diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..a4e9e432
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,15 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+tab_width = 4
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+max_line_length = 120
+
+[*.nix]
+indent_size = 2
diff --git a/.envrc b/.envrc
index 3550a30f..403a9bdf 100644
--- a/.envrc
+++ b/.envrc
@@ -1 +1,5 @@
+#!/usr/bin/env bash
+
 use flake
+
+PATH_add bin
diff --git a/.gitignore b/.gitignore
index 1b5d37b8..73ce2e1f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -68,3 +68,9 @@ cached_target
 
 # Direnv cache
 /.direnv
+
+# Gitlab CI cache
+/.gitlab-ci.d
+
+# mdbook output
+public/
\ No newline at end of file
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d05bb899..8c880b9c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,241 +1,184 @@
 stages:
-  - build
-  - build docker image
-  - test
-  - upload artifacts
+  - ci
+  - artifacts
+  - publish
 
 variables:
-  # Make GitLab CI go fast:
-  GIT_SUBMODULE_STRATEGY: recursive
-  FF_USE_FASTZIP: 1
-  CACHE_COMPRESSION_LEVEL: fastest
-
-# --------------------------------------------------------------------- #
-#  Create and publish docker image                                      #
-# --------------------------------------------------------------------- #
-
-.docker-shared-settings:
-  stage: "build docker image"
-  image:
-    name: jdrouet/docker-with-buildx:20.10.21-0.9.1
-    pull_policy: if-not-present
-  needs: []
-  tags: [ "docker" ]
-  variables:
-    # Docker in Docker:
-    DOCKER_HOST: tcp://docker:2375/
-    DOCKER_TLS_CERTDIR: ""
-    # Famedly runners use BTRFS, overlayfs and overlay2 often break jobs
-    DOCKER_DRIVER: btrfs
-  services:
-    - docker:dind
-  script:
-    - apk add openssh-client
-    - eval $(ssh-agent -s)
-    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
-    - printf "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config
-    - sh .gitlab/setup-buildx-remote-builders.sh
-    # Authorize against this project's own image registry:
-    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
-    # Build multiplatform image and push to temporary tag:
-    - >
-      docker buildx build 
-      --platform "linux/arm/v7,linux/arm64,linux/amd64"
-      --pull
-      --tag "$CI_REGISTRY_IMAGE/temporary-ci-images:$CI_JOB_ID"
-      --push
-      --file "Dockerfile" .
-    # Build multiplatform image to deb stage and extract their .deb files:
-    - >
-      docker buildx build 
-      --platform "linux/arm/v7,linux/arm64,linux/amd64"
-      --target "packager-result"
-      --output="type=local,dest=/tmp/build-output"
-      --file "Dockerfile" .
-    # Build multiplatform image to binary stage and extract their binaries:
-    - >
-      docker buildx build 
-      --platform "linux/arm/v7,linux/arm64,linux/amd64"
-      --target "builder-result"
-      --output="type=local,dest=/tmp/build-output"
-      --file "Dockerfile" .
-    # Copy to GitLab container registry:
-    - >
-      docker buildx imagetools create
-      --tag "$CI_REGISTRY_IMAGE/$TAG"
-      --tag "$CI_REGISTRY_IMAGE/$TAG-bullseye"
-      --tag "$CI_REGISTRY_IMAGE/$TAG-commit-$CI_COMMIT_SHORT_SHA"
-      "$CI_REGISTRY_IMAGE/temporary-ci-images:$CI_JOB_ID"
-    # if DockerHub credentials exist, also copy to dockerhub:
-    - if [ -n "${DOCKER_HUB}" ]; then docker login -u "$DOCKER_HUB_USER" -p "$DOCKER_HUB_PASSWORD" "$DOCKER_HUB"; fi
-    - >
-      if [ -n "${DOCKER_HUB}" ]; then 
-      docker buildx imagetools create
-      --tag "$DOCKER_HUB_IMAGE/$TAG"
-      --tag "$DOCKER_HUB_IMAGE/$TAG-bullseye"
-      --tag "$DOCKER_HUB_IMAGE/$TAG-commit-$CI_COMMIT_SHORT_SHA"
-      "$CI_REGISTRY_IMAGE/temporary-ci-images:$CI_JOB_ID"
-      ; fi
-    - mv /tmp/build-output ./
-  artifacts:
-    paths:
-      - "./build-output/" 
-
-docker:next:
-  extends: .docker-shared-settings
-  rules:
-    - if: '$BUILD_SERVER_SSH_PRIVATE_KEY && $CI_COMMIT_BRANCH == "next"'
-  variables:
-    TAG: "matrix-conduit:next"
-
-docker:master:
-  extends: .docker-shared-settings
-  rules:
-    - if: '$BUILD_SERVER_SSH_PRIVATE_KEY && $CI_COMMIT_BRANCH == "master"'
-  variables:
-    TAG: "matrix-conduit:latest"
-
-docker:tags:
-  extends: .docker-shared-settings
-  rules:
-    - if: "$BUILD_SERVER_SSH_PRIVATE_KEY && $CI_COMMIT_TAG"
-  variables:
-    TAG: "matrix-conduit:$CI_COMMIT_TAG"
-
-
-# --------------------------------------------------------------------- #
-#  Run tests                                                            #
-# --------------------------------------------------------------------- #
-
-cargo check:
-  stage: test
-  image: docker.io/rust:1.64.0-bullseye
-  needs: []
-  interruptible: true
-  before_script:
-    - "rustup show && rustc --version && cargo --version" # Print version info for debugging
-    - apt-get update && apt-get -y --no-install-recommends install libclang-dev # dependency for rocksdb
-  script:
-    - cargo check
-
-
-.test-shared-settings:
-  stage: "test"
-  needs: []
-  image: "registry.gitlab.com/jfowl/conduit-containers/rust-with-tools:latest"
-  tags: ["docker"]
-  variables:
-    CARGO_INCREMENTAL: "false" # https://matklad.github.io/2021/09/04/fast-rust-builds.html#ci-workflow
-  interruptible: true
-
-test:cargo:
-  extends: .test-shared-settings
-  before_script:
-    - apt-get update && apt-get -y --no-install-recommends install libclang-dev # dependency for rocksdb
-  script:
-    - rustc --version && cargo --version # Print version info for debugging
-    - "cargo test --color always --workspace --verbose --locked --no-fail-fast -- -Z unstable-options --format json | gitlab-report -p test > $CI_PROJECT_DIR/report.xml"
-  artifacts:
-    when: always
-    reports:
-      junit: report.xml
-
-test:clippy:
-  extends: .test-shared-settings
-  allow_failure: true
-  before_script:
-    - rustup component add clippy
-    - apt-get update && apt-get -y --no-install-recommends install libclang-dev # dependency for rocksdb
-  script:
-    - rustc --version && cargo --version # Print version info for debugging
-    - "cargo clippy --color always --verbose --message-format=json | gitlab-report -p clippy > $CI_PROJECT_DIR/gl-code-quality-report.json"
-  artifacts:
-    when: always
-    reports:
-      codequality: gl-code-quality-report.json
-
-test:format:
-  extends: .test-shared-settings
-  before_script:
-    - rustup component add rustfmt
-  script:
-    - cargo fmt --all -- --check
-
-test:audit:
-  extends: .test-shared-settings
-  allow_failure: true
-  script:
-    - cargo audit --color always || true
-    - cargo audit --stale --json | gitlab-report -p audit > gl-sast-report.json
-  artifacts:
-    when: always
-    reports:
-      sast: gl-sast-report.json
-
-test:dockerlint:
-  stage: "test"
-  needs: []
-  image: "ghcr.io/hadolint/hadolint@sha256:6c4b7c23f96339489dd35f21a711996d7ce63047467a9a562287748a03ad5242" # 2.8.0-alpine
-  interruptible: true
-  script:
-    - hadolint --version
-    # First pass: Print for CI log:
-    - >
-      hadolint
-      --no-fail --verbose
-      ./Dockerfile
-    # Then output the results into a json for GitLab to pretty-print this in the MR:
-    - >
-      hadolint
-      --format gitlab_codeclimate
-      --failure-threshold error
-      ./Dockerfile > dockerlint.json
-  artifacts:
-    when: always
-    reports:
-      codequality: dockerlint.json
-    paths:
-      - dockerlint.json
-  rules:
-    - if: '$CI_COMMIT_REF_NAME != "master"'
-      changes:
-        - docker/*Dockerfile
-        - Dockerfile
-        - .gitlab-ci.yml
-    - if: '$CI_COMMIT_REF_NAME == "master"'
-    - if: '$CI_COMMIT_REF_NAME == "next"'
-
-# --------------------------------------------------------------------- #
-#  Store binaries as package so they have download urls                 #
-# --------------------------------------------------------------------- #
-
-# DISABLED FOR NOW, NEEDS TO BE FIXED AT A LATER TIME:
-
-#publish:package:
-#  stage: "upload artifacts"
-#  needs:
-#    - "docker:tags"
-#  rules:
-#    - if: "$CI_COMMIT_TAG"
-#  image: curlimages/curl:latest
-#  tags: ["docker"]
-#  variables:
-#    GIT_STRATEGY: "none" # Don't need a clean copy of the code, we just operate on artifacts
-#  script:
-#    - 'BASE_URL="${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/conduit-${CI_COMMIT_REF_SLUG}/build-${CI_PIPELINE_ID}"'
-#    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file build-output/linux_amd64/conduit "${BASE_URL}/conduit-x86_64-unknown-linux-gnu"'
-#    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file build-output/linux_arm_v7/conduit "${BASE_URL}/conduit-armv7-unknown-linux-gnu"'
-#    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file build-output/linux_arm64/conduit "${BASE_URL}/conduit-aarch64-unknown-linux-gnu"'
-#    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file build-output/linux_amd64/conduit.deb "${BASE_URL}/conduit-x86_64-unknown-linux-gnu.deb"'
-#    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file build-output/linux_arm_v7/conduit.deb "${BASE_URL}/conduit-armv7-unknown-linux-gnu.deb"'
-#    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file build-output/linux_arm64/conduit.deb "${BASE_URL}/conduit-aarch64-unknown-linux-gnu.deb"'
+  # Makes some things print in color
+  TERM: ansi
 
 # Avoid duplicate pipelines
 # See: https://docs.gitlab.com/ee/ci/yaml/workflow.html#switch-between-branch-pipelines-and-merge-request-pipelines
 workflow:
   rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
       when: never
-    - if: "$CI_COMMIT_BRANCH"
-    - if: "$CI_COMMIT_TAG"
+    - if: $CI
+
+before_script:
+  # Enable nix-command and flakes
+  - if command -v nix > /dev/null; then echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf; fi
+
+  # Add our own binary cache
+  - if command -v nix > /dev/null; then echo "extra-substituters = https://nix.computer.surgery/conduit" >> /etc/nix/nix.conf; fi
+  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = conduit:ZGAf6P6LhNvnoJJ3Me3PRg7tlLSrPxcQ2RiE5LIppjo=" >> /etc/nix/nix.conf; fi
+
+  # Add alternate binary cache
+  - if command -v nix > /dev/null && [ -n "$ATTIC_ENDPOINT" ]; then echo "extra-substituters = $ATTIC_ENDPOINT" >> /etc/nix/nix.conf; fi
+  - if command -v nix > /dev/null && [ -n "$ATTIC_PUBLIC_KEY" ]; then echo "extra-trusted-public-keys = $ATTIC_PUBLIC_KEY" >> /etc/nix/nix.conf; fi
+
+  # Add crane binary cache
+  - if command -v nix > /dev/null; then echo "extra-substituters = https://crane.cachix.org" >> /etc/nix/nix.conf; fi
+  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = crane.cachix.org-1:8Scfpmn9w+hGdXH/Q9tTLiYAE/2dnJYRJP7kl80GuRk=" >> /etc/nix/nix.conf; fi
+
+  # Add nix-community binary cache
+  - if command -v nix > /dev/null; then echo "extra-substituters = https://nix-community.cachix.org" >> /etc/nix/nix.conf; fi
+  - if command -v nix > /dev/null; then echo "extra-trusted-public-keys = nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" >> /etc/nix/nix.conf; fi
+
+  # Install direnv and nix-direnv
+  - if command -v nix > /dev/null; then nix-env -iA nixpkgs.direnv nixpkgs.nix-direnv; fi
+
+  # Allow .envrc
+  - if command -v nix > /dev/null; then direnv allow; fi
+
+  # Set CARGO_HOME to a cacheable path
+  - export CARGO_HOME="$(git rev-parse --show-toplevel)/.gitlab-ci.d/cargo"
+
+ci:
+  stage: ci
+  image: nixos/nix:2.20.4
+  script:
+    # Cache the inputs required for the devShell
+    - ./bin/nix-build-and-cache .#devShells.x86_64-linux.default.inputDerivation
+
+    - direnv exec . engage
+  cache:
+    key: nix
+    paths:
+      - target
+      - .gitlab-ci.d
+  rules:
+    # CI on upstream runners (only available for maintainers)
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $IS_UPSTREAM_CI == "true"
+    # Manual CI on unprotected branches that are not MRs
+    - if: $CI_PIPELINE_SOURCE != "merge_request_event" && $CI_COMMIT_REF_PROTECTED == "false"
+      when: manual
+    # Manual CI on forks
+    - if: $IS_UPSTREAM_CI != "true"
+      when: manual
+    - if: $CI
+  interruptible: true
+
+artifacts:
+  stage: artifacts
+  image: nixos/nix:2.20.4
+  script:
+    - ./bin/nix-build-and-cache .#static-x86_64-unknown-linux-musl
+    - cp result/bin/conduit x86_64-unknown-linux-musl
+
+    - mkdir -p target/release
+    - cp result/bin/conduit target/release
+    - direnv exec . cargo deb --no-build
+    - mv target/debian/*.deb x86_64-unknown-linux-musl.deb
+
+    # Since the OCI image package is based on the binary package, this has the
+    # fun side effect of uploading the normal binary too. Conduit users who are
+    # deploying with Nix can leverage this fact by adding our binary cache to
+    # their systems.
+    #
+    # Note that although we have an `oci-image-x86_64-unknown-linux-musl`
+    # output, we don't build it because it would be largely redundant to this
+    # one since it's all containerized anyway.
+    - ./bin/nix-build-and-cache .#oci-image
+    - cp result oci-image-amd64.tar.gz
+
+    - ./bin/nix-build-and-cache .#static-aarch64-unknown-linux-musl
+    - cp result/bin/conduit aarch64-unknown-linux-musl
+
+    - ./bin/nix-build-and-cache .#oci-image-aarch64-unknown-linux-musl
+    - cp result oci-image-arm64v8.tar.gz
+
+    - ./bin/nix-build-and-cache .#book
+    # We can't just copy the symlink, we need to dereference it https://gitlab.com/gitlab-org/gitlab/-/issues/19746
+    - cp -r --dereference result public
+  artifacts:
+    paths:
+      - x86_64-unknown-linux-musl
+      - aarch64-unknown-linux-musl
+      - x86_64-unknown-linux-musl.deb
+      - oci-image-amd64.tar.gz
+      - oci-image-arm64v8.tar.gz
+      - public
+  rules:
+    # CI required for all MRs
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    # Optional CI on forks
+    - if: $IS_UPSTREAM_CI != "true"
+      when: manual
+      allow_failure: true
+    - if: $CI
+  interruptible: true
+
+.push-oci-image:
+  stage: publish
+  image: docker:25.0.0
+  services:
+    - docker:25.0.0-dind
+  variables:
+    IMAGE_SUFFIX_AMD64: amd64
+    IMAGE_SUFFIX_ARM64V8: arm64v8
+  script:
+    - docker load -i oci-image-amd64.tar.gz
+    - IMAGE_ID_AMD64=$(docker images -q conduit:next)
+    - docker load -i oci-image-arm64v8.tar.gz
+    - IMAGE_ID_ARM64V8=$(docker images -q conduit:next)
+    # Tag and push the architecture specific images
+    - docker tag $IMAGE_ID_AMD64 $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_AMD64
+    - docker tag $IMAGE_ID_ARM64V8 $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_ARM64V8
+    - docker push $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_AMD64
+    - docker push $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_ARM64V8
+    # Tag the multi-arch image
+    - docker manifest create $IMAGE_NAME:$CI_COMMIT_SHA --amend $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_AMD64 --amend $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_ARM64V8
+    - docker manifest push $IMAGE_NAME:$CI_COMMIT_SHA
+    # Tag and push the git ref
+    - docker manifest create $IMAGE_NAME:$CI_COMMIT_REF_NAME --amend $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_AMD64 --amend $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_ARM64V8
+    - docker manifest push $IMAGE_NAME:$CI_COMMIT_REF_NAME
+    # Tag git tags as 'latest'
+    - |
+      if [[ -n "$CI_COMMIT_TAG" ]]; then
+        docker manifest create $IMAGE_NAME:latest --amend $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_AMD64 --amend $IMAGE_NAME:$CI_COMMIT_SHA-$IMAGE_SUFFIX_ARM64V8
+        docker manifest push $IMAGE_NAME:latest
+      fi
+  dependencies:
+    - artifacts
+  only:
+    - next
+    - master
+    - tags
+
+oci-image:push-gitlab:
+  extends: .push-oci-image
+  variables:
+    IMAGE_NAME: $CI_REGISTRY_IMAGE/matrix-conduit
+  before_script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+
+oci-image:push-dockerhub:
+  extends: .push-oci-image
+  variables:
+    IMAGE_NAME: matrixconduit/matrix-conduit
+  before_script:
+    - docker login -u $DOCKER_HUB_USER -p $DOCKER_HUB_PASSWORD
+
+pages:
+  stage: publish
+  dependencies:
+    - artifacts
+  only:
+    - next
+  script:
+    - "true"
+  artifacts:
+    paths:
+      - public
diff --git a/.gitlab/route-map.yml b/.gitlab/route-map.yml
new file mode 100644
index 00000000..2c23079c
--- /dev/null
+++ b/.gitlab/route-map.yml
@@ -0,0 +1,3 @@
+# Docs: Map markdown to html files
+- source: /docs/(.+)\.md/
+  public: '\1.html'
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index b3b1498f..78f7ebeb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,15 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "addr2line"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+dependencies = [
+ "gimli",
+]
+
 [[package]]
 name = "adler"
 version = "1.0.2"
@@ -10,56 +19,60 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
 dependencies = [
- "getrandom 0.2.8",
+ "cfg-if",
  "once_cell",
  "version_check",
+ "zerocopy",
 ]
 
 [[package]]
 name = "aho-corasick"
-version = "0.7.20"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc936419f96fa211c1b9166887b38e5e40b19958e5b895be7c1f93adec7071ac"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
-name = "alloc-no-stdlib"
-version = "2.0.4"
+name = "allocator-api2"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
 
 [[package]]
-name = "alloc-stdlib"
-version = "0.2.2"
+name = "anstyle"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
-dependencies = [
- "alloc-no-stdlib",
-]
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
 
 [[package]]
 name = "arc-swap"
-version = "1.5.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "983cd8b9d4b02a6dc6ffa557262eb5858a27a0038ffffe21a0f133eaa819a164"
+checksum = "7b3d0060af21e8d11a926981cc00c6c1541aa91dd64b9f881985c3da1094425f"
 
 [[package]]
 name = "arrayref"
-version = "0.3.6"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
+checksum = "6b4930d2cb77ce62f89ee5d5289b4ac049559b1c45539271f5ed4fdc7db34545"
 
 [[package]]
 name = "arrayvec"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
+name = "as_variant"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38fa22307249f86fb7fad906fcae77f2564caeb56d7209103c551cd1cf4798f"
 
 [[package]]
 name = "assign"
@@ -67,38 +80,24 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f093eed78becd229346bf859eec0aa4dd7ddde0757287b2b4107a1f09c80002"
 
-[[package]]
-name = "async-compression"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942c7cd7ae39e91bde4820d74132e9862e62c2f386c3aa90ccf55949f5bad63a"
-dependencies = [
- "brotli",
- "flate2",
- "futures-core",
- "memchr",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "async-trait"
-version = "0.1.58"
+version = "0.1.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e805d94e6b5001b651426cf4cd446b1ab5f319d27bab5c644f61de0a804360c"
+checksum = "c980ee35e870bd1a4d2c8294d4c04d0499e67bca1e4b5cefcc693c2fa00caea9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "atomic"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b88d82667eca772c4aa12f0f1348b3ae643424c8876448f3f7bd5787032e234c"
+checksum = "8d818003e740b63afc82337e3160717f4f63078720a810b7b903e70a5d1d2994"
 dependencies = [
- "autocfg",
+ "bytemuck",
 ]
 
 [[package]]
@@ -109,13 +108,13 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "axum"
-version = "0.5.17"
+version = "0.6.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acee9fd5073ab6b045a275b3e709c163dd36c90685219cb21804a147b58dba43"
+checksum = "3b829e4e32b91e643de6eafe82b1d90675f5874230191a4ffbc1b336dec4d6bf"
 dependencies = [
  "async-trait",
  "axum-core",
- "bitflags",
+ "bitflags 1.3.2",
  "bytes",
  "futures-util",
  "headers",
@@ -128,22 +127,22 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
+ "rustversion",
  "serde",
  "serde_json",
+ "serde_path_to_error",
  "serde_urlencoded",
  "sync_wrapper",
- "tokio",
  "tower",
- "tower-http",
  "tower-layer",
  "tower-service",
 ]
 
 [[package]]
 name = "axum-core"
-version = "0.2.9"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37e5939e02c56fecd5c017c37df4238c0a839fa76b7f97acdd7efb804fd181cc"
+checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
 dependencies = [
  "async-trait",
  "bytes",
@@ -151,15 +150,16 @@ dependencies = [
  "http",
  "http-body",
  "mime",
+ "rustversion",
  "tower-layer",
  "tower-service",
 ]
 
 [[package]]
 name = "axum-server"
-version = "0.4.4"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8456dab8f11484979a86651da8e619b355ede5d61a160755155f6c344bd18c47"
+checksum = "447f28c85900215cc1bea282f32d4a2f22d55c5a300afdfbc661c8d6a632e063"
 dependencies = [
  "arc-swap",
  "bytes",
@@ -169,56 +169,57 @@ dependencies = [
  "hyper",
  "pin-project-lite",
  "rustls",
- "rustls-pemfile 1.0.1",
+ "rustls-pemfile",
  "tokio",
  "tokio-rustls",
  "tower-service",
 ]
 
 [[package]]
-name = "base64"
-version = "0.13.1"
+name = "backtrace"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
-[[package]]
-name = "base64"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea22880d78093b0cbe17c89f64a7d457941e65759157ec6cb31a31d652b05e5"
-
-[[package]]
-name = "base64ct"
-version = "1.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b645a089122eccb6111b4f81cbc1a49f5900ac4666bb93ac027feaecf15607bf"
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
- "serde",
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
 ]
 
 [[package]]
-name = "bindgen"
-version = "0.59.2"
+name = "base64"
+version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bd2a9a458e8f4304c52c43ebb0cfbd520289f8379a52e329a38afda99bf8eb8"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
+[[package]]
+name = "bindgen"
+version = "0.69.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
 dependencies = [
- "bitflags",
+ "bitflags 2.4.2",
  "cexpr",
  "clang-sys",
+ "itertools 0.12.1",
  "lazy_static",
  "lazycell",
- "peeking_take_while",
  "proc-macro2",
  "quote",
  "regex",
  "rustc-hash",
  "shlex",
+ "syn 2.0.52",
 ]
 
 [[package]]
@@ -228,10 +229,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
-name = "blake2b_simd"
-version = "1.0.0"
+name = "bitflags"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72936ee4afc7f8f736d1c38383b56480b5497b4617b4a77bdbf1d2ababc76127"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+
+[[package]]
+name = "blake2b_simd"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23285ad32269793932e830392f2fe2f83e26488fd3ec778883a93c8323735780"
 dependencies = [
  "arrayref",
  "arrayvec",
@@ -240,74 +247,56 @@ dependencies = [
 
 [[package]]
 name = "block-buffer"
-version = "0.9.0"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-buffer"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "brotli"
-version = "3.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1a0b1dbcc8ae29329621f8d4f0d835787c1c38bb1401979b49d13b0b305ff68"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
- "brotli-decompressor",
-]
-
-[[package]]
-name = "brotli-decompressor"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ad2d4653bf5ca36ae797b1f4bb4dbddb60ce49ca4aed8a2ce4829f60425b80"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
-]
-
 [[package]]
 name = "bumpalo"
-version = "3.11.1"
+version = "3.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
+checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
 
 [[package]]
 name = "bytemuck"
-version = "1.12.3"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaa3a8d9a1ca92e282c96a32d6511b695d7d994d1d102ba85d279f9b2756947f"
+checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.3.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
+checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.11+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
 
 [[package]]
 name = "cc"
-version = "1.0.77"
+version = "1.0.90"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f73505338f7d905b19d18738976aae232eb46b8efc15554ffc56deb5d9ebe4"
+checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
 dependencies = [
  "jobserver",
+ "libc",
 ]
 
 [[package]]
@@ -326,10 +315,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "clang-sys"
-version = "1.4.0"
+name = "cfg_aliases"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa2e27ae6ab525c3d369ded447057bca5438d86dc3a68f6faafb8269ba82ebf3"
+checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+
+[[package]]
+name = "clang-sys"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67523a3b4be3ce1989d607a828d036249522dd9c1c8de7f4dd2dae43a37369d1"
 dependencies = [
  "glob",
  "libc",
@@ -338,37 +333,41 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.0.27"
+version = "4.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0acbd8d28a0a60d7108d7ae850af6ba34cf2d1257fc646980e5f97ce14275966"
+checksum = "b230ab84b0ffdf890d5a10abdbc8b83ae1c4918275daea1ab8801f71536b2651"
 dependencies = [
- "bitflags",
+ "clap_builder",
  "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
+dependencies = [
+ "anstyle",
  "clap_lex",
- "once_cell",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.0.21"
+version = "4.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0177313f9f02afc995627906bbd8967e2be069f5261954222dac78290c2b9014"
+checksum = "307bc0538d5f0f83b8248db3087aa92fe504e4691294d0c96c0eabc33f47ba47"
 dependencies = [
  "heck",
- "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.3.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d4198f73e42b4936b35b5bb248d81d2b595ecb170da0bac7655c54eedfa8da8"
-dependencies = [
- "os_str_bytes",
-]
+checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
 
 [[package]]
 name = "color_quant"
@@ -378,40 +377,41 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "conduit"
-version = "0.6.0-alpha"
+version = "0.7.0-alpha"
 dependencies = [
  "async-trait",
  "axum",
  "axum-server",
- "base64 0.13.1",
+ "base64",
  "bytes",
  "clap",
- "crossbeam",
  "directories",
  "figment",
  "futures-util",
- "heed",
  "hmac",
  "http",
+ "hyper",
  "image",
  "jsonwebtoken",
  "lazy_static",
  "lru-cache",
+ "nix",
  "num_cpus",
  "opentelemetry",
  "opentelemetry-jaeger",
  "parking_lot",
  "persy",
- "rand 0.8.5",
+ "rand",
  "regex",
  "reqwest",
  "ring",
- "rocksdb",
  "ruma",
  "rusqlite",
  "rust-argon2",
+ "rust-rocksdb",
  "sd-notify",
  "serde",
+ "serde_html_form",
  "serde_json",
  "serde_yaml",
  "sha-1",
@@ -433,21 +433,27 @@ dependencies = [
 
 [[package]]
 name = "const-oid"
-version = "0.9.1"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cec318a675afcb6a1ea1d4340e2d377e56e47c266f28043ceccbf4412ddfdd3b"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const_panic"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6051f239ecec86fde3410901ab7860d458d160371533842974fc61f96d15879b"
 
 [[package]]
 name = "constant_time_eq"
-version = "0.1.5"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
+checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
 
 [[package]]
 name = "core-foundation"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -455,109 +461,57 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.5"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc"
-version = "2.1.0"
+version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49fc9a695bca7f35f5f4c15cddc84415f66a74ea78eef08e90c5024f2b540e23"
+checksum = "86ec7a15cbe22e59248fc7eadb1907dab5ba09372595da4d73dd805ed4417dfe"
 dependencies = [
  "crc-catalog",
 ]
 
 [[package]]
 name = "crc-catalog"
-version = "1.1.1"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccaeedb56da03b09f598226e25e80088cb4cd25f316e6e4df7d695f0feeb1403"
+checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
 
 [[package]]
 name = "crc32fast"
-version = "1.3.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
 dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crossbeam"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2801af0d36612ae591caa9568261fddce32ce6e08a7275ea334a06a4ad021a2c"
-dependencies = [
- "cfg-if",
- "crossbeam-channel",
- "crossbeam-deque",
- "crossbeam-epoch",
- "crossbeam-queue",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.6"
+version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+checksum = "ab3db02a9c5b5121e1e42fbdb1aeb65f5e02624cc58c43f2884c6ccac0b82f95"
 dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
-dependencies = [
- "cfg-if",
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
-dependencies = [
- "autocfg",
- "cfg-if",
- "crossbeam-utils",
- "memoffset",
- "scopeguard",
-]
-
-[[package]]
-name = "crossbeam-queue"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
-dependencies = [
- "cfg-if",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.14"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
-dependencies = [
- "cfg-if",
-]
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
 
 [[package]]
 name = "crypto-common"
@@ -571,25 +525,40 @@ dependencies = [
 
 [[package]]
 name = "curve25519-dalek"
-version = "3.2.0"
+version = "4.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9fdf9972b2bd6af2d913799d9ebc165ea4d2e65878e329d9c6b372c4491b61"
+checksum = "0a677b8922c94e01bdbb12126b0bc852f00447528dee1782229af9c720c3f348"
 dependencies = [
- "byteorder",
- "digest 0.9.0",
- "rand_core 0.5.1",
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "platforms",
+ "rustc_version",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
-name = "dashmap"
-version = "5.4.0"
+name = "curve25519-dalek-derive"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "907076dfda823b0b36d2a1bb5f90c96660a5bbcd7729e10727f07858f22c4edc"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
 dependencies = [
  "cfg-if",
- "hashbrown",
+ "hashbrown 0.14.3",
  "lock_api",
  "once_cell",
  "parking_lot_core",
@@ -597,36 +566,36 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.3.2"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ee2393c4a91429dffb4bedf19f4d6abf27d8a732c8ce4980305d782e5426d57"
+checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
 
 [[package]]
 name = "der"
-version = "0.6.0"
+version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dd2ae565c0a381dde7fade45fce95984c568bdcb4700a4fdbe3175e0380b2f"
+checksum = "fffa369a668c8af7dbf8b5e56c9f744fbd399949ed171606040001947de40b1c"
 dependencies = [
  "const-oid",
  "zeroize",
 ]
 
 [[package]]
-name = "digest"
-version = "0.9.0"
+name = "deranged"
+version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
 dependencies = [
- "generic-array",
+ "powerfmt",
 ]
 
 [[package]]
 name = "digest"
-version = "0.10.6"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer 0.10.3",
+ "block-buffer",
  "crypto-common",
  "subtle",
 ]
@@ -653,38 +622,40 @@ dependencies = [
 
 [[package]]
 name = "ed25519"
-version = "1.5.2"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9c280362032ea4203659fc489832d0204ef09f247a0506f170dafcac08c369"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
+ "pkcs8",
  "signature",
 ]
 
 [[package]]
 name = "ed25519-dalek"
-version = "1.0.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c762bae6dcaf24c4c84667b8579785430908723d5c889f469d76a41d59cc7a9d"
+checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "rand 0.7.3",
+ "rand_core",
  "serde",
  "sha2",
+ "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "either"
-version = "1.8.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.31"
+version = "0.8.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
 dependencies = [
  "cfg-if",
 ]
@@ -698,9 +669,15 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.109",
 ]
 
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
 [[package]]
 name = "fallible-iterator"
 version = "0.2.0"
@@ -714,10 +691,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
-name = "figment"
-version = "0.10.8"
+name = "fdeflate"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e56602b469b2201400dec66a66aec5a9b8761ee97cd1b8c96ab2483fcc16cc9"
+checksum = "4f9bfee30e4dedf0ab8b422f03af778d9612b63f502710fc500a334ebe2de645"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1676f435fc1dadde4d03e43f5d62b259e1ce5f40bd4ffb21db2b42ebe59c1382"
+
+[[package]]
+name = "figment"
+version = "0.10.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6e5bc7bd59d60d0d45a6ccab6cf0f4ce28698fb4e81e750ddf229c9b824026"
 dependencies = [
  "atomic",
  "pear",
@@ -729,9 +721,9 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.0.25"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -745,9 +737,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.1.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
  "percent-encoding",
 ]
@@ -762,17 +754,11 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "fs_extra"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2022715d62ab30faffd124d40b76f4134a550a87792276512b18d63272333394"
-
 [[package]]
 name = "futures"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38390104763dc37a5145a53c29c63c1290b5d316d6086ec32c293f6736051bb0"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -785,9 +771,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ba265a92256105f45b719605a571ffe2d1f0fea3807304b522c1d778f79eed"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -795,15 +781,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04909a7a7e4633ae6c4a9ab280aeb86da1236243a77b694a49eacd659a4bd3ac"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7acc85df6714c176ab5edf386123fafe217be88c0840ec11f199441134a074e2"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -812,38 +798,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00f5fb52a06bdcadeb54e8d3671f8888a39697dcb0b81b23b55174030427f4eb"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdfb8ce053d86b91919aad980c220b1fb8401a9394410e1c289ed7e66b61835d"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39c15cf1a4aa79df40f1bb462fb39676d0ad9e366c2a33b590d7c66f4f81fcf9"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
 
 [[package]]
 name = "futures-task"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffb393ac5d9a6eaa9d3fdf37ae2776656b706e200c8e16b1bdb227f5198e6ea"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
 
 [[package]]
 name = "futures-util"
-version = "0.3.25"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "197676987abd2f9cadff84926f410af1c183608d36641465df73ae8211dc65d6"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -859,9 +845,9 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "0.14.6"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
@@ -869,47 +855,44 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.1.16"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
 name = "gif"
-version = "0.11.4"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3edd93c6756b4dfaf2709eafcc345ba2636565295c198a9cfbf75fa5e3e00b06"
+checksum = "3fb2d69b19215e18bb912fa30f7ce15846e301408695e44e0ef719f1da9e19f2"
 dependencies = [
  "color_quant",
  "weezl",
 ]
 
 [[package]]
-name = "glob"
-version = "0.3.0"
+name = "gimli"
+version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
+checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
+
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "h2"
-version = "0.3.15"
+version = "0.3.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f9f29bc9dda355256b2916cf526ab02ce0aeaaaf2bad60d65ef3f12f11dd0f4"
+checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
 dependencies = [
  "bytes",
  "fnv",
@@ -917,7 +900,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap",
+ "indexmap 2.2.5",
  "slab",
  "tokio",
  "tokio-util",
@@ -929,27 +912,33 @@ name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 dependencies = [
  "ahash",
+ "allocator-api2",
 ]
 
 [[package]]
 name = "hashlink"
-version = "0.8.1"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69fe1fcf8b4278d860ad0548329f892a3631fb63f82574df68275f34cdbe0ffa"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
 dependencies = [
- "hashbrown",
+ "hashbrown 0.14.3",
 ]
 
 [[package]]
 name = "headers"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3e372db8e5c0d213e0cd0b9be18be2aca3d44cf2fe30a9d46a65581cd454584"
+checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
 dependencies = [
- "base64 0.13.1",
- "bitflags",
+ "base64",
  "bytes",
  "headers-core",
  "http",
@@ -969,54 +958,15 @@ dependencies = [
 
 [[package]]
 name = "heck"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
-
-[[package]]
-name = "heed"
-version = "0.10.6"
-source = "git+https://github.com/timokoesters/heed.git?rev=f6f825da7fb2c758867e05ad973ef800a6fe1d5d#f6f825da7fb2c758867e05ad973ef800a6fe1d5d"
-dependencies = [
- "bytemuck",
- "byteorder",
- "heed-traits",
- "heed-types",
- "libc",
- "lmdb-rkv-sys",
- "once_cell",
- "page_size",
- "serde",
- "synchronoise",
- "url",
-]
-
-[[package]]
-name = "heed-traits"
-version = "0.7.0"
-source = "git+https://github.com/timokoesters/heed.git?rev=f6f825da7fb2c758867e05ad973ef800a6fe1d5d#f6f825da7fb2c758867e05ad973ef800a6fe1d5d"
-
-[[package]]
-name = "heed-types"
-version = "0.7.2"
-source = "git+https://github.com/timokoesters/heed.git?rev=f6f825da7fb2c758867e05ad973ef800a6fe1d5d#f6f825da7fb2c758867e05ad973ef800a6fe1d5d"
-dependencies = [
- "bincode",
- "bytemuck",
- "byteorder",
- "heed-traits",
- "serde",
- "serde_json",
-]
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.19"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "hmac"
@@ -1024,7 +974,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest 0.10.6",
+ "digest",
 ]
 
 [[package]]
@@ -1040,9 +990,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.8"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75f43d41e26995c17e71ee126451dd3941010b0514a81a9d11f3b341debc2399"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
  "bytes",
  "fnv",
@@ -1051,9 +1001,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
  "http",
@@ -1062,9 +1012,9 @@ dependencies = [
 
 [[package]]
 name = "http-range-header"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bfe8eed0a9285ef776bb792479ea3834e8b94e13d615c2f66d03dd50a435a29"
+checksum = "add0ab9360ddbd88cfeb3bd9574a1d85cfdfa14db10b3e21d3700dbc4328758f"
 
 [[package]]
 name = "httparse"
@@ -1074,15 +1024,15 @@ checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
 [[package]]
 name = "httpdate"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "0.14.23"
+version = "0.14.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
+checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1104,10 +1054,11 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.23.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59df7c4e19c950e6e0e868dcc0a300b09a9b88e9ec55bd879ca819087a77355d"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
+ "futures-util",
  "http",
  "hyper",
  "rustls",
@@ -1128,9 +1079,9 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "0.3.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -1138,28 +1089,37 @@ dependencies = [
 
 [[package]]
 name = "image"
-version = "0.24.5"
+version = "0.24.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69b7ea949b537b0fd0af141fff8c77690f2ce96f4f41f042ccb6c69c6c965945"
+checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "gif",
  "jpeg-decoder",
- "num-rational",
  "num-traits",
  "png",
 ]
 
 [[package]]
 name = "indexmap"
-version = "1.9.2"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885e79c1fc4b10f0e172c475f458b7f7b93061064d98c3293e98c5ba0c8b399"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
 dependencies = [
  "autocfg",
- "hashbrown",
+ "hashbrown 0.12.3",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b0b929d511467233429c45a44ac1dcaa21ba0f5ba11e4879e6ed28ddb4f9df4"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.14.3",
  "serde",
 ]
 
@@ -1177,57 +1137,66 @@ checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
 
 [[package]]
 name = "ipconfig"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd302af1b90f2463a98fa5ad469fc212c8e3175a41c3068601bfa2727591c5be"
+checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
 dependencies = [
  "socket2",
  "widestring",
- "winapi",
- "winreg 0.10.1",
+ "windows-sys 0.48.0",
+ "winreg",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.5.1"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f88c5561171189e69df9d98bcf18fd5f9558300f7ea7b801eb8a0fd748bd8745"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "itertools"
-version = "0.10.5"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
 dependencies = [
  "either",
 ]
 
 [[package]]
 name = "itoa"
-version = "1.0.4"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
 
 [[package]]
 name = "jobserver"
-version = "0.1.25"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "068b1ee6743e4d11fb9c6a1e6064b3693a1b600e7f5f5988047d98b3dc9fb90b"
+checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "jpeg-decoder"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
+checksum = "f5d4a7da358eff58addd2877a45865158f0d78c911d43a5784ceb7bbf52833b0"
 
 [[package]]
 name = "js-sys"
-version = "0.3.60"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -1252,11 +1221,12 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "8.1.1"
+version = "9.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa4b4af834c6cfd35d8763d359661b90f2e45d8f750a0849156c7f4671af09c"
+checksum = "5c7ea04a7c5c055c175f189b6dc6ba036fd62306b58c66c9f6389036c503a3f4"
 dependencies = [
- "base64 0.13.1",
+ "base64",
+ "js-sys",
  "pem",
  "ring",
  "serde",
@@ -1266,25 +1236,23 @@ dependencies = [
 
 [[package]]
 name = "konst"
-version = "0.2.19"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "330f0e13e6483b8c34885f7e6c9f19b1a7bd449c673fbb948a51c99d66ef74f4"
+checksum = "8d712a8c49d4274f8d8a5cf61368cb5f3c143d149882b1a2918129e53395fdb0"
 dependencies = [
- "konst_macro_rules",
- "konst_proc_macros",
+ "const_panic",
+ "konst_kernel",
+ "typewit",
 ]
 
 [[package]]
-name = "konst_macro_rules"
-version = "0.2.19"
+name = "konst_kernel"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
-
-[[package]]
-name = "konst_proc_macros"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "984e109462d46ad18314f10e392c286c3d47bce203088a09012de1015b45b737"
+checksum = "dac6ea8c376b6e208a81cf39b8e82bebf49652454d98a4829e907dac16ef1790"
+dependencies = [
+ "typewit",
+]
 
 [[package]]
 name = "lazy_static"
@@ -1300,37 +1268,47 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.137"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libloading"
-version = "0.7.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+checksum = "0c2a198fb6b0eada2a8df47933734e6d35d350665a33a3593d7164fa52c75c19"
 dependencies = [
  "cfg-if",
- "winapi",
+ "windows-targets 0.52.4",
 ]
 
 [[package]]
-name = "librocksdb-sys"
-version = "6.20.3"
+name = "libredox"
+version = "0.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c309a9d2470844aceb9a4a098cf5286154d20596868b75a6b36357d2bb9ca25d"
+checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
 dependencies = [
- "bindgen",
- "cc",
- "glob",
+ "bitflags 2.4.2",
  "libc",
+ "redox_syscall",
 ]
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.25.2"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29f835d03d717946d28b1d1ed632eb6f0e24a299388ee623d0c23118d3e8a7fa"
+checksum = "afc22eff61b133b115c6e8c74e818c628d6d5e7a502afea6f64dee076dd94326"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "libz-sys"
+version = "1.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037731f5d3aaa87a5675e895b63ddff1a87624bc29f77004ea829809654e48f6"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1343,22 +1321,11 @@ version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
-[[package]]
-name = "lmdb-rkv-sys"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61b9ce6b3be08acefa3003c57b7565377432a89ec24476bbe72e11d101f852fe"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
-]
-
 [[package]]
 name = "lock_api"
-version = "0.4.9"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1366,12 +1333,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.17"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if",
-]
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "lru-cache"
@@ -1382,6 +1346,16 @@ dependencies = [
  "linked-hash-map",
 ]
 
+[[package]]
+name = "lz4-sys"
+version = "1.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d27b317e207b10f69f5e75494119e391a96f48861ae870d1da6edac98ca900"
+dependencies = [
+ "cc",
+ "libc",
+]
+
 [[package]]
 name = "maplit"
 version = "1.0.2"
@@ -1400,41 +1374,32 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
 dependencies = [
- "regex-automata",
+ "regex-automata 0.1.10",
 ]
 
 [[package]]
 name = "matches"
-version = "0.1.9"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
 [[package]]
 name = "matchit"
-version = "0.5.0"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73cbba799671b762df5a175adf59ce145165747bb891505c43d09aefbbf38beb"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-
-[[package]]
-name = "memoffset"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
-dependencies = [
- "autocfg",
-]
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "mime"
-version = "0.3.16"
+version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "minimal-lexical"
@@ -1444,30 +1409,42 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.6.2"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
 dependencies = [
  "adler",
+ "simd-adler32",
 ]
 
 [[package]]
 name = "mio"
-version = "0.8.5"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5d732bc30207a6423068df043e3d02e0735b155ad7ce1a6f76fe2baa5b158de"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
- "log",
- "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.42.0",
+ "wasi",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "nix"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+dependencies = [
+ "bitflags 2.4.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
 ]
 
 [[package]]
 name = "nom"
-version = "7.1.1"
+version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
 dependencies = [
  "memchr",
  "minimal-lexical",
@@ -1485,66 +1462,63 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
 dependencies = [
  "autocfg",
  "num-integer",
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
- "autocfg",
- "num-traits",
-]
-
-[[package]]
-name = "num-rational"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
-dependencies = [
- "autocfg",
- "num-integer",
  "num-traits",
 ]
 
 [[package]]
 name = "num-traits"
-version = "0.2.15"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
 dependencies = [
  "autocfg",
 ]
 
 [[package]]
 name = "num_cpus"
-version = "1.14.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6058e64324c71e02bc2b150e4f3bc8286db6c83092132ffa3f6b1eab0f9def5"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
  "hermit-abi",
  "libc",
 ]
 
 [[package]]
-name = "once_cell"
-version = "1.16.0"
+name = "object"
+version = "0.32.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86f0b0d4bf799edbc74508c1e8bf170ff5f41238e5f8225603ca7caaae2b7860"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
-name = "opaque-debug"
-version = "0.3.0"
+name = "once_cell"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "openssl-probe"
@@ -1597,7 +1571,7 @@ dependencies = [
  "fnv",
  "futures-channel",
  "futures-util",
- "indexmap",
+ "indexmap 1.9.3",
  "js-sys",
  "once_cell",
  "pin-project-lite",
@@ -1620,7 +1594,7 @@ dependencies = [
  "once_cell",
  "opentelemetry_api",
  "percent-encoding",
- "rand 0.8.5",
+ "rand",
  "thiserror",
  "tokio",
  "tokio-stream",
@@ -1635,28 +1609,12 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "os_str_bytes"
-version = "6.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
-
 [[package]]
 name = "overload"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
-[[package]]
-name = "page_size"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eebde548fbbf1ea81a99b128872779c437752fb99f217c45245e1a61dcd9edcd"
-dependencies = [
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.12.1"
@@ -1669,28 +1627,28 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.4"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dc9e0dc2adc1c69d09143aff38d3d30c5c3f0df0dad82e6d25547af174ebec0"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-sys 0.42.0",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
 name = "paste"
-version = "1.0.9"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1de2e551fb905ac83f73f7aedf2f0cb4a0da7e35efa24a202a936269f1f18e1"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
 
 [[package]]
 name = "pear"
-version = "0.2.3"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e44241c5e4c868e3eaa78b7c1848cadd6344ed4f54d029832d32b415a58702"
+checksum = "4ccca0f6c17acc81df8e242ed473ec144cbf5c98037e69aa6d144780aad103c8"
 dependencies = [
  "inlinable_string",
  "pear_codegen",
@@ -1699,48 +1657,43 @@ dependencies = [
 
 [[package]]
 name = "pear_codegen"
-version = "0.2.3"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82a5ca643c2303ecb740d506539deba189e16f2754040a42901cd8105d0282d0"
+checksum = "2e22670e8eb757cff11d6c199ca7b987f352f0346e0be4dd23869ec72cb53c77"
 dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
-
 [[package]]
 name = "pem"
-version = "1.1.0"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c64931a1a212348ec4f3b4362585eca7159d0d09cbdf4a7f74f02173596fd4"
+checksum = "1b8fcc794035347fb64beda2d3b462595dd2753e3f268d89c5aae77e8cf2c310"
 dependencies = [
- "base64 0.13.1",
+ "base64",
+ "serde",
 ]
 
 [[package]]
 name = "percent-encoding"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "persy"
-version = "1.3.4"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5511189f4dbd737283b0dd2ff6715f2e35fd0d3e1ddf953ed6a772e439e1f73f"
+checksum = "9ef4b7250ab3a90ded0e284b2633469c23ef01ea868fe7cbb64e2f0a7d6f6d02"
 dependencies = [
  "crc",
  "data-encoding",
  "fs2",
  "linked-hash-map",
- "rand 0.8.5",
+ "rand",
  "thiserror",
  "unsigned-varint",
  "zigzag",
@@ -1748,29 +1701,29 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.0.12"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad29a609b6bcd67fee905812e544992d216af9d755757c05ed2d0e15a74c6ecc"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.0.12"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "069bdb1e05adc7a8990dce9cc75370895fbe4e3d58b9b73bf1aee56359344a55"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.9"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "pin-utils"
@@ -1780,9 +1733,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkcs8"
-version = "0.9.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
  "der",
  "spki",
@@ -1790,22 +1743,35 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.26"
+version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+
+[[package]]
+name = "platforms"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626dec3cac7cc0e1577a2ec3fc496277ec2baa084bebad95bb6fdbfae235f84c"
 
 [[package]]
 name = "png"
-version = "0.17.7"
+version = "0.17.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d708eaf860a19b19ce538740d2b4bdeeb8337fa53f7738455e706623ad5c638"
+checksum = "06e4b0d3d1312775e782c86c91a111aa1f910cbb65e1337f9975b5f9a554b5e1"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "crc32fast",
+ "fdeflate",
  "flate2",
  "miniz_oxide",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.17"
@@ -1814,57 +1780,32 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro-crate"
-version = "1.2.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eda0fc3b0fb7c975631757e14d9049da17374063edb6ebbcbc54d880d4fe94e9"
+checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
 dependencies = [
- "once_cell",
- "thiserror",
- "toml",
-]
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
+ "toml_datetime",
+ "toml_edit",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.47"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ea3d908b0e36316caf9e9e2c4625cdde190a7e6f440d794667ed17a1855e725"
+checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "proc-macro2-diagnostics"
-version = "0.9.1"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bf29726d67464d49fa6224a1d07936a8c08bb3fba727c7493f6cf1616fdaada"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
  "version_check",
  "yansi",
 ]
@@ -1877,26 +1818,13 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quote"
-version = "1.0.21"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "rand"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-dependencies = [
- "getrandom 0.1.16",
- "libc",
- "rand_chacha 0.2.2",
- "rand_core 0.5.1",
- "rand_hc",
-]
-
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -1904,18 +1832,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.5.1",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -1925,16 +1843,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-dependencies = [
- "getrandom 0.1.16",
+ "rand_core",
 ]
 
 [[package]]
@@ -1943,47 +1852,39 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.8",
-]
-
-[[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
+ "getrandom",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.16"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
 dependencies = [
- "getrandom 0.2.8",
- "redox_syscall",
+ "getrandom",
+ "libredox",
  "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.7.0"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e076559ef8e241f2ae3479e36f97bd5741c0330689e217ad51ce2c76808b868a"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-automata 0.4.6",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
@@ -1992,21 +1893,39 @@ version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
 dependencies = [
- "regex-syntax",
+ "regex-syntax 0.6.29",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.28"
+version = "0.6.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "reqwest"
-version = "0.11.9"
-source = "git+https://github.com/timokoesters/reqwest?rev=57b7cf4feb921573dfafad7d34b9ac6e44ead0bd#57b7cf4feb921573dfafad7d34b9ac6e44ead0bd"
+version = "0.11.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78bf93c4af7a8bb7d879d51cebe797356ff10ae8516ace542b5182d9dcac10b2"
 dependencies = [
- "base64 0.13.1",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -2018,25 +1937,28 @@ dependencies = [
  "hyper-rustls",
  "ipnet",
  "js-sys",
- "lazy_static",
  "log",
  "mime",
+ "once_cell",
  "percent-encoding",
  "pin-project-lite",
  "rustls",
  "rustls-native-certs",
- "rustls-pemfile 0.2.1",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
+ "sync_wrapper",
+ "system-configuration",
  "tokio",
  "tokio-rustls",
  "tokio-socks",
+ "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "winreg 0.7.0",
+ "winreg",
 ]
 
 [[package]]
@@ -2051,33 +1973,23 @@ dependencies = [
 
 [[package]]
 name = "ring"
-version = "0.16.20"
+version = "0.17.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
 dependencies = [
  "cc",
+ "cfg-if",
+ "getrandom",
  "libc",
- "once_cell",
  "spin",
  "untrusted",
- "web-sys",
- "winapi",
-]
-
-[[package]]
-name = "rocksdb"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a62eca5cacf2c8261128631bed9f045598d40bfbe4b29f5163f0f802f8f44a7"
-dependencies = [
- "libc",
- "librocksdb-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "ruma"
-version = "0.7.4"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.9.4"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "assign",
  "js_int",
@@ -2085,6 +1997,7 @@ dependencies = [
  "ruma-appservice-api",
  "ruma-client-api",
  "ruma-common",
+ "ruma-events",
  "ruma-federation-api",
  "ruma-identity-service-api",
  "ruma-push-gateway-api",
@@ -2094,75 +2007,103 @@ dependencies = [
 
 [[package]]
 name = "ruma-appservice-api"
-version = "0.7.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.9.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "js_int",
  "ruma-common",
+ "ruma-events",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "ruma-client-api"
-version = "0.15.3"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.17.4"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
+ "as_variant",
  "assign",
  "bytes",
  "http",
  "js_int",
  "js_option",
  "maplit",
- "percent-encoding",
  "ruma-common",
+ "ruma-events",
  "serde",
+ "serde_html_form",
  "serde_json",
 ]
 
 [[package]]
 name = "ruma-common"
-version = "0.10.5"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.12.1"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
- "base64 0.20.0",
+ "as_variant",
+ "base64",
  "bytes",
  "form_urlencoded",
  "http",
- "indexmap",
- "itoa",
+ "indexmap 2.2.5",
  "js_int",
- "js_option",
  "konst",
  "percent-encoding",
- "rand 0.8.5",
+ "rand",
  "regex",
  "ruma-identifiers-validation",
  "ruma-macros",
  "serde",
+ "serde_html_form",
+ "serde_json",
+ "thiserror",
+ "time",
+ "tracing",
+ "url",
+ "uuid",
+ "web-time",
+ "wildmatch",
+]
+
+[[package]]
+name = "ruma-events"
+version = "0.27.11"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
+dependencies = [
+ "as_variant",
+ "indexmap 2.2.5",
+ "js_int",
+ "js_option",
+ "percent-encoding",
+ "regex",
+ "ruma-common",
+ "ruma-identifiers-validation",
+ "ruma-macros",
+ "serde",
  "serde_json",
  "thiserror",
  "tracing",
  "url",
- "uuid",
  "wildmatch",
 ]
 
 [[package]]
 name = "ruma-federation-api"
-version = "0.6.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.8.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "js_int",
  "ruma-common",
+ "ruma-events",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "ruma-identifiers-validation"
-version = "0.9.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.9.3"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "js_int",
  "thiserror",
@@ -2170,8 +2111,8 @@ dependencies = [
 
 [[package]]
 name = "ruma-identity-service-api"
-version = "0.6.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.8.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "js_int",
  "ruma-common",
@@ -2180,8 +2121,8 @@ dependencies = [
 
 [[package]]
 name = "ruma-macros"
-version = "0.10.5"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.12.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "once_cell",
  "proc-macro-crate",
@@ -2189,30 +2130,31 @@ dependencies = [
  "quote",
  "ruma-identifiers-validation",
  "serde",
- "syn",
+ "syn 2.0.52",
  "toml",
 ]
 
 [[package]]
 name = "ruma-push-gateway-api"
-version = "0.6.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.8.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
  "js_int",
  "ruma-common",
+ "ruma-events",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "ruma-signatures"
-version = "0.12.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.14.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
- "base64 0.20.0",
+ "base64",
  "ed25519-dalek",
  "pkcs8",
- "rand 0.7.3",
+ "rand",
  "ruma-common",
  "serde_json",
  "sha2",
@@ -2222,12 +2164,13 @@ dependencies = [
 
 [[package]]
 name = "ruma-state-res"
-version = "0.8.0"
-source = "git+https://github.com/ruma/ruma?rev=67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26#67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26"
+version = "0.10.0"
+source = "git+https://github.com/ruma/ruma?rev=5495b85aa311c2805302edb0a7de40399e22b397#5495b85aa311c2805302edb0a7de40399e22b397"
 dependencies = [
- "itertools",
+ "itertools 0.11.0",
  "js_int",
  "ruma-common",
+ "ruma-events",
  "serde",
  "serde_json",
  "thiserror",
@@ -2236,11 +2179,11 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01e213bc3ecb39ac32e81e51ebe31fd888a940515173e3a18a35f8c6e896422a"
+checksum = "549b9d036d571d42e6e85d1c1425e2ac83491075078ca9a15be021c56b1641f2"
 dependencies = [
- "bitflags",
+ "bitflags 2.4.2",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -2250,16 +2193,48 @@ dependencies = [
 
 [[package]]
 name = "rust-argon2"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b50162d19404029c1ceca6f6980fe40d45c8b369f6f44446fa14bb39573b5bb9"
+checksum = "a5885493fdf0be6cdff808d1533ce878d21cfa49c7086fa00c66355cd9141bfc"
 dependencies = [
- "base64 0.13.1",
+ "base64",
  "blake2b_simd",
  "constant_time_eq",
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rust-librocksdb-sys"
+version = "0.18.1+8.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef22f434855ceb8daf99073fcf909d957ad8705f5b530154e47978ae68e867c"
+dependencies = [
+ "bindgen",
+ "bzip2-sys",
+ "cc",
+ "glob",
+ "libc",
+ "libz-sys",
+ "lz4-sys",
+ "zstd-sys",
+]
+
+[[package]]
+name = "rust-rocksdb"
+version = "0.22.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62223f035e676bb69da2ab9487e6f710da82be89473c658c51ed3b1a60c4b4a6"
+dependencies = [
+ "libc",
+ "rust-librocksdb-sys",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -2267,74 +2242,89 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
-name = "rustls"
-version = "0.20.7"
+name = "rustc_version"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "539a2bfe908f471bfa933876bd1eb6a19cf2176d375f82ef7f99530a40e48c2c"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
 dependencies = [
  "log",
  "ring",
+ "rustls-webpki",
  "sct",
- "webpki",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.2"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0167bac7a9f490495f3c33013e7722b53cb087ecbe082fb0c6387c96f634ea50"
+checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile 1.0.1",
+ "rustls-pemfile",
  "schannel",
  "security-framework",
 ]
 
 [[package]]
 name = "rustls-pemfile"
-version = "0.2.1"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eebeaeb360c87bfb72e84abdb3447159c0eaececf1bef2aecd65a8be949d1c9"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
- "base64 0.13.1",
+ "base64",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "1.0.1"
+name = "rustls-webpki"
+version = "0.101.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0864aeff53f8c05aa08d86e5ef839d3dfcf07aeba2db32f12db0ef716e87bd55"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
 dependencies = [
- "base64 0.13.1",
+ "ring",
+ "untrusted",
 ]
 
+[[package]]
+name = "rustversion"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+
 [[package]]
 name = "ryu"
-version = "1.0.11"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"
+checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
 
 [[package]]
 name = "schannel"
-version = "0.1.20"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d6731146462ea25d9244b2ed5fd1d716d25c52e4d54aa4fb0f3c4e9854dbe2"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
 dependencies = [
- "lazy_static",
- "windows-sys 0.36.1",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "sct"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
 dependencies = [
  "ring",
  "untrusted",
@@ -2348,11 +2338,11 @@ checksum = "621e3680f3e07db4c9c2c3fb07c6223ab2fab2e54bd3c04c3ae037990f428c32"
 
 [[package]]
 name = "security-framework"
-version = "2.7.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bc1bb97804af6631813c55739f771071e0f2ed33ee20b68c86ec505d906356c"
+checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2361,45 +2351,83 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.6.1"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0160a13a177a45bfb43ce71c01580998474f556ad854dcbca936dd2841a5c556"
+checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
 dependencies = [
  "core-foundation-sys",
  "libc",
 ]
 
 [[package]]
-name = "serde"
-version = "1.0.147"
+name = "semver"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d193d69bae983fc11a79df82342761dfbf28a99fc8d203dca4c3c1b590948965"
+checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
+
+[[package]]
+name = "serde"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.147"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f1d362ca8fc9c3e3a7484440752472d68a6caa98f1ab81d99b5dfe517cec852"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
+]
+
+[[package]]
+name = "serde_html_form"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50437e6a58912eecc08865e35ea2e8d365fbb2db0debb1c8bb43bf1faf055f25"
+dependencies = [
+ "form_urlencoded",
+ "indexmap 2.2.5",
+ "itoa",
+ "ryu",
+ "serde",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.89"
+version = "1.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020ff22c755c2ed3f8cf162dbb41a7268d934702f3ed3631656ea597e08fc3db"
+checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
 dependencies = [
  "itoa",
  "ryu",
  "serde",
 ]
 
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af99884400da37c88f5e9146b7f1fd0fbcae8f6eec4e9da38b67d05486f814a6"
+dependencies = [
+ "itoa",
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -2414,11 +2442,11 @@ dependencies = [
 
 [[package]]
 name = "serde_yaml"
-version = "0.9.14"
+version = "0.9.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d232d893b10de3eb7258ff01974d6ee20663d8e833263c99409d4b13a0209da"
+checksum = "8fd075d994154d4a774f95b51fb96bdc2832b0ea48425c92546073816cda1f2f"
 dependencies = [
- "indexmap",
+ "indexmap 2.2.5",
  "itoa",
  "ryu",
  "serde",
@@ -2427,68 +2455,75 @@ dependencies = [
 
 [[package]]
 name = "sha-1"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "028f48d513f9678cda28f6e4064755b3fbb2af6acd672f2c209b62323f7aea0f"
+checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest 0.10.6",
+ "digest",
 ]
 
 [[package]]
 name = "sha1"
-version = "0.10.5"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest 0.10.6",
+ "digest",
 ]
 
 [[package]]
 name = "sha2"
-version = "0.9.9"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
- "block-buffer 0.9.0",
  "cfg-if",
  "cpufeatures",
- "digest 0.9.0",
- "opaque-debug",
+ "digest",
 ]
 
 [[package]]
 name = "sharded-slab"
-version = "0.1.4"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "900fba806f70c630b0a382d0d825e17a0f19fcd059a2ade1ff237bcddf446b31"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
 dependencies = [
  "lazy_static",
 ]
 
 [[package]]
 name = "shlex"
-version = "1.1.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51e73328dc4ac0c7ccbda3a494dfa03df1de2f46018127f60c693f2648455b0"
+checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "signature"
-version = "1.6.4"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
 
 [[package]]
 name = "simple_asn1"
@@ -2504,40 +2539,40 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
 dependencies = [
  "autocfg",
 ]
 
 [[package]]
 name = "smallvec"
-version = "1.10.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
 name = "socket2"
-version = "0.4.7"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02e2d2db9033d13a1567121ddd7a095ee144db4e1ca1b1bda3419bc0da294ebd"
+checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
 dependencies = [
  "libc",
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "spin"
-version = "0.5.2"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
 [[package]]
 name = "spki"
-version = "0.6.0"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
  "der",
@@ -2554,15 +2589,26 @@ dependencies = [
 
 [[package]]
 name = "subtle"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "1.0.103"
+version = "1.0.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b699d15b36d1f02c3e7c69f8ffef53de37aefae075d8488d4ba1a7788d574a07"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2571,57 +2617,58 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20518fe4a4c9acf048008599e464deb21beeae3d3578418951a189c235a7a9a8"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
-name = "synchronoise"
-version = "1.0.1"
+name = "system-configuration"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dbc01390fc626ce8d1cffe3376ded2b72a11bb70e1c75f404a210e4daa4def2"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
- "crossbeam-queue",
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
 ]
 
 [[package]]
-name = "synstructure"
-version = "0.12.6"
+name = "system-configuration-sys"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "unicode-xid",
+ "core-foundation-sys",
+ "libc",
 ]
 
 [[package]]
 name = "thiserror"
-version = "1.0.37"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10deb33631e3c9018b9baf9dcbbc4f737320d2b576bac10f6aefa048fa407e3e"
+checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.37"
+version = "1.0.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "982d17546b47146b28f7c22e3d08465f6b8903d0ea13c1660d9d84a6e7adcdbb"
+checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.4"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
 dependencies = [
+ "cfg-if",
  "once_cell",
 ]
 
@@ -2649,9 +2696,9 @@ dependencies = [
 
 [[package]]
 name = "tikv-jemalloc-ctl"
-version = "0.5.0"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e37706572f4b151dff7a0146e040804e9c26fe3a3118591112f05cf12a4216c1"
+checksum = "619bfed27d807b54f7f776b9430d4f8060e66ee138a28632ca898584d462c31c"
 dependencies = [
  "libc",
  "paste",
@@ -2660,20 +2707,19 @@ dependencies = [
 
 [[package]]
 name = "tikv-jemalloc-sys"
-version = "0.5.2+5.3.0-patched"
+version = "0.5.4+5.3.0-patched"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec45c14da997d0925c7835883e4d5c181f196fa142f8c19d7643d1e9af2592c3"
+checksum = "9402443cb8fd499b6f327e40565234ff34dbda27460c5b47db0db77443dd85d1"
 dependencies = [
  "cc",
- "fs_extra",
  "libc",
 ]
 
 [[package]]
 name = "tikv-jemallocator"
-version = "0.5.0"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20612db8a13a6c06d57ec83953694185a367e16945f66565e8028d2c0bd76979"
+checksum = "965fe0c26be5c56c94e38ba547249074803efd52adfb66de62107d95aab3eaca"
 dependencies = [
  "libc",
  "tikv-jemalloc-sys",
@@ -2681,11 +2727,14 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.17"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a561bf4617eebd33bca6434b988f39ed798e527f51a1e797d0ee4f61c0a38376"
+checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
 dependencies = [
+ "deranged",
  "itoa",
+ "num-conv",
+ "powerfmt",
  "serde",
  "time-core",
  "time-macros",
@@ -2693,16 +2742,17 @@ dependencies = [
 
 [[package]]
 name = "time-core"
-version = "0.1.0"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.6"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d967f99f534ca7e495c575c62638eebc2898a8c84c119b89e250477bc4ba16b2"
+checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
@@ -2717,49 +2767,47 @@ dependencies = [
 
 [[package]]
 name = "tinyvec_macros"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.22.0"
+version = "1.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76ce4a75fb488c605c54bf610f221cea8b0dafb53333c1a67e8ee199dcd2ae3"
+checksum = "61285f6515fa018fb2d1e46eb21223fff441ee8db5d0f1435e8ab4f5cdb80931"
 dependencies = [
- "autocfg",
+ "backtrace",
  "bytes",
  "libc",
- "memchr",
  "mio",
  "num_cpus",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
- "winapi",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "1.8.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.23.4"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c43ee83903113e03984cb9e5cebe6c04a5116269e900e3ddba8f068a62adda59"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
  "rustls",
  "tokio",
- "webpki",
 ]
 
 [[package]]
@@ -2776,9 +2824,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.11"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d660770404473ccd7bc9f8b28494a811bc18542b915c0855c51e8f419d5223ce"
+checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -2787,9 +2835,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.4"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
+checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2801,11 +2849,36 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.5.9"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82e1a7758622a465f8cee077614c73484dac5b836c02ff6a40d5d1010324d7"
+checksum = "185d8ab0dfbb35cf1399a6344d8484209c088f75f8f68230da55d48d95d43e3d"
 dependencies = [
  "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
+dependencies = [
+ "indexmap 2.2.5",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
 ]
 
 [[package]]
@@ -2818,7 +2891,6 @@ dependencies = [
  "futures-util",
  "pin-project",
  "pin-project-lite",
- "tokio",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -2826,12 +2898,11 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.3.4"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c530c8675c1dbf98facee631536fa116b5fb6382d7dd6dc1b118d970eafe3ba"
+checksum = "61c5bb1d698276a2443e5ecfabc1008bf15a36c12e6a7176e7bf089ea9131140"
 dependencies = [
- "async-compression",
- "bitflags",
+ "bitflags 2.4.2",
  "bytes",
  "futures-core",
  "futures-util",
@@ -2839,8 +2910,6 @@ dependencies = [
  "http-body",
  "http-range-header",
  "pin-project-lite",
- "tokio",
- "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
@@ -2861,11 +2930,10 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.37"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "cfg-if",
  "log",
  "pin-project-lite",
  "tracing-attributes",
@@ -2874,20 +2942,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.23"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4017f8f45139870ca7e672686113917c71c7a6e02d4924eda67186083c03081a"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.30"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
  "valuable",
@@ -2906,12 +2974,23 @@ dependencies = [
 
 [[package]]
 name = "tracing-log"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ddad33d2d10b1ed7eb9d1f518a5674713876e97e5bb9b7345a7984fbb4f922"
+checksum = "f751112709b4e791d8ce53e32c4ed2d353565a795ce84da2285393f41557bdf2"
 dependencies = [
- "lazy_static",
  "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
  "tracing-core",
 ]
 
@@ -2925,15 +3004,15 @@ dependencies = [
  "opentelemetry",
  "tracing",
  "tracing-core",
- "tracing-log",
+ "tracing-log 0.1.4",
  "tracing-subscriber",
 ]
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.16"
+version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6176eae26dd70d0c919749377897b54a9276bd7061339665dd68777926b5a70"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
 dependencies = [
  "matchers",
  "nu-ansi-term",
@@ -2944,7 +3023,7 @@ dependencies = [
  "thread_local",
  "tracing",
  "tracing-core",
- "tracing-log",
+ "tracing-log 0.2.0",
 ]
 
 [[package]]
@@ -2963,7 +3042,7 @@ dependencies = [
  "idna 0.2.3",
  "ipnet",
  "lazy_static",
- "rand 0.8.5",
+ "rand",
  "smallvec",
  "thiserror",
  "tinyvec",
@@ -2994,88 +3073,97 @@ dependencies = [
 
 [[package]]
 name = "try-lock"
-version = "0.2.3"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59547bce71d9c38b83d9c0e92b6066c4253371f15005def0c30d9657f50c7642"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
-version = "1.15.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "typewit"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6fb9ae6a3cafaf0a5d14c2302ca525f9ae8e07a0f0e6949de88d882c37a6e24"
+dependencies = [
+ "typewit_proc_macros",
+]
+
+[[package]]
+name = "typewit_proc_macros"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e36a83ea2b3c704935a01b4642946aadd445cea40b10935e3f8bd8052b8193d6"
 
 [[package]]
 name = "uncased"
-version = "0.9.7"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09b01702b0fd0b3fadcf98e098780badda8742d4f4a7676615cad90e8ac73622"
+checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
 dependencies = [
  "version_check",
 ]
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.8"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "099b7128301d285f79ddd55b9a83d5e6b9e97c92e0ea0daebee7263e932de992"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.5"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
 dependencies = [
  "tinyvec",
 ]
 
-[[package]]
-name = "unicode-xid"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
-
 [[package]]
 name = "unsafe-libyaml"
-version = "0.2.4"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1e5fa573d8ac5f1a856f8d7be41d390ee973daf97c806b2c1a465e4e1406e68"
+checksum = "ab4c90930b95a82d00dc9e9ac071b4991924390d46cbd0dfe566148667605e4b"
 
 [[package]]
 name = "unsigned-varint"
-version = "0.7.1"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d86a8dc7f45e4c1b0d30e43038c38f274e77af056aa5f74b93c2cf9eb3c1c836"
+checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
 
 [[package]]
 name = "untrusted"
-version = "0.7.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.3.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
- "idna 0.3.0",
+ "idna 0.5.0",
  "percent-encoding",
 ]
 
 [[package]]
 name = "uuid"
-version = "1.2.2"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "422ee0de9031b5b948b97a8fc04e3aa35230001a722ddd27943e0be31564ce4c"
+checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"
 dependencies = [
- "getrandom 0.2.8",
+ "getrandom",
 ]
 
 [[package]]
@@ -3098,20 +3186,13 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "want"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
 dependencies = [
- "log",
  "try-lock",
 ]
 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -3120,9 +3201,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.83"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -3130,24 +3211,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.83"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.33"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23639446165ca5a5de86ae1d8896b737ae80319560fbaa4c2887b7da6e7ebd7d"
+checksum = "76bc14366121efc8dbb487ab05bcc9d346b3b5ec0eaa76e46594cabbe51762c0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -3157,9 +3238,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.83"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3167,60 +3248,60 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.83"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.52",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.83"
+version = "0.2.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
 
 [[package]]
 name = "web-sys"
-version = "0.3.60"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
 ]
 
 [[package]]
-name = "webpki"
-version = "0.22.0"
+name = "web-time"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
- "ring",
- "untrusted",
+ "js-sys",
+ "wasm-bindgen",
 ]
 
 [[package]]
 name = "weezl"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
+checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"
 
 [[package]]
 name = "widestring"
-version = "0.5.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17882f045410753661207383517a6f62ec3dbeb6a4ed2acce01f0728238d1983"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
 
 [[package]]
 name = "wildmatch"
-version = "2.1.1"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee583bdc5ff1cf9db20e9db5bb3ff4c3089a8f6b8b31aff265c9aba85812db86"
+checksum = "017f0a8ed8331210d91b7a4c30d4edef8f21a65c02f2540496e2e79725f6d8a8"
 
 [[package]]
 name = "winapi"
@@ -3246,149 +3327,187 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-sys"
-version = "0.36.1"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows_aarch64_msvc 0.36.1",
- "windows_i686_gnu 0.36.1",
- "windows_i686_msvc 0.36.1",
- "windows_x86_64_gnu 0.36.1",
- "windows_x86_64_msvc 0.36.1",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
 name = "windows-sys"
-version = "0.42.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc 0.42.0",
- "windows_i686_gnu 0.42.0",
- "windows_i686_msvc 0.42.0",
- "windows_x86_64_gnu 0.42.0",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc 0.42.0",
+ "windows-targets 0.52.4",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.4",
+ "windows_aarch64_msvc 0.52.4",
+ "windows_i686_gnu 0.52.4",
+ "windows_i686_msvc 0.52.4",
+ "windows_x86_64_gnu 0.52.4",
+ "windows_x86_64_gnullvm 0.52.4",
+ "windows_x86_64_msvc 0.52.4",
 ]
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.42.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d2aa71f6f0cbe00ae5167d90ef3cfe66527d6f613ca78ac8024c3ccab9a19e"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.42.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd0f252f5a35cac83d6311b2e795981f5ee6e67eb1f9a7f64eb4500fbc4dcdb4"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.42.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbeae19f6716841636c28d695375df17562ca208b2b7d0dc47635a50ae6c5de7"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.42.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84c12f65daa39dd2babe6e442988fc329d6243fdce47d7d2d155b8d874862246"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.42.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf7b1b21b5362cbc318f686150e5bcea75ecedc74dd157d874d754a2ca44b0ed"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.42.0"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09d525d2ba30eeb3297665bd434a54297e4170c7f1a44cad4ef58095b4cd2028"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.42.0"
+version = "0.52.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f40009d85759725a34da6d89a94e63d7bdc50a862acf0dbc7c8e488f1edcb6f5"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
 
 [[package]]
-name = "winreg"
-version = "0.7.0"
+name = "winnow"
+version = "0.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0120db82e8a1e0b9fb3345a539c478767c0048d842860994d96113d5b667bd69"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
 dependencies = [
- "winapi",
+ "memchr",
 ]
 
 [[package]]
 name = "winreg"
-version = "0.10.1"
+version = "0.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
 dependencies = [
- "winapi",
+ "cfg-if",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "yansi"
-version = "0.5.1"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
 [[package]]
-name = "zeroize"
-version = "1.5.7"
+name = "zerocopy"
+version = "0.7.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c394b5bd0c6f669e7275d9c20aa90ae064cb22e75a1cad54e1b34088034b149f"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
 dependencies = [
- "zeroize_derive",
+ "zerocopy-derive",
 ]
 
 [[package]]
-name = "zeroize_derive"
-version = "1.3.2"
+name = "zerocopy-derive"
+version = "0.7.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f8f187641dad4f680d25c4bfc4225b418165984179f26ca76ec4fb6441d3a17"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
- "synstructure",
+ "syn 2.0.52",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+
 [[package]]
 name = "zigzag"
 version = "0.1.0"
@@ -3397,3 +3516,13 @@ checksum = "70b40401a28d86ce16a330b863b86fd7dbee4d7c940587ab09ab8c019f9e3fdf"
 dependencies = [
  "num-traits",
 ]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.9+zstd.1.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e16efa8a874a0481a574084d34cc26fdb3b99627480f785888deb6386506656"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/Cargo.toml b/Cargo.toml
index 84310847..6f9f9a3b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,3 +1,14 @@
+# Keep alphabetically sorted
+[workspace.lints.rust]
+explicit_outlives_requirements = "warn"
+unused_qualifications = "warn"
+
+# Keep alphabetically sorted
+[workspace.lints.clippy]
+cloned_instead_of_copied = "warn"
+dbg_macro = "warn"
+str_to_string = "warn"
+
 [package]
 name = "conduit"
 description = "A Matrix homeserver written in Rust"
@@ -6,108 +17,123 @@ authors = ["timokoesters <timo@koesters.xyz>"]
 homepage = "https://conduit.rs"
 repository = "https://gitlab.com/famedly/conduit"
 readme = "README.md"
-version = "0.6.0-alpha"
+version = "0.7.0-alpha"
 edition = "2021"
 
-# When changing this, make sure to update the `flake.lock` file by running
-# `nix flake update`. If you don't have Nix installed or otherwise don't know
-# how to do this, ping `@charles:computer.surgery` or `@dusk:gaze.systems` in
-# the matrix room.
-rust-version = "1.64.0"
+# See also `rust-toolchain.toml`
+rust-version = "1.75.0"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
+[lints]
+workspace = true
+
 [dependencies]
 # Web framework
-axum = { version = "0.5.17", default-features = false, features = ["form", "headers", "http1", "http2", "json", "matched-path"], optional = true }
-axum-server = { version = "0.4.0", features = ["tls-rustls"] }
-tower = { version = "0.4.8", features = ["util"] }
-tower-http = { version = "0.3.4", features = ["add-extension", "cors", "compression-full", "sensitive-headers", "trace", "util"] }
+axum = { version = "0.6.18", default-features = false, features = ["form", "headers", "http1", "http2", "json", "matched-path"], optional = true }
+axum-server = { version = "0.5.1", features = ["tls-rustls"] }
+tower = { version = "0.4.13", features = ["util"] }
+tower-http = { version = "0.4.1", features = ["add-extension", "cors", "sensitive-headers", "trace", "util"] }
 
 # Used for matrix spec type definitions and helpers
 #ruma = { version = "0.4.0", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
-ruma = { git = "https://github.com/ruma/ruma", rev = "67d0f3cc04a8d1dc4a8a1ec947519967ce11ce26", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }
-#ruma = { git = "https://github.com/timokoesters/ruma", rev = "50c1db7e0a3a21fc794b0cce3b64285a4c750c71", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
-#ruma = { path = "../ruma/crates/ruma", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
+ruma = { git = "https://github.com/ruma/ruma", rev = "5495b85aa311c2805302edb0a7de40399e22b397", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-msc3575", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }
+#ruma = { git = "https://github.com/timokoesters/ruma", rev = "4ec9c69bb7e09391add2382b3ebac97b6e8f4c64", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-msc3575", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }
+#ruma = { path = "../ruma/crates/ruma", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-msc3575", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }
 
 # Async runtime and utilities
-tokio = { version = "1.11.0", features = ["fs", "macros", "signal", "sync"] }
+tokio = { version = "1.28.1", features = ["fs", "macros", "signal", "sync"] }
 # Used for storing data permanently
 #sled = { version = "0.34.7", features = ["compression", "no_metrics"], optional = true }
 #sled = { git = "https://github.com/spacejam/sled.git", rev = "e4640e0773595229f398438886f19bca6f7326a2", features = ["compression"] }
-persy = { version = "1.0.0", optional = true, features = ["background_ops"] }
+persy = { version = "1.4.4", optional = true, features = ["background_ops"] }
 
