Prepare 0.3.116

Reviewed-on: https://git.asonix.dog/asonix/relay/pulls/3

.drone.yml

@@ -1,421 +0,0 @@
-kind: pipeline
-type: docker
-name: clippy
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: clippy
-  image: asonix/rust-builder:latest-linux-amd64
-  pull: always
-  commands:
-  - rustup component add clippy
-  - cargo clippy --no-deps -- -D warnings
-
-trigger:
-  event:
-  - push
-  - pull_request
-  - tag
-
----
-
-kind: pipeline
-type: docker
-name: tests
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: tests
-  image: asonix/rust-builder:latest-linux-amd64
-  pull: always
-  commands:
-  - cargo test
-
-trigger:
-  event:
-  - push
-  - pull_request
-  - tag
-
----
-
-kind: pipeline
-type: docker
-name: check-amd64
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: check
-  image: asonix/rust-builder:latest-linux-amd64
-  pull: always
-  commands:
-  - cargo check --target=$TARGET
-
-trigger:
-  event:
-  - push
-  - pull_request
-
----
-
-kind: pipeline
-type: docker
-name: build-amd64
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: build
-  image: asonix/rust-builder:latest-linux-amd64
-  pull: always
-  commands:
-  - cargo build --target=$TARGET --release
-  - $TOOL-strip target/$TARGET/release/relay
-  - cp target/$TARGET/release/relay .
-  - cp relay relay-linux-amd64
-
-- name: push
-  image: plugins/docker:20
-  settings:
-    username: asonix
-    password:
-      from_secret: dockerhub_token
-    repo: asonix/relay
-    dockerfile: docker/drone/Dockerfile
-    auto_tag: true
-    auto_tag_suffix: linux-amd64
-    build_args:
-    - REPO_ARCH=amd64
-
-- name: publish
-  image: plugins/gitea-release:1
-  settings:
-    api_key:
-      from_secret: gitea_token
-    base_url: https://git.asonix.dog
-    files:
-    - relay-linux-amd64
-
-depends_on:
-- clippy
-- tests
-
-trigger:
-  event:
-  - tag
-
----
-
-kind: pipeline
-type: docker
-name: check-arm64v8
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: check
-  image: asonix/rust-builder:latest-linux-arm64v8
-  pull: always
-  commands:
-  - cargo check --target=$TARGET
-
-trigger:
-  event:
-  - push
-  - pull_request
-
----
-
-kind: pipeline
-type: docker
-name: build-arm64v8
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: build
-  image: asonix/rust-builder:latest-linux-arm64v8
-  pull: always
-  commands:
-  - cargo build --target=$TARGET --release
-  - $TOOL-strip target/$TARGET/release/relay
-  - cp target/$TARGET/release/relay .
-  - cp relay relay-linux-arm64v8
-
-- name: push
-  image: plugins/docker:20
-  settings:
-    username: asonix
-    password:
-      from_secret: dockerhub_token
-    repo: asonix/relay
-    dockerfile: docker/drone/Dockerfile
-    auto_tag: true
-    auto_tag_suffix: linux-arm64v8
-    build_args:
-    - REPO_ARCH=arm64v8
-
-- name: publish
-  image: plugins/gitea-release:1
-  settings:
-    api_key:
-      from_secret: gitea_token
-    base_url: https://git.asonix.dog
-    files:
-    - relay-linux-arm64v8
-
-depends_on:
-- clippy
-- tests
-
-trigger:
-  event:
-  - tag
-
----
-
-kind: pipeline
-type: docker
-name: check-arm32v7
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: check
-  image: asonix/rust-builder:latest-linux-arm32v7
-  pull: always
-  commands:
-  - cargo check --target=$TARGET
-
-trigger:
-  event:
-  - push
-  - pull_request
-
----
-
-kind: pipeline
-type: docker
-name: build-arm32v7
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: build
-  image: asonix/rust-builder:latest-linux-arm32v7
-  pull: always
-  commands:
-  - cargo build --target=$TARGET --release
-  - $TOOL-strip target/$TARGET/release/relay
-  - cp target/$TARGET/release/relay .
-  - cp relay relay-linux-arm32v7
-
-- name: push
-  image: plugins/docker:20
-  settings:
-    username: asonix
-    password:
-      from_secret: dockerhub_token
-    repo: asonix/relay
-    dockerfile: docker/drone/Dockerfile
-    auto_tag: true
-    auto_tag_suffix: linux-arm32v7
-    build_args:
-    - REPO_ARCH=arm32v7
-
-- name: publish
-  image: plugins/gitea-release:1
-  settings:
-    api_key:
-      from_secret: gitea_token
-    base_url: https://git.asonix.dog
-    files:
-    - relay-linux-arm32v7
-
-depends_on:
-- clippy
-- tests
-
-trigger:
-  event:
-  - tag
-
----
-
-kind: pipeline
-type: docker
-name: manifest
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: manifest
-  image: plugins/manifest:1
-  settings:
-    username: asonix
-    password:
-      from_secret: dockerhub_token
-    dump: true
-    auto_tag: true
-    ignore_missing: true
-    spec: docker/drone/manifest.tmpl
-
-
-depends_on:
-- build-amd64
-- build-arm64v8
-- build-arm32v7
-
-trigger:
-  event:
-  - tag
-
----
-
-kind: pipeline
-type: docker
-name: publish-crate
-
-platform:
-  arch: amd64
-
-clone:
-  disable: true
-
-steps:
-- name: clone
-  image: alpine/git:latest
-  user: root
-  commands:
-  - git clone $DRONE_GIT_HTTP_URL .
-  - git checkout $DRONE_COMMIT
-  - chown -R 991:991 .
-
-- name: publish
-  image: asonix/rust-builder:latest-linux-amd64
-  pull: always
-  environment:
-    CRATES_IO_TOKEN:
-      from_secret: crates_io_token
-  commands:
-  - cargo publish --token $CRATES_IO_TOKEN
-
-depends_on:
-- build-amd64
-- build-arm64v8
-- build-arm32v7
-
-trigger:
-  event:
-  - tag

