Exclude CODEOWNERS from language statistics

Add CODEOWNERS (one staff approval)
Prepare v2.7.0 release (#5538 )
2026-11-01 09:18:32 -05:00 · 2026-11-01 09:18:32 -05:00 · 2025-11-10 21:18:24 +04:00 · 2025-11-10 20:45:21 +04:00 · 2025-11-09 22:46:54 +04:00 · 2025-11-09 20:36:10 +04:00
1219 changed files with 81661 additions and 71352 deletions
@@ -15,3 +15,4 @@

 # additional files for Docker images
 !build/ferretdb
+!build/postgres-documentdb
@@ -0,0 +1,9 @@
+# https://editorconfig.org
+
+root = true
+
+[*]
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+charset = utf-8
@@ -3,3 +3,8 @@
 *.png filter=lfs diff=lfs merge=lfs -text
 *.webp filter=lfs diff=lfs merge=lfs -text
 *.gif filter=lfs diff=lfs merge=lfs -text
+
+*.pdf filter=lfs diff=lfs merge=lfs -text
+
+*.go diff=golang
+.gitea/CODEOWNERS linguist-detectable=false
@@ -0,0 +1,3 @@
+# Pull requests request review from the eligible staff team(s).
+# One approval from either an Admin or Developer satisfies branch protection.
+*   @trueog/Admins @trueog/Developers
@@ -1,21 +1,10 @@
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-# Order is important; the last matching pattern takes the most precedence.
+# Order is important; the last matching pattern has the highest precedence.

-*                           @AlekSi
+*               @AlekSi @chilagrow

-/cmd/                       @FerretDB/leads
-/ferretdb/                  @FerretDB/leads
-/integration/               @FerretDB/leads
-/internal/                  @FerretDB/leads
-
-/internal/backends/         @AlekSi
+/website/       @AlekSi @Fashander

 # @AlekSi for engineering, @ptrfarkas for marketing.
 # See also Mergify configuration.
-/website/                   @AlekSi @ptrfarkas
-
-/build/                     @AlekSi
-/build/legacy-mongo-shell/  @FerretDB/specops
-
-go.mod                      @AlekSi
-go.sum                      @AlekSi
+/website/blog/  @AlekSi @ptrfarkas
@@ -14,18 +14,14 @@ body:
  - type: textarea
    id: version
    attributes:
-      label: FerretDB version
+      label: FerretDB, PostgreSQL, and DocumentDB versions
      description: >
-        What version and package of FerretDB do you use?
-        Please provide an output of running FerretDB with [`--version` flag](https://docs.ferretdb.io/v1.24/configuration/flags/).
-    validations:
-      required: true
-  - type: input
-    id: backend
-    attributes:
-      label: Backend
-      description: >
-        What backend (PostgreSQL, etc) and what version do you use?
+        Please add the output of the `serverStatus` command.
+      value: |
+        ```json
+        {
+        }
+        ```
    validations:
      required: true
  - type: textarea
@@ -33,13 +29,13 @@ body:
      label: Environment
      description: |
        For example:
-          - **OS**: Ubuntu 22.04 x86_64
-          - **Deployment**: Docker using `ghcr.io/ferretdb/ferretdb:1.15.0` image
-          - **Deployment details**: Docker version 24.0.6
+          - **OS**: Ubuntu 24.04 x86_64
+          - **Deployment**: Docker using `ghcr.io/ferretdb/ferretdb:2` image
+          - **Deployment details**: Docker version 27.3.1
      value: |
-        - OS:
-        - Deployment:
-        - Deployment details:
+        - **OS**:
+        - **Deployment**:
+        - **Deployment details**:
    validations:
      required: true
  - type: textarea
@@ -48,7 +44,7 @@ body:
      label: What did you do?
      description: >
        Include MongoDB queries or
-        [pull request with a test script](https://github.com/FerretDB/FerretDB/blob/main-v1/CONTRIBUTING.md#reporting-a-bug)
+        [pull request with a test script](https://github.com/FerretDB/FerretDB/blob/main/CONTRIBUTING.md#reporting-a-bug)
        if you can.
    validations:
      required: true
@@ -65,6 +61,6 @@ body:
    attributes:
      label: What did you see instead?
      description: >
-        Please include FerretDB [logs](https://docs.ferretdb.io/v1.24/configuration/observability/).
+        Please include FerretDB [logs](https://docs.ferretdb.io/configuration/observability/).
    validations:
      required: true
@@ -31,11 +31,10 @@ body:
      description: What should be done to consider this issue done? List everything that applies.
      value: |
        - handler updated;
-        - all backends updated;
        - unit tests added/updated;
        - integration/compatibility tests added/updated;
        - spot refactorings done;
-        - user documentation updated or an issue to create documentation created;
+        - user documentation updated (or an issue to create documentation created);
        - something else?
    validations:
      required: true
@@ -4,7 +4,7 @@
 blank_issues_enabled: false
 contact_links:
  - name: Quick question
-    url: https://join.slack.com/t/ferretdb/shared_invite/zt-zqe9hj8g-ZcMG3~5Cs5u9uuOPnZB8~A
+    url: https://slack.ferretdb.io/
    about: Please join our Slack chat.
  - name: General question or discussion
    url: https://github.com/FerretDB/FerretDB/discussions/categories/general
@@ -10,8 +10,8 @@ This guide tries to be short and does not mention things that are completely aut

 We want our work to be visible and transparent.
 This way we can help each other and make sure that we are on the right track.
-To uphold these principles, we agree to make results of our daily work available for others through various means such as
-pull requests, code reviews, created issues, or any other relevant method.
+To uphold these principles, we agree to make results of our daily work available for others through various means
+such as pushed commits, updated pull requests, code reviews, created issues, or any other relevant method.

 ### Community

@@ -27,8 +27,10 @@ please follow these notes below when you working with pull request:
 1. Send pull requests from forks; do not make personal branches in the main repository.
   This way, we are similar to community members and could notice similar problems that we could fix for everyone,
   not just for us.
-2. Pull request title should be accurate and descriptive as it is used in the generated changelog.
+2. Pull request title should be accurate and descriptive
+   as it is used in the generated [changelog](../CHANGELOG.md) as is.
   It generally should start with imperative verb ("Fix …", not "Fixing …", "Fixed …" or other forms).
+   It should not have a prefix ("Fix …", not "Fix: …") (we use labels for categorization).
   It should not mention the issue number.
 3. It is fine to send several sequential pull requests for one issue to make them easier to review.
   In that case, please still use the `Closes` word as described in [CONTRIBUTING.md](../CONTRIBUTING.md)
@@ -2,21 +2,30 @@

 ## Preparation

-1. Check tests, linters.
-2. Check issues and pull requests, update milestones and labels.
-3. Check if there are breaking changes or anything that should be reflected in the changelog and/or user documentation.
-4. Create draft release on GitHub with autogenerated release notes.
-5. Generate changelog:
-   - Run `task changelog MILESTONE_TITLE=vX.Y.Z PREVIOUS_MILESTONE_TITLE=vX.Y.Z` to generate release changelog for the given milestone.
-   - Copy the changelog to the `CHANGELOG.md` file.
+1. [Release DocumentDB](https://github.com/FerretDB/documentdb/blob/ferretdb/.github/RELEASE_CHECKLIST.md).
+2. Update DocumentDB image tags to point to release in:
+   - [eval image](../build/ferretdb/eval.Dockerfile);
+   - [eval-dev image](../build/ferretdb/eval-dev.Dockerfile);
+   - [local image](../build/deps/postgres-documentdb.Dockerfile);
+   - [bw image](../build/ferretdb-bw/Dockerfile).
+3. Update constants in [`documentdb.go`](../build/version/documentdb.go).
+4. Check DocumentDB images/tags in documentation (where we specify full tags).
+5. Re-run tests, linters.
+6. Check issues and pull requests, update milestones and labels.
+7. Check if there are breaking changes or anything that should be reflected in the changelog and/or user documentation.
+8. Create draft release on GitHub with autogenerated release notes.
+9. Update CHANGELOG.md:
+   - Run `task changelog PREV=vX.Y.Z NEXT=vX.Y.Z` to generate release changelog for the given milestone.
+   - Check warnings, copy output to the `CHANGELOG.md` file.
   - Sort items within sections according to importance if needed.
   - Add first-time contributor credits if any (copy this data from the release draft).
-6. Run `task docs-version VERSION=X.Y`.
-   Update `versions` in `docusaurus.config.js`.
-   Remove the oldest version from `versioned_docs`, `versioned_sidebars`, `versions.json`.
-7. Run `task docs-fmt`.
-8. Commit and push changes to the PR.
-9. Merge PR, pull and check `git status`.
+   - Add link to DocumentDB release page.
+10. Run `task docs-version VERSION=X.Y`.
+    Update `versions` and `createRedirects` in `docusaurus.config.js`.
+    Remove the oldest version from `versioned_docs`, `versioned_sidebars`, `versions.json`.
+11. Run `task docs`.
+12. Commit and push changes to the PR.
+13. Merge PR, pull and check `git status`.

 ## Git tag

@@ -24,8 +33,8 @@
 2. Check `task gen-version; git status` output.
 3. Push it!
 4. Refresh
-   - `env GOPROXY=https://proxy.golang.org go mod download -x github.com/FerretDB/FerretDB@<vX.Y.Z>`
-   - `https://pkg.go.dev/github.com/FerretDB/FerretDB@<vX.Y.Z>` from https://pkg.go.dev/github.com/FerretDB/FerretDB?tab=versions.
+   - `env GOPROXY=https://proxy.golang.org go mod download -x github.com/FerretDB/FerretDB/v2@<vX.Y.Z>`
+   - `https://pkg.go.dev/github.com/FerretDB/FerretDB/v2@<vX.Y.Z>` from https://pkg.go.dev/github.com/FerretDB/FerretDB/v2?tab=versions.

 ## Release

@@ -36,21 +45,27 @@
 4. Check:
   - https://hub.docker.com/r/ferretdb/ferretdb/tags
   - https://hub.docker.com/r/ferretdb/ferretdb-dev/tags
-   - https://hub.docker.com/r/ferretdb/all-in-one/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-eval/tags
+   - https://hub.docker.com/r/ferretdb/ferretdb-eval-dev/tags
   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb
   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-dev
-   - https://github.com/FerretDB/FerretDB/pkgs/container/all-in-one
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-eval
+   - https://github.com/FerretDB/FerretDB/pkgs/container/ferretdb-eval-dev
   - https://quay.io/repository/ferretdb/ferretdb?tab=tags
   - https://quay.io/repository/ferretdb/ferretdb-dev?tab=tags
-   - https://quay.io/repository/ferretdb/all-in-one?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-eval?tab=tags
+   - https://quay.io/repository/ferretdb/ferretdb-eval-dev?tab=tags
 5. Close milestone in issues.
 6. Publish release on GitHub.
 7. Announce it on Slack.

 ## Soon after

-1. Bump the latest version on https://beacon.ferretdb.com and https://beacon.ferretdb.io.
-2. Publish and announce blog post.
-3. Tweet, toot.
-4. Update NixOS package: https://github.com/NixOS/nixpkgs/tree/master/pkgs/servers/nosql/ferretdb.
-5. Update Civo package: https://github.com/civo/kubernetes-marketplace/tree/master/ferretdb.
+1. Publish and announce blog post.
+2. Add link to blog post to `CHANGELOG.md` and release page.
+3. Bump the latest version on https://beacon.ferretdb.com and https://beacon.ferretdb.io.
+4. Update DocumentDB images/tags in Dockerfiles to point back to development version.
+5. Update DocumentDB images/tags in the current documentation (where we specify full tags)
+   to point to the next (non-existing) version.
+6. Update URLs with `/refs/tags/` in them in the current documentation
+   to point to the next (non-existing) version.
@@ -30,7 +30,32 @@ flag_management:

 # https://docs.codecov.com/docs/pull-request-comments
 comment:
-  layout: reach,diff,files,flags
+  layout: reach,diff,files,flags,components
+
+# https://docs.codecov.com/docs/components
+component_management:
+  default_rules:
+    statuses:
+      - type: project
+        target: auto
+        threshold: 1%
+  individual_components:
+    - component_id: clientconn
+      name: "clientconn"
+      paths:
+        - internal/clientconn/**
+    - component_id: dataapi
+      name: "dataapi"
+      paths:
+        - internal/dataapi/**
+    - component_id: documentdb
+      name: "documentdb"
+      paths:
+        - internal/documentdb/**
+    - component_id: handler
+      name: "handler"
+      paths:
+        - internal/handler/**

 # https://docs.codecov.com/docs/github-checks
 # Annotations may be hidden by pressing the "a" key or by unselecting "Show annotations" in the top right of the file.
@@ -3,6 +3,8 @@
 # Apply the "not ready" label to prevent cascaded CI runs on each auto-merge.

 version: 2
+
+# Most configurations are duplicated to add main-v1 branch.
 updates:
  - package-ecosystem: "github-actions"
    directory: "/"
@@ -16,6 +18,19 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "github-actions"
+    target-branch: "main-v1"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      github-actions-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"

  - package-ecosystem: "docker"
    directory: "/build/ferretdb"
@@ -29,6 +44,20 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "docker"
+    target-branch: "main-v1"
+    directory: "/build/ferretdb"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-docker-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
  - package-ecosystem: "docker"
    directory: "/build/deps"
    labels: ["deps", "not ready"]
@@ -41,6 +70,19 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "docker"
+    target-branch: "main-v1"
+    directory: "/build/deps"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      build-deps-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"

  - package-ecosystem: "gomod"
    directory: "/"
@@ -54,6 +96,20 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      ferretdb-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
  - package-ecosystem: "gomod"
    directory: "/integration"
    labels: ["deps", "not ready"]
@@ -66,6 +122,20 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/integration"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      integration-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
  - package-ecosystem: "gomod"
    directory: "/tools"
    labels: ["deps", "not ready"]
@@ -78,6 +148,20 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/tools"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      tools-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
  - package-ecosystem: "gomod"
    directory: "/tools/golangci"
    labels: ["deps", "not ready"]
@@ -90,3 +174,41 @@ updates:
      interval: "weekly"
      day: "wednesday"
      time: "01:42"
+  - package-ecosystem: "gomod"
+    target-branch: "main-v1"
+    directory: "/tools/golangci"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      golangci-v1:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  # no mcphost in main-v1
+  - package-ecosystem: "gomod"
+    directory: "/tools/mcphost"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    groups:
+      mcphost:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
+
+  # no submodules in main-v1
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    labels: ["deps", "not ready"]
+    assignees: [AlekSi]
+    open-pull-requests-limit: 20
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:42"
@@ -11,7 +11,6 @@ pull_request_rules:
      - "-draft"
      - "-locked"
      - "-merged"
-      - "author != dependabot[bot]"
      - "base = main"
      - "branch-protection-review-decision = APPROVED"
      - "check-success = golangci-lint"
@@ -1,33 +0,0 @@
---
-# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
-
-changelog:
-  categories:
-    - title: New Features 🎉
-      labels:
-        - code/feature
-
-    - title: Fixed Bugs 🐛
-      labels:
-        - code/bug
-        - code/bug-regression
-
-    - title: Enhancements 🛠
-      labels:
-        - code/enhancement
-
-    - title: Documentation 📄
-      labels:
-        - blog/engineering
-        - blog/marketing
-        - documentation
-
-    - title: Other Changes 🤖
-      labels:
-        - code/chore
-        - project
-        - deps
-
-    - title: This section should be empty
-      labels:
-        - "*"
@@ -12,6 +12,7 @@ repository:
  enable_vulnerability_alerts: true

 # https://docs.github.com/en/rest/issues/labels
+# Labels are being used by issues, PRs, and discussions.
 labels:
  # area
  - name: area/admin
@@ -29,44 +30,33 @@ labels:
  - name: area/cursors
    color: "#D93F0B"
    description: Issues about cursors
+  - name: area/dataapi
+    color: "#D98F93"
+    description: Issues about Data API
  - name: area/diag
    color: "#909BA6"
    description: Issues about diagnostic commands
+  - name: area/errors
+    color: "#DE231F"
+    description: Issues about MongoDB-compatible error codes and messages
  - name: area/fuzz
    color: "#D4C5F9"
    description: Issues about fuzzing and smithing
  - name: area/indexes
    color: "#006B75"
    description: Issues about indexes
+  - name: area/mcp
+    color: "#95921F"
+    description: Issues about MCP
  - name: area/observability
    color: "#E04D33"
    description: Issues about metrics, logs, traces, pprof, etc
-  - name: area/oplog
-    color: "#09D521"
-    description: Issues about OpLog and capped collections
-  - name: area/params
-    color: "#FBCA04"
-    description: Issues about command parameters extraction
  - name: area/performance
    color: "#D02FE8"
    description: Issues about performance
-  - name: area/pushdown
-    color: "#83F7BA"
-    description: Issues about query pushdown
-  - name: area/types
+  - name: area/wire
    color: "#0354F4"
-    description: Issues about data types, BSON, wire protocol, etc
-
-  # backend
-  - name: backend/pg
-    color: "#305C83"
-    description: Issues about PostgreSQL backend
-  - name: backend/sqlite
-    color: "#2C8FCA"
-    description: Issues about SQLite backend
-  - name: backend/hana
-    color: "#2D6AB1"
-    description: Issues about SAP HANA backend
+    description: Issues about BSON and the wire protocol

  # blog
  - name: blog/engineering
@@ -12,24 +12,18 @@ on:
      shard_total:
        required: true
        type: number
-      coveralls:
-        required: true
-        type: boolean
-      disable_pushdown:
+      test_timeout:
+        required: false
+        type: string
+        default: 20m
+      no_xfail:
        required: false
        type: boolean
        default: false
-      postgres_dockerfile:
-        required: false
-        type: string
-        default: "postgres"
-      checkout_ref:
-        required: false
-        type: string
-        default: ""
-    secrets:
-      FERRETDB_HANA_URL:
+      skip_flaky_check:
        required: false
+        type: boolean
+        default: false

 env:
  GOPATH: /home/runner/go
@@ -43,30 +37,20 @@ jobs:
  run:
    # make it short to fit in GitHub UI; all parameters are already in the caller's name
    name: Run
-
-    # https://www.ubicloud.com/docs/about/pricing#github-actions
-    # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#per-minute-rates-for-larger-runners
-    runs-on: ubicloud-standard-4
-
+    runs-on: ubuntu-24.04
    timeout-minutes: 25

    steps:
-      - name: Dump github context
-        run: echo "$GITHUB_CONTEXT"
-        env:
-          GITHUB_CONTEXT: ${{ toJSON(github) }}
-
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
-          ref: ${{ inputs.checkout_ref }}

-      # for branch.txt on pull_request_target; the correct branch is already checked out on push / schedule
+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
      - name: Name branch
-        if: github.event_name == 'pull_request_target'
+        if: github.event_name == 'pull_request'
        env:
          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
        run: git checkout -b $BRANCH
@@ -80,62 +64,100 @@ jobs:
        run: go generate -x
        working-directory: tools

+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Start environment
        run: bin/task env-up-detach
-        env:
-          POSTGRES_DOCKERFILE: ${{ inputs.postgres_dockerfile }}

      - name: Run init
        run: bin/task init

+      - name: Setup Ollama and MCPHost
+        run: |
+          mkdir -p tmp/logs
+          curl -fsSL https://ollama.com/install.sh | sh
+          sudo systemctl stop ollama
+          bin/task ollama  > tmp/logs/ollama.log  2>&1 &
+          bin/task mcphost > tmp/logs/mcphost.log 2>&1 &
+
      - name: Wait for and setup environment
        run: bin/task env-setup

      - name: >
          Run ${{ inputs.task }} tests
-          (${{ inputs.shard_index }}/${{ inputs.shard_total }},
-          pushdown=${{ !inputs.disable_pushdown }})
+          (${{ inputs.shard_index }}/${{ inputs.shard_total }})
        run: >
          bin/task test-integration-${{ inputs.task }}
          SHARD_INDEX=${{ inputs.shard_index }}
          SHARD_TOTAL=${{ inputs.shard_total }}
-          TEST_TIMEOUT=20m
-          DISABLE_PUSHDOWN=${{ inputs.disable_pushdown }}
+          TEST_TIMEOUT=${{ inputs.test_timeout }}
+          NO_XFAIL=${{ inputs.no_xfail }}
        env:
-          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
-          FERRETDB_HANA_URL: ${{ secrets.FERRETDB_HANA_URL }}
+          ENVTOOL_DEBUG: ${{ runner.debug == '1' && 'true' || 'false' }}
+
+      - name: Collect logs
+        if: failure()
+        run: |
+          bin/task env-logs-collect
+          cp -v integration/*.json.tmp integration/*.txt.tmp tmp/logs/
+
+      - name: Compress logs before upload
+        if: failure()
+        run: zip -r -q -9 logs.zip tmp/logs
+
+      - name: Upload logs
+        if: failure()
+        uses: actions/upload-artifact@v5
+        with:
+          name: logs-${{ inputs.task }}-${{ inputs.shard_index }}-${{ inputs.shard_total }}
+          path: logs.zip
+          retention-days: 3

-      # The token is not required but should make uploads more stable.
-      # If secrets are unavailable (for example, for a pull request from a fork), it fallbacks to the tokenless uploads.
-      #
-      # Unfortunately, it seems that tokenless uploads fail too often.
-      # See https://github.com/codecov/codecov-action/issues/837.
-      #
-      # We also can't use ${{ vars.CODECOV_TOKEN }}: https://github.com/orgs/community/discussions/44322
      - name: Upload coverage information to codecov
        if: always()
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
        with:
-          token: 3c5cbd1b-5110-4302-ad5a-080390ca731a
          files: ./integration/integration-${{ inputs.task }}.txt
-          flags: integration,${{ inputs.task }}-${{ inputs.shard_index }},filter-${{ !inputs.disable_pushdown }}
+          flags: integration,${{ inputs.task }},${{ inputs.task }}-${{ inputs.shard_index }}
+          disable_file_fixes: true
          fail_ci_if_error: true
          verbose: true

      - name: Upload coverage information to coveralls
-        if: always() && inputs.coveralls
+        if: always()
        uses: coverallsapp/github-action@v2
        with:
          file: ./integration/integration-${{ inputs.task }}.txt
-          flag-name: integration-${{ inputs.task }}-${{ inputs.shard_index }}-filter-${{ !inputs.disable_pushdown }}
+          flag-name: integration-${{ inputs.task }}-${{ inputs.shard_index }}
          parallel: true

+      - name: Convert test results to JUnit XML format
+        if: always() && !inputs.skip_flaky_check
+        run: >
+          ./bin/go-junit-report -parser=gojson
+          -in ./integration/*.json.tmp
+          -out ./integration/${{ inputs.task }}.xml
+
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
+        with:
+          flags: integration,${{ inputs.task }},${{ inputs.task }}-${{ inputs.shard_index }}
+          file: ./integration/${{ inputs.task }}.xml
+
      # we don't want them on CI
      - name: Clean test and fuzz caches
        if: always()
        run: go clean -testcache -fuzzcache

      - name: Check dirty
+        if: always()
        run: |
+          git status --untracked-files --ignored
          git status
          git diff --exit-code
@@ -18,9 +18,12 @@ jobs:
    name: Cleanup
    runs-on: server

+    permissions:
+      contents: read
+
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -63,7 +63,7 @@ env:
 jobs:
  conform-pr:
    name: Conform PR
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 5

    # No `trust` label check because we don't checkout PR's code.
@@ -0,0 +1,95 @@
+---
+name: CTS
+on:
+  pull_request:
+    types:
+      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - main
+      - main-*
+      - releases/*
+
+env:
+  GOPATH: /home/runner/go
+  GOCACHE: /home/runner/go/cache
+  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
+  GOMODCACHE: /home/runner/go/mod
+  GOPROXY: https://proxy.golang.org
+  GOTOOLCHAIN: local
+
+jobs:
+  run:
+    name: Run CTS tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+
+    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    permissions:
+      contents: read
+
+    steps:
+      # TODO https://github.com/FerretDB/github-actions/issues/211
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # for `git describe` to work
+          lfs: false # LFS is used only by website
+
+      - name: Setup Go
+        uses: FerretDB/github-actions/setup-go@main
+        with:
+          cache-key: cts
+
+      - name: Install Task
+        run: go generate -x
+        working-directory: tools
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Start environment
+        run: bin/task env-up-detach
+
+      - name: Run init
+        run: bin/task init
+
+      - name: Build bin/ferretdb
+        run: bin/task build-host
+
+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
+      - name: Start FerretDB (no auth) in the background
+        run: >
+          bin/ferretdb
+          --listen-addr=:27017
+          --proxy-addr=127.0.0.1:37017
+          --no-auth
+          --mode=diff-normal
+          --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
+          2> ferretdb.log &
+
+      - name: Run CTS
+        if: always()
+        run: bin/task cts
+
+      # we don't want them on CI
+      - name: Clean test and fuzz caches
+        if: always()
+        run: go clean -testcache -fuzzcache
+
+      - name: Check dirty
+        if: always()
+        run: |
+          git status --untracked-files --ignored
+          git status
+          git diff --exit-code
@@ -28,22 +28,27 @@ concurrency:
 jobs:
  contexts:
    name: Contexts
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 5

    # comment out to enable this job
    if: false

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website

      - name: Debug git status
-        run: git status
+        run: |
+          git status --untracked-files --ignored
+          git status

      - name: Dump github context
        run: echo "$GITHUB_CONTEXT"
@@ -32,16 +32,20 @@ env:
 jobs:
  build:
    name: Build docs
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
+          fetch-depth: 0 # for `git describe` to work
          lfs: true

      # This step will fail with "Error: Resource not accessible by integration"
@@ -54,6 +58,7 @@ jobs:
          filesizelimit: 102400b
          labelName: use-git-lfs
          exclusionPatterns: |
+            **/*.go
            **/*.js
            **/*.md
            **/go.sum
@@ -70,9 +75,6 @@ jobs:
      - name: Build tools
        run: bin/task env-pull

-      - name: Create directory
-        run: mkdir -p tmp/githubcache
-
      - name: Build docs
        run: bin/task docs
        env:
@@ -88,7 +90,7 @@ jobs:

      # it has to be exactly "docs.tar" for actions/deploy-pages below
      - name: Upload archive artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: docs
          path: tmp/docs.tar
@@ -102,7 +104,7 @@ jobs:

  github:
    name: Deploy to GitHub Pages
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    # exclude pull_request and schedule
@@ -31,15 +31,18 @@ env:
 jobs:
  format:
    name: Format files
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -60,6 +63,8 @@ jobs:
        run: bin/task fmt-yaml

      - name: Check dirty
+        if: always()
        run: |
+          git status --untracked-files --ignored
          git status
          git diff --exit-code
@@ -1,62 +0,0 @@
---
-# Integration tests for extra configuration.
-
-name: Go Extra
-on:
-  schedule:
-    - cron: "12 1 * * *" # after Go workflow to reuse "Setup Go" cache
-
-env:
-  GOPATH: /home/runner/go
-  GOCACHE: /home/runner/go/cache
-  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
-  GOMODCACHE: /home/runner/go/mod
-  GOPROXY: https://proxy.golang.org
-  GOTOOLCHAIN: local
-
-jobs:
-  integration:
-    # job name must be unique; make it unique and nice
-    name: >
-      ${{ matrix.task }} ${{ matrix.postgres_dockerfile }} ${{ matrix.shard_index }}/${{ matrix.shard_total }}
-      (pushdown=${{ matrix.disable_pushdown }})
-
-    # To avoid conflict with go.yml.
-    concurrency:
-      group: ${{ github.workflow }}-integration-${{ matrix.task }}-${{ matrix.postgres_dockerfile }}-${{ matrix.shard_index }}-${{ matrix.disable_pushdown }}-${{ github.head_ref || github.ref_name }}
-      cancel-in-progress: true
-
-    strategy:
-      fail-fast: false
-      matrix:
-        task: [postgresql, sqlite, mysql]
-        shard_index: [1, 2, 3]
-        shard_total: [3]
-        disable_pushdown: [false, true]
-        include:
-          - task: postgresql
-            shard_index: 1
-            shard_total: 3
-            disable_pushdown: false
-            postgres_dockerfile: citus
-          - task: postgresql
-            shard_index: 2
-            shard_total: 3
-            disable_pushdown: false
-            postgres_dockerfile: citus
-          - task: postgresql
-            shard_index: 3
-            shard_total: 3
-            disable_pushdown: false
-            postgres_dockerfile: citus
-
-    # Do not submit to coveralls because it can't handle parallel workflows:
-    # https://github.com/lemurheavy/coveralls-public/issues/1636#issuecomment-1529460515
-    uses: ./.github/workflows/_integration.yml
-    with:
-      task: ${{ matrix.task }}
-      shard_index: ${{ matrix.shard_index }}
-      shard_total: ${{ matrix.shard_total }}
-      disable_pushdown: ${{ matrix.disable_pushdown }}
-      postgres_dockerfile: ${{ matrix.postgres_dockerfile }}
-      coveralls: false
@@ -1,64 +0,0 @@
---
-# Integration tests that need access to secrets.
-
-name: Go Trusted
-on:
-  pull_request_target:
-    types:
-      # not for "labeled" to prevent two builds for "labeled" and "unlabeled" when labels are changed
-      - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild
-      - opened
-      - reopened
-      - synchronize
-  push:
-    branches:
-      - main
-      - main-*
-      - releases/*
-  schedule:
-    - cron: "12 1 * * *" # after Go workflow to reuse "Setup Go" cache
-
-env:
-  GOPATH: /home/runner/go
-  GOCACHE: /home/runner/go/cache
-  GOLANGCI_LINT_CACHE: /home/runner/go/cache/lint
-  GOMODCACHE: /home/runner/go/mod
-  GOPROXY: https://proxy.golang.org
-  GOTOOLCHAIN: local
-
-jobs:
-  integration:
-    # job name must be unique; make it unique and nice
-    name: ${{ matrix.task }} ${{ matrix.shard_index }}/${{ matrix.shard_total }}
-
-    # Do not run this job in parallel for any PR change or branch push
-    # to save some resources.
-    concurrency:
-      group: ${{ github.workflow }}-integration-${{ matrix.task }}-${{ matrix.shard_index }}-${{ github.head_ref || github.ref_name }}
-      cancel-in-progress: true
-
-    if: >
-      github.event_name != 'pull_request_target' ||
-      (
-        contains(github.event.pull_request.labels.*.name, 'trust') &&
-        !contains(github.event.pull_request.labels.*.name, 'not ready')
-      )
-
-    strategy:
-      fail-fast: false
-      matrix:
-        task: [hana]
-        shard_index: [1]
-        shard_total: [1]
-
-    # Do not submit to coveralls because it can't handle parallel workflows:
-    # https://github.com/lemurheavy/coveralls-public/issues/1636#issuecomment-1529460515
-    uses: ./.github/workflows/_integration.yml
-    with:
-      task: ${{ matrix.task }}
-      shard_index: ${{ matrix.shard_index }}
-      shard_total: ${{ matrix.shard_total }}
-      checkout_ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || ''}}
-      coveralls: false
-    secrets:
-      FERRETDB_HANA_URL: ${{ secrets.FERRETDB_HANA_URL }}
@@ -26,7 +26,7 @@ env:
 jobs:
  short-test:
    name: Short test
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 15

