diff --git a/.gitignore b/.gitignore
index cab0673..7e5fef8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /target
 /.vscode
-/config.toml
\ No newline at end of file
+/config.toml
+*.db
\ No newline at end of file
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..819396e
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "website"]
+	path = website
+	url = https://git.libre-chip.org/libre-chip/website.git
diff --git a/Cargo.lock b/Cargo.lock
index f804b68..edff9eb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -21,16 +21,16 @@ dependencies = [
 
 [[package]]
 name = "actix-http"
-version = "3.6.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d223b13fd481fc0d1f83bb12659ae774d9e3601814c68a0bc539731698cca743"
+checksum = "4eb9843d84c775696c37d9a418bbb01b932629d01870722c0f13eb3f95e2536d"
 dependencies = [
  "actix-codec",
  "actix-rt",
  "actix-service",
  "actix-utils",
  "ahash",
- "base64 0.21.7",
+ "base64 0.22.1",
  "bitflags 2.5.0",
  "brotli",
  "bytes",
@@ -65,27 +65,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e01ed3140b2f8d422c68afa1ed2e85d996ea619c988ac834d255db32138655cb"
 dependencies = [
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
 name = "actix-router"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22475596539443685426b6bdadb926ad0ecaefdfc5fb05e5e3441f15463c511"
+checksum = "13d324164c51f63867b57e73ba5936ea151b8a41a1d23d1031eeb9f70d0236f8"
 dependencies = [
  "bytestring",
+ "cfg-if",
  "http",
  "regex",
+ "regex-lite",
  "serde",
  "tracing",
 ]
 
 [[package]]
 name = "actix-rt"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28f32d40287d3f402ae0028a9d54bef51af15c8769492826a69d28f81893151d"
+checksum = "24eda4e2a6e042aa4e55ac438a2ae052d3b5da0ecf83d7411e1a368946925208"
 dependencies = [
  "futures-core",
  "tokio",
@@ -93,9 +95,9 @@ dependencies = [
 
 [[package]]
 name = "actix-server"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eb13e7eef0423ea6eab0e59f6c72e7cb46d33691ad56a726b3cd07ddec2c2d4"
+checksum = "b02303ce8d4e8be5b855af6cf3c3a08f3eff26880faad82bab679c22d3650cb5"
 dependencies = [
  "actix-rt",
  "actix-service",
@@ -147,9 +149,9 @@ dependencies = [
 
 [[package]]
 name = "actix-web"
-version = "4.5.1"
+version = "4.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a6556ddebb638c2358714d853257ed226ece6023ef9364f23f0c70737ea984"
+checksum = "5d6316df3fa569627c98b12557a8b6ff0674e5be4bb9b5e4ae2550ddb4964ed6"
 dependencies = [
  "actix-codec",
  "actix-http",
@@ -176,6 +178,7 @@ dependencies = [
  "once_cell",
  "pin-project-lite",
  "regex",
+ "regex-lite",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -187,14 +190,14 @@ dependencies = [
 
 [[package]]
 name = "actix-web-codegen"
-version = "4.2.2"
+version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb1f50ebbb30eca122b188319a4398b3f7bb4a8cdf50ecfb73bfc6a3c3ce54f5"
+checksum = "f591380e2e68490b5dfaf1dd1aa0ebe78d84ba7067078512b4ea6e4492d622b8"
 dependencies = [
  "actix-router",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -301,47 +304,48 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.13"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
+ "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.2"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
 dependencies = [
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
  "anstyle",
  "windows-sys 0.52.0",
@@ -349,15 +353,15 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.81"
+version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
 
 [[package]]
 name = "autocfg"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
@@ -398,6 +402,12 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
 [[package]]
 name = "base64ct"
 version = "1.6.0"
@@ -427,9 +437,9 @@ dependencies = [
 
 [[package]]
 name = "brotli"
-version = "3.5.0"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d640d25bc63c50fb1f0b545ffd80207d2e10a4c965530809b40ba3386825c391"
+checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -438,9 +448,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "2.5.1"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+checksum = "9a45bd2e4095a8b518033b128020dd4a55aab1c0a381ba4404a472630f4bc362"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -448,9 +458,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
@@ -475,12 +485,13 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.91"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd97381a8cc6493395a5afc4c691c1084b3768db713b73aa215217aa245d153"
+checksum = "96c51067fd44124faa7f870b4b1c969379ad32b2ba805aa959430ceaa384f695"
 dependencies = [
  "jobserver",
  "libc",
+ "once_cell",
 ]
 
 [[package]]
@@ -491,9 +502,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d04d43504c61aa6c7531f1871dd0d418d91130162063b789da00fd7057a5e"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -501,7 +512,7 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -516,9 +527,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.4"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
+checksum = "5db83dced34638ad474f39f250d7fea9598bdd239eaced1bdf45d597da0f433f"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -526,33 +537,33 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.2"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
+checksum = "f7e204572485eb3fbf28f871612191521df159bc3e15a9f5064c66dba3a8c05f"
 dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "strsim 0.11.1",
+ "strsim",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.5.4"
+version = "4.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
+checksum = "c780290ccf4fb26629baa7a1081e68ced113f1d3ec302fa5948f1c381ebf06c6"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
+checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
 
 [[package]]
 name = "clio"
@@ -598,9 +609,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 
 [[package]]
 name = "const-oid"
@@ -659,9 +670,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3855a8a784b474f333699ef2bbca9db2c4a1f6d9088a90a2d25b1eb53111eaa"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
 dependencies = [
  "cfg-if",
 ]
@@ -700,16 +711,15 @@ dependencies = [
 
 [[package]]
 name = "curve25519-dalek"
-version = "4.1.2"
+version = "4.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a677b8922c94e01bdbb12126b0bc852f00447528dee1782229af9c720c3f348"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
  "cpufeatures",
  "curve25519-dalek-derive",
  "digest",
  "fiat-crypto",
- "platforms",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -723,14 +733,14 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
 name = "darling"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54e36fcd13ed84ffdfda6f5be89b31287cbb80c439841fe69e04841435464391"
+checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -738,27 +748,27 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c2cf1c23a687a1feeb728783b993c4e1ad83d99f351801977dd809b48d0a70f"
+checksum = "622687fe0bac72a04e5599029151f5796111b90f1baaa9b544d807a5e31cd120"
 dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim 0.10.0",
- "syn 2.0.58",
+ "strsim",
+ "syn",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a668eda54683121533a393014d8692171709ff57a7d61f187b6e782719f8933f"
+checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -784,15 +794,60 @@ dependencies = [
 
 [[package]]
 name = "derive_more"
-version = "0.99.17"
+version = "0.99.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb810d30a7c1953f91334de7244731fc3f3c10d7fe163338a35b9f640960321"
+checksum = "5f33878137e4dafd7fa914ad4e259e18a4e8e532b9617a2d0150262bf53abfce"
 dependencies = [
  "convert_case",
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 1.0.109",
+ "syn",
+]
+
+[[package]]
+name = "diesel"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62d6dcd069e7b5fe49a302411f759d4cf1cf2c27fe798ef46fb8baefc053dd2b"
+dependencies = [
+ "chrono",
+ "diesel_derives",
+ "libsqlite3-sys",
+ "time",
+]
+
+[[package]]
+name = "diesel_derives"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59de76a222c2b8059f789cbe07afbfd8deb8c31dd0bc2a21f85e256c1def8259"
+dependencies = [
+ "diesel_table_macro_syntax",
+ "dsl_auto_type",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "diesel_migrations"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a73ce704bad4231f001bff3314d91dce4aba0770cee8b233991859abc15c1f6"
+dependencies = [
+ "diesel",
+ "migrations_internals",
+ "migrations_macros",
+]
+
+[[package]]
+name = "diesel_table_macro_syntax"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "209c735641a413bc68c4923a9d6ad4bcb3ca306b794edaa7eb0b3228a99ffb25"
+dependencies = [
+ "syn",
 ]
 
 [[package]]
@@ -807,6 +862,20 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "dsl_auto_type"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0892a17df262a24294c382f0d5997571006e7a4348b4327557c4ff1cd4a8bccc"
+dependencies = [
+ "darling",
+ "either",
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.17"
@@ -834,6 +903,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
  "pkcs8",
+ "serde",
  "signature",
 ]
 
@@ -845,6 +915,7 @@ checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
+ "rand_core",
  "serde",
  "sha2",
  "subtle",
@@ -853,9 +924,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.10.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
 [[package]]
 name = "elliptic-curve"
@@ -880,9 +951,9 @@ dependencies = [
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -918,9 +989,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -938,9 +1009,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "ff"
@@ -954,15 +1025,15 @@ dependencies = [
 
