0d9bc8a22cb1b2f4c8e55eb72c13f362"
 dependencies = [
 "shlex",
 ]
@ -360,9 +414,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.35"
+version = "4.5.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944"
+checksum = "2df961d8c8a0d08aa9945718ccf584145eee3f3aa06cddbeac12933781102e04"
 dependencies = [
 "clap_builder",
 "clap_derive",
@ -370,9 +424,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.5.35"
+version = "4.5.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9"
+checksum = "132dbda40fb6753878316a489d5a1242a8ef2f0d9e47ba01c951ea8aa7d013a5"
 dependencies = [
 "anstream",
 "anstyle",
@ -648,9 +702,9 @@ dependencies = [

 [[package]]
 name = "data-encoding"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "575f75dfd25738df5b91b8e43e14d44bda14637a58fae779fd2b064f8bf3e010"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"

 [[package]]
 name = "delegate"
@ -870,12 +924,12 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"

 [[package]]
 name = "flate2"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11faaf5a5236997af9848be0bef4db95824b1d534ebc64d0f0c6cf3e67bd38dc"
+checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
 dependencies = [
 "crc32fast",
- "miniz_oxide 0.8.5",
+ "miniz_oxide 0.8.8",
 ]

 [[package]]
@ -1090,9 +1144,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5017294ff4bb30944501348f6f8e42e6ad28f42c8bbef7a74029aff064a4e3c2"
+checksum = "75249d144030531f8dee69fe9cea04d3edf809a017ae445e2abdff6629e86633"
 dependencies = [
 "atomic-waker",
 "bytes",
@ -1107,6 +1161,12 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.2"
@ -1293,9 +1353,9 @@ dependencies = [

 [[package]]
 name = "iana-time-zone"
-version = "0.1.62"
+version = "0.1.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2fd658b06e56721792c5df4475705b6cda790e9298d19d2f8af083457bcd127"
+checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
 dependencies = [
 "android_system_properties",
 "core-foundation-sys",
@ -1303,7 +1363,7 @@ dependencies = [
 "js-sys",
 "log",
 "wasm-bindgen",
- "windows-core 0.52.0",
+ "windows-core 0.61.0",
 ]

 [[package]]
@ -1473,7 +1533,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
 dependencies = [
 "equivalent",
- "hashbrown",
+ "hashbrown 0.15.2",
 ]

 [[package]]
@ -1625,10 +1685,20 @@ dependencies = [
 ]

 [[package]]
-name = "libc"
-version = "0.2.171"
+name = "leon"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
+checksum = "42a865ffec5587961f5afc6d365bccb304f4feaa1928f4fe94c91c9d210d7310"
+dependencies = [
+ "miette",
+ "thiserror 2.0.12",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.172"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"

 [[package]]
 name = "libm"
@ -1644,9 +1714,9 @@ checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"

 [[package]]
 name = "linux-raw-sys"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe7db12097d22ec582439daf8618b8fdd1a7bef6270e9af3b1ebcd30893cf413"
+checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"

 [[package]]
 name = "litemap"
@ -1682,7 +1752,7 @@ version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 dependencies = [
- "hashbrown",
+ "hashbrown 0.15.2",
 ]

 [[package]]
@ -1694,6 +1764,12 @@ dependencies = [
 "regex-automata 0.1.10",
 ]

+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "md5"
 version = "0.7.0"
@ -1706,6 +1782,29 @@ version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"

+[[package]]
+name = "miette"
+version = "7.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a955165f87b37fd1862df2a59547ac542c77ef6d17c666f619d1ad22dd89484"
+dependencies = [
+ "cfg-if",
+ "miette-derive",
+ "thiserror 1.0.69",
+ "unicode-width 0.1.14",
+]
+
+[[package]]
+name = "miette-derive"
+version = "7.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf45bf44ab49be92fd1227a3be6fc6f617f1a337c06af54981048574d8783147"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@ -1729,9 +1828,9 @@ dependencies = [

 [[package]]
 name = "miniz_oxide"
-version = "0.8.5"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e3e04debbb59698c15bacbb6d93584a8c0ca9cc3213cb423d31f760d8843ce5"
+checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
 dependencies = [
 "adler2",
 ]
@ -2150,9 +2249,9 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
 "unicode-ident",
 ]
@ -2185,7 +2284,7 @@ checksum = "b820744eb4dc9b57a3398183639c511b5a26d2ed702cedd3febaa1393caa22cc"
 dependencies = [
 "bytes",
 "getrandom 0.3.2",
- "rand 0.9.0",
+ "rand 0.9.1",
 "ring",
 "rustc-hash",
 "rustls",
@ -2199,9 +2298,9 @@ dependencies = [

 [[package]]
 name = "quinn-udp"
-version = "0.5.10"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e46f3055866785f6b92bc6164b76be02ca8f2eb4b002c0354b28cf4c119e5944"
+checksum = "541d0f57c6ec747a90738a52741d3221f7960e8ac2f0ff4b1a63680e033b4ab5"
 dependencies = [
 "cfg_aliases",
 "libc",
@ -2239,13 +2338,12 @@ dependencies = [

 [[package]]
 name = "rand"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
 dependencies = [
 "rand_chacha 0.9.0",
 "rand_core 0.9.3",
- "zerocopy",
 ]

 [[package]]
@ -2309,9 +2407,9 @@ dependencies = [

 [[package]]
 name = "redox_syscall"
-version = "0.5.10"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b8c0c260b63a8219631167be35e6a988e9554dbd323f8bd08439c8ed1302bd1"
+checksum = "d2f103c6d277498fbceb16e84d317e2a400f160f46904d5f5410848c829511a3"
 dependencies = [
 "bitflags",
 ]
@ -2586,15 +2684,15 @@ dependencies = [
 "bitflags",
 "errno",
 "libc",
- "linux-raw-sys 0.9.3",
+ "linux-raw-sys 0.9.4",
 "windows-sys 0.59.0",
 ]