    # Do not run this job in parallel for any PR change or branch push.
@@ -36,14 +36,24 @@ jobs:

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website

+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
      - name: Setup Go
        uses: FerretDB/github-actions/setup-go@main
        with:
@@ -68,13 +78,15 @@ jobs:
        run: go clean -testcache -fuzzcache

      - name: Check dirty
+        if: always()
        run: |
+          git status --untracked-files --ignored
          git status
          git diff --exit-code

  test:
    name: Test
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 15

    # Do not run this job in parallel for any PR change or branch push.
@@ -84,14 +96,24 @@ jobs:

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website

+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
      - name: Setup Go
        uses: FerretDB/github-actions/setup-go@main
        with:
@@ -101,58 +123,92 @@ jobs:
        run: go generate -x
        working-directory: tools

+      # install.sh starts ollama service, stop it since we want to run with `bin/task ollama` with environment variables
+      - name: Setup Ollama
+        run: |
+          curl -fsSL https://ollama.com/install.sh | sudo -E sh
+          sudo systemctl stop ollama
+
+      - name: Start Ollama in the background
+        run: |
+          bin/task ollama &
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Start environment
        run: bin/task env-up-detach

+      - name: Pull and load Ollama model
+        run: |
+          bin/task ollama-model
+
      - name: Run init
        run: bin/task init

+      - name: Wait for and setup environment
+        run: bin/task env-setup
+
      - name: Regenerate and reformat
        run: bin/task gen
+        env:
+          # must be a SUPERUSER to ensure parameter_default is set
+          DOCUMENTDB_GEN_URL: postgres://username:password@127.0.0.1:5432/postgres

      - name: Build bin/ferretdb
        run: bin/task build-host

-      - name: Wait for and setup environment
-        run: bin/task env-setup
-
      - name: Run unit tests
        run: bin/task test-unit TEST_TIMEOUT=10m
        env:
          GOFLAGS: ${{ runner.debug == '1' && '-v' || '' }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # for tools

-      # The token is not required but should make uploads more stable.
-      # If secrets are unavailable (for example, for a pull request from a fork), it fallbacks to the tokenless uploads.
-      #
-      # Unfortunately, it seems that tokenless uploads fail too often.
-      # See https://github.com/codecov/codecov-action/issues/837.
-      #
-      # We also can't use ${{ vars.CODECOV_TOKEN }}: https://github.com/orgs/community/discussions/44322
      - name: Upload coverage information to codecov
        if: always()
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
        with:
-          token: 3c5cbd1b-5110-4302-ad5a-080390ca731a
          files: ./cover.txt
          flags: unit
+          disable_file_fixes: true
          fail_ci_if_error: true
          verbose: true

      - name: Upload coverage information to coveralls
+        if: always()
        uses: coverallsapp/github-action@v2
        with:
          file: ./cover.txt
          flag-name: unit
          parallel: true

+      - name: Convert test results to JUnit XML format
+        if: always()
+        run: >
+          ./bin/go-junit-report
+          -in ./unit.txt
+          -out ./unit.xml
+
+      - name: Upload test results to Codecov
+        if: always()
+        uses: codecov/test-results-action@v1
+        with:
+          flags: unit
+          file: ./unit.xml
+
      # we don't want them on CI
      - name: Clean test and fuzz caches
        if: always()
        run: go clean -testcache -fuzzcache

      - name: Check dirty
+        if: always()
        run: |
+          git status --untracked-files --ignored
          git status
          git diff --exit-code

@@ -171,36 +227,59 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        task: [postgresql, sqlite]
+        task: [postgresql, yugabytedb]
        shard_index: [1, 2, 3, 4, 5]
        shard_total: [5]
        include:
          - { task: "mongodb", shard_index: 1, shard_total: 1 }
+          - { task: "yugabytedb", skip_flaky_check: true } # Too many failures for now

    uses: ./.github/workflows/_integration.yml
    with:
      task: ${{ matrix.task }}
      shard_index: ${{ matrix.shard_index }}
      shard_total: ${{ matrix.shard_total }}
-      coveralls: true
+      skip_flaky_check: ${{ matrix.skip_flaky_check || false }}
+
+  integration-no-xfail:
+    name: postgresql no-xfail
+
+    # Do not run this job in parallel for any PR change or branch push
+    # to save some resources.
+    concurrency:
+      group: ${{ github.workflow }}-integration-no-xfail-${{ github.head_ref || github.ref_name }}
+      cancel-in-progress: true
+
+    # disable for now
+    if: false
+    # if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')
+
+    uses: ./.github/workflows/_integration.yml
+    with:
+      task: postgresql
+      shard_index: 1
+      shard_total: 1
+      test_timeout: 5m
+      no_xfail: true

  # https://github.com/lemurheavy/coveralls-public/issues/1636
  submit-coveralls:
    name: Submit final coveralls report
-    runs-on: ubuntu-22.04
-
+    runs-on: ubuntu-24.04
    needs: [test, integration]
+
    if: always() && (github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready'))

    steps:
      - name: Submit coveralls
+        if: always()
        uses: coverallsapp/github-action@v2
        with:
          parallel-finished: true

  env-data:
    name: env-data
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    # Do not run this job in parallel for any PR change or branch push.
@@ -210,10 +289,13 @@ jobs:

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -227,6 +309,13 @@ jobs:
        run: go generate -x
        working-directory: tools

+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Start environment
        run: bin/task env-up-detach

@@ -249,7 +338,7 @@ jobs:

  golangci-lint:
    name: golangci-lint
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    # Do not run this job in parallel for any PR change or branch push.
@@ -259,14 +348,25 @@ jobs:

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+      issues: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `golangci-lint run --new` to work
          lfs: false # LFS is used only by website

+      # for branch.txt on pull_request; the correct branch is already checked out on push / schedule
+      - name: Name branch
+        if: github.event_name == 'pull_request'
+        env:
+          BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+        run: git checkout -b $BRANCH
+
      - name: Setup Go
        uses: FerretDB/github-actions/setup-go@main
        with:
@@ -26,7 +26,7 @@ on:
    tags:
      - "*"
  schedule:
-    - cron: "10 1 * * 1" # after cleanup
+    - cron: "10 1 * * 1" # after cleanup and DocumentDB

 # Do not run this workflow in parallel for any PR change or branch/tag push
 # to prevent concurrent pushes for the same Docker image tag
@@ -64,7 +64,7 @@ jobs:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
        if: github.event_name != 'pull_request_target'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -72,7 +72,7 @@ jobs:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout pull request code
        if: github.event_name == 'pull_request_target'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -136,9 +136,13 @@ jobs:
          username: ferretdbbot
          password: ${{ secrets.QUAY_TOKEN }}

-      - name: Build and push all-in-one Docker images ${{ steps.tag.outputs.all_in_one_images }}
-        if: steps.tag.outputs.all_in_one_images != ''
-        run: bin/task docker-all-in-one-push DOCKER_IMAGES=${{ steps.tag.outputs.all_in_one_images }}
+      - name: Build and push evaluation development Docker images ${{ steps.tag.outputs.eval_dev_images }}
+        if: steps.tag.outputs.eval_dev_images != ''
+        run: bin/task docker-eval-dev-push DOCKER_IMAGES=${{ steps.tag.outputs.eval_dev_images }}
+
+      - name: Build and push evaluation Docker images ${{ steps.tag.outputs.eval_images }}
+        if: steps.tag.outputs.eval_images != ''
+        run: bin/task docker-eval-push DOCKER_IMAGES=${{ steps.tag.outputs.eval_images }}

      - name: Build and push development Docker images ${{ steps.tag.outputs.development_images }}
        if: steps.tag.outputs.development_images != ''
@@ -152,7 +156,7 @@ jobs:
        run: bin/task build-development

      - name: Upload development binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: bin-dev
          path: tmp/bin-dev/
@@ -163,7 +167,7 @@ jobs:
        run: bin/task build-production

      - name: Upload production binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: bin
          path: tmp/bin/
@@ -174,7 +178,7 @@ jobs:
        run: bin/task packages

      - name: Upload .deb packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: debs
          path: tmp/debs/
@@ -182,7 +186,7 @@ jobs:
          if-no-files-found: error

      - name: Upload .rpm packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: rpms
          path: tmp/rpms/
@@ -190,6 +194,8 @@ jobs:
          if-no-files-found: error

      - name: Check dirty
+        if: always()
        run: |
+          git status --untracked-files --ignored
          git status
          git diff --exit-code
@@ -31,15 +31,18 @@ env:
 jobs:
  security-scan:
    name: Security scan
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -1,5 +1,5 @@
 ---
-name: JS
+name: Test scripts
 on:
  pull_request:
    types:
@@ -9,6 +9,7 @@ on:
      - synchronize
    paths:
      - build/legacy-mongo-shell/*.js
+      - build/testscripts/*.sql
  push:
    branches:
      - main
@@ -31,17 +32,20 @@ env:
  GOTOOLCHAIN: local

 jobs:
-  testjs:
-    name: Test script
-    runs-on: ubuntu-22.04
+  run:
+    name: Run test scripts
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready')

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for `git describe` to work
          lfs: false # LFS is used only by website
@@ -49,12 +53,19 @@ jobs:
      - name: Setup Go
        uses: FerretDB/github-actions/setup-go@main
        with:
-          cache-key: testjs
+          cache-key: testscripts

      - name: Install Task
        run: go generate -x
        working-directory: tools

+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Start environment
        run: bin/task env-up-detach

@@ -67,20 +78,26 @@ jobs:
      - name: Wait for and setup environment
        run: bin/task env-setup

-      - name: Start FerretDB in the background
+      - name: Start FerretDB (no auth) in the background
        run: >
          bin/ferretdb
          --listen-addr=:27017
-          --proxy-addr=127.0.0.1:47017
+          --proxy-addr=127.0.0.1:37017
+          --no-auth
          --mode=diff-normal
-          --handler=pg
-          --postgresql-url='postgres://username@127.0.0.1:5432/ferretdb'
+          --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
          2> ferretdb.log &

-      - name: Run testjs for MongoDB
-        run: bin/task testjs TESTJS_PORT=47017
+      - name: Run testsql for PostgreSQL
+        if: always()
+        run: bin/task testsql

-      - name: Run testjs for FerretDB
+      - name: Run testjs for MongoDB (no auth)
+        if: always()
+        run: bin/task testjs TESTJS_PORT=37017
+
+      - name: Run testjs for FerretDB (no auth)
+        if: always()
        run: bin/task testjs

      - name: Compress FerretDB log before upload
@@ -89,7 +106,7 @@ jobs:

      - name: Upload FerretDB log
        if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: ferretdb-log
          path: ferretdb-log.zip
@@ -99,6 +116,7 @@ jobs:
      - name: Show FerretDB log
        if: always()
        run: |
+          echo "::remove-matcher owner=go::"
          cat ferretdb.log
          rm ferretdb.log

@@ -108,6 +126,8 @@ jobs:
        run: go clean -testcache -fuzzcache

      - name: Check dirty
+        if: always()
        run: |
+          git status --untracked-files --ignored
          git status
          git diff --exit-code
@@ -26,7 +26,7 @@ env:
 jobs:
  blog-preview:
    name: Preview blog
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    if: >
@@ -39,10 +39,13 @@ jobs:
      name: cloudflare-dev-blog
      url: ${{ steps.extract.outputs.extracted_url }}

+    permissions:
+      contents: read
+
    steps:
      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for wrangler to work
          lfs: true
@@ -68,9 +71,6 @@ jobs:
      - name: Build tools
        run: bin/task env-pull

-      - name: Create directory
-        run: mkdir -p tmp/githubcache
-
      - name: Build blog
        run: bin/task blog
        env:
@@ -93,7 +93,7 @@ jobs:

  docs-preview:
    name: Preview docs
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    if: >
@@ -105,6 +105,9 @@ jobs:
      name: cloudflare-dev-docs
      url: ${{ steps.extract.outputs.extracted_url }}

+    permissions:
+      contents: read
+
    steps:
      # We can't easily download build results from the Docs workflow:
      # https://github.com/actions/download-artifact/issues/172
@@ -113,7 +116,7 @@ jobs:

      # TODO https://github.com/FerretDB/github-actions/issues/211
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0 # for wrangler to work
          lfs: true
@@ -1,14 +1,19 @@
-# Please use global .gitignore file for .vscode/, .idea/, go.work, .envrc, etc.
+# This file is used only for repository-specific patterns.
+# Please use global .gitignore file for .DS_Store, .idea/, go.work, .envrc, etc.
 # See https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files#configuring-ignored-files-for-all-repositories-on-your-computer

-docker-compose.override.yml
-
 state.json
+telemetry.json
+
+*.bc
+*.o
+*.so

 *.out
-*.sqlite*
+*.tmp
 *.txt
 !website/static/*.txt
+*.xml

 .task/
 bin/
@@ -0,0 +1,4 @@
+[submodule "documentdb"]
+	path = build/postgres-documentdb/documentdb
+	url = https://github.com/FerretDB/documentdb.git
+	branch = ferretdb
@@ -5,6 +5,7 @@
 run:
  timeout: 3m

+# bin/golangci-lint linters -c .golangci-new.yml
 linters-settings:
  asasalint:
    exclude:
@@ -18,8 +19,7 @@ linters-settings:
    check-blank: false
    disable-default-exclusions: false
    exclude-functions:
-      - (*database/sql.Rows).Close
-      - (*github.com/FerretDB/FerretDB/internal/util/fsql.Rows).Close
+      - (*github.com/jackc/pgx/v5.Conn).Close
  errorlint:
    # see caveats at https://github.com/polyfloyd/go-errorlint#fmterrorf-wrapping-verb
    errorf: false
@@ -41,14 +41,6 @@ linters-settings:
      - name: package-comments
  staticcheck:
    checks: ["all"]
-  tagalign:
-    sort: true
-    order:
-      - name
-      - cmd
-      - arg
-      - default
-      - help
  wsl:
    # https://github.com/bombsimon/wsl/blob/master/doc/configuration.md
    strict-append: false
@@ -70,6 +62,7 @@ linters:
    - asciicheck
    - depguard
    - exhaustive
+    - exhaustruct
    - forbidigo
    - gci
    - gochecksumtype
@@ -86,6 +79,8 @@ linters:
    - misspell
    - nolintlint
    - sloglint
+    - tagalign
+    - unparam
    - unused
    - whitespace

@@ -104,8 +99,6 @@ linters:
    - err113
    - errchkjson
    - errname
-    - exhaustruct
-    - exportloopref
    - fatcontext
    - forcetypeassert
    - funlen
@@ -123,6 +116,7 @@ linters:
    - gosec
    - gosmopolitan
    - grouper
+    - iface
    - inamedparam
    - interfacebloat
    - intrange
@@ -147,6 +141,7 @@ linters:
    - promlinter
    - protogetter
    - reassign
+    - recvcheck
    - rowserrcheck
    - sloglint
    - spancheck
@@ -160,7 +155,6 @@ linters:
    - tparallel
    - typecheck
    - unconvert
-    - unparam
    - usestdlibvars
    - varnamelen
    - wastedassign
@@ -16,8 +16,9 @@ linters-settings:
            desc: use `context` package instead
          - pkg: golang.org/x/exp/slices
            desc: use `slices` package instead
-          - pkg: maps
-            desc: use `golang.org/x/exp/maps` package instead
+          - pkg: golang.org/x/exp/maps
+            desc: use `maps` package instead
+
          - pkg: github.com/jackc/pgconn
            desc: use `github.com/jackc/pgx/v5/pgconn` package instead
          - pkg: github.com/jackc/pgproto3
@@ -29,87 +30,91 @@ linters-settings:
          - pkg: github.com/jackc/pgx/v4
            desc: use `github.com/jackc/pgx/v5` package instead

+          # TODO https://github.com/FerretDB/FerretDB/issues/4798
+          # - pkg: go.mongodb.org/mongo-driver/bson
+          #   desc: use `go.mongodb.org/mongo-driver/v2/bson` package instead
+          # - pkg: go.mongodb.org/mongo-driver/mongo
+          #   desc: use `go.mongodb.org/mongo-driver/v2/mongo` package instead
+
+          # - pkg: github.com/xdg-go/scram
+          #   desc: use `github.com/FerretDB/FerretDB/v2/internal/util/scram` package instead
      ferretdb-in-tools:
        files:
          - "**/tools/**/*.go"
        deny:
-          - pkg: github.com/FerretDB/FerretDB/internal/
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/
            desc: tools should not import FerretDB code
-
-      types:
-        files:
-          - "**/internal/util/logging/*.go"
-        deny:
-          - pkg: github.com/FerretDB/FerretDB/internal/types
-      sjson:
-        files:
-          - $all
-          - "!**/internal/backends/sqlite/*.go"
-          - "!**/internal/backends/postgresql/*.go"
-          - "!**/internal/backends/postgresql/metadata/*.go"
-          - "!**/internal/backends/mysql/*.go"
-          - "!**/internal/backends/mysql/metadata/*.go"
-          - "!**/internal/backends/hana/*.go"
-        deny:
-          - pkg: github.com/FerretDB/FerretDB/internal/handler/sjson
-      common:
-        files:
-          - "**/internal/backends/**.go"
-          - "**/internal/clientconn/cursor/*.go"
-        deny:
-          - pkg: github.com/FerretDB/FerretDB/internal/handler/common
-      handlererrors:
+      wirebson:
        files:
          - $all
+          - "!**/cmd/envtool/*.go"
          - "!**/internal/clientconn/*.go"
+          - "!**/internal/dataapi/server/*.go"
+          - "!**/internal/documentdb/**.go"
+          - "!**/internal/driver/*.go"
          - "!**/internal/handler/**.go"
+          - "!**/internal/mcp/*.go"
+          - "!**/internal/mongoerrors/*.go"
+          - "!**/internal/util/logging/*.go"
+          - "!**/internal/util/scram/*.go"
+          - "!**/internal/util/testutil/*.go"
        deny:
-          - pkg: github.com/FerretDB/FerretDB/internal/handler/handlererrors
-      backends:
+          - pkg: github.com/FerretDB/wire/wirebson
+      documentdb:
        files:
-          - "**/internal/clientconn/cursor/*.go"
+          - "**/internal/documentdb/genwrap/*.go"
        deny:
-          - pkg: github.com/FerretDB/FerretDB/internal/backends
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/documentdb
+      cursor:
+        files:
+          - $all
+          - "!**/internal/documentdb/**.go"
+        deny:
+          - pkg: github.com/FerretDB/FerretDB/v2/internal/documentdb/cursor
  exhaustive:
    default-signifies-exhaustive: false
+  exhaustruct:
+    include:
+      - TODO
  forbidigo:
    forbid:
      - p: ^\Qpgxpool.Pool.AcquireFunc\E$
        pkg: ^\Qgithub.com/jackc/pgx/v5/pgxpool\E$
        msg: Use `Acquire` with `defer Release()` instead.

-      # integration tests use a different configuration file
+      # TODO https://github.com/FerretDB/FerretDB/issues/4798
      - p: ^\Qbson.E\E$
        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
-        msg: Use `*types.Document` or `*types.Array` instead.
-      - p: ^\Qprimitive.E\E$
-        pkg: ^\Qgo.mongodb.org/mongo-driver/bson/primitive\E$
-        msg: Use `*types.Document` or `*types.Array` instead.
+        msg: Use `*wirebson.Document` or `*wirebson.Array` instead.
      - p: ^\Qbson.D\E$
        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
-        msg: Use `*types.Document` instead.
-      - p: ^\Qprimitive.D\E$
-        pkg: ^\Qgo.mongodb.org/mongo-driver/bson/primitive\E$
-        msg: Use `*types.Document` instead.
+        msg: Use `*wirebson.Document` instead.
      - p: ^\Qbson.M\E$
        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
-        msg: Use `*types.Document` instead.
-      - p: ^\Qprimitive.M\E$
-        pkg: ^\Qgo.mongodb.org/mongo-driver/bson/primitive\E$
-        msg: Use `*types.Document` instead.
+        msg: Use `*wirebson.Document` instead.
      - p: ^\Qbson.A\E$
        pkg: ^\Qgo.mongodb.org/mongo-driver/bson\E$
-        msg: Use `*types.Array` instead.
-      - p: ^\Qprimitive.A\E$
-        pkg: ^\Qgo.mongodb.org/mongo-driver/bson/primitive\E$
-        msg: Use `*types.Array` instead.
+        msg: Use `*wirebson.Array` instead.
+
+      - p: ^\Qbson.E\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` or `*wirebson.Array` instead.
+      - p: ^\Qbson.D\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.M\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Document` instead.
+      - p: ^\Qbson.A\E$
+        pkg: ^\Qgo.mongodb.org/mongo-driver/v2/bson\E$
+        msg: Use `*wirebson.Array` instead.
    exclude-godoc-examples: true
    analyze-types: true
  gci:
    sections:
      - standard
      - default
-      - prefix(github.com/FerretDB/FerretDB)
+      - prefix(github.com/FerretDB/FerretDB/v2/)
  goconst:
    min-occurrences: 5
    ignore-tests: true
@@ -123,6 +128,8 @@ linters-settings:
      - BUG
      - FIXME
      - HACK
+      - lala
+      - lalala
  goheader:
    # Please do not update it, including bumping a year.
    template: |-
@@ -140,10 +147,12 @@ linters-settings:
      See the License for the specific language governing permissions and
      limitations under the License.
  goimports:
-    local-prefixes: github.com/FerretDB/FerretDB
+    local-prefixes: github.com/FerretDB/FerretDB/v2
  gomodguard:
    blocked:
-      modules: []
+      modules:
+        - github.com/FerretDB/FerretDB:
+            reason: "Use `github.com/FerretDB/FerretDB/v2/...` instead."
  gosimple:
    checks: ["all"]
  govet:
@@ -153,15 +162,14 @@ linters-settings:
      - nilness
      - shadow
  importas:
-    no-unaliased: false
-    no-extra-aliases: true
+    # https://github.com/julz/importas/issues/15
+    no-unaliased: true
+    no-extra-aliases: false
    alias:
+      - pkg: runtime/debug
+        alias: runtimedebug
      - pkg: github.com/prometheus/client_model/go
        alias: dto
-      - pkg: modernc.org/sqlite
-        alias: sqlite3
-      - pkg: modernc.org/sqlite/lib
-        alias: sqlite3lib
      - pkg: go.opentelemetry.io/otel/attribute
        alias: otelattribute
      - pkg: go.opentelemetry.io/otel/codes
@@ -172,10 +180,8 @@ linters-settings:
        alias: otelsdkresource
      - pkg: go.opentelemetry.io/otel/sdk/trace
        alias: otelsdktrace
-      - pkg: go.opentelemetry.io/otel/semconv/v1.21.0
+      - pkg: go.opentelemetry.io/otel/semconv/v1.34.0
        alias: otelsemconv
-      - pkg: github.com/FerretDB/FerretDB/internal/backends/mysql/metadata/pool
-        alias: mysqlpool
  # ineffassign
  lll:
    line-length: 130
@@ -211,7 +217,23 @@ linters-settings:
    checks:
      - all
      - -SA1019 # ignore deprecation errors in existing code; new code is checked by the other configuration
-  # unused
+  tagalign:
+    sort: true
+    order:
+      - name
+      - cmd
+      - arg
+      - default
+      - help
+  unparam:
+    check-exported: false
+  unused:
+    field-writes-are-uses: false
+    post-statements-are-reads: false
+    exported-fields-are-used: false
+    parameters-are-used: true # it should be false, TODO https://github.com/FerretDB/FerretDB-DocumentDB/issues/823
+    local-variables-are-used: false
+    generated-is-used: false
  whitespace:
    multi-if: false
    multi-func: false
@@ -222,6 +244,7 @@ linters:
    - asciicheck
    - depguard
    - exhaustive
+    - exhaustruct
    - forbidigo
    - gci
    - gochecksumtype
@@ -241,6 +264,8 @@ linters:
    - revive
    - sloglint
    - staticcheck
+    - tagalign
+    - unparam
    - unused
    - whitespace

@@ -253,3 +278,7 @@ issues:
    # we don't want to introduce that constant
    - linters: [goconst]
      text: "^string `_id` has \\d+ occurrences, make it a constant"
+
+    - linters: [forbidigo]
+      path: "\\Qferretdb/ferretdb_test.go"
+      text: "\\Quse of `bson.D` forbidden"
@@ -1,3 +1,6 @@
 # We can't have it in build/.prettierignore due to https://github.com/prettier/prettier/issues/15428
 # Textlint uses the same format, so we re-use the file.
+build/postgres-documentdb/documentdb/**
+internal/dataapi/api/openapi.json
+internal/dataapi/api/openapi-original.json
 website/static/codapi/snippet.js
@@ -30,7 +30,7 @@ On macOS and Windows, [Docker Desktop](https://www.docker.com/products/docker-de
 On Windows, it should be [configured to use WSL 2](https://docs.docker.com/desktop/windows/wsl/) without any distro;
 all commands should be run on the host.

-You will need Go 1.22 or later on the host.
+You will need Go 1.25 or later on the host.
 If your package manager doesn't provide it yet,
 please install it from [go.dev](https://go.dev/dl/).

@@ -106,8 +106,6 @@ To help us accurately identify the cause, we encourage you to include a pull req
 Please write the test script in [build/legacy-mongo-shell/test.js](build/legacy-mongo-shell/test.js).
 You can find an overview of the available assertions [here](build/legacy-mongo-shell/README.md).
 Use these assertions to validate your test's assumptions and invariants.
-You can also find an example of how to prepare a test script in
-[build/legacy-mongo-shell/test.example.js](build/legacy-mongo-shell/test.example.js).

 With `task` installed (see above), you may test your script using following steps:

@@ -125,12 +123,20 @@ With `task` installed (see above), you may do the following:

 1. Start the development environment with `task env-up`.
 2. Run all tests with `task test` (see [below](#running-tests)).
-3. Start FerretDB with `task run`, `task run-sqlite` or `task run-proxy`.
-   (See [Operation modes](https://docs.ferretdb.io/v1.24/configuration/operation-modes/) page in our documentation.)
+3. Start FerretDB with `task run`.
+   The development environment uses `diff-normal` mode as the default mode.
+   Set preferred mode such as `task run MODE=diff-proxy`.
+   (See [Operation modes](https://docs.ferretdb.io/configuration/operation-modes/) page in our documentation.)
 4. Fill collections in the `test` database with data for experiments with `task env-data`.
 5. Run `mongosh` with `task mongosh`.
   See what collections were created by the previous command with `show collections`.

+#### Commands for authenticated connection
+
+1. Start the development environment with `task env-up`.
+2. Start FerretDB with `task run-secure MODE=normal` or `task run-secure MODE=proxy`.
+3. Run `task mongosh-secure` to establish an authenticated connection.
+
 ### Code overview

 The directory `cmd` provides commands implementation.
@@ -141,19 +147,19 @@ They are installed into `bin/` by `cd tools; go generate -x`.

 The `internal` subpackages contain most of the FerretDB code:

- `types` package provides Go types matching BSON types that don't have built-in Go equivalents:
-  we use `int32` for BSON's int32, but `types.ObjectID` for BSON's ObjectId.
- `bson` package provides converters from/to BSON for built-in and `types` types.
- `wire` package provides wire protocol implementation.
- `clientconn` package provides client connection implementation.
-  It accepts client connections, reads `wire`/`bson` protocol messages, and passes them to `handler`.
-  Responses are then converted to `wire`/`bson` messages and sent back to the client.
- `handler` contains implementations of command handlers.
-  They use `types` and `wire` packages, but `bson` package details are hidden.
- `handler/sjson` provides converters from/to SJSON for built-in and `types` types.
-  SJSON adds some extensions to JSON for keeping object keys in order,
-  preserving BSON type information in the values themselves, etc.
-  It is used by some backends.
+- `handler` provides implementations of command handlers.
+  The logic of commands like `find` and `aggregate` is there.
+- `dataapi` provides an Data API wrapper for `handler`.
+  It allows FerretDB to be used over HTTP instead of MongoDB wire protocol.
+- `clientconn` provides wire protocol server implementation.
+  It accepts client connections, reads wire protocol messages, and passes them to `handler`.
+  Responses are then converted and sent back to the client.
+- `documentdb` provides DocumentDB extension integration.
+- `mongoerrors` provides MongoDB-compatible error types and codes.
+  They are used by `handler` and `documentdb`.
+
+The wire protocol implementation and BSON handling code were extracted into a separate repository:
+https://github.com/FerretDB/wire

 #### Running tests

@@ -169,13 +175,13 @@ They use the Go MongoDB driver like a regular user application.
 They could test any MongoDB-compatible database (such as FerretDB or MongoDB itself) via a regular TCP or TLS port
 or Unix domain socket.
 They also could test in-process FerretDB instances
-(meaning that integration tests start and stop them themselves) with a given backend.
+(meaning that integration tests start and stop them themselves).
 Finally, some integration tests (so-called compatibility or "compat" tests) connect to two systems
 ("target" for FerretDB and "compat" for MongoDB) at the same time,
 send the same queries to both, and compare results.
 You can run them with:

- `task test-integration-postgresql` for in-process FerretDB with PostgreSQL backend and MongoDB;
+- `task test-integration-postgresql` for in-process FerretDB and MongoDB;
 - `task test-integration-mongodb` for MongoDB only, skipping compat tests;
 - or `task test-integration` to run all in parallel.

