fix html download + address extension mentionned in original commit

Recordings were failing to download in the local stack because of
several small issues stacked together:

* nginx: add a `/media/recordings/` location that authorizes
  against `recordings/media-auth/`. Before, every media request
  went to `files/media-auth/`, which returned 403 for recording
  paths.
* nginx: call `proxy_hide_header Content-Disposition` before
  `add_header Content-Disposition "attachment"`. Garage stored the
  header as `inline`, which combined with nginx's value into
  `inline, attachment` and broke browser downloads.
* frontend: `mediaUrl()` now uses the frontend origin, so
  recording links go through the Vite `/media` proxy instead of
  hitting Django directly on `:8071`.
* frontend: include the file extension in the download filename.

.github/workflows/ci.yml

@@ -226,8 +226,9 @@ jobs:
       REDIS_URL: redis://localhost:6379/1
       STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
       AWS_S3_ENDPOINT_URL: http://localhost:9000
-      AWS_S3_ACCESS_KEY_ID: meet
-      AWS_S3_SECRET_ACCESS_KEY: password
+      AWS_S3_ACCESS_KEY_ID: meet-access-key
+      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
+      AWS_S3_REGION_NAME: local
       OIDC_RS_CLIENT_ID: meet
       OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
       OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
@@ -250,34 +251,22 @@ jobs:
           path: "src/backend/core/templates/mail"
           key: mail-templates-${{ hashFiles('src/mail/mjml') }}
 
-      - name: Start MinIO
+      # Creates the access key and the bucket on startup
+      - name: Start Garage
         run: |
-          docker pull quay.io/minio/minio
-          docker run -d --name minio \
+          docker run -d --name garage \
             -p 9000:9000 \
-            -e "MINIO_ACCESS_KEY=meet" \
-            -e "MINIO_SECRET_KEY=password" \
-            -v /data/media:/data \
-            quay.io/minio/minio server --console-address :9001 /data
+            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
+            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
+            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
+            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
+            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
+            dxflrs/garage:v2.4.1 \
+            /garage server --single-node --default-bucket
 
-      # Tool to wait for a service to be ready
-      - name: Install Dockerize
+      - name: Wait for Garage to be ready
         run: |
-          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
-            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
-            sudo tar -C /usr/local/bin -xzv
-
-      - name: Wait for MinIO to be ready
-        run: |
-          dockerize -wait tcp://localhost:9000 -timeout 10s
-
-      - name: Configure MinIO
-        run: |
-          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
-          docker exec ${MINIO} sh -c \
-            "mc alias set meet http://localhost:9000 meet password && \
-            mc alias ls && \
-            mc mb meet/meet-media-storage"
+          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'
 
       - name: Install Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -310,9 +299,9 @@ jobs:
     env:
       AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
       AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
-      AWS_S3_ENDPOINT_URL: "minio:9000"
-      AWS_S3_ACCESS_KEY_ID: "meet"
-      AWS_S3_SECRET_ACCESS_KEY: "password"
+      AWS_S3_ENDPOINT_URL: "garage:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
+      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
       WHISPERX_BASE_URL: "https://configure-your-url.com"
       WHISPERX_ASR_MODEL: "large-v2"
       WHISPERX_API_KEY: "test-whisperx-secret"

CHANGELOG.md

@@ -8,6 +8,16 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- ⬆️(backend) update python dependencies
+- ⬆️(summary) update python dependencies
+- ⬆️(agents) update python dependencies
+
+### Fixed
+
+- ⚡️(frontend) disable posthog-js periodic feature flag reloads
+
 ## [1.32.1] - 2026-09-25
 
 ### Fixed
@@ -20,8 +30,10 @@ and this project adheres to
 ### Added
 
 - ✨(backend) make the LiveKit default video codec configurable
+- ✨(backend) purge rooms inactive for a configurable period
 - 🔧(dev) add support for Bureautix workstations
 - ✨(frontend) add screen share zoom controls #1498
+- 🔨(makefile) add targets to list and download files stored in Garage
 
 ### Changed
 
@@ -40,6 +52,9 @@ and this project adheres to
 - ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
 - 🔖(helm) release chart 0.0.28
 - ♻️(backend) decouple recording event handling from LiveKit egress statuses
+- ♻️(agents) replace the minio client by boto3
+- 🔧(compose) replace MinIO by Garage for local development
+- 🔧(helm) point media services to Garage by default
 
 ### Fixed
 

Makefile

@@ -69,6 +69,22 @@ LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT)
 # -- Frontend
 PATH_FRONT          = ./src/frontend
 
+# -- Storage
+GARAGE_BUCKET       = meet-media-storage
+STORAGE_FOLDERS     = recordings transcripts summaries
+STORAGE_DIRS        = $(addprefix data/,$(STORAGE_FOLDERS))
+COMPOSE_RUN_AWS     = $(COMPOSE_RUN) --user $(DOCKER_USER)
+AWS_CLI             = garage-cors --endpoint-url=http://garage:9000
+# Extensions listed in each folder (skips the Egress manifests in recordings/)
+recordings_EXTENSIONS  = mp4 ogg
+transcripts_EXTENSIONS = json
+summaries_EXTENSIONS   = txt
+# $(1): folder. Lists its objects with a known extension, most recent first
+storage_list        = s3api list-objects-v2 --bucket $(GARAGE_BUCKET) \
+  --prefix $(1)/
+storage_query       = reverse(sort_by(Contents[?$(foreach ext,$($(1)_EXTENSIONS), \
+  ends_with(Key, `".$(ext)"`) ||) `false`] || `[]`, &LastModified))
+
 # ==============================================================================
 # RULES
 
@@ -77,6 +93,9 @@ default: help
 data/media:
 	@mkdir -p data/media
 
+$(STORAGE_DIRS):
+	@mkdir -p $@
+
 data/static:
 	@mkdir -p data/static
 
@@ -85,6 +104,7 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
+	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
@@ -317,12 +337,38 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret
 
+env.d/development/garage:
+	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
+		env.d/development/garage.dist > env.d/development/garage
+
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber
 
 env.d/development/metadata_collector:
 	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector
 
+# -- Storage
+
+recordings-download-latest: ## download the latest recording from Garage into data/recordings
+transcripts-download-latest: ## download the latest transcript from Garage into data/transcripts
+summaries-download-latest: ## download the latest summary from Garage into data/summaries
+$(STORAGE_FOLDERS:%=%-download-latest): %-download-latest: data/%
+	@key=$$($(COMPOSE_RUN_AWS) -T $(AWS_CLI) $(call storage_list,$*) \
+		--query '$(call storage_query,$*)[0].Key' --output text) && \
+	if [ "$$key" = "None" ]; then echo "No $* found"; exit 1; fi && \
+	$(COMPOSE_RUN_AWS) --volume $(CURDIR)/data/$*:/aws/data/$* \
+		$(AWS_CLI) s3 cp "s3://$(GARAGE_BUCKET)/$$key" data/$*/
+.PHONY: $(STORAGE_FOLDERS:%=%-download-latest)
+
+recordings-list: ## list recordings stored in Garage, most recent first
+transcripts-list: ## list transcripts stored in Garage, most recent first
+summaries-list: ## list summaries stored in Garage, most recent first
+$(STORAGE_FOLDERS:%=%-list): %-list:
+	@$(COMPOSE_RUN_AWS) $(AWS_CLI) $(call storage_list,$*) \
+		--query '$(call storage_query,$*)[].{Date: LastModified, Key: Key, "Size (bytes)": Size}' \
+		--output table
+.PHONY: $(STORAGE_FOLDERS:%=%-list)
+
 # -- Internationalization
 
 env.d/development/crowdin:

UPGRADE.md

@@ -16,6 +16,44 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
+### Purging inactive rooms
+
+Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
+
+- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
+- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
+- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
+- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
+- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
+
+* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
+* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
+
+### Local development: MinIO replaced by Garage
+
+The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
+
+To migrate a local environment:
+
+1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
+2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
+3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
+4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
+5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
+
+### Summary service and metadata collector: boto3 replaces the minio client
+
+The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
+Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
+
+Also:
+- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
+- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
+
+### Helm chart: media services default to Garage
+
+The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
+
 ## v1.30.0
 
 ### Removing S3 storage-event webhooks for recordings

bin/Tiltfile

@@ -104,8 +104,8 @@ k8s_yaml(secret_yaml_generic(
 
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
 
-k8s_resource('minio-bucket', resource_deps=['minio'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
+k8s_resource('garage-cors', resource_deps=['garage'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])

compose.yml

@@ -15,36 +15,44 @@ services:
     ports:
       - "1081:1080"
 