 [[package]]
 name = "rustls"
-version = "0.23.25"
+version = "0.23.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "822ee9188ac4ec04a2f0531e55d035fb2de73f18b41a63c70c2712503b6fb13c"
+checksum = "df51b5869f3a441595eac5e8ff14d486ff285f7b8c0df8770e49c3b56351f0f0"
 dependencies = [
 "once_cell",
 "ring",
@ -2764,6 +2862,16 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "serde_path_to_error"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59fab13f937fa393d08645bf3a84bdfe86e296747b506ada67bb15f10f218b2a"
+dependencies = [
+ "itoa",
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@ -2857,6 +2965,7 @@ dependencies = [
 name = "siranga"
 version = "0.0.0"
 dependencies = [
+ "axum",
 "bytes",
 "clap",
 "clio",
@ -2869,6 +2978,7 @@ dependencies = [
 "hyper",
 "hyper-util",
 "ldap3",
+ "leon",
 "pin-project-lite",
 "rand 0.8.5",
 "ratatui",
@ -2876,6 +2986,7 @@ dependencies = [
 "russh",
 "thiserror 2.0.12",
 "tokio",
+ "tokio-util",
 "tracing",
 "tracing-subscriber",
 "unicode-width 0.2.0",
@ -2892,9 +3003,9 @@ dependencies = [

 [[package]]
 name = "smallvec"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
+checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"

 [[package]]
 name = "socket2"
@ -3206,6 +3317,8 @@ dependencies = [
 "bytes",
 "futures-core",
 "futures-sink",
+ "futures-util",
+ "hashbrown 0.14.5",
 "pin-project-lite",
 "tokio",
 ]
@ -3223,6 +3336,7 @@ dependencies = [
 "tokio",
 "tower-layer",
 "tower-service",
+ "tracing",
 ]

 [[package]]
@ -3243,6 +3357,7 @@ version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
+ "log",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@ -3608,24 +3723,28 @@ dependencies = [

 [[package]]
 name = "windows-core"
-version = "0.52.0"
+version = "0.58.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
 dependencies = [
+ "windows-implement 0.58.0",
+ "windows-interface 0.58.0",
+ "windows-result 0.2.0",
+ "windows-strings 0.1.0",
 "windows-targets 0.52.6",
 ]

 [[package]]
 name = "windows-core"
-version = "0.58.0"
+version = "0.61.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
+checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
 dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-result 0.2.0",
- "windows-strings 0.1.0",
- "windows-targets 0.52.6",
+ "windows-implement 0.60.0",
+ "windows-interface 0.59.1",
+ "windows-link",
+ "windows-result 0.3.2",
+ "windows-strings 0.4.0",
 ]

 [[package]]
@ -3639,6 +3758,17 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "windows-implement"
+version = "0.60.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "windows-interface"
 version = "0.58.0"
@ -3650,6 +3780,17 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "windows-interface"
+version = "0.59.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.1.1"
@ -3704,6 +3845,15 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "windows-strings"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.42.0"
--- a/Cargo.toml
+++ b/Cargo.toml
@ -2,8 +2,10 @@
 name = "siranga"
 edition = "2024"
 default-run = "siranga"
+license = "AGPL-3.0-only"

 [dependencies]
+axum = "0.8.3"
 bytes = "1.10.1"
 clap = { version = "4.5.35", features = ["derive"] }
 clio = { version = "0.3.5", features = ["clap-parse"] }
@ -16,6 +18,7 @@ http-body-util = { version = "0.1.3", features = ["full"] }
 hyper = { version = "1.6.0", features = ["full"] }
 hyper-util = { version = "0.1.11", features = ["full"] }
 ldap3 = "0.11.5"
+leon = "3.0.2"
 pin-project-lite = "0.2.16"
 rand = "0.8.5"
 ratatui = { version = "0.29.0", features = ["unstable-backend-writer"] }
@ -23,6 +26,7 @@ reqwest = { version = "0.12.15", features = ["rustls-tls"] }
 russh = "0.51.1"
 thiserror = "2.0.12"
 tokio = { version = "1.44.2", features = ["full"] }
+tokio-util = { version = "0.7.14", features = ["rt"] }
 tracing = "0.1.41"
 tracing-subscriber = { version = "0.3.19", features = ["json", "env-filter"] }
 unicode-width = "0.2.0"
--- a/5
+++ b/5
@ -1,4 +1,4 @@
-FROM rust:1.85 AS base
+FROM rust:1.86 AS base
 ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
 RUN cargo install cargo-chef --locked --version 0.1.71 && \
    cargo install cargo-auditable --locked --version 0.6.6
@ -14,7 +14,8 @@ ENV RUSTC_BOOTSTRAP=1
 RUN cargo chef cook --release --recipe-path recipe.json

 COPY . .
-ENV RUSTC_BOOTSTRAP=1
+ARG RELEASE_VERSION
+ENV RELEASE_VERSION=${RELEASE_VERSION}
 RUN cargo auditable build --release

 FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
--- a/661
+++ b/661
@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
--- a/README.md
+++ b/README.md
@ -29,7 +29,7 @@ This deployment runs in a cluster with [Authelia](https://github.com/authelia/au
 A tunnel can be opened using the following command:

 ```
-ssh <username>@<host> [-p <ssh port>] -t -R <local port>:localhost:<local port>
+ssh <username>@<host> [-p <ssh port>] -tq -R <local port>:localhost:<local port>
 ```