.forgejo/workflows/check.yaml

@@ -0,0 +1,61 @@
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  clippy:
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Clippy
+        run: |
+          cargo clippy --no-default-features -- -D warnings
+
+  tests:
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Test
+        run: cargo test
+
+  check:
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - x86_64-unknown-linux-musl
+          - armv7-unknown-linux-musleabihf
+          - aarch64-unknown-linux-musl
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Debug builds
+        run: cargo zigbuild --target ${{ matrix.target }}

.forgejo/workflows/publish.yaml

@@ -0,0 +1,226 @@
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+env:
+  REGISTRY_IMAGE: asonix/relay
+
+jobs:
+  clippy:
+    runs-on: base-image
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Clippy
+        run: |
+          # cargo clippy --no-default-features -- -D warnings
+          cargo clippy --no-default-features
+
+  tests:
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Test
+        run: cargo test
+
+  build:
+    needs:
+      - clippy
+      - tests
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    strategy:
+      fail-fast: false
+      matrix:
+        info:
+          - target: x86_64-unknown-linux-musl
+            artifact: linux-amd64
+            platform: linux/amd64
+          - target: armv7-unknown-linux-musleabihf
+            artifact: linux-arm32v7
+            platform: linux/arm/v7
+          - target: aarch64-unknown-linux-musl
+            artifact: linux-arm64v8
+            platform: linux/arm64
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Prepare Platform
+        run: |
+          platform=${{ matrix.info.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+        shell: bash
+      -
+        name: Docker meta
+        id: meta
+        uses: https://github.com/docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+          flavor: |
+            latest=auto
+            suffix=-${{ matrix.info.artifact }}
+          tags: |
+            type=raw,value=latest,enable={{ is_default_branch }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      -
+        name: Set up QEMU
+        uses: https://github.com/docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+      -
+        name: Docker login
+        uses: https://github.com/docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Compile relay
+        run: cargo zigbuild --target ${{ matrix.info.target }} --release
+      -
+        name: Prepare artifacts
+        run: |
+          mkdir artifacts
+          cp target/${{ matrix.info.target }}/release/relay artifacts/relay-${{ matrix.info.artifact }}
+      -
+        uses: https://github.com/actions/upload-artifact@v3
+        with:
+          name: binaries
+          path: artifacts/
+      -
+        name: Prepare binary
+        run: |
+          cp target/${{ matrix.info.target }}/release/relay docker/forgejo/relay
+      -
+        name: Build and push ${{ matrix.info.platform }} docker image
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: ./docker/forgejo
+          platforms: ${{ matrix.info.platform }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},name-canonical=true,push=true
+      -
+        name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+          echo "Created /tmp/digests/${digest#sha256:}"
+        shell: bash
+      -
+        name: Upload ${{ matrix.info.platform }} digest
+        uses: https://github.com/actions/upload-artifact@v3
+        with:
+          name: digests
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  publish-docker:
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    needs: [build]
+    steps:
+      -
+        name: Download digests
+        uses: https://github.com/actions/download-artifact@v3
+        with:
+          name: digests
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker login
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Docker meta
+        id: meta
+        uses: https://github.com/docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+          flavor: |
+            latest=auto
+          tags: |
+            type=raw,value=latest,enable={{ is_default_branch }}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      -
+        name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          tags=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "${DOCKER_METADATA_OUTPUT_JSON}")
+          images=$(printf "${{ env.REGISTRY_IMAGE }}@sha256:%s " *)
+          echo "Running 'docker buildx imagetools create ${tags[@]} ${images[@]}'"
+          docker buildx imagetools create ${tags[@]} ${images[@]}
+        shell: bash
+      -
+        name: Inspect Image
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
+
+  publish-forgejo:
+    needs: [build]
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      - uses: https://github.com/actions/download-artifact@v3
+        with:
+          name: binaries
+          path: artifacts/
+          merge-multiple: true
+      - uses: actions/forgejo-release@v1
+        with:
+          direction: upload
+          token: ${{ secrets.GITHUB_TOKEN }}
+          release-dir: artifacts/
+
+  publish-crate:
+    needs: [build]
+    runs-on: docker
+    container:
+      image: docker.io/asonix/actions-base-image:0.1
+    steps:
+      -
+        name: Checkout relay
+        uses: https://github.com/actions/checkout@v4
+      -
+        name: Cargo Cache
+        uses: https://git.asonix.dog/asonix/actions/cache-rust-dependencies@main
+      -
+        name: Publish Crate
+        run: cargo publish --token ${{ secrets.CRATES_IO_TOKEN }}

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "ap-relay"
 description = "A simple activitypub relay"
-version = "0.3.108"
+version = "0.3.116"
 authors = ["asonix <asonix@asonix.dog>"]
 license = "AGPL-3.0"
 readme = "README.md"
@@ -14,6 +14,9 @@ build = "src/build.rs"
 name = "relay"
 path = "src/main.rs"
 