 # Used for the http request / response body type for Ruma endpoints used with reqwest
-bytes = "1.1.0"
-http = "0.2.4"
+bytes = "1.4.0"
+http = "0.2.9"
 # Used to find data directory for default db path
-directories = "4.0.0"
+directories = "4.0.1"
 # Used for ruma wrapper
-serde_json = { version = "1.0.68", features = ["raw_value"] }
+serde_json = { version = "1.0.96", features = ["raw_value"] }
 # Used for appservice registration files
-serde_yaml = "0.9.13"
+serde_yaml = "0.9.21"
 # Used for pdu definition
-serde = { version = "1.0.130", features = ["rc"] }
+serde = { version = "1.0.163", features = ["rc"] }
 # Used for secure identifiers
-rand = "0.8.4"
+rand = "0.8.5"
 # Used to hash passwords
 rust-argon2 = "1.0.0"
 # Used to send requests
-reqwest = { default-features = false, features = ["rustls-tls-native-roots", "socks"], git = "https://github.com/timokoesters/reqwest", rev = "57b7cf4feb921573dfafad7d34b9ac6e44ead0bd" }
+hyper = "0.14.26"
+reqwest = { version = "0.11.18", default-features = false, features = ["rustls-tls-native-roots", "socks"] }
 # Used for conduit::Error type
-thiserror = "1.0.29"
+thiserror = "1.0.40"
 # Used to generate thumbnails for images
-image = { version = "0.24.4", default-features = false, features = ["jpeg", "png", "gif"] }
+image = { version = "0.24.6", default-features = false, features = ["jpeg", "png", "gif"] }
 # Used to encode server public key
-base64 = "0.13.0"
+base64 = "0.21.2"
 # Used when hashing the state
-ring = "0.16.20"
+ring = "0.17.7"
 # Used when querying the SRV record of other servers
 trust-dns-resolver = "0.22.0"
 # Used to find matching events for appservices
-regex = "1.5.4"
+regex = "1.8.1"
 # jwt jsonwebtokens
-jsonwebtoken = "8.1.1"
+jsonwebtoken = "9.2.0"
 # Performance measurements
-tracing = { version = "0.1.27", features = [] }
-tracing-subscriber = { version = "0.3.16", features = ["env-filter"] }
+tracing = { version = "0.1.37", features = [] }
+tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
 tracing-flame = "0.2.0"
 opentelemetry = { version = "0.18.0", features = ["rt-tokio"] }
 opentelemetry-jaeger = { version = "0.17.0", features = ["rt-tokio"] }
 tracing-opentelemetry = "0.18.0"
 lru-cache = "0.1.2"
-rusqlite = { version = "0.28.0", optional = true, features = ["bundled"] }
+rusqlite = { version = "0.29.0", optional = true, features = ["bundled"] }
 parking_lot = { version = "0.12.1", optional = true }
-crossbeam = { version = "0.8.1", optional = true }
-num_cpus = "1.13.0"
+# crossbeam = { version = "0.8.2", optional = true }
+num_cpus = "1.15.0"
 threadpool = "1.8.1"
-heed = { git = "https://github.com/timokoesters/heed.git", rev = "f6f825da7fb2c758867e05ad973ef800a6fe1d5d", optional = true }
-rocksdb = { version = "0.17.0", default-features = true, features = ["multi-threaded-cf", "zstd"], optional = true }
+# heed = { git = "https://github.com/timokoesters/heed.git", rev = "f6f825da7fb2c758867e05ad973ef800a6fe1d5d", optional = true }
+# Used for ruma wrapper
+serde_html_form = "0.2.0"
 
-thread_local = "1.1.3"
+thread_local = "1.1.7"
 # used for TURN server authentication
 hmac = "0.12.1"
-sha-1 = "0.10.0"
+sha-1 = "0.10.1"
 sha2 = "0.9"
 # used for conduit's CLI and admin room command parsing
-clap = { version = "4.0.11", default-features = false, features = ["std", "derive", "help", "usage", "error-context"] }
-futures-util = { version = "0.3.17", default-features = false }
+clap = { version = "4.3.0", default-features = false, features = ["std", "derive", "help", "usage", "error-context", "string"] }
+futures-util = { version = "0.3.28", default-features = false }
 # Used for reading the configuration from conduit.toml & environment variables
-figment = { version = "0.10.6", features = ["env", "toml"] }
+figment = { version = "0.10.8", features = ["env", "toml"] }
 
 tikv-jemalloc-ctl = { version = "0.5.0", features = ["use_std"], optional = true }
 tikv-jemallocator = { version = "0.5.0", features = ["unprefixed_malloc_on_supported_platforms"], optional = true }
 lazy_static = "1.4.0"
-async-trait = "0.1.57"
+async-trait = "0.1.68"
 
 sd-notify = { version = "0.4.1", optional = true }
 
+[dependencies.rocksdb]
+package = "rust-rocksdb"
+version = "0.22.7"
+optional = true
+features = [
+    "multi-threaded-cf",
+    "zstd",
+    "lz4",
+]
+
+[target.'cfg(unix)'.dependencies]
+nix = { version = "0.28", features = ["resource"] }
+
 [features]
-default = ["conduit_bin", "backend_sqlite", "backend_rocksdb", "jemalloc", "systemd"]
+default = ["conduit_bin", "backend_sqlite", "backend_rocksdb", "systemd"]
 #backend_sled = ["sled"]
 backend_persy = ["persy", "parking_lot"]
 backend_sqlite = ["sqlite"]
-backend_heed = ["heed", "crossbeam"]
+#backend_heed = ["heed", "crossbeam"]
 backend_rocksdb = ["rocksdb"]
 jemalloc = ["tikv-jemalloc-ctl", "tikv-jemallocator"]
 sqlite = ["rusqlite", "parking_lot", "tokio/signal"]
@@ -135,7 +161,7 @@ instead of a server that has high scalability."""
 section = "net"
 priority = "optional"
 assets = [
-  ["debian/README.Debian", "usr/share/doc/matrix-conduit/", "644"],
+  ["debian/README.md", "usr/share/doc/matrix-conduit/README.Debian", "644"],
   ["README.md", "usr/share/doc/matrix-conduit/", "644"],
   ["target/release/conduit", "usr/sbin/matrix-conduit", "755"],
 ]
diff --git a/Cross.toml b/Cross.toml
deleted file mode 100644
index 5d99a358..00000000
--- a/Cross.toml
+++ /dev/null
@@ -1,23 +0,0 @@
-[build.env]
-# CI uses an S3 endpoint to store sccache artifacts, so their config needs to
-# be available in the cross container as well
-passthrough = [
-    "RUSTC_WRAPPER",
-    "AWS_ACCESS_KEY_ID",
-    "AWS_SECRET_ACCESS_KEY",
-    "SCCACHE_BUCKET",
-    "SCCACHE_ENDPOINT",
-    "SCCACHE_S3_USE_SSL",
-]
-
-[target.aarch64-unknown-linux-musl]
-image = "registry.gitlab.com/jfowl/conduit-containers/rust-cross-aarch64-unknown-linux-musl:latest"
-
-[target.arm-unknown-linux-musleabihf]
-image = "registry.gitlab.com/jfowl/conduit-containers/rust-cross-arm-unknown-linux-musleabihf:latest"
-
-[target.armv7-unknown-linux-musleabihf]
-image = "registry.gitlab.com/jfowl/conduit-containers/rust-cross-armv7-unknown-linux-musleabihf:latest"
-
-[target.x86_64-unknown-linux-musl]
-image = "registry.gitlab.com/jfowl/conduit-containers/rust-cross-x86_64-unknown-linux-musl@sha256:b6d689e42f0236c8a38b961bca2a12086018b85ed20e0826310421daf182e2bb"
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index 2763b126..00000000
--- a/Dockerfile
+++ /dev/null
@@ -1,130 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM docker.io/rust:1.64-bullseye AS builder
-WORKDIR /usr/src/conduit
-
-# Install required packages to build Conduit and it's dependencies
-RUN apt-get update && \
-    apt-get -y --no-install-recommends install libclang-dev=1:11.0-51+nmu5
-
-# == Build dependencies without our own code separately for caching ==
-#
-# Need a fake main.rs since Cargo refuses to build anything otherwise.
-#
-# See https://github.com/rust-lang/cargo/issues/2644 for a Cargo feature
-# request that would allow just dependencies to be compiled, presumably
-# regardless of whether source files are available.
-RUN mkdir src && touch src/lib.rs && echo 'fn main() {}' > src/main.rs
-COPY Cargo.toml Cargo.lock ./
-RUN cargo build --release && rm -r src
-
-# Copy over actual Conduit sources
-COPY src src
-
-# main.rs and lib.rs need their timestamp updated for this to work correctly since
-# otherwise the build with the fake main.rs from above is newer than the
-# source files (COPY preserves timestamps).
-#
-# Builds conduit and places the binary at /usr/src/conduit/target/release/conduit
-RUN touch src/main.rs && touch src/lib.rs && cargo build --release
-
-
-# ONLY USEFUL FOR CI: target stage to extract build artifacts
-FROM scratch AS builder-result
-COPY --from=builder /usr/src/conduit/target/release/conduit /conduit
-
-
-
-# ---------------------------------------------------------------------------------------------------------------
-# Build cargo-deb, a tool to package up rust binaries into .deb packages for Debian/Ubuntu based systems:
-# ---------------------------------------------------------------------------------------------------------------
-FROM docker.io/rust:1.64-bullseye AS build-cargo-deb
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-    dpkg \
-    dpkg-dev \
-    liblzma-dev
-
-RUN cargo install cargo-deb 
-# => binary is in /usr/local/cargo/bin/cargo-deb
-
-
-# ---------------------------------------------------------------------------------------------------------------
-# Package conduit build-result into a .deb package:
-# ---------------------------------------------------------------------------------------------------------------
-FROM builder AS packager
-WORKDIR /usr/src/conduit
-
-COPY ./LICENSE ./LICENSE
-COPY ./README.md ./README.md
-COPY debian/README.Debian ./debian/
-COPY --from=build-cargo-deb /usr/local/cargo/bin/cargo-deb /usr/local/cargo/bin/cargo-deb
-
-# --no-build makes cargo-deb reuse already compiled project
-RUN cargo deb --no-build
-# => Package is in /usr/src/conduit/target/debian/<project_name>_<version>_<arch>.deb
-
-
-# ONLY USEFUL FOR CI: target stage to extract build artifacts
-FROM scratch AS packager-result
-COPY --from=packager /usr/src/conduit/target/debian/*.deb /conduit.deb
-
-
-# ---------------------------------------------------------------------------------------------------------------
-# Stuff below this line actually ends up in the resulting docker image
-# ---------------------------------------------------------------------------------------------------------------
-FROM docker.io/debian:bullseye-slim AS runner
-
-# Standard port on which Conduit launches.
-# You still need to map the port when using the docker command or docker-compose.
-EXPOSE 6167
-
-ARG DEFAULT_DB_PATH=/var/lib/matrix-conduit
-
-ENV CONDUIT_PORT=6167 \
-    CONDUIT_ADDRESS="0.0.0.0" \
-    CONDUIT_DATABASE_PATH=${DEFAULT_DB_PATH} \
-    CONDUIT_CONFIG=''
-#    └─> Set no config file to do all configuration with env vars
-
-# Conduit needs:
-#   dpkg: to install conduit.deb
-#   ca-certificates: for https
-#   iproute2 & wget: for the healthcheck script
-RUN apt-get update && apt-get -y --no-install-recommends install \
-    dpkg \
-    ca-certificates \
-    iproute2 \
-    wget \
-    && rm -rf /var/lib/apt/lists/*
-
-# Test if Conduit is still alive, uses the same endpoint as Element
-COPY ./docker/healthcheck.sh /srv/conduit/healthcheck.sh
-HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
-
-# Install conduit.deb:
-COPY --from=packager /usr/src/conduit/target/debian/*.deb /srv/conduit/
-RUN dpkg -i /srv/conduit/*.deb
-
-# Improve security: Don't run stuff as root, that does not need to run as root
-# Most distros also use 1000:1000 for the first real user, so this should resolve volume mounting problems.
-ARG USER_ID=1000
-ARG GROUP_ID=1000
-RUN set -x ; \
-    groupadd -r -g ${GROUP_ID} conduit ; \
-    useradd -l -r -M -d /srv/conduit -o -u ${USER_ID} -g conduit conduit && exit 0 ; exit 1
-
-# Create database directory, change ownership of Conduit files to conduit user and group and make the healthcheck executable:
-RUN chown -cR conduit:conduit /srv/conduit && \
-    chmod +x /srv/conduit/healthcheck.sh && \
-    mkdir -p ${DEFAULT_DB_PATH} && \
-    chown -cR conduit:conduit ${DEFAULT_DB_PATH}
-
-# Change user to conduit, no root permissions afterwards:
-USER conduit
-# Set container home directory
-WORKDIR /srv/conduit
-
-# Run Conduit and print backtraces on panics
-ENV RUST_BACKTRACE=1
-ENTRYPOINT [ "/usr/sbin/matrix-conduit" ]
diff --git a/README.md b/README.md
index f73f6aa9..474a5247 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,15 @@
 # Conduit
-### A Matrix homeserver written in Rust
 
+<!-- ANCHOR: catchphrase -->
+### A Matrix homeserver written in Rust
+<!-- ANCHOR_END: catchphrase -->
+
+Please visit the [Conduit documentation](https://famedly.gitlab.io/conduit) for more information.
+Alternatively you can open [docs/introduction.md](docs/introduction.md) in this repository.
+
+<!-- ANCHOR: body -->
 #### What is Matrix?
+
 [Matrix](https://matrix.org) is an open network for secure and decentralized
 communication. Users from every Matrix homeserver can chat with users from all
 other Matrix servers. You can even use bridges (also called Matrix appservices)
@@ -15,11 +23,7 @@ friends or company.
 
 #### Can I try it out?
 
-Yes! You can test our Conduit instance by opening a Matrix client (<https://app.element.io> or Element Android for
-example) and registering on the `conduit.rs` homeserver.
-
-*Registration is currently disabled because of scammers. For an account please
-  message us (see contact section below).*
+Yes! You can test our Conduit instance by opening a client that supports registration tokens such as [Element web](https://app.element.io/), [Nheko](https://matrix.org/ecosystem/clients/nheko/) or [SchildiChat web](https://app.schildi.chat/) and registering on the `conduit.rs` homeserver. The registration token is "for_testing_only". Don't share personal information. Once you have registered, you can use any other [Matrix client](https://matrix.org/ecosystem/clients) to login.
 
 Server hosting for conduit.rs is donated by the Matrix.org Foundation.
 
@@ -33,27 +37,25 @@ There are still a few important features missing:
 
 - E2EE emoji comparison over federation (E2EE chat works)
 - Outgoing read receipts, typing, presence over federation (incoming works)
+<!-- ANCHOR_END: body -->
 
-Check out the [Conduit 1.0 Release Milestone](https://gitlab.com/famedly/conduit/-/milestones/3).
-
-#### How can I deploy my own?
-
-- Simple install (this was tested the most): [DEPLOY.md](DEPLOY.md)
-- Debian package: [debian/README.Debian](debian/README.Debian)
-- Nix/NixOS: [nix/README.md](nix/README.md)
-- Docker: [docker/README.md](docker/README.md)
-
-If you want to connect an Appservice to Conduit, take a look at [APPSERVICES.md](APPSERVICES.md).
-
+<!-- ANCHOR: footer -->
 #### How can I contribute?
 
-1. Look for an issue you would like to work on and make sure it's not assigned
-   to other users
-2. Ask someone to assign the issue to you (comment on the issue or chat in
-   [#conduit:fachschaften.org](https://matrix.to/#/#conduit:fachschaften.org))
-3. Fork the repo and work on the issue.[#conduit:fachschaften.org](https://matrix.to/#/#conduit:fachschaften.org) is happy to help :)
+1. Look for an issue you would like to work on and make sure no one else is currently working on it.
+2. Tell us that you are working on the issue (comment on the issue or chat in
+   [#conduit:fachschaften.org](https://matrix.to/#/#conduit:fachschaften.org)). If it is more complicated, please explain your approach and ask questions.
+3. Fork the repo, create a new branch and push commits.
 4. Submit a MR
 
+#### Contact
+
+If you have any questions, feel free to
+- Ask in `#conduit:fachschaften.org` on Matrix
+- Write an E-Mail to `conduit@koesters.xyz`
+- Send an direct message to `@timokoesters:fachschaften.org` on Matrix
+- [Open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new)
+
 #### Thanks to
 
 Thanks to FUTO, Famedly, Prototype Fund (DLR and German BMBF) and all individuals for financially supporting this project.
@@ -63,20 +65,13 @@ Thanks to the contributors to Conduit and all libraries we use, for example:
 - Ruma: A clean library for the Matrix Spec in Rust
 - axum: A modular web framework
 
-#### Contact
-
-If you run into any question, feel free to
-- Ask us in `#conduit:fachschaften.org` on Matrix
-- Write an E-Mail to `conduit@koesters.xyz`
-- Send an direct message to `timo@fachschaften.org` on Matrix
-- [Open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new)
-
 #### Donate
 
-Liberapay: <https://liberapay.com/timokoesters/>\
-Bitcoin: `bc1qnnykf986tw49ur7wx9rpw2tevpsztvar5x8w4n`
+- Liberapay: <https://liberapay.com/timokoesters/>
+- Bitcoin: `bc1qnnykf986tw49ur7wx9rpw2tevpsztvar5x8w4n`
 
 #### Logo
 
-Lightning Bolt Logo: https://github.com/mozilla/fxemoji/blob/gh-pages/svgs/nature/u26A1-bolt.svg \
-Logo License: https://github.com/mozilla/fxemoji/blob/gh-pages/LICENSE.md
+- Lightning Bolt Logo: <https://github.com/mozilla/fxemoji/blob/gh-pages/svgs/nature/u26A1-bolt.svg>
+- Logo License: <https://github.com/mozilla/fxemoji/blob/gh-pages/LICENSE.md>
+<!-- ANCHOR_END: footer -->
diff --git a/bin/complement b/bin/complement
new file mode 100755
index 00000000..291953dd
--- /dev/null
+++ b/bin/complement
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Path to Complement's source code
+COMPLEMENT_SRC="$1"
+
+# A `.jsonl` file to write test logs to
+LOG_FILE="$2"
+
+# A `.jsonl` file to write test results to
+RESULTS_FILE="$3"
+
+OCI_IMAGE="complement-conduit:dev"
+
+env \
+    -C "$(git rev-parse --show-toplevel)" \
+    docker build \
+        --tag "$OCI_IMAGE" \
+        --file complement/Dockerfile \
+        .
+
+# It's okay (likely, even) that `go test` exits nonzero
+set +o pipefail
+env \
+    -C "$COMPLEMENT_SRC" \
+    COMPLEMENT_BASE_IMAGE="$OCI_IMAGE" \
+    go test -json ./tests | tee "$LOG_FILE"
+set -o pipefail
+
+# Post-process the results into an easy-to-compare format
+cat "$LOG_FILE" | jq -c '
+    select(
+        (.Action == "pass" or .Action == "fail" or .Action == "skip")
+        and .Test != null
+    ) | {Action: .Action, Test: .Test}
+    ' | sort > "$RESULTS_FILE"
diff --git a/bin/nix-build-and-cache b/bin/nix-build-and-cache
new file mode 100755
index 00000000..350e1717
--- /dev/null
+++ b/bin/nix-build-and-cache
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# The first argument must be the desired installable
+INSTALLABLE="$1"
+
+# Build the installable and forward any other arguments too
+nix build "$@"
+
+if [ ! -z ${ATTIC_TOKEN+x} ]; then
+    nix run --inputs-from . attic -- \
+        login \
+        conduit \
+        "${ATTIC_ENDPOINT:-https://nix.computer.surgery/conduit}" \
+        "$ATTIC_TOKEN"
+
+    # Push the target installable and its build dependencies
+    nix run --inputs-from . attic -- \
+        push \
+        conduit \
+        "$(nix path-info "$INSTALLABLE" --derivation)" \
+        "$(nix path-info "$INSTALLABLE")"
+else
+    echo "\$ATTIC_TOKEN is unset, skipping uploading to the binary cache"
+fi
diff --git a/book.toml b/book.toml
new file mode 100644
index 00000000..e25746ca
--- /dev/null
+++ b/book.toml
@@ -0,0 +1,18 @@
+[book]
+title = "Conduit"
+description = "Conduit is a simple, fast and reliable chat server for the Matrix protocol"
+language = "en"
+multilingual = false
+src = "docs"
+
+[build]
+build-dir = "public"
+create-missing = true
+
+[output.html]
+git-repository-url = "https://gitlab.com/famedly/conduit"
+edit-url-template = "https://gitlab.com/famedly/conduit/-/edit/next/{path}"
+git-repository-icon = "fa-git-square"
+
+[output.html.search]
+limit-results = 15
diff --git a/complement/Dockerfile b/complement/Dockerfile
index 43416fa1..813af10e 100644
--- a/complement/Dockerfile
+++ b/complement/Dockerfile
@@ -1,26 +1,30 @@
-# For use in our CI only. This requires a build artifact created by a previous run pipline stage to be placed in cached_target/release/conduit
-FROM registry.gitlab.com/jfowl/conduit-containers/rust-with-tools:commit-16a08e9b as builder
-#FROM rust:latest as builder
+FROM rust:1.75.0
 
 WORKDIR /workdir
 
-ARG RUSTC_WRAPPER
-ARG AWS_ACCESS_KEY_ID
-ARG AWS_SECRET_ACCESS_KEY
-ARG SCCACHE_BUCKET
-ARG SCCACHE_ENDPOINT
-ARG SCCACHE_S3_USE_SSL
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libclang-dev
 
-COPY . .
-RUN mkdir -p target/release
-RUN test -e cached_target/release/conduit && cp cached_target/release/conduit target/release/conduit || cargo build --release
-
-## Actual image
-FROM debian:bullseye
-WORKDIR /workdir
+COPY Cargo.toml Cargo.toml
+COPY Cargo.lock Cargo.lock
+COPY src src
+RUN cargo build --release \
+    && mv target/release/conduit conduit \
+    && rm -rf target
 
 # Install caddy
-RUN apt-get update && apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-testing-archive-keyring.gpg && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-testing.list && apt-get update && apt-get install -y caddy
+RUN apt-get update \
+    && apt-get install -y \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https \
+    curl \
+    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/gpg.key' \
+    | gpg --dearmor -o /usr/share/keyrings/caddy-testing-archive-keyring.gpg \
+    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/debian.deb.txt' \
+    | tee /etc/apt/sources.list.d/caddy-testing.list \
+    && apt-get update \
+    && apt-get install -y caddy
 
 COPY conduit-example.toml conduit.toml
 COPY complement/caddy.json caddy.json
@@ -29,15 +33,9 @@ ENV SERVER_NAME=localhost
 ENV CONDUIT_CONFIG=/workdir/conduit.toml
 
 RUN sed -i "s/port = 6167/port = 8008/g" conduit.toml
-RUN echo "allow_federation = true" >> conduit.toml
-RUN echo "allow_encryption = true" >> conduit.toml
-RUN echo "allow_registration = true" >> conduit.toml
 RUN echo "log = \"warn,_=off,sled=off\"" >> conduit.toml
 RUN sed -i "s/address = \"127.0.0.1\"/address = \"0.0.0.0\"/g" conduit.toml
 
-COPY --from=builder /workdir/target/release/conduit /workdir/conduit
-RUN chmod +x /workdir/conduit
-
 EXPOSE 8008 8448
 
 CMD uname -a && \
diff --git a/complement/README.md b/complement/README.md
index b86aab38..185b251a 100644
--- a/complement/README.md
+++ b/complement/README.md
@@ -1,13 +1,11 @@
-# Running Conduit on Complement
+# Complement
 
-This assumes that you're familiar with complement, if not, please readme
-[their readme](https://github.com/matrix-org/complement#running).
+## What's that?
 
-Complement works with "base images", this directory (and Dockerfile) helps build the conduit complement-ready docker
-image.
+Have a look at [its repository](https://github.com/matrix-org/complement).
 
-To build, `cd` to the base directory of the workspace, and run this:
+## How do I use it with Conduit?
 
-`docker build -t complement-conduit:dev -f complement/Dockerfile .`
-
-Then use `complement-conduit:dev` as a base image for running complement tests.
+The script at [`../bin/complement`](../bin/complement) has automation for this.
+It takes a few command line arguments, you can read the script to find out what
+those are.
diff --git a/conduit-example.toml b/conduit-example.toml
index 6089aa5a..a52121ac 100644
--- a/conduit-example.toml
+++ b/conduit-example.toml
@@ -39,6 +39,7 @@ max_request_size = 20_000_000 # in bytes
 allow_registration = true
 
 allow_federation = true
+allow_check_for_updates = true
 
 # Enable the display name lightning bolt on registration.
 enable_lightning_bolt = true
@@ -50,7 +51,11 @@ enable_lightning_bolt = true
 trusted_servers = ["matrix.org"]
 
 #max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
-#log = "warn,state_res=warn,rocket=off,_=off,sled=off"
+
+# Controls the log verbosity. See also [here][0].
+#
+# [0]: https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#directives
+#log = "..."
 
 address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
 #address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.
diff --git a/debian/README.Debian b/debian/README.md
similarity index 58%
rename from debian/README.Debian
rename to debian/README.md
index 5f63b5cb..4ddb614d 100644
--- a/debian/README.Debian
+++ b/debian/README.md
@@ -1,28 +1,36 @@
 Conduit for Debian
 ==================
 
+Installation
+------------
+
+Information about downloading, building and deploying the Debian package, see
+the "Installing Conduit" section in the Deploying docs.
+All following sections until "Setting up the Reverse Proxy" be ignored because
+this is handled automatically by the packaging.
+
 Configuration
 -------------
 
 When installed, Debconf generates the configuration of the homeserver
 (host)name, the address and port it listens on. This configuration ends up in
-/etc/matrix-conduit/conduit.toml.
+`/etc/matrix-conduit/conduit.toml`.
 
 You can tweak more detailed settings by uncommenting and setting the variables
-in /etc/matrix-conduit/conduit.toml. This involves settings such as the maximum
+in `/etc/matrix-conduit/conduit.toml`. This involves settings such as the maximum
 file size for download/upload, enabling federation, etc.
 
 Running
 -------
 
-The package uses the matrix-conduit.service systemd unit file to start and
+The package uses the `matrix-conduit.service` systemd unit file to start and
 stop Conduit. It loads the configuration file mentioned above to set up the
 environment before running the server.
 
 This package assumes by default that Conduit will be placed behind a reverse
 proxy such as Apache or nginx. This default deployment entails just listening
-on 127.0.0.1 and the free port 6167 and is reachable via a client using the URL
-http://localhost:6167.
+on `127.0.0.1` and the free port `6167` and is reachable via a client using the URL
+<http://localhost:6167>.
 
 At a later stage this packaging may support also setting up TLS and running
 stand-alone.  In this case, however, you need to set up some certificates and
diff --git a/debian/postinst b/debian/postinst
index 73e554b7..110f22d6 100644
--- a/debian/postinst
+++ b/debian/postinst
@@ -19,11 +19,11 @@ case "$1" in
         _matrix-conduit
     fi
 
-    # Create the database path if it does not exist yet.
-    if [ ! -d "$CONDUIT_DATABASE_PATH" ]; then
-      mkdir -p "$CONDUIT_DATABASE_PATH"
-      chown _matrix-conduit "$CONDUIT_DATABASE_PATH"
-    fi
+    # Create the database path if it does not exist yet and fix up ownership
+    # and permissions.
+    mkdir -p "$CONDUIT_DATABASE_PATH"
+    chown _matrix-conduit "$CONDUIT_DATABASE_PATH"
+    chmod 700 "$CONDUIT_DATABASE_PATH"
 
     if [ ! -e "$CONDUIT_CONFIG_FILE" ]; then
       # Write the debconf values in the config.
@@ -73,11 +73,11 @@ max_request_size = 20_000_000 # in bytes
 allow_registration = true
 
 allow_federation = true
+allow_check_for_updates = true
 
 trusted_servers = ["matrix.org"]
 
 #max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
-#log = "warn,state_res=warn,rocket=off,_=off,sled=off"
 EOF
     fi
     ;;
diff --git a/default.nix b/default.nix
new file mode 100644
index 00000000..f620865d
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,10 @@
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = lock.nodes.flake-compat.locked.url or "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).defaultNix
diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md
new file mode 100644
index 00000000..30316e27
--- /dev/null
+++ b/docs/SUMMARY.md
@@ -0,0 +1,12 @@
+# Summary
+
+- [Introduction](introduction.md)
+
+- [Example configuration](configuration.md)
+- [Deploying](deploying.md)
+    - [Generic](deploying/generic.md)
+    - [Debian](deploying/debian.md)
+    - [Docker](deploying/docker.md)
+    - [NixOS](deploying/nixos.md)
+- [TURN](turn.md)
+- [Appservices](appservices.md)
diff --git a/APPSERVICES.md b/docs/appservices.md
similarity index 100%
rename from APPSERVICES.md
rename to docs/appservices.md
diff --git a/docs/configuration.md b/docs/configuration.md
new file mode 100644
index 00000000..a47e5ff9
--- /dev/null
+++ b/docs/configuration.md
@@ -0,0 +1,5 @@
+# Example configuration
+
+``` toml
+{{#include ../conduit-example.toml}}
+```
diff --git a/docs/deploying.md b/docs/deploying.md
new file mode 100644
index 00000000..136e6538
--- /dev/null
+++ b/docs/deploying.md
@@ -0,0 +1,3 @@
+# Deploying
+
+This chapter describes various ways to deploy Conduit.
diff --git a/docs/deploying/debian.md b/docs/deploying/debian.md
new file mode 100644
index 00000000..2e8a544a
--- /dev/null
+++ b/docs/deploying/debian.md
@@ -0,0 +1 @@
+{{#include ../../debian/README.md}}
diff --git a/docker/docker-compose.for-traefik.yml b/docs/deploying/docker-compose.for-traefik.yml
similarity index 98%
rename from docker/docker-compose.for-traefik.yml
rename to docs/deploying/docker-compose.for-traefik.yml
index 474299f6..82bb55b0 100644
--- a/docker/docker-compose.for-traefik.yml
+++ b/docs/deploying/docker-compose.for-traefik.yml
@@ -29,9 +29,9 @@ services:
             CONDUIT_MAX_REQUEST_SIZE: 20_000_000 # in bytes, ~20 MB
             CONDUIT_ALLOW_REGISTRATION: 'true'
             CONDUIT_ALLOW_FEDERATION: 'true'
+            CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
             CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
             #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
-            #CONDUIT_LOG: warn,rocket=off,_=off,sled=off
             CONDUIT_ADDRESS: 0.0.0.0
             CONDUIT_CONFIG: '' # Ignore this
 
diff --git a/docker/docker-compose.override.yml b/docs/deploying/docker-compose.override.yml
similarity index 100%
rename from docker/docker-compose.override.yml
rename to docs/deploying/docker-compose.override.yml
diff --git a/docker/docker-compose.with-traefik.yml b/docs/deploying/docker-compose.with-traefik.yml
similarity index 95%
rename from docker/docker-compose.with-traefik.yml
rename to docs/deploying/docker-compose.with-traefik.yml
index 79ebef4b..58603277 100644
--- a/docker/docker-compose.with-traefik.yml
+++ b/docs/deploying/docker-compose.with-traefik.yml
@@ -33,10 +33,10 @@ services:
             # CONDUIT_PORT: 6167
             # CONDUIT_CONFIG: '/srv/conduit/conduit.toml'  # if you want to configure purely by env vars, set this to an empty string ''
             # Available levels are: error, warn, info, debug, trace - more info at: https://docs.rs/env_logger/*/env_logger/#enabling-logging
-            # CONDUIT_LOG: info  # default is: "warn,_=off,sled=off"
             # CONDUIT_ALLOW_JAEGER: 'false'
-            # CONDUIT_ALLOW_ENCRYPTION: 'false'
-            # CONDUIT_ALLOW_FEDERATION: 'false'
+            # CONDUIT_ALLOW_ENCRYPTION: 'true'
+            # CONDUIT_ALLOW_FEDERATION: 'true'
+            # CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
             # CONDUIT_DATABASE_PATH: /srv/conduit/.local/share/conduit
             # CONDUIT_WORKERS: 10
             # CONDUIT_MAX_REQUEST_SIZE: 20_000_000  # in bytes, ~20 MB
@@ -94,4 +94,4 @@ volumes:
     acme:
 
 networks:
-    proxy:
\ No newline at end of file
+    proxy:
diff --git a/docker-compose.yml b/docs/deploying/docker-compose.yml
similarity index 97%
rename from docker-compose.yml
rename to docs/deploying/docker-compose.yml
index d9c32b51..97f91daf 100644
--- a/docker-compose.yml
+++ b/docs/deploying/docker-compose.yml
@@ -29,9 +29,9 @@ services:
             CONDUIT_MAX_REQUEST_SIZE: 20_000_000 # in bytes, ~20 MB
             CONDUIT_ALLOW_REGISTRATION: 'true'
             CONDUIT_ALLOW_FEDERATION: 'true'
+            CONDUIT_ALLOW_CHECK_FOR_UPDATES: 'true'
             CONDUIT_TRUSTED_SERVERS: '["matrix.org"]'
             #CONDUIT_MAX_CONCURRENT_REQUESTS: 100
-            #CONDUIT_LOG: warn,rocket=off,_=off,sled=off
             CONDUIT_ADDRESS: 0.0.0.0
             CONDUIT_CONFIG: '' # Ignore this
     #
diff --git a/docker/README.md b/docs/deploying/docker.md
similarity index 58%
rename from docker/README.md
rename to docs/deploying/docker.md
index c7028329..c19ef51b 100644
--- a/docker/README.md
+++ b/docs/deploying/docker.md
@@ -1,10 +1,39 @@
-# Deploy using Docker
+# Conduit for Docker
 
 > **Note:** To run and use Conduit you should probably use it with a Domain or Subdomain behind a reverse proxy (like Nginx, Traefik, Apache, ...) with a Lets Encrypt certificate.
 
 ## Docker
 
-### Build & Dockerfile
+To run Conduit with Docker you can either build the image yourself or pull it from a registry.
+
+
+### Use a registry
+
+OCI images for Conduit are available in the registries listed below. We recommend using the image tagged as `latest` from GitLab's own registry.
+
+| Registry        | Image                                                           | Size                          | Notes                  |
+| --------------- | --------------------------------------------------------------- | ----------------------------- | ---------------------- |
+| GitLab Registry | [registry.gitlab.com/famedly/conduit/matrix-conduit:latest][gl] | ![Image Size][shield-latest]  | Stable image.          |
+| Docker Hub      | [docker.io/matrixconduit/matrix-conduit:latest][dh]             | ![Image Size][shield-latest]  | Stable image.          |
+| GitLab Registry | [registry.gitlab.com/famedly/conduit/matrix-conduit:next][gl]   | ![Image Size][shield-next]    | Development version.   |
+| Docker Hub      | [docker.io/matrixconduit/matrix-conduit:next][dh]               | ![Image Size][shield-next]    | Development version.   |
+
+
+[dh]: https://hub.docker.com/r/matrixconduit/matrix-conduit
+[gl]: https://gitlab.com/famedly/conduit/container_registry/2497937
+[shield-latest]: https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest
+[shield-next]: https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/next
+
+
+Use 
+```bash
+docker image pull <link>
+```
+to pull it to your machine.
+
+
+
+### Build using a dockerfile
 
 The Dockerfile provided by Conduit has two stages, each of which creates an image.
 
@@ -19,9 +48,11 @@ docker build --tag matrixconduit/matrix-conduit:latest .
 
 which also will tag the resulting image as `matrixconduit/matrix-conduit:latest`.
 
+
+
 ### Run
 
-After building the image you can simply run it with
+When you have the image you can simply run it with
 
 ```bash
 docker run -d -p 8448:6167 \
@@ -33,28 +64,18 @@ docker run -d -p 8448:6167 \
   -e CONDUIT_MAX_REQUEST_SIZE="20_000_000" \
   -e CONDUIT_TRUSTED_SERVERS="[\"matrix.org\"]" \
   -e CONDUIT_MAX_CONCURRENT_REQUESTS="100" \
-  -e CONDUIT_LOG="warn,rocket=off,_=off,sled=off" \
-  --name conduit matrixconduit/matrix-conduit:latest
+  --name conduit <link>
 ```
 
-or you can skip the build step and pull the image from one of the following registries:
+or you can use [docker-compose](#docker-compose).
 
-| Registry        | Image                                                           | Size                  |
-| --------------- | --------------------------------------------------------------- | --------------------- |
-| Docker Hub      | [matrixconduit/matrix-conduit:latest][dh]                       | ![Image Size][shield] |
-| GitLab Registry | [registry.gitlab.com/famedly/conduit/matrix-conduit:latest][gl] | ![Image Size][shield] |
-
-[dh]: https://hub.docker.com/r/matrixconduit/matrix-conduit
-[gl]: https://gitlab.com/famedly/conduit/container_registry/2497937
-[shield]: https://img.shields.io/docker/image-size/matrixconduit/matrix-conduit/latest
-
-The `-d` flag lets the container run in detached mode. You now need to supply a `conduit.toml` config file, an example can be found [here](../conduit-example.toml).
+The `-d` flag lets the container run in detached mode. You now need to supply a `conduit.toml` config file, an example can be found [here](../configuration.md).
 You can pass in different env vars to change config values on the fly. You can even configure Conduit completely by using env vars, but for that you need
 to pass `-e CONDUIT_CONFIG=""` into your container. For an overview of possible values, please take a look at the `docker-compose.yml` file.
 
 If you just want to test Conduit for a short time, you can use the `--rm` flag, which will clean up everything related to your container after you stop it.
 
-## Docker-compose
+### Docker-compose
 
 If the `docker run` command is not for you or your setup, you can also use one of the provided `docker-compose` files.
 
@@ -66,8 +87,7 @@ Depending on your proxy setup, you can use one of the following files;
 When picking the traefik-related compose file, rename it so it matches `docker-compose.yml`, and
 rename the override file to `docker-compose.override.yml`. Edit the latter with the values you want
 for your server.
-
-Additional info about deploying Conduit can be found [here](../DEPLOY.md).
+Additional info about deploying Conduit can be found [here](generic.md).
 
 ### Build
 
@@ -95,7 +115,7 @@ As a container user, you probably know about Traefik. It is a easy to use revers
 containerized app and services available through the web. With the two provided files,
 [`docker-compose.for-traefik.yml`](docker-compose.for-traefik.yml) (or
 [`docker-compose.with-traefik.yml`](docker-compose.with-traefik.yml)) and
-[`docker-compose.override.yml`](docker-compose.override.traefik.yml), it is equally easy to deploy
+[`docker-compose.override.yml`](docker-compose.override.yml), it is equally easy to deploy
 and use Conduit, with a little caveat. If you already took a look at the files, then you should have
 seen the `well-known` service, and that is the little caveat. Traefik is simply a proxy and
 loadbalancer and is not able to serve any kind of content, but for Conduit to federate, we need to
@@ -106,9 +126,10 @@ With the service `well-known` we use a single `nginx` container that will serve
 
 So...step by step:
 
-1. Copy [`docker-compose.traefik.yml`](docker-compose.traefik.yml) and [`docker-compose.override.traefik.yml`](docker-compose.override.traefik.yml) from the repository and remove `.traefik` from the filenames.
+1. Copy [`docker-compose.for-traefik.yml`](docker-compose.for-traefik.yml) (or
+[`docker-compose.with-traefik.yml`](docker-compose.with-traefik.yml)) and [`docker-compose.override.yml`](docker-compose.override.yml) from the repository and remove `.for-traefik` (or `.with-traefik`) from the filename.
 2. Open both files and modify/adjust them to your needs. Meaning, change the `CONDUIT_SERVER_NAME` and the volume host mappings according to your needs.
-3. Create the `conduit.toml` config file, an example can be found [here](../conduit-example.toml), or set `CONDUIT_CONFIG=""` and configure Conduit per env vars.
+3. Create the `conduit.toml` config file, an example can be found [here](../configuration.md), or set `CONDUIT_CONFIG=""` and configure Conduit per env vars.
 4. Uncomment the `element-web` service if you want to host your own Element Web Client and create a `element_config.json`.
 5. Create the files needed by the `well-known` service.
 
@@ -138,3 +159,58 @@ So...step by step:
 
 6. Run `docker-compose up -d`
 7. Connect to your homeserver with your preferred client and create a user. You should do this immediately after starting Conduit, because the first created user is the admin.
+
+
+
+
+## Voice communication
+
+In order to make or receive calls, a TURN server is required. Conduit suggests using [Coturn](https://github.com/coturn/coturn) for this purpose, which is also available as a Docker image. Before proceeding with the software installation, it is essential to have the necessary configurations in place.
+
+### Configuration
+
+Create a configuration file called `coturn.conf` containing:
+
+```conf
+use-auth-secret
+static-auth-secret=<a secret key>
+realm=<your server domain>
+```
+A common way to generate a suitable alphanumeric secret key is by using `pwgen -s 64 1`.
+
+These same values need to be set in conduit. You can either modify conduit.toml to include these lines:
+```
+turn_uris = ["turn:<your server domain>?transport=udp", "turn:<your server domain>?transport=tcp"]
+turn_secret = "<secret key from coturn configuration>"
+```
+or append the following to the docker environment variables dependig on which configuration method you used earlier:
+```yml
+CONDUIT_TURN_URIS: '["turn:<your server domain>?transport=udp", "turn:<your server domain>?transport=tcp"]'
+CONDUIT_TURN_SECRET: "<secret key from coturn configuration>"
+```
+Restart Conduit to apply these changes.
+
+### Run
+Run the [Coturn](https://hub.docker.com/r/coturn/coturn) image using 
+```bash
+docker run -d --network=host -v $(pwd)/coturn.conf:/etc/coturn/turnserver.conf coturn/coturn
+```
+
+or docker-compose. For the latter, paste the following section into a file called `docker-compose.yml`
+and run `docker-compose up -d` in the same directory.
+
+```yml
+version: 3
+services:
+    turn:
+      container_name: coturn-server
+      image: docker.io/coturn/coturn
+      restart: unless-stopped
+      network_mode: "host"
+      volumes:
+        - ./coturn.conf:/etc/coturn/turnserver.conf
+```
+
+To understand why the host networking mode is used and explore alternative configuration options, please visit the following link: https://github.com/coturn/coturn/blob/master/docker/coturn/README.md.
+For security recommendations see Synapse's [Coturn documentation](https://github.com/matrix-org/synapse/blob/develop/docs/setup/turn/coturn.md#configuration).
+
diff --git a/DEPLOY.md b/docs/deploying/generic.md
similarity index 57%
rename from DEPLOY.md
rename to docs/deploying/generic.md
index 1d1fc138..307de359 100644
--- a/DEPLOY.md
+++ b/docs/deploying/generic.md
@@ -1,4 +1,4 @@
-# Deploying Conduit
+# Generic deployment documentation
 
 > ## Getting help
 >
@@ -7,77 +7,67 @@
 
 ## Installing Conduit
 
-Although you might be able to compile Conduit for Windows, we do recommend running it on a linux server. We therefore
+Although you might be able to compile Conduit for Windows, we do recommend running it on a Linux server. We therefore
 only offer Linux binaries.
 
-You may simply download the binary that fits your machine. Run `uname -m` to see what you need. Now copy the right url:
+You may simply download the binary that fits your machine. Run `uname -m` to see what you need. Now copy the appropriate url:
 
-| CPU Architecture                            | Download stable version                                         | Download development version                                |
-| ------------------------------------------- | --------------------------------------------------------------- | ----------------------------------------------------------- |
-| x84_64 / amd64 (Most servers and computers) | [Binary][x84_64-glibc-master] / [.deb][x84_64-glibc-master-deb] | [Binary][x84_64-glibc-next] / [.deb][x84_64-glibc-next-deb] |
-| armv7 (e.g. Raspberry Pi by default)        | [Binary][armv7-glibc-master] / [.deb][armv7-glibc-master-deb]   | [Binary][armv7-glibc-next] / [.deb][armv7-glibc-next-deb]   |
-| armv8 / aarch64                             | [Binary][armv8-glibc-master] / [.deb][armv8-glibc-master-deb]   | [Binary][armv8-glibc-next] / [.deb][armv8-glibc-next-deb]   |
+**Stable versions:**
+
+| CPU Architecture                            | Download stable version                                         |
+| ------------------------------------------- | --------------------------------------------------------------- |
+| x84_64 / amd64 (Most servers and computers) | [Binary][x84_64-glibc-master] / [.deb][x84_64-glibc-master-deb] |
+| armv7 (e.g. Raspberry Pi by default)        | [Binary][armv7-glibc-master] / [.deb][armv7-glibc-master-deb]   |
+| armv8 / aarch64                             | [Binary][armv8-glibc-master] / [.deb][armv8-glibc-master-deb]   |
 
 These builds were created on and linked against the glibc version shipped with Debian bullseye.
-If you use a system with an older glibc version, you might need to compile Conduit yourself.
+If you use a system with an older glibc version (e.g. RHEL8), you might need to compile Conduit yourself.
 
 [x84_64-glibc-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/build-output/linux_amd64/conduit?job=docker:master
 [armv7-glibc-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/build-output/linux_arm_v7/conduit?job=docker:master
 [armv8-glibc-master]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/build-output/linux_arm64/conduit?job=docker:master
-[x84_64-glibc-next]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/next/raw/build-output/linux_amd64/conduit?job=docker:next
-[armv7-glibc-next]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/next/raw/build-output/linux_arm_v7/conduit?job=docker:next
-[armv8-glibc-next]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/next/raw/build-output/linux_arm64/conduit?job=docker:next
 [x84_64-glibc-master-deb]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/build-output/linux_amd64/conduit.deb?job=docker:master
 [armv7-glibc-master-deb]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/build-output/linux_arm_v7/conduit.deb?job=docker:master
 [armv8-glibc-master-deb]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/master/raw/build-output/linux_arm64/conduit.deb?job=docker:master
-[x84_64-glibc-next-deb]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/next/raw/build-output/linux_amd64/conduit.deb?job=docker:next
-[armv7-glibc-next-deb]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/next/raw/build-output/linux_arm_v7/conduit.deb?job=docker:next
-[armv8-glibc-next-deb]: https://gitlab.com/famedly/conduit/-/jobs/artifacts/next/raw/build-output/linux_arm64/conduit.deb?job=docker:next
+
+**Latest versions:**
+
+| Target | Type | Download |
+|-|-|-|
+| `x86_64-unknown-linux-musl` | Statically linked Debian package | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/x86_64-unknown-linux-musl.deb?job=artifacts) |
+| `x86_64-unknown-linux-musl` | Statically linked binary | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/x86_64-unknown-linux-musl?job=artifacts) |
+| `aarch64-unknown-linux-musl` | Statically linked binary | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/aarch64-unknown-linux-musl?job=artifacts) |
+| `x86_64-unknown-linux-gnu` | OCI image | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/oci-image-amd64.tar.gz?job=artifacts) |
+| `aarch64-unknown-linux-musl` | OCI image | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/oci-image-arm64v8.tar.gz?job=artifacts) |
 
 ```bash
 $ sudo wget -O /usr/local/bin/matrix-conduit <url>
 $ sudo chmod +x /usr/local/bin/matrix-conduit
 ```
 
-Alternatively, you may compile the binary yourself
+Alternatively, you may compile the binary yourself. First, install any dependencies:
 
 ```bash
+# Debian
 $ sudo apt install libclang-dev build-essential
-```
 
+# RHEL
+$ sudo dnf install clang
+```
+Then, `cd` into the source tree of conduit-next and run:
 ```bash
 $ cargo build --release
 ```
 
-If you want to cross compile Conduit to another architecture, read the guide below.
-
-<details>
-<summary>Cross compilation</summary>
-
-As easiest way to compile conduit for another platform [cross-rs](https://github.com/cross-rs/cross) is recommended, so install it first.
-
-In order to use RockDB as storage backend append `-latomic` to linker flags.
-
-For example, to build a binary for Raspberry Pi Zero W (ARMv6) you need `arm-unknown-linux-gnueabihf` as compilation
-target.
-
-```bash
-git clone https://gitlab.com/famedly/conduit.git
-cd conduit
-export RUSTFLAGS='-C link-arg=-lgcc -Clink-arg=-latomic -Clink-arg=-static-libgcc'
-cross build --release --no-default-features --features conduit_bin,backend_rocksdb,jemalloc --target=arm-unknown-linux-gnueabihf
-```
-</details>
-
 ## Adding a Conduit user
 
 While Conduit can run as any user it is usually better to use dedicated users for different services. This also allows
 you to make sure that the file permissions are correctly set up.
 
-In Debian you can use this command to create a Conduit user:
+In Debian or RHEL, you can use this command to create a Conduit user:
 
 ```bash
-sudo adduser --system conduit --no-create-home
+sudo adduser --system conduit --group --disabled-login --no-create-home
 ```
 
 ## Forwarding ports in the firewall or the router
@@ -86,6 +76,19 @@ Conduit uses the ports 443 and 8448 both of which need to be open in the firewal
 
 If Conduit runs behind a router or in a container and has a different public IP address than the host system these public ports need to be forwarded directly or indirectly to the port mentioned in the config.
 
+## Optional: Avoid port 8448
+
+If Conduit runs behind Cloudflare reverse proxy, which doesn't support port 8448 on free plans, [delegation](https://matrix-org.github.io/synapse/latest/delegate.html) can be set up to have federation traffic routed to port 443:
+```apache
+# .well-known delegation on Apache
+<Files "/.well-known/matrix/server">
+    ErrorDocument 200 '{"m.server": "your.server.name:443"}'
+    Header always set Content-Type application/json
+    Header always set Access-Control-Allow-Origin *
+</Files>
+```
+[SRV DNS record](https://spec.matrix.org/latest/server-server-api/#resolving-server-names) delegation is also [possible](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-srv-record/).
+
 ## Setting up a systemd service
 
 Now we'll set up a systemd service for Conduit, so it's easy to start/stop Conduit and set it to autostart when your
@@ -100,7 +103,7 @@ After=network.target
 [Service]
 Environment="CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml"
 User=conduit
-Group=nogroup
+Group=conduit
 Restart=always
 ExecStart=/usr/local/bin/matrix-conduit
 
@@ -116,59 +119,16 @@ $ sudo systemctl daemon-reload
 
 ## Creating the Conduit configuration file
 
-Now we need to create the Conduit's config file in `/etc/matrix-conduit/conduit.toml`. Paste this in **and take a moment
-to read it. You need to change at least the server name.**  
+Now we need to create the Conduit's config file in
+`/etc/matrix-conduit/conduit.toml`. Paste in the contents of
+[`conduit-example.toml`](../configuration.md) **and take a moment to read it.
+You need to change at least the server name.**
 You can also choose to use a different database backend, but right now only `rocksdb` and `sqlite` are recommended.
 
-```toml
-[global]
-# The server_name is the pretty name of this server. It is used as a suffix for user
-# and room ids. Examples: matrix.org, conduit.rs
-
-# The Conduit server needs all /_matrix/ requests to be reachable at
-# https://your.server.name/ on port 443 (client-server) and 8448 (federation).
-
-# If that's not possible for you, you can create /.well-known files to redirect
-# requests. See
-# https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
-# and
-# https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
-# for more information
-
-# YOU NEED TO EDIT THIS
-#server_name = "your.server.name"
-
-# This is the only directory where Conduit will save its data
-database_path = "/var/lib/matrix-conduit/"
-database_backend = "rocksdb"
-
-# The port Conduit will be running on. You need to set up a reverse proxy in
-# your web server (e.g. apache or nginx), so all requests to /_matrix on port
-# 443 and 8448 will be forwarded to the Conduit instance running on this port
-# Docker users: Don't change this, you'll need to map an external port to this.
-port = 6167
-
-# Max size for uploads
-max_request_size = 20_000_000 # in bytes
-
-# Enables registration. If set to false, no users can register on this server.
-allow_registration = true
-
-allow_federation = true
-
-trusted_servers = ["matrix.org"]
-
-#max_concurrent_requests = 100 # How many requests Conduit sends to other servers at the same time
-#log = "warn,state_res=warn,rocket=off,_=off,sled=off"
-
-address = "127.0.0.1" # This makes sure Conduit can only be reached using the reverse proxy
-#address = "0.0.0.0" # If Conduit is running in a container, make sure the reverse proxy (ie. Traefik) can reach it.
-```
-
 ## Setting the correct file permissions
 
 As we are using a Conduit specific user we need to allow it to read the config. To do that you can run this command on
-Debian:
+Debian or RHEL:
 
 ```bash
 sudo chown -R root:root /etc/matrix-conduit
@@ -179,7 +139,7 @@ If you use the default database path you also need to run this:
 
 ```bash
 sudo mkdir -p /var/lib/matrix-conduit/
-sudo chown -R conduit:nogroup /var/lib/matrix-conduit/
+sudo chown -R conduit:conduit /var/lib/matrix-conduit/
 sudo chmod 700 /var/lib/matrix-conduit/
 ```
 
@@ -192,6 +152,11 @@ This depends on whether you use Apache, Caddy, Nginx or another web server.
 Create `/etc/apache2/sites-enabled/050-conduit.conf` and copy-and-paste this:
 
 ```apache
+# Requires mod_proxy and mod_proxy_http
+#
+# On Apache instance compiled from source,
+# paste into httpd-ssl.conf or httpd.conf
+
 Listen 8448
 
 <VirtualHost *:443 *:8448>
@@ -199,7 +164,7 @@ Listen 8448
 ServerName your.server.name # EDIT THIS
 
 AllowEncodedSlashes NoDecode
-ProxyPass /_matrix/ http://127.0.0.1:6167/_matrix/ nocanon
+ProxyPass /_matrix/ http://127.0.0.1:6167/_matrix/ timeout=300 nocanon
 ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/
 
 </VirtualHost>
@@ -208,7 +173,11 @@ ProxyPassReverse /_matrix/ http://127.0.0.1:6167/_matrix/
 **You need to make some edits again.** When you are done, run
 
 ```bash
+# Debian
 $ sudo systemctl reload apache2
+
+# Installed from source
+$ sudo apachectl -k graceful
 ```
 
 ### Caddy
@@ -241,12 +210,14 @@ server {
     merge_slashes off;
 
     # Nginx defaults to only allow 1MB uploads
+    # Increase this to allow posting large files such as videos
     client_max_body_size 20M;
 
     location /_matrix/ {
-        proxy_pass http://127.0.0.1:6167$request_uri;
+        proxy_pass http://127.0.0.1:6167;
         proxy_set_header Host $http_host;
         proxy_buffering off;
+        proxy_read_timeout 5m;
     }
 
     ssl_certificate /etc/letsencrypt/live/your.server.name/fullchain.pem; # EDIT THIS
@@ -266,11 +237,19 @@ $ sudo systemctl reload nginx
 
 If you chose Caddy as your web proxy SSL certificates are handled automatically and you can skip this step.
 
-The easiest way to get an SSL certificate, if you don't have one already, is to install `certbot` and run this:
+The easiest way to get an SSL certificate, if you don't have one already, is to [install](https://certbot.eff.org/instructions) `certbot` and run this:
 
 ```bash
+# To use ECC for the private key, 
+# paste into /etc/letsencrypt/cli.ini:
+# key-type = ecdsa
+# elliptic-curve = secp384r1
+
 $ sudo certbot -d your.server.name
 ```
+[Automated renewal](https://eff-certbot.readthedocs.io/en/stable/using.html#automated-renewals) is usually preconfigured.
+
+If using Cloudflare, configure instead the edge and origin certificates in dashboard. In case you’re already running a website on the same Apache server, you can just copy-and-paste the SSL configuration from your main virtual host on port 443 into the above-mentioned vhost.
 
 ## You're done!
 
@@ -288,12 +267,14 @@ $ sudo systemctl enable conduit
 
 ## How do I know it works?
 
-You can open <https://app.element.io>, enter your homeserver and try to register.
+You can open [a Matrix client](https://matrix.org/ecosystem/clients), enter your homeserver and try to register. If you are using a registration token, use [Element web](https://app.element.io/), [Nheko](https://matrix.org/ecosystem/clients/nheko/) or [SchildiChat web](https://app.schildi.chat/), as they support this feature.
 
 You can also use these commands as a quick health check.
 