 This will open a new tunnel with a randomly generated name, you can specify a name for the tunnel by instead using `-R <name>:<local port>:localhost:<local port>`.
@ -48,6 +48,7 @@ Host tunnel
    Port <ssh port>
    User <username>
    RequestTTY yes
+    LogLevel QUIET
 ```

 You can now connect with `ssh tunnel -R <local port>:localhost:<local port>`.
--- a/helper/k8s.yaml
+++ b/helper/k8s.yaml
@ -1,10 +1,7 @@
-apiVersion: v1
-kind: ConfigMap
+apiVersion: authelia.huizinga.dev/v1
+kind: AccessControlRule
 metadata:
-  name: authelia-acl
-  annotations:
-    config.huizinga.dev/fragment: authelia-acl
-data:
-  rules: |
-    - domain: "*.tunnel.huizinga.dev"
+  name: tunnel-dev
+spec:
+  domain: "*.tunnel.huizinga.dev"
  policy: one_factor
--- a/manifests/deployment.yaml
+++ b/manifests/deployment.yaml
@ -31,8 +31,12 @@ spec:
              cpu: 50m
              memory: 100Mi
          ports:
-            - containerPort: 3000
-            - containerPort: 2222
+            - name: ssh
+              containerPort: 2222
+            - name: http
+              containerPort: 3000
+            - name: metrics
+              containerPort: 4000
          volumeMounts:
            - name: credentials
              readOnly: true
@ -51,12 +55,23 @@ spec:
              value: ldap://lldap.lldap.svc.cluster.local:3890
            - name: LDAP_BASE
              value: ou=people,dc=huizinga,dc=dev
+            - name: LDAP_SEARCH_FILTER
+              value: (uid={username})
            - name: LDAP_BIND_DN
-              value: uid=siranga.siranga,ou=people,dc=huizinga,dc=dev
+              valueFrom:
+                secretKeyRef:
+                  name: siranga-lldap-credentials
+                  key: bind_dn
            - name: LDAP_PASSWORD_FILE
              value: /secrets/credentials/password
            - name: PRIVATE_KEY_FILE
              value: /secrets/key/private.pem
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: metrics
+            initialDelaySeconds: 3
+            periodSeconds: 3
      volumes:
        - name: credentials
          secret:
--- a/manifests/service.yaml
+++ b/manifests/service.yaml
@ -6,6 +6,7 @@ spec:
  ports:
    - name: http
      port: 3000
+      targetPort: http
  selector:
    app: siranga
 ---
@ -20,6 +21,6 @@ spec:
  ports:
    - name: ssh
      port: 22
-      targetPort: 2222
+      targetPort: ssh
  selector:
    app: siranga
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.86"
+profile = "default"
+components = ["rust-analyzer"]
--- a/src/io/stats.rs
+++ b/src/io/stats.rs
@ -1,6 +1,6 @@
 use std::pin::Pin;
 use std::sync::Arc;
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use std::task::{Context, Poll};

 use pin_project_lite::pin_project;
@ -14,6 +14,7 @@ pub struct Stats {
    connections: AtomicUsize,
    rx: AtomicUsize,
    tx: AtomicUsize,
+    failed: AtomicBool,
 }

 impl Stats {
@ -33,6 +34,14 @@ impl Stats {
        self.connections.load(Ordering::Relaxed)
    }

+    pub fn failed(&self) -> bool {
+        self.failed.load(Ordering::Relaxed)
+    }
+
+    pub fn set_failed(&self, failed: bool) {
+        self.failed.store(failed, Ordering::Relaxed);
+    }
+
    pub fn rx(&self) -> Unit {
        Unit::new(self.rx.load(Ordering::Relaxed), "B")
    }
--- a/src/ldap.rs
+++ b/src/ldap.rs
@ -1,10 +1,16 @@
 use ldap3::{LdapConnAsync, SearchEntry};
+use leon::{Template, vals};
 use russh::keys::PublicKey;
+use tokio::select;
+use tokio::task::JoinHandle;
+use tokio_util::sync::CancellationToken;
+use tracing::{debug, error};

 #[derive(Debug, Clone)]
 pub struct Ldap {
    base: String,
    ldap: ldap3::Ldap,
+    search_filter: String,
 }

 #[derive(Debug, thiserror::Error)]
@ -17,21 +23,30 @@ pub enum LdapError {
    MissingEnvironmentVariable(&'static str),
    #[error("Could not read password file: {0}")]
    CouldNotReadPasswordFile(#[from] std::io::Error),
+    #[error("Failed to parse search filter: {0}")]
+    FailedToParseSearchFilter(#[from] leon::ParseError),
+    #[error("Failed to render search filter: {0}")]
+    FailedToRenderSearchFilter(#[from] leon::RenderError),
 }

 impl Ldap {
-    pub async fn start_from_env() -> Result<Ldap, LdapError> {
+    pub async fn start_from_env(
+        token: CancellationToken,
+    ) -> Result<(Ldap, JoinHandle<()>), LdapError> {
        let address = std::env::var("LDAP_ADDRESS")
            .map_err(|_| LdapError::MissingEnvironmentVariable("LDAP_ADDRESS"))?;
        let base = std::env::var("LDAP_BASE")
            .map_err(|_| LdapError::MissingEnvironmentVariable("LDAP_BASE"))?;
        let bind_dn = std::env::var("LDAP_BIND_DN")
            .map_err(|_| LdapError::MissingEnvironmentVariable("LDAP_BIND_DN"))?;
+        let search_filter = std::env::var("LDAP_SEARCH_FILTER")
+            .map_err(|_| LdapError::MissingEnvironmentVariable("LDAP_SEARCH_FILTER"))?;

        let password = std::env::var("LDAP_PASSWORD_FILE").map_or_else(
            |_| {
-                std::env::var("LDAP_PASSWORD")
-                    .map_err(|_| LdapError::MissingEnvironmentVariable("LDAP_PASSWORD"))
+                std::env::var("LDAP_PASSWORD").map_err(|_| {
+                    LdapError::MissingEnvironmentVariable("LDAP_PASSWORD or LDAP_PASSWORD_FILE")
+                })
            },
            |path| {
                std::fs::read_to_string(path)
@ -41,24 +56,57 @@ impl Ldap {
        )?;

        let (conn, mut ldap) = LdapConnAsync::new(&address).await?;
-        ldap3::drive!(conn);
+        let handle = tokio::spawn(async move {
+            select! {
+                res = conn.drive() => {