@@ -185,7 +191,7 @@ If tests fail and the output is too confusing, try running them sequentially by
 You can also run `task -C 1` to limit the number of concurrent tasks, which is useful for debugging.

 To run a subset of integration tests and test cases, you may use Task variable `TEST_RUN`.
-For example, to run all tests related to the `getMore` command implementation for in-process FerretDB with PostgreSQL backend
+For example, to run all tests for the `getMore` command with in-process FerretDB
 you may use `task test-integration-postgresql TEST_RUN='(?i)GetMore'`.

 Finally, since all tests just run `go test` with various arguments and flags under the hood
@@ -194,12 +200,10 @@ you may also use all standard `go` tool facilities,
 including [`GOFLAGS` environment variable](https://pkg.go.dev/cmd/go#hdr-Environment_variables).
 For example:

- to run all tests related to the `getMore` command implementation in-process FerretDB with PostgreSQL backend
-  with all subtests running sequentially,
-  you may use `env GOFLAGS='-parallel=1' task test-integration-postgresql TEST_RUN='(?i)GetMore'`;
- to run all tests for in-process FerretDB with SQLite backend
-  with [Go execution tracer](https://pkg.go.dev/runtime/trace) enabled,
-  you may use `env GOFLAGS='-trace=trace.out' task test-integration-sqlite`.
+- to run all tests for the `getMore` command sequentially,
+  you may use `env GOFLAGS='-parallel=1 -p=1' task test-integration-postgresql TEST_RUN='(?i)GetMore'`;
+- to run all tests with MongoDB with [Go execution tracer](https://pkg.go.dev/runtime/trace) enabled
+  you may use `env GOFLAGS='-trace=trace.out' task test-integration-mongodb`.

 <!-- textlint-disable one-sentence-per-line -->

@@ -239,10 +243,10 @@ and some other pages such as [Spelling](https://go.dev/wiki/Spelling).
 Some of our idiosyncrasies are documented below.

 1. We use type switches over BSON types in many places in our code.
-   The order of `case`s follows this order: https://pkg.go.dev/github.com/FerretDB/FerretDB/internal/types#hdr-Mapping
+   The order of `case`s follows this order: https://pkg.go.dev/github.com/FerretDB/wire/wirebson#hdr-Types
   It may seem random, but it is only pseudo-random and follows BSON spec: https://bsonspec.org/spec.html
 2. We generally pass and return `struct`s by pointers.
-   There are some exceptions like `types.Path` that have value semantics, but when in doubt – use pointers.
+   There are some exceptions like `time.Time` that have value semantics, but when in doubt – use pointers.

 #### Comments conventions

@@ -271,21 +275,23 @@ Some of our idiosyncrasies are documented below.

 #### Integration tests conventions

-We prefer our integration tests to be straightforward,
-branchless (with a few, if any, `if` and `switch` statements),
-and backend-independent.
-Ideally, the same test should work for both FerretDB with all backends and MongoDB.
+We prefer our integration tests to be straightforward and
+branchless (with a few, if any, `if` and `switch` statements).
+Ideally, the same test should work for both FerretDB and MongoDB.
 If that's impossible without some branching, use helpers exported from the `setup` package,
 such us `FailsForFerretDB`, `SkipForMongoDB`, etc.
+Please use expected failure rather than skipping the test, whenever it's possible.
+It makes tracking development progress much easier.
+
 The bar for using other ways of branching, such as checking error codes and messages, is very high.
 Writing separate tests might be much better than making a single test that checks error text.

 Also, we should use driver methods as much as possible instead of testing commands directly via `RunCommand`.

-We have a lot of existing helpers to convert the driver's `bson.D` values to our `*types.Document` values,
-to compare them, etc.
-In most cases, they should be used instead of (deprecated) `bson.D.Map()`,
-`bson.Unmarshal`, decoding into a struct with `bson` tags, comparing fields one-by-one, etc.
+In most cases, helpers such as `AssertEqualDocuments` are used to compare `bson.D` documents.
+The differences in field order, types, missing fields and others should be reported.
+If differences are expected such as `version` field, only the field key can be used for `bson.D` document comparison.
+Use of (deprecated) `bson.D.Map()` or converting `bson.D` to other types using helpers should be avoided when possible.
 The bar for adding new helpers is very high.
 Please check all existing ones.

@@ -297,30 +303,42 @@ For example:
 const doubleMaxPrec = float64(1<<53 - 1) // 9007199254740991.0:    largest double values that could be represented as integer exactly
 ```

+Avoid writing tests that cannot run in parallel with other tests.
+The `integration` directory contains multiple test packages,
+and tests from other packages may run at the same time.
+Such test becomes flaky and hard to maintain.
+
 #### Integration tests naming guidelines

 <!-- https://github.com/FerretDB/FerretDB/issues/694 -->

-1. Test names should include the name of the command being tested.
-   For instance, `TestDistinct` for testing the distinct command.
+Use `Test<Command><Operator><Scenario>` format for test names, omitting `<Operator>` and `<Scenario>` if unnecessary.
+
+1. Include the name of the command (and the operator if any).
+   For example, `TestDistinct` for testing the distinct command.
 2. Compatibility tests should have `Compat` in the name, following the command.
   For example, `TestDistinctCompat`.
-3. If the test doesn't use driver method but runs a command directly via `RunCommand`,
-   the suffix `Command` should be added.
+3. If the test runs a command directly via `RunCommand`, add the suffix `Command`.
   For example, `TestDistinctCommand`.
-4. If the test is both compat and runs a command, the suffix `CommandCompat` should be added.
+4. If the test is both compat and runs a command, add the suffix `CommandCompat`.
   For example, `TestInsertCommandCompat`.
 5. If the file consists of compatibility tests, add the `_compat` suffix.
   For example, `distinct_compat_test.go`.
-6. Test names should be descriptive and provide information about the functionality or condition being tested.
-   If the test is checking for a specific error scenario, include the error scenario in the name.
+6. Use descriptive test names to include the condition or the specific error being tested.
+   For example, `TestAggregateCompatSortDotNotation` for compatibility tests
+   on `aggregate` command `$sort` operator on a document field.
 7. Keep test names concise, avoiding overly cryptic names.
   Use abbreviations when appropriate.
 8. Avoid including test data in the name to maintain clarity and prevent excessively long names.
-9. Test case names should follow `TitleCase` capitalization style.
+9. Use `TitleCase` capitalization style for test case names.
   No spaces, dashes or underscores should be used neither for test names nor for test case names.
-10. Keep the concatenation of test name segments (test, subtests) within 64 characters
+10. Use [BSON notation](https://bsonspec.org/spec.html) vocabulary.
+    For example, use `Double` and not `float64`.
+11. Keep the concatenation of test name segments (test, subtests) within 64 characters
    to satisfy the maximum limit for database names.
+12. Use a package for tests in the same scope.
+    Separating into packages can reduce binary sizes and may enhance performance.
+    For example, use `users` package for user management test files.

 ### Submitting code changes

@@ -389,4 +407,4 @@ Before submitting a pull request, please make sure that:
   created from the [current state](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork)
   of our main branch.
 2. Documentation is formatted, linted, and built with `task docs`.
-3. Documentation is written according to our [writing guide](https://docs.ferretdb.io/v1.24/contributing/writing-guide/).
+3. Documentation is written according to our [writing guide](https://docs.ferretdb.io/contributing/writing-guide/).
@@ -1,2 +0,0 @@
-FerretDB database system (https://www.ferretdb.com/).
-Copyright 2021 FerretDB Inc.
@@ -1,28 +1,34 @@
 # FerretDB

-[![Go Reference](https://pkg.go.dev/badge/github.com/FerretDB/FerretDB/ferretdb.svg)](https://pkg.go.dev/github.com/FerretDB/FerretDB/ferretdb)
+<!-- textlint-disable one-sentence-per-line -->
+
+> [!TIP]
+> Looking for FerretDB v1?
+> It is [there](https://github.com/FerretDB/FerretDB/tree/main-v1).
+
+<!-- textlint-enable one-sentence-per-line -->
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/FerretDB/FerretDB/v2/ferretdb.svg)](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb)

 [![Go](https://github.com/FerretDB/FerretDB/actions/workflows/go.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/go.yml)
-[![codecov](https://codecov.io/gh/FerretDB/FerretDB/branch/main-v1/graph/badge.svg?token=JZ56XFT3DM)](https://codecov.io/gh/FerretDB/FerretDB)
+[![codecov](https://codecov.io/gh/FerretDB/FerretDB/branch/main/graph/badge.svg?token=JZ56XFT3DM)](https://codecov.io/gh/FerretDB/FerretDB)

 [![Security](https://github.com/FerretDB/FerretDB/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/security.yml)
 [![Packages](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/packages.yml)
 [![Docs](https://github.com/FerretDB/FerretDB/actions/workflows/docs.yml/badge.svg?branch=main)](https://github.com/FerretDB/FerretDB/actions/workflows/docs.yml)

-FerretDB was founded to become the de-facto open-source substitute to MongoDB.
-FerretDB is an open-source proxy, converting the MongoDB 5.0+ wire protocol queries to SQL -
-using PostgreSQL or SQLite as a database engine.
+FerretDB is an open-source alternative to MongoDB.
+It is a proxy that converts MongoDB 5.0+ wire protocol queries to SQL
+and uses PostgreSQL with [DocumentDB extension](https://github.com/documentdb/documentdb) as a database engine.

 ```mermaid
 flowchart LR
  A["Any application<br>Any MongoDB driver"]
  F{{FerretDB}}
-  P[(PostgreSQL)]
-  S[("SQLite")]
+  P[(PostgreSQL<br>DocumentDB extension)]

  A -- "MongoDB protocol<br>BSON" --> F
  F -- "PostgreSQL protocol<br>SQL" --> P
-  F -. "SQLite library<br>SQL" .-> S
 ```

 ## Why do we need FerretDB?
@@ -31,7 +37,7 @@ MongoDB was originally an eye-opening technology for many of us developers,
 empowering us to build applications faster than using relational databases.
 In its early days, its ease-to-use and well-documented drivers made MongoDB one of the simplest database solutions available.
 However, as time passed, MongoDB abandoned its open-source roots;
-changing the license to [SSPL](https://www.mongodb.com/licensing/server-side-public-license) - making it unusable for many open source and early-stage commercial projects.
+changing the license to [SSPL](https://www.ferretdb.com/sspl) - making it unusable for many open-source and early-stage commercial projects.

 Most MongoDB users do not require any advanced features offered by MongoDB;
 however, they need an easy-to-use open-source document database solution.
@@ -45,84 +51,70 @@ Features are constantly being added to further increase compatibility and perfor

 We welcome all contributors.
 See our [public roadmap](https://github.com/orgs/FerretDB/projects/2/views/1),
-a list of [known differences with MongoDB](https://docs.ferretdb.io/v1.24/diff/),
+lists of [known differences and supported commands](https://docs.ferretdb.io/migration/compatibility/),
 and [contributing guidelines](CONTRIBUTING.md).

 ## Quickstart

-Run this command to start FerretDB with PostgreSQL backend:
+Run this command to start FerretDB with PostgreSQL, make sure to update `<username>` and `<password>`:

 ```sh
-docker run -d --rm --name ferretdb -p 27017:27017 ghcr.io/ferretdb/all-in-one
+docker run -d --rm --name ferretdb -p 27017:27017 \
+  -e POSTGRES_USER=<username> \
+  -e POSTGRES_PASSWORD=<password> \
+  ghcr.io/ferretdb/ferretdb-eval:2
 ```

-Alternatively, run this command to start FerretDB with SQLite backend:
-
-```sh
-docker run -d --rm --name ferretdb -p 27017:27017 -e FERRETDB_HANDLER=sqlite ghcr.io/ferretdb/all-in-one
-```
-
-This command will start a container with FerretDB, PostgreSQL/SQLite, and MongoDB Shell for quick testing and experiments.
+This command will start a container with FerretDB, pre-packaged PostgreSQL with DocumentDB extension, and MongoDB Shell for quick testing and experiments.
 However, it is unsuitable for production use cases because it keeps all data inside and loses it on shutdown.
-See our [Docker quickstart guide](https://docs.ferretdb.io/v1.24/quickstart-guide/docker/) for instructions
+See our [installation guides](https://docs.ferretdb.io/installation/) for instructions
 that don't have those problems.

 With that container running, you can:

- Connect to it with any MongoDB client application using MongoDB URI `mongodb://127.0.0.1:27017/`.
- Connect to it using MongoDB Shell by just running `mongosh`.
+- Connect to it with any MongoDB client application using the MongoDB URI `mongodb://<username>:<password>@127.0.0.1:27017/`.
+- Connect to it using the MongoDB Shell by just running `mongosh`.
  If you don't have it installed locally, you can run `docker exec -it ferretdb mongosh`.
- For the PostgreSQL backend, connect to it by running `docker exec -it ferretdb psql -U username ferretdb`.
-  FerretDB uses PostgreSQL schemas for MongoDB databases.
-  So, if you created some collections in the `test` database using any MongoDB client,
-  you can switch to it by running `SET search_path = 'test';` query
-  and see a list of PostgreSQL tables by running `\d` `psql` command.
- For the SQLite backend, connect to it by running `docker exec -it ferretdb sqlite3 /state/<database>.sqlite`.
-  So, if you created some collections in the `test` database using any MongoDB client,
-  run `docker exec -it ferretdb sqlite3 /state/test.sqlite`
-  and see a list of SQLite tables by running `.tables` command.
+- For PostgreSQL, connect to it by running `docker exec -it ferretdb psql -U <username> postgres`.

 You can stop the container with `docker stop ferretdb`.

-We also provide binaries and packages for various Linux distributions,
-as well as [Go library package](https://pkg.go.dev/github.com/FerretDB/FerretDB/ferretdb) that embeds FerretDB into your application.
-See [our documentation](https://docs.ferretdb.io/v1.24/quickstart-guide/) for more details.
+We also provide binaries and packages for various Linux distributions.
+as well as [Go library package](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/ferretdb)
+that embeds FerretDB into your application.
+See [our documentation](https://docs.ferretdb.io/installation/) for more details.

 ## Building and packaging

 <!-- textlint-disable one-sentence-per-line -->

 > [!NOTE]
-> We strongly advise users not to build FerretDB themselves.
+> We advise users not to build FerretDB themselves.
 > Instead, use binaries, Docker images, or packages provided by us.

 <!-- textlint-enable one-sentence-per-line -->

 FerretDB could be built as any other Go program,
 but a few generated files and build tags could affect it.
-See [there](https://pkg.go.dev/github.com/FerretDB/FerretDB/build/version) for more details.
+See [there](https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/build/version) for more details.

 ## Managed FerretDB at cloud providers

+- [FerretDB Cloud](https://cloud.ferretdb.com/)
 - [Civo](https://www.civo.com/marketplace/FerretDB)
 - [Tembo](https://tembo.io/docs/tembo-stacks/mongo-alternative)
 - [Elestio](https://elest.io/open-source/ferretdb)
- [Cozystack](https://cozystack.io/docs/components/#managed-ferretdb).
-
-## Documentation
-
- [Documentation for users](https://docs.ferretdb.io/).
- [Documentation for Go developers about embeddable FerretDB](https://pkg.go.dev/github.com/FerretDB/FerretDB/ferretdb).
+- [Cozystack](https://cozystack.io/docs/components/#managed-ferretdb)

 ## Community

- Website and blog: https://www.ferretdb.com/.
- Twitter: [@ferret_db](https://twitter.com/ferret_db).
+- Website: https://www.ferretdb.com/.
+- Blog: https://blog.ferretdb.io/.
+- Documentation: https://docs.ferretdb.io/.
+- X (Twitter): [@ferret_db](https://x.com/ferret_db).
 - Mastodon: [@ferretdb@techhub.social](https://techhub.social/@ferretdb).
- [Slack chat](https://join.slack.com/t/ferretdb/shared_invite/zt-zqe9hj8g-ZcMG3~5Cs5u9uuOPnZB8~A) for quick questions.
+- [Slack chat](https://slack.ferretdb.io/) for quick questions.
 - [GitHub Discussions](https://github.com/FerretDB/FerretDB/discussions) for longer topics.
 - [GitHub Issues](https://github.com/FerretDB/FerretDB/issues) for bugs and missing features.
- [Open Office Hours meeting](https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=NGhrZTA5dXZ0MzQzN2gyaGVtZmx2aWxmN2pfMjAyNDA0MDhUMTcwMDAwWiBjX24zN3RxdW9yZWlsOWIwMm0wNzQwMDA3MjQ0QGc&tmsrc=c_n37tquoreil9b02m0740007244%40group.calendar.google.com&scp=ALL)
-  every Monday at 17:00 UTC at [Google Meet](https://meet.google.com/mcb-arhw-qbq).

 If you want to contact FerretDB Inc., please use [this form](https://www.ferretdb.com/contact/).
@@ -8,14 +8,17 @@ env:
 vars:
  SHARD_INDEX: 0
  SHARD_TOTAL: 0
-  DISABLE_PUSHDOWN: false
  TEST_RUN: ""
  TEST_TIMEOUT: 35m
+  NO_XFAIL: false
  BENCH_TIME: 5s
  TESTJS_PORT: 27017
  RACE_FLAG: -race={{and (ne OS "windows") (ne ARCH "arm") (ne ARCH "riscv64")}}
-  BUILD_TAGS: ferretdb_debug,ferretdb_hana
-  SERVICES: postgres postgres_secured mysql mongodb mongodb_secured jaeger
+  BUILD_TAGS: ferretdb_dev
+  MODE: diff-normal
+  SERVICES: jaeger mongodb mongodb-secure postgres yugabytedb
+  LLM: qwen3:0.6b # sync with code
+  LLM_CONTEXT: 40960 # https://ollama.com/library/qwen3:0.6b

 tasks:
  # invoked when `task` is run without arguments
@@ -30,7 +33,6 @@ tasks:
      - task: test-unit
      - task: lint
      - task: security
-      - task: fmt-yaml
      - task: docs

  init-tools:
@@ -47,6 +49,13 @@ tasks:
      - go mod verify
      - go generate -x

+  init-tools-mcphost:
+    dir: tools/mcphost
+    cmds:
+      - go mod tidy
+      - go mod verify
+      - go generate -x
+
  init-integration:
    dir: integration
    cmds:
@@ -55,7 +64,7 @@ tasks:

  init:
    desc: "Install development tools"
-    deps: [init-tools, init-tools-golangci, init-integration]
+    deps: [init-tools, init-tools-golangci, init-tools-mcphost, init-integration]
    cmds:
      - go mod tidy
      - go mod verify
@@ -105,6 +114,15 @@ tasks:
      - docker compose ps --all
      - docker compose logs --follow

+  env-logs-collect:
+    desc: "Collect logs from Docker and save them to tmp/logs"
+    cmds:
+      - bin/envtool{{exeExt}} shell mkdir tmp/logs
+      - docker compose ps --all > tmp/logs/compose-ps.txt
+      - docker compose logs > tmp/logs/compose-logs.txt
+      - docker compose exec yugabytedb sh -c "bin/yugabyted collect_logs --stdout | gunzip | tar -xf - --one-top-level=/tmp/logs"
+      - docker compose cp yugabytedb:/tmp/logs tmp/logs/yugabytedb
+
  env-up:
    desc: "Start development environment"
    deps: [env-up-detach, env-setup]
@@ -153,17 +171,18 @@ tasks:
    desc: "Generate (and format) Go code"
    cmds:
      - go generate -x ./...
+      #- bin/deadcode{{exeExt}} -generated -test -filter=documentdb_api ./cmd/ferretdb
      - bin/task{{exeExt}} -d integration integration-gen
      - task: fmt-go

-  # invoked by FerretDB/github-actions/linters action
  fmt:
    deps: [fmt-go]

+  # invoked by FerretDB/github-actions/linters action
  fmt-go:
    desc: "Format Go code"
    cmds:
-      - bin/goimports{{exeExt}} -local=github.com/FerretDB/FerretDB -w .
+      - bin/goimports{{exeExt}} -local=github.com/FerretDB/FerretDB/v2 -w .
      - bin/gofumpt{{exeExt}} -w .

  test:
@@ -173,27 +192,30 @@ tasks:
  test-unit-short:
    desc: "Run short unit tests (with caching)"
    cmds:
-      - go test -short -timeout={{.TEST_TIMEOUT}} {{.RACE_FLAG}} -tags={{.BUILD_TAGS}} -shuffle=on -coverpkg=./... -coverprofile=cover.txt ./...
+      - go test -c -o /dev/null ./...
+      - go test -short -timeout={{.TEST_TIMEOUT}} {{.RACE_FLAG}} -tags={{.BUILD_TAGS}} -shuffle=on -coverprofile=cover.txt ./...
      - bin/task{{exeExt}} -d tools tools-test-short

  test-unit:
    desc: "Run all unit tests"
    cmds:
-      - go test -count=1 -timeout={{.TEST_TIMEOUT}} {{.RACE_FLAG}} -tags={{.BUILD_TAGS}} -shuffle=on -coverpkg=./... -coverprofile=cover.txt ./...
+      - go test -c -o /dev/null ./...
+      - go test -v -count=1 -timeout={{.TEST_TIMEOUT}} {{.RACE_FLAG}} -tags={{.BUILD_TAGS}} -shuffle=on -coverprofile=cover.txt ./... | tee unit.txt
      - go test -count=1 -timeout={{.TEST_TIMEOUT}} {{.RACE_FLAG}} -tags={{.BUILD_TAGS}} -shuffle=on -bench=. -benchtime=1x ./...
      - bin/task{{exeExt}} -d tools tools-test

+  test-integration-build:
+    run: once
+    dir: integration
+    cmd: go test -c -o /dev/null ./...
+
  test-integration:
-    desc: "Run integration tests for several backends in parallel"
-    deps:
-      - test-integration-postgresql
-      - test-integration-sqlite
-      # no test-integration-hana
-      - test-integration-mongodb
+    desc: "Run integration tests in parallel"
+    deps: [test-integration-postgresql, test-integration-mongodb]

  test-integration-postgresql:
-    desc: "Run integration tests for `postgresql` backend"
-    deps: [gen-version]
+    desc: "Run integration tests for PostgreSQL/DocumentDB"
+    deps: [gen-version, test-integration-build]
    dir: integration
    cmds:
      - >
@@ -202,6 +224,7 @@ tasks:
        --shard-total={{.SHARD_TOTAL}}
        --run='{{.TEST_RUN}}'
        --skip='{{.TEST_SKIP}}'
+        --raw-prefix=postgresql-{{.SHARD_INDEX}}-{{.SHARD_TOTAL}}
        --
        -count=1
        -timeout={{.TEST_TIMEOUT}}
@@ -211,93 +234,14 @@ tasks:
        -coverpkg=../...
        -coverprofile=integration-postgresql.txt
        ./...
-        -target-backend=ferretdb-postgresql
-        -target-tls
-        -postgresql-url='postgres://username@127.0.0.1:5432/ferretdb?search_path='
-        -compat-url='mongodb://username:password@127.0.0.1:47018/?tls=true&tlsCertificateKeyFile=client.pem&tlsCaFile=rootCA-cert.pem&replicaSet=rs0'
-        -disable-pushdown={{.DISABLE_PUSHDOWN}}
-
-  test-integration-sqlite:
-    desc: "Run integration tests for `sqlite` backend"
-    deps: [gen-version]
-    dir: integration
-    cmds:
-      - >
-        ../bin/envtool{{exeExt}} tests run
-        --shard-index={{.SHARD_INDEX}}
-        --shard-total={{.SHARD_TOTAL}}
-        --run='{{.TEST_RUN}}'
-        --skip='{{.TEST_SKIP}}'
-        --
-        -count=1
-        -timeout={{.TEST_TIMEOUT}}
-        {{.RACE_FLAG}}
-        -tags={{.BUILD_TAGS}}
-        -shuffle=on
-        -coverpkg=../...
-        -coverprofile=integration-sqlite.txt
-        ./...
-        -target-backend=ferretdb-sqlite
-        -sqlite-url=file:../tmp/sqlite-tests/
-        -target-tls
-        -compat-url='mongodb://username:password@127.0.0.1:47018/?tls=true&tlsCertificateKeyFile=client.pem&tlsCaFile=rootCA-cert.pem&replicaSet=rs0'
-        -disable-pushdown={{.DISABLE_PUSHDOWN}}
-
-  test-integration-mysql:
-    desc: "Run integration tests for `mysql` handler"
-    deps: [gen-version]
-    dir: integration
-    cmds:
-      - >
-        ../bin/envtool{{exeExt}} tests run
-        --shard-index={{.SHARD_INDEX}}
-        --shard-total={{.SHARD_TOTAL}}
-        --run='{{.TEST_RUN}}'
-        --skip='{{.TEST_SKIP}}'
-        --
-        -count=1
-        -timeout={{.TEST_TIMEOUT}}
-        {{.RACE_FLAG}}
-        -tags={{.BUILD_TAGS}}
-        -shuffle=on
-        -coverpkg=../...
-        -coverprofile=integration-mysql.txt
-        ./...
-        -target-backend=ferretdb-mysql
-        -target-tls
-        -mysql-url='mysql://username:password@127.0.0.1:3306/ferretdb'
-        -compat-url='mongodb://username:password@127.0.0.1:47018/?tls=true&tlsCertificateKeyFile=client.pem&tlsCaFile=rootCA-cert.pem&replicaSet=rs0'
-        -disable-pushdown={{.DISABLE_PUSHDOWN}}
-
-  test-integration-hana:
-    desc: "Run integration tests for `hana` handler"
-    deps: [gen-version]
-    dir: integration
-    cmds:
-      - >
-        ../bin/envtool{{exeExt}} tests run
-        --shard-index={{.SHARD_INDEX}}
-        --shard-total={{.SHARD_TOTAL}}
-        --run='{{.TEST_RUN}}'
-        --skip='{{.TEST_SKIP}}'
-        --
-        -count=1
-        -timeout={{.TEST_TIMEOUT}}
-        {{.RACE_FLAG}}
-        -tags={{.BUILD_TAGS}}
-        -shuffle=on
-        -coverpkg=../...
-        -coverprofile=integration-hana.txt
-        ./...
-        -target-backend=ferretdb-hana
-        -target-tls
-        -hana-url=$FERRETDB_HANA_URL
-        -compat-url='mongodb://username:password@127.0.0.1:47018/?tls=true&tlsCertificateKeyFile=client.pem&tlsCaFile=rootCA-cert.pem&replicaSet=rs0'
-        -disable-pushdown={{.DISABLE_PUSHDOWN}}
+        -target-backend=ferretdb
+        -postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
+        -compat-url='mongodb://username:password@127.0.0.1:47017/?replicaSet=rs0'
+        -no-xfail={{.NO_XFAIL}}

  test-integration-mongodb:
    desc: "Run integration tests for MongoDB"
-    deps: [gen-version]
+    deps: [gen-version, test-integration-build]
    dir: integration
    cmds:
      - >
@@ -306,6 +250,7 @@ tasks:
        --shard-total={{.SHARD_TOTAL}}
        --run='{{.TEST_RUN}}'
        --skip='{{.TEST_SKIP}}'
+        --raw-prefix=mongodb-{{.SHARD_INDEX}}-{{.SHARD_TOTAL}}
        --
        -count=1
        -timeout={{.TEST_TIMEOUT}}
@@ -315,8 +260,50 @@ tasks:
        -coverpkg=../...
        -coverprofile=integration-mongodb.txt
        ./...
-        -target-url='mongodb://username:password@127.0.0.1:47018/?tls=true&tlsCertificateKeyFile=client.pem&tlsCaFile=rootCA-cert.pem&replicaSet=rs0'
+        -target-url='mongodb://username:password@127.0.0.1:47017/?replicaSet=rs0'
        -target-backend=mongodb
+        -no-xfail={{.NO_XFAIL}}
+
+  test-integration-yugabytedb:
+    desc: "Run integration tests for FerretDB with YugabyteDB sequentially"
+    vars:
+      # DPanic on InternalError stops execution of remaining tests,
+      # ensure to complete all tests by not setting development build tag and without race detector.
+      # TODO https://github.com/FerretDB/FerretDB/issues/5397
+      BUILD_TAGS: ""
+      RACE_FLAG: -race=false
+    deps:
+      - task: gen-version
+        vars:
+          BUILD_TAGS:
+            ref: .BUILD_TAGS
+          RACE_FLAG:
+            ref: .RACE_FLAG
+      - task: test-integration-build
+    dir: integration
+    cmds:
+      - >
+        ../bin/envtool{{exeExt}} tests run
+        --shard-index={{.SHARD_INDEX}}
+        --shard-total={{.SHARD_TOTAL}}
+        --run='{{.TEST_RUN}}'
+        --skip='{{.TEST_SKIP}}'
+        --raw-prefix=yugabytedb-{{.SHARD_INDEX}}-{{.SHARD_TOTAL}}
+        --
+        -count=1
+        -parallel=1
+        -p=1
+        -timeout={{.TEST_TIMEOUT}}
+        {{.RACE_FLAG}}
+        -tags={{.BUILD_TAGS}}
+        -shuffle=on
+        -coverpkg=../...
+        -coverprofile=integration-yugabytedb.txt
+        ./...
+        -target-backend=ferretdb-yugabytedb
+        -postgresql-url='postgres://pg-user:pg-pass@127.0.0.1:5433/yugabyte'
+        -compat-url='mongodb://username:password@127.0.0.1:47017/?replicaSet=rs0'
+        -no-xfail={{.NO_XFAIL}}

  bench-unit:
    desc: "Run unit benchmarks"
@@ -326,124 +313,70 @@ tasks:
      - bin/benchstat{{exeExt}} old.txt new.txt

  run:
-    desc: "Run FerretDB with `postgresql` backend"
+    desc: "Run FerretDB without auth"
    deps: [build-host]
    cmds:
      - >
        bin/ferretdb{{exeExt}}
+        --mode={{.MODE}}
+        --no-auth
        --listen-addr=:27017
-        --proxy-addr=127.0.0.1:47017
-        --mode=diff-normal
-        --repl-set-name=rs0
-        --handler=pg
-        --postgresql-url='postgres://username@127.0.0.1:5432/ferretdb?search_path='
-        --test-records-dir=tmp/records
+        --listen-data-api-addr=127.0.0.1:8899
+        --listen-mcp-addr=127.0.0.1:8081
+        --proxy-addr=127.0.0.1:37017
+        --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
        --otel-traces-url=http://127.0.0.1:4318/v1/traces
+        --dev-records-dir=tmp/records

-  run-sqlite:
-    desc: "Run FerretDB with `sqlite` backend"
+  run-secure:
+    desc: "Run FerretDB with auth"
    deps: [build-host]
    cmds:
-      - bin/envtool{{exeExt}} shell mkdir tmp/sqlite
      - >
        bin/ferretdb{{exeExt}}
+        --mode={{.MODE}}
        --listen-addr=:27017
+        --listen-data-api-addr=127.0.0.1:8899
+        --listen-mcp-addr=127.0.0.1:8081
        --proxy-addr=127.0.0.1:47017
-        --mode=diff-normal
-        --handler=sqlite
-        --sqlite-url=file:tmp/sqlite/
-        --test-records-dir=tmp/records
+        --postgresql-url='postgres://username:password@127.0.0.1:5432/postgres'
+        --otel-traces-url=http://127.0.0.1:4318/v1/traces
+        --dev-repl-set-name=rs0
+        --dev-records-dir=tmp/records

-  run-mysql:
-    desc: "Run FerretDB with `mysql` backend"
+  run-yugabytedb:
+    desc: "Run FerretDB with YugabyteDB without auth"
    deps: [build-host]
    cmds:
      - >
        bin/ferretdb{{exeExt}}
+        --mode={{.MODE}}
+        --no-auth
        --listen-addr=:27017
-        --proxy-addr=127.0.0.1:47017
-        --mode=diff-normal
-        --handler=mysql
-        --mysql-url='mysql://username@127.0.0.1:3306/ferretdb'
-        --test-records-dir=tmp/records
+        --listen-data-api-addr=127.0.0.1:8899
+        --listen-mcp-addr=127.0.0.1:8081
+        --proxy-addr=127.0.0.1:37017
+        --postgresql-url='postgres://username:password@127.0.0.1:5433/yugabyte'
+        --otel-traces-url=http://127.0.0.1:4318/v1/traces
+        --dev-records-dir=tmp/records

-  # set FERRETDB_HANA_URL environment variable to use it
-  run-hana:
-    desc: "Run FerretDB with `hana` backend"
+  run-yugabytedb-secure:
+    desc: "Run FerretDB with YugabyteDB with auth"
    deps: [build-host]
    cmds:
      - >
        bin/ferretdb{{exeExt}}
+        --mode={{.MODE}}
        --listen-addr=:27017
+        --listen-data-api-addr=127.0.0.1:8899
+        --listen-mcp-addr=127.0.0.1:8081
        --proxy-addr=127.0.0.1:47017
-        --mode=diff-normal
-        --handler=hana
-        --test-records-dir=tmp/records
-
-  run-secured:
-    desc: "Run FerretDB with `postgresql` backend (TLS, auth required)"
-    deps: [build-host]
-    cmds:
-      - >
-        bin/ferretdb{{exeExt}}
-        --listen-addr=''
-        --listen-tls=:27018
-        --listen-tls-cert-file=./build/certs/server-cert.pem
-        --listen-tls-key-file=./build/certs/server-key.pem
-        --listen-tls-ca-file=./build/certs/rootCA-cert.pem
-        --proxy-addr=127.0.0.1:47017
-        --mode=diff-normal
-        --handler=pg
-        --postgresql-url='postgres://127.0.0.1:5433/ferretdb?search_path='
-        --test-records-dir=tmp/records
-
-  run-proxy:
-    desc: "Run FerretDB in the diff-proxy mode"
-    deps: [build-host]
-    cmds:
-      - >
-        bin/ferretdb{{exeExt}}
-        --listen-addr=:27017
-        --proxy-addr=127.0.0.1:47017
-        --mode=diff-proxy
-        --handler=pg
-        --postgresql-url='postgres://username@127.0.0.1:5432/ferretdb?search_path='
-        --test-records-dir=tmp/records
-
-  run-sqlite-proxy:
-    desc: "Run FerretDB with `sqlite` handler in the diff-proxy mode"
-    deps: [build-host]
-    cmds:
-      - bin/envtool{{exeExt}} shell mkdir tmp/sqlite
-      - >
-        bin/ferretdb{{exeExt}}
-        --listen-addr=:27017
-        --proxy-addr=127.0.0.1:47017
-        --mode=diff-proxy
-        --handler=sqlite
-        --sqlite-url=file:tmp/sqlite/
-        --test-records-dir=tmp/records
-
-  run-proxy-secured:
-    desc: "Run FerretDB in the diff-proxy mode (TLS, auth required)"
-    deps: [build-host]
-    cmds:
-      - >
-        bin/ferretdb{{exeExt}}
-        --listen-addr=''
-        --listen-tls=:27018
-        --listen-tls-cert-file=./build/certs/server-cert.pem
-        --listen-tls-key-file=./build/certs/server-key.pem
-        --listen-tls-ca-file=./build/certs/rootCA-cert.pem
-        --proxy-addr=127.0.0.1:47018
-        --proxy-tls-cert-file=./build/certs/client-cert.pem
-        --proxy-tls-key-file=./build/certs/client-key.pem
-        --proxy-tls-ca-file=./build/certs/rootCA-cert.pem
-        --mode=diff-proxy
-        --handler=pg
-        --postgresql-url='postgres://username@127.0.0.1:5433/ferretdb?search_path='
-        --test-records-dir=tmp/records
+        --postgresql-url='postgres://username:password@127.0.0.1:5433/yugabyte'
+        --otel-traces-url=http://127.0.0.1:4318/v1/traces
+        --dev-repl-set-name=rs0
+        --dev-records-dir=tmp/records

+  # invoked by FerretDB/github-actions/linters action
  lint:
    desc: "Run linters"
    cmds:
@@ -451,8 +384,7 @@ tasks:
      - bin/envtool{{exeExt}} shell mkdir tmp/githubcache
      - bin/golangci-lint{{exeExt}} run --config=.golangci.yml
      - bin/golangci-lint{{exeExt}} run --config=.golangci-new.yml
-      - bin/go-consistent{{exeExt}} -pedantic ./cmd/... ./internal/... ./build/... ./ferretdb/...
-
+      - bin/go-consistent{{exeExt}} -pedantic ./cmd/... ./ferretdb/... ./internal/...
      - go vet -vettool=bin/checkswitch{{exeExt}} ./...
      - go vet -vettool=bin/checkcomments{{exeExt}} ./...

@@ -473,27 +405,41 @@ tasks:

  security-trivy:
    cmds:
-      - docker compose run --rm trivy --config=./build/trivy.yml filesystem .
+      - docker compose run --rm trivy --config=./build/trivy.yml filesystem --ignorefile=./build/.trivyignore .

  godocs:
    desc: "Serve Go code documentation"
    cmds:
      - bin/pkgsite{{exeExt}} -http=127.0.0.1:6060 -open

+  ollama:
+    desc: "Run local Ollama server"
+    cmds:
+      - ollama serve
+    env:
+      OLLAMA_CONTEXT_LENGTH: "{{.LLM_CONTEXT}}"
+      OLLAMA_DEBUG: 2
+
+  ollama-model:
+    desc: "Pull and load Ollama model"
+    cmds:
+      - ollama pull {{.LLM}}
+      - ollama run --think=false {{.LLM}} 'Hi!'
+
+  mcphost:
+    desc: "Run MCPHost for local Ollama server"
+    cmds:
+      - bin/mcphost --config=build/mcphost.json --model=ollama:{{.LLM}}
+
  psql:
    desc: "Run psql"
    cmds:
-      - docker compose exec -e PGPASSWORD=password postgres psql -U username -d ferretdb
+      - docker compose exec postgres psql -p 5432 -U username -d postgres

-  sqlite3:
-    desc: "Run sqlite3"
+  ysqlsh:
+    desc: "Run YugabyteDB SQL shell"
    cmds:
-      - sqlite3 tmp/sqlite/*.sqlite
-
-  mysql:
-    desc: "Run mysql"
-    cmds:
-      - docker compose exec -e MYSQL_PASSWORD=password mysql mysql -u username -ppassword ferretdb
+      - docker compose exec yugabytedb ./bin/ysqlsh postgres://username:password@host.docker.internal:5433/yugabyte

  mongosh:
    desc: "Run MongoDB shell (`mongosh`)"
@@ -503,17 +449,32 @@ tasks:
        --verbose --eval 'disableTelemetry()' --shell
        'mongodb://host.docker.internal:27017/?heartbeatFrequencyMS=300000'

-  mongosh-secured:
-    desc: "Run MongoDB shell (`mongosh`) with TLS and auth"
+  mongosh-secure:
+    desc: "Run MongoDB shell (`mongosh`) with auth"
    cmds:
      - >
        docker compose exec mongodb mongosh
        --verbose --eval 'disableTelemetry()' --shell
-        'mongodb://username:password@host.docker.internal:27018/?authMechanism=PLAIN&tls=true&tlsCertificateKeyFile=/etc/certs/client.pem&tlsCaFile=/etc/certs/rootCA-cert.pem'
+        'mongodb://username:password@host.docker.internal:27017/?heartbeatFrequencyMS=300000'
+
+  mongo:
+    desc: "Run legacy MongoDB shell (`mongo`)"
+    cmds:
+      - >
+        docker compose run --rm legacy-mongo-shell
+        'mongodb://username:password@host.docker.internal:27017/'
+
+  testsql:
+    desc: "Run pgTAP with test.sql script"
+    cmds:
+      - docker compose exec postgres pg_prove --ext .sql --verbose -p 5432 -U username -d postgres /testscripts/

  testjs:
    desc: "Run legacy MongoDB shell (`mongo`) with test.js script"
    cmds:
+      # Authentication with username:password will not work
+      # because this user is created by setup with a different salt length,
+      # and there are no other credentials to use.
      - >
        docker compose run --rm legacy-mongo-shell
        'mongodb://host.docker.internal:{{.TESTJS_PORT}}/'
@@ -529,7 +490,6 @@ tasks:
          --bootstrap=true
          --use=false
          --config=./build/buildkitd.toml
-          --driver=docker-container