 [[package]]
 name = "fiat-crypto"
-version = "0.2.7"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c007b1ae3abe1cb6f85a16305acd418b7ca6343b953633fee2b76d8f108b830f"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "flate2"
-version = "1.0.28"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -1054,7 +1125,7 @@ checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -1100,9 +1171,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.13"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06fddc2749e0528d2813f95e050e87e52c8cbbae56223b9babf73b3e53b0cc6"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -1165,9 +1236,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "heck"
@@ -1229,9 +1300,9 @@ dependencies = [
 
 [[package]]
 name = "httparse"
-version = "1.8.0"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+checksum = "0fcc0b4a115bf80b728eb8ea024ad5bd707b615bfed49e0665b6e0f86fd082d9"
 
 [[package]]
 name = "httpdate"
@@ -1247,9 +1318,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.28"
+version = "0.14.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "f361cde2f109281a220d4307746cdfd5ee3f410da58a70377762396775634b33"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1359,7 +1430,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown 0.14.5",
  "serde",
 ]
 
@@ -1389,6 +1460,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -1406,9 +1483,9 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "jobserver"
-version = "0.1.28"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab46a6e9526ddef3ae7f787c06f0f2600639ba80ea3eade3d8e670a2230f51d6"
+checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
 dependencies = [
  "libc",
 ]
@@ -1439,9 +1516,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 
 [[package]]
 name = "libm"
@@ -1450,10 +1527,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.4.13"
+name = "libsqlite3-sys"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+checksum = "0c10584274047cb335c23d3e61bcef8e323adae7c5c8c760540f73610177fc3f"
+dependencies = [
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "listenfd"
@@ -1485,9 +1572,9 @@ checksum = "4d873d7c67ce09b42110d801813efbc9364414e356be9935700d368351657487"
 
 [[package]]
 name = "lock_api"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1501,9 +1588,30 @@ checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "migrations_internals"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd01039851e82f8799046eabbb354056283fb265c8ec0996af940f4e85a380ff"
+dependencies = [
+ "serde",
+ "toml",
+]
+
+[[package]]
+name = "migrations_macros"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffb161cc72176cb37aa47f1fc520d3ef02263d67d661f44f05d05a079e1237fd"
+dependencies = [
+ "migrations_internals",
+ "proc-macro2",
+ "quote",
+]
 
 [[package]]
 name = "mime"
@@ -1513,9 +1621,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
+checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
 dependencies = [
  "adler",
 ]
@@ -1534,11 +1642,10 @@ dependencies = [
 
 [[package]]
 name = "native-tls"
-version = "0.2.11"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
 dependencies = [
- "lazy_static",
  "libc",
  "log",
  "openssl",
@@ -1584,9 +1691,9 @@ dependencies = [
 
 [[package]]
 name = "num-iter"
-version = "0.1.44"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d869c01cc0c455284163fd0092f1f93835385ccab5a98a0dcc497b2f8bf055a9"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1595,9 +1702,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
  "libm",
@@ -1709,7 +1816,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -1771,9 +1878,9 @@ dependencies = [
 
 [[package]]
 name = "parking_lot"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
 dependencies = [
  "lock_api",
  "parking_lot_core",
@@ -1781,22 +1888,22 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.9"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
 name = "paste"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "pem-rfc7468"
@@ -1852,12 +1959,6 @@ version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
-[[package]]
-name = "platforms"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db23d408679286588f4d4644f965003d056e3dd5abcaaa938116871d7ce2fee7"
-
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1893,18 +1994,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.79"
+version = "1.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+checksum = "22244ce15aa966053a896d1accb3a6e68469b97c7f33f284b99f0d576879fc23"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -1941,18 +2042,18 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.4.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+checksum = "c82cf8cff14456045f55ec4241383baeff27af886adb72ffb2162f99911de0fd"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.4"
+version = "1.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
+checksum = "b91213439dad192326a0d7c6ee3955910425f441d7038e0d6933b0aec5c4517f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1962,9 +2063,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
+checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1972,10 +2073,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "regex-syntax"
-version = "0.8.3"
+name = "regex-lite"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
+checksum = "53a49587ad06b26609c52e423de037e7f57f20d53535d66e08c695f347df952a"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
 
 [[package]]
 name = "reqwest"
@@ -2068,9 +2175,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.23"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "rustc_version"
@@ -2083,9 +2190,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.32"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
  "bitflags 2.5.0",
  "errno",
@@ -2096,9 +2203,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.10"
+version = "0.21.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
 dependencies = [
  "log",
  "ring",
@@ -2127,9 +2234,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e86697c916019a8588c99b5fac3cead74ec0b4b819707a682fd4d23fa0ce1ba1"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "same-file"
@@ -2181,11 +2288,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
+checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2194,9 +2301,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
+checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2204,15 +2311,15 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92d43fe69e652f3df9bdc2b85b2854a0825b86e4fb76bc44d945137d053639ca"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
 dependencies = [
  "serde_derive",
 ]
@@ -2229,20 +2336,20 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.203"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.115"
+version = "1.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
+checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
 dependencies = [
  "itoa",
  "ryu",
@@ -2270,9 +2377,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3622f419d1296904700073ea6cc23ad690adbd66f13ea683df73298736f0c1"
+checksum = "79e674e01f999af37c49f70a6ede167a8a60b2503e56c5599532a65baa5969a0"
 dependencies = [
  "serde",
 ]
@@ -2291,11 +2398,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.7.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee80b0e361bbf88fd2f6e242ccd19cfda072cb0faa6ae694ecee08199938569a"
+checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
@@ -2309,14 +2416,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.7.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6561dc161a9224638a31d876ccdfefbc1df91d3f3a8342eddb35f055d48c7655"
+checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -2352,9 +2459,9 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
 dependencies = [
  "libc",
 ]
@@ -2386,9 +2493,9 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -2416,12 +2523,6 @@ dependencies = [
  "der",
 ]
 
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -2430,13 +2531,17 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "subscribe-list"
-version = "0.1.0"
+version = "0.1.2"
 dependencies = [
  "actix-session",
  "actix-web",
+ "chrono",
  "clap",
  "clio",
  "color-eyre",
+ "diesel",
+ "diesel_migrations",
+ "ed25519-dalek",
  "env_logger",
  "eyre",
  "futures",
@@ -2444,9 +2549,12 @@ dependencies = [
  "listenfd",
  "log",
  "openidconnect",
+ "regex",
  "reqwest",
  "serde",
  "serde_json",
+ "serde_urlencoded",
+ "serde_with",
  "tinytemplate",
  "tokio",
  "toml",
@@ -2460,20 +2568,9 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
+checksum = "c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2521,22 +2618,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.58"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
+checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.58"
+version = "1.0.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -2551,9 +2648,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -2572,9 +2669,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
@@ -2607,9 +2704,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.37.0"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
+checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2626,13 +2723,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
@@ -2657,23 +2754,22 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
 name = "toml"
-version = "0.8.12"
+version = "0.8.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9dd1545e8208b4a5af1aa9bbd0b4cf7e9ea08fabc5d0a5c67fcaafa17433aa3"
+checksum = "6f49eb2ab21d2f26bd6db7bf383edc527a7ebaee412d17af4d40fdccd442f335"
 dependencies = [
  "indexmap 2.2.6",
  "serde",
@@ -2684,18 +2780,18 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.9"
+version = "0.22.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e40bb779c5187258fd7aad0eb68cb8706a0a81fa712fbea808ab43c4b8374c4"
+checksum = "f21c7aaf97f1bd9ca9d4f9e73b0a6c74bd5afef56f2bc931943a6e1c37e04e38"
 dependencies = [
  "indexmap 2.2.6",
  "serde",
@@ -2803,9 +2899,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.0"
+version = "2.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
+checksum = "22784dbdf76fdde8af1aeda5622b546b422b6fc585325248a2bf9f5e41e94d6c"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2815,9 +2911,9 @@ dependencies = [
 
