wip update tag

🚧 (frontend) Add start/stop audio recording menu item
Functional but not mergeable—remote participants need to be informed when recording starts, including the egress ID to prevent collisions. Quick and dirty implementation.
2026-09-30 14:38:33 +00:00 · 2024-09-12 11:19:23 +02:00 · 2024-09-12 10:58:21 +02:00 · 2024-09-12 10:58:19 +02:00 · 2024-09-12 10:49:00 +02:00 · 2024-09-12 10:49:00 +02:00
1172 changed files with 13486 additions and 167728 deletions
@@ -1,9 +0,0 @@
 [codespell]
 # Files that are not English, or generated
 skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
  ./LICENSES,
  ./src/summary/summary/core/locales,
  ./src/summary/summary/core/prompt.py
 # Valid words in French (connexion) or in the code (statics)
 ignore-words-list = connexion,statics
 check-filenames = true
@@ -4,7 +4,7 @@ __pycache__
 **/__pycache__
 **/*.pyc
 venv
-**/.venv
+.venv
 # System-specific files
 .DS_Store
@@ -24,15 +24,13 @@ data
 .cache
 .circleci
 .git
 .vscode
 .iml
 .idea
 db.sqlite3
 .mypy_cache
 .pylint.d
-
+.pytest_cache
 **/.idea
 **/.vscode
 **/.pytest_cache
 **/.mypy_cache
 **/.ruff_cache
 # Frontend
-**/node_modules
+node_modules
@@ -0,0 +1,28 @@
 ---
 name: 🐛 Bug Report
 about: If something is not working as expected 🤔.
 ---
 ## Bug Report
 **Problematic behavior**
 A clear and concise description of the behavior.
 **Expected behavior/code**
 A clear and concise description of what you expected to happen (or code).
 **Steps to Reproduce**
 1. Do this...
 2. Then this...
 3. And then the bug happens!
 **Environment**
 - Meet version:
 - Platform:
 **Possible Solution**
 <!--- Only if you have suggestions on a fix for the bug -->
 **Additional context/Screenshots**
 Add any other context about the problem here. If applicable, add screenshots to help explain.
@@ -0,0 +1,23 @@
 ---
 name: ✨ Feature Request
 about: I have a suggestion (and may want to build it 💪)!
 ---
 ## Feature Request
 **Is your feature request related to a problem or unsupported use case? Please describe.**
 A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
 **Describe the solution you'd like**
 A clear and concise description of what you want to happen. Add any considered drawbacks.
 **Describe alternatives you've considered**
 A clear and concise description of any alternative solutions or features you've considered.
 **Discovery, Documentation, Adoption, Migration Strategy**
 If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
 Maybe a screenshot or design?
 **Do you want to work on it through a Pull Request?**
 <!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->
@@ -0,0 +1,22 @@
 ---
 name: 🤗 Support Question
 about: If you have a question 💬, or something was not clear from the docs!
 ---
 <!-- ^ Click "Preview" for a nicer view! ^
 We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
 ---
 Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
 Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
 If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
 **Topic**
 What's the general area of your question: for example, docker setup, database schema, search functionality,...
 **Question**
 Try to be as specific as possible so we can help you as best we can. Please be patient 🙏
@@ -0,0 +1,11 @@
 ## Purpose
 Description...
 ## Proposal
 Description...
 - [] item 1...
 - [] item 2...
@@ -1,19 +0,0 @@
 name: Changelog Workflow
 on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true
 jobs:
  changelog:
    uses: suitenumerique/ci/.github/workflows/_changelog.yml@main
@@ -1,246 +0,0 @@
 name: CI
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"
 permissions:
  contents: read
 jobs:
  lint-python:
    name: lint ${{ matrix.service }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - service: backend
            working_directory: src/backend
            pylint_targets: meet demo core
          - service: agents
            working_directory: src/agents
            pylint_targets: ""
          - service: summary
            working_directory: src/summary
            pylint_targets: ""
    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@main
    with:
      working_directory: ${{ matrix.working_directory }}
      python_version: "3.13"
      pylint_targets: ${{ matrix.pylint_targets }}
  test-back:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/backend
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: meet
          POSTGRES_USER: dinum
          POSTGRES_PASSWORD: pass
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
      redis:
        image: redis:5
        ports:
          - 6379:6379
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DJANGO_CONFIGURATION: Test
      DJANGO_SETTINGS_MODULE: meet.settings
      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
      DB_HOST: localhost
      DB_NAME: meet
      DB_USER: dinum
      DB_PASSWORD: pass
      DB_PORT: 5432
      REDIS_URL: redis://localhost:6379/1
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
      AWS_S3_ENDPOINT_URL: http://localhost:9000
      AWS_S3_ACCESS_KEY_ID: meet
      AWS_S3_SECRET_ACCESS_KEY: password
      OIDC_RS_CLIENT_ID: meet
      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
      OIDC_OP_URL: https://oidc.example.com
      MEDIA_BASE_URL: http://localhost:8083
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Create writable /data
        run: |
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static
      - name: Build or restore the mail templates
        uses: suitenumerique/ci/actions/mail-templates@main
      - name: Start MinIO
        run: |
          docker pull quay.io/minio/minio
          docker run -d --name minio \
            -p 9000:9000 \
            -e "MINIO_ACCESS_KEY=meet" \
            -e "MINIO_SECRET_KEY=password" \
            -v /data/media:/data \
            quay.io/minio/minio server --console-address :9001 /data
      # Tool to wait for a service to be ready
      - name: Install Dockerize
        run: |
          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
            sudo tar -C /usr/local/bin -xzv
      - name: Wait for MinIO to be ready
        run: |
          dockerize -wait tcp://localhost:9000 -timeout 10s
      - name: Configure MinIO
        run: |
          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
          docker exec ${MINIO} sh -c \
            "mc alias set meet http://localhost:9000 meet password && \
            mc alias ls && \
            mc mb meet/meet-media-storage"
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the dependencies
        run: uv sync --locked --all-extras
      - name: Install gettext (required to compile messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      - name: Generate a MO file from strings extracted from the project
        run: uv run --no-sync --no-build python manage.py compilemessages
      - name: Run tests
        run: uv run --no-sync --no-build pytest -n 2
  test-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/summary
    env:
      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
      AWS_S3_ENDPOINT_URL: "minio:9000"
      AWS_S3_ACCESS_KEY_ID: "meet"
      AWS_S3_SECRET_ACCESS_KEY: "password"
      WHISPERX_BASE_URL: "https://configure-your-url.com"
      WHISPERX_ASR_MODEL: "large-v2"
      WHISPERX_API_KEY: "test-whisperx-secret"
      WHISPERX_DEFAULT_LANGUAGE: "fr"
      LLM_BASE_URL: "https://configure-your-url.com"
      LLM_API_KEY: "test-llm-secret"
      LLM_MODEL: "test-llm-model"
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install ffmpeg
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the project
        run: uv sync --locked --all-extras
      - name: Run summary tests
        run: uv run --no-sync --no-build pytest
  lint-front:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install dependencies
        run: cd src/frontend/ && npm ci --ignore-scripts
      - name: Check linting
        run: cd src/frontend/ && npm run lint
      - name: Check format
        run: cd src/frontend/ && npm run check
  lint-sdk:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Check linting
        run: npm run lint
      - name: Check format
        run: npm run check
  build-sdk:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs: lint-sdk
    defaults:
      run:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Build SDK
        run: npm run build
@@ -1,18 +0,0 @@
 name: Project quality Workflow
 on:
  pull_request:
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true
 jobs:
  quality:
    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@main
    with:
      print_check_paths: src/backend src/summary src/agents
      codespell_ignore_words: ""
@@ -0,0 +1,33 @@
 name: Download Crowdin translations
 on:
  workflow_dispatch:
    types: [file-fully-translated]
 permissions:
  contents: write
  pull-requests: write
 jobs:
  crowdin:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Download Crowdin files
        uses: crowdin/github-action@v2
        with:
          upload_sources: false
          upload_translations: false
          download_translations: true
          localization_branch_name: l10n_crowdin_translations
          create_pull_request: true
          pull_request_title: "New Crowdin translations"
          pull_request_body: "New Crowdin pull request with translations"
          pull_request_base_branch_name: "main"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
          CROWDIN_BASE_PATH: ${{ github.workspace }}
@@ -0,0 +1,52 @@
 name: Deploy
 on:
  push:
    tags:
      - 'preprod'
      - 'production'
 jobs:
  notify-argocd:
    runs-on: ubuntu-latest
    steps:
      -
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: "meet,secrets"
      -
        name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Call argocd github webhook
        run: |
          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
  start-test-on-preprod:
    needs:
      - notify-argocd
    runs-on: ubuntu-latest
    if: startsWith(github.event.ref, 'refs/tags/preprod')
    steps:
      -
        name: Debug
        run: |
          echo "Start test when preprod is ready"
@@ -1,5 +1,4 @@
-name: Docker images
+name: Docker Hub Workflow
 run-name: Docker images
 on:
  workflow_dispatch:
@@ -12,66 +11,130 @@ on:
    branches:
      - 'main'
-permissions:
+env:
-  contents: read
+  DOCKER_USER: 1001:127
 jobs:
-  build-and-push:
+  build-and-push-backend:
-    name: ${{ matrix.service }}
+    runs-on: ubuntu-latest
-    strategy:
+    steps:
-      fail-fast: false
+      -
-      matrix:
+        uses: actions/create-github-app-token@v1
-        include:
+        id: app-token
-          - service: backend
+        with:
-            image_name: lasuite/meet-backend
+          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: "meet,secrets"
      -
        name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: lasuite/meet-backend
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request'
        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
      -
        name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
            file: ./Dockerfile
          target: backend-production
-          - service: frontend
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-            image_name: lasuite/meet-frontend
+          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-frontend:
    runs-on: ubuntu-latest
    steps:
      -
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: "meet,secrets"
      -
        name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: lasuite/meet-frontend
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request'
        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
      -
        name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./src/frontend/Dockerfile
          target: frontend-production
-          - service: frontend-dinum
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-            image_name: lasuite/meet-frontend-dinum
+          push: ${{ github.event_name != 'pull_request' }}
-            context: .
+          tags: ${{ steps.meta.outputs.tags }}
-            file: ./docker/dinum-frontend/Dockerfile
+          labels: ${{ steps.meta.outputs.labels }}
            target: frontend-production
          - service: summary
            image_name: lasuite/meet-summary
            context: ./src/summary
            file: ./src/summary/Dockerfile
            target: production
          - service: agents
            image_name: lasuite/meet-agents
            context: ./src/agents
            file: ./src/agents/Dockerfile
            target: production
    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@main
    with:
      image_name: ${{ matrix.image_name }}
      context: ${{ matrix.context }}
      file: ${{ matrix.file }}
      target: ${{ matrix.target }}
      docker_user: "1001:127"
      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
      trivy_scan: true
    secrets:
      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
  notify-argocd:
    permissions:
      contents: read
    needs:
-      - build-and-push
+      - build-and-push-frontend
      - build-and-push-backend
    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
+    if: |
      github.event_name != 'pull_request'
    steps:
-      - uses: suitenumerique/ci/actions/argocd-webhook-notification@main
+      -
-        id: notify
+        uses: actions/create-github-app-token@v1
        id: app-token
        with:
-          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
+          app-id: ${{ secrets.APP_ID }}
-          argocd_webhook_secret: "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}"
+          private-key: ${{ secrets.PRIVATE_KEY }}
-          argocd_url: "${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}"
+          owner: ${{ github.repository_owner }}
          repositories: "meet,secrets"
      -
        name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Call argocd github webhook
        run: |
          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
@@ -0,0 +1,243 @@
 name: meet Workflow
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "*"
 jobs:
  lint-git:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: show
        run: git log
      - name: Enforce absence of print statements in code
        run: |
          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/meet.yml' | grep "print("
      - name: Check absence of fixup commits
        run: |
          ! git log | grep 'fixup!'
      - name: Install gitlint
        run: pip install --user requests gitlint
      - name: Lint commit messages added to main
        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
  build-mails:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "18"
      - name: Restore the mail templates
        uses: actions/cache@v4
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
      - name: Install yarn
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: npm install -g yarn
      - name: Install node dependencies
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: yarn install --frozen-lockfile
      - name: Build mails
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: yarn build
      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
        uses: actions/cache@v4
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
  lint-back:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install development dependencies
        run: pip install --user .[dev]
      - name: Check code formatting with ruff
        run: ~/.local/bin/ruff format . --diff
      - name: Lint code with ruff
        run: ~/.local/bin/ruff check .