 ```bash
 $ curl https://your.server.name/_matrix/client/versions
+
+# If using port 8448
 $ curl https://your.server.name:8448/_matrix/client/versions
 ```
 
@@ -304,8 +285,8 @@ $ curl https://your.server.name:8448/_matrix/client/versions
 
 ## Audio/Video calls
 
-For Audio/Video call functionality see the [TURN Guide](TURN.md).
+For Audio/Video call functionality see the [TURN Guide](../turn.md).
 
 ## Appservices
 
-If you want to set up an appservice, take a look at the [Appservice Guide](APPSERVICES.md).
+If you want to set up an appservice, take a look at the [Appservice Guide](../appservices.md).
diff --git a/docs/deploying/nixos.md b/docs/deploying/nixos.md
new file mode 100644
index 00000000..bf9b1a11
--- /dev/null
+++ b/docs/deploying/nixos.md
@@ -0,0 +1,18 @@
+# Conduit for NixOS
+
+Conduit can be acquired by Nix from various places:
+
+* The `flake.nix` at the root of the repo
+* The `default.nix` at the root of the repo
+* From Nixpkgs
+
+The `flake.nix` and `default.nix` do not (currently) provide a NixOS module, so
+(for now) [`services.matrix-conduit`][module] from Nixpkgs should be used to
+configure Conduit.
+
+If you want to run the latest code, you should get Conduit from the `flake.nix`
+or `default.nix` and set [`services.matrix-conduit.package`][package]
+appropriately.
+
+[module]: https://search.nixos.org/options?channel=unstable&query=services.matrix-conduit
+[package]: https://search.nixos.org/options?channel=unstable&query=services.matrix-conduit.package
diff --git a/docs/introduction.md b/docs/introduction.md
new file mode 100644
index 00000000..da34ab6e
--- /dev/null
+++ b/docs/introduction.md
@@ -0,0 +1,13 @@
+# Conduit
+
+{{#include ../README.md:catchphrase}}
+
+{{#include ../README.md:body}}
+
+#### How can I deploy my own?
+
+- [Deployment options](deploying.md)
+
+If you want to connect an Appservice to Conduit, take a look at the [appservices documentation](appservices.md).
+
+{{#include ../README.md:footer}}
diff --git a/TURN.md b/docs/turn.md
similarity index 97%
rename from TURN.md
rename to docs/turn.md
index 63c1e99f..a61f1b13 100644
--- a/TURN.md
+++ b/docs/turn.md
@@ -22,4 +22,4 @@ turn_secret = "ADD SECRET HERE"
 
 ## Apply settings
 
-Restart Conduit.
\ No newline at end of file
+Restart Conduit.
diff --git a/engage.toml b/engage.toml
new file mode 100644
index 00000000..cb284167
--- /dev/null
+++ b/engage.toml
@@ -0,0 +1,74 @@
+interpreter = ["bash", "-euo", "pipefail", "-c"]
+
+[[task]]
+name = "engage"
+group = "versions"
+script = "engage --version"
+
+[[task]]
+name = "rustc"
+group = "versions"
+script = "rustc --version"
+
+[[task]]
+name = "cargo"
+group = "versions"
+script = "cargo --version"
+
+[[task]]
+name = "cargo-fmt"
+group = "versions"
+script = "cargo fmt --version"
+
+[[task]]
+name = "rustdoc"
+group = "versions"
+script = "rustdoc --version"
+
+[[task]]
+name = "cargo-clippy"
+group = "versions"
+script = "cargo clippy -- --version"
+
+[[task]]
+name = "lychee"
+group = "versions"
+script = "lychee --version"
+
+[[task]]
+name = "cargo-fmt"
+group = "lints"
+script = "cargo fmt --check -- --color=always"
+
+[[task]]
+name = "cargo-doc"
+group = "lints"
+script = """
+RUSTDOCFLAGS="-D warnings" cargo doc \
+    --workspace \
+    --no-deps \
+    --document-private-items \
+    --color always
+"""
+
+[[task]]
+name = "cargo-clippy"
+group = "lints"
+script = "cargo clippy --workspace --all-targets --color=always -- -D warnings"
+
+[[task]]
+name = "lychee"
+group = "lints"
+script = "lychee --offline docs"
+
+[[task]]
+name = "cargo"
+group = "tests"
+script = """
+cargo test \
+    --workspace \
+    --all-targets \
+    --color=always \
+    -- \
+    --color=always
+"""
diff --git a/flake.lock b/flake.lock
index d76ff59b..1c2142f2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,22 +1,41 @@
 {
   "nodes": {
-    "crane": {
+    "attic": {
       "inputs": {
+        "crane": "crane",
         "flake-compat": "flake-compat",
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1680584903,
-        "narHash": "sha256-uraq+D3jcLzw/UVk0xMHcnfILfIMa0DLrtAEq2nNlxU=",
+        "lastModified": 1707922053,
+        "narHash": "sha256-wSZjK+rOXn+UQiP1NbdNn5/UW6UcBxjvlqr2wh++MbM=",
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "rev": "6eabc3f02fae3683bffab483e614bebfcd476b21",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "ref": "main",
+        "repo": "attic",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "attic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1702918879,
+        "narHash": "sha256-tWJqzajIvYcaRWxn+cLUB9L9Pv4dQ3Bfit/YjU5ze3g=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "65d3f6a3970cd46bef5eedfd458300f72c56b3c5",
+        "rev": "7195c00c272fdd92fc74e7d5a0a2844b9fadb2fb",
         "type": "github"
       },
       "original": {
@@ -25,6 +44,27 @@
         "type": "github"
       }
     },
+    "crane_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1707685877,
+        "narHash": "sha256-XoXRS+5whotelr1rHiZle5t5hDg9kpguS5yk8c8qzOc=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "2c653e4478476a52c6aa3ac0495e4dea7449ea0e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "2c653e4478476a52c6aa3ac0495e4dea7449ea0e",
+        "type": "github"
+      }
+    },
     "fenix": {
       "inputs": {
         "nixpkgs": [
@@ -33,11 +73,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1680607374,
-        "narHash": "sha256-U5iiPqbAanr+sQCCZ7zxYhwCXdcDpish8Uy4ELZeXM0=",
+        "lastModified": 1709619709,
+        "narHash": "sha256-l6EPVJfwfelWST7qWQeP6t/TDK3HHv5uUB1b2vw4mOQ=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "e70d498e97017daa59363eafa054619d4fa160c3",
+        "rev": "c8943ea9e98d41325ff57d4ec14736d330b321b2",
         "type": "github"
       },
       "original": {
@@ -62,13 +102,29 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
         "type": "github"
       },
       "original": {
@@ -77,37 +133,106 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1709126324,
+        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nix-filter": {
+      "locked": {
+        "lastModified": 1705332318,
+        "narHash": "sha256-kcw1yFeJe9N4PjQji9ZeX47jg0p9A0DuU4djKvg1a7I=",
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "rev": "3449dc925982ad46246cfc36469baf66e1b64f17",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1680652733,
-        "narHash": "sha256-FFG6Nai9M71C0Uc+D8TxyHoAjTplM0/9uWKsl7ALfUs=",
+        "lastModified": 1702539185,
+        "narHash": "sha256-KnIRG5NMdLIpEkZTnN5zovNYc0hhXjAgv6pfd5Z4c7U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "cc5bde408572508efd1273852862d418bb313443",
+        "rev": "aa9d4729cbc99dabacb50e3994dcefb3ea0f7447",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1702780907,
+        "narHash": "sha256-blbrBBXjjZt6OKTcYX1jpe9SRof2P9ZYWPzq22tzXAA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1e2e384c5b7c50dbf8e9c441a9e58d85f408b01f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1709479366,
+        "narHash": "sha256-n6F0n8UV6lnTZbYPl1A9q1BS0p4hduAv1mGAP17CVd0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b8697e57f10292a6165a20f03d2f42920dfaf973",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "crane": "crane",
+        "attic": "attic",
+        "crane": "crane_2",
         "fenix": "fenix",
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "flake-compat": "flake-compat_2",
+        "flake-utils": "flake-utils_2",
+        "nix-filter": "nix-filter",
+        "nixpkgs": "nixpkgs_2"
       }
     },
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1680435407,
-        "narHash": "sha256-IPBtZCOh3BdrR+V77cL7r6WQnclWcZ/85BDYnmq/GnQ=",
+        "lastModified": 1709571018,
+        "narHash": "sha256-ISFrxHxE0J5g7lDAscbK88hwaT5uewvWoma9TlFmRzM=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "236576227a299fd19ba836b1834ab50c948af994",
+        "rev": "9f14343f9ee24f53f17492c5f9b653427e2ad15e",
         "type": "github"
       },
       "original": {
@@ -117,28 +242,18 @@
         "type": "github"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "flake-utils": [
-          "crane",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "crane",
-          "nixpkgs"
-        ]
-      },
+    "systems": {
       "locked": {
-        "lastModified": 1680488274,
-        "narHash": "sha256-0vYMrZDdokVmPQQXtFpnqA2wEgCCUXf5a3dDuDVshn0=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "7ec2ff598a172c6e8584457167575b3a1a5d80d8",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
+        "owner": "nix-systems",
+        "repo": "default",
         "type": "github"
       }
     }
diff --git a/flake.nix b/flake.nix
index 970e8474..4536f172 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,93 +1,317 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs";
+    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-unstable";
     flake-utils.url = "github:numtide/flake-utils";
+    nix-filter.url = "github:numtide/nix-filter";
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
 
     fenix = {
       url = "github:nix-community/fenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     crane = {
-      url = "github:ipetkov/crane";
+      # Pin latest crane that's not affected by the following bugs:
+      #
+      # * <https://github.com/ipetkov/crane/issues/527#issuecomment-1978079140>
+      # * <https://github.com/toml-rs/toml/issues/691>
+      # * <https://github.com/toml-rs/toml/issues/267>
+      url = "github:ipetkov/crane?rev=2c653e4478476a52c6aa3ac0495e4dea7449ea0e";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-utils.follows = "flake-utils";
     };
+    attic.url = "github:zhaofengli/attic?ref=main";
   };
 
   outputs =
     { self
     , nixpkgs
     , flake-utils
+    , nix-filter
 
     , fenix
     , crane
+    , ...
     }: flake-utils.lib.eachDefaultSystem (system:
     let
-      pkgs = nixpkgs.legacyPackages.${system};
-
-      # Use mold on Linux
-      stdenv = if pkgs.stdenv.isLinux then
-        pkgs.stdenvAdapters.useMoldLinker pkgs.stdenv
-      else
-        pkgs.stdenv;
+      pkgsHost = nixpkgs.legacyPackages.${system};
 
       # Nix-accessible `Cargo.toml`
       cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
 
       # The Rust toolchain to use
-      toolchain = fenix.packages.${system}.toolchainOf {
-        # Use the Rust version defined in `Cargo.toml`
-        channel = cargoToml.package.rust-version;
+      toolchain = fenix.packages.${system}.fromToolchainFile {
+        file = ./rust-toolchain.toml;
 
-        # THE rust-version HASH
-        sha256 = "sha256-8len3i8oTwJSOJZMosGGXHBL5BVuGQnWOT2St5YAUFU=";
+        # See also `rust-toolchain.toml`
+        sha256 = "sha256-SXRtAuO4IqNOQq+nLbrsDFbVk+3aVA8NNpSZsKlVH/8=";
       };
 
-      # The system's RocksDB
-      ROCKSDB_INCLUDE_DIR = "${pkgs.rocksdb_6_23}/include";
-      ROCKSDB_LIB_DIR = "${pkgs.rocksdb_6_23}/lib";
+      builder = pkgs:
+        ((crane.mkLib pkgs).overrideToolchain toolchain).buildPackage;
 
-      # Shared between the package and the devShell
-      nativeBuildInputs = (with pkgs.rustPlatform; [
-        bindgenHook
-      ]);
+      nativeBuildInputs = pkgs: [
+        # bindgen needs the build platform's libclang. Apparently due to
+        # "splicing weirdness", pkgs.rustPlatform.bindgenHook on its own doesn't
+        # quite do the right thing here.
+        pkgs.pkgsBuildHost.rustPlatform.bindgenHook
+      ];
 
-      builder =
-        ((crane.mkLib pkgs).overrideToolchain toolchain.toolchain).buildPackage;
+      rocksdb' = pkgs:
+      let
+        version = "8.11.3";
+      in
+      pkgs.rocksdb.overrideAttrs (old: {
+        inherit version;
+        src = pkgs.fetchFromGitHub {
+          owner = "facebook";
+          repo = "rocksdb";
+          rev = "v${version}";
+          hash = "sha256-OpEiMwGxZuxb9o3RQuSrwZMQGLhe9xLT1aa3HpI4KPs=";
+        };
+      });
+
+      env = pkgs: {
+        CONDUIT_VERSION_EXTRA = self.shortRev or self.dirtyShortRev;
+        ROCKSDB_INCLUDE_DIR = "${rocksdb' pkgs}/include";
+        ROCKSDB_LIB_DIR = "${rocksdb' pkgs}/lib";
+      }
+      // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isStatic {
+        ROCKSDB_STATIC = "";
+      }
+      // {
+        CARGO_BUILD_RUSTFLAGS = let inherit (pkgs) lib stdenv; in
+          lib.concatStringsSep " " ([]
+            ++ lib.optionals
+              # This disables PIE for static builds, which isn't great in terms
+              # of security. Unfortunately, my hand is forced because nixpkgs'
+              # `libstdc++.a` is built without `-fPIE`, which precludes us from
+              # leaving PIE enabled.
+              stdenv.hostPlatform.isStatic
+              ["-C" "relocation-model=static"]
+            ++ lib.optionals
+              (stdenv.buildPlatform.config != stdenv.hostPlatform.config)
+              ["-l" "c"]
+            ++ lib.optionals
+              # This check has to match the one [here][0]. We only need to set
+              # these flags when using a different linker. Don't ask me why,
+              # though, because I don't know. All I know is it breaks otherwise.
+              #
+              # [0]: https://github.com/NixOS/nixpkgs/blob/5cdb38bb16c6d0a38779db14fcc766bc1b2394d6/pkgs/build-support/rust/lib/default.nix#L37-L40
+              (
+                # Nixpkgs doesn't check for x86_64 here but we do, because I
+                # observed a failure building statically for x86_64 without
+                # including it here. Linkers are weird.
+                (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isx86_64)
+                  && stdenv.hostPlatform.isStatic
+                  && !stdenv.isDarwin
+                  && !stdenv.cc.bintools.isLLVM
+              )
+              [
+                "-l"
+                "stdc++"
+                "-L"
+                "${stdenv.cc.cc.lib}/${stdenv.hostPlatform.config}/lib"
+              ]
+          );
+      }
+
+      # What follows is stolen from [here][0]. Its purpose is to properly
+      # configure compilers and linkers for various stages of the build, and
+      # even covers the case of build scripts that need native code compiled and
+      # run on the build platform (I think).
+      #
+      # [0]: https://github.com/NixOS/nixpkgs/blob/5cdb38bb16c6d0a38779db14fcc766bc1b2394d6/pkgs/build-support/rust/lib/default.nix#L57-L80
+      // (
+        let
+          inherit (pkgs.rust.lib) envVars;
+        in
+        pkgs.lib.optionalAttrs
+          (pkgs.stdenv.targetPlatform.rust.rustcTarget
+            != pkgs.stdenv.hostPlatform.rust.rustcTarget)
+          (
+            let
+              inherit (pkgs.stdenv.targetPlatform.rust) cargoEnvVarTarget;
+            in
+            {
+              "CC_${cargoEnvVarTarget}" = envVars.ccForTarget;
+              "CXX_${cargoEnvVarTarget}" = envVars.cxxForTarget;
+              "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" =
+                envVars.linkerForTarget;
+            }
+          )
+      // (
+        let
+          inherit (pkgs.stdenv.hostPlatform.rust) cargoEnvVarTarget rustcTarget;
+        in
+        {
+          "CC_${cargoEnvVarTarget}" = envVars.ccForHost;
+          "CXX_${cargoEnvVarTarget}" = envVars.cxxForHost;
+          "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = envVars.linkerForHost;
+          CARGO_BUILD_TARGET = rustcTarget;
+        }
+      )
+      // (
+        let
+          inherit (pkgs.stdenv.buildPlatform.rust) cargoEnvVarTarget;
+        in
+        {
+          "CC_${cargoEnvVarTarget}" = envVars.ccForBuild;
+          "CXX_${cargoEnvVarTarget}" = envVars.cxxForBuild;
+          "CARGO_TARGET_${cargoEnvVarTarget}_LINKER" = envVars.linkerForBuild;
+          HOST_CC = "${pkgs.pkgsBuildHost.stdenv.cc}/bin/cc";
+          HOST_CXX = "${pkgs.pkgsBuildHost.stdenv.cc}/bin/c++";
+        }
+      ));
+
+      package = pkgs: builder pkgs {
+        src = nix-filter {
+          root = ./.;
+          include = [
+            "src"
+            "Cargo.toml"
+            "Cargo.lock"
+          ];
+        };
+
+        # This is redundant with CI
+        doCheck = false;
+
+        env = env pkgs;
+        nativeBuildInputs = nativeBuildInputs pkgs;
+
+        meta.mainProgram = cargoToml.package.name;
+      };
+
+      mkOciImage = pkgs: package:
+        pkgs.dockerTools.buildImage {
+          name = package.pname;
+          tag = "next";
+          copyToRoot = [
+            pkgs.dockerTools.caCertificates
+          ];
+          config = {
+            # Use the `tini` init system so that signals (e.g. ctrl+c/SIGINT)
+            # are handled as expected
+            Entrypoint = [
+              "${pkgs.lib.getExe' pkgs.tini "tini"}"
+              "--"
+            ];
+            Cmd = [
+              "${pkgs.lib.getExe package}"
+            ];
+          };
+        };
     in
     {
-      packages.default = builder {
-        src = ./.;
+      packages = {
+        default = package pkgsHost;
+        oci-image = mkOciImage pkgsHost self.packages.${system}.default;
 
-        inherit
-          stdenv
-          nativeBuildInputs
-          ROCKSDB_INCLUDE_DIR
-          ROCKSDB_LIB_DIR;
-      };
+        book =
+        let
+          package = self.packages.${system}.default;
+        in
+        pkgsHost.stdenv.mkDerivation {
+          pname = "${package.pname}-book";
+          version = package.version;
 
-      devShells.default = (pkgs.mkShell.override { inherit stdenv; }) {
-        # Rust Analyzer needs to be able to find the path to default crate
-        # sources, and it can read this environment variable to do so
-        RUST_SRC_PATH = "${toolchain.rust-src}/lib/rustlib/src/rust/library";
+          src = nix-filter {
+            root = ./.;
+            include = [
+              "book.toml"
+              "conduit-example.toml"
+              "README.md"
+              "debian/README.md"
+              "docs"
+            ];
+          };
 
-        inherit
-          ROCKSDB_INCLUDE_DIR
-          ROCKSDB_LIB_DIR;
+          nativeBuildInputs = (with pkgsHost; [
+            mdbook
+          ]);
+
+          buildPhase = ''
+            mdbook build
+            mv public $out
+          '';
+        };
+      }
+      //
+      builtins.listToAttrs
+        (builtins.concatLists
+          (builtins.map
+            (crossSystem:
+              let
+                binaryName = "static-${crossSystem}";
+                pkgsCrossStatic =
+                  (import nixpkgs {
+                    inherit system;
+                    crossSystem = {
+                      config = crossSystem;
+                    };
+                  }).pkgsStatic;
+              in
+              [
+                # An output for a statically-linked binary
+                {
+                  name = binaryName;
+                  value = package pkgsCrossStatic;
+                }
+
+                # An output for an OCI image based on that binary
+                {
+                  name = "oci-image-${crossSystem}";
+                  value = mkOciImage
+                    pkgsCrossStatic
+                    self.packages.${system}.${binaryName};
+                }
+              ]
+            )
+            [
+              "x86_64-unknown-linux-musl"
+              "aarch64-unknown-linux-musl"
+            ]
+          )
+        );
+
+      devShells.default = pkgsHost.mkShell {
+        env = env pkgsHost // {
+          # Rust Analyzer needs to be able to find the path to default crate
+          # sources, and it can read this environment variable to do so. The
+          # `rust-src` component is required in order for this to work.
+          RUST_SRC_PATH = "${toolchain}/lib/rustlib/src/rust/library";
+        };
 
         # Development tools
-        nativeBuildInputs = nativeBuildInputs ++ (with toolchain; [
-          cargo
-          clippy
-          rust-src
-          rustc
-          rustfmt
-        ]);
-      };
+        nativeBuildInputs = nativeBuildInputs pkgsHost ++ [
+          # Always use nightly rustfmt because most of its options are unstable
+          #
+          # This needs to come before `toolchain` in this list, otherwise
+          # `$PATH` will have stable rustfmt instead.
+          fenix.packages.${system}.latest.rustfmt
 
-      checks = {
-        packagesDefault = self.packages.${system}.default;
-        devShellsDefault = self.devShells.${system}.default;
+          toolchain
+        ] ++ (with pkgsHost; [
+          engage
+
+          # Needed for producing Debian packages
+          cargo-deb
+
+          # Needed for Complement
+          go
+          olm
+
+          # Needed for our script for Complement
+          jq
+
+          # Needed for finding broken markdown links
+          lychee
+
+          # Useful for editing the book locally
+          mdbook
+        ]);
       };
     });
 }
diff --git a/nix/README.md b/nix/README.md
deleted file mode 100644
index 77bad0fa..00000000
--- a/nix/README.md
+++ /dev/null
@@ -1,189 +0,0 @@
-# Conduit for Nix/NixOS
-
-This guide assumes you have a recent version of Nix (^2.4) installed.
-
-Since Conduit ships as a Nix flake, you'll first need to [enable
-flakes][enable_flakes].
-
-You can now use the usual Nix commands to interact with Conduit's flake. For
-example, `nix run gitlab:famedly/conduit` will run Conduit (though you'll need
-to provide configuration and such manually as usual).
-
-If your NixOS configuration is defined as a flake, you can depend on this flake
-to provide a more up-to-date version than provided by `nixpkgs`. In your flake,
-add the following to your `inputs`:
-
-```nix
-conduit = {
-    url = "gitlab:famedly/conduit";
-
-    # Assuming you have an input for nixpkgs called `nixpkgs`. If you experience
-    # build failures while using this, try commenting/deleting this line. This
-    # will probably also require you to always build from source.
-    inputs.nixpkgs.follows = "nixpkgs";
-};
-```
-
-Next, make sure you're passing your flake inputs to the `specialArgs` argument
-of `nixpkgs.lib.nixosSystem` [as explained here][specialargs]. This guide will
-assume you've named the group `flake-inputs`.
-
-Now you can configure Conduit and a reverse proxy for it. Add the following to
-a new Nix file and include it in your configuration:
-
-```nix
-{ config
-, pkgs
-, flake-inputs
-, ...
-}:
-
-let
-  # You'll need to edit these values
-
-  # The hostname that will appear in your user and room IDs
-  server_name = "example.com";
-
-  # The hostname that Conduit actually runs on
-  #
-  # This can be the same as `server_name` if you want. This is only necessary
-  # when Conduit is running on a different machine than the one hosting your
-  # root domain. This configuration also assumes this is all running on a single
-  # machine, some tweaks will need to be made if this is not the case.
-  matrix_hostname = "matrix.${server_name}";
-
-  # An admin email for TLS certificate notifications
-  admin_email = "admin@${server_name}";
-
-  # These ones you can leave alone
-
-  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
-  well_known_server = pkgs.writeText "well-known-matrix-server" ''
-    {
-      "m.server": "${matrix_hostname}"
-    }
-  '';
-
-  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
-  well_known_client = pkgs.writeText "well-known-matrix-client" ''
-    {
-      "m.homeserver": {
-        "base_url": "https://${matrix_hostname}"
-      }
-    }
-  '';
-in
-
-{
-  # Configure Conduit itself
-  services.matrix-conduit = {
-    enable = true;
-
-    # This causes NixOS to use the flake defined in this repository instead of
-    # the build of Conduit built into nixpkgs.
-    package = flake-inputs.conduit.packages.${pkgs.system}.default;
-
-    settings.global = {
-      inherit server_name;
-    };
-  };
-
-  # Configure automated TLS acquisition/renewal
-  security.acme = {
-    acceptTerms = true;
-    defaults = {
-      email = admin_email;
-    };
-  };
-
-  # ACME data must be readable by the NGINX user
-  users.users.nginx.extraGroups = [
-    "acme"
-  ];
-
-  # Configure NGINX as a reverse proxy
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-
-    virtualHosts = {
-      "${matrix_hostname}" = {
-        forceSSL = true;
-        enableACME = true;
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "0.0.0.0";
-            port = 8448;
-            ssl = true;
-          }
-        ];
-
-        locations."/_matrix/" = {
-          proxyPass = "http://backend_conduit$request_uri";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_set_header Host $host;
-            proxy_buffering off;
-          '';
-        };
-
-        extraConfig = ''
-          merge_slashes off;
-        '';
-      };
-
-      "${server_name}" = {
-        forceSSL = true;
-        enableACME = true;
-
-        locations."=/.well-known/matrix/server" = {
-          # Use the contents of the derivation built previously
-          alias = "${well_known_server}";
-
-          extraConfig = ''
-            # Set the header since by default NGINX thinks it's just bytes
-            default_type application/json;
-          '';
-        };
-
-        locations."=/.well-known/matrix/client" = {
-          # Use the contents of the derivation built previously
-          alias = "${well_known_client}";
-
-          extraConfig = ''
-            # Set the header since by default NGINX thinks it's just bytes
-            default_type application/json;
-
-            # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
-            add_header Access-Control-Allow-Origin "*";
-          '';
-        };
-      };
-    };
-
-    upstreams = {
-      "backend_conduit" = {
-        servers = {
-          "localhost:${toString config.services.matrix-conduit.settings.global.port}" = { };
-        };
-      };
-    };
-  };
-
-  # Open firewall ports for HTTP, HTTPS, and Matrix federation
-  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
-  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
-}
-```
-
-Now you can rebuild your system configuration and you should be good to go!
-
-[enable_flakes]: https://nixos.wiki/wiki/Flakes#Enable_flakes
-
-[specialargs]: https://nixos.wiki/wiki/Flakes#Using_nix_flakes_with_NixOS
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 00000000..f7a94340
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,22 @@
+# This is the authoritiative configuration of this project's Rust toolchain.
+#
+# Other files that need upkeep when this changes:
+#
+# * `.gitlab-ci.yml`
+# * `Cargo.toml`
+# * `flake.nix`
+#
+# Search in those files for `rust-toolchain.toml` to find the relevant places.
+# If you're having trouble making the relevant changes, bug a maintainer.
+
+[toolchain]
+channel = "1.75.0"
+components = [
+    # For rust-analyzer
+    "rust-src",
+]
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "x86_64-unknown-linux-musl",
+    "aarch64-unknown-linux-musl",
+]
diff --git a/src/api/appservice_server.rs b/src/api/appservice_server.rs
index dc319e2c..3ec7a66e 100644
--- a/src/api/appservice_server.rs
+++ b/src/api/appservice_server.rs
@@ -1,24 +1,35 @@
 use crate::{services, utils, Error, Result};
 use bytes::BytesMut;
-use ruma::api::{IncomingResponse, MatrixVersion, OutgoingRequest, SendAccessToken};
+use ruma::api::{
+    appservice::Registration, IncomingResponse, MatrixVersion, OutgoingRequest, SendAccessToken,
+};
 use std::{fmt::Debug, mem, time::Duration};
 use tracing::warn;
 
+/// Sends a request to an appservice
+///
+/// Only returns None if there is no url specified in the appservice registration file
 #[tracing::instrument(skip(request))]
 pub(crate) async fn send_request<T: OutgoingRequest>(
-    registration: serde_yaml::Value,
+    registration: Registration,
     request: T,
-) -> Result<T::IncomingResponse>
+) -> Result<Option<T::IncomingResponse>>
 where
     T: Debug,
 {
-    let destination = registration.get("url").unwrap().as_str().unwrap();
-    let hs_token = registration.get("hs_token").unwrap().as_str().unwrap();
+    let destination = match registration.url {
+        Some(url) => url,
+        None => {
+            return Ok(None);
+        }
+    };
+
+    let hs_token = registration.hs_token.as_str();
 
     let mut http_request = request
         .try_into_http_request::<BytesMut>(
-            destination,
-            SendAccessToken::IfRequired(""),
+            &destination,
+            SendAccessToken::IfRequired(hs_token),
             &[MatrixVersion::V1_0],
         )
         .unwrap()
@@ -39,8 +50,7 @@ where
     );
     *http_request.uri_mut() = parts.try_into().expect("our manipulation is always valid");
 
-    let mut reqwest_request = reqwest::Request::try_from(http_request)
-        .expect("all http requests are valid reqwest requests");
+    let mut reqwest_request = reqwest::Request::try_from(http_request)?;
 
     *reqwest_request.timeout_mut() = Some(Duration::from_secs(30));
 
@@ -55,9 +65,7 @@ where
         Err(e) => {
             warn!(
                 "Could not send request to appservice {:?} at {}: {}",
-                registration.get("id"),
-                destination,
-                e
+                registration.id, destination, e
             );
             return Err(e.into());
         }
@@ -95,7 +103,8 @@ where
             .body(body)
             .expect("reqwest body is valid http body"),
     );
-    response.map_err(|_| {
+
+    response.map(Some).map_err(|_| {
         warn!(
             "Appservice returned invalid response bytes {}\n{}",
             destination, url
diff --git a/src/api/client_server/account.rs b/src/api/client_server/account.rs
index 1d7480a2..9f98369b 100644
--- a/src/api/client_server/account.rs
+++ b/src/api/client_server/account.rs
@@ -3,7 +3,8 @@ use crate::{api::client_server, services, utils, Error, Result, Ruma};
 use ruma::{
     api::client::{
         account::{
-            change_password, deactivate, get_3pids, get_username_availability, register,
+            change_password, deactivate, get_3pids, get_username_availability,
+            register::{self, LoginType},
             request_3pid_management_token_via_email, request_3pid_management_token_via_msisdn,
             whoami, ThirdPartyIdRemovalStatus,
         },
@@ -74,13 +75,23 @@ pub async fn get_register_available_route(
 /// - Creates a new account and populates it with default account data
 /// - If `inhibit_login` is false: Creates a device and returns device id and access_token
 pub async fn register_route(body: Ruma<register::v3::Request>) -> Result<register::v3::Response> {
-    if !services().globals.allow_registration() && !body.from_appservice {
+    if !services().globals.allow_registration()
+        && !body.from_appservice
+        && services().globals.config.registration_token.is_none()
+    {
         return Err(Error::BadRequest(
             ErrorKind::Forbidden,
             "Registration has been disabled.",
         ));
     }
 
+    if body.body.login_type == Some(LoginType::ApplicationService) && !body.from_appservice {
+        return Err(Error::BadRequest(
+            ErrorKind::MissingToken,
+            "Missing appservice token.",
+        ));
+    }
+
     let is_guest = body.kind == RegistrationKind::Guest;
 
     let user_id = match (&body.username, is_guest) {
@@ -121,7 +132,11 @@ pub async fn register_route(body: Ruma<register::v3::Request>) -> Result<registe
     // UIAA
     let mut uiaainfo = UiaaInfo {
         flows: vec![AuthFlow {
-            stages: vec![AuthType::Dummy],
+            stages: if services().globals.config.registration_token.is_some() {
+                vec![AuthType::RegistrationToken]
+            } else {
+                vec![AuthType::Dummy]
+            },
         }],
         completed: Vec::new(),
         params: Default::default(),
@@ -222,21 +237,32 @@ pub async fn register_route(body: Ruma<register::v3::Request>) -> Result<registe
     )?;
 
     info!("New user {} registered on this server.", user_id);
-    services()
-        .admin
-        .send_message(RoomMessageEventContent::notice_plain(format!(
-            "New user {user_id} registered on this server."
-        )));
+    if !body.from_appservice && !is_guest {
+        services()
+            .admin
+            .send_message(RoomMessageEventContent::notice_plain(format!(
+                "New user {user_id} registered on this server."
+            )));
+    }
 
     // If this is the first real user, grant them admin privileges
     // Note: the server user, @conduit:servername, is generated first
-    if services().users.count()? == 2 {
-        services()
-            .admin
-            .make_user_admin(&user_id, displayname)
-            .await?;
+    if !is_guest {
+        if let Some(admin_room) = services().admin.get_admin_room()? {
+            if services()
+                .rooms
+                .state_cache
+                .room_joined_count(&admin_room)?
+                == Some(1)
+            {
+                services()
+                    .admin
+                    .make_user_admin(&user_id, displayname)
+                    .await?;
 
-        warn!("Granting {} admin privileges as the first user", user_id);
+                warn!("Granting {} admin privileges as the first user", user_id);
+            }
+        }
     }
 
     Ok(register::v3::Response {
diff --git a/src/api/client_server/alias.rs b/src/api/client_server/alias.rs
index ab51b506..b84c7c4e 100644
--- a/src/api/client_server/alias.rs
+++ b/src/api/client_server/alias.rs
@@ -1,5 +1,5 @@
 use crate::{services, Error, Result, Ruma};
-use regex::Regex;
+use rand::seq::SliceRandom;
 use ruma::{
     api::{
         appservice,
@@ -90,41 +90,30 @@ pub(crate) async fn get_alias_helper(
             )
             .await?;
 
-        return Ok(get_alias::v3::Response::new(
-            response.room_id,
-            response.servers,
-        ));
+        let mut servers = response.servers;
+        servers.shuffle(&mut rand::thread_rng());
+
+        return Ok(get_alias::v3::Response::new(response.room_id, servers));
     }
 
     let mut room_id = None;
     match services().rooms.alias.resolve_local_alias(&room_alias)? {
         Some(r) => room_id = Some(r),
         None => {
-            for (_id, registration) in services().appservice.all()? {
-                let aliases = registration
-                    .get("namespaces")
-                    .and_then(|ns| ns.get("aliases"))
-                    .and_then(|aliases| aliases.as_sequence())
-                    .map_or_else(Vec::new, |aliases| {
-                        aliases
-                            .iter()
-                            .filter_map(|aliases| Regex::new(aliases.get("regex")?.as_str()?).ok())
-                            .collect::<Vec<_>>()
-                    });
-
-                if aliases
-                    .iter()
-                    .any(|aliases| aliases.is_match(room_alias.as_str()))
-                    && services()
-                        .sending
-                        .send_appservice_request(
-                            registration,
-                            appservice::query::query_room_alias::v1::Request {
-                                room_alias: room_alias.clone(),
-                            },
-                        )
-                        .await
-                        .is_ok()
+            for appservice in services().appservice.read().await.values() {
+                if appservice.aliases.is_match(room_alias.as_str())
+                    && matches!(
+                        services()
+                            .sending
+                            .send_appservice_request(
+                                appservice.registration.clone(),
+                                appservice::query::query_room_alias::v1::Request {
+                                    room_alias: room_alias.clone(),
+                                },
+                            )
+                            .await,
+                        Ok(Some(_opt_result))
+                    )
                 {
                     room_id = Some(
                         services()
diff --git a/src/api/client_server/config.rs b/src/api/client_server/config.rs
index 12f9aeaa..37279e35 100644
--- a/src/api/client_server/config.rs
+++ b/src/api/client_server/config.rs
@@ -75,7 +75,7 @@ pub async fn get_global_account_data_route(
 
     let event: Box<RawJsonValue> = services()
         .account_data
-        .get(None, sender_user, body.event_type.clone().into())?
+        .get(None, sender_user, body.event_type.to_string().into())?
         .ok_or(Error::BadRequest(ErrorKind::NotFound, "Data not found."))?;
 
     let account_data = serde_json::from_str::<ExtractGlobalEventContent>(event.get())
@@ -95,11 +95,7 @@ pub async fn get_room_account_data_route(
 
     let event: Box<RawJsonValue> = services()
         .account_data
-        .get(
-            Some(&body.room_id),
-            sender_user,
-            body.event_type.clone().into(),
-        )?
+        .get(Some(&body.room_id), sender_user, body.event_type.clone())?
         .ok_or(Error::BadRequest(ErrorKind::NotFound, "Data not found."))?;
 
     let account_data = serde_json::from_str::<ExtractRoomEventContent>(event.get())
diff --git a/src/api/client_server/context.rs b/src/api/client_server/context.rs
index 5a3013b0..8e193e6b 100644
--- a/src/api/client_server/context.rs
+++ b/src/api/client_server/context.rs
@@ -3,7 +3,7 @@ use ruma::{
     api::client::{context::get_context, error::ErrorKind, filter::LazyLoadOptions},
     events::StateEventType,
 };
-use std::{collections::HashSet, convert::TryFrom};
+use std::collections::HashSet;
 use tracing::error;
 
 /// # `GET /_matrix/client/r0/rooms/{roomId}/context`
@@ -69,18 +69,16 @@ pub async fn get_context_route(
         lazy_loaded.insert(base_event.sender.as_str().to_owned());
     }
 
+    // Use limit with maximum 100
+    let limit = u64::from(body.limit).min(100) as usize;
+
     let base_event = base_event.to_room_event();
 
     let events_before: Vec<_> = services()
         .rooms
         .timeline
         .pdus_until(sender_user, &room_id, base_token)?
-        .take(
-            u32::try_from(body.limit).map_err(|_| {
-                Error::BadRequest(ErrorKind::InvalidParam, "Limit value is invalid.")
-            })? as usize
-                / 2,
-        )
+        .take(limit / 2)
         .filter_map(|r| r.ok()) // Remove buggy events
         .filter(|(_, pdu)| {
             services()
@@ -103,7 +101,10 @@ pub async fn get_context_route(
         }
     }
 
-    let start_token = events_before.last().map(|(count, _)| count.stringify());
+    let start_token = events_before
+        .last()
+        .map(|(count, _)| count.stringify())
+        .unwrap_or_else(|| base_token.stringify());
 
     let events_before: Vec<_> = events_before
         .into_iter()
@@ -114,12 +115,7 @@ pub async fn get_context_route(
         .rooms
         .timeline
         .pdus_after(sender_user, &room_id, base_token)?
-        .take(
-            u32::try_from(body.limit).map_err(|_| {
-                Error::BadRequest(ErrorKind::InvalidParam, "Limit value is invalid.")
-            })? as usize
-                / 2,
-        )
+        .take(limit / 2)
         .filter_map(|r| r.ok()) // Remove buggy events
         .filter(|(_, pdu)| {
             services()
@@ -161,7 +157,10 @@ pub async fn get_context_route(
         .state_full_ids(shortstatehash)
         .await?;
 
-    let end_token = events_after.last().map(|(count, _)| count.stringify());
+    let end_token = events_after
+        .last()
+        .map(|(count, _)| count.stringify())
+        .unwrap_or_else(|| base_token.stringify());
 
     let events_after: Vec<_> = events_after
         .into_iter()
@@ -198,8 +197,8 @@ pub async fn get_context_route(
     }
 
     let resp = get_context::v3::Response {
-        start: start_token,
-        end: end_token,
+        start: Some(start_token),
+        end: Some(end_token),
         events_before,
         event: Some(base_event),
         events_after,
diff --git a/src/api/client_server/directory.rs b/src/api/client_server/directory.rs
index e1322109..50ae9f15 100644
--- a/src/api/client_server/directory.rs
+++ b/src/api/client_server/directory.rs
@@ -20,7 +20,6 @@ use ruma::{
             guest_access::{GuestAccess, RoomGuestAccessEventContent},
             history_visibility::{HistoryVisibility, RoomHistoryVisibilityEventContent},
             join_rules::{JoinRule, RoomJoinRulesEventContent},
-            name::RoomNameEventContent,
             topic::RoomTopicEventContent,
         },
         StateEventType,
@@ -203,17 +202,7 @@ pub(crate) async fn get_public_rooms_filtered_helper(
                                 Error::bad_database("Invalid canonical alias event in database.")
                             })
                     })?,
-                name: services()
-                    .rooms
-                    .state_accessor
-                    .room_state_get(&room_id, &StateEventType::RoomName, "")?
-                    .map_or(Ok(None), |s| {
-                        serde_json::from_str(s.content.get())
-                            .map(|c: RoomNameEventContent| c.name)
-                            .map_err(|_| {
-                                Error::bad_database("Invalid room name event in database.")
-                            })
-                    })?,
+                name: services().rooms.state_accessor.get_name(&room_id)?,
                 num_joined_members: services()
                     .rooms
                     .state_cache
@@ -232,6 +221,7 @@ pub(crate) async fn get_public_rooms_filtered_helper(
                         serde_json::from_str(s.content.get())
                             .map(|c: RoomTopicEventContent| Some(c.topic))
                             .map_err(|_| {
+                                error!("Invalid room topic event in database for room {}", room_id);
                                 Error::bad_database("Invalid room topic event in database.")
                             })
                     })?,
diff --git a/src/api/client_server/keys.rs b/src/api/client_server/keys.rs
index ba89ece0..4af8890d 100644
--- a/src/api/client_server/keys.rs
+++ b/src/api/client_server/keys.rs
@@ -17,7 +17,11 @@ use ruma::{
     DeviceKeyAlgorithm, OwnedDeviceId, OwnedUserId, UserId,
 };
 use serde_json::json;
-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::{
+    collections::{hash_map, BTreeMap, HashMap, HashSet},
+    time::{Duration, Instant},
+};
+use tracing::debug;
 
 /// # `POST /_matrix/client/r0/keys/upload`
 ///
@@ -132,6 +136,7 @@ pub async fn upload_signing_keys_route(
             master_key,
             &body.self_signing_key,
             &body.user_signing_key,
+            true, // notify so that other users see the new keys
         )?;
     }
 
@@ -151,18 +156,6 @@ pub async fn upload_signatures_route(
             let key = serde_json::to_value(key)
                 .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid key JSON"))?;
 
-            let is_signed_key = match key.get("usage") {
-                Some(usage) => usage
-                    .as_array()
-                    .map(|usage| !usage.contains(&json!("master")))
-                    .unwrap_or(false),
-                None => true,
-            };
-
-            if !is_signed_key {
-                continue;
-            }
-
             for signature in key
                 .get("signatures")
                 .ok_or(Error::BadRequest(
@@ -323,15 +316,17 @@ pub(crate) async fn get_keys_helper<F: Fn(&UserId) -> bool>(
             }
         }
 
-        if let Some(master_key) = services()
-            .users
-            .get_master_key(user_id, &allowed_signatures)?
+        if let Some(master_key) =
+            services()
+                .users
+                .get_master_key(sender_user, user_id, &allowed_signatures)?
         {
             master_keys.insert(user_id.to_owned(), master_key);
         }
-        if let Some(self_signing_key) = services()
-            .users
-            .get_self_signing_key(user_id, &allowed_signatures)?
+        if let Some(self_signing_key) =
+            services()
+                .users
+                .get_self_signing_key(sender_user, user_id, &allowed_signatures)?
         {
             self_signing_keys.insert(user_id.to_owned(), self_signing_key);
         }
@@ -344,36 +339,99 @@ pub(crate) async fn get_keys_helper<F: Fn(&UserId) -> bool>(
 
     let mut failures = BTreeMap::new();
 
+    let back_off = |id| async {
+        match services()
+            .globals
+            .bad_query_ratelimiter
+            .write()
+            .await
+            .entry(id)
+        {
+            hash_map::Entry::Vacant(e) => {
+                e.insert((Instant::now(), 1));
+            }
+            hash_map::Entry::Occupied(mut e) => *e.get_mut() = (Instant::now(), e.get().1 + 1),
+        }
+    };
+
     let mut futures: FuturesUnordered<_> = get_over_federation
         .into_iter()
         .map(|(server, vec)| async move {
+            if let Some((time, tries)) = services()
+                .globals
+                .bad_query_ratelimiter
+                .read()
+                .await
+                .get(server)
+            {
+                // Exponential backoff
+                let mut min_elapsed_duration = Duration::from_secs(30) * (*tries) * (*tries);
+                if min_elapsed_duration > Duration::from_secs(60 * 60 * 24) {
+                    min_elapsed_duration = Duration::from_secs(60 * 60 * 24);
+                }
+
+                if time.elapsed() < min_elapsed_duration {
+                    debug!("Backing off query from {:?}", server);
+                    return (
+                        server,
+                        Err(Error::BadServerResponse("bad query, still backing off")),
+                    );
+                }
+            }
+
             let mut device_keys_input_fed = BTreeMap::new();
             for (user_id, keys) in vec {
                 device_keys_input_fed.insert(user_id.to_owned(), keys.clone());
             }
             (
                 server,
-                services()
-                    .sending
-                    .send_federation_request(
+                tokio::time::timeout(
+                    Duration::from_secs(25),
+                    services().sending.send_federation_request(
                         server,
                         federation::keys::get_keys::v1::Request {
                             device_keys: device_keys_input_fed,
                         },
-                    )
-                    .await,
+                    ),
+                )
+                .await
+                .map_err(|_e| Error::BadServerResponse("Query took too long")),
             )
         })
         .collect();
 
     while let Some((server, response)) = futures.next().await {
         match response {
-            Ok(response) => {
-                master_keys.extend(response.master_keys);
+            Ok(Ok(response)) => {
+                for (user, masterkey) in response.master_keys {
+                    let (master_key_id, mut master_key) =
+                        services().users.parse_master_key(&user, &masterkey)?;
+
+                    if let Some(our_master_key) = services().users.get_key(
+                        &master_key_id,
+                        sender_user,
+                        &user,
+                        &allowed_signatures,
+                    )? {
+                        let (_, our_master_key) =
+                            services().users.parse_master_key(&user, &our_master_key)?;
+                        master_key.signatures.extend(our_master_key.signatures);
+                    }
+                    let json = serde_json::to_value(master_key).expect("to_value always works");
+                    let raw = serde_json::from_value(json).expect("Raw::from_value always works");
+                    services().users.add_cross_signing_keys(
+                        &user, &raw, &None, &None,
+                        false, // Dont notify. A notification would trigger another key request resulting in an endless loop
+                    )?;
+                    master_keys.insert(user, raw);
+                }
+
                 self_signing_keys.extend(response.self_signing_keys);
                 device_keys.extend(response.device_keys);
             }
-            Err(_e) => {
+            _ => {
+                back_off(server.to_owned()).await;
+
                 failures.insert(server.to_string(), json!({}));
             }
         }
diff --git a/src/api/client_server/media.rs b/src/api/client_server/media.rs
index 3410cc01..7fc65c26 100644
--- a/src/api/client_server/media.rs
+++ b/src/api/client_server/media.rs
@@ -1,3 +1,5 @@
+use std::time::Duration;
+
 use crate::{service::media::FileMeta, services, utils, Error, Result, Ruma};
 use ruma::api::client::{
     error::ErrorKind,
@@ -49,7 +51,7 @@ pub async fn create_content_route(
         .await?;
 
     Ok(create_content::v3::Response {
-        content_uri: mxc.try_into().expect("Invalid mxc:// URI"),
+        content_uri: mxc.into(),
         blurhash: None,
     })
 }
@@ -67,6 +69,8 @@ pub async fn get_remote_content(
                 allow_remote: false,
                 server_name: server_name.to_owned(),
                 media_id,
+                timeout_ms: Duration::from_secs(20),
+                allow_redirect: false,
             },
         )
         .await?;
@@ -194,6 +198,8 @@ pub async fn get_content_thumbnail_route(
                     method: body.method.clone(),
                     server_name: body.server_name.clone(),
                     media_id: body.media_id.clone(),
+                    timeout_ms: Duration::from_secs(20),
+                    allow_redirect: false,
                 },
             )
             .await?;
diff --git a/src/api/client_server/membership.rs b/src/api/client_server/membership.rs
index b9b1756e..86ac5950 100644
--- a/src/api/client_server/membership.rs
+++ b/src/api/client_server/membership.rs
@@ -17,7 +17,7 @@ use ruma::{
             member::{MembershipState, RoomMemberEventContent},
             power_levels::RoomPowerLevelsEventContent,
         },
-        RoomEventType, StateEventType,
+        StateEventType, TimelineEventType,
     },
     serde::Base64,
     state_res, CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
@@ -26,9 +26,10 @@ use ruma::{
 use serde_json::value::{to_raw_value, RawValue as RawJsonValue};
 use std::{
     collections::{hash_map::Entry, BTreeMap, HashMap, HashSet},
-    sync::{Arc, RwLock},
+    sync::Arc,
     time::{Duration, Instant},
 };
+use tokio::sync::RwLock;
 use tracing::{debug, error, info, warn};
 
 use crate::{
@@ -64,7 +65,12 @@ pub async fn join_room_by_id_route(
             .map(|user| user.server_name().to_owned()),
     );
 
-    servers.push(body.room_id.server_name().to_owned());
+    servers.push(
+        body.room_id
+            .server_name()
+            .expect("Room IDs should always have a server name")
+            .into(),
+    );
 
     join_room_by_id_helper(
         body.sender_user.as_deref(),
@@ -105,13 +111,19 @@ pub async fn join_room_by_id_or_alias_route(
                     .map(|user| user.server_name().to_owned()),
             );
 
-            servers.push(room_id.server_name().to_owned());
+            servers.push(
+                room_id
+                    .server_name()
+                    .expect("Room IDs should always have a server name")
+                    .into(),
+            );
+
             (servers, room_id)
         }
         Err(room_alias) => {
             let response = get_alias_helper(room_alias).await?;
 
-            (response.servers.into_iter().collect(), response.room_id)
+            (response.servers, response.room_id)
         }
     };
 
@@ -201,24 +213,28 @@ pub async fn kick_user_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.clone())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomMember,
-            content: to_raw_value(&event).expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some(body.user_id.to_string()),
-            redacts: None,
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&event).expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(body.user_id.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     drop(state_lock);
 
@@ -254,6 +270,7 @@ pub async fn ban_user_route(body: Ruma<ban_user::v3::Request>) -> Result<ban_use
                 serde_json::from_str(event.content.get())
                     .map(|event: RoomMemberEventContent| RoomMemberEventContent {
                         membership: MembershipState::Ban,
+                        join_authorized_via_users_server: None,
                         ..event
                     })
                     .map_err(|_| Error::bad_database("Invalid member event in database."))
@@ -265,24 +282,28 @@ pub async fn ban_user_route(body: Ruma<ban_user::v3::Request>) -> Result<ban_use
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.clone())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomMember,
-            content: to_raw_value(&event).expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some(body.user_id.to_string()),
-            redacts: None,
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&event).expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(body.user_id.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     drop(state_lock);
 
@@ -323,24 +344,28 @@ pub async fn unban_user_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.clone())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomMember,
-            content: to_raw_value(&event).expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some(body.user_id.to_string()),
-            redacts: None,
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&event).expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(body.user_id.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     drop(state_lock);
 
@@ -399,7 +424,7 @@ pub async fn get_member_events_route(
     if !services()
         .rooms
         .state_accessor
-        .user_can_see_state_events(&sender_user, &body.room_id)?
+        .user_can_see_state_events(sender_user, &body.room_id)?
     {
         return Err(Error::BadRequest(
             ErrorKind::Forbidden,
@@ -434,7 +459,7 @@ pub async fn joined_members_route(
     if !services()
         .rooms
         .state_accessor
-        .user_can_see_state_events(&sender_user, &body.room_id)?
+        .user_can_see_state_events(sender_user, &body.room_id)?
     {
         return Err(Error::BadRequest(
             ErrorKind::Forbidden,
@@ -478,7 +503,7 @@ async fn join_room_by_id_helper(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(room_id.to_owned())
             .or_default(),
     );
@@ -590,6 +615,7 @@ async fn join_room_by_id_helper(
                     room_id: room_id.to_owned(),
                     event_id: event_id.to_owned(),
                     pdu: PduEvent::convert_to_outgoing_federation_event(join_event.clone()),
+                    omit_members: false,
                 },
             )
             .await?;
@@ -597,7 +623,7 @@ async fn join_room_by_id_helper(
         info!("send_join finished");
 
         if let Some(signed_raw) = &send_join_response.room_state.event {
-            info!("There is a signed event. This room is probably using restricted joins");
+            info!("There is a signed event. This room is probably using restricted joins. Adding signature to our event");
             let (signed_event_id, signed_value) =
                 match gen_event_id_canonical_json(signed_raw, &room_version_id) {
                     Ok(t) => t,
@@ -617,7 +643,7 @@ async fn join_room_by_id_helper(
                 ));
             }
 
-            if let Ok(signature) = signed_value["signatures"]
+            match signed_value["signatures"]
                 .as_object()
                 .ok_or(Error::BadRequest(
                     ErrorKind::InvalidParam,
@@ -628,18 +654,20 @@ async fn join_room_by_id_helper(
                         ErrorKind::InvalidParam,
                         "Server did not send its signature",
                     ))
-                })
-            {
-                join_event
-                    .get_mut("signatures")
-                    .expect("we created a valid pdu")
-                    .as_object_mut()
-                    .expect("we created a valid pdu")
-                    .insert(remote_server.to_string(), signature.clone());
-            } else {
-                warn!(
-                    "Server {remote_server} sent invalid signature in sendjoin signatures for event {signed_value:?}",
-                );
+                }) {
+                Ok(signature) => {
+                    join_event
+                        .get_mut("signatures")
+                        .expect("we created a valid pdu")
+                        .as_object_mut()
+                        .expect("we created a valid pdu")
+                        .insert(remote_server.to_string(), signature.clone());
+                }
+                Err(e) => {
+                    warn!(
+                        "Server {remote_server} sent invalid signature in sendjoin signatures for event {signed_value:?}: {e:?}",
+                    );
+                }
             }
         }
 
@@ -666,13 +694,13 @@ async fn join_room_by_id_helper(
             .iter()
             .map(|pdu| validate_and_add_event_id(pdu, &room_version_id, &pub_key_map))
         {
-            let (event_id, value) = match result {
+            let (event_id, value) = match result.await {
                 Ok(t) => t,
                 Err(_) => continue,
             };
 
             let pdu = PduEvent::from_id_val(&event_id, value.clone()).map_err(|e| {
-                warn!("{:?}: {}", value, e);
+                warn!("Invalid PDU in send_join response: {} {:?}", e, value);
                 Error::BadServerResponse("Invalid PDU in send_join response.")
             })?;
 
@@ -696,7 +724,7 @@ async fn join_room_by_id_helper(
             .iter()
             .map(|pdu| validate_and_add_event_id(pdu, &room_version_id, &pub_key_map))
         {
-            let (event_id, value) = match result {
+            let (event_id, value) = match result.await {
                 Ok(t) => t,
                 Err(_) => continue,
             };
@@ -708,7 +736,7 @@ async fn join_room_by_id_helper(
         }
 
         info!("Running send_join auth check");
-        if !state_res::event_auth::auth_check(
+        let authenticated = state_res::event_auth::auth_check(
             &state_res::RoomVersion::new(&room_version_id).expect("room version is supported"),
             &parsed_join_pdu,
             None::<PduEvent>, // TODO: third party invite
@@ -731,7 +759,9 @@ async fn join_room_by_id_helper(
         .map_err(|e| {
             warn!("Auth check failed: {e}");
             Error::BadRequest(ErrorKind::InvalidParam, "Auth check failed")
-        })? {
+        })?;
+
+        if !authenticated {
             return Err(Error::BadRequest(
                 ErrorKind::InvalidParam,
                 "Auth check failed",
@@ -741,15 +771,17 @@ async fn join_room_by_id_helper(
         info!("Saving state from send_join");
         let (statehash_before_join, new, removed) = services().rooms.state_compressor.save_state(
             room_id,
-            state
-                .into_iter()
-                .map(|(k, id)| {
-                    services()
-                        .rooms
-                        .state_compressor
-                        .compress_state_event(k, &id)
-                })
-                .collect::<Result<_>>()?,
+            Arc::new(
+                state
+                    .into_iter()
+                    .map(|(k, id)| {
+                        services()
+                            .rooms
+                            .state_compressor
+                            .compress_state_event(k, &id)
+                    })
+                    .collect::<Result<_>>()?,
+            ),
         )?;
 
         services()
@@ -766,12 +798,16 @@ async fn join_room_by_id_helper(
         let statehash_after_join = services().rooms.state.append_to_state(&parsed_join_pdu)?;
 
         info!("Appending new room join event");
-        services().rooms.timeline.append_pdu(
-            &parsed_join_pdu,
-            join_event,
-            vec![(*parsed_join_pdu.event_id).to_owned()],
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .append_pdu(
+                &parsed_join_pdu,
+                join_event,
+                vec![(*parsed_join_pdu.event_id).to_owned()],
+                &state_lock,
+            )
+            .await?;
 
         info!("Setting final room state for new room");
         // We set the room state after inserting the pdu, so that we never have a moment in time
@@ -884,23 +920,34 @@ async fn join_room_by_id_helper(
         };
 
         // Try normal join first
-        let error = match services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomMember,
-                content: to_raw_value(&event).expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some(sender_user.to_string()),
-                redacts: None,
-            },
-            sender_user,
-            room_id,
-            &state_lock,
-        ) {
+        let error = match services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomMember,
+                    content: to_raw_value(&event).expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some(sender_user.to_string()),
+                    redacts: None,
+                },
+                sender_user,
+                room_id,
+                &state_lock,
+            )
+            .await
+        {
             Ok(_event_id) => return Ok(join_room_by_id::v3::Response::new(room_id.to_owned())),
             Err(e) => e,
         };
 
-        if !restriction_rooms.is_empty() {
+        if !restriction_rooms.is_empty()
+            && servers
+                .iter()
+                .filter(|s| *s != services().globals.server_name())
+                .count()
+                > 0
+        {
             info!(
                 "We couldn't do the join locally, maybe federation can help to satisfy the restricted join requirements"
             );
@@ -996,6 +1043,7 @@ async fn join_room_by_id_helper(
                         room_id: room_id.to_owned(),
                         event_id: event_id.to_owned(),
                         pdu: PduEvent::convert_to_outgoing_federation_event(join_event.clone()),
+                        omit_members: false,
                     },
                 )
                 .await?;
@@ -1084,7 +1132,7 @@ async fn make_join_request(
     make_join_response_and_server
 }
 
-fn validate_and_add_event_id(
+async fn validate_and_add_event_id(
     pdu: &RawJsonValue,
     room_version: &RoomVersionId,
     pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
@@ -1100,24 +1148,26 @@ fn validate_and_add_event_id(
     ))
     .expect("ruma's reference hashes are valid event ids");
 
-    let back_off = |id| match services()
-        .globals
-        .bad_event_ratelimiter
-        .write()
-        .unwrap()
-        .entry(id)
-    {
-        Entry::Vacant(e) => {
-            e.insert((Instant::now(), 1));
+    let back_off = |id| async {
+        match services()
+            .globals
+            .bad_event_ratelimiter
+            .write()
+            .await
+            .entry(id)
+        {
+            Entry::Vacant(e) => {
+                e.insert((Instant::now(), 1));
+            }
+            Entry::Occupied(mut e) => *e.get_mut() = (Instant::now(), e.get().1 + 1),
         }
-        Entry::Occupied(mut e) => *e.get_mut() = (Instant::now(), e.get().1 + 1),
     };
 
     if let Some((time, tries)) = services()
         .globals
         .bad_event_ratelimiter
         .read()
-        .unwrap()
+        .await
         .get(&event_id)
     {
         // Exponential backoff
@@ -1132,15 +1182,10 @@ fn validate_and_add_event_id(
         }
     }
 
-    if let Err(e) = ruma::signatures::verify_event(
-        &*pub_key_map
-            .read()
-            .map_err(|_| Error::bad_database("RwLock is poisoned."))?,
-        &value,
-        room_version,
-    ) {
+    if let Err(e) = ruma::signatures::verify_event(&*pub_key_map.read().await, &value, room_version)
+    {
         warn!("Event {} failed verification {:?} {}", event_id, pdu, e);
-        back_off(event_id);
+        back_off(event_id).await;
         return Err(Error::BadServerResponse("Event failed verification."));
     }
 
@@ -1166,7 +1211,7 @@ pub(crate) async fn invite_helper<'a>(
                     .globals
                     .roomid_mutex_state
                     .write()
-                    .unwrap()
+                    .await
                     .entry(room_id.to_owned())
                     .or_default(),
             );
@@ -1186,7 +1231,7 @@ pub(crate) async fn invite_helper<'a>(
 
             let (pdu, pdu_json) = services().rooms.timeline.create_hash_and_sign_event(
                 PduBuilder {
-                    event_type: RoomEventType::RoomMember,
+                    event_type: TimelineEventType::RoomMember,
                     content,
                     unsigned: None,
                     state_key: Some(user_id.to_string()),
@@ -1287,34 +1332,38 @@ pub(crate) async fn invite_helper<'a>(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(room_id.to_owned())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomMember,
-            content: to_raw_value(&RoomMemberEventContent {
-                membership: MembershipState::Invite,
-                displayname: services().users.displayname(user_id)?,
-                avatar_url: services().users.avatar_url(user_id)?,
-                is_direct: Some(is_direct),
-                third_party_invite: None,
-                blurhash: services().users.blurhash(user_id)?,
-                reason,
-                join_authorized_via_users_server: None,
-            })
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some(user_id.to_string()),
-            redacts: None,
-        },
-        sender_user,
-        room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&RoomMemberEventContent {
+                    membership: MembershipState::Invite,
+                    displayname: services().users.displayname(user_id)?,
+                    avatar_url: services().users.avatar_url(user_id)?,
+                    is_direct: Some(is_direct),
+                    third_party_invite: None,
+                    blurhash: services().users.blurhash(user_id)?,
+                    reason,
+                    join_authorized_via_users_server: None,
+                })
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(user_id.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            room_id,
+            &state_lock,
+        )
+        .await?;
 
     drop(state_lock);
 
@@ -1351,7 +1400,7 @@ pub async fn leave_all_rooms(user_id: &UserId) -> Result<()> {
 pub async fn leave_room(user_id: &UserId, room_id: &RoomId, reason: Option<String>) -> Result<()> {
     // Ask a remote server if we don't have this room
     if !services().rooms.metadata.exists(room_id)?
-        && room_id.server_name() != services().globals.server_name()
+        && room_id.server_name() != Some(services().globals.server_name())
     {
         if let Err(e) = remote_leave_room(user_id, room_id).await {
             warn!("Failed to leave room {} remotely: {}", user_id, e);
@@ -1382,7 +1431,7 @@ pub async fn leave_room(user_id: &UserId, room_id: &RoomId, reason: Option<Strin
                 .globals
                 .roomid_mutex_state
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.to_owned())
                 .or_default(),
         );
@@ -1417,19 +1466,24 @@ pub async fn leave_room(user_id: &UserId, room_id: &RoomId, reason: Option<Strin
 
         event.membership = MembershipState::Leave;
         event.reason = reason;
+        event.join_authorized_via_users_server = None;
 
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomMember,
-                content: to_raw_value(&event).expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some(user_id.to_string()),
-                redacts: None,
-            },
-            user_id,
-            room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomMember,
+                    content: to_raw_value(&event).expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some(user_id.to_string()),
+                    redacts: None,
+                },
+                user_id,
+                room_id,
+                &state_lock,
+            )
+            .await?;
     }
 
     Ok(())
diff --git a/src/api/client_server/message.rs b/src/api/client_server/message.rs
index f7c77f69..89f33591 100644
--- a/src/api/client_server/message.rs
+++ b/src/api/client_server/message.rs
@@ -7,7 +7,7 @@ use ruma::{
         error::ErrorKind,
         message::{get_message_events, send_message_event},
     },
-    events::{RoomEventType, StateEventType},
+    events::{StateEventType, TimelineEventType},
 };
 use std::{
     collections::{BTreeMap, HashSet},
@@ -32,14 +32,14 @@ pub async fn send_message_event_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.clone())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
     // Forbid m.room.encrypted if encryption is disabled
-    if RoomEventType::RoomEncrypted == body.event_type.to_string().into()
+    if TimelineEventType::RoomEncrypted == body.event_type.to_string().into()
         && !services().globals.allow_encryption()
     {
         return Err(Error::BadRequest(
@@ -73,19 +73,23 @@ pub async fn send_message_event_route(
     let mut unsigned = BTreeMap::new();
     unsigned.insert("transaction_id".to_owned(), body.txn_id.to_string().into());
 
-    let event_id = services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: body.event_type.to_string().into(),
-            content: serde_json::from_str(body.body.body.json().get())
-                .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid JSON body."))?,
-            unsigned: Some(unsigned),
-            state_key: None,
-            redacts: None,
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    let event_id = services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: body.event_type.to_string().into(),
+                content: serde_json::from_str(body.body.body.json().get())
+                    .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid JSON body."))?,
+                unsigned: Some(unsigned),
+                state_key: None,
+                redacts: None,
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     services().transaction_ids.add_txnid(
         sender_user,
@@ -116,25 +120,23 @@ pub async fn get_message_events_route(
     let from = match body.from.clone() {
         Some(from) => PduCount::try_from_string(&from)?,
         None => match body.dir {
-            ruma::api::client::Direction::Forward => PduCount::min(),
-            ruma::api::client::Direction::Backward => PduCount::max(),
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
         },
     };
 
     let to = body
         .to
         .as_ref()
-        .and_then(|t| PduCount::try_from_string(&t).ok());
+        .and_then(|t| PduCount::try_from_string(t).ok());
 
-    services().rooms.lazy_loading.lazy_load_confirm_delivery(
-        sender_user,
-        sender_device,
-        &body.room_id,
-        from,
-    )?;
+    services()
+        .rooms
+        .lazy_loading
+        .lazy_load_confirm_delivery(sender_user, sender_device, &body.room_id, from)
+        .await?;
 
-    // Use limit or else 10
-    let limit = body.limit.try_into().map_or(10_usize, |l: u32| l as usize);
+    let limit = u64::from(body.limit).min(100) as usize;
 
     let next_token;
 
@@ -143,7 +145,7 @@ pub async fn get_message_events_route(
     let mut lazy_loaded = HashSet::new();
 
     match body.dir {
-        ruma::api::client::Direction::Forward => {
+        ruma::api::Direction::Forward => {
             let events_after: Vec<_> = services()
                 .rooms
                 .timeline
@@ -187,7 +189,7 @@ pub async fn get_message_events_route(
             resp.end = next_token.map(|count| count.stringify());
             resp.chunk = events_after;
         }
-        ruma::api::client::Direction::Backward => {
+        ruma::api::Direction::Backward => {
             services()
                 .rooms
                 .timeline
diff --git a/src/api/client_server/mod.rs b/src/api/client_server/mod.rs
index 6ed17e76..54c99aa0 100644
--- a/src/api/client_server/mod.rs
+++ b/src/api/client_server/mod.rs
@@ -16,14 +16,17 @@ mod profile;
 mod push;
 mod read_marker;
 mod redact;
+mod relations;
 mod report;
 mod room;
 mod search;
 mod session;
+mod space;
 mod state;
 mod sync;
 mod tag;
 mod thirdparty;
+mod threads;
 mod to_device;
 mod typing;
 mod unversioned;
@@ -48,14 +51,17 @@ pub use profile::*;
 pub use push::*;
 pub use read_marker::*;
 pub use redact::*;
+pub use relations::*;
 pub use report::*;
 pub use room::*;
 pub use search::*;
 pub use session::*;
+pub use space::*;
 pub use state::*;
 pub use sync::*;
 pub use tag::*;
 pub use thirdparty::*;
+pub use threads::*;
 pub use to_device::*;
 pub use typing::*;
 pub use unversioned::*;
diff --git a/src/api/client_server/presence.rs b/src/api/client_server/presence.rs
index ef88d1a0..e5cd1b8e 100644
--- a/src/api/client_server/presence.rs
+++ b/src/api/client_server/presence.rs
@@ -1,5 +1,8 @@
-use crate::{services, utils, Result, Ruma};
-use ruma::api::client::presence::{get_presence, set_presence};
+use crate::{services, utils, Error, Result, Ruma};
+use ruma::api::client::{
+    error::ErrorKind,
+    presence::{get_presence, set_presence},
+};
 use std::time::Duration;
 
 /// # `PUT /_matrix/client/r0/presence/{userId}/status`
@@ -79,6 +82,9 @@ pub async fn get_presence_route(
             presence: presence.content.presence,
         })
     } else {
-        todo!();
+        Err(Error::BadRequest(
+            ErrorKind::NotFound,
+            "Presence state for this user was not found",
+        ))
     }
 }
diff --git a/src/api/client_server/profile.rs b/src/api/client_server/profile.rs
index 6400e891..cf1db2d7 100644
--- a/src/api/client_server/profile.rs
+++ b/src/api/client_server/profile.rs
@@ -9,7 +9,7 @@ use ruma::{
         },
         federation::{self, query::get_profile_information::v1::ProfileField},
     },
-    events::{room::member::RoomMemberEventContent, RoomEventType, StateEventType},
+    events::{room::member::RoomMemberEventContent, StateEventType, TimelineEventType},
 };
 use serde_json::value::to_raw_value;
 use std::sync::Arc;
@@ -37,9 +37,10 @@ pub async fn set_displayname_route(
         .map(|room_id| {
             Ok::<_, Error>((
                 PduBuilder {
-                    event_type: RoomEventType::RoomMember,
+                    event_type: TimelineEventType::RoomMember,
                     content: to_raw_value(&RoomMemberEventContent {
                         displayname: body.displayname.clone(),
+                        join_authorized_via_users_server: None,
                         ..serde_json::from_str(
                             services()
                                 .rooms
@@ -77,18 +78,17 @@ pub async fn set_displayname_route(
                 .globals
                 .roomid_mutex_state
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.clone())
                 .or_default(),
         );
         let state_lock = mutex_state.lock().await;
 
-        let _ = services().rooms.timeline.build_and_append_pdu(
-            pdu_builder,
-            sender_user,
-            &room_id,
-            &state_lock,
-        );
+        let _ = services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(pdu_builder, sender_user, &room_id, &state_lock)
+            .await;
 
         // Presence update
         services().rooms.edus.presence.update_presence(
@@ -172,9 +172,10 @@ pub async fn set_avatar_url_route(
         .map(|room_id| {
             Ok::<_, Error>((
                 PduBuilder {
-                    event_type: RoomEventType::RoomMember,
+                    event_type: TimelineEventType::RoomMember,
                     content: to_raw_value(&RoomMemberEventContent {
                         avatar_url: body.avatar_url.clone(),
+                        join_authorized_via_users_server: None,
                         ..serde_json::from_str(
                             services()
                                 .rooms
@@ -212,18 +213,17 @@ pub async fn set_avatar_url_route(
                 .globals
                 .roomid_mutex_state
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.clone())
                 .or_default(),
         );
         let state_lock = mutex_state.lock().await;
 
-        let _ = services().rooms.timeline.build_and_append_pdu(
-            pdu_builder,
-            sender_user,
-            &room_id,
-            &state_lock,
-        );
+        let _ = services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(pdu_builder, sender_user, &room_id, &state_lock)
+            .await;
 
         // Presence update
         services().rooms.edus.presence.update_presence(
diff --git a/src/api/client_server/push.rs b/src/api/client_server/push.rs
index b0441384..72768662 100644
--- a/src/api/client_server/push.rs
+++ b/src/api/client_server/push.rs
@@ -5,11 +5,11 @@ use ruma::{
         push::{
             delete_pushrule, get_pushers, get_pushrule, get_pushrule_actions, get_pushrule_enabled,
             get_pushrules_all, set_pusher, set_pushrule, set_pushrule_actions,
-            set_pushrule_enabled, RuleKind, RuleScope,
+            set_pushrule_enabled, RuleScope,
         },
     },
     events::{push_rules::PushRulesEvent, GlobalAccountDataEventType},
-    push::{ConditionalPushRuleInit, NewPushRule, PatternedPushRuleInit, SimplePushRuleInit},
+    push::{InsertPushRuleError, RemovePushRuleError},
 };
 
 /// # `GET /_matrix/client/r0/pushrules`
@@ -65,30 +65,10 @@ pub async fn get_pushrule_route(
         .map_err(|_| Error::bad_database("Invalid account data event in db."))?
         .content;
 
-    let global = account_data.global;
-    let rule = match body.kind {
-        RuleKind::Override => global
-            .override_
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.clone().into()),
-        RuleKind::Underride => global
-            .underride
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.clone().into()),
-        RuleKind::Sender => global
-            .sender
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.clone().into()),
-        RuleKind::Room => global
-            .room
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.clone().into()),
-        RuleKind::Content => global
-            .content
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.clone().into()),
-        _ => None,
-    };
+    let rule = account_data
+        .global
+        .get(body.kind.clone(), &body.rule_id)
+        .map(Into::into);
 
     if let Some(rule) = rule {
         Ok(get_pushrule::v3::Response { rule })
@@ -131,66 +111,36 @@ pub async fn set_pushrule_route(
     let mut account_data = serde_json::from_str::<PushRulesEvent>(event.get())
         .map_err(|_| Error::bad_database("Invalid account data event in db."))?;
 
-    let global = &mut account_data.content.global;
-    match body.rule {
-        NewPushRule::Override(rule) => {
-            global.override_.replace(
-                ConditionalPushRuleInit {
-                    actions: rule.actions,
-                    default: false,
-                    enabled: true,
-                    rule_id: rule.rule_id,
-                    conditions: rule.conditions,
-                }
-                .into(),
-            );
-        }
-        NewPushRule::Underride(rule) => {
-            global.underride.replace(
-                ConditionalPushRuleInit {
-                    actions: rule.actions,
-                    default: false,
-                    enabled: true,
-                    rule_id: rule.rule_id,
-                    conditions: rule.conditions,
-                }
-                .into(),
-            );
-        }
-        NewPushRule::Sender(rule) => {
-            global.sender.replace(
-                SimplePushRuleInit {
-                    actions: rule.actions,
-                    default: false,
-                    enabled: true,
-                    rule_id: rule.rule_id,
-                }
-                .into(),
-            );
-        }
-        NewPushRule::Room(rule) => {
-            global.room.replace(
-                SimplePushRuleInit {
-                    actions: rule.actions,
-                    default: false,
-                    enabled: true,
-                    rule_id: rule.rule_id,
-                }
-                .into(),
-            );
-        }
-        NewPushRule::Content(rule) => {
-            global.content.replace(
-                PatternedPushRuleInit {
-                    actions: rule.actions,
-                    default: false,
-                    enabled: true,
-                    rule_id: rule.rule_id,
-                    pattern: rule.pattern,
-                }
-                .into(),
-            );
-        }
+    if let Err(error) = account_data.content.global.insert(
+        body.rule.clone(),
+        body.after.as_deref(),
+        body.before.as_deref(),
+    ) {
+        let err = match error {
+            InsertPushRuleError::ServerDefaultRuleId => Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Rule IDs starting with a dot are reserved for server-default rules.",
+            ),
+            InsertPushRuleError::InvalidRuleId => Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Rule ID containing invalid characters.",
+            ),
+            InsertPushRuleError::RelativeToServerDefaultRule => Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Can't place a push rule relatively to a server-default rule.",
+            ),
+            InsertPushRuleError::UnknownRuleId => Error::BadRequest(
+                ErrorKind::NotFound,
+                "The before or after rule could not be found.",
+            ),
+            InsertPushRuleError::BeforeHigherThanAfter => Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "The before rule has a higher priority than the after rule.",
+            ),
+            _ => Error::BadRequest(ErrorKind::InvalidParam, "Invalid data."),
+        };
+
+        return Err(err);
     }
 
     services().account_data.update(
@@ -235,33 +185,15 @@ pub async fn get_pushrule_actions_route(
         .content;
 
     let global = account_data.global;
-    let actions = match body.kind {
-        RuleKind::Override => global
-            .override_
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.actions.clone()),
-        RuleKind::Underride => global
-            .underride
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.actions.clone()),
-        RuleKind::Sender => global
-            .sender
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.actions.clone()),
-        RuleKind::Room => global
-            .room
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.actions.clone()),
-        RuleKind::Content => global
-            .content
-            .get(body.rule_id.as_str())
-            .map(|rule| rule.actions.clone()),
-        _ => None,
-    };
+    let actions = global
+        .get(body.kind.clone(), &body.rule_id)
+        .map(|rule| rule.actions().to_owned())
+        .ok_or(Error::BadRequest(
+            ErrorKind::NotFound,
+            "Push rule not found.",
+        ))?;
 
-    Ok(get_pushrule_actions::v3::Response {
-        actions: actions.unwrap_or_default(),
-    })
+    Ok(get_pushrule_actions::v3::Response { actions })
 }
 
 /// # `PUT /_matrix/client/r0/pushrules/{scope}/{kind}/{ruleId}/actions`
@@ -294,40 +226,17 @@ pub async fn set_pushrule_actions_route(
     let mut account_data = serde_json::from_str::<PushRulesEvent>(event.get())
         .map_err(|_| Error::bad_database("Invalid account data event in db."))?;
 
-    let global = &mut account_data.content.global;
-    match body.kind {
-        RuleKind::Override => {
-            if let Some(mut rule) = global.override_.get(body.rule_id.as_str()).cloned() {
-                rule.actions = body.actions.clone();
-                global.override_.replace(rule);
-            }
-        }
-        RuleKind::Underride => {
-            if let Some(mut rule) = global.underride.get(body.rule_id.as_str()).cloned() {
-                rule.actions = body.actions.clone();
-                global.underride.replace(rule);
-            }
-        }
-        RuleKind::Sender => {
-            if let Some(mut rule) = global.sender.get(body.rule_id.as_str()).cloned() {
-                rule.actions = body.actions.clone();
-                global.sender.replace(rule);
-            }
-        }
-        RuleKind::Room => {
-            if let Some(mut rule) = global.room.get(body.rule_id.as_str()).cloned() {
-                rule.actions = body.actions.clone();
-                global.room.replace(rule);
-            }
-        }
-        RuleKind::Content => {
-            if let Some(mut rule) = global.content.get(body.rule_id.as_str()).cloned() {
-                rule.actions = body.actions.clone();
-                global.content.replace(rule);
-            }
-        }
-        _ => {}
-    };
+    if account_data
+        .content
+        .global
+        .set_actions(body.kind.clone(), &body.rule_id, body.actions.clone())
+        .is_err()
+    {
+        return Err(Error::BadRequest(
+            ErrorKind::NotFound,
+            "Push rule not found.",
+        ));
+    }
 
     services().account_data.update(
         None,
@@ -370,34 +279,13 @@ pub async fn get_pushrule_enabled_route(
         .map_err(|_| Error::bad_database("Invalid account data event in db."))?;
 
     let global = account_data.content.global;
-    let enabled = match body.kind {
-        RuleKind::Override => global
-            .override_
-            .iter()
-            .find(|rule| rule.rule_id == body.rule_id)
-            .map_or(false, |rule| rule.enabled),
-        RuleKind::Underride => global
-            .underride
-            .iter()
-            .find(|rule| rule.rule_id == body.rule_id)
-            .map_or(false, |rule| rule.enabled),
-        RuleKind::Sender => global
-            .sender
-            .iter()
-            .find(|rule| rule.rule_id == body.rule_id)
-            .map_or(false, |rule| rule.enabled),
-        RuleKind::Room => global
-            .room
-            .iter()
-            .find(|rule| rule.rule_id == body.rule_id)
-            .map_or(false, |rule| rule.enabled),
-        RuleKind::Content => global
-            .content
-            .iter()
-            .find(|rule| rule.rule_id == body.rule_id)
-            .map_or(false, |rule| rule.enabled),
-        _ => false,
-    };
+    let enabled = global
+        .get(body.kind.clone(), &body.rule_id)
+        .map(|r| r.enabled())
+        .ok_or(Error::BadRequest(
+            ErrorKind::NotFound,
+            "Push rule not found.",
+        ))?;
 
     Ok(get_pushrule_enabled::v3::Response { enabled })
 }
@@ -432,44 +320,16 @@ pub async fn set_pushrule_enabled_route(
     let mut account_data = serde_json::from_str::<PushRulesEvent>(event.get())
         .map_err(|_| Error::bad_database("Invalid account data event in db."))?;
 
-    let global = &mut account_data.content.global;
-    match body.kind {
-        RuleKind::Override => {
-            if let Some(mut rule) = global.override_.get(body.rule_id.as_str()).cloned() {
-                global.override_.remove(&rule);
-                rule.enabled = body.enabled;
-                global.override_.insert(rule);
-            }
-        }
-        RuleKind::Underride => {
-            if let Some(mut rule) = global.underride.get(body.rule_id.as_str()).cloned() {
-                global.underride.remove(&rule);
-                rule.enabled = body.enabled;
-                global.underride.insert(rule);
-            }
-        }
-        RuleKind::Sender => {
-            if let Some(mut rule) = global.sender.get(body.rule_id.as_str()).cloned() {
-                global.sender.remove(&rule);
-                rule.enabled = body.enabled;
-                global.sender.insert(rule);
-            }
-        }
-        RuleKind::Room => {
-            if let Some(mut rule) = global.room.get(body.rule_id.as_str()).cloned() {
-                global.room.remove(&rule);
-                rule.enabled = body.enabled;
-                global.room.insert(rule);
-            }
-        }
-        RuleKind::Content => {
-            if let Some(mut rule) = global.content.get(body.rule_id.as_str()).cloned() {
-                global.content.remove(&rule);
-                rule.enabled = body.enabled;
-                global.content.insert(rule);
-            }
-        }
-        _ => {}
+    if account_data
+        .content
+        .global
+        .set_enabled(body.kind.clone(), &body.rule_id, body.enabled)
+        .is_err()
+    {
+        return Err(Error::BadRequest(
+            ErrorKind::NotFound,
+            "Push rule not found.",
+        ));
     }
 
     services().account_data.update(
@@ -512,34 +372,23 @@ pub async fn delete_pushrule_route(
     let mut account_data = serde_json::from_str::<PushRulesEvent>(event.get())
         .map_err(|_| Error::bad_database("Invalid account data event in db."))?;
 
-    let global = &mut account_data.content.global;
-    match body.kind {
-        RuleKind::Override => {
-            if let Some(rule) = global.override_.get(body.rule_id.as_str()).cloned() {
-                global.override_.remove(&rule);
+    if let Err(error) = account_data
+        .content
+        .global
+        .remove(body.kind.clone(), &body.rule_id)
+    {
+        let err = match error {
+            RemovePushRuleError::ServerDefault => Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Cannot delete a server-default pushrule.",
+            ),
+            RemovePushRuleError::NotFound => {
+                Error::BadRequest(ErrorKind::NotFound, "Push rule not found.")
             }
-        }
-        RuleKind::Underride => {
-            if let Some(rule) = global.underride.get(body.rule_id.as_str()).cloned() {
-                global.underride.remove(&rule);
-            }
-        }
-        RuleKind::Sender => {
-            if let Some(rule) = global.sender.get(body.rule_id.as_str()).cloned() {
-                global.sender.remove(&rule);
-            }
-        }
-        RuleKind::Room => {
-            if let Some(rule) = global.room.get(body.rule_id.as_str()).cloned() {
-                global.room.remove(&rule);
-            }
-        }
-        RuleKind::Content => {
-            if let Some(rule) = global.content.get(body.rule_id.as_str()).cloned() {
-                global.content.remove(&rule);
-            }
-        }
-        _ => {}
+            _ => Error::BadRequest(ErrorKind::InvalidParam, "Invalid data."),
+        };
+
+        return Err(err);
     }
 
     services().account_data.update(
diff --git a/src/api/client_server/redact.rs b/src/api/client_server/redact.rs
index a29a5610..f0603f4b 100644
--- a/src/api/client_server/redact.rs
+++ b/src/api/client_server/redact.rs
@@ -3,7 +3,7 @@ use std::sync::Arc;
 use crate::{service::pdu::PduBuilder, services, Result, Ruma};
 use ruma::{
     api::client::redact::redact_event,
-    events::{room::redaction::RoomRedactionEventContent, RoomEventType},
+    events::{room::redaction::RoomRedactionEventContent, TimelineEventType},
 };
 
 use serde_json::value::to_raw_value;
@@ -24,27 +24,32 @@ pub async fn redact_event_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.clone())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
-    let event_id = services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomRedaction,
-            content: to_raw_value(&RoomRedactionEventContent {
-                reason: body.reason.clone(),
-            })
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: None,
-            redacts: Some(body.event_id.into()),
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    let event_id = services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomRedaction,
+                content: to_raw_value(&RoomRedactionEventContent {
+                    redacts: Some(body.event_id.clone()),
+                    reason: body.reason.clone(),
+                })
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: None,
+                redacts: Some(body.event_id.into()),