+                    if let Err(err) = res {
+                        error!("LDAP connection error: {}", err);
+                    } else {
+                        error!("LDAP connection lost");
+                        token.cancel();
+                    }
+                }
+                _ = token.cancelled() => {
+                    debug!("Graceful shutdown");
+                }
+            }
+        });

        ldap.simple_bind(&bind_dn, &password).await?.success()?;

-        Ok(Self { base, ldap })
+        Ok((
+            Self {
+                base,
+                ldap,
+                search_filter,
+            },
+            handle,
+        ))
    }

    pub async fn get_ssh_keys(
        &mut self,
        user: impl AsRef<str>,
    ) -> Result<Vec<PublicKey>, LdapError> {
+        let search_filter = Template::parse(&self.search_filter)?;
+
+        let search_filter = search_filter.render(&&vals(|key| {
+            if key == "username" {
+                Some(user.as_ref().to_string().into())
+            } else {
+                None
+            }
+        }))?;
+
+        debug!("search_filter = {search_filter}");
+
        Ok(self
            .ldap
            .search(
                &self.base,
                ldap3::Scope::Subtree,
                // TODO: Make this not hardcoded
-                &format!("(uid={})", user.as_ref()),
+                &search_filter,
                vec!["sshkeys"],
            )
            .await?
--- a/src/lib.rs
+++ b/src/lib.rs
@ -1,8 +1,12 @@
 #![feature(let_chains)]
 #![feature(iter_intersperse)]
+#![feature(future_join)]
 mod helper;
 mod io;
 pub mod ldap;
 pub mod ssh;
 pub mod tunnel;
+mod version;
 pub mod web;
+
+pub use version::VERSION;
--- a/src/main.rs
+++ b/src/main.rs
@ -1,22 +1,65 @@
+#![feature(future_join)]
+use std::future::join;
 use std::net::SocketAddr;
 use std::path::Path;
+use std::time::Duration;

+use axum::routing::get;
+use axum::{Json, Router};
 use color_eyre::eyre::Context;
 use dotenvy::dotenv;
-use git_version::git_version;
-use hyper::server::conn::http1::{self};
-use hyper_util::rt::TokioIo;
 use rand::rngs::OsRng;
+use siranga::VERSION;
 use siranga::ldap::Ldap;
 use siranga::ssh::Server;
 use siranga::tunnel::Registry;
 use siranga::web::{ForwardAuth, Service};
 use tokio::net::TcpListener;
-use tracing::{error, info, warn};
+use tokio::select;
+use tokio_util::sync::CancellationToken;
+use tracing::{debug, error, info, warn};
 use tracing_subscriber::EnvFilter;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;

+#[cfg(unix)]
+async fn sigterm() {
+    use tokio::signal::unix::SignalKind;
+
+    let mut sigterm =
+        tokio::signal::unix::signal(SignalKind::terminate()).expect("should be able to initialize");
+    sigterm.recv().await;
+}
+
+#[cfg(not(unix))]
+async fn sigterm() {
+    std::future::pending::<()>().await;
+}
+
+async fn shutdown_task(token: CancellationToken) {
+    select! {
+        _ = tokio::signal::ctrl_c() => {
+            debug!("Received SIGINT");
+        }
+        _ = sigterm() => {
+            debug!("Received SIGTERM");
+        }
+        _ = token.cancelled() => {
+            debug!("Application called for graceful shutdown");
+        }
+    }
+    info!("Starting graceful shutdown");
+    token.cancel();
+    select! {
+        _ = tokio::time::sleep(Duration::from_secs(5)) => {}
+        _ = tokio::signal::ctrl_c() => {}
+    }
+}
+
+async fn axum_graceful_shutdown(token: CancellationToken) {
+    token.cancelled().await;
+}
+
 #[tokio::main]
 async fn main() -> color_eyre::Result<()> {
    color_eyre::install()?;
@ -38,11 +81,7 @@ async fn main() -> color_eyre::Result<()> {
            .init();
    }

-    info!(
-        "Starting {} ({})",
-        std::env!("CARGO_PKG_NAME"),
-        git_version!(),
-    );
+    info!(version = VERSION, "Starting",);

    let key = if let Ok(path) = std::env::var("PRIVATE_KEY_FILE") {
        russh::keys::PrivateKey::read_openssh_file(Path::new(&path))
@ -52,46 +91,56 @@ async fn main() -> color_eyre::Result<()> {
        russh::keys::PrivateKey::random(&mut OsRng, russh::keys::Algorithm::Ed25519)?
    };

-    let http_port = std::env::var("HTTP_PORT")
-        .map(|port| port.parse().wrap_err_with(|| format!("HTTP_PORT={port}")))
-        .unwrap_or(Ok(3000))?;
    let ssh_port = std::env::var("SSH_PORT")
        .map(|port| port.parse().wrap_err_with(|| format!("SSH_PORT={port}")))
        .unwrap_or(Ok(2222))?;
+    let http_port = std::env::var("HTTP_PORT")
+        .map(|port| port.parse().wrap_err_with(|| format!("HTTP_PORT={port}")))
+        .unwrap_or(Ok(3000))?;
+    let metrics_port = std::env::var("METRICS_PORT")
+        .map(|port| {
+            port.parse()
+                .wrap_err_with(|| format!("METRICS_PORT={port}"))
+        })
+        .unwrap_or(Ok(4000))?;

    let domain =
        std::env::var("TUNNEL_DOMAIN").unwrap_or_else(|_| format!("localhost:{http_port}"));
    let authz_address = std::env::var("AUTHZ_ENDPOINT").wrap_err("AUTHZ_ENDPOINT is not set")?;

-    let ldap = Ldap::start_from_env().await?;
    let registry = Registry::new(domain);
-    let mut ssh = Server::new(ldap, registry.clone());
-    let addr = SocketAddr::from(([0, 0, 0, 0], ssh_port));
-    tokio::spawn(async move { ssh.run(key, addr).await });
-    info!("SSH is available on {addr}");
+
+    let token = CancellationToken::new();
+
+    let (ldap, ldap_handle) = Ldap::start_from_env(token.clone()).await?;
+
+    let ssh = Server::new(ldap, registry.clone(), token.clone());