      - name: Lint code with pylint
        run: ~/.local/bin/pylint meet demo core
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
    defaults:
      run:
        working-directory: src/backend
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: meet
          POSTGRES_USER: dinum
          POSTGRES_PASSWORD: pass
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
    env:
      DJANGO_CONFIGURATION: Test
      DJANGO_SETTINGS_MODULE: meet.settings
      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
      DB_HOST: localhost
      DB_NAME: meet
      DB_USER: dinum
      DB_PASSWORD: pass
      DB_PORT: 5432
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
      LIVEKIT_API_SECRET: secret
      LIVEKIT_API_KEY: devkey
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Create writable /data
        run: |
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static
      - name: Restore the mail templates
        uses: actions/cache@v4
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install development dependencies
        run: pip install --user .[dev]
      - name: Install gettext (required to compile messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      - name: Generate a MO file from strings extracted from the project
        run: python manage.py compilemessages
      - name: Run tests
        run: ~/.local/bin/pytest -n 2
  lint-front:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Install dependencies
        run: cd src/frontend/ && npm ci
      - name: Check linting
        run: cd src/frontend/ && npm run lint
      - name: Check format
        run: cd src/frontend/ && npm run check
  i18n-crowdin:
    runs-on: ubuntu-latest
    steps:
      -
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: "infrastructure,secrets"
      -
        name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
          secret-file: secrets/numerique-gouv/meet/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      - name: Install gettext (required to make messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install development dependencies
        working-directory: src/backend
        run: pip install --user .[dev]
      - name: Generate the translation base file
        run: ~/.local/bin/django-admin makemessages --keep-pot --all
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "18.x"
          cache: "npm"
          cache-dependency-path: src/frontend/package-lock.json
      - name: Install dependencies
        run: cd src/frontend/ && npm ci
      - name: Extract the frontend translation
        run: make frontend-i18n-extract
      - name: Upload files to Crowdin
        uses: crowdin/github-action@v2
        with:
          config: crowdin/config.yml
          upload_sources: true
          upload_translations: true
          download_translations: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_BASE_PATH: ${{ github.workspace }}
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
@@ -1,17 +0,0 @@
 name: Release Helm chart
 on:
  push:
    branches:
      - main
    paths:
      - src/helm/meet/**
 permissions:
  contents: read
 jobs:
  release:
    permissions:
      contents: write
    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@main
@@ -1,21 +0,0 @@
 name: Security analysis
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "**"
 permissions: {}
 jobs:
  zizmor:
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@main
    with:
      config: .github/zizmor.yml
@@ -1,5 +0,0 @@
 rules:
  unpinned-uses:
    config:
      policies:
        "suitenumerique/*": ref-pin
@@ -31,7 +31,6 @@ MANIFEST
 # Translations	# Translations
 *.pot
 *.mo
 # Environments
 .env
@@ -80,12 +79,3 @@ db.sqlite3
 # Egress output
 docker/livekit/out
 # LiveKit CA configuration
 docker/livekit/rootCA.pem
 # Frontend rollup-plugin-visualizer
 /src/frontend/rollup-plugin-visualizer/*
 # NixOS
 .devenv
@@ -0,0 +1,3 @@
 [submodule "secrets"]
 	path = secrets
 	url = ../secrets
@@ -8,5 +8,3 @@ creation_rules:
      - age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa #marie
      - age1qy04neuzwpasmvljqrcvhwnf0kz5cpyteze38c8avp0czewskasszv9pyw #argocd
      - age18fgn6j2vwwswqcpv9xpcehq8mrf9zs2sglwkamp3tzwx8d9jq9jsrskrk9 #manuuu
      - age1hm2hsfgjezpsc3k0y5w5feq9t8vl3seq04qjhgt6ztd6403wfvpsgxu09m # github-repo
      - age1hnhuzj96ktkhpyygvmz0x9h8mfvssz7ss6emmukags644mdhf4msajk93r # Samuel Paccoud
@@ -7,780 +7,3 @@ and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ## [Unreleased]
 ## [1.32.1] - 2026-09-25
 ### Fixed
 - 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
 - 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
 ## [1.32.0] - 2026-09-25
 ### Added
 - ✨(backend) make the LiveKit default video codec configurable
 - 🔧(dev) add support for Bureautix workstations
 - ✨(frontend) add screen share zoom controls #1498
 ### Changed
 - 🔥(backend) remove unused API viewset and permission helpers
 - 🔊(backend) pin the dockerflow logger level to WARNING
 - 🚑️(summary) serve health endpoints with the dockerflow router
 - ♻️(backend) serve the dockerflow views early in the middleware stack
 - 📈(frontend) include LiveKit SIDs in the connection analytics event
 - 🔇(backend) silence expected 401 warnings on /me
 - 🔇(backend) silence noisy request summary info logs
 - ⚡️(frontend) defer loading the Crisp script until idle
 - ⬆️(frontend) upgrade react-i18next from 17.0.10 to 17.0.12
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
 - ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
 - 🔖(helm) release chart 0.0.28
 - ♻️(backend) decouple recording event handling from LiveKit egress statuses
 ### Fixed
 - 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
 - 🐛(helm) render periodSeconds and failureThreshold on probes
 - 🐛(backend) report the app release to Sentry instead of "NA"
 - 🐛(frontend) play the waiting room notification sound on every arrival
 - 🐛(frontend) apply saved reception resolution when joining a meeting #1714
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
 - 🔒️(backend) reject inactive users in resource server backend
 - 🐛(frontend) fix file permissions in the Docker image
 - 🚸(frontend) inform user that recording waits until a track is published
 - 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
 - 🐛(backend) handle failed and aborted egresses
 - 🩹(frontend) notify participants when a recording fails or is aborted
 - 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
 ## [1.31.0] - 2026-09-08
 ### Added
 - ✨(frontend) add 1080p sending resolution option #1660
 - ✨(backend) add Traefik support via configurable media-auth url header #1649
 - ✨(backend) update a room's attributes from the external API
 - 🔊(backend) log request duration in Gunicorn workers
 - 📈(frontend) track missing lobby participant on accept/reject
 - ✨(backend) sort waiting participants by their arrival time
 ### Changed
 - ⬆️(dev) pin LiveKit server to v1.13.6
 - 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
 ### Fixed
 - 🐛(backend) allow any printable ASCII characters in user sub field #1673
 - 🐛(frontend) keep the sending resolution picked while the camera is off #1667
 - 🐛(frontend) restore automatic lower-hand on speaking
 - 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
 - 🐛(frontend) keep feedback buttons on one line for fr/es/en
 - ⚡️(frontend) increase lobby polling interval on both sides
 - ⚡️(frontend) add trailing slash on the /me endpoint call
 - ⚡️(backend) refactor lobby storage to bound key lookups per room
 - ⚡️(backend) refactor presence cache to bound key lookups per room
 - 💄(frontend) position the login hint dynamically next to the button
 ## [1.30.0] - 2026-09-01
 ### Added
 - ✨(agent) support Voxtral realtime as inference engine
 - 🌐(i18n) add Spanish language support
 - ✨(frontend) expose publish permissions on the media state element #1661
 ### Changed
 - 🔥(backend) remove the S3 storage-event webhook for recordings
 - ♻️(backend) always finalize recordings using the LiveKit egress_ended webhook
 - ⬆️(frontend) upgrade posthog-js from 1.409.5 to 1.414.0
 - ⬆️(frontend) upgrade @fontsource-variable/lexend from 5.2.11 to 5.3.0
 - ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
 - ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
 - ♻️(backend) factorize s3 client creation in utils
 - ♿️(frontend) close side panel with Escape key #1507
 ### Fixed
 - 🐛(frontend) fix chat text-area bug
 ## [1.29.0] - 2026-08-25
 ### Added
 - ✨(any) let any authenticated user manage the lobby on trusted rooms
 ### Changed
 - 📱(frontend) collapse mobile control bar items on narrow viewports
 - 📱(frontend) stack idle modal buttons in a column on mobile
 - 📱(frontend) improve feedback screen responsiveness on mobile
 - ⬆️(frontend) upgrade @fontsource-variable/atkinson-hyperlegible-next
 - ⬆️(frontend) upgrade i18next-resources-to-backend from 1.2.1 to 1.2.3
 - ⬆️(frontend) upgrade @tanstack/react-query from 5.101.1 to 5.101.4
 - ⬆️(frontend) upgrade @pandacss/preset-panda from 1.11.3 to 1.12.0
 - ⬆️(frontend) upgrade posthog-js from 1.404.1 to 1.409.5
 - ⚡️(frontend) apply frugal constraint to the active meeting audio track
 - ⚡️(backend) replace blocking Redis KEYS with cursor-based SCAN
 - ✨(summary) add hostname to analytics properties
 ## [1.28.0] - 2026-08-24
 ### Added
 - 📈(frontend) track errors when starting or stopping a recording
 - 🚸(frontend) explain camera-in-use failures on the join screen
 ### Changed
 - ✨(backend) accept form-urlencoded on the user token endpoint
 - ✨(summary) configurable s3 region
 - ⬆️(frontend) upgrade i18next and react-i18next patch versions
 - ⬆️(frontend) upgrade posthog-js from 1.395.0 to 1.404.1
 - ⬆️(frontend) upgrade livekit-client and @livekit/components-react
 - 💄(frontend) increase the blur intensity
 ### Fixed
 - 📝(docs) fix minor typos in comments and docstrings
 - ⬆️(backend) bump sqlparse from 0.5.5 to 0.6.0
 - ⬆️(mail) bump @html-to/text-cli from 0.6.0 to 0.6.1
 - 🐛(frontend) treat client-initiated connect aborts as events
 - 🐛(frontend) use state instead of a ref for MoreControls container
 - 🐛(frontend) stop init_virtual_background from firing on blur updates
 - 🐛(frontend) hoist mute confirmation dialog to VideoConference level
 - 🐛(frontend) fix joined notification tile no longer rendering properly
 - 🐛(frontend) handle device-in-use errors on Chrome / Windows 10
 - 🐛(frontend) handle Firefox/Windows AbortError on device start
 - 🐛(frontend) treat "Timeout starting source" AbortError as device-in-use
 - 🔇(frontend) suppress leaked WebSocket error events from livekit-client
 ## [1.27.0] - 2026-08-14
 ### Changed
 - 🔥(frontend) drop unused vendored ConnectionObserver
 - 🐛(frontend) vendor formatChatMessageLinks and trim surrounding newlines
 ### Fixed
 - 📈(frontend) downgrade unreachable external home URL from error to event
 - 🐛(frontend) handle 401 responses when syncing user preferences
 - 🐛(frontend) harden speaker test against missing sinks and play errors
 - 🐛(frontend) implement hysteresis band for the control bar layout
 - 🐛(frontend) fix toolbar ResizeObserver loop and alignment drift
 - 🐛(analytics) filter benign ResizeObserver loop error in Sentry/PostHog
 - 🐛(frontend) stop reporting screen-share denials as errors
 - 🐛(frontend) generalize screen-share error modal beyond macOS
 - 📈(frontend) stop double-reporting media device failures
 ## [1.26.0] - 2026-08-12
 ### Added
 - 📈(frontend) capture media diagnostics on media errors
 - ✨(frontend) add an audio gauge to the microphone select menu
 - ✨(frontend) add a sound tester to the output select menu
 - ✨(frontend) prompt for permissions when toggling a denied device
 - ⚗️(frontend) capture console.error in PostHog
 - 📈(frontend) snapshot media devices on the happy path
 - 🚸(frontend) guide users when the OS blocks browser media access
 - ✨(frontend) add a silent-microphone watcher on join and room screens
 ### Changed
 - ♻️(frontend) encapsulate error tracking behind a telemetry module
 - ♻️(frontend) encapsulate PostHog capture calls in the telemetry module
 - 🔧(frontend) sync persisted device ids with the actual selected devices
 - 💄(frontend) hide the ProConnect button on narrow viewports
 - ♻️(frontend) prefer captureMediaEvent over reportError when no-op
 ### Fixed
 - 🐛(frontend) drop exact deviceId constraint on dynamic track creation
 - 🐛(frontend) fix permission store regression
 - 🐛(frontend) handle missing device errors gracefully
 - 🐛(frontend) display the meeting id in the join screen page title
 ## [1.25.2] - 2026-08-06
 ### Fixed
 - 🐛(frontend) serve MediaPipe assets under a versioned path
 - 🐛(frontend) harmonize cache configuration for MediaPipe assets
 ## [1.25.1] - 2026-08-06
 ### Fixed
 - 🚑️(frontend) fix background crash from MediaPipe WASM version mismatch
 ## [1.25.0] - 2026-08-05
 ### Added
 - ✨(summary) report exception type in failure analytics
 - ✨(frontend) add configurable documentation menu item
 - ✨(frontend) allow promoting authenticated participants
 - ✨(frontend) introduce an "unauthenticated" participant badge
 - ✨(backend) add roomkit viewset to start a room without WebRTC join
 - ✨(frontend) let users set default configuration for generated links
 - ✨(frontend) expose media state to external gateways
 - ✨(frontend) add connection test feature
 - ✨(sdk) allow passing a background color to the calendar iframe
 - ✨(sdk) add a room configuration popup from CreateMeetingButton
 ### Changed
 - ⬆️(frontend) upgrade @mediapipe/tasks-vision from 0.10.14 to 0.10.35
 - ⬆️(frontend) upgrade i18next from 26.3.1 to 26.3.6
 - ⬆️(frontend) upgrade posthog-js from 1.391.2 to 1.395.0
 - ⬆️(frontend) upgrade @tanstack/react-query from 5.101.0 to 5.101.1
 - ⬆️(frontend) upgrade livekit-client from 2.19.2 to 2.20.0
 - ⚡️(frontend) limit unnecessary re-renders #1510
 - 📝(legal) update terms of service
 - 💄(frontend) render Avatar initials in uppercase
 - 💄(frontend) improve participant name rendering in the list
 - 🚚(backend) rename TelephonyService to SIPManagement
 - ⬆️(dependencies) update python dependencies
 ### Fixed
 - 🐛(transcription) fix silent bug in speaker assignment
 - 🐛(summary) extend tasks auto retry logic
 - 🐛(summary) properly detect when failure webhook should be sent
 - 🐛(backend) preserve recording metadata when updating room access
 - 🐛(backend) allow any string as sub in the API serializer
 - 🐛(frontend) fall back to user.full_name on request-entry
 - 🚸(frontend) show two initials in the Avatar when possible
 - 🩹(all) clear the SonarCloud reliability finding and the lint debt
 - 🐛(frontend) stop the installed app reopening the room it came from
 - 🐛(backend) serialize lazy title in summary payload
 - 💄(frontend) show pointer cursor on interactive switches
 - 🐛(frontend) fix icon centering in the Switch primitive
 - 🐛(frontend) keep Unicode initials intact in avatar
 - 🐛(frontend) prevent concurrent settings updates from overwriting each other
 ## [1.24.0] - 2026-07-21
 ### Added
 - ✨(backend) allow searching the recording admin table by owner email
 - ✨(frontend) add participant color gradient when camera is off #1490
 - ✨(all) allow forcing SSO display name for authenticated users
 - ➕(frontend) install vite-plugin-static-copy for MediaPipe WASM assets
 - ✨(addon) show add-in tools when creating meetings in shared calendars
 ### Changed
 - 🗑️(settings) deprecate SUMMARY_SERVICE_VERSION=1
 - ⬆️(mail) update mjml to v5 and @html-to/text-cli
 - 🚸(frontend) initialize the join input name with the persisted full name
 - ♻️(frontend) refactor background processors to use the new API
 - ♻️(frontend) inline model weights to avoid loading them from remote
 - ♻️(frontend) inline MediaPipe WASM modules to avoid loading from remote
 - ⬆️(frontend) upgrade posthog-js from 1.387.0 to 1.391.2
 - ⬆️(frontend) upgrade react-stately from 3.47.0 to 3.48.0
 - ⬆️(frontend) upgrade react-aria from 3.49.0 to 3.50.0
 - ⬆️(frontend) upgrade react-aria-components from 1.18.0 to 1.19.0
 ### Fixed
 - 🩹(backend) identify externally provisioned users to PostHog
 - 🐛(backend) fix info panel crash for unregistered rooms
 - ♿️(frontend) focus side panel container on open #1452
 - 🐛(summary) whisper call error handling
 ## [1.23.0] - 2026-07-08
 ### Added
 - ✨(backend) extend analytics module to support feature flags
 - ✨(backend) implement feature flags in Posthog analytics backend
 - ✨(agents) report errors to Sentry for all LiveKit agents
 ### Changed
 - ⬆️(agents) upgrade to python 3.14 slim
 - ⬆️(dependencies) update python dependencies
 - 💥(summary) remove v1 related code #1362
 - ✨(meet) use compatible with summary v2 #1362
 - ♻️(backend) refactor analytics backend from Protocol to abstract class
 - 🔥(summary) remove call to summary enabled feature flag
 - ♻️(frontend) wrap MuteEveryoneButton with AdminOrOwnerOnly
 - ⬆️(frontend) upgrade livekit-client from 2.19.0 to 2.19.2
 - ⬆️(frontend) upgrade posthog-js from 1.386.5 to 1.387.0
 - ⬆️(frontend) upgrade @tanstack/react-query from 5.100.14 to 5.101.0
 - ⬆️(frontend) update the frontend build image to Node 22
 - 🔒️(frontend) update docker image to nginx-unprivileged:1.30.3-alpine3.23
 - ✨(summary) more precise analytics events
 ### Fixed
 - 🚀(front) fix frontend build failure
 - 🐛(makefile) fix args in make test
 - 🩹(backend) fix case-insensitive email deduplication in merge command
 - 🐛(summary) support media files with bad streams #1478
 ## [1.22.0] - 2026-07-03
 ### Added
 - ✨(frontend) cap and paginate tiles in picture-in-picture #1383
 - 📝(docs) document rebranding the favicon via a volume mount #1443
 - ✨(backend) add command to clean pending and deleted files
 - 🧱(helm) run clean files command as cronjob
 - ✨(backend) add fallback to save recordings without S3/MinIO webhooks
 - 🩹(frontend) enable screen share button in PiP #1458
 - 🐛(backend) support unencoded S3 notification object keys #1455
 - ✨(frontend) prioritize screen share in picture-in-picture layout #1467
 ### Changed
 - ✨(summary) generalized stt api call #1420
 - ♻️(env) refactor env variables handling
 - 🚸(frontend) use "Advanced" instead of "Premium" in the sidepanel
 - ♿️(frontend) make fullscreen share warning keyboard accessible #1459
 - ⬆️(summary) update docker alpine to 3.24 & ffmpeg to 8.1.2 #1471
 ### Fixed
 - 🛂(backend) reject user access tokens on the API
 - 🩹(helm) fix Helm ingress rendering when passing multiple hosts
 ## [1.21.0] - 2026-06-15
 ### Added
 - ✨(frontend) allow disabling silent login via a URL parameter
 - ✨(frontend) allow hiding the login button via a URL parameter
 - ✨(summary) add optional satisfaction survey footer
 ### Changed
 - ✨(frontend) enhance noise reduction with BBBA audio processing pipeline