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     drop(state_lock);
 
diff --git a/src/api/client_server/relations.rs b/src/api/client_server/relations.rs
new file mode 100644
index 00000000..124f1310
--- /dev/null
+++ b/src/api/client_server/relations.rs
@@ -0,0 +1,146 @@
+use ruma::api::client::relations::{
+    get_relating_events, get_relating_events_with_rel_type,
+    get_relating_events_with_rel_type_and_event_type,
+};
+
+use crate::{service::rooms::timeline::PduCount, services, Result, Ruma};
+
+/// # `GET /_matrix/client/r0/rooms/{roomId}/relations/{eventId}/{relType}/{eventType}`
+pub async fn get_relating_events_with_rel_type_and_event_type_route(
+    body: Ruma<get_relating_events_with_rel_type_and_event_type::v1::Request>,
+) -> Result<get_relating_events_with_rel_type_and_event_type::v1::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let from = match body.from.clone() {
+        Some(from) => PduCount::try_from_string(&from)?,
+        None => match ruma::api::Direction::Backward {
+            // TODO: fix ruma so `body.dir` exists
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
+        },
+    };
+
+    let to = body
+        .to
+        .as_ref()
+        .and_then(|t| PduCount::try_from_string(t).ok());
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|u| u32::try_from(u).ok())
+        .map_or(10_usize, |u| u as usize)
+        .min(100);
+
+    let res = services()
+        .rooms
+        .pdu_metadata
+        .paginate_relations_with_filter(
+            sender_user,
+            &body.room_id,
+            &body.event_id,
+            Some(body.event_type.clone()),
+            Some(body.rel_type.clone()),
+            from,
+            to,
+            limit,
+        )?;
+
+    Ok(
+        get_relating_events_with_rel_type_and_event_type::v1::Response {
+            chunk: res.chunk,
+            next_batch: res.next_batch,
+            prev_batch: res.prev_batch,
+        },
+    )
+}
+
+/// # `GET /_matrix/client/r0/rooms/{roomId}/relations/{eventId}/{relType}`
+pub async fn get_relating_events_with_rel_type_route(
+    body: Ruma<get_relating_events_with_rel_type::v1::Request>,
+) -> Result<get_relating_events_with_rel_type::v1::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let from = match body.from.clone() {
+        Some(from) => PduCount::try_from_string(&from)?,
+        None => match ruma::api::Direction::Backward {
+            // TODO: fix ruma so `body.dir` exists
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
+        },
+    };
+
+    let to = body
+        .to
+        .as_ref()
+        .and_then(|t| PduCount::try_from_string(t).ok());
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|u| u32::try_from(u).ok())
+        .map_or(10_usize, |u| u as usize)
+        .min(100);
+
+    let res = services()
+        .rooms
+        .pdu_metadata
+        .paginate_relations_with_filter(
+            sender_user,
+            &body.room_id,
+            &body.event_id,
+            None,
+            Some(body.rel_type.clone()),
+            from,
+            to,
+            limit,
+        )?;
+
+    Ok(get_relating_events_with_rel_type::v1::Response {
+        chunk: res.chunk,
+        next_batch: res.next_batch,
+        prev_batch: res.prev_batch,
+    })
+}
+
+/// # `GET /_matrix/client/r0/rooms/{roomId}/relations/{eventId}`
+pub async fn get_relating_events_route(
+    body: Ruma<get_relating_events::v1::Request>,
+) -> Result<get_relating_events::v1::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let from = match body.from.clone() {
+        Some(from) => PduCount::try_from_string(&from)?,
+        None => match ruma::api::Direction::Backward {
+            // TODO: fix ruma so `body.dir` exists
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
+        },
+    };
+
+    let to = body
+        .to
+        .as_ref()
+        .and_then(|t| PduCount::try_from_string(t).ok());
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|u| u32::try_from(u).ok())
+        .map_or(10_usize, |u| u as usize)
+        .min(100);
+
+    services()
+        .rooms
+        .pdu_metadata
+        .paginate_relations_with_filter(
+            sender_user,
+            &body.room_id,
+            &body.event_id,
+            None,
+            None,
+            from,
+            to,
+            limit,
+        )
+}
diff --git a/src/api/client_server/room.rs b/src/api/client_server/room.rs
index aa6fa5f1..5d4cbe8a 100644
--- a/src/api/client_server/room.rs
+++ b/src/api/client_server/room.rs
@@ -19,7 +19,7 @@ use ruma::{
             tombstone::RoomTombstoneEventContent,
             topic::RoomTopicEventContent,
         },
-        RoomEventType, StateEventType,
+        StateEventType, TimelineEventType,
     },
     int,
     serde::JsonObject,
@@ -61,7 +61,7 @@ pub async fn create_room_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(room_id.clone())
             .or_default(),
     );
@@ -142,8 +142,9 @@ pub async fn create_room_route(
             content
         }
         None => {
+            // TODO: Add correct value for v11
             let mut content = serde_json::from_str::<CanonicalJsonObject>(
-                to_raw_value(&RoomCreateEventContent::new(sender_user.clone()))
+                to_raw_value(&RoomCreateEventContent::new_v1(sender_user.clone()))
                     .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid creation content"))?
                     .get(),
             )
@@ -173,42 +174,50 @@ pub async fn create_room_route(
     }
 
     // 1. The room create event
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomCreate,
-            content: to_raw_value(&content).expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomCreate,
+                content: to_raw_value(&content).expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &room_id,
+            &state_lock,
+        )
+        .await?;
 
     // 2. Let the room creator join
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomMember,
-            content: to_raw_value(&RoomMemberEventContent {
-                membership: MembershipState::Join,
-                displayname: services().users.displayname(sender_user)?,
-                avatar_url: services().users.avatar_url(sender_user)?,
-                is_direct: Some(body.is_direct),
-                third_party_invite: None,
-                blurhash: services().users.blurhash(sender_user)?,
-                reason: None,
-                join_authorized_via_users_server: None,
-            })
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some(sender_user.to_string()),
-            redacts: None,
-        },
-        sender_user,
-        &room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&RoomMemberEventContent {
+                    membership: MembershipState::Join,
+                    displayname: services().users.displayname(sender_user)?,
+                    avatar_url: services().users.avatar_url(sender_user)?,
+                    is_direct: Some(body.is_direct),
+                    third_party_invite: None,
+                    blurhash: services().users.blurhash(sender_user)?,
+                    reason: None,
+                    join_authorized_via_users_server: None,
+                })
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(sender_user.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            &room_id,
+            &state_lock,
+        )
+        .await?;
 
     // 3. Power levels
 
@@ -245,30 +254,14 @@ pub async fn create_room_route(
         }
     }
 
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomPowerLevels,
-            content: to_raw_value(&power_levels_content)
-                .expect("to_raw_value always works on serde_json::Value"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &room_id,
-        &state_lock,
-    )?;
-
-    // 4. Canonical room alias
-    if let Some(room_alias_id) = &alias {
-        services().rooms.timeline.build_and_append_pdu(
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
             PduBuilder {
-                event_type: RoomEventType::RoomCanonicalAlias,
-                content: to_raw_value(&RoomCanonicalAliasEventContent {
-                    alias: Some(room_alias_id.to_owned()),
-                    alt_aliases: vec![],
-                })
-                .expect("We checked that alias earlier, it must be fine"),
+                event_type: TimelineEventType::RoomPowerLevels,
+                content: to_raw_value(&power_levels_content)
+                    .expect("to_raw_value always works on serde_json::Value"),
                 unsigned: None,
                 state_key: Some("".to_owned()),
                 redacts: None,
@@ -276,64 +269,100 @@ pub async fn create_room_route(
             sender_user,
             &room_id,
             &state_lock,
-        )?;
+        )
+        .await?;
+
+    // 4. Canonical room alias
+    if let Some(room_alias_id) = &alias {
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomCanonicalAlias,
+                    content: to_raw_value(&RoomCanonicalAliasEventContent {
+                        alias: Some(room_alias_id.to_owned()),
+                        alt_aliases: vec![],
+                    })
+                    .expect("We checked that alias earlier, it must be fine"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                sender_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
     }
 
     // 5. Events set by preset
 
     // 5.1 Join Rules
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomJoinRules,
-            content: to_raw_value(&RoomJoinRulesEventContent::new(match preset {
-                RoomPreset::PublicChat => JoinRule::Public,
-                // according to spec "invite" is the default
-                _ => JoinRule::Invite,
-            }))
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomJoinRules,
+                content: to_raw_value(&RoomJoinRulesEventContent::new(match preset {
+                    RoomPreset::PublicChat => JoinRule::Public,
+                    // according to spec "invite" is the default
+                    _ => JoinRule::Invite,
+                }))
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &room_id,
+            &state_lock,
+        )
+        .await?;
 
     // 5.2 History Visibility
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomHistoryVisibility,
-            content: to_raw_value(&RoomHistoryVisibilityEventContent::new(
-                HistoryVisibility::Shared,
-            ))
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomHistoryVisibility,
+                content: to_raw_value(&RoomHistoryVisibilityEventContent::new(
+                    HistoryVisibility::Shared,
+                ))
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &room_id,
+            &state_lock,
+        )
+        .await?;
 
     // 5.3 Guest Access
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomGuestAccess,
-            content: to_raw_value(&RoomGuestAccessEventContent::new(match preset {
-                RoomPreset::PublicChat => GuestAccess::Forbidden,
-                _ => GuestAccess::CanJoin,
-            }))
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &room_id,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomGuestAccess,
+                content: to_raw_value(&RoomGuestAccessEventContent::new(match preset {
+                    RoomPreset::PublicChat => GuestAccess::Forbidden,
+                    _ => GuestAccess::CanJoin,
+                }))
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &room_id,
+            &state_lock,
+        )
+        .await?;
 
     // 6. Events listed in initial_state
     for event in &body.initial_state {
@@ -346,53 +375,60 @@ pub async fn create_room_route(
         pdu_builder.state_key.get_or_insert_with(|| "".to_owned());
 
         // Silently skip encryption events if they are not allowed
-        if pdu_builder.event_type == RoomEventType::RoomEncryption
+        if pdu_builder.event_type == TimelineEventType::RoomEncryption
             && !services().globals.allow_encryption()
         {
             continue;
         }
 
-        services().rooms.timeline.build_and_append_pdu(
-            pdu_builder,
-            sender_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(pdu_builder, sender_user, &room_id, &state_lock)
+            .await?;
     }
 
     // 7. Events implied by name and topic
     if let Some(name) = &body.name {
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomName,
-                content: to_raw_value(&RoomNameEventContent::new(Some(name.clone())))
-                    .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            sender_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomName,
+                    content: to_raw_value(&RoomNameEventContent::new(name.clone()))
+                        .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                sender_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
     }
 
     if let Some(topic) = &body.topic {
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomTopic,
-                content: to_raw_value(&RoomTopicEventContent {
-                    topic: topic.clone(),
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            sender_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomTopic,
+                    content: to_raw_value(&RoomTopicEventContent {
+                        topic: topic.clone(),
+                    })
+                    .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                sender_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
     }
 
     // 8. Events implied by invite (and TODO: invite_3pid)
@@ -429,7 +465,10 @@ pub async fn get_room_event_route(
         .rooms
         .timeline
         .get_pdu(&body.event_id)?
-        .ok_or(Error::BadRequest(ErrorKind::NotFound, "Event not found."))?;
+        .ok_or_else(|| {
+            warn!("Event not found, event ID: {:?}", &body.event_id);
+            Error::BadRequest(ErrorKind::NotFound, "Event not found.")
+        })?;
 
     if !services().rooms.state_accessor.user_can_see_event(
         sender_user,
@@ -442,6 +481,9 @@ pub async fn get_room_event_route(
         ));
     }
 
+    let mut event = (*event).clone();
+    event.add_age()?;
+
     Ok(get_room_event::v3::Response {
         event: event.to_room_event(),
     })
@@ -516,7 +558,7 @@ pub async fn upgrade_room_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.clone())
             .or_default(),
     );
@@ -524,22 +566,26 @@ pub async fn upgrade_room_route(
 
     // Send a m.room.tombstone event to the old room to indicate that it is not intended to be used any further
     // Fail if the sender does not have the required permissions
-    let tombstone_event_id = services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomTombstone,
-            content: to_raw_value(&RoomTombstoneEventContent {
-                body: "This room has been replaced".to_owned(),
-                replacement_room: replacement_room.clone(),
-            })
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    let tombstone_event_id = services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomTombstone,
+                content: to_raw_value(&RoomTombstoneEventContent {
+                    body: "This room has been replaced".to_owned(),
+                    replacement_room: replacement_room.clone(),
+                })
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     // Change lock to replacement room
     drop(state_lock);
@@ -548,7 +594,7 @@ pub async fn upgrade_room_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(replacement_room.clone())
             .or_default(),
     );
@@ -606,43 +652,51 @@ pub async fn upgrade_room_route(
         ));
     }
 
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomCreate,
-            content: to_raw_value(&create_event_content)
-                .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &replacement_room,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomCreate,
+                content: to_raw_value(&create_event_content)
+                    .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &replacement_room,
+            &state_lock,
+        )
+        .await?;
 
     // Join the new room
-    services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomMember,
-            content: to_raw_value(&RoomMemberEventContent {
-                membership: MembershipState::Join,
-                displayname: services().users.displayname(sender_user)?,
-                avatar_url: services().users.avatar_url(sender_user)?,
-                is_direct: None,
-                third_party_invite: None,
-                blurhash: services().users.blurhash(sender_user)?,
-                reason: None,
-                join_authorized_via_users_server: None,
-            })
-            .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some(sender_user.to_string()),
-            redacts: None,
-        },
-        sender_user,
-        &replacement_room,
-        &state_lock,
-    )?;
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&RoomMemberEventContent {
+                    membership: MembershipState::Join,
+                    displayname: services().users.displayname(sender_user)?,
+                    avatar_url: services().users.avatar_url(sender_user)?,
+                    is_direct: None,
+                    third_party_invite: None,
+                    blurhash: services().users.blurhash(sender_user)?,
+                    reason: None,
+                    join_authorized_via_users_server: None,
+                })
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(sender_user.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            &replacement_room,
+            &state_lock,
+        )
+        .await?;
 
     // Recommended transferable state events list from the specs
     let transferable_state_events = vec![
@@ -669,18 +723,22 @@ pub async fn upgrade_room_route(
                 None => continue, // Skipping missing events.
             };
 
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: event_type.to_string().into(),
-                content: event_content,
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            sender_user,
-            &replacement_room,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: event_type.to_string().into(),
+                    content: event_content,
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                sender_user,
+                &replacement_room,
+                &state_lock,
+            )
+            .await?;
     }
 
     // Moves any local aliases to the new room
@@ -714,19 +772,23 @@ pub async fn upgrade_room_route(
     power_levels_event_content.invite = new_level;
 
     // Modify the power levels in the old room to prevent sending of events and inviting new users
-    let _ = services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: RoomEventType::RoomPowerLevels,
-            content: to_raw_value(&power_levels_event_content)
-                .expect("event is valid, we just created it"),
-            unsigned: None,
-            state_key: Some("".to_owned()),
-            redacts: None,
-        },
-        sender_user,
-        &body.room_id,
-        &state_lock,
-    )?;
+    let _ = services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomPowerLevels,
+                content: to_raw_value(&power_levels_event_content)
+                    .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some("".to_owned()),
+                redacts: None,
+            },
+            sender_user,
+            &body.room_id,
+            &state_lock,
+        )
+        .await?;
 
     drop(state_lock);
 
diff --git a/src/api/client_server/search.rs b/src/api/client_server/search.rs
index fe69e7c7..e9fac365 100644
--- a/src/api/client_server/search.rs
+++ b/src/api/client_server/search.rs
@@ -31,7 +31,8 @@ pub async fn search_events_route(
             .collect()
     });
 
-    let limit = filter.limit.map_or(10, |l| u64::from(l) as usize);
+    // Use limit or else 10, with maximum 100
+    let limit = filter.limit.map_or(10, u64::from).min(100) as usize;
 
     let mut searches = Vec::new();
 
diff --git a/src/api/client_server/session.rs b/src/api/client_server/session.rs
index 64c00720..54069c03 100644
--- a/src/api/client_server/session.rs
+++ b/src/api/client_server/session.rs
@@ -9,7 +9,7 @@ use ruma::{
     UserId,
 };
 use serde::Deserialize;
-use tracing::info;
+use tracing::{info, warn};
 
 #[derive(Debug, Deserialize)]
 struct Claims {
@@ -26,6 +26,7 @@ pub async fn get_login_types_route(
 ) -> Result<get_login_types::v3::Response> {
     Ok(get_login_types::v3::Response::new(vec![
         get_login_types::v3::LoginType::Password(Default::default()),
+        get_login_types::v3::LoginType::ApplicationService(Default::default()),
     ]))
 }
 
@@ -41,23 +42,31 @@ pub async fn get_login_types_route(
 /// Note: You can use [`GET /_matrix/client/r0/login`](fn.get_supported_versions_route.html) to see
 /// supported login types.
 pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Response> {
+    // To allow deprecated login methods
+    #![allow(deprecated)]
     // Validate login method
     // TODO: Other login methods
     let user_id = match &body.login_info {
         login::v3::LoginInfo::Password(login::v3::Password {
             identifier,
             password,
+            user,
+            address: _,
+            medium: _,
         }) => {
-            let username = if let UserIdentifier::UserIdOrLocalpart(user_id) = identifier {
-                user_id.to_lowercase()
+            let user_id = if let Some(UserIdentifier::UserIdOrLocalpart(user_id)) = identifier {
+                UserId::parse_with_server_name(
+                    user_id.to_lowercase(),
+                    services().globals.server_name(),
+                )
+            } else if let Some(user) = user {
+                UserId::parse(user)
             } else {
+                warn!("Bad login type: {:?}", &body.login_info);
                 return Err(Error::BadRequest(ErrorKind::Forbidden, "Bad login type."));
-            };
-            let user_id =
-                UserId::parse_with_server_name(username, services().globals.server_name())
-                    .map_err(|_| {
-                        Error::BadRequest(ErrorKind::InvalidUsername, "Username is invalid.")
-                    })?;
+            }
+            .map_err(|_| Error::BadRequest(ErrorKind::InvalidUsername, "Username is invalid."))?;
+
             let hash = services()
                 .users
                 .password_hash(&user_id)?
@@ -103,7 +112,31 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re
                 ));
             }
         }
+        login::v3::LoginInfo::ApplicationService(login::v3::ApplicationService {
+            identifier,
+            user,
+        }) => {
+            if !body.from_appservice {
+                return Err(Error::BadRequest(
+                    ErrorKind::MissingToken,
+                    "Missing appservice token.",
+                ));
+            };
+            if let Some(UserIdentifier::UserIdOrLocalpart(user_id)) = identifier {
+                UserId::parse_with_server_name(
+                    user_id.to_lowercase(),
+                    services().globals.server_name(),
+                )
+            } else if let Some(user) = user {
+                UserId::parse(user)
+            } else {
+                warn!("Bad login type: {:?}", &body.login_info);
+                return Err(Error::BadRequest(ErrorKind::Forbidden, "Bad login type."));
+            }
+            .map_err(|_| Error::BadRequest(ErrorKind::InvalidUsername, "Username is invalid."))?
+        }
         _ => {
+            warn!("Unsupported or unknown login type: {:?}", &body.login_info);
             return Err(Error::BadRequest(
                 ErrorKind::Unknown,
                 "Unsupported login type.",
@@ -141,6 +174,8 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re
 
     info!("{} logged in", user_id);
 
+    // Homeservers are still required to send the `home_server` field
+    #[allow(deprecated)]
     Ok(login::v3::Response {
         user_id,
         access_token: token,
diff --git a/src/api/client_server/space.rs b/src/api/client_server/space.rs
new file mode 100644
index 00000000..e2ea8c34
--- /dev/null
+++ b/src/api/client_server/space.rs
@@ -0,0 +1,34 @@
+use crate::{services, Result, Ruma};
+use ruma::api::client::space::get_hierarchy;
+
+/// # `GET /_matrix/client/v1/rooms/{room_id}/hierarchy``
+///
+/// Paginates over the space tree in a depth-first manner to locate child rooms of a given space.
+pub async fn get_hierarchy_route(
+    body: Ruma<get_hierarchy::v1::Request>,
+) -> Result<get_hierarchy::v1::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    let skip = body
+        .from
+        .as_ref()
+        .and_then(|s| s.parse::<usize>().ok())
+        .unwrap_or(0);
+
+    let limit = body.limit.map_or(10, u64::from).min(100) as usize;
+
+    let max_depth = body.max_depth.map_or(3, u64::from).min(10) as usize + 1; // +1 to skip the space room itself
+
+    services()
+        .rooms
+        .spaces
+        .get_hierarchy(
+            sender_user,
+            &body.room_id,
+            limit,
+            skip,
+            max_depth,
+            body.suggested_only,
+        )
+        .await
+}
diff --git a/src/api/client_server/state.rs b/src/api/client_server/state.rs
index 8e4ceaf9..e62aa013 100644
--- a/src/api/client_server/state.rs
+++ b/src/api/client_server/state.rs
@@ -12,6 +12,7 @@ use ruma::{
     serde::Raw,
     EventId, RoomId, UserId,
 };
+use tracing::log::warn;
 
 /// # `PUT /_matrix/client/r0/rooms/{roomId}/state/{eventType}/{stateKey}`
 ///
@@ -84,7 +85,7 @@ pub async fn get_state_events_route(
     if !services()
         .rooms
         .state_accessor
-        .user_can_see_state_events(&sender_user, &body.room_id)?
+        .user_can_see_state_events(sender_user, &body.room_id)?
     {
         return Err(Error::BadRequest(
             ErrorKind::Forbidden,
@@ -117,7 +118,7 @@ pub async fn get_state_events_for_key_route(
     if !services()
         .rooms
         .state_accessor
-        .user_can_see_state_events(&sender_user, &body.room_id)?
+        .user_can_see_state_events(sender_user, &body.room_id)?
     {
         return Err(Error::BadRequest(
             ErrorKind::Forbidden,
@@ -129,10 +130,13 @@ pub async fn get_state_events_for_key_route(
         .rooms
         .state_accessor
         .room_state_get(&body.room_id, &body.event_type, &body.state_key)?
-        .ok_or(Error::BadRequest(
-            ErrorKind::NotFound,
-            "State event not found.",
-        ))?;
+        .ok_or_else(|| {
+            warn!(
+                "State event {:?} not found in room {:?}",
+                &body.event_type, &body.room_id
+            );
+            Error::BadRequest(ErrorKind::NotFound, "State event not found.")
+        })?;
 
     Ok(get_state_events_for_key::v3::Response {
         content: serde_json::from_str(event.content.get())
@@ -153,7 +157,7 @@ pub async fn get_state_events_for_empty_key_route(
     if !services()
         .rooms
         .state_accessor
-        .user_can_see_state_events(&sender_user, &body.room_id)?
+        .user_can_see_state_events(sender_user, &body.room_id)?
     {
         return Err(Error::BadRequest(
             ErrorKind::Forbidden,
@@ -165,10 +169,13 @@ pub async fn get_state_events_for_empty_key_route(
         .rooms
         .state_accessor
         .room_state_get(&body.room_id, &body.event_type, "")?
-        .ok_or(Error::BadRequest(
-            ErrorKind::NotFound,
-            "State event not found.",
-        ))?;
+        .ok_or_else(|| {
+            warn!(
+                "State event {:?} not found in room {:?}",
+                &body.event_type, &body.room_id
+            );
+            Error::BadRequest(ErrorKind::NotFound, "State event not found.")
+        })?;
 
     Ok(get_state_events_for_key::v3::Response {
         content: serde_json::from_str(event.content.get())
@@ -220,24 +227,28 @@ async fn send_state_event_for_key_helper(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(room_id.to_owned())
             .or_default(),
     );
     let state_lock = mutex_state.lock().await;
 
-    let event_id = services().rooms.timeline.build_and_append_pdu(
-        PduBuilder {
-            event_type: event_type.to_string().into(),
-            content: serde_json::from_str(json.json().get()).expect("content is valid json"),
-            unsigned: None,
-            state_key: Some(state_key),
-            redacts: None,
-        },
-        sender_user,
-        room_id,
-        &state_lock,
-    )?;
+    let event_id = services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: event_type.to_string().into(),
+                content: serde_json::from_str(json.json().get()).expect("content is valid json"),
+                unsigned: None,
+                state_key: Some(state_key),
+                redacts: None,
+            },
+            sender_user,
+            room_id,
+            &state_lock,
+        )
+        .await?;
 
     Ok(event_id)
 }
diff --git a/src/api/client_server/sync.rs b/src/api/client_server/sync.rs
index 5eb820cc..da603dcf 100644
--- a/src/api/client_server/sync.rs
+++ b/src/api/client_server/sync.rs
@@ -1,4 +1,7 @@
-use crate::{service::rooms::timeline::PduCount, services, Error, Result, Ruma, RumaResponse};
+use crate::{
+    service::rooms::timeline::PduCount, services, Error, PduEvent, Result, Ruma, RumaResponse,
+};
+
 use ruma::{
     api::client::{
         filter::{FilterDefinition, LazyLoadOptions},
@@ -8,24 +11,25 @@ use ruma::{
                 Ephemeral, Filter, GlobalAccountData, InviteState, InvitedRoom, JoinedRoom,
                 LeftRoom, Presence, RoomAccountData, RoomSummary, Rooms, State, Timeline, ToDevice,
             },
+            v4::SlidingOp,
             DeviceLists, UnreadNotificationsCount,
         },
         uiaa::UiaaResponse,
     },
     events::{
         room::member::{MembershipState, RoomMemberEventContent},
-        RoomEventType, StateEventType,
+        StateEventType, TimelineEventType,
     },
     serde::Raw,
-    DeviceId, OwnedDeviceId, OwnedUserId, RoomId, UserId,
+    uint, DeviceId, JsOption, OwnedDeviceId, OwnedUserId, RoomId, UInt, UserId,
 };
 use std::{
-    collections::{hash_map::Entry, BTreeMap, HashMap, HashSet},
+    collections::{hash_map::Entry, BTreeMap, BTreeSet, HashMap, HashSet},
     sync::Arc,
     time::Duration,
 };
 use tokio::sync::watch::Sender;
-use tracing::error;
+use tracing::{error, info};
 
 /// # `GET /_matrix/client/r0/sync`
 ///
@@ -72,7 +76,7 @@ pub async fn sync_events_route(
         .globals
         .sync_receivers
         .write()
-        .unwrap()
+        .await
         .entry((sender_user.clone(), sender_device.clone()))
     {
         Entry::Vacant(v) => {
@@ -95,6 +99,8 @@ pub async fn sync_events_route(
 
                 o.insert((body.since.clone(), rx.clone()));
 
+                info!("Sync started for {sender_user}");
+
                 tokio::spawn(sync_helper_wrapper(
                     sender_user.clone(),
                     sender_device.clone(),
@@ -144,7 +150,7 @@ async fn sync_helper_wrapper(
                 .globals
                 .sync_receivers
                 .write()
-                .unwrap()
+                .await
                 .entry((sender_user, sender_device))
             {
                 Entry::Occupied(o) => {
@@ -199,7 +205,7 @@ async fn sync_helper(
     let mut joined_rooms = BTreeMap::new();
     let since = body
         .since
-        .clone()
+        .as_ref()
         .and_then(|string| string.parse().ok())
         .unwrap_or(0);
     let sincecount = PduCount::Normal(since);
@@ -299,11 +305,11 @@ async fn sync_helper(
                     .globals
                     .roomid_mutex_insert
                     .write()
-                    .unwrap()
+                    .await
                     .entry(room_id.clone())
                     .or_default(),
             );
-            let insert_lock = mutex_insert.lock().unwrap();
+            let insert_lock = mutex_insert.lock().await;
             drop(insert_lock);
         }
 
@@ -431,11 +437,11 @@ async fn sync_helper(
                     .globals
                     .roomid_mutex_insert
                     .write()
-                    .unwrap()
+                    .await
                     .entry(room_id.clone())
                     .or_default(),
             );
-            let insert_lock = mutex_insert.lock().unwrap();
+            let insert_lock = mutex_insert.lock().await;
             drop(insert_lock);
         }
 
@@ -460,7 +466,7 @@ async fn sync_helper(
     }
 
     for user_id in left_encrypted_users {
-        let still_share_encrypted_room = services()
+        let dont_share_encrypted_room = services()
             .rooms
             .user
             .get_shared_rooms(vec![sender_user.clone(), user_id.clone()])?
@@ -478,7 +484,7 @@ async fn sync_helper(
             .all(|encrypted| !encrypted);
         // If the user doesn't share an encrypted room with the target anymore, we need to tell
         // them
-        if still_share_encrypted_room {
+        if dont_share_encrypted_room {
             device_list_left.insert(user_id);
         }
     }
@@ -551,6 +557,7 @@ async fn sync_helper(
     }
 }
 
+#[allow(clippy::too_many_arguments)]
 async fn load_joined_room(
     sender_user: &UserId,
     sender_device: &DeviceId,
@@ -573,57 +580,21 @@ async fn load_joined_room(
                 .globals
                 .roomid_mutex_insert
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.to_owned())
                 .or_default(),
         );
-        let insert_lock = mutex_insert.lock().unwrap();
+        let insert_lock = mutex_insert.lock().await;
         drop(insert_lock);
     }
 
-    let timeline_pdus;
-    let limited;
-    if services()
-        .rooms
-        .timeline
-        .last_timeline_count(&sender_user, &room_id)?
-        > sincecount
-    {
-        let mut non_timeline_pdus = services()
-            .rooms
-            .timeline
-            .pdus_until(&sender_user, &room_id, PduCount::max())?
-            .filter_map(|r| {
-                // Filter out buggy events
-                if r.is_err() {
-                    error!("Bad pdu in pdus_since: {:?}", r);
-                }
-                r.ok()
-            })
-            .take_while(|(pducount, _)| pducount > &sincecount);
-
-        // Take the last 10 events for the timeline
-        timeline_pdus = non_timeline_pdus
-            .by_ref()
-            .take(10)
-            .collect::<Vec<_>>()
-            .into_iter()
-            .rev()
-            .collect::<Vec<_>>();
-
-        // They /sync response doesn't always return all messages, so we say the output is
-        // limited unless there are events in non_timeline_pdus
-        limited = non_timeline_pdus.next().is_some();
-    } else {
-        timeline_pdus = Vec::new();
-        limited = false;
-    }
+    let (timeline_pdus, limited) = load_timeline(sender_user, room_id, sincecount, 10)?;
 
     let send_notification_counts = !timeline_pdus.is_empty()
         || services()
             .rooms
             .user
-            .last_notification_read(&sender_user, &room_id)?
+            .last_notification_read(sender_user, room_id)?
             > since;
 
     let mut timeline_users = HashSet::new();
@@ -631,17 +602,16 @@ async fn load_joined_room(
         timeline_users.insert(event.sender.as_str().to_owned());
     }
 
-    services().rooms.lazy_loading.lazy_load_confirm_delivery(
-        &sender_user,
-        &sender_device,
-        &room_id,
-        sincecount,
-    )?;
+    services()
+        .rooms
+        .lazy_loading
+        .lazy_load_confirm_delivery(sender_user, sender_device, room_id, sincecount)
+        .await?;
 
     // Database queries:
 
     let current_shortstatehash =
-        if let Some(s) = services().rooms.state.get_room_shortstatehash(&room_id)? {
+        if let Some(s) = services().rooms.state.get_room_shortstatehash(room_id)? {
             s
         } else {
             error!("Room {} has no state", room_id);
@@ -651,215 +621,154 @@ async fn load_joined_room(
     let since_shortstatehash = services()
         .rooms
         .user
-        .get_token_shortstatehash(&room_id, since)?;
-
-    // Calculates joined_member_count, invited_member_count and heroes
-    let calculate_counts = || {
-        let joined_member_count = services()
-            .rooms
-            .state_cache
-            .room_joined_count(&room_id)?
-            .unwrap_or(0);
-        let invited_member_count = services()
-            .rooms
-            .state_cache
-            .room_invited_count(&room_id)?
-            .unwrap_or(0);
-
-        // Recalculate heroes (first 5 members)
-        let mut heroes = Vec::new();
-
-        if joined_member_count + invited_member_count <= 5 {
-            // Go through all PDUs and for each member event, check if the user is still joined or
-            // invited until we have 5 or we reach the end
-
-            for hero in services()
-                .rooms
-                .timeline
-                .all_pdus(&sender_user, &room_id)?
-                .filter_map(|pdu| pdu.ok()) // Ignore all broken pdus
-                .filter(|(_, pdu)| pdu.kind == RoomEventType::RoomMember)
-                .map(|(_, pdu)| {
-                    let content: RoomMemberEventContent = serde_json::from_str(pdu.content.get())
-                        .map_err(|_| {
-                        Error::bad_database("Invalid member event in database.")
-                    })?;
-
-                    if let Some(state_key) = &pdu.state_key {
-                        let user_id = UserId::parse(state_key.clone())
-                            .map_err(|_| Error::bad_database("Invalid UserId in member PDU."))?;
-
-                        // The membership was and still is invite or join
-                        if matches!(
-                            content.membership,
-                            MembershipState::Join | MembershipState::Invite
-                        ) && (services().rooms.state_cache.is_joined(&user_id, &room_id)?
-                            || services()
-                                .rooms
-                                .state_cache
-                                .is_invited(&user_id, &room_id)?)
-                        {
-                            Ok::<_, Error>(Some(state_key.clone()))
-                        } else {
-                            Ok(None)
-                        }
-                    } else {
-                        Ok(None)
-                    }
-                })
-                // Filter out buggy users
-                .filter_map(|u| u.ok())
-                // Filter for possible heroes
-                .flatten()
-            {
-                if heroes.contains(&hero) || hero == sender_user.as_str() {
-                    continue;
-                }
-
-                heroes.push(hero);
-            }
-        }
-
-        Ok::<_, Error>((
-            Some(joined_member_count),
-            Some(invited_member_count),
-            heroes,
-        ))
-    };
-
-    let since_sender_member: Option<RoomMemberEventContent> = since_shortstatehash
-        .and_then(|shortstatehash| {
-            services()
-                .rooms
-                .state_accessor
-                .state_get(
-                    shortstatehash,
-                    &StateEventType::RoomMember,
-                    sender_user.as_str(),
-                )
-                .transpose()
-        })
-        .transpose()?
-        .and_then(|pdu| {
-            serde_json::from_str(pdu.content.get())
-                .map_err(|_| Error::bad_database("Invalid PDU in database."))
-                .ok()
-        });
-
-    let joined_since_last_sync =
-        since_sender_member.map_or(true, |member| member.membership != MembershipState::Join);
+        .get_token_shortstatehash(room_id, since)?;
 
     let (heroes, joined_member_count, invited_member_count, joined_since_last_sync, state_events) =
-        if since_shortstatehash.is_none() || joined_since_last_sync {
-            // Probably since = 0, we will do an initial sync
-
-            let (joined_member_count, invited_member_count, heroes) = calculate_counts()?;
-
-            let current_state_ids = services()
-                .rooms
-                .state_accessor
-                .state_full_ids(current_shortstatehash)
-                .await?;
-
-            let mut state_events = Vec::new();
-            let mut lazy_loaded = HashSet::new();
-
-            let mut i = 0;
-            for (shortstatekey, id) in current_state_ids {
-                let (event_type, state_key) = services()
-                    .rooms
-                    .short
-                    .get_statekey_from_short(shortstatekey)?;
-
-                if event_type != StateEventType::RoomMember {
-                    let pdu = match services().rooms.timeline.get_pdu(&id)? {
-                        Some(pdu) => pdu,
-                        None => {
-                            error!("Pdu in state not found: {}", id);
-                            continue;
-                        }
-                    };
-                    state_events.push(pdu);
-
-                    i += 1;
-                    if i % 100 == 0 {
-                        tokio::task::yield_now().await;
-                    }
-                } else if !lazy_load_enabled
-                || full_state
-                || timeline_users.contains(&state_key)
-                // TODO: Delete the following line when this is resolved: https://github.com/vector-im/element-web/issues/22565
-                || *sender_user == state_key
-                {
-                    let pdu = match services().rooms.timeline.get_pdu(&id)? {
-                        Some(pdu) => pdu,
-                        None => {
-                            error!("Pdu in state not found: {}", id);
-                            continue;
-                        }
-                    };
-
-                    // This check is in case a bad user ID made it into the database
-                    if let Ok(uid) = UserId::parse(&state_key) {
-                        lazy_loaded.insert(uid);
-                    }
-                    state_events.push(pdu);
-
-                    i += 1;
-                    if i % 100 == 0 {
-                        tokio::task::yield_now().await;
-                    }
-                }
-            }
-
-            // Reset lazy loading because this is an initial sync
-            services().rooms.lazy_loading.lazy_load_reset(
-                &sender_user,
-                &sender_device,
-                &room_id,
-            )?;
-
-            // The state_events above should contain all timeline_users, let's mark them as lazy
-            // loaded.
-            services().rooms.lazy_loading.lazy_load_mark_sent(
-                &sender_user,
-                &sender_device,
-                &room_id,
-                lazy_loaded,
-                next_batchcount,
-            );
-
-            (
-                heroes,
-                joined_member_count,
-                invited_member_count,
-                true,
-                state_events,
-            )
-        } else if timeline_pdus.is_empty() && since_shortstatehash == Some(current_shortstatehash) {
+        if timeline_pdus.is_empty() && since_shortstatehash == Some(current_shortstatehash) {
             // No state changes
             (Vec::new(), None, None, false, Vec::new())
         } else {
-            // Incremental /sync
-            let since_shortstatehash = since_shortstatehash.unwrap();
+            // Calculates joined_member_count, invited_member_count and heroes
+            let calculate_counts = || {
+                let joined_member_count = services()
+                    .rooms
+                    .state_cache
+                    .room_joined_count(room_id)?
+                    .unwrap_or(0);
+                let invited_member_count = services()
+                    .rooms
+                    .state_cache
+                    .room_invited_count(room_id)?
+                    .unwrap_or(0);
 
-            let mut state_events = Vec::new();
-            let mut lazy_loaded = HashSet::new();
+                // Recalculate heroes (first 5 members)
+                let mut heroes = Vec::new();
+
+                if joined_member_count + invited_member_count <= 5 {
+                    // Go through all PDUs and for each member event, check if the user is still joined or
+                    // invited until we have 5 or we reach the end
+
+                    for hero in services()
+                        .rooms
+                        .timeline
+                        .all_pdus(sender_user, room_id)?
+                        .filter_map(|pdu| pdu.ok()) // Ignore all broken pdus
+                        .filter(|(_, pdu)| pdu.kind == TimelineEventType::RoomMember)
+                        .map(|(_, pdu)| {
+                            let content: RoomMemberEventContent =
+                                serde_json::from_str(pdu.content.get()).map_err(|_| {
+                                    Error::bad_database("Invalid member event in database.")
+                                })?;
+
+                            if let Some(state_key) = &pdu.state_key {
+                                let user_id = UserId::parse(state_key.clone()).map_err(|_| {
+                                    Error::bad_database("Invalid UserId in member PDU.")
+                                })?;
+
+                                // The membership was and still is invite or join
+                                if matches!(
+                                    content.membership,
+                                    MembershipState::Join | MembershipState::Invite
+                                ) && (services()
+                                    .rooms
+                                    .state_cache
+                                    .is_joined(&user_id, room_id)?
+                                    || services()
+                                        .rooms
+                                        .state_cache
+                                        .is_invited(&user_id, room_id)?)
+                                {
+                                    Ok::<_, Error>(Some(state_key.clone()))
+                                } else {
+                                    Ok(None)
+                                }
+                            } else {
+                                Ok(None)
+                            }
+                        })
+                        // Filter out buggy users
+                        .filter_map(|u| u.ok())
+                        // Filter for possible heroes
+                        .flatten()
+                    {
+                        if heroes.contains(&hero) || hero == sender_user.as_str() {
+                            continue;
+                        }
+
+                        heroes.push(hero);
+                    }
+                }
+
+                Ok::<_, Error>((
+                    Some(joined_member_count),
+                    Some(invited_member_count),
+                    heroes,
+                ))
+            };
+
+            let since_sender_member: Option<RoomMemberEventContent> = since_shortstatehash
+                .and_then(|shortstatehash| {
+                    services()
+                        .rooms
+                        .state_accessor
+                        .state_get(
+                            shortstatehash,
+                            &StateEventType::RoomMember,
+                            sender_user.as_str(),
+                        )
+                        .transpose()
+                })
+                .transpose()?
+                .and_then(|pdu| {
+                    serde_json::from_str(pdu.content.get())
+                        .map_err(|_| Error::bad_database("Invalid PDU in database."))
+                        .ok()
+                });
+
+            let joined_since_last_sync = since_sender_member
+                .map_or(true, |member| member.membership != MembershipState::Join);
+
+            if since_shortstatehash.is_none() || joined_since_last_sync {
+                // Probably since = 0, we will do an initial sync
+
+                let (joined_member_count, invited_member_count, heroes) = calculate_counts()?;
 
-            if since_shortstatehash != current_shortstatehash {
                 let current_state_ids = services()
                     .rooms
                     .state_accessor
                     .state_full_ids(current_shortstatehash)
                     .await?;
-                let since_state_ids = services()
-                    .rooms
-                    .state_accessor
-                    .state_full_ids(since_shortstatehash)
-                    .await?;
 
-                for (key, id) in current_state_ids {
-                    if full_state || since_state_ids.get(&key) != Some(&id) {
+                let mut state_events = Vec::new();
+                let mut lazy_loaded = HashSet::new();
+
+                let mut i = 0;
+                for (shortstatekey, id) in current_state_ids {
+                    let (event_type, state_key) = services()
+                        .rooms
+                        .short
+                        .get_statekey_from_short(shortstatekey)?;
+
+                    if event_type != StateEventType::RoomMember {
+                        let pdu = match services().rooms.timeline.get_pdu(&id)? {
+                            Some(pdu) => pdu,
+                            None => {
+                                error!("Pdu in state not found: {}", id);
+                                continue;
+                            }
+                        };
+                        state_events.push(pdu);
+
+                        i += 1;
+                        if i % 100 == 0 {
+                            tokio::task::yield_now().await;
+                        }
+                    } else if !lazy_load_enabled
+                || full_state
+                || timeline_users.contains(&state_key)
+                // TODO: Delete the following line when this is resolved: https://github.com/vector-im/element-web/issues/22565
+                || *sender_user == state_key
+                    {
                         let pdu = match services().rooms.timeline.get_pdu(&id)? {
                             Some(pdu) => pdu,
                             None => {
@@ -868,145 +777,222 @@ async fn load_joined_room(
                             }
                         };
 
-                        if pdu.kind == RoomEventType::RoomMember {
-                            match UserId::parse(
-                                pdu.state_key
-                                    .as_ref()
-                                    .expect("State event has state key")
-                                    .clone(),
-                            ) {
-                                Ok(state_key_userid) => {
-                                    lazy_loaded.insert(state_key_userid);
-                                }
-                                Err(e) => error!("Invalid state key for member event: {}", e),
-                            }
+                        // This check is in case a bad user ID made it into the database
+                        if let Ok(uid) = UserId::parse(&state_key) {
+                            lazy_loaded.insert(uid);
                         }
-
                         state_events.push(pdu);
-                        tokio::task::yield_now().await;
+
+                        i += 1;
+                        if i % 100 == 0 {
+                            tokio::task::yield_now().await;
+                        }
                     }
                 }
-            }
 
-            for (_, event) in &timeline_pdus {
-                if lazy_loaded.contains(&event.sender) {
-                    continue;
-                }
+                // Reset lazy loading because this is an initial sync
+                services().rooms.lazy_loading.lazy_load_reset(
+                    sender_user,
+                    sender_device,
+                    room_id,
+                )?;
 
-                if !services().rooms.lazy_loading.lazy_load_was_sent_before(
-                    &sender_user,
-                    &sender_device,
-                    &room_id,
-                    &event.sender,
-                )? || lazy_load_send_redundant
-                {
-                    if let Some(member_event) = services().rooms.state_accessor.room_state_get(
-                        &room_id,
-                        &StateEventType::RoomMember,
-                        event.sender.as_str(),
-                    )? {
-                        lazy_loaded.insert(event.sender.clone());
-                        state_events.push(member_event);
+                // The state_events above should contain all timeline_users, let's mark them as lazy
+                // loaded.
+                services()
+                    .rooms
+                    .lazy_loading
+                    .lazy_load_mark_sent(
+                        sender_user,
+                        sender_device,
+                        room_id,
+                        lazy_loaded,
+                        next_batchcount,
+                    )
+                    .await;
+
+                (
+                    heroes,
+                    joined_member_count,
+                    invited_member_count,
+                    true,
+                    state_events,
+                )
+            } else {
+                // Incremental /sync
+                let since_shortstatehash = since_shortstatehash.unwrap();
+
+                let mut state_events = Vec::new();
+                let mut lazy_loaded = HashSet::new();
+
+                if since_shortstatehash != current_shortstatehash {
+                    let current_state_ids = services()
+                        .rooms
+                        .state_accessor
+                        .state_full_ids(current_shortstatehash)
+                        .await?;
+                    let since_state_ids = services()
+                        .rooms
+                        .state_accessor
+                        .state_full_ids(since_shortstatehash)
+                        .await?;
+
+                    for (key, id) in current_state_ids {
+                        if full_state || since_state_ids.get(&key) != Some(&id) {
+                            let pdu = match services().rooms.timeline.get_pdu(&id)? {
+                                Some(pdu) => pdu,
+                                None => {
+                                    error!("Pdu in state not found: {}", id);
+                                    continue;
+                                }
+                            };
+
+                            if pdu.kind == TimelineEventType::RoomMember {
+                                match UserId::parse(
+                                    pdu.state_key
+                                        .as_ref()
+                                        .expect("State event has state key")
+                                        .clone(),
+                                ) {
+                                    Ok(state_key_userid) => {
+                                        lazy_loaded.insert(state_key_userid);
+                                    }
+                                    Err(e) => error!("Invalid state key for member event: {}", e),
+                                }
+                            }
+
+                            state_events.push(pdu);
+                            tokio::task::yield_now().await;
+                        }
                     }
                 }
-            }
 
-            services().rooms.lazy_loading.lazy_load_mark_sent(
-                &sender_user,
-                &sender_device,
-                &room_id,
-                lazy_loaded,
-                next_batchcount,
-            );
-
-            let encrypted_room = services()
-                .rooms
-                .state_accessor
-                .state_get(current_shortstatehash, &StateEventType::RoomEncryption, "")?
-                .is_some();
-
-            let since_encryption = services().rooms.state_accessor.state_get(
-                since_shortstatehash,
-                &StateEventType::RoomEncryption,
-                "",
-            )?;
-
-            // Calculations:
-            let new_encrypted_room = encrypted_room && since_encryption.is_none();
-
-            let send_member_count = state_events
-                .iter()
-                .any(|event| event.kind == RoomEventType::RoomMember);
-
-            if encrypted_room {
-                for state_event in &state_events {
-                    if state_event.kind != RoomEventType::RoomMember {
+                for (_, event) in &timeline_pdus {
+                    if lazy_loaded.contains(&event.sender) {
                         continue;
                     }
 
-                    if let Some(state_key) = &state_event.state_key {
-                        let user_id = UserId::parse(state_key.clone())
-                            .map_err(|_| Error::bad_database("Invalid UserId in member PDU."))?;
-
-                        if user_id == sender_user {
-                            continue;
-                        }
-
-                        let new_membership = serde_json::from_str::<RoomMemberEventContent>(
-                            state_event.content.get(),
-                        )
-                        .map_err(|_| Error::bad_database("Invalid PDU in database."))?
-                        .membership;
-
-                        match new_membership {
-                            MembershipState::Join => {
-                                // A new user joined an encrypted room
-                                if !share_encrypted_room(&sender_user, &user_id, &room_id)? {
-                                    device_list_updates.insert(user_id);
-                                }
-                            }
-                            MembershipState::Leave => {
-                                // Write down users that have left encrypted rooms we are in
-                                left_encrypted_users.insert(user_id);
-                            }
-                            _ => {}
+                    if !services().rooms.lazy_loading.lazy_load_was_sent_before(
+                        sender_user,
+                        sender_device,
+                        room_id,
+                        &event.sender,
+                    )? || lazy_load_send_redundant
+                    {
+                        if let Some(member_event) = services().rooms.state_accessor.room_state_get(
+                            room_id,
+                            &StateEventType::RoomMember,
+                            event.sender.as_str(),
+                        )? {
+                            lazy_loaded.insert(event.sender.clone());
+                            state_events.push(member_event);
                         }
                     }
                 }
+
+                services()
+                    .rooms
+                    .lazy_loading
+                    .lazy_load_mark_sent(
+                        sender_user,
+                        sender_device,
+                        room_id,
+                        lazy_loaded,
+                        next_batchcount,
+                    )
+                    .await;
+
+                let encrypted_room = services()
+                    .rooms
+                    .state_accessor
+                    .state_get(current_shortstatehash, &StateEventType::RoomEncryption, "")?
+                    .is_some();
+
+                let since_encryption = services().rooms.state_accessor.state_get(
+                    since_shortstatehash,
+                    &StateEventType::RoomEncryption,
+                    "",
+                )?;
+
+                // Calculations:
+                let new_encrypted_room = encrypted_room && since_encryption.is_none();
+
+                let send_member_count = state_events
+                    .iter()
+                    .any(|event| event.kind == TimelineEventType::RoomMember);
+
+                if encrypted_room {
+                    for state_event in &state_events {
+                        if state_event.kind != TimelineEventType::RoomMember {
+                            continue;
+                        }
+
+                        if let Some(state_key) = &state_event.state_key {
+                            let user_id = UserId::parse(state_key.clone()).map_err(|_| {
+                                Error::bad_database("Invalid UserId in member PDU.")
+                            })?;
+
+                            if user_id == sender_user {
+                                continue;
+                            }
+
+                            let new_membership = serde_json::from_str::<RoomMemberEventContent>(
+                                state_event.content.get(),
+                            )
+                            .map_err(|_| Error::bad_database("Invalid PDU in database."))?
+                            .membership;
+
+                            match new_membership {
+                                MembershipState::Join => {
+                                    // A new user joined an encrypted room
+                                    if !share_encrypted_room(sender_user, &user_id, room_id)? {
+                                        device_list_updates.insert(user_id);
+                                    }
+                                }
+                                MembershipState::Leave => {
+                                    // Write down users that have left encrypted rooms we are in
+                                    left_encrypted_users.insert(user_id);
+                                }
+                                _ => {}
+                            }
+                        }
+                    }
+                }
+
+                if joined_since_last_sync && encrypted_room || new_encrypted_room {
+                    // If the user is in a new encrypted room, give them all joined users
+                    device_list_updates.extend(
+                        services()
+                            .rooms
+                            .state_cache
+                            .room_members(room_id)
+                            .flatten()
+                            .filter(|user_id| {
+                                // Don't send key updates from the sender to the sender
+                                sender_user != user_id
+                            })
+                            .filter(|user_id| {
+                                // Only send keys if the sender doesn't share an encrypted room with the target already
+                                !share_encrypted_room(sender_user, user_id, room_id)
+                                    .unwrap_or(false)
+                            }),
+                    );
+                }
+
+                let (joined_member_count, invited_member_count, heroes) = if send_member_count {
+                    calculate_counts()?
+                } else {
+                    (None, None, Vec::new())
+                };
+
+                (
+                    heroes,
+                    joined_member_count,
+                    invited_member_count,
+                    joined_since_last_sync,
+                    state_events,
+                )
             }
-
-            if joined_since_last_sync && encrypted_room || new_encrypted_room {
-                // If the user is in a new encrypted room, give them all joined users
-                device_list_updates.extend(
-                    services()
-                        .rooms
-                        .state_cache
-                        .room_members(&room_id)
-                        .flatten()
-                        .filter(|user_id| {
-                            // Don't send key updates from the sender to the sender
-                            &sender_user != user_id
-                        })
-                        .filter(|user_id| {
-                            // Only send keys if the sender doesn't share an encrypted room with the target already
-                            !share_encrypted_room(&sender_user, user_id, &room_id).unwrap_or(false)
-                        }),
-                );
-            }
-
-            let (joined_member_count, invited_member_count, heroes) = if send_member_count {
-                calculate_counts()?
-            } else {
-                (None, None, Vec::new())
-            };
-
-            (
-                heroes,
-                joined_member_count,
-                invited_member_count,
-                joined_since_last_sync,
-                state_events,
-            )
         };
 
     // Look for device list updates in this room
@@ -1022,7 +1008,7 @@ async fn load_joined_room(
             services()
                 .rooms
                 .user
-                .notification_count(&sender_user, &room_id)?
+                .notification_count(sender_user, room_id)?
                 .try_into()
                 .expect("notification count can't go that high"),
         )
@@ -1035,7 +1021,7 @@ async fn load_joined_room(
             services()
                 .rooms
                 .user
-                .highlight_count(&sender_user, &room_id)?
+                .highlight_count(sender_user, room_id)?
                 .try_into()
                 .expect("highlight count can't go that high"),
         )
@@ -1064,15 +1050,22 @@ async fn load_joined_room(
         .rooms
         .edus
         .read_receipt
-        .readreceipts_since(&room_id, since)
+        .readreceipts_since(room_id, since)
         .filter_map(|r| r.ok()) // Filter out buggy events
         .map(|(_, _, v)| v)
         .collect();
 
-    if services().rooms.edus.typing.last_typing_update(&room_id)? > since {
+    if services()
+        .rooms
+        .edus
+        .typing
+        .last_typing_update(room_id)
+        .await?
+        > since
+    {
         edus.push(
             serde_json::from_str(
-                &serde_json::to_string(&services().rooms.edus.typing.typings_all(&room_id)?)
+                &serde_json::to_string(&services().rooms.edus.typing.typings_all(room_id).await?)
                     .expect("event is valid, we just created it"),
             )
             .expect("event is valid, we just created it"),
@@ -1081,7 +1074,7 @@ async fn load_joined_room(
 
     // Save the state after this sync so we can send the correct state diff next sync
     services().rooms.user.associate_token_shortstatehash(
-        &room_id,
+        room_id,
         next_batch,
         current_shortstatehash,
     )?;
@@ -1090,7 +1083,7 @@ async fn load_joined_room(
         account_data: RoomAccountData {
             events: services()
                 .account_data
-                .changes_since(Some(&room_id), &sender_user, since)?
+                .changes_since(Some(room_id), sender_user, since)?
                 .into_iter()
                 .filter_map(|(_, v)| {
                     serde_json::from_str(v.json().get())
@@ -1124,6 +1117,52 @@ async fn load_joined_room(
     })
 }
 
+fn load_timeline(
+    sender_user: &UserId,
+    room_id: &RoomId,
+    roomsincecount: PduCount,
+    limit: u64,
+) -> Result<(Vec<(PduCount, PduEvent)>, bool), Error> {
+    let timeline_pdus;
+    let limited;
+    if services()
+        .rooms
+        .timeline
+        .last_timeline_count(sender_user, room_id)?
+        > roomsincecount
+    {
+        let mut non_timeline_pdus = services()
+            .rooms
+            .timeline
+            .pdus_until(sender_user, room_id, PduCount::max())?
+            .filter_map(|r| {
+                // Filter out buggy events
+                if r.is_err() {
+                    error!("Bad pdu in pdus_since: {:?}", r);
+                }
+                r.ok()
+            })
+            .take_while(|(pducount, _)| pducount > &roomsincecount);
+
+        // Take the last events for the timeline
+        timeline_pdus = non_timeline_pdus
+            .by_ref()
+            .take(limit as usize)
+            .collect::<Vec<_>>()
+            .into_iter()
+            .rev()
+            .collect::<Vec<_>>();
+
+        // They /sync response doesn't always return all messages, so we say the output is
+        // limited unless there are events in non_timeline_pdus
+        limited = non_timeline_pdus.next().is_some();
+    } else {
+        timeline_pdus = Vec::new();
+        limited = false;
+    }
+    Ok((timeline_pdus, limited))
+}
+
 fn share_encrypted_room(
     sender_user: &UserId,
     user_id: &UserId,
@@ -1147,3 +1186,578 @@ fn share_encrypted_room(
         })
         .any(|encrypted| encrypted))
 }
+
+pub async fn sync_events_v4_route(
+    body: Ruma<sync_events::v4::Request>,
+) -> Result<sync_events::v4::Response, RumaResponse<UiaaResponse>> {
+    let sender_user = body.sender_user.expect("user is authenticated");
+    let sender_device = body.sender_device.expect("user is authenticated");
+    let mut body = body.body;
+    // Setup watchers, so if there's no response, we can wait for them
+    let watcher = services().globals.watch(&sender_user, &sender_device);
+
+    let next_batch = services().globals.next_count()?;
+
+    let globalsince = body
+        .pos
+        .as_ref()
+        .and_then(|string| string.parse().ok())
+        .unwrap_or(0);
+
+    if globalsince == 0 {
+        if let Some(conn_id) = &body.conn_id {
+            services().users.forget_sync_request_connection(
+                sender_user.clone(),
+                sender_device.clone(),
+                conn_id.clone(),
+            )
+        }
+    }
+
+    // Get sticky parameters from cache
+    let known_rooms = services().users.update_sync_request_with_cache(
+        sender_user.clone(),
+        sender_device.clone(),
+        &mut body,
+    );
+
+    let all_joined_rooms = services()
+        .rooms
+        .state_cache
+        .rooms_joined(&sender_user)
+        .filter_map(|r| r.ok())
+        .collect::<Vec<_>>();
+
+    if body.extensions.to_device.enabled.unwrap_or(false) {
+        services()
+            .users
+            .remove_to_device_events(&sender_user, &sender_device, globalsince)?;
+    }
+
+    let mut left_encrypted_users = HashSet::new(); // Users that have left any encrypted rooms the sender was in
+    let mut device_list_changes = HashSet::new();
+    let mut device_list_left = HashSet::new();
+
+    if body.extensions.e2ee.enabled.unwrap_or(false) {
+        // Look for device list updates of this account
+        device_list_changes.extend(
+            services()
+                .users
+                .keys_changed(sender_user.as_ref(), globalsince, None)
+                .filter_map(|r| r.ok()),
+        );
+
+        for room_id in &all_joined_rooms {
+            let current_shortstatehash =
+                if let Some(s) = services().rooms.state.get_room_shortstatehash(room_id)? {
+                    s
+                } else {
+                    error!("Room {} has no state", room_id);
+                    continue;
+                };
+
+            let since_shortstatehash = services()
+                .rooms
+                .user
+                .get_token_shortstatehash(room_id, globalsince)?;
+
+            let since_sender_member: Option<RoomMemberEventContent> = since_shortstatehash
+                .and_then(|shortstatehash| {
+                    services()
+                        .rooms
+                        .state_accessor
+                        .state_get(
+                            shortstatehash,
+                            &StateEventType::RoomMember,
+                            sender_user.as_str(),
+                        )
+                        .transpose()
+                })
+                .transpose()?
+                .and_then(|pdu| {
+                    serde_json::from_str(pdu.content.get())
+                        .map_err(|_| Error::bad_database("Invalid PDU in database."))
+                        .ok()
+                });
+
+            let encrypted_room = services()
+                .rooms
+                .state_accessor
+                .state_get(current_shortstatehash, &StateEventType::RoomEncryption, "")?
+                .is_some();
+
+            if let Some(since_shortstatehash) = since_shortstatehash {
+                // Skip if there are only timeline changes
+                if since_shortstatehash == current_shortstatehash {
+                    continue;
+                }
+
+                let since_encryption = services().rooms.state_accessor.state_get(
+                    since_shortstatehash,
+                    &StateEventType::RoomEncryption,
+                    "",
+                )?;
+
+                let joined_since_last_sync = since_sender_member
+                    .map_or(true, |member| member.membership != MembershipState::Join);
+
+                let new_encrypted_room = encrypted_room && since_encryption.is_none();
+                if encrypted_room {
+                    let current_state_ids = services()
+                        .rooms
+                        .state_accessor
+                        .state_full_ids(current_shortstatehash)
+                        .await?;
+                    let since_state_ids = services()
+                        .rooms
+                        .state_accessor
+                        .state_full_ids(since_shortstatehash)
+                        .await?;
+
+                    for (key, id) in current_state_ids {
+                        if since_state_ids.get(&key) != Some(&id) {
+                            let pdu = match services().rooms.timeline.get_pdu(&id)? {
+                                Some(pdu) => pdu,
+                                None => {
+                                    error!("Pdu in state not found: {}", id);
+                                    continue;
+                                }
+                            };
+                            if pdu.kind == TimelineEventType::RoomMember {
+                                if let Some(state_key) = &pdu.state_key {
+                                    let user_id =
+                                        UserId::parse(state_key.clone()).map_err(|_| {
+                                            Error::bad_database("Invalid UserId in member PDU.")
+                                        })?;
+
+                                    if user_id == sender_user {
+                                        continue;
+                                    }
+
+                                    let new_membership = serde_json::from_str::<
+                                        RoomMemberEventContent,
+                                    >(
+                                        pdu.content.get()
+                                    )
+                                    .map_err(|_| Error::bad_database("Invalid PDU in database."))?
+                                    .membership;
+
+                                    match new_membership {
+                                        MembershipState::Join => {
+                                            // A new user joined an encrypted room
+                                            if !share_encrypted_room(
+                                                &sender_user,
+                                                &user_id,
+                                                room_id,
+                                            )? {
+                                                device_list_changes.insert(user_id);
+                                            }
+                                        }
+                                        MembershipState::Leave => {
+                                            // Write down users that have left encrypted rooms we are in
+                                            left_encrypted_users.insert(user_id);
+                                        }
+                                        _ => {}
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if joined_since_last_sync || new_encrypted_room {
+                        // If the user is in a new encrypted room, give them all joined users
+                        device_list_changes.extend(
+                            services()
+                                .rooms
+                                .state_cache
+                                .room_members(room_id)
+                                .flatten()
+                                .filter(|user_id| {
+                                    // Don't send key updates from the sender to the sender
+                                    &sender_user != user_id
+                                })
+                                .filter(|user_id| {
+                                    // Only send keys if the sender doesn't share an encrypted room with the target already
+                                    !share_encrypted_room(&sender_user, user_id, room_id)
+                                        .unwrap_or(false)
+                                }),
+                        );
+                    }
+                }
+            }
+            // Look for device list updates in this room
+            device_list_changes.extend(
+                services()
+                    .users
+                    .keys_changed(room_id.as_ref(), globalsince, None)
+                    .filter_map(|r| r.ok()),
+            );
+        }
+        for user_id in left_encrypted_users {
+            let dont_share_encrypted_room = services()
+                .rooms
+                .user
+                .get_shared_rooms(vec![sender_user.clone(), user_id.clone()])?
+                .filter_map(|r| r.ok())
+                .filter_map(|other_room_id| {
+                    Some(
+                        services()
+                            .rooms
+                            .state_accessor
+                            .room_state_get(&other_room_id, &StateEventType::RoomEncryption, "")
+                            .ok()?
+                            .is_some(),
+                    )
+                })
+                .all(|encrypted| !encrypted);
+            // If the user doesn't share an encrypted room with the target anymore, we need to tell
+            // them
+            if dont_share_encrypted_room {
+                device_list_left.insert(user_id);
+            }
+        }
+    }
+
+    let mut lists = BTreeMap::new();
+    let mut todo_rooms = BTreeMap::new(); // and required state
+
+    for (list_id, list) in body.lists {
+        if list.filters.and_then(|f| f.is_invite).unwrap_or(false) {
+            continue;
+        }
+
+        let mut new_known_rooms = BTreeSet::new();
+
+        lists.insert(
+            list_id.clone(),
+            sync_events::v4::SyncList {
+                ops: list
+                    .ranges
+                    .into_iter()
+                    .map(|mut r| {
+                        r.0 =
+                            r.0.clamp(uint!(0), UInt::from(all_joined_rooms.len() as u32 - 1));
+                        r.1 =
+                            r.1.clamp(r.0, UInt::from(all_joined_rooms.len() as u32 - 1));
+                        let room_ids = all_joined_rooms
+                            [(u64::from(r.0) as usize)..=(u64::from(r.1) as usize)]
+                            .to_vec();
+                        new_known_rooms.extend(room_ids.iter().cloned());
+                        for room_id in &room_ids {
+                            let todo_room = todo_rooms.entry(room_id.clone()).or_insert((
+                                BTreeSet::new(),
+                                0,
+                                u64::MAX,
+                            ));
+                            let limit = list
+                                .room_details
+                                .timeline_limit
+                                .map_or(10, u64::from)
+                                .min(100);
+                            todo_room
+                                .0
+                                .extend(list.room_details.required_state.iter().cloned());
+                            todo_room.1 = todo_room.1.max(limit);
+                            // 0 means unknown because it got out of date
+                            todo_room.2 = todo_room.2.min(
+                                known_rooms
+                                    .get(&list_id)
+                                    .and_then(|k| k.get(room_id))
+                                    .copied()
+                                    .unwrap_or(0),
+                            );
+                        }
+                        sync_events::v4::SyncOp {
+                            op: SlidingOp::Sync,
+                            range: Some(r),
+                            index: None,
+                            room_ids,
+                            room_id: None,
+                        }
+                    })
+                    .collect(),
+                count: UInt::from(all_joined_rooms.len() as u32),
+            },
+        );
+
+        if let Some(conn_id) = &body.conn_id {
+            services().users.update_sync_known_rooms(
+                sender_user.clone(),
+                sender_device.clone(),
+                conn_id.clone(),
+                list_id,
+                new_known_rooms,
+                globalsince,
+            );
+        }
+    }
+
+    let mut known_subscription_rooms = BTreeSet::new();
+    for (room_id, room) in &body.room_subscriptions {
+        if !services().rooms.metadata.exists(room_id)? {
+            continue;
+        }
+        let todo_room = todo_rooms
+            .entry(room_id.clone())
+            .or_insert((BTreeSet::new(), 0, u64::MAX));
+        let limit = room.timeline_limit.map_or(10, u64::from).min(100);
+        todo_room.0.extend(room.required_state.iter().cloned());
+        todo_room.1 = todo_room.1.max(limit);
+        // 0 means unknown because it got out of date
+        todo_room.2 = todo_room.2.min(
+            known_rooms
+                .get("subscriptions")
+                .and_then(|k| k.get(room_id))
+                .copied()
+                .unwrap_or(0),
+        );
+        known_subscription_rooms.insert(room_id.clone());
+    }
+
+    for r in body.unsubscribe_rooms {
+        known_subscription_rooms.remove(&r);
+        body.room_subscriptions.remove(&r);
+    }
+
+    if let Some(conn_id) = &body.conn_id {
+        services().users.update_sync_known_rooms(
+            sender_user.clone(),
+            sender_device.clone(),
+            conn_id.clone(),
+            "subscriptions".to_owned(),
+            known_subscription_rooms,
+            globalsince,
+        );
+    }
+
+    if let Some(conn_id) = &body.conn_id {
+        services().users.update_sync_subscriptions(
+            sender_user.clone(),
+            sender_device.clone(),
+            conn_id.clone(),
+            body.room_subscriptions,
+        );
+    }
+
+    let mut rooms = BTreeMap::new();
+    for (room_id, (required_state_request, timeline_limit, roomsince)) in &todo_rooms {
+        let roomsincecount = PduCount::Normal(*roomsince);
+
+        let (timeline_pdus, limited) =
+            load_timeline(&sender_user, room_id, roomsincecount, *timeline_limit)?;
+
+        if roomsince != &0 && timeline_pdus.is_empty() {
+            continue;
+        }
+
+        let prev_batch = timeline_pdus
+            .first()
+            .map_or(Ok::<_, Error>(None), |(pdu_count, _)| {
+                Ok(Some(match pdu_count {
+                    PduCount::Backfilled(_) => {
+                        error!("timeline in backfill state?!");
+                        "0".to_owned()
+                    }
+                    PduCount::Normal(c) => c.to_string(),
+                }))
+            })?
+            .or_else(|| {
+                if roomsince != &0 {
+                    Some(roomsince.to_string())
+                } else {
+                    None
+                }
+            });
+
+        let room_events: Vec<_> = timeline_pdus
+            .iter()
+            .map(|(_, pdu)| pdu.to_sync_room_event())
+            .collect();
+
+        let required_state = required_state_request
+            .iter()
+            .flat_map(|state| {
+                services()
+                    .rooms
+                    .state_accessor
+                    .room_state_get(room_id, &state.0, &state.1)
+                    .ok()
+                    .flatten()
+                    .map(|state| state.to_sync_state_event())
+            })
+            .collect();
+
+        // Heroes
+        let heroes = services()
+            .rooms
+            .state_cache
+            .room_members(room_id)
+            .filter_map(|r| r.ok())
+            .filter(|member| member != &sender_user)
+            .flat_map(|member| {
+                services()
+                    .rooms
+                    .state_accessor
+                    .get_member(room_id, &member)
+                    .ok()
+                    .flatten()
+                    .map(|memberevent| {
+                        (
+                            memberevent
+                                .displayname
+                                .unwrap_or_else(|| member.to_string()),
+                            memberevent.avatar_url,
+                        )
+                    })
+            })
+            .take(5)
+            .collect::<Vec<_>>();
+        let name = match &heroes[..] {
+            [] => None,
+            [only] => Some(only.0.clone()),
+            [firsts @ .., last] => Some(
+                firsts
+                    .iter()
+                    .map(|h| h.0.clone())
+                    .collect::<Vec<_>>()
+                    .join(", ")
+                    + " and "
+                    + &last.0,
+            ),
+        };
+
+        let avatar = if let [only] = &heroes[..] {
+            only.1.clone()
+        } else {
+            None
+        };
+
+        rooms.insert(
+            room_id.clone(),
+            sync_events::v4::SlidingSyncRoom {
+                name: services().rooms.state_accessor.get_name(room_id)?.or(name),
+                avatar: if let Some(avatar) = avatar {
+                    JsOption::Some(avatar)
+                } else {
+                    match services().rooms.state_accessor.get_avatar(room_id)? {
+                        JsOption::Some(avatar) => JsOption::from_option(avatar.url),
+                        JsOption::Null => JsOption::Null,
+                        JsOption::Undefined => JsOption::Undefined,
+                    }
+                },
+                initial: Some(roomsince == &0),
+                is_dm: None,
+                invite_state: None,
+                unread_notifications: UnreadNotificationsCount {
+                    highlight_count: Some(
+                        services()
+                            .rooms
+                            .user
+                            .highlight_count(&sender_user, room_id)?
+                            .try_into()
+                            .expect("notification count can't go that high"),
+                    ),
+                    notification_count: Some(
+                        services()
+                            .rooms
+                            .user
+                            .notification_count(&sender_user, room_id)?
+                            .try_into()
+                            .expect("notification count can't go that high"),
+                    ),
+                },
+                timeline: room_events,
+                required_state,
+                prev_batch,
+                limited,
+                joined_count: Some(
+                    (services()
+                        .rooms
+                        .state_cache
+                        .room_joined_count(room_id)?
+                        .unwrap_or(0) as u32)
+                        .into(),
+                ),
+                invited_count: Some(
+                    (services()
+                        .rooms
+                        .state_cache
+                        .room_invited_count(room_id)?
+                        .unwrap_or(0) as u32)
+                        .into(),
+                ),
+                num_live: None, // Count events in timeline greater than global sync counter
+                timestamp: None,
+            },
+        );
+    }
+
+    if rooms
+        .iter()
+        .all(|(_, r)| r.timeline.is_empty() && r.required_state.is_empty())
+    {
+        // Hang a few seconds so requests are not spammed
+        // Stop hanging if new info arrives
+        let mut duration = body.timeout.unwrap_or(Duration::from_secs(30));
+        if duration.as_secs() > 30 {
+            duration = Duration::from_secs(30);
+        }
+        let _ = tokio::time::timeout(duration, watcher).await;
+    }
+
+    Ok(sync_events::v4::Response {
+        initial: globalsince == 0,
+        txn_id: body.txn_id.clone(),
+        pos: next_batch.to_string(),
+        lists,
+        rooms,
+        extensions: sync_events::v4::Extensions {
+            to_device: if body.extensions.to_device.enabled.unwrap_or(false) {
+                Some(sync_events::v4::ToDevice {
+                    events: services()
+                        .users
+                        .get_to_device_events(&sender_user, &sender_device)?,
+                    next_batch: next_batch.to_string(),
+                })
+            } else {
+                None
+            },
+            e2ee: sync_events::v4::E2EE {
+                device_lists: DeviceLists {
+                    changed: device_list_changes.into_iter().collect(),
+                    left: device_list_left.into_iter().collect(),
+                },
+                device_one_time_keys_count: services()
+                    .users
+                    .count_one_time_keys(&sender_user, &sender_device)?,
+                // Fallback keys are not yet supported
+                device_unused_fallback_key_types: None,
+            },
+            account_data: sync_events::v4::AccountData {
+                global: if body.extensions.account_data.enabled.unwrap_or(false) {
+                    services()
+                        .account_data
+                        .changes_since(None, &sender_user, globalsince)?
+                        .into_iter()
+                        .filter_map(|(_, v)| {
+                            serde_json::from_str(v.json().get())
+                                .map_err(|_| {
+                                    Error::bad_database("Invalid account event in database.")
+                                })
+                                .ok()
+                        })
+                        .collect()
+                } else {
+                    Vec::new()
+                },
+                rooms: BTreeMap::new(),
+            },
+            receipts: sync_events::v4::Receipts {
+                rooms: BTreeMap::new(),
+            },
+            typing: sync_events::v4::Typing {
+                rooms: BTreeMap::new(),
+            },
+        },
+        delta_token: None,
+    })
+}
diff --git a/src/api/client_server/threads.rs b/src/api/client_server/threads.rs
new file mode 100644
index 00000000..a095b420
--- /dev/null
+++ b/src/api/client_server/threads.rs
@@ -0,0 +1,49 @@
+use ruma::api::client::{error::ErrorKind, threads::get_threads};
+
+use crate::{services, Error, Result, Ruma};
+
+/// # `GET /_matrix/client/r0/rooms/{roomId}/threads`
+pub async fn get_threads_route(
+    body: Ruma<get_threads::v1::Request>,
+) -> Result<get_threads::v1::Response> {
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|l| l.try_into().ok())
+        .unwrap_or(10)
+        .min(100);
+
+    let from = if let Some(from) = &body.from {
+        from.parse()
+            .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, ""))?
+    } else {
+        u64::MAX
+    };
+
+    let threads = services()
+        .rooms
+        .threads
