diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/.gitignore b/.gitignore
index 112807c..edf038e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,39 @@
 /aardvark-dns-v1.0.3-vendor.tar.gz
 /aardvark-dns-v1.1.0-vendor.tar.gz
 /v1.1.0.tar.gz
+/aardvark-dns-v1.2.0-vendor.tar.gz
+/v1.2.0.tar.gz
+/aardvark-dns-v1.3.0-vendor.tar.gz
+/v1.3.0.tar.gz
+/aardvark-dns-v1.4.0-vendor.tar.gz
+/v1.4.0.tar.gz
+/aardvark-dns-v1.5.0-vendor.tar.gz
+/v1.5.0.tar.gz
+/aardvark-dns-v1.6.0-vendor.tar.gz
+/v1.6.0.tar.gz
+/v1.7.0.tar.gz
+/aardvark-dns-v1.7.0-vendor.tar.gz
+/v1.8.0.tar.gz
+/aardvark-dns-v1.8.0-vendor.tar.gz
+/v1.9.0.tar.gz
+/aardvark-dns-v1.9.0-vendor.tar.gz
+/v1.10.0.tar.gz
+/aardvark-dns-v1.10.0-vendor.tar.gz
+/v1.11.0.tar.gz
+/aardvark-dns-v1.11.0-vendor.tar.gz
+/aardvark-dns-v1.12.1-vendor.tar.gz
+/v1.12.1.tar.gz
+/v1.12.2.tar.gz
+/aardvark-dns-v1.12.2-vendor.tar.gz
+/v1.13.0.tar.gz
+/aardvark-dns-v1.13.0-vendor.tar.gz
+/v1.13.1.tar.gz
+/aardvark-dns-v1.13.1-vendor.tar.gz
+/v1.14.0.tar.gz
+/aardvark-dns-v1.14.0-vendor.tar.gz
+/v1.15.0.tar.gz
+/aardvark-dns-v1.15.0-vendor.tar.gz
+/v1.16.0.tar.gz
+/aardvark-dns-v1.16.0-vendor.tar.gz
+/v1.17.0.tar.gz
+/aardvark-dns-v1.17.0-vendor.tar.gz
diff --git a/.packit.yaml b/.packit.yaml
new file mode 100644
index 0000000..89d1cee
--- /dev/null
+++ b/.packit.yaml
@@ -0,0 +1,148 @@
+---
+# See the documentation for more information:
+# https://packit.dev/docs/configuration/
+
+downstream_package_name: aardvark-dns
+upstream_tag_template: v{version}
+
+# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
+# propose-downstream job. This is done so tests maintained upstream can be run
+# downstream in Zuul CI and Bodhi.
+# Ref: https://packit.dev/docs/configuration#files_to_sync
+files_to_sync:
+  - src: rpm/gating.yaml
+    dest: gating.yaml
+    delete: true
+  - src: plans/
+    dest: plans/
+    delete: true
+    mkpath: true
+  - src: test/tmt
+    dest: test/tmt
+    delete: true
+    mkpath: true
+  - src: .fmf/
+    dest: .fmf/
+    delete: true
+  - .packit.yaml
+
+packages:
+  aardvark-dns-fedora:
+    pkg_tool: fedpkg
+    specfile_path: rpm/aardvark-dns.spec
+  aardvark-dns-centos:
+    pkg_tool: centpkg
+    specfile_path: rpm/aardvark-dns.spec
+  aardvark-dns-eln:
+    specfile_path: rpm/aardvark-dns.spec
+
+srpm_build_deps:
+  - cargo
+  - git-archive-all
+  - make
+  - openssl-devel
+
+# https://packit.dev/docs/configuration/actions
+# fix-spec-file only operates on copr builds and doesn't affect official distro builds
+actions:
+  fix-spec-file: "bash .packit-copr-rpm.sh"
+
+jobs:
+  - job: copr_build
+    trigger: pull_request
+    packages: [aardvark-dns-fedora]
+    notifications: &copr_build_failure_notification
+      failure_comment:
+        message: "Ephemeral COPR build failed. @containers/packit-build please check."
+    targets: &fedora_copr_targets
+      - fedora-all-x86_64
+      - fedora-all-aarch64
+    enable_net: true
+    osh_diff_scan_after_copr_build: false
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [aardvark-dns-eln]
+    notifications: *copr_build_failure_notification
+    targets:
+      fedora-eln-x86_64:
+        additional_repos:
+          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
+      fedora-eln-aarch64:
+        additional_repos:
+          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
+    enable_net: true
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [aardvark-dns-centos]
+    notifications: *copr_build_failure_notification
+    targets: &centos_copr_targets
+      - centos-stream-9-x86_64
+      - centos-stream-9-aarch64
+      - centos-stream-10-x86_64
+      - centos-stream-10-aarch64
+    enable_net: true
+
+  # Run on commit to main branch
+  - job: copr_build
+    trigger: commit
+    packages: [aardvark-dns-fedora]
+    notifications:
+      failure_comment:
+        message: "podman-next COPR build failed. @containers/packit-build please check."
+    branch: main
+    owner: rhcontainerbot
+    project: podman-next
+    enable_net: true
+
+  # Tests on Fedora
+  - job: tests
+    trigger: pull_request
+    packages: [aardvark-dns-fedora]
+    notifications: &test_failure_notification
+      failure_comment:
+        message: "Tests failed. @containers/packit-build please check."
+    targets: *fedora_copr_targets
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
+
+  # Tests on CentOS Stream
+  - job: tests
+    trigger: pull_request
+    packages: [aardvark-dns-centos]
+    notifications: *test_failure_notification
+    targets: *centos_copr_targets
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
+
+  # Sync to Fedora
+  - job: propose_downstream
+    trigger: release
+    packages: [aardvark-dns-fedora]
+    update_release: false
+    dist_git_branches: &fedora_targets
+      - fedora-all
+
+  # Sync to CentOS Stream
+  - job: propose_downstream
+    trigger: release
+    packages: [aardvark-dns-centos]
+    update_release: false
+    dist_git_branches:
+      - c10s
+      - c9s
+
+  - job: koji_build
+    trigger: commit
+    packages: [aardvark-dns-fedora]
+    sidetag_group: netavark-releases
+    dependents:
+      - netavark
+    dist_git_branches: *fedora_targets
diff --git a/README.packit b/README.packit
new file mode 100644
index 0000000..e03362b
--- /dev/null
+++ b/README.packit
@@ -0,0 +1,3 @@
+This repository is maintained by packit.
+https://packit.dev/
+The file was generated using packit 1.12.0.post1.dev13+gd51655c23.
diff --git a/aardvark-dns.spec b/aardvark-dns.spec
index 7698896..08b71ac 100644
--- a/aardvark-dns.spec
+++ b/aardvark-dns.spec
@@ -1,135 +1,50 @@
 # trust-dns-{client,server} not available
 # using vendored deps
 