-  minio:
+  garage:
     user: ${DOCKER_USER:-1000}
-    image: quay.io/minio/minio
+    image: dxflrs/garage:v2.4.1
+    command: /garage server --single-node --default-bucket
+    env_file:
+      - env.d/development/garage
     environment:
-      - MINIO_ROOT_USER=meet
-      - MINIO_ROOT_PASSWORD=password
+      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
+      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
+      - GARAGE_DEFAULT_BUCKET=meet-media-storage
     ports:
-      - '9000:9000'
-      - '9001:9001'
+      - '127.0.0.1:9000:9000'
     healthcheck:
-      test: [ "CMD", "mc", "ready", "local" ]
+      test: [ "CMD", "/garage", "health" ]
       interval: 1s
       timeout: 20s
       retries: 300
-    entrypoint: ""
-    command: minio server --console-address :9001 /data
     volumes:
-      - ./data/media:/data
+      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
+      - ./data/media:/var/lib/garage
 
-  createbuckets:
-    image: quay.io/minio/mc
+  # Garage denies cross-origin requests by default: allow the frontend to upload files
+  garage-cors:
+    image: amazon/aws-cli:2.37.1
+    environment:
+      - AWS_ACCESS_KEY_ID=meet-access-key
+      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
+      - AWS_DEFAULT_REGION=local
     depends_on:
-      minio:
+      garage:
         condition: service_healthy
         restart: true
-    entrypoint: >
-      sh -c "
-      /usr/bin/mc alias set meet http://minio:9000 meet password && \
-      /usr/bin/mc mb meet/meet-media-storage && \
-      exit 0;"
+    command:
+      - s3api
+      - put-bucket-cors
+      - --endpoint-url=http://garage:9000
+      - --bucket=meet-media-storage
+      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
 
   app-dev:
     build:
@@ -70,7 +78,7 @@ services:
         - postgresql
         - mailcatcher
         - redis
-        - createbuckets
+        - garage-cors
     extra_hosts:
       - "127.0.0.1.nip.io:host-gateway"
     networks:
@@ -110,7 +118,7 @@ services:
       - postgresql
       - redis
       - livekit
-      - minio
+      - garage
 
   celery:
     user: ${DOCKER_USER:-1000}
@@ -145,6 +153,7 @@ services:
       target: frontend-production
       args:
         VITE_API_BASE_URL: "http://localhost:8071"
+        VITE_MEDIA_BASE_URL: "http://localhost:8083"
         VITE_APP_TITLE: "LaSuite Meet"
     image: meet:frontend-development
     ports:
@@ -244,7 +253,7 @@ services:
       - /app/.venv
     depends_on:
       - livekit
-      - minio
+      - garage
     develop:
       watch:
         - action: rebuild
@@ -297,7 +306,7 @@ services:
     depends_on:
       - redis-summary
       - app-summary-dev
-      - minio
+      - garage
     develop:
       watch:
         - action: rebuild
@@ -317,7 +326,7 @@ services:
     depends_on:
       - redis-summary
       - app-summary-dev
-      - minio
+      - garage
     develop:
       watch:
         - action: rebuild

devenv.nix

@@ -163,7 +163,7 @@ in
       REDIS_URL = "redis://127.0.0.1:6379/1";
       CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
 
-      # S3 / MinIO
+      # S3 / Garage
       AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
 
       # OIDC

docker/compose.d/compose.podman.yml

@@ -19,7 +19,9 @@ services:
     <<: *keep-id
   celery-dev:
     <<: *keep-id
-  minio:
+  garage:
+    <<: *keep-id
+  garage-cors:
     <<: *keep-id
   node:
     <<: *keep-id

docker/files/etc/garage/garage.toml

@@ -0,0 +1,15 @@
+# Garage configuration for local development only: single node, no replication.
+# See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+db_engine = "lmdb"
+
+replication_factor = 1
+
+rpc_bind_addr = "127.0.0.1:3901"
+rpc_public_addr = "127.0.0.1:3901"
+
+[s3_api]
+api_bind_addr = "[::]:9000"
+# Clients must sign their requests for this region (AWS_S3_REGION_NAME)
+s3_region = "local"

docker/files/etc/nginx/conf.d/default.conf

@@ -4,6 +4,36 @@ server {
     server_name localhost;
     charset utf-8;
 
+    # Proxy auth for recordings (authorized by the recordings viewset)
+    location /media/recordings/ {
+        auth_request /media-auth-recordings;
+        auth_request_set $authHeader $upstream_http_authorization;
+        auth_request_set $authDate $upstream_http_x_amz_date;
+        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+        proxy_set_header Authorization $authHeader;
+        proxy_set_header X-Amz-Date $authDate;
+        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+        proxy_pass http://garage:9000/meet-media-storage/recordings/;
+        proxy_set_header Host garage:9000;
+        proxy_hide_header Content-Disposition;
+        add_header Content-Disposition "attachment";
+    }
+
+    location = /media-auth-recordings {
+        internal;
+        proxy_pass http://app-dev:8000/api/v1.0/recordings/media-auth/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Original-URL $request_uri;
+
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-Method $request_method;
+    }
+
     # Proxy auth for media
     location /media/ {
         # Auth request configuration
@@ -17,9 +47,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from Minio
-        proxy_pass http://minio:9000/meet-media-storage/;
-        proxy_set_header Host minio:9000;
+        # Get resource from Garage
+        proxy_pass http://garage:9000/meet-media-storage/;
+        proxy_set_header Host garage:9000;
         # To use with ds_proxy
         # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
         # proxy_set_header Host ds-proxy:4444;

docs/developping_locally.md

@@ -13,7 +13,7 @@ These components rely on a few key services:
 
 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
-- MinIO for storing files (room recordings)
+- Garage for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)
 
 We provide two stack options for getting Visio up and running for development:

docs/features/room-purge.md

@@ -0,0 +1,40 @@
+# Room purge
+
+Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
+
+## How it works
+
+Each time LiveKit tells the backend that a room has started (`room_started` webhook), the backend records the date on the room (`last_started_at`).
+A room is inactive when:
+
+- it was last started more than `ROOM_INACTIVITY_DELETION_DAYS` days ago, or
+- it was never started and was created more than `ROOM_INACTIVITY_DELETION_DAYS` days ago.
+
+Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
+
+The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
+
+```bash
+python manage.py purge_inactive_rooms            # delete the inactive rooms
+python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
+```
+
+## Rooms that are kept
+
+A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
+
+- with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
+- with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
+
+## What happens to a purged room
+
+The room is deleted from the database, along with its accesses, its telephony PIN code, and the recording entries it still holds — the expired ones and those that were never saved, since any other recording would have protected the room — together with their own accesses.
+
+The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
+
+⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
+and can be reused when a meeting is created from that same URL.
+
+* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
+
+* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.

docs/features/transcription.md

@@ -42,7 +42,7 @@ sequenceDiagram
   participant Backend as Backend API
   participant Summary as Summary Service
   participant Celery as Celery Workers (transcribe-queue)
-  participant MinIO as MinIO (Object Storage)
+  participant S3 as S3 (Object Storage)
   participant STT as WhisperX API
   participant Docs as LaSuite Docs
 
@@ -50,7 +50,7 @@ sequenceDiagram
   Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time
 
   Summary->>Celery: Register task (transcribe-queue)
-  Celery->>MinIO: Fetch audio file
+  Celery->>S3: Fetch audio file
   Celery->>STT: Transcribe audio (WhisperX)
   STT-->>Celery: Segmented transcript
 
@@ -72,11 +72,12 @@ sequenceDiagram
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
-| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
-| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
-| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
-| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
-| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
+| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3 bucket used for storing recordings.                                                                                                                      |
+| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3 storage.                                                                                                                                         |
+| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3.                                                                                                                                                      |
+| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3.                                                                                                                                                      |
+| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3 requests.                                                                                                                                              |
+| aws_s3_region_name       | String    | —                                                                     | Region used to sign S3 requests, passed as-is to boto3.                                                                                                                 |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |

docs/installation/compose.md

@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |
 
-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.
 
 
 ## Software Requirements

docs/installation/kubernetes.md

@@ -403,6 +403,7 @@ These are the environmental options available on meet backend.
 | LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
 | RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
 | ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
+| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                               |
 | RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
 | RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |

env.d/development/common.dist

@@ -24,9 +24,10 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=http://garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True
 
@@ -63,7 +64,8 @@ ALLOW_UNREGISTERED_ROOMS=False
 
 # Recording
 RECORDING_ENABLE=True
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
+SUMMARY_SERVICE_VERSION=2
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording

env.d/development/garage.dist

@@ -0,0 +1,2 @@
+# Filled with a random value by `make create-env-files`
+GARAGE_RPC_SECRET=

env.d/development/metadata_collector.dist

@@ -2,8 +2,9 @@ LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret
 
-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 AWS_STORAGE_BUCKET_NAME=meet-media-storage
 AWS_S3_SECURE_ACCESS=False

env.d/development/multi_user_transcriber.dist

@@ -1,6 +1,7 @@
-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 
 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey

env.d/development/summary.dist

@@ -2,11 +2,12 @@ APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"
 
 AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="minio:9000"
+AWS_S3_ENDPOINT_URL="garage:9000"
 AWS_S3_SECURE_ACCESS=false
 