 [[package]]
 name = "utf8parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
@@ -2889,7 +2985,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
@@ -2923,7 +3019,7 @@ checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -2968,11 +3064,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
 dependencies = [
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2987,7 +3083,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3020,7 +3116,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3040,17 +3136,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.4",
- "windows_aarch64_msvc 0.52.4",
- "windows_i686_gnu 0.52.4",
- "windows_i686_msvc 0.52.4",
- "windows_x86_64_gnu 0.52.4",
- "windows_x86_64_gnullvm 0.52.4",
- "windows_x86_64_msvc 0.52.4",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -3067,9 +3164,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -3085,9 +3182,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -3103,9 +3200,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -3121,9 +3224,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -3139,9 +3242,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -3157,9 +3260,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -3175,15 +3278,15 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "winnow"
-version = "0.6.5"
+version = "0.6.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
+checksum = "59b5e5f6c299a3c7890b876a2a587f3115162487e704907d9b6cd29473052ba1"
 dependencies = [
  "memchr",
 ]
@@ -3200,29 +3303,29 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.7.32"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.32"
+version = "0.7.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.58",
+ "syn",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.7.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
 
 [[package]]
 name = "zstd"
@@ -3244,9 +3347,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.10+zstd.1.5.6"
+version = "2.0.11+zstd.1.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c253a4914af5bafc8fa8c86ee400827e83cf6ec01195ec1f1ed8441bf00d65aa"
+checksum = "75652c55c0b6f3e6f12eb786fe1bc960396bf05a1eb3bf1f3691c3610ac2e6d4"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index 807610c..f512c18 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,16 +1,22 @@
 [package]
 name = "subscribe-list"
-version = "0.1.0"
+version = "0.1.2"
 edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+authors = ["Jacob Lifshay <programmerjake@gmail.com>"]
+description = "web server for managing subscriptions"
+license = "GPL-3.0-or-later"
+publish = false
 