+[profile.release]
+strip = true
+
 [features]
 console = ["dep:console-subscriber"]
 default = []
@@ -21,60 +24,60 @@ default = []
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-actix-web = { version = "4.4.0", default-features = false, features = ["compress-brotli", "compress-gzip", "rustls-0_22"] }
+actix-web = { version = "4.4.0", default-features = false, features = ["compress-brotli", "compress-gzip", "rustls-0_23"] }
 actix-webfinger = { version = "0.5.0", default-features = false }
 activitystreams = "0.7.0-alpha.25"
 activitystreams-ext = "0.1.0-alpha.3"
-ammonia = "3.1.0"
+ammonia = "4.0.0"
-async-cpupool = "0.2.0"
+async-cpupool = "0.3.0"
-bcrypt = "0.15"
+bcrypt = "0.16"
-base64 = "0.21"
+base64 = "0.22"
 clap = { version = "4.0.0", features = ["derive"] }
 color-eyre = "0.6.2"
 config = { version = "0.14.0", default-features = false, features = ["toml", "json", "yaml"] }
-console-subscriber = { version = "0.2", optional = true }
+console-subscriber = { version = "0.4", optional = true }
-dashmap = "5.1.0"
+dashmap = "6.0.1"
 dotenv = "0.15.0"
-flume = "0.11.0"
+futures-core = "0.3.30"
 lru = "0.12.0"
-metrics = "0.22.0"
+metrics = "0.23.0"
-metrics-exporter-prometheus = { version = "0.13.0", default-features = false, features = [
+metrics-exporter-prometheus = { version = "0.15.0", default-features = false, features = [
   "http-listener",
 ] }
-metrics-util = "0.16.0"
+metrics-util = "0.17.0"
 mime = "0.3.16"
 minify-html = "0.15.0"
-opentelemetry = "0.21"
+opentelemetry = "0.27.1"
-opentelemetry_sdk = { version = "0.21", features = ["rt-tokio"] }
+opentelemetry_sdk = { version = "0.27", features = ["rt-tokio"] }
-opentelemetry-otlp = "0.14"
+opentelemetry-otlp = { version = "0.27", features = ["grpc-tonic"] }
 pin-project-lite = "0.2.9"
 # pinned to metrics-util
 quanta = "0.12.0"
 rand = "0.8"
-reqwest = { version = "0.11", default-features = false, features = ["rustls-tls", "stream"]}
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"]}
-reqwest-middleware = "0.2"
+reqwest-middleware = { version = "0.4", default-features = false, features = ["json"] }
-reqwest-tracing = "0.4.5"
+reqwest-tracing = "0.5.0"
 ring = "0.17.5"
-rsa = { version = "0.9" }
+rsa = "0.9"
 rsa-magic-public-key = "0.8.0"
-rustls = "0.22.0"
+rustls = { version = "0.23.0", default-features = false, features = ["ring", "logging", "std", "tls12"] }
-rustls-channel-resolver = "0.2.0"
+rustls-channel-resolver = "0.3.0"
 rustls-pemfile = "2"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 sled = "0.34.7"
 streem = "0.2.0"
-teloxide = { version = "0.12.0", default-features = false, features = [
+teloxide = { version = "0.13.0", default-features = false, features = [
   "ctrlc_handler",
   "macros",
   "rustls",
 ] }
-thiserror = "1.0"
+thiserror = "2.0"
 time = { version = "0.3.17", features = ["serde"] }
 tracing = "0.1"
 tracing-error = "0.2"
 tracing-log = "0.2"
-tracing-opentelemetry = "0.22"
+tracing-opentelemetry = "0.28"
 tracing-subscriber = { version = "0.3", features = [
   "ansi",
   "env-filter",
@@ -84,17 +87,17 @@ tokio = { version = "1", features = ["full", "tracing"] }
 uuid = { version = "1", features = ["v4", "serde"] }
 
 [dependencies.background-jobs]
-version = "0.18.0"
+version = "0.19.0"
 default-features = false
 features = ["error-logging", "metrics", "tokio"]
 
 [dependencies.http-signature-normalization-actix]
-version = "0.11.0"
+version = "0.11.1"
 default-features = false
 features = ["server", "ring"]
 
 [dependencies.http-signature-normalization-reqwest]
-version = "0.11.0"
+version = "0.13.0"
 default-features = false
 features = ["middleware", "ring"]
 

docker/drone/Dockerfile

@@ -1,11 +0,0 @@
-ARG REPO_ARCH
-
-FROM asonix/rust-runner:latest-linux-$REPO_ARCH
-
-COPY relay /usr/local/bin/relay
-
-USER app
-EXPOSE 8080
-VOLUME /mnt
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD ["/usr/local/bin/relay"]

docker/drone/manifest.tmpl

@@ -1,25 +0,0 @@
-image: asonix/relay:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
-{{#if build.tags}}
-tags:
-{{#each build.tags}}
-  - {{this}}
-{{/each}}
-{{/if}}
-manifests:
-  -
-    image: asonix/relay:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64
-    platform:
-      architecture: amd64
-      os: linux
-  -
-    image: asonix/relay:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm64v8
-    platform:
-      architecture: arm64
-      os: linux
-      variant: v8
-  -
-    image: asonix/relay:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm32v7
-    platform:
-      architecture: arm
-      os: linux
-      variant: v7