 - 🚸(frontend) mute join notification sound in larger rooms
 - 🚸(frontend) mute participants by default when joining a large meeting
 ### Fixed
 - 🐛(frontend) fix metadata agent collector enabled check
 ### Fixed
 - ♿️(frontend) improve accessibility of the Effects panel #1401
 ## [1.20.0] - 2026-06-12
 ### Changed
 - ♻️(addon) improve Outlook add-on: i18n support, feedback link, smarter link
 - ⬆️(frontend) upgrade react-i18next from 15.1.1 to 17.0.8
 ### Fixed
 - 🐛(frontend) fix noise reduction left-channel-only audio
 ## [1.19.0] - 2026-06-04
 ### Added
 - ✨(backend) add file specific admin #1387
 ### Changed
 - 🐛(agents) fix bug when closing metadata-collector
 - ⬆️(dependencies) update python dependencies
 - ⬆️(frontend) update js dependencies
 - ♻️(agents) replace deprecated room options API
 ### Fixed
 - 🔇(summary) make ffmpeg quiet #1404
 - 🔒️(backend) prevent accessing files if they are not ready #1395
 - # ⬆️(backend) upgrade idna to >=3.15 to address CVE-2026-45409
 ## [1.18.0] - 2026-06-03
 ### Added
 - 🔧(backend) backport logging configuration from docs
 - 🧑‍💻(backend) add management command to merge duplicate users
 - 👷(helm) add Kubernetes job for duplicate user merge command
 ### Fixed
 - 🐛(backend) prevent duplicate pending users on concurrent requests
 - 🔒️(backend) prevent file change post checks #1377
 ## [1.17.0] - 2026-05-31
 ### Added
 - ✨(fullstack) allow participants to mute others based on room configuration
 - ✨(frontend) add synchronizer for room metadata updates
 - ✨(frontend) make reaction toolbar responsive on small viewports
 - ✨(frontend) enable reactions on mobile devices
 - ✨(frontend) introduce picture-in-picture meeting
 - ✨(backend) add core.recording.event.parsers.S3Parser
 - ✨(summary) extended support for all video / audio files #1358
 ### Changed
 - ♻️(fullstack) simplify source serialization
 - ✨(backend) expose room configuration to all API consumers
 - 🩹(frontend) improve reaction toolbar centering with dynamic positioning
 - 🚀 (paas) remove buildpack requirements.txt to use the new uv.lock #1349
 - ✨(backend) allow room configuration and access level via external api #1260
 - ♻️(backend) prefix Swagger routes with /api
 ### Fixed
 - 🩹(backend) fix swagger and redoc documentation URLs
 ## [1.16.0] - 2026-05-13
 ### Added
 - 🔒️(backend) add validation of Room.configuration
 - ✨(helm) add support multiple transcribe worker / endpoint #1247
 - ✨(backend) make LiveKit Egress recording encoding configurable #1288
 - ✨(summary) add speaker-to-participant assignment
 ### Changed
 - ♻️(summary) change tasks endpoint signature
 - ⬆️(dependencies) update urllib3 to v2.7.0 [SECURITY]
 - 🧑‍💻(agents) use `uv` for package management
 - ✨(summary) improve speaker-to-participant assignment
 ### Fixed
 - ♻(frontend) standardize role terminology across localizations
 - 🐛(backend) make start-recording atomic and fault-tolerant
 - 🔒️(frontend) room ids are generated with non-cryptographic rand
 - ⬆️(mail) fix dependencies not having resolved or integrity field #1321
 - 🐛(summary) complete webm support #1328
 - 🐛(backend) add link to "Open" text in recording email
 - 🩹(frontend) fix spacing regression in mobile control bar
 ## [1.15.0] - 2026-04-30
 ### Added
 - ✨(backend) add metadata collection of VAD, connection and chat events
 - ✨(backend) introduce add-ons authentication backend
 - 💬(backend) clarify french transcription audio download link text #1299
 - 🚧(addons) introduce initial Microsoft Outlook add-in support (alpha)
 - 🔧(backend) add setting to toggle application token exchange mechanism
 - ✨(backend) support add-ons authentication in external viewset
 ### Fixed
 - 🐛(summary) support webm #1290
 - ⬆️(backend) bump django-lasuite to v0.0.26
 - 🩹(frontend) use a more standard (quality) rating scale
 - 🩹(frontend) fix access control for screen recording feature flag
 - 🩹(frontend) fix reconnect loop caused by connectionObserverStore updates
 ## [1.14.0] - 2026-04-16
 ### Added
 - 🔒️(helm) Add pod and container securityContext #1197
 - ✨(summary) add routes v2 for async STT and summary tasks #1171
 - ✅(backend) add unit tests for JwtTokenService #1232
 ### Changed
 - ⬆️(backend) bump lodash from 4.17.23 to 4.18.1 in /src/mail
 - ⬆️(frontend) bump hono from 4.12.8 to 4.12.12 in /src/frontend
 - ⬆️(backend) bump pygments from 2.19.2 to 2.20.0 in /src/backend
 - ♻️(backend) use Authorization header for LiveKit token authentication
 - 🥅(backend) refine Twirp error handling for participant operations
 - ✨(summary) allow more file extensions #1265
 - ♿️(frontend) refocus reactions toolbar with ctrl+shift+e is activated #1262
 - ♿️(frontend) set an explicit document title on recording download page #1261
 - ♿️(frontend) add customizable accessibility fonts #1270
 ### Fixed
 - ⬆️(dependencies) update aiohttp to v3.13.4 [SECURITY]
 - ⬆️(dependencies) update vite to v7.3.2 [SECURITY]
 - ⬆️(dependencies) update django to v5.2.13 [SECURITY]
 - 🔒(backend) rely on backend to allow participant update their metadata
 - 🐛(summary) fix failure webhook notification #1233
 - 🐛(summary) relax whisperX payload format #1233
 - ⬆️(backend) upgrade dependencies to fix Pillow CVE-2026-40192
 - ⬆️(frontend) upgrade frontend image to Alpine 3.23 to address CVEs
 ## [1.13.0] - 2026-03-31
 ### Changed
 - ⬆️(dependencies) update python dependencies
 - ♿️(frontend) add explicit region for call controls #1216
 - ♿️(frontend) improve accessibility of the reaction toolbar #1216
 - ♿️(frontend) enhance sidepanel navigation accessibility #1216
 ### Fixed
 - 🔒️(backend) fix email disclosure in room invitation endpoint #1200
 - 🐛(backend) fix regression in update-participant endpoint #1204
 ## [1.12.0] - 2026-03-24
 ### Changed
 - ♻️(backend) configurable SESSION_ENGINE #1038 #1154
 - ♿️(frontend) fix sidepanel accessibility aria-label #1182
 - ♿️(frontend) fix more tools heading hierarchy #1181
 - ♿️(fronted) improve button descriptions for More tools actions #1184
 - 💄(spinner) enforce spinner height #1183
 - 💄(custom-background) add upload indicator with preview #1183
 - ♿️(backend) improve logo accessibility in recording email notification #1092
 - ♿️(summary) improve accessibility of transcription download link #1187
 - 💄(frontend) show OS-specific shortcut in participant tile hint #1193
 - ⬆️(frontend) bump flatted from 3.3.1 to 3.4.2 in /src/frontend #1188
 - ⬆️️️(frontend) bump undici from 6.23.0 to 6.24.1 in /src/frontend
 - ⬆️️️(frontend) bump hono from 4.12.2 to 4.12.7 in /src/frontend
 - ⬆️️️(frontend) bump dompurify from 3.3.1 to 3.3.2 in /src/frontend
 ### Fixed
 - 🐛(frontend) disable personal custom background while deleting #1183
 - 🐛(frontend) auto-select new custom background when not logged in #1183
 - 🐛(frontend) fix device selection not applying during conference #1156
 ## [1.11.0] - 2026-03-19
 ### Added
 - ✨(helm) support celery with our Django backend #1124
 - ✨(helm) support ingress for custom background image #1124
 - ✨(backend) add authenticated user rate throttling on request-entry #1129
 - ✨(backend) expose `is_active` field for Application in Django admin #1133
 - ✨(file-upload) disable by default & limit count by user #1141
 - ✨(frontend) custom background #1067
 ### Changed
 - ♿️(frontend) Caption text size setting for accessibility #1062
 - ♿️(frontend) sync html lang attribute with i18n for screen readers #1111
 - ♿️(frontend) improve MoreLink a11y and UX on home page #1112
 - ♿️(frontend) improve chat toast a11y for screen readers #1109
 - ♿️(frontend) improve ui and aria labels for help article links #1108
 - 🌐(frontend) improve German translation #1125
 - 🔨(python-env) migrate meet main app to UV #1120
 - ♻️(backend) align Application model field with `is_active` convention #1133
 - 🔐(backend) avoids revealing the inactive status of an application #1135
 - ⚡️(helm) reduce initialDelaySeconds and add periods seconds #1139
 - 🔒️(backend) avoid information exposure through exception messages #1144
 - ⬆️(dependencies) update PyJWT to v2.12.0 [SECURITY] #1151
 - 📌(agents) unpin OpenSSL and related dependencies #1167
 - ♿️(frontend) add caption font and background color customization #1122
 ### Fixed
 - 🐛(frontend) fix hand icon and queue position alignment and position #1119
 - 🩹(backend) add page_size to pagination for room endpoints #1131
 - 🐛(backend) refactor lobby throttling to use participant id #1129
 - 🩹(backend) ignore non-recording uploads in storage webhook handler #1142
 - 🐛(frontend) fix dimension mismatch in BackgroundCustomProcessor #1116
 ## [1.10.0] - 2026-03-05
 ### Changed
 - 🔒️(backend) enhance API input validation to strengthen security #1053
 - 🦺(backend) strengthen API validation for recording options #1063
 - ⚡️(frontend) optimize few performance caveats #1073
 - 🔒️(helm) introduce a dedicated Kubernetes Ingress for webhook-livekit #1066
 - ⬆️(deps) bump rollup from 4.44.2 to 4.59.0 in /src/frontend #1088
 ### Fixed
 - 🐛(migrations) use settings in migrations #1058
 - 💄(frontend) truncate pinned participant name with ellipsis on overflow #1056
 - ♿(frontend) prevent focus ring clipping on invite dialog #1078
 - ♿(frontend) dynamic tab title when connected to meeting #1060
 - 🩹(frontend) remove incorrect reference to ProConnect on the prejoin #1080
 - ✨(frontend) add Ctrl+Shift+/ to open shortcuts settings #1050
 - ♿(frontend) announce selected state to screen readers #1081
 - 💄(frontend) truncate long names with ellipsis in reaction overlay #1099
 ### Added
 - ✨(backend) add file upload feature #1030
 ## [1.9.0] - 2026-03-02
 ### Added
 - 👷(docker) add arm64 platform support for image builds
 - ✨(summary) add localization support for transcription context text
 ### Changed
 - ♻️(frontend) replace custom reactions toolbar with react aria popover #985
 - 🔒️(frontend) uninstall curl from the frontend production image #987
 - 💄(frontend) add focus ring to reaction emoji buttons
 - ✨(frontend) introduce a shortcut settings tab #975
 - 🚚(frontend) rename "wellknown" directory to "well-known" #1009
 - 🌐(frontend) localize SR modifier labels #1010
 - ⬆️(backend) update python dependencies #1011
 - ♿️(frontend) fix focus ring on tab container components #1012
 - ♿️(frontend) upgrade join meeting modal accessibility #1027
 - ⬆️(python) bump minimal required python version to 3.13 #1033
 - ♿️(frontend) improve accessibility of the IntroSlider carousel #1026
 - ♿️(frontend) add skip link component for keyboard navigation #1019
 - ♿️(frontend) announce mic/camera state to SR on shortcut toggle #1052
 ### Fixed
 - 🩹(frontend) fix German language preference update #1021
 ## [1.8.0] - 2026-02-20
 ### Changed
 - 🔒️(agents) uninstall pip from the agents image
 - 🔒️(summary) switch to Alpine base image
 - 🔒️(backend) uninstall pip in the production image
 ### Fixed
 - 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
 - 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
 ## [1.7.0] - 2026-02-19
 ### Added
 - ✨(frontend) expose Windows app web link #976
 - ✨(frontend) support additional shortcuts to broaden accessibility
 ### Changed
 - ✨(frontend) add clickable settings general link in idle modal #974
 - ♻️(backend) refactor external API token-related items #1006
 ## [1.6.0] - 2026-02-10
 ### Added
 - ✨(backend) monitor throttling rate failure through sentry #964
 - 🚀(paas) add PaaS deployment scripts, tested on Scalingo #957
 ### Changed
 - ♿️(frontend) improve spinner reduced‑motion fallback #931
 - ♿️(frontend) fix form labels and autocomplete wiring #932
 - 🥅(summary) catch file-related exceptions when handling recording #944
 - 📝(frontend) update legal terms #956
 - ⚡️(backend) enhance django admin's loading performance #954
 - 🌐(frontend) add missing DE translation for accessibility settings
 ### Fixed
 - 🔐(backend) enforce object-level permission checks on room endpoint #959
 - 🔒️(backend) add application validation when consuming external JWT #963
 ## [1.5.0] - 2026-01-28
 ### Changed
 - ♿️(frontend) adjust visual-only tooltip a11y labels #910
 - ♿️(frontend) sr pin/unpin announcements with dedicated messages #898
 - ♿(frontend) adjust sr announcements for idle disconnect timer #908
 - ♿️(frontend) add global screen reader announcer#922
 ### Fixed
 - 🔒️(frontend) fix an XSS vulnerability on the recording page #911
 ## [1.4.0] - 2026-01-25
 ### Added
 - ✨(frontend) add configurable redirect for unauthenticated users #904
 ### Changed
 - ♿️(frontend) add accessible back button in side panel #881
 - ♿️(frontend) improve participants toggle a11y label #880
 - ♿️(frontend) make carousel image decorative #871
 - ♿️(frontend) reactions are now vocalized and configurable #849
 - ♿️(frontend) improve background effect announcements #879
 ### Fixed
 - 🔒(backend) prevent automatic upgrade setuptools
 - ♿(frontend) improve contrast for selected options #863
 - ♿️(frontend) announce copy state in invite dialog #877
 - 📝(frontend) align close dialog label in rooms locale #878
 - 🩹(backend) use case-insensitive email matching in the external api #887
 - 🐛(frontend) ensure transcript segments are sorted by their timestamp #899
 - 🐛(frontend) scope scrollbar gutter override to video rooms #882
 ## [1.3.0] - 2026-01-13
 ### Added
 - ✨(summary) add dutch and german languages
 - 🔧(agents) make Silero VAD optional
 - 🚸(frontend) explain to a user they were ejected
 ### Changed
 - 📈(frontend) track new recording's modes
 - ♿️(frontend) improve accessibility of the background and effects menu
 - ♿️(frontend) improve SR and focus for transcript and recording #810
 - 💄(frontend) adjust spacing in the recording side panels
 - 🚸(frontend) remove the default comma delimiter in humanized durations
 ### Fixed
 - 🐛(frontend) remove unexpected F2 tooltip when clicking video screen
 - 🩹(frontend) icon font loading to avoid text/icon flickering
 ## [1.2.0] - 2026-01-05
 ### Added
 - ✨(agent) support Kyutai client for subtitle
 - ✨(all) support starting transcription and recording simultaneously
 - ✨(backend) persist options on a recording
 - ✨(all) support choosing the transcription language
 - ✨(summary) add a download link to the audio/video file
 - ✨(frontend) allow unprivileged users to request a recording
 ### Changed
 - 🚸(frontend) remove the beta badge
 - ♻️(summary) extract file handling in a robust service
 - ♻️(all) manage recording state on the backend side
 ## [1.1.0] - 2025-12-22
 ### Added
 - ✨(backend) enable user creation via email for external integrations
 - ✨(summary) add Langfuse observability for LLM API calls
 ## [1.0.1] - 2025-12-17
 ### Changed
 - ♿(frontend) improve accessibility:
 - ♿️(frontend) hover controls, focus, SR #803
 - ♿️(frontend) change ptt keybinding from space to v #813
 - ♿(frontend) indicate external link opens in new window on feedback #816
 - ♿(frontend) fix heading level in modal to maintain semantic hierarchy #815
 - ♿️(frontend) Improve focus management when opening and closing chat #807
@@ -1,76 +0,0 @@
 # Contributor Covenant Code of Conduct
 ## Our Pledge
 In the interest of fostering an open and welcoming environment, we as
 contributors and maintainers pledge to making participation in our project and
 our community a harassment-free experience for everyone, regardless of age, body
 size, disability, ethnicity, sex characteristics, gender identity and expression,
 level of experience, education, socio-economic status, nationality, personal
 appearance, race, religion, or sexual identity and orientation.
 ## Our Standards
 Examples of behavior that contributes to creating a positive environment
 include:
 * Using welcoming and inclusive language
 * Being respectful of differing viewpoints and experiences
 * Gracefully accepting constructive criticism
 * Focusing on what is best for the community
 * Showing empathy towards other community members
 Examples of unacceptable behavior by participants include:
 * The use of sexualized language or imagery and unwelcome sexual attention or
  advances
 * Trolling, insulting/derogatory comments, and personal or political attacks
 * Public or private harassment
 * Publishing others' private information, such as a physical or electronic
  address, without explicit permission
 * Other conduct which could reasonably be considered inappropriate in a
  professional setting
 ## Our Responsibilities
 Project maintainers are responsible for clarifying the standards of acceptable
 behavior and are expected to take appropriate and fair corrective action in
 response to any instances of unacceptable behavior.
 Project maintainers have the right and responsibility to remove, edit, or
 reject comments, commits, code, wiki edits, issues, and other contributions
 that are not aligned to this Code of Conduct, or to ban temporarily or
 permanently any contributor for other behaviors that they deem inappropriate,
 threatening, offensive, or harmful.
 ## Scope
 This Code of Conduct applies both within project spaces and in public spaces
 when an individual is representing the project or its community. Examples of
 representing a project or community include using an official project e-mail
 address, posting via an official social media account, or acting as an appointed
 representative at an online or offline event. Representation of a project may be
 further defined and clarified by project maintainers.
 ## Enforcement
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported by contacting the project team at visio@numerique.gouv.fr. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.
 Further details of specific enforcement policies may be posted separately.
 Project maintainers who do not follow or enforce the Code of Conduct in good
 faith may face temporary or permanent repercussions as determined by other
 members of the project's leadership.
 ## Attribution
 This Code of Conduct is adapted from the [PostHog Code of Conduct](https://github.com/PostHog/posthog/blob/master/CODE_OF_CONDUCT.md), inspired from Contributor Covenant version 1.4,
 available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
 [homepage]: https://www.contributor-covenant.org
 For answers to common questions about this code of conduct, see
 https://www.contributor-covenant.org/faq
@@ -1,77 +0,0 @@
 # Contributing to the Project
 Thank you for taking the time to contribute! Please follow these guidelines to ensure a smooth and productive workflow. 🚀🚀🚀
 To get started with the project, please refer to the [README.md](https://github.com/suitenumerique/meet/blob/main/README.md) for detailed instructions.
 Please also check out our [dev handbook](https://suitenumerique.gitbook.io/handbook) to learn our best practices.
 ## Creating an Issue
 When creating an issue, please provide the following details:
 1.  **Title**: A concise and descriptive title for the issue.