 [dependencies]
 actix-session = { version = "0.9.0", features = ["cookie-session"] }
 actix-web = { version = "4.5.1", features = ["secure-cookies"] }
+chrono = { version = "0.4.37", features = ["now"] }
 clap = { version = "4.5.4", features = ["derive"] }
 clio = { version = "0.3.5", features = ["clap-parse"] }
 color-eyre = "0.6.3"
+diesel = { version = "2.1.5", features = ["sqlite", "chrono"] }
+diesel_migrations = { version = "2.1.0", features = ["sqlite"] }
+ed25519-dalek = { version = "2.1.1", features = ["rand_core", "serde"] }
 env_logger = "0.11.3"
 eyre = "0.6.12"
 futures = "0.3.30"
@@ -21,6 +27,24 @@ openidconnect = "3.5.0"
 reqwest = "0.11.27"
 serde = { version = "1.0.197", features = ["derive"] }
 serde_json = "1.0.115"
+serde_urlencoded = "0.7.1"
+serde_with = { version = "3.7.0", features = ["base64"] }
 tinytemplate = "1.2.1"
 tokio = { version = "1.37.0", features = ["macros", "rt-multi-thread"] }
 toml = { version = "0.8.12", features = ["preserve_order"] }
+
+[build-dependencies]
+regex = "1.10.4"
+
+[package.metadata.deb]
+depends = ["$auto", "adduser (>= 3.11)"]
+assets = [
+    ["target/release/subscribe-list", "usr/bin/", "755"],
+    ["config.toml.sample", "usr/share/subscribe-list/config.toml.sample", "644"],
+]
+maintainer-scripts = "debian"
+
+[package.metadata.deb.systemd-units]
+unit-name = "subscribe-list"
+unit-scripts = "."
+enable = false
diff --git a/LICENSE.md b/LICENSE.md
new file mode 100644
index 0000000..496acdb
--- /dev/null
+++ b/LICENSE.md
@@ -0,0 +1,675 @@
+# GNU GENERAL PUBLIC LICENSE
+
+Version 3, 29 June 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+<https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+## Preamble
+
+The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+the GNU General Public License is intended to guarantee your freedom
+to share and change all versions of a program--to make sure it remains
+free software for all its users. We, the Free Software Foundation, use
+the GNU General Public License for most of our software; it applies
+also to any other work released this way by its authors. You can apply
+it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights. Therefore, you
+have certain responsibilities if you distribute copies of the
+software, or if you modify it: responsibilities to respect the freedom
+of others.
+
+For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received. You must make sure that they, too, receive
+or can get the source code. And you must show them these terms so they
+know their rights.
+
+Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software. For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the
+manufacturer can do so. This is fundamentally incompatible with the
+aim of protecting users' freedom to change the software. The
+systematic pattern of such abuse occurs in the area of products for
+individuals to use, which is precisely where it is most unacceptable.
+Therefore, we have designed this version of the GPL to prohibit the
+practice for those products. If such problems arise substantially in
+other domains, we stand ready to extend this provision to those
+domains in future versions of the GPL, as needed to protect the
+freedom of users.
+
+Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish
+to avoid the special danger that patents applied to a free program
+could make it effectively proprietary. To prevent this, the GPL
+assures that patents cannot be used to render the program non-free.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+## TERMS AND CONDITIONS
+
+### 0. Definitions.
+
+"This License" refers to version 3 of the GNU General Public License.
+
+"Copyright" also means copyright-like laws that apply to other kinds
+of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of
+an exact copy. The resulting work is called a "modified version" of
+the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user
+through a computer network, with no transfer of a copy, is not
+conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to
+the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+### 1. Source Code.
+
+The "source code" for a work means the preferred form of the work for
+making modifications to it. "Object code" means any non-source form of
+a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can
+regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same
+work.
+
+### 2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey,
+without conditions so long as your license otherwise remains in force.
+You may convey covered works to others for the sole purpose of having
+them make modifications exclusively for you, or provide you with
+facilities for running those works, provided that you comply with the
+terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for
+you must do so exclusively on your behalf, under your direction and
+control, on terms that prohibit them from making any copies of your
+copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the
+conditions stated below. Sublicensing is not allowed; section 10 makes
+it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such
+circumvention is effected by exercising rights under this License with
+respect to the covered work, and you disclaim any intention to limit
+operation or modification of the work as a means of enforcing, against
+the work's users, your or third parties' legal rights to forbid
+circumvention of technological measures.
+
+### 4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these
+conditions:
+
+-   a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+-   b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under
+    section 7. This requirement modifies the requirement in section 4
+    to "keep intact all notices".
+-   c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy. This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged. This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+-   d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+### 6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+-   a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+-   b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the Corresponding
+    Source from a network server at no charge.
+-   c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source. This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+-   d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge. You need not require recipients to copy the
+    Corresponding Source along with the object code. If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source. Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+-   e) Convey the object code using peer-to-peer transmission,
+    provided you inform other peers where the object code and
+    Corresponding Source of the work are being offered to the general
+    public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal,
+family, or household purposes, or (2) anything designed or sold for
+incorporation into a dwelling. In determining whether a product is a
+consumer product, doubtful cases shall be resolved in favor of
+coverage. For a particular product received by a particular user,
+"normally used" refers to a typical or common use of that class of
+product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected
+to use, the product. A product is a consumer product regardless of
+whether the product has substantial commercial, industrial or
+non-consumer uses, unless such uses represent the only significant
+mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to
+install and execute modified versions of a covered work in that User
+Product from a modified version of its Corresponding Source. The
+information must suffice to ensure that the continued functioning of
+the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or
+updates for a work that has been modified or installed by the
+recipient, or for the User Product in which it has been modified or
+installed. Access to a network may be denied when the modification
+itself materially and adversely affects the operation of the network
+or violates the rules and protocols for communication across the
+network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+### 7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders
+of that material) supplement the terms of this License with terms:
+
+-   a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+-   b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+-   c) Prohibiting misrepresentation of the origin of that material,
+    or requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+-   d) Limiting the use for publicity purposes of names of licensors
+    or authors of the material; or
+-   e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+-   f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions
+    of it) with contractual assumptions of liability to the recipient,
+    for any liability that these contractual assumptions directly
+    impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+### 8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your license
+from a particular copyright holder is reinstated (a) provisionally,
+unless and until the copyright holder explicitly and finally
+terminates your license, and (b) permanently, if the copyright holder
+fails to notify you of the violation by some reasonable means prior to
+60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+### 9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run
+a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+### 11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned
+or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on
+the non-exercise of one or more of the rights that are specifically
+granted under this License. You may not convey a covered work if you
+are a party to an arrangement with a third party that is in the
+business of distributing software, under which you make payment to the
+third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties
+who would receive the covered work from you, a discriminatory patent
+license (a) in connection with copies of the covered work conveyed by
+you (or copies made from those copies), or (b) primarily for and in
+connection with specific products or compilations that contain the
+covered work, unless you entered into that arrangement, or that patent
+license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+### 12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under
+this License and any other pertinent obligations, then as a
+consequence you may not convey it at all. For example, if you agree to
+terms that obligate you to collect a royalty for further conveying
+from those to whom you convey the Program, the only way you could
+satisfy both those terms and this License would be to refrain entirely
+from conveying the Program.
+
+### 13. Use with the GNU Affero General Public License.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+### 14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU General Public License from time to time. Such new versions
+will be similar in spirit to the present version, but may differ in
+detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies that a certain numbered version of the GNU General Public
+License "or any later version" applies to it, you have the option of
+following the terms and conditions either of that numbered version or
+of any later version published by the Free Software Foundation. If the
+Program does not specify a version number of the GNU General Public
+License, you may choose any version ever published by the Free
+Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions
+of the GNU General Public License can be used, that proxy's public
+statement of acceptance of a version permanently authorizes you to
+choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+### 15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
+WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
+PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
+CORRECTION.
+
+### 16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
+NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
+LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
+TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program. It is safest to
+attach them to the start of each source file to most effectively state
+the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+        <one line to give the program's name and a brief idea of what it does.>
+        Copyright (C) <year>  <name of author>
+
+        This program is free software: you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation, either version 3 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+        <program>  Copyright (C) <year>  <name of author>
+        This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+        This is free software, and you are welcome to redistribute it
+        under certain conditions; type `show c' for details.
+
+The hypothetical commands \`show w' and \`show c' should show the
+appropriate parts of the General Public License. Of course, your
+program's commands might be different; for a GUI interface, you would
+use an "about box".
+
+You should also get your employer (if you work as a programmer) or
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary. For more information on this, and how to apply and follow
+the GNU GPL, see <https://www.gnu.org/licenses/>.
+
+The GNU General Public License does not permit incorporating your
+program into proprietary programs. If your program is a subroutine
+library, you may consider it more useful to permit linking proprietary
+applications with the library. If this is what you want to do, use the
+GNU Lesser General Public License instead of this License. But first,
+please read <https://www.gnu.org/licenses/why-not-lgpl.html>.
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000..47838f7
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,79 @@
+use regex::Regex;
+use std::{collections::HashSet, env, error::Error, fs, path::Path, process::Command};
+
+fn escape_template(v: &str) -> Result<String, String> {
+    let cant_escape = "\\{";
+    if v.contains(cant_escape) {
+        return Err(format!("can't escape {cant_escape}"));
+    }
+    Ok(v.replace("{", "\\{"))
+}
+
+fn main() -> Result<(), Box<dyn Error>> {
+    println!("cargo:rerun-if-changed=migrations");
+    println!("cargo:rerun-if-changed=website");
+    let out_dir = env::var_os("OUT_DIR").unwrap();
+    let website_dir = Path::new(&out_dir).join("website");
+    let templates_dir = Path::new(&out_dir).join("templates");
+    fs::create_dir_all(&templates_dir)?;
+    let status = Command::new("mdbook")
+        .arg("build")
+        .arg("--dest-dir")
+        .arg(&website_dir)
+        .current_dir("website")
+        .status()
+        .map_err(|e| format!("Can't run mdbook: {e}"))?;
+    if !status.success() {
+        return Err(format!("mdbook exited with an error: {status:?}").into());
+    }
+    let sub_template_path = website_dir.join("subscription/index.html");
+    let sub_template = fs::read_to_string(&sub_template_path)
+        .map_err(|e| format!("Error reading {}: {e}", sub_template_path.display()))?;
+    let regex = Regex::new(r#"(?s)<div class="subscribe_list_template_section" id="(?<id>[^"]*)"/>(?<template>.*?)<div class="subscribe_list_template_section"/>"#).unwrap();
+    let matches = Vec::from_iter(regex.captures_iter(&sub_template));
+    let mut between_matches = vec![];
+    let mut last_end = 0;
+    for m in &matches {
+        let m = m.get(0).unwrap();
+        between_matches.push(&sub_template[last_end..m.start()]);
+        last_end = m.end();
+    }
+    between_matches.push(&sub_template[last_end..]);
+    let prefix = between_matches.remove(0);
+    let Some(suffix) = between_matches.pop() else {
+        return Err(format!(
+            "no subscribe_list_template_section `div`s found: {}",
+            sub_template_path.display()
+        )
+        .into());
+    };
+    let prefix = escape_template(prefix)?;
+    let suffix = escape_template(suffix)?;
+    for i in between_matches {
+        if i.trim_start() != "" {
+            return Err(format!(
+                r#"can't have non-whitespace text between
+<div class="subscribe_list_template_section"/>
+and next
+<div class="subscribe_list_template_section" id="..">"#
+            )
+            .into());
+        }
+    }
+    let mut identifiers = HashSet::new();
+    for m in &matches {
+        let id = &m["id"];
+        if id.contains(|ch: char| !ch.is_ascii_alphanumeric() && ch != '_') {
+            return Err(format!("invalid identifier {id:?}").into());
+        }
+        if !identifiers.insert(id) {
+            return Err(format!("duplicate identifier {id:?}").into());
+        }
+        let template = &m["template"];
+        fs::write(
+            templates_dir.join(format!("{id}.txt")),
+            prefix.clone() + template + &suffix,
+        )?;
+    }
+    Ok(())
+}
diff --git a/config.toml.sample b/config.toml.sample
index da14b88..42c7e5d 100644
--- a/config.toml.sample
+++ b/config.toml.sample
@@ -1,3 +1,6 @@
+sqlite_db = "/var/lib/subscribe-list/list.db"
+server_base_url = "https://my-site/"
+
 [oidc.google]
 pretty_name = "Google"
 issuer_url = "https://accounts.google.com"
@@ -12,4 +15,4 @@ issuer_url = "https://salsa.debian.org"
 client_id = "<TODO>"
 secret = "<TODO>"
 redirect_url = "https://my-site/subscription/callback/debian-salsa"
-scopes = ["email"]
+scopes = ["email", "openid"]
diff --git a/debian/postinst b/debian/postinst
new file mode 100755
index 0000000..422d058
--- /dev/null
+++ b/debian/postinst
@@ -0,0 +1,42 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        if ! getent group | grep -q "^www-data:"; then
+            echo -n "Adding group www-data.."
+            addgroup --quiet --system www-data 2>/dev/null || true
+            echo ".done"
+        fi
+        test -d /var/www || mkdir /var/www
+        if ! getent passwd | grep -q "^www-data:"; then
+            echo -n "Adding system user www-data.."
+            adduser --quiet --system --ingroup www-data --no-create-home --disabled-password www-data 2>/dev/null || true
+            echo ".done"
+        fi
+        usermod -c www-data -d /var/www -g www-data www-data
+        if ! test -d /var/lib/subscribe-list/; then
+            mkdir -m 750 /var/lib/subscribe-list/
+            touch /var/lib/subscribe-list/list.db
+            chmod 640 /var/lib/subscribe-list/list.db
+            chown -R www-data:www-data /var/lib/subscribe-list/
+        fi
+        if ! test -d /etc/subscribe-list/; then
+            mkdir -m 750 /etc/subscribe-list/
+            install -m 640 /usr/share/subscribe-list/config.toml.sample /etc/subscribe-list/config.toml
+            chown -R root:www-data /etc/subscribe-list/
+        fi
+        ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+        ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0
\ No newline at end of file
diff --git a/diesel.toml b/diesel.toml
new file mode 100644
index 0000000..c028f4a
--- /dev/null
+++ b/diesel.toml
@@ -0,0 +1,9 @@
+# For documentation on how to configure this file,
+# see https://diesel.rs/guides/configuring-diesel-cli
+
+[print_schema]
+file = "src/schema.rs"
+custom_type_derives = ["diesel::query_builder::QueryId"]
+
+[migrations_directory]
+dir = "migrations"
diff --git a/migrations/.keep b/migrations/.keep
new file mode 100644
index 0000000..e69de29
diff --git a/migrations/2024-04-08-223926_create_accounts/down.sql b/migrations/2024-04-08-223926_create_accounts/down.sql
new file mode 100644
index 0000000..b882e7c
--- /dev/null
+++ b/migrations/2024-04-08-223926_create_accounts/down.sql
@@ -0,0 +1 @@
+DROP TABLE "accounts"
\ No newline at end of file
diff --git a/migrations/2024-04-08-223926_create_accounts/up.sql b/migrations/2024-04-08-223926_create_accounts/up.sql
new file mode 100644
index 0000000..db9059a
--- /dev/null
+++ b/migrations/2024-04-08-223926_create_accounts/up.sql
@@ -0,0 +1,4 @@
+CREATE TABLE "accounts" (
+    "email" TEXT NOT NULL PRIMARY KEY ASC,
+    "date" TIMESTAMP NOT NULL
+) WITHOUT ROWID;
\ No newline at end of file
diff --git a/migrations/2024-04-09-022737_add-email-unsubscribe-url-key/down.sql b/migrations/2024-04-09-022737_add-email-unsubscribe-url-key/down.sql
new file mode 100644
index 0000000..031d0dc
--- /dev/null
+++ b/migrations/2024-04-09-022737_add-email-unsubscribe-url-key/down.sql
@@ -0,0 +1 @@
+DROP TABLE "keys";
\ No newline at end of file
diff --git a/migrations/2024-04-09-022737_add-email-unsubscribe-url-key/up.sql b/migrations/2024-04-09-022737_add-email-unsubscribe-url-key/up.sql
new file mode 100644
index 0000000..96af126
--- /dev/null
+++ b/migrations/2024-04-09-022737_add-email-unsubscribe-url-key/up.sql
@@ -0,0 +1,4 @@
+CREATE TABLE "keys" (
+    "id" INTEGER PRIMARY KEY CHECK ("id" = 0) NOT NULL DEFAULT 0,
+    "email-unsubscribe-url" BLOB NOT NULL
+) WITHOUT ROWID;
\ No newline at end of file
diff --git a/src/app.rs b/src/app.rs
index 7186e7d..1dcc774 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -1,19 +1,24 @@
 use crate::{
     client::async_http_client,
-    config::{Config, OIDCProvider},
+    config::Config,
+    db::DbThread,
+    keys::Signed,
+    models::{Account, Keys},
 };
 use actix_session::Session;
 use actix_web::{
     get,
     http::header::{ContentType, LOCATION},
+    routes,
     web::{self, ServiceConfig},
     HttpResponse, Responder,
 };
-use eyre::{ensure, Context, OptionExt};
+use eyre::{ensure, OptionExt};
 use openidconnect::{
     core::{CoreAuthenticationFlow, CoreUserInfoClaims},
-    AuthorizationCode, CsrfToken, EndUserEmail, Nonce, OAuth2TokenResponse,
+    AuthorizationCode, CsrfToken, EndUserEmail, Nonce, OAuth2TokenResponse, TokenResponse,
 };
+use reqwest::Url;
 use serde::{Deserialize, Serialize};
 use std::marker::PhantomData;
 use tinytemplate::TinyTemplate;
@@ -47,7 +52,7 @@ impl<T: Template> DynTemplate for PhantomData<T> {
 macro_rules! templates {
     (
         $(
-            #[text = $text:literal]
+            #[text = $text:expr]
             $(#[$meta:meta])*
             $vis:vis struct $name:ident $fields:tt
         )*
@@ -72,26 +77,24 @@ pub struct SubscriptionLoggedOutTemplateProviders {
 }
 