+    let ssh_addr = SocketAddr::from(([0, 0, 0, 0], ssh_port));
+    let ssh_task = ssh.run(key, ssh_addr);
+    info!("SSH is available on {ssh_addr}");

    let auth = ForwardAuth::new(authz_address);
    let service = Service::new(registry, auth);
-    let addr = SocketAddr::from(([0, 0, 0, 0], http_port));
-    let listener = TcpListener::bind(addr).await?;
-    info!("HTTP is available on {addr}");
+    let http_addr = SocketAddr::from(([0, 0, 0, 0], http_port));
+    let http_listener = TcpListener::bind(http_addr).await?;
+    let http_task = service.serve(http_listener, token.clone());
+    info!("HTTP is available on {http_addr}");

-    // TODO: Graceful shutdown
-    loop {
-        let (stream, _) = listener.accept().await?;
-        let io = TokioIo::new(stream);
+    let metrics_app = Router::new().route("/health", get(async || Json("healthy")));
+    let metrics_addr = SocketAddr::from(([0, 0, 0, 0], metrics_port));
+    let metrics_listener = TcpListener::bind(metrics_addr).await?;
+    let metrics = axum::serve(metrics_listener, metrics_app)
+        .with_graceful_shutdown(axum_graceful_shutdown(token.clone()));
+    info!("Metrics are available on {http_addr}");

-        let service = service.clone();
-        tokio::spawn(async move {
-            if let Err(err) = http1::Builder::new()
-                .preserve_header_case(true)
-                .title_case_headers(true)
-                .serve_connection(io, service)
-                .with_upgrades()
-                .await
-            {
-                error!("Failed to serve connection: {err:?}");
+    select! {
+        _ = join!(ldap_handle, ssh_task, http_task, metrics.into_future()) => {
+            info!("Shutdown gracefully");
        }
-        });
+        _ = shutdown_task(token.clone()) => {
+            error!("Failed to shutdown gracefully");
        }
+    };
+
+    Ok(())
 }
--- a/src/ssh/handler.rs
+++ b/src/ssh/handler.rs
@ -2,22 +2,24 @@ use std::cmp::min;
 use std::iter::once;

 use clap::Parser;
-use git_version::git_version;
 use ratatui::layout::Rect;
 use ratatui::prelude::CrosstermBackend;
 use ratatui::{Terminal, TerminalOptions, Viewport};
 use russh::ChannelId;
 use russh::keys::ssh_key::PublicKey;
 use russh::server::{Auth, Msg, Session};
+use tokio_util::sync::CancellationToken;
 use tracing::{debug, trace, warn};

+use super::renderer::Renderer;
+use crate::VERSION;
 use crate::io::{Input, TerminalHandle};
 use crate::ldap::{Ldap, LdapError};
 use crate::tunnel::{Registry, Tunnel, TunnelAccess};

 /// Quickly create http tunnels for development
 #[derive(Parser, Debug)]
-#[command(version = git_version!(), about, long_about = None)]
+#[command(version = VERSION, about, long_about = None)]
 pub struct Args {
    /// Make all tunnels public by default instead of private
    #[arg(long, group = "access")]
@ -62,7 +64,7 @@ pub struct Handler {
 }

 impl Handler {
-    pub fn new(ldap: Ldap, registry: Registry) -> Self {
+    pub fn new(ldap: Ldap, registry: Registry, token: CancellationToken) -> Self {
        Self {
            ldap,
            registry,
@ -70,7 +72,7 @@ impl Handler {
            user: None,
            pty_channel: None,

-            renderer: Default::default(),
+            renderer: Renderer::new(token),
            selected: None,
            rename_input: None,
        }
@ -328,6 +330,26 @@ impl russh::server::Handler for Handler {
        Ok(session.channel_success(channel)?)
    }

+    async fn channel_close(
+        &mut self,
+        channel: ChannelId,
+        session: &mut Session,
+    ) -> Result<(), Self::Error> {
+        if let Some(pty_channel) = self.pty_channel
+            && pty_channel == channel
+        {
+            debug!("Pty channel closed");
+
+            session.disconnect(
+                russh::Disconnect::ByApplication,
+                "Remaining active connections have been closed",
+                "EN",
+            )?;
+        }
+
+        Ok(())
+    }
+
    async fn tcpip_forward(
        &mut self,
        address: &str,
--- a/src/ssh/mod.rs
+++ b/src/ssh/mod.rs
@ -11,7 +11,9 @@ use russh::MethodKind;
 use russh::keys::PrivateKey;
 use russh::server::Server as _;
 use tokio::net::ToSocketAddrs;
-use tracing::{debug, warn};
+use tokio::select;
+use tokio_util::sync::CancellationToken;
+use tracing::{debug, error, warn};

 use crate::ldap::Ldap;
 use crate::tunnel::Registry;
@ -19,18 +21,30 @@ use crate::tunnel::Registry;
 pub struct Server {
    ldap: Ldap,
    registry: Registry,
+    token: CancellationToken,
+}
+
+async fn graceful_shutdown(token: CancellationToken) {
+    token.cancelled().await;
+    let duration = 1;
+    // All pty sessions will close once the token is cancelled, but to properly allow the sessions
+    // to close the ssh server still needs to be driven, so we let it run a little bit longer.
+    // TODO: Figure out a way to wait for all connections to be closed, would require also closing
+    // non-pty sessions somehow
+    debug!("Waiting for {duration}s before stopping");
+    tokio::time::sleep(Duration::from_secs(duration)).await;
 }

 impl Server {
-    pub fn new(ldap: Ldap, registry: Registry) -> Self {
-        Server { ldap, registry }
+    pub fn new(ldap: Ldap, registry: Registry, token: CancellationToken) -> Self {
+        Server {
+            ldap,
+            registry,
+            token,
+        }
    }

-    pub fn run(
-        &mut self,
-        key: PrivateKey,
-        addr: impl ToSocketAddrs + Send + std::fmt::Debug,
-    ) -> impl Future<Output = Result<(), std::io::Error>> + Send {