 2.  **Description**: A detailed explanation of the issue, including relevant context or screenshots if applicable.
 3.  **Steps to Reproduce**: If the issue is a bug, include the steps needed to reproduce the problem.
 4.  **Expected vs. Actual Behavior**: Describe what you expected to happen and what actually happened.
 5.  **Labels**: Add appropriate labels to categorize the issue (e.g., bug, feature request, documentation).
 ## Commit Message Format
 All commit messages must adhere to the following format:
 `<gitmoji>(type) title description`
 *   <**gitmoji**>: Use a gitmoji to represent the purpose of the commit. For example, ✨ for adding a new feature or 🔥 for removing something, see the list here: <https://gitmoji.dev/>.
 *   **(type)**: Describe the type of change. Common types include `backend`, `frontend`, `CI`, `docker` etc...
 *   **title**: A short, descriptive title for the change, starting with a lowercase character.
 *   **description**: Include additional details about what was changed and why.
 ### Example Commit Message
 ```
 ✨(frontend) add user authentication logic 
 Implemented login and signup features, and integrated OAuth2 for social login.
 ```
 ## Changelog Update
 Please add a line to the changelog describing your development. The changelog entry should include a brief summary of the changes, this helps in tracking changes effectively and keeping everyone informed. We usually include the title of the pull request, followed by the pull request ID to finish the log entry. The changelog line should be less than 80 characters in total.
 ### Example Changelog Message
 ```
 ## [Unreleased]
 ## Added
 - ✨(frontend) add AI to the project #321
 ```
 ## Pull Requests
 It is nice to add information about the purpose of the pull request to help reviewers understand the context and intent of the changes. If you can, add some pictures or a small video to show the changes.
 ### Don't forget to:
 - check your commits
 - check the linting: `make lint && make frontend-lint`
 - check the tests: `make test`
 - add a changelog entry
 Once all the required tests have passed, you can request a review from the project maintainers.
 ## Code Style
 Please maintain consistency in code style. Run any linting tools available to make sure the code is clean and follows the project's conventions.
 ## Tests
 Make sure that all new features or fixes have corresponding tests. Run the test suite before pushing your changes to ensure that nothing is broken.
 ## Asking for Help
 If you need any help while contributing, feel free to open a discussion or ask for guidance in the issue tracker. We are more than happy to assist!
 Thank you for your contributions! 👍
@@ -1,43 +1,30 @@
 # Django Meet
 # ---- base image to inherit from ----
-FROM python:3.13.15-alpine3.24 AS base
+FROM python:3.10-slim-bullseye as base
 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip
 # Upgrade system packages to install security updates
-RUN apk update && \
+RUN apt-get update && \
-  apk upgrade
+  apt-get -y upgrade && \
  rm -rf /var/lib/apt/lists/*
 # ---- Back-end builder image ----
-FROM base AS back-builder
+FROM base as back-builder
 WORKDIR /builder
-ENV UV_COMPILE_BYTECODE=1
+# Copy required python dependencies
-ENV UV_LINK_MODE=copy
+COPY ./src/backend /builder
-# Disable Python downloads, because we want to use the system interpreter
+RUN mkdir /install && \
-# across both images. If using a managed Python version, it needs to be
+  pip install --prefix=/install .
 # copied from the build image into the final image;
 ENV UV_PYTHON_DOWNLOADS=0
 # install uv
 COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /bin/
 WORKDIR /app
 RUN --mount=type=cache,target=/root/.cache/uv \
  --mount=type=bind,source=src/backend/uv.lock,target=uv.lock \
  --mount=type=bind,source=src/backend/pyproject.toml,target=pyproject.toml \
  uv sync --locked --no-install-project --no-dev
 COPY src/backend /app
 RUN --mount=type=cache,target=/root/.cache/uv \
  uv sync --locked --no-dev
 # ---- mails ----
-FROM node:22 AS mail-builder
+FROM node:20 as mail-builder
 COPY ./src/mail /mail/app
@@ -48,22 +35,24 @@ RUN yarn install --frozen-lockfile && \
 # ---- static link collector ----
-FROM base AS link-collector
+FROM base as link-collector
 ARG MEET_STATIC_ROOT=/data/static
-RUN apk add \
+# Install libpangocairo & rdfind
-  pango \
+RUN apt-get update && \
-  libmagic \
+    apt-get install -y \
-  rdfind
+      libpangocairo-1.0-0 \
      rdfind && \
    rm -rf /var/lib/apt/lists/*
 # Copy installed python dependencies
 COPY --from=back-builder /install /usr/local
 # Copy Meet application (see .dockerignore)
 COPY ./src/backend /app/
 WORKDIR /app
 # Copy the application from the builder
 COPY --from=back-builder /app /app
 ENV PATH="/app/.venv/bin:$PATH"
 # collectstatic
 RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
    python manage.py collectstatic --noinput
@@ -73,19 +62,21 @@ RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
 RUN rdfind -makesymlinks true -followsymlinks true -makeresultsfile false ${MEET_STATIC_ROOT}
 # ---- Core application image ----
-FROM base AS core
+FROM base as core
 ENV PYTHONUNBUFFERED=1
-RUN apk --no-cache add \
+# Install required system libs
-  cairo \
+RUN apt-get update && \
-  gdk-pixbuf \
+    apt-get install -y \
      gettext \
      libcairo2 \
      libffi-dev \
-  pango \
+      libgdk-pixbuf2.0-0 \
-  libmagic \
+      libpango-1.0-0 \
-  shared-mime-info
+      libpangocairo-1.0-0 \
-
+      shared-mime-info && \
  rm -rf /var/lib/apt/lists/*
 # Copy entrypoint
 COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
@@ -95,34 +86,34 @@ COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
-# Copy the application from the builder
+# Copy installed python dependencies
-COPY --from=back-builder /app /app
+COPY --from=back-builder /install /usr/local
 # Copy Meet application (see .dockerignore)
 COPY ./src/backend /app/
 WORKDIR /app
 ENV PATH="/app/.venv/bin:$PATH"
 # Generate compiled translation messages
 RUN DJANGO_CONFIGURATION=Build \
  python manage.py compilemessages --ignore=".venv/**/*"
 # We wrap commands run in this container by the following entrypoint that
 # creates a user on-the-fly with the container user ID (see USER) and root group
 # ID.
 ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
 # ---- Development image ----
-FROM core AS backend-development
+FROM core as backend-development
 # Switch back to the root user to install development dependencies
 USER root:root
 # Install psql
-RUN apk add postgresql-client
+RUN apt-get update && \
    apt-get install -y postgresql-client && \
    rm -rf /var/lib/apt/lists/*
-# Install development dependencies
+# Uninstall Meet and re-install it in editable mode along with development
-RUN --mount=from=ghcr.io/astral-sh/uv:0.10.9,source=/uv,target=/bin/uv \
+# dependencies
-  uv sync --all-extras --locked
+RUN pip uninstall -y meet
 RUN pip install -e .[dev]
 # Restore the un-privileged user running the application
 ARG DOCKER_USER
@@ -137,7 +128,7 @@ ENV DB_HOST=postgresql \
 CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
 # ---- Production image ----
-FROM core AS backend-production
+FROM core as backend-production
 ARG MEET_STATIC_ROOT=/data/static
@@ -145,9 +136,6 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py
 # Remove pip to reduce attack surface in production
 RUN pip uninstall -y pip
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -1,6 +1,6 @@
 MIT License
-Copyright (c) 2024-2025 DINUM/Etalab
+Copyright (c) 2023 Direction Interministérielle du Numérique - Gouvernement Français
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,79 +0,0 @@
 # LICENCE OUVERTE 2.0/OPEN LICENCE 2.0
 ## Réutilisation de l’« Information » sous  cette licence
 Le « Concédant » concède au « Réutilisateur » un droit non exclusif et gratuit de libre  « Réutilisation » de l’« Information » objet de la présente licence, à des fins commerciales ou non, dans le monde entier et pour une durée illimitée, dans les conditions exprimées ci-dessous.
 **Le « Réutilisateur » est libre de réutiliser l’« Information » :**
 -   de la communiquer, la reproduire, la copier ;
 -   de l’adapter, la modifier, l’extraire et la transformer, notamment pour créer des « Informations dérivées » ;
 -   de la diffuser, la redistribuer, la publier et la transmettre, de l’exploiter à titre commercial, par exemple en la combinant avec d’autres informations, ou en l’incluant dans votre propre produit ou application.
 **Sous réserve de :**
 -   mentionner la paternité de l’«Information» : sa source (a minima le nom du  « Concédant ») et la date de la dernière mise à jour de l’« Information » réutilisée.
 Le « Réutilisateur » peut notamment s’ acquitter de cette condition en indiquant l’adresse (URL) renvoyant vers « l’Information » et assurant une mention effective de sa paternité.
 **Par exemple :**
 Dans le cas d’une réutilisation de la base SIRENE de l’INSEE, mentionner l’URL du « Concédant » : www.insee.fr + la date de dernière mise à jour de l’Information réutilisée.
 Cette mention de paternité ne doit ni conférer un caractère officiel à la « Réutilisation » de l’« Information », ni suggérer une quelconque reconnaissance ou caution par le « Concédant », ou par toute autre entité publique, du « Réutilisateur » ou de sa « Réutilisation ».
 ## Données à caractère personnel
 L’« Information » mise à disposition peut contenir des « Données à caractère personnel » pouvant faire l’objet d’une « Réutilisation ». Alors, le « Concédant » informe le « Réutilisateur » (par tous moyens) de leur présence, l’ « Information » peut être librement réutilisée, sans faire obstacle aux libertés accordées par la présente licence, à condition de respecter le cadre légal relatif à la protection des données à caractère personnel.
 ## Droits de propriété intellectuelle
 Il est garanti au « Réutilisateur » que l’ « Information » ne contient pas de « Droits de propriété intellectuelle »  appartenant à des tiers qui pourraient faire obstacle aux libertés qui lui sont accordées par la présente licence.
 Les éventuels « Droits de propriété intellectuelle » détenus par le « Concédant » sur l’ « Information » ne font pas obstacle aux libertés qui sont accordées par la présente licence. Lorsque le « Concédant » détient des « Droits de propriété intellectuelle » » sur l’ « Information », il les cède au « Réutilisateur » de façon non exclusive, à titre gracieux, pour le monde entier, pour toute la durée des « Droits de propriété intellectuelle », et le « Réutilisateur »  peut en faire tout usage conformément aux libertés et aux conditions définies par la présente licence.
 ## Responsabilité
 L’ «Information» est mise à disposition telle que produite ou reçue, sans autre garantie expresse ou tacite qui n’est pas prévue par la présente licence. L’absence de défauts ou d’erreurs éventuellement contenues dans l’ «Information», comme la fourniture continue de l’ « Information » n’est pas garantie par le «Concédant». Il ne peut être tenu pour responsable de toute perte, préjudice ou dommage de quelque sorte causé à des tiers du fait de la « Réutilisation ».
 Le « Réutilisateur » est seul responsable de la « Réutilisation » de l’« Information ».
 La « Réutilisation » ne doit pas induire en erreur des tiers quant au contenu de l’« Information », sa source et sa date de mise à jour.
 ## Droit applicable
 La présente licence est régie par le droit français.
 ### Compatibilité de la présente licence
 Elle a été conçue pour être compatible avec toute licence libre qui exige _a minima_ la mention de paternité. Elle est notamment compatible avec la version antérieure de la présente licence ainsi qu’avec les licences « Open Government Licence » (OGL) du Royaume-Uni, « Creative Commons Attribution » (CC-BY) de Creative Commons et « Open Data Commons Attribution » (ODC-BY) de l’Open Knowledge Foundation.
 ## Définitions
 Sont considérés, au sens de la présente licence comme :
 -   Le « **Concédant** » : toute personne concédant un droit de « Réutilisation » sur l’« Information » dans les libertés et les conditions prévues par la présente licence.
 -   L’« **Information** » :
    -   toute information publique figurant dans des documents communiqués ou publiés par une administration mentionnée au premier alinéa de l’article L.300-2 du CRPA ;
    -   toute information mise à disposition par toute personne selon les termes et conditions de la présente licence.
 -   La « **Réutilisation** » : l’utilisation de l’« Information » à d’autres fins que celles pour lesquelles elle a été produite ou reçue.
 -   Le « **Réutilisateur** » : toute personne qui réutilise les « Informations »  conformément aux conditions de la présente licence.
 -   Des « **Données à caractère personnel** » : toute information se rapportant à une personne physique identifiée ou identifiable, pouvant être identifiée directement ou indirectement. Leur « Réutilisation » est subordonnée au respect du cadre juridique en vigueur.
 -   Une « **Information dérivée** » : toute nouvelle donnée ou information créées directement à partir de l’« Information » ou à partir d’une combinaison  de l’ « Information » et d’autres données ou informations non  soumises à cette licence.
 -   Les « **Droits de propriété intellectuelle** » : tous droits identifiés comme tels par le Code de la propriété intellectuelle (droit d’auteur, droits voisins au droit d’auteur, droit sui generis des producteurs de bases de données).
 ## À propos de cette licence
 La présente licence a vocation à être utilisée par les administrations pour la réutilisation de leurs informations publiques. Elle peut également être utilisée par toute personne souhaitant mettre à disposition de l’« Information » dans les conditions définies par la présente licence
 La France est dotée d’un cadre juridique global visant à une diffusion spontanée par les administrations de leurs informations publiques afin d’en permettre la plus large réutilisation.
 Le droit de la « Réutilisation » de l’« Information » des administrations est régi par le code des relations entre le public et l’administration (CRPA) et, le cas échéant, le code du patrimoine (livre II relatif aux archives).
 Cette licence facilite la réutilisation libre et gratuite des informations publiques et figure parmi les licences qui peuvent être utilisées par l’administration en vertu du décret pris en application de l’article L.323-2 du CRPA.
 Etalab est la mission chargée, sous l’autorité du Premier ministre, d’ouvrir le plus grand nombre de données publiques des administrations de l’État et de ses établissements publics. Elle a réalisé la Licence Ouverte pour faciliter la réutilisation libre et gratuite de ces informations publiques, telles que définies par l’article L321-1 du CRPA.
 Cette licence est une version 2.0 de la Licence Ouverte.
 Etalab se réserve la faculté de proposer de nouvelles versions de la Licence Ouverte. Cependant, les « Réutilisateurs » pourront continuer à réutiliser les informations disponibles sous cette licence s’ils le souhaitent.
@@ -1,21 +0,0 @@
 MIT License
 Copyright (c) 2024-2025 DINUM/Etalab
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
@@ -23,10 +23,9 @@
 # ==============================================================================
 # VARIABLES
-ESC := $(shell printf '\033')
+BOLD := \033[1m
-BOLD := $(ESC)[1m
+RESET := \033[0m
-RESET := $(ESC)[0m
+GREEN := \033[1;32m
 GREEN := $(ESC)[1;32m
 # -- Database
@@ -44,9 +43,6 @@ COMPOSE_EXEC             = $(COMPOSE) exec
 COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
 COMPOSE_RUN         = $(COMPOSE) run --rm
 COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
 COMPOSE_RUN_LINT_BACK    = $(COMPOSE_RUN) --no-deps app-dev
 COMPOSE_RUN_LINT_AGENTS  = $(COMPOSE_RUN) --no-deps multi-user-transcriber-dev
 COMPOSE_RUN_LINT_SUMMARY = $(COMPOSE_RUN) --no-deps app-summary-dev
 COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
 WAIT_DB             = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
@@ -54,18 +50,6 @@ WAIT_DB                  = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB
 MANAGE              = $(COMPOSE_RUN_APP) python manage.py
 MAIL_NPM            = $(COMPOSE_RUN) -w /app/src/mail node npm
 # -- Linters
 LINT_RUFF_FORMAT    = ruff format .