 templates! {
-    #[text = r#"<head><title>Subscription</title></head>
-<body>
-<ul>
-{{- for provider in providers -}}
-<li><a href="{provider.url}">{provider.pretty_name}</a></li>
-{{- endfor -}}
-</ul>
-</body>"#]
+    #[text = include_str!(concat!(env!("OUT_DIR"), "/templates/SubscriptionLoggedOut.txt"))]
     #[derive(Debug, Serialize)]
     pub struct SubscriptionLoggedOutTemplate {
         pub providers: Vec<SubscriptionLoggedOutTemplateProviders>,
     }
-    #[text = r#"<head><title>Subscription</title></head>
-<body>
-<p>Logged in as {email}</p>
-</body>"#]
+    #[text = include_str!(concat!(env!("OUT_DIR"), "/templates/SubscriptionLoggedIn.txt"))]
     #[derive(Debug, Serialize)]
     pub struct SubscriptionLoggedInTemplate {
         pub email: EndUserEmail,
     }
+    #[text = r#"<head><title>Subscription</title></head>
+<body>
+<p>Bad Signature.</p>
+<hr/>
+<a href="/subscription">Register or Sign In</a>
+</body>"#]
+    #[derive(Debug, Serialize)]
+    pub struct SubscriptionBadSignature {}
 }
 
 pub fn make_templates() -> TinyTemplate<'static> {
@@ -129,7 +132,44 @@ impl SessionState {
     }
 }
 
-impl OIDCProvider {}
+pub async fn get_or_insert_account(
+    email: EndUserEmail,
+    session: &Session,
+    db: web::Data<DbThread>,
+) -> SessionState {
+    let state = SessionState {
+        email: email.clone(),
+    };
+    db.run_on(move |connection| {
+        use crate::schema::accounts::dsl::accounts;
+        use diesel::prelude::*;
+        let account = Account {
+            email: email.to_string(),
+            date: chrono::Utc::now().naive_utc(),
+        };
+        match diesel::insert_into(accounts)
+            .values(&account)
+            .on_conflict_do_nothing()
+            .execute(connection)
+        {
+            Ok(0) => {
+                log::debug!("found existing account: {}", account.email.as_str());
+            }
+            Ok(_) => {
+                log::info!("created new account: {}", account.email.as_str());
+            }
+            Err(e) => {
+                log::error!(
+                    "failed to get/insert account: {}\n{e}",
+                    account.email.as_str()
+                )
+            }
+        }
+    })
+    .await;
+    state.set(session);
+    state
+}
 
 const NONCE: &'static str = "nonce";
 const CSRF_TOKEN: &'static str = "csrf_token";
@@ -146,6 +186,7 @@ pub async fn callback(
     session: Session,
     path: web::Path<(String,)>,
     query: web::Query<AuthQuery>,
+    db: web::Data<DbThread>,
 ) -> impl Responder {
     let mut resp = HttpResponse::SeeOther().body("");
     resp.headers_mut()
@@ -155,15 +196,15 @@ pub async fn callback(
     }
     let body = async {
         let csrf_token = session
-            .get::<CsrfToken>(CSRF_TOKEN)
-            .context("invalid csrf token")?
-            .ok_or_eyre("missing csrf token")?;
+            .remove_as::<CsrfToken>(CSRF_TOKEN)
+            .ok_or_eyre("missing csrf token")?
+            .ok()
+            .ok_or_eyre("invalid csrf token")?;
         let nonce = session
-            .get::<Nonce>(NONCE)
-            .context("invalid nonce")?
-            .ok_or_eyre("missing nonce")?;
-        session.remove(CSRF_TOKEN);
-        session.remove(NONCE);
+            .remove_as::<Nonce>(NONCE)
+            .ok_or_eyre("missing nonce")?
+            .ok()
+            .ok_or_eyre("invalid nonce")?;
         ensure!(
             csrf_token.secret() == query.state.secret(),
             "csrf token doesn't match"
@@ -175,6 +216,14 @@ pub async fn callback(
             .exchange_code(query.into_inner().code)
             .request_async(async_http_client)
             .await?;
+        if let Some(id_token) = token.id_token() {
+            let id_token_claims =
+                id_token.claims(&provider.state().client.id_token_verifier(), &nonce)?;
+            if let Some(email) = id_token_claims.email().cloned() {
+                get_or_insert_account(email, &session, db).await;
+                return Ok(());
+            }
+        }
         let user_info: CoreUserInfoClaims = provider
             .state()
             .client
@@ -182,7 +231,7 @@ pub async fn callback(
             .request_async(async_http_client)
             .await?;
         let email = user_info.email().ok_or_eyre("no email provided")?.clone();
-        SessionState { email }.set(&session);
+        get_or_insert_account(email, &session, db).await;
         Ok(())
     };
     let result: eyre::Result<()> = body.await;
@@ -224,10 +273,93 @@ pub async fn login(
     resp
 }
 