+        .threads_until(sender_user, &body.room_id, from, &body.include)?
+        .take(limit)
+        .filter_map(|r| r.ok())
+        .filter(|(_, pdu)| {
+            services()
+                .rooms
+                .state_accessor
+                .user_can_see_event(sender_user, &body.room_id, &pdu.event_id)
+                .unwrap_or(false)
+        })
+        .collect::<Vec<_>>();
+
+    let next_batch = threads.last().map(|(count, _)| count.to_string());
+
+    Ok(get_threads::v1::Response {
+        chunk: threads
+            .into_iter()
+            .map(|(_, pdu)| pdu.to_room_event())
+            .collect(),
+        next_batch,
+    })
+}
diff --git a/src/api/client_server/to_device.rs b/src/api/client_server/to_device.rs
index 26db4e4d..31590fc7 100644
--- a/src/api/client_server/to_device.rs
+++ b/src/api/client_server/to_device.rs
@@ -1,4 +1,3 @@
-use ruma::events::ToDeviceEventType;
 use std::collections::BTreeMap;
 
 use crate::{services, Error, Result, Ruma};
@@ -42,7 +41,7 @@ pub async fn send_event_to_device_route(
                     serde_json::to_vec(&federation::transactions::edu::Edu::DirectToDevice(
                         DirectDeviceContent {
                             sender: sender_user.clone(),
-                            ev_type: ToDeviceEventType::from(&*body.event_type),
+                            ev_type: body.event_type.clone(),
                             message_id: count.to_string().into(),
                             messages,
                         },
@@ -60,7 +59,7 @@ pub async fn send_event_to_device_route(
                         sender_user,
                         target_user_id,
                         target_device_id,
-                        &body.event_type,
+                        &body.event_type.to_string(),
                         event.deserialize_as().map_err(|_| {
                             Error::BadRequest(ErrorKind::InvalidParam, "Event is invalid")
                         })?,
@@ -73,7 +72,7 @@ pub async fn send_event_to_device_route(
                             sender_user,
                             target_user_id,
                             &target_device_id?,
-                            &body.event_type,
+                            &body.event_type.to_string(),
                             event.deserialize_as().map_err(|_| {
                                 Error::BadRequest(ErrorKind::InvalidParam, "Event is invalid")
                             })?,
diff --git a/src/api/client_server/typing.rs b/src/api/client_server/typing.rs
index 43217e1a..e9e93708 100644
--- a/src/api/client_server/typing.rs
+++ b/src/api/client_server/typing.rs
@@ -23,17 +23,23 @@ pub async fn create_typing_event_route(
     }
 
     if let Typing::Yes(duration) = body.state {
-        services().rooms.edus.typing.typing_add(
-            sender_user,
-            &body.room_id,
-            duration.as_millis() as u64 + utils::millis_since_unix_epoch(),
-        )?;
+        services()
+            .rooms
+            .edus
+            .typing
+            .typing_add(
+                sender_user,
+                &body.room_id,
+                duration.as_millis() as u64 + utils::millis_since_unix_epoch(),
+            )
+            .await?;
     } else {
         services()
             .rooms
             .edus
             .typing
-            .typing_remove(sender_user, &body.room_id)?;
+            .typing_remove(sender_user, &body.room_id)
+            .await?;
     }
 
     Ok(create_typing_event::v3::Response {})
diff --git a/src/api/client_server/unversioned.rs b/src/api/client_server/unversioned.rs
index 526598b9..70e260ec 100644
--- a/src/api/client_server/unversioned.rs
+++ b/src/api/client_server/unversioned.rs
@@ -1,8 +1,9 @@
 use std::{collections::BTreeMap, iter::FromIterator};
 
-use ruma::api::client::discovery::get_supported_versions;
+use axum::{response::IntoResponse, Json};
+use ruma::api::client::{discovery::get_supported_versions, error::ErrorKind};
 
-use crate::{Result, Ruma};
+use crate::{services, Error, Result, Ruma};
 
 /// # `GET /_matrix/client/versions`
 ///
@@ -23,9 +24,27 @@ pub async fn get_supported_versions_route(
             "r0.6.0".to_owned(),
             "v1.1".to_owned(),
             "v1.2".to_owned(),
+            "v1.3".to_owned(),
+            "v1.4".to_owned(),
+            "v1.5".to_owned(),
         ],
         unstable_features: BTreeMap::from_iter([("org.matrix.e2e_cross_signing".to_owned(), true)]),
     };
 
     Ok(resp)
 }
+
+/// # `GET /.well-known/matrix/client`
+pub async fn well_known_client_route(
+    _body: Ruma<get_supported_versions::Request>,
+) -> Result<impl IntoResponse> {
+    let client_url = match services().globals.well_known_client() {
+        Some(url) => url.clone(),
+        None => return Err(Error::BadRequest(ErrorKind::NotFound, "Not found.")),
+    };
+
+    Ok(Json(serde_json::json!({
+        "m.homeserver": {"base_url": client_url},
+        "org.matrix.msc3575.proxy": {"url": client_url}
+    })))
+}
diff --git a/src/api/client_server/user_directory.rs b/src/api/client_server/user_directory.rs
index c30bac51..b4d11800 100644
--- a/src/api/client_server/user_directory.rs
+++ b/src/api/client_server/user_directory.rs
@@ -48,6 +48,9 @@ pub async fn search_users_route(
             return None;
         }
 
+        // It's a matching user, but is the sender allowed to see them?
+        let mut user_visible = false;
+
         let user_is_in_public_rooms = services()
             .rooms
             .state_cache
@@ -69,22 +72,26 @@ pub async fn search_users_route(
             });
 
         if user_is_in_public_rooms {
-            return Some(user);
+            user_visible = true;
+        } else {
+            let user_is_in_shared_rooms = services()
+                .rooms
+                .user
+                .get_shared_rooms(vec![sender_user.clone(), user_id])
+                .ok()?
+                .next()
+                .is_some();
+
+            if user_is_in_shared_rooms {
+                user_visible = true;
+            }
         }
 
-        let user_is_in_shared_rooms = services()
-            .rooms
-            .user
-            .get_shared_rooms(vec![sender_user.clone(), user_id])
-            .ok()?
-            .next()
-            .is_some();
-
-        if user_is_in_shared_rooms {
-            return Some(user);
+        if !user_visible {
+            return None;
         }
 
-        None
+        Some(user)
     });
 
     let results = users.by_ref().take(limit).collect();
diff --git a/src/api/client_server/voip.rs b/src/api/client_server/voip.rs
index 4990c17c..f0d91f71 100644
--- a/src/api/client_server/voip.rs
+++ b/src/api/client_server/voip.rs
@@ -1,4 +1,5 @@
 use crate::{services, Result, Ruma};
+use base64::{engine::general_purpose, Engine as _};
 use hmac::{Hmac, Mac};
 use ruma::{api::client::voip::get_turn_server_info, SecondsSinceUnixEpoch};
 use sha1::Sha1;
@@ -28,7 +29,7 @@ pub async fn turn_server_route(
             .expect("HMAC can take key of any size");
         mac.update(username.as_bytes());
 
-        let password: String = base64::encode_config(mac.finalize().into_bytes(), base64::STANDARD);
+        let password: String = general_purpose::STANDARD.encode(mac.finalize().into_bytes());
 
         (username, password)
     } else {
diff --git a/src/api/ruma_wrapper/axum.rs b/src/api/ruma_wrapper/axum.rs
index 74f506f6..e721e80d 100644
--- a/src/api/ruma_wrapper/axum.rs
+++ b/src/api/ruma_wrapper/axum.rs
@@ -3,51 +3,73 @@ use std::{collections::BTreeMap, iter::FromIterator, str};
 use axum::{
     async_trait,
     body::{Full, HttpBody},
-    extract::{
-        rejection::TypedHeaderRejectionReason, FromRequest, Path, RequestParts, TypedHeader,
-    },
+    extract::{rejection::TypedHeaderRejectionReason, FromRequest, Path, TypedHeader},
     headers::{
         authorization::{Bearer, Credentials},
         Authorization,
     },
     response::{IntoResponse, Response},
-    BoxError,
+    BoxError, RequestExt, RequestPartsExt,
 };
-use bytes::{BufMut, Bytes, BytesMut};
-use http::StatusCode;
+use bytes::{Buf, BufMut, Bytes, BytesMut};
+use http::{Request, StatusCode};
 use ruma::{
     api::{client::error::ErrorKind, AuthScheme, IncomingRequest, OutgoingResponse},
-    CanonicalJsonValue, OwnedDeviceId, OwnedServerName, UserId,
+    CanonicalJsonValue, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 };
 use serde::Deserialize;
 use tracing::{debug, error, warn};
 
 use super::{Ruma, RumaResponse};
-use crate::{services, Error, Result};
+use crate::{service::appservice::RegistrationInfo, services, Error, Result};
+
+enum Token {
+    Appservice(Box<RegistrationInfo>),
+    User((OwnedUserId, OwnedDeviceId)),
+    Invalid,
+    None,
+}
 
 #[async_trait]
-impl<T, B> FromRequest<B> for Ruma<T>
+impl<T, S, B> FromRequest<S, B> for Ruma<T>
 where
     T: IncomingRequest,
-    B: HttpBody + Send,
+    B: HttpBody + Send + 'static,
     B::Data: Send,
     B::Error: Into<BoxError>,
 {
     type Rejection = Error;
 
-    async fn from_request(req: &mut RequestParts<B>) -> Result<Self, Self::Rejection> {
+    async fn from_request(req: Request<B>, _state: &S) -> Result<Self, Self::Rejection> {
         #[derive(Deserialize)]
         struct QueryParams {
             access_token: Option<String>,
             user_id: Option<String>,
         }
 
-        let metadata = T::METADATA;
-        let auth_header = Option::<TypedHeader<Authorization<Bearer>>>::from_request(req).await?;
-        let path_params = Path::<Vec<String>>::from_request(req).await?;
+        let (mut parts, mut body) = match req.with_limited_body() {
+            Ok(limited_req) => {
+                let (parts, body) = limited_req.into_parts();
+                let body = to_bytes(body)
+                    .await
+                    .map_err(|_| Error::BadRequest(ErrorKind::MissingToken, "Missing token."))?;
+                (parts, body)
+            }
+            Err(original_req) => {
+                let (parts, body) = original_req.into_parts();
+                let body = to_bytes(body)
+                    .await
+                    .map_err(|_| Error::BadRequest(ErrorKind::MissingToken, "Missing token."))?;
+                (parts, body)
+            }
+        };
 
-        let query = req.uri().query().unwrap_or_default();
-        let query_params: QueryParams = match ruma::serde::urlencoded::from_str(query) {
+        let metadata = T::METADATA;
+        let auth_header: Option<TypedHeader<Authorization<Bearer>>> = parts.extract().await?;
+        let path_params: Path<Vec<String>> = parts.extract().await?;
+
+        let query = parts.uri.query().unwrap_or_default();
+        let query_params: QueryParams = match serde_html_form::from_str(query) {
             Ok(params) => params,
             Err(e) => {
                 error!(%query, "Failed to deserialize query parameters: {}", e);
@@ -63,188 +85,197 @@ where
             None => query_params.access_token.as_deref(),
         };
 
-        let mut body = Bytes::from_request(req)
-            .await
-            .map_err(|_| Error::BadRequest(ErrorKind::MissingToken, "Missing token."))?;
+        let token = if let Some(token) = token {
+            if let Some(reg_info) = services().appservice.find_from_token(token).await {
+                Token::Appservice(Box::new(reg_info.clone()))
+            } else if let Some((user_id, device_id)) = services().users.find_from_token(token)? {
+                Token::User((user_id, OwnedDeviceId::from(device_id)))
+            } else {
+                Token::Invalid
+            }
+        } else {
+            Token::None
+        };
 
         let mut json_body = serde_json::from_slice::<CanonicalJsonValue>(&body).ok();
 
-        let appservices = services().appservice.all().unwrap();
-        let appservice_registration = appservices.iter().find(|(_id, registration)| {
-            registration
-                .get("as_token")
-                .and_then(|as_token| as_token.as_str())
-                .map_or(false, |as_token| token == Some(as_token))
-        });
-
         let (sender_user, sender_device, sender_servername, from_appservice) =
-            if let Some((_id, registration)) = appservice_registration {
-                match metadata.authentication {
-                    AuthScheme::AccessToken => {
-                        let user_id = query_params.user_id.map_or_else(
+            match (metadata.authentication, token) {
+                (_, Token::Invalid) => {
+                    return Err(Error::BadRequest(
+                        ErrorKind::UnknownToken { soft_logout: false },
+                        "Unknown access token.",
+                    ))
+                }
+                (
+                    AuthScheme::AccessToken | AuthScheme::AccessTokenOptional,
+                    Token::Appservice(info),
+                ) => {
+                    let user_id = query_params
+                        .user_id
+                        .map_or_else(
                             || {
                                 UserId::parse_with_server_name(
-                                    registration
-                                        .get("sender_localpart")
-                                        .unwrap()
-                                        .as_str()
-                                        .unwrap(),
+                                    info.registration.sender_localpart.as_str(),
                                     services().globals.server_name(),
                                 )
-                                .unwrap()
                             },
-                            |s| UserId::parse(s).unwrap(),
-                        );
+                            UserId::parse,
+                        )
+                        .map_err(|_| {
+                            Error::BadRequest(ErrorKind::InvalidUsername, "Username is invalid.")
+                        })?;
+                    if !services().users.exists(&user_id)? {
+                        return Err(Error::BadRequest(
+                            ErrorKind::Forbidden,
+                            "User does not exist.",
+                        ));
+                    }
 
-                        if !services().users.exists(&user_id).unwrap() {
+                    // TODO: Check if appservice is allowed to be that user
+                    (Some(user_id), None, None, true)
+                }
+                (AuthScheme::None | AuthScheme::AppserviceToken, Token::Appservice(_)) => {
+                    (None, None, None, true)
+                }
+                (AuthScheme::AccessToken, Token::None) => {
+                    return Err(Error::BadRequest(
+                        ErrorKind::MissingToken,
+                        "Missing access token.",
+                    ));
+                }
+                (
+                    AuthScheme::AccessToken | AuthScheme::AccessTokenOptional | AuthScheme::None,
+                    Token::User((user_id, device_id)),
+                ) => (Some(user_id), Some(device_id), None, false),
+                (AuthScheme::ServerSignatures, Token::None) => {
+                    if !services().globals.allow_federation() {
+                        return Err(Error::bad_config("Federation is disabled."));
+                    }
+
+                    let TypedHeader(Authorization(x_matrix)) = parts
+                        .extract::<TypedHeader<Authorization<XMatrix>>>()
+                        .await
+                        .map_err(|e| {
+                            warn!("Missing or invalid Authorization header: {}", e);
+
+                            let msg = match e.reason() {
+                                TypedHeaderRejectionReason::Missing => {
+                                    "Missing Authorization header."
+                                }
+                                TypedHeaderRejectionReason::Error(_) => {
+                                    "Invalid X-Matrix signatures."
+                                }
+                                _ => "Unknown header-related error",
+                            };
+
+                            Error::BadRequest(ErrorKind::Forbidden, msg)
+                        })?;
+
+                    let origin_signatures = BTreeMap::from_iter([(
+                        x_matrix.key.clone(),
+                        CanonicalJsonValue::String(x_matrix.sig),
+                    )]);
+
+                    let signatures = BTreeMap::from_iter([(
+                        x_matrix.origin.as_str().to_owned(),
+                        CanonicalJsonValue::Object(origin_signatures),
+                    )]);
+
+                    let mut request_map = BTreeMap::from_iter([
+                        (
+                            "method".to_owned(),
+                            CanonicalJsonValue::String(parts.method.to_string()),
+                        ),
+                        (
+                            "uri".to_owned(),
+                            CanonicalJsonValue::String(parts.uri.to_string()),
+                        ),
+                        (
+                            "origin".to_owned(),
+                            CanonicalJsonValue::String(x_matrix.origin.as_str().to_owned()),
+                        ),
+                        (
+                            "destination".to_owned(),
+                            CanonicalJsonValue::String(
+                                services().globals.server_name().as_str().to_owned(),
+                            ),
+                        ),
+                        (
+                            "signatures".to_owned(),
+                            CanonicalJsonValue::Object(signatures),
+                        ),
+                    ]);
+
+                    if let Some(json_body) = &json_body {
+                        request_map.insert("content".to_owned(), json_body.clone());
+                    };
+
+                    let keys_result = services()
+                        .rooms
+                        .event_handler
+                        .fetch_signing_keys(&x_matrix.origin, vec![x_matrix.key.to_owned()])
+                        .await;
+
+                    let keys = match keys_result {
+                        Ok(b) => b,
+                        Err(e) => {
+                            warn!("Failed to fetch signing keys: {}", e);
                             return Err(Error::BadRequest(
                                 ErrorKind::Forbidden,
-                                "User does not exist.",
+                                "Failed to fetch signing keys.",
                             ));
                         }
+                    };
 
-                        // TODO: Check if appservice is allowed to be that user
-                        (Some(user_id), None, None, true)
-                    }
-                    AuthScheme::ServerSignatures => (None, None, None, true),
-                    AuthScheme::None => (None, None, None, true),
-                }
-            } else {
-                match metadata.authentication {
-                    AuthScheme::AccessToken => {
-                        let token = match token {
-                            Some(token) => token,
-                            _ => {
-                                return Err(Error::BadRequest(
-                                    ErrorKind::MissingToken,
-                                    "Missing access token.",
-                                ))
-                            }
-                        };
+                    let pub_key_map =
+                        BTreeMap::from_iter([(x_matrix.origin.as_str().to_owned(), keys)]);
 
-                        match services().users.find_from_token(token).unwrap() {
-                            None => {
-                                return Err(Error::BadRequest(
-                                    ErrorKind::UnknownToken { soft_logout: false },
-                                    "Unknown access token.",
-                                ))
-                            }
-                            Some((user_id, device_id)) => (
-                                Some(user_id),
-                                Some(OwnedDeviceId::from(device_id)),
-                                None,
-                                false,
-                            ),
-                        }
-                    }
-                    AuthScheme::ServerSignatures => {
-                        let TypedHeader(Authorization(x_matrix)) =
-                            TypedHeader::<Authorization<XMatrix>>::from_request(req)
-                                .await
-                                .map_err(|e| {
-                                    warn!("Missing or invalid Authorization header: {}", e);
+                    match ruma::signatures::verify_json(&pub_key_map, &request_map) {
+                        Ok(()) => (None, None, Some(x_matrix.origin), false),
+                        Err(e) => {
+                            warn!(
+                                "Failed to verify json request from {}: {}\n{:?}",
+                                x_matrix.origin, e, request_map
+                            );
 
-                                    let msg = match e.reason() {
-                                        TypedHeaderRejectionReason::Missing => {
-                                            "Missing Authorization header."
-                                        }
-                                        TypedHeaderRejectionReason::Error(_) => {
-                                            "Invalid X-Matrix signatures."
-                                        }
-                                        _ => "Unknown header-related error",
-                                    };
-
-                                    Error::BadRequest(ErrorKind::Forbidden, msg)
-                                })?;
-
-                        let origin_signatures = BTreeMap::from_iter([(
-                            x_matrix.key.clone(),
-                            CanonicalJsonValue::String(x_matrix.sig),
-                        )]);
-
-                        let signatures = BTreeMap::from_iter([(
-                            x_matrix.origin.as_str().to_owned(),
-                            CanonicalJsonValue::Object(origin_signatures),
-                        )]);
-
-                        let mut request_map = BTreeMap::from_iter([
-                            (
-                                "method".to_owned(),
-                                CanonicalJsonValue::String(req.method().to_string()),
-                            ),
-                            (
-                                "uri".to_owned(),
-                                CanonicalJsonValue::String(req.uri().to_string()),
-                            ),
-                            (
-                                "origin".to_owned(),
-                                CanonicalJsonValue::String(x_matrix.origin.as_str().to_owned()),
-                            ),
-                            (
-                                "destination".to_owned(),
-                                CanonicalJsonValue::String(
-                                    services().globals.server_name().as_str().to_owned(),
-                                ),
-                            ),
-                            (
-                                "signatures".to_owned(),
-                                CanonicalJsonValue::Object(signatures),
-                            ),
-                        ]);
-
-                        if let Some(json_body) = &json_body {
-                            request_map.insert("content".to_owned(), json_body.clone());
-                        };
-
-                        let keys_result = services()
-                            .rooms
-                            .event_handler
-                            .fetch_signing_keys(&x_matrix.origin, vec![x_matrix.key.to_owned()])
-                            .await;
-
-                        let keys = match keys_result {
-                            Ok(b) => b,
-                            Err(e) => {
-                                warn!("Failed to fetch signing keys: {}", e);
-                                return Err(Error::BadRequest(
-                                    ErrorKind::Forbidden,
-                                    "Failed to fetch signing keys.",
-                                ));
-                            }
-                        };
-
-                        let pub_key_map =
-                            BTreeMap::from_iter([(x_matrix.origin.as_str().to_owned(), keys)]);
-
-                        match ruma::signatures::verify_json(&pub_key_map, &request_map) {
-                            Ok(()) => (None, None, Some(x_matrix.origin), false),
-                            Err(e) => {
+                            if parts.uri.to_string().contains('@') {
                                 warn!(
-                                    "Failed to verify json request from {}: {}\n{:?}",
-                                    x_matrix.origin, e, request_map
-                                );
-
-                                if req.uri().to_string().contains('@') {
-                                    warn!(
-                                        "Request uri contained '@' character. Make sure your \
+                                    "Request uri contained '@' character. Make sure your \
                                          reverse proxy gives Conduit the raw uri (apache: use \
                                          nocanon)"
-                                    );
-                                }
-
-                                return Err(Error::BadRequest(
-                                    ErrorKind::Forbidden,
-                                    "Failed to verify X-Matrix signatures.",
-                                ));
+                                );
                             }
+
+                            return Err(Error::BadRequest(
+                                ErrorKind::Forbidden,
+                                "Failed to verify X-Matrix signatures.",
+                            ));
                         }
                     }
-                    AuthScheme::None => (None, None, None, false),
+                }
+                (
+                    AuthScheme::None
+                    | AuthScheme::AppserviceToken
+                    | AuthScheme::AccessTokenOptional,
+                    Token::None,
+                ) => (None, None, None, false),
+                (AuthScheme::ServerSignatures, Token::Appservice(_) | Token::User(_)) => {
+                    return Err(Error::BadRequest(
+                        ErrorKind::Unauthorized,
+                        "Only server signatures should be used on this endpoint.",
+                    ));
+                }
+                (AuthScheme::AppserviceToken, Token::User(_)) => {
+                    return Err(Error::BadRequest(
+                        ErrorKind::Unauthorized,
+                        "Only appservice access tokens should be used on this endpoint.",
+                    ));
                 }
             };
 
-        let mut http_request = http::Request::builder().uri(req.uri()).method(req.method());
-        *http_request.headers_mut().unwrap() = req.headers().clone();
+        let mut http_request = http::Request::builder().uri(parts.uri).method(parts.method);
+        *http_request.headers_mut().unwrap() = parts.headers;
 
         if let Some(CanonicalJsonValue::Object(json_body)) = &mut json_body {
             let user_id = sender_user.clone().unwrap_or_else(|| {
@@ -281,10 +312,8 @@ where
         debug!("{:?}", http_request);
 
         let body = T::try_from_http_request(http_request, &path_params).map_err(|e| {
-            warn!(
-                "try_from_http_request failed: {:?}\nJSON body: {:?}",
-                e, json_body
-            );
+            warn!("try_from_http_request failed: {:?}", e);
+            debug!("JSON body: {:?}", json_body);
             Error::BadRequest(ErrorKind::BadJson, "Failed to deserialize request.")
         })?;
 
@@ -364,3 +393,55 @@ impl<T: OutgoingResponse> IntoResponse for RumaResponse<T> {
         }
     }
 }
+
+// copied from hyper under the following license:
+// Copyright (c) 2014-2021 Sean McArthur
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+pub(crate) async fn to_bytes<T>(body: T) -> Result<Bytes, T::Error>
+where
+    T: HttpBody,
+{
+    futures_util::pin_mut!(body);
+
+    // If there's only 1 chunk, we can just return Buf::to_bytes()
+    let mut first = if let Some(buf) = body.data().await {
+        buf?
+    } else {
+        return Ok(Bytes::new());
+    };
+
+    let second = if let Some(buf) = body.data().await {
+        buf?
+    } else {
+        return Ok(first.copy_to_bytes(first.remaining()));
+    };
+
+    // With more than 1 buf, we gotta flatten into a Vec first.
+    let cap = first.remaining() + second.remaining() + body.size_hint().lower() as usize;
+    let mut vec = Vec::with_capacity(cap);
+    vec.put(first);
+    vec.put(second);
+
+    while let Some(buf) = body.data().await {
+        vec.put(buf?);
+    }
+
+    Ok(vec.into())
+}
diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index 852e59a8..fa7f1315 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -1,3 +1,5 @@
+#![allow(deprecated)]
+
 use crate::{
     api::client_server::{self, claim_keys_helper, get_keys_helper},
     service::pdu::{gen_event_id_canonical_json, PduBuilder},
@@ -18,11 +20,7 @@ use ruma::{
             discovery::{get_server_keys, get_server_version, ServerSigningKeys, VerifyKey},
             event::{get_event, get_missing_events, get_room_state, get_room_state_ids},
             keys::{claim_keys, get_keys},
-            membership::{
-                create_invite,
-                create_join_event::{self, RoomState},
-                prepare_join_event,
-            },
+            membership::{create_invite, create_join_event, prepare_join_event},
             query::{get_profile_information, get_room_information},
             transactions::{
                 edu::{DeviceListUpdateContent, DirectDeviceContent, Edu, SigningKeyUpdateContent},
@@ -39,7 +37,7 @@ use ruma::{
             join_rules::{JoinRule, RoomJoinRulesEventContent},
             member::{MembershipState, RoomMemberEventContent},
         },
-        RoomEventType, StateEventType,
+        StateEventType, TimelineEventType,
     },
     serde::{Base64, JsonObject, Raw},
     to_device::DeviceIdOrAllDevices,
@@ -53,11 +51,12 @@ use std::{
     fmt::Debug,
     mem,
     net::{IpAddr, SocketAddr},
-    sync::{Arc, RwLock},
+    sync::Arc,
     time::{Duration, Instant, SystemTime},
 };
+use tokio::sync::RwLock;
 
-use tracing::{debug, error, info, warn};
+use tracing::{debug, error, warn};
 
 /// Wraps either an literal IP address plus port, or a hostname plus complement
 /// (colon-plus-port if it was specified).
@@ -125,6 +124,12 @@ where
         return Err(Error::bad_config("Federation is disabled."));
     }
 
+    if destination == services().globals.server_name() {
+        return Err(Error::bad_config(
+            "Won't send federation request to ourselves",
+        ));
+    }
+
     debug!("Preparing to send request to {destination}");
 
     let mut write_destination_to_cache = false;
@@ -133,7 +138,7 @@ where
         .globals
         .actual_destination_cache
         .read()
-        .unwrap()
+        .await
         .get(destination)
         .cloned();
 
@@ -153,7 +158,7 @@ where
         .try_into_http_request::<Vec<u8>>(
             &actual_destination_str,
             SendAccessToken::IfRequired(""),
-            &[MatrixVersion::V1_0],
+            &[MatrixVersion::V1_4],
         )
         .map_err(|e| {
             warn!(
@@ -228,8 +233,7 @@ where
         }
     }
 
-    let reqwest_request = reqwest::Request::try_from(http_request)
-        .expect("all http requests are valid reqwest requests");
+    let reqwest_request = reqwest::Request::try_from(http_request)?;
 
     let url = reqwest_request.url().clone();
 
@@ -286,7 +290,7 @@ where
                         .globals
                         .actual_destination_cache
                         .write()
-                        .unwrap()
+                        .await
                         .insert(
                             OwnedServerName::from(destination),
                             (actual_destination, host),
@@ -337,7 +341,7 @@ fn add_port_to_hostname(destination_str: &str) -> FedDest {
 }
 
 /// Returns: actual_destination, host header
-/// Implemented according to the specification at https://matrix.org/docs/spec/server_server/r0.1.4#resolving-server-names
+/// Implemented according to the specification at <https://matrix.org/docs/spec/server_server/r0.1.4#resolving-server-names>
 /// Numbers in comments below refer to bullet points in linked section of specification
 async fn find_actual_destination(destination: &'_ ServerName) -> (FedDest, FedDest) {
     debug!("Finding actual destination for {destination}");
@@ -471,12 +475,11 @@ async fn find_actual_destination(destination: &'_ ServerName) -> (FedDest, FedDe
     (actual_destination, hostname)
 }
 
-async fn query_srv_record(hostname: &'_ str) -> Option<FedDest> {
-    let hostname = hostname.trim_end_matches('.');
-    if let Ok(Some(host_port)) = services()
+async fn query_given_srv_record(record: &str) -> Option<FedDest> {
+    services()
         .globals
         .dns_resolver()
-        .srv_lookup(format!("_matrix._tcp.{hostname}."))
+        .srv_lookup(record)
         .await
         .map(|srv| {
             srv.iter().next().map(|result| {
@@ -486,10 +489,17 @@ async fn query_srv_record(hostname: &'_ str) -> Option<FedDest> {
                 )
             })
         })
+        .unwrap_or(None)
+}
+
+async fn query_srv_record(hostname: &'_ str) -> Option<FedDest> {
+    let hostname = hostname.trim_end_matches('.');
+
+    if let Some(host_port) = query_given_srv_record(&format!("_matrix-fed._tcp.{hostname}.")).await
     {
         Some(host_port)
     } else {
-        None
+        query_given_srv_record(&format!("_matrix._tcp.{hostname}.")).await
     }
 }
 
@@ -501,6 +511,10 @@ async fn request_well_known(destination: &str) -> Option<String> {
         .send()
         .await;
     debug!("Got well known response");
+    if let Err(e) = &response {
+        debug!("Well known error: {e:?}");
+        return None;
+    }
     let text = response.ok()?.text().await;
     debug!("Got well known response text");
     let body: serde_json::Value = serde_json::from_str(&text.ok()?).ok()?;
@@ -592,10 +606,6 @@ pub async fn get_server_keys_deprecated_route() -> impl IntoResponse {
 pub async fn get_public_rooms_filtered_route(
     body: Ruma<get_public_rooms_filtered::v1::Request>,
 ) -> Result<get_public_rooms_filtered::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let response = client_server::get_public_rooms_filtered_helper(
         None,
         body.limit,
@@ -619,10 +629,6 @@ pub async fn get_public_rooms_filtered_route(
 pub async fn get_public_rooms_route(
     body: Ruma<get_public_rooms::v1::Request>,
 ) -> Result<get_public_rooms::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let response = client_server::get_public_rooms_filtered_helper(
         None,
         body.limit,
@@ -658,7 +664,7 @@ pub fn parse_incoming_pdu(
 
     let room_version_id = services().rooms.state.get_room_version(&room_id)?;
 
-    let (event_id, value) = match gen_event_id_canonical_json(&pdu, &room_version_id) {
+    let (event_id, value) = match gen_event_id_canonical_json(pdu, &room_version_id) {
         Ok(t) => t,
         Err(_) => {
             // Event could not be converted to canonical json
@@ -677,10 +683,6 @@ pub fn parse_incoming_pdu(
 pub async fn send_transaction_message_route(
     body: Ruma<send_transaction_message::v1::Request>,
 ) -> Result<send_transaction_message::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -699,27 +701,40 @@ pub async fn send_transaction_message_route(
     // let mut auth_cache = EventMap::new();
 
     for pdu in &body.pdus {
-        let r = parse_incoming_pdu(&pdu);
+        let value: CanonicalJsonObject = serde_json::from_str(pdu.get()).map_err(|e| {
+            warn!("Error parsing incoming event {:?}: {:?}", pdu, e);
+            Error::BadServerResponse("Invalid PDU in server response")
+        })?;
+        let room_id: OwnedRoomId = value
+            .get("room_id")
+            .and_then(|id| RoomId::parse(id.as_str()?).ok())
+            .ok_or(Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Invalid room id in pdu",
+            ))?;
+
+        if services().rooms.state.get_room_version(&room_id).is_err() {
+            debug!("Server is not in room {room_id}");
+            continue;
+        }
+
+        let r = parse_incoming_pdu(pdu);
         let (event_id, value, room_id) = match r {
             Ok(t) => t,
             Err(e) => {
-                warn!("Could not parse pdu: {e}");
+                warn!("Could not parse PDU: {e}");
+                warn!("Full PDU: {:?}", &pdu);
                 continue;
             }
         };
         // We do not add the event_id field to the pdu here because of signature and hashes checks
 
-        services()
-            .rooms
-            .event_handler
-            .acl_check(sender_servername, &room_id)?;
-
         let mutex = Arc::clone(
             services()
                 .globals
                 .roomid_mutex_federation
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.to_owned())
                 .or_default(),
         );
@@ -804,7 +819,7 @@ pub async fn send_transaction_message_route(
                                 .readreceipt_update(&user_id, &room_id, event)?;
                         } else {
                             // TODO fetch missing events
-                            info!("No known event ids in read receipt: {:?}", user_updates);
+                            debug!("No known event ids in read receipt: {:?}", user_updates);
                         }
                     }
                 }
@@ -816,17 +831,23 @@ pub async fn send_transaction_message_route(
                     .is_joined(&typing.user_id, &typing.room_id)?
                 {
                     if typing.typing {
-                        services().rooms.edus.typing.typing_add(
-                            &typing.user_id,
-                            &typing.room_id,
-                            3000 + utils::millis_since_unix_epoch(),
-                        )?;
+                        services()
+                            .rooms
+                            .edus
+                            .typing
+                            .typing_add(
+                                &typing.user_id,
+                                &typing.room_id,
+                                3000 + utils::millis_since_unix_epoch(),
+                            )
+                            .await?;
                     } else {
                         services()
                             .rooms
                             .edus
                             .typing
-                            .typing_remove(&typing.user_id, &typing.room_id)?;
+                            .typing_remove(&typing.user_id, &typing.room_id)
+                            .await?;
                     }
                 }
             }
@@ -908,6 +929,7 @@ pub async fn send_transaction_message_route(
                         &master_key,
                         &self_signing_key,
                         &None,
+                        true,
                     )?;
                 }
             }
@@ -918,7 +940,7 @@ pub async fn send_transaction_message_route(
     Ok(send_transaction_message::v1::Response {
         pdus: resolved_map
             .into_iter()
-            .map(|(e, r)| (e, r.map_err(|e| e.to_string())))
+            .map(|(e, r)| (e, r.map_err(|e| e.sanitized_error())))
             .collect(),
     })
 }
@@ -931,10 +953,6 @@ pub async fn send_transaction_message_route(
 pub async fn get_event_route(
     body: Ruma<get_event::v1::Request>,
 ) -> Result<get_event::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -944,7 +962,10 @@ pub async fn get_event_route(
         .rooms
         .timeline
         .get_pdu_json(&body.event_id)?
-        .ok_or(Error::BadRequest(ErrorKind::NotFound, "Event not found."))?;
+        .ok_or_else(|| {
+            warn!("Event not found, event ID: {:?}", &body.event_id);
+            Error::BadRequest(ErrorKind::NotFound, "Event not found.")
+        })?;
 
     let room_id_str = event
         .get("room_id")
@@ -967,7 +988,7 @@ pub async fn get_event_route(
 
     if !services().rooms.state_accessor.server_can_see_event(
         sender_servername,
-        &room_id,
+        room_id,
         &body.event_id,
     )? {
         return Err(Error::BadRequest(
@@ -990,16 +1011,12 @@ pub async fn get_event_route(
 pub async fn get_backfill_route(
     body: Ruma<get_backfill::v1::Request>,
 ) -> Result<get_backfill::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
         .expect("server is authenticated");
 
-    info!("Got backfill request from: {}", sender_servername);
+    debug!("Got backfill request from: {}", sender_servername);
 
     if !services()
         .rooms
@@ -1033,7 +1050,7 @@ pub async fn get_backfill_route(
     let all_events = services()
         .rooms
         .timeline
-        .pdus_until(&user_id!("@doesntmatter:conduit.rs"), &body.room_id, until)?
+        .pdus_until(user_id!("@doesntmatter:conduit.rs"), &body.room_id, until)?
         .take(limit.try_into().unwrap());
 
     let events = all_events
@@ -1050,7 +1067,7 @@ pub async fn get_backfill_route(
         })
         .map(|(_, pdu)| services().rooms.timeline.get_pdu_json(&pdu.event_id))
         .filter_map(|r| r.ok().flatten())
-        .map(|pdu| PduEvent::convert_to_outgoing_federation_event(pdu))
+        .map(PduEvent::convert_to_outgoing_federation_event)
         .collect();
 
     Ok(get_backfill::v1::Response {
@@ -1066,10 +1083,6 @@ pub async fn get_backfill_route(
 pub async fn get_missing_events_route(
     body: Ruma<get_missing_events::v1::Request>,
 ) -> Result<get_missing_events::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -1155,10 +1168,6 @@ pub async fn get_missing_events_route(
 pub async fn get_event_authorization_route(
     body: Ruma<get_event_authorization::v1::Request>,
 ) -> Result<get_event_authorization::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -1184,7 +1193,10 @@ pub async fn get_event_authorization_route(
         .rooms
         .timeline
         .get_pdu_json(&body.event_id)?
-        .ok_or(Error::BadRequest(ErrorKind::NotFound, "Event not found."))?;
+        .ok_or_else(|| {
+            warn!("Event not found, event ID: {:?}", &body.event_id);
+            Error::BadRequest(ErrorKind::NotFound, "Event not found.")
+        })?;
 
     let room_id_str = event
         .get("room_id")
@@ -1214,10 +1226,6 @@ pub async fn get_event_authorization_route(
 pub async fn get_room_state_route(
     body: Ruma<get_room_state::v1::Request>,
 ) -> Result<get_room_state::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -1294,10 +1302,6 @@ pub async fn get_room_state_route(
 pub async fn get_room_state_ids_route(
     body: Ruma<get_room_state_ids::v1::Request>,
 ) -> Result<get_room_state_ids::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -1355,10 +1359,6 @@ pub async fn get_room_state_ids_route(
 pub async fn create_join_event_template_route(
     body: Ruma<prepare_join_event::v1::Request>,
 ) -> Result<prepare_join_event::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     if !services().rooms.metadata.exists(&body.room_id)? {
         return Err(Error::BadRequest(
             ErrorKind::NotFound,
@@ -1381,7 +1381,7 @@ pub async fn create_join_event_template_route(
             .globals
             .roomid_mutex_state
             .write()
-            .unwrap()
+            .await
             .entry(body.room_id.to_owned())
             .or_default(),
     );
@@ -1440,7 +1440,7 @@ pub async fn create_join_event_template_route(
 
     let (_pdu, mut pdu_json) = services().rooms.timeline.create_hash_and_sign_event(
         PduBuilder {
-            event_type: RoomEventType::RoomMember,
+            event_type: TimelineEventType::RoomMember,
             content,
             unsigned: None,
             state_key: Some(body.user_id.to_string()),
@@ -1465,11 +1465,7 @@ async fn create_join_event(
     sender_servername: &ServerName,
     room_id: &RoomId,
     pdu: &RawJsonValue,
-) -> Result<RoomState> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
+) -> Result<create_join_event::v1::RoomState> {
     if !services().rooms.metadata.exists(room_id)? {
         return Err(Error::BadRequest(
             ErrorKind::NotFound,
@@ -1551,7 +1547,7 @@ async fn create_join_event(
             .globals
             .roomid_mutex_federation
             .write()
-            .unwrap()
+            .await
             .entry(room_id.to_owned())
             .or_default(),
     );
@@ -1587,7 +1583,7 @@ async fn create_join_event(
 
     services().sending.send_pdu(servers, &pdu_id)?;
 
-    Ok(RoomState {
+    Ok(create_join_event::v1::RoomState {
         auth_chain: auth_chain_ids
             .filter_map(|id| services().rooms.timeline.get_pdu_json(&id).ok().flatten())
             .map(PduEvent::convert_to_outgoing_federation_event)
@@ -1628,7 +1624,18 @@ pub async fn create_join_event_v2_route(
         .as_ref()
         .expect("server is authenticated");
 
-    let room_state = create_join_event(sender_servername, &body.room_id, &body.pdu).await?;
+    let create_join_event::v1::RoomState {
+        auth_chain,
+        state,
+        event,
+    } = create_join_event(sender_servername, &body.room_id, &body.pdu).await?;
+    let room_state = create_join_event::v2::RoomState {
+        members_omitted: false,
+        auth_chain,
+        state,
+        event,
+        servers_in_room: None,
+    };
 
     Ok(create_join_event::v2::Response { room_state })
 }
@@ -1639,10 +1646,6 @@ pub async fn create_join_event_v2_route(
 pub async fn create_invite_route(
     body: Ruma<create_invite::v2::Request>,
 ) -> Result<create_invite::v2::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let sender_servername = body
         .sender_servername
         .as_ref()
@@ -1756,8 +1759,11 @@ pub async fn create_invite_route(
 pub async fn get_devices_route(
     body: Ruma<get_devices::v1::Request>,
 ) -> Result<get_devices::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
+    if body.user_id.server_name() != services().globals.server_name() {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Tried to access user from other server.",
+        ));
     }
 
     let sender_servername = body
@@ -1788,12 +1794,14 @@ pub async fn get_devices_route(
                 })
             })
             .collect(),
-        master_key: services()
-            .users
-            .get_master_key(&body.user_id, &|u| u.server_name() == sender_servername)?,
+        master_key: services().users.get_master_key(None, &body.user_id, &|u| {
+            u.server_name() == sender_servername
+        })?,
         self_signing_key: services()
             .users
-            .get_self_signing_key(&body.user_id, &|u| u.server_name() == sender_servername)?,
+            .get_self_signing_key(None, &body.user_id, &|u| {
+                u.server_name() == sender_servername
+            })?,
     })
 }
 
@@ -1803,10 +1811,6 @@ pub async fn get_devices_route(
 pub async fn get_room_information_route(
     body: Ruma<get_room_information::v1::Request>,
 ) -> Result<get_room_information::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
-    }
-
     let room_id = services()
         .rooms
         .alias
@@ -1828,8 +1832,11 @@ pub async fn get_room_information_route(
 pub async fn get_profile_information_route(
     body: Ruma<get_profile_information::v1::Request>,
 ) -> Result<get_profile_information::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
+    if body.user_id.server_name() != services().globals.server_name() {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Tried to access user from other server.",
+        ));
     }
 
     let mut displayname = None;
@@ -1864,8 +1871,15 @@ pub async fn get_profile_information_route(
 ///
 /// Gets devices and identity keys for the given users.
 pub async fn get_keys_route(body: Ruma<get_keys::v1::Request>) -> Result<get_keys::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
+    if body
+        .device_keys
+        .iter()
+        .any(|(u, _)| u.server_name() != services().globals.server_name())
+    {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Tried to access user from other server.",
+        ));
     }
 
     let result = get_keys_helper(None, &body.device_keys, |u| {
@@ -1886,8 +1900,15 @@ pub async fn get_keys_route(body: Ruma<get_keys::v1::Request>) -> Result<get_key
 pub async fn claim_keys_route(
     body: Ruma<claim_keys::v1::Request>,
 ) -> Result<claim_keys::v1::Response> {
-    if !services().globals.allow_federation() {
-        return Err(Error::bad_config("Federation is disabled."));
+    if body
+        .one_time_keys
+        .iter()
+        .any(|(u, _)| u.server_name() != services().globals.server_name())
+    {
+        return Err(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Tried to access user from other server.",
+        ));
     }
 
     let result = claim_keys_helper(&body.one_time_keys).await?;
diff --git a/src/clap.rs b/src/clap.rs
new file mode 100644
index 00000000..170d2a17
--- /dev/null
+++ b/src/clap.rs
@@ -0,0 +1,27 @@
+//! Integration with `clap`
+
+use clap::Parser;
+
+/// Returns the current version of the crate with extra info if supplied
+///
+/// Set the environment variable `CONDUIT_VERSION_EXTRA` to any UTF-8 string to
+/// include it in parenthesis after the SemVer version. A common value are git
+/// commit hashes.
+fn version() -> String {
+    let cargo_pkg_version = env!("CARGO_PKG_VERSION");
+
+    match option_env!("CONDUIT_VERSION_EXTRA") {
+        Some(x) => format!("{} ({})", cargo_pkg_version, x),
+        None => cargo_pkg_version.to_owned(),
+    }
+}
+
+/// Command line arguments
+#[derive(Parser)]
+#[clap(about, version = version())]
+pub struct Args {}
+
+/// Parse command line arguments into structured data
+pub fn parse() -> Args {
+    Args::parse()
+}
diff --git a/src/config/mod.rs b/src/config/mod.rs
index 31a586f2..4605855f 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -28,6 +28,8 @@ pub struct Config {
     pub db_cache_capacity_mb: f64,
     #[serde(default = "true_fn")]
     pub enable_lightning_bolt: bool,
+    #[serde(default = "true_fn")]
+    pub allow_check_for_updates: bool,
     #[serde(default = "default_conduit_cache_capacity_modifier")]
     pub conduit_cache_capacity_modifier: f64,
     #[serde(default = "default_rocksdb_max_open_files")]
@@ -44,6 +46,7 @@ pub struct Config {
     pub max_fetch_prev_events: u16,
     #[serde(default = "false_fn")]
     pub allow_registration: bool,
+    pub registration_token: Option<String>,
     #[serde(default = "true_fn")]
     pub allow_encryption: bool,
     #[serde(default = "false_fn")]
@@ -54,6 +57,7 @@ pub struct Config {
     pub allow_unstable_room_versions: bool,
     #[serde(default = "default_default_room_version")]
     pub default_room_version: RoomVersionId,
+    pub well_known_client: Option<String>,
     #[serde(default = "false_fn")]
     pub allow_jaeger: bool,
     #[serde(default = "false_fn")]
@@ -61,7 +65,7 @@ pub struct Config {
     #[serde(default)]
     pub proxy: ProxyConfig,
     pub jwt_secret: Option<String>,
-    #[serde(default = "Vec::new")]
+    #[serde(default = "default_trusted_servers")]
     pub trusted_servers: Vec<OwnedServerName>,
     #[serde(default = "default_log")]
     pub log: String,
@@ -224,7 +228,7 @@ fn default_database_backend() -> String {
 }
 
 fn default_db_cache_capacity_mb() -> f64 {
-    1000.0
+    300.0
 }
 
 fn default_conduit_cache_capacity_modifier() -> f64 {
@@ -255,8 +259,12 @@ fn default_max_fetch_prev_events() -> u16 {
     100_u16
 }
 
+fn default_trusted_servers() -> Vec<OwnedServerName> {
+    vec![OwnedServerName::try_from("matrix.org").unwrap()]
+}
+
 fn default_log() -> String {
-    "warn,state_res=warn,_=off,sled=off".to_owned()
+    "warn,state_res=warn,_=off".to_owned()
 }
 
 fn default_turn_ttl() -> u64 {
diff --git a/src/config/proxy.rs b/src/config/proxy.rs
index dcf304e9..c03463e7 100644
--- a/src/config/proxy.rs
+++ b/src/config/proxy.rs
@@ -29,7 +29,9 @@ use crate::Result;
 /// would be used for `ordinary.onion`, `matrix.myspecial.onion`, but not `hello.myspecial.onion`.
 #[derive(Clone, Debug, Deserialize)]
 #[serde(rename_all = "snake_case")]
+#[derive(Default)]
 pub enum ProxyConfig {
+    #[default]
     None,
     Global {
         #[serde(deserialize_with = "crate::utils::deserialize_from_str")]
@@ -48,11 +50,6 @@ impl ProxyConfig {
         })
     }
 }
-impl Default for ProxyConfig {
-    fn default() -> Self {
-        ProxyConfig::None
-    }
-}
 
 #[derive(Clone, Debug, Deserialize)]
 pub struct PartialProxyConfig {
diff --git a/src/database/abstraction.rs b/src/database/abstraction.rs
index 93660f9f..0a321054 100644
--- a/src/database/abstraction.rs
+++ b/src/database/abstraction.rs
@@ -38,6 +38,7 @@ pub trait KeyValueDatabaseEngine: Send + Sync {
     fn memory_usage(&self) -> Result<String> {
         Ok("Current database engine does not support memory usage reporting.".to_owned())
     }
+    fn clear_caches(&self) {}
 }
 
 pub trait KvTree: Send + Sync {
diff --git a/src/database/abstraction/persy.rs b/src/database/abstraction/persy.rs
index 1fa7a0df..da7d4cf0 100644
--- a/src/database/abstraction/persy.rs
+++ b/src/database/abstraction/persy.rs
@@ -116,7 +116,7 @@ impl KvTree for PersyTree {
         match iter {
             Ok(iter) => Box::new(iter.filter_map(|(k, v)| {
                 v.into_iter()
-                    .map(|val| ((*k).to_owned().into(), (*val).to_owned().into()))
+                    .map(|val| ((*k).to_owned(), (*val).to_owned()))
                     .next()
             })),
             Err(e) => {
@@ -142,7 +142,7 @@ impl KvTree for PersyTree {
             Ok(iter) => {
                 let map = iter.filter_map(|(k, v)| {
                     v.into_iter()
-                        .map(|val| ((*k).to_owned().into(), (*val).to_owned().into()))
+                        .map(|val| ((*k).to_owned(), (*val).to_owned()))
                         .next()
                 });
                 if backwards {
@@ -179,7 +179,7 @@ impl KvTree for PersyTree {
                     iter.take_while(move |(k, _)| (*k).starts_with(&owned_prefix))
                         .filter_map(|(k, v)| {
                             v.into_iter()
-                                .map(|val| ((*k).to_owned().into(), (*val).to_owned().into()))
+                                .map(|val| ((*k).to_owned(), (*val).to_owned()))
                                 .next()
                         }),
                 )
diff --git a/src/database/abstraction/rocksdb.rs b/src/database/abstraction/rocksdb.rs
index 34d91d29..447ee038 100644
--- a/src/database/abstraction/rocksdb.rs
+++ b/src/database/abstraction/rocksdb.rs
@@ -23,30 +23,35 @@ pub struct RocksDbEngineTree<'a> {
 fn db_options(max_open_files: i32, rocksdb_cache: &rocksdb::Cache) -> rocksdb::Options {
     let mut block_based_options = rocksdb::BlockBasedOptions::default();
     block_based_options.set_block_cache(rocksdb_cache);
-
-    // "Difference of spinning disk"
-    // https://zhangyuchi.gitbooks.io/rocksdbbook/content/RocksDB-Tuning-Guide.html
+    block_based_options.set_bloom_filter(10.0, false);
     block_based_options.set_block_size(4 * 1024);
     block_based_options.set_cache_index_and_filter_blocks(true);
+    block_based_options.set_pin_l0_filter_and_index_blocks_in_cache(true);
+    block_based_options.set_optimize_filters_for_memory(true);
 
     let mut db_opts = rocksdb::Options::default();
     db_opts.set_block_based_table_factory(&block_based_options);
-    db_opts.set_optimize_filters_for_hits(true);
-    db_opts.set_skip_stats_update_on_db_open(true);
-    db_opts.set_level_compaction_dynamic_level_bytes(true);
-    db_opts.set_target_file_size_base(256 * 1024 * 1024);
-    //db_opts.set_compaction_readahead_size(2 * 1024 * 1024);
-    //db_opts.set_use_direct_reads(true);
-    //db_opts.set_use_direct_io_for_flush_and_compaction(true);
     db_opts.create_if_missing(true);
     db_opts.increase_parallelism(num_cpus::get() as i32);
     db_opts.set_max_open_files(max_open_files);
-    db_opts.set_compression_type(rocksdb::DBCompressionType::Zstd);
+    db_opts.set_compression_type(rocksdb::DBCompressionType::Lz4);
+    db_opts.set_bottommost_compression_type(rocksdb::DBCompressionType::Zstd);
     db_opts.set_compaction_style(rocksdb::DBCompactionStyle::Level);
-    db_opts.optimize_level_style_compaction(10 * 1024 * 1024);
 
-    let prefix_extractor = rocksdb::SliceTransform::create_fixed_prefix(1);
-    db_opts.set_prefix_extractor(prefix_extractor);
+    // https://github.com/facebook/rocksdb/wiki/Setup-Options-and-Basic-Tuning
+    db_opts.set_level_compaction_dynamic_level_bytes(true);
+    db_opts.set_max_background_jobs(6);
+    db_opts.set_bytes_per_sync(1048576);
+
+    // https://github.com/facebook/rocksdb/issues/849
+    db_opts.set_keep_log_file_num(100);
+
+    // https://github.com/facebook/rocksdb/wiki/WAL-Recovery-Modes#ktoleratecorruptedtailrecords
+    //
+    // Unclean shutdowns of a Matrix homeserver are likely to be fine when
+    // recovered in this manner as it's likely any lost information will be
+    // restored via federation.
+    db_opts.set_wal_recovery_mode(rocksdb::DBRecoveryMode::TolerateCorruptedTailRecords);
 
     db_opts
 }
@@ -54,7 +59,7 @@ fn db_options(max_open_files: i32, rocksdb_cache: &rocksdb::Cache) -> rocksdb::O
 impl KeyValueDatabaseEngine for Arc<Engine> {
     fn open(config: &Config) -> Result<Self> {
         let cache_capacity_bytes = (config.db_cache_capacity_mb * 1024.0 * 1024.0) as usize;
-        let rocksdb_cache = rocksdb::Cache::new_lru_cache(cache_capacity_bytes).unwrap();
+        let rocksdb_cache = rocksdb::Cache::new_lru_cache(cache_capacity_bytes);
 
         let db_opts = db_options(config.rocksdb_max_open_files, &rocksdb_cache);
 
@@ -121,6 +126,8 @@ impl KeyValueDatabaseEngine for Arc<Engine> {
             self.cache.get_pinned_usage() as f64 / 1024.0 / 1024.0,
         ))
     }
+
+    fn clear_caches(&self) {}
 }
 
 impl RocksDbEngineTree<'_> {
@@ -131,12 +138,17 @@ impl RocksDbEngineTree<'_> {
 
 impl KvTree for RocksDbEngineTree<'_> {
     fn get(&self, key: &[u8]) -> Result<Option<Vec<u8>>> {
-        Ok(self.db.rocks.get_cf(&self.cf(), key)?)
+        let readoptions = rocksdb::ReadOptions::default();
+
+        Ok(self.db.rocks.get_cf_opt(&self.cf(), key, &readoptions)?)
     }
 
     fn insert(&self, key: &[u8], value: &[u8]) -> Result<()> {
+        let writeoptions = rocksdb::WriteOptions::default();
         let lock = self.write_lock.read().unwrap();
-        self.db.rocks.put_cf(&self.cf(), key, value)?;
+        self.db
+            .rocks
+            .put_cf_opt(&self.cf(), key, value, &writeoptions)?;
         drop(lock);
 
         self.watchers.wake(key);
@@ -145,23 +157,32 @@ impl KvTree for RocksDbEngineTree<'_> {
     }
 
     fn insert_batch<'a>(&self, iter: &mut dyn Iterator<Item = (Vec<u8>, Vec<u8>)>) -> Result<()> {
+        let writeoptions = rocksdb::WriteOptions::default();
         for (key, value) in iter {
-            self.db.rocks.put_cf(&self.cf(), key, value)?;
+            self.db
+                .rocks
+                .put_cf_opt(&self.cf(), key, value, &writeoptions)?;
         }
 
         Ok(())
     }
 
     fn remove(&self, key: &[u8]) -> Result<()> {
-        Ok(self.db.rocks.delete_cf(&self.cf(), key)?)
+        let writeoptions = rocksdb::WriteOptions::default();
+        Ok(self
+            .db
+            .rocks
+            .delete_cf_opt(&self.cf(), key, &writeoptions)?)
     }
 
     fn iter<'a>(&'a self) -> Box<dyn Iterator<Item = (Vec<u8>, Vec<u8>)> + 'a> {
+        let readoptions = rocksdb::ReadOptions::default();
+
         Box::new(
             self.db
                 .rocks
-                .iterator_cf(&self.cf(), rocksdb::IteratorMode::Start)
-                //.map(|r| r.unwrap())
+                .iterator_cf_opt(&self.cf(), readoptions, rocksdb::IteratorMode::Start)
+                .map(|r| r.unwrap())
                 .map(|(k, v)| (Vec::from(k), Vec::from(v))),
         )
     }
@@ -171,11 +192,14 @@ impl KvTree for RocksDbEngineTree<'_> {
         from: &[u8],
         backwards: bool,
     ) -> Box<dyn Iterator<Item = (Vec<u8>, Vec<u8>)> + 'a> {
+        let readoptions = rocksdb::ReadOptions::default();
+
         Box::new(
             self.db
                 .rocks
-                .iterator_cf(
+                .iterator_cf_opt(
                     &self.cf(),
+                    readoptions,
                     rocksdb::IteratorMode::From(
                         from,
                         if backwards {
@@ -185,29 +209,39 @@ impl KvTree for RocksDbEngineTree<'_> {
                         },
                     ),
                 )
-                //.map(|r| r.unwrap())
+                .map(|r| r.unwrap())
                 .map(|(k, v)| (Vec::from(k), Vec::from(v))),
         )
     }
 
     fn increment(&self, key: &[u8]) -> Result<Vec<u8>> {
+        let readoptions = rocksdb::ReadOptions::default();
+        let writeoptions = rocksdb::WriteOptions::default();
+
         let lock = self.write_lock.write().unwrap();
 
-        let old = self.db.rocks.get_cf(&self.cf(), key)?;
+        let old = self.db.rocks.get_cf_opt(&self.cf(), key, &readoptions)?;
         let new = utils::increment(old.as_deref()).unwrap();
-        self.db.rocks.put_cf(&self.cf(), key, &new)?;
+        self.db
+            .rocks
+            .put_cf_opt(&self.cf(), key, &new, &writeoptions)?;
 
         drop(lock);
         Ok(new)
     }
 
     fn increment_batch<'a>(&self, iter: &mut dyn Iterator<Item = Vec<u8>>) -> Result<()> {
+        let readoptions = rocksdb::ReadOptions::default();
+        let writeoptions = rocksdb::WriteOptions::default();
+
         let lock = self.write_lock.write().unwrap();
 
         for key in iter {
-            let old = self.db.rocks.get_cf(&self.cf(), &key)?;
+            let old = self.db.rocks.get_cf_opt(&self.cf(), &key, &readoptions)?;
             let new = utils::increment(old.as_deref()).unwrap();
-            self.db.rocks.put_cf(&self.cf(), key, new)?;
+            self.db
+                .rocks
+                .put_cf_opt(&self.cf(), key, new, &writeoptions)?;
         }
 
         drop(lock);
@@ -219,14 +253,17 @@ impl KvTree for RocksDbEngineTree<'_> {
         &'a self,
         prefix: Vec<u8>,
     ) -> Box<dyn Iterator<Item = (Vec<u8>, Vec<u8>)> + 'a> {
+        let readoptions = rocksdb::ReadOptions::default();
+
         Box::new(
             self.db
                 .rocks
-                .iterator_cf(
+                .iterator_cf_opt(
                     &self.cf(),
+                    readoptions,
                     rocksdb::IteratorMode::From(&prefix, rocksdb::Direction::Forward),
                 )
-                //.map(|r| r.unwrap())
+                .map(|r| r.unwrap())
                 .map(|(k, v)| (Vec::from(k), Vec::from(v)))
                 .take_while(move |(k, _)| k.starts_with(&prefix)),
         )
diff --git a/src/database/abstraction/sqlite.rs b/src/database/abstraction/sqlite.rs
index b69efb61..222a8433 100644
--- a/src/database/abstraction/sqlite.rs
+++ b/src/database/abstraction/sqlite.rs
@@ -33,7 +33,7 @@ impl Iterator for PreparedStatementIterator<'_> {
 struct NonAliasingBox<T>(*mut T);
 impl<T> Drop for NonAliasingBox<T> {
     fn drop(&mut self) {
-        unsafe { Box::from_raw(self.0) };
+        drop(unsafe { Box::from_raw(self.0) });
     }
 }
 
diff --git a/src/database/abstraction/watchers.rs b/src/database/abstraction/watchers.rs
index 55cb60b3..01156abd 100644
--- a/src/database/abstraction/watchers.rs
+++ b/src/database/abstraction/watchers.rs
@@ -8,6 +8,7 @@ use tokio::sync::watch;
 
 #[derive(Default)]
 pub(super) struct Watchers {
+    #[allow(clippy::type_complexity)]
     watchers: RwLock<HashMap<Vec<u8>, (watch::Sender<()>, watch::Receiver<()>)>>,
 }
 
diff --git a/src/database/key_value/account_data.rs b/src/database/key_value/account_data.rs
index e1eef966..970b36b5 100644
--- a/src/database/key_value/account_data.rs
+++ b/src/database/key_value/account_data.rs
@@ -123,13 +123,12 @@ impl service::account_data::Data for KeyValueDatabase {
             .take_while(move |(k, _)| k.starts_with(&prefix))
             .map(|(k, v)| {
                 Ok::<_, Error>((
-                    RoomAccountDataEventType::try_from(
+                    RoomAccountDataEventType::from(
                         utils::string_from_bytes(k.rsplit(|&b| b == 0xff).next().ok_or_else(
                             || Error::bad_database("RoomUserData ID in db is invalid."),
                         )?)
                         .map_err(|_| Error::bad_database("RoomUserData ID in db is invalid."))?,
-                    )
-                    .map_err(|_| Error::bad_database("RoomUserData ID in db is invalid."))?,
+                    ),
                     serde_json::from_slice::<Raw<AnyEphemeralRoomEvent>>(&v).map_err(|_| {
                         Error::bad_database("Database contains invalid account data.")
                     })?,
diff --git a/src/database/key_value/appservice.rs b/src/database/key_value/appservice.rs
index 9a821a65..b547e66a 100644
--- a/src/database/key_value/appservice.rs
+++ b/src/database/key_value/appservice.rs
@@ -1,18 +1,15 @@
+use ruma::api::appservice::Registration;
+
 use crate::{database::KeyValueDatabase, service, utils, Error, Result};
 
 impl service::appservice::Data for KeyValueDatabase {
     /// Registers an appservice and returns the ID to the caller
-    fn register_appservice(&self, yaml: serde_yaml::Value) -> Result<String> {
-        // TODO: Rumaify
-        let id = yaml.get("id").unwrap().as_str().unwrap();
+    fn register_appservice(&self, yaml: Registration) -> Result<String> {
+        let id = yaml.id.as_str();
         self.id_appserviceregistrations.insert(
             id.as_bytes(),
             serde_yaml::to_string(&yaml).unwrap().as_bytes(),
         )?;
-        self.cached_registrations
-            .write()
-            .unwrap()
-            .insert(id.to_owned(), yaml.to_owned());
 
         Ok(id.to_owned())
     }
@@ -25,33 +22,18 @@ impl service::appservice::Data for KeyValueDatabase {
     fn unregister_appservice(&self, service_name: &str) -> Result<()> {
         self.id_appserviceregistrations
             .remove(service_name.as_bytes())?;
-        self.cached_registrations
-            .write()
-            .unwrap()
-            .remove(service_name);
         Ok(())
     }
 
-    fn get_registration(&self, id: &str) -> Result<Option<serde_yaml::Value>> {
-        self.cached_registrations
-            .read()
-            .unwrap()
-            .get(id)
-            .map_or_else(
-                || {
-                    self.id_appserviceregistrations
-                        .get(id.as_bytes())?
-                        .map(|bytes| {
-                            serde_yaml::from_slice(&bytes).map_err(|_| {
-                                Error::bad_database(
-                                    "Invalid registration bytes in id_appserviceregistrations.",
-                                )
-                            })
-                        })
-                        .transpose()
-                },
-                |r| Ok(Some(r.clone())),
-            )
+    fn get_registration(&self, id: &str) -> Result<Option<Registration>> {
+        self.id_appserviceregistrations
+            .get(id.as_bytes())?
+            .map(|bytes| {
+                serde_yaml::from_slice(&bytes).map_err(|_| {
+                    Error::bad_database("Invalid registration bytes in id_appserviceregistrations.")
+                })
+            })
+            .transpose()
     }
 
     fn iter_ids<'a>(&'a self) -> Result<Box<dyn Iterator<Item = Result<String>> + 'a>> {
@@ -64,7 +46,7 @@ impl service::appservice::Data for KeyValueDatabase {
         )))
     }
 
-    fn all(&self) -> Result<Vec<(String, serde_yaml::Value)>> {
+    fn all(&self) -> Result<Vec<(String, Registration)>> {
         self.iter_ids()?
             .filter_map(|id| id.ok())
             .map(move |id| {
diff --git a/src/database/key_value/globals.rs b/src/database/key_value/globals.rs
index 7b7675ca..2851ce53 100644
--- a/src/database/key_value/globals.rs
+++ b/src/database/key_value/globals.rs
@@ -1,7 +1,8 @@
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, HashMap};
 
 use async_trait::async_trait;
 use futures_util::{stream::FuturesUnordered, StreamExt};
+use lru_cache::LruCache;
 use ruma::{
     api::federation::discovery::{ServerSigningKeys, VerifyKey},
     signatures::Ed25519KeyPair,
@@ -11,6 +12,7 @@ use ruma::{
 use crate::{database::KeyValueDatabase, service, services, utils, Error, Result};
 
 pub const COUNTER: &[u8] = b"c";
+pub const LAST_CHECK_FOR_UPDATES_COUNT: &[u8] = b"u";
 
 #[async_trait]
 impl service::globals::Data for KeyValueDatabase {
@@ -26,6 +28,23 @@ impl service::globals::Data for KeyValueDatabase {
         })
     }
 
+    fn last_check_for_updates_id(&self) -> Result<u64> {
+        self.global
+            .get(LAST_CHECK_FOR_UPDATES_COUNT)?
+            .map_or(Ok(0_u64), |bytes| {
+                utils::u64_from_bytes(&bytes).map_err(|_| {
+                    Error::bad_database("last check for updates count has invalid bytes.")
+                })
+            })
+    }
+
+    fn update_check_for_updates_id(&self, id: u64) -> Result<()> {
+        self.global
+            .insert(LAST_CHECK_FOR_UPDATES_COUNT, &id.to_be_bytes())?;
+
+        Ok(())
+    }
+
     async fn watch(&self, user_id: &UserId, device_id: &DeviceId) -> Result<()> {
         let userid_bytes = user_id.as_bytes().to_vec();
         let mut userid_prefix = userid_bytes.clone();
@@ -75,7 +94,9 @@ impl service::globals::Data for KeyValueDatabase {
             futures.push(self.pduid_pdu.watch_prefix(&short_roomid));
 
             // EDUs
-            futures.push(self.roomid_lasttypingupdate.watch_prefix(&roomid_bytes));
+            futures.push(Box::into_pin(Box::new(async move {
+                let _result = services().rooms.edus.typing.wait_for_update(&room_id).await;
+            })));
 
             futures.push(self.readreceiptid_readreceipt.watch_prefix(&roomid_prefix));
 
@@ -118,8 +139,67 @@ impl service::globals::Data for KeyValueDatabase {
         self._db.cleanup()
     }
 
-    fn memory_usage(&self) -> Result<String> {
-        self._db.memory_usage()
+    fn memory_usage(&self) -> String {
+        let pdu_cache = self.pdu_cache.lock().unwrap().len();
+        let shorteventid_cache = self.shorteventid_cache.lock().unwrap().len();
+        let auth_chain_cache = self.auth_chain_cache.lock().unwrap().len();
+        let eventidshort_cache = self.eventidshort_cache.lock().unwrap().len();
+        let statekeyshort_cache = self.statekeyshort_cache.lock().unwrap().len();
+        let our_real_users_cache = self.our_real_users_cache.read().unwrap().len();
+        let appservice_in_room_cache = self.appservice_in_room_cache.read().unwrap().len();
+        let lasttimelinecount_cache = self.lasttimelinecount_cache.lock().unwrap().len();
+
+        let mut response = format!(
+            "\
+pdu_cache: {pdu_cache}
+shorteventid_cache: {shorteventid_cache}
+auth_chain_cache: {auth_chain_cache}
+eventidshort_cache: {eventidshort_cache}
+statekeyshort_cache: {statekeyshort_cache}
+our_real_users_cache: {our_real_users_cache}
+appservice_in_room_cache: {appservice_in_room_cache}
+lasttimelinecount_cache: {lasttimelinecount_cache}\n"
+        );
+        if let Ok(db_stats) = self._db.memory_usage() {
+            response += &db_stats;
+        }
+
+        response
+    }
+
+    fn clear_caches(&self, amount: u32) {
+        if amount > 0 {
+            let c = &mut *self.pdu_cache.lock().unwrap();
+            *c = LruCache::new(c.capacity());
+        }
+        if amount > 1 {
+            let c = &mut *self.shorteventid_cache.lock().unwrap();
+            *c = LruCache::new(c.capacity());
+        }
+        if amount > 2 {
+            let c = &mut *self.auth_chain_cache.lock().unwrap();
+            *c = LruCache::new(c.capacity());
+        }
+        if amount > 3 {
+            let c = &mut *self.eventidshort_cache.lock().unwrap();
+            *c = LruCache::new(c.capacity());
+        }
+        if amount > 4 {
+            let c = &mut *self.statekeyshort_cache.lock().unwrap();
+            *c = LruCache::new(c.capacity());
+        }
+        if amount > 5 {
+            let c = &mut *self.our_real_users_cache.write().unwrap();
+            *c = HashMap::new();
+        }
+        if amount > 6 {
+            let c = &mut *self.appservice_in_room_cache.write().unwrap();
+            *c = HashMap::new();
+        }
+        if amount > 7 {
+            let c = &mut *self.lasttimelinecount_cache.lock().unwrap();
+            *c = HashMap::new();
+        }
     }
 
     fn load_keypair(&self) -> Result<Ed25519KeyPair> {
@@ -178,8 +258,8 @@ impl service::globals::Data for KeyValueDatabase {
             ..
         } = new_keys;
 
-        keys.verify_keys.extend(verify_keys.into_iter());
-        keys.old_verify_keys.extend(old_verify_keys.into_iter());
+        keys.verify_keys.extend(verify_keys);
+        keys.old_verify_keys.extend(old_verify_keys);
 
         self.server_signingkeys.insert(
             origin.as_bytes(),
diff --git a/src/database/key_value/rooms/edus/mod.rs b/src/database/key_value/rooms/edus/mod.rs
index 6c652918..7abf946f 100644
--- a/src/database/key_value/rooms/edus/mod.rs
+++ b/src/database/key_value/rooms/edus/mod.rs
@@ -1,6 +1,5 @@
 mod presence;
 mod read_receipt;
-mod typing;
 
 use crate::{database::KeyValueDatabase, service};
 
diff --git a/src/database/key_value/rooms/edus/typing.rs b/src/database/key_value/rooms/edus/typing.rs
deleted file mode 100644
index 5709192c..00000000
--- a/src/database/key_value/rooms/edus/typing.rs
+++ /dev/null
@@ -1,127 +0,0 @@
-use std::{collections::HashSet, mem};
-
-use ruma::{OwnedUserId, RoomId, UserId};
-
-use crate::{database::KeyValueDatabase, service, services, utils, Error, Result};
-
-impl service::rooms::edus::typing::Data for KeyValueDatabase {
-    fn typing_add(&self, user_id: &UserId, room_id: &RoomId, timeout: u64) -> Result<()> {
-        let mut prefix = room_id.as_bytes().to_vec();
-        prefix.push(0xff);
-
-        let count = services().globals.next_count()?.to_be_bytes();
-
-        let mut room_typing_id = prefix;
-        room_typing_id.extend_from_slice(&timeout.to_be_bytes());
-        room_typing_id.push(0xff);
-        room_typing_id.extend_from_slice(&count);
-
-        self.typingid_userid
-            .insert(&room_typing_id, user_id.as_bytes())?;
-
-        self.roomid_lasttypingupdate
-            .insert(room_id.as_bytes(), &count)?;
-
-        Ok(())
-    }
-
-    fn typing_remove(&self, user_id: &UserId, room_id: &RoomId) -> Result<()> {
-        let mut prefix = room_id.as_bytes().to_vec();
-        prefix.push(0xff);
-
-        let user_id = user_id.to_string();
-
-        let mut found_outdated = false;
-
-        // Maybe there are multiple ones from calling roomtyping_add multiple times
-        for outdated_edu in self
-            .typingid_userid
-            .scan_prefix(prefix)
-            .filter(|(_, v)| &**v == user_id.as_bytes())
-        {
-            self.typingid_userid.remove(&outdated_edu.0)?;
-            found_outdated = true;
-        }
-
-        if found_outdated {
-            self.roomid_lasttypingupdate.insert(
-                room_id.as_bytes(),
-                &services().globals.next_count()?.to_be_bytes(),
-            )?;
-        }
-
-        Ok(())
-    }
-
-    fn typings_maintain(&self, room_id: &RoomId) -> Result<()> {
-        let mut prefix = room_id.as_bytes().to_vec();
-        prefix.push(0xff);
-
-        let current_timestamp = utils::millis_since_unix_epoch();
-
-        let mut found_outdated = false;
-
-        // Find all outdated edus before inserting a new one
-        for outdated_edu in self
-            .typingid_userid
-            .scan_prefix(prefix)
-            .map(|(key, _)| {
-                Ok::<_, Error>((
-                    key.clone(),
-                    utils::u64_from_bytes(
-                        &key.splitn(2, |&b| b == 0xff).nth(1).ok_or_else(|| {
-                            Error::bad_database("RoomTyping has invalid timestamp or delimiters.")
-                        })?[0..mem::size_of::<u64>()],
-                    )
-                    .map_err(|_| Error::bad_database("RoomTyping has invalid timestamp bytes."))?,
-                ))
-            })
-            .filter_map(|r| r.ok())
-            .take_while(|&(_, timestamp)| timestamp < current_timestamp)
-        {
-            // This is an outdated edu (time > timestamp)
-            self.typingid_userid.remove(&outdated_edu.0)?;
-            found_outdated = true;
-        }
-
-        if found_outdated {
-            self.roomid_lasttypingupdate.insert(
-                room_id.as_bytes(),
-                &services().globals.next_count()?.to_be_bytes(),
-            )?;
-        }
-
-        Ok(())
-    }
-
-    fn last_typing_update(&self, room_id: &RoomId) -> Result<u64> {
-        Ok(self
-            .roomid_lasttypingupdate
-            .get(room_id.as_bytes())?
-            .map(|bytes| {
-                utils::u64_from_bytes(&bytes).map_err(|_| {
-                    Error::bad_database("Count in roomid_lastroomactiveupdate is invalid.")
-                })
-            })
-            .transpose()?
-            .unwrap_or(0))
-    }
-
-    fn typings_all(&self, room_id: &RoomId) -> Result<HashSet<OwnedUserId>> {
-        let mut prefix = room_id.as_bytes().to_vec();
-        prefix.push(0xff);
-
-        let mut user_ids = HashSet::new();
-
-        for (_, user_id) in self.typingid_userid.scan_prefix(prefix) {
-            let user_id = UserId::parse(utils::string_from_bytes(&user_id).map_err(|_| {
-                Error::bad_database("User ID in typingid_userid is invalid unicode.")
-            })?)
-            .map_err(|_| Error::bad_database("User ID in typingid_userid is invalid."))?;
-
-            user_ids.insert(user_id);
-        }
-
-        Ok(user_ids)
-    }
-}
diff --git a/src/database/key_value/rooms/mod.rs b/src/database/key_value/rooms/mod.rs
index 406943ed..e7b53d30 100644
--- a/src/database/key_value/rooms/mod.rs
+++ b/src/database/key_value/rooms/mod.rs
@@ -12,6 +12,7 @@ mod state;
 mod state_accessor;
 mod state_cache;
 mod state_compressor;
+mod threads;
 mod timeline;
 mod user;
 
diff --git a/src/database/key_value/rooms/pdu_metadata.rs b/src/database/key_value/rooms/pdu_metadata.rs
index 76ec7346..0641f9d8 100644
--- a/src/database/key_value/rooms/pdu_metadata.rs
+++ b/src/database/key_value/rooms/pdu_metadata.rs
@@ -1,10 +1,64 @@
-use std::sync::Arc;
+use std::{mem, sync::Arc};
 
-use ruma::{EventId, RoomId};
+use ruma::{EventId, RoomId, UserId};
 
-use crate::{database::KeyValueDatabase, service, Result};
+use crate::{
+    database::KeyValueDatabase,
+    service::{self, rooms::timeline::PduCount},
+    services, utils, Error, PduEvent, Result,
+};
 
 impl service::rooms::pdu_metadata::Data for KeyValueDatabase {
+    fn add_relation(&self, from: u64, to: u64) -> Result<()> {
+        let mut key = to.to_be_bytes().to_vec();
+        key.extend_from_slice(&from.to_be_bytes());
+        self.tofrom_relation.insert(&key, &[])?;
+        Ok(())
+    }
+
+    fn relations_until<'a>(
+        &'a self,
+        user_id: &'a UserId,
+        shortroomid: u64,
+        target: u64,
+        until: PduCount,
+    ) -> Result<Box<dyn Iterator<Item = Result<(PduCount, PduEvent)>> + 'a>> {
+        let prefix = target.to_be_bytes().to_vec();
+        let mut current = prefix.clone();
+
+        let count_raw = match until {
+            PduCount::Normal(x) => x - 1,
+            PduCount::Backfilled(x) => {
+                current.extend_from_slice(&0_u64.to_be_bytes());
+                u64::MAX - x - 1
+            }
+        };
+        current.extend_from_slice(&count_raw.to_be_bytes());
+
+        Ok(Box::new(
+            self.tofrom_relation
+                .iter_from(&current, true)
+                .take_while(move |(k, _)| k.starts_with(&prefix))
+                .map(move |(tofrom, _data)| {
+                    let from = utils::u64_from_bytes(&tofrom[(mem::size_of::<u64>())..])
+                        .map_err(|_| Error::bad_database("Invalid count in tofrom_relation."))?;
+
+                    let mut pduid = shortroomid.to_be_bytes().to_vec();
+                    pduid.extend_from_slice(&from.to_be_bytes());
+
+                    let mut pdu = services()
+                        .rooms
+                        .timeline
+                        .get_pdu_from_id(&pduid)?
+                        .ok_or_else(|| Error::bad_database("Pdu in tofrom_relation is invalid."))?;
+                    if pdu.sender != user_id {
+                        pdu.remove_transaction_id()?;
+                    }
+                    Ok((PduCount::Normal(from), pdu))
+                }),
+        ))
+    }
+
     fn mark_as_referenced(&self, room_id: &RoomId, event_ids: &[Arc<EventId>]) -> Result<()> {
         for prev in event_ids {
             let mut key = room_id.as_bytes().to_vec();
diff --git a/src/database/key_value/rooms/short.rs b/src/database/key_value/rooms/short.rs
index c0223170..98cfa48a 100644
--- a/src/database/key_value/rooms/short.rs
+++ b/src/database/key_value/rooms/short.rs
@@ -157,10 +157,9 @@ impl service::rooms::short::Data for KeyValueDatabase {
             .ok_or_else(|| Error::bad_database("Invalid statekey in shortstatekey_statekey."))?;
 
         let event_type =
-            StateEventType::try_from(utils::string_from_bytes(eventtype_bytes).map_err(|_| {
+            StateEventType::from(utils::string_from_bytes(eventtype_bytes).map_err(|_| {
                 Error::bad_database("Event type in shortstatekey_statekey is invalid unicode.")
-            })?)
-            .map_err(|_| Error::bad_database("Event type in shortstatekey_statekey is invalid."))?;
+            })?);
 
         let state_key = utils::string_from_bytes(statekey_bytes).map_err(|_| {
             Error::bad_database("Statekey in shortstatekey_statekey is invalid unicode.")
diff --git a/src/database/key_value/rooms/state_accessor.rs b/src/database/key_value/rooms/state_accessor.rs
index 0f0c0dc7..fe40b937 100644
--- a/src/database/key_value/rooms/state_accessor.rs
+++ b/src/database/key_value/rooms/state_accessor.rs
@@ -16,11 +16,11 @@ impl service::rooms::state_accessor::Data for KeyValueDatabase {
             .1;
         let mut result = HashMap::new();
         let mut i = 0;
-        for compressed in full_state.into_iter() {
+        for compressed in full_state.iter() {
             let parsed = services()
                 .rooms
                 .state_compressor
-                .parse_compressed_state_event(&compressed)?;
+                .parse_compressed_state_event(compressed)?;
             result.insert(parsed.0, parsed.1);
 
             i += 1;
@@ -45,11 +45,11 @@ impl service::rooms::state_accessor::Data for KeyValueDatabase {
 
         let mut result = HashMap::new();
         let mut i = 0;
-        for compressed in full_state {
+        for compressed in full_state.iter() {
             let (_, eventid) = services()
                 .rooms
                 .state_compressor
-                .parse_compressed_state_event(&compressed)?;
+                .parse_compressed_state_event(compressed)?;
             if let Some(pdu) = services().rooms.timeline.get_pdu(&eventid)? {
                 result.insert(
                     (
@@ -95,13 +95,13 @@ impl service::rooms::state_accessor::Data for KeyValueDatabase {
             .expect("there is always one layer")
             .1;
         Ok(full_state
-            .into_iter()
+            .iter()
             .find(|bytes| bytes.starts_with(&shortstatekey.to_be_bytes()))
             .and_then(|compressed| {
                 services()
                     .rooms
                     .state_compressor
-                    .parse_compressed_state_event(&compressed)
+                    .parse_compressed_state_event(compressed)
                     .ok()
                     .map(|(_, id)| id)
             }))
diff --git a/src/database/key_value/rooms/state_cache.rs b/src/database/key_value/rooms/state_cache.rs
index d0ea0c2c..49e3842b 100644
--- a/src/database/key_value/rooms/state_cache.rs
+++ b/src/database/key_value/rooms/state_cache.rs
@@ -1,13 +1,16 @@
 use std::{collections::HashSet, sync::Arc};
 
-use regex::Regex;
 use ruma::{
     events::{AnyStrippedStateEvent, AnySyncStateEvent},
     serde::Raw,
     OwnedRoomId, OwnedServerName, OwnedUserId, RoomId, ServerName, UserId,
 };
 
-use crate::{database::KeyValueDatabase, service, services, utils, Error, Result};
+use crate::{
+    database::KeyValueDatabase,
+    service::{self, appservice::RegistrationInfo},
+    services, utils, Error, Result,
+};
 
 impl service::rooms::state_cache::Data for KeyValueDatabase {
     fn mark_as_once_joined(&self, user_id: &UserId, room_id: &RoomId) -> Result<()> {
@@ -184,46 +187,28 @@ impl service::rooms::state_cache::Data for KeyValueDatabase {
     }
 
     #[tracing::instrument(skip(self, room_id, appservice))]
-    fn appservice_in_room(
-        &self,
-        room_id: &RoomId,
-        appservice: &(String, serde_yaml::Value),
-    ) -> Result<bool> {
+    fn appservice_in_room(&self, room_id: &RoomId, appservice: &RegistrationInfo) -> Result<bool> {
         let maybe = self
             .appservice_in_room_cache
             .read()
             .unwrap()
             .get(room_id)
-            .and_then(|map| map.get(&appservice.0))
+            .and_then(|map| map.get(&appservice.registration.id))
             .copied();
 
         if let Some(b) = maybe {
             Ok(b)
-        } else if let Some(namespaces) = appservice.1.get("namespaces") {
-            let users = namespaces
-                .get("users")
-                .and_then(|users| users.as_sequence())
-                .map_or_else(Vec::new, |users| {
-                    users
-                        .iter()
-                        .filter_map(|users| Regex::new(users.get("regex")?.as_str()?).ok())
-                        .collect::<Vec<_>>()
-                });
-
-            let bridge_user_id = appservice
-                .1
-                .get("sender_localpart")
-                .and_then(|string| string.as_str())
-                .and_then(|string| {
-                    UserId::parse_with_server_name(string, services().globals.server_name()).ok()
-                });
+        } else {
+            let bridge_user_id = UserId::parse_with_server_name(
+                appservice.registration.sender_localpart.as_str(),
+                services().globals.server_name(),
+            )
+            .ok();
 
             let in_room = bridge_user_id
                 .map_or(false, |id| self.is_joined(&id, room_id).unwrap_or(false))
                 || self.room_members(room_id).any(|userid| {
-                    userid.map_or(false, |userid| {
-                        users.iter().any(|r| r.is_match(userid.as_str()))
-                    })
+                    userid.map_or(false, |userid| appservice.users.is_match(userid.as_str()))
                 });
 
             self.appservice_in_room_cache
@@ -231,11 +216,9 @@ impl service::rooms::state_cache::Data for KeyValueDatabase {
                 .unwrap()
                 .entry(room_id.to_owned())
                 .or_default()
-                .insert(appservice.0.clone(), in_room);
+                .insert(appservice.registration.id.clone(), in_room);
 
             Ok(in_room)
-        } else {
-            Ok(false)
         }
     }
 
@@ -471,6 +454,7 @@ impl service::rooms::state_cache::Data for KeyValueDatabase {
     }
 
     /// Returns an iterator over all rooms a user was invited to.
+    #[allow(clippy::type_complexity)]
     #[tracing::instrument(skip(self))]
     fn rooms_invited<'a>(
         &'a self,
@@ -549,6 +533,7 @@ impl service::rooms::state_cache::Data for KeyValueDatabase {
     }
 
     /// Returns an iterator over all rooms a user left.
+    #[allow(clippy::type_complexity)]
     #[tracing::instrument(skip(self))]
     fn rooms_left<'a>(
         &'a self,
diff --git a/src/database/key_value/rooms/state_compressor.rs b/src/database/key_value/rooms/state_compressor.rs
index d0a9be48..65ea603e 100644
--- a/src/database/key_value/rooms/state_compressor.rs
+++ b/src/database/key_value/rooms/state_compressor.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashSet, mem::size_of};
+use std::{collections::HashSet, mem::size_of, sync::Arc};
 
 use crate::{
     database::KeyValueDatabase,
@@ -37,20 +37,20 @@ impl service::rooms::state_compressor::Data for KeyValueDatabase {
 
         Ok(StateDiff {
             parent,
-            added,
-            removed,
+            added: Arc::new(added),
+            removed: Arc::new(removed),
         })
     }
 
     fn save_statediff(&self, shortstatehash: u64, diff: StateDiff) -> Result<()> {
         let mut value = diff.parent.unwrap_or(0).to_be_bytes().to_vec();
-        for new in &diff.added {
+        for new in diff.added.iter() {
             value.extend_from_slice(&new[..]);
         }
 
         if !diff.removed.is_empty() {
             value.extend_from_slice(&0_u64.to_be_bytes());
-            for removed in &diff.removed {
+            for removed in diff.removed.iter() {
                 value.extend_from_slice(&removed[..]);
             }
         }
diff --git a/src/database/key_value/rooms/threads.rs b/src/database/key_value/rooms/threads.rs
new file mode 100644
index 00000000..5e3dc970
--- /dev/null
+++ b/src/database/key_value/rooms/threads.rs
@@ -0,0 +1,78 @@
+use std::mem;
+
+use ruma::{api::client::threads::get_threads::v1::IncludeThreads, OwnedUserId, RoomId, UserId};
+
+use crate::{database::KeyValueDatabase, service, services, utils, Error, PduEvent, Result};
+
+impl service::rooms::threads::Data for KeyValueDatabase {
+    fn threads_until<'a>(
+        &'a self,
+        user_id: &'a UserId,
+        room_id: &'a RoomId,
+        until: u64,
+        _include: &'a IncludeThreads,
+    ) -> Result<Box<dyn Iterator<Item = Result<(u64, PduEvent)>> + 'a>> {
+        let prefix = services()
+            .rooms
+            .short
+            .get_shortroomid(room_id)?
+            .expect("room exists")
+            .to_be_bytes()
+            .to_vec();
+
+        let mut current = prefix.clone();
+        current.extend_from_slice(&(until - 1).to_be_bytes());
+
+        Ok(Box::new(
+            self.threadid_userids
+                .iter_from(&current, true)
+                .take_while(move |(k, _)| k.starts_with(&prefix))
+                .map(move |(pduid, _users)| {
+                    let count = utils::u64_from_bytes(&pduid[(mem::size_of::<u64>())..])
+                        .map_err(|_| Error::bad_database("Invalid pduid in threadid_userids."))?;
+                    let mut pdu = services()
+                        .rooms
+                        .timeline
+                        .get_pdu_from_id(&pduid)?
+                        .ok_or_else(|| {
+                            Error::bad_database("Invalid pduid reference in threadid_userids")
+                        })?;
+                    if pdu.sender != user_id {
+                        pdu.remove_transaction_id()?;
+                    }
+                    Ok((count, pdu))
+                }),
+        ))
+    }
+
+    fn update_participants(&self, root_id: &[u8], participants: &[OwnedUserId]) -> Result<()> {
+        let users = participants
+            .iter()
+            .map(|user| user.as_bytes())
+            .collect::<Vec<_>>()
+            .join(&[0xff][..]);
+
+        self.threadid_userids.insert(root_id, &users)?;
+
+        Ok(())
+    }
+
+    fn get_participants(&self, root_id: &[u8]) -> Result<Option<Vec<OwnedUserId>>> {
+        if let Some(users) = self.threadid_userids.get(root_id)? {
+            Ok(Some(
+                users