 LINT_RUFF_CHECK     = ruff check . --fix
 LINT_PYLINT         = pylint meet demo core
 LINT_BACK           = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK) \
  && echo 'lint:pylint started…' && $(LINT_PYLINT)
 LINT_AGENTS         = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
 LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
 # -- Frontend
 PATH_FRONT          = ./src/frontend
@@ -87,11 +71,7 @@ create-env-files: \
 	env.d/development/common \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
-	env.d/development/kc_postgresql \
+	env.d/development/kc_postgresql
 	env.d/development/summary \
 	env.d/development/kube-secret \
 	env.d/development/multi_user_transcriber \
 	env.d/development/metadata_collector
 .PHONY: create-env-files
 bootstrap: ## Prepare Docker images for the project
@@ -104,30 +84,14 @@ bootstrap: \
 	demo \
 	back-i18n-compile \
 	mails-install \
-	mails-build \
+	mails-build
 	run
 .PHONY: bootstrap
 # -- Docker/compose
-build: ## build the project containers
+build: ## build the app-dev container
-	@$(MAKE) build-backend
+	@$(COMPOSE) build app-dev --no-cache
 	@$(MAKE) build-frontend
 	@$(MAKE) build-agents
 .PHONY: build
 build-backend: ## build the app-dev container
 	@$(COMPOSE) build app-dev
 .PHONY: build-backend
 build-frontend: ## build the frontend container
 	@$(COMPOSE) build frontend
 .PHONY: build-frontend
 build-agents: ## build the multi-user-transcriber agent container
 	@$(COMPOSE) build multi-user-transcriber-dev
 .PHONY: build-agents
 down: ## stop and remove containers, networks, images, and volumes
 	@$(COMPOSE) down
 .PHONY: down
@@ -136,38 +100,10 @@ logs: ## display app-dev logs (follow mode)
 	@$(COMPOSE) logs -f app-dev
 .PHONY: logs
-run-backend: ## start only the backend application and all needed services
+run: ## start the wsgi (production) and development server
-	@$(COMPOSE) up --force-recreate -d celery-dev --remove-orphans
+	@$(COMPOSE) up --force-recreate -d celery-dev
 	@$(COMPOSE) up --force-recreate -d nginx
 	@$(COMPOSE) up -d livekit
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run-backend
 run-summary: ## start only the summary application and all needed services
 	@$(COMPOSE) up --force-recreate -d celery-summary-transcribe
 	@$(COMPOSE) up --force-recreate -d celery-summary-summarize
 .PHONY: run-summary
 run-agents: ## start the multi-user-transcriber agent
 	@$(MAKE) run-agent-multi-user-transcriber
 	@$(MAKE) run-agent-metadata-collector
 .PHONY: run-agents
 run-agent-multi-user-transcriber: ## start the LiveKit agents (multi users transcriber)
 	@$(COMPOSE) up --force-recreate -d multi-user-transcriber-dev
 .PHONY: run-agent-multi-user-transcriber
 run-agent-metadata-collector: ## start the LiveKit agents (metadata collector)
 	@$(COMPOSE) up --force-recreate -d metadata-collector-dev
 .PHONY: run-agent-metadata-collector
 run:
 run: ## start the wsgi (production) and development server
 	@$(MAKE) run-backend
 	@$(MAKE) run-summary
 	@$(MAKE) run-agents
 	@$(COMPOSE) up --force-recreate -d frontend
 .PHONY: run
 status: ## an alias for "docker compose ps"
@@ -178,25 +114,6 @@ stop: ## stop the development server using Docker
 	@$(COMPOSE) stop
 .PHONY: stop
 # -- Front
 frontend-development-install: ## install the frontend locally
 	cd $(PATH_FRONT) && npm i
 .PHONY: frontend-development-install
 frontend-lint: ## run the frontend linter
 	cd $(PATH_FRONT) && npm run lint
 .PHONY: frontend-lint
 frontend-format: ## run the frontend format
 	cd $(PATH_FRONT) && npm run format
 .PHONY: frontend-format
 run-frontend-development: ## run the frontend in development mode
 	@$(COMPOSE) stop frontend
 	cd $(PATH_FRONT) && npm run dev
 .PHONY: run-frontend-development
 # -- Backend
 demo: ## flush db then create a demo for load testing purpose
@@ -204,60 +121,43 @@ demo: ## flush db then create a demo for load testing purpose
 	@$(MANAGE) create_demo
 .PHONY: demo
-lint: ## lint all python sources (back-end, agents, summary)
+# Nota bene: Black should come after isort just in case they don't agree...
-	@$(MAKE) lint-back
+lint: ## lint back-end python sources
-	@$(MAKE) lint-agents
+lint: \
-	@$(MAKE) lint-summary
+  lint-ruff-format \
  lint-ruff-check \
  lint-pylint
 .PHONY: lint
 lint-back: ## lint back-end python sources
 	@$(COMPOSE_RUN_LINT_BACK) sh -c "$(LINT_BACK)"
 .PHONY: lint-back
 lint-agents: ## lint agents python sources
 	@$(COMPOSE_RUN_LINT_AGENTS) sh -c "$(LINT_AGENTS)"
 .PHONY: lint-agents
 lint-summary: ## lint summary python sources
 	@$(COMPOSE_RUN_LINT_SUMMARY) sh -c "$(LINT_SUMMARY)"
 .PHONY: lint-summary
 lint-ruff-format: ## format back-end python sources with ruff
 	@echo 'lint:ruff-format started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_FORMAT)
+	@$(COMPOSE_RUN_APP) ruff format .
 .PHONY: lint-ruff-format
 lint-ruff-check: ## lint back-end python sources with ruff
 	@echo 'lint:ruff-check started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_CHECK)
+	@$(COMPOSE_RUN_APP) ruff check . --fix
 .PHONY: lint-ruff-check
 lint-pylint: ## lint back-end python sources with pylint only on changed files from main
 	@echo 'lint:pylint started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_PYLINT)
+	@$(COMPOSE_RUN_APP) pylint meet demo core
 .PHONY: lint-pylint
-test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
+test: ## run project tests
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	@$(MAKE) test-back-parallel
 	$(MAKE) test-back-parallel ARGS="$${args}" && \
 	$(MAKE) test-summary ARGS="$${args}"
 .PHONY: test
-test-back: ## run back-end tests (pass extra pytest args via ARGS)
+test-back: ## run back-end tests
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest $${args}
+	bin/pytest $${args:-${1}}
 .PHONY: test-back
-test-back-parallel: ## run all back-end tests in parallel (pass extra pytest args via ARGS)
+test-back-parallel: ## run all back-end tests in parallel
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest -n auto $${args}
+	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel
 test-summary: ## run summary tests (pass extra pytest args via ARGS)
 	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
 	bin/pytest-summary $${args}
 .PHONY: test-summary
 makemigrations:  ## run django makemigrations for the Meet project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
@@ -278,7 +178,7 @@ superuser: ## Create an admin superuser with password "admin"
 .PHONY: superuser
 back-i18n-compile: ## compile the gettext files
-	@$(MANAGE) compilemessages --ignore=".venv/**/*"
+	@$(MANAGE) compilemessages --ignore="venv/**/*"
 .PHONY: back-i18n-compile
 back-i18n-generate: ## create the .pot files used for i18n
@@ -292,7 +192,7 @@ shell: ## connect to database shell
 # -- Database
 dbshell: ## connect to database shell
-	@$(COMPOSE_EXEC_APP) python manage.py dbshell
+	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell
 resetdb: FLUSH_ARGS ?=
@@ -311,18 +211,6 @@ env.d/development/postgresql:
 env.d/development/kc_postgresql:
 	cp -n env.d/development/kc_postgresql.dist env.d/development/kc_postgresql
 env.d/development/summary:
 	cp -n env.d/development/summary.dist env.d/development/summary
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber
 env.d/development/metadata_collector:
 	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector
 # -- Internationalization
 env.d/development/crowdin:
@@ -410,15 +298,10 @@ frontend-i18n-generate: \
 # -- K8S
 build-k8s-cluster: ## build the kubernetes cluster using kind
 build-k8s-cluster: \
    env.d/development/kube-secret \
 	./bin/start-kind.sh
 .PHONY: build-k8s-cluster
-start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
+start-tilt: ## start the kubernetes cluster using kind
-	DEV_ENV=dev-keycloak tilt up --namespace=meet -f ./bin/Tiltfile
+	tilt up -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
 start-tilt-dinum: ## start the kubernetes cluster using kind, without Pro Connect for authentication, but with DINUM styles
 	DEV_ENV=dev-dinum tilt up --namespace=meet -f ./bin/Tiltfile
 .PHONY: build-k8s-cluster
@@ -1,2 +0,0 @@
 web: bin/buildpack_start.sh
 postdeploy: python manage.py migrate
@@ -1,186 +1,155 @@
-<p align="center">
+# Meet
-  <img alt="meet logo" src="./docs/assets/banner-meet-fr.png" maxWidth="100%">
+
-</p>
+Meet is a simple video and phone conferencing tool, powered by [LiveKit](https://livekit.io/).
 Meet is built on top of [Django Rest
 Framework](https://www.django-rest-framework.org/) and [Vite.js](https://vitejs.dev/).
 ## Getting started
 ### Prerequisite
 #### Docker
 Make sure you have a recent version of Docker and [Docker
 Compose](https://docs.docker.com/compose/install) installed on your laptop:
 ```bash
 $ docker -v
  Docker version 20.10.2, build 2291f61
 $ docker compose -v
  docker compose version 1.27.4, build 40524192
 ```
 > ⚠️ You may need to run the following commands with `sudo` but this can be
 > avoided by assigning your user to the `docker` group.
 #### LiveKit CLI
 Install LiveKit CLI, which provides utilities for interacting with the LiveKit ecosystem (including the server, egress, and more), please follow the instructions available in the [official repository](https://github.com/livekit/livekit-cli).
 ### Project bootstrap
 The easiest way to start working on the project is to use GNU Make:
 ```bash
 $ make bootstrap FLUSH_ARGS='--no-input'
 ```
 Then you can access to the project in development mode by going to http://localhost:3000.
 You will be prompted to log in, the default credentials are:
 ```bash
 username: meet
 password: meet
 ```
 ---
 This command builds the `app` container, installs dependencies, performs
 database migrations and compile translations. It's a good idea to use this
 command each time you are pulling code from the project repository to avoid
 dependency-related or migration-related issues.
 Your Docker services should now be up and running 🎉
 [FIXME] Explain how to run the frontend project.
 ### Configure LiveKit CLI
 For the optimal DX, create a default project named `meet` to use with `livekit-cli` commands:
 ```bash
 $ livekit-cli project add
 URL: http://localhost:7880
 API Key: devkey
 API Secret: secret
 Give it a name for later reference: meet
 ? Make this project default?? [y/N] y
 ```
 Thus, you won't need to pass the project API Key and API Secret for each command.
-<p align="center">
+### Adding content
  <a href="https://github.com/suitenumerique/meet/stargazers/">
    <img src="https://img.shields.io/github/stars/suitenumerique/meet" alt="">
  </a>
  <a href='http://makeapullrequest.com'><img alt='PRs Welcome' src='https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=shields'/></a>
  <img alt="GitHub commit activity" src="https://img.shields.io/github/commit-activity/m/suitenumerique/meet"/>
  <img alt="GitHub closed issues" src="https://img.shields.io/github/issues-closed/suitenumerique/meet"/>
  <a href="https://github.com/suitenumerique/meet/blob/main/LICENSE">
    <img alt="GitHub closed issues" src="https://img.shields.io/github/license/suitenumerique/meet"/>
  </a>
  <a href="https://digitalpublicgoods.net/r/la-suite-meet-simple-video-conferencing">
    <img src="https://img.shields.io/badge/Verified-DPG-3333AB?logo=data:image/svg%2bxml;base64,PHN2ZyB3aWR0aD0iMzEiIGhlaWdodD0iMzMiIHZpZXdCb3g9IjAgMCAzMSAzMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0LjIwMDggMjEuMzY3OEwxMC4xNzM2IDE4LjAxMjRMMTEuNTIxOSAxNi40MDAzTDEzLjk5MjggMTguNDU5TDE5LjYyNjkgMTIuMjExMUwyMS4xOTA5IDEzLjYxNkwxNC4yMDA4IDIxLjM2NzhaTTI0LjYyNDEgOS4zNTEyN0wyNC44MDcxIDMuMDcyOTdMMTguODgxIDUuMTg2NjJMMTUuMzMxNCAtMi4zMzA4MmUtMDVMMTEuNzgyMSA1LjE4NjYyTDUuODU2MDEgMy4wNzI5N0w2LjAzOTA2IDkuMzUxMjdMMCAxMS4xMTc3TDMuODQ1MjEgMTYuMDg5NUwwIDIxLjA2MTJMNi4wMzkwNiAyMi44Mjc3TDUuODU2MDEgMjkuMTA2TDExLjc4MjEgMjYuOTkyM0wxNS4zMzE0IDMyLjE3OUwxOC44ODEgMjYuOTkyM0wyNC44MDcxIDI5LjEwNkwyNC42MjQxIDIyLjgyNzdMMzAuNjYzMSAyMS4wNjEyTDI2LjgxNzYgMTYuMDg5NUwzMC42NjMxIDExLjExNzdMMjQuNjI0MSA5LjM1MTI3WiIgZmlsbD0id2hpdGUiLz4KPC9zdmc+Cg==" alt="DPG Badge"/>
  </a>
 </p>
-<p align="center">
+You can create a basic demo site by running:
  <a href="https://livekit.io/">LiveKit</a> - <a href="https://matrix.to/#/#meet-official:matrix.org">Chat with us</a> - <a href="https://github.com/orgs/suitenumerique/projects/3/views/2">Roadmap</a> - <a href="https://github.com/suitenumerique/meet/blob/main/CHANGELOG.md">Changelog</a> - <a href="https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md">Bug reports</a> 
 </p>
-<p align="center">
+```bash
-  <a href="https://visio.numerique.gouv.fr/">
+$ make demo
-    <img src="https://github.com/user-attachments/assets/09c1faa1-de88-4848-af3a-6fbe793999bf" alt="La Suite Meet Demonstration">
+```
  </a>
 </p>
-## La Suite Meet: Simple Video Conferencing
+Finally, you can check all available Make rules using:
-Powered by [LiveKit](https://livekit.io/), La Suite Meet offers Zoom-level performance with high-quality video and audio. No installation required—simply join calls directly from your browser. Check out LiveKit's impressive optimizations in their [blog post](https://blog.livekit.io/livekit-one-dot-zero/).
+```bash
 $ make help
 ```
-> [!TIP]
+### Django admin
-> New here? Start by introducing yourself in our Matrix channel:
+
-> **https://matrix.to/#/#meet-official:matrix.org**
+You can access the Django admin site at
->
+[http://localhost:8071/admin](http://localhost:8071/admin).
-> We’re happy to discuss ideas, answer questions, and help to deploy LaSuite Meet.
+
 You first need to create a superuser account:
 ```bash
 $ make superuser
 ```
 ### Run application on local Kubernetes
 The application is deployed across staging, preprod, and production environments using Kubernetes (K8s).
 Reproducing environment conditions locally is crucial for developing new features or debugging issues.
 This is facilitated by [Tilt](https://tilt.dev/) ("Kubernetes for Prod, Tilt for Dev").  Tilt enables smart rebuilds and live updates for services running locally in Kubernetes.  We defined our services in a Tiltfile located at `bin/Tiltfile`.
-### Features
+#### Getting Started
 - Optimized for stability in large meetings (+100 p.)
 - Support for multiple screen sharing streams
 - Non-persistent, secure chat
 - End-to-end encryption (coming soon)
 - Meeting recording
 - Meeting transcription & Summary (currently in beta)
 - Telephony integration
 - Secure participation with robust authentication and access control
 - Customizable frontend style
 - LiveKit Advances features including :
  - speaker detection 
  - simulcast 
  - end-to-end optimizations 
  - selective subscription
  - SVC codecs (VP9, AV1)
 Make sure you have installed:
 - kubectl
 - helm
 - helmfile
 - tilt
-La Suite Meet is fully self-hostable and released under the MIT License, ensuring complete control and flexibility. It's simple to [get started](https://visio.numerique.gouv.fr/) or [request a demo](mailto:visio@numerique.gouv.fr). 
+To build and start the Kubernetes cluster using Kind:
 ```shell
 $ make build-k8s-cluster 
 ```
-We’re continuously adding new features to enhance your experience, with the latest updates coming soon!
+Once the Kubernetes cluster is ready, start the application stack locally:
 ```shell
 $ make start-tilt
 ```
 These commands set up and run your application environment using Tilt for local Kubernetes development.
-### 🚀 Major roll out to all French public servants
+You can monitor Tilt's at `http://localhost:10350/`. After Tilt actions finish, you can access the app at `https://meet.127.0.0.1.nip.io/`.
-On the 29th of January 2026, Prime Minister Sébastien Lecornu, announced the full deployment of Visio—the French government’s dedicated Meet platform—to all public servants. ([Source in English](https://www.nytimes.com/2026/01/29/world/europe/france-zoom-alternative-visio.html))
+#### Debugging frontend
-## Table of Contents
+Tilt deploys the `meet-dev` for the frontend by default, to benefit from Vite.js hot reloading while developing. 
 To troubleshoot production issues, please modify the Tiltfile, switch frontend's target to `frontend-production`:
- [Get started](#get-started)
+```yaml
- [Docs](#docs)
+...
 - [Self-host](#self-host)
 - [Contributing](#contributing)
 - [Philosophy](#philosophy)
 - [Open source](#open-source)
 docker_build(
    'localhost:5001/meet-frontend:latest',
    context='..',
    dockerfile='../src/frontend/Dockerfile',
    only=['./src/frontend', './docker', './.dockerignore'],
    target='frontend-production',  # Update this line when needed
    live_update=[
        sync('../src/frontend', '/home/frontend'),
    ]
 )
 ...