+#[derive(Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct EmailUnsubscribeUrlQueryParams {
+    pub signed_email: Signed<EndUserEmail, ed25519_dalek::Signature>,
+}
+
+impl EmailUnsubscribeUrlQueryParams {
+    pub fn new(email: &EndUserEmail, keys: &Keys) -> Self {
+        Self {
+            signed_email: Signed::sign(email, keys.email_unsubscribe_url.secret()).unwrap(),
+        }
+    }
+    pub fn make_url(&self, config: &Config) -> Url {
+        let mut retval = config.server_base_url.join("/subscription/email").unwrap();
+        retval.set_query(Some(&serde_urlencoded::to_string(&self).unwrap()));
+        retval
+    }
+}
+
+#[get("/subscription/email")]
+pub async fn email_unsubscribe(
+    keys: web::Data<Keys>,
+    session: Session,
+    query: web::Query<EmailUnsubscribeUrlQueryParams>,
+) -> impl Responder {
+    let Ok(Ok(email)) = query
+        .signed_email
+        .verify(keys.email_unsubscribe_url.secret())
+    else {
+        return HttpResponse::Forbidden()
+            .content_type(ContentType::html())
+            .body(SubscriptionBadSignature {}.render().unwrap());
+    };
+    SessionState { email }.set(&session);
+    let mut resp = HttpResponse::SeeOther().body("");
+    resp.headers_mut()
+        .insert(LOCATION, "/subscription".parse().unwrap());
+    resp
+}
+
+#[get("/subscription/logout")]
+pub async fn logout(session: Session) -> impl Responder {
+    session.purge();
+    let mut resp = HttpResponse::SeeOther().body("");
+    resp.headers_mut()
+        .insert(LOCATION, "/subscription".parse().unwrap());
+    resp
+}
+
+#[get("/subscription/unsubscribe")]
+pub async fn unsubscribe(session: Session, db: web::Data<DbThread>) -> impl Responder {
+    if let Some(state) = SessionState::get(&session) {
+        db.run_on(move |connection| {
+            use crate::schema::accounts::dsl::*;
+            use diesel::prelude::*;
+            match diesel::delete(accounts.filter(email.eq(state.email.as_str())))
+                .execute(connection)
+            {
+                Ok(_) => {
+                    log::info!("deleted account: {}", state.email.as_str());
+                }
+                Err(e) => {
+                    log::error!("failed to delete account: {}\n{e}", state.email.as_str())
+                }
+            }
+        })
+        .await;
+    }
+    session.purge();
+    let mut resp = HttpResponse::SeeOther().body("");
+    resp.headers_mut()
+        .insert(LOCATION, "/subscription".parse().unwrap());
+    resp
+}
+
+#[routes]
 #[get("/subscription")]
-pub async fn subscription(config: web::Data<Config>, session: Session) -> impl Responder {
+#[get("/subscription/")]
+#[get("/subscription/index.html")]
+pub async fn subscription(
+    config: web::Data<Config>,
+    session: Session,
+    db: web::Data<DbThread>,
+) -> impl Responder {
     if let Some(SessionState { email }) = SessionState::get(&session) {
-        let mut template = SubscriptionLoggedInTemplate { email };
+        get_or_insert_account(email.clone(), &session, db).await;
+        let template = SubscriptionLoggedInTemplate { email };
         HttpResponse::Ok()
             .content_type(ContentType::html())
             .body(template.render().expect("rendering can't fail"))
@@ -247,8 +379,20 @@ pub async fn subscription(config: web::Data<Config>, session: Session) -> impl R
     }
 }
 
+pub async fn page_not_found() -> impl Responder {
+    HttpResponse::NotFound()
+        .content_type(ContentType::html())
+        .body(include_str!(concat!(env!("OUT_DIR"), "/website/404.html")))
+}
+
 pub fn all_services(cfg: &mut ServiceConfig) {
-    cfg.service(subscription).service(login).service(callback);
+    cfg.service(subscription)
+        .service(login)
+        .service(callback)
+        .service(logout)
+        .service(unsubscribe)
+        .service(email_unsubscribe)
+        .default_service(web::to(page_not_found));
 }
 
 #[cfg(test)]
diff --git a/src/cli.rs b/src/cli.rs
index aec9713..f1398dd 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -1,25 +1,52 @@
 use crate::config;
-use clap::{ArgAction, Args, Parser};
+use clap::{ArgAction, Args, Parser, Subcommand};
 use eyre::ensure;
-use futures::try_join;
+use futures::future::try_join_all;
 use listenfd::ListenFd;
-use std::{net::TcpListener, os::unix::net::UnixListener, path::PathBuf};
+
+use std::{future::Future, net::TcpListener, os::unix::net::UnixListener, path::PathBuf, pin::Pin};
 
 #[derive(Parser, Debug)]
 pub struct CLI {
-    #[arg(long, value_parser, value_name = "path/to/config.toml")]
+    #[arg(long, value_name = "path/to/config.toml")]
     pub config: config::Config,
-    #[command(flatten)]
-    pub listen: Listen,
+    #[command(subcommand)]
+    pub subcommand: CLISubcommand,
 }
 
 impl CLI {
     pub async fn resolve(&mut self, listenfd: &mut ListenFd) -> eyre::Result<()> {
-        try_join!(self.config.resolve(), self.listen.resolve(listenfd))?;
+        let mut futures: Vec<Pin<Box<dyn Future<Output = eyre::Result<()>> + Send>>> = vec![];
+        let resolve_provider_metadata;
+        match &mut self.subcommand {
+            CLISubcommand::Serve { listen } => {
+                resolve_provider_metadata = true;
+                futures.push(Box::pin(listen.resolve(listenfd)));
+            }
+            CLISubcommand::GenerateUnsubscribeUrls { emails: _ } => {
+                resolve_provider_metadata = false;
+            }
+        }
+        futures.push(Box::pin(self.config.resolve(resolve_provider_metadata)));
+        try_join_all(futures).await?;
+        if resolve_provider_metadata {
+            log::info!("retrieved config from auth servers");
+        }
         Ok(())
     }
 }
 
+#[derive(Subcommand, Debug)]
+pub enum CLISubcommand {
+    Serve {
+        #[command(flatten)]
+        listen: Listen,
+    },
+    GenerateUnsubscribeUrls {
+        emails: Vec<String>,
+    },
+}
+
 #[derive(Args, Debug)]
 #[group(required = true)]
 pub struct Listen {
diff --git a/src/config.rs b/src/config.rs
index 6107f11..043f46e 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,45 +1,71 @@
 use crate::client::async_http_client;
 use clap::builder::{TryMapValueParser, TypedValueParser, ValueParserFactory};
 use clio::CachedInput;
-use eyre::Context;
+use eyre::{ensure, Context, OptionExt};
 use futures::future::try_join_all;
 use indexmap::IndexMap;
 use openidconnect::{
     core::{CoreClient, CoreProviderMetadata},
     ClientId, ClientSecret, IssuerUrl, RedirectUrl, Scope,
 };
+use reqwest::Url;
 use serde::{Deserialize, Serialize};
+use std::num::NonZeroU16;
+
+pub fn default_db_thread_channel_capacity() -> NonZeroU16 {
+    NonZeroU16::new(10).unwrap()
+}
 
 #[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct Config {
+    pub sqlite_db: String,
+    #[serde(default = "default_db_thread_channel_capacity")]
+    pub db_thread_channel_capacity: NonZeroU16,
+    pub server_base_url: Url,
     pub oidc: IndexMap<String, OIDCProvider>,
 }
 
 impl ValueParserFactory for Config {
     type Parser = TryMapValueParser<
         <CachedInput as ValueParserFactory>::Parser,
-        fn(CachedInput) -> eyre::Result<Config>,
+        fn(CachedInput) -> Result<Config, String>,
     >;
 
     fn value_parser() -> Self::Parser {
-        CachedInput::value_parser().try_map(Config::load)
+        CachedInput::value_parser().try_map(|v| Config::load(&v).map_err(|e| format!("{e:#}")))
     }
 }
 
 impl Config {
+    #[allow(dead_code)]
     pub const EXAMPLE: &'static str =
         include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/config.toml.sample"));
     pub fn load_str(input: &str, path: impl ToString) -> eyre::Result<Config> {
         toml::from_str(input).wrap_err_with(|| path.to_string())
     }
 
-    pub fn load(input: CachedInput) -> eyre::Result<Config> {
+    pub fn load(input: &CachedInput) -> eyre::Result<Config> {
+        log::debug!("loading config from: {}", input.path());
         let s = std::str::from_utf8(input.get_data()).wrap_err_with(|| input.path().to_string())?;
-        toml::from_str(s).wrap_err_with(|| input.path().to_string())
+        Self::load_str(s, input.path())
     }
 
