Build Matrix

Tuwunel’s CI tests a large combinatorial space of build configurations. The matrix has six independent dimensions. Not all combinations are valid or useful, so the bake configuration and workflow files apply exclusions to keep the total job count tractable.

Cargo Profiles

Cargo Feature Sets

The feature sets are named groups of Cargo features, defined in docker/bake.hcl as the cargo_feat_sets map.

none

No optional features. Produces the smallest, most minimal binary. Used to verify that nothing in the default code path accidentally depends on an optional feature.

default

The feature set shipped to users in standard packages:

brotli_compression, element_hacks, gzip_compression, io_uring, jemalloc, jemalloc_conf, media_thumbnail, release_max_log_level, systemd, url_preview, zstd_compression

logging

All of default (without release_max_log_level) plus features useful for development and diagnostics:

blurhashing, bzip2_compression, console, direct_tls, jemalloc_prof, jemalloc_stats, ldap, lz4_compression, perf_measurements, sentry_telemetry, tokio_console, tuwunel_mods

all

Everything, including release_max_log_level. The most exhaustive compilation target; used for clippy, doc tests, and integration tests.

Note

The feature direct_tls is always added to every build regardless of the selected feature set (cargo_features_always in bake.hcl).

Rust Toolchains

The bake.sh script reads rust-toolchain.toml to resolve stable to the project’s minimum supported Rust version, ensuring released binaries are always built against a pinned toolchain rather than whatever stable happens to be current. Nix additionally verifies this with a SHA256 check in flake.nix.

Rust Targets (Cross-compilation)

These are the --target values passed to Cargo:

Cross-compilation to aarch64 runs on ARM64 GitHub Actions runners and produces binaries for Raspberry Pi 4+, AWS Graviton, and Apple Silicon (via Rosetta or native under Linux).

CPU Optimization Levels (System Targets)

The sys_target dimension controls which x86_64 microarchitecture level the binary is compiled for. This affects both Rust compiler flags and, for targets that include RocksDB, the native library build.

Warning

Running a binary compiled for a higher level than the host CPU supports causes an Illegal Instruction (SIGILL) crash immediately on startup. The generic deployment guide includes a command to determine which level your CPU supports.

RocksDB benefits significantly from hardware CRC32 (available from v2 onward) and from SIMD compression routines (improved further at v3). For production deployments, -v3- binaries are the recommended default.

System Images

The base OS image for build and runtime containers. Currently only one system is tested:

Linking Mode

Static versus dynamic linking is selected automatically based on the profile and toolchain:

Static linking produces fully portable binaries that run on any Linux system without matching library versions. Dynamic linking is used during development and testing because it produces faster incremental builds.

Matrix Combinations in Practice

The CI does not test every possible combination — the cross-product of all dimensions would be in the thousands. Instead, each workflow job selects a slice of the matrix appropriate to its task:

The test.yml workflow embeds about 51 explicit exclusions to remove combinations that are redundant, impossible, or not worth the resource cost.