docker/forgejo/Dockerfile

@@ -0,0 +1,24 @@
+FROM alpine:3.19
+
+ARG UID=991
+ARG GID=991
+
+ENV \
+  UID=${UID} \
+  GID=${GID}
+
+USER root
+RUN \
+  addgroup -g "${GID}" app && \
+  adduser -D -G app -u "${UID}" -g "" -h /opt/app app && \
+  apk add tini && \
+  chown -R app:app /mnt
+
+COPY relay /usr/local/bin/relay
+
+USER app
+EXPOSE 6669
+EXPOSE 8080
+VOLUME /mnt
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["/usr/local/bin/relay"]

docker/prod/docker-compose.yml

@@ -2,7 +2,7 @@ version: '3.3'
 
 services:
   relay:
-    image: asonix/relay:0.3.85
+    image: asonix/relay:0.3.115
     ports:
       - "8079:8079"
     restart: always

flake.lock

@@ -5,11 +5,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1710146030,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -20,16 +20,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1705133751,
+        "lastModified": 1733550349,
-        "narHash": "sha256-rCIsyE80jgiOU78gCWN3A0wE0tR2GI5nH6MlS+HaaSQ=",
+        "narHash": "sha256-NcGumB4Lr6KSDq+nIqXtNA8QwAQKDSZT7N9OTGWbTrs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9b19f5e77dd906cb52dade0b7bd280339d2a1f3d",
+        "rev": "e2605d0744c2417b09f8bf850dfca42fcf537d34",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "relay";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
     flake-utils.url = "github:numtide/flake-utils";
   };
 

relay.nix

@@ -5,7 +5,7 @@
 
 rustPlatform.buildRustPackage {
   pname = "relay";
-  version = "0.3.108";
+  version = "0.3.116";
   src = ./.;
   cargoLock.lockFile = ./Cargo.lock;
 

src/admin/client.rs

@@ -5,7 +5,6 @@ use crate::{
     error::{Error, ErrorKind},
     extractors::XApiToken,
 };
-use actix_web::http::header::Header;
 use reqwest_middleware::ClientWithMiddleware;
 use serde::de::DeserializeOwned;
 
@@ -87,13 +86,17 @@ async fn get_results<T: DeserializeOwned>(
 
     let res = client
         .get(iri.as_str())
-        .header(XApiToken::name(), x_api_token.to_string())
+        .header(XApiToken::http1_name(), x_api_token.to_string())
         .send()
         .await
         .map_err(|e| ErrorKind::SendRequest(iri.to_string(), e.to_string()))?;
 
     if !res.status().is_success() {
-        return Err(ErrorKind::Status(iri.to_string(), res.status()).into());
+        return Err(ErrorKind::Status(
+            iri.to_string(),
+            crate::http1::status_to_http02(res.status()),
+        )
+        .into());
     }
 
     let t = res
@@ -116,7 +119,7 @@ async fn post_domains(
 
     let res = client
         .post(iri.as_str())
-        .header(XApiToken::name(), x_api_token.to_string())
+        .header(XApiToken::http1_name(), x_api_token.to_string())
         .json(&Domains { domains })
         .send()
         .await

src/collector.rs

@@ -15,6 +15,10 @@ const MINUTES: u64 = 60 * SECONDS;
 const HOURS: u64 = 60 * MINUTES;
 const DAYS: u64 = 24 * HOURS;
 
+pub(crate) fn recordable(len: usize) -> u32 {
+    ((len as u64) % u64::from(u32::MAX)) as u32
+}
+
 type DistributionMap = BTreeMap<Vec<(String, String)>, Summary>;
 
 #[derive(Clone)]
@@ -299,7 +303,14 @@ impl Inner {
                 for sample in samples {
                     entry.add(*sample);
                 }
-            })
+            });
+
+            let mut total_len = 0;
+            for dist_map in d.values() {
+                total_len += dist_map.len();
+            }
+
+            metrics::gauge!("relay.collector.distributions.size").set(recordable(total_len));
         }
 
         let d = self.distributions.read().unwrap().clone();
@@ -358,6 +369,7 @@ impl MemoryCollector {
     ) {
         let mut d = self.inner.descriptions.write().unwrap();
         d.entry(key.as_str().to_owned()).or_insert(description);
+        metrics::gauge!("relay.collector.descriptions.size").set(recordable(d.len()));
     }
 
     pub(crate) fn install(&self) -> Result<(), SetRecorderError<Self>> {

src/data/last_online.rs

@@ -9,10 +9,10 @@ pub(crate) struct LastOnline {
 impl LastOnline {
     pub(crate) fn mark_seen(&self, iri: &IriStr) {
         if let Some(authority) = iri.authority_str() {
-            self.domains
+            let mut guard = self.domains.lock().unwrap();
-                .lock()
+            guard.insert(authority.to_string(), OffsetDateTime::now_utc());
-                .unwrap()
+            metrics::gauge!("relay.last-online.size",)
-                .insert(authority.to_string(), OffsetDateTime::now_utc());
+                .set(crate::collector::recordable(guard.len()));
         }
     }
 

src/data/state.rs

@@ -73,7 +73,9 @@ impl State {
     }
 
     pub(crate) fn cache(&self, object_id: IriString, actor_id: IriString) {
-        self.object_cache.write().unwrap().put(object_id, actor_id);
+        let mut guard = self.object_cache.write().unwrap();
+        guard.put(object_id, actor_id);
+        metrics::gauge!("relay.object-cache.size").set(crate::collector::recordable(guard.len()));
     }
 