 ```
-## Get started
+## Contributing
-## Docs
+This project is intended to be community-driven, so please, do not hesitate to
-
+get in touch if you have any question related to our implementation or design
-We're currently working on both technical and user documentation for La Suite Meet. In the meantime, many of the essential aspects are already well covered by the [LiveKit documentation](https://docs.livekit.io/home/) and their [self-hosting guide](https://docs.livekit.io/home/self-hosting/deployment/). Stay tuned for more updates!
+decisions.
 ## Self-host
 ### La Suite Meet is easy to install on your own servers
 We use Kubernetes for our [production instance](https://visio.numerique.gouv.fr/) but also support Docker Compose. The community contributed a couple other methods (Nix, YunoHost etc.) check out the [docs](/docs/installation/README.md) to get detailed instructions and examples.
 **Questions?** Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).
 > [!NOTE]
 > Some advanced features (ex: recording, transcription) lack detailed documentation. We're working hard to provide comprehensive guides soon.
 #### Known instances
 We hope to see many more, here is an incomplete list of public La Suite Meet instances. Feel free to make a PR to add ones that are not listed below🙏
 | Url                                                           | Org          | Access                                                                                                                                        |
 |---------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
 | [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM        | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up     |
 | [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT         | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up |
 | [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop | Free and open demo to all. Content and accounts are reset after one month                                                                     |
 | [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud   | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps.                                                         |
 | [Clever Cloud](https://www.clever.cloud/product/visio/)       | clever cloud | Openvisio is a sovereign video conferencing solution based on LaSuite Meet offered by [Clever Cloud](https://www.clever.cloud/).              |
 | [Email.eu](https://email.eu/)                                 | Email.eu     | Sovereign business workspace.                                                                                                                 |
 # Contributing
 We <3 contributions of all kinds **big or small** and we’re genuinely glad you’re here. 🌱
 ### Start by saying hi
 **The best first contribution is simply to come say hi.**
 Before opening a PR, especially a larger one, or one written with the help of AI, we encourage you to reach out to a maintainer on our [Matrix channel](https://matrix.to/#/#meet-official:matrix.org) (@antoine.lebaud:matrix.org).
 Getting in touch early helps us align on goals, avoid duplicated or wasted effort, and build a community that stays active, welcoming, and fun to be part of. There are no silly questions here: whether you’ve shipped hundreds of PRs or you’re just getting started, you’re welcome.
 ### AI contributions
 AI-assisted contributions are welcome. But code is never the end goal. What matters most is building relationships, sharing knowledge, and growing a sustainable community over time.
 If your contribution has been heavily generated with AI, please be transparent about it. This helps maintainers review it with the right context and respects the time they invest in the project.
 Using AI does not transfer ownership of the contribution: you should still fully understand the code, the problem it solves, and the reasoning behind the approach you propose. In short, even if AI helped write it, the why should still be yours.
 ### Contributions beyond code
 **Not technical? We need you too.**
 Open source is much more than code. Writing documentation, improving onboarding, translating content, answering questions, reporting bugs, or simply helping others feel welcome all make a huge difference.
 ### Ways to contribute
 When you’re ready, here are a few ways to get involved:
 * 👋 **Say hello** and share your ideas with the community and maintainers on our [Matrix channel](https://matrix.to/#/#meet-official:matrix.org)
 * 🛠️ **Open a PR** by following our guide to [develop La Suite Meet locally](https://github.com/suitenumerique/meet/blob/main/docs/developping_locally.md)
 * 💡 **Suggest an idea** by opening a [feature request](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=enhancement&template=Feature_request.md)
 * 🐛 **Report a bug** by opening a [bug report](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md)
 Thank you for helping build something open, useful, and human. 💙
 ### Community call
 We host a community call on the first Friday of every month to share updates, discuss ideas, and connect with contributors.
 Whether you’re actively contributing or just curious about the project, you’re welcome to join. More details are shared on the [Matrix channel](https://matrix.to/#/#meet-official:matrix.org).
 ## Philosophy
 We’re relentlessly focused on building the best open-source video conferencing product—La Suite Meet. Growth comes from creating something people truly need, not just from chasing metrics.
 Our users come first. We’re committed to making La Suite Meet as accessible and easy to use as proprietary solutions, ensuring it meets the highest standards.
 Most of the heavy engineering is handled by the incredible LiveKit team, allowing us to focus on delivering a top-tier product. We follow extreme programming practices, favoring pair programming and quick, iterative releases. Challenge our tech and architecture—simplicity is always our top priority.
 ## Open-source
 Gov 🇫🇷 supports open source! This project is available under [MIT license](https://github.com/suitenumerique/meet/blob/0cc2a7b7b4f4821e2c4d9d790efa739622bb6601/LICENSE).
 All features we develop will always remain open-source, and we are committed to contributing back to the LiveKit community whenever feasible.
 To learn more, don't hesitate to [reach out](mailto:visio@numerique.gouv.fr).
 ### Help us!
 Come help us make La Suite Meet even better. We're growing fast and [would love some help](mailto:visio@numerique.gouv.fr).
 ## Contributors 🧞
 <a href="https://github.com/suitenumerique/meet/graphs/contributors">
  <img src="https://contrib.rocks/image?repo=suitenumerique/meet" />
 </a>
 ## Credits 
 We're using the awesome [LiveKit](https://livekit.io/) implementation. We're also thankful to the teams behind [Django Rest Framework](https://www.django-rest-framework.org/), [Vite.js](https://vite.dev/), and [React Aria](https://github.com/adobe/react-spectrum) — Thanks for your amazing work!
 This project is tested with BrowserStack.
 ## License
-Code in this repository is published under the MIT license by DINUM (Direction interministériel du numérique).
+This work is released under the MIT License (see [LICENSE](./LICENSE)).
 Documentation (in the docs/) directory is released under the [Etalab-2.0 license](https://spdx.org/licenses/etalab-2.0.html).
@@ -1,23 +0,0 @@
 # Security Policy
 ## Reporting a Vulnerability
 Security is very important to us.
 If you have any issue regarding security, please disclose the information responsibly by submitting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at visio@numerique.gouv.fr
 We appreciate your effort to make Visio more secure.
 ## Vulnerability disclosure policy
 Working with security issues in an open source project can be challenging, as we are required to disclose potential problems that could be exploited by attackers. With this in mind, our security fix policy is as follows:
 1. The Maintainers team will handle the fix as usual (Pull Request,
   release).
 2. In the release notes, we will include the identification numbers from the
   GitHub Advisory Database (GHSA) and, if applicable, the Common Vulnerabilities
   and Exposures (CVE) identifier for the vulnerability.
 3. Once this grace period has passed, we will publish the vulnerability.
 By adhering to this security policy, we aim to address security concerns
 effectively and responsibly in our open source software project.
@@ -15,34 +15,3 @@ the following command inside your docker container:
 (Note : in your development environment, you can `make migrate`.)
 ## [Unreleased]
 ## v1.30.0
 ### Removing S3 storage-event webhooks for recordings
 Recordings were previously confirmed as saved by an S3 storage-event webhook posting to `/api/v1.0/recordings/storage-hook/`. That endpoint has been removed: recordings are now always finalized from LiveKit's own `egress_ended` webhook, which has been the default path since v1.22.0.
 **Required for every deployment:** LiveKit must be able to deliver webhooks to the backend at `/api/v1.0/rooms/webhooks-livekit/`. This is now the only way a recording reaches a saved state; if `egress_ended` is never delivered, recordings stay in the `active` state.
 For hosters who had configured storage-event webhooks:
 - Recordings reach the same final state, but they are now finalized when LiveKit reports the egress as ended rather than when the storage backend reports the upload.
 - Remove the event notification from your bucket configuration: it now targets a non-existent endpoint and will fail on every delivery.
 For hosters who had **not** configured storage-event webhooks:
 - Nothing changes. Recordings have been finalized from the `egress_ended` webhook since v1.22.0.
 In both cases, the following settings are no longer used and can be removed from your env: `RECORDING_EVENT_PARSER_CLASS`, `RECORDING_ENABLE_STORAGE_EVENT_AUTH`, `RECORDING_STORAGE_EVENT_ENABLE`, `RECORDING_STORAGE_EVENT_TOKEN`.
 On completion of the egress, a recording moves to `notification_succeeded`, or to `saved` if notifying external services failed.
 ## v1.23.0
 As part of the 1.23.0 release, the legacy `api/v1` implementation has been removed from the _experimental_ Summary service and Meet has been migrated to the new `api/v2`.
 **To avoid a breaking change, the Meet backend continues to use the Summary service's v1-compatible API format by default (`SUMMARY_SERVICE_VERSION` setting defaults to `1`).**
 If you are deploying both Meet and Summary from this repository, you must configure the Meet backend to use the v2 API by setting the following environment variable `SUMMARY_SERVICE_VERSION=2`.
 If you are upgrading only the Meet deployment while keeping an older Summary v1 compatible deployment, no action is required, as the v1-compatible API remains the default.
 Note that we plan on removing the legacy `v1` summary compatibility in a future major version. If you have your own implementation for the summary service, we recommend updating its API contract and setting `SUMMARY_SERVICE_VERSION=2`.
@@ -2,18 +2,6 @@ load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
 load('ext://namespace', 'namespace_create', 'namespace_inject')
 namespace_create('meet')
 DEV_ENV = os.getenv('DEV_ENV', 'dev-keycloak')
 if DEV_ENV == 'dev-dinum':
    update_settings(suppress_unused_image_warnings=["localhost:5001/meet-frontend-generic:latest"])
 if DEV_ENV == 'dev-keycloak':
    update_settings(suppress_unused_image_warnings=["localhost:5001/meet-frontend-dinum:latest"])
 def clean_old_images(image_name):
    local('docker images -q %s | tail -n +2 | xargs -r docker rmi' % image_name)
 docker_build(
    'localhost:5001/meet-backend:latest',
    context='..',
@@ -23,28 +11,14 @@ docker_build(
    live_update=[
        sync('../src/backend', '/app'),
        run(
-            'uv sync --locked --no-dev',
+            'pip install -r /app/requirements.txt',
-            trigger=['../src/backend/uv.lock', '../src/backend/pyproject.toml']
+            trigger=['./api/requirements.txt']
        )
    ]
 )
 clean_old_images('localhost:5001/meet-backend')
 docker_build(
-    'localhost:5001/meet-frontend-dinum:latest',
+    'localhost:5001/meet-frontend:latest',
    context='..',
    dockerfile='../docker/dinum-frontend/Dockerfile',
    only=['./src/frontend', './src/addons', './docker', './.dockerignore'],
    target = 'frontend-production',
    live_update=[
        sync('../src/frontend', '/home/frontend'),
        sync('../src/addons', '/home/addons'),
    ]
 )
 clean_old_images('localhost:5001/meet-frontend-dinum')
 docker_build(
    'localhost:5001/meet-frontend-generic:latest',
    context='..',
    dockerfile='../src/frontend/Dockerfile',
    only=['./src/frontend', './docker', './.dockerignore'],
@@ -53,77 +27,8 @@ docker_build(
        sync('../src/frontend', '/home/frontend'),
    ]
 )
 clean_old_images('localhost:5001/meet-frontend-generic')
-docker_build(
+k8s_yaml(local('cd ../src/helm && helmfile -n meet -e dev template .'))
    'localhost:5001/meet-summary:latest',
    context='../src/summary',
    dockerfile='../src/summary/Dockerfile',
    only=['.'],
    target = 'production',
    live_update=[
        sync('../src/summary', '/app'),
    ]
 )
 clean_old_images('localhost:5001/meet-summary')
 docker_build(
    'localhost:5001/meet-agents:latest',
    context='../src/agents',
    dockerfile='../src/agents/Dockerfile',
    only=['.'],
    target = 'production',
    live_update=[
        sync('../src/agents', '/app'),
    ]
 )
 clean_old_images('localhost:5001/meet-agents')
 # Copy the mkcert root CA certificate to our Docker build context
 # This is necessary because we need to inject the certificate into our LiveKit container
 local_resource(
    'copy-root-ca',
    cmd='cp -f "$(mkcert -CAROOT)/rootCA.pem" ../docker/livekit/rootCA.pem',
    deps=[],  # No dependencies needed
 )
 # Build a custom LiveKit Docker image that includes our root CA certificate
 # This allows LiveKit to trust our local development certificates
 docker_build(
    'localhost:5001/meet-livekit:latest',
    context='../docker/livekit',
    dockerfile='./../docker/livekit/Dockerfile',
    only=['.'],
 )
 clean_old_images('localhost:5001/meet-livekit')
 load('ext://secret', 'secret_yaml_generic')
 k8s_yaml(secret_yaml_generic(
    name="secret-dev",
    from_env_file="../env.d/development/kube-secret"
 ))
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
 k8s_resource('minio-bucket', resource_deps=['minio'])
 k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
 # Trigger once on launch
 k8s_resource(
    'meet-backend-createsuperuser',
    resource_deps=['meet-backend-migrate'],
    trigger_mode=TRIGGER_MODE_MANUAL,
 )
 k8s_resource(
    'meet-backend-migrate',
    resource_deps=['meet-backend'],
    trigger_mode=TRIGGER_MODE_MANUAL,
 )
 migration = '''
 set -eu
@@ -5,7 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0
-export COMPOSE_FILE="${COMPOSE_FILE:-${REPO_DIR}/compose.yml}"
+COMPOSE_FILE="${REPO_DIR}/docker-compose.yml"
 COMPOSE_PROJECT="meet"
@@ -42,6 +42,7 @@ function _docker_compose() {
    echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
    docker compose \
        -p "${COMPOSE_PROJECT}" \
        -f "${COMPOSE_FILE}" \
        --project-directory "${REPO_DIR}" \
        "$@"
 }
@@ -55,12 +56,12 @@ function _docker_compose() {
 function _dc_run() {
    _set_user
-    user_args=()
+    user_args="--user=$USER_ID"
-    if [ -n "$USER_ID" ]; then
+    if [ -z $USER_ID ]; then
-        user_args=("--user=$USER_ID")
+        user_args=""
    fi
-    _docker_compose run --rm "${user_args[@]}" "$@"
+    _docker_compose run --rm $user_args "$@"
 }
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +75,12 @@ function _dc_exec() {
    echo "🐳(compose) exec command: '\$@'"
-    user_args=()
+    user_args="--user=$USER_ID"
-    if [ -n "$USER_ID" ]; then
+    if [ -z $USER_ID ]; then
-        user_args=("--user=$USER_ID")
+        user_args=""
    fi
-    _docker_compose exec "${user_args[@]}" "$@"
+    _docker_compose exec $user_args "$@"
 }
 # _django_manage: wrap django's manage.py command with docker compose
@@ -1,9 +0,0 @@
 #!/bin/bash
 set -o errexit    # always exit on error
 set -o pipefail   # don't ignore exit codes when piping output
 echo "-----> Running post-compile script"
 # Cleanup
 rm -rf docker docs env.d gitlint
@@ -1,49 +0,0 @@
 #!/bin/bash
 set -o errexit    # always exit on error
 set -o pipefail   # don't ignore exit codes when piping output
 echo "-----> Running post-frontend script"
 # Move the frontend build to the nginx root and clean up
 mkdir -p build/
 mv src/frontend/dist build/frontend-out
 ASSETS_DIR=build/frontend-out/assets
 if [ -n "$CUSTOM_LOGO_URL" ]; then
    # Ensure https
    [[ ! "$CUSTOM_LOGO_URL" =~ ^https:// ]] && echo "[custom-logo] ERROR: URL must use HTTPS" >&2 && exit 1
    # Prevent SSRF
    HOSTNAME=$(echo "$CUSTOM_LOGO_URL" | sed -E 's|^https://([^/:]+).*|\1|')
    [[ "$HOSTNAME" =~ ^(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|0\.0\.0\.0|\[::1\]) ]] && echo "[custom-logo] ERROR: SSRF blocked: $HOSTNAME" >&2 && exit 1
    LOGO_FILE="${ASSETS_DIR}/logo.svg"
    TMP_FILE=$(mktemp "${LOGO_FILE}.XXXXXX.tmp")
    # Actual download
    echo "[custom-logo] INFO: Downloading custom logo from: $CUSTOM_LOGO_URL"
    curl -fsSL --tlsv1.2 -o "$TMP_FILE" "$CUSTOM_LOGO_URL"
    # Validate filesize
    FILESIZE=$(stat -c%s "$TMP_FILE" 2>/dev/null || stat -f%z "$TMP_FILE")
    [[ "$FILESIZE" -eq 0 ]] && echo "[custom-logo] ERROR: empty file" >&2 && exit 1
    [[ "$FILESIZE" -gt 5242880 ]] && echo "[custom-logo] ERROR: file too large (${FILESIZE}B > 5MB)" >&2 && exit 1
    # Validate file type
    IS_SVG=false
    HEADER=$(head -c 100 "$TMP_FILE" | tr -d '\0' | tr '[:upper:]' '[:lower:]')
    [[ "$HEADER" =~ ^.*"<svg".*$ ]] && IS_SVG=true
    [[ "$HEADER" =~ ^.*"<?xml".*"<svg".*$ ]] && IS_SVG=true
    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
    mv -f "$TMP_FILE" "$LOGO_FILE"
    echo "[custom-logo] INFO: Custom logo downloaded successfully"
 fi
 mv src/backend/* ./
 mv deploy/paas/* ./
 echo "3.13" > .python-version
@@ -1,15 +0,0 @@
 #!/bin/bash
 # Start the Django backend server
 gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 # Start the Nginx server
 bin/run &
 # if the current shell is killed, also terminate all its children     
 trap 'pkill -TERM -P $$' SIGTERM
 # wait for a single child to finish,
 wait -n
 # then kill all the other tasks
 pkill -P $$
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 # shellcheck source=bin/_config.sh
 source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-_dc_run \
+_docker_compose "$@"
    app-summary-dev \
    python -m pytest "$@"
@@ -1,89 +0,0 @@
 #!/usr/bin/env bash
 set -o errexit
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
 cleanup() {
    rm -f "${TEMP_SECRET_FILE}"
 }
 trap cleanup EXIT
 # Check if kubectl is available
 check_prerequisites() {
    if ! command -v kubectl &> /dev/null; then
        echo "Error: kubectl is not installed or not in PATH"
        exit 1
    fi
 }
 # Check if secret already exists
 check_secret_exists() {
    kubectl -n "${NAMESPACE}" get secrets "${SECRET_NAME}" &> /dev/null
 }
 # Collect user input securely
 get_user_input() {
    echo "Please provide the following information:"
    read -r -p "Enter your Vaultwarden email login: " LOGIN
    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
    echo
    read -r -p "Enter your Vaultwarden server url: " URL
 }
 # Create and apply the secret
 create_secret() {
    cat > "${TEMP_SECRET_FILE}" << EOF
 apiVersion: v1
 kind: Secret
 metadata:
  name: ${SECRET_NAME}
  namespace: ${NAMESPACE}
 type: Opaque
 stringData:
  BW_HOST: ${URL}
  BW_PASSWORD: ${PASSWORD}
  BW_USERNAME: ${LOGIN}
 EOF
    kubectl -n "${NAMESPACE}" apply -f "${TEMP_SECRET_FILE}"
 }
 # Install external-secrets using Helm
 install_external_secrets() {
    if ! kubectl get ns external-secrets &>/dev/null; then
        echo "Installing external-secrets…"
        helm repo add external-secrets https://charts.external-secrets.io
        helm upgrade --install external-secrets \
            external-secrets/external-secrets \
            -n external-secrets \
            --create-namespace \
            --set installCRDs=true
    else
        echo "External secrets already deployed"
    fi
 }
 main() {
    check_prerequisites
    if check_secret_exists; then
        echo "Secret '${SECRET_NAME}' already present in namespace '${NAMESPACE}'"
        exit 0
    fi
    echo -e "${TEMP_SECRET_FILE}"
    get_user_input
    echo -e "\nCreating Vaultwarden secret…"
    create_secret
    install_external_secrets
    echo "Secret installation completed successfully"
 }
 main "$@"
@@ -1,9 +1,9 @@
-#!/usr/bin/env bash
+#!/bin/bash
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
-cat <<'EOF' >"$PRE_COMMIT_FILE"
+cat <<'EOF' >$PRE_COMMIT_FILE
 #!/bin/bash
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
-chmod +x "$PRE_COMMIT_FILE"
+chmod +x $PRE_COMMIT_FILE
@@ -1,181 +0,0 @@
 #!/bin/bash
 set -e  # Exit on error
 # Colors for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m' # No Color
 # Function to print colored output
 print_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
 }
 print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
 }
 print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
 }
 # Function to update npm package version
 update_npm_version() {
    local component=$1
    print_info "Updating $component version..."