          --driver-opt network=host
          --driver-opt env.JAEGER_TRACE=127.0.0.1:6831
          --driver-opt env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
@@ -578,7 +538,7 @@ tasks:
      vars: [DOCKER_ARCH, DIR_ARCH, BIN_FILE, BIN_DIR]

  build-development:
-    desc: "Build development debug binaries"
+    desc: "Build development binaries"
    cmds:
      - echo 'bin-development' > build/version/package.txt
      - bin/envtool{{exeExt}} shell rmdir tmp/build
@@ -587,18 +547,19 @@ tasks:
        vars:
          FILE: ferretdb/development
          TARGET: development-binary
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=local,dest=tmp/build
-      - for: [amd64, arm64, arm/v7]
+      - for: [amd64, arm64]
        task: build-move-check
        vars:
+          # TODO https://github.com/FerretDB/FerretDB/issues/5019
          DOCKER_ARCH: "{{.ITEM}}" # arm/v7
          DIR_ARCH: '{{replace "/" "_" .ITEM}}' # arm/v7 -> arm_v7
-          BIN_FILE: 'ferretdb-dev-linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
+          BIN_FILE: 'ferretdb-dev-{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
          BIN_DIR: bin-dev

  build-production:
-    desc: "Build production non-debug binaries"
+    desc: "Build production binaries"
    cmds:
      - echo 'bin' > build/version/package.txt
      - bin/envtool{{exeExt}} shell rmdir tmp/build
@@ -607,14 +568,15 @@ tasks:
        vars:
          FILE: ferretdb/production
          TARGET: production-binary
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=local,dest=tmp/build
-      - for: [amd64, arm64, arm/v7]
+      - for: [amd64, arm64]
        task: build-move-check
        vars:
+          # TODO https://github.com/FerretDB/FerretDB/issues/5019
          DOCKER_ARCH: "{{.ITEM}}" # arm/v7
          DIR_ARCH: '{{replace "/" "_" .ITEM}}' # arm/v7 -> arm_v7
-          BIN_FILE: 'ferretdb-linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
+          BIN_FILE: 'ferretdb-{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
          BIN_DIR: bin

  docker-local:
@@ -631,14 +593,27 @@ tasks:
      vars: [FILE]

  # TODO https://github.com/FerretDB/FerretDB/issues/2212
-  docker-all-in-one-push:
+  docker-eval-dev-push:
    cmds:
-      - echo 'docker-all-in-one' > build/version/package.txt
+      - echo 'docker-eval-dev' > build/version/package.txt
      - task: docker-build
        vars:
-          FILE: ferretdb/all-in-one
-          TARGET: all-in-one
-          PLATFORM: linux/amd64,linux/arm64 # no mongosh for arm/v6 and arm/v7
+          FILE: ferretdb/eval-dev
+          TARGET: eval-dev
+          PLATFORM: linux/amd64,linux/arm64
+          OUTPUT: type=image,push=true
+    requires:
+      vars: [DOCKER_IMAGES]
+
+  # TODO https://github.com/FerretDB/FerretDB/issues/2212
+  docker-eval-push:
+    cmds:
+      - echo 'docker-eval' > build/version/package.txt
+      - task: docker-build
+        vars:
+          FILE: ferretdb/eval
+          TARGET: eval
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=image,push=true
    requires:
      vars: [DOCKER_IMAGES]
@@ -651,7 +626,7 @@ tasks:
        vars:
          FILE: ferretdb/development
          TARGET: development
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=image,push=true
    requires:
      vars: [DOCKER_IMAGES]
@@ -664,7 +639,7 @@ tasks:
        vars:
          FILE: ferretdb/production
          TARGET: production
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=image,push=true
    requires:
      vars: [DOCKER_IMAGES]
@@ -686,6 +661,7 @@ tasks:
        --packager={{.PACKAGER}}
        --target=tmp/{{.PACKAGER}}s/ferretdb-{{.FILE_SUFFIX}}.{{.PACKAGER}}
    env:
+      # TODO https://github.com/FerretDB/FerretDB/issues/5019
      PACKAGE_VERSION: "{{.PACKAGE_VERSION}}"
      PACKAGE_ARCH: "{{.PACKAGE_ARCH}}"
      DIR_ARCH: "{{.DIR_ARCH}}"
@@ -713,21 +689,22 @@ tasks:
        vars:
          FILE: ferretdb/development
          TARGET: development-binary
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=local,dest=tmp/build
-      - for: [amd64, arm64, arm/v7]
+      - for: [amd64, arm64]
        task: packages-build
        vars:
+          # TODO https://github.com/FerretDB/FerretDB/issues/5019
          PACKAGER: deb
          PACKAGE_VERSION: "{{.PACKAGE_VERSION}}"
          PACKAGE_ARCH: '{{replace "/" "" .ITEM | replace "v" ""}}' # arm/v7 -> arm7
          DIR_ARCH: '{{replace "/" "_" .ITEM}}' # arm/v7 -> arm_v7
-          FILE_SUFFIX: 'dev-linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
-      - for: [amd64, arm64, arm/v7]
+          FILE_SUFFIX: 'dev-{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
+      - for: [amd64, arm64]
        task: packages-deb-check
        vars:
          DOCKER_ARCH: "{{.ITEM}}" # arm/v7
-          FILE_SUFFIX: 'dev-linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
+          FILE_SUFFIX: 'dev-{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
    vars:
      PACKAGE_VERSION:
        sh: bin/envtool{{exeExt}} package-version
@@ -741,21 +718,22 @@ tasks:
        vars:
          FILE: ferretdb/production
          TARGET: production-binary
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=local,dest=tmp/build
-      - for: [amd64, arm64, arm/v7]
+      - for: [amd64, arm64]
        task: packages-build
        vars:
+          # TODO https://github.com/FerretDB/FerretDB/issues/5019
          PACKAGER: deb
          PACKAGE_VERSION: "{{.PACKAGE_VERSION}}"
          PACKAGE_ARCH: '{{replace "/" "" .ITEM | replace "v" ""}}' # arm/v7 -> arm7
          DIR_ARCH: '{{replace "/" "_" .ITEM}}' # arm/v7 -> arm_v7
-          FILE_SUFFIX: 'linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
-      - for: [amd64, arm64, arm/v7]
+          FILE_SUFFIX: '{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
+      - for: [amd64, arm64]
        task: packages-deb-check
        vars:
          DOCKER_ARCH: "{{.ITEM}}" # arm/v7
-          FILE_SUFFIX: 'linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
+          FILE_SUFFIX: '{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
    vars:
      PACKAGE_VERSION:
        sh: bin/envtool{{exeExt}} package-version
@@ -781,21 +759,22 @@ tasks:
        vars:
          FILE: ferretdb/development
          TARGET: development-binary
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=local,dest=tmp/build
-      - for: [amd64, arm64, arm/v7]
+      - for: [amd64, arm64]
        task: packages-build
        vars:
+          # TODO https://github.com/FerretDB/FerretDB/issues/5019
          PACKAGER: rpm
          PACKAGE_VERSION: "{{.PACKAGE_VERSION}}"
          PACKAGE_ARCH: '{{replace "/" "" .ITEM | replace "v" ""}}' # arm/v7 -> arm7
          DIR_ARCH: '{{replace "/" "_" .ITEM}}' # arm/v7 -> arm_v7
-          FILE_SUFFIX: 'dev-linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
-      - for: [amd64, arm64, arm/v7]
+          FILE_SUFFIX: 'dev-{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
+      - for: [amd64, arm64]
        task: packages-rpm-check
        vars:
          DOCKER_ARCH: "{{.ITEM}}" # arm/v7
-          FILE_SUFFIX: 'dev-linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
+          FILE_SUFFIX: 'dev-{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
    vars:
      PACKAGE_VERSION:
        sh: bin/envtool{{exeExt}} package-version
@@ -809,21 +788,22 @@ tasks:
        vars:
          FILE: ferretdb/production
          TARGET: production-binary
-          PLATFORM: linux/amd64,linux/arm64,linux/arm/v7 # TODO https://github.com/FerretDB/FerretDB/issues/3354
+          PLATFORM: linux/amd64,linux/arm64
          OUTPUT: type=local,dest=tmp/build
-      - for: [amd64, arm64, arm/v7]
+      - for: [amd64, arm64]
        task: packages-build
        vars:
+          # TODO https://github.com/FerretDB/FerretDB/issues/5019
          PACKAGER: rpm
          PACKAGE_VERSION: "{{.PACKAGE_VERSION}}"
          PACKAGE_ARCH: '{{replace "/" "" .ITEM | replace "v" ""}}' # arm/v7 -> arm7
          DIR_ARCH: '{{replace "/" "_" .ITEM}}' # arm/v7 -> arm_v7
-          FILE_SUFFIX: 'linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
-      - for: [amd64, arm64, arm/v7]
+          FILE_SUFFIX: '{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
+      - for: [amd64, arm64]
        task: packages-rpm-check
        vars:
          DOCKER_ARCH: "{{.ITEM}}" # arm/v7
-          FILE_SUFFIX: 'linux-{{replace "/" "" .ITEM}}' # arm/v7 -> armv7
+          FILE_SUFFIX: '{{replace "/" "" .ITEM}}-linux' # arm/v7 -> armv7
    vars:
      PACKAGE_VERSION:
        sh: bin/envtool{{exeExt}} package-version
@@ -833,6 +813,14 @@ tasks:
    cmds:
      - docker compose run --rm prettier --write --print-width 120 "**/*.js"

+      # .js files are also used for mongosh output snippets
+      # (with added `response = ` to make them valid JavaScript).
+      # The formatting of quotes, commas and semicolons should not be modified.
+      # Flags are set to ensure that.
+      - >
+        docker compose run --rm prettier --write --single-quote --trailing-comma none --no-semi
+        --print-width 120 "website/*docs/**/*.js"
+
  fmt-json:
    desc: "Format JSON files"
    cmds:
@@ -843,29 +831,52 @@ tasks:
    cmds:
      - docker compose run --rm prettier --write --print-width 120 "**/*.yml"

-  # see https://github.com/DavidAnson/markdownlint-cli2#command-line for the reason we use double-quotes
+  # See https://github.com/DavidAnson/markdownlint-cli2#command-line for the reason we use double quotes in command.
  fmt-docs:
    desc: "Format and lint documentation"
-    deps: [fmt-js, fmt-json, fmt-yaml]
+    deps: [gen-version, fmt-js, fmt-json, fmt-yaml]
    run: once
    cmds:
      - >
        docker compose run --rm textlint --fix --config build/.textlintrc --ignore-path .prettierignore
        "**/*.md" "**/*.mdx" ".github/**/*.md"
+
+      # Use the same flags as in fmt-js for mongosh snippets above.
+      #
+      # Note that embedded code snippets in ``` Markdown blocks are not reformatted if they can't be parsed.
+      # Ensure that the code is valid and can be parsed by changing formatting manually
+      # and running this task again, checking that formatting changes.
+      #
+      # TODO --print-width 120 (https://github.com/FerretDB/FerretDB/issues/4636)
      - >
-        docker compose run --rm prettier --write --parser markdown --no-semi --single-quote --trailing-comma none
+        docker compose run --rm prettier --write --single-quote --trailing-comma none --no-semi
        "**/*.md" "**/*.mdx"
+
      - >
        docker compose run --rm markdownlint --config "build/.markdownlint.yml"
-        "**/*.md" "**/*.mdx"
+        "**/*.md" "**/*.mdx" "#build/postgres-documentdb/documentdb/"
+      - bin/envtool{{exeExt}} shell rmdir tmp/githubcache
+      - bin/envtool{{exeExt}} shell mkdir tmp/githubcache
      - bin/checkdocs

  docs-fmt:
    deps: [fmt-docs]

+  docs-gen:
+    desc: "Generate documentation examples using CTS tool"
+    cmds:
+      - bin/opendocdb-cts fmt --dir=website/docs/guides
+      - bin/opendocdb-cts convert --dir=website/docs/guides website/docs/guides --db=db
+      - task: fmt-docs
+
+  cts:
+    desc: "Run CTS tests against FerretDB"
+    cmds:
+      - bin/opendocdb-cts run --dir=website/docs/guides --uri=mongodb://127.0.0.1:27017/cts
+
  docs:
    desc: "Format, lint and build documentation"
-    deps: [fmt-docs]
+    deps: [docs-gen]
    cmds:
      - docker compose run --rm docusaurus-docs build

@@ -877,17 +888,17 @@ tasks:

  pngcrush:
    cmds:
-      - pngcrush -ow -brute {{.FILE}}
+      - pngcrush -ow -brute -rem text {{.FILE}}
    requires:
      vars: [FILE]

  pngcrush-new:
    cmds:
-      - git diff --name-only upstream/main '*.png' | parallel "pngcrush -ow -brute {} {.}.temp"
+      - git diff --name-only upstream/main '*.png' | parallel "pngcrush -ow -brute -rem text {} {.}.temp"

  pngcrush-all:
    cmds:
-      - find . -type f -name '*.png' | parallel "pngcrush -ow -brute {} {.}.temp"
+      - find . -type f -name '*.png' | parallel "pngcrush -ow -brute -rem text {} {.}.temp"

  docs-dev:
    desc: "Start documentation development server"
@@ -925,8 +936,8 @@ tasks:
      - docker compose run --rm --service-ports wrangler pages deployment create --project-name=blog website/build

  changelog:
-    desc: "Generate changelogs locally for a given milestone."
+    desc: "Generate changelog"
    cmds:
-      - bin/generatechangelog -milestone={{.MILESTONE_TITLE}} -previous={{.PREVIOUS_MILESTONE_TITLE}}
+      - bin/generatechangelog -prev={{.PREV}} -next={{.NEXT}}
    requires:
-      vars: [MILESTONE_TITLE, PREVIOUS_MILESTONE_TITLE]
+      vars: [PREV, NEXT]
@@ -11,4 +11,7 @@ MD006: false # deprecated
 MD013: false # we use https://sembr.org that could lead to long lines
 MD026: { punctuation: ".,;:。，；：" } # default is .,;:!。，；：！
 MD029: { style: ordered }
+MD033: false # for MDX
 MD034: false # autolink tags <link> no longer supported by MDX
+MD037: false # clashes with MDX comments
+MD059: false # not yet
@@ -0,0 +1,7 @@
+# https://github.com/cloudwego/eino#dependencies
+# TODO https://github.com/cloudwego/eino/issues/291
+CVE-2025-30153
+
+# https://nvd.nist.gov/vuln/detail/CVE-2025-51471
+# https://github.com/ollama/ollama/pull/10750
+CVE-2025-51471
@@ -5,9 +5,12 @@ export TRUST_STORES=system
 HOSTS=localhost 127.0.0.1 ::1 host.docker.internal

 gen:
+	rm -f *.pem
 	mkcert -install
 	mkcert -client -cert-file client-cert.pem -key-file client-key.pem $(HOSTS)
 	cat client-cert.pem client-key.pem > client.pem
 	mkcert -cert-file server-cert.pem -key-file server-key.pem $(HOSTS)
 	cat server-cert.pem server-key.pem > server.pem
 	mkcert -uninstall
+	mv rootCA.pem rootCA-cert.pem
+	rm -f rootCA-key.pem
@@ -1,27 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEkjCCAvqgAwIBAgIQIJJuiEy6fblSjN6q3SwleDANBgkqhkiG9w0BAQsFADCB
-kTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMM
-MW1rY2VydCBhbGVrc2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5r
-bykwHhcNMjIxMjEwMDcxODA1WhcNMjUwMzEwMDcxODA1WjBeMScwJQYDVQQKEx5t
-a2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxMzAxBgNVBAsMKmFsZWtzaUBQ
-cm9ib29rLmxvY2FsIChBbGV4ZXkgUGFsYXpoY2hlbmtvKTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAL6Wjqflpl7y4g/N0LZGFBZOmUMCveNA9VhSBVYK
-wgaeY8Ypl/xmfTjAcVXbzkSunwxFDVL1cZavaM5fRFLlF9Tj7A8hxaE/Cwr3Gr9U
-qAiFgRMQZb1CxkCdkqw6dgsXx8N5TfcEijG8CEiKhSYTFVD6ca8tgE0F8c568ES1
-CVxynoxAmLedNNGYt3IyCSow6c8YUouWOccf3EzuhoL0NnuYgm0hwIJB2WCJlEJA
-HcYabDMdDCAWhKQ2kNoh4hV576L3I9zl549ghnGrZzGhjcHn8AgNRvZasfgaSttx
-dCAiPqtvc2KJJO6fG3Ue+bDftMk3n9/IZ+XpCRD7gznBVbcCAwEAAaOBlzCBlDAO
-BgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB8G
-A1UdIwQYMBaAFKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2Fs
-aG9zdIIUaG9zdC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAA
-AAEwDQYJKoZIhvcNAQELBQADggGBABbgVfpgwwMNMXa359jwzrjDZA9MMhCec5Du
-UbbwZJxQqWkbvlHsn11VTCTjvRqpjc7pgU9vclZgj3/h+j8cw8uy1ZsjV2sQhyJX
-DQVVfm60jvb3+deamePciPPwXzOHZswdfnEHgRYQiSx035HKniErAFTXR9v+ZSl9
-9qVjkuR6cRi02iLmjmnXB55vzyfgXmlNwMlYqIe9e3WsqdGKKw50qx6B6VU1J0tz
-H7DDmgzF3jiOhNmdjHVFoz4wDnx3e1GhziVc8e8tuBANIAyTasahVlnP+KtJPao2
-ciqFZrRbSxYwXCQRwd5F4FvVLLkqVYO2PRDBGi8m483hHgI5bkOfyrNIvgiNGGWV
-Fq/uVEwgqUItmgpy2ZdRz4zA1GL4olCKX8FALDgwVI6t1Ygo5EoUP1m1xyC7NK5R
-WI701gZnMICUos39Usvp8EagwYyDtkLxumznMS1q+m9sy+gY4Kfag3tnzcJHyjUN
-yfWf5P+Sjdx0+qAVOnAHd+2estdu5g==
+MIIEkzCCAvugAwIBAgIRAJQIOW0DsoWpmhRIS6qVTMkwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDGNj/3rcpjgu8GZHg1AS8lAEy8tbg73+9YRPJs
+IAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrYyW1vNb0ANWPGVd6ReqtJm0wt
+plfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfnHHtwoj649Vw3CjAIRXufB9dD
+EPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj2yhVeXqXC7s8y9HCKSa08tBO
+e3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJF8Vk9ilA+PXL37CIaTkdJOsX
+doacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFpag1LWs/nAgMBAAGjgZcwgZQw
+DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAf
+BgNVHSMEGDAWgBRMfF45cY0dizvyML/k08KmEEPhkjBCBgNVHREEOzA5gglsb2Nh
+bGhvc3SCFGhvc3QuZG9ja2VyLmludGVybmFshwR/AAABhxAAAAAAAAAAAAAAAAAA
+AAABMA0GCSqGSIb3DQEBCwUAA4IBgQBiim9kFNYL81xP6MHNJe2erc3IrpCCn7IC
+WfrhqIz89o/2gYIWqwlc7IWA+y13btUAkaXVDZvZMoFMKbvUcF89OpO8G+4XpbX4
+uu9Q5pC3cjnFymO8xTRNgOam6yySLbjwzZwQIZ/0hh9xCeQ64tlw/a4VT6+UJrYn
+SNTPI38f/MwCFkyr4vCkCUIOIwTRfDc2BwHu1CJ820Hu3Jpr10CRzBOvsDJlDg8c
+vcmbdo+jsqEFMNIZpTblZA+MALRq4eK6Bas3YQcqIGjo+lxx9eYCGzZH1ygS/K5X
+501rBpLJ4OklIVTFWuo5IVwJ9RWMPgX3htl3HzpGztEV8nB9LEjKl9Lmm7xPb8+n
+ytycvckVyFe5JtejNtiB+9v0jNyqvEe2B7hdGfSLchuCv0a3xsocnayxnJChKtqI
+vo022s1k9k7wwJ2Qeq49HfK3yY00SgXYpUljKHLZocisYBxHmNbegzSBa2x7RU+k
+YexHKXvwNHdkVNOTs9LgER0EexdK+AM=
 -----END CERTIFICATE-----
@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+lo6n5aZe8uIP
-zdC2RhQWTplDAr3jQPVYUgVWCsIGnmPGKZf8Zn04wHFV285Erp8MRQ1S9XGWr2jO
-X0RS5RfU4+wPIcWhPwsK9xq/VKgIhYETEGW9QsZAnZKsOnYLF8fDeU33BIoxvAhI
-ioUmExVQ+nGvLYBNBfHOevBEtQlccp6MQJi3nTTRmLdyMgkqMOnPGFKLljnHH9xM
-7oaC9DZ7mIJtIcCCQdlgiZRCQB3GGmwzHQwgFoSkNpDaIeIVee+i9yPc5eePYIZx
-q2cxoY3B5/AIDUb2WrH4GkrbcXQgIj6rb3NiiSTunxt1Hvmw37TJN5/fyGfl6QkQ
-+4M5wVW3AgMBAAECggEAMiun+gK2PSBq6gYf/xuLhiPCrKU4H26mJ03QIcpLMTrY
-wP2KCONh62KdcyCdt+7P54b17vS1phke2dSyQ7ATCfPF3GXjhIL4ATbzT5KVeUjL
-pZ0Xay78yV2xkq0BDgKAj7CLGY+UYWtCMvZj/pXfcqW674Zm09/Qu64ZObz+bds5
-cCrGyhpj1pXZJNBwfaJg82VwWIdytwcFdRwtgywiUJOZ+ldcnJU13f3HjxERpYYA
-zSvNi63bkBEMnj844p9MMsqwb5r8/lZQRvI2K6dW/dRa8xmQKi00AjtPOZMly1Re
-07brcVTmav2jYhZp9PxZUiRMmCdzEnhLtsynaYWVoQKBgQDGQxJeQncM12GuV1Oo
-nHJwRyICzB6DJ8nmErpK0a/zvIiQxUD+/qPVzTDI9C5lBWWPniGjdv57Nb0on1l3
-zp9MPzZrzLBTYyFT5nPBLyhcrRyd0Acz0MeB8p/UwErBP4JsJsjfuSB/Pa9YmbgV
-4GtWQ8khV05vhtivtR3xZl+RRQKBgQD2F2DQjfEuq4tD08v1JiBQQLM+Yw3k0tSe
-f4HFlbOHtPGEHbzrt3eD6fOhJmkVEkQcde4h22+oHpKff/5h0iiW5N4NUrIoL4WN
-34ZHIcpo+gjcdzrLF9fytzLbaaSpDApVVhcRX3JinwKpCp9G4y06KKKRV5EhW4MM
-+1kdZbzUywKBgEG/GkdB2ULb5duvv+FpSBXtsNymnfO2bSCr0zVehe/Y9Jy1nREy
-llgfPG9Xck8z0/MlaFhR7KAlOP5QoZW2YmMhj0V+UnbEp9ev03Eb11GsYpH+23SW
-ZqK0N8aQofmluvVsgy6VsK4hYZWLHF281zt7LSauUidv20mhUTWtUkHVAoGBAJUa
-fRJfri30yiCChyU1wIZfbTrzkUt/YkvWPa6VkX076Ml/qyO2ubc3XOHa//hAZPxJ
-h8sDxZc7TuNNDbf/OZCTgubXoBIxGN5o/FbE5nrMY+oQY5MCE1mAHlRKofW60df6
-nWdtSUTvyxDY2sB8jL6cOEOPpuNrKvAGqmvhZJQZAoGBAJOR7QEbU7L5rWEHDs2z
-QU8ry3y9stbt/ViP/RE63jLcxP5RG7LueDRYsNSdY0WA8wbJ6WNElo3EvxMurmmn
-jkjuhbcFgDFZ5W6cjjG8kDytIHcH73xbZLjqmN/NfsSW211HudkembKfQ4G6llPu
-dZpM5PgCoeFawQ1SnC+CSmcR
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGNj/3rcpjgu8G
+ZHg1AS8lAEy8tbg73+9YRPJsIAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrY
+yW1vNb0ANWPGVd6ReqtJm0wtplfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfn
+HHtwoj649Vw3CjAIRXufB9dDEPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj
+2yhVeXqXC7s8y9HCKSa08tBOe3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJ
+F8Vk9ilA+PXL37CIaTkdJOsXdoacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFp
+ag1LWs/nAgMBAAECggEBAJBcqrJFzYY0sspBGpvgROn6EenPoGNbcgMkFDxUC2ew
+2cZGE18n9duI8odAa6tn3XuNsmII3JBsnw4NhrrctM8WE5k8qWHjqiVuCkmlQZD6
+IPmOowT3Nw+OsyXyBZ3MocJP5WFJUGakb+iPgghC4tPrQEKGFP2xPZxSJaIfEABa
+HgSYTSr+n8lJUKdld00BNSWXBxsVQ8NAw/5AFjFP4R3TeCwbd34lpMpkLvOax05j
+xbdZr0MP03MT8PYMBRzqMcST0OR7bK8vyAnB/ezxhrnQaMV2NeHpisB3UbNFi+PT
+63tNV/S2hCOGDZ5V+jFQ6FRyUw1gOlJK/EMGLIEt3kECgYEA1gMXqlp5w0OIBBkS
+MbhY2LhVO0v3LBHtRCqFbKGdA3yrHrsq/YJKlJbEoiw9mWGgYq7h0jNAsvI/WLgo
+tm4AUxRdG9YZDqNEcfcODnLqFg5D7/abSXx+An3pwZ+fQgL8STGu9up/Xl1Sss1T
+JHBEOM+vqb7TQxPPvl77SUHUwX8CgYEA7RmVO6PEepnJuMGYgG9Au5SMkcFY5iK5
+AqlEHio097+KsQ+K4nxW8yvtNoXnSBsfX3t78vI6zjSeFgk/MhoVUGLKIQTwq6KO
+WvASeB1zIzSkfXISznMs/CxGMt9FODvM9PCJMpeFAvJNDn83vupo0oxagu+EUVoF
+eGoqNEMMVZkCgYEAgx+d7lhE5miH+8rIpQIIHbDDN/ORW8UYFH3hBe/3Xd2Skt+m
+tXCQ9X1yuNJWY5W3SP9RiRKx/3IBcgBToYLAXCbL7XQ+IgPSuejfCedKmXzgDzSP
+bHUEV86B3IpKb42YudfhFZQTueN/+eFnoZnPkudc/6nVkvGehUt4tyfIjU0CgYAP
+PebHB7cYvowmMWPRVdWOeXUz5X8GhFLqZeE4IzR2fLy4tywRdTbNuRQtvhvpGb1B
+kRmdu46mNOG4vu1uFhkqqr8dskiab//AvtAhIpuFNtwgKFYnKWZJ67qziIDVpZp+
+YHwhYXYug08K0IjP4BfO+TDUW/tgk23omMKPy4OeeQKBgQCiKzdHtUO6KujjueYX
+lbDVbdEiXYbGzKcMmE0E/DK73xXpXT/CQ+tjB3nZKHDwkTN6h9ZZYzjhRWmHRlRh
+WqGqmWr4D3I0B9jnxCTpDuZIlJ21G336RbsZD8yi+eyMwJXN4csItGSlMig04jvo
+5vTIN0D0uXAvDD23TEcilpQzcA==
 -----END PRIVATE KEY-----
@@ -1,55 +1,55 @@
 -----BEGIN CERTIFICATE-----
-MIIEkjCCAvqgAwIBAgIQIJJuiEy6fblSjN6q3SwleDANBgkqhkiG9w0BAQsFADCB
-kTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMM
-MW1rY2VydCBhbGVrc2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5r
-bykwHhcNMjIxMjEwMDcxODA1WhcNMjUwMzEwMDcxODA1WjBeMScwJQYDVQQKEx5t
-a2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxMzAxBgNVBAsMKmFsZWtzaUBQ
-cm9ib29rLmxvY2FsIChBbGV4ZXkgUGFsYXpoY2hlbmtvKTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAL6Wjqflpl7y4g/N0LZGFBZOmUMCveNA9VhSBVYK
-wgaeY8Ypl/xmfTjAcVXbzkSunwxFDVL1cZavaM5fRFLlF9Tj7A8hxaE/Cwr3Gr9U
-qAiFgRMQZb1CxkCdkqw6dgsXx8N5TfcEijG8CEiKhSYTFVD6ca8tgE0F8c568ES1
-CVxynoxAmLedNNGYt3IyCSow6c8YUouWOccf3EzuhoL0NnuYgm0hwIJB2WCJlEJA
-HcYabDMdDCAWhKQ2kNoh4hV576L3I9zl549ghnGrZzGhjcHn8AgNRvZasfgaSttx
-dCAiPqtvc2KJJO6fG3Ue+bDftMk3n9/IZ+XpCRD7gznBVbcCAwEAAaOBlzCBlDAO
-BgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB8G
-A1UdIwQYMBaAFKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2Fs
-aG9zdIIUaG9zdC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAA
-AAEwDQYJKoZIhvcNAQELBQADggGBABbgVfpgwwMNMXa359jwzrjDZA9MMhCec5Du
-UbbwZJxQqWkbvlHsn11VTCTjvRqpjc7pgU9vclZgj3/h+j8cw8uy1ZsjV2sQhyJX
-DQVVfm60jvb3+deamePciPPwXzOHZswdfnEHgRYQiSx035HKniErAFTXR9v+ZSl9
-9qVjkuR6cRi02iLmjmnXB55vzyfgXmlNwMlYqIe9e3WsqdGKKw50qx6B6VU1J0tz
-H7DDmgzF3jiOhNmdjHVFoz4wDnx3e1GhziVc8e8tuBANIAyTasahVlnP+KtJPao2
-ciqFZrRbSxYwXCQRwd5F4FvVLLkqVYO2PRDBGi8m483hHgI5bkOfyrNIvgiNGGWV
-Fq/uVEwgqUItmgpy2ZdRz4zA1GL4olCKX8FALDgwVI6t1Ygo5EoUP1m1xyC7NK5R
-WI701gZnMICUos39Usvp8EagwYyDtkLxumznMS1q+m9sy+gY4Kfag3tnzcJHyjUN
-yfWf5P+Sjdx0+qAVOnAHd+2estdu5g==
+MIIEkzCCAvugAwIBAgIRAJQIOW0DsoWpmhRIS6qVTMkwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
+bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
+UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDGNj/3rcpjgu8GZHg1AS8lAEy8tbg73+9YRPJs
+IAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrYyW1vNb0ANWPGVd6ReqtJm0wt
+plfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfnHHtwoj649Vw3CjAIRXufB9dD
+EPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj2yhVeXqXC7s8y9HCKSa08tBO
+e3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJF8Vk9ilA+PXL37CIaTkdJOsX
+doacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFpag1LWs/nAgMBAAGjgZcwgZQw
+DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAf
+BgNVHSMEGDAWgBRMfF45cY0dizvyML/k08KmEEPhkjBCBgNVHREEOzA5gglsb2Nh
+bGhvc3SCFGhvc3QuZG9ja2VyLmludGVybmFshwR/AAABhxAAAAAAAAAAAAAAAAAA
+AAABMA0GCSqGSIb3DQEBCwUAA4IBgQBiim9kFNYL81xP6MHNJe2erc3IrpCCn7IC
+WfrhqIz89o/2gYIWqwlc7IWA+y13btUAkaXVDZvZMoFMKbvUcF89OpO8G+4XpbX4
+uu9Q5pC3cjnFymO8xTRNgOam6yySLbjwzZwQIZ/0hh9xCeQ64tlw/a4VT6+UJrYn
+SNTPI38f/MwCFkyr4vCkCUIOIwTRfDc2BwHu1CJ820Hu3Jpr10CRzBOvsDJlDg8c
+vcmbdo+jsqEFMNIZpTblZA+MALRq4eK6Bas3YQcqIGjo+lxx9eYCGzZH1ygS/K5X
+501rBpLJ4OklIVTFWuo5IVwJ9RWMPgX3htl3HzpGztEV8nB9LEjKl9Lmm7xPb8+n
+ytycvckVyFe5JtejNtiB+9v0jNyqvEe2B7hdGfSLchuCv0a3xsocnayxnJChKtqI
+vo022s1k9k7wwJ2Qeq49HfK3yY00SgXYpUljKHLZocisYBxHmNbegzSBa2x7RU+k
+YexHKXvwNHdkVNOTs9LgER0EexdK+AM=
 -----END CERTIFICATE-----
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+lo6n5aZe8uIP
-zdC2RhQWTplDAr3jQPVYUgVWCsIGnmPGKZf8Zn04wHFV285Erp8MRQ1S9XGWr2jO
-X0RS5RfU4+wPIcWhPwsK9xq/VKgIhYETEGW9QsZAnZKsOnYLF8fDeU33BIoxvAhI
-ioUmExVQ+nGvLYBNBfHOevBEtQlccp6MQJi3nTTRmLdyMgkqMOnPGFKLljnHH9xM
-7oaC9DZ7mIJtIcCCQdlgiZRCQB3GGmwzHQwgFoSkNpDaIeIVee+i9yPc5eePYIZx
-q2cxoY3B5/AIDUb2WrH4GkrbcXQgIj6rb3NiiSTunxt1Hvmw37TJN5/fyGfl6QkQ
-+4M5wVW3AgMBAAECggEAMiun+gK2PSBq6gYf/xuLhiPCrKU4H26mJ03QIcpLMTrY
-wP2KCONh62KdcyCdt+7P54b17vS1phke2dSyQ7ATCfPF3GXjhIL4ATbzT5KVeUjL
-pZ0Xay78yV2xkq0BDgKAj7CLGY+UYWtCMvZj/pXfcqW674Zm09/Qu64ZObz+bds5
-cCrGyhpj1pXZJNBwfaJg82VwWIdytwcFdRwtgywiUJOZ+ldcnJU13f3HjxERpYYA
-zSvNi63bkBEMnj844p9MMsqwb5r8/lZQRvI2K6dW/dRa8xmQKi00AjtPOZMly1Re
-07brcVTmav2jYhZp9PxZUiRMmCdzEnhLtsynaYWVoQKBgQDGQxJeQncM12GuV1Oo
-nHJwRyICzB6DJ8nmErpK0a/zvIiQxUD+/qPVzTDI9C5lBWWPniGjdv57Nb0on1l3
-zp9MPzZrzLBTYyFT5nPBLyhcrRyd0Acz0MeB8p/UwErBP4JsJsjfuSB/Pa9YmbgV
-4GtWQ8khV05vhtivtR3xZl+RRQKBgQD2F2DQjfEuq4tD08v1JiBQQLM+Yw3k0tSe
-f4HFlbOHtPGEHbzrt3eD6fOhJmkVEkQcde4h22+oHpKff/5h0iiW5N4NUrIoL4WN
-34ZHIcpo+gjcdzrLF9fytzLbaaSpDApVVhcRX3JinwKpCp9G4y06KKKRV5EhW4MM
-+1kdZbzUywKBgEG/GkdB2ULb5duvv+FpSBXtsNymnfO2bSCr0zVehe/Y9Jy1nREy
-llgfPG9Xck8z0/MlaFhR7KAlOP5QoZW2YmMhj0V+UnbEp9ev03Eb11GsYpH+23SW
-ZqK0N8aQofmluvVsgy6VsK4hYZWLHF281zt7LSauUidv20mhUTWtUkHVAoGBAJUa
-fRJfri30yiCChyU1wIZfbTrzkUt/YkvWPa6VkX076Ml/qyO2ubc3XOHa//hAZPxJ
-h8sDxZc7TuNNDbf/OZCTgubXoBIxGN5o/FbE5nrMY+oQY5MCE1mAHlRKofW60df6
-nWdtSUTvyxDY2sB8jL6cOEOPpuNrKvAGqmvhZJQZAoGBAJOR7QEbU7L5rWEHDs2z
-QU8ry3y9stbt/ViP/RE63jLcxP5RG7LueDRYsNSdY0WA8wbJ6WNElo3EvxMurmmn