     pub(crate) fn is_connected(&self, iri: &IriString) -> bool {

src/db.rs

@@ -7,7 +7,7 @@ use rsa::{
     pkcs8::{DecodePrivateKey, EncodePrivateKey},
     RsaPrivateKey,
 };
-use sled::{Batch, Tree};
+use sled::{transaction::TransactionError, Batch, Transactional, Tree};
 use std::{
     collections::{BTreeMap, HashMap},
     sync::{
@@ -283,10 +283,15 @@ impl Db {
     pub(crate) async fn check_health(&self) -> Result<(), Error> {
         let next = self.inner.healthz_counter.fetch_add(1, Ordering::Relaxed);
         self.unblock(move |inner| {
-            inner
+            let res = inner
                 .healthz
                 .insert("healthz", &next.to_be_bytes()[..])
-                .map_err(Error::from)
+                .map_err(Error::from);
+
+            metrics::gauge!("relay.db.healthz.size")
+                .set(crate::collector::recordable(inner.healthz.len()));
+
+            res
         })
         .await?;
         self.inner.healthz.flush_async().await?;
@@ -349,6 +354,9 @@ impl Db {
                 .actor_id_info
                 .insert(actor_id.as_str().as_bytes(), vec)?;
 
+            metrics::gauge!("relay.db.actor-id-info.size")
+                .set(crate::collector::recordable(inner.actor_id_info.len()));
+
             Ok(())
         })
         .await
@@ -383,6 +391,9 @@ impl Db {
                 .actor_id_instance
                 .insert(actor_id.as_str().as_bytes(), vec)?;
 
+            metrics::gauge!("relay.db.actor-id-instance.size")
+                .set(crate::collector::recordable(inner.actor_id_instance.len()));
+
             Ok(())
         })
         .await
@@ -417,6 +428,9 @@ impl Db {
                 .actor_id_contact
                 .insert(actor_id.as_str().as_bytes(), vec)?;
 
+            metrics::gauge!("relay.db.actor-id-contact.size")
+                .set(crate::collector::recordable(inner.actor_id_contact.len()));
+
             Ok(())
         })
         .await
@@ -447,6 +461,12 @@ impl Db {
             inner
                 .media_url_media_id
                 .insert(url.as_str().as_bytes(), id.as_bytes())?;
+
+            metrics::gauge!("relay.db.media-id-media-url.size")
+                .set(crate::collector::recordable(inner.media_id_media_url.len()));
+            metrics::gauge!("relay.db.media-url-media-id.size")
+                .set(crate::collector::recordable(inner.media_url_media_id.len()));
+
             Ok(())
         })
         .await
@@ -538,6 +558,14 @@ impl Db {
             inner
                 .actor_id_actor
                 .insert(actor.id.as_str().as_bytes(), vec)?;
+
+            metrics::gauge!("relay.db.public-key-actor-id.size").set(crate::collector::recordable(
+                inner.public_key_id_actor_id.len(),
+            ));
+
+            metrics::gauge!("relay.db.actor-id-actor.size").set(crate::collector::recordable(
+                inner.public_key_id_actor_id.len(),
+            ));
             Ok(())
         })
         .await
@@ -550,6 +578,10 @@ impl Db {
                 .connected_actor_ids
                 .remove(actor_id.as_str().as_bytes())?;
 
+            metrics::gauge!("relay.db.connected-actor-ids.size").set(crate::collector::recordable(
+                inner.connected_actor_ids.len(),
+            ));
+
             Ok(())
         })
         .await
@@ -562,6 +594,10 @@ impl Db {
                 .connected_actor_ids
                 .insert(actor_id.as_str().as_bytes(), actor_id.as_str().as_bytes())?;
 
+            metrics::gauge!("relay.db.connected-actor-ids.size").set(crate::collector::recordable(
+                inner.connected_actor_ids.len(),
+            ));
+
             Ok(())
         })
         .await
@@ -569,30 +605,64 @@ impl Db {
 
     pub(crate) async fn add_blocks(&self, domains: Vec<String>) -> Result<(), Error> {
         self.unblock(move |inner| {
-            for connected in inner.connected_by_domain(&domains) {
+            let connected_by_domain = inner.connected_by_domain(&domains).collect::<Vec<_>>();
-                inner
-                    .connected_actor_ids
-                    .remove(connected.as_str().as_bytes())?;
-            }
 
-            for authority in &domains {
+            let res = (
-                inner
+                &inner.connected_actor_ids,
-                    .blocked_domains
+                &inner.blocked_domains,
-                    .insert(domain_key(authority), authority.as_bytes())?;
+                &inner.allowed_domains,
-                inner.allowed_domains.remove(domain_key(authority))?;
+            )
-            }
+                .transaction(|(connected, blocked, allowed)| {
+                    let mut connected_batch = Batch::default();
+                    let mut blocked_batch = Batch::default();
+                    let mut allowed_batch = Batch::default();
 
-            Ok(())
+                    for connected in &connected_by_domain {
+                        connected_batch.remove(connected.as_str().as_bytes());
+                    }
+
+                    for authority in &domains {
+                        blocked_batch
+                            .insert(domain_key(authority).as_bytes(), authority.as_bytes());
+                        allowed_batch.remove(domain_key(authority).as_bytes());
+                    }
+
+                    connected.apply_batch(&connected_batch)?;
+                    blocked.apply_batch(&blocked_batch)?;
+                    allowed.apply_batch(&allowed_batch)?;
+
+                    Ok(())
+                });
+
+            metrics::gauge!("relay.db.connected-actor-ids.size").set(crate::collector::recordable(
+                inner.connected_actor_ids.len(),
+            ));
+            metrics::gauge!("relay.db.blocked-domains.size")
+                .set(crate::collector::recordable(inner.blocked_domains.len()));
+            metrics::gauge!("relay.db.allowed-domains.size")
+                .set(crate::collector::recordable(inner.allowed_domains.len()));
+
+            match res {
+                Ok(()) => Ok(()),
+                Err(TransactionError::Abort(e) | TransactionError::Storage(e)) => Err(e.into()),
+            }
         })
         .await
     }
 
     pub(crate) async fn remove_blocks(&self, domains: Vec<String>) -> Result<(), Error> {
         self.unblock(move |inner| {
+            let mut blocked_batch = Batch::default();
+
             for authority in &domains {
-                inner.blocked_domains.remove(domain_key(authority))?;
+                blocked_batch.remove(domain_key(authority).as_bytes());
             }
 