-# debuginfo doesn't work yet
-%global debug_package %{nil}
+%global with_debug 1
 
-%global built_tag v1.1.0
+%if 0%{?with_debug}
+%global _find_debuginfo_dwz_opts %{nil}
+%global _dwz_low_mem_die_limit 0
+%else
+%global debug_package %{nil}
+%endif
 
 Name: aardvark-dns
-Version: 1.1.0
-%if "%{_vendor}" == "debbuild"
-Packager: Lokesh Mandvekar <https://github.com/lsm5>
-License: ASL-2.0+
-Release: 0%{?dist}
+%if %{defined copr_username}
+Epoch: 102
 %else
-License: ASL 2.0 and BSD and MIT
+Epoch: 2
+%endif
+# DO NOT TOUCH the Version string!
+# The TRUE source of this specfile is:
+# https://github.com/containers/podman/blob/main/rpm/podman.spec
+# If that's what you're reading, Version must be 0, and will be updated by Packit for
+# copr and koji builds.
+# If you're reading this on dist-git, the version is automatically filled in by Packit.
+Version: 1.17.0
+# The `AND` needs to be uppercase in the License for SPDX compatibility
+License: Apache-2.0 AND MIT AND Zlib
 Release: %autorelease
-ExclusiveArch: %{rust_arches}
+%if %{defined golang_arches_future}
+ExclusiveArch: %{golang_arches_future}
+%else
+ExclusiveArch: aarch64 ppc64le s390x x86_64
 %endif
 Summary: Authoritative DNS server for A/AAAA container records
 URL: https://github.com/containers/%{name}
-Source0: %{url}/archive/%{built_tag}.tar.gz
-Source1: %{url}/releases/download/%{built_tag}/%{name}-%{built_tag}-vendor.tar.gz
+# Tarballs fetched from upstream's release page
+Source0: %{url}/archive/v%{version}.tar.gz
+Source1: %{url}/releases/download/v%{version}/%{name}-v%{version}-vendor.tar.gz
 BuildRequires: cargo
-%if "%{_vendor}" == "debbuild"
-BuildRequires: git
-%else
 BuildRequires: git-core
 BuildRequires: make
+%if %{defined rhel}
+# rust-toolset requires the `local` repo enabled on non-koji ELN build environments
+BuildRequires: rust-toolset
+%else
+BuildRequires: rust-packaging
 BuildRequires: rust-srpm-macros
-# cargo tree --prefix none | awk '{print "Provides: bundled(crate("$1")) = "$2}' | sort | uniq
-Provides: bundled(crate(aardvark-dns)) = v1.0.3
-Provides: bundled(crate(aho-corasick)) = v0.7.18
-Provides: bundled(crate(anyhow)) = v1.0.57
-Provides: bundled(crate(async-broadcast)) = v0.4.0
-Provides: bundled(crate(async-trait)) = v0.1.53
-Provides: bundled(crate(atty)) = v0.2.14
-Provides: bundled(crate(autocfg)) = v1.1.0
-Provides: bundled(crate(bitflags)) = v1.3.2
-Provides: bundled(crate(bytes)) = v1.1.0
-Provides: bundled(crate(cfg-if)) = v1.0.0
-Provides: bundled(crate(chrono)) = v0.4.19
-Provides: bundled(crate(clap)) = v3.1.15
-Provides: bundled(crate(clap_derive)) = v3.1.7
-Provides: bundled(crate(clap_lex)) = v0.2.0
-Provides: bundled(crate(data-encoding)) = v2.3.2
-Provides: bundled(crate(easy-parallel)) = v3.2.0
-Provides: bundled(crate(endian-type)) = v0.1.2
-Provides: bundled(crate(enum-as-inner)) = v0.4.0
-Provides: bundled(crate(env_logger)) = v0.9.0
-Provides: bundled(crate(error-chain)) = v0.12.4
-Provides: bundled(crate(event-listener)) = v2.5.2
-Provides: bundled(crate(form_urlencoded)) = v1.0.1
-Provides: bundled(crate(futures-channel)) = v0.3.21
-Provides: bundled(crate(futures-core)) = v0.3.21
-Provides: bundled(crate(futures-executor)) = v0.3.21
-Provides: bundled(crate(futures-io)) = v0.3.21
-Provides: bundled(crate(futures-macro)) = v0.3.21
-Provides: bundled(crate(futures-task)) = v0.3.21
-Provides: bundled(crate(futures-util)) = v0.3.21