-AWS_S3_ACCESS_KEY_ID="meet"
-AWS_S3_SECRET_ACCESS_KEY="password"
+AWS_S3_ACCESS_KEY_ID="meet-access-key"
+AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
+AWS_S3_REGION_NAME="local"
 
 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"

src/agents/metadata_collector.py

@@ -6,9 +6,11 @@ import logging
 import os
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
-from io import BytesIO
 from typing import List, Optional
 
+import boto3
+from botocore.config import Config
+from botocore.exceptions import BotoCoreError, ClientError
 from dotenv import load_dotenv
 from livekit import api, rtc
 from livekit.agents import (
@@ -28,8 +30,6 @@ from livekit.agents import (
     room_io as lk_room_io,
 )
 from livekit.plugins import silero
-from minio import Minio
-from minio.error import S3Error
 
 from exceptions import MissingConfigError
 from observability import configure_sentry, set_job_context
@@ -59,6 +59,30 @@ server = AgentServer(
 server.setup_fnc = prewarm
 
 
+def create_s3_client():
+    """Create an S3 client for the configured endpoint and region.
+
+    The endpoint may be given with or without a scheme: the scheme always
+    follows AWS_S3_SECURE_ACCESS.
+    """
+    endpoint = (
+        os.getenv("AWS_S3_ENDPOINT_URL", "")
+        .removeprefix("https://")
+        .removeprefix("http://")
+        .rstrip("/")
+    )
+    secure = os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true"
+
+    return boto3.client(
+        "s3",
+        endpoint_url=f"{'https' if secure else 'http'}://{endpoint}",
+        aws_access_key_id=os.getenv("AWS_S3_ACCESS_KEY_ID"),
+        aws_secret_access_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
+        region_name=os.getenv("AWS_S3_REGION_NAME"),
+        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
+    )
+
+
 @dataclass
 class MetadataEvent:
     """A single timestamped event recorded during a meeting."""
@@ -121,18 +145,13 @@ class MetadataCollector:
 
     def __init__(self, ctx: JobContext, recording_id: str):
         """Initialize metadata agent."""
-        self.minio_client = Minio(
-            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
-            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
-            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
-            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
-        )
-
         if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
             self.bucket_name = bucket_name
         else:
             raise MissingConfigError
 
+        self.s3_client = create_s3_client()
+
         self.ctx = ctx
         self._sessions: dict[str, AgentSession] = {}
         self._tasks: set[asyncio.Task] = set()
@@ -201,20 +220,18 @@ class MetadataCollector:
         }
 
         data = json.dumps(payload, indent=2).encode("utf-8")
-        stream = BytesIO(data)
 
         try:
-            self.minio_client.put_object(
-                self.bucket_name,
-                self.output_filename,
-                stream,
-                length=len(data),
-                content_type="application/json",
+            self.s3_client.put_object(
+                Bucket=self.bucket_name,
+                Key=self.output_filename,
+                Body=data,
+                ContentType="application/json",
             )
             logger.info(
                 "Uploaded speaker meeting metadata",
             )
-        except S3Error:
+        except (BotoCoreError, ClientError):
             logger.exception(
                 "Failed to upload meeting metadata",
             )

src/agents/pyproject.toml

@@ -4,21 +4,21 @@ name = "agents"
 version = "1.32.1"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.6.7",
-    "livekit-plugins-deepgram==1.6.7",
-    "livekit-plugins-silero==1.6.7",
+    "livekit-agents==1.7.0",
+    "livekit-plugins-deepgram==1.7.0",
+    "livekit-plugins-silero==1.7.0",
     "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.2",
-    "protobuf==6.33.6",
-    "minio==7.2.20",
-    "sentry-sdk==2.66.1",
+    "boto3==1.43.56",
+    "python-dotenv==1.2.3",
+    "protobuf==7.36.0",
+    "sentry-sdk==2.68.1",
     "websockets==17.1",
     "httpx==0.28.1",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.0",
+    "ruff==0.16.4",
 ]
 
 [tool.uv]

src/backend/core/admin.py

@@ -279,9 +279,16 @@ class RoomAdmin(admin.ModelAdmin):
 
     inlines = (ResourceAccessInline,)
     search_fields = ["name", "slug", "=id"]
-    list_display = ["name", "slug", "access_level", "get_owner", "created_at"]
-    list_filter = ["access_level", "created_at"]
-    readonly_fields = ["id", "created_at", "updated_at"]
+    list_display = [
+        "name",
+        "slug",
+        "access_level",
+        "get_owner",
+        "created_at",
+        "last_started_at",
+    ]
+    list_filter = ["access_level", "created_at", "last_started_at"]
+    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]
 
     def get_queryset(self, request):
         """Optimize queries by prefetching related access and user data to avoid N+1 queries."""

src/backend/core/management/commands/purge_inactive_rooms.py

@@ -0,0 +1,94 @@
+"""Purge inactive rooms."""
+
+from datetime import timedelta
+from itertools import batched
+from logging import getLogger
+
+from django.conf import settings
+from django.core.management.base import BaseCommand
+from django.db.models import Exists, OuterRef, Q
+from django.utils import timezone
+
+from core.models import Recording, RecordingStatusChoices, Room
+
+logger = getLogger(__name__)
+
+CHUNK_SIZE = 500
+
+
+class Command(BaseCommand):
+    """
+    Delete rooms that have not been started for ROOM_INACTIVITY_DELETION_DAYS days:
+    - rooms which were last started before that period
+    - rooms never started and created before that period
+
+    Rooms holding a saved recording that has not expired are kept.
+    """
+
+    help = "Purge inactive rooms"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="List the rooms that would be purged without deleting them",
+        )
+
+    def handle(self, *args, **options):
+        """Browse inactive rooms and delete them chunk by chunk."""
+
+        if not settings.ROOM_INACTIVITY_DELETION_DAYS:
+            self.stdout.write(
+                "Purging inactive rooms is disabled "
+                "(ROOM_INACTIVITY_DELETION_DAYS is not set)."
+            )
+            return
+
+        now = timezone.now()
+        inactive_rooms = self.get_inactive_rooms(now)
+
+        inactive_count = inactive_rooms.count()
+        if not inactive_count:
+            self.stdout.write("No inactive room to purge.")
+            return
+
+        if options["dry_run"]:
+            self.stdout.write(
+                f"[dry-run] {inactive_count} inactive room(s) would be purged:"
+            )
+            names = inactive_rooms.values_list("name", flat=True)
+            for name in names.iterator(chunk_size=CHUNK_SIZE):
+                self.stdout.write(f"- {name}")
+            return
+
+        purged_count = 0
+        rooms = inactive_rooms.values_list("pk", "slug").iterator(chunk_size=CHUNK_SIZE)
+        for chunk in batched(rooms, CHUNK_SIZE, strict=False):
+            for room_id, slug in chunk:
+                logger.info("Purging inactive room %s (%s)", room_id, slug)
+
+            _, deleted_by_model = inactive_rooms.filter(
+                pk__in=[room_id for room_id, _ in chunk]
+            ).delete()
+            purged_count += deleted_by_model.get("core.Room", 0)
+
+        self.stdout.write(f"Purged {purged_count} inactive room(s).")
+
+    @staticmethod
+    def get_inactive_rooms(now):
+        """Return the rooms inactive for too long that no recording protects."""
+
+        threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
+        is_inactive = Q(last_started_at__lt=threshold) | Q(
+            last_started_at__isnull=True, created_at__lt=threshold
+        )
+
+        protected_recordings = Recording.objects.filter(
+            room=OuterRef("pk"), status__in=RecordingStatusChoices.saved_statuses()
+        )
+        if settings.RECORDING_EXPIRATION_DAYS:
+            protected_recordings = protected_recordings.filter(
+                created_at__gte=now - timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
+            )
+
+        return Room.objects.filter(is_inactive, ~Exists(protected_recordings))

src/backend/core/migrations/0024_room_last_started_at.py

@@ -0,0 +1,18 @@
+from django.db import migrations, models
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0023_alter_recording_status'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='room',
+            name='last_started_at',
+            field=models.DateTimeField(blank=True, default=django.utils.timezone.now, editable=False, help_text='date and time at which the room was last started', null=True, verbose_name='last started at'),
+            preserve_default=False,
+        ),
+    ]

src/backend/core/models.py

@@ -87,6 +87,17 @@ class RecordingStatusChoices(models.TextChoices):
             cls.FAILED_TO_STOP,
         }
 
+    @classmethod
+    def saved_statuses(cls):
+        """Return the statuses of a recording whose file users can access."""
+
+        return {
+            cls.NOTIFICATION_SUCCEEDED,
+            cls.SAVED,
+            cls.EXTERNAL_PROCESS_SUCCESSFUL,
+            cls.EXTERNAL_PROCESS_FAILED,
+        }
+
 
 class RecordingModeChoices(models.TextChoices):
     """Recording mode choices."""
@@ -426,6 +437,13 @@ class Room(Resource):
         verbose_name=_("Room PIN code"),
         help_text=_("Unique n-digit code that identifies this room in telephony mode."),
     )
+    last_started_at = models.DateTimeField(
+        verbose_name=_("last started at"),
+        help_text=_("date and time at which the room was last started"),
+        blank=True,
+        null=True,
+        editable=False,
+    )
 
     class Meta:
         db_table = "meet_room"
@@ -682,12 +700,7 @@ class Recording(BaseModel):
     @property
     def is_saved(self) -> bool:
         """Check if the recording is in a saved state."""
-        return self.status in {
-            RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
-            RecordingStatusChoices.SAVED,
-            RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL,
-            RecordingStatusChoices.EXTERNAL_PROCESS_FAILED,
-        }
+        return self.status in RecordingStatusChoices.saved_statuses()
 