+            inner.blocked_domains.apply_batch(blocked_batch)?;
+
+            metrics::gauge!("relay.db.blocked-domains.size")
+                .set(crate::collector::recordable(inner.blocked_domains.len()));
+
             Ok(())
         })
         .await
@@ -600,12 +670,17 @@ impl Db {
 
     pub(crate) async fn add_allows(&self, domains: Vec<String>) -> Result<(), Error> {
         self.unblock(move |inner| {
+            let mut allowed_batch = Batch::default();
+
             for authority in &domains {
-                inner
+                allowed_batch.insert(domain_key(authority).as_bytes(), authority.as_bytes());
-                    .allowed_domains
-                    .insert(domain_key(authority), authority.as_bytes())?;
             }
 
+            inner.allowed_domains.apply_batch(allowed_batch)?;
+
+            metrics::gauge!("relay.db.allowed-domains.size")
+                .set(crate::collector::recordable(inner.allowed_domains.len()));
+
             Ok(())
         })
         .await
@@ -614,17 +689,32 @@ impl Db {
     pub(crate) async fn remove_allows(&self, domains: Vec<String>) -> Result<(), Error> {
         self.unblock(move |inner| {
             if inner.restricted_mode {
-                for connected in inner.connected_by_domain(&domains) {
+                let connected_by_domain = inner.connected_by_domain(&domains).collect::<Vec<_>>();
-                    inner
+
-                        .connected_actor_ids
+                let mut connected_batch = Batch::default();
-                        .remove(connected.as_str().as_bytes())?;
+
+                for connected in &connected_by_domain {
+                    connected_batch.remove(connected.as_str().as_bytes());
                 }
+
+                inner.connected_actor_ids.apply_batch(connected_batch)?;
+
+                metrics::gauge!("relay.db.connected-actor-ids.size").set(
+                    crate::collector::recordable(inner.connected_actor_ids.len()),
+                );
             }
 
+            let mut allowed_batch = Batch::default();
+
             for authority in &domains {
-                inner.allowed_domains.remove(domain_key(authority))?;
+                allowed_batch.remove(domain_key(authority).as_bytes());
             }
 
+            inner.allowed_domains.apply_batch(allowed_batch)?;
+
+            metrics::gauge!("relay.db.allowed-domains.size")
+                .set(crate::collector::recordable(inner.allowed_domains.len()));
+
             Ok(())
         })
         .await
@@ -665,6 +755,10 @@ impl Db {
             inner
                 .settings
                 .insert("private-key".as_bytes(), pem_pkcs8.as_bytes())?;
+
+            metrics::gauge!("relay.db.settings.size")
+                .set(crate::collector::recordable(inner.settings.len()));
+
             Ok(())
         })
         .await

src/error.rs

@@ -123,6 +123,9 @@ pub(crate) enum ErrorKind {
     #[error("Couldn't sign request")]
     SignRequest,
 
+    #[error("Response body from server exceeded limits")]
+    BodyTooLarge,
+
     #[error("Couldn't make request")]
     Reqwest(#[from] reqwest::Error),
 

src/extractors.rs

@@ -163,6 +163,10 @@ impl XApiToken {
     pub(crate) fn new(token: String) -> Self {
         Self(token)
     }
+
+    pub(crate) const fn http1_name() -> reqwest::header::HeaderName {
+        reqwest::header::HeaderName::from_static("x-api-token")
+    }
 }
 
 impl Header for XApiToken {

src/http1.rs

@@ -0,0 +1,18 @@
+pub(crate) fn name_to_http02(
+    name: &reqwest::header::HeaderName,
+) -> actix_web::http::header::HeaderName {
+    actix_web::http::header::HeaderName::from_bytes(name.as_ref())
+        .expect("headername conversions always work")
+}
+
+pub(crate) fn value_to_http02(
+    value: &reqwest::header::HeaderValue,
+) -> actix_web::http::header::HeaderValue {
+    actix_web::http::header::HeaderValue::from_bytes(value.as_bytes())
+        .expect("headervalue conversions always work")
+}
+
+pub(crate) fn status_to_http02(status: reqwest::StatusCode) -> actix_web::http::StatusCode {
+    actix_web::http::StatusCode::from_u16(status.as_u16())
+        .expect("statuscode conversions always work")
+}

src/jobs.rs

@@ -40,7 +40,12 @@ fn debug_object(activity: &serde_json::Value) -> &serde_json::Value {
     object
 }
 
+pub(crate) fn build_storage() -> MetricsStorage<Storage<TokioTimer>> {
+    MetricsStorage::wrap(Storage::new(TokioTimer))
+}
+
 pub(crate) fn create_workers(
+    storage: MetricsStorage<Storage<TokioTimer>>,
     state: State,
     actors: ActorCache,
     media: MediaCache,
@@ -48,18 +53,15 @@ pub(crate) fn create_workers(
 ) -> std::io::Result<JobServer> {
     let deliver_concurrency = config.deliver_concurrency();
 