+    pub async fn run(mut self, key: PrivateKey, addr: impl ToSocketAddrs + Send + std::fmt::Debug) {
        let config = russh::server::Config {
            inactivity_timeout: Some(Duration::from_secs(3600)),
            auth_rejection_time: Duration::from_secs(1),
@ -47,7 +61,17 @@ impl Server {

        debug!(?addr, "Running ssh");

-        async move { self.run_on_address(config, addr).await }
+        let token = self.token.clone();
+        select! {
+            res = self.run_on_address(config, addr) => {
+                if let Err(err) = res {
+                    error!("SSH Server error: {err}");
+                }
+            }
+            _ = graceful_shutdown(token) => {
+                debug!("Graceful shutdown");
+            }
+        }
    }
 }

@ -55,7 +79,7 @@ impl russh::server::Server for Server {
    type Handler = Handler;

    fn new_client(&mut self, _peer_addr: Option<SocketAddr>) -> Self::Handler {
-        Handler::new(self.ldap.clone(), self.registry.clone())
+        Handler::new(self.ldap.clone(), self.registry.clone(), self.token.clone())
    }

    fn handle_session_error(&mut self, error: <Self::Handler as russh::server::Handler>::Error) {
--- a/src/ssh/renderer.rs
+++ b/src/ssh/renderer.rs
@ -4,7 +4,6 @@ use std::iter::once;
 use std::time::Duration;

 use futures::StreamExt;
-use git_version::git_version;
 use ratatui::layout::{Constraint, Flex, Layout, Position, Rect};
 use ratatui::prelude::CrosstermBackend;
 use ratatui::style::{Style, Stylize as _};
@ -15,9 +14,11 @@ use ratatui::widgets::{
 use ratatui::{Frame, Terminal};
 use tokio::select;
 use tokio::sync::mpsc::{UnboundedReceiver, UnboundedSender, unbounded_channel};
-use tracing::error;
+use tokio_util::sync::CancellationToken;
+use tracing::{debug, error};
 use unicode_width::UnicodeWidthStr;

+use crate::VERSION;
 use crate::io::TerminalHandle;
 use crate::tunnel::{Tunnel, TunnelRow};

@ -36,6 +37,8 @@ struct RendererInner {
    rows: Vec<TunnelRow>,
    input: Option<String>,
    rx: UnboundedReceiver<Message>,
+
+    token: CancellationToken,
 }

 fn compute_widths(rows: &Vec<Vec<Span<'static>>>) -> Vec<u16> {
@ -75,12 +78,13 @@ fn compute_column_skip(
 }

 impl RendererInner {
-    fn new(rx: UnboundedReceiver<Message>) -> Self {
+    fn new(rx: UnboundedReceiver<Message>, token: CancellationToken) -> Self {
        Self {
            state: Default::default(),
            rows: Default::default(),
            input: None,
            rx,
+            token,
        }
    }

@ -165,7 +169,7 @@ impl RendererInner {
    }

    fn render_title(&self, frame: &mut Frame, rect: Rect) {
-        let title = format!("{} ({})", std::env!("CARGO_PKG_NAME"), git_version!()).bold();
+        let title = format!("{} ({})", std::env!("CARGO_PKG_NAME"), VERSION).bold();
        let title = Line::from(title).centered();
        frame.render_widget(title, rect);
    }
@ -303,6 +307,10 @@ impl RendererInner {
                        self.render(frame);
                    })?;
                }
+                _ = self.token.cancelled() => {
+                    debug!("Graceful shutdown");
+                    break;
+                }
            }
        }

@ -310,16 +318,24 @@ impl RendererInner {
    }
 }

-#[derive(Debug, Default, Clone)]
+#[derive(Debug, Clone)]
 pub struct Renderer {
    tx: Option<UnboundedSender<Message>>,
+    token: CancellationToken,
 }

 impl Renderer {
+    pub fn new(token: CancellationToken) -> Self {
+        Self {
+            tx: Default::default(),
+            token,
+        }
+    }
+
    pub fn start(&mut self, terminal: Terminal<CrosstermBackend<TerminalHandle>>) {
        let (tx, rx) = unbounded_channel();

-        let mut inner = RendererInner::new(rx);
+        let mut inner = RendererInner::new(rx, self.token.clone());

        tokio::spawn(async move {
            if let Err(err) = inner.start(terminal).await {
--- a/src/tunnel/mod.rs
+++ b/src/tunnel/mod.rs
@ -40,7 +40,12 @@ impl TunnelInner {
                &self.internal_address,
                self.port,
            )
-            .await?;
+            .await
+            .inspect_err(|_| {
+                self.stats.set_failed(true);
+            })?;
+
+        self.stats.set_failed(false);

        Ok(TrackStats::new(channel.into_stream(), self.stats.clone()))
    }
--- a/src/tunnel/tui.rs
+++ b/src/tunnel/tui.rs
@ -17,9 +17,15 @@ pub struct TunnelRow {

 impl From<&TunnelRow> for Vec<Span<'static>> {
    fn from(row: &TunnelRow) -> Self {
+        let port = if row.stats.failed() {
+            row.port.clone().red()
+        } else {
+            row.port.clone()
+        };
+
        vec![
            row.name.clone(),
-            row.port.clone(),
+            port,
            row.access.clone(),
            row.address.clone(),
            row.stats.connections().to_string().into(),
--- a/src/version.rs
+++ b/src/version.rs
@ -0,0 +1,11 @@
+pub const VERSION: &str = get_version();
+
+const fn get_version() -> &'static str {
+    if let Some(version) = std::option_env!("RELEASE_VERSION")
+        && !version.is_empty()
+    {
+        version
+    } else {
+        git_version::git_version!(fallback = "unknown")
+    }
+}
--- a/src/web/mod.rs
+++ b/src/web/mod.rs
@ -10,10 +10,14 @@ use bytes::Bytes;
 use http_body_util::combinators::BoxBody;
 use http_body_util::{BodyExt as _, Empty};
 use hyper::body::Incoming;
-use hyper::client::conn::http1::Builder;
-use hyper::header::{self, HOST};
-use hyper::{Request, Response, StatusCode};
+use hyper::header::{self, HOST, UPGRADE};
+use hyper::{Request, Response, StatusCode, client, server};
