diff --git a/Cargo.lock b/Cargo.lock
index 15828b7..7fdc83f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -70,6 +70,15 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "api"
+version = "0.1.0"
+dependencies = [
+ "capnp",
+ "capnpc",
+ "walkdir",
+]
+
 [[package]]
 name = "arrayref"
 version = "0.3.6"
@@ -602,15 +611,14 @@ dependencies = [
 name = "diflouroborane"
 version = "0.3.0"
 dependencies = [
+ "api",
  "async-channel",
  "async-native-tls",
  "async-oneshot",
  "async-trait",
  "bincode",
  "capnp",
- "capnp-futures",
  "capnp-rpc",
- "capnpc",
  "chrono",
  "clap",
  "erased-serde",
@@ -637,7 +645,6 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "uuid",
- "walkdir",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index f4be257..1223920 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -57,10 +57,9 @@ tracing = "0.1.28"
 tracing-subscriber = "0.2.25"
 
 # API
-capnp = "0.14.3"
-capnpc = "0.14.4"
+api = { path = "api" }
+capnp = "0.14"
 capnp-rpc = "0.14.1"
-capnp-futures = "0.14.1"
 
 # API Authentication
 rsasl = "1.4.0" # TODO update this if bindgen breaks (again)
@@ -76,11 +75,6 @@ erased-serde = "0.3"
 serde_dhall = { version = "0.10.1", default-features = false }
 serde_json = "1.0"
 
-[build-dependencies]
-capnpc = "0.14.4"
-# Used in build.rs to iterate over all files in schema/
-walkdir = "2.3.2"
-
 [dev-dependencies]
 futures-test = "0.3.16"
 tempfile = "3.2"
diff --git a/api/Cargo.toml b/api/Cargo.toml
index d968b7b..9a8ff7f 100644
--- a/api/Cargo.toml
+++ b/api/Cargo.toml
@@ -2,7 +2,15 @@
 name = "api"
 version = "0.1.0"
 edition = "2021"
+build = "build.rs"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
+capnp = "0.14.3"
+capnpc = "0.14.4"
+
+[build-dependencies]
+capnpc = "0.14.4"
+# Used in build.rs to iterate over all files in schema/
+walkdir = "2.3.2"
diff --git a/api/build.rs b/api/build.rs
index a353525..f764b78 100644
--- a/api/build.rs
+++ b/api/build.rs
@@ -8,14 +8,8 @@ fn is_hidden(entry: &DirEntry) -> bool {
 }
 
 fn main() {
-    // Tell cargo to only run this script if the schema files or this script have changed
-    println!("cargo:rerun-if-changed=schema");
-
     let mut compile_command = ::capnpc::CompilerCommand::new();
-
-    // Set parent module of all generated schema files.
-    // i.e. a file "user.capnp" will result in module "schema::user"
-    compile_command.default_parent_module(vec!["schema".into()]);
+    compile_command.src_prefix("schema");
 
     for entry in WalkDir::new("schema")
         .max_depth(2)
diff --git a/api/schema b/api/schema
index 3023fb2..f713df2 160000
--- a/api/schema
+++ b/api/schema
@@ -1 +1 @@
-Subproject commit 3023fb22598980352f0865825f6d91ce5f20754e
+Subproject commit f713df2221727f2f9535be4c4c9ae36de77c1a63
diff --git a/api/src/lib.rs b/api/src/lib.rs
index 1b4a90c..69c9f77 100644
--- a/api/src/lib.rs
+++ b/api/src/lib.rs
@@ -1,8 +1,41 @@
-#[cfg(test)]
-mod tests {
-    #[test]
-    fn it_works() {
-        let result = 2 + 2;
-        assert_eq!(result, 4);
-    }
+pub use capnpc::schema_capnp;
+
+#[allow(dead_code)]
+pub mod auth_capnp {
+    include!(concat!(env!("OUT_DIR"), "/auth_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod main_capnp {
+    include!(concat!(env!("OUT_DIR"), "/main_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod utils_capnp {
+    include!(concat!(env!("OUT_DIR"), "/utils_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod resource_capnp {
+    include!(concat!(env!("OUT_DIR"), "/resource_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod resources_capnp {
+    include!(concat!(env!("OUT_DIR"), "/resources_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod role_capnp {
+    include!(concat!(env!("OUT_DIR"), "/role_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod user_capnp {
+    include!(concat!(env!("OUT_DIR"), "/user_capnp.rs"));
+}
+
+#[allow(dead_code)]
+pub mod users_capnp {
+    include!(concat!(env!("OUT_DIR"), "/users_capnp.rs"));
 }
diff --git a/bffhd/lib.rs b/bffhd/lib.rs
index e662035..250dc11 100644
--- a/bffhd/lib.rs
+++ b/bffhd/lib.rs
@@ -1,13 +1,13 @@
 #![forbid(unused_imports)]
+#![warn(missing_docs, missing_debug_implementations)]
+
 