-jkjuhbcFgDFZ5W6cjjG8kDytIHcH73xbZLjqmN/NfsSW211HudkembKfQ4G6llPu
-dZpM5PgCoeFawQ1SnC+CSmcR
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDGNj/3rcpjgu8G
+ZHg1AS8lAEy8tbg73+9YRPJsIAytaCmoQYbRZncrWa9hWT0568DGSWbHye4+ZFrY
+yW1vNb0ANWPGVd6ReqtJm0wtplfcyzbgGN4EIYgHEUjFvVfDg6fHdV5K8z6UGGfn
+HHtwoj649Vw3CjAIRXufB9dDEPAZoh2NKp+EEQiNlX8+oNIMGYmGP6QAh1l/RCrj
+2yhVeXqXC7s8y9HCKSa08tBOe3AzHfWrcksVC2HugR6+/KjinOowlL4GwtpQ9clJ
+F8Vk9ilA+PXL37CIaTkdJOsXdoacEC84NpeSyQYf8g4q5uHDTEc4kg5NQ04TizFp
+ag1LWs/nAgMBAAECggEBAJBcqrJFzYY0sspBGpvgROn6EenPoGNbcgMkFDxUC2ew
+2cZGE18n9duI8odAa6tn3XuNsmII3JBsnw4NhrrctM8WE5k8qWHjqiVuCkmlQZD6
+IPmOowT3Nw+OsyXyBZ3MocJP5WFJUGakb+iPgghC4tPrQEKGFP2xPZxSJaIfEABa
+HgSYTSr+n8lJUKdld00BNSWXBxsVQ8NAw/5AFjFP4R3TeCwbd34lpMpkLvOax05j
+xbdZr0MP03MT8PYMBRzqMcST0OR7bK8vyAnB/ezxhrnQaMV2NeHpisB3UbNFi+PT
+63tNV/S2hCOGDZ5V+jFQ6FRyUw1gOlJK/EMGLIEt3kECgYEA1gMXqlp5w0OIBBkS
+MbhY2LhVO0v3LBHtRCqFbKGdA3yrHrsq/YJKlJbEoiw9mWGgYq7h0jNAsvI/WLgo
+tm4AUxRdG9YZDqNEcfcODnLqFg5D7/abSXx+An3pwZ+fQgL8STGu9up/Xl1Sss1T
+JHBEOM+vqb7TQxPPvl77SUHUwX8CgYEA7RmVO6PEepnJuMGYgG9Au5SMkcFY5iK5
+AqlEHio097+KsQ+K4nxW8yvtNoXnSBsfX3t78vI6zjSeFgk/MhoVUGLKIQTwq6KO
+WvASeB1zIzSkfXISznMs/CxGMt9FODvM9PCJMpeFAvJNDn83vupo0oxagu+EUVoF
+eGoqNEMMVZkCgYEAgx+d7lhE5miH+8rIpQIIHbDDN/ORW8UYFH3hBe/3Xd2Skt+m
+tXCQ9X1yuNJWY5W3SP9RiRKx/3IBcgBToYLAXCbL7XQ+IgPSuejfCedKmXzgDzSP
+bHUEV86B3IpKb42YudfhFZQTueN/+eFnoZnPkudc/6nVkvGehUt4tyfIjU0CgYAP
+PebHB7cYvowmMWPRVdWOeXUz5X8GhFLqZeE4IzR2fLy4tywRdTbNuRQtvhvpGb1B
+kRmdu46mNOG4vu1uFhkqqr8dskiab//AvtAhIpuFNtwgKFYnKWZJ67qziIDVpZp+
+YHwhYXYug08K0IjP4BfO+TDUW/tgk23omMKPy4OeeQKBgQCiKzdHtUO6KujjueYX
+lbDVbdEiXYbGzKcMmE0E/DK73xXpXT/CQ+tjB3nZKHDwkTN6h9ZZYzjhRWmHRlRh
+WqGqmWr4D3I0B9jnxCTpDuZIlJ21G336RbsZD8yi+eyMwJXN4csItGSlMig04jvo
+5vTIN0D0uXAvDD23TEcilpQzcA==
 -----END PRIVATE KEY-----
@@ -1,29 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIE8zCCA1ugAwIBAgIQTrUnODKCVekcQa56Q2OQzTANBgkqhkiG9w0BAQsFADCB
-kTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMM
-MW1rY2VydCBhbGVrc2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5r
-bykwHhcNMjIxMjA1MDgxNzA0WhcNMzIxMjA1MDgxNzA0WjCBkTEeMBwGA1UEChMV
-bWtjZXJ0IGRldmVsb3BtZW50IENBMTMwMQYDVQQLDCphbGVrc2lAUHJvYm9vay5s
-b2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykxOjA4BgNVBAMMMW1rY2VydCBhbGVr
-c2lAUHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggGiMA0GCSqG
-SIb3DQEBAQUAA4IBjwAwggGKAoIBgQCgLa+u4TDI3iPESTdOpaSO3C1zN4Kx+AwV
-6y5MQHs3tQUx5jDdo66wDXkcSIv2xQERbbQSmpTy1rbarN2fq5H4KvgTTQZkpYbt
-ho9sziZjMlAUD1VP7Xo0FkgXK20z+t1i7b5DSuZ8oOGTFxwL67qZwkTP5VKHstEm
-tLiVgNnmNBsGtxZxpkj8zG8Emn7LSS0DpaKAgxeoyDqkMkpU834+sHdqfTbCfWLA
-J8ClkJv4gjR8iXswBl9Gr0j3fOcWNCTOZz0Rn8k6aEUyFnQBSQ5ENN5X44QoXeB9
-Xvh0c0T3tC8M3LLXW6i/LioeHjnQ8tlHl8p8SC+ICz22mrAiMHl2ALVE3qJGd15R
-4Ni0RGL743URQG2r38WzzVqJ/cZHCfi66eCNSMfeP0XOG5UtJUl0Ko6FwKd7bRY4
-BgT6dvxSsCXT2wMyr+Lf4nTkRwKmdJ7PpiG/67fq8b9Jy/1TUK9Y+8F0dyCrDo1O
-iHNfnngVtcCJSS1WmxEY+zPkPir0pykCAwEAAaNFMEMwDgYDVR0PAQH/BAQDAgIE
-MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFKrDcJcU9cWHA3BoHNr90+ch
-Ut2qMA0GCSqGSIb3DQEBCwUAA4IBgQAeM0iseib1sINK9rlZs2sp4ueg8l/oRr1O
-Jqqlgt8MnF948HM0XDneiqXpKDRjmcNTgFocHEDnGfGObiyqjnOfgdu7+q/pDzkH
-wAnWUc3zQPS2Z4tvy0SFVlZSl1RDgOA8tjt4MyoZLJII+y3O6N/Y9Lu/kCkYzdnQ
-GeiYKYS1CiZ5CfUvuL4uQihdUBIBol7OY2S7/udbmEqBUMw6xOZ7j8DMx5p9BGs/
-zWVCrIYDihHOdSbDb0Dy4cKc12l8YvabzxpUvIte5l7V8/7jLgv0mBAaY1mz6LeT
-xStnsUVL1qUwiUT4LLXc57HT/j4AAWZLW4lvQGSVfDLvpudT9tHJzlizAfJ3XQcq
-3wc5VxUiWi98W63yzX+jDgpdGi9qZwnuTR9oukWkquNJcq7zGl6bgwg15cfnsKwd
-918cPTZ7bhpH2JqiaTcUSXfYm6fOSPGTG3JqKE7R8zyOeITJAM+F19fmmROy3iRE
-h9CGy7MtERq0izVN39Nv/7fEQYISpck=
+MIIE9DCCA1ygAwIBAgIRAKmp4Hngu2VSn3W3/HbqhhcwDQYJKoZIhvcNAQELBQAw
+gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
+DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
+a28pMB4XDTI1MDQyNDA2Mjg1MFoXDTM1MDQyNDA2Mjg1MFowgZExHjAcBgNVBAoT
+FW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxla3NpQFByb2Jvb2su
+bG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQDDDFta2NlcnQgYWxl
+a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMIIBojANBgkq
+hkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAw/ZCWaFBwUs1uiVu5vwfx7CJKL10EvH7
+rBJfUnDMoK/AYUzAhvVumi1WDmT4TnVG4MSQ/Ep5RV5HsidT8Sz75NB5Vu6rRyD1
+4BVgR0R4WnyE4XQ7QX/eFvuAL1ToRWwqUtKLPaeYN1v+Xvi7HSeiwS1fPYnZ60mt
+SpTOUn3c2EptKwHSZF5g5nrlX0RNEWiqZLW8zy49psDF57883DTOOvDvreH75zRy
+jbaz2zXHdERct/zdnAOqPu5D/dT7Oi6ubtbqpp6Ytd0SYASf1DkMc+pq5ta1ZL6j
+hs9x6a2X/INYwjXIH+TVqhW6VLR15ieT960dFeJOU2kRRDoOoFegOR5DlLgXyt4c
+fap053vL5qbctAWKV0q/4oF4TNRh+9iAXm70HSfPvA8CYv2QIanmsAKlFxkw4lSY
+kh2Gycbi2te8AjA8IYYo++DJiy5Y23NWYswZv/qtnZDymaYc3zVooriCie270iiN
+Dwysl3saSQL2m2C6VimLJZy8CqyCt3HTAgMBAAGjRTBDMA4GA1UdDwEB/wQEAwIC
+BDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRMfF45cY0dizvyML/k08Km
+EEPhkjANBgkqhkiG9w0BAQsFAAOCAYEAKSq6dmHItnF8C4yWP6i08BHAmhqmGo/Q
+PvgnnDjNMMX888dJ+cDSTi4r6ukPsjmCj16XZ2RNg2v2nYzO4S6qjuW3vPOGBugG
+lCanj0AOZVcZY+te2z8hTxwLDVaRGTm9Tw8jEmjtiNwpChnkIBqAjlHbJZpHpjzv
+khusNY8KKH0I/uMBQfIOMKf8fBvu2k8wYlyW1pwwgmVDWbiTv3tU9px7Lh7WSd3w
+NFTC+xGAsl+tR7Z/UZB9FcI522IZm6A5LsTp4JfsQ4deUdU7iV36cqTrxG6A59BL
+P/BS711oUlei3ORBloFhSXGKVPHqHu1jGGnpIFyQx6uS/0v1M6FN5wmZxAN+YVmO
+7B7ttS3mN3PpALJIy+/P/EjtwVqzX+2HdJ+zo3JIHqtIQunBWAeeCZpltn3yd/35
+MCa9RG7ftdfVrh2SwdZkR/bhKlgbelZ4EoxHXBiJxwZwVY8rJx/n2Bp+fp7crjhC
+ZTscssX+5FbczWgIqzG5vmNescyM4XE3
 -----END CERTIFICATE-----
@@ -1,40 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQCgLa+u4TDI3iPE
-STdOpaSO3C1zN4Kx+AwV6y5MQHs3tQUx5jDdo66wDXkcSIv2xQERbbQSmpTy1rba
-rN2fq5H4KvgTTQZkpYbtho9sziZjMlAUD1VP7Xo0FkgXK20z+t1i7b5DSuZ8oOGT
-FxwL67qZwkTP5VKHstEmtLiVgNnmNBsGtxZxpkj8zG8Emn7LSS0DpaKAgxeoyDqk
-MkpU834+sHdqfTbCfWLAJ8ClkJv4gjR8iXswBl9Gr0j3fOcWNCTOZz0Rn8k6aEUy
-FnQBSQ5ENN5X44QoXeB9Xvh0c0T3tC8M3LLXW6i/LioeHjnQ8tlHl8p8SC+ICz22
-mrAiMHl2ALVE3qJGd15R4Ni0RGL743URQG2r38WzzVqJ/cZHCfi66eCNSMfeP0XO
-G5UtJUl0Ko6FwKd7bRY4BgT6dvxSsCXT2wMyr+Lf4nTkRwKmdJ7PpiG/67fq8b9J
-y/1TUK9Y+8F0dyCrDo1OiHNfnngVtcCJSS1WmxEY+zPkPir0pykCAwEAAQKCAYBH
-A1oy/vVA6HMU75zMilVFXMntnbucqSq6gPSaq6+1B9UQxUv+xzWIKcD60BL1SWvq
-zScbZFsKujSBCEiNJGRnkK1A6VIfRt9l6NUnWNHeAo1MB2w8Lj2SYBp/4ynb9Kk3
-1c0XSlqbADxhmMo/YrfsuRsGzFVlgdqF/XMkHOb9zzX4KS2THzSWlw/VC6WQ/JUv
-W7yKmxPfKT4OU5luxjC/HD8k//RKD4q7RCR9gnoTl64rVExAA2M0FDwWNNLCnkTL
-iMJVZY8JzGawJr97sMMJ1vKCPyAJIKS/Qv/K49BT01pb08dsgUR0LSwr+e+E8jNL
-f8WBlDD4maHSovztqWeR7Gnczv0WTjIzn+UpiUUmAmBVDjeidXH/NsP01NJUyhPa
-HlKJBCfNbtFNWZkliwMu2Yq5cZnOFFHb3O+3FhyZc7c46np3EdQOJwX+jVgjaaT/
-aQYMTNib0nrVkoliM4vNxH8lNhKZlsPzSXLlr9mAWXa/+iK3HiXmWO6jENRIFq0C
-gcEAzL/2kp8MjbQrKyFrmF9hNQ7e6/ObadgjGwjGAliIlVRwC38lc5tdFbthRQpt
-VfAunRimh2LI+8SBiJnigFa8IezgPkNVuOlopYwcOHTdm//NcAmNH5f5aan99QJS
-IYnD3txvZgKT4kBW8Amt3MdYbBrXJmnDz5AA0ofqJH7XfycIsXuUb8RGML3xi87M
-9Fw81lXsOqag/sAwmTybN0C69iypDTOLEU+LfHd5JYs908JRbSkWfvGozKik9ZHR
-G9IfAoHBAMhFqS0x4Vejs0mZSdXkcdqFbN5eAeNj0+xVuscCbv4ir2QQS9xUqYmy
-gHKbHKASSUXyQ2iKoEdVrvPD0XWQbBbZ0Hx61zdGo9SdDItU4pvZ+jpXsQrmnmxV
-0e3DOKQpkEDJJKVFwVvF/Z/LqK0Zm1aPVjcLXn9t5BAQbATfAlprJF8JziJiNJDy
-csjtuR7wGsXQRWdbnqg3hn6/upl8WtPHhMwew/Cgf8WGYXi0fcqOFyfjjWq+Lu0Y
-lTkqQ54ttwKBwQCGn9VtVHx5k7QqmL/ZISWWMF/svnE6Z+21MdCX7ERqA2nkdUZX
-vBi5WEo9jfyT2+eaTYH5VL+Xov4UpjHidqUenVRYPAfaHEY9S2Gm0ViA4PHgL7eF
-xXQtwKMFfPApsx6Bo2jvptQ7mFhRXdveZYhDFGbQkAw6ppGT29/c/TWOGklCAWJ5
-FpGcLNfsOB5UsW0i9L3tVnBW8GFD8DCSZNJJWNYSowhWannpbdjPEb2mRYcqgjCT
-aSu23VARUz4tz7sCgcAzvrPwZnPntfcr6/xE1IqKQHEZn0ZznyZxaNEifEF7TjDs
-9Lz1B7bqSgGgGu2xeigOd4LtLuwsojna59xluNQEr3CLyR10Pb80vwMvuNX4GMDr
-dB7dRyrlqOLdwNQQrmCELLRYM4a7FJPsRq2lU/lrywsmm7xlxlnnwKZ4N7qe7BHw
-sFLfVWppjQsVWT68fKMeOyrDgsuigP4yH42x/IxnLaTlLInJ0V5SBd+HVXMu87mN
-5+BxFQSA5BoiNAZWh08CgcAriIjqFrqxLEPJZQxmTIB3ZrCiaG27Df9AskFdCCR0
-k+zBNVqQUCVSbJHTwn/hQ/eaQk2DQoGZEfYptGaKaTulhwA17WvmDKdkR2rJrtGk
-6KD54eM3x6spwmk0bNf52d7ATOVqKOTUFZkFjuH7TYM8Mq1QiyUjQK8U7yJz3C8g
-7vc5UB8grPTMHKcmmHD1OUfldVSkHOkpWsPPCE7MQIKE8/Pd+Mw+yEJu2RjTTk4i
-7/buVacrwTZs6HZc8WXXQMA=
-----END PRIVATE KEY-----
@@ -1,27 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEiTCCAvGgAwIBAgIRAIudq+AfKl856muWz/i3yLkwDQYJKoZIhvcNAQELBQAw
+MIIEiTCCAvGgAwIBAgIRAMa57BhiUa7ds8bjquZeuGwwDQYJKoZIhvcNAQELBQAw
 gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
 a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
 DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
-a28pMB4XDTIyMTIxMDA3MTgwNVoXDTI1MDMxMDA3MTgwNVowXjEnMCUGA1UEChMe
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
 bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
 UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQCv9ohL1csSCSPGrQrXhcBrsuQH5w9OskV68cpn
-8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQDWLpWRSnNXjuSa9Y+uti7JCa
-SEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6UeslrCYFxMI9z/o1ucl/h7Ti+iRV
-pbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60dM04MEzJmJECTZCoQ5iSz+bL
-aOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/AmnojD0S3RKwRMlNGJOWers5ExYix
-DWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1l2ye7/tZAgMBAAGjgY0wgYow
+DQEBAQUAA4IBDwAwggEKAoIBAQDBYwQjUTxzptQQJQl5bSSkK8bCA6wAnuzk3lOi
+h0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCmcCJMA8+nZuvJSTdGeYMYF8Ca
+eBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20IZ4LBcC6dBalox8/iUcZHQpRm
+Rejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlEZ/fDiYwQC0z0JJaG/+3OQG1p
+gRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb/99oPLUDL7QcEqQ0yETGTx2i
+jVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q25TvoE0AtAgMBAAGjgY0wgYow
 DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
-FKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
+FEx8XjlxjR2LO/Iwv+TTwqYQQ+GSMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
 dC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
-hvcNAQELBQADggGBAFRfs4mj3CnK43sdCUd30K6ILhTIii2Mjb+olCUmOrR3Gka6
-J3LLEOdvanFpHDpx3wcxHe6YKuBpDAqTkwB/4LuOA0hHyLsV3O+U+QMgNuTvpAWq
-BgB0xs02mXIvcIYmTOI100Nh9SYULNuohZo4Jtw9+noLMc3xIKlEUCKqDjEu26mp
-N9hKkFd4Qf8hs0j4UFNFfZC7qOzTyX1XGd0roGlNFc9Pm/bjo2hW1PgI3wa72Cux
-FXul8NoKUyBYZ0xnUjeXc5akfpxl7cywqOorKXRk2xikr388R5fuAoeBnQK/unr5
-AUOuAVG0zfLheRed46Op5cF7KJmc66OgPFYcgMAdYIwiy+LXZcXmCCuVU+t0WX4S
-2zJ52HcfOHp+ius0FJwYgZ0G0SiVnj0tbxqLj1kBRK3qyyIEWaTdXTjYeotWbDzh
-0BrtGxzft7ploi2CfpSh1vPhTWWoAvtr4I/sHmV91yDLY3PUU/ywoCCk2JCWmBvh
-8ytaa2MFPzdWI6t9Bw==
+hvcNAQELBQADggGBAMOYUQen1PpG34YcmdSNIO62/GFSNR0CID8R+1lvqZFyiaeA
+HTUhDfWVopY8KuqzgXgXE2nAxLf6WSa0kIJOUIE7eLU5zMBW/rLcoa6UxhT2nXjh
+gd7d2PPLSXE/ZBMkoXeQVuZVImywT7haNI0tee3ariIbXeaiaLP6NBlnFva50Tkn
+qKeQpV5UPDQcEvChDtWSvsPkb9yp1CcavBEEJ8XZwgIbV4qKB0z2Q812wsPadpXE
+VLy8KwYhjxBVJyAEH3qpiZH5N+nTnQwu3slWCIck5cskpXGPBX+WIY4nS/4y+idX
+EhnwowfDewWGum58sdUYdyUpdC7NTw4AoZ42y9PcgXu8/qhLr0N0n5/Slmlxe7oN
+zOQfOZduv8oOLW0GuccqGEPwDManU995syDOmqZbBuBt590E2Pid3dwtr/0kyLax
+SyAACTQi7Q0WUPfFj13jCqGU5z99Y6W7RudUg/+snCxiSvc+x/wphjmnGO73X9+p
+uH5dRdyAeGHFw9e2kQ==
 -----END CERTIFICATE-----
@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCv9ohL1csSCSPG
-rQrXhcBrsuQH5w9OskV68cpn8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQ
-DWLpWRSnNXjuSa9Y+uti7JCaSEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6Uesl
-rCYFxMI9z/o1ucl/h7Ti+iRVpbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60
-dM04MEzJmJECTZCoQ5iSz+bLaOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/Amnoj
-D0S3RKwRMlNGJOWers5ExYixDWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1
-l2ye7/tZAgMBAAECggEBAKVMZds/moV12orfscim2A0UPwyBbarS41xMWYTshMNK
-nQpQhQ+iqzeFuaPq+I8eW+ZkEZBxZqtxTXh8qsdkrHcrT1AiHjvrc0Y5ztlwPNdZ
-mee2Dy7bhVbrlbxOxQeUePBeVWok/oU0gT6hihJvNL2Wa4ke34AS/sUekRV4F98A
-nujWss06lvIv0RqivhFDuYBdGuteygcMyHjCwZj597KQAjoo+p5nvN3DJJ5C/bcq
-dwmRSbKMmauv1tnMl9h8EsZUFM89x2xrCtXEzSzV6ZCe32TF7DimDGhNlCkiVnoC
-Ohzz6eYZzEYfRQTMQT5s3jix24C8Wc6wOYyDGjdjQmUCgYEA1Y+Ju+mLYnhF6xKm
-XOvMGgna16E33LVJessTY3gy1+MZtfvHm3Op+xkGmOAjoVXTk/za5yuDOZf5CR0/
-slY1N/PolZ6/K++ObqIOBBYYt1jE1FX3sGM8tJEIwgq6UCItCxDWPxHOG+ZHRtvx
-v+4A1v7/2PtaYOTiGMGmsbP5RxcCgYEA0u5KKO7fWZG6PSy/kD6LGx68t8nviCY4
-POrG171jir7Rs00qi3PNpln2qzgcnkJdOxpKv/VfDcxZgb42kAVN4O/xeqti/k/4
-YCUfXL2VmQE6T/slBkzhRAKpBLZOf49Awwh3JTutfeCL2MB9JiCHbzrObO5g3MgC
-92L5I6C0Vw8CgYEAl95MV0o8qdjX99Q6ZEf2y+mIK+FlBVoSF/WEIy9eELJaHVUg
-XIbDMWJZk6uJCvkqzcl5rfz+g510JqwbGOo/TDvygTvzvP3NbxVlHDjOeMvypQFB
-c7kOeWXOMZdJaST0nTLq+Mzjoml+9IACibdp93o9XQNaAR+jPXGw5hwTQB8CgYBW
-DmYvQRXawzvKjaEyRnIWhHnWOgsB7yXupJKvnlMoXiXME2WSM5LplbavsFrsroK/
-BEEPBBrd1EuIRYSZSbC2Xu6Ub6wZuaLKBxs+iRKps/iIfRxj76XQS42NoJtyK43u
-hFun0ys7OguUSSRGE+ttk/54LuFR8kBTkgu3X290PQKBgF8s/Fx3akNCpgjG8at3
-U+Edmb3wLVckAiYIDHksnreowdJB4yR/05QDbgGYTrRhppEMuHmsN1geYfQmNa3b
-GAlSvv4H5YK4QrUUJZTcBXBFneMdZK67bohfbRkQIwSm5u0xLDUVoD3UhSz26Pu3
-b1anKvC576arrZ8pewyW2kp1
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBYwQjUTxzptQQ
+JQl5bSSkK8bCA6wAnuzk3lOih0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCm
+cCJMA8+nZuvJSTdGeYMYF8CaeBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20I
+Z4LBcC6dBalox8/iUcZHQpRmRejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlE
+Z/fDiYwQC0z0JJaG/+3OQG1pgRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb
+/99oPLUDL7QcEqQ0yETGTx2ijVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q2
+5TvoE0AtAgMBAAECggEBAJWdVGM6g0l6hVBkRxsxbIqy75fEnXrxeZdrxkrU2jsQ
+avcRNI5qXaHCvPlfayH8RMe+85ihGUrpKn2J/Y7P2ATMZJka0u/sLJckMTeQsw8V
+88mdkhMjdiryIz+JGQe1c/cVVwhSfhibLRC2fHvJndaPvcw54kRXPc593S/u4E3X
+uc5pyoPkiyon4AzQ3piVTRrdtQRyyT1UDJ+lRyTBLuWcM50H4O50VliIrk2HVxGA
+dfL8tnYOGnW7l12xCa6OoT03/qOBS1yPd8vXFAmnbEzbzvAEIDXC0GXQ5CPHOsFu
+ZnviDmjt2I/OSygBqnaxCuE0cMgIvI7zf2ie43Onu4UCgYEA0STl3mC80lSg8Ddo
+qGj+uPck3aOtUtI0ni94rM4YwgqDakm1aMDtVbivg3F9HLjDPxCe+iyQFOvjJ+uR
+KEdp5zFmS3Sf9lB0PymCbeAicRJA6ku+9GxbYk9VNWkxrNozDn4iolio41xjZSZ4
+iXHBh/s2xeZeGfW65/MOJMjvk/cCgYEA7LZh6ueBrBJkMf3imcmz7cfEkUyzioyM
+3Gz8JMNINPsb8QTYLaAog0m7eQ6FVZB0lIQV9V+pTzbhCxSbAryL7aOr7vKmFlgb
+tB5YqsdYHGftZAqwJzFNorAA2Yh5Z5H1+xAB3i4uB4lHwIC1Sl79vor7tccvGFPK
+hWX8Mz82+/sCgYAmI3NjpQJp3JLom0ITi+n/ctofLMzbkIeV3RRFduPe5qnmRQC2
+1I+zFRW0g4qMJUk9g9tpxZyUpBttWTDERpmSVljQI7lT4oIATqKBROEi+3ApCZ0N
+14Cmoc7pCYDMg5HR78CDGGXb6Cob9PMAJWVkVbQ8THEWjNADojgPDzFZKwKBgGGN
+tIL7z9wbZEGaEUYx8z4+gwsioieqTu8U10FLXbm/9z74MSN0it24iFOWoWqm8vS2
+DtqmBv/HbS2E23FgRQa12kjKpZo1y40KqJ4RM4XZauM86GXuksFGacM81FPTup0y
+dqKbQ4sFj5WNNamlxks9ugirQwRym9coNazlE4L7AoGBAMaeWaVaRbFu+jgscPud
+k5J27o9zH8CS+xngOYEjGFpdR/52ZMhpQOrtFJX0mCOi9vpAQ5Ro0kk1HMPH0mGU
+5b75OUy6SBfnYR7mw7imc85bP+lQoe8kmb+wrIJMYx9RGGbDatDFbxCEasqNzvFf
+VQXTnh0brizumpbOfHlZXced
 -----END PRIVATE KEY-----
@@ -1,55 +1,55 @@
 -----BEGIN CERTIFICATE-----
-MIIEiTCCAvGgAwIBAgIRAIudq+AfKl856muWz/i3yLkwDQYJKoZIhvcNAQELBQAw
+MIIEiTCCAvGgAwIBAgIRAMa57BhiUa7ds8bjquZeuGwwDQYJKoZIhvcNAQELBQAw
 gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqYWxl
 a3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVua28pMTowOAYDVQQD
 DDFta2NlcnQgYWxla3NpQFByb2Jvb2subG9jYWwgKEFsZXhleSBQYWxhemhjaGVu
-a28pMB4XDTIyMTIxMDA3MTgwNVoXDTI1MDMxMDA3MTgwNVowXjEnMCUGA1UEChMe
+a28pMB4XDTI1MDQyNDA2Mjg1NVoXDTI3MDcyNDA2Mjg1NVowXjEnMCUGA1UEChMe
 bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCphbGVrc2lA
 UHJvYm9vay5sb2NhbCAoQWxleGV5IFBhbGF6aGNoZW5rbykwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQCv9ohL1csSCSPGrQrXhcBrsuQH5w9OskV68cpn
-8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQDWLpWRSnNXjuSa9Y+uti7JCa
-SEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6UeslrCYFxMI9z/o1ucl/h7Ti+iRV
-pbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60dM04MEzJmJECTZCoQ5iSz+bL
-aOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/AmnojD0S3RKwRMlNGJOWers5ExYix
-DWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1l2ye7/tZAgMBAAGjgY0wgYow
+DQEBAQUAA4IBDwAwggEKAoIBAQDBYwQjUTxzptQQJQl5bSSkK8bCA6wAnuzk3lOi
+h0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCmcCJMA8+nZuvJSTdGeYMYF8Ca
+eBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20IZ4LBcC6dBalox8/iUcZHQpRm
+Rejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlEZ/fDiYwQC0z0JJaG/+3OQG1p
+gRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb/99oPLUDL7QcEqQ0yETGTx2i
+jVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q25TvoE0AtAgMBAAGjgY0wgYow
 DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
-FKrDcJcU9cWHA3BoHNr90+chUt2qMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
+FEx8XjlxjR2LO/Iwv+TTwqYQQ+GSMEIGA1UdEQQ7MDmCCWxvY2FsaG9zdIIUaG9z
 dC5kb2NrZXIuaW50ZXJuYWyHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
-hvcNAQELBQADggGBAFRfs4mj3CnK43sdCUd30K6ILhTIii2Mjb+olCUmOrR3Gka6
-J3LLEOdvanFpHDpx3wcxHe6YKuBpDAqTkwB/4LuOA0hHyLsV3O+U+QMgNuTvpAWq
-BgB0xs02mXIvcIYmTOI100Nh9SYULNuohZo4Jtw9+noLMc3xIKlEUCKqDjEu26mp
-N9hKkFd4Qf8hs0j4UFNFfZC7qOzTyX1XGd0roGlNFc9Pm/bjo2hW1PgI3wa72Cux
-FXul8NoKUyBYZ0xnUjeXc5akfpxl7cywqOorKXRk2xikr388R5fuAoeBnQK/unr5
-AUOuAVG0zfLheRed46Op5cF7KJmc66OgPFYcgMAdYIwiy+LXZcXmCCuVU+t0WX4S
-2zJ52HcfOHp+ius0FJwYgZ0G0SiVnj0tbxqLj1kBRK3qyyIEWaTdXTjYeotWbDzh
-0BrtGxzft7ploi2CfpSh1vPhTWWoAvtr4I/sHmV91yDLY3PUU/ywoCCk2JCWmBvh
-8ytaa2MFPzdWI6t9Bw==
+hvcNAQELBQADggGBAMOYUQen1PpG34YcmdSNIO62/GFSNR0CID8R+1lvqZFyiaeA
+HTUhDfWVopY8KuqzgXgXE2nAxLf6WSa0kIJOUIE7eLU5zMBW/rLcoa6UxhT2nXjh
+gd7d2PPLSXE/ZBMkoXeQVuZVImywT7haNI0tee3ariIbXeaiaLP6NBlnFva50Tkn
+qKeQpV5UPDQcEvChDtWSvsPkb9yp1CcavBEEJ8XZwgIbV4qKB0z2Q812wsPadpXE
+VLy8KwYhjxBVJyAEH3qpiZH5N+nTnQwu3slWCIck5cskpXGPBX+WIY4nS/4y+idX
+EhnwowfDewWGum58sdUYdyUpdC7NTw4AoZ42y9PcgXu8/qhLr0N0n5/Slmlxe7oN
+zOQfOZduv8oOLW0GuccqGEPwDManU995syDOmqZbBuBt590E2Pid3dwtr/0kyLax
+SyAACTQi7Q0WUPfFj13jCqGU5z99Y6W7RudUg/+snCxiSvc+x/wphjmnGO73X9+p
+uH5dRdyAeGHFw9e2kQ==
 -----END CERTIFICATE-----
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCv9ohL1csSCSPG
-rQrXhcBrsuQH5w9OskV68cpn8E49cofnAeGN462G5Fk98GRfBNLXQOwBXA4KpzjQ
-DWLpWRSnNXjuSa9Y+uti7JCaSEVS668euY891vFT2IQyf9ZPr5DYp/t6VPz6Uesl
-rCYFxMI9z/o1ucl/h7Ti+iRVpbbaeO6K5kR9/XMC/0kDFS1ORmdC25gFDENpje60
-dM04MEzJmJECTZCoQ5iSz+bLaOt0LmxIgrCN7yH/kjpC64PXWwrUIylMYq/Amnoj
-D0S3RKwRMlNGJOWers5ExYixDWZ83BGZiZCJqLxExl7vyiz2D84xdNbWWXJBjQF1
-l2ye7/tZAgMBAAECggEBAKVMZds/moV12orfscim2A0UPwyBbarS41xMWYTshMNK
-nQpQhQ+iqzeFuaPq+I8eW+ZkEZBxZqtxTXh8qsdkrHcrT1AiHjvrc0Y5ztlwPNdZ
-mee2Dy7bhVbrlbxOxQeUePBeVWok/oU0gT6hihJvNL2Wa4ke34AS/sUekRV4F98A
-nujWss06lvIv0RqivhFDuYBdGuteygcMyHjCwZj597KQAjoo+p5nvN3DJJ5C/bcq
-dwmRSbKMmauv1tnMl9h8EsZUFM89x2xrCtXEzSzV6ZCe32TF7DimDGhNlCkiVnoC
-Ohzz6eYZzEYfRQTMQT5s3jix24C8Wc6wOYyDGjdjQmUCgYEA1Y+Ju+mLYnhF6xKm
-XOvMGgna16E33LVJessTY3gy1+MZtfvHm3Op+xkGmOAjoVXTk/za5yuDOZf5CR0/
-slY1N/PolZ6/K++ObqIOBBYYt1jE1FX3sGM8tJEIwgq6UCItCxDWPxHOG+ZHRtvx
-v+4A1v7/2PtaYOTiGMGmsbP5RxcCgYEA0u5KKO7fWZG6PSy/kD6LGx68t8nviCY4
-POrG171jir7Rs00qi3PNpln2qzgcnkJdOxpKv/VfDcxZgb42kAVN4O/xeqti/k/4
-YCUfXL2VmQE6T/slBkzhRAKpBLZOf49Awwh3JTutfeCL2MB9JiCHbzrObO5g3MgC
-92L5I6C0Vw8CgYEAl95MV0o8qdjX99Q6ZEf2y+mIK+FlBVoSF/WEIy9eELJaHVUg
-XIbDMWJZk6uJCvkqzcl5rfz+g510JqwbGOo/TDvygTvzvP3NbxVlHDjOeMvypQFB
-c7kOeWXOMZdJaST0nTLq+Mzjoml+9IACibdp93o9XQNaAR+jPXGw5hwTQB8CgYBW
-DmYvQRXawzvKjaEyRnIWhHnWOgsB7yXupJKvnlMoXiXME2WSM5LplbavsFrsroK/
-BEEPBBrd1EuIRYSZSbC2Xu6Ub6wZuaLKBxs+iRKps/iIfRxj76XQS42NoJtyK43u
-hFun0ys7OguUSSRGE+ttk/54LuFR8kBTkgu3X290PQKBgF8s/Fx3akNCpgjG8at3
-U+Edmb3wLVckAiYIDHksnreowdJB4yR/05QDbgGYTrRhppEMuHmsN1geYfQmNa3b
-GAlSvv4H5YK4QrUUJZTcBXBFneMdZK67bohfbRkQIwSm5u0xLDUVoD3UhSz26Pu3
-b1anKvC576arrZ8pewyW2kp1
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDBYwQjUTxzptQQ
+JQl5bSSkK8bCA6wAnuzk3lOih0Szk463wSsPpDWPf/NgxsB3HP2ANUtGCdCcKxCm
+cCJMA8+nZuvJSTdGeYMYF8CaeBGRyQK1ifucZp9o0F+oK02cx36v/BzjhCEyn20I
+Z4LBcC6dBalox8/iUcZHQpRmRejo07KrLSws8w/T21Lk7GURnHWZej+dicukxZlE
+Z/fDiYwQC0z0JJaG/+3OQG1pgRqYD6Dn/lnB8DvMZfW+EV/zyjT292WgHr9NQ+Yb
+/99oPLUDL7QcEqQ0yETGTx2ijVlN8A3DM0gwlWD7TYXorc6bTQeDiG6vJk+I11Q2
+5TvoE0AtAgMBAAECggEBAJWdVGM6g0l6hVBkRxsxbIqy75fEnXrxeZdrxkrU2jsQ
+avcRNI5qXaHCvPlfayH8RMe+85ihGUrpKn2J/Y7P2ATMZJka0u/sLJckMTeQsw8V
+88mdkhMjdiryIz+JGQe1c/cVVwhSfhibLRC2fHvJndaPvcw54kRXPc593S/u4E3X
+uc5pyoPkiyon4AzQ3piVTRrdtQRyyT1UDJ+lRyTBLuWcM50H4O50VliIrk2HVxGA
+dfL8tnYOGnW7l12xCa6OoT03/qOBS1yPd8vXFAmnbEzbzvAEIDXC0GXQ5CPHOsFu
+ZnviDmjt2I/OSygBqnaxCuE0cMgIvI7zf2ie43Onu4UCgYEA0STl3mC80lSg8Ddo
+qGj+uPck3aOtUtI0ni94rM4YwgqDakm1aMDtVbivg3F9HLjDPxCe+iyQFOvjJ+uR
+KEdp5zFmS3Sf9lB0PymCbeAicRJA6ku+9GxbYk9VNWkxrNozDn4iolio41xjZSZ4
+iXHBh/s2xeZeGfW65/MOJMjvk/cCgYEA7LZh6ueBrBJkMf3imcmz7cfEkUyzioyM
+3Gz8JMNINPsb8QTYLaAog0m7eQ6FVZB0lIQV9V+pTzbhCxSbAryL7aOr7vKmFlgb
+tB5YqsdYHGftZAqwJzFNorAA2Yh5Z5H1+xAB3i4uB4lHwIC1Sl79vor7tccvGFPK
+hWX8Mz82+/sCgYAmI3NjpQJp3JLom0ITi+n/ctofLMzbkIeV3RRFduPe5qnmRQC2
+1I+zFRW0g4qMJUk9g9tpxZyUpBttWTDERpmSVljQI7lT4oIATqKBROEi+3ApCZ0N
+14Cmoc7pCYDMg5HR78CDGGXb6Cob9PMAJWVkVbQ8THEWjNADojgPDzFZKwKBgGGN
+tIL7z9wbZEGaEUYx8z4+gwsioieqTu8U10FLXbm/9z74MSN0it24iFOWoWqm8vS2
+DtqmBv/HbS2E23FgRQa12kjKpZo1y40KqJ4RM4XZauM86GXuksFGacM81FPTup0y
+dqKbQ4sFj5WNNamlxks9ugirQwRym9coNazlE4L7AoGBAMaeWaVaRbFu+jgscPud
+k5J27o9zH8CS+xngOYEjGFpdR/52ZMhpQOrtFJX0mCOi9vpAQ5Ro0kk1HMPH0mGU
+5b75OUy6SBfnYR7mw7imc85bP+lQoe8kmb+wrIJMYx9RGGbDatDFbxCEasqNzvFf
+VQXTnh0brizumpbOfHlZXced
 -----END PRIVATE KEY-----
@@ -1 +0,0 @@
-FROM citusdata/citus:12.1
@@ -1 +1 @@
-FROM ghcr.io/ferretdb/docusaurus-docs:3.7.0-1
+FROM ghcr.io/ferretdb/docusaurus-docs:3.7.0-4
@@ -1 +1 @@
-FROM ghcr.io/ferretdb/ferretdb-prettier:3.4.2-1
+FROM ghcr.io/ferretdb/ferretdb-prettier:3.6.2-1
@@ -1 +1 @@
-FROM ghcr.io/ferretdb/ferretdb-textlint:14.4.2-1
+FROM ghcr.io/ferretdb/ferretdb-textlint:15.2.0-1
@@ -1 +1 @@
-FROM ghcr.io/ferretdb/ferretdb-wrangler:3.101.0-1
+FROM ghcr.io/ferretdb/ferretdb-wrangler:4.24.0-1
@@ -1 +1 @@
-FROM jaegertracing/all-in-one:1.65.0
+FROM jaegertracing/all-in-one:1.74.0
@@ -1 +1,2 @@
+# TODO https://github.com/FerretDB/FerretDB/issues/5073
 FROM ghcr.io/ferretdb/legacy-mongo-shell:7.0.8-1
@@ -1 +1 @@
-FROM davidanson/markdownlint-cli2:v0.13.0
+FROM davidanson/markdownlint-cli2:v0.18.1
@@ -1 +0,0 @@
-FROM mongo:7.0.8
@@ -0,0 +1,16 @@
+# syntax=docker/dockerfile:1
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5073
+FROM mongo:7.0.8
+
+# If you encounter an "unknown instruction" error there,
+# please update Docker to the latest version.
+
+# see https://github.com/docker-library/mongo/issues/475
+RUN <<EOF
+set -ex
+
+echo 'topsecret' > /etc/mongod_keyfile.txt
+chmod 0400 /etc/mongod_keyfile.txt
+chown 999:999 /etc/mongod_keyfile.txt
+EOF
@@ -1 +0,0 @@
-FROM mysql:8.4.0
@@ -0,0 +1,5 @@
+# Use development image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-0.107.0-ferretdb-2.7.0
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb
@@ -1 +0,0 @@
-FROM postgres:16.4
@@ -1,2 +1,2 @@
-FROM aquasec/trivy:0.58.2
+FROM aquasec/trivy:0.67.2
 WORKDIR /workdir
@@ -0,0 +1 @@
+FROM yugabytedb/yugabyte:2025.1.1.0-b197
@@ -0,0 +1,27 @@
+# Use production image and full tag close to the release.
+FROM --platform=linux/amd64 ghcr.io/ferretdb/postgres-documentdb:17-0.107.0-ferretdb-2.7.0
+
+# Use moving development image during development.
+# FROM --platform=linux/amd64 ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb
+
+RUN --mount=type=cache,target=/var/cache/apt <<EOF
+
+curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
+
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+
+apt update
+apt install -y git-lfs mongodb-mongosh tmux nano
+
+cd /tmp
+curl -OJL https://go.dev/dl/go1.25.4.linux-amd64.tar.gz
+tar -xf go1.25.4.linux-amd64.tar.gz
+rm go1.25.4.linux-amd64.tar.gz
+mv go /usr/local/
+ln -s /usr/local/go/bin/* /usr/local/bin/
+go version
+
+EOF
+
+WORKDIR /ferretdb/build/ferretdb-bw
@@ -0,0 +1,26 @@
+all: ferretdb_loader ferretdb
+
+ferretdb_loader:
+	$(MAKE) -C $@
+
+ferretdb:
+	$(MAKE) -C $@
+
+clean:
+	$(MAKE) -C ferretdb_loader clean
+	$(MAKE) -C ferretdb clean
+
+install:
+	$(MAKE) -C ferretdb_loader install
+	$(MAKE) -C ferretdb install
+
+docker:
+	docker buildx build --builder=ferretdb --tag=ferretdb-bw --load .
+	docker run --platform=linux/amd64 --name=ferretdb-bw --rm -it \
+		-e POSTGRES_USER=username -e POSTGRES_PASSWORD=password -e POSTGRES_DB=postgres \
+		-v $(shell pwd)/../..:/ferretdb ferretdb-bw /bin/bash
+
+docker-exec:
+	docker exec -it ferretdb-bw /bin/bash
+
+.PHONY: all ferretdb_loader ferretdb
@@ -0,0 +1,4 @@
+# FerretDB as a PostgreSQL background worker
+
+Not supported.
+Do not use yet.
@@ -0,0 +1,21 @@
+GO ?= $(shell which go)
+PG_CONFIG ?= pg_config
+PG_INCLUDE := $(shell $(PG_CONFIG) --includedir-server)
+PG_PKGLIB := $(shell $(PG_CONFIG) --pkglibdir)
+INSTALL_BIN = $(shell which install)
+
+CGO_CFLAGS ?= "-I$(PG_INCLUDE) -Wno-implicit-function-declaration"
+CGO_LDFLAGS ?= "-shared"
+
+object = ferretdb.so
+
+all: $(object)
+
+$(object): ferretdb.go
+	CGO_CFLAGS=$(CGO_CFLAGS) CGO_LDFLAGS=$(CGO_LDFLAGS) $(GO) build -v -tags=ferretdb_bw -buildmode=c-shared -o $@ .
+
+install: $(object)
+	$(INSTALL_BIN) -c -m 755 $(object) $(PG_PKGLIB)
+
+clean:
+	rm -f $(object)
@@ -0,0 +1,77 @@
+// Copyright 2021 FerretDB Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build ferretdb_bw
+
+package main
+
+/*
+#include "postgres.h"
+*/
+import "C"
+
+import (
+	"context"
+	"log"
+	"log/slog"
+	"os"
+
+	"github.com/FerretDB/FerretDB/v2/build/version"
+	"github.com/FerretDB/FerretDB/v2/ferretdb"
+	"github.com/FerretDB/FerretDB/v2/internal/util/ctxutil"