-Provides: bundled(crate(getrandom)) = v0.2.6
-Provides: bundled(crate(hashbrown)) = v0.11.2
-Provides: bundled(crate(heck)) = v0.4.0
-Provides: bundled(crate(hostname)) = v0.3.1
-Provides: bundled(crate(humantime)) = v2.1.0
-Provides: bundled(crate(idna)) = v0.2.3
-Provides: bundled(crate(indexmap)) = v1.8.1
-Provides: bundled(crate(instant)) = v0.1.12
-Provides: bundled(crate(ipnet)) = v2.5.0
-Provides: bundled(crate(itoa)) = v1.0.1
-Provides: bundled(crate(lazy_static)) = v1.4.0
-Provides: bundled(crate(libc)) = v0.2.125
-Provides: bundled(crate(lock_api)) = v0.4.7
-Provides: bundled(crate(log)) = v0.4.17
-Provides: bundled(crate(match_cfg)) = v0.1.0
-Provides: bundled(crate(matches)) = v0.1.9
-Provides: bundled(crate(memchr)) = v2.5.0
-Provides: bundled(crate(mio)) = v0.8.2
-Provides: bundled(crate(nibble_vec)) = v0.1.0
-Provides: bundled(crate(num-integer)) = v0.1.45
-Provides: bundled(crate(num-traits)) = v0.2.15
-Provides: bundled(crate(num_cpus)) = v1.13.1
-Provides: bundled(crate(num_threads)) = v0.1.6
-Provides: bundled(crate(once_cell)) = v1.10.0
-Provides: bundled(crate(os_str_bytes)) = v6.0.0
-Provides: bundled(crate(parking_lot)) = v0.12.0
-Provides: bundled(crate(parking_lot_core)) = v0.9.3
-Provides: bundled(crate(percent-encoding)) = v2.1.0
-Provides: bundled(crate(pin-project-lite)) = v0.2.9
-Provides: bundled(crate(pin-utils)) = v0.1.0
-Provides: bundled(crate(ppv-lite86)) = v0.2.16
-Provides: bundled(crate(proc-macro-error)) = v1.0.4
-Provides: bundled(crate(proc-macro-error-attr)) = v1.0.4
-Provides: bundled(crate(proc-macro2)) = v1.0.37
-Provides: bundled(crate(quick-error)) = v1.2.3
-Provides: bundled(crate(quote)) = v1.0.18
-Provides: bundled(crate(radix_trie)) = v0.2.1
-Provides: bundled(crate(rand)) = v0.8.5
-Provides: bundled(crate(rand_chacha)) = v0.3.1
-Provides: bundled(crate(rand_core)) = v0.6.3
-Provides: bundled(crate(regex)) = v1.5.5
-Provides: bundled(crate(regex-syntax)) = v0.6.25
-Provides: bundled(crate(resolv-conf)) = v0.7.0
-Provides: bundled(crate(scopeguard)) = v1.1.0
-Provides: bundled(crate(serde)) = v1.0.137
-Provides: bundled(crate(serde_derive)) = v1.0.137
-Provides: bundled(crate(signal-hook)) = v0.3.13
-Provides: bundled(crate(signal-hook-registry)) = v1.4.0
-Provides: bundled(crate(slab)) = v0.4.6
-Provides: bundled(crate(smallvec)) = v1.8.0
-Provides: bundled(crate(socket2)) = v0.4.4
-Provides: bundled(crate(strsim)) = v0.10.0
-Provides: bundled(crate(syn)) = v1.0.92
-Provides: bundled(crate(syslog)) = v6.0.1
-Provides: bundled(crate(termcolor)) = v1.1.3
-Provides: bundled(crate(textwrap)) = v0.15.0
-Provides: bundled(crate(thiserror)) = v1.0.31
-Provides: bundled(crate(thiserror-impl)) = v1.0.31
-Provides: bundled(crate(time)) = v0.3.9
-Provides: bundled(crate(tinyvec)) = v1.6.0
-Provides: bundled(crate(tinyvec_macros)) = v0.1.0
-Provides: bundled(crate(tokio)) = v1.18.1
-Provides: bundled(crate(tokio-macros)) = v1.7.0
-Provides: bundled(crate(toml)) = v0.5.9
-Provides: bundled(crate(trust-dns-client)) = v0.21.2
-Provides: bundled(crate(trust-dns-proto)) = v0.21.2
-Provides: bundled(crate(trust-dns-server)) = v0.21.2
-Provides: bundled(crate(unicode-bidi)) = v0.3.8
-Provides: bundled(crate(unicode-normalization)) = v0.1.19
-Provides: bundled(crate(unicode-xid)) = v0.2.3
-Provides: bundled(crate(url)) = v2.2.2
-Provides: bundled(crate(version_check)) = v0.9.4
 %endif
 