     @property
     def extension(self):

src/backend/core/services/livekit_events.py

@@ -8,6 +8,7 @@ from enum import Enum
 from logging import getLogger
 
 from django.conf import settings
+from django.utils import timezone
 
 from livekit import api
 
@@ -270,12 +271,20 @@ class LiveKitEventsService:
             )
             raise ActionFailedError("Failed to process room started event") from e
 
-        try:
-            room = models.Room.objects.get(id=room_id)
-        except models.Room.DoesNotExist as err:
-            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
+        room_updated_count = models.Room.objects.filter(pk=room_id).update(
+            last_started_at=timezone.now()
+        )
+        if not room_updated_count:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist")
 
         if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
+            try:
+                room = models.Room.objects.get(pk=room_id)
+            except models.Room.DoesNotExist as err:
+                raise ActionFailedError(
+                    f"Room with ID {room_id} does not exist"
+                ) from err
+
             try:
                 self.sip_management.ensure_dispatch_rule(room)
             except SIPException as e:

src/backend/core/tests/commands/test_purge_inactive_rooms.py

@@ -0,0 +1,239 @@
+"""Tests for the purge_inactive_rooms management command."""
+
+import logging
+from datetime import timedelta
+from io import StringIO
+from unittest import mock
+
+from django.core.management import call_command
+from django.utils import timezone
+
+import pytest
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+COMMAND_MODULE = "core.management.commands.purge_inactive_rooms"
+
+BEFORE_PERIOD = timedelta(days=366)
+WITHIN_PERIOD = timedelta(days=364)
+
+
+@pytest.fixture(name="purge_enabled", autouse=True)
+def fixture_purge_enabled(settings):
+    """Enable the purge of the rooms inactive for a year."""
+    settings.ROOM_INACTIVITY_DELETION_DAYS = 365
+    settings.RECORDING_EXPIRATION_DAYS = 30
+
+
+def create_at(date, factory, **kwargs):
+    """Build an object with the factory as if it was created at the given date."""
+    with mock.patch("django.utils.timezone.now", return_value=date):
+        return factory(**kwargs)
+
+
+def call_purge(*args):
+    """Run the purge command and return what it wrote on stdout."""
+    out = StringIO()
+    call_command("purge_inactive_rooms", *args, stdout=out)
+    return out.getvalue()
+
+
+def room_exists(room):
+    """Tell whether the room is still in database."""
+    return models.Room.objects.filter(pk=room.pk).exists()
+
+
+def test_purge_inactive_rooms_disabled(settings):
+    """Should delete nothing when no inactivity period is configured."""
+    settings.ROOM_INACTIVITY_DELETION_DAYS = None
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+
+    assert "disabled" in call_purge()
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_without_recording_expiration(settings):
+    """Should purge when recordings never expire, keeping rooms with a saved one."""
+    settings.RECORDING_EXPIRATION_DAYS = None
+    long_ago = timezone.now() - BEFORE_PERIOD
+    room = create_at(long_ago, factories.RoomFactory)
+    room_with_recording = create_at(long_ago, factories.RoomFactory)
+    create_at(
+        long_ago,
+        factories.RecordingFactory,
+        room=room_with_recording,
+        status=models.RecordingStatusChoices.SAVED,
+    )
+
+    assert call_purge() == "Purged 1 inactive room(s).\n"
+
+    assert not room_exists(room)
+    assert room_exists(room_with_recording)
+
+
+def test_purge_inactive_rooms_without_recording_expiration_not_saved(settings):
+    """Should delete a room whose recordings were never saved when none expire."""
+    settings.RECORDING_EXPIRATION_DAYS = None
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+def test_purge_inactive_rooms_started_before_period(caplog):
+    """Should delete a room that was last started before the inactivity period."""
+    now = timezone.now()
+    room = create_at(
+        now - timedelta(days=800),
+        factories.RoomFactory,
+        last_started_at=now - BEFORE_PERIOD,
+    )
+
+    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
+        output = call_purge()
+
+    assert output == "Purged 1 inactive room(s).\n"
+    assert not room_exists(room)
+    assert f"Purging inactive room {room.pk} ({room.slug})" in caplog.text
+
+
+def test_purge_inactive_rooms_never_started_created_before_period():
+    """Should delete a room that was never started and created before the period."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+def test_purge_inactive_rooms_started_within_period():
+    """Should keep a room created long ago that was started within the period."""
+    now = timezone.now()
+    room = create_at(
+        now - timedelta(days=800),
+        factories.RoomFactory,
+        last_started_at=now - WITHIN_PERIOD,
+    )
+
+    assert call_purge() == "No inactive room to purge.\n"
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_never_started_created_within_period():
+    """Should keep a room that was never started but created within the period."""
+    room = create_at(timezone.now() - WITHIN_PERIOD, factories.RoomFactory)
+
+    assert call_purge() == "No inactive room to purge.\n"
+
+    assert room_exists(room)
+
+
+@pytest.mark.parametrize(
+    "status", sorted(models.RecordingStatusChoices.saved_statuses())
+)
+def test_purge_inactive_rooms_recording_not_expired(settings, status):
+    """Should keep a room holding a saved recording that has not expired yet."""
+    settings.RECORDING_EXPIRATION_DAYS = 400
+    long_ago = timezone.now() - BEFORE_PERIOD
+    room = create_at(long_ago, factories.RoomFactory)
+    create_at(long_ago, factories.RecordingFactory, room=room, status=status)
+
+    call_purge()
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_recording_expired(settings):
+    """Should delete a room along with its recordings when they all have expired."""
+    settings.RECORDING_EXPIRATION_DAYS = 30
+    long_ago = timezone.now() - BEFORE_PERIOD
+    room = create_at(long_ago, factories.RoomFactory)
+    recording = create_at(
+        long_ago,
+        factories.RecordingFactory,
+        room=room,
+        status=models.RecordingStatusChoices.SAVED,
+    )
+
+    call_purge()
+
+    assert not room_exists(room)
+    assert not models.Recording.objects.filter(pk=recording.pk).exists()
+
+
+@pytest.mark.parametrize(
+    "status",
+    [
+        status
+        for status in models.RecordingStatusChoices
+        if status not in models.RecordingStatusChoices.saved_statuses()
+    ],
+)
+def test_purge_inactive_rooms_recording_not_saved(status):
+    """Should delete a room whose recordings were never saved, even unexpired."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    factories.RecordingFactory(room=room, status=status)
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+def test_purge_inactive_rooms_recording_saved_among_others():
+    """Should keep a room holding a saved recording next to a failed one."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.SAVED)
+
+    call_purge()
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_deletes_accesses_and_resource():
+    """Should delete the last owner access and the resource of a purged room."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    access = factories.UserResourceAccessFactory(
+        resource=room, role=models.RoleChoices.OWNER
+    )
+
+    call_purge()
+
+    assert not room_exists(room)
+    assert not models.Resource.objects.filter(pk=room.pk).exists()
+    assert not models.ResourceAccess.objects.filter(pk=access.pk).exists()
+    assert models.User.objects.filter(pk=access.user.pk).exists()
+
+
+def test_purge_inactive_rooms_dry_run():
+    """Should list the inactive rooms by name without deleting them on a dry run."""
+    long_ago = timezone.now() - BEFORE_PERIOD
+    rooms = [
+        create_at(long_ago, factories.RoomFactory, name=name)
+        for name in ("Alpha room", "Beta room")
+    ]
+    factories.RoomFactory(name="Recent room")
+
+    assert call_purge("--dry-run") == (
+        "[dry-run] 2 inactive room(s) would be purged:\n- Alpha room\n- Beta room\n"
+    )
+
+    assert all(room_exists(room) for room in rooms)
+
+
+def test_purge_inactive_rooms_several_chunks():
+    """Should delete every inactive room when they span several chunks."""
+    long_ago = timezone.now() - BEFORE_PERIOD
+    rooms = [create_at(long_ago, factories.RoomFactory) for _ in range(5)]
+
+    with mock.patch(f"{COMMAND_MODULE}.CHUNK_SIZE", 2):
+        output = call_purge()
+
+    assert output == "Purged 5 inactive room(s).\n"
+    assert not any(room_exists(room) for room in rooms)

src/backend/core/tests/files/test_api_files_create.py

@@ -117,14 +117,14 @@ def test_api_files_create_file_authenticated_success():
     policy_parsed = urlparse(policy)
 
     assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
+    assert policy_parsed.netloc in ["garage:9000", "localhost:9000"]
     assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 
     assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
     assert query_params.pop("X-Amz-Credential") == [
-        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
+        f"meet-access-key/{now.strftime('%Y%m%d')}/local/s3/aws4_request"
     ]
     assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
     assert query_params.pop("X-Amz-Expires") == ["60"]