-    let queue_handle = WorkerConfig::new(
+    let queue_handle = WorkerConfig::new(storage, move |queue_handle| {
-        MetricsStorage::wrap(Storage::new(TokioTimer)),
+        JobState::new(
-        move |queue_handle| {
+            state.clone(),
-            JobState::new(
+            actors.clone(),
-                state.clone(),
+            JobServer::new(queue_handle),
-                actors.clone(),
+            media.clone(),
-                JobServer::new(queue_handle),
+            config.clone(),
-                media.clone(),
+        )
-                config.clone(),
+    })
-            )
-        },
-    )
     .register::<Deliver>()
     .register::<DeliverMany>()
     .register::<QueryNodeinfo>()

src/jobs/nodeinfo.rs

@@ -156,7 +156,7 @@ struct Link {
 #[serde(untagged)]
 enum MaybeSupported<T> {
     Supported(T),
-    Unsupported(String),
+    Unsupported(#[allow(unused)] String),
 }
 
 impl<T> MaybeSupported<T> {
@@ -165,8 +165,8 @@ impl<T> MaybeSupported<T> {
     }
 }
 
-struct SupportedVersion(String);
+struct SupportedVersion(#[allow(unused)] String);
-struct SupportedNodeinfo(String);
+struct SupportedNodeinfo(#[allow(unused)] String);
 
 static SUPPORTED_VERSIONS: &str = "2.";
 static SUPPORTED_NODEINFO: &str = "http://nodeinfo.diaspora.software/ns/schema/2.";

src/main.rs

@@ -12,7 +12,7 @@ use error::Error;
 use http_signature_normalization_actix::middleware::VerifySignature;
 use metrics_exporter_prometheus::PrometheusBuilder;
 use metrics_util::layers::FanoutBuilder;
-use opentelemetry::KeyValue;
+use opentelemetry::{trace::TracerProvider, KeyValue};
 use opentelemetry_otlp::WithExportConfig;
 use opentelemetry_sdk::Resource;
 use reqwest_middleware::ClientWithMiddleware;
@@ -33,11 +33,13 @@ mod db;
 mod error;
 mod extractors;
 mod future;
+mod http1;
 mod jobs;
 mod middleware;
 mod requests;
 mod routes;
 mod spawner;
+mod stream;
 mod telegram;
 
 use crate::config::UrlKind;
@@ -81,22 +83,21 @@ fn init_subscriber(
     let subscriber = subscriber.with(console_layer);
 
     if let Some(url) = opentelemetry_url {
-        let tracer = opentelemetry_otlp::new_pipeline()
+        let exporter = opentelemetry_otlp::SpanExporter::builder()
-            .tracing()
+            .with_tonic()
-            .with_trace_config(
+            .with_endpoint(url.as_str())
-                opentelemetry_sdk::trace::config().with_resource(Resource::new(vec![
+            .build()?;
-                    KeyValue::new("service.name", software_name),
+
-                ])),
+        let tracer_provider = opentelemetry_sdk::trace::TracerProvider::builder()
-            )
+            .with_resource(Resource::new(vec![KeyValue::new(
-            .with_exporter(
+                "service.name",
-                opentelemetry_otlp::new_exporter()
+                software_name,
-                    .tonic()
+            )]))
-                    .with_endpoint(url.as_str()),
+            .with_batch_exporter(exporter, opentelemetry_sdk::runtime::Tokio)
-            )
+            .build();
-            .install_batch(opentelemetry_sdk::runtime::Tokio)?;
 
         let otel_layer = tracing_opentelemetry::layer()
-            .with_tracer(tracer)
+            .with_tracer(tracer_provider.tracer(software_name))
             .with_filter(targets);
 
         let subscriber = subscriber.with(otel_layer);
@@ -321,10 +322,16 @@ async fn server_main(
     let sign_spawner2 = sign_spawner.clone();
     let verify_spawner2 = verify_spawner.clone();
     let config2 = config.clone();
+    let job_store = jobs::build_storage();
     let server = HttpServer::new(move || {
-        let job_server =
+        let job_server = create_workers(
-            create_workers(state.clone(), actors.clone(), media.clone(), config.clone())
+            job_store.clone(),
-                .expect("Failed to create job server");
+            state.clone(),
+            actors.clone(),
+            media.clone(),
+            config.clone(),
+        )
+        .expect("Failed to create job server");
 
         let app = App::new()
             .app_data(web::Data::new(db.clone()))
@@ -411,7 +418,7 @@ async fn server_main(
             .with_no_client_auth()
             .with_cert_resolver(cert_rx);
         server
-            .bind_rustls_0_22(bind_address, server_config)?
+            .bind_rustls_0_23(bind_address, server_config)?
             .run()
             .await?;
 

src/middleware/timings.rs

@@ -80,7 +80,7 @@ where
     fn call(&self, req: ServiceRequest) -> Self::Future {
         let log_on_drop = LogOnDrop {
             begin: Instant::now(),
-            path: req.path().to_string(),
+            path: format!("{:?}", req.match_pattern()),
             method: req.method().to_string(),
             arm: false,
         };

src/requests.rs

@@ -2,6 +2,7 @@ use crate::{
     data::LastOnline,
     error::{Error, ErrorKind},
     spawner::Spawner,
+    stream::{aggregate, limit_stream},
 };
 use activitystreams::iri_string::types::IriString;
 use actix_web::http::header::Date;
@@ -24,6 +25,9 @@ const ONE_MINUTE: u64 = 60 * ONE_SECOND;
 const ONE_HOUR: u64 = 60 * ONE_MINUTE;
 const ONE_DAY: u64 = 24 * ONE_HOUR;
 