-    pub async fn resolve(&mut self) -> eyre::Result<()> {
-        try_join_all(self.oidc.iter_mut().map(|(_, provider)| provider.resolve())).await?;
+    pub async fn resolve(&mut self, resolve_provider_metadata: bool) -> eyre::Result<()> {
+        let expected_server_base_url: Url = self
+            .server_base_url
+            .origin()
+            .ascii_serialization()
+            .parse()
+            .ok()
+            .ok_or_eyre("invalid server_base_url")?;
+        ensure!(
+            self.server_base_url == expected_server_base_url,
+            "invalid server_base_url -- expected {expected_server_base_url}"
+        );
+        try_join_all(self.oidc.iter_mut().map(|(name, provider)| {
+            provider.resolve(name, resolve_provider_metadata, &self.server_base_url)
+        }))
+        .await?;
         Ok(())
     }
 }
@@ -66,21 +92,34 @@ impl OIDCProvider {
     pub fn state(&self) -> &OIDCProviderState {
         self.state.as_ref().expect("resolve called by main")
     }
-    pub async fn resolve(&mut self) -> eyre::Result<()> {
-        let provider_metadata =
-            CoreProviderMetadata::discover_async(self.issuer_url.clone(), async_http_client)
-                .await?;
-        let client = CoreClient::from_provider_metadata(
-            provider_metadata.clone(),
-            self.client_id.clone(),
-            Some(self.secret.clone()),
+    pub async fn resolve(
+        &mut self,
+        name: &str,
+        resolve_provider_metadata: bool,
+        server_base_url: &Url,
+    ) -> eyre::Result<()> {
+        let expected_redirect_url =
+            server_base_url.join(&format!("/subscription/callback/{name}"))?;
+        ensure!(
+            self.redirect_url.as_str() == expected_redirect_url.as_str(),
+            "oidc.{name:?}.redirect_url should be {expected_redirect_url}"
         );
-        let client = client.disable_openid_scope();
-        let client = client.set_redirect_uri(self.redirect_url.clone());
-        self.state = Some(OIDCProviderState {
-            client,
-            provider_metadata,
-        });
+        if resolve_provider_metadata {
+            let provider_metadata =
+                CoreProviderMetadata::discover_async(self.issuer_url.clone(), async_http_client)
+                    .await?;
+            let client = CoreClient::from_provider_metadata(
+                provider_metadata.clone(),
+                self.client_id.clone(),
+                Some(self.secret.clone()),
+            );
+            let client = client.disable_openid_scope();
+            let client = client.set_redirect_uri(self.redirect_url.clone());
+            self.state = Some(OIDCProviderState {
+                client,
+                provider_metadata,
+            });
+        }
         Ok(())
     }
 }
diff --git a/src/db.rs b/src/db.rs
new file mode 100644
index 0000000..46c44c3
--- /dev/null
+++ b/src/db.rs
@@ -0,0 +1,56 @@
+use tokio::sync::{mpsc, oneshot};
+
+struct DbThreadInner {
+    op_sender: mpsc::Sender<Box<dyn FnOnce(&mut diesel::SqliteConnection) + Send>>,
+    join_handle: std::thread::JoinHandle<()>,
+}
+
+pub struct DbThread(Option<DbThreadInner>);
+
+impl DbThread {
+    pub fn new(mut connection: diesel::SqliteConnection, buffer: usize) -> Self {
+        let (op_sender, mut op_receiver) =
+            mpsc::channel::<Box<dyn FnOnce(&mut diesel::SqliteConnection) + Send>>(buffer);
+        let join_handle = std::thread::spawn(move || loop {
+            let Some(f) = op_receiver.blocking_recv() else {
+                break;
+            };
+            f(&mut connection);
+        });
+        Self(Some(DbThreadInner {
+            op_sender,
+            join_handle,
+        }))
+    }
+    pub async fn run_on<
+        F: FnOnce(&mut diesel::SqliteConnection) -> T + Send + 'static,
+        T: Send + 'static,
+    >(
+        &self,
+        f: F,
+    ) -> T {
+        let (result_sender, result_receiver) = oneshot::channel();
+        self.0
+            .as_ref()
+            .unwrap()
+            .op_sender
+            .send(Box::new(move |connection| {
+                // if send failed, the future must have been canceled, so ignore send failures
+                let _ = result_sender.send(f(connection));
+            }))
+            .await
+            .expect("send to succeed");
+        result_receiver.await.expect("result to be written")
+    }
+}
+
+impl Drop for DbThread {
+    fn drop(&mut self) {
+        let DbThreadInner {
+            op_sender,
+            join_handle,
+        } = self.0.take().unwrap();
+        drop(op_sender);
+        join_handle.join().unwrap();
+    }
+}
diff --git a/src/keys.rs b/src/keys.rs
new file mode 100644
index 0000000..d0969e7
--- /dev/null
+++ b/src/keys.rs
@@ -0,0 +1,139 @@
+use crate::models::{Keys, OnlyZero};
+use core::fmt;
+use diesel::{
+    expression::TypedExpressionType, sql_types::SqlType, Connection, RunQueryDsl, SqliteConnection,
+};
+use ed25519_dalek::{
+    ed25519::{signature::rand_core::OsRng, SignatureEncoding},
+    SignatureError, Signer, Verifier,
+};
+use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use serde_with::{
+    base64::{Base64, UrlSafe},
+    formats::Unpadded,
+    serde_as,
+};
+use std::marker::PhantomData;
+
+#[derive(Copy, Clone)]
+pub struct Key<T>(T);
+
+impl<T> fmt::Debug for Key<T> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Key([redacted])")
+    }
+}
+
+impl<T> Key<T> {
+    pub fn new(v: T) -> Self {
+        Self(v)
+    }
+    pub fn secret(&self) -> &T {
+        &self.0
+    }
+}
+
+impl<ST, DB: diesel::backend::Backend> diesel::Queryable<ST, DB> for Key<ed25519_dalek::SigningKey>
+where
+    Vec<u8>: diesel::Queryable<ST, DB>,
+{
+    type Row = <Vec<u8> as diesel::Queryable<ST, DB>>::Row;
+
+    fn build(row: Self::Row) -> diesel::deserialize::Result<Self> {
+        let v = <Vec<u8> as diesel::Queryable<ST, DB>>::build(row)?;
+        Ok(Key(ed25519_dalek::SigningKey::try_from(&*v)?))
+    }
+}
+
+impl<T: SqlType + TypedExpressionType> diesel::expression::AsExpression<T>
+    for Key<ed25519_dalek::SigningKey>
+where
+    Vec<u8>: diesel::expression::AsExpression<T>,
+{
+    type Expression = <Vec<u8> as diesel::expression::AsExpression<T>>::Expression;
+
+    fn as_expression(self) -> Self::Expression {
+        Vec::<u8>::from(self.0.to_bytes()).as_expression()
+    }
+}
+
+impl<'a, T: SqlType + TypedExpressionType> diesel::expression::AsExpression<T>
+    for &'a Key<ed25519_dalek::SigningKey>
+where
+    &'a [u8]: diesel::expression::AsExpression<T>,
+{
+    type Expression = <&'a [u8] as diesel::expression::AsExpression<T>>::Expression;
+
+    fn as_expression(self) -> Self::Expression {
+        self.0.as_bytes()[..].as_expression()
+    }
+}
+
+impl<'a, T: SqlType + TypedExpressionType> diesel::expression::AsExpression<T>
+    for &'a &'_ Key<ed25519_dalek::SigningKey>
+where
+    &'a [u8]: diesel::expression::AsExpression<T>,
+{
+    type Expression = <&'a [u8] as diesel::expression::AsExpression<T>>::Expression;
+
+    fn as_expression(self) -> Self::Expression {
+        self.0.as_bytes()[..].as_expression()
+    }
+}
+
+pub fn get_or_make_keys(db: &mut SqliteConnection) -> eyre::Result<Keys> {
+    db.transaction(|db| -> eyre::Result<Keys> {
+        let keys: Option<Keys> = crate::schema::keys::dsl::keys.load(db)?.get(0).cloned();
+        if let Some(keys) = keys {
+            return Ok(keys);
+        }
+        let keys = Keys {
+            id: OnlyZero::Zero,
+            email_unsubscribe_url: Key::new(ed25519_dalek::SigningKey::generate(&mut OsRng)),
+        };
+        diesel::insert_into(crate::schema::keys::dsl::keys)
+            .values(keys.clone())
+            .execute(db)?;
+        Ok(keys)
+    })
+}
+
+#[serde_as]
+#[derive(Serialize, Deserialize)]
+pub struct Signed<T, S: SignatureEncoding> {
+    #[serde(rename = "v")]
+    value: String,
+    #[serde(rename = "s", bound(deserialize = "S::Repr: TryFrom<Vec<u8>>"))]
+    #[serde_as(as = "Base64<UrlSafe, Unpadded>")]
+    signature: S::Repr,
+    #[serde(skip)]
+    _phantom: PhantomData<(fn() -> T, S)>,
+}
+
+impl<T: Serialize + DeserializeOwned, S: SignatureEncoding> Signed<T, S> {
+    pub fn sign<K>(value: &T, key: &K) -> Result<Self, serde_json::Error>
+    where
+        K: Signer<S>,
+    {
+        let value = serde_json::to_string(value)?;
+        let signature = key.sign(value.as_bytes()).to_bytes();
+        Ok(Self {
+            value,
+            signature,
+            _phantom: PhantomData,
+        })
+    }
+    pub fn verify<K>(&self, key: &K) -> eyre::Result<Result<T, SignatureError>>
+    where
+        K: Verifier<S>,
+        for<'a> eyre::Report: From<<S as TryFrom<&'a [u8]>>::Error>,
+    {
+        if let Err(e) = key.verify(
+            &self.value.as_bytes(),
+            &S::try_from(self.signature.as_ref())?,
+        ) {
+            return Ok(Err(e));
+        }
+        Ok(Ok(serde_json::from_str(&self.value)?))
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 7235f9e..0887a55 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,22 +1,38 @@
-use crate::cli::{Listen, ListenFdSocket, ListenFdSockets};
+use crate::{
+    app::EmailUnsubscribeUrlQueryParams,
+    cli::{CLISubcommand, Listen, ListenFdSocket, ListenFdSockets},
+    config::Config,
+    db::DbThread,
+    keys::get_or_make_keys,
+    models::Keys,
+};
 use actix_session::{storage::CookieSessionStore, SessionMiddleware};
 use actix_web::{cookie::Key, web, App, HttpServer};
 use clap::Parser;
+use diesel::Connection;
+use diesel_migrations::{embed_migrations, EmbeddedMigrations, MigrationHarness};
+use eyre::eyre;
 use listenfd::ListenFd;
+use openidconnect::EndUserEmail;
+
+pub const MIGRATIONS: EmbeddedMigrations = embed_migrations!();
 