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -7,6 +7,7 @@ from unittest import mock
 
 from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
+from django.utils import timezone
 
 import pytest
 from rest_framework.test import APIClient
@@ -507,3 +508,20 @@ def test_api_rooms_retrieve_administrators(
         role=str(user_access.role),
         participant_id=None,
     )
+
+
+@pytest.mark.parametrize("access_level", RoomAccessLevel)
+@pytest.mark.parametrize("role", [None, *RoleChoices])
+def test_api_rooms_retrieve_last_started_at_not_exposed(role, access_level):
+    """Should not expose when the room was last started, whoever the requester is."""
+    room = RoomFactory(access_level=access_level, last_started_at=timezone.now())
+    client = APIClient()
+    user = UserFactory()
+    if role is not None:
+        UserResourceAccessFactory(resource=room, user=user, role=role)
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
+
+    assert response.status_code == 200
+    assert "last_started_at" not in response.json()

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,8 +3,11 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
+from datetime import timedelta
 from unittest.mock import patch
 
+from django.utils import timezone
+
 import pytest
 from rest_framework.test import APIClient
 
@@ -225,6 +228,39 @@ def test_api_rooms_update_administrators_name_only(mock_update_metadata):
     mock_update_metadata.assert_not_called()
 
 
+@pytest.mark.parametrize("method", ["put", "patch"])
+def test_api_rooms_update_last_started_at_ignored(method):
+    """Should ignore a "last_started_at" value sent by a client.
+
+    The field is only ever written by the LiveKit "room_started" webhook: it is not
+    declared on the serializer and is "editable=False" on the model. A client must
+    not be able to keep a room alive by postponing its last start date.
+    """
+    user = UserFactory()
+    last_started_at = timezone.now() - timedelta(days=30)
+    room = RoomFactory(
+        name="Old name",
+        last_started_at=last_started_at,
+        users=[(user, random.choice(["administrator", "owner"]))],
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = getattr(client, method)(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"name": "New name", "last_started_at": timezone.now().isoformat()},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert "last_started_at" not in response.json()
+
+    room.refresh_from_db()
+    # The rest of the payload was applied, so the request was not simply rejected
+    assert room.name == "New name"
+    assert room.last_started_at == last_started_at
+
+
 @pytest.mark.parametrize(
     "configuration",
     [

src/backend/core/tests/services/test_livekit_events.py

@@ -5,12 +5,16 @@ Test LiveKitEvents service.
 
 import logging
 import uuid
+from datetime import timedelta
 from unittest import mock
 
+from django.utils import timezone
+
 import pytest
 from livekit.api import EgressStatus
 
 from core.factories import RecordingFactory, RoomFactory
+from core.models import Room
 from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import RecordingEventsService
 from core.services.livekit_events import (
@@ -696,6 +700,82 @@ def test_handle_room_started_skips_dispatch_rule_when_telephony_disabled(
     mock_ensure_dispatch_rule.assert_not_called()
 
 
+def test_handle_room_started_records_access(service, settings):
+    """Should record the access on a room that is started for the first time."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    settings.ROOMKIT_ENABLED = False
+    room = RoomFactory()
+    other_room = RoomFactory()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    now = timezone.now()
+    with mock.patch("django.utils.timezone.now", return_value=now):
+        service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at == now
+
+    other_room.refresh_from_db()
+    assert other_room.last_started_at is None
+
+
+def test_handle_room_started_overwrites_previous_access(service, settings):
+    """Should overwrite the previous access each time the room is started again."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    settings.ROOMKIT_ENABLED = False
+    now = timezone.now()
+    room = RoomFactory(last_started_at=now - timedelta(days=30))
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    with mock.patch("django.utils.timezone.now", return_value=now):
+        service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at == now
+
+
+def test_handle_room_started_only_updates_access(service, settings):
+    """Should leave the slug and the update date untouched when recording the access."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    settings.ROOMKIT_ENABLED = False
+    room = RoomFactory()
+    Room.objects.filter(pk=room.pk).update(slug="𓆑")
+    room.refresh_from_db()
+    updated_at = room.updated_at
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at is not None
+    assert room.slug == "𓆑"
+    assert room.updated_at == updated_at
+
+
+@mock.patch.object(
+    SIPManagement,
+    "ensure_dispatch_rule",
+    side_effect=SIPException("Test error"),
+)
+def test_handle_room_started_records_access_when_dispatch_rule_creation_fails(
+    mock_ensure_dispatch_rule, service, settings
+):
+    """Should still record the access when ensuring the dispatch rule fails."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    room = RoomFactory()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    with pytest.raises(ActionFailedError):
+        service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at is not None
+
+
 def test_handle_room_started_raises_error_for_invalid_room_name(service):
     """Should raise ActionFailedError when room name format is invalid  when room starts."""
     mock_data = mock.MagicMock()

src/backend/core/tests/test_models_rooms.py

@@ -92,6 +92,12 @@ def test_models_rooms_access_level_default():
     assert room.access_level == RoomAccessLevel.PUBLIC
 
 
+def test_models_rooms_last_started_at_default():
+    """Should have no last access date until the room is started."""
+    room = Room.objects.create(name="room")
+    assert room.last_started_at is None
+
+
 # Access rights methods
 
 

src/backend/meet/settings.py

@@ -730,6 +730,9 @@ class Base(Configuration):
     ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
         True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
     )
+    ROOM_INACTIVITY_DELETION_DAYS = values.PositiveIntegerValue(
+        None, environ_name="ROOM_INACTIVITY_DELETION_DAYS", environ_prefix=None
+    )
     # if provided, treat as suspicious (possible privilege escalation attempt).
     PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
         ["hidden", "recorder", "agent"],
@@ -1249,6 +1252,25 @@ class Base(Configuration):
                 stacklevel=2,
             )
 
+        if cls.ROOM_INACTIVITY_DELETION_DAYS:
+            if not cls.RECORDING_EXPIRATION_DAYS:
+                warnings.warn(
+                    "ROOM_INACTIVITY_DELETION_DAYS is set but "
+                    "RECORDING_EXPIRATION_DAYS is not. Recordings never expire, so "
+                    "inactive rooms holding a saved recording will never be purged.",
+                    UserWarning,
+                    stacklevel=2,
+                )
+            elif cls.RECORDING_EXPIRATION_DAYS >= cls.ROOM_INACTIVITY_DELETION_DAYS:
+                warnings.warn(
+                    "RECORDING_EXPIRATION_DAYS is greater than or equal to "
+                    "ROOM_INACTIVITY_DELETION_DAYS. Inactive rooms holding a saved "
+                    "recording will be kept past the inactivity period, until their "
+                    "recordings expire.",
+                    UserWarning,
+                    stacklevel=2,
+                )
+
         # The SENTRY_DSN setting should be available to activate sentry for an environment
         if cls.SENTRY_DSN is not None:
             sentry_sdk.init(

src/backend/pyproject.toml

@@ -2,7 +2,7 @@
 # Meet package
 #
 [build-system]
-requires = ["uv_build>=0.11.16,<0.12.0"]
+requires = ["uv_build>=0.12.6,<0.13.0"]
 build-backend = "uv_build"
 
 [project]
@@ -24,7 +24,7 @@ keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.43.56",
+    "boto3==1.43.80",
     "Brotli==1.2.0",
     "brevo-python==1.2.0",
     "celery[redis]==5.6.3",
@@ -33,7 +33,7 @@ dependencies = [
     "django-cors-headers==4.9.0",
     "django-countries==9.0.0",
     "django-filter==26.1",
-    "django-lasuite[all]==0.0.27",
+    "django-lasuite[all]==0.0.29",
     "django-parler==2.4",
     "redis==5.2.1",
     "django-redis==7.0.0",
@@ -41,30 +41,30 @@ dependencies = [
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
     "django==5.2.16",
-    "djangorestframework==3.17.2",
+    "djangorestframework==3.18.0",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
-    "gunicorn==26.0.0",
+    "gunicorn==26.2.0",
     "jsonschema==4.26.0",
-    "markdown==3.10.2",
+    "markdown==3.10.3",
     "nested-multipart-parser==1.6.0",
-    "posthog==7.29.0",
+    "posthog==7.44.0",
     "psycopg[binary]==3.3.4",
     "pydantic==2.13.4",
     "PyJWT==2.13.0",
     "python-frontmatter==1.3.0",
     "python-magic==0.4.27",
     "requests==2.34.2",
-    "sentry-sdk==2.66.1",
+    "sentry-sdk==2.68.1",
     "whitenoise==6.12.0",
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.2.0",
     "aiohttp==3.14.3",
     "urllib3==2.7.0",
-    "phonenumbers==9.0.34",
-    "cryptography==50.0.0", # CVE-2026-69247
+    "phonenumbers==9.0.37",
+    "cryptography==50.0.1", # CVE-2026-69247
 ]
 