 %description
@@ -138,31 +53,67 @@ Provides: bundled(crate(version_check)) = v0.9.4
 Forwards other request to configured resolvers.
 Read more about configuration in `src/backend/mod.rs`.
 
+%package tests
+Summary: Tests for %{name}
+
+Requires: %{name} = %{epoch}:%{version}-%{release}
+Requires: bats
+Requires: bind-utils
+Requires: jq
+Requires: netavark
+Requires: socat
+Requires: dnsmasq
+
+%description tests
+%{summary}
+
+This package contains system tests for %{name} and is only intended to be used
+for gating tests.
+
 %prep
-%autosetup -Sgit
+%autosetup -Sgit %{name}-%{version}
+# Following steps are only required on environments like koji which have no
+# network access and thus depend on the vendored tarball. Copr pulls
+# dependencies directly from the network.
+%if !%{defined copr_username}
 tar fx %{SOURCE1}
-mkdir -p .cargo
-
-cat >.cargo/config << EOF
-[source.crates-io]
-replace-with = "vendored-sources"
-
-[source.vendored-sources]
-directory = "vendor"
-EOF
+%if 0%{?fedora} || 0%{?rhel} >= 10
+%cargo_prep -v vendor
+%else
+%cargo_prep -V 1
+%endif
+%endif
 
 %build
-%{__make} build
+%{__make} CARGO="%{__cargo}" build
+%if (0%{?fedora} || 0%{?rhel} >= 10) && !%{defined copr_username}
+%cargo_license_summary
+%{cargo_license} > LICENSE.dependencies
+%cargo_vendor_manifest
+%endif
 