+)
+
+//export BackgroundWorkerMain
+func BackgroundWorkerMain(args C.Datum) {
+	log.SetPrefix("ferretdb: ")
+	log.SetFlags(0)
+
+	ctx, stop := ctxutil.SigTerm(context.Background())
+	defer stop()
+
+	f, err := ferretdb.New(&ferretdb.Config{
+		// TODO https://github.com/FerretDB/FerretDB/issues/4771
+		PostgreSQLURL: "postgres://username:password@127.0.0.1:5432/postgres",
+		ListenAddr:    "127.0.0.1:27017",
+		StateDir:      ".",
+		LogLevel:      slog.LevelDebug,
+		LogOutput:     os.Stderr,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	version.Get().Package = "extension"
+
+	done := make(chan struct{})
+
+	// Use WaitLatch, ResetLatch, and WL_POSTMASTER_DEATH to check if `postmaster` process died and call stop().
+	// TODO https://github.com/FerretDB/FerretDB/issues/4771
+
+	go func() {
+		f.Run(ctx)
+		close(done)
+	}()
+
+	uri := f.MongoDBURI()
+	log.Printf("Running at %s", uri)
+
+	<-done
+
+	return
+}
+
+func main() {
+	panic("not reached")
+}
@@ -0,0 +1,86 @@
+/* Code generated by cmd/cgo; DO NOT EDIT. */
+
+/* package github.com/FerretDB/FerretDB/v2/build/ferretdb-bw/ferretdb */
+
+
+#line 1 "cgo-builtin-export-prolog"
+
+#include <stddef.h>
+
+#ifndef GO_CGO_EXPORT_PROLOGUE_H
+#define GO_CGO_EXPORT_PROLOGUE_H
+
+#ifndef GO_CGO_GOSTRING_TYPEDEF
+typedef struct { const char *p; ptrdiff_t n; } _GoString_;
+#endif
+
+#endif
+
+/* Start of preamble from import "C" comments.  */
+
+
+#line 3 "ferretdb.go"
+
+#include "postgres.h"
+
+#line 1 "cgo-generated-wrapper"
+
+
+/* End of preamble from import "C" comments.  */
+
+
+/* Start of boilerplate cgo prologue.  */
+#line 1 "cgo-gcc-export-header-prolog"
+
+#ifndef GO_CGO_PROLOGUE_H
+#define GO_CGO_PROLOGUE_H
+
+typedef signed char GoInt8;
+typedef unsigned char GoUint8;
+typedef short GoInt16;
+typedef unsigned short GoUint16;
+typedef int GoInt32;
+typedef unsigned int GoUint32;
+typedef long long GoInt64;
+typedef unsigned long long GoUint64;
+typedef GoInt64 GoInt;
+typedef GoUint64 GoUint;
+typedef size_t GoUintptr;
+typedef float GoFloat32;
+typedef double GoFloat64;
+#ifdef _MSC_VER
+#include <complex.h>
+typedef _Fcomplex GoComplex64;
+typedef _Dcomplex GoComplex128;
+#else
+typedef float _Complex GoComplex64;
+typedef double _Complex GoComplex128;
+#endif
+
+/*
+  static assertion to make sure the file is being used on architecture
+  at least with matching size of GoInt.
+*/
+typedef char _check_for_64_bit_pointer_matching_GoInt[sizeof(void*)==64/8 ? 1:-1];
+
+#ifndef GO_CGO_GOSTRING_TYPEDEF
+typedef _GoString_ GoString;
+#endif
+typedef void *GoMap;
+typedef void *GoChan;
+typedef struct { void *t; void *v; } GoInterface;
+typedef struct { void *data; GoInt len; GoInt cap; } GoSlice;
+
+#endif
+
+/* End of boilerplate cgo prologue.  */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern void BackgroundWorkerMain(Datum args);
+
+#ifdef __cplusplus
+}
+#endif
@@ -0,0 +1,4 @@
+MODULES = ferretdb_loader
+PG_CONFIG ?= pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)
@@ -0,0 +1,53 @@
+#include <dlfcn.h>
+#include "postgres.h"
+#include "pgstat.h"
+#include "postmaster/bgworker.h"
+#include "storage/ipc.h"
+#include "storage/latch.h"
+#include "storage/proc.h"
+#include "miscadmin.h"
+#include "utils/elog.h"
+#include "fmgr.h"
+
+PG_MODULE_MAGIC;
+
+static char *ferretdb_so = "ferretdb.so";
+
+PGDLLEXPORT void background_main(Datum main_arg);
+
+void background_main(Datum main_arg)
+{
+    bgworker_main_type f;
+    char *path;
+    void *h;
+
+    BackgroundWorkerUnblockSignals();
+
+    path = (char *)palloc(strlen(pkglib_path) + 1 + strlen(ferretdb_so) + 1);
+    join_path_components(path, pkglib_path, ferretdb_so);
+    elog(LOG, "ferretdb_loader: loading '%s'", path);
+
+    h = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
+    pfree(path);
+
+    f = (bgworker_main_type)dlsym(h, "BackgroundWorkerMain");
+    f(main_arg);
+
+    dlclose(h);
+    proc_exit(0);
+}
+
+void _PG_init(void)
+{
+    BackgroundWorker worker;
+    MemSet(&worker, 0, sizeof(BackgroundWorker));
+
+    snprintf(worker.bgw_name, BGW_MAXLEN, "FerretDBLoader");
+    worker.bgw_flags = BGWORKER_SHMEM_ACCESS;
+    worker.bgw_start_time = BgWorkerStart_RecoveryFinished;
+    worker.bgw_restart_time = BGW_NEVER_RESTART;
+    snprintf(worker.bgw_library_name, BGW_MAXLEN, "ferretdb_loader");
+    snprintf(worker.bgw_function_name, BGW_MAXLEN, "background_main");
+
+    RegisterBackgroundWorker(&worker);
+}
@@ -9,9 +9,9 @@ ExecStart=/usr/bin/ferretdb
 Restart=on-failure

 # Configure the FerretDB service with `systemctl edit ferretdb`.
-# For more configuration options check https://docs.ferretdb.io/v1.24/configuration/flags/
+# For more configuration options check https://docs.ferretdb.io/configuration/flags/

-Environment="FERRETDB_POSTGRESQL_URL=postgres://127.0.0.1:5432/ferretdb"
+Environment="FERRETDB_POSTGRESQL_URL=postgres://127.0.0.1:5432/postgres"

 [Install]
 WantedBy=multi-user.target
@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-exec /usr/bin/runsvdir /etc/service
@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-exec /ferretdb
@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-exec /usr/local/bin/docker-entrypoint.sh postgres
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1

-# for development releases (`ferret-dev` image)
+# for development releases (`ferretdb-dev` image)

 # While we already know commit and version from commit.txt and version.txt inside image,
 # it is not possible to use them in LABELs for the final image.
@@ -12,9 +12,10 @@ ARG LABEL_COMMIT

 # prepare stage

-FROM --platform=$BUILDPLATFORM golang:1.23.5 AS development-prepare
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS development-prepare

-# use a single directory for all Go caches to simpliy RUN --mount commands below
+# use a single directory for all Go caches to simplify RUN --mount commands below
 ENV GOPATH=/cache/gopath
 ENV GOCACHE=/cache/gocache
 ENV GOMODCACHE=/cache/gomodcache
@@ -36,10 +37,10 @@ EOF

 # build stage

-FROM golang:1.23.5 AS development-build
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS development-build

 ARG TARGETARCH
-ARG TARGETVARIANT

 ARG LABEL_VERSION
 ARG LABEL_COMMIT
@@ -66,18 +67,15 @@ set -ex

 git status

-# Do not raise it without providing a separate v1 build
-# because v2+ is problematic for some virtualization platforms and older hardware.
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
 export GOAMD64=v1
-
-# Set GOARM explicitly due to https://github.com/docker-library/golang/issues/494.
-export GOARM=${TARGETVARIANT#v}
+export GOARM64=v8.0

 export CGO_ENABLED=1

 # Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
 # (and that happens on GitHub-hosted Actions runners).
-# Also disable it on arm/v6 and arm/v7 because it is not supported there.
 RACE=false
 if test "$TARGETARCH" = "amd64"
 then
@@ -91,7 +89,7 @@ go env
 # check if stdlib was cached
 go install -v -race=$RACE std

-go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_debug -coverpkg=./... ./cmd/ferretdb
+go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_dev -coverpkg=./... ./cmd/ferretdb

 go version -m bin/ferretdb
 bin/ferretdb --version
@@ -107,7 +105,8 @@ COPY --from=development-build /src/bin/ferretdb /ferretdb

 # final stage

-FROM golang:1.23.5 AS development
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS development

 ENV GOCOVERDIR=/tmp/cover
 ENV GORACE=halt_on_error=1,history_size=2
@@ -116,7 +115,7 @@ RUN mkdir /tmp/cover

 COPY --from=development-build /src/bin/ferretdb /ferretdb

-ENTRYPOINT ["/ferretdb"]
+ENTRYPOINT [ "/ferretdb" ]

 HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
  CMD ["/ferretdb", "ping"]
@@ -130,17 +129,15 @@ ENV FERRETDB_LISTEN_ADDR=:27017
 # ENV FERRETDB_LISTEN_TLS=:27018
 ENV FERRETDB_DEBUG_ADDR=:8088
 ENV FERRETDB_STATE_DIR=/state
-ENV FERRETDB_SQLITE_URL=file:/state/

 ARG LABEL_VERSION
 ARG LABEL_COMMIT

 # TODO https://github.com/FerretDB/FerretDB/issues/2212
-LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (development image)"
 LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
 LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
-LABEL org.opencontainers.image.title="FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (development image)"
 LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
 LABEL org.opencontainers.image.vendor="FerretDB Inc."
 LABEL org.opencontainers.image.version="${LABEL_VERSION}"
@@ -1,8 +1,6 @@
 # syntax=docker/dockerfile:1

-# Dockerfile for all-in-one releases (`all-in-one` image).
-# It always uses native compilation with race detector
-# because packages are only available for amd64 and arm64 anyway.
+# evaluation image with development release (`ferretdb-eval-dev` image)

 # While we already know commit and version from commit.txt and version.txt inside image,
 # it is not possible to use them in LABELs for the final image.
@@ -14,9 +12,10 @@ ARG LABEL_COMMIT

 # prepare stage

-FROM --platform=$BUILDPLATFORM golang:1.23.5 AS all-in-one-prepare
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS eval-dev-prepare

-# use a single directory for all Go caches to simpliy RUN --mount commands below
+# use a single directory for all Go caches to simplify RUN --mount commands below
 ENV GOPATH=/cache/gopath
 ENV GOCACHE=/cache/gocache
 ENV GOMODCACHE=/cache/gomodcache
@@ -38,7 +37,8 @@ EOF

 # build stage

-FROM golang:1.23.5 AS all-in-one-build
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS eval-dev-build

 ARG TARGETARCH

@@ -60,24 +60,22 @@ WORKDIR /src
 COPY . .

 # to add a dependency
-COPY --from=all-in-one-prepare /src/go.mod /src/go.sum /src/
+COPY --from=eval-dev-prepare /src/go.mod /src/go.sum /src/

 RUN --mount=type=cache,target=/cache <<EOF
 set -ex

 git status

-# Do not raise it without providing a separate v1 build
-# because v2+ is problematic for some virtualization platforms and older hardware.
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
 export GOAMD64=v1
-
-# GOARM is not set because it is ignored for arm64
+export GOARM64=v8.0

 export CGO_ENABLED=1

 # Disable race detector on arm64 due to https://github.com/golang/go/issues/29948
 # (and that happens on GitHub-hosted Actions runners).
-# Also disable it on arm/v6 and arm/v7 because it is not supported there.
 RACE=false
 if test "$TARGETARCH" = "amd64"
 then
@@ -91,7 +89,7 @@ go env
 # check if stdlib was cached
 go install -v -race=$RACE std

-go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_debug -coverpkg=./... ./cmd/ferretdb
+go build -v -o=bin/ferretdb -race=$RACE -tags=ferretdb_dev -coverpkg=./... ./cmd/ferretdb

 go version -m bin/ferretdb
 bin/ferretdb --version
@@ -100,66 +98,52 @@ EOF

 # final stage

-FROM postgres:16.4 AS all-in-one
+# Use development image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-0.107.0-ferretdb-2.7.0 AS eval-dev

-COPY --from=all-in-one-build /src/bin/ferretdb /ferretdb
-
-ENV GOCOVERDIR=/tmp/cover
-ENV GORACE=halt_on_error=1,history_size=2
-
-RUN mkdir /tmp/cover
-
-# all-in-one hacks start there
-
-COPY --from=all-in-one-build /src/build/ferretdb/all-in-one/ferretdb.sh /etc/service/ferretdb/run
-COPY --from=all-in-one-build /src/build/ferretdb/all-in-one/postgresql.sh /etc/service/postgresql/run
-COPY --from=all-in-one-build /src/build/ferretdb/all-in-one/entrypoint.sh /entrypoint.sh
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb AS eval-dev

 RUN --mount=type=cache,sharing=locked,target=/var/cache/apt <<EOF
-set -ex
-
-apt update
-apt install -y curl runit sqlite3
-
+apt install -y curl supervisor
 curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
 echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
 apt update
 apt install -y mongodb-mongosh
+
+mkdir /tmp/cover
 EOF

-ENV FERRETDB_POSTGRESQL_URL=postgres://username:password@127.0.0.1:5432/ferretdb
-ENV POSTGRES_USER=username
-ENV POSTGRES_PASSWORD=password
-ENV POSTGRES_DB=ferretdb
+COPY --from=eval-dev-build /src/bin/ferretdb /usr/local/bin/ferretdb

-STOPSIGNAL SIGHUP
-ENTRYPOINT ["/entrypoint.sh"]
+COPY --from=eval-dev-build /src/build/ferretdb/evaluation/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY --from=eval-dev-build /src/build/ferretdb/evaluation/entrypoint.sh /usr/local/bin/entrypoint.sh

-# all-in-one hacks stop there
+ENTRYPOINT ["entrypoint.sh"]

 HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
-  CMD ["/ferretdb", "ping"]
+  CMD ["/usr/local/bin/ferretdb", "ping"]

-WORKDIR /
 VOLUME /state
 EXPOSE 27017 27018 8088

+ENV GOCOVERDIR=/tmp/cover
+ENV GORACE=halt_on_error=1,history_size=2
+
 # don't forget to update documentation if you change defaults
 ENV FERRETDB_LISTEN_ADDR=:27017
 # ENV FERRETDB_LISTEN_TLS=:27018
 ENV FERRETDB_DEBUG_ADDR=:8088
 ENV FERRETDB_STATE_DIR=/state
-ENV FERRETDB_SQLITE_URL=file:/state/

 ARG LABEL_VERSION
 ARG LABEL_COMMIT

 # TODO https://github.com/FerretDB/FerretDB/issues/2212
-LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (evaluation development image)"
 LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
 LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
-LABEL org.opencontainers.image.title="FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (evaluation development image)"
 LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
 LABEL org.opencontainers.image.vendor="FerretDB Inc."
 LABEL org.opencontainers.image.version="${LABEL_VERSION}"
@@ -0,0 +1,136 @@
+# syntax=docker/dockerfile:1
+
+# evaluation image (formerly "all-in-one") with production release (`ferretdb-eval` image)
+
+# While we already know commit and version from commit.txt and version.txt inside image,
+# it is not possible to use them in LABELs for the final image.
+# We need to pass them as build arguments.
+# Defining ARGs there makes them global.
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+
+# prepare stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS eval-prepare
+
+# use a single directory for all Go caches to simplify RUN --mount commands below
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# remove ",direct"
+ENV GOPROXY=https://proxy.golang.org
+
+COPY go.mod go.sum /src/
+
+WORKDIR /src
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+go mod download
+go mod verify
+EOF
+
+
+# build stage
+
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS eval-build
+
+ARG TARGETARCH
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+RUN test -n "$LABEL_VERSION"
+RUN test -n "$LABEL_COMMIT"
+
+# use the same directories for Go caches as above
+ENV GOPATH=/cache/gopath
+ENV GOCACHE=/cache/gocache
+ENV GOMODCACHE=/cache/gomodcache
+
+# modules are already downloaded
+ENV GOPROXY=off
+
+# see .dockerignore
+WORKDIR /src
+COPY . .
+
+# to add a dependency
+COPY --from=eval-prepare /src/go.mod /src/go.sum /src/
+
+RUN --mount=type=cache,target=/cache <<EOF
+set -ex
+
+git status
+
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
+export GOAMD64=v1
+export GOARM64=v8.0
+
+export CGO_ENABLED=0
+
+go env
+
+# Trim paths mostly to check that building with `-trimpath` is supported.
+
+# check if stdlib was cached
+go install -v -trimpath std
+
+go build -v -trimpath -o=bin/ferretdb ./cmd/ferretdb
+
+go version -m bin/ferretdb
+bin/ferretdb --version
+EOF
+
+
+# final stage
+
+# Use production image and full tag close to the release.
+FROM ghcr.io/ferretdb/postgres-documentdb:17-0.107.0-ferretdb-2.7.0 AS eval
+
+# Use moving development image during development.
+# FROM ghcr.io/ferretdb/postgres-documentdb-dev:17-ferretdb AS eval
+
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt <<EOF
+apt install -y curl supervisor
+curl -L https://pgp.mongodb.com/server-7.0.asc | apt-key add -
+echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/7.0 main" | tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+apt update
+apt install -y mongodb-mongosh
+EOF
+
+COPY --from=eval-build /src/bin/ferretdb /usr/local/bin/ferretdb
+
+COPY --from=eval-build /src/build/ferretdb/evaluation/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY --from=eval-build /src/build/ferretdb/evaluation/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["entrypoint.sh"]
+
+HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
+  CMD ["/usr/local/bin/ferretdb", "ping"]
+
+VOLUME /state
+EXPOSE 27017 27018 8088
+
+# don't forget to update documentation if you change defaults
+ENV FERRETDB_LISTEN_ADDR=:27017
+# ENV FERRETDB_LISTEN_TLS=:27018
+ENV FERRETDB_DEBUG_ADDR=:8088
+ENV FERRETDB_STATE_DIR=/state
+
+ARG LABEL_VERSION
+ARG LABEL_COMMIT
+
+# TODO https://github.com/FerretDB/FerretDB/issues/2212
+LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative (evaluation image)"
+LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
+LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
+LABEL org.opencontainers.image.title="FerretDB (evaluation image)"
+LABEL org.opencontainers.image.url="https://www.ferretdb.com/"
+LABEL org.opencontainers.image.vendor="FerretDB Inc."
+LABEL org.opencontainers.image.version="${LABEL_VERSION}"
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "$POSTGRES_PASSWORD" ]; then
+    echo "Error: POSTGRES_PASSWORD must be set. See https://docs.ferretdb.io/installation/evaluation/"
+    exit 1
+fi
+
+if [ "${POSTGRES_DB:-postgres}" != "postgres" ]; then
+    echo "Error: POSTGRES_DB must be set to 'postgres' or unset. See https://docs.ferretdb.io/installation/evaluation/"
+    exit 1
+fi
+
+# prevent unset POSTGRES_DB using the value of POSTGRES_USER, see https://hub.docker.com/_/postgres
+export POSTGRES_DB="postgres"
+
+export FERRETDB_POSTGRESQL_URL="postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@127.0.0.1:5432/${POSTGRES_DB}"
+
+exec /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
@@ -0,0 +1,24 @@
+; https://supervisord.org/configuration.html#supervisord-section-values
+[supervisord]
+nodaemon=true
+loglevel=info
+logfile=/dev/stderr
+logfile_maxbytes=0
+
+; https://supervisord.org/configuration.html#program-x-section-values
+[program:postgres]
+command=/usr/local/bin/docker-entrypoint.sh postgres
+; lower priority postgres starts before ferretdb (default priority 999)
+priority=1
+; fast shutdown https://www.postgresql.org/docs/current/server-shutdown.html
+stopsignal=INT
+stdout_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+redirect_stderr=true
+
+; https://supervisord.org/configuration.html#program-x-section-values
+[program:ferretdb]
+command=/usr/local/bin/ferretdb
+stdout_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+redirect_stderr=true
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1

-# for production releases (`ferret` image)
+# for production releases (`ferretdb` image)

 # While we already know commit and version from commit.txt and version.txt inside image,
 # it is not possible to use them in LABELs for the final image.
@@ -12,9 +12,10 @@ ARG LABEL_COMMIT

 # prepare stage

-FROM --platform=$BUILDPLATFORM golang:1.23.5 AS production-prepare
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM --platform=$BUILDPLATFORM golang:1.25.4-bookworm AS production-prepare

-# use a single directory for all Go caches to simpliy RUN --mount commands below
+# use a single directory for all Go caches to simplify RUN --mount commands below
 ENV GOPATH=/cache/gopath
 ENV GOCACHE=/cache/gocache
 ENV GOMODCACHE=/cache/gomodcache
@@ -36,10 +37,10 @@ EOF

 # build stage

-FROM golang:1.23.5 AS production-build
+# TODO https://github.com/FerretDB/FerretDB/issues/5449
+FROM golang:1.25.4-bookworm AS production-build

 ARG TARGETARCH
-ARG TARGETVARIANT

 ARG LABEL_VERSION
 ARG LABEL_COMMIT
@@ -66,12 +67,10 @@ set -ex

 git status

-# Do not raise it without providing a separate v1 build
-# because v2+ is problematic for some virtualization platforms and older hardware.
+# Do not raise without providing separate builds with those values
+# because higher versions are problematic for some virtualization platforms and older hardware.
 export GOAMD64=v1
-
-# Set GOARM explicitly due to https://github.com/docker-library/golang/issues/494.
-export GOARM=${TARGETVARIANT#v}
+export GOARM64=v8.0

 export CGO_ENABLED=0

@@ -108,7 +107,7 @@ USER ferretdb:ferretdb
 COPY --from=production-build /src/bin/ferretdb /ferretdb
 COPY --from=production-build --chown=ferretdb:ferretdb /state /state

-ENTRYPOINT ["/ferretdb"]
+ENTRYPOINT [ "/ferretdb" ]

 HEALTHCHECK --interval=1m --timeout=5s --retries=1 --start-period=30s --start-interval=5s \
  CMD ["/ferretdb", "ping"]
@@ -122,14 +121,12 @@ ENV FERRETDB_LISTEN_ADDR=:27017
 # ENV FERRETDB_LISTEN_TLS=:27018
 ENV FERRETDB_DEBUG_ADDR=:8088
 ENV FERRETDB_STATE_DIR=/state
-ENV FERRETDB_SQLITE_URL=file:/state/

 ARG LABEL_VERSION
 ARG LABEL_COMMIT

 # TODO https://github.com/FerretDB/FerretDB/issues/2212
 LABEL org.opencontainers.image.description="A truly Open Source MongoDB alternative"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
 LABEL org.opencontainers.image.revision="${LABEL_COMMIT}"
 LABEL org.opencontainers.image.source="https://github.com/FerretDB/FerretDB"
 LABEL org.opencontainers.image.title="FerretDB"
@@ -1,26 +0,0 @@
-// Copy to test.js and run with `task testjs`.
-
-(function () {
-  "use strict";
-
-  const coll = db.test;
-
-  coll.drop();
-
-  const init = [
-    { _id: "double", v: 42.13 },
-    { _id: "double-whole", v: 42.0 },
-    { _id: "double-zero", v: 0.0 },
-  ];
-
-  coll.insertMany(init);
-
-  const query = { v: { $gt: 42.0 } };
-
-  const expected = [{ _id: "double", v: 42.13 }];
-
-  const actual = coll.find(query).toArray();
-  assert.eq(expected, actual);
-
-  print("test.js passed!");
-})();
@@ -3,5 +3,26 @@
 (function () {
  "use strict";

+  // Update the following example with your test.
+
+  const coll = db.test;
+
+  coll.drop();
+
+  const init = [
+    { _id: "double", v: 42.13 },
+    { _id: "double-whole", v: 42.0 },
+    { _id: "double-zero", v: 0.0 },
+  ];
+
+  coll.insertMany(init);
+
+  const query = { v: { $gt: 42.0 } };
+
+  const expected = [{ _id: "double", v: 42.13 }];
+
+  const actual = coll.find(query).toArray();
+  assert.eq(expected, actual);
+
  print("test.js passed!");
 })();
@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "FerretDB": {
+      "type": "remote",
+      "url": "http://127.0.0.1:8081/mcp"
+    }
+  }
+}
@@ -0,0 +1,16 @@
+setParameter:
+  enableTestCommands: 1 # for sleep
+
+net:
+  port: 47017 # matches host's port for replica set to work
+  bindIpAll: true
+  tls:
+    mode: disabled
+
+security:
+  authorization: enabled
+  keyFile: /etc/mongod_keyfile.txt
+
+replication:
+  oplogSizeMB: 512
+  replSetName: rs0
@@ -1,12 +1,11 @@
+setParameter:
+  enableTestCommands: 1 # for sleep
+
 net:
-  port: 47017 # matches host's port for replica set to work
+  port: 37017 # matches host's port for replica set to work
  bindIpAll: true
  tls:
    mode: disabled

 security:
  authorization: disabled
-
-replication:
-  oplogSizeMB: 512
-  replSetName: rs0
@@ -1,16 +0,0 @@
-net:
-  port: 47018 # matches host's port for replica set to work
-  bindIpAll: true
-  tls:
-    mode: requireTLS
-    certificateKeyFile: /etc/certs/server.pem
-    CAFile: /etc/certs/rootCA-cert.pem
-    clusterFile: /etc/certs/client.pem
-
-security:
-  authorization: enabled # that also enables authentication
-  clusterAuthMode: x509
-
-replication:
-  oplogSizeMB: 512
-  replSetName: rs0
@@ -0,0 +1,17 @@
+-- Please do not merge changes in this file.
+
+-- See https://pgtap.org/documentation.html#usingpgtap.
+
+-- Start transaction and plan the tests.
+BEGIN;
+SELECT plan(1); -- number of test assertions
+
+SET documentdb_core.bsonUseEJson = on;
+
+-- Update the following example with your test.
+
+SELECT pass();
+
+-- Finish the tests and clean up.
+SELECT * FROM finish();
+ROLLBACK;
@@ -15,3 +15,5 @@ scan:
    - .env
    - .envrc
    - build/certs/*.pem
+    - internal/dataapi/api/openapi.json
+    - internal/dataapi/api/openapi-original.json
@@ -0,0 +1,48 @@
+// Copyright 2021 FerretDB Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package version
+
+import "runtime"
+
+const (
+	// DocumentDB is a version of DocumentDB this version of FerretDB is compatible with.
+	DocumentDB = "0.107.0 gitref: HEAD sha:e63835403d buildId:0"
+
+	// DocumentDBURL points to the release page of the DocumentDB version above.
+	DocumentDBURL = "https://github.com/FerretDB/documentdb/releases/tag/v0.107.0-ferretdb-2.7.0"
+)
+
+// DocumentDBSafeToUpdate represents versions of DocumentDB that FerretDB can update.
+var DocumentDBSafeToUpdate = []string{
+	"0.102.0 gitref: HEAD sha:80462f5 buildId:0",    // v2.1.0
+	"0.103.0 gitref: HEAD sha:7514232 buildId:0",    // v2.2.0
+	"0.104.0 gitref: HEAD sha:2045d0e buildId:0",    // v2.3.0, v2.3.1
+	"0.105.0 gitref: HEAD sha:8453d93b buildId:0",   // v2.4.0
+	"0.106.0 gitref: HEAD sha:beb9d25d98 buildId:0", // v2.5.0
+	// FerretDB v2.6.0 wasn't released
+}