 [project.urls]
@@ -76,20 +76,20 @@ dependencies = [
 [dependency-groups]
 dev = [
     "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.7.1",
+    "drf-spectacular-sidecar==2026.8.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.15.0",
+    "ipython==9.16.1",
     "pyfakefs==6.2.0",
     "pylint-django==2.8.0",
     "pylint<4.0.0",
     "pytest-cov==7.1.0",
-    "pytest-django==4.12.0",
+    "pytest-django==4.14.0",
     "pytest==9.1.1",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.26.2",
-    "ruff==0.16.0",
+    "ruff==0.16.4",
     "types-requests==2.33.0.20260712",
 ]
 

src/frontend/Dockerfile

@@ -39,6 +39,9 @@ ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
 ARG VITE_APP_TITLE
 ENV VITE_APP_TITLE=${VITE_APP_TITLE}
 
+ARG VITE_MEDIA_BASE_URL
+ENV VITE_MEDIA_BASE_URL=${VITE_MEDIA_BASE_URL}
+
 RUN npm run build
 
 # ---- Front-end image ----

src/frontend/src/api/mediaUrl.ts

@@ -1,6 +1,6 @@
 export const mediaUrl = (path: string) => {
   const origin =
-    import.meta.env.VITE_API_BASE_URL ||
+    import.meta.env.VITE_MEDIA_BASE_URL ||
     (typeof window !== 'undefined' ? window.location.origin : '')
 
   // Remove leading/trailing slashes from origin/path if it exists

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -41,6 +41,7 @@ export const useAnalytics = ({
         api_host: host,
         flags_api_host: flags_api_host,
         person_profiles: 'always',
+        remote_config_refresh_interval_ms: 0,
         capture_pageview: 'history_change',
         capture_pageleave: true,
         capture_exceptions: {

src/frontend/src/features/recording/routes/RecordingDownload.tsx

@@ -148,7 +148,7 @@ const RecordingDownload = () => {
             </Text>
             <LinkButton
               href={mediaUrl(data.key)}
-              download={`${data.room.name}-${formatDate(data.created_at)}`}
+              download={`${data.room.name}-${formatDate(data.created_at)}.${data.key.split('.').pop()}`}
             >
               {t('success.button')}
             </LinkButton>

src/frontend/src/vite-env.d.ts

@@ -6,6 +6,7 @@ declare const __MEDIAPIPE_VERSION__: string
 interface ImportMetaEnv {
   readonly VITE_API_BASE_URL: string
   readonly VITE_APP_TITLE: string
+  readonly VITE_MEDIA_BASE_URL?: string
 }
 
 interface ImportMeta {

src/helm/env.d/common.yaml.gotmpl

@@ -24,10 +24,11 @@ _summaryEnvVars: &summaryEnvVars
   APP_NAME: summary-microservice
   APP_API_TOKEN: password
   AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
-  AWS_S3_ACCESS_KEY_ID: meet
-  AWS_S3_SECRET_ACCESS_KEY: password
+  AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000/
+  AWS_S3_ACCESS_KEY_ID: meet-access-key
+  AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
   AWS_S3_SECURE_ACCESS: False
+  AWS_S3_REGION_NAME: local
   AUTHORIZED_TENANTS: >
     [
       {
@@ -161,9 +162,9 @@ backend:
     FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
     FRONTEND_IS_SILENT_LOGIN_ENABLED: False
     # S3 Storage
-    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
-    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet-access-key
+    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
     AWS_STORAGE_BUCKET_NAME: meet-media-storage
     # Telephony
     ROOM_TELEPHONY_ENABLED: True
@@ -180,7 +181,7 @@ backend:
     # Custom Background
     AWS_S3_REGION_NAME: local
     AWS_S3_SIGNATURE_VERSION: s3v4
-    AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io
+    AWS_S3_DOMAIN_REPLACE: https://garage.127.0.0.1.nip.io
     MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
     FILE_UPLOAD_ENABLED: True
     CELERY_ENABLED: True
@@ -264,11 +265,11 @@ ingressMedia:
   annotations:
     nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1
 
 serviceMedia:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
   port: 9000
 
 # ---- Extra ingress/service for background file uploads ------------
@@ -280,11 +281,11 @@ ingressMediaFiles:
   annotations:
     nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1
 
 serviceMediaFiles:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
   port: 9000
 
 # ---- STT Orchestration Microservice Components --------------------
@@ -362,10 +363,11 @@ agentMetadata:
     {{- end }}
     {{- end }}
     ENABLE_SILERO_VAD: "false"
-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
-    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_ENDPOINT_URL: garage.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet-access-key
+    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
     AWS_S3_SECURE_ACCESS: False
+    AWS_S3_REGION_NAME: local
     AWS_STORAGE_BUCKET_NAME: meet-media-storage
     AWS_S3_OUTPUT_FOLDER: metadata
 

src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl

@@ -16,11 +16,11 @@ egress:
     address: redis-master:6379
     password: pass
   s3:
-    access_key: meet
-    secret: password
+    access_key: meet-access-key
+    secret: meet-secret-access-key
     region: local
     bucket: meet-media-storage
-    endpoint: http://minio:9000
+    endpoint: http://garage:9000
     force_path_style: true
 
 loadBalancer:

src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl

@@ -19,11 +19,11 @@ egress:
     address: redis-master:6379
     password: pass
   s3:
-    access_key: meet
-    secret: password
+    access_key: meet-access-key
+    secret: meet-secret-access-key
     region: local
     bucket: meet-media-storage
-    endpoint: http://minio:9000
+    endpoint: http://garage:9000
     force_path_style: true
 
 loadBalancer:

src/helm/extra/templates/garage.yaml

@@ -0,0 +1,172 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: garage
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 10m
+spec:
+  rules:
+  - host: "garage.127.0.0.1.nip.io"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: garage
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - garage.127.0.0.1.nip.io
+    secretName: meet-tls
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  ports:
+  - name: client
+    port: 9000
+    protocol: TCP
+    targetPort: 9000
+  selector:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: garage
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: garage-config
+  namespace: {{ .Release.Namespace | quote }}
+data:
+  garage.toml: |
+    metadata_dir = "/var/lib/garage/meta"
+    data_dir = "/var/lib/garage/data"
+    db_engine = "lmdb"
+
+    replication_factor = 1
+
+    rpc_bind_addr = "127.0.0.1:3901"
+    rpc_public_addr = "127.0.0.1:3901"
+
+    [s3_api]
+    api_bind_addr = "[::]:9000"
+    # Clients must sign their requests for this region (AWS_S3_REGION_NAME)
+    s3_region = "local"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: garage-dev
+  namespace: {{ .Release.Namespace | quote }}
+type: Opaque
+data:
+  GARAGE_RPC_SECRET: {{ printf "%s/garage-rpc-secret" .Release.Namespace | sha256sum | b64enc }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: garage
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: garage
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: extra
+      app.kubernetes.io/name: garage
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: extra
+        app.kubernetes.io/name: garage
+    spec:
+      containers:
+      - name: garage
+        command:
+          - /garage
+          - server
+          - --single-node
+          - --default-bucket
+        env:
+          - name: GARAGE_RPC_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: garage-dev
+                key: GARAGE_RPC_SECRET
+          - name: GARAGE_DEFAULT_ACCESS_KEY
+            value: meet-access-key
+          - name: GARAGE_DEFAULT_SECRET_KEY
+            value: meet-secret-access-key
+          - name: GARAGE_DEFAULT_BUCKET
+            value: meet-media-storage
+        image: "dxflrs/garage:v2.4.1"
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9000
+          name: client
+        readinessProbe:
+          exec:
+            command:
+              - /garage
+              - health
+        volumeMounts:
+        - mountPath: /etc/garage.toml
+          name: config
+          subPath: garage.toml
+        - mountPath: /var/lib/garage
+          name: data
+      volumes:
+      - name: config
+        configMap:
+          name: garage-config
+      - name: data
+        emptyDir:
+---
+# Garage denies cross-origin requests by default: allow the frontend to upload
+# files straight to the bucket
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: garage-cors
+spec:
+  template:
+    spec:
+      containers:
+      - name: aws-cli
+        image: amazon/aws-cli:2.37.1
+        env:
+          - name: AWS_ACCESS_KEY_ID
+            value: meet-access-key
+          - name: AWS_SECRET_ACCESS_KEY
+            value: meet-secret-access-key
+          - name: AWS_DEFAULT_REGION
+            value: local
+          - name: AWS_ENDPOINT_URL
+            value: http://garage:9000
+          - name: BUCKET
+            value: meet-media-storage
+        command:
+          - /bin/sh
+          - -c
+          - |
+            deadline=$(($(date +%s) + 300))
+            until aws s3api head-bucket --bucket="$BUCKET" --cli-connect-timeout=5; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "Bucket $BUCKET still unavailable on $AWS_ENDPOINT_URL" >&2
+                exit 1
+              fi
+              echo "Waiting for bucket $BUCKET on $AWS_ENDPOINT_URL"
+              sleep 5
+            done
+            exec aws s3api put-bucket-cors --bucket="$BUCKET" \
+              --cors-configuration='{"CORSRules": [{"AllowedOrigins": ["https://meet.127.0.0.1.nip.io"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
+      restartPolicy: Never
+  backoffLimit: 3