+// 20 KB
+const JSON_SIZE_LIMIT: usize = 20 * 1024;
+
 #[derive(Debug)]
 pub(crate) enum BreakerStrategy {
     // Requires a successful response
@@ -229,7 +233,11 @@ impl Requests {
                 }
             }
 
-            return Err(ErrorKind::Status(parsed_url.to_string(), status).into());
+            return Err(ErrorKind::Status(
+                parsed_url.to_string(),
+                crate::http1::status_to_http02(status),
+            )
+            .into());
         }
 
         // only actually succeed a breaker on 2xx response
@@ -262,7 +270,7 @@ impl Requests {
     where
         T: serde::de::DeserializeOwned,
     {
-        let body = self
+        let stream = self
             .do_deliver(
                 url,
                 &serde_json::json!({}),
@@ -271,8 +279,9 @@ impl Requests {
                 strategy,
             )
             .await?
-            .bytes()
+            .bytes_stream();
-            .await?;
+
+        let body = aggregate(limit_stream(stream, JSON_SIZE_LIMIT)).await?;
 
         Ok(serde_json::from_slice(&body)?)
     }
@@ -299,11 +308,12 @@ impl Requests {
     where
         T: serde::de::DeserializeOwned,
     {
-        let body = self
+        let stream = self
             .do_fetch_response(url, accept, strategy)
             .await?
-            .bytes()
+            .bytes_stream();
-            .await?;
+
+        let body = aggregate(limit_stream(stream, JSON_SIZE_LIMIT)).await?;
 
         Ok(serde_json::from_slice(&body)?)
     }

src/routes/media.rs

@@ -2,10 +2,14 @@ use crate::{
     data::MediaCache,
     error::Error,
     requests::{BreakerStrategy, Requests},
+    stream::limit_stream,
 };
 use actix_web::{body::BodyStream, web, HttpResponse};
 use uuid::Uuid;
 
+// 16 MB
+const IMAGE_SIZE_LIMIT: usize = 16 * 1024 * 1024;
+
 #[tracing::instrument(name = "Media", skip(media, requests))]
 pub(crate) async fn route(
     media: web::Data<MediaCache>,
@@ -19,13 +23,19 @@ pub(crate) async fn route(
             .fetch_response(&url, BreakerStrategy::Allow404AndBelow)
             .await?;
 
-        let mut response = HttpResponse::build(res.status());
+        let mut response = HttpResponse::build(crate::http1::status_to_http02(res.status()));
 
         for (name, value) in res.headers().iter().filter(|(h, _)| *h != "connection") {
-            response.insert_header((name.clone(), value.clone()));
+            response.insert_header((
+                crate::http1::name_to_http02(name),
+                crate::http1::value_to_http02(value),
+            ));
         }
 
-        return Ok(response.body(BodyStream::new(res.bytes_stream())));
+        return Ok(response.body(BodyStream::new(limit_stream(
+            res.bytes_stream(),
+            IMAGE_SIZE_LIMIT,
+        ))));
     }
 
     Ok(HttpResponse::NotFound().finish())

src/stream.rs

@@ -0,0 +1,59 @@
+use crate::error::{Error, ErrorKind};
+use actix_web::web::{Bytes, BytesMut};
+use futures_core::Stream;
+use streem::IntoStreamer;
+
+pub(crate) fn limit_stream<'a, S>(
+    input: S,
+    limit: usize,
+) -> impl Stream<Item = Result<Bytes, Error>> + Send + 'a
+where
+    S: Stream<Item = reqwest::Result<Bytes>> + Send + 'a,
+{
+    streem::try_from_fn(move |yielder| async move {
+        let stream = std::pin::pin!(input);
+        let mut stream = stream.into_streamer();
+
+        let mut count = 0;
+
+        while let Some(bytes) = stream.try_next().await? {
+            count += bytes.len();
+
+            if count > limit {
+                return Err(ErrorKind::BodyTooLarge.into());
+            }
+
+            yielder.yield_ok(bytes).await;
+        }
+
+        Ok(())
+    })
+}
+
+pub(crate) async fn aggregate<S>(input: S) -> Result<Bytes, Error>
+where
+    S: Stream<Item = Result<Bytes, Error>>,
+{
+    let stream = std::pin::pin!(input);
+    let mut streamer = stream.into_streamer();
+
+    let mut buf = Vec::new();
+
+    while let Some(bytes) = streamer.try_next().await? {
+        buf.push(bytes);
+    }
+
+    if buf.len() == 1 {
+        return Ok(buf.pop().expect("buf has exactly one element"));
+    }
+
+    let total_size: usize = buf.iter().map(|b| b.len()).sum();
+
+    let mut bytes_mut = BytesMut::with_capacity(total_size);
+
+    for bytes in &buf {
+        bytes_mut.extend_from_slice(&bytes);
+    }
+
+    Ok(bytes_mut.freeze())
+}

src/telegram.rs

@@ -75,7 +75,8 @@ pub(crate) fn start(admin_handle: String, db: Db, token: &str) {
 
 fn is_admin(admin_handle: &str, message: &Message) -> bool {
     message
-        .from()
+        .from
+        .as_ref()
         .and_then(|user| user.username.as_deref())
         .map(|username| username == admin_handle)
         .unwrap_or(false)