    cd "src/$component"
    npm version "$VERSION" --no-git-tag-version
    cd -
 }
 # Function to update Python project version in pyproject.toml
 update_python_version() {
    local component=$1
    print_info "Updating $component version..."
    cd "src/$component"
    if [ ! -f "pyproject.toml" ]; then
        print_error "pyproject.toml not found in src/$component!"
        exit 1
    fi
    if grep -q '^version = "' pyproject.toml; then
        sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
        rm pyproject.toml.bak
        print_info "Updated pyproject.toml version to $VERSION"
    else
        print_error "Could not find version line in pyproject.toml"
        exit 1
    fi
    cd -
 }
 # Check if we're in a git repository
 if ! git rev-parse --git-dir > /dev/null 2>&1; then
    print_error "Not a git repository. Please run this script from the root of your project."
    exit 1
 fi
 # Check if working directory is clean
 if ! git diff-index --quiet HEAD --; then
    print_error "Working directory is not clean. Please commit or stash your changes first."
    exit 1
 fi
 # Ask user for release version number
 echo ""
 read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    print_error "Invalid version format. Please use semantic versioning (e.g., 1.2.3)"
    exit 1
 fi
 print_info "Release version: $VERSION"
 # Check if branch already exists
 BRANCH_NAME="release/$VERSION"
 if git show-ref --verify --quiet "refs/heads/$BRANCH_NAME"; then
    print_error "Branch $BRANCH_NAME already exists!"
    exit 1
 fi
 # Create and checkout new branch
 print_info "Creating branch: $BRANCH_NAME"
 git checkout -b "$BRANCH_NAME"
 # Update frontend
 update_npm_version "frontend"
 # Update SDK
 update_npm_version "sdk"
 # Update mail
 update_npm_version "mail"
 # Update backend pyproject.toml
 update_python_version "backend"
 # Run uv lock in backend
 print_info "Running uv lock in backend..."
 cd "src/backend"
 uv lock
 cd -
 # Update summary pyproject.toml
 update_python_version "summary"
 # Run uv lock in summary
 print_info "Running uv lock in summary..."
 cd "src/summary"
 uv lock
 cd -
 # Update agents pyproject.toml
 update_python_version "agents"
 # Run uv lock in agents
 print_info "Running uv lock in agents..."
 cd "src/agents"
 uv lock
 cd -
 # Update CHANGELOG
 print_info "Updating CHANGELOG..."
 if [ ! -f "CHANGELOG.md" ]; then
    print_error "CHANGELOG.md not found in project root!"
    exit 1
 fi
 # Get current date in YYYY-MM-DD format
 CURRENT_DATE=$(date +%Y-%m-%d)
 # Replace [Unreleased] with [version number] - YYYY-MM-DD
 if grep -q '\[Unreleased\]' CHANGELOG.md; then
    sed -i.bak "s/\[Unreleased\]/[$VERSION] - $CURRENT_DATE/" CHANGELOG.md
    # Add new [Unreleased] section after the header
    # This adds it after the line containing "Semantic Versioning"
    sed -i.bak "/Semantic Versioning/a\\
 \\
 ## [Unreleased]
 " CHANGELOG.md
    rm CHANGELOG.md.bak
    print_info "Updated CHANGELOG.md"
 else
    print_warning "Could not find [Unreleased] section in CHANGELOG.md"
 fi
 # Summary
 echo ""
 print_info "Release preparation complete!"
 echo ""
 echo "Summary:"
 echo "  - Branch created: $BRANCH_NAME"
 echo "  - Version updated to: $VERSION"
 echo "  - Files modified:"
 echo "      - src/frontend/package.json"
 echo "      - src/sdk/package.json"
 echo "      - src/mail/package.json"
 echo "      - src/backend/pyproject.toml"
 echo "      - src/backend/uv.lock"
 echo "      - src/summary/pyproject.toml"
 echo "      - src/summary/uv.lock"
 echo "      - src/agents/pyproject.toml"
 echo "      - src/agents/uv.lock"
 echo "      - CHANGELOG.md"
 echo ""
 print_warning "Next steps:"
 echo "  1. Review the changes: git status"
 echo "  2. Commit the changes: git add . && git commit -m 'Release $VERSION'"
 echo "  3. Push the branch: git push origin $BRANCH_NAME"
 echo ""
@@ -1,3 +1,103 @@
-#!/usr/bin/env bash
+#!/bin/sh
 set -o errexit
-curl https://raw.githubusercontent.com/numerique-gouv/tools/refs/heads/main/kind/create_cluster.sh | bash -s -- meet
+CURRENT_DIR=$(pwd)
 echo "0. Create ca"
 # 0. Create ca
 mkcert -install
 cd /tmp
 mkcert "127.0.0.1.nip.io" "*.127.0.0.1.nip.io"
 cd $CURRENT_DIR
 echo "1. Create registry container unless it already exists"
 # 1. Create registry container unless it already exists
 reg_name='kind-registry'
 reg_port='5001'
 if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
 	docker run \
 		-d --restart=always -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
 		registry:2
 fi
 echo "2. Create kind cluster with containerd registry config dir enabled"
 # 2. Create kind cluster with containerd registry config dir enabled
 # TODO: kind will eventually enable this by default and this patch will
 # be unnecessary.
 #
 # See:
 # https://github.com/kubernetes-sigs/kind/issues/2875
 # https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
 # See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
 cat <<EOF | kind create cluster --config=-
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
 - |-
  [plugins."io.containerd.grpc.v1.cri".registry]
    config_path = "/etc/containerd/certs.d"
 nodes:
 - role: control-plane
  image: kindest/node:v1.27.3
  kubeadmConfigPatches:
  - |
    kind: InitConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        node-labels: "ingress-ready=true"
  extraPortMappings:
  - containerPort: 80
    hostPort: 80
    protocol: TCP
  - containerPort: 443
    hostPort: 443
    protocol: TCP
 - role: worker
  image: kindest/node:v1.27.3
 - role: worker
  image: kindest/node:v1.27.3
 EOF
 echo "3. Add the registry config to the nodes"
 # 3. Add the registry config to the nodes
 #
 # This is necessary because localhost resolves to loopback addresses that are
 # network-namespace local.
 # In other words: localhost in the container is not localhost on the host.
 #
 # We want a consistent name that works from both ends, so we tell containerd to
 # alias localhost:${reg_port} to the registry container when pulling images
 REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
 for node in $(kind get nodes); do
 	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
 	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
 [host."http://${reg_name}:5000"]
 EOF
 done
 echo "4. Connect the registry to the cluster network if not already connected"
 # 4. Connect the registry to the cluster network if not already connected
 # This allows kind to bootstrap the network but ensures they're on the same network
 if [ "$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' "${reg_name}")" = 'null' ]; then
 	docker network connect "kind" "${reg_name}"
 fi
 echo "5. Document the local registry"
 # 5. Document the local registry
 # https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/generic/1755-communicating-a-local-registry
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: local-registry-hosting
  namespace: kube-public
 data:
  localRegistryHosting.v1: |
    host: "localhost:${reg_port}"
    help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
 EOF
 echo "6. Install ingress-nginx"
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
 kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'
@@ -1,5 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 git submodule update --init --recursive
 # shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -1,3 +1,3 @@
-#!/usr/bin/env bash
+#!/bin/bash
 find . -name "*.enc.*" -exec sops updatekeys -y {} \;
@@ -1,13 +0,0 @@
 #!/usr/bin/env bash
 set -e
 HELMFILE=src/helm/helmfile.yaml
 environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=0}' "$HELMFILE" | grep -E '^[[:space:]]{2}[a-zA-Z]+' | sed 's/^[[:space:]]*//;s/:.*//')
 for env in $environments; do
 	echo "################### $env lint ###################"
 	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done
@@ -1,328 +0,0 @@
 services:
  postgresql:
    image: postgres:16
    env_file:
      - env.d/development/postgresql
    ports:
      - "15432:5432"
  redis:
    image: redis:5
  mailcatcher:
    image: sj26/mailcatcher:latest
    ports:
      - "1081:1080"
  minio:
    user: ${DOCKER_USER:-1000}
    image: quay.io/minio/minio
    environment:
      - MINIO_ROOT_USER=meet
      - MINIO_ROOT_PASSWORD=password
    ports:
      - '9000:9000'
      - '9001:9001'
    healthcheck:
      test: [ "CMD", "mc", "ready", "local" ]
      interval: 1s
      timeout: 20s
      retries: 300
    entrypoint: ""
    command: minio server --console-address :9001 /data
    volumes:
      - ./data/media:/data
  createbuckets:
    image: quay.io/minio/mc
    depends_on:
      minio:
        condition: service_healthy
        restart: true
    entrypoint: >
      sh -c "
      /usr/bin/mc alias set meet http://minio:9000 meet password && \
      /usr/bin/mc mb meet/meet-media-storage && \
      exit 0;"
  app-dev:
    build:
      context: .
      target: backend-development
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
    image: meet:backend-development
    environment:
      - PYLINTHOME=/app/.pylint.d
      - DJANGO_CONFIGURATION=Development
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    ports:
      - "8071:8000"
    volumes:
      - ./src/backend:/app
      - ./data/static:/data/static
      - /app/.venv
    depends_on:
        - postgresql
        - mailcatcher
        - redis
        - createbuckets
    extra_hosts:
      - "127.0.0.1.nip.io:host-gateway"
    networks:
      - resource-server
      - default
  celery-dev:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-development
    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG", "--pool=solo"]
    environment:
      - DJANGO_CONFIGURATION=Development
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    volumes:
      - ./src/backend:/app
      - ./data/static:/data/static
      - /app/.venv
    depends_on:
      - app-dev
  app:
    build:
      context: .
      target: backend-production
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
    image: meet:backend-production
    environment:
      - DJANGO_CONFIGURATION=Demo
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    depends_on:
      - postgresql
      - redis
      - livekit
      - minio
  celery:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-production
    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO", "--pool=solo"]
    environment:
      - DJANGO_CONFIGURATION=Demo
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    depends_on:
      - app
  nginx:
    image: nginx:1.25
    ports:
      - "8083:8083"
    volumes:
      - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
    depends_on:
      - keycloak
      - app-dev
    networks:
      - resource-server
      - default
  frontend:
    user: "${DOCKER_USER:-1000}"
    build:
      context: .
      dockerfile: ./src/frontend/Dockerfile
      target: frontend-production
      args:
        VITE_API_BASE_URL: "http://localhost:8071"
        VITE_APP_TITLE: "LaSuite Meet"
    image: meet:frontend-development
    ports:
      - "3000:8080"
  dockerize:
    image: jwilder/dockerize
    platform: linux/x86_64
  crowdin:
    image: crowdin/cli:4.0.0
    volumes:
      - ".:/app"
    env_file:
      - env.d/development/crowdin
    user: "${DOCKER_USER:-1000}"
    working_dir: /app
  node:
    image: node:22
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
    volumes:
      - ".:/app"
  kc_postgresql:
    image: postgres:14.3
    ports:
      - "5433:5432"
    env_file:
      - env.d/development/kc_postgresql
  keycloak:
    image: quay.io/keycloak/keycloak:20.0.1
    volumes:
      - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
    command:
      - start-dev
      - --features=preview
      - --import-realm
      - --proxy=edge
      - --hostname-url=http://localhost:8083
      - --hostname-admin-url=http://localhost:8083/
      - --hostname-strict=false
      - --hostname-strict-https=false
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_DB: postgres
      KC_DB_URL_HOST: kc_postgresql
      KC_DB_URL_DATABASE: keycloak
      KC_DB_PASSWORD: pass
      KC_DB_USERNAME: meet
      KC_DB_SCHEMA: public
      PROXY_ADDRESS_FORWARDING: 'true'
    ports:
      - "8080:8080"
    depends_on:
      - kc_postgresql
  livekit:
    image: livekit/livekit-server:v1.13.6
    entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
    ports:
      - "7880:7880"
      - "7881:7881"
      - "7882:7882/udp"
      - "3478:3478/udp"
      - "30000-30100:30000-30100/udp"
    volumes:
      - ./docker/livekit/config/livekit-server.yaml:/config.yaml
    depends_on:
      - redis
      - livekit-egress
  livekit-egress:
    image: livekit/egress:v1.11.0
    environment:
      EGRESS_CONFIG_FILE: ./livekit-egress.yaml
    volumes:
      - ./docker/livekit/config/livekit-egress.yaml:/livekit-egress.yaml
      - ./docker/livekit/out:/out
    depends_on:
      - redis
  metadata-collector-dev:
    build:
      context: ./src/agents
      target: development
    user: ${DOCKER_USER:-1000}
    command: ["python", "metadata_collector.py", "dev"]
    env_file:
      - env.d/development/metadata_collector
    volumes:
      - ./src/agents:/app
      - /app/.venv
    depends_on:
      - livekit
      - minio
    develop:
      watch:
        - action: rebuild
          path: ./src/agents
  multi-user-transcriber-dev:
    build:
      context: ./src/agents
      target: development
    user: ${DOCKER_USER:-1000}
    command: ["python", "multi_user_transcriber.py", "dev"]
    env_file:
      - env.d/development/multi_user_transcriber
    volumes:
      - ./src/agents:/app
      - /app/.venv
  redis-summary:
    image: redis
    ports:
      - "6379:6379"
  app-summary-dev:
    build:
      context: src/summary
      target: development
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
    env_file:
      - env.d/development/summary
    ports:
      - "8001:8000"
    volumes:
      - ./src/summary:/app
    depends_on:
        - redis-summary
  celery-summary-transcribe:
    container_name: celery-summary-transcribe
    build:
      context: ./src/summary
      dockerfile: Dockerfile
      target: production
    command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q transcribe-queue-v2
    env_file:
      - env.d/development/summary
    volumes:
      - ./src/summary:/app
    depends_on:
      - redis-summary
      - app-summary-dev
      - minio
    develop:
      watch:
        - action: rebuild
          path: ./src/summary
  celery-summary-summarize:
    container_name: celery-summary-summarize
    build:
      context: ./src/summary
      dockerfile: Dockerfile
      target: production
    command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q summarize-queue-v2
    env_file:
      - env.d/development/summary
    volumes:
      - ./src/summary:/app
    depends_on:
      - redis-summary
      - app-summary-dev
      - minio
    develop:
      watch:
        - action: rebuild
          path: ./src/summary
 networks:
  default:
  resource-server:
@@ -1,52 +0,0 @@
 # ERB templated nginx configuration
 # see https://doc.scalingo.com/platform/deployment/buildpacks/nginx
 upstream backend_server {
 	server localhost:8000 fail_timeout=0;
 }
 server {
  listen <%= ENV["PORT"] %>;
  server_name _;
  server_tokens off;
  root /app/build/frontend-out;
  # Django rest framework
  location ^~ /api/ {
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_redirect off;
      proxy_pass http://backend_server;
  }
  # Django admin
  location ^~ /admin/ {
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_redirect off;
      proxy_pass http://backend_server;
  }
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
      add_header Cache-Control "public, max-age=2592000";
  }
  # Serve static files
  location / {
      try_files $uri $uri/ /index.html;
      # Add no-cache headers
      add_header Cache-Control "no-cache, no-store, must-revalidate";
      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
      add_header Expires 0;
  }
  # Optionally, handle 404 errors by redirecting to index.html
  error_page 404 =200 /index.html;
 }
@@ -1,47 +0,0 @@
 {
  "nodes": {
    "devenv": {
      "locked": {
        "dir": "src/modules",
        "lastModified": 1778705847,
        "narHash": "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=",
        "ref": "refs/tags/v2.1.2",
        "rev": "ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be",
        "revCount": 6569,
        "type": "git",
        "url": "https://github.com/cachix/devenv"
      },
      "original": {
        "dir": "src/modules",
        "ref": "refs/tags/v2.1.2",
        "type": "git",
        "url": "https://github.com/cachix/devenv"
      }
    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1789542786,
        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
        "ref": "nixos-26.05",
        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
        "shallow": true,
        "type": "git",
        "url": "https://github.com/NixOS/nixpkgs"
      },
      "original": {
        "ref": "nixos-26.05",
        "shallow": true,
        "type": "git",
        "url": "https://github.com/NixOS/nixpkgs"
      }
    },
    "root": {
      "inputs": {
        "devenv": "devenv",
        "nixpkgs": "nixpkgs"
      }
    }
  },
  "root": "root",
  "version": 7
 }
@@ -1,265 +0,0 @@
 # =============================================================================
 #  devenv.nix — La Suite Meet ("Visio") developer environment
 # =============================================================================
 {
  pkgs,
  lib,
  config,
  ...