+use hyper_util::rt::TokioIo;
 use response::response;
+use tokio::net::TcpListener;
+use tokio::select;
+use tokio_util::sync::CancellationToken;
+use tokio_util::task::TaskTracker;
 use tracing::{debug, error, trace, warn};

 use crate::tunnel::{Registry, TunnelAccess};
@ -22,11 +26,83 @@ use crate::tunnel::{Registry, TunnelAccess};
 pub struct Service {
    registry: Registry,
    auth: ForwardAuth,
+    task_tracker: TaskTracker,
+}
+
+pub fn empty() -> BoxBody<Bytes, hyper::Error> {
+    Empty::<Bytes>::new()
+        .map_err(|never| match never {})
+        .boxed()
+}
+
+fn copy_request_parts<T>(req: Request<T>) -> (Request<T>, Request<BoxBody<Bytes, hyper::Error>>) {
+    let (parts, body) = req.into_parts();
+    let req = Request::from_parts(parts.clone(), body);
+    let forwarded_req = Request::from_parts(parts, empty());
+
+    (req, forwarded_req)
+}
+
+fn copy_response_parts<T>(
+    resp: Response<T>,
+) -> (Response<T>, Response<BoxBody<Bytes, hyper::Error>>) {
+    let (parts, body) = resp.into_parts();
+    let resp = Response::from_parts(parts.clone(), body);
+    let forwarded_resp = Response::from_parts(parts, empty());
+
+    (resp, forwarded_resp)
 }

 impl Service {
    pub fn new(registry: Registry, auth: ForwardAuth) -> Self {
-        Self { registry, auth }
+        Self {
+            registry,
+            auth,
+            task_tracker: Default::default(),
+        }
+    }
+
+    pub async fn handle_connection(&self, listener: &TcpListener) -> std::io::Result<()> {
+        let (stream, _) = listener.accept().await?;
+
+        let io = TokioIo::new(stream);
+        let connection = server::conn::http1::Builder::new()
+            .preserve_header_case(true)
+            .title_case_headers(true)
+            .serve_connection(io, self.clone())
+            .with_upgrades();
+
+        self.task_tracker.spawn(async move {
+            if let Err(err) = connection.await {
+                error!("Failed to serve connection: {err:?}");
+            }
+        });
+
+        Ok(())
+    }
+
+    pub async fn serve(self, listener: TcpListener, token: CancellationToken) {
+        loop {
+            select! {
+                res = self.handle_connection(&listener) => {
+                    if let Err(err) = res {
+                        error!("Failed to accept connection: {err}")
+                    }
+                }
+                _ = token.cancelled() => {
+                    break;
+                }
+            }
+        }
+
+        debug!(
+            "Waiting for {} connections to close",
+            self.task_tracker.len()
+        );
+        self.task_tracker.close();
+        self.task_tracker.wait().await;
+
+        debug!("Graceful shutdown");
    }
 }

@ -59,10 +135,9 @@ impl hyper::service::Service<Request<Incoming>> for Service {

        debug!(authority, "Tunnel request");

-        let registry = self.registry.clone();
-        let auth = self.auth.clone();
+        let s = self.clone();
        Box::pin(async move {
-            let Some(entry) = registry.get(&authority).await else {
+            let Some(entry) = s.registry.get(&authority).await else {
                debug!(tunnel = authority, "Unknown tunnel");
                let resp = response(StatusCode::NOT_FOUND, "Unknown tunnel");

@ -70,7 +145,7 @@ impl hyper::service::Service<Request<Incoming>> for Service {
            };

            if !entry.is_public().await {
-                let user = match auth.check(req.method(), req.headers()).await {
+                let user = match s.auth.check(req.method(), req.headers()).await {
                    Ok(AuthStatus::Authenticated(user)) => user,
                    Ok(AuthStatus::Unauthenticated(location)) => {
                        let resp = Response::builder()
@ -129,19 +204,72 @@ impl hyper::service::Service<Request<Incoming>> for Service {
                }
            };

-            let (mut sender, conn) = Builder::new()
+            let (mut sender, conn) = client::conn::http1::Builder::new()
                .preserve_header_case(true)
                .title_case_headers(true)
                .handshake(io)
                .await?;

-            tokio::spawn(async move {
+            let conn = conn.with_upgrades();
+            s.task_tracker.spawn(async move {
                if let Err(err) = conn.await {
                    warn!(runnel = authority, "Connection failed: {err}");
                }
            });

-            let resp = sender.send_request(req).await?;
+            let (mut req, forwarded_req) = copy_request_parts(req);
+
+            let resp = sender.send_request(forwarded_req).await?;
+
+            if req.headers().contains_key(UPGRADE)
+                && req.headers().get(UPGRADE) == resp.headers().get(UPGRADE)
+            {
+                let (mut resp, forwarded_resp) = copy_response_parts(resp);
+
+                debug!("UPGRADE established");
+                match hyper::upgrade::on(&mut resp).await {
+                    Ok(upgraded_resp) => {
+                        s.task_tracker.spawn(async move {
+                            match hyper::upgrade::on(&mut req).await {
+                                Ok(upgraded_req) => {
+                                    let mut upgraded_req = TokioIo::new(upgraded_req);
+                                    let mut upgraded_resp = TokioIo::new(upgraded_resp);
+
+                                    match tokio::io::copy_bidirectional(
+                                        &mut upgraded_req,
+                                        &mut upgraded_resp,