 %install
 %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install
 
+%{__install} -d -p %{buildroot}%{_datadir}/%{name}/test
+%{__cp} -rp test/* %{buildroot}%{_datadir}/%{name}/test/
+%{__rm} -rf %{buildroot}%{_datadir}/%{name}/test/tmt/
+
+# Add empty check section to silence rpmlint warning.
+# No tests meant to be run here.
+%check
+
 %files
 %license LICENSE
+%if (0%{?fedora} || 0%{?rhel} >= 10) && !%{defined copr_username}
+%license LICENSE.dependencies
+%license cargo-vendor.txt
+%endif
 %dir %{_libexecdir}/podman
 %{_libexecdir}/podman/%{name}
 
+%files tests
+%{_datadir}/%{name}/test
+
 %changelog
-%if "%{_vendor}" != "debbuild"
 %autochangelog
-%endif
diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..1fb3172
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,16 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts:
+  - bodhi_update_push_stable
+  - bodhi_update_push_testing
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
diff --git a/plans/main.fmf b/plans/main.fmf
new file mode 100644
index 0000000..2b884e7
--- /dev/null
+++ b/plans/main.fmf
@@ -0,0 +1,33 @@
+discover:
+    how: fmf
+execute:
+    how: tmt
+prepare:
+    - when: distro == centos-stream or distro == rhel
+      how: shell
+      script: |
+        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
+        dnf -y config-manager --set-enabled epel
+      order: 10
+    - when: initiator == packit
+      how: shell
+      script: |
+        COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo"
+        if compgen -G $COPR_REPO_FILE > /dev/null; then
+            sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE
+        fi
+        dnf -y upgrade --allowerasing
+      order: 20
+
+/no-rpm:
+    summary: Run tests independent of rpm
+    discover+:
+        filter: tag:no-rpm
+    adjust+:
+        - enabled: false
+          when: initiator is not defined or initiator != packit
+
+/rpm:
+    summary: Run tests on the rpm
+    discover+:
+        filter: tag:rpm
diff --git a/sources b/sources
index 1b8d3a2..413dc03 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (aardvark-dns-v1.1.0-vendor.tar.gz) = b2c28eb900efc0a4b1c9d39db334ee4613c518689b5a86ea97b8d543ab69331c07c02963339f7c91ec0a2510f8cad0e7efcd4db570f9ed3df77953a85bf91ee2
-SHA512 (v1.1.0.tar.gz) = 96acfac34f6cb894dc7ea170d74de6342da95d345f4109703e0d57ff98662968251fafde8e8a4f5c047a6ff4725ca632b598d024b6660d7dc4a07afeffdee26a
+SHA512 (v1.17.0.tar.gz) = 42e3a261bb5b9df83b8bb853ed50dd7dfda643895262aedf5ccdc865c598e913996a244d234ac309a18ee1a884b7ba847679dfe5d8b6521e674114c8aba552da
+SHA512 (aardvark-dns-v1.17.0-vendor.tar.gz) = b7ec2a2a34d5bb36dbcc55611dc9ec0ff2c1bed4469cc4b12d4eb0bd78bb7d6cae6f80a02ac32ade5c435fdd11e22ddd99646aa4de504c8369ee56cfa470e6a5
diff --git a/test/tmt/tmt/main.fmf b/test/tmt/tmt/main.fmf
new file mode 100644
index 0000000..9210cc8
--- /dev/null
+++ b/test/tmt/tmt/main.fmf
@@ -0,0 +1,26 @@
+/validate:
+    tag: [ no-rpm, validate ]
+    summary: Validate test
+    test: make -C ../.. validate
+    require:
+        - clippy
+        - rustfmt
+
+/unit:
+    tag: [ no-rpm, unit ]
+    summary: Unit tests
+    test: make -C ../.. unit
+    require:
+        - cargo
+
+/integration:
+    tag: [ rpm, integration ]
+    summary: Integration tests
+    test: bash test_integration.sh
+    environment:
+        AARDVARK: /usr/libexec/podman/aardvark-dns
+    require:
+        - aardvark-dns-tests
+    adjust:
+        duration: 10m
+        when: arch == aarch64
diff --git a/test/tmt/tmt/test_integration.sh b/test/tmt/tmt/test_integration.sh
new file mode 100644
index 0000000..0839800
--- /dev/null
+++ b/test/tmt/tmt/test_integration.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+rpm -q aardvark-dns aardvark-dns-tests netavark
+
+cd /usr/share/aardvark-dns/
+bats test/