src/helm/extra/templates/minio.yaml

@@ -1,115 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: minio
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 10m
-spec:
-  rules:
-  - host: "minio.127.0.0.1.nip.io"
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: minio
-            port:
-              number: 9000
-  tls:
-  - hosts:
-    - minio.127.0.0.1.nip.io
-    secretName: meet-tls
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: client
-    port: 9000
-    protocol: TCP
-    targetPort: 9000
-  - name: console
-    port: 9001
-    protocol: TCP
-    targetPort: 9001
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: minio
-  type: ClusterIP
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: minio
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: minio
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: minio
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: minio
-    spec:
-      containers:
-      - name: minio
-        command:
-          - /bin/sh
-          - -c
-          - |
-            minio server --console-address :9001 /data
-        env:
-          - name: MINIO_ROOT_USER
-            value: meet
-          - name: MINIO_ROOT_PASSWORD
-            value: password
-        image: "quay.io/minio/minio"
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9000
-          name: client
-        - containerPort: 9001
-          name: console
-        volumeMounts:
-        - mountPath: /data
-          name: data
-        - mountPath: /etc/ssl/certs/mkcert-ca.pem
-          name: mkcert
-          subPath: rootCA.pem
-      volumes:
-      - name: data
-        emptyDir:
-      - name: mkcert
-        secret:
-          secretName: mkcert
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: minio-bucket
-spec:
-  template:
-    spec:
-      containers:
-      - name: mc
-        image: quay.io/minio/mc
-        command:
-          - /bin/sh
-          - -c
-          - |
-            /usr/bin/mc alias set meet http://minio:9000 meet password && \
-            /usr/bin/mc mb meet/meet-media-storage && \
-            exit 0
-      restartPolicy: Never
-  backoffLimit: 3

src/helm/meet/README.md

@@ -45,10 +45,10 @@
 | `ingressMedia.tls.additional[].hosts[]`                                      | Hosts for additional TLS config                      |                                                                    |
 | `ingressMedia.annotations.nginx.ingress.kubernetes.io/auth-url`              |                                                      | `https://meet.example.com/api/v1.0/recordings/media-auth/`         |
 | `ingressMedia.annotations.nginx.ingress.kubernetes.io/auth-response-headers` |                                                      | `Authorization, X-Amz-Date, X-Amz-Content-SHA256`                  |
-| `ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost`        |                                                      | `minio.meet.svc.cluster.local:9000`                                |
+| `ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost`        |                                                      | `garage.meet.svc.cluster.local:9000`                               |
 | `ingressMedia.annotations.nginx.ingress.kubernetes.io/configuration-snippet` |                                                      | `add_header Content-Security-Policy "default-src 'none'" always;
 ` |
-| `serviceMedia.host`                                                          |                                                      | `minio.meet.svc.cluster.local`                                     |
+| `serviceMedia.host`                                                          |                                                      | `garage.meet.svc.cluster.local`                                    |
 | `serviceMedia.port`                                                          |                                                      | `9000`                                                             |
 | `serviceMedia.annotations`                                                   |                                                      | `{}`                                                               |
 

src/helm/meet/values.yaml

@@ -128,7 +128,7 @@ ingressMedia:
     nginx.ingress.kubernetes.io/use-regex: "true"
     nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/recordings/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/configuration-snippet: |
       add_header Content-Security-Policy "default-src 'none'" always;
 
@@ -136,7 +136,7 @@ ingressMedia:
 ## @param serviceMedia.port
 ## @param serviceMedia.annotations
 serviceMedia:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
   port: 9000
   annotations: {}
 
@@ -171,7 +171,7 @@ ingressMediaFiles:
     nginx.ingress.kubernetes.io/use-regex: "true"
     nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/files/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/configuration-snippet: |
       add_header Content-Security-Policy "default-src 'none'" always;
       add_header Content-Disposition "attachment";
@@ -180,7 +180,7 @@ ingressMediaFiles:
 ## @param serviceMediaFiles.port
 ## @param serviceMediaFiles.annotations
 serviceMediaFiles:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
   port: 9000
   annotations: {}
 
@@ -289,6 +289,9 @@ backend:
   ## @param backend.cronjobs[1].name Name of the CronJob
   ## @param backend.cronjobs[1].schedule Schedule in cron format
   ## @param backend.cronjobs[1].command The bash command to execute in the CronJob
+  ## @param backend.cronjobs[2].name Name of the CronJob
+  ## @param backend.cronjobs[2].schedule Schedule in cron format
+  ## @param backend.cronjobs[2].command The bash command to execute in the CronJob
 
   cronjobs:
     - name: clean-pending-files
@@ -303,6 +306,12 @@ backend:
         - "/bin/sh"
         - "-c"
         - "python manage.py purge_deleted_files"
+    - name: purge-inactive-rooms
+      schedule: "0 1 * * *"
+      command:
+        - "/bin/sh"
+        - "-c"
+        - "python manage.py purge_inactive_rooms"
 
   ## @param backend.mergeDuplicateUsers.command backend merge_duplicate_users command
   ## @param backend.mergeDuplicateUsers.restartPolicy backend merge_duplicate_users job restart policy

src/summary/pyproject.toml

@@ -10,18 +10,18 @@ dependencies = [
     "pydantic-settings>=2.1.0",
     "celery==5.6.3",
     "redis==5.2.1",
+    "boto3==1.43.56",
     "dockerflow==2026.3.4",
-    "minio==7.2.20",
-    "openai==2.48.0",
-    "posthog==7.29.0",
+    "openai==3.3.1",
+    "posthog==7.44.0",
     "requests==2.34.2",
-    "sentry-sdk[fastapi, celery]==2.66.1",
+    "sentry-sdk[fastapi, celery]==2.68.1",
     "langfuse==4.14.1"
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.0",
+    "ruff==0.16.4",
     "pytest==9.1.1",
     "responses>=0.25.8",
 ]

src/summary/summary/core/config.py

@@ -77,7 +77,7 @@ class Settings(BaseSettings):
     summarize_queue_v2: str = "summarize-queue-v2"
     call_webhook_queue_v2: str = "call-webhook-queue-v2"
 
-    # Minio settings
+    # S3 settings
     aws_storage_bucket_name: str
     aws_s3_endpoint_url: str
     aws_s3_access_key_id: str

src/summary/summary/core/file_service.py

@@ -1,6 +1,5 @@
 """File service to encapsulate files' manipulations."""
 
-import io
 import json
 import logging
 import os
@@ -9,11 +8,13 @@ import tempfile
 from contextlib import contextmanager
 from dataclasses import dataclass
 from datetime import timedelta
+from functools import cached_property
 from pathlib import Path
 from urllib.parse import urlparse
 
+import boto3
 import requests
-from minio import Minio
+from botocore.config import Config
 
 from summary.core.config import get_settings
 from summary.core.shared_models import WhisperXResponse
@@ -266,30 +267,44 @@ class FileServiceException(Exception):
     pass
 
 
+def _build_s3_client():
+    """Build an S3 client for the configured endpoint and region.
+
+    The endpoint may be given with or without a scheme: the scheme always
+    follows `aws_s3_secure_access`.
+    """
+    endpoint = (
+        settings.aws_s3_endpoint_url.removeprefix("https://")
+        .removeprefix("http://")
+        .rstrip("/")
+    )
+    scheme = "https" if settings.aws_s3_secure_access else "http"
+
+    return boto3.client(
+        "s3",
+        endpoint_url=f"{scheme}://{endpoint}",
+        aws_access_key_id=settings.aws_s3_access_key_id,
+        aws_secret_access_key=settings.aws_s3_secret_access_key.get_secret_value(),
+        region_name=settings.aws_s3_region_name,
+        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
+    )
+
+
 class FileService:
-    """Service for downloading and preparing files from MinIO storage."""
+    """Service for downloading and preparing files from S3 storage."""
 
     def __init__(self):
-        """Initialize FileService with MinIO client and configuration."""
-        endpoint = (
-            settings.aws_s3_endpoint_url.removeprefix("https://")
-            .removeprefix("http://")
-            .rstrip("/")
-        )
-
-        self._minio_client = Minio(
-            endpoint,
-            access_key=settings.aws_s3_access_key_id,
-            secret_key=settings.aws_s3_secret_access_key.get_secret_value(),
-            secure=settings.aws_s3_secure_access,
-            region=settings.aws_s3_region_name,
-        )
-
+        """Initialize FileService with its configuration."""
         self._bucket_name = settings.aws_storage_bucket_name
         self._stream_chunk_size = 32 * 1024
 
         self._max_duration_seconds = settings.recording_max_duration
 
+    @cached_property
+    def _s3_client(self):
+        """S3 client, created on first use."""
+        return _build_s3_client()
+
     def _download_from_cloud_storage_url(self, cloud_storage_url: str) -> Path:
         """Download file from a cloud storage URL to local temporary file."""
         logger.info(
@@ -368,7 +383,7 @@ class FileService:
     ):
         """Download and prepare audio file for processing.
 