-pub mod config;
 pub mod db;
 pub mod error;
 pub mod network;
 pub mod oid;
 pub mod permissions;
 pub mod resource;
-pub mod schema;
 pub mod state;
 pub mod varint;
 
diff --git a/bffhd/oid.rs b/bffhd/oid.rs
index 4913952..9096399 100644
--- a/bffhd/oid.rs
+++ b/bffhd/oid.rs
@@ -1,4 +1,4 @@
-//! oid crate by https://github.com/UnnecessaryEngineering/oid turned into vendore'd module
+//! oid crate by <https://github.com/UnnecessaryEngineering/oid> turned into vendore'd module
 //!
 //! [Object Identifiers] are a standard of the [ITU] used to reference objects, things, and
 //! concepts in a globally unique way. This crate provides for data structures and methods
diff --git a/bffhd/schema.rs b/bffhd/schema.rs
deleted file mode 100644
index 70d6308..0000000
--- a/bffhd/schema.rs
+++ /dev/null
@@ -1,41 +0,0 @@
-pub use capnpc::schema_capnp;
-
-#[allow(dead_code)]
-pub mod auth_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/auth_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod main_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/main_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod utils_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/utils_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod resource_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/resource_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod resources_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/resources_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod role_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/role_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod user_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/user_capnp.rs"));
-}
-
-#[allow(dead_code)]
-pub mod users_capnp {
-    include!(concat!(env!("OUT_DIR"), "/schema/users_capnp.rs"));
-}
diff --git a/bffhd/varint.rs b/bffhd/varint.rs
index 85ae9e9..a7d3f83 100644
--- a/bffhd/varint.rs
+++ b/bffhd/varint.rs
@@ -113,6 +113,7 @@ impl_convert_from_to!(u32, 5, VarU32);
 impl_convert_from_to!(u64, 10, VarU64);
 impl_convert_from_to!(u128, 19, VarU128);
 
+#[allow(dead_code)]
 #[cfg(target_pointer_width = "64")]
 type VarUsize = VarU64;
 #[cfg(target_pointer_width = "32")]
diff --git a/bffhd/config.rs b/bin/bffhd/config.rs
similarity index 98%
rename from bffhd/config.rs
rename to bin/bffhd/config.rs
index 5d8afb8..b2b4a51 100644
--- a/bffhd/config.rs
+++ b/bin/bffhd/config.rs
@@ -7,7 +7,7 @@ use serde::{Serialize, Deserialize, Deserializer, Serializer};
 use std::fmt::Formatter;
 use std::net::{SocketAddr, IpAddr, ToSocketAddrs};
 use std::str::FromStr;
-use crate::permissions::{PermRule, RoleIdentifier};
+use diflouroborane::permissions::{PermRule, RoleIdentifier};
 use serde::de::Error;
 
 type Result<T> = std::result::Result<T, serde_dhall::Error>;
diff --git a/bin/bffhd/main.rs b/bin/bffhd/main.rs
index f480e4b..009bb32 100644
--- a/bin/bffhd/main.rs
+++ b/bin/bffhd/main.rs
@@ -5,10 +5,12 @@ use std::{
 };
 use clap::{App, Arg, crate_version, crate_description, crate_name};
 use std::str::FromStr;
-use diflouroborane::{config, error::Error};
+use diflouroborane::{error::Error};
 use diflouroborane::db::{Databases, Dump};
 use std::net::ToSocketAddrs;
 
+mod config;
+
 fn main() -> Result<(), Error> {
     tracing_subscriber::fmt::init();
     // Argument parsing
diff --git a/docs/connection-state.dot b/docs/connection-state.dot
index 5806f85..9080e36 100644
--- a/docs/connection-state.dot
+++ b/docs/connection-state.dot
@@ -1,6 +1,11 @@
 strict digraph connection {
     Establish [label="TCP/SCTP connection established"];
     Closed [label="TCP/SCTP connection closed"];
+    Open;
+    SASL;
+    Authenticated;
+    STARTTLS;
+    Encrypted;
 
     Establish -> Open [label=open];