+                    .split(|b| *b == 0xff)
+                    .map(|bytes| {
+                        UserId::parse(utils::string_from_bytes(bytes).map_err(|_| {
+                            Error::bad_database("Invalid UserId bytes in threadid_userids.")
+                        })?)
+                        .map_err(|_| Error::bad_database("Invalid UserId in threadid_userids."))
+                    })
+                    .filter_map(|r| r.ok())
+                    .collect(),
+            ))
+        } else {
+            Ok(None)
+        }
+    }
+}
diff --git a/src/database/key_value/rooms/timeline.rs b/src/database/key_value/rooms/timeline.rs
index d9c4423c..0331a624 100644
--- a/src/database/key_value/rooms/timeline.rs
+++ b/src/database/key_value/rooms/timeline.rs
@@ -39,11 +39,10 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
 
     /// Returns the `count` of this pdu's id.
     fn get_pdu_count(&self, event_id: &EventId) -> Result<Option<PduCount>> {
-        Ok(self
-            .eventid_pduid
+        self.eventid_pduid
             .get(event_id.as_bytes())?
             .map(|pdu_id| pdu_count(&pdu_id))
-            .transpose()?)
+            .transpose()
     }
 
     /// Returns the json of a pdu.
@@ -80,12 +79,10 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
 
     /// Returns the pdu's id.
     fn get_pdu_id(&self, event_id: &EventId) -> Result<Option<Vec<u8>>> {
-        Ok(self.eventid_pduid.get(event_id.as_bytes())?)
+        self.eventid_pduid.get(event_id.as_bytes())
     }
 
     /// Returns the pdu.
-    ///
-    /// Checks the `eventid_outlierpdu` Tree if not found in the timeline.
     fn get_non_outlier_pdu(&self, event_id: &EventId) -> Result<Option<PduEvent>> {
         self.eventid_pduid
             .get(event_id.as_bytes())?
@@ -198,19 +195,30 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
     }
 
     /// Removes a pdu and creates a new one with the same id.
-    fn replace_pdu(&self, pdu_id: &[u8], pdu: &PduEvent) -> Result<()> {
+    fn replace_pdu(
+        &self,
+        pdu_id: &[u8],
+        pdu_json: &CanonicalJsonObject,
+        pdu: &PduEvent,
+    ) -> Result<()> {
         if self.pduid_pdu.get(pdu_id)?.is_some() {
             self.pduid_pdu.insert(
                 pdu_id,
-                &serde_json::to_vec(pdu).expect("CanonicalJsonObject is always a valid"),
+                &serde_json::to_vec(pdu_json).expect("CanonicalJsonObject is always a valid"),
             )?;
-            Ok(())
         } else {
-            Err(Error::BadRequest(
+            return Err(Error::BadRequest(
                 ErrorKind::NotFound,
                 "PDU does not exist.",
-            ))
+            ));
         }
+
+        self.pdu_cache
+            .lock()
+            .unwrap()
+            .remove(&(*pdu.event_id).to_owned());
+
+        Ok(())
     }
 
     /// Returns an iterator over all events and their tokens in a room that happened before the
@@ -221,7 +229,7 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
         room_id: &RoomId,
         until: PduCount,
     ) -> Result<Box<dyn Iterator<Item = Result<(PduCount, PduEvent)>> + 'a>> {
-        let (prefix, current) = count_to_id(&room_id, until, 1, true)?;
+        let (prefix, current) = count_to_id(room_id, until, 1, true)?;
 
         let user_id = user_id.to_owned();
 
@@ -235,6 +243,7 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
                     if pdu.sender != user_id {
                         pdu.remove_transaction_id()?;
                     }
+                    pdu.add_age()?;
                     let count = pdu_count(&pdu_id)?;
                     Ok((count, pdu))
                 }),
@@ -247,7 +256,7 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
         room_id: &RoomId,
         from: PduCount,
     ) -> Result<Box<dyn Iterator<Item = Result<(PduCount, PduEvent)>> + 'a>> {
-        let (prefix, current) = count_to_id(&room_id, from, 1, false)?;
+        let (prefix, current) = count_to_id(room_id, from, 1, false)?;
 
         let user_id = user_id.to_owned();
 
@@ -261,6 +270,7 @@ impl service::rooms::timeline::Data for KeyValueDatabase {
                     if pdu.sender != user_id {
                         pdu.remove_transaction_id()?;
                     }
+                    pdu.add_age()?;
                     let count = pdu_count(&pdu_id)?;
                     Ok((count, pdu))
                 }),
@@ -321,7 +331,7 @@ fn count_to_id(
         .rooms
         .short
         .get_shortroomid(room_id)?
-        .expect("room exists")
+        .ok_or_else(|| Error::bad_database("Looked for bad shortroomid in timeline"))?
         .to_be_bytes()
         .to_vec();
     let mut pdu_id = prefix.clone();
diff --git a/src/database/key_value/users.rs b/src/database/key_value/users.rs
index 1cabab0e..0e6db83a 100644
--- a/src/database/key_value/users.rs
+++ b/src/database/key_value/users.rs
@@ -146,10 +146,9 @@ impl service::users::Data for KeyValueDatabase {
         self.userid_avatarurl
             .get(user_id.as_bytes())?
             .map(|bytes| {
-                let s = utils::string_from_bytes(&bytes)
-                    .map_err(|_| Error::bad_database("Avatar URL in db is invalid."))?;
-                s.try_into()
+                utils::string_from_bytes(&bytes)
                     .map_err(|_| Error::bad_database("Avatar URL in db is invalid."))
+                    .map(Into::into)
             })
             .transpose()
     }
@@ -449,33 +448,13 @@ impl service::users::Data for KeyValueDatabase {
         master_key: &Raw<CrossSigningKey>,
         self_signing_key: &Option<Raw<CrossSigningKey>>,
         user_signing_key: &Option<Raw<CrossSigningKey>>,
+        notify: bool,
     ) -> Result<()> {
         // TODO: Check signatures
-
         let mut prefix = user_id.as_bytes().to_vec();
         prefix.push(0xff);
 
-        // Master key
-        let mut master_key_ids = master_key
-            .deserialize()
-            .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid master key"))?
-            .keys
-            .into_values();
-
-        let master_key_id = master_key_ids.next().ok_or(Error::BadRequest(
-            ErrorKind::InvalidParam,
-            "Master key contained no key.",
-        ))?;
-
-        if master_key_ids.next().is_some() {
-            return Err(Error::BadRequest(
-                ErrorKind::InvalidParam,
-                "Master key contained more than one key.",
-            ));
-        }
-
-        let mut master_key_key = prefix.clone();
-        master_key_key.extend_from_slice(master_key_id.as_bytes());
+        let (master_key_key, _) = self.parse_master_key(user_id, master_key)?;
 
         self.keyid_key
             .insert(&master_key_key, master_key.json().get().as_bytes())?;
@@ -551,7 +530,9 @@ impl service::users::Data for KeyValueDatabase {
                 .insert(user_id.as_bytes(), &user_signing_key_key)?;
         }
 
-        self.mark_device_key_update(user_id)?;
+        if notify {
+            self.mark_device_key_update(user_id)?;
+        }
 
         Ok(())
     }
@@ -592,7 +573,6 @@ impl service::users::Data for KeyValueDatabase {
             &serde_json::to_vec(&cross_signing_key).expect("CrossSigningKey::to_vec always works"),
         )?;
 
-        // TODO: Should we notify about this change?
         self.mark_device_key_update(target_id)?;
 
         Ok(())
@@ -691,45 +671,80 @@ impl service::users::Data for KeyValueDatabase {
         })
     }
 
+    fn parse_master_key(
+        &self,
+        user_id: &UserId,
+        master_key: &Raw<CrossSigningKey>,
+    ) -> Result<(Vec<u8>, CrossSigningKey)> {
+        let mut prefix = user_id.as_bytes().to_vec();
+        prefix.push(0xff);
+
+        let master_key = master_key
+            .deserialize()
+            .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid master key"))?;
+        let mut master_key_ids = master_key.keys.values();
+        let master_key_id = master_key_ids.next().ok_or(Error::BadRequest(
+            ErrorKind::InvalidParam,
+            "Master key contained no key.",
+        ))?;
+        if master_key_ids.next().is_some() {
+            return Err(Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Master key contained more than one key.",
+            ));
+        }
+        let mut master_key_key = prefix.clone();
+        master_key_key.extend_from_slice(master_key_id.as_bytes());
+        Ok((master_key_key, master_key))
+    }
+
+    fn get_key(
+        &self,
+        key: &[u8],
+        sender_user: Option<&UserId>,
+        user_id: &UserId,
+        allowed_signatures: &dyn Fn(&UserId) -> bool,
+    ) -> Result<Option<Raw<CrossSigningKey>>> {
+        self.keyid_key.get(key)?.map_or(Ok(None), |bytes| {
+            let mut cross_signing_key = serde_json::from_slice::<serde_json::Value>(&bytes)
+                .map_err(|_| Error::bad_database("CrossSigningKey in db is invalid."))?;
+            clean_signatures(
+                &mut cross_signing_key,
+                sender_user,
+                user_id,
+                allowed_signatures,
+            )?;
+
+            Ok(Some(Raw::from_json(
+                serde_json::value::to_raw_value(&cross_signing_key)
+                    .expect("Value to RawValue serialization"),
+            )))
+        })
+    }
+
     fn get_master_key(
         &self,
+        sender_user: Option<&UserId>,
         user_id: &UserId,
         allowed_signatures: &dyn Fn(&UserId) -> bool,
     ) -> Result<Option<Raw<CrossSigningKey>>> {
         self.userid_masterkeyid
             .get(user_id.as_bytes())?
             .map_or(Ok(None), |key| {
-                self.keyid_key.get(&key)?.map_or(Ok(None), |bytes| {
-                    let mut cross_signing_key = serde_json::from_slice::<serde_json::Value>(&bytes)
-                        .map_err(|_| Error::bad_database("CrossSigningKey in db is invalid."))?;
-                    clean_signatures(&mut cross_signing_key, user_id, allowed_signatures)?;
-
-                    Ok(Some(Raw::from_json(
-                        serde_json::value::to_raw_value(&cross_signing_key)
-                            .expect("Value to RawValue serialization"),
-                    )))
-                })
+                self.get_key(&key, sender_user, user_id, allowed_signatures)
             })
     }
 
     fn get_self_signing_key(
         &self,
+        sender_user: Option<&UserId>,
         user_id: &UserId,
         allowed_signatures: &dyn Fn(&UserId) -> bool,
     ) -> Result<Option<Raw<CrossSigningKey>>> {
         self.userid_selfsigningkeyid
             .get(user_id.as_bytes())?
             .map_or(Ok(None), |key| {
-                self.keyid_key.get(&key)?.map_or(Ok(None), |bytes| {
-                    let mut cross_signing_key = serde_json::from_slice::<serde_json::Value>(&bytes)
-                        .map_err(|_| Error::bad_database("CrossSigningKey in db is invalid."))?;
-                    clean_signatures(&mut cross_signing_key, user_id, allowed_signatures)?;
-
-                    Ok(Some(Raw::from_json(
-                        serde_json::value::to_raw_value(&cross_signing_key)
-                            .expect("Value to RawValue serialization"),
-                    )))
-                })
+                self.get_key(&key, sender_user, user_id, allowed_signatures)
             })
     }
 
@@ -930,6 +945,8 @@ impl service::users::Data for KeyValueDatabase {
     }
 }
 
+impl KeyValueDatabase {}
+
 /// Will only return with Some(username) if the password was not empty and the
 /// username could be successfully parsed.
 /// If utils::string_from_bytes(...) returns an error that username will be skipped
diff --git a/src/database/mod.rs b/src/database/mod.rs
index 0eae027c..9bf3ac05 100644
--- a/src/database/mod.rs
+++ b/src/database/mod.rs
@@ -8,6 +8,7 @@ use crate::{
 use abstraction::{KeyValueDatabaseEngine, KvTree};
 use directories::ProjectDirs;
 use lru_cache::LruCache;
+
 use ruma::{
     events::{
         push_rules::{PushRulesEvent, PushRulesEventContent},
@@ -18,6 +19,7 @@ use ruma::{
     CanonicalJsonValue, EventId, OwnedDeviceId, OwnedEventId, OwnedRoomId, OwnedUserId, RoomId,
     UserId,
 };
+use serde::Deserialize;
 use std::{
     collections::{BTreeMap, HashMap, HashSet},
     fs::{self, remove_dir_all},
@@ -25,7 +27,9 @@ use std::{
     mem::size_of,
     path::Path,
     sync::{Arc, Mutex, RwLock},
+    time::Duration,
 };
+use tokio::time::interval;
 
 use tracing::{debug, error, info, warn};
 
@@ -67,8 +71,6 @@ pub struct KeyValueDatabase {
     pub(super) readreceiptid_readreceipt: Arc<dyn KvTree>, // ReadReceiptId = RoomId + Count + UserId
     pub(super) roomuserid_privateread: Arc<dyn KvTree>, // RoomUserId = Room + User, PrivateRead = Count
     pub(super) roomuserid_lastprivatereadupdate: Arc<dyn KvTree>, // LastPrivateReadUpdate = Count
-    pub(super) typingid_userid: Arc<dyn KvTree>,        // TypingId = RoomId + TimeoutTime + Count
-    pub(super) roomid_lasttypingupdate: Arc<dyn KvTree>, // LastRoomTypingUpdate = Count
     pub(super) presenceid_presence: Arc<dyn KvTree>,    // PresenceId = RoomId + Count + UserId
     pub(super) userid_lastpresenceupdate: Arc<dyn KvTree>, // LastPresenceUpdate = Count
 
@@ -80,6 +82,8 @@ pub struct KeyValueDatabase {
     pub(super) aliasid_alias: Arc<dyn KvTree>, // AliasId = RoomId + Count
     pub(super) publicroomids: Arc<dyn KvTree>,
 
+    pub(super) threadid_userids: Arc<dyn KvTree>, // ThreadId = RoomId + Count
+
     pub(super) tokenids: Arc<dyn KvTree>, // TokenId = ShortRoomId + Token + PduIdCount
 
     /// Participating servers in a room.
@@ -128,6 +132,8 @@ pub struct KeyValueDatabase {
     pub(super) eventid_outlierpdu: Arc<dyn KvTree>,
     pub(super) softfailedeventids: Arc<dyn KvTree>,
 
+    /// ShortEventId + ShortEventId -> ().
+    pub(super) tofrom_relation: Arc<dyn KvTree>,
     /// RoomId + EventId -> Parent PDU EventId.
     pub(super) referencedevents: Arc<dyn KvTree>,
 
@@ -155,7 +161,6 @@ pub struct KeyValueDatabase {
     //pub pusher: pusher::PushData,
     pub(super) senderkey_pusher: Arc<dyn KvTree>,
 
-    pub(super) cached_registrations: Arc<RwLock<HashMap<String, serde_yaml::Value>>>,
     pub(super) pdu_cache: Mutex<LruCache<OwnedEventId, Arc<PduEvent>>>,
     pub(super) shorteventid_cache: Mutex<LruCache<u64, Arc<EventId>>>,
     pub(super) auth_chain_cache: Mutex<LruCache<Vec<u64>, Arc<HashSet<u64>>>>,
@@ -260,6 +265,10 @@ impl KeyValueDatabase {
             }
         };
 
+        if config.registration_token == Some(String::new()) {
+            return Err(Error::bad_config("Registration token is empty"));
+        }
+
         if config.max_request_size < 1024 {
             error!(?config.max_request_size, "Max request size is less than 1KB. Please increase it.");
         }
@@ -290,8 +299,6 @@ impl KeyValueDatabase {
             roomuserid_privateread: builder.open_tree("roomuserid_privateread")?, // "Private" read receipt
             roomuserid_lastprivatereadupdate: builder
                 .open_tree("roomuserid_lastprivatereadupdate")?,
-            typingid_userid: builder.open_tree("typingid_userid")?,
-            roomid_lasttypingupdate: builder.open_tree("roomid_lasttypingupdate")?,
             presenceid_presence: builder.open_tree("presenceid_presence")?,
             userid_lastpresenceupdate: builder.open_tree("userid_lastpresenceupdate")?,
             pduid_pdu: builder.open_tree("pduid_pdu")?,
@@ -302,6 +309,8 @@ impl KeyValueDatabase {
             aliasid_alias: builder.open_tree("aliasid_alias")?,
             publicroomids: builder.open_tree("publicroomids")?,
 
+            threadid_userids: builder.open_tree("threadid_userids")?,
+
             tokenids: builder.open_tree("tokenids")?,
 
             roomserverids: builder.open_tree("roomserverids")?,
@@ -342,6 +351,7 @@ impl KeyValueDatabase {
             eventid_outlierpdu: builder.open_tree("eventid_outlierpdu")?,
             softfailedeventids: builder.open_tree("softfailedeventids")?,
 
+            tofrom_relation: builder.open_tree("tofrom_relation")?,
             referencedevents: builder.open_tree("referencedevents")?,
             roomuserdataid_accountdata: builder.open_tree("roomuserdataid_accountdata")?,
             roomusertype_roomuserdataid: builder.open_tree("roomusertype_roomuserdataid")?,
@@ -358,7 +368,6 @@ impl KeyValueDatabase {
             global: builder.open_tree("global")?,
             server_signingkeys: builder.open_tree("server_signingkeys")?,
 
-            cached_registrations: Arc::new(RwLock::new(HashMap::new())),
             pdu_cache: Mutex::new(LruCache::new(
                 config
                     .pdu_cache_capacity
@@ -411,7 +420,7 @@ impl KeyValueDatabase {
         }
 
         // If the database has any data, perform data migrations before starting
-        let latest_database_version = 12;
+        let latest_database_version = 13;
 
         if services().users.count()? > 0 {
             // MIGRATIONS
@@ -580,8 +589,8 @@ impl KeyValueDatabase {
 
                         services().rooms.state_compressor.save_state_from_diff(
                             current_sstatehash,
-                            statediffnew,
-                            statediffremoved,
+                            Arc::new(statediffnew),
+                            Arc::new(statediffremoved),
                             2, // every state change is 2 event changes on average
                             states_parents,
                         )?;
@@ -838,7 +847,9 @@ impl KeyValueDatabase {
                         if rule.is_some() {
                             let mut rule = rule.unwrap().clone();
                             rule.rule_id = content_rule_transformation[1].to_owned();
-                            rules_list.content.remove(content_rule_transformation[0]);
+                            rules_list
+                                .content
+                                .shift_remove(content_rule_transformation[0]);
                             rules_list.content.insert(rule);
                         }
                     }
@@ -861,7 +872,7 @@ impl KeyValueDatabase {
                             if let Some(rule) = rule {
                                 let mut rule = rule.clone();
                                 rule.rule_id = transformation[1].to_owned();
-                                rules_list.underride.remove(transformation[0]);
+                                rules_list.underride.shift_remove(transformation[0]);
                                 rules_list.underride.insert(rule);
                             }
                         }
@@ -880,7 +891,47 @@ impl KeyValueDatabase {
                 warn!("Migration: 11 -> 12 finished");
             }
 
+            // This migration can be reused as-is anytime the server-default rules are updated.
             if services().globals.database_version()? < 13 {
+                for username in services().users.list_local_users()? {
+                    let user = match UserId::parse_with_server_name(
+                        username.clone(),
+                        services().globals.server_name(),
+                    ) {
+                        Ok(u) => u,
+                        Err(e) => {
+                            warn!("Invalid username {username}: {e}");
+                            continue;
+                        }
+                    };
+
+                    let raw_rules_list = services()
+                        .account_data
+                        .get(
+                            None,
+                            &user,
+                            GlobalAccountDataEventType::PushRules.to_string().into(),
+                        )
+                        .unwrap()
+                        .expect("Username is invalid");
+
+                    let mut account_data =
+                        serde_json::from_str::<PushRulesEvent>(raw_rules_list.get()).unwrap();
+
+                    let user_default_rules = ruma::push::Ruleset::server_default(&user);
+                    account_data
+                        .content
+                        .global
+                        .update_with_server_default(user_default_rules);
+
+                    services().account_data.update(
+                        None,
+                        &user,
+                        GlobalAccountDataEventType::PushRules.to_string().into(),
+                        &serde_json::to_value(account_data).expect("to json value always works"),
+                    )?;
+                }
+
                 // Move old media files to new names
                 for (key, _) in db.mediaid_file.iter() {
                     // we know that this method is deprecated, but we need to use it to migrate the old files
@@ -950,6 +1001,9 @@ impl KeyValueDatabase {
         services().sending.start_handler();
 
         Self::start_cleanup_task().await;
+        if services().globals.allow_check_for_updates() {
+            Self::start_check_for_updates_task();
+        }
 
         Ok(())
     }
@@ -966,9 +1020,61 @@ impl KeyValueDatabase {
     }
 
     #[tracing::instrument]
-    pub async fn start_cleanup_task() {
-        use tokio::time::interval;
+    pub fn start_check_for_updates_task() {
+        tokio::spawn(async move {
+            let timer_interval = Duration::from_secs(60 * 60);
+            let mut i = interval(timer_interval);
+            loop {
+                i.tick().await;
+                let _ = Self::try_handle_updates().await;
+            }
+        });
+    }
 
+    async fn try_handle_updates() -> Result<()> {
+        let response = services()
+            .globals
+            .default_client()
+            .get("https://conduit.rs/check-for-updates/stable")
+            .send()
+            .await?;
+
+        #[derive(Deserialize)]
+        struct CheckForUpdatesResponseEntry {
+            id: u64,
+            date: String,
+            message: String,
+        }
+        #[derive(Deserialize)]
+        struct CheckForUpdatesResponse {
+            updates: Vec<CheckForUpdatesResponseEntry>,
+        }
+
+        let response = serde_json::from_str::<CheckForUpdatesResponse>(&response.text().await?)
+            .map_err(|_| Error::BadServerResponse("Bad version check response"))?;
+
+        let mut last_update_id = services().globals.last_check_for_updates_id()?;
+        for update in response.updates {
+            last_update_id = last_update_id.max(update.id);
+            if update.id > services().globals.last_check_for_updates_id()? {
+                println!("{}", update.message);
+                services()
+                    .admin
+                    .send_message(RoomMessageEventContent::text_plain(format!(
+                    "@room: The following is a message from the Conduit developers. It was sent on '{}':\n\n{}",
+                    update.date, update.message
+                )))
+            }
+        }
+        services()
+            .globals
+            .update_check_for_updates_id(last_update_id)?;
+
+        Ok(())
+    }
+
+    #[tracing::instrument]
+    pub async fn start_cleanup_task() {
         #[cfg(unix)]
         use tokio::signal::unix::{signal, SignalKind};
 
diff --git a/src/lib.rs b/src/lib.rs
index dc6a9d2f..5a89f805 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,18 +1,13 @@
-#![warn(
-    rust_2018_idioms,
-    unused_qualifications,
-    clippy::cloned_instead_of_copied,
-    clippy::str_to_string
-)]
-#![allow(clippy::suspicious_else_formatting)]
-#![deny(clippy::dbg_macro)]
-
 pub mod api;
+pub mod clap;
 mod config;
 mod database;
 mod service;
 mod utils;
 
+// Not async due to services() being used in many closures, and async closures are not stable as of writing
+// This is the case for every other occurence of sync Mutex/RwLock, except for database related ones, where
+// the current maintainer (Timo) has asked to not modify those
 use std::sync::RwLock;
 
 pub use api::ruma_wrapper::{Ruma, RumaResponse};
diff --git a/src/main.rs b/src/main.rs
index 59e82a79..b5bf742d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,17 +1,7 @@
-#![warn(
-    rust_2018_idioms,
-    unused_qualifications,
-    clippy::cloned_instead_of_copied,
-    clippy::str_to_string
-)]
-#![allow(clippy::suspicious_else_formatting)]
-#![deny(clippy::dbg_macro)]
-
 use std::{future::Future, io, net::SocketAddr, sync::atomic, time::Duration};
 
 use axum::{
-    extract::{DefaultBodyLimit, FromRequest, MatchedPath},
-    handler::Handler,
+    extract::{DefaultBodyLimit, FromRequestParts, MatchedPath},
     response::IntoResponse,
     routing::{get, on, MethodFilter},
     Router,
@@ -40,7 +30,7 @@ use tower_http::{
     trace::TraceLayer,
     ServiceBuilderExt as _,
 };
-use tracing::{error, info, warn};
+use tracing::{debug, error, info, warn};
 use tracing_subscriber::{prelude::*, EnvFilter};
 
 pub use conduit::*; // Re-export everything from the library crate
@@ -54,7 +44,9 @@ static GLOBAL: Jemalloc = Jemalloc;
 
 #[tokio::main]
 async fn main() {
-    // Initialize DB
+    clap::parse();
+
+    // Initialize config
     let raw_config =
         Figment::new()
             .merge(
@@ -123,6 +115,16 @@ async fn main() {
         tracing::subscriber::set_global_default(subscriber).unwrap();
     }
 
+    // This is needed for opening lots of file descriptors, which tends to
+    // happen more often when using RocksDB and making lots of federation
+    // connections at startup. The soft limit is usually 1024, and the hard
+    // limit is usually 512000; I've personally seen it hit >2000.
+    //
+    // * https://www.freedesktop.org/software/systemd/man/systemd.exec.html#id-1.12.2.1.17.6
+    // * https://github.com/systemd/systemd/commit/0abf94923b4a95a7d89bc526efc84e7ca2b71741
+    #[cfg(unix)]
+    maximize_fd_limit().expect("should be able to increase the soft limit to the hard limit");
+
     info!("Loading database");
     if let Err(error) = KeyValueDatabase::load_or_create(config).await {
         error!(?error, "The database couldn't be loaded or created");
@@ -159,7 +161,6 @@ async fn run_server() -> io::Result<()> {
                 tracing::info_span!("http_request", %path)
             }),
         )
-        .compression()
         .layer(axum::middleware::from_fn(unrecognized_method))
         .layer(
             CorsLayer::new()
@@ -227,7 +228,7 @@ async fn spawn_task<B: Send + 'static>(
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
 }
 
-async fn unrecognized_method<B>(
+async fn unrecognized_method<B: Send>(
     req: axum::http::Request<B>,
     next: axum::middleware::Next<B>,
 ) -> std::result::Result<axum::response::Response, StatusCode> {
@@ -358,6 +359,7 @@ fn routes() -> Router {
                 .put(client_server::send_state_event_for_empty_key_route),
         )
         .ruma_route(client_server::sync_events_route)
+        .ruma_route(client_server::sync_events_v4_route)
         .ruma_route(client_server::get_context_route)
         .ruma_route(client_server::get_message_events_route)
         .ruma_route(client_server::search_events_route)
@@ -383,6 +385,11 @@ fn routes() -> Router {
         .ruma_route(client_server::set_pushers_route)
         // .ruma_route(client_server::third_party_route)
         .ruma_route(client_server::upgrade_room_route)
+        .ruma_route(client_server::get_threads_route)
+        .ruma_route(client_server::get_relating_events_with_rel_type_and_event_type_route)
+        .ruma_route(client_server::get_relating_events_with_rel_type_route)
+        .ruma_route(client_server::get_relating_events_route)
+        .ruma_route(client_server::get_hierarchy_route)
         .ruma_route(server_server::get_server_version_route)
         .route(
             "/_matrix/key/v2/server",
@@ -418,7 +425,8 @@ fn routes() -> Router {
             "/_matrix/client/v3/rooms/:room_id/initialSync",
             get(initial_sync),
         )
-        .fallback(not_found.into_service())
+        .route("/", get(it_works))
+        .fallback(not_found)
 }
 
 async fn shutdown_signal(handle: ServerHandle) {
@@ -467,6 +475,10 @@ async fn initial_sync(_uri: Uri) -> impl IntoResponse {
     )
 }
 
+async fn it_works() -> &'static str {
+    "Hello from Conduit!"
+}
+
 trait RouterExt {
     fn ruma_route<H, T>(self, handler: H) -> Self
     where
@@ -502,7 +514,7 @@ macro_rules! impl_ruma_handler {
             Fut: Future<Output = Result<Req::OutgoingResponse, E>>
                 + Send,
             E: IntoResponse,
-            $( $ty: FromRequest<axum::body::Body> + Send + 'static, )*
+            $( $ty: FromRequestParts<()> + Send + 'static, )*
         {
             fn add_to_router(self, mut router: Router) -> Router {
                 let meta = Req::METADATA;
@@ -545,3 +557,21 @@ fn method_to_filter(method: Method) -> MethodFilter {
         m => panic!("Unsupported HTTP method: {m:?}"),
     }
 }
+
+#[cfg(unix)]
+#[tracing::instrument(err)]
+fn maximize_fd_limit() -> Result<(), nix::errno::Errno> {
+    use nix::sys::resource::{getrlimit, setrlimit, Resource};
+
+    let res = Resource::RLIMIT_NOFILE;
+
+    let (soft_limit, hard_limit) = getrlimit(res)?;
+
+    debug!("Current nofile soft limit: {soft_limit}");
+
+    setrlimit(res, hard_limit, hard_limit)?;
+
+    debug!("Increased nofile soft limit to {hard_limit}");
+
+    Ok(())
+}
diff --git a/src/service/admin/mod.rs b/src/service/admin/mod.rs
index b6609e13..408adf6f 100644
--- a/src/service/admin/mod.rs
+++ b/src/service/admin/mod.rs
@@ -8,6 +8,7 @@ use std::{
 use clap::Parser;
 use regex::Regex;
 use ruma::{
+    api::appservice::Registration,
     events::{
         room::{
             canonical_alias::RoomCanonicalAliasEventContent,
@@ -21,12 +22,12 @@ use ruma::{
             power_levels::RoomPowerLevelsEventContent,
             topic::RoomTopicEventContent,
         },
-        RoomEventType,
+        TimelineEventType,
     },
-    EventId, OwnedRoomAliasId, RoomAliasId, RoomId, RoomVersionId, ServerName, UserId,
+    EventId, OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId, RoomVersionId, ServerName, UserId,
 };
 use serde_json::value::to_raw_value;
-use tokio::sync::{mpsc, Mutex, MutexGuard};
+use tokio::sync::{mpsc, Mutex, RwLock};
 
 use crate::{
     api::client_server::{leave_all_rooms, AUTO_GEN_PASSWORD_LENGTH},
@@ -50,7 +51,7 @@ enum AdminCommand {
     /// Registering a new bridge using the ID of an existing bridge will replace
     /// the old one.
     ///
-    /// [commandbody]
+    /// [commandbody]()
     /// # ```
     /// # yaml content here
     /// # ```
@@ -96,7 +97,7 @@ enum AdminCommand {
     /// Removing a mass amount of users from a room may cause a significant amount of leave events.
     /// The time to leave rooms may depend significantly on joined rooms and servers.
     ///
-    /// [commandbody]
+    /// [commandbody]()
     /// # ```
     /// # User list here
     /// # ```
@@ -121,7 +122,7 @@ enum AdminCommand {
     /// The PDU event is only checked for validity and is not added to the
     /// database.
     ///
-    /// [commandbody]
+    /// [commandbody]()
     /// # ```
     /// # PDU json content here
     /// # ```
@@ -134,7 +135,13 @@ enum AdminCommand {
     },
 
     /// Print database memory usage statistics
-    DatabaseMemoryUsage,
+    MemoryUsage,
+
+    /// Clears all of Conduit's database caches with index smaller than the amount
+    ClearDatabaseCaches { amount: u32 },
+
+    /// Clears all of Conduit's service caches with index smaller than the amount
+    ClearServiceCaches { amount: u32 },
 
     /// Show configuration values
     ShowConfig,
@@ -157,6 +164,20 @@ enum AdminCommand {
     DisableRoom { room_id: Box<RoomId> },
     /// Enables incoming federation handling for a room again.
     EnableRoom { room_id: Box<RoomId> },
+
+    /// Verify json signatures
+    /// [commandbody]()
+    /// # ```
+    /// # json here
+    /// # ```
+    SignJson,
+
+    /// Verify json signatures
+    /// [commandbody]()
+    /// # ```
+    /// # json here
+    /// # ```
+    VerifyJson,
 }
 
 #[derive(Debug)]
@@ -194,60 +215,44 @@ impl Service {
         let conduit_user = UserId::parse(format!("@conduit:{}", services().globals.server_name()))
             .expect("@conduit:server_name is valid");
 
-        let conduit_room = services()
-            .rooms
-            .alias
-            .resolve_local_alias(
-                format!("#admins:{}", services().globals.server_name())
-                    .as_str()
-                    .try_into()
-                    .expect("#admins:server_name is a valid room alias"),
-            )
-            .expect("Database data for admin room alias must be valid")
-            .expect("Admin room must exist");
+        if let Ok(Some(conduit_room)) = services().admin.get_admin_room() {
+            loop {
+                tokio::select! {
+                    Some(event) = receiver.recv() => {
+                        let message_content = match event {
+                            AdminRoomEvent::SendMessage(content) => content,
+                            AdminRoomEvent::ProcessMessage(room_message) => self.process_admin_message(room_message).await
+                        };
 
-        let send_message = |message: RoomMessageEventContent, mutex_lock: &MutexGuard<'_, ()>| {
-            services()
-                .rooms
-                .timeline
-                .build_and_append_pdu(
-                    PduBuilder {
-                        event_type: RoomEventType::RoomMessage,
-                        content: to_raw_value(&message)
-                            .expect("event is valid, we just created it"),
-                        unsigned: None,
-                        state_key: None,
-                        redacts: None,
-                    },
-                    &conduit_user,
-                    &conduit_room,
-                    mutex_lock,
-                )
-                .unwrap();
-        };
+                        let mutex_state = Arc::clone(
+                            services().globals
+                                .roomid_mutex_state
+                                .write()
+                                .await
+                                .entry(conduit_room.to_owned())
+                                .or_default(),
+                        );
 
-        loop {
-            tokio::select! {
-                Some(event) = receiver.recv() => {
-                    let message_content = match event {
-                        AdminRoomEvent::SendMessage(content) => content,
-                        AdminRoomEvent::ProcessMessage(room_message) => self.process_admin_message(room_message).await
-                    };
+                        let state_lock = mutex_state.lock().await;
 
-                    let mutex_state = Arc::clone(
-                        services().globals
-                            .roomid_mutex_state
-                            .write()
-                            .unwrap()
-                            .entry(conduit_room.to_owned())
-                            .or_default(),
-                    );
-
-                    let state_lock = mutex_state.lock().await;
-
-                    send_message(message_content, &state_lock);
-
-                    drop(state_lock);
+                        services()
+                            .rooms
+                            .timeline
+                            .build_and_append_pdu(
+                                PduBuilder {
+                                    event_type: TimelineEventType::RoomMessage,
+                                    content: to_raw_value(&message_content)
+                                        .expect("event is valid, we just created it"),
+                                    unsigned: None,
+                                    state_key: None,
+                                    redacts: None,
+                                },
+                                &conduit_user,
+                                &conduit_room,
+                                &state_lock,
+                            )
+                            .await.unwrap();
+                    }
                 }
             }
         }
@@ -267,7 +272,7 @@ impl Service {
 
     // Parse and process a message from the admin room
     async fn process_admin_message(&self, room_message: String) -> RoomMessageEventContent {
-        let mut lines = room_message.lines();
+        let mut lines = room_message.lines().filter(|l| !l.trim().is_empty());
         let command_line = lines.next().expect("each string has at least one line");
         let body: Vec<_> = lines.collect();
 
@@ -331,10 +336,9 @@ impl Service {
                 if body.len() > 2 && body[0].trim() == "```" && body.last().unwrap().trim() == "```"
                 {
                     let appservice_config = body[1..body.len() - 1].join("\n");
-                    let parsed_config =
-                        serde_yaml::from_str::<serde_yaml::Value>(&appservice_config);
+                    let parsed_config = serde_yaml::from_str::<Registration>(&appservice_config);
                     match parsed_config {
-                        Ok(yaml) => match services().appservice.register_appservice(yaml) {
+                        Ok(yaml) => match services().appservice.register_appservice(yaml).await {
                             Ok(id) => RoomMessageEventContent::text_plain(format!(
                                 "Appservice registered with ID: {id}."
                             )),
@@ -357,6 +361,7 @@ impl Service {
             } => match services()
                 .appservice
                 .unregister_appservice(&appservice_identifier)
+                .await
             {
                 Ok(()) => RoomMessageEventContent::text_plain("Appservice unregistered."),
                 Err(e) => RoomMessageEventContent::text_plain(format!(
@@ -364,25 +369,13 @@ impl Service {
                 )),
             },
             AdminCommand::ListAppservices => {
-                if let Ok(appservices) = services()
-                    .appservice
-                    .iter_ids()
-                    .map(|ids| ids.collect::<Vec<_>>())
-                {
-                    let count = appservices.len();
-                    let output = format!(
-                        "Appservices ({}): {}",
-                        count,
-                        appservices
-                            .into_iter()
-                            .filter_map(|r| r.ok())
-                            .collect::<Vec<_>>()
-                            .join(", ")
-                    );
-                    RoomMessageEventContent::text_plain(output)
-                } else {
-                    RoomMessageEventContent::text_plain("Failed to get appservices.")
-                }
+                let appservices = services().appservice.iter_ids().await;
+                let output = format!(
+                    "Appservices ({}): {}",
+                    appservices.len(),
+                    appservices.join(", ")
+                );
+                RoomMessageEventContent::text_plain(output)
             }
             AdminCommand::ListRooms => {
                 let room_ids = services().rooms.metadata.iter_ids();
@@ -414,11 +407,7 @@ impl Service {
                 Err(e) => RoomMessageEventContent::text_plain(e.to_string()),
             },
             AdminCommand::IncomingFederation => {
-                let map = services()
-                    .globals
-                    .roomid_federationhandletime
-                    .read()
-                    .unwrap();
+                let map = services().globals.roomid_federationhandletime.read().await;
                 let mut msg: String = format!("Handling {} incoming pdus:\n", map.len());
 
                 for (r, (e, i)) in map.iter() {
@@ -531,12 +520,24 @@ impl Service {
                     None => RoomMessageEventContent::text_plain("PDU not found."),
                 }
             }
-            AdminCommand::DatabaseMemoryUsage => match services().globals.db.memory_usage() {
-                Ok(response) => RoomMessageEventContent::text_plain(response),
-                Err(e) => RoomMessageEventContent::text_plain(format!(
-                    "Failed to get database memory usage: {e}"
-                )),
-            },
+            AdminCommand::MemoryUsage => {
+                let response1 = services().memory_usage().await;
+                let response2 = services().globals.db.memory_usage();
+
+                RoomMessageEventContent::text_plain(format!(
+                    "Services:\n{response1}\n\nDatabase:\n{response2}"
+                ))
+            }
+            AdminCommand::ClearDatabaseCaches { amount } => {
+                services().globals.db.clear_caches(amount);
+
+                RoomMessageEventContent::text_plain("Done.")
+            }
+            AdminCommand::ClearServiceCaches { amount } => {
+                services().clear_caches(amount).await;
+
+                RoomMessageEventContent::text_plain("Done.")
+            }
             AdminCommand::ShowConfig => {
                 // Construct and send the response
                 RoomMessageEventContent::text_plain(format!("{}", services().globals.config))
@@ -554,6 +555,13 @@ impl Service {
                     }
                 };
 
+                // Checks if user is local
+                if user_id.server_name() != services().globals.server_name() {
+                    return Ok(RoomMessageEventContent::text_plain(
+                        "The specified user is not from this server!",
+                    ));
+                };
+
                 // Check if the specified user is valid
                 if !services().users.exists(&user_id)?
                     || user_id
@@ -657,7 +665,15 @@ impl Service {
                 user_id,
             } => {
                 let user_id = Arc::<UserId>::from(user_id);
-                if services().users.exists(&user_id)? {
+                if !services().users.exists(&user_id)? {
+                    RoomMessageEventContent::text_plain(format!(
+                        "User {user_id} doesn't exist on this server"
+                    ))
+                } else if user_id.server_name() != services().globals.server_name() {
+                    RoomMessageEventContent::text_plain(format!(
+                        "User {user_id} is not from this server"
+                    ))
+                } else {
                     RoomMessageEventContent::text_plain(format!(
                         "Making {user_id} leave all rooms before deactivation..."
                     ));
@@ -671,30 +687,76 @@ impl Service {
                     RoomMessageEventContent::text_plain(format!(
                         "User {user_id} has been deactivated"
                     ))
-                } else {
-                    RoomMessageEventContent::text_plain(format!(
-                        "User {user_id} doesn't exist on this server"
-                    ))
                 }
             }
             AdminCommand::DeactivateAll { leave_rooms, force } => {
                 if body.len() > 2 && body[0].trim() == "```" && body.last().unwrap().trim() == "```"
                 {
-                    let usernames = body.clone().drain(1..body.len() - 1).collect::<Vec<_>>();
+                    let users = body.clone().drain(1..body.len() - 1).collect::<Vec<_>>();
 
-                    let mut user_ids: Vec<&UserId> = Vec::new();
+                    let mut user_ids = Vec::new();
+                    let mut remote_ids = Vec::new();
+                    let mut non_existant_ids = Vec::new();
+                    let mut invalid_users = Vec::new();
 
-                    for &username in &usernames {
-                        match <&UserId>::try_from(username) {
-                            Ok(user_id) => user_ids.push(user_id),
+                    for &user in &users {
+                        match <&UserId>::try_from(user) {
+                            Ok(user_id) => {
+                                if user_id.server_name() != services().globals.server_name() {
+                                    remote_ids.push(user_id)
+                                } else if !services().users.exists(user_id)? {
+                                    non_existant_ids.push(user_id)
+                                } else {
+                                    user_ids.push(user_id)
+                                }
+                            }
                             Err(_) => {
-                                return Ok(RoomMessageEventContent::text_plain(format!(
-                                    "{username} is not a valid username"
-                                )))
+                                invalid_users.push(user);
                             }
                         }
                     }
 
+                    let mut markdown_message = String::new();
+                    let mut html_message = String::new();
+                    if !invalid_users.is_empty() {
+                        markdown_message.push_str("The following user ids are not valid:\n```\n");
+                        html_message.push_str("The following user ids are not valid:\n<pre>\n");
+                        for invalid_user in invalid_users {
+                            markdown_message.push_str(&format!("{invalid_user}\n"));
+                            html_message.push_str(&format!("{invalid_user}\n"));
+                        }
+                        markdown_message.push_str("```\n\n");
+                        html_message.push_str("</pre>\n\n");
+                    }
+                    if !remote_ids.is_empty() {
+                        markdown_message
+                            .push_str("The following users are not from this server:\n```\n");
+                        html_message
+                            .push_str("The following users are not from this server:\n<pre>\n");
+                        for remote_id in remote_ids {
+                            markdown_message.push_str(&format!("{remote_id}\n"));
+                            html_message.push_str(&format!("{remote_id}\n"));
+                        }
+                        markdown_message.push_str("```\n\n");
+                        html_message.push_str("</pre>\n\n");
+                    }
+                    if !non_existant_ids.is_empty() {
+                        markdown_message.push_str("The following users do not exist:\n```\n");
+                        html_message.push_str("The following users do not exist:\n<pre>\n");
+                        for non_existant_id in non_existant_ids {
+                            markdown_message.push_str(&format!("{non_existant_id}\n"));
+                            html_message.push_str(&format!("{non_existant_id}\n"));
+                        }
+                        markdown_message.push_str("```\n\n");
+                        html_message.push_str("</pre>\n\n");
+                    }
+                    if !markdown_message.is_empty() {
+                        return Ok(RoomMessageEventContent::text_html(
+                            markdown_message,
+                            html_message,
+                        ));
+                    }
+
                     let mut deactivation_count = 0;
                     let mut admins = Vec::new();
 
@@ -736,6 +798,60 @@ impl Service {
                     )
                 }
             }
+            AdminCommand::SignJson => {
+                if body.len() > 2 && body[0].trim() == "```" && body.last().unwrap().trim() == "```"
+                {
+                    let string = body[1..body.len() - 1].join("\n");
+                    match serde_json::from_str(&string) {
+                        Ok(mut value) => {
+                            ruma::signatures::sign_json(
+                                services().globals.server_name().as_str(),
+                                services().globals.keypair(),
+                                &mut value,
+                            )
+                            .expect("our request json is what ruma expects");
+                            let json_text = serde_json::to_string_pretty(&value)
+                                .expect("canonical json is valid json");
+                            RoomMessageEventContent::text_plain(json_text)
+                        }
+                        Err(e) => RoomMessageEventContent::text_plain(format!("Invalid json: {e}")),
+                    }
+                } else {
+                    RoomMessageEventContent::text_plain(
+                        "Expected code block in command body. Add --help for details.",
+                    )
+                }
+            }
+            AdminCommand::VerifyJson => {
+                if body.len() > 2 && body[0].trim() == "```" && body.last().unwrap().trim() == "```"
+                {
+                    let string = body[1..body.len() - 1].join("\n");
+                    match serde_json::from_str(&string) {
+                        Ok(value) => {
+                            let pub_key_map = RwLock::new(BTreeMap::new());
+
+                            services()
+                                .rooms
+                                .event_handler
+                                .fetch_required_signing_keys(&value, &pub_key_map)
+                                .await?;
+
+                            let pub_key_map = pub_key_map.read().await;
+                            match ruma::signatures::verify_json(&pub_key_map, &value) {
+                                Ok(_) => RoomMessageEventContent::text_plain("Signature correct"),
+                                Err(e) => RoomMessageEventContent::text_plain(format!(
+                                    "Signature verification failed: {e}"
+                                )),
+                            }
+                        }
+                        Err(e) => RoomMessageEventContent::text_plain(format!("Invalid json: {e}")),
+                    }
+                } else {
+                    RoomMessageEventContent::text_plain(
+                        "Expected code block in command body. Add --help for details.",
+                    )
+                }
+            }
         };
 
         Ok(reply_message_content)
@@ -772,12 +888,15 @@ impl Service {
             .expect("Regex compilation should not fail");
         let text = re.replace_all(&text, "<code>$1</code>: $4");
 
-        // Look for a `[commandbody]` tag. If it exists, use all lines below it that
+        // Look for a `[commandbody]()` tag. If it exists, use all lines below it that
         // start with a `#` in the USAGE section.
         let mut text_lines: Vec<&str> = text.lines().collect();
         let mut command_body = String::new();
 
-        if let Some(line_index) = text_lines.iter().position(|line| *line == "[commandbody]") {
+        if let Some(line_index) = text_lines
+            .iter()
+            .position(|line| *line == "[commandbody]()")
+        {
             text_lines.remove(line_index);
 
             while text_lines
@@ -833,7 +952,7 @@ impl Service {
                 .globals
                 .roomid_mutex_state
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.clone())
                 .or_default(),
         );
@@ -846,176 +965,229 @@ impl Service {
 
         services().users.create(&conduit_user, None)?;
 
-        let mut content = RoomCreateEventContent::new(conduit_user.clone());
+        let mut content = RoomCreateEventContent::new_v1(conduit_user.clone());
         content.federate = true;
         content.predecessor = None;
         content.room_version = services().globals.default_room_version();
 
         // 1. The room create event
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomCreate,
-                content: to_raw_value(&content).expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomCreate,
+                    content: to_raw_value(&content).expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 2. Make conduit bot join
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomMember,
-                content: to_raw_value(&RoomMemberEventContent {
-                    membership: MembershipState::Join,
-                    displayname: None,
-                    avatar_url: None,
-                    is_direct: None,
-                    third_party_invite: None,
-                    blurhash: None,
-                    reason: None,
-                    join_authorized_via_users_server: None,
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some(conduit_user.to_string()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomMember,
+                    content: to_raw_value(&RoomMemberEventContent {
+                        membership: MembershipState::Join,
+                        displayname: None,
+                        avatar_url: None,
+                        is_direct: None,
+                        third_party_invite: None,
+                        blurhash: None,
+                        reason: None,
+                        join_authorized_via_users_server: None,
+                    })
+                    .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some(conduit_user.to_string()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 3. Power levels
         let mut users = BTreeMap::new();
         users.insert(conduit_user.clone(), 100.into());
 
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomPowerLevels,
-                content: to_raw_value(&RoomPowerLevelsEventContent {
-                    users,
-                    ..Default::default()
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomPowerLevels,
+                    content: to_raw_value(&RoomPowerLevelsEventContent {
+                        users,
+                        ..Default::default()
+                    })
+                    .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 4.1 Join Rules
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomJoinRules,
-                content: to_raw_value(&RoomJoinRulesEventContent::new(JoinRule::Invite))
-                    .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomJoinRules,
+                    content: to_raw_value(&RoomJoinRulesEventContent::new(JoinRule::Invite))
+                        .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 4.2 History Visibility
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomHistoryVisibility,
-                content: to_raw_value(&RoomHistoryVisibilityEventContent::new(
-                    HistoryVisibility::Shared,
-                ))
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomHistoryVisibility,
+                    content: to_raw_value(&RoomHistoryVisibilityEventContent::new(
+                        HistoryVisibility::Shared,
+                    ))
+                    .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 4.3 Guest Access
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomGuestAccess,
-                content: to_raw_value(&RoomGuestAccessEventContent::new(GuestAccess::Forbidden))
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomGuestAccess,
+                    content: to_raw_value(&RoomGuestAccessEventContent::new(
+                        GuestAccess::Forbidden,
+                    ))
                     .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 5. Events implied by name and topic
         let room_name = format!("{} Admin Room", services().globals.server_name());
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomName,
-                content: to_raw_value(&RoomNameEventContent::new(Some(room_name)))
-                    .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomName,
+                    content: to_raw_value(&RoomNameEventContent::new(room_name))
+                        .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomTopic,
-                content: to_raw_value(&RoomTopicEventContent {
-                    topic: format!("Manage {}", services().globals.server_name()),
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomTopic,
+                    content: to_raw_value(&RoomTopicEventContent {
+                        topic: format!("Manage {}", services().globals.server_name()),
+                    })
+                    .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         // 6. Room alias
         let alias: OwnedRoomAliasId = format!("#admins:{}", services().globals.server_name())
             .try_into()
             .expect("#admins:server_name is a valid alias name");
 
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomCanonicalAlias,
-                content: to_raw_value(&RoomCanonicalAliasEventContent {
-                    alias: Some(alias.clone()),
-                    alt_aliases: Vec::new(),
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
+        services()
+            .rooms
+            .timeline
+            .build_and_append_pdu(
+                PduBuilder {
+                    event_type: TimelineEventType::RoomCanonicalAlias,
+                    content: to_raw_value(&RoomCanonicalAliasEventContent {
+                        alias: Some(alias.clone()),
+                        alt_aliases: Vec::new(),
+                    })
+                    .expect("event is valid, we just created it"),
+                    unsigned: None,
+                    state_key: Some("".to_owned()),
+                    redacts: None,
+                },
+                &conduit_user,
+                &room_id,
+                &state_lock,
+            )
+            .await?;
 
         services().rooms.alias.set_alias(&alias, &room_id)?;
 
         Ok(())
     }
 
+    /// Gets the room ID of the admin room
+    ///
+    /// Errors are propagated from the database, and will have None if there is no admin room
+    pub(crate) fn get_admin_room(&self) -> Result<Option<OwnedRoomId>> {
+        let admin_room_alias: Box<RoomAliasId> =
+            format!("#admins:{}", services().globals.server_name())
+                .try_into()
+                .expect("#admins:server_name is a valid alias name");
+
+        services()
+            .rooms
+            .alias
+            .resolve_local_alias(&admin_room_alias)
+    }
+
     /// Invite the user to the conduit admin room.
     ///
     /// In conduit, this is equivalent to granting admin privileges.
@@ -1024,104 +1196,107 @@ impl Service {
         user_id: &UserId,
         displayname: String,
     ) -> Result<()> {
-        let admin_room_alias: Box<RoomAliasId> =
-            format!("#admins:{}", services().globals.server_name())
-                .try_into()
-                .expect("#admins:server_name is a valid alias name");
-        let room_id = services()
-            .rooms
-            .alias
-            .resolve_local_alias(&admin_room_alias)?
-            .expect("Admin room must exist");
+        if let Some(room_id) = services().admin.get_admin_room()? {
+            let mutex_state = Arc::clone(
+                services()
+                    .globals
+                    .roomid_mutex_state
+                    .write()
+                    .await
+                    .entry(room_id.clone())
+                    .or_default(),
+            );
+            let state_lock = mutex_state.lock().await;
 
-        let mutex_state = Arc::clone(
+            // Use the server user to grant the new admin's power level
+            let conduit_user =
+                UserId::parse_with_server_name("conduit", services().globals.server_name())
+                    .expect("@conduit:server_name is valid");
+
+            // Invite and join the real user
             services()
-                .globals
-                .roomid_mutex_state
-                .write()
-                .unwrap()
-                .entry(room_id.clone())
-                .or_default(),
-        );
-        let state_lock = mutex_state.lock().await;
+                .rooms
+                .timeline
+                .build_and_append_pdu(
+                    PduBuilder {
+                        event_type: TimelineEventType::RoomMember,
+                        content: to_raw_value(&RoomMemberEventContent {
+                            membership: MembershipState::Invite,
+                            displayname: None,
+                            avatar_url: None,
+                            is_direct: None,
+                            third_party_invite: None,
+                            blurhash: None,
+                            reason: None,
+                            join_authorized_via_users_server: None,
+                        })
+                        .expect("event is valid, we just created it"),
+                        unsigned: None,
+                        state_key: Some(user_id.to_string()),
+                        redacts: None,
+                    },
+                    &conduit_user,
+                    &room_id,
+                    &state_lock,
+                )
+                .await?;
+            services()
+                .rooms
+                .timeline
+                .build_and_append_pdu(
+                    PduBuilder {
+                        event_type: TimelineEventType::RoomMember,
+                        content: to_raw_value(&RoomMemberEventContent {
+                            membership: MembershipState::Join,
+                            displayname: Some(displayname),
+                            avatar_url: None,
+                            is_direct: None,
+                            third_party_invite: None,
+                            blurhash: None,
+                            reason: None,
+                            join_authorized_via_users_server: None,
+                        })
+                        .expect("event is valid, we just created it"),
+                        unsigned: None,
+                        state_key: Some(user_id.to_string()),
+                        redacts: None,
+                    },
+                    user_id,
+                    &room_id,
+                    &state_lock,
+                )
+                .await?;
 
-        // Use the server user to grant the new admin's power level
-        let conduit_user =
-            UserId::parse_with_server_name("conduit", services().globals.server_name())
-                .expect("@conduit:server_name is valid");
+            // Set power level
+            let mut users = BTreeMap::new();
+            users.insert(conduit_user.to_owned(), 100.into());
+            users.insert(user_id.to_owned(), 100.into());
 
-        // Invite and join the real user
-        services().rooms.timeline.build_and_append_pdu(
+            services()
+                .rooms
+                .timeline
+                .build_and_append_pdu(
+                    PduBuilder {
+                        event_type: TimelineEventType::RoomPowerLevels,
+                        content: to_raw_value(&RoomPowerLevelsEventContent {
+                            users,
+                            ..Default::default()
+                        })
+                        .expect("event is valid, we just created it"),
+                        unsigned: None,
+                        state_key: Some("".to_owned()),
+                        redacts: None,
+                    },
+                    &conduit_user,
+                    &room_id,
+                    &state_lock,
+                )
+                .await?;
+
+            // Send welcome message
+            services().rooms.timeline.build_and_append_pdu(
             PduBuilder {
-                event_type: RoomEventType::RoomMember,
-                content: to_raw_value(&RoomMemberEventContent {
-                    membership: MembershipState::Invite,
-                    displayname: None,
-                    avatar_url: None,
-                    is_direct: None,
-                    third_party_invite: None,
-                    blurhash: None,
-                    reason: None,
-                    join_authorized_via_users_server: None,
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some(user_id.to_string()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomMember,
-                content: to_raw_value(&RoomMemberEventContent {
-                    membership: MembershipState::Join,
-                    displayname: Some(displayname),
-                    avatar_url: None,
-                    is_direct: None,
-                    third_party_invite: None,
-                    blurhash: None,
-                    reason: None,
-                    join_authorized_via_users_server: None,
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some(user_id.to_string()),
-                redacts: None,
-            },
-            user_id,
-            &room_id,
-            &state_lock,
-        )?;
-
-        // Set power level
-        let mut users = BTreeMap::new();
-        users.insert(conduit_user.to_owned(), 100.into());
-        users.insert(user_id.to_owned(), 100.into());
-
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomPowerLevels,
-                content: to_raw_value(&RoomPowerLevelsEventContent {
-                    users,
-                    ..Default::default()
-                })
-                .expect("event is valid, we just created it"),
-                unsigned: None,
-                state_key: Some("".to_owned()),
-                redacts: None,
-            },
-            &conduit_user,
-            &room_id,
-            &state_lock,
-        )?;
-
-        // Send welcome message
-        services().rooms.timeline.build_and_append_pdu(
-            PduBuilder {
-                event_type: RoomEventType::RoomMessage,
+                event_type: TimelineEventType::RoomMessage,
                 content: to_raw_value(&RoomMessageEventContent::text_html(
                         format!("## Thank you for trying out Conduit!\n\nConduit is currently in Beta. This means you can join and participate in most Matrix rooms, but not all features are supported and you might run into bugs from time to time.\n\nHelpful links:\n> Website: https://conduit.rs\n> Git and Documentation: https://gitlab.com/famedly/conduit\n> Report issues: https://gitlab.com/famedly/conduit/-/issues\n\nFor a list of available commands, send the following message in this room: `@conduit:{}: --help`\n\nHere are some rooms you can join (by typing the command):\n\nConduit room (Ask questions and get notified on updates):\n`/join #conduit:fachschaften.org`\n\nConduit lounge (Off-topic, only Conduit users are allowed to join)\n`/join #conduit-lounge:conduit.rs`", services().globals.server_name()),
                         format!("<h2>Thank you for trying out Conduit!</h2>\n<p>Conduit is currently in Beta. This means you can join and participate in most Matrix rooms, but not all features are supported and you might run into bugs from time to time.</p>\n<p>Helpful links:</p>\n<blockquote>\n<p>Website: https://conduit.rs<br>Git and Documentation: https://gitlab.com/famedly/conduit<br>Report issues: https://gitlab.com/famedly/conduit/-/issues</p>\n</blockquote>\n<p>For a list of available commands, send the following message in this room: <code>@conduit:{}: --help</code></p>\n<p>Here are some rooms you can join (by typing the command):</p>\n<p>Conduit room (Ask questions and get notified on updates):<br><code>/join #conduit:fachschaften.org</code></p>\n<p>Conduit lounge (Off-topic, only Conduit users are allowed to join)<br><code>/join #conduit-lounge:conduit.rs</code></p>\n", services().globals.server_name()),
@@ -1134,8 +1309,8 @@ impl Service {
             &conduit_user,
             &room_id,
             &state_lock,
-        )?;
-
+        ).await?;
+        }
         Ok(())
     }
 }
diff --git a/src/service/appservice/data.rs b/src/service/appservice/data.rs
index 744f0f94..ab19a50c 100644
--- a/src/service/appservice/data.rs
+++ b/src/service/appservice/data.rs
@@ -1,8 +1,10 @@
+use ruma::api::appservice::Registration;
+
 use crate::Result;
 
 pub trait Data: Send + Sync {
     /// Registers an appservice and returns the ID to the caller
-    fn register_appservice(&self, yaml: serde_yaml::Value) -> Result<String>;
+    fn register_appservice(&self, yaml: Registration) -> Result<String>;
 
     /// Remove an appservice registration
     ///
@@ -11,9 +13,9 @@ pub trait Data: Send + Sync {
     /// * `service_name` - the name you send to register the service previously
     fn unregister_appservice(&self, service_name: &str) -> Result<()>;
 
-    fn get_registration(&self, id: &str) -> Result<Option<serde_yaml::Value>>;
+    fn get_registration(&self, id: &str) -> Result<Option<Registration>>;
 
     fn iter_ids<'a>(&'a self) -> Result<Box<dyn Iterator<Item = Result<String>> + 'a>>;
 
-    fn all(&self) -> Result<Vec<(String, serde_yaml::Value)>>;
+    fn all(&self) -> Result<Vec<(String, Registration)>>;
 }
diff --git a/src/service/appservice/mod.rs b/src/service/appservice/mod.rs
index 3052964d..7d2d46bd 100644
--- a/src/service/appservice/mod.rs
+++ b/src/service/appservice/mod.rs
@@ -1,37 +1,184 @@
 mod data;
 
+use std::collections::BTreeMap;
+
 pub use data::Data;
 
-use crate::Result;
+use futures_util::Future;
+use regex::RegexSet;
+use ruma::api::appservice::{Namespace, Registration};
+use tokio::sync::RwLock;
+
+use crate::{services, Result};
+
+/// Compiled regular expressions for a namespace.
+#[derive(Clone, Debug)]
+pub struct NamespaceRegex {
+    pub exclusive: Option<RegexSet>,
+    pub non_exclusive: Option<RegexSet>,
+}
+
+impl NamespaceRegex {
+    /// Checks if this namespace has rights to a namespace
+    pub fn is_match(&self, heystack: &str) -> bool {
+        if self.is_exclusive_match(heystack) {
+            return true;
+        }
+
+        if let Some(non_exclusive) = &self.non_exclusive {
+            if non_exclusive.is_match(heystack) {
+                return true;
+            }
+        }
+        false
+    }
+
+    /// Checks if this namespace has exlusive rights to a namespace
+    pub fn is_exclusive_match(&self, heystack: &str) -> bool {
+        if let Some(exclusive) = &self.exclusive {
+            if exclusive.is_match(heystack) {
+                return true;
+            }
+        }
+        false
+    }
+}
+
+impl TryFrom<Vec<Namespace>> for NamespaceRegex {
+    fn try_from(value: Vec<Namespace>) -> Result<Self, regex::Error> {
+        let mut exclusive = vec![];
+        let mut non_exclusive = vec![];
+
+        for namespace in value {
+            if namespace.exclusive {
+                exclusive.push(namespace.regex);
+            } else {
+                non_exclusive.push(namespace.regex);
+            }
+        }
+
+        Ok(NamespaceRegex {
+            exclusive: if exclusive.is_empty() {
+                None
+            } else {
+                Some(RegexSet::new(exclusive)?)
+            },
+            non_exclusive: if non_exclusive.is_empty() {
+                None
+            } else {
+                Some(RegexSet::new(non_exclusive)?)
+            },
+        })
+    }
+
+    type Error = regex::Error;
+}
+
+/// Appservice registration combined with its compiled regular expressions.
+#[derive(Clone, Debug)]
+pub struct RegistrationInfo {
+    pub registration: Registration,
+    pub users: NamespaceRegex,
+    pub aliases: NamespaceRegex,
+    pub rooms: NamespaceRegex,
+}
+
+impl TryFrom<Registration> for RegistrationInfo {
+    fn try_from(value: Registration) -> Result<RegistrationInfo, regex::Error> {
+        Ok(RegistrationInfo {
+            users: value.namespaces.users.clone().try_into()?,
+            aliases: value.namespaces.aliases.clone().try_into()?,
+            rooms: value.namespaces.rooms.clone().try_into()?,
+            registration: value,
+        })
+    }
+
+    type Error = regex::Error;
+}
 
 pub struct Service {
     pub db: &'static dyn Data,
+    registration_info: RwLock<BTreeMap<String, RegistrationInfo>>,
 }
 
 impl Service {
-    /// Registers an appservice and returns the ID to the caller
-    pub fn register_appservice(&self, yaml: serde_yaml::Value) -> Result<String> {
+    pub fn build(db: &'static dyn Data) -> Result<Self> {
+        let mut registration_info = BTreeMap::new();
+        // Inserting registrations into cache
+        for appservice in db.all()? {
+            registration_info.insert(
+                appservice.0,
+                appservice
+                    .1
+                    .try_into()
+                    .expect("Should be validated on registration"),
+            );
+        }
+
+        Ok(Self {
+            db,
+            registration_info: RwLock::new(registration_info),
+        })
+    }
+    /// Registers an appservice and returns the ID to the caller.
+    pub async fn register_appservice(&self, yaml: Registration) -> Result<String> {
+        services()
+            .appservice
+            .registration_info
+            .write()
+            .await
+            .insert(yaml.id.clone(), yaml.clone().try_into()?);
+
         self.db.register_appservice(yaml)
     }
 
-    /// Remove an appservice registration
+    /// Removes an appservice registration.
     ///
     /// # Arguments
     ///
     /// * `service_name` - the name you send to register the service previously
-    pub fn unregister_appservice(&self, service_name: &str) -> Result<()> {
+    pub async fn unregister_appservice(&self, service_name: &str) -> Result<()> {
+        services()
+            .appservice
+            .registration_info
+            .write()
+            .await
+            .remove(service_name)
+            .ok_or_else(|| crate::Error::AdminCommand("Appservice not found"))?;
+
         self.db.unregister_appservice(service_name)
     }
 
-    pub fn get_registration(&self, id: &str) -> Result<Option<serde_yaml::Value>> {
-        self.db.get_registration(id)
+    pub async fn get_registration(&self, id: &str) -> Option<Registration> {
+        self.registration_info
+            .read()
+            .await
+            .get(id)
+            .cloned()
+            .map(|info| info.registration)
     }
 
-    pub fn iter_ids(&self) -> Result<impl Iterator<Item = Result<String>> + '_> {
-        self.db.iter_ids()
+    pub async fn iter_ids(&self) -> Vec<String> {
+        self.registration_info
+            .read()
+            .await
+            .keys()
+            .cloned()
+            .collect()
     }
 
-    pub fn all(&self) -> Result<Vec<(String, serde_yaml::Value)>> {
-        self.db.all()
+    pub async fn find_from_token(&self, token: &str) -> Option<RegistrationInfo> {
+        self.read()
+            .await
+            .values()
+            .find(|info| info.registration.as_token == token)
+            .cloned()
+    }
+
+    pub fn read(
+        &self,
+    ) -> impl Future<Output = tokio::sync::RwLockReadGuard<'_, BTreeMap<String, RegistrationInfo>>>
+    {
+        self.registration_info.read()
     }
 }
diff --git a/src/service/globals/data.rs b/src/service/globals/data.rs
index 04371a0a..8a66751b 100644
--- a/src/service/globals/data.rs
+++ b/src/service/globals/data.rs
@@ -13,9 +13,12 @@ use crate::Result;
 pub trait Data: Send + Sync {
     fn next_count(&self) -> Result<u64>;
     fn current_count(&self) -> Result<u64>;
+    fn last_check_for_updates_id(&self) -> Result<u64>;
+    fn update_check_for_updates_id(&self, id: u64) -> Result<()>;
     async fn watch(&self, user_id: &UserId, device_id: &DeviceId) -> Result<()>;
     fn cleanup(&self) -> Result<()>;
-    fn memory_usage(&self) -> Result<String>;
+    fn memory_usage(&self) -> String;
+    fn clear_caches(&self, amount: u32);
     fn load_keypair(&self) -> Result<Ed25519KeyPair>;
     fn remove_keypair(&self) -> Result<()>;
     fn add_signing_key(
diff --git a/src/service/globals/mod.rs b/src/service/globals/mod.rs
index 769a37a9..57031de5 100644
--- a/src/service/globals/mod.rs
+++ b/src/service/globals/mod.rs
@@ -1,13 +1,20 @@
 mod data;
 pub use data::Data;
 use ruma::{
-    OwnedDeviceId, OwnedEventId, OwnedRoomId, OwnedServerName, OwnedServerSigningKeyId, OwnedUserId,
+    serde::Base64, OwnedDeviceId, OwnedEventId, OwnedRoomId, OwnedServerName,
+    OwnedServerSigningKeyId, OwnedUserId,
 };
 use sha2::Digest;
 
 use crate::api::server_server::FedDest;
 
 use crate::{services, Config, Error, Result};
+use futures_util::FutureExt;
+use hyper::{
+    client::connect::dns::{GaiResolver, Name},
+    service::Service as HyperService,
+};
+use reqwest::dns::{Addrs, Resolve, Resolving};
 use ruma::{
     api::{
         client::sync::sync_events,
@@ -17,20 +24,24 @@ use ruma::{
 };
 use std::{
     collections::{BTreeMap, HashMap},
+    error::Error as StdError,
     fs,
-    future::Future,
+    future::{self, Future},
+    iter,
     net::{IpAddr, SocketAddr},
     path::PathBuf,
     sync::{
         atomic::{self, AtomicBool},
-        Arc, Mutex, RwLock,
+        Arc, Mutex, RwLock as StdRwLock,
     },
     time::{Duration, Instant},
 };
-use tokio::sync::{broadcast, watch::Receiver, Mutex as TokioMutex, Semaphore};
+use tokio::sync::{broadcast, watch::Receiver, Mutex, RwLock, Semaphore};
 use tracing::{error, info};
 use trust_dns_resolver::TokioAsyncResolver;
 
+use base64::{engine::general_purpose, Engine as _};
+
 type WellKnownMap = HashMap<OwnedServerName, (FedDest, String)>;
 type TlsNameMap = HashMap<String, (Vec<IpAddr>, u16)>;
 type RateLimitState = (Instant, u32); // Time if last failed try, number of failed tries
@@ -43,7 +54,7 @@ pub struct Service {
     pub db: &'static dyn Data,
 
     pub actual_destination_cache: Arc<RwLock<WellKnownMap>>, // actual_destination, host
-    pub tls_name_override: Arc<RwLock<TlsNameMap>>,
+    pub tls_name_override: Arc<StdRwLock<TlsNameMap>>,
     pub config: Config,
     keypair: Arc<ruma::signatures::Ed25519KeyPair>,
     dns_resolver: TokioAsyncResolver,
@@ -54,11 +65,12 @@ pub struct Service {
     pub unstable_room_versions: Vec<RoomVersionId>,
     pub bad_event_ratelimiter: Arc<RwLock<HashMap<OwnedEventId, RateLimitState>>>,
     pub bad_signature_ratelimiter: Arc<RwLock<HashMap<Vec<String>, RateLimitState>>>,
+    pub bad_query_ratelimiter: Arc<RwLock<HashMap<OwnedServerName, RateLimitState>>>,
     pub servername_ratelimiter: Arc<RwLock<HashMap<OwnedServerName, Arc<Semaphore>>>>,
     pub sync_receivers: RwLock<HashMap<(OwnedUserId, OwnedDeviceId), SyncHandle>>,
     pub roomid_mutex_insert: RwLock<HashMap<OwnedRoomId, Arc<Mutex<()>>>>,
-    pub roomid_mutex_state: RwLock<HashMap<OwnedRoomId, Arc<TokioMutex<()>>>>,
-    pub roomid_mutex_federation: RwLock<HashMap<OwnedRoomId, Arc<TokioMutex<()>>>>, // this lock will be held longer
+    pub roomid_mutex_state: RwLock<HashMap<OwnedRoomId, Arc<Mutex<()>>>>,
+    pub roomid_mutex_federation: RwLock<HashMap<OwnedRoomId, Arc<Mutex<()>>>>, // this lock will be held longer
     pub roomid_federationhandletime: RwLock<HashMap<OwnedRoomId, (OwnedEventId, Instant)>>,
     pub stateres_mutex: Arc<Mutex<()>>,
     pub rotate: RotationHandler,
@@ -96,6 +108,45 @@ impl Default for RotationHandler {
     }
 }
 
+pub struct Resolver {
+    inner: GaiResolver,
+    overrides: Arc<StdRwLock<TlsNameMap>>,
+}
+
+impl Resolver {
+    pub fn new(overrides: Arc<StdRwLock<TlsNameMap>>) -> Self {
+        Resolver {
+            inner: GaiResolver::new(),
+            overrides,
+        }
+    }
+}
+
+impl Resolve for Resolver {
+    fn resolve(&self, name: Name) -> Resolving {
+        self.overrides
+            .read()
+            .unwrap()
+            .get(name.as_str())
+            .and_then(|(override_name, port)| {
+                override_name.first().map(|first_name| {
+                    let x: Box<dyn Iterator<Item = SocketAddr> + Send> =
+                        Box::new(iter::once(SocketAddr::new(*first_name, *port)));
+                    let x: Resolving = Box::pin(future::ready(Ok(x)));
+                    x
+                })
+            })
+            .unwrap_or_else(|| {
+                let this = &mut self.inner.clone();
+                Box::pin(HyperService::<Name>::call(this, name).map(|result| {
+                    result
+                        .map(|addrs| -> Addrs { Box::new(addrs) })
+                        .map_err(|err| -> Box<dyn StdError + Send + Sync> { Box::new(err) })
+                }))
+            })
+    }
+}
+
 impl Service {
     pub fn load(db: &'static dyn Data, config: Config) -> Result<Self> {
         let keypair = db.load_keypair();
@@ -109,7 +160,7 @@ impl Service {
             }
         };
 
-        let tls_name_override = Arc::new(RwLock::new(TlsNameMap::new()));
+        let tls_name_override = Arc::new(StdRwLock::new(TlsNameMap::new()));
 
         let jwt_decoding_key = config
             .jwt_secret
@@ -117,14 +168,8 @@ impl Service {
             .map(|secret| jsonwebtoken::DecodingKey::from_secret(secret.as_bytes()));
 
         let default_client = reqwest_client_builder(&config)?.build()?;
-        let name_override = Arc::clone(&tls_name_override);
         let federation_client = reqwest_client_builder(&config)?
-            .resolve_fn(move |domain| {
-                let read_guard = name_override.read().unwrap();
-                let (override_name, port) = read_guard.get(&domain)?;
-                let first_name = override_name.get(0)?;
-                Some(SocketAddr::new(*first_name, *port))
-            })
+            .dns_resolver(Arc::new(Resolver::new(tls_name_override.clone())))
             .build()?;
 
         // Supported and stable room versions
@@ -158,6 +203,7 @@ impl Service {
             unstable_room_versions,
             bad_event_ratelimiter: Arc::new(RwLock::new(HashMap::new())),
             bad_signature_ratelimiter: Arc::new(RwLock::new(HashMap::new())),
+            bad_query_ratelimiter: Arc::new(RwLock::new(HashMap::new())),
             servername_ratelimiter: Arc::new(RwLock::new(HashMap::new())),
             roomid_mutex_state: RwLock::new(HashMap::new()),
             roomid_mutex_insert: RwLock::new(HashMap::new()),
@@ -209,6 +255,16 @@ impl Service {
         self.db.current_count()
     }
 
+    #[tracing::instrument(skip(self))]
+    pub fn last_check_for_updates_id(&self) -> Result<u64> {
+        self.db.last_check_for_updates_id()
+    }
+
+    #[tracing::instrument(skip(self))]
+    pub fn update_check_for_updates_id(&self, id: u64) -> Result<()> {
+        self.db.update_check_for_updates_id(id)
+    }
+
     pub async fn watch(&self, user_id: &UserId, device_id: &DeviceId) -> Result<()> {
         self.db.watch(user_id, device_id).await
     }
@@ -217,10 +273,6 @@ impl Service {
         self.db.cleanup()
     }
 
-    pub fn memory_usage(&self) -> Result<String> {
-        self.db.memory_usage()
-    }
-
     pub fn server_name(&self) -> &ServerName {
         self.config.server_name.as_ref()
     }
@@ -261,6 +313,10 @@ impl Service {
         self.config.enable_lightning_bolt
     }
 
+    pub fn allow_check_for_updates(&self) -> bool {
+        self.config.allow_check_for_updates
+    }
+
     pub fn trusted_servers(&self) -> &[OwnedServerName] {
         &self.config.trusted_servers
     }
@@ -323,7 +379,19 @@ impl Service {
         &self,
         origin: &ServerName,
     ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>> {
-        self.db.signing_keys_for(origin)
+        let mut keys = self.db.signing_keys_for(origin)?;
+        if origin == self.server_name() {
+            keys.insert(
+                format!("ed25519:{}", services().globals.keypair().version())
+                    .try_into()
+                    .expect("found invalid server signing keys in DB"),
+                VerifyKey {
+                    key: Base64::new(self.keypair.public_key().to_vec()),
+                },
+            );
+        }
+
+        Ok(keys)
     }
 
     pub fn database_version(&self) -> Result<u64> {
@@ -345,12 +413,9 @@ impl Service {
         let mut r = PathBuf::new();
         r.push(self.config.database_path.clone());
         r.push("media");
-        r.push(base64::encode_config(
-            // Using the hash of the key as the filename
-            // This is to prevent the total length of the path from exceeding the maximum length
-            sha2::Sha256::digest(key),
-            base64::URL_SAFE_NO_PAD,
-        ));
+        // Using the hash of the key as the filename
+        // This is to prevent the total length of the path from exceeding the maximum length
+        r.push(general_purpose::URL_SAFE_NO_PAD.encode(sha2::Sha256::digest(key));
         r
     }
 
@@ -363,10 +428,14 @@ impl Service {
         let mut r = PathBuf::new();
         r.push(self.config.database_path.clone());
         r.push("media");
-        r.push(base64::encode_config(key, base64::URL_SAFE_NO_PAD));
+        r.push(general_purpose::URL_SAFE_NO_PAD.encode(key));
         r
     }
 
+    pub fn well_known_client(&self) -> &Option<String> {
+        &self.config.well_known_client
+    }
+
     pub fn shutdown(&self) {
         self.shutdown.store(true, atomic::Ordering::Relaxed);
         // On shutdown
diff --git a/src/service/media/mod.rs b/src/service/media/mod.rs
index 1b243392..064e8ba2 100644
--- a/src/service/media/mod.rs
+++ b/src/service/media/mod.rs
@@ -8,7 +8,7 @@ use image::imageops::FilterType;
 
 use tokio::{
     fs::File,
-    io::{AsyncReadExt, AsyncWriteExt},
+    io::{AsyncReadExt, AsyncWriteExt, BufReader},
 };
 
 pub struct FileMeta {
@@ -70,7 +70,9 @@ impl Service {
         {
             let path = services().globals.get_media_file(&key);
             let mut file = Vec::new();
-            File::open(path).await?.read_to_end(&mut file).await?;
+            BufReader::new(File::open(path).await?)
+                .read_to_end(&mut file)
+                .await?;
 
             Ok(Some(FileMeta {
                 content_disposition,
diff --git a/src/service/mod.rs b/src/service/mod.rs
index eea397f7..4c11bc18 100644
--- a/src/service/mod.rs
+++ b/src/service/mod.rs
@@ -1,11 +1,13 @@
 use std::{
-    collections::HashMap,
-    sync::{Arc, Mutex},
+    collections::{BTreeMap, HashMap},
+    sync::{Arc, Mutex as StdMutex},
 };
 
 use lru_cache::LruCache;
+use tokio::sync::{broadcast, Mutex};
 
 use crate::{Config, Result};
+use tokio::sync::RwLock;
 
 pub mod account_data;
 pub mod admin;
@@ -55,7 +57,7 @@ impl Services {
         config: Config,
     ) -> Result<Self> {
         Ok(Self {
-            appservice: appservice::Service { db },
+            appservice: appservice::Service::build(db)?,
             pusher: pusher::Service { db },
             rooms: rooms::Service {
                 alias: rooms::alias::Service { db },
@@ -64,7 +66,11 @@ impl Services {
                 edus: rooms::edus::Service {
                     presence: rooms::edus::presence::Service { db },
                     read_receipt: rooms::edus::read_receipt::Service { db },
-                    typing: rooms::edus::typing::Service { db },
+                    typing: rooms::edus::typing::Service {
+                        typing: RwLock::new(BTreeMap::new()),
+                        last_typing_update: RwLock::new(BTreeMap::new()),
+                        typing_update_sender: broadcast::channel(100).0,
+                    },
                 },
                 event_handler: rooms::event_handler::Service,
                 lazy_loading: rooms::lazy_loading::Service {
@@ -79,17 +85,17 @@ impl Services {
                 state: rooms::state::Service { db },
                 state_accessor: rooms::state_accessor::Service {
                     db,
-                    server_visibility_cache: Mutex::new(LruCache::new(
+                    server_visibility_cache: StdMutex::new(LruCache::new(
                         (100.0 * config.conduit_cache_capacity_modifier) as usize,
                     )),
-                    user_visibility_cache: Mutex::new(LruCache::new(
+                    user_visibility_cache: StdMutex::new(LruCache::new(
                         (100.0 * config.conduit_cache_capacity_modifier) as usize,
                     )),
                 },
                 state_cache: rooms::state_cache::Service { db },
                 state_compressor: rooms::state_compressor::Service {
                     db,
-                    stateinfo_cache: Mutex::new(LruCache::new(
+                    stateinfo_cache: StdMutex::new(LruCache::new(
                         (100.0 * config.conduit_cache_capacity_modifier) as usize,
                     )),
                 },
@@ -97,11 +103,18 @@ impl Services {
                     db,
                     lasttimelinecount_cache: Mutex::new(HashMap::new()),
                 },
+                threads: rooms::threads::Service { db },
+                spaces: rooms::spaces::Service {
+                    roomid_spacechunk_cache: Mutex::new(LruCache::new(200)),
+                },
                 user: rooms::user::Service { db },
             },
             transaction_ids: transaction_ids::Service { db },
             uiaa: uiaa::Service { db },
-            users: users::Service { db },
+            users: users::Service {
+                db,
+                connections: StdMutex::new(BTreeMap::new()),
+            },
             account_data: account_data::Service { db },
             admin: admin::Service::build(),
             key_backups: key_backups::Service { db },
@@ -111,4 +124,97 @@ impl Services {
             globals: globals::Service::load(db, config)?,
         })
     }
+    async fn memory_usage(&self) -> String {
+        let lazy_load_waiting = self.rooms.lazy_loading.lazy_load_waiting.lock().await.len();
+        let server_visibility_cache = self
+            .rooms
+            .state_accessor
+            .server_visibility_cache
+            .lock()
+            .unwrap()
+            .len();
+        let user_visibility_cache = self
+            .rooms
+            .state_accessor
+            .user_visibility_cache
+            .lock()
+            .unwrap()
+            .len();
+        let stateinfo_cache = self
+            .rooms
+            .state_compressor
+            .stateinfo_cache
+            .lock()
+            .unwrap()
+            .len();
+        let lasttimelinecount_cache = self
+            .rooms
+            .timeline
+            .lasttimelinecount_cache
+            .lock()
+            .await
+            .len();
+        let roomid_spacechunk_cache = self.rooms.spaces.roomid_spacechunk_cache.lock().await.len();
+
+        format!(
+            "\
+lazy_load_waiting: {lazy_load_waiting}
+server_visibility_cache: {server_visibility_cache}
+user_visibility_cache: {user_visibility_cache}
+stateinfo_cache: {stateinfo_cache}
+lasttimelinecount_cache: {lasttimelinecount_cache}
+roomid_spacechunk_cache: {roomid_spacechunk_cache}\
+            "
+        )
+    }
+    async fn clear_caches(&self, amount: u32) {
+        if amount > 0 {
+            self.rooms
+                .lazy_loading
+                .lazy_load_waiting
+                .lock()
+                .await
+                .clear();
+        }
+        if amount > 1 {
+            self.rooms
+                .state_accessor
+                .server_visibility_cache
+                .lock()
+                .unwrap()
+                .clear();
+        }
+        if amount > 2 {
+            self.rooms
+                .state_accessor
+                .user_visibility_cache
+                .lock()
+                .unwrap()
+                .clear();
+        }
+        if amount > 3 {
+            self.rooms
+                .state_compressor
+                .stateinfo_cache
+                .lock()
+                .unwrap()
+                .clear();
+        }
+        if amount > 4 {
+            self.rooms
+                .timeline
+                .lasttimelinecount_cache
+                .lock()
+                .await
+                .clear();
+        }
+        if amount > 5 {
+            self.rooms
+                .spaces
+                .roomid_spacechunk_cache
+                .lock()
+                .await
+                .clear();
+        }
+    }
 }
diff --git a/src/service/pdu.rs b/src/service/pdu.rs
index 5b5cbd03..c8d78604 100644
--- a/src/service/pdu.rs
+++ b/src/service/pdu.rs
@@ -1,9 +1,9 @@
 use crate::Error;
 use ruma::{
     events::{
-        room::member::RoomMemberEventContent, AnyEphemeralRoomEvent, AnyStateEvent,
-        AnyStrippedStateEvent, AnySyncStateEvent, AnySyncTimelineEvent, AnyTimelineEvent,
-        RoomEventType, StateEvent,
+        room::member::RoomMemberEventContent, space::child::HierarchySpaceChildEvent,
+        AnyEphemeralRoomEvent, AnyMessageLikeEvent, AnyStateEvent, AnyStrippedStateEvent,
+        AnySyncStateEvent, AnySyncTimelineEvent, AnyTimelineEvent, StateEvent, TimelineEventType,
     },
     serde::Raw,
     state_res, CanonicalJsonObject, CanonicalJsonValue, EventId, MilliSecondsSinceUnixEpoch,