+                                    )
+                                    .await
+                                    {
+                                        Ok((rx, tx)) => {
+                                            debug!(
+                                                "Received {rx} bytes and send {tx} bytes over upgraded tunnel"
+                                            );
+                                        }
+                                        Err(err) => {
+                                            // Likely due to channel being closed
+                                            // TODO: Show warning if not channel closed, otherwise ignore
+                                            debug!("Upgraded connection error: {err:?}");
+                                        }
+                                    }
+                                }
+                                Err(err) => {
+                                    error!("Failed to upgrade: {err}");
+                                }
+                            }
+                        });
+
+                        return Ok(forwarded_resp.map(|b| b.boxed()));
+                    }
+                    Err(err) => {
+                        error!("Failed to upgrade req: {err}");
+                        return Ok(response(StatusCode::BAD_REQUEST, "Failed to upgrade"));
+                    }
+                }
+            }
+
+            trace!("{resp:#?}");
+
            Ok(resp.map(|b| b.boxed()))
        })
    }
Author	SHA1	Message	Date
Dreaded_X	3c29377013	Trigger reconcile webhook once build is done All checks were successful Build and deploy / build (push) Successful in 7m18s Details	2025-04-23 21:00:02 +02:00
Dreaded_X	07123a92a9	Use reusable workflow All checks were successful Build and deploy / build (push) Successful in 5m30s Details	2025-04-23 14:08:42 +02:00
Dreaded_X	ac15ce1d38	Clarified password env variable missing error All checks were successful kustomization/siranga/3850ce12 reconciliation succeeded Build and deploy / Build container and manifests (push) Successful in 5m49s Details	2025-04-22 10:47:18 +02:00
Dreaded_X	5a7652f3a4	Make ldap search filter configurable All checks were successful Build and deploy / Build container and manifests (push) Successful in 6m8s Details kustomization/siranga/3850ce12 reconciliation succeeded	2025-04-22 00:42:56 +02:00
Dreaded_X	95ad229077	Get bind_dn from secret	2025-04-22 00:42:33 +02:00
Dreaded_X	e9673211c1	Added liveness probe All checks were successful Build and deploy / Build container and manifests (push) Successful in 5m57s Details	2025-04-21 03:22:34 +02:00
Dreaded_X	f0bf60c78a	Use named container ports	2025-04-21 02:36:59 +02:00
Dreaded_X	8cafe2b3ca	Added support for upgrade requests All checks were successful Build and deploy / Build container and manifests (push) Successful in 6m9s Details	2025-04-21 02:21:22 +02:00
Dreaded_X	ed7770f792	Fixed spelling of shutdown during forceful shutdown	2025-04-21 02:21:22 +02:00
Dreaded_X	dc1f75aee3	Close any remaining connections once the tui exits	2025-04-21 02:21:22 +02:00
Dreaded_X	0fe043acb5	Revert "Use store instead of fetch_add for atomics" All checks were successful Build and deploy / Build container and manifests (push) Successful in 6m1s Details This reverts commit `d4bd0ef1ca`.	2025-04-21 02:21:18 +02:00
Dreaded_X	878df8da40	Start graceful shutdown on SIGTERM All checks were successful Build and deploy / Build container and manifests (push) Successful in 5m32s Details	2025-04-20 00:58:18 +02:00
Dreaded_X	27f6119905	Second ctrl-c forces application to stop directly All checks were successful Build and deploy / Build container and manifests (push) Successful in 5m21s Details	2025-04-20 00:26:23 +02:00
Dreaded_X	c7b0cfc888	Gracefully shutdown if LDAP connection is lost	2025-04-20 00:24:32 +02:00
Dreaded_X	7851d6bb12	Implemented more graceful shutdown All checks were successful Build and deploy / Build container and manifests (push) Successful in 7m27s Details	2025-04-20 00:14:24 +02:00
Dreaded_X	49fd6d8a3a	Added suggestion to enable quiet mode for ssh client	2025-04-20 00:14:23 +02:00
Dreaded_X	ca742fe332	Updated authelia acl helper	2025-04-20 00:14:20 +02:00
Dreaded_X	b5c832fb38	Updated crates All checks were successful Build and deploy / Build container and manifests (push) Successful in 7m33s Details	2025-04-18 16:08:09 +02:00
Dreaded_X	526b9b0e0c	Update rust 1.85 -> 1.86 All checks were successful Build and deploy / Build container and manifests (push) Successful in 7m24s Details	2025-04-18 15:56:49 +02:00
Dreaded_X	e92b61b1a7	Set rust toolchain All checks were successful Build and deploy / Build container and manifests (push) Successful in 6m53s Details	2025-04-18 15:30:38 +02:00
Dreaded_X	a0b742b0b1	Changed syntax used in build.yaml	2025-04-18 15:08:07 +02:00
Dreaded_X	d4bd0ef1ca	Use store instead of fetch_add for atomics All checks were successful Build and deploy / Build container and manifests (push) Successful in 2m48s Details	2025-04-18 14:58:15 +02:00
Dreaded_X	95e47c708c	Highlight port in red if tunnel failed to open	2025-04-18 14:57:31 +02:00
Dreaded_X	75bfd4d5cf	Fixed version string All checks were successful Build and deploy / Build container and manifests (push) Successful in 2m30s Details	2025-04-18 14:12:30 +02:00
Dreaded_X	7fb8cb9c60	Added dockerignore to improve caching	2025-04-18 12:01:20 +02:00
Dreaded_X	a370338780	Added LICENSE All checks were successful Build and deploy / Build container and manifests (push) Successful in 7m10s Details	2025-04-18 11:44:41 +02:00