 mod app;
 mod cli;
 mod client;
 mod config;
+mod db;
+mod keys;
+mod models;
+mod schema;
 
-pub async fn main() -> eyre::Result<()> {
-    env_logger::init();
-    let mut listenfd = ListenFd::from_env();
-    color_eyre::install()?;
-    let mut args = cli::CLI::parse();
-    args.resolve(&mut listenfd).await?;
-    log::info!("retrieved config from auth servers");
-    let config = web::Data::new(args.config);
+pub async fn run_server(
+    config: Config,
+    db: web::Data<DbThread>,
+    keys: web::Data<Keys>,
+    listen: Listen,
+) -> eyre::Result<()> {
+    let config = web::Data::new(config);
     let cookie_session_key = Key::generate();
     let mut server = HttpServer::new(move || {
         let cookie_session =
@@ -26,13 +42,15 @@ pub async fn main() -> eyre::Result<()> {
         App::new()
             .wrap(cookie_session)
             .app_data(config.clone())
+            .app_data(db.clone())
+            .app_data(keys.clone())
             .configure(app::all_services)
     });
     let Listen {
         listen_tcp,
         listen_unix,
         listen_fd,
-    } = &mut args.listen;
+    } = listen;
     for sock in listen_tcp.iter() {
         server = server.bind_auto_h2c(sock)?;
     }
@@ -40,7 +58,7 @@ pub async fn main() -> eyre::Result<()> {
         server = server.bind_uds(sock)?;
     }
     if let Some(ListenFdSockets(sockets)) = listen_fd {
-        for sock in sockets.drain(..) {
+        for sock in sockets.into_iter() {
             server = match sock {
                 ListenFdSocket::Tcp(sock) => server.listen_auto_h2c(sock)?,
                 ListenFdSocket::Unix(sock) => server.listen_uds(sock)?,
@@ -51,3 +69,38 @@ pub async fn main() -> eyre::Result<()> {
     server.run().await?;
     Ok(())
 }
+
+pub async fn generate_unsubscribe_urls(
+    config: Config,
+    keys: web::Data<Keys>,
+    emails: Vec<String>,
+) -> eyre::Result<()> {
+    for email in emails {
+        let email = EndUserEmail::new(email);
+        let url = EmailUnsubscribeUrlQueryParams::new(&email, &keys).make_url(&config);
+        println!("{url}");
+    }
+    Ok(())
+}
+
+pub async fn main() -> eyre::Result<()> {
+    env_logger::init();
+    let mut listenfd = ListenFd::from_env();
+    color_eyre::install()?;
+    let mut cli = cli::CLI::parse();
+    let mut db = diesel::SqliteConnection::establish(&cli.config.sqlite_db)?;
+    db.run_pending_migrations(MIGRATIONS)
+        .map_err(|e| eyre!(e))?;
+    let keys = web::Data::new(get_or_make_keys(&mut db)?);
+    let db = web::Data::new(DbThread::new(
+        db,
+        cli.config.db_thread_channel_capacity.get().into(),
+    ));
+    cli.resolve(&mut listenfd).await?;
+    match cli.subcommand {
+        CLISubcommand::Serve { listen } => run_server(cli.config, db, keys, listen).await,
+        CLISubcommand::GenerateUnsubscribeUrls { emails } => {
+            generate_unsubscribe_urls(cli.config, keys, emails).await
+        }
+    }
+}
diff --git a/src/models.rs b/src/models.rs
new file mode 100644
index 0000000..502ab72
--- /dev/null
+++ b/src/models.rs
@@ -0,0 +1,43 @@
+use crate::keys::Key;
+use chrono::NaiveDateTime;
+use diesel::prelude::*;
+use eyre::ensure;
+
+#[derive(Queryable, Selectable, Insertable)]
+#[diesel(table_name = crate::schema::accounts)]
+#[diesel(check_for_backend(diesel::sqlite::Sqlite))]
+pub struct Account {
+    pub email: String,
+    pub date: NaiveDateTime,
+}
+
+#[derive(Copy, Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum OnlyZero {
+    #[default]
+    Zero = 0,
+}
+
+impl From<OnlyZero> for i32 {
+    fn from(_value: OnlyZero) -> Self {
+        0
+    }
+}
+
+impl TryFrom<i32> for OnlyZero {
+    type Error = eyre::Report;
+
+    fn try_from(value: i32) -> Result<Self, Self::Error> {
+        ensure!(value == 0, "tried to convert nonzero value into OnlyZero");
+        Ok(OnlyZero::Zero)
+    }
+}
+
+#[derive(Queryable, Selectable, Insertable, Clone)]
+#[diesel(table_name = crate::schema::keys)]
+#[diesel(check_for_backend(diesel::sqlite::Sqlite))]
+pub struct Keys {
+    #[diesel(serialize_as = i32)]
+    #[diesel(deserialize_as = i32)]
+    pub id: OnlyZero,
+    pub email_unsubscribe_url: Key<ed25519_dalek::SigningKey>,
+}
diff --git a/src/schema.rs b/src/schema.rs
new file mode 100644
index 0000000..93f31d2
--- /dev/null
+++ b/src/schema.rs
@@ -0,0 +1,21 @@
+// @generated automatically by Diesel CLI.
+
+diesel::table! {
+    accounts (email) {
+        email -> Text,
+        date -> Timestamp,
+    }
+}
+
+diesel::table! {
+    keys (id) {
+        id -> Integer,
+        #[sql_name = "email-unsubscribe-url"]
+        email_unsubscribe_url -> Binary,
+    }
+}
+
+diesel::allow_tables_to_appear_in_same_query!(
+    accounts,
+    keys,
+);
diff --git a/subscribe-list.service b/subscribe-list.service
new file mode 100644
index 0000000..06e4ac9
--- /dev/null
+++ b/subscribe-list.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=web server for managing subscriptions
+Requires=subscribe-list.socket
+
+[Service]
+Environment=RUST_LOG=info
+Type=exec
+ExecStartPre=test -f /var/lib/subscribe-list/list.db
+ExecStart=/usr/bin/subscribe-list --config /etc/subscribe-list/config.toml serve --listen-fd
+User=www-data
+Group=www-data
+
+[Install]
+Also=subscribe-list.socket
\ No newline at end of file
diff --git a/subscribe-list.socket b/subscribe-list.socket
new file mode 100644
index 0000000..8083ff1
--- /dev/null
+++ b/subscribe-list.socket
@@ -0,0 +1,8 @@
+[Unit]
+Description=subscribe-list socket
+
+[Socket]
+ListenStream=/run/subscribe-list.socket
+
+[Install]
+WantedBy=sockets.target
diff --git a/website b/website
new file mode 160000
index 0000000..bfa8bd2
--- /dev/null
+++ b/website
@@ -0,0 +1 @@
+Subproject commit bfa8bd253cb9ba1bcc1358891767f8c2411a63fe