@@ -31,7 +31,7 @@ pub struct PduEvent {
     pub sender: OwnedUserId,
     pub origin_server_ts: UInt,
     #[serde(rename = "type")]
-    pub kind: RoomEventType,
+    pub kind: TimelineEventType,
     pub content: Box<RawJsonValue>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub state_key: Option<String>,
@@ -53,10 +53,10 @@ impl PduEvent {
         self.unsigned = None;
 
         let allowed: &[&str] = match self.kind {
-            RoomEventType::RoomMember => &["join_authorised_via_users_server", "membership"],
-            RoomEventType::RoomCreate => &["creator"],
-            RoomEventType::RoomJoinRules => &["join_rule"],
-            RoomEventType::RoomPowerLevels => &[
+            TimelineEventType::RoomMember => &["join_authorised_via_users_server", "membership"],
+            TimelineEventType::RoomCreate => &["creator"],
+            TimelineEventType::RoomJoinRules => &["join_rule"],
+            TimelineEventType::RoomPowerLevels => &[
                 "ban",
                 "events",
                 "events_default",
@@ -66,7 +66,7 @@ impl PduEvent {
                 "users",
                 "users_default",
             ],
-            RoomEventType::RoomHistoryVisibility => &["history_visibility"],
+            TimelineEventType::RoomHistoryVisibility => &["history_visibility"],
             _ => &[],
         };
 
@@ -103,6 +103,19 @@ impl PduEvent {
         Ok(())
     }
 
+    pub fn add_age(&mut self) -> crate::Result<()> {
+        let mut unsigned: BTreeMap<String, Box<RawJsonValue>> = self
+            .unsigned
+            .as_ref()
+            .map_or_else(|| Ok(BTreeMap::new()), |u| serde_json::from_str(u.get()))
+            .map_err(|_| Error::bad_database("Invalid unsigned in pdu event"))?;
+
+        unsigned.insert("age".to_owned(), to_raw_value(&1).unwrap());
+        self.unsigned = Some(to_raw_value(&unsigned).expect("unsigned is valid"));
+
+        Ok(())
+    }
+
     #[tracing::instrument(skip(self))]
     pub fn to_sync_room_event(&self) -> Raw<AnySyncTimelineEvent> {
         let mut json = json!({
@@ -175,6 +188,30 @@ impl PduEvent {
         serde_json::from_value(json).expect("Raw::from_value always works")
     }
 
+    #[tracing::instrument(skip(self))]
+    pub fn to_message_like_event(&self) -> Raw<AnyMessageLikeEvent> {
+        let mut json = json!({
+            "content": self.content,
+            "type": self.kind,
+            "event_id": self.event_id,
+            "sender": self.sender,
+            "origin_server_ts": self.origin_server_ts,
+            "room_id": self.room_id,
+        });
+
+        if let Some(unsigned) = &self.unsigned {
+            json["unsigned"] = json!(unsigned);
+        }
+        if let Some(state_key) = &self.state_key {
+            json["state_key"] = json!(state_key);
+        }
+        if let Some(redacts) = &self.redacts {
+            json["redacts"] = json!(redacts);
+        }
+
+        serde_json::from_value(json).expect("Raw::from_value always works")
+    }
+
     #[tracing::instrument(skip(self))]
     pub fn to_state_event(&self) -> Raw<AnyStateEvent> {
         let mut json = json!({
@@ -224,6 +261,19 @@ impl PduEvent {
         serde_json::from_value(json).expect("Raw::from_value always works")
     }
 
+    #[tracing::instrument(skip(self))]
+    pub fn to_stripped_spacechild_state_event(&self) -> Raw<HierarchySpaceChildEvent> {
+        let json = json!({
+            "content": self.content,
+            "type": self.kind,
+            "sender": self.sender,
+            "state_key": self.state_key,
+            "origin_server_ts": self.origin_server_ts,
+        });
+
+        serde_json::from_value(json).expect("Raw::from_value always works")
+    }
+
     #[tracing::instrument(skip(self))]
     pub fn to_member_event(&self) -> Raw<StateEvent<RoomMemberEventContent>> {
         let mut json = json!({
@@ -296,7 +346,7 @@ impl state_res::Event for PduEvent {
         &self.sender
     }
 
-    fn event_type(&self) -> &RoomEventType {
+    fn event_type(&self) -> &TimelineEventType {
         &self.kind
     }
 
@@ -335,7 +385,7 @@ impl PartialEq for PduEvent {
 }
 impl PartialOrd for PduEvent {
     fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
-        self.event_id.partial_cmp(&other.event_id)
+        Some(self.cmp(other))
     }
 }
 impl Ord for PduEvent {
@@ -372,7 +422,7 @@ pub(crate) fn gen_event_id_canonical_json(
 #[derive(Debug, Deserialize)]
 pub struct PduBuilder {
     #[serde(rename = "type")]
-    pub event_type: RoomEventType,
+    pub event_type: TimelineEventType,
     pub content: Box<RawJsonValue>,
     pub unsigned: Option<BTreeMap<String, serde_json::Value>>,
     pub state_key: Option<String>,
diff --git a/src/service/pusher/mod.rs b/src/service/pusher/mod.rs
index ba096a2d..6ca86be7 100644
--- a/src/service/pusher/mod.rs
+++ b/src/service/pusher/mod.rs
@@ -1,6 +1,6 @@
 mod data;
 pub use data::Data;
-use ruma::events::AnySyncTimelineEvent;
+use ruma::{events::AnySyncTimelineEvent, push::PushConditionPowerLevelsCtx};
 
 use crate::{services, Error, PduEvent, Result};
 use bytes::BytesMut;
@@ -13,10 +13,7 @@ use ruma::{
         },
         IncomingResponse, MatrixVersion, OutgoingRequest, SendAccessToken,
     },
-    events::{
-        room::{name::RoomNameEventContent, power_levels::RoomPowerLevelsEventContent},
-        RoomEventType, StateEventType,
-    },
+    events::{room::power_levels::RoomPowerLevelsEventContent, StateEventType, TimelineEventType},
     push::{Action, PushConditionRoomCtx, PushFormat, Ruleset, Tweak},
     serde::Raw,
     uint, RoomId, UInt, UserId,
@@ -69,8 +66,7 @@ impl Service {
             })?
             .map(|body| body.freeze());
 
-        let reqwest_request = reqwest::Request::try_from(http_request)
-            .expect("all http requests are valid reqwest requests");
+        let reqwest_request = reqwest::Request::try_from(http_request)?;
 
         // TODO: we could keep this very short and let expo backoff do it's thing...
         //*reqwest_request.timeout_mut() = Some(Duration::from_secs(5));
@@ -162,13 +158,12 @@ impl Service {
             &pdu.room_id,
         )? {
             let n = match action {
-                Action::DontNotify => false,
-                // TODO: Implement proper support for coalesce
-                Action::Notify | Action::Coalesce => true,
+                Action::Notify => true,
                 Action::SetTweak(tweak) => {
                     tweaks.push(tweak.clone());
                     continue;
                 }
+                _ => false,
             };
 
             if notify.is_some() {
@@ -197,6 +192,12 @@ impl Service {
         pdu: &Raw<AnySyncTimelineEvent>,
         room_id: &RoomId,
     ) -> Result<&'a [Action]> {
+        let power_levels = PushConditionPowerLevelsCtx {
+            users: power_levels.users.clone(),
+            users_default: power_levels.users_default,
+            notifications: power_levels.notifications.clone(),
+        };
+
         let ctx = PushConditionRoomCtx {
             room_id: room_id.to_owned(),
             member_count: 10_u32.into(), // TODO: get member count efficiently
@@ -205,9 +206,7 @@ impl Service {
                 .users
                 .displayname(user)?
                 .unwrap_or_else(|| user.localpart().to_owned()),
-            users_power_levels: power_levels.users.clone(),
-            default_power_level: power_levels.users_default,
-            notification_power_levels: power_levels.notifications.clone(),
+            power_levels: Some(power_levels),
         };
 
         Ok(ruleset.get_actions(pdu, &ctx))
@@ -248,7 +247,7 @@ impl Service {
                 // TODO: missed calls
                 notifi.counts = NotificationCounts::new(unread, uint!(0));
 
-                if event.kind == RoomEventType::RoomEncrypted
+                if event.kind == TimelineEventType::RoomEncrypted
                     || tweaks
                         .iter()
                         .any(|t| matches!(t, Tweak::Highlight(true) | Tweak::Sound(_)))
@@ -264,28 +263,14 @@ impl Service {
                     notifi.event_type = Some(event.kind.clone());
                     notifi.content = serde_json::value::to_raw_value(&event.content).ok();
 
-                    if event.kind == RoomEventType::RoomMember {
+                    if event.kind == TimelineEventType::RoomMember {
                         notifi.user_is_target =
                             event.state_key.as_deref() == Some(event.sender.as_str());
                     }
 
                     notifi.sender_display_name = services().users.displayname(&event.sender)?;
 
-                    let room_name = if let Some(room_name_pdu) = services()
-                        .rooms
-                        .state_accessor
-                        .room_state_get(&event.room_id, &StateEventType::RoomName, "")?
-                    {
-                        serde_json::from_str::<RoomNameEventContent>(room_name_pdu.content.get())
-                            .map_err(|_| {
-                                Error::bad_database("Invalid room name event in database.")
-                            })?
-                            .name
-                    } else {
-                        None
-                    };
-
-                    notifi.room_name = room_name;
+                    notifi.room_name = services().rooms.state_accessor.get_name(&event.room_id)?;
 
                     self.send_request(&http.url, send_event_notification::v1::Request::new(notifi))
                         .await?;
diff --git a/src/service/rooms/edus/mod.rs b/src/service/rooms/edus/mod.rs
index cf7a3591..a6bc3d5b 100644
--- a/src/service/rooms/edus/mod.rs
+++ b/src/service/rooms/edus/mod.rs
@@ -2,7 +2,7 @@ pub mod presence;
 pub mod read_receipt;
 pub mod typing;
 
-pub trait Data: presence::Data + read_receipt::Data + typing::Data + 'static {}
+pub trait Data: presence::Data + read_receipt::Data + 'static {}
 
 pub struct Service {
     pub presence: presence::Service,
diff --git a/src/service/rooms/edus/presence/mod.rs b/src/service/rooms/edus/presence/mod.rs
index 860aea18..4b929d28 100644
--- a/src/service/rooms/edus/presence/mod.rs
+++ b/src/service/rooms/edus/presence/mod.rs
@@ -17,29 +17,32 @@ impl Service {
     /// make sure users outside these rooms can't see them.
     pub fn update_presence(
         &self,
-        user_id: &UserId,
-        room_id: &RoomId,
-        presence: PresenceEvent,
+        _user_id: &UserId,
+        _room_id: &RoomId,
+        _presence: PresenceEvent,
     ) -> Result<()> {
-        self.db.update_presence(user_id, room_id, presence)
+        // self.db.update_presence(user_id, room_id, presence)
+        Ok(())
     }
 
     /// Resets the presence timeout, so the user will stay in their current presence state.
-    pub fn ping_presence(&self, user_id: &UserId) -> Result<()> {
-        self.db.ping_presence(user_id)
+    pub fn ping_presence(&self, _user_id: &UserId) -> Result<()> {
+        // self.db.ping_presence(user_id)
+        Ok(())
     }
 
     pub fn get_last_presence_event(
         &self,
-        user_id: &UserId,
-        room_id: &RoomId,
+        _user_id: &UserId,
+        _room_id: &RoomId,
     ) -> Result<Option<PresenceEvent>> {
-        let last_update = match self.db.last_presence_update(user_id)? {
-            Some(last) => last,
-            None => return Ok(None),
-        };
+        // let last_update = match self.db.last_presence_update(user_id)? {
+        //     Some(last) => last,
+        //     None => return Ok(None),
+        // };
 
-        self.db.get_presence_event(room_id, user_id, last_update)
+        // self.db.get_presence_event(room_id, user_id, last_update)
+        Ok(None)
     }
 
     /* TODO
@@ -111,12 +114,12 @@ impl Service {
     }*/
 
     /// Returns the most recent presence updates that happened after the event with id `since`.
-    #[tracing::instrument(skip(self, since, room_id))]
     pub fn presence_since(
         &self,
-        room_id: &RoomId,
-        since: u64,
+        _room_id: &RoomId,
+        _since: u64,
     ) -> Result<HashMap<OwnedUserId, PresenceEvent>> {
-        self.db.presence_since(room_id, since)
+        // self.db.presence_since(room_id, since)
+        Ok(HashMap::new())
     }
 }
diff --git a/src/service/rooms/edus/read_receipt/data.rs b/src/service/rooms/edus/read_receipt/data.rs
index a183d196..044dad82 100644
--- a/src/service/rooms/edus/read_receipt/data.rs
+++ b/src/service/rooms/edus/read_receipt/data.rs
@@ -11,6 +11,7 @@ pub trait Data: Send + Sync {
     ) -> Result<()>;
 
     /// Returns an iterator over the most recent read_receipts in a room that happened after the event with id `since`.
+    #[allow(clippy::type_complexity)]
     fn readreceipts_since<'a>(
         &'a self,
         room_id: &RoomId,
diff --git a/src/service/rooms/edus/typing/data.rs b/src/service/rooms/edus/typing/data.rs
deleted file mode 100644
index 3b1eecfb..00000000
--- a/src/service/rooms/edus/typing/data.rs
+++ /dev/null
@@ -1,21 +0,0 @@
-use crate::Result;
-use ruma::{OwnedUserId, RoomId, UserId};
-use std::collections::HashSet;
-
-pub trait Data: Send + Sync {
-    /// Sets a user as typing until the timeout timestamp is reached or roomtyping_remove is
-    /// called.
-    fn typing_add(&self, user_id: &UserId, room_id: &RoomId, timeout: u64) -> Result<()>;
-
-    /// Removes a user from typing before the timeout is reached.
-    fn typing_remove(&self, user_id: &UserId, room_id: &RoomId) -> Result<()>;
-
-    /// Makes sure that typing events with old timestamps get removed.
-    fn typings_maintain(&self, room_id: &RoomId) -> Result<()>;
-
-    /// Returns the count of the last typing update in this room.
-    fn last_typing_update(&self, room_id: &RoomId) -> Result<u64>;
-
-    /// Returns all user ids currently typing.
-    fn typings_all(&self, room_id: &RoomId) -> Result<HashSet<OwnedUserId>>;
-}
diff --git a/src/service/rooms/edus/typing/mod.rs b/src/service/rooms/edus/typing/mod.rs
index 7d44f7d7..7546aa84 100644
--- a/src/service/rooms/edus/typing/mod.rs
+++ b/src/service/rooms/edus/typing/mod.rs
@@ -1,48 +1,117 @@
-mod data;
+use ruma::{events::SyncEphemeralRoomEvent, OwnedRoomId, OwnedUserId, RoomId, UserId};
+use std::collections::BTreeMap;
+use tokio::sync::{broadcast, RwLock};
 
-pub use data::Data;
-use ruma::{events::SyncEphemeralRoomEvent, RoomId, UserId};
-
-use crate::Result;
+use crate::{services, utils, Result};
 
 pub struct Service {
-    pub db: &'static dyn Data,
+    pub typing: RwLock<BTreeMap<OwnedRoomId, BTreeMap<OwnedUserId, u64>>>, // u64 is unix timestamp of timeout
+    pub last_typing_update: RwLock<BTreeMap<OwnedRoomId, u64>>, // timestamp of the last change to typing users
+    pub typing_update_sender: broadcast::Sender<OwnedRoomId>,
 }
 
 impl Service {
     /// Sets a user as typing until the timeout timestamp is reached or roomtyping_remove is
     /// called.
-    pub fn typing_add(&self, user_id: &UserId, room_id: &RoomId, timeout: u64) -> Result<()> {
-        self.db.typing_add(user_id, room_id, timeout)
+    pub async fn typing_add(&self, user_id: &UserId, room_id: &RoomId, timeout: u64) -> Result<()> {
+        self.typing
+            .write()
+            .await
+            .entry(room_id.to_owned())
+            .or_default()
+            .insert(user_id.to_owned(), timeout);
+        self.last_typing_update
+            .write()
+            .await
+            .insert(room_id.to_owned(), services().globals.next_count()?);
+        let _ = self.typing_update_sender.send(room_id.to_owned());
+        Ok(())
     }
 
     /// Removes a user from typing before the timeout is reached.
-    pub fn typing_remove(&self, user_id: &UserId, room_id: &RoomId) -> Result<()> {
-        self.db.typing_remove(user_id, room_id)
+    pub async fn typing_remove(&self, user_id: &UserId, room_id: &RoomId) -> Result<()> {
+        self.typing
+            .write()
+            .await
+            .entry(room_id.to_owned())
+            .or_default()
+            .remove(user_id);
+        self.last_typing_update
+            .write()
+            .await
+            .insert(room_id.to_owned(), services().globals.next_count()?);
+        let _ = self.typing_update_sender.send(room_id.to_owned());
+        Ok(())
+    }
+
+    pub async fn wait_for_update(&self, room_id: &RoomId) -> Result<()> {
+        let mut receiver = self.typing_update_sender.subscribe();
+        while let Ok(next) = receiver.recv().await {
+            if next == room_id {
+                break;
+            }
+        }
+
+        Ok(())
     }
 
     /// Makes sure that typing events with old timestamps get removed.
-    fn typings_maintain(&self, room_id: &RoomId) -> Result<()> {
-        self.db.typings_maintain(room_id)
+    async fn typings_maintain(&self, room_id: &RoomId) -> Result<()> {
+        let current_timestamp = utils::millis_since_unix_epoch();
+        let mut removable = Vec::new();
+        {
+            let typing = self.typing.read().await;
+            let Some(room) = typing.get(room_id) else {
+                return Ok(());
+            };
+            for (user, timeout) in room {
+                if *timeout < current_timestamp {
+                    removable.push(user.clone());
+                }
+            }
+            drop(typing);
+        }
+        if !removable.is_empty() {
+            let typing = &mut self.typing.write().await;
+            let room = typing.entry(room_id.to_owned()).or_default();
+            for user in removable {
+                room.remove(&user);
+            }
+            self.last_typing_update
+                .write()
+                .await
+                .insert(room_id.to_owned(), services().globals.next_count()?);
+            let _ = self.typing_update_sender.send(room_id.to_owned());
+        }
+        Ok(())
     }
 
     /// Returns the count of the last typing update in this room.
-    pub fn last_typing_update(&self, room_id: &RoomId) -> Result<u64> {
-        self.typings_maintain(room_id)?;
-
-        self.db.last_typing_update(room_id)
+    pub async fn last_typing_update(&self, room_id: &RoomId) -> Result<u64> {
+        self.typings_maintain(room_id).await?;
+        Ok(self
+            .last_typing_update
+            .read()
+            .await
+            .get(room_id)
+            .copied()
+            .unwrap_or(0))
     }
 
     /// Returns a new typing EDU.
-    pub fn typings_all(
+    pub async fn typings_all(
         &self,
         room_id: &RoomId,
     ) -> Result<SyncEphemeralRoomEvent<ruma::events::typing::TypingEventContent>> {
-        let user_ids = self.db.typings_all(room_id)?;
-
         Ok(SyncEphemeralRoomEvent {
             content: ruma::events::typing::TypingEventContent {
-                user_ids: user_ids.into_iter().collect(),
+                user_ids: self
+                    .typing
+                    .read()
+                    .await
+                    .get(room_id)
+                    .map(|m| m.keys().cloned().collect())
+                    .unwrap_or_default(),
             },
         })
     }
diff --git a/src/service/rooms/event_handler/mod.rs b/src/service/rooms/event_handler/mod.rs
index b01a2828..1547d406 100644
--- a/src/service/rooms/event_handler/mod.rs
+++ b/src/service/rooms/event_handler/mod.rs
@@ -1,25 +1,23 @@
 /// An async function that can recursively call itself.
 type AsyncRecursiveType<'a, T> = Pin<Box<dyn Future<Output = T> + 'a + Send>>;
 
-use ruma::{
-    api::federation::discovery::{get_remote_server_keys, get_server_keys},
-    CanonicalJsonObject, CanonicalJsonValue, OwnedServerName, OwnedServerSigningKeyId,
-    RoomVersionId,
-};
 use std::{
     collections::{hash_map, BTreeMap, HashMap, HashSet},
     pin::Pin,
-    sync::{Arc, RwLock, RwLockWriteGuard},
+    sync::Arc,
     time::{Duration, Instant, SystemTime},
 };
-use tokio::sync::Semaphore;
 
 use futures_util::{stream::FuturesUnordered, Future, StreamExt};
 use ruma::{
     api::{
         client::error::ErrorKind,
         federation::{
-            discovery::get_remote_server_keys_batch::{self, v2::QueryCriteria},
+            discovery::{
+                get_remote_server_keys,
+                get_remote_server_keys_batch::{self, v2::QueryCriteria},
+                get_server_keys,
+            },
             event::{get_event, get_room_state_ids},
             membership::create_join_event,
         },
@@ -31,13 +29,17 @@ use ruma::{
     int,
     serde::Base64,
     state_res::{self, RoomVersion, StateMap},
-    uint, EventId, MilliSecondsSinceUnixEpoch, RoomId, ServerName,
+    uint, CanonicalJsonObject, CanonicalJsonValue, EventId, MilliSecondsSinceUnixEpoch,
+    OwnedServerName, OwnedServerSigningKeyId, RoomId, RoomVersionId, ServerName,
 };
 use serde_json::value::RawValue as RawJsonValue;
+use tokio::sync::{RwLock, RwLockWriteGuard, Semaphore};
 use tracing::{debug, error, info, trace, warn};
 
 use crate::{service::*, services, Error, PduEvent, Result};
 
+use super::state_compressor::CompressedStateEvent;
+
 pub struct Service;
 
 impl Service {
@@ -62,9 +64,8 @@ impl Service {
     /// 12. Ensure that the state is derived from the previous current state (i.e. we calculated by
     ///     doing state res where one of the inputs was a previously trusted set of state, don't just
     ///     trust a set of state we got from a remote)
-    /// 13. Check if the event passes auth based on the "current state" of the room, if not "soft fail"
-    ///     it
-    /// 14. Use state resolution to find new room state
+    /// 13. Use state resolution to find new room state
+    /// 14. Check if the event passes auth based on the "current state" of the room, if not soft fail it
     // We use some AsyncRecursiveType hacks here so we can call this async funtion recursively
     #[tracing::instrument(skip(self, value, is_timeline_event, pub_key_map))]
     pub(crate) async fn handle_incoming_pdu<'a>(
@@ -91,6 +92,8 @@ impl Service {
             ));
         }
 
+        services().rooms.event_handler.acl_check(origin, room_id)?;
+
         // 1. Skip the PDU if we already have it as a timeline event
         if let Some(pdu_id) = services().rooms.timeline.get_pdu_id(event_id)? {
             return Ok(Some(pdu_id.to_vec()));
@@ -116,8 +119,17 @@ impl Service {
             .ok_or_else(|| Error::bad_database("Failed to find first pdu in db."))?;
 
         let (incoming_pdu, val) = self
-            .handle_outlier_pdu(origin, &create_event, event_id, room_id, value, pub_key_map)
+            .handle_outlier_pdu(
+                origin,
+                &create_event,
+                event_id,
+                room_id,
+                value,
+                false,
+                pub_key_map,
+            )
             .await?;
+        self.check_room_id(room_id, &incoming_pdu)?;
 
         // 8. if not timeline event: stop
         if !is_timeline_event {
@@ -156,7 +168,7 @@ impl Service {
                 .globals
                 .bad_event_ratelimiter
                 .read()
-                .unwrap()
+                .await
                 .get(&*prev_id)
             {
                 // Exponential backoff
@@ -172,7 +184,22 @@ impl Service {
             }
 
             if errors >= 5 {
-                break;
+                // Timeout other events
+                match services()
+                    .globals
+                    .bad_event_ratelimiter
+                    .write()
+                    .await
+                    .entry((*prev_id).to_owned())
+                {
+                    hash_map::Entry::Vacant(e) => {
+                        e.insert((Instant::now(), 1));
+                    }
+                    hash_map::Entry::Occupied(mut e) => {
+                        *e.get_mut() = (Instant::now(), e.get().1 + 1)
+                    }
+                }
+                continue;
             }
 
             if let Some((pdu, json)) = eventid_info.remove(&*prev_id) {
@@ -186,7 +213,7 @@ impl Service {
                     .globals
                     .roomid_federationhandletime
                     .write()
-                    .unwrap()
+                    .await
                     .insert(room_id.to_owned(), ((*prev_id).to_owned(), start_time));
 
                 if let Err(e) = self
@@ -206,7 +233,7 @@ impl Service {
                         .globals
                         .bad_event_ratelimiter
                         .write()
-                        .unwrap()
+                        .await
                         .entry((*prev_id).to_owned())
                     {
                         hash_map::Entry::Vacant(e) => {
@@ -222,9 +249,9 @@ impl Service {
                     .globals
                     .roomid_federationhandletime
                     .write()
-                    .unwrap()
+                    .await
                     .remove(&room_id.to_owned());
-                warn!(
+                debug!(
                     "Handling prev event {} took {}m{}s",
                     prev_id,
                     elapsed.as_secs() / 60,
@@ -240,7 +267,7 @@ impl Service {
             .globals
             .roomid_federationhandletime
             .write()
-            .unwrap()
+            .await
             .insert(room_id.to_owned(), (event_id.to_owned(), start_time));
         let r = services()
             .rooms
@@ -258,12 +285,13 @@ impl Service {
             .globals
             .roomid_federationhandletime
             .write()
-            .unwrap()
+            .await
             .remove(&room_id.to_owned());
 
         r
     }
 
+    #[allow(clippy::type_complexity, clippy::too_many_arguments)]
     #[tracing::instrument(skip(self, create_event, value, pub_key_map))]
     fn handle_outlier_pdu<'a>(
         &'a self,
@@ -272,6 +300,7 @@ impl Service {
         event_id: &'a EventId,
         room_id: &'a RoomId,
         mut value: BTreeMap<String, CanonicalJsonValue>,
+        auth_events_known: bool,
         pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
     ) -> AsyncRecursiveType<'a, Result<(Arc<PduEvent>, BTreeMap<String, CanonicalJsonValue>)>> {
         Box::pin(async move {
@@ -297,14 +326,11 @@ impl Service {
             let room_version =
                 RoomVersion::new(room_version_id).expect("room version is supported");
 
-            let mut val = match ruma::signatures::verify_event(
-                &pub_key_map.read().expect("RwLock is poisoned."),
-                &value,
-                room_version_id,
-            ) {
+            let guard = pub_key_map.read().await;
+            let mut val = match ruma::signatures::verify_event(&guard, &value, room_version_id) {
                 Err(e) => {
                     // Drop
-                    warn!("Dropping bad event {}: {}", event_id, e);
+                    warn!("Dropping bad event {}: {}", event_id, e,);
                     return Err(Error::BadRequest(
                         ErrorKind::InvalidParam,
                         "Signature verification failed",
@@ -313,7 +339,7 @@ impl Service {
                 Ok(ruma::signatures::Verified::Signatures) => {
                     // Redact
                     warn!("Calculated hash does not match: {}", event_id);
-                    match ruma::canonical_json::redact(value, room_version_id, None) {
+                    let obj = match ruma::canonical_json::redact(value, room_version_id, None) {
                         Ok(obj) => obj,
                         Err(_) => {
                             return Err(Error::BadRequest(
@@ -321,11 +347,23 @@ impl Service {
                                 "Redaction failed",
                             ))
                         }
+                    };
+
+                    // Skip the PDU if it is redacted and we already have it as an outlier event
+                    if services().rooms.timeline.get_pdu_json(event_id)?.is_some() {
+                        return Err(Error::BadRequest(
+                            ErrorKind::InvalidParam,
+                            "Event was redacted and we already knew about it",
+                        ));
                     }
+
+                    obj
                 }
                 Ok(ruma::signatures::Verified::All) => value,
             };
 
+            drop(guard);
+
             // Now that we have checked the signature and hashes we can add the eventID and convert
             // to our PduEvent type
             val.insert(
@@ -337,26 +375,30 @@ impl Service {
             )
             .map_err(|_| Error::bad_database("Event is not a valid PDU."))?;
 
-            // 4. fetch any missing auth events doing all checks listed here starting at 1. These are not timeline events
-            // 5. Reject "due to auth events" if can't get all the auth events or some of the auth events are also rejected "due to auth events"
-            // NOTE: Step 5 is not applied anymore because it failed too often
-            debug!(event_id = ?incoming_pdu.event_id, "Fetching auth events");
-            self.fetch_and_handle_outliers(
-                origin,
-                &incoming_pdu
-                    .auth_events
-                    .iter()
-                    .map(|x| Arc::from(&**x))
-                    .collect::<Vec<_>>(),
-                create_event,
-                room_id,
-                room_version_id,
-                pub_key_map,
-            )
-            .await;
+            self.check_room_id(room_id, &incoming_pdu)?;
+
+            if !auth_events_known {
+                // 4. fetch any missing auth events doing all checks listed here starting at 1. These are not timeline events
+                // 5. Reject "due to auth events" if can't get all the auth events or some of the auth events are also rejected "due to auth events"
+                // NOTE: Step 5 is not applied anymore because it failed too often
+                debug!(event_id = ?incoming_pdu.event_id, "Fetching auth events");
+                self.fetch_and_handle_outliers(
+                    origin,
+                    &incoming_pdu
+                        .auth_events
+                        .iter()
+                        .map(|x| Arc::from(&**x))
+                        .collect::<Vec<_>>(),
+                    create_event,
+                    room_id,
+                    room_version_id,
+                    pub_key_map,
+                )
+                .await;
+            }
 
             // 6. Reject "due to auth events" if the event doesn't pass auth based on the auth events
-            info!(
+            debug!(
                 "Auth check for {} based on auth events",
                 incoming_pdu.event_id
             );
@@ -372,6 +414,8 @@ impl Service {
                     }
                 };
 
+                self.check_room_id(room_id, &auth_event)?;
+
                 match auth_events.entry((
                     auth_event.kind.to_string().into(),
                     auth_event
@@ -418,7 +462,7 @@ impl Service {
                 ));
             }
 
-            info!("Validation successful.");
+            debug!("Validation successful.");
 
             // 7. Persist the event as an outlier.
             services()
@@ -426,7 +470,7 @@ impl Service {
                 .outlier
                 .add_pdu_outlier(&incoming_pdu.event_id, &val)?;
 
-            info!("Added pdu as outlier.");
+            debug!("Added pdu as outlier.");
 
             Ok((Arc::new(incoming_pdu), val))
         })
@@ -475,7 +519,7 @@ impl Service {
         // TODO: if we know the prev_events of the incoming event we can avoid the request and build
         // the state from a known point and resolve if > 1 prev_event
 
-        info!("Requesting state at event");
+        debug!("Requesting state at event");
         let mut state_at_incoming_event = None;
 
         if incoming_pdu.prev_events.len() == 1 {
@@ -498,7 +542,7 @@ impl Service {
             };
 
             if let Some(Ok(mut state)) = state {
-                info!("Using cached state");
+                debug!("Using cached state");
                 let prev_pdu = services()
                     .rooms
                     .timeline
@@ -522,7 +566,7 @@ impl Service {
                 state_at_incoming_event = Some(state);
             }
         } else {
-            info!("Calculating state at event using state res");
+            debug!("Calculating state at event using state res");
             let mut extremity_sstatehashes = HashMap::new();
 
             let mut okay = true;
@@ -631,7 +675,7 @@ impl Service {
         }
 
         if state_at_incoming_event.is_none() {
-            info!("Calling /state_ids");
+            debug!("Calling /state_ids");
             // Call /state_ids to find out what the state at this pdu is. We trust the server's
             // response to some extend, but we still do a lot of checks on the events
             match services()
@@ -646,14 +690,16 @@ impl Service {
                 .await
             {
                 Ok(res) => {
-                    info!("Fetching state events at event.");
+                    debug!("Fetching state events at event.");
+                    let collect = res
+                        .pdu_ids
+                        .iter()
+                        .map(|x| Arc::from(&**x))
+                        .collect::<Vec<_>>();
                     let state_vec = self
                         .fetch_and_handle_outliers(
                             origin,
-                            &res.pdu_ids
-                                .iter()
-                                .map(|x| Arc::from(&**x))
-                                .collect::<Vec<_>>(),
+                            &collect,
                             create_event,
                             room_id,
                             room_version_id,
@@ -709,7 +755,7 @@ impl Service {
         let state_at_incoming_event =
             state_at_incoming_event.expect("we always set this to some above");
 
-        info!("Starting auth check");
+        debug!("Starting auth check");
         // 11. Check the auth of the event passes based on the state of the event
         let check_result = state_res::event_auth::auth_check(
             &room_version,
@@ -733,16 +779,34 @@ impl Service {
                 "Event has failed auth check with state at the event.",
             ));
         }
-        info!("Auth check succeeded");
+        debug!("Auth check succeeded");
+
+        // Soft fail check before doing state res
+        let auth_events = services().rooms.state.get_auth_events(
+            room_id,
+            &incoming_pdu.kind,
+            &incoming_pdu.sender,
+            incoming_pdu.state_key.as_deref(),
+            &incoming_pdu.content,
+        )?;
+
+        let soft_fail = !state_res::event_auth::auth_check(
+            &room_version,
+            &incoming_pdu,
+            None::<PduEvent>,
+            |k, s| auth_events.get(&(k.clone(), s.to_owned())),
+        )
+        .map_err(|_e| Error::BadRequest(ErrorKind::InvalidParam, "Auth check failed."))?;
+
+        // 13. Use state resolution to find new room state
 
         // We start looking at current room state now, so lets lock the room
-
         let mutex_state = Arc::clone(
             services()
                 .globals
                 .roomid_mutex_state
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.to_owned())
                 .or_default(),
         );
@@ -750,7 +814,7 @@ impl Service {
 
         // Now we calculate the set of extremities this room has after the incoming event has been
         // applied. We start with the previous extremities (aka leaves)
-        info!("Calculating extremities");
+        debug!("Calculating extremities");
         let mut extremities = services().rooms.state.get_forward_extremities(room_id)?;
 
         // Remove any forward extremities that are referenced by this incoming event's prev_events
@@ -771,45 +835,68 @@ impl Service {
             )
         });
 
-        info!("Compressing state at event");
-        let state_ids_compressed = state_at_incoming_event
-            .iter()
-            .map(|(shortstatekey, id)| {
-                services()
-                    .rooms
-                    .state_compressor
-                    .compress_state_event(*shortstatekey, id)
-            })
-            .collect::<Result<_>>()?;
+        debug!("Compressing state at event");
+        let state_ids_compressed = Arc::new(
+            state_at_incoming_event
+                .iter()
+                .map(|(shortstatekey, id)| {
+                    services()
+                        .rooms
+                        .state_compressor
+                        .compress_state_event(*shortstatekey, id)
+                })
+                .collect::<Result<_>>()?,
+        );
 
-        // 13. Check if the event passes auth based on the "current state" of the room, if not "soft fail" it
-        info!("Starting soft fail auth check");
+        if incoming_pdu.state_key.is_some() {
+            debug!("Preparing for stateres to derive new room state");
 
-        let auth_events = services().rooms.state.get_auth_events(
-            room_id,
-            &incoming_pdu.kind,
-            &incoming_pdu.sender,
-            incoming_pdu.state_key.as_deref(),
-            &incoming_pdu.content,
-        )?;
+            // We also add state after incoming event to the fork states
+            let mut state_after = state_at_incoming_event.clone();
+            if let Some(state_key) = &incoming_pdu.state_key {
+                let shortstatekey = services().rooms.short.get_or_create_shortstatekey(
+                    &incoming_pdu.kind.to_string().into(),
+                    state_key,
+                )?;
 
-        let soft_fail = !state_res::event_auth::auth_check(
-            &room_version,
-            &incoming_pdu,
-            None::<PduEvent>,
-            |k, s| auth_events.get(&(k.clone(), s.to_owned())),
-        )
-        .map_err(|_e| Error::BadRequest(ErrorKind::InvalidParam, "Auth check failed."))?;
+                state_after.insert(shortstatekey, Arc::from(&*incoming_pdu.event_id));
+            }
+
+            let new_room_state = self
+                .resolve_state(room_id, room_version_id, state_after)
+                .await?;
+
+            // Set the new room state to the resolved state
+            debug!("Forcing new room state");
+
+            let (sstatehash, new, removed) = services()
+                .rooms
+                .state_compressor
+                .save_state(room_id, new_room_state)?;
+
+            services()
+                .rooms
+                .state
+                .force_state(room_id, sstatehash, new, removed, &state_lock)
+                .await?;
+        }
+
+        // 14. Check if the event passes auth based on the "current state" of the room, if not soft fail it
+        debug!("Starting soft fail auth check");
 
         if soft_fail {
-            services().rooms.timeline.append_incoming_pdu(
-                &incoming_pdu,
-                val,
-                extremities.iter().map(|e| (**e).to_owned()).collect(),
-                state_ids_compressed,
-                soft_fail,
-                &state_lock,
-            )?;
+            services()
+                .rooms
+                .timeline
+                .append_incoming_pdu(
+                    &incoming_pdu,
+                    val,
+                    extremities.iter().map(|e| (**e).to_owned()).collect(),
+                    state_ids_compressed,
+                    soft_fail,
+                    &state_lock,
+                )
+                .await?;
 
             // Soft fail, we keep the event as an outlier but don't add it to the timeline
             warn!("Event was soft failed: {:?}", incoming_pdu);
@@ -823,204 +910,128 @@ impl Service {
             ));
         }
 
-        if incoming_pdu.state_key.is_some() {
-            info!("Loading current room state ids");
-            let current_sstatehash = services()
-                .rooms
-                .state
-                .get_room_shortstatehash(room_id)?
-                .expect("every room has state");
-
-            let current_state_ids = services()
-                .rooms
-                .state_accessor
-                .state_full_ids(current_sstatehash)
-                .await?;
-
-            info!("Preparing for stateres to derive new room state");
-            let mut extremity_sstatehashes = HashMap::new();
-
-            info!(?extremities, "Loading extremities");
-            for id in &extremities {
-                match services().rooms.timeline.get_pdu(id)? {
-                    Some(leaf_pdu) => {
-                        extremity_sstatehashes.insert(
-                            services()
-                                .rooms
-                                .state_accessor
-                                .pdu_shortstatehash(&leaf_pdu.event_id)?
-                                .ok_or_else(|| {
-                                    error!(
-                                        "Found extremity pdu with no statehash in db: {:?}",
-                                        leaf_pdu
-                                    );
-                                    Error::bad_database("Found pdu with no statehash in db.")
-                                })?,
-                            leaf_pdu,
-                        );
-                    }
-                    _ => {
-                        error!("Missing state snapshot for {:?}", id);
-                        return Err(Error::BadDatabase("Missing state snapshot."));
-                    }
-                }
-            }
-
-            let mut fork_states = Vec::new();
-
-            // 12. Ensure that the state is derived from the previous current state (i.e. we calculated
-            //     by doing state res where one of the inputs was a previously trusted set of state,
-            //     don't just trust a set of state we got from a remote).
-
-            // We do this by adding the current state to the list of fork states
-            extremity_sstatehashes.remove(&current_sstatehash);
-            fork_states.push(current_state_ids);
-
-            // We also add state after incoming event to the fork states
-            let mut state_after = state_at_incoming_event.clone();
-            if let Some(state_key) = &incoming_pdu.state_key {
-                let shortstatekey = services().rooms.short.get_or_create_shortstatekey(
-                    &incoming_pdu.kind.to_string().into(),
-                    state_key,
-                )?;
-
-                state_after.insert(shortstatekey, Arc::from(&*incoming_pdu.event_id));
-            }
-            fork_states.push(state_after);
-
-            let mut update_state = false;
-            // 14. Use state resolution to find new room state
-            let new_room_state = if fork_states.is_empty() {
-                panic!("State is empty");
-            } else if fork_states.iter().skip(1).all(|f| &fork_states[0] == f) {
-                info!("State resolution trivial");
-                // There was only one state, so it has to be the room's current state (because that is
-                // always included)
-                fork_states[0]
-                    .iter()
-                    .map(|(k, id)| {
-                        services()
-                            .rooms
-                            .state_compressor
-                            .compress_state_event(*k, id)
-                    })
-                    .collect::<Result<_>>()?
-            } else {
-                info!("Loading auth chains");
-                // We do need to force an update to this room's state
-                update_state = true;
-
-                let mut auth_chain_sets = Vec::new();
-                for state in &fork_states {
-                    auth_chain_sets.push(
-                        services()
-                            .rooms
-                            .auth_chain
-                            .get_auth_chain(
-                                room_id,
-                                state.iter().map(|(_, id)| id.clone()).collect(),
-                            )
-                            .await?
-                            .collect(),
-                    );
-                }
-
-                info!("Loading fork states");
-
-                let fork_states: Vec<_> = fork_states
-                    .into_iter()
-                    .map(|map| {
-                        map.into_iter()
-                            .filter_map(|(k, id)| {
-                                services()
-                                    .rooms
-                                    .short
-                                    .get_statekey_from_short(k)
-                                    .map(|(ty, st_key)| ((ty.to_string().into(), st_key), id))
-                                    .ok()
-                            })
-                            .collect::<StateMap<_>>()
-                    })
-                    .collect();
-
-                info!("Resolving state");
-
-                let lock = services().globals.stateres_mutex.lock();
-                let state = match state_res::resolve(
-                    room_version_id,
-                    &fork_states,
-                    auth_chain_sets,
-                    |id| {
-                        let res = services().rooms.timeline.get_pdu(id);
-                        if let Err(e) = &res {
-                            error!("LOOK AT ME Failed to fetch event: {}", e);
-                        }
-                        res.ok().flatten()
-                    },
-                ) {
-                    Ok(new_state) => new_state,
-                    Err(_) => {
-                        return Err(Error::bad_database("State resolution failed, either an event could not be found or deserialization"));
-                    }
-                };
-
-                drop(lock);
-
-                info!("State resolution done. Compressing state");
-
-                state
-                    .into_iter()
-                    .map(|((event_type, state_key), event_id)| {
-                        let shortstatekey = services().rooms.short.get_or_create_shortstatekey(
-                            &event_type.to_string().into(),
-                            &state_key,
-                        )?;
-                        services()
-                            .rooms
-                            .state_compressor
-                            .compress_state_event(shortstatekey, &event_id)
-                    })
-                    .collect::<Result<_>>()?
-            };
-
-            // Set the new room state to the resolved state
-            if update_state {
-                info!("Forcing new room state");
-                let (sstatehash, new, removed) = services()
-                    .rooms
-                    .state_compressor
-                    .save_state(room_id, new_room_state)?;
-                services()
-                    .rooms
-                    .state
-                    .force_state(room_id, sstatehash, new, removed, &state_lock)
-                    .await?;
-            }
-        }
-
-        info!("Appending pdu to timeline");
+        debug!("Appending pdu to timeline");
         extremities.insert(incoming_pdu.event_id.clone());
 
         // Now that the event has passed all auth it is added into the timeline.
         // We use the `state_at_event` instead of `state_after` so we accurately
         // represent the state for this event.
 
-        let pdu_id = services().rooms.timeline.append_incoming_pdu(
-            &incoming_pdu,
-            val,
-            extremities.iter().map(|e| (**e).to_owned()).collect(),
-            state_ids_compressed,
-            soft_fail,
-            &state_lock,
-        )?;
+        let pdu_id = services()
+            .rooms
+            .timeline
+            .append_incoming_pdu(
+                &incoming_pdu,
+                val,
+                extremities.iter().map(|e| (**e).to_owned()).collect(),
+                state_ids_compressed,
+                soft_fail,
+                &state_lock,
+            )
+            .await?;
 
-        info!("Appended incoming pdu");
+        debug!("Appended incoming pdu");
 
         // Event has passed all auth/stateres checks
         drop(state_lock);
         Ok(pdu_id)
     }
 
+    async fn resolve_state(
+        &self,
+        room_id: &RoomId,
+        room_version_id: &RoomVersionId,
+        incoming_state: HashMap<u64, Arc<EventId>>,
+    ) -> Result<Arc<HashSet<CompressedStateEvent>>> {
+        debug!("Loading current room state ids");
+        let current_sstatehash = services()
+            .rooms
+            .state
+            .get_room_shortstatehash(room_id)?
+            .expect("every room has state");
+
+        let current_state_ids = services()
+            .rooms
+            .state_accessor
+            .state_full_ids(current_sstatehash)
+            .await?;
+
+        let fork_states = [current_state_ids, incoming_state];
+
+        let mut auth_chain_sets = Vec::new();
+        for state in &fork_states {
+            auth_chain_sets.push(
+                services()
+                    .rooms
+                    .auth_chain
+                    .get_auth_chain(room_id, state.iter().map(|(_, id)| id.clone()).collect())
+                    .await?
+                    .collect(),
+            );
+        }
+
+        debug!("Loading fork states");
+
+        let fork_states: Vec<_> = fork_states
+            .into_iter()
+            .map(|map| {
+                map.into_iter()
+                    .filter_map(|(k, id)| {
+                        services()
+                            .rooms
+                            .short
+                            .get_statekey_from_short(k)
+                            .map(|(ty, st_key)| ((ty.to_string().into(), st_key), id))
+                            .ok()
+                    })
+                    .collect::<StateMap<_>>()
+            })
+            .collect();
+
+        debug!("Resolving state");
+
+        let fetch_event = |id: &_| {
+            let res = services().rooms.timeline.get_pdu(id);
+            if let Err(e) = &res {
+                error!("LOOK AT ME Failed to fetch event: {}", e);
+            }
+            res.ok().flatten()
+        };
+
+        let lock = services().globals.stateres_mutex.lock();
+        let state = match state_res::resolve(
+            room_version_id,
+            &fork_states,
+            auth_chain_sets,
+            fetch_event,
+        ) {
+            Ok(new_state) => new_state,
+            Err(_) => {
+                return Err(Error::bad_database("State resolution failed, either an event could not be found or deserialization"));
+            }
+        };
+
+        drop(lock);
+
+        debug!("State resolution done. Compressing state");
+
+        let new_room_state = state
+            .into_iter()
+            .map(|((event_type, state_key), event_id)| {
+                let shortstatekey = services()
+                    .rooms
+                    .short
+                    .get_or_create_shortstatekey(&event_type.to_string().into(), &state_key)?;
+                services()
+                    .rooms
+                    .state_compressor
+                    .compress_state_event(shortstatekey, &event_id)
+            })
+            .collect::<Result<_>>()?;
+
+        Ok(Arc::new(new_room_state))
+    }
+
     /// Find the event and auth it. Once the event is validated (steps 1 - 8)
     /// it is appended to the outliers Tree.
     ///
@@ -1030,6 +1041,7 @@ impl Service {
     /// b. Look at outlier pdu tree
     /// c. Ask origin server over federation
     /// d. TODO: Ask other servers over federation?
+    #[allow(clippy::type_complexity)]
     #[tracing::instrument(skip_all)]
     pub(crate) fn fetch_and_handle_outliers<'a>(
         &'a self,
@@ -1042,41 +1054,25 @@ impl Service {
     ) -> AsyncRecursiveType<'a, Vec<(Arc<PduEvent>, Option<BTreeMap<String, CanonicalJsonValue>>)>>
     {
         Box::pin(async move {
-            let back_off = |id| match services()
-                .globals
-                .bad_event_ratelimiter
-                .write()
-                .unwrap()
-                .entry(id)
-            {
-                hash_map::Entry::Vacant(e) => {
-                    e.insert((Instant::now(), 1));
+            let back_off = |id| async move {
+                match services()
+                    .globals
+                    .bad_event_ratelimiter
+                    .write()
+                    .await
+                    .entry(id)
+                {
+                    hash_map::Entry::Vacant(e) => {
+                        e.insert((Instant::now(), 1));
+                    }
+                    hash_map::Entry::Occupied(mut e) => {
+                        *e.get_mut() = (Instant::now(), e.get().1 + 1)
+                    }
                 }
-                hash_map::Entry::Occupied(mut e) => *e.get_mut() = (Instant::now(), e.get().1 + 1),
             };
 
             let mut pdus = vec![];
             for id in events {
-                if let Some((time, tries)) = services()
-                    .globals
-                    .bad_event_ratelimiter
-                    .read()
-                    .unwrap()
-                    .get(&**id)
-                {
-                    // Exponential backoff
-                    let mut min_elapsed_duration =
-                        Duration::from_secs(5 * 60) * (*tries) * (*tries);
-                    if min_elapsed_duration > Duration::from_secs(60 * 60 * 24) {
-                        min_elapsed_duration = Duration::from_secs(60 * 60 * 24);
-                    }
-
-                    if time.elapsed() < min_elapsed_duration {
-                        info!("Backing off from {}", id);
-                        continue;
-                    }
-                }
-
                 // a. Look in the main timeline (pduid_pdu tree)
                 // b. Look at outlier pdu tree
                 // (get_pdu_json checks both)
@@ -1094,6 +1090,26 @@ impl Service {
                 let mut events_all = HashSet::new();
                 let mut i = 0;
                 while let Some(next_id) = todo_auth_events.pop() {
+                    if let Some((time, tries)) = services()
+                        .globals
+                        .bad_event_ratelimiter
+                        .read()
+                        .await
+                        .get(&*next_id)
+                    {
+                        // Exponential backoff
+                        let mut min_elapsed_duration =
+                            Duration::from_secs(5 * 60) * (*tries) * (*tries);
+                        if min_elapsed_duration > Duration::from_secs(60 * 60 * 24) {
+                            min_elapsed_duration = Duration::from_secs(60 * 60 * 24);
+                        }
+
+                        if time.elapsed() < min_elapsed_duration {
+                            info!("Backing off from {}", next_id);
+                            continue;
+                        }
+                    }
+
                     if events_all.contains(&next_id) {
                         continue;
                     }
@@ -1104,7 +1120,7 @@ impl Service {
                     }
 
                     if let Ok(Some(_)) = services().rooms.timeline.get_pdu(&next_id) {
-                        trace!("Found {} in db", id);
+                        trace!("Found {} in db", next_id);
                         continue;
                     }
 
@@ -1125,7 +1141,7 @@ impl Service {
                                 match pdu::gen_event_id_canonical_json(&res.pdu, room_version_id) {
                                     Ok(t) => t,
                                     Err(_) => {
-                                        back_off((*next_id).to_owned());
+                                        back_off((*next_id).to_owned()).await;
                                         continue;
                                     }
                                 };
@@ -1157,12 +1173,32 @@ impl Service {
                         }
                         Err(_) => {
                             warn!("Failed to fetch event: {}", next_id);
-                            back_off((*next_id).to_owned());
+                            back_off((*next_id).to_owned()).await;
                         }
                     }
                 }
 
                 for (next_id, value) in events_in_reverse_order.iter().rev() {
+                    if let Some((time, tries)) = services()
+                        .globals
+                        .bad_event_ratelimiter
+                        .read()
+                        .await
+                        .get(&**next_id)
+                    {
+                        // Exponential backoff
+                        let mut min_elapsed_duration =
+                            Duration::from_secs(5 * 60) * (*tries) * (*tries);
+                        if min_elapsed_duration > Duration::from_secs(60 * 60 * 24) {
+                            min_elapsed_duration = Duration::from_secs(60 * 60 * 24);
+                        }
+
+                        if time.elapsed() < min_elapsed_duration {
+                            info!("Backing off from {}", next_id);
+                            continue;
+                        }
+                    }
+
                     match self
                         .handle_outlier_pdu(
                             origin,
@@ -1170,6 +1206,7 @@ impl Service {
                             next_id,
                             room_id,
                             value.clone(),
+                            true,
                             pub_key_map,
                         )
                         .await
@@ -1181,7 +1218,7 @@ impl Service {
                         }
                         Err(e) => {
                             warn!("Authentication of event {} failed: {:?}", next_id, e);
-                            back_off((**next_id).to_owned());
+                            back_off((**next_id).to_owned()).await;
                         }
                     }
                 }
@@ -1227,6 +1264,8 @@ impl Service {
                 .await
                 .pop()
             {
+                self.check_room_id(room_id, &pdu)?;
+
                 if amount > services().globals.max_fetch_prev_events() {
                     // Max limit reached
                     warn!("Max prev event limit reached!");
@@ -1334,7 +1373,7 @@ impl Service {
 
             pub_key_map
                 .write()
-                .map_err(|_| Error::bad_database("RwLock is poisoned."))?
+                .await
                 .insert(signature_server.clone(), keys);
         }
 
@@ -1343,7 +1382,7 @@ impl Service {
 
     // Gets a list of servers for which we don't have the signing key yet. We go over
     // the PDUs and either cache the key or add it to the list that needs to be retrieved.
-    fn get_server_keys_from_cache(
+    async fn get_server_keys_from_cache(
         &self,
         pdu: &RawJsonValue,
         servers: &mut BTreeMap<OwnedServerName, BTreeMap<OwnedServerSigningKeyId, QueryCriteria>>,
@@ -1367,7 +1406,7 @@ impl Service {
             .globals
             .bad_event_ratelimiter
             .read()
-            .unwrap()
+            .await
             .get(event_id)
         {
             // Exponential backoff
@@ -1443,17 +1482,19 @@ impl Service {
         > = BTreeMap::new();
 
         {
-            let mut pkm = pub_key_map
-                .write()
-                .map_err(|_| Error::bad_database("RwLock is poisoned."))?;
+            let mut pkm = pub_key_map.write().await;
 
             // Try to fetch keys, failure is okay
             // Servers we couldn't find in the cache will be added to `servers`
             for pdu in &event.room_state.state {
-                let _ = self.get_server_keys_from_cache(pdu, &mut servers, room_version, &mut pkm);
+                let _ = self
+                    .get_server_keys_from_cache(pdu, &mut servers, room_version, &mut pkm)
+                    .await;
             }
             for pdu in &event.room_state.auth_chain {
-                let _ = self.get_server_keys_from_cache(pdu, &mut servers, room_version, &mut pkm);
+                let _ = self
+                    .get_server_keys_from_cache(pdu, &mut servers, room_version, &mut pkm)
+                    .await;
             }
 
             drop(pkm);
@@ -1477,9 +1518,7 @@ impl Service {
                 .await
             {
                 trace!("Got signing keys: {:?}", keys);
-                let mut pkm = pub_key_map
-                    .write()
-                    .map_err(|_| Error::bad_database("RwLock is poisoned."))?;
+                let mut pkm = pub_key_map.write().await;
                 for k in keys.server_keys {
                     let k = match k.deserialize() {
                         Ok(key) => key,
@@ -1538,10 +1577,7 @@ impl Service {
                         .into_iter()
                         .map(|(k, v)| (k.to_string(), v.key))
                         .collect();
-                    pub_key_map
-                        .write()
-                        .map_err(|_| Error::bad_database("RwLock is poisoned."))?
-                        .insert(origin.to_string(), result);
+                    pub_key_map.write().await.insert(origin.to_string(), result);
                 }
             }
             info!("Done handling result");
@@ -1572,12 +1608,21 @@ impl Service {
                 }
             };
 
+        if acl_event_content.allow.is_empty() {
+            // Ignore broken acl events
+            return Ok(());
+        }
+
         if acl_event_content.is_allowed(server_name) {
             Ok(())
         } else {
+            info!(
+                "Server {} was denied by room ACL in {}",
+                server_name, room_id
+            );
             Err(Error::BadRequest(
                 ErrorKind::Forbidden,
-                "Server was denied by ACL",
+                "Server was denied by room ACL",
             ))
         }
     }
@@ -1597,14 +1642,14 @@ impl Service {
             .globals
             .servername_ratelimiter
             .read()
-            .unwrap()
+            .await
             .get(origin)
             .map(|s| Arc::clone(s).acquire_owned());
 
         let permit = match permit {
             Some(p) => p,
             None => {
-                let mut write = services().globals.servername_ratelimiter.write().unwrap();
+                let mut write = services().globals.servername_ratelimiter.write().await;
                 let s = Arc::clone(
                     write
                         .entry(origin.to_owned())
@@ -1616,24 +1661,26 @@ impl Service {
         }
         .await;
 
-        let back_off = |id| match services()
-            .globals
-            .bad_signature_ratelimiter
-            .write()
-            .unwrap()
-            .entry(id)
-        {
-            hash_map::Entry::Vacant(e) => {
-                e.insert((Instant::now(), 1));
+        let back_off = |id| async {
+            match services()
+                .globals
+                .bad_signature_ratelimiter
+                .write()
+                .await
+                .entry(id)
+            {
+                hash_map::Entry::Vacant(e) => {
+                    e.insert((Instant::now(), 1));
+                }
+                hash_map::Entry::Occupied(mut e) => *e.get_mut() = (Instant::now(), e.get().1 + 1),
             }
-            hash_map::Entry::Occupied(mut e) => *e.get_mut() = (Instant::now(), e.get().1 + 1),
         };
 
         if let Some((time, tries)) = services()
             .globals
             .bad_signature_ratelimiter
             .read()
-            .unwrap()
+            .await
             .get(&signature_ids)
         {
             // Exponential backoff
@@ -1740,11 +1787,22 @@ impl Service {
 
         drop(permit);
 
-        back_off(signature_ids);
+        back_off(signature_ids).await;
 
         warn!("Failed to find public key for server: {}", origin);
         Err(Error::BadServerResponse(
             "Failed to find public key for server",
         ))
     }
+
+    fn check_room_id(&self, room_id: &RoomId, pdu: &PduEvent) -> Result<()> {
+        if pdu.room_id != room_id {
+            warn!("Found event from room {} in room {}", pdu.room_id, room_id);
+            return Err(Error::BadRequest(
+                ErrorKind::InvalidParam,
+                "Event has wrong room id",
+            ));
+        }
+        Ok(())
+    }
 }
diff --git a/src/service/rooms/lazy_loading/mod.rs b/src/service/rooms/lazy_loading/mod.rs
index e6e4f896..e2594a0a 100644
--- a/src/service/rooms/lazy_loading/mod.rs
+++ b/src/service/rooms/lazy_loading/mod.rs
@@ -1,11 +1,9 @@
 mod data;
-use std::{
-    collections::{HashMap, HashSet},
-    sync::Mutex,
-};
+use std::collections::{HashMap, HashSet};
 
 pub use data::Data;
 use ruma::{DeviceId, OwnedDeviceId, OwnedRoomId, OwnedUserId, RoomId, UserId};
+use tokio::sync::Mutex;
 
 use crate::Result;
 
@@ -14,6 +12,7 @@ use super::timeline::PduCount;
 pub struct Service {
     pub db: &'static dyn Data,
 
+    #[allow(clippy::type_complexity)]
     pub lazy_load_waiting:
         Mutex<HashMap<(OwnedUserId, OwnedDeviceId, OwnedRoomId, PduCount), HashSet<OwnedUserId>>>,
 }
@@ -32,7 +31,7 @@ impl Service {
     }
 
     #[tracing::instrument(skip(self))]
-    pub fn lazy_load_mark_sent(
+    pub async fn lazy_load_mark_sent(
         &self,
         user_id: &UserId,
         device_id: &DeviceId,
@@ -40,7 +39,7 @@ impl Service {
         lazy_load: HashSet<OwnedUserId>,
         count: PduCount,
     ) {
-        self.lazy_load_waiting.lock().unwrap().insert(
+        self.lazy_load_waiting.lock().await.insert(
             (
                 user_id.to_owned(),
                 device_id.to_owned(),
@@ -52,14 +51,14 @@ impl Service {
     }
 
     #[tracing::instrument(skip(self))]
-    pub fn lazy_load_confirm_delivery(
+    pub async fn lazy_load_confirm_delivery(
         &self,
         user_id: &UserId,
         device_id: &DeviceId,
         room_id: &RoomId,
         since: PduCount,
     ) -> Result<()> {
-        if let Some(user_ids) = self.lazy_load_waiting.lock().unwrap().remove(&(
+        if let Some(user_ids) = self.lazy_load_waiting.lock().await.remove(&(
             user_id.to_owned(),
             device_id.to_owned(),
             room_id.to_owned(),
diff --git a/src/service/rooms/mod.rs b/src/service/rooms/mod.rs
index 8956e4d8..f0739841 100644
--- a/src/service/rooms/mod.rs
+++ b/src/service/rooms/mod.rs
@@ -9,10 +9,12 @@ pub mod outlier;
 pub mod pdu_metadata;
 pub mod search;
 pub mod short;
+pub mod spaces;
 pub mod state;
 pub mod state_accessor;
 pub mod state_cache;
 pub mod state_compressor;
+pub mod threads;
 pub mod timeline;
 pub mod user;
 
@@ -32,6 +34,7 @@ pub trait Data:
     + state_cache::Data
     + state_compressor::Data
     + timeline::Data
+    + threads::Data
     + user::Data
 {
 }
@@ -53,5 +56,7 @@ pub struct Service {
     pub state_cache: state_cache::Service,
     pub state_compressor: state_compressor::Service,
     pub timeline: timeline::Service,
+    pub threads: threads::Service,
+    pub spaces: spaces::Service,
     pub user: user::Service,
 }
diff --git a/src/service/rooms/pdu_metadata/data.rs b/src/service/rooms/pdu_metadata/data.rs
index b157938f..a4df34cc 100644
--- a/src/service/rooms/pdu_metadata/data.rs
+++ b/src/service/rooms/pdu_metadata/data.rs
@@ -1,9 +1,18 @@
 use std::sync::Arc;
 
-use crate::Result;
-use ruma::{EventId, RoomId};
+use crate::{service::rooms::timeline::PduCount, PduEvent, Result};
+use ruma::{EventId, RoomId, UserId};
 
 pub trait Data: Send + Sync {
+    fn add_relation(&self, from: u64, to: u64) -> Result<()>;
+    #[allow(clippy::type_complexity)]
+    fn relations_until<'a>(
+        &'a self,
+        user_id: &'a UserId,
+        room_id: u64,
+        target: u64,
+        until: PduCount,
+    ) -> Result<Box<dyn Iterator<Item = Result<(PduCount, PduEvent)>> + 'a>>;
     fn mark_as_referenced(&self, room_id: &RoomId, event_ids: &[Arc<EventId>]) -> Result<()>;
     fn is_event_referenced(&self, room_id: &RoomId, event_id: &EventId) -> Result<bool>;
     fn mark_event_soft_failed(&self, event_id: &EventId) -> Result<()>;
diff --git a/src/service/rooms/pdu_metadata/mod.rs b/src/service/rooms/pdu_metadata/mod.rs
index b816678c..411f4f54 100644
--- a/src/service/rooms/pdu_metadata/mod.rs
+++ b/src/service/rooms/pdu_metadata/mod.rs
@@ -2,15 +2,172 @@ mod data;
 use std::sync::Arc;
 
 pub use data::Data;
-use ruma::{EventId, RoomId};
+use ruma::{
+    api::client::relations::get_relating_events,
+    events::{relation::RelationType, TimelineEventType},
+    EventId, RoomId, UserId,
+};
+use serde::Deserialize;
 
-use crate::Result;
+use crate::{services, PduEvent, Result};
+
+use super::timeline::PduCount;
 
 pub struct Service {
     pub db: &'static dyn Data,
 }
 
+#[derive(Clone, Debug, Deserialize)]
+struct ExtractRelType {
+    rel_type: RelationType,
+}
+#[derive(Clone, Debug, Deserialize)]
+struct ExtractRelatesToEventId {
+    #[serde(rename = "m.relates_to")]
+    relates_to: ExtractRelType,
+}
+
 impl Service {
+    #[tracing::instrument(skip(self, from, to))]
+    pub fn add_relation(&self, from: PduCount, to: PduCount) -> Result<()> {
+        match (from, to) {
+            (PduCount::Normal(f), PduCount::Normal(t)) => self.db.add_relation(f, t),
+            _ => {
+                // TODO: Relations with backfilled pdus
+
+                Ok(())
+            }
+        }
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    pub fn paginate_relations_with_filter(
+        &self,
+        sender_user: &UserId,
+        room_id: &RoomId,
+        target: &EventId,
+        filter_event_type: Option<TimelineEventType>,
+        filter_rel_type: Option<RelationType>,
+        from: PduCount,
+        to: Option<PduCount>,
+        limit: usize,
+    ) -> Result<get_relating_events::v1::Response> {
+        let next_token;
+
+        //TODO: Fix ruma: match body.dir {
+        match ruma::api::Direction::Backward {
+            ruma::api::Direction::Forward => {
+                let events_after: Vec<_> = services()
+                    .rooms
+                    .pdu_metadata
+                    .relations_until(sender_user, room_id, target, from)? // TODO: should be relations_after
+                    .filter(|r| {
+                        r.as_ref().map_or(true, |(_, pdu)| {
+                            filter_event_type.as_ref().map_or(true, |t| &pdu.kind == t)
+                                && if let Ok(content) =
+                                    serde_json::from_str::<ExtractRelatesToEventId>(
+                                        pdu.content.get(),
+                                    )
+                                {
+                                    filter_rel_type
+                                        .as_ref()
+                                        .map_or(true, |r| &content.relates_to.rel_type == r)
+                                } else {
+                                    false
+                                }
+                        })
+                    })
+                    .take(limit)
+                    .filter_map(|r| r.ok()) // Filter out buggy events
+                    .filter(|(_, pdu)| {
+                        services()
+                            .rooms
+                            .state_accessor
+                            .user_can_see_event(sender_user, room_id, &pdu.event_id)
+                            .unwrap_or(false)
+                    })
+                    .take_while(|&(k, _)| Some(k) != to) // Stop at `to`
+                    .collect();
+
+                next_token = events_after.last().map(|(count, _)| count).copied();
+
+                let events_after: Vec<_> = events_after
+                    .into_iter()
+                    .rev() // relations are always most recent first
+                    .map(|(_, pdu)| pdu.to_message_like_event())
+                    .collect();
+
+                Ok(get_relating_events::v1::Response {
+                    chunk: events_after,
+                    next_batch: next_token.map(|t| t.stringify()),
+                    prev_batch: Some(from.stringify()),
+                })
+            }
+            ruma::api::Direction::Backward => {
+                let events_before: Vec<_> = services()
+                    .rooms
+                    .pdu_metadata
+                    .relations_until(sender_user, room_id, target, from)?
+                    .filter(|r| {
+                        r.as_ref().map_or(true, |(_, pdu)| {
+                            filter_event_type.as_ref().map_or(true, |t| &pdu.kind == t)
+                                && if let Ok(content) =
+                                    serde_json::from_str::<ExtractRelatesToEventId>(
+                                        pdu.content.get(),
+                                    )
+                                {
+                                    filter_rel_type
+                                        .as_ref()
+                                        .map_or(true, |r| &content.relates_to.rel_type == r)
+                                } else {
+                                    false
+                                }
+                        })
+                    })
+                    .take(limit)
+                    .filter_map(|r| r.ok()) // Filter out buggy events
+                    .filter(|(_, pdu)| {
+                        services()
+                            .rooms
+                            .state_accessor
+                            .user_can_see_event(sender_user, room_id, &pdu.event_id)
+                            .unwrap_or(false)
+                    })
+                    .take_while(|&(k, _)| Some(k) != to) // Stop at `to`
+                    .collect();
+
+                next_token = events_before.last().map(|(count, _)| count).copied();
+
+                let events_before: Vec<_> = events_before
+                    .into_iter()
+                    .map(|(_, pdu)| pdu.to_message_like_event())
+                    .collect();
+
+                Ok(get_relating_events::v1::Response {
+                    chunk: events_before,
+                    next_batch: next_token.map(|t| t.stringify()),
+                    prev_batch: Some(from.stringify()),
+                })
+            }
+        }
+    }
+
+    pub fn relations_until<'a>(
+        &'a self,
+        user_id: &'a UserId,
+        room_id: &'a RoomId,
+        target: &'a EventId,
+        until: PduCount,
+    ) -> Result<impl Iterator<Item = Result<(PduCount, PduEvent)>> + 'a> {
+        let room_id = services().rooms.short.get_or_create_shortroomid(room_id)?;
+        let target = match services().rooms.timeline.get_pdu_count(target)? {
+            Some(PduCount::Normal(c)) => c,
+            // TODO: Support backfilled relations
+            _ => 0, // This will result in an empty iterator
+        };
+        self.db.relations_until(user_id, room_id, target, until)
+    }
+
     #[tracing::instrument(skip(self, room_id, event_ids))]
     pub fn mark_as_referenced(&self, room_id: &RoomId, event_ids: &[Arc<EventId>]) -> Result<()> {
         self.db.mark_as_referenced(room_id, event_ids)
diff --git a/src/service/rooms/search/data.rs b/src/service/rooms/search/data.rs
index 6eef38fb..7ea7e3d1 100644
--- a/src/service/rooms/search/data.rs
+++ b/src/service/rooms/search/data.rs
@@ -4,6 +4,7 @@ use ruma::RoomId;
 pub trait Data: Send + Sync {
     fn index_pdu(&self, shortroomid: u64, pdu_id: &[u8], message_body: &str) -> Result<()>;
 
+    #[allow(clippy::type_complexity)]
     fn search_pdus<'a>(
         &'a self,
         room_id: &RoomId,
diff --git a/src/service/rooms/spaces/mod.rs b/src/service/rooms/spaces/mod.rs
new file mode 100644
index 00000000..981d4a37
--- /dev/null
+++ b/src/service/rooms/spaces/mod.rs
@@ -0,0 +1,505 @@
+use std::sync::Arc;
+
+use lru_cache::LruCache;
+use ruma::{
+    api::{
+        client::{
+            error::ErrorKind,
+            space::{get_hierarchy, SpaceHierarchyRoomsChunk},
+        },
+        federation,
+    },
+    events::{
+        room::{
+            avatar::RoomAvatarEventContent,
+            canonical_alias::RoomCanonicalAliasEventContent,
+            create::RoomCreateEventContent,
+            guest_access::{GuestAccess, RoomGuestAccessEventContent},
+            history_visibility::{HistoryVisibility, RoomHistoryVisibilityEventContent},
+            join_rules::{self, AllowRule, JoinRule, RoomJoinRulesEventContent},
+            topic::RoomTopicEventContent,
+        },
+        space::child::SpaceChildEventContent,
+        StateEventType,
+    },
+    space::SpaceRoomJoinRule,
+    OwnedRoomId, RoomId, UserId,
+};
+use tokio::sync::Mutex;
+
+use tracing::{debug, error, warn};
+
+use crate::{services, Error, PduEvent, Result};
+
+pub enum CachedJoinRule {
+    //Simplified(SpaceRoomJoinRule),
+    Full(JoinRule),
+}
+
+pub struct CachedSpaceChunk {
+    chunk: SpaceHierarchyRoomsChunk,
+    children: Vec<OwnedRoomId>,
+    join_rule: CachedJoinRule,
+}
+
+pub struct Service {
+    pub roomid_spacechunk_cache: Mutex<LruCache<OwnedRoomId, Option<CachedSpaceChunk>>>,
+}
+
+impl Service {
+    pub async fn get_hierarchy(
+        &self,
+        sender_user: &UserId,
+        room_id: &RoomId,
+        limit: usize,
+        skip: usize,
+        max_depth: usize,
+        suggested_only: bool,
+    ) -> Result<get_hierarchy::v1::Response> {
+        let mut left_to_skip = skip;
+
+        let mut rooms_in_path = Vec::new();
+        let mut stack = vec![vec![room_id.to_owned()]];
+        let mut results = Vec::new();
+
+        while let Some(current_room) = {
+            while stack.last().map_or(false, |s| s.is_empty()) {
+                stack.pop();
+            }
+            if !stack.is_empty() {
+                stack.last_mut().and_then(|s| s.pop())
+            } else {
+                None
+            }
+        } {
+            rooms_in_path.push(current_room.clone());
+            if results.len() >= limit {
+                break;
+            }
+
+            if let Some(cached) = self
+                .roomid_spacechunk_cache
+                .lock()
+                .await
+                .get_mut(&current_room.to_owned())
+                .as_ref()
+            {
+                if let Some(cached) = cached {
+                    let allowed = match &cached.join_rule {
+                        //CachedJoinRule::Simplified(s) => {
+                        //self.handle_simplified_join_rule(s, sender_user, &current_room)?
+                        //}
+                        CachedJoinRule::Full(f) => {
+                            self.handle_join_rule(f, sender_user, &current_room)?
+                        }
+                    };
+                    if allowed {
+                        if left_to_skip > 0 {
+                            left_to_skip -= 1;
+                        } else {
+                            results.push(cached.chunk.clone());
+                        }
+                        if rooms_in_path.len() < max_depth {
+                            stack.push(cached.children.clone());
+                        }
+                    }
+                }
+                continue;
+            }
+
+            if let Some(current_shortstatehash) = services()
+                .rooms
+                .state
+                .get_room_shortstatehash(&current_room)?
+            {
+                let state = services()
+                    .rooms
+                    .state_accessor
+                    .state_full_ids(current_shortstatehash)
+                    .await?;
+
+                let mut children_ids = Vec::new();
+                let mut children_pdus = Vec::new();
+                for (key, id) in state {
+                    let (event_type, state_key) =
+                        services().rooms.short.get_statekey_from_short(key)?;
+                    if event_type != StateEventType::SpaceChild {
+                        continue;
+                    }
+
+                    let pdu = services()
+                        .rooms
+                        .timeline
+                        .get_pdu(&id)?
+                        .ok_or_else(|| Error::bad_database("Event in space state not found"))?;
+
+                    if serde_json::from_str::<SpaceChildEventContent>(pdu.content.get())
+                        .ok()
+                        .map(|c| c.via)
+                        .map_or(true, |v| v.is_empty())
+                    {
+                        continue;
+                    }
+
+                    if let Ok(room_id) = OwnedRoomId::try_from(state_key) {
+                        children_ids.push(room_id);
+                        children_pdus.push(pdu);
+                    }
+                }
+
+                // TODO: Sort children
+                children_ids.reverse();
+
+                let chunk = self.get_room_chunk(sender_user, &current_room, children_pdus);
+                if let Ok(chunk) = chunk {
+                    if left_to_skip > 0 {
+                        left_to_skip -= 1;
+                    } else {
+                        results.push(chunk.clone());
+                    }
+                    let join_rule = services()
+                        .rooms
+                        .state_accessor
+                        .room_state_get(&current_room, &StateEventType::RoomJoinRules, "")?
+                        .map(|s| {
+                            serde_json::from_str(s.content.get())
+                                .map(|c: RoomJoinRulesEventContent| c.join_rule)
+                                .map_err(|e| {
+                                    error!("Invalid room join rule event in database: {}", e);
+                                    Error::BadDatabase("Invalid room join rule event in database.")
+                                })
+                        })
+                        .transpose()?
+                        .unwrap_or(JoinRule::Invite);
+
+                    self.roomid_spacechunk_cache.lock().await.insert(
+                        current_room.clone(),
+                        Some(CachedSpaceChunk {
+                            chunk,
+                            children: children_ids.clone(),
+                            join_rule: CachedJoinRule::Full(join_rule),
+                        }),
+                    );
+                }
+
+                if rooms_in_path.len() < max_depth {
+                    stack.push(children_ids);
+                }
+            } else {
+                let server = current_room
+                    .server_name()
+                    .expect("Room IDs should always have a server name");
+                if server == services().globals.server_name() {
+                    continue;
+                }
+                if !results.is_empty() {
+                    // Early return so the client can see some data already
+                    break;
+                }
+                debug!("Asking {server} for /hierarchy");
+                if let Ok(response) = services()
+                    .sending
+                    .send_federation_request(
+                        server,
+                        federation::space::get_hierarchy::v1::Request {
+                            room_id: current_room.to_owned(),
+                            suggested_only,
+                        },
+                    )
+                    .await
+                {
+                    warn!("Got response from {server} for /hierarchy\n{response:?}");
+                    let chunk = SpaceHierarchyRoomsChunk {
+                        canonical_alias: response.room.canonical_alias,
+                        name: response.room.name,
+                        num_joined_members: response.room.num_joined_members,
+                        room_id: response.room.room_id,
+                        topic: response.room.topic,
+                        world_readable: response.room.world_readable,
+                        guest_can_join: response.room.guest_can_join,
+                        avatar_url: response.room.avatar_url,
+                        join_rule: response.room.join_rule.clone(),
+                        room_type: response.room.room_type,
+                        children_state: response.room.children_state,
+                    };
+                    let children = response
+                        .children
+                        .iter()
+                        .map(|c| c.room_id.clone())
+                        .collect::<Vec<_>>();
+
+                    let join_rule = match response.room.join_rule {
+                        SpaceRoomJoinRule::Invite => JoinRule::Invite,
+                        SpaceRoomJoinRule::Knock => JoinRule::Knock,
+                        SpaceRoomJoinRule::Private => JoinRule::Private,
+                        SpaceRoomJoinRule::Restricted => {
+                            JoinRule::Restricted(join_rules::Restricted {
+                                allow: response
+                                    .room
+                                    .allowed_room_ids
+                                    .into_iter()
+                                    .map(AllowRule::room_membership)
+                                    .collect(),
+                            })
+                        }
+                        SpaceRoomJoinRule::KnockRestricted => {
+                            JoinRule::KnockRestricted(join_rules::Restricted {
+                                allow: response
+                                    .room
+                                    .allowed_room_ids
+                                    .into_iter()
+                                    .map(AllowRule::room_membership)
+                                    .collect(),
+                            })
+                        }
+                        SpaceRoomJoinRule::Public => JoinRule::Public,
+                        _ => return Err(Error::BadServerResponse("Unknown join rule")),
+                    };
+                    if self.handle_join_rule(&join_rule, sender_user, &current_room)? {
+                        if left_to_skip > 0 {
+                            left_to_skip -= 1;
+                        } else {
+                            results.push(chunk.clone());
+                        }
+                        if rooms_in_path.len() < max_depth {
+                            stack.push(children.clone());
+                        }
+                    }
+
+                    self.roomid_spacechunk_cache.lock().await.insert(
+                        current_room.clone(),
+                        Some(CachedSpaceChunk {
+                            chunk,
+                            children,
+                            join_rule: CachedJoinRule::Full(join_rule),
+                        }),
+                    );
+
+                    /* TODO:
+                    for child in response.children {
+                        roomid_spacechunk_cache.insert(
+                            current_room.clone(),
+                            CachedSpaceChunk {
+                                chunk: child.chunk,
+                                children,
+                                join_rule,
+                            },
+                        );
+                    }
+                    */
+                } else {
+                    self.roomid_spacechunk_cache
+                        .lock()
+                        .await
+                        .insert(current_room.clone(), None);
+                }
+            }
+        }
+
+        Ok(get_hierarchy::v1::Response {
+            next_batch: if results.is_empty() {
+                None
+            } else {
+                Some((skip + results.len()).to_string())
+            },
+            rooms: results,
+        })
+    }
+
+    fn get_room_chunk(
+        &self,
+        sender_user: &UserId,
+        room_id: &RoomId,
+        children: Vec<Arc<PduEvent>>,
+    ) -> Result<SpaceHierarchyRoomsChunk> {
+        Ok(SpaceHierarchyRoomsChunk {
+            canonical_alias: services()
+                .rooms
+                .state_accessor
+                .room_state_get(room_id, &StateEventType::RoomCanonicalAlias, "")?
+                .map_or(Ok(None), |s| {
+                    serde_json::from_str(s.content.get())
+                        .map(|c: RoomCanonicalAliasEventContent| c.alias)
+                        .map_err(|_| {
+                            Error::bad_database("Invalid canonical alias event in database.")
+                        })
+                })?,
+            name: services().rooms.state_accessor.get_name(room_id)?,
+            num_joined_members: services()
+                .rooms
+                .state_cache
+                .room_joined_count(room_id)?
+                .unwrap_or_else(|| {
+                    warn!("Room {} has no member count", room_id);
+                    0
+                })
+                .try_into()
+                .expect("user count should not be that big"),
+            room_id: room_id.to_owned(),
+            topic: services()
+                .rooms
+                .state_accessor
+                .room_state_get(room_id, &StateEventType::RoomTopic, "")?
+                .map_or(Ok(None), |s| {
+                    serde_json::from_str(s.content.get())
+                        .map(|c: RoomTopicEventContent| Some(c.topic))
+                        .map_err(|_| {
+                            error!("Invalid room topic event in database for room {}", room_id);
+                            Error::bad_database("Invalid room topic event in database.")
+                        })
+                })?,
+            world_readable: services()
+                .rooms
+                .state_accessor
+                .room_state_get(room_id, &StateEventType::RoomHistoryVisibility, "")?
+                .map_or(Ok(false), |s| {
+                    serde_json::from_str(s.content.get())
+                        .map(|c: RoomHistoryVisibilityEventContent| {
+                            c.history_visibility == HistoryVisibility::WorldReadable
+                        })
+                        .map_err(|_| {
+                            Error::bad_database(
+                                "Invalid room history visibility event in database.",
+                            )
+                        })
+                })?,
+            guest_can_join: services()
+                .rooms
+                .state_accessor
+                .room_state_get(room_id, &StateEventType::RoomGuestAccess, "")?
+                .map_or(Ok(false), |s| {
+                    serde_json::from_str(s.content.get())
+                        .map(|c: RoomGuestAccessEventContent| {
+                            c.guest_access == GuestAccess::CanJoin
+                        })
+                        .map_err(|_| {
+                            Error::bad_database("Invalid room guest access event in database.")
+                        })
+                })?,
+            avatar_url: services()
+                .rooms
+                .state_accessor
+                .room_state_get(room_id, &StateEventType::RoomAvatar, "")?
+                .map(|s| {
+                    serde_json::from_str(s.content.get())
+                        .map(|c: RoomAvatarEventContent| c.url)
+                        .map_err(|_| Error::bad_database("Invalid room avatar event in database."))
+                })
+                .transpose()?
+                // url is now an Option<String> so we must flatten
+                .flatten(),
+            join_rule: {
+                let join_rule = services()
+                    .rooms
+                    .state_accessor
+                    .room_state_get(room_id, &StateEventType::RoomJoinRules, "")?
+                    .map(|s| {
+                        serde_json::from_str(s.content.get())
+                            .map(|c: RoomJoinRulesEventContent| c.join_rule)
+                            .map_err(|e| {
+                                error!("Invalid room join rule event in database: {}", e);
+                                Error::BadDatabase("Invalid room join rule event in database.")
+                            })
+                    })
+                    .transpose()?
+                    .unwrap_or(JoinRule::Invite);
+
+                if !self.handle_join_rule(&join_rule, sender_user, room_id)? {