+
+// PostgreSQLTest is a version of PostgreSQL used by tests.
+var PostgreSQLTest string
+
+func init() {
+	arch := "x86_64-pc-linux-gnu"
+	if runtime.GOARCH == "arm64" {
+		arch = "aarch64-unknown-linux-gnu"
+	}
+
+	PostgreSQLTest = "PostgreSQL 17.6 (Debian 17.6-2.pgdg12+1) on " + arch + ", " +
+		"compiled by gcc (Debian 12.2.0-14+deb12u1) 12.2.0, 64-bit"
+}
@@ -24,7 +24,7 @@ import (
 	"strings"
 	"sync"

-	"github.com/FerretDB/FerretDB/internal/util/must"
+	"github.com/FerretDB/FerretDB/v2/internal/util/must"
 )

 // runGit runs `git` with given arguments and returns stdout.
@@ -1 +1 @@
-7.0.42
+v7.0.77
@@ -14,7 +14,7 @@

 // Package version provides information about FerretDB version and build configuration.
 //
-// # Required files
+// # Extra files
 //
 // The following generated text files may be present in this (`build/version`) directory during building:
 //   - version.txt (required) contains information about the FerretDB version in a format
@@ -25,46 +25,37 @@
 //
 // # Go build tags
 //
-// The following Go build tags (also known as build constraints) affect all builds of FerretDB,
-// including embedded usage:
+// The following Go build tags (also known as build constraints) affect builds of FerretDB:
 //
-//	ferretdb_debug			- enables debug build (see below; implied by builds with race detector)
-//	ferretdb_hana			- enables Hana backend (alpha)
-//	ferretdb_no_postgresql	- disables PostgreSQL backend
-//	ferretdb_no_sqlite		- disables SQLite backend
+//	ferretdb_dev - enables development build (see below; implied by builds with race detector)
 //
-// # Debug builds
+// # Development builds
 //
-// Debug builds of FerretDB behave differently in a few aspects:
-//   - Some values that are normally randomized are fixed or less randomized to make debugging easier.
-//   - Some internal errors cause crashes instead of being handled more gracefully.
-//   - Stack traces are collected more liberally.
-//   - Metrics are written to stderr on exit.
-//   - The default logging level is set to debug.
-//
-// Debug builds are orthogonal to production releases, development releases, and local/host builds.
-// For example, the host build could be made non-debug, and the production release, in theory, could be a debug build.
-//
-// Currently, our production releases are non-debug builds,
-// and all other builds and releases (development releases, all-in-one releases, local builds, etc.) are debug builds.
+// Development builds of FerretDB behave differently in a few aspects:
+//   - they are significantly slower;
+//   - some values that are normally randomized are fixed or less randomized to make debugging easier;
+//   - some internal errors cause crashes instead of being handled more gracefully;
+//   - stack traces are collected more liberally;
+//   - metrics are written to stderr on exit;
+//   - the default logging level is set to debug.
 package version

 import (
 	"embed"
 	"fmt"
 	"regexp"
-	"runtime/debug"
+	"runtime"
+	runtimedebug "runtime/debug"
 	"strconv"
 	"strings"

-	"github.com/FerretDB/FerretDB/internal/types"
-	"github.com/FerretDB/FerretDB/internal/util/debugbuild"
-	"github.com/FerretDB/FerretDB/internal/util/must"
+	"github.com/FerretDB/FerretDB/v2/internal/util/devbuild"
+	"github.com/FerretDB/FerretDB/v2/internal/util/must"
 )

 // Each pattern in a //go:embed line must match at least one file or non-empty directory,
-// but most files are generated and are not present when embeddable FerretDB package is used.
-// As a workaround, mongodb.txt is always present.
+// but most files are generated and may be absent (for example, when embeddable package is being used).
+// As a workaround, mongodb.txt is always present and stored in the repository / Go module.

 //go:generate go run ./generate.go

@@ -80,14 +71,14 @@ type Info struct {
 	Branch           string
 	Dirty            bool
 	Package          string
-	DebugBuild       bool
-	BuildEnvironment *types.Document
+	DevBuild         bool
+	BuildEnvironment map[string]string

 	// MongoDBVersion is fake MongoDB version for clients that check major.minor to adjust their behavior.
 	MongoDBVersion string

 	// MongoDBVersionArray is MongoDBVersion, but as an array.
-	MongoDBVersionArray *types.Array
+	MongoDBVersionArray [4]int32
 }

 // info singleton instance set by init().
@@ -96,90 +87,207 @@ var info *Info
 // unknown is a placeholder for unknown version, commit, and branch values.
 const unknown = "unknown"

+// FerretDB module path from go.mod.
+const ferretdbModule = "github.com/FerretDB/FerretDB/v2"
+
+// semVerTag is a https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string,
+// but with a leading `v`.
+//
+//nolint:lll // for readability
+var semVerTag = regexp.MustCompile(`^v(?P<major>0|[1-9]\d*)\.(?P<minor>0|[1-9]\d*)\.(?P<patch>0|[1-9]\d*)(?:-(?P<prerelease>(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+(?P<buildmetadata>[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`)
+
 // Get returns current build's info.
+//
+// It returns a shared instance without any synchronization.
+// If caller needs to modify the instance, it should make sure there is no concurrent accesses.
 func Get() *Info {
 	return info
 }

-func init() {
-	versionRe := regexp.MustCompile(`^([0-9]+)\.([0-9]+)\.([0-9]+)$`)
+// initFromFiles initializes info from txt files (that might be absent).
+// All info fields are set to non-empty values, but some of them may be unknown.
+func initFromFiles() {
+	mongodbTxt := strings.TrimSpace(string(must.NotFail(gen.ReadFile("mongodb.txt"))))

-	parts := versionRe.FindStringSubmatch(strings.TrimSpace(string(must.NotFail(gen.ReadFile("mongodb.txt")))))
-	if len(parts) != 4 {
+	match := semVerTag.FindStringSubmatch(mongodbTxt)
+	if match == nil || len(match) != semVerTag.NumSubexp()+1 {
 		panic("invalid mongodb.txt")
 	}
-	major := must.NotFail(strconv.ParseInt(parts[1], 10, 32))
-	minor := must.NotFail(strconv.ParseInt(parts[2], 10, 32))
-	patch := must.NotFail(strconv.ParseInt(parts[3], 10, 32))
+
+	major := must.NotFail(strconv.ParseInt(match[semVerTag.SubexpIndex("major")], 10, 32))
+	minor := must.NotFail(strconv.ParseInt(match[semVerTag.SubexpIndex("minor")], 10, 32))
+	patch := must.NotFail(strconv.ParseInt(match[semVerTag.SubexpIndex("patch")], 10, 32))
 	mongoDBVersion := fmt.Sprintf("%d.%d.%d", major, minor, patch)
-	mongoDBVersionArray := must.NotFail(types.NewArray(int32(major), int32(minor), int32(patch), int32(0)))
+	mongoDBVersionArray := [...]int32{int32(major), int32(minor), int32(patch), int32(0)}

 	info = &Info{
-		Version:             unknown,
-		Commit:              unknown,
-		Branch:              unknown,
-		Dirty:               false,
-		Package:             unknown,
-		DebugBuild:          debugbuild.Enabled,
-		BuildEnvironment:    must.NotFail(types.NewDocument()),
+		Version:  unknown,
+		Commit:   unknown,
+		Branch:   unknown,
+		Dirty:    false,
+		Package:  unknown,
+		DevBuild: devbuild.Enabled,
+		BuildEnvironment: map[string]string{
+			"go.runtime": runtime.Version(),
+		},
 		MongoDBVersion:      mongoDBVersion,
 		MongoDBVersionArray: mongoDBVersionArray,
 	}

-	// do not expose extra information when embeddable FerretDB package is used
-	// (and some of it is most likely absent anyway)
-
-	buildInfo, ok := debug.ReadBuildInfo()
-	if !ok {
-		return
-	}
-
-	// TODO https://github.com/FerretDB/FerretDB/issues/4001
-	if buildInfo.Main.Path != "github.com/FerretDB/FerretDB" {
-		return
-	}
-
+	// Those files are present in two cases:
+	// 1. When we are working in the FerretDB repo (building binaries, running integration tests, etc),
+	//    those files are generated by `task gen-version`.
+	// 2. When someone builds the FerretDB binary as described in the package description.
 	for f, sp := range map[string]*string{
 		"version.txt": &info.Version,
 		"commit.txt":  &info.Commit,
 		"branch.txt":  &info.Branch,
 		"package.txt": &info.Package,
 	} {
-		if b, _ := gen.ReadFile(f); len(b) > 0 {
-			*sp = strings.TrimSpace(string(b))
-		}
-	}
-
-	if !strings.HasPrefix(info.Version, "v") {
-		msg := "Invalid build/version/version.txt file content. Please run `bin/task gen-version`.\n"
-		msg += "Alternatively, create this file manually with a content similar to\n"
-		msg += "the output of `git describe`: `v<major>.<minor>.<patch>`.\n"
-		msg += "See https://pkg.go.dev/github.com/FerretDB/FerretDB/build/version"
-		panic(msg)
-	}
-
-	info.BuildEnvironment.Set("go.version", buildInfo.GoVersion)
-
-	for _, s := range buildInfo.Settings {
-		switch s.Key {
-		case "vcs.revision":
-			if s.Value != info.Commit {
-				// for non-official builds
-				if info.Commit == unknown {
-					info.Commit = s.Value
-					continue
-				}
-
-				panic(fmt.Sprintf("commit.txt value %q != vcs.revision value %q\n"+
-					"Please run `bin/task gen-version`", info.Commit, s.Value,
-				))
-			}
-
-		case "vcs.modified":
-			info.Dirty = must.NotFail(strconv.ParseBool(s.Value))
-
-		default:
-			info.BuildEnvironment.Set(s.Key, s.Value)
+		b, _ := gen.ReadFile(f)
+		if s := strings.TrimSpace(string(b)); s != "" {
+			*sp = s
 		}
 	}
 }
+
+// readBuildInfo returns FerretDB version and commit from the build info.
+// It also updates info.BuildEnvironment and info.Dirty when it is sure we are building FerretDB,
+// and not something that uses FerretDB.
+func readBuildInfo() (version, commit string) {
+	// in theory, someone could use embeddable package in a Go program that is built without modules
+	buildInfo, ok := runtimedebug.ReadBuildInfo()
+	if !ok {
+		return
+	}
+
+	info.BuildEnvironment["go.version"] = buildInfo.GoVersion
+
+	// What buildInfo contains depends on what is being built and how.
+	// There are at least five cases:
+	//
+	// 1. Builds and unit tests in the FerretDB repo (task build-host, task test-unit, etc).
+	//      Version is not set even for tags due to https://github.com/golang/go/issues/72877.
+	//    Path: "github.com/FerretDB/FerretDB/v2/cmd/ferretdb"
+	//      (or "github.com/FerretDB/FerretDB/v2/build/version.test", etc)
+	//    Main.Path: "github.com/FerretDB/FerretDB/v2"
+	//    Main.Version: "(devel)"
+	//
+	// 2. Builds with known module version (go install github.com/FerretDB/FerretDB/v2/cmd/ferretdb@v2.0.0).
+	//    Path: "github.com/FerretDB/FerretDB/v2/cmd/ferretdb"
+	//    Main.Path: "github.com/FerretDB/FerretDB/v2"
+	//    Main.Version: "v2.0.0"
+	//
+	// 3. Ad-hoc builds (go run main.go readyz.go --dev-version) due to https://github.com/golang/go/issues/51279.
+	//    Path: "command-line-arguments"
+	//    Main.Path: ""
+	//    Main.Version: ""
+	//    Deps.Path: "github.com/FerretDB/FerretDB/v2"
+	//    Deps.Version: "(devel)"
+	//
+	// 4. Integration tests (both in the test and in the command handler).
+	//    Path: "github.com/FerretDB/FerretDB/v2/integration.test"
+	//    Main.Path: "github.com/FerretDB/FerretDB/v2/integration"
+	//    Main.Version: "(devel)"
+	//    Deps: null
+	//
+	// 5. Embeddable package.
+	//    Path: ???
+	//    Main.Path: ???
+	//    Deps.Path: "github.com/FerretDB/FerretDB/v2"
+	//    Deps.Version: "v2.0.0"
+	//    With replace directive in go.mod:
+	//      Deps.Replace.Path: "../FerretDB"
+	//      Deps.Replace.Version: "(devel)"
+	//
+	// In short, FerretDB version could be derived from the module version only when module version could be known,
+	// which is not often the case. And there are bugs in the Go toolchain that prevent version from being set
+	// even when it is known.
+
+	// cases 1 and 2
+	if buildInfo.Main.Path == ferretdbModule {
+		version = buildInfo.Main.Version
+
+		// in the case 1 even for tags due to https://github.com/golang/go/issues/72877
+		if version == "(devel)" {
+			version = ""
+		}
+
+		for _, s := range buildInfo.Settings {
+			if v := s.Value; v != "" {
+				info.BuildEnvironment[s.Key] = v
+			}
+
+			// both are present only in the case 1
+			switch s.Key {
+			case "vcs.revision":
+				commit = s.Value
+			case "vcs.modified":
+				info.Dirty = must.NotFail(strconv.ParseBool(s.Value))
+			}
+		}
+
+		return
+	}
+
+	// cases 3, 4, and 5
+
+	for _, dep := range buildInfo.Deps {
+		if dep.Path != ferretdbModule {
+			continue
+		}
+
+		version = dep.Version
+		if dep.Replace != nil {
+			version = dep.Replace.Version
+		}
+
+		// cases 3 and 4
+		if version == "(devel)" {
+			version = ""
+		}
+
+		// vcs.revision and other settings refer to the repository that uses FerretDB, not FerretDB itself.
+		// We don't want git commit hashes or build configurations of other repos.
+
+		break
+	}
+
+	return
+}
+
+func init() {
+	initFromFiles()
+
+	version, commit := readBuildInfo()
+
+	if info.Version == unknown && version != "" {
+		info.Version = version
+	}
+
+	if info.Commit == unknown && commit != "" {
+		info.Commit = commit
+	}
+
+	if info.Version != unknown {
+		if match := semVerTag.FindStringSubmatch(info.Version); match == nil || len(match) != semVerTag.NumSubexp()+1 {
+			msg := fmt.Sprintf("info.Version: %q, version: %q\n", info.Version, version)
+			msg += "Invalid build/version/version.txt file content. Please run `bin/task gen-version`.\n"
+			msg += "Alternatively, create this file manually with a content similar to\n"
+			msg += "the output of `git describe`: `v<major>.<minor>.<patch>`.\n"
+			msg += "See https://pkg.go.dev/github.com/FerretDB/FerretDB/v2/build/version"
+			panic(msg)
+		}
+	}
+
+	// This does not work for git submodules.
+	// Investigate and create an issue.
+	//
+	// if info.Commit != unknown {
+	// 	if info.Commit != commit && commit != "" {
+	// 		msg := fmt.Sprintf("info.Commit: %q, commit: %q\n", info.Commit, commit)
+	// 		msg += "Invalid build/version/commit.txt file content. Please run `bin/task gen-version`."
+	// 		panic(msg)
+	// 	}
+	// }
+}
@@ -15,20 +15,24 @@
 package version

 import (
+	"runtime"
 	"testing"

 	"github.com/stretchr/testify/assert"
-
-	"github.com/FerretDB/FerretDB/internal/types"
-	"github.com/FerretDB/FerretDB/internal/util/must"
-	"github.com/FerretDB/FerretDB/internal/util/testutil"
 )

-func TestGet(t *testing.T) {
-	v := Get()
+func TestCase1(t *testing.T) {
+	assert.Regexp(t, semVerTag, info.Version)
+	assert.Regexp(t, `^[0-9a-f]{40}$`, info.Commit)
+	assert.NotEmpty(t, info.Branch)
+	assert.NotEqual(t, unknown, info.Branch)
+	assert.NotEmpty(t, info.Package)
+	// package is unknown on CI for short tests where package.txt is not created

-	assert.NotEmpty(t, v.Version)
+	assert.Equal(t, "7.0.77", info.MongoDBVersion)
+	assert.Equal(t, [...]int32{int32(7), int32(0), int32(77), int32(0)}, info.MongoDBVersionArray)

-	assert.Equal(t, "7.0.42", v.MongoDBVersion)
-	testutil.AssertEqual(t, must.NotFail(types.NewArray(int32(7), int32(0), int32(42), int32(0))), v.MongoDBVersionArray)
+	assert.Equal(t, runtime.Version(), info.BuildEnvironment["go.version"])
+	assert.Equal(t, runtime.Version(), info.BuildEnvironment["go.runtime"])
+	assert.Empty(t, info.BuildEnvironment["vcs.revision"]) // not set for unit tests
 }
@@ -0,0 +1 @@
+CREATE EXTENSION IF NOT EXISTS documentdb CASCADE;
@@ -23,8 +23,6 @@ import (
 	"html/template"
 	"io"
 	"log/slog"
-	"net"
-	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -34,16 +32,10 @@ import (
 	"time"

 	"github.com/alecthomas/kong"
-	"github.com/prometheus/client_golang/prometheus"

-	"github.com/FerretDB/FerretDB/build/version"
-	mysqlpool "github.com/FerretDB/FerretDB/internal/backends/mysql/metadata/pool"
-	"github.com/FerretDB/FerretDB/internal/backends/postgresql/metadata/pool"
-	"github.com/FerretDB/FerretDB/internal/util/ctxutil"
-	"github.com/FerretDB/FerretDB/internal/util/debug"
-	"github.com/FerretDB/FerretDB/internal/util/lazyerrors"
-	"github.com/FerretDB/FerretDB/internal/util/logging"
-	"github.com/FerretDB/FerretDB/internal/util/state"
+	"github.com/FerretDB/FerretDB/v2/build/version"
+	"github.com/FerretDB/FerretDB/v2/internal/util/ctxutil"
+	"github.com/FerretDB/FerretDB/v2/internal/util/logging"
 )

 var (
@@ -57,225 +49,6 @@ var (
 // versionFile contains version information with leading v.
 const versionFile = "build/version/version.txt"

-// waitForPort waits for the given port to be available until ctx is canceled.
-func waitForPort(ctx context.Context, logger *slog.Logger, port uint16) error {
-	addr := fmt.Sprintf("127.0.0.1:%d", port)
-	logger.InfoContext(ctx, fmt.Sprintf("Waiting for %s to be up", addr))
-
-	var retry int64
-	for ctx.Err() == nil {
-		conn, err := net.Dial("tcp", addr)
-		if err == nil {
-			conn.Close()
-			return nil
-		}
-
-		logger.InfoContext(ctx, fmt.Sprintf("%s: %s", addr, err))
-
-		retry++
-		ctxutil.SleepWithJitter(ctx, time.Second, retry)
-	}
-
-	return fmt.Errorf("failed to connect to %s", addr)
-}
-
-// setupAnyPostgres configures given PostgreSQL.
-func setupAnyPostgres(ctx context.Context, logger *slog.Logger, uri string) error {
-	u, err := url.Parse(uri)
-	if err != nil {
-		return err
-	}
-
-	port, err := strconv.ParseUint(u.Port(), 10, 16)
-	if err != nil {
-		return err
-	}
-
-	if u.User == nil {
-		return lazyerrors.New("No username specified")
-	}
-
-	if err = waitForPort(ctx, logger, uint16(port)); err != nil {
-		return err
-	}
-
-	sp, err := state.NewProvider("")
-	if err != nil {
-		return err
-	}
-
-	p, err := pool.New(uri, logger, sp)
-	if err != nil {
-		return err
-	}
-
-	defer p.Close()
-
-	username := u.User.Username()
-	password, _ := u.User.Password()
-
-	var retry int64
-	for ctx.Err() == nil {
-		if _, err = p.Get(username, password); err == nil {
-			break
-		}
-
-		logger.InfoContext(ctx, fmt.Sprintf("%s: %s", uri, err))
-
-		retry++
-		ctxutil.SleepWithJitter(ctx, time.Second, retry)
-	}
-
-	if ctx.Err() != nil {
-		return ctx.Err()
-	}
-
-	return nil
-}
-
-// setupPostgres configures `postgres` container.
-func setupPostgres(ctx context.Context, logger *slog.Logger) error {
-	// user `username` must exist, but password may be any, even empty
-	return setupAnyPostgres(ctx, logging.WithName(logger, "postgres"), "postgres://username@127.0.0.1:5432/ferretdb")
-}
-
-// setupPostgresSecured configures `postgres_secured` container.
-func setupPostgresSecured(ctx context.Context, logger *slog.Logger) error {
-	return setupAnyPostgres(ctx, logging.WithName(logger, "postgres_secured"), "postgres://username:password@127.0.0.1:5433/ferretdb") //nolint:lll // for readability
-}
-
-// setupMySQL configures `mysql` container.
-func setupMySQL(ctx context.Context, logger *slog.Logger) error {
-	uri := "mysql://root:password@127.0.0.1:3306/ferretdb"
-
-	sp, err := state.NewProvider("")
-	if err != nil {
-		return err
-	}
-
-	if err = waitForPort(ctx, logging.WithName(logger, "mysql"), 3306); err != nil {
-		return err
-	}
-
-	p, err := mysqlpool.New(uri, logger, sp)
-	if err != nil {
-		return err
-	}
-
-	defer p.Close()
-
-	var retry int64
-	for ctx.Err() == nil {
-		db, err := p.Get("root", "password")
-		if err == nil {
-			if _, err = db.ExecContext(ctx, "GRANT ALL PRIVILEGES ON *.* TO 'username'@'%';"); err != nil {
-				return lazyerrors.Error(err)
-			}
-
-			break
-		}
-
-		logger.InfoContext(ctx, fmt.Sprintf("%s: %s", uri, err))
-
-		retry++
-		ctxutil.SleepWithJitter(ctx, time.Second, retry)
-	}
-
-	if ctx.Err() != nil {
-		return ctx.Err()
-	}
-
-	return nil
-}
-
-// setupMongodb configures `mongodb` container.
-func setupMongodb(ctx context.Context, logger *slog.Logger) error {
-	if err := waitForPort(ctx, logging.WithName(logger, "mongodb"), 47017); err != nil {
-		return err
-	}
-
-	eval := `'rs.initiate({_id: "rs0", members: [{_id: 0, host: "localhost:47017" }]})'`
-	args := []string{"compose", "exec", "-T", "mongodb", "mongosh", "--port=47017", "--eval", eval}
-
-	var buf bytes.Buffer
-	var retry int64
-
-	for ctx.Err() == nil {
-		buf.Reset()
-
-		err := runCommand("docker", args, &buf, logger)
-		if err == nil {
-			break
-		}
-
-		logger.InfoContext(ctx, fmt.Sprintf("%s:\n%s", err, buf.String()))
-
-		retry++
-		ctxutil.SleepWithJitter(ctx, time.Second, retry)
-	}
-
-	return ctx.Err()
-}
-
-// setupMongodbSecured configures `mongodb_secured` container.
-func setupMongodbSecured(ctx context.Context, logger *slog.Logger) error {
-	if err := waitForPort(ctx, logging.WithName(logger, "mongodb_secured"), 47018); err != nil {
-		return err
-	}
-
-	eval := `'rs.initiate({_id: "rs0", members: [{_id: 0, host: "localhost:47018" }]})'`
-	shell := `mongodb://username:password@127.0.0.1:47018/?tls=true&tlsCertificateKeyFile=/etc/certs/client.pem&tlsCaFile=/etc/certs/rootCA-cert.pem` //nolint:lll // for readability
-	args := []string{"compose", "exec", "-T", "mongodb_secured", "mongosh", "--eval", eval, "--shell", shell}
-
-	var buf bytes.Buffer
-	var retry int64
-
-	for ctx.Err() == nil {
-		buf.Reset()
-
-		err := runCommand("docker", args, &buf, logger)
-		if err == nil {
-			break
-		}
-
-		logger.InfoContext(ctx, fmt.Sprintf("%s:\n%s", err, buf.String()))
-
-		retry++
-		ctxutil.SleepWithJitter(ctx, time.Second, retry)
-	}
-
-	return ctx.Err()
-}
-
-// setup runs all setup commands.
-func setup(ctx context.Context, logger *slog.Logger) error {
-	h, err := debug.Listen(&debug.ListenOpts{
-		TCPAddr: "127.0.0.1:8089",
-		L:       logging.WithName(logger, "debug"),
-		R:       prometheus.DefaultRegisterer,
-	})
-	if err != nil {
-		return lazyerrors.Error(err)
-	}
-
-	go h.Serve(ctx)
-
-	for _, f := range []func(context.Context, *slog.Logger) error{
-		setupPostgres,
-		setupPostgresSecured,
-		setupMySQL,
-		setupMongodb,
-		setupMongodbSecured,
-	} {
-		if err := f(ctx, logger); err != nil {
-			return err
-		}
-	}
-
-	logger.InfoContext(ctx, "Done")
-	return nil
-}
-
 // runCommand runs command with given arguments.
 func runCommand(command string, args []string, stdout io.Writer, logger *slog.Logger) error {
 	bin, err := exec.LookPath(command)
@@ -338,12 +111,12 @@ func printDiagnosticData(w io.Writer, setupError error, logger *slog.Logger) err
 		"GOOS":   runtime.GOOS,
 		"GOARCH": runtime.GOARCH,

-		"Version":    info.Version,
-		"Commit":     info.Commit,
-		"Branch":     info.Branch,
-		"Dirty":      info.Dirty,
-		"Package":    info.Package,
-		"DebugBuild": info.DebugBuild,
+		"Version":  info.Version,
+		"Commit":   info.Commit,
+		"Branch":   info.Branch,
+		"Dirty":    info.Dirty,
+		"Package":  info.Package,
+		"DevBuild": info.DevBuild,

 		"GoVersion":      runtime.Version(),
 		"GitVersion":     strings.TrimSpace(gitVersion),
@@ -417,6 +190,7 @@ type TestsRunParams struct {
 	ShardTotal uint   `help:"Total number of shards."`
 	Run        string `help:"Run only tests matching the regexp."`
 	Skip       string `help:"Skip tests matching the regexp."`
+	RawPrefix  string `help:"Prefix for raw output files."`

 	Args []string `arg:"" help:"Other arguments and flags for 'go test'." passthrough:""`
 }
@@ -434,13 +208,13 @@ var cli struct {

 	Shell struct {
 		Mkdir struct {
-			Paths []string `arg:"" name:"path" help:"Paths to create." type:"path"`
+			Paths []string `name:"path" arg:"" help:"Paths to create." type:"path"`
 		} `cmd:"" help:"Create directories if they do not already exist."`
 		Rmdir struct {
-			Paths []string `arg:"" name:"path" help:"Paths to remove." type:"path"`
+			Paths []string `name:"path" arg:"" help:"Paths to remove." type:"path"`
 		} `cmd:"" help:"Remove directories."`
 		Read struct {
-			Paths []string `arg:"" name:"path" help:"Paths to read." type:"path"`
+			Paths []string `name:"path" arg:"" help:"Paths to read." type:"path"`
 		} `cmd:"" help:"Read files."`
 	} `cmd:""`

@@ -457,10 +231,10 @@ var cli struct {
 }

 func main() {
-	kongCtx := kong.Parse(&cli)
+	kongCtx := kong.Parse(&cli, kong.DefaultEnvars("ENVTOOL"))

 	// https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
-	if t, _ := strconv.ParseBool(os.Getenv("CI")); t {
+	if t, _ := strconv.ParseBool(os.Getenv("RUNNER_DEBUG")); t {
 		cli.Debug = true
 	}

@@ -474,9 +248,10 @@ func main() {
 		Level:        level,
 		RemoveTime:   true,
 		RemoveSource: true,
+		// the logger handles messages from the `go test` command output
+		SkipChecks: true,
 	}
-
-	logging.Setup(opts, "")
+	logging.SetupDefault(opts, "")
 	logger := slog.Default()

 	cmd := kongCtx.Command()
@@ -486,7 +261,7 @@ func main() {

 	switch cmd {
 	case "setup":
-		ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 		defer cancel()

 		err = setup(ctx, logger)
@@ -562,7 +337,7 @@ func main() {

 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
-			logger.Error("Failed to exit", logging.Error(exitErr))
+			logger.Error("Failed", logging.Error(exitErr))
 			os.Exit(exitErr.ExitCode())
 		}

@@ -22,7 +22,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"github.com/FerretDB/FerretDB/internal/util/testutil"
+	"github.com/FerretDB/FerretDB/v2/internal/util/testutil"
 )

 func TestPrintDiagnosticData(t *testing.T) {
@@ -1 +1 @@
 .0.42
 v7.0.77
				`@@ -0,0 +1 @@`
				`CREATE EXTENSION IF NOT EXISTS documentdb CASCADE;`