-        Downloads file from MinIO or an external cloud URL, validates duration,
+        Downloads file from S3 or an external cloud URL, validates duration,
         and yields an open file handle with metadata. Automatically cleans up
         temporary files when the context exits.
         """
@@ -416,16 +431,13 @@ class FileService:
                     logger.warning("Failed to remove temporary file %s: %s", path, e)
 
     def store_transcript(self, *, transcript: WhisperXResponse, job_id: str) -> None:
-        """Store transcript in MinIO."""
+        """Store transcript in S3."""
         logger.info("Storing transcript for job id %s", job_id)
         transcript_path = f"{settings.aws_transcript_path}/{job_id}.json"
         logger.debug("Transcript path: %s", transcript_path)
         data = transcript.model_dump_json().encode()
-        self._minio_client.put_object(
-            self._bucket_name,
-            transcript_path,
-            io.BytesIO(data),
-            length=len(data),
+        self._s3_client.put_object(
+            Bucket=self._bucket_name, Key=transcript_path, Body=data
         )
         logger.info("Transcript stored successfully for job id %s", job_id)
 
@@ -433,21 +445,20 @@ class FileService:
         """Get signed URL for transcript file."""
         transcript_path = f"{settings.aws_transcript_path}/{job_id}.json"
         logger.debug("Transcript path: %s", transcript_path)
-        return self._minio_client.presigned_get_object(
-            self._bucket_name, transcript_path, expires=timedelta(hours=24)
+        return self._s3_client.generate_presigned_url(
+            "get_object",
+            Params={"Bucket": self._bucket_name, "Key": transcript_path},
+            ExpiresIn=int(timedelta(hours=24).total_seconds()),
         )
 
     def store_summary(self, *, summary: str, job_id: str) -> None:
-        """Store summary in MinIO."""
+        """Store summary in S3."""
         logger.info("Storing summary for job id %s", job_id)
         summary_path = f"{settings.aws_summary_path}/{job_id}.txt"
         logger.debug("Summary path: %s", summary_path)
         data = summary.encode()
-        self._minio_client.put_object(
-            self._bucket_name,
-            summary_path,
-            io.BytesIO(data),
-            length=len(data),
+        self._s3_client.put_object(
+            Bucket=self._bucket_name, Key=summary_path, Body=data
         )
         logger.info("Summary stored successfully for job id %s", job_id)
 
@@ -455,6 +466,8 @@ class FileService:
         """Get signed URL for summary file."""
         summary_path = f"{settings.aws_summary_path}/{job_id}.txt"
         logger.debug("Summary path: %s", summary_path)
-        return self._minio_client.presigned_get_object(
-            self._bucket_name, summary_path, expires=timedelta(hours=24)
+        return self._s3_client.generate_presigned_url(
+            "get_object",
+            Params={"Bucket": self._bucket_name, "Key": summary_path},
+            ExpiresIn=int(timedelta(hours=24).total_seconds()),
         )

src/summary/tests/unit/test_file_service.py

@@ -1,17 +1,22 @@
 """Unit tests for the file service."""
 
 import json
+from collections.abc import Callable, Iterator
 from pathlib import Path
 from unittest.mock import Mock
+from urllib.parse import parse_qs, urlparse
 
 import pytest
+from botocore.stub import Stubber
 
 from summary.core import file_service
 from summary.core.file_service import (
+    FileService,
     MediaInfo,
     extract_audio_from_media,
     get_media_info,
 )
+from summary.core.shared_models import WhisperXResponse
 
 BASE_PATH = Path(__file__).parent.parent / "assets"
 
@@ -24,6 +29,46 @@ MEDIA_INFO_SAMPLE_VISIO = MediaInfo(
 )
 
 
+S3Settings = Callable[..., None]
+
+
+@pytest.fixture
+def s3_settings(monkeypatch: pytest.MonkeyPatch) -> S3Settings:
+    """Configure the S3 settings read by the file service.
+
+    The returned function overrides some of them on top of the current ones.
+    The (frozen) settings are replaced by a copy, restored after the test.
+    """
+
+    def override(**values) -> None:
+        monkeypatch.setattr(
+            file_service, "settings", file_service.settings.model_copy(update=values)
+        )
+
+    override(
+        aws_s3_endpoint_url="garage:9000",
+        aws_s3_secure_access=False,
+        aws_s3_region_name="fr-par",
+        aws_storage_bucket_name="meet-media-storage",
+    )
+    return override
+
+
+@pytest.fixture
+def s3_stubber(
+    monkeypatch: pytest.MonkeyPatch, s3_settings: S3Settings
+) -> Iterator[Stubber]:
+    """Stub the S3 client built by the file service.
+
+    An unexpected S3 call fails the test instead of reaching the network.
+    """
+    stubber = Stubber(file_service._build_s3_client())
+    stubber.activate()
+    monkeypatch.setattr(file_service, "_build_s3_client", lambda: stubber.client)
+    yield stubber
+    stubber.assert_no_pending_responses()
+
+
 @pytest.mark.parametrize(
     "media_info",
     [
@@ -149,3 +194,92 @@ def test_extract_audio_from_video():
         assert path.name.endswith(".m4a")
     finally:
         path.unlink(missing_ok=True)
+
+
+@pytest.mark.parametrize(
+    ("endpoint_url", "secure_access", "expected_endpoint_url"),
+    [
+        ("garage:9000", False, "http://garage:9000"),
+        ("http://garage:9000/", False, "http://garage:9000"),
+        ("s3.example.com", True, "https://s3.example.com"),
+        ("http://s3.example.com", True, "https://s3.example.com"),
+    ],
+)
+def test_s3_client_endpoint_follows_secure_access(
+    s3_settings: S3Settings,
+    endpoint_url: str,
+    secure_access: bool,
+    expected_endpoint_url: str,
+) -> None:
+    """The endpoint scheme is taken from aws_s3_secure_access, not from the URL."""
+    s3_settings(aws_s3_endpoint_url=endpoint_url, aws_s3_secure_access=secure_access)
+
+    assert FileService()._s3_client.meta.endpoint_url == expected_endpoint_url
+
+
+@pytest.mark.parametrize("region_name", ["fr-par", None])
+def test_s3_client_region_is_passed_as_is(
+    monkeypatch: pytest.MonkeyPatch,
+    s3_settings: S3Settings,
+    region_name: str | None,
+) -> None:
+    """The configured region goes straight to boto3, even when it is unset."""
+    s3_settings(aws_s3_region_name=region_name)
+    boto3_client = Mock()
+    monkeypatch.setattr(file_service.boto3, "client", boto3_client)
+
+    assert FileService()._s3_client is boto3_client.return_value
+
+    boto3_client.assert_called_once()
+    assert boto3_client.call_args.kwargs["region_name"] == region_name
+
+
+def test_store_transcript(s3_stubber: Stubber) -> None:
+    """The transcript is stored as JSON under the transcripts path."""
+    transcript = WhisperXResponse(segments=())
+    s3_stubber.add_response(
+        "put_object",
+        {},
+        {
+            "Bucket": "meet-media-storage",
+            "Key": "transcripts/job-1.json",
+            "Body": transcript.model_dump_json().encode(),
+        },
+    )
+
+    FileService().store_transcript(transcript=transcript, job_id="job-1")
+
+
+def test_store_summary(s3_stubber: Stubber) -> None:
+    """The summary is stored as text under the summaries path."""
+    s3_stubber.add_response(
+        "put_object",
+        {},
+        {
+            "Bucket": "meet-media-storage",
+            "Key": "summaries/job-1.txt",
+            "Body": b"The summary",
+        },
+    )
+
+    FileService().store_summary(summary="The summary", job_id="job-1")
+
+
+@pytest.mark.parametrize(
+    ("method", "expected_path"),
+    [
+        ("get_transcript_signed_url", "/meet-media-storage/transcripts/job-1.json"),
+        ("get_summary_signed_url", "/meet-media-storage/summaries/job-1.txt"),
+    ],
+)
+def test_signed_urls(s3_stubber: Stubber, method: str, expected_path: str) -> None:
+    """Signed URLs are path-style, SigV4-signed for the region, valid for a day."""
+    url = urlparse(getattr(FileService(), method)("job-1"))
+    query = parse_qs(url.query)
+
+    assert url.scheme == "http"
+    assert url.netloc == "garage:9000"
+    assert url.path == expected_path
+    assert query["X-Amz-Algorithm"] == ["AWS4-HMAC-SHA256"]
+    assert "/fr-par/s3/aws4_request" in query["X-Amz-Credential"][0]
+    assert query["X-Amz-Expires"] == ["86400"]