+                    debug!("User is not allowed to see room {room_id}");
+                    // This error will be caught later
+                    return Err(Error::BadRequest(
+                        ErrorKind::Forbidden,
+                        "User is not allowed to see the room",
+                    ));
+                }
+
+                self.translate_joinrule(&join_rule)?
+            },
+            room_type: services()
+                .rooms
+                .state_accessor
+                .room_state_get(room_id, &StateEventType::RoomCreate, "")?
+                .map(|s| {
+                    serde_json::from_str::<RoomCreateEventContent>(s.content.get()).map_err(|e| {
+                        error!("Invalid room create event in database: {}", e);
+                        Error::BadDatabase("Invalid room create event in database.")
+                    })
+                })
+                .transpose()?
+                .and_then(|e| e.room_type),
+            children_state: children
+                .into_iter()
+                .map(|pdu| pdu.to_stripped_spacechild_state_event())
+                .collect(),
+        })
+    }
+
+    fn translate_joinrule(&self, join_rule: &JoinRule) -> Result<SpaceRoomJoinRule> {
+        match join_rule {
+            JoinRule::Invite => Ok(SpaceRoomJoinRule::Invite),
+            JoinRule::Knock => Ok(SpaceRoomJoinRule::Knock),
+            JoinRule::Private => Ok(SpaceRoomJoinRule::Private),
+            JoinRule::Restricted(_) => Ok(SpaceRoomJoinRule::Restricted),
+            JoinRule::KnockRestricted(_) => Ok(SpaceRoomJoinRule::KnockRestricted),
+            JoinRule::Public => Ok(SpaceRoomJoinRule::Public),
+            _ => Err(Error::BadServerResponse("Unknown join rule")),
+        }
+    }
+
+    fn handle_simplified_join_rule(
+        &self,
+        join_rule: &SpaceRoomJoinRule,
+        sender_user: &UserId,
+        room_id: &RoomId,
+    ) -> Result<bool> {
+        let allowed = match join_rule {
+            SpaceRoomJoinRule::Public => true,
+            SpaceRoomJoinRule::Knock => true,
+            SpaceRoomJoinRule::Invite => services()
+                .rooms
+                .state_cache
+                .is_joined(sender_user, room_id)?,
+            _ => false,
+        };
+
+        Ok(allowed)
+    }
+
+    fn handle_join_rule(
+        &self,
+        join_rule: &JoinRule,
+        sender_user: &UserId,
+        room_id: &RoomId,
+    ) -> Result<bool> {
+        if self.handle_simplified_join_rule(
+            &self.translate_joinrule(join_rule)?,
+            sender_user,
+            room_id,
+        )? {
+            return Ok(true);
+        }
+
+        match join_rule {
+            JoinRule::Restricted(r) => {
+                for rule in &r.allow {
+                    if let join_rules::AllowRule::RoomMembership(rm) = rule {
+                        if let Ok(true) = services()
+                            .rooms
+                            .state_cache
+                            .is_joined(sender_user, &rm.room_id)
+                        {
+                            return Ok(true);
+                        }
+                    }
+                }
+
+                Ok(false)
+            }
+            JoinRule::KnockRestricted(_) => {
+                // TODO: Check rules
+                Ok(false)
+            }
+            _ => Ok(false),
+        }
+    }
+}
diff --git a/src/service/rooms/state/mod.rs b/src/service/rooms/state/mod.rs
index 3072b80f..f6581bb5 100644
--- a/src/service/rooms/state/mod.rs
+++ b/src/service/rooms/state/mod.rs
@@ -6,9 +6,10 @@ use std::{
 
 pub use data::Data;
 use ruma::{
+    api::client::error::ErrorKind,
     events::{
         room::{create::RoomCreateEventContent, member::MembershipState},
-        AnyStrippedStateEvent, RoomEventType, StateEventType,
+        AnyStrippedStateEvent, StateEventType, TimelineEventType,
     },
     serde::Raw,
     state_res::{self, StateMap},
@@ -32,15 +33,15 @@ impl Service {
         &self,
         room_id: &RoomId,
         shortstatehash: u64,
-        statediffnew: HashSet<CompressedStateEvent>,
-        _statediffremoved: HashSet<CompressedStateEvent>,
+        statediffnew: Arc<HashSet<CompressedStateEvent>>,
+        _statediffremoved: Arc<HashSet<CompressedStateEvent>>,
         state_lock: &MutexGuard<'_, ()>, // Take mutex guard to make sure users get the room state mutex
     ) -> Result<()> {
-        for event_id in statediffnew.into_iter().filter_map(|new| {
+        for event_id in statediffnew.iter().filter_map(|new| {
             services()
                 .rooms
                 .state_compressor
-                .parse_compressed_state_event(&new)
+                .parse_compressed_state_event(new)
                 .ok()
                 .map(|(_, id)| id)
         }) {
@@ -49,10 +50,6 @@ impl Service {
                 None => continue,
             };
 
-            if pdu.get("type").and_then(|val| val.as_str()) != Some("m.room.member") {
-                continue;
-            }
-
             let pdu: PduEvent = match serde_json::from_str(
                 &serde_json::to_string(&pdu).expect("CanonicalJsonObj can be serialized to JSON"),
             ) {
@@ -60,34 +57,49 @@ impl Service {
                 Err(_) => continue,
             };
 
-            #[derive(Deserialize)]
-            struct ExtractMembership {
-                membership: MembershipState,
+            match pdu.kind {
+                TimelineEventType::RoomMember => {
+                    #[derive(Deserialize)]
+                    struct ExtractMembership {
+                        membership: MembershipState,
+                    }
+
+                    let membership =
+                        match serde_json::from_str::<ExtractMembership>(pdu.content.get()) {
+                            Ok(e) => e.membership,
+                            Err(_) => continue,
+                        };
+
+                    let state_key = match pdu.state_key {
+                        Some(k) => k,
+                        None => continue,
+                    };
+
+                    let user_id = match UserId::parse(state_key) {
+                        Ok(id) => id,
+                        Err(_) => continue,
+                    };
+
+                    services().rooms.state_cache.update_membership(
+                        room_id,
+                        &user_id,
+                        membership,
+                        &pdu.sender,
+                        None,
+                        false,
+                    )?;
+                }
+                TimelineEventType::SpaceChild => {
+                    services()
+                        .rooms
+                        .spaces
+                        .roomid_spacechunk_cache
+                        .lock()
+                        .await
+                        .remove(&pdu.room_id);
+                }
+                _ => continue,
             }
-
-            let membership = match serde_json::from_str::<ExtractMembership>(pdu.content.get()) {
-                Ok(e) => e.membership,
-                Err(_) => continue,
-            };
-
-            let state_key = match pdu.state_key {
-                Some(k) => k,
-                None => continue,
-            };
-
-            let user_id = match UserId::parse(state_key) {
-                Ok(id) => id,
-                Err(_) => continue,
-            };
-
-            services().rooms.state_cache.update_membership(
-                room_id,
-                &user_id,
-                membership,
-                &pdu.sender,
-                None,
-                false,
-            )?;
         }
 
         services().rooms.state_cache.update_joined_count(room_id)?;
@@ -107,7 +119,7 @@ impl Service {
         &self,
         event_id: &EventId,
         room_id: &RoomId,
-        state_ids_compressed: HashSet<CompressedStateEvent>,
+        state_ids_compressed: Arc<HashSet<CompressedStateEvent>>,
     ) -> Result<u64> {
         let shorteventid = services()
             .rooms
@@ -152,9 +164,9 @@ impl Service {
                         .copied()
                         .collect();
 
-                    (statediffnew, statediffremoved)
+                    (Arc::new(statediffnew), Arc::new(statediffremoved))
                 } else {
-                    (state_ids_compressed, HashSet::new())
+                    (state_ids_compressed, Arc::new(HashSet::new()))
                 };
             services().rooms.state_compressor.save_state_from_diff(
                 shortstatehash,
@@ -234,8 +246,8 @@ impl Service {
 
             services().rooms.state_compressor.save_state_from_diff(
                 shortstatehash,
-                statediffnew,
-                statediffremoved,
+                Arc::new(statediffnew),
+                Arc::new(statediffremoved),
                 2,
                 states_parents,
             )?;
@@ -320,7 +332,7 @@ impl Service {
             "",
         )?;
 
-        let create_event_content: Option<RoomCreateEventContent> = create_event
+        let create_event_content: RoomCreateEventContent = create_event
             .as_ref()
             .map(|create_event| {
                 serde_json::from_str(create_event.content.get()).map_err(|e| {
@@ -328,11 +340,10 @@ impl Service {
                     Error::bad_database("Invalid create event in db.")
                 })
             })
-            .transpose()?;
-        let room_version = create_event_content
-            .map(|create_event| create_event.room_version)
-            .ok_or(Error::BadDatabase("Invalid room version"))?;
-        Ok(room_version)
+            .transpose()?
+            .ok_or_else(|| Error::BadRequest(ErrorKind::InvalidParam, "No create event found"))?;
+
+        Ok(create_event_content.room_version)
     }
 
     pub fn get_room_shortstatehash(&self, room_id: &RoomId) -> Result<Option<u64>> {
@@ -358,7 +369,7 @@ impl Service {
     pub fn get_auth_events(
         &self,
         room_id: &RoomId,
-        kind: &RoomEventType,
+        kind: &TimelineEventType,
         sender: &UserId,
         state_key: Option<&str>,
         content: &serde_json::value::RawValue,
@@ -396,12 +407,12 @@ impl Service {
             .1;
 
         Ok(full_state
-            .into_iter()
+            .iter()
             .filter_map(|compressed| {
                 services()
                     .rooms
                     .state_compressor
-                    .parse_compressed_state_event(&compressed)
+                    .parse_compressed_state_event(compressed)
                     .ok()
             })
             .filter_map(|(shortstatekey, event_id)| {
diff --git a/src/service/rooms/state_accessor/mod.rs b/src/service/rooms/state_accessor/mod.rs
index a25a8b5d..c287edc5 100644
--- a/src/service/rooms/state_accessor/mod.rs
+++ b/src/service/rooms/state_accessor/mod.rs
@@ -9,16 +9,19 @@ use lru_cache::LruCache;
 use ruma::{
     events::{
         room::{
+            avatar::RoomAvatarEventContent,
             history_visibility::{HistoryVisibility, RoomHistoryVisibilityEventContent},
             member::{MembershipState, RoomMemberEventContent},
+            name::RoomNameEventContent,
         },
         StateEventType,
     },
-    EventId, OwnedServerName, OwnedUserId, RoomId, ServerName, UserId,
+    EventId, JsOption, OwnedServerName, OwnedUserId, RoomId, ServerName, UserId,
 };
-use tracing::error;
+use serde_json::value::to_raw_value;
+use tracing::{error, warn};
 
-use crate::{services, Error, PduEvent, Result};
+use crate::{service::pdu::PduBuilder, services, Error, PduEvent, Result};
 
 pub struct Service {
     pub db: &'static dyn Data,
@@ -178,7 +181,7 @@ impl Service {
             return Ok(*visibility);
         }
 
-        let currently_member = services().rooms.state_cache.is_joined(&user_id, &room_id)?;
+        let currently_member = services().rooms.state_cache.is_joined(user_id, room_id)?;
 
         let history_visibility = self
             .state_get(shortstatehash, &StateEventType::RoomHistoryVisibility, "")?
@@ -195,11 +198,11 @@ impl Service {
             HistoryVisibility::Shared => currently_member,
             HistoryVisibility::Invited => {
                 // Allow if any member on requesting server was AT LEAST invited, else deny
-                self.user_was_invited(shortstatehash, &user_id)
+                self.user_was_invited(shortstatehash, user_id)
             }
             HistoryVisibility::Joined => {
                 // Allow if any member on requested server was joined, else deny
-                self.user_was_joined(shortstatehash, &user_id)
+                self.user_was_joined(shortstatehash, user_id)
             }
             _ => {
                 error!("Unknown history visibility {history_visibility}");
@@ -219,10 +222,10 @@ impl Service {
     /// the room's history_visibility at that event's state.
     #[tracing::instrument(skip(self, user_id, room_id))]
     pub fn user_can_see_state_events(&self, user_id: &UserId, room_id: &RoomId) -> Result<bool> {
-        let currently_member = services().rooms.state_cache.is_joined(&user_id, &room_id)?;
+        let currently_member = services().rooms.state_cache.is_joined(user_id, room_id)?;
 
         let history_visibility = self
-            .room_state_get(&room_id, &StateEventType::RoomHistoryVisibility, "")?
+            .room_state_get(room_id, &StateEventType::RoomHistoryVisibility, "")?
             .map_or(Ok(HistoryVisibility::Shared), |s| {
                 serde_json::from_str(s.content.get())
                     .map(|c: RoomHistoryVisibilityEventContent| c.history_visibility)
@@ -269,4 +272,83 @@ impl Service {
     ) -> Result<Option<Arc<PduEvent>>> {
         self.db.room_state_get(room_id, event_type, state_key)
     }
+
+    pub fn get_name(&self, room_id: &RoomId) -> Result<Option<String>> {
+        services()
+            .rooms
+            .state_accessor
+            .room_state_get(room_id, &StateEventType::RoomName, "")?
+            .map_or(Ok(None), |s| {
+                serde_json::from_str(s.content.get())
+                    .map(|c: RoomNameEventContent| Some(c.name))
+                    .map_err(|e| {
+                        error!(
+                            "Invalid room name event in database for room {}. {}",
+                            room_id, e
+                        );
+                        Error::bad_database("Invalid room name event in database.")
+                    })
+            })
+    }
+
+    pub fn get_avatar(&self, room_id: &RoomId) -> Result<JsOption<RoomAvatarEventContent>> {
+        services()
+            .rooms
+            .state_accessor
+            .room_state_get(room_id, &StateEventType::RoomAvatar, "")?
+            .map_or(Ok(JsOption::Undefined), |s| {
+                serde_json::from_str(s.content.get())
+                    .map_err(|_| Error::bad_database("Invalid room avatar event in database."))
+            })
+    }
+
+    pub async fn user_can_invite(
+        &self,
+        room_id: &RoomId,
+        sender: &UserId,
+        target_user: &UserId,
+    ) -> Result<bool> {
+        let content = to_raw_value(&RoomMemberEventContent::new(MembershipState::Invite))
+            .expect("Event content always serializes");
+
+        let new_event = PduBuilder {
+            event_type: ruma::events::TimelineEventType::RoomMember,
+            content,
+            unsigned: None,
+            state_key: Some(target_user.into()),
+            redacts: None,
+        };
+
+        let mutex_state = Arc::clone(
+            services()
+                .globals
+                .roomid_mutex_state
+                .write()
+                .await
+                .entry(room_id.to_owned())
+                .or_default(),
+        );
+        let state_lock = mutex_state.lock().await;
+
+        Ok(services()
+            .rooms
+            .timeline
+            .create_hash_and_sign_event(new_event, sender, room_id, &state_lock)
+            .is_ok())
+    }
+
+    pub fn get_member(
+        &self,
+        room_id: &RoomId,
+        user_id: &UserId,
+    ) -> Result<Option<RoomMemberEventContent>> {
+        services()
+            .rooms
+            .state_accessor
+            .room_state_get(room_id, &StateEventType::RoomMember, user_id.as_str())?
+            .map_or(Ok(None), |s| {
+                serde_json::from_str(s.content.get())
+                    .map_err(|_| Error::bad_database("Invalid room member event in database."))
+            })
+    }
 }
diff --git a/src/service/rooms/state_cache/data.rs b/src/service/rooms/state_cache/data.rs
index d8bb4a44..b511919a 100644
--- a/src/service/rooms/state_cache/data.rs
+++ b/src/service/rooms/state_cache/data.rs
@@ -1,6 +1,6 @@
 use std::{collections::HashSet, sync::Arc};
 
-use crate::Result;
+use crate::{service::appservice::RegistrationInfo, Result};
 use ruma::{
     events::{AnyStrippedStateEvent, AnySyncStateEvent},
     serde::Raw,
@@ -22,11 +22,7 @@ pub trait Data: Send + Sync {
 
     fn get_our_real_users(&self, room_id: &RoomId) -> Result<Arc<HashSet<OwnedUserId>>>;
 
-    fn appservice_in_room(
-        &self,
-        room_id: &RoomId,
-        appservice: &(String, serde_yaml::Value),
-    ) -> Result<bool>;
+    fn appservice_in_room(&self, room_id: &RoomId, appservice: &RegistrationInfo) -> Result<bool>;
 
     /// Makes a user forget a room.
     fn forget(&self, room_id: &RoomId, user_id: &UserId) -> Result<()>;
@@ -78,6 +74,7 @@ pub trait Data: Send + Sync {
     ) -> Box<dyn Iterator<Item = Result<OwnedRoomId>> + 'a>;
 
     /// Returns an iterator over all rooms a user was invited to.
+    #[allow(clippy::type_complexity)]
     fn rooms_invited<'a>(
         &'a self,
         user_id: &UserId,
@@ -96,6 +93,7 @@ pub trait Data: Send + Sync {
     ) -> Result<Option<Vec<Raw<AnyStrippedStateEvent>>>>;
 
     /// Returns an iterator over all rooms a user left.
+    #[allow(clippy::type_complexity)]
     fn rooms_left<'a>(
         &'a self,
         user_id: &UserId,
diff --git a/src/service/rooms/state_cache/mod.rs b/src/service/rooms/state_cache/mod.rs
index 32afdd4e..c108695d 100644
--- a/src/service/rooms/state_cache/mod.rs
+++ b/src/service/rooms/state_cache/mod.rs
@@ -14,8 +14,9 @@ use ruma::{
     serde::Raw,
     OwnedRoomId, OwnedServerName, OwnedUserId, RoomId, ServerName, UserId,
 };
+use tracing::warn;
 
-use crate::{services, Error, Result};
+use crate::{service::appservice::RegistrationInfo, services, Error, Result};
 
 pub struct Service {
     pub db: &'static dyn Data,
@@ -88,8 +89,9 @@ impl Service {
                                 RoomAccountDataEventType::Tag,
                             )?
                             .map(|event| {
-                                serde_json::from_str(event.get()).map_err(|_| {
-                                    Error::bad_database("Invalid account data event in db.")
+                                serde_json::from_str(event.get()).map_err(|e| {
+                                    warn!("Invalid account data event in db: {e:?}");
+                                    Error::BadDatabase("Invalid account data event in db.")
                                 })
                             })
                         {
@@ -113,8 +115,9 @@ impl Service {
                                 GlobalAccountDataEventType::Direct.to_string().into(),
                             )?
                             .map(|event| {
-                                serde_json::from_str::<DirectEvent>(event.get()).map_err(|_| {
-                                    Error::bad_database("Invalid account data event in db.")
+                                serde_json::from_str::<DirectEvent>(event.get()).map_err(|e| {
+                                    warn!("Invalid account data event in db: {e:?}");
+                                    Error::BadDatabase("Invalid account data event in db.")
                                 })
                             })
                         {
@@ -155,8 +158,10 @@ impl Service {
                             .into(),
                     )?
                     .map(|event| {
-                        serde_json::from_str::<IgnoredUserListEvent>(event.get())
-                            .map_err(|_| Error::bad_database("Invalid account data event in db."))
+                        serde_json::from_str::<IgnoredUserListEvent>(event.get()).map_err(|e| {
+                            warn!("Invalid account data event in db: {e:?}");
+                            Error::BadDatabase("Invalid account data event in db.")
+                        })
                     })
                     .transpose()?
                     .map_or(false, |ignored| {
@@ -200,7 +205,7 @@ impl Service {
     pub fn appservice_in_room(
         &self,
         room_id: &RoomId,
-        appservice: &(String, serde_yaml::Value),
+        appservice: &RegistrationInfo,
     ) -> Result<bool> {
         self.db.appservice_in_room(room_id, appservice)
     }
diff --git a/src/service/rooms/state_compressor/data.rs b/src/service/rooms/state_compressor/data.rs
index ce164c6d..d221d576 100644
--- a/src/service/rooms/state_compressor/data.rs
+++ b/src/service/rooms/state_compressor/data.rs
@@ -1,12 +1,12 @@
-use std::collections::HashSet;
+use std::{collections::HashSet, sync::Arc};
 
 use super::CompressedStateEvent;
 use crate::Result;
 
 pub struct StateDiff {
     pub parent: Option<u64>,
-    pub added: HashSet<CompressedStateEvent>,
-    pub removed: HashSet<CompressedStateEvent>,
+    pub added: Arc<HashSet<CompressedStateEvent>>,
+    pub removed: Arc<HashSet<CompressedStateEvent>>,
 }
 
 pub trait Data: Send + Sync {
diff --git a/src/service/rooms/state_compressor/mod.rs b/src/service/rooms/state_compressor/mod.rs
index 356f32c8..6118e06b 100644
--- a/src/service/rooms/state_compressor/mod.rs
+++ b/src/service/rooms/state_compressor/mod.rs
@@ -16,14 +16,15 @@ use self::data::StateDiff;
 pub struct Service {
     pub db: &'static dyn Data,
 
+    #[allow(clippy::type_complexity)]
     pub stateinfo_cache: Mutex<
         LruCache<
             u64,
             Vec<(
-                u64,                           // sstatehash
-                HashSet<CompressedStateEvent>, // full state
-                HashSet<CompressedStateEvent>, // added
-                HashSet<CompressedStateEvent>, // removed
+                u64,                                // sstatehash
+                Arc<HashSet<CompressedStateEvent>>, // full state
+                Arc<HashSet<CompressedStateEvent>>, // added
+                Arc<HashSet<CompressedStateEvent>>, // removed
             )>,
         >,
     >,
@@ -33,16 +34,17 @@ pub type CompressedStateEvent = [u8; 2 * size_of::<u64>()];
 
 impl Service {
     /// Returns a stack with info on shortstatehash, full state, added diff and removed diff for the selected shortstatehash and each parent layer.
+    #[allow(clippy::type_complexity)]
     #[tracing::instrument(skip(self))]
     pub fn load_shortstatehash_info(
         &self,
         shortstatehash: u64,
     ) -> Result<
         Vec<(
-            u64,                           // sstatehash
-            HashSet<CompressedStateEvent>, // full state
-            HashSet<CompressedStateEvent>, // added
-            HashSet<CompressedStateEvent>, // removed
+            u64,                                // sstatehash
+            Arc<HashSet<CompressedStateEvent>>, // full state
+            Arc<HashSet<CompressedStateEvent>>, // added
+            Arc<HashSet<CompressedStateEvent>>, // removed
         )>,
     > {
         if let Some(r) = self
@@ -62,13 +64,19 @@ impl Service {
 
         if let Some(parent) = parent {
             let mut response = self.load_shortstatehash_info(parent)?;
-            let mut state = response.last().unwrap().1.clone();
+            let mut state = (*response.last().unwrap().1).clone();
             state.extend(added.iter().copied());
+            let removed = (*removed).clone();
             for r in &removed {
                 state.remove(r);
             }
 
-            response.push((shortstatehash, state, added, removed));
+            response.push((shortstatehash, Arc::new(state), added, Arc::new(removed)));
+
+            self.stateinfo_cache
+                .lock()
+                .unwrap()
+                .insert(shortstatehash, response.clone());
 
             Ok(response)
         } else {
@@ -125,6 +133,7 @@ impl Service {
     /// * `statediffremoved` - Removed from base. Each vec is shortstatekey+shorteventid
     /// * `diff_to_sibling` - Approximately how much the diff grows each time for this layer
     /// * `parent_states` - A stack with info on shortstatehash, full state, added diff and removed diff for each parent layer
+    #[allow(clippy::type_complexity)]
     #[tracing::instrument(skip(
         self,
         statediffnew,
@@ -135,14 +144,14 @@ impl Service {
     pub fn save_state_from_diff(
         &self,
         shortstatehash: u64,
-        statediffnew: HashSet<CompressedStateEvent>,
-        statediffremoved: HashSet<CompressedStateEvent>,
+        statediffnew: Arc<HashSet<CompressedStateEvent>>,
+        statediffremoved: Arc<HashSet<CompressedStateEvent>>,
         diff_to_sibling: usize,
         mut parent_states: Vec<(
-            u64,                           // sstatehash
-            HashSet<CompressedStateEvent>, // full state
-            HashSet<CompressedStateEvent>, // added
-            HashSet<CompressedStateEvent>, // removed
+            u64,                                // sstatehash
+            Arc<HashSet<CompressedStateEvent>>, // full state
+            Arc<HashSet<CompressedStateEvent>>, // added
+            Arc<HashSet<CompressedStateEvent>>, // removed
         )>,
     ) -> Result<()> {
         let diffsum = statediffnew.len() + statediffremoved.len();
@@ -152,29 +161,29 @@ impl Service {
             // To many layers, we have to go deeper
             let parent = parent_states.pop().unwrap();
 
-            let mut parent_new = parent.2;
-            let mut parent_removed = parent.3;
+            let mut parent_new = (*parent.2).clone();
+            let mut parent_removed = (*parent.3).clone();
 
-            for removed in statediffremoved {
-                if !parent_new.remove(&removed) {
+            for removed in statediffremoved.iter() {
+                if !parent_new.remove(removed) {
                     // It was not added in the parent and we removed it
-                    parent_removed.insert(removed);
+                    parent_removed.insert(*removed);
                 }
                 // Else it was added in the parent and we removed it again. We can forget this change
             }
 
-            for new in statediffnew {
-                if !parent_removed.remove(&new) {
+            for new in statediffnew.iter() {
+                if !parent_removed.remove(new) {
                     // It was not touched in the parent and we added it
-                    parent_new.insert(new);
+                    parent_new.insert(*new);
                 }
                 // Else it was removed in the parent and we added it again. We can forget this change
             }
 
             self.save_state_from_diff(
                 shortstatehash,
-                parent_new,
-                parent_removed,
+                Arc::new(parent_new),
+                Arc::new(parent_removed),
                 diffsum,
                 parent_states,
             )?;
@@ -205,29 +214,29 @@ impl Service {
 
         if diffsum * diffsum >= 2 * diff_to_sibling * parent_diff {
             // Diff too big, we replace above layer(s)
-            let mut parent_new = parent.2;
-            let mut parent_removed = parent.3;
+            let mut parent_new = (*parent.2).clone();
+            let mut parent_removed = (*parent.3).clone();
 
-            for removed in statediffremoved {
-                if !parent_new.remove(&removed) {
+            for removed in statediffremoved.iter() {
+                if !parent_new.remove(removed) {
                     // It was not added in the parent and we removed it
-                    parent_removed.insert(removed);
+                    parent_removed.insert(*removed);
                 }
                 // Else it was added in the parent and we removed it again. We can forget this change
             }
 
-            for new in statediffnew {
-                if !parent_removed.remove(&new) {
+            for new in statediffnew.iter() {
+                if !parent_removed.remove(new) {
                     // It was not touched in the parent and we added it
-                    parent_new.insert(new);
+                    parent_new.insert(*new);
                 }
                 // Else it was removed in the parent and we added it again. We can forget this change
             }
 
             self.save_state_from_diff(
                 shortstatehash,
-                parent_new,
-                parent_removed,
+                Arc::new(parent_new),
+                Arc::new(parent_removed),
                 diffsum,
                 parent_states,
             )?;
@@ -247,14 +256,15 @@ impl Service {
     }
 
     /// Returns the new shortstatehash, and the state diff from the previous room state
+    #[allow(clippy::type_complexity)]
     pub fn save_state(
         &self,
         room_id: &RoomId,
-        new_state_ids_compressed: HashSet<CompressedStateEvent>,
+        new_state_ids_compressed: Arc<HashSet<CompressedStateEvent>>,
     ) -> Result<(
         u64,
-        HashSet<CompressedStateEvent>,
-        HashSet<CompressedStateEvent>,
+        Arc<HashSet<CompressedStateEvent>>,
+        Arc<HashSet<CompressedStateEvent>>,
     )> {
         let previous_shortstatehash = services().rooms.state.get_room_shortstatehash(room_id)?;
 
@@ -271,7 +281,11 @@ impl Service {
             .get_or_create_shortstatehash(&state_hash)?;
 
         if Some(new_shortstatehash) == previous_shortstatehash {
-            return Ok((new_shortstatehash, HashSet::new(), HashSet::new()));
+            return Ok((
+                new_shortstatehash,
+                Arc::new(HashSet::new()),
+                Arc::new(HashSet::new()),
+            ));
         }
 
         let states_parents = previous_shortstatehash
@@ -290,9 +304,9 @@ impl Service {
                 .copied()
                 .collect();
 
-            (statediffnew, statediffremoved)
+            (Arc::new(statediffnew), Arc::new(statediffremoved))
         } else {
-            (new_state_ids_compressed, HashSet::new())
+            (new_state_ids_compressed, Arc::new(HashSet::new()))
         };
 
         if !already_existed {
diff --git a/src/service/rooms/threads/data.rs b/src/service/rooms/threads/data.rs
new file mode 100644
index 00000000..e7159de0
--- /dev/null
+++ b/src/service/rooms/threads/data.rs
@@ -0,0 +1,16 @@
+use crate::{PduEvent, Result};
+use ruma::{api::client::threads::get_threads::v1::IncludeThreads, OwnedUserId, RoomId, UserId};
+
+pub trait Data: Send + Sync {
+    #[allow(clippy::type_complexity)]
+    fn threads_until<'a>(
+        &'a self,
+        user_id: &'a UserId,
+        room_id: &'a RoomId,
+        until: u64,
+        include: &'a IncludeThreads,
+    ) -> Result<Box<dyn Iterator<Item = Result<(u64, PduEvent)>> + 'a>>;
+
+    fn update_participants(&self, root_id: &[u8], participants: &[OwnedUserId]) -> Result<()>;
+    fn get_participants(&self, root_id: &[u8]) -> Result<Option<Vec<OwnedUserId>>>;
+}
diff --git a/src/service/rooms/threads/mod.rs b/src/service/rooms/threads/mod.rs
new file mode 100644
index 00000000..c6193bc8
--- /dev/null
+++ b/src/service/rooms/threads/mod.rs
@@ -0,0 +1,116 @@
+mod data;
+
+pub use data::Data;
+use ruma::{
+    api::client::{error::ErrorKind, threads::get_threads::v1::IncludeThreads},
+    events::relation::BundledThread,
+    uint, CanonicalJsonValue, EventId, RoomId, UserId,
+};
+
+use serde_json::json;
+
+use crate::{services, Error, PduEvent, Result};
+
+pub struct Service {
+    pub db: &'static dyn Data,
+}
+
+impl Service {
+    pub fn threads_until<'a>(
+        &'a self,
+        user_id: &'a UserId,
+        room_id: &'a RoomId,
+        until: u64,
+        include: &'a IncludeThreads,
+    ) -> Result<impl Iterator<Item = Result<(u64, PduEvent)>> + 'a> {
+        self.db.threads_until(user_id, room_id, until, include)
+    }
+
+    pub fn add_to_thread(&self, root_event_id: &EventId, pdu: &PduEvent) -> Result<()> {
+        let root_id = &services()
+            .rooms
+            .timeline
+            .get_pdu_id(root_event_id)?
+            .ok_or_else(|| {
+                Error::BadRequest(
+                    ErrorKind::InvalidParam,
+                    "Invalid event id in thread message",
+                )
+            })?;
+
+        let root_pdu = services()
+            .rooms
+            .timeline
+            .get_pdu_from_id(root_id)?
+            .ok_or_else(|| {
+                Error::BadRequest(ErrorKind::InvalidParam, "Thread root pdu not found")
+            })?;
+
+        let mut root_pdu_json = services()
+            .rooms
+            .timeline
+            .get_pdu_json_from_id(root_id)?
+            .ok_or_else(|| {
+                Error::BadRequest(ErrorKind::InvalidParam, "Thread root pdu not found")
+            })?;
+
+        if let CanonicalJsonValue::Object(unsigned) = root_pdu_json
+            .entry("unsigned".to_owned())
+            .or_insert_with(|| CanonicalJsonValue::Object(Default::default()))
+        {
+            if let Some(mut relations) = unsigned
+                .get("m.relations")
+                .and_then(|r| r.as_object())
+                .and_then(|r| r.get("m.thread"))
+                .and_then(|relations| {
+                    serde_json::from_value::<BundledThread>(relations.clone().into()).ok()
+                })
+            {
+                // Thread already existed
+                relations.count += uint!(1);
+                relations.latest_event = pdu.to_message_like_event();
+
+                let content = serde_json::to_value(relations).expect("to_value always works");
+
+                unsigned.insert(
+                    "m.relations".to_owned(),
+                    json!({ "m.thread": content })
+                        .try_into()
+                        .expect("thread is valid json"),
+                );
+            } else {
+                // New thread
+                let relations = BundledThread {
+                    latest_event: pdu.to_message_like_event(),
+                    count: uint!(1),
+                    current_user_participated: true,
+                };
+
+                let content = serde_json::to_value(relations).expect("to_value always works");
+
+                unsigned.insert(
+                    "m.relations".to_owned(),
+                    json!({ "m.thread": content })
+                        .try_into()
+                        .expect("thread is valid json"),
+                );
+            }
+
+            services()
+                .rooms
+                .timeline
+                .replace_pdu(root_id, &root_pdu_json, &root_pdu)?;
+        }
+
+        let mut users = Vec::new();
+        if let Some(userids) = self.db.get_participants(root_id)? {
+            users.extend_from_slice(&userids);
+            users.push(pdu.sender.clone());
+        } else {
+            users.push(root_pdu.sender);
+            users.push(pdu.sender.clone());
+        }
+
+        self.db.update_participants(root_id, &users)
+    }
+}
diff --git a/src/service/rooms/timeline/data.rs b/src/service/rooms/timeline/data.rs
index 193f3843..6290b8cc 100644
--- a/src/service/rooms/timeline/data.rs
+++ b/src/service/rooms/timeline/data.rs
@@ -57,10 +57,16 @@ pub trait Data: Send + Sync {
     ) -> Result<()>;
 
     /// Removes a pdu and creates a new one with the same id.
-    fn replace_pdu(&self, pdu_id: &[u8], pdu: &PduEvent) -> Result<()>;
+    fn replace_pdu(
+        &self,
+        pdu_id: &[u8],
+        pdu_json: &CanonicalJsonObject,
+        pdu: &PduEvent,
+    ) -> Result<()>;
 
     /// Returns an iterator over all events and their tokens in a room that happened before the
     /// event with id `until` in reverse-chronological order.
+    #[allow(clippy::type_complexity)]
     fn pdus_until<'a>(
         &'a self,
         user_id: &UserId,
@@ -70,6 +76,7 @@ pub trait Data: Send + Sync {
 
     /// Returns an iterator over all events in a room that happened after the event with id `from`
     /// in chronological order.
+    #[allow(clippy::type_complexity)]
     fn pdus_after<'a>(
         &'a self,
         user_id: &UserId,
diff --git a/src/service/rooms/timeline/mod.rs b/src/service/rooms/timeline/mod.rs
index 47f4c65c..379d97fe 100644
--- a/src/service/rooms/timeline/mod.rs
+++ b/src/service/rooms/timeline/mod.rs
@@ -1,45 +1,41 @@
 mod data;
 
-use std::cmp::Ordering;
-use std::collections::{BTreeMap, HashMap};
-
-use std::sync::RwLock;
 use std::{
-    collections::HashSet,
-    sync::{Arc, Mutex},
+    cmp::Ordering,
+    collections::{BTreeMap, HashMap, HashSet},
+    sync::Arc,
 };
 
 pub use data::Data;
-use regex::Regex;
-use ruma::api::federation;
-use ruma::serde::Base64;
+
 use ruma::{
-    api::client::error::ErrorKind,
+    api::{client::error::ErrorKind, federation},
     canonical_json::to_canonical_value,
     events::{
         push_rules::PushRulesEvent,
         room::{
-            create::RoomCreateEventContent, member::MembershipState,
+            create::RoomCreateEventContent, encrypted::Relation, member::MembershipState,
             power_levels::RoomPowerLevelsEventContent,
         },
-        GlobalAccountDataEventType, RoomEventType, StateEventType,
+        GlobalAccountDataEventType, StateEventType, TimelineEventType,
     },
     push::{Action, Ruleset, Tweak},
-    state_res,
-    state_res::Event,
-    state_res::RoomVersion,
-    uint, CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
-    OwnedServerName, RoomAliasId, RoomId, UserId,
+    serde::Base64,
+    state_res::{self, Event, RoomVersion},
+    uint, user_id, CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
+    OwnedServerName, RoomId, ServerName, UserId,
 };
-use ruma::{user_id, ServerName};
 use serde::Deserialize;
 use serde_json::value::{to_raw_value, RawValue as RawJsonValue};
-use tokio::sync::MutexGuard;
+use tokio::sync::{Mutex, MutexGuard, RwLock};
 use tracing::{error, info, warn};
 
-use crate::api::server_server;
 use crate::{
-    service::pdu::{EventHash, PduBuilder},
+    api::server_server,
+    service::{
+        appservice::NamespaceRegex,
+        pdu::{EventHash, PduBuilder},
+    },
     services, utils, Error, PduEvent, Result,
 };
 
@@ -60,8 +56,8 @@ impl PduCount {
     }
 
     pub fn try_from_string(token: &str) -> Result<Self> {
-        if token.starts_with('-') {
-            token[1..].parse().map(PduCount::Backfilled)
+        if let Some(stripped) = token.strip_prefix('-') {
+            stripped.parse().map(PduCount::Backfilled)
         } else {
             token.parse().map(PduCount::Normal)
         }
@@ -92,18 +88,6 @@ impl Ord for PduCount {
         }
     }
 }
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn comparisons() {
-        assert!(PduCount::Normal(1) < PduCount::Normal(2));
-        assert!(PduCount::Backfilled(2) < PduCount::Backfilled(1));
-        assert!(PduCount::Normal(1) > PduCount::Backfilled(1));
-        assert!(PduCount::Backfilled(1) < PduCount::Normal(1));
-    }
-}
 
 pub struct Service {
     pub db: &'static dyn Data,
@@ -114,7 +98,7 @@ pub struct Service {
 impl Service {
     #[tracing::instrument(skip(self))]
     pub fn first_pdu_in_room(&self, room_id: &RoomId) -> Result<Option<Arc<PduEvent>>> {
-        self.all_pdus(&user_id!("@doesntmatter:conduit.rs"), &room_id)?
+        self.all_pdus(user_id!("@doesntmatter:conduit.rs"), room_id)?
             .next()
             .map(|o| o.map(|(_, p)| Arc::new(p)))
             .transpose()
@@ -199,8 +183,13 @@ impl Service {
 
     /// Removes a pdu and creates a new one with the same id.
     #[tracing::instrument(skip(self))]
-    fn replace_pdu(&self, pdu_id: &[u8], pdu: &PduEvent) -> Result<()> {
-        self.db.replace_pdu(pdu_id, pdu)
+    pub fn replace_pdu(
+        &self,
+        pdu_id: &[u8],
+        pdu_json: &CanonicalJsonObject,
+        pdu: &PduEvent,
+    ) -> Result<()> {
+        self.db.replace_pdu(pdu_id, pdu_json, pdu)
     }
 
     /// Creates a new persisted data unit and adds it to a room.
@@ -210,7 +199,7 @@ impl Service {
     ///
     /// Returns pdu id
     #[tracing::instrument(skip(self, pdu, pdu_json, leaves))]
-    pub fn append_pdu<'a>(
+    pub async fn append_pdu<'a>(
         &self,
         pdu: &PduEvent,
         mut pdu_json: CanonicalJsonObject,
@@ -272,11 +261,11 @@ impl Service {
                 .globals
                 .roomid_mutex_insert
                 .write()
-                .unwrap()
+                .await
                 .entry(pdu.room_id.clone())
                 .or_default(),
         );
-        let insert_lock = mutex_insert.lock().unwrap();
+        let insert_lock = mutex_insert.lock().await;
 
         let count1 = services().globals.next_count()?;
         // Mark as read first so the sending client doesn't get a notification even if appending
@@ -317,12 +306,25 @@ impl Service {
         let mut notifies = Vec::new();
         let mut highlights = Vec::new();
 
-        for user in services()
+        let mut push_target = services()
             .rooms
             .state_cache
-            .get_our_real_users(&pdu.room_id)?
-            .iter()
-        {
+            .get_our_real_users(&pdu.room_id)?;
+
+        if pdu.kind == TimelineEventType::RoomMember {
+            if let Some(state_key) = &pdu.state_key {
+                let target_user_id = UserId::parse(state_key.clone())
+                    .expect("This state_key was previously validated");
+
+                if !push_target.contains(&target_user_id) {
+                    let mut target = push_target.as_ref().clone();
+                    target.insert(target_user_id);
+                    push_target = Arc::new(target);
+                }
+            }
+        }
+
+        for user in push_target.iter() {
             // Don't notify the user of their own events
             if user == &pdu.sender {
                 continue;
@@ -354,9 +356,7 @@ impl Service {
                 &pdu.room_id,
             )? {
                 match action {
-                    Action::DontNotify => notify = false,
-                    // TODO: Implement proper support for coalesce
-                    Action::Notify | Action::Coalesce => notify = true,
+                    Action::Notify => notify = true,
                     Action::SetTweak(Tweak::Highlight(true)) => {
                         highlight = true;
                     }
@@ -381,12 +381,23 @@ impl Service {
             .increment_notification_counts(&pdu.room_id, notifies, highlights)?;
 
         match pdu.kind {
-            RoomEventType::RoomRedaction => {
+            TimelineEventType::RoomRedaction => {
                 if let Some(redact_id) = &pdu.redacts {
                     self.redact_pdu(redact_id, pdu)?;
                 }
             }
-            RoomEventType::RoomMember => {
+            TimelineEventType::SpaceChild => {
+                if let Some(_state_key) = &pdu.state_key {
+                    services()
+                        .rooms
+                        .spaces
+                        .roomid_spacechunk_cache
+                        .lock()
+                        .await
+                        .remove(&pdu.room_id);
+                }
+            }
+            TimelineEventType::RoomMember => {
                 if let Some(state_key) = &pdu.state_key {
                     #[derive(Deserialize)]
                     struct ExtractMembership {
@@ -420,7 +431,7 @@ impl Service {
                     )?;
                 }
             }
-            RoomEventType::RoomMessage => {
+            TimelineEventType::RoomMessage => {
                 #[derive(Deserialize)]
                 struct ExtractBody {
                     body: Option<String>,
@@ -435,116 +446,139 @@ impl Service {
                         .search
                         .index_pdu(shortroomid, &pdu_id, &body)?;
 
-                    let admin_room = services().rooms.alias.resolve_local_alias(
-                        <&RoomAliasId>::try_from(
-                            format!("#admins:{}", services().globals.server_name()).as_str(),
-                        )
-                        .expect("#admins:server_name is a valid room alias"),
-                    )?;
                     let server_user = format!("@conduit:{}", services().globals.server_name());
 
-                    let to_conduit = body.starts_with(&format!("{server_user}: "));
+                    let to_conduit = body.starts_with(&format!("{server_user}: "))
+                        || body.starts_with(&format!("{server_user} "))
+                        || body == format!("{server_user}:")
+                        || body == server_user;
 
                     // This will evaluate to false if the emergency password is set up so that
                     // the administrator can execute commands as conduit
                     let from_conduit = pdu.sender == server_user
                         && services().globals.emergency_password().is_none();
 
-                    if to_conduit && !from_conduit && admin_room.as_ref() == Some(&pdu.room_id) {
-                        services().admin.process_message(body);
+                    if let Some(admin_room) = services().admin.get_admin_room()? {
+                        if to_conduit && !from_conduit && admin_room == pdu.room_id {
+                            services().admin.process_message(body);
+                        }
                     }
                 }
             }
             _ => {}
         }
 
-        for appservice in services().appservice.all()? {
+        // Update Relationships
+        #[derive(Deserialize)]
+        struct ExtractRelatesTo {
+            #[serde(rename = "m.relates_to")]
+            relates_to: Relation,
+        }
+
+        #[derive(Clone, Debug, Deserialize)]
+        struct ExtractEventId {
+            event_id: OwnedEventId,
+        }
+        #[derive(Clone, Debug, Deserialize)]
+        struct ExtractRelatesToEventId {
+            #[serde(rename = "m.relates_to")]
+            relates_to: ExtractEventId,
+        }
+
+        if let Ok(content) = serde_json::from_str::<ExtractRelatesToEventId>(pdu.content.get()) {
+            if let Some(related_pducount) = services()
+                .rooms
+                .timeline
+                .get_pdu_count(&content.relates_to.event_id)?
+            {
+                services()
+                    .rooms
+                    .pdu_metadata
+                    .add_relation(PduCount::Normal(count2), related_pducount)?;
+            }
+        }
+
+        if let Ok(content) = serde_json::from_str::<ExtractRelatesTo>(pdu.content.get()) {
+            match content.relates_to {
+                Relation::Reply { in_reply_to } => {
+                    // We need to do it again here, because replies don't have
+                    // event_id as a top level field
+                    if let Some(related_pducount) = services()
+                        .rooms
+                        .timeline
+                        .get_pdu_count(&in_reply_to.event_id)?
+                    {
+                        services()
+                            .rooms
+                            .pdu_metadata
+                            .add_relation(PduCount::Normal(count2), related_pducount)?;
+                    }
+                }
+                Relation::Thread(thread) => {
+                    services()
+                        .rooms
+                        .threads
+                        .add_to_thread(&thread.event_id, pdu)?;
+                }
+                _ => {} // TODO: Aggregate other types
+            }
+        }
+
+        for appservice in services().appservice.read().await.values() {
             if services()
                 .rooms
                 .state_cache
-                .appservice_in_room(&pdu.room_id, &appservice)?
+                .appservice_in_room(&pdu.room_id, appservice)?
             {
                 services()
                     .sending
-                    .send_pdu_appservice(appservice.0, pdu_id.clone())?;
+                    .send_pdu_appservice(appservice.registration.id.clone(), pdu_id.clone())?;
                 continue;
             }
 
             // If the RoomMember event has a non-empty state_key, it is targeted at someone.
             // If it is our appservice user, we send this PDU to it.
-            if pdu.kind == RoomEventType::RoomMember {
+            if pdu.kind == TimelineEventType::RoomMember {
                 if let Some(state_key_uid) = &pdu
                     .state_key
                     .as_ref()
                     .and_then(|state_key| UserId::parse(state_key.as_str()).ok())
                 {
-                    if let Some(appservice_uid) = appservice
-                        .1
-                        .get("sender_localpart")
-                        .and_then(|string| string.as_str())
-                        .and_then(|string| {
-                            UserId::parse_with_server_name(string, services().globals.server_name())
-                                .ok()
-                        })
-                    {
-                        if state_key_uid == &appservice_uid {
-                            services()
-                                .sending
-                                .send_pdu_appservice(appservice.0, pdu_id.clone())?;
-                            continue;
-                        }
+                    let appservice_uid = appservice.registration.sender_localpart.as_str();
+                    if state_key_uid == appservice_uid {
+                        services().sending.send_pdu_appservice(
+                            appservice.registration.id.clone(),
+                            pdu_id.clone(),
+                        )?;
+                        continue;
                     }
                 }
             }
 
-            if let Some(namespaces) = appservice.1.get("namespaces") {
-                let users = namespaces
-                    .get("users")
-                    .and_then(|users| users.as_sequence())
-                    .map_or_else(Vec::new, |users| {
-                        users
-                            .iter()
-                            .filter_map(|users| Regex::new(users.get("regex")?.as_str()?).ok())
-                            .collect::<Vec<_>>()
-                    });
-                let aliases = namespaces
-                    .get("aliases")
-                    .and_then(|aliases| aliases.as_sequence())
-                    .map_or_else(Vec::new, |aliases| {
-                        aliases
-                            .iter()
-                            .filter_map(|aliases| Regex::new(aliases.get("regex")?.as_str()?).ok())
-                            .collect::<Vec<_>>()
-                    });
-                let rooms = namespaces
-                    .get("rooms")
-                    .and_then(|rooms| rooms.as_sequence());
+            let matching_users = |users: &NamespaceRegex| {
+                appservice.users.is_match(pdu.sender.as_str())
+                    || pdu.kind == TimelineEventType::RoomMember
+                        && pdu
+                            .state_key
+                            .as_ref()
+                            .map_or(false, |state_key| users.is_match(state_key))
+            };
+            let matching_aliases = |aliases: &NamespaceRegex| {
+                services()
+                    .rooms
+                    .alias
+                    .local_aliases_for_room(&pdu.room_id)
+                    .filter_map(|r| r.ok())
+                    .any(|room_alias| aliases.is_match(room_alias.as_str()))
+            };
 
-                let matching_users = |users: &Regex| {
-                    users.is_match(pdu.sender.as_str())
-                        || pdu.kind == RoomEventType::RoomMember
-                            && pdu
-                                .state_key
-                                .as_ref()
-                                .map_or(false, |state_key| users.is_match(state_key))
-                };
-                let matching_aliases = |aliases: &Regex| {
-                    services()
-                        .rooms
-                        .alias
-                        .local_aliases_for_room(&pdu.room_id)
-                        .filter_map(|r| r.ok())
-                        .any(|room_alias| aliases.is_match(room_alias.as_str()))
-                };
-
-                if aliases.iter().any(matching_aliases)
-                    || rooms.map_or(false, |rooms| rooms.contains(&pdu.room_id.as_str().into()))
-                    || users.iter().any(matching_users)
-                {
-                    services()
-                        .sending
-                        .send_pdu_appservice(appservice.0, pdu_id.clone())?;
-                }
+            if matching_aliases(&appservice.aliases)
+                || appservice.rooms.is_match(pdu.room_id.as_str())
+                || matching_users(&appservice.users)
+            {
+                services()
+                    .sending
+                    .send_pdu_appservice(appservice.registration.id.clone(), pdu_id.clone())?;
             }
         }
 
@@ -738,7 +772,7 @@ impl Service {
     /// Creates a new persisted data unit and adds it to a room. This function takes a
     /// roomid_mutex_state, meaning that only this function is able to mutate the room state.
     #[tracing::instrument(skip(self, state_lock))]
-    pub fn build_and_append_pdu(
+    pub async fn build_and_append_pdu(
         &self,
         pdu_builder: PduBuilder,
         sender: &UserId,
@@ -748,89 +782,85 @@ impl Service {
         let (pdu, pdu_json) =
             self.create_hash_and_sign_event(pdu_builder, sender, room_id, state_lock)?;
 
-        let admin_room = services().rooms.alias.resolve_local_alias(
-            <&RoomAliasId>::try_from(
-                format!("#admins:{}", services().globals.server_name()).as_str(),
-            )
-            .expect("#admins:server_name is a valid room alias"),
-        )?;
-        if admin_room.filter(|v| v == room_id).is_some() {
-            match pdu.event_type() {
-                RoomEventType::RoomEncryption => {
-                    warn!("Encryption is not allowed in the admins room");
-                    return Err(Error::BadRequest(
-                        ErrorKind::Forbidden,
-                        "Encryption is not allowed in the admins room.",
-                    ));
+        if let Some(admin_room) = services().admin.get_admin_room()? {
+            if admin_room == room_id {
+                match pdu.event_type() {
+                    TimelineEventType::RoomEncryption => {
+                        warn!("Encryption is not allowed in the admins room");
+                        return Err(Error::BadRequest(
+                            ErrorKind::Forbidden,
+                            "Encryption is not allowed in the admins room.",
+                        ));
+                    }
+                    TimelineEventType::RoomMember => {
+                        #[derive(Deserialize)]
+                        struct ExtractMembership {
+                            membership: MembershipState,
+                        }
+
+                        let target = pdu
+                            .state_key()
+                            .filter(|v| v.starts_with('@'))
+                            .unwrap_or(sender.as_str());
+                        let server_name = services().globals.server_name();
+                        let server_user = format!("@conduit:{}", server_name);
+                        let content = serde_json::from_str::<ExtractMembership>(pdu.content.get())
+                            .map_err(|_| Error::bad_database("Invalid content in pdu."))?;
+
+                        if content.membership == MembershipState::Leave {
+                            if target == server_user {
+                                warn!("Conduit user cannot leave from admins room");
+                                return Err(Error::BadRequest(
+                                    ErrorKind::Forbidden,
+                                    "Conduit user cannot leave from admins room.",
+                                ));
+                            }
+
+                            let count = services()
+                                .rooms
+                                .state_cache
+                                .room_members(room_id)
+                                .filter_map(|m| m.ok())
+                                .filter(|m| m.server_name() == server_name)
+                                .filter(|m| m != target)
+                                .count();
+                            if count < 2 {
+                                warn!("Last admin cannot leave from admins room");
+                                return Err(Error::BadRequest(
+                                    ErrorKind::Forbidden,
+                                    "Last admin cannot leave from admins room.",
+                                ));
+                            }
+                        }
+
+                        if content.membership == MembershipState::Ban && pdu.state_key().is_some() {
+                            if target == server_user {
+                                warn!("Conduit user cannot be banned in admins room");
+                                return Err(Error::BadRequest(
+                                    ErrorKind::Forbidden,
+                                    "Conduit user cannot be banned in admins room.",
+                                ));
+                            }
+
+                            let count = services()
+                                .rooms
+                                .state_cache
+                                .room_members(room_id)
+                                .filter_map(|m| m.ok())
+                                .filter(|m| m.server_name() == server_name)
+                                .filter(|m| m != target)
+                                .count();
+                            if count < 2 {
+                                warn!("Last admin cannot be banned in admins room");
+                                return Err(Error::BadRequest(
+                                    ErrorKind::Forbidden,
+                                    "Last admin cannot be banned in admins room.",
+                                ));
+                            }
+                        }
+                    }
+                    _ => {}
                 }
-                RoomEventType::RoomMember => {
-                    #[derive(Deserialize)]
-                    struct ExtractMembership {
-                        membership: MembershipState,
-                    }
-
-                    let target = pdu
-                        .state_key()
-                        .filter(|v| v.starts_with("@"))
-                        .unwrap_or(sender.as_str());
-                    let server_name = services().globals.server_name();
-                    let server_user = format!("@conduit:{}", server_name);
-                    let content = serde_json::from_str::<ExtractMembership>(pdu.content.get())
-                        .map_err(|_| Error::bad_database("Invalid content in pdu."))?;
-
-                    if content.membership == MembershipState::Leave {
-                        if target == &server_user {
-                            warn!("Conduit user cannot leave from admins room");
-                            return Err(Error::BadRequest(
-                                ErrorKind::Forbidden,
-                                "Conduit user cannot leave from admins room.",
-                            ));
-                        }
-
-                        let count = services()
-                            .rooms
-                            .state_cache
-                            .room_members(room_id)
-                            .filter_map(|m| m.ok())
-                            .filter(|m| m.server_name() == server_name)
-                            .filter(|m| m != target)
-                            .count();
-                        if count < 2 {
-                            warn!("Last admin cannot leave from admins room");
-                            return Err(Error::BadRequest(
-                                ErrorKind::Forbidden,
-                                "Last admin cannot leave from admins room.",
-                            ));
-                        }
-                    }
-
-                    if content.membership == MembershipState::Ban && pdu.state_key().is_some() {
-                        if target == &server_user {
-                            warn!("Conduit user cannot be banned in admins room");
-                            return Err(Error::BadRequest(
-                                ErrorKind::Forbidden,
-                                "Conduit user cannot be banned in admins room.",
-                            ));
-                        }
-
-                        let count = services()
-                            .rooms
-                            .state_cache
-                            .room_members(room_id)
-                            .filter_map(|m| m.ok())
-                            .filter(|m| m.server_name() == server_name)
-                            .filter(|m| m != target)
-                            .count();
-                        if count < 2 {
-                            warn!("Last admin cannot be banned in admins room");
-                            return Err(Error::BadRequest(
-                                ErrorKind::Forbidden,
-                                "Last admin cannot be banned in admins room.",
-                            ));
-                        }
-                    }
-                }
-                _ => {}
             }
         }
 
@@ -838,14 +868,16 @@ impl Service {
         // pdu without it's state. This is okay because append_pdu can't fail.
         let statehashid = services().rooms.state.append_to_state(&pdu)?;
 
-        let pdu_id = self.append_pdu(
-            &pdu,
-            pdu_json,
-            // Since this PDU references all pdu_leaves we can update the leaves
-            // of the room
-            vec![(*pdu.event_id).to_owned()],
-            state_lock,
-        )?;
+        let pdu_id = self
+            .append_pdu(
+                &pdu,
+                pdu_json,
+                // Since this PDU references all pdu_leaves we can update the leaves
+                // of the room
+                vec![(*pdu.event_id).to_owned()],
+                state_lock,
+            )
+            .await?;
 
         // We set the room state after inserting the pdu, so that we never have a moment in time
         // where events in the current room state do not exist
@@ -862,7 +894,7 @@ impl Service {
             .collect();
 
         // In case we are kicking or banning a user, we need to inform their server of the change
-        if pdu.kind == RoomEventType::RoomMember {
+        if pdu.kind == TimelineEventType::RoomMember {
             if let Some(state_key_uid) = &pdu
                 .state_key
                 .as_ref()
@@ -883,12 +915,12 @@ impl Service {
     /// Append the incoming event setting the state snapshot to the state from the
     /// server that sent the event.
     #[tracing::instrument(skip_all)]
-    pub fn append_incoming_pdu<'a>(
+    pub async fn append_incoming_pdu<'a>(
         &self,
         pdu: &PduEvent,
         pdu_json: CanonicalJsonObject,
         new_room_leaves: Vec<OwnedEventId>,
-        state_ids_compressed: HashSet<CompressedStateEvent>,
+        state_ids_compressed: Arc<HashSet<CompressedStateEvent>>,
         soft_fail: bool,
         state_lock: &MutexGuard<'_, ()>, // Take mutex guard to make sure users get the room state mutex
     ) -> Result<Option<Vec<u8>>> {
@@ -913,11 +945,11 @@ impl Service {
             return Ok(None);
         }
 
-        let pdu_id =
-            services()
-                .rooms
-                .timeline
-                .append_pdu(pdu, pdu_json, new_room_leaves, state_lock)?;
+        let pdu_id = services()
+            .rooms
+            .timeline
+            .append_pdu(pdu, pdu_json, new_room_leaves, state_lock)
+            .await?;
 
         Ok(Some(pdu_id))
     }
@@ -958,12 +990,17 @@ impl Service {
     /// Replace a PDU with the redacted form.
     #[tracing::instrument(skip(self, reason))]
     pub fn redact_pdu(&self, event_id: &EventId, reason: &PduEvent) -> Result<()> {
+        // TODO: Don't reserialize, keep original json
         if let Some(pdu_id) = self.get_pdu_id(event_id)? {
             let mut pdu = self
                 .get_pdu_from_id(&pdu_id)?
                 .ok_or_else(|| Error::bad_database("PDU ID points to invalid PDU."))?;
             pdu.redact(reason)?;
-            self.replace_pdu(&pdu_id, &pdu)?;
+            self.replace_pdu(
+                &pdu_id,
+                &utils::to_canonical_object(&pdu).expect("PDU is an object"),
+                &pdu,
+            )?;
         }
         // If event does not exist, just noop
         Ok(())
@@ -972,7 +1009,7 @@ impl Service {
     #[tracing::instrument(skip(self, room_id))]
     pub async fn backfill_if_required(&self, room_id: &RoomId, from: PduCount) -> Result<()> {
         let first_pdu = self
-            .all_pdus(&user_id!("@doesntmatter:conduit.rs"), &room_id)?
+            .all_pdus(user_id!("@doesntmatter:conduit.rs"), room_id)?
             .next()
             .expect("Room is not empty")?;
 
@@ -984,7 +1021,7 @@ impl Service {
         let power_levels: RoomPowerLevelsEventContent = services()
             .rooms
             .state_accessor
-            .room_state_get(&room_id, &StateEventType::RoomPowerLevels, "")?
+            .room_state_get(room_id, &StateEventType::RoomPowerLevels, "")?
             .map(|ev| {
                 serde_json::from_str(ev.content.get())
                     .map_err(|_| Error::bad_database("invalid m.room.power_levels event"))
@@ -1015,11 +1052,9 @@ impl Service {
                 .await;
             match response {
                 Ok(response) => {
-                    let mut pub_key_map = RwLock::new(BTreeMap::new());
+                    let pub_key_map = RwLock::new(BTreeMap::new());
                     for pdu in response.pdus {
-                        if let Err(e) = self
-                            .backfill_pdu(backfill_server, pdu, &mut pub_key_map)
-                            .await
+                        if let Err(e) = self.backfill_pdu(backfill_server, pdu, &pub_key_map).await
                         {
                             warn!("Failed to add backfilled pdu: {e}");
                         }
@@ -1051,7 +1086,7 @@ impl Service {
                 .globals
                 .roomid_mutex_federation
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.to_owned())
                 .or_default(),
         );
@@ -1066,7 +1101,7 @@ impl Service {
         services()
             .rooms
             .event_handler
-            .handle_incoming_pdu(origin, &event_id, &room_id, value, false, &pub_key_map)
+            .handle_incoming_pdu(origin, &event_id, &room_id, value, false, pub_key_map)
             .await?;
 
         let value = self.get_pdu_json(&event_id)?.expect("We just created it");
@@ -1083,11 +1118,11 @@ impl Service {
                 .globals
                 .roomid_mutex_insert
                 .write()
-                .unwrap()
+                .await
                 .entry(room_id.clone())
                 .or_default(),
         );
-        let insert_lock = mutex_insert.lock().unwrap();
+        let insert_lock = mutex_insert.lock().await;
 
         let count = services().globals.next_count()?;
         let mut pdu_id = shortroomid.to_be_bytes().to_vec();
@@ -1099,24 +1134,21 @@ impl Service {
 
         drop(insert_lock);
 
-        match pdu.kind {
-            RoomEventType::RoomMessage => {
-                #[derive(Deserialize)]
-                struct ExtractBody {
-                    body: Option<String>,
-                }
-
-                let content = serde_json::from_str::<ExtractBody>(pdu.content.get())
-                    .map_err(|_| Error::bad_database("Invalid content in pdu."))?;
-
-                if let Some(body) = content.body {
-                    services()
-                        .rooms
-                        .search
-                        .index_pdu(shortroomid, &pdu_id, &body)?;
-                }
+        if pdu.kind == TimelineEventType::RoomMessage {
+            #[derive(Deserialize)]
+            struct ExtractBody {
+                body: Option<String>,
+            }
+
+            let content = serde_json::from_str::<ExtractBody>(pdu.content.get())
+                .map_err(|_| Error::bad_database("Invalid content in pdu."))?;
+
+            if let Some(body) = content.body {
+                services()
+                    .rooms
+                    .search
+                    .index_pdu(shortroomid, &pdu_id, &body)?;
             }
-            _ => {}
         }
         drop(mutex_lock);
 
@@ -1124,3 +1156,16 @@ impl Service {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn comparisons() {
+        assert!(PduCount::Normal(1) < PduCount::Normal(2));
+        assert!(PduCount::Backfilled(2) < PduCount::Backfilled(1));
+        assert!(PduCount::Normal(1) > PduCount::Backfilled(1));
+        assert!(PduCount::Backfilled(1) < PduCount::Normal(1));
+    }
+}
diff --git a/src/service/sending/data.rs b/src/service/sending/data.rs
index 2e574e23..8b4d236f 100644
--- a/src/service/sending/data.rs
+++ b/src/service/sending/data.rs
@@ -5,6 +5,7 @@ use crate::Result;
 use super::{OutgoingKind, SendingEventType};
 
 pub trait Data: Send + Sync {
+    #[allow(clippy::type_complexity)]
     fn active_requests<'a>(
         &'a self,
     ) -> Box<dyn Iterator<Item = Result<(Vec<u8>, OutgoingKind, SendingEventType)>> + 'a>;
diff --git a/src/service/sending/mod.rs b/src/service/sending/mod.rs
index 14d83be3..7e54e8b4 100644
--- a/src/service/sending/mod.rs
+++ b/src/service/sending/mod.rs
@@ -18,9 +18,11 @@ use crate::{
 use federation::transactions::send_transaction_message;
 use futures_util::{stream::FuturesUnordered, StreamExt};
 
+use base64::{engine::general_purpose, Engine as _};
+
 use ruma::{
     api::{
-        appservice,
+        appservice::{self, Registration},
         federation::{
             self,
             transactions::edu::{
@@ -129,7 +131,7 @@ impl Service {
         for (key, outgoing_kind, event) in self.db.active_requests().filter_map(|r| r.ok()) {
             let entry = initial_transactions
                 .entry(outgoing_kind.clone())
-                .or_insert_with(Vec::new);
+                .or_default();
 
             if entry.len() > 30 {
                 warn!(
@@ -482,11 +484,11 @@ impl Service {
 
                 let permit = services().sending.maximum_requests.acquire().await;
 
-                let response = appservice_server::send_request(
+                let response = match appservice_server::send_request(
                     services()
                         .appservice
                         .get_registration(id)
-                        .map_err(|e| (kind.clone(), e))?
+                        .await
                         .ok_or_else(|| {
                             (
                                 kind.clone(),
@@ -497,23 +499,22 @@ impl Service {
                         })?,
                     appservice::event::push_events::v1::Request {
                         events: pdu_jsons,
-                        txn_id: (&*base64::encode_config(
-                            calculate_hash(
-                                &events
-                                    .iter()
-                                    .map(|e| match e {
-                                        SendingEventType::Edu(b) | SendingEventType::Pdu(b) => &**b,
-                                    })
-                                    .collect::<Vec<_>>(),
-                            ),
-                            base64::URL_SAFE_NO_PAD,
-                        ))
+                        txn_id: (&*general_purpose::URL_SAFE_NO_PAD.encode(calculate_hash(
+                            &events
+                                .iter()
+                                .map(|e| match e {
+                                    SendingEventType::Edu(b) | SendingEventType::Pdu(b) => &**b,
+                                })
+                                .collect::<Vec<_>>(),
+                        )))
                             .into(),
                     },
                 )
                 .await
-                .map(|_response| kind.clone())
-                .map_err(|e| (kind, e));
+                {
+                    Ok(_) => Ok(kind.clone()),
+                    Err(e) => Err((kind.clone(), e)),
+                };
 
                 drop(permit);
 
@@ -642,7 +643,7 @@ impl Service {
                         pdus: pdu_jsons,
                         edus: edu_jsons,
                         origin_server_ts: MilliSecondsSinceUnixEpoch::now(),
-                        transaction_id: (&*base64::encode_config(
+                        transaction_id: (&*general_purpose::URL_SAFE_NO_PAD.encode(
                             calculate_hash(
                                 &events
                                     .iter()
@@ -651,7 +652,6 @@ impl Service {
                                     })
                                     .collect::<Vec<_>>(),
                             ),
-                            base64::URL_SAFE_NO_PAD,
                         ))
                             .into(),
                     },
@@ -700,12 +700,15 @@ impl Service {
         response
     }
 
+    /// Sends a request to an appservice
+    ///
+    /// Only returns None if there is no url specified in the appservice registration file
     #[tracing::instrument(skip(self, registration, request))]
     pub async fn send_appservice_request<T: OutgoingRequest>(
         &self,
-        registration: serde_yaml::Value,
+        registration: Registration,
         request: T,
-    ) -> Result<T::IncomingResponse>
+    ) -> Result<Option<T::IncomingResponse>>
     where
         T: Debug,
     {
diff --git a/src/service/uiaa/mod.rs b/src/service/uiaa/mod.rs
index 147ce4d1..ed39af99 100644
--- a/src/service/uiaa/mod.rs
+++ b/src/service/uiaa/mod.rs
@@ -96,6 +96,17 @@ impl Service {
                 // Password was correct! Let's add it to `completed`
                 uiaainfo.completed.push(AuthType::Password);
             }
+            AuthData::RegistrationToken(t) => {
+                if Some(t.token.trim()) == services().globals.config.registration_token.as_deref() {
+                    uiaainfo.completed.push(AuthType::RegistrationToken);
+                } else {
+                    uiaainfo.auth_error = Some(ruma::api::client::error::StandardErrorBody {
+                        kind: ErrorKind::Forbidden,
+                        message: "Invalid registration token.".to_owned(),
+                    });
+                    return Ok((false, uiaainfo));
+                }
+            }
             AuthData::Dummy(_) => {
                 uiaainfo.completed.push(AuthType::Dummy);
             }
diff --git a/src/service/users/data.rs b/src/service/users/data.rs
index 85532109..ddf941e3 100644
--- a/src/service/users/data.rs
+++ b/src/service/users/data.rs
@@ -111,6 +111,7 @@ pub trait Data: Send + Sync {
         master_key: &Raw<CrossSigningKey>,
         self_signing_key: &Option<Raw<CrossSigningKey>>,
         user_signing_key: &Option<Raw<CrossSigningKey>>,
+        notify: bool,
     ) -> Result<()>;
 
     fn sign_key(
@@ -136,14 +137,30 @@ pub trait Data: Send + Sync {
         device_id: &DeviceId,
     ) -> Result<Option<Raw<DeviceKeys>>>;
 
+    fn parse_master_key(
+        &self,
+        user_id: &UserId,
+        master_key: &Raw<CrossSigningKey>,
+    ) -> Result<(Vec<u8>, CrossSigningKey)>;
+
+    fn get_key(
+        &self,
+        key: &[u8],
+        sender_user: Option<&UserId>,
+        user_id: &UserId,
+        allowed_signatures: &dyn Fn(&UserId) -> bool,
+    ) -> Result<Option<Raw<CrossSigningKey>>>;
+
     fn get_master_key(
         &self,
+        sender_user: Option<&UserId>,
         user_id: &UserId,
         allowed_signatures: &dyn Fn(&UserId) -> bool,
     ) -> Result<Option<Raw<CrossSigningKey>>>;
 
     fn get_self_signing_key(
         &self,
+        sender_user: Option<&UserId>,
         user_id: &UserId,
         allowed_signatures: &dyn Fn(&UserId) -> bool,
     ) -> Result<Option<Raw<CrossSigningKey>>>;
diff --git a/src/service/users/mod.rs b/src/service/users/mod.rs
index 6be5c895..fb983a41 100644
--- a/src/service/users/mod.rs
+++ b/src/service/users/mod.rs
@@ -1,20 +1,42 @@
 mod data;
-use std::{collections::BTreeMap, mem};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    mem,
+    sync::{Arc, Mutex},
+};
 
 pub use data::Data;
 use ruma::{
-    api::client::{device::Device, error::ErrorKind, filter::FilterDefinition},
+    api::client::{
+        device::Device,
+        error::ErrorKind,
+        filter::FilterDefinition,
+        sync::sync_events::{
+            self,
+            v4::{ExtensionsConfig, SyncRequestList},
+        },
+    },
     encryption::{CrossSigningKey, DeviceKeys, OneTimeKey},
     events::AnyToDeviceEvent,
     serde::Raw,
     DeviceId, DeviceKeyAlgorithm, DeviceKeyId, OwnedDeviceId, OwnedDeviceKeyId, OwnedMxcUri,
-    OwnedUserId, RoomAliasId, UInt, UserId,
+    OwnedRoomId, OwnedUserId, RoomAliasId, UInt, UserId,
 };
 
 use crate::{services, Error, Result};
 
+pub struct SlidingSyncCache {
+    lists: BTreeMap<String, SyncRequestList>,
+    subscriptions: BTreeMap<OwnedRoomId, sync_events::v4::RoomSubscription>,
+    known_rooms: BTreeMap<String, BTreeMap<OwnedRoomId, u64>>, // For every room, the roomsince number
+    extensions: ExtensionsConfig,
+}
+
 pub struct Service {
     pub db: &'static dyn Data,
+    #[allow(clippy::type_complexity)]
+    pub connections:
+        Mutex<BTreeMap<(OwnedUserId, OwnedDeviceId, String), Arc<Mutex<SlidingSyncCache>>>>,
 }
 
 impl Service {
@@ -23,6 +45,214 @@ impl Service {
         self.db.exists(user_id)
     }
 
+    pub fn forget_sync_request_connection(
+        &self,
+        user_id: OwnedUserId,
+        device_id: OwnedDeviceId,
+        conn_id: String,
+    ) {
+        self.connections
+            .lock()
+            .unwrap()
+            .remove(&(user_id, device_id, conn_id));
+    }
+
+    pub fn update_sync_request_with_cache(
+        &self,
+        user_id: OwnedUserId,
+        device_id: OwnedDeviceId,
+        request: &mut sync_events::v4::Request,
+    ) -> BTreeMap<String, BTreeMap<OwnedRoomId, u64>> {
+        let Some(conn_id) = request.conn_id.clone() else {
+            return BTreeMap::new();
+        };
+
+        let mut cache = self.connections.lock().unwrap();
+        let cached = Arc::clone(
+            cache
+                .entry((user_id, device_id, conn_id))
+                .or_insert_with(|| {
+                    Arc::new(Mutex::new(SlidingSyncCache {
+                        lists: BTreeMap::new(),
+                        subscriptions: BTreeMap::new(),
+                        known_rooms: BTreeMap::new(),
+                        extensions: ExtensionsConfig::default(),
+                    }))
+                }),
+        );
+        let cached = &mut cached.lock().unwrap();
+        drop(cache);
+
+        for (list_id, list) in &mut request.lists {
+            if let Some(cached_list) = cached.lists.get(list_id) {
+                if list.sort.is_empty() {
+                    list.sort = cached_list.sort.clone();
+                };
+                if list.room_details.required_state.is_empty() {
+                    list.room_details.required_state =
+                        cached_list.room_details.required_state.clone();
+                };
+                list.room_details.timeline_limit = list
+                    .room_details
+                    .timeline_limit
+                    .or(cached_list.room_details.timeline_limit);
+                list.include_old_rooms = list
+                    .include_old_rooms
+                    .clone()
+                    .or(cached_list.include_old_rooms.clone());
+                match (&mut list.filters, cached_list.filters.clone()) {
+                    (Some(list_filters), Some(cached_filters)) => {
+                        list_filters.is_dm = list_filters.is_dm.or(cached_filters.is_dm);
+                        if list_filters.spaces.is_empty() {
+                            list_filters.spaces = cached_filters.spaces;
+                        }
+                        list_filters.is_encrypted =
+                            list_filters.is_encrypted.or(cached_filters.is_encrypted);
+                        list_filters.is_invite =
+                            list_filters.is_invite.or(cached_filters.is_invite);
+                        if list_filters.room_types.is_empty() {
+                            list_filters.room_types = cached_filters.room_types;
+                        }
+                        if list_filters.not_room_types.is_empty() {
+                            list_filters.not_room_types = cached_filters.not_room_types;
+                        }
+                        list_filters.room_name_like = list_filters
+                            .room_name_like
+                            .clone()
+                            .or(cached_filters.room_name_like);
+                        if list_filters.tags.is_empty() {
+                            list_filters.tags = cached_filters.tags;
+                        }
+                        if list_filters.not_tags.is_empty() {
+                            list_filters.not_tags = cached_filters.not_tags;
+                        }
+                    }
+                    (_, Some(cached_filters)) => list.filters = Some(cached_filters),
+                    (Some(list_filters), _) => list.filters = Some(list_filters.clone()),
+                    (_, _) => {}
+                }
+                if list.bump_event_types.is_empty() {
+                    list.bump_event_types = cached_list.bump_event_types.clone();
+                };
+            }
+            cached.lists.insert(list_id.clone(), list.clone());
+        }
+
+        cached.subscriptions.extend(
+            request
+                .room_subscriptions
+                .iter()
+                .map(|(k, v)| (k.clone(), v.clone())),
+        );
+        request.room_subscriptions.extend(
+            cached
+                .subscriptions
+                .iter()
+                .map(|(k, v)| (k.clone(), v.clone())),
+        );
+
+        request.extensions.e2ee.enabled = request
+            .extensions
+            .e2ee
+            .enabled
+            .or(cached.extensions.e2ee.enabled);
+
+        request.extensions.to_device.enabled = request
+            .extensions
+            .to_device
+            .enabled
+            .or(cached.extensions.to_device.enabled);
+
+        request.extensions.account_data.enabled = request
+            .extensions
+            .account_data
+            .enabled
+            .or(cached.extensions.account_data.enabled);
+        request.extensions.account_data.lists = request
+            .extensions
+            .account_data
+            .lists
+            .clone()
+            .or(cached.extensions.account_data.lists.clone());
+        request.extensions.account_data.rooms = request
+            .extensions
+            .account_data
+            .rooms
+            .clone()
+            .or(cached.extensions.account_data.rooms.clone());
+
+        cached.extensions = request.extensions.clone();
+
+        cached.known_rooms.clone()
+    }
+
+    pub fn update_sync_subscriptions(
+        &self,
+        user_id: OwnedUserId,
+        device_id: OwnedDeviceId,
+        conn_id: String,
+        subscriptions: BTreeMap<OwnedRoomId, sync_events::v4::RoomSubscription>,
+    ) {
+        let mut cache = self.connections.lock().unwrap();
+        let cached = Arc::clone(
+            cache
+                .entry((user_id, device_id, conn_id))
+                .or_insert_with(|| {
+                    Arc::new(Mutex::new(SlidingSyncCache {
+                        lists: BTreeMap::new(),
+                        subscriptions: BTreeMap::new(),
+                        known_rooms: BTreeMap::new(),
+                        extensions: ExtensionsConfig::default(),
+                    }))
+                }),
+        );
+        let cached = &mut cached.lock().unwrap();
+        drop(cache);
+
+        cached.subscriptions = subscriptions;
+    }
+
+    pub fn update_sync_known_rooms(
+        &self,
+        user_id: OwnedUserId,
+        device_id: OwnedDeviceId,
+        conn_id: String,
+        list_id: String,
+        new_cached_rooms: BTreeSet<OwnedRoomId>,
+        globalsince: u64,
+    ) {
+        let mut cache = self.connections.lock().unwrap();
+        let cached = Arc::clone(
+            cache
+                .entry((user_id, device_id, conn_id))
+                .or_insert_with(|| {
+                    Arc::new(Mutex::new(SlidingSyncCache {
+                        lists: BTreeMap::new(),
+                        subscriptions: BTreeMap::new(),
+                        known_rooms: BTreeMap::new(),
+                        extensions: ExtensionsConfig::default(),
+                    }))
+                }),
+        );
+        let cached = &mut cached.lock().unwrap();
+        drop(cache);
+
+        for (roomid, lastsince) in cached
+            .known_rooms
+            .entry(list_id.clone())
+            .or_default()
+            .iter_mut()
+        {
+            if !new_cached_rooms.contains(roomid) {
+                *lastsince = 0;
+            }
+        }
+        let list = cached.known_rooms.entry(list_id).or_default();
+        for roomid in new_cached_rooms {
+            list.insert(roomid, globalsince);
+        }
+    }
+
     /// Check if account is deactivated
     pub fn is_deactivated(&self, user_id: &UserId) -> Result<bool> {
         self.db.is_deactivated(user_id)
@@ -190,9 +420,15 @@ impl Service {
         master_key: &Raw<CrossSigningKey>,
         self_signing_key: &Option<Raw<CrossSigningKey>>,
         user_signing_key: &Option<Raw<CrossSigningKey>>,
+        notify: bool,
     ) -> Result<()> {
-        self.db
-            .add_cross_signing_keys(user_id, master_key, self_signing_key, user_signing_key)
+        self.db.add_cross_signing_keys(
+            user_id,
+            master_key,
+            self_signing_key,
+            user_signing_key,
+            notify,
+        )
     }
 
     pub fn sign_key(
@@ -226,20 +462,43 @@ impl Service {
         self.db.get_device_keys(user_id, device_id)
     }
 
-    pub fn get_master_key(
+    pub fn parse_master_key(
         &self,
         user_id: &UserId,
+        master_key: &Raw<CrossSigningKey>,
+    ) -> Result<(Vec<u8>, CrossSigningKey)> {
+        self.db.parse_master_key(user_id, master_key)
+    }
+
+    pub fn get_key(
+        &self,
+        key: &[u8],
+        sender_user: Option<&UserId>,
+        user_id: &UserId,
         allowed_signatures: &dyn Fn(&UserId) -> bool,
     ) -> Result<Option<Raw<CrossSigningKey>>> {
-        self.db.get_master_key(user_id, allowed_signatures)
+        self.db
+            .get_key(key, sender_user, user_id, allowed_signatures)
+    }
+
+    pub fn get_master_key(
+        &self,
+        sender_user: Option<&UserId>,
+        user_id: &UserId,
+        allowed_signatures: &dyn Fn(&UserId) -> bool,
+    ) -> Result<Option<Raw<CrossSigningKey>>> {
+        self.db
+            .get_master_key(sender_user, user_id, allowed_signatures)
     }
 
     pub fn get_self_signing_key(
         &self,
+        sender_user: Option<&UserId>,
         user_id: &UserId,
         allowed_signatures: &dyn Fn(&UserId) -> bool,
     ) -> Result<Option<Raw<CrossSigningKey>>> {
-        self.db.get_self_signing_key(user_id, allowed_signatures)
+        self.db
+            .get_self_signing_key(sender_user, user_id, allowed_signatures)
     }
 
     pub fn get_user_signing_key(&self, user_id: &UserId) -> Result<Option<Raw<CrossSigningKey>>> {
@@ -342,6 +601,7 @@ impl Service {
 /// Ensure that a user only sees signatures from themselves and the target user
 pub fn clean_signatures<F: Fn(&UserId) -> bool>(
     cross_signing_key: &mut serde_json::Value,
+    sender_user: Option<&UserId>,
     user_id: &UserId,
     allowed_signatures: F,
 ) -> Result<(), Error> {
@@ -355,9 +615,9 @@ pub fn clean_signatures<F: Fn(&UserId) -> bool>(
         for (user, signature) in
             mem::replace(signatures, serde_json::Map::with_capacity(new_capacity))
         {
-            let id = <&UserId>::try_from(user.as_str())
+            let sid = <&UserId>::try_from(user.as_str())
                 .map_err(|_| Error::bad_database("Invalid user ID in database."))?;
-            if id == user_id || allowed_signatures(id) {
+            if sender_user == Some(user_id) || sid == user_id || allowed_signatures(sid) {
                 signatures.insert(user, signature);
             }
         }
diff --git a/src/utils/error.rs b/src/utils/error.rs
index 4f044ca2..899dfde6 100644
--- a/src/utils/error.rs
+++ b/src/utils/error.rs
@@ -9,7 +9,7 @@ use ruma::{
     OwnedServerName,
 };
 use thiserror::Error;
-use tracing::{error, warn};
+use tracing::{error, info};
 
 #[cfg(feature = "persy")]
 use persy::PersyError;
@@ -54,6 +54,11 @@ pub enum Error {
         #[from]
         source: reqwest::Error,
     },
+    #[error("Could build regular expression: {source}")]
+    RegexError {
+        #[from]
+        source: regex::Error,
+    },
     #[error("{0}")]
     FederationError(OwnedServerName, RumaError),
     #[error("Could not do this io: {source}")]
@@ -80,6 +85,8 @@ pub enum Error {
     #[cfg(feature = "conduit_bin")]
     #[error("{0}")]
     PathError(#[from] axum::extract::rejection::PathRejection),
+    #[error("{0}")]
+    AdminCommand(&'static str),
 }
 
 impl Error {
@@ -116,9 +123,11 @@ impl Error {
             Self::BadRequest(kind, _) => (
                 kind.clone(),
                 match kind {
-                    Forbidden | GuestAccessForbidden | ThreepidAuthFailed | ThreepidDenied => {
-                        StatusCode::FORBIDDEN
-                    }
+                    WrongRoomKeysVersion { .. }
+                    | Forbidden
+                    | GuestAccessForbidden
+                    | ThreepidAuthFailed
+                    | ThreepidDenied => StatusCode::FORBIDDEN,
                     Unauthorized | UnknownToken { .. } | MissingToken => StatusCode::UNAUTHORIZED,
                     NotFound | Unrecognized => StatusCode::NOT_FOUND,
                     LimitExceeded { .. } => StatusCode::TOO_MANY_REQUESTS,
@@ -131,13 +140,35 @@ impl Error {
             _ => (Unknown, StatusCode::INTERNAL_SERVER_ERROR),
         };
 
-        warn!("{}: {}", status_code, message);
+        info!("Returning an error: {}: {}", status_code, message);
 
         RumaResponse(UiaaResponse::MatrixError(RumaError {
             body: ErrorBody::Standard { kind, message },
             status_code,
         }))
     }
+
+    /// Sanitizes public-facing errors that can leak sensitive information.
+    pub fn sanitized_error(&self) -> String {
+        let db_error = String::from("Database or I/O error occurred.");
+
+        match self {
+            #[cfg(feature = "sled")]
+            Self::SledError { .. } => db_error,
+            #[cfg(feature = "sqlite")]
+            Self::SqliteError { .. } => db_error,
+            #[cfg(feature = "persy")]
+            Self::PersyError { .. } => db_error,
+            #[cfg(feature = "heed")]
+            Self::HeedError => db_error,
+            #[cfg(feature = "rocksdb")]
+            Self::RocksDbError { .. } => db_error,
+            Self::IoError { .. } => db_error,
+            Self::BadConfig { .. } => db_error,
+            Self::BadDatabase { .. } => db_error,
+            _ => self.to_string(),
+        }
+    }
 }
 
 #[cfg(feature = "persy")]