 }:
 let
  python = pkgs.python313;
  nodejs = pkgs.nodejs_22;
  backendDir = "src/backend";
  agentsDir = "src/agents";
  summaryDir = "src/summary";
  frontendDir = "src/frontend";
  readDotEnv =
    file:
    let
      lines = lib.splitString "\n" (builtins.readFile file);
      unquote =
        v:
        let
          len = builtins.stringLength v;
        in
        if len >= 2 && lib.hasPrefix "\"" v && lib.hasSuffix "\"" v then
          builtins.substring 1 (len - 2) v
        else if len >= 2 && lib.hasPrefix "'" v && lib.hasSuffix "'" v then
          builtins.substring 1 (len - 2) v
        else
          v;
      parseLine =
        line:
        let
          m = builtins.match "[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)" line;
        in
        if m == null then null else { name = builtins.elemAt m 0; value = unquote (builtins.elemAt m 1); };
    in
    builtins.listToAttrs (builtins.filter (x: x != null) (map parseLine lines));
  # Reuse existing .env
  dotEnv =
    (readDotEnv ./env.d/development/common.dist)
    // (readDotEnv ./env.d/development/postgresql.dist);
  sharedEnv = builtins.removeAttrs dotEnv [ "PYTHONPATH" ]; # only makes sense inside the backend container.
 in
 {
  options.meet = {
    agents.enable = lib.mkEnableOption "tooling for the LiveKit agents in src/agents";
    summary.enable = lib.mkEnableOption "tooling for the summary service in src/summary";
    k8s.enable = lib.mkEnableOption "Kubernetes dev utilities";
  };
  config = {
    # Profile can be activated with devenv --profile <profile> shell
    profiles = {
      agents.module = {
        meet.agents.enable = true;
      };
      summary.module = {
        meet.summary.enable = true;
      };
      k8s.module = {
        meet.k8s.enable = true;
      };
    };
    languages.python = {
      enable = true;
      package = python;
      directory = backendDir;
      manylinux.enable = pkgs.stdenv.hostPlatform.isLinux;
      libraries = [
        "${config.devenv.dotfile}/profile"
        pkgs.file
        pkgs.zlib
        pkgs.libffi
        pkgs.openssl
      ];
      uv.enable = true;
      uv.sync.enable = false;
      venv.enable = false;
      lsp.enable = true;
    };
    languages.javascript = {
      enable = true;
      package = nodejs;
      directory = frontendDir;
      npm.enable = true;
      yarn.enable = true;
      corepack.enable = false;
    };
    languages.typescript.enable = false;
    languages.nix.enable = true;
    packages =
      with pkgs;
      [
        gnumake
        file
        shared-mime-info
        gettext
        postgresql_16
        git
        curl
        jq
        podman
        podman-compose
        docker-client
      ]
      # -- LiveKit agents
      ++ lib.optionals config.meet.agents.enable [
        glib
        portaudio
        livekit-cli
      ]
      # -- summary service
      ++ lib.optionals config.meet.summary.enable [
        redis
      ]
      # -- Kubernetes tools
      ++ lib.optionals config.meet.k8s.enable [
        kubectl
        kubernetes-helm
        helmfile
        tilt
        kind
        mkcert
      ];
    env = sharedEnv // {
      UV_LINK_MODE = "copy";
      PYTHONDONTWRITEBYTECODE = "1";
      PYTHONUNBUFFERED = "1";
      UV_PROJECT_ENVIRONMENT = lib.mkForce ".venv";
      COMPOSE_PROJECT_NAME = "meet";
      DJANGO_DATA_DIR = "${config.devenv.root}/data";
      # Database / Pgsql
      DB_HOST = "127.0.0.1";
      DB_PORT = "15432";
      PGHOST = "127.0.0.1";
      PGPORT = "15432";
      PGDATABASE = sharedEnv.DB_NAME;
      PGUSER = sharedEnv.DB_USER;
      PGPASSWORD = sharedEnv.DB_PASSWORD;
      REDIS_URL = "redis://127.0.0.1:6379/1";
      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
      # S3 / MinIO
      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
      # OIDC
      OIDC_OP_JWKS_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/certs";
      OIDC_OP_TOKEN_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token";
      OIDC_OP_USER_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/userinfo";
      OIDC_OP_INTROSPECTION_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token/introspect";
      # summary service
      SUMMARY_SERVICE_ENDPOINT = "http://127.0.0.1:8001/api/v2/async-jobs/transcribe/";
      SUMMARY_SERVICE_VERSION = "2";
      # Mail
      DJANGO_EMAIL_HOST = "127.0.0.1";
    };
    scripts = {
      meet-venv = {
        description = "Create/refresh meet uv virtualenvs for backend, agents and summary";
        exec = ''
          set -euo pipefail
          cd "$DEVENV_ROOT"
          echo "==> ${backendDir} (uv sync --locked, dependency-groups)"
          ( cd "${backendDir}" && uv sync --locked --all-groups )
          echo "==> ${agentsDir} (uv sync --locked --all-extras)"
          ( cd "${agentsDir}" && uv sync --locked --all-extras )
          echo "==> ${summaryDir} (uv sync --locked --all-extras)"
          ( cd "${summaryDir}" && uv sync --locked --all-extras )
          echo
          echo "Synced the following virtualenvs successfully:"
          echo "  ${backendDir}/.venv"
          echo "  ${agentsDir}/.venv"
          echo "  ${summaryDir}/.venv"
        '';
      };
    };
    enterShell = ''
      # Make podman socket accessible in order to launch regular docker commands.
      # Set MEET_PODMAN_SOCKET=0 to keep the DOCKER_HOST of the calling environment.
      case "''${MEET_PODMAN_SOCKET:-1}" in
        0|false|no|off) ;;
        *)
          _rundir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
          export DOCKER_HOST="unix://$_rundir/podman/podman.sock"
          unset _rundir
          ;;
      esac
      # Compose files to merge
      _compose_dir="${config.devenv.root}/docker/compose.d"
      _compose_files="${config.devenv.root}/compose.yml"
      export DOCKER_USER="$(id -u):$(id -g)"
      case "''${DOCKER_HOST:-}" in
        *podman*)
          _compose_files="$_compose_files:$_compose_dir/compose.podman.yml"
          # Build images with Podman/Buildah rather than BuildKit. `docker
          # compose build` otherwise has buildx boot a moby/buildkit container,
          # and that container lands in its own network namespace with neither
          # the proxy in its environment nor any route to it.
          # Buildah has neither problem: base images are resolved by the Podman systemd
          # service, which inherits the proxy from its systemd socket activated unit, and
          # RUN steps execute in the *host* network namespace
          export DOCKER_BUILDKIT=0
          export COMPOSE_BAKE=false
          ;;
      esac
      # Apply Bureautix override
      if [ -n "''${http_proxy:-}" ]; then
        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
      fi
      export COMPOSE_FILE="$_compose_files"
      unset _compose_dir _compose_files
      # Make binaries accessible
      for _d in \
        "$DEVENV_ROOT/${backendDir}/.venv/bin" \
        "$DEVENV_ROOT/${agentsDir}/.venv/bin" \
        "$DEVENV_ROOT/${summaryDir}/.venv/bin" \
        "$DEVENV_ROOT/${frontendDir}/node_modules/.bin"
      do
        [ -d "$_d" ] && export PATH="$_d:$PATH"
      done
      unset _d
    '';
  };
 }
@@ -1,5 +0,0 @@
 inputs:
  nixpkgs:
    url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
  devenv:
    url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules
@@ -0,0 +1,175 @@
 version: '3.8'
 services:
  postgresql:
    image: postgres:16
    env_file:
      - env.d/development/postgresql
    ports:
      - "15432:5432"
  redis:
    image: redis:5
  mailcatcher:
    image: sj26/mailcatcher:latest
    ports:
      - "1081:1080"
  app-dev:
    build:
      context: .
      target: backend-development
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
    image: meet:backend-development
    environment:
      - PYLINTHOME=/app/.pylint.d
      - DJANGO_CONFIGURATION=Development
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    ports:
      - "8071:8000"
    volumes:
      - ./src/backend:/app
      - ./data/static:/data/static
    depends_on:
        - postgresql
        - mailcatcher
        - redis
        - nginx
        - livekit
  celery-dev:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-development
    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG"]
    environment:
      - DJANGO_CONFIGURATION=Development
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    volumes:
      - ./src/backend:/app
      - ./data/static:/data/static
    depends_on:
      - app-dev
  app:
    build:
      context: .
      target: backend-production
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
    image: meet:backend-production
    environment:
      - DJANGO_CONFIGURATION=Demo
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    depends_on:
      - postgresql
      - redis
      - livekit
  celery:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-production
    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO"]
    environment:
      - DJANGO_CONFIGURATION=Demo
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
    depends_on:
      - app
  nginx:
    image: nginx:1.25
    ports:
      - "8083:8083"
    volumes:
      - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
    depends_on:
      - keycloak
  dockerize:
    image: jwilder/dockerize
  crowdin:
    image: crowdin/cli:4.0.0
    volumes:
      - ".:/app"
    env_file:
      - env.d/development/crowdin
    user: "${DOCKER_USER:-1000}"
    working_dir: /app
  node:
    image: node:18
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
    volumes:
      - ".:/app"
  kc_postgresql:
    image: postgres:14.3
    ports:
      - "5433:5432"
    env_file:
      - env.d/development/kc_postgresql
  keycloak:
    image: quay.io/keycloak/keycloak:20.0.1
    volumes:
      - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
    command:
      - start-dev
      - --features=preview
      - --import-realm
      - --proxy=edge
      - --hostname-url=http://localhost:8083
      - --hostname-admin-url=http://localhost:8083/
      - --hostname-strict=false
      - --hostname-strict-https=false
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_DB: postgres
      KC_DB_URL_HOST: kc_postgresql
      KC_DB_URL_DATABASE: keycloak
      KC_DB_PASSWORD: pass
      KC_DB_USERNAME: meet
      KC_DB_SCHEMA: public
      PROXY_ADDRESS_FORWARDING: 'true'
    ports:
      - "8080:8080"
    depends_on:
      - kc_postgresql
  livekit:
    image: livekit/livekit-server
    entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
    ports:
      - "7880:7880"
      - "7881:7881"
      - "7882:7882/udp"
    volumes:
      - ./docker/livekit/config/livekit-server.yaml:/config.yaml
    depends_on:
      - redis
      - livekit-egress
  livekit-egress:
      image: livekit/egress
      environment:
        EGRESS_CONFIG_FILE: ./livekit-egress.yaml
      volumes:
        - ./docker/livekit/config/livekit-egress.yaml:/livekit-egress.yaml
        - ./docker/livekit/out:/out
      depends_on:
        - redis
@@ -1,48 +0,0 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
 # the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
 # otherwise all connections fail during the build.
 x-proxy-vars: &proxy-vars
  http_proxy: ${http_proxy:-}
  https_proxy: ${https_proxy:-}
  no_proxy: ${no_proxy:-}
 services:
  app:
    build:
      args:
        <<: *proxy-vars
  app-dev:
    build:
      args:
        <<: *proxy-vars
  frontend:
    build:
      args:
        <<: *proxy-vars
  metadata-collector-dev:
    build:
      args:
        <<: *proxy-vars
  multi-user-transcriber-dev:
    build:
      args:
        <<: *proxy-vars
  app-summary-dev:
    build:
      args:
        <<: *proxy-vars
  celery-summary-transcribe:
    build:
      args:
        <<: *proxy-vars
  celery-summary-summarize:
    build:
      args:
        <<: *proxy-vars
  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
  keycloak:
    ports: !override
      - "8081:8080"
@@ -1,33 +0,0 @@
 # Rootless Podman override for compose.yml.
 #
 # Rootless Podman maps container UID 0 to the host user and every other
 # container UID to a subuid that owns nothing in the worktree. Meet compose.ymlruns
 # its containers as DOCKER_USER=$(id -u):$(id -g), which would land on such a
 # subuid and make every bind mount effectively read-only.
 #
 # `userns_mode: keep-id` maps the host user to the same UID and GID inside the
 # container instead, so DOCKER_USER keeps its Docker value and files written
 # through a bind mount are owned by the host user on both sides.
 #
 # Only the services that mount the worktree and run as DOCKER_USER are listed.
 x-keep-id: &keep-id
  userns_mode: keep-id
 services:
  app-dev:
    <<: *keep-id
  celery-dev:
    <<: *keep-id
  minio:
    <<: *keep-id
  node:
    <<: *keep-id
  crowdin:
    <<: *keep-id
  metadata-collector-dev:
    <<: *keep-id
  multi-user-transcriber-dev:
    <<: *keep-id
  app-summary-dev:
    <<: *keep-id
@@ -1,83 +0,0 @@
 # ---- Front-end image ----
 FROM node:22-alpine AS frontend-deps
 WORKDIR /home/frontend/
 COPY ./src/frontend/package.json ./package.json
 COPY ./src/frontend/package-lock.json ./package-lock.json
 RUN npm ci
 COPY .dockerignore ./.dockerignore
 COPY ./src/frontend/ .
 # ---- Front-end builder image ----
 FROM frontend-deps AS meet-builder
 WORKDIR /home/frontend
 ENV VITE_APP_TITLE="Visio"
 ENV VITE_BUILD_SOURCEMAP="true"
 RUN npm run build
 # Inject PostHog sourcemap metadata into the built assets
 # This metadata is essential for correctly mapping errors to source maps in production
 RUN set -e && \
    npx @posthog/cli@0.4.8 sourcemap inject --directory ./dist/assets
 COPY ./docker/dinum-frontend/dinum-styles.css \
    ./dist/assets/
 COPY ./docker/dinum-frontend/logo.svg \
    ./dist/assets/logo.svg
 COPY ./docker/dinum-frontend/assets/ \
    ./dist/assets/
 COPY ./docker/dinum-frontend/fonts/ \
    ./dist/assets/fonts/
 # ---- Addons builder image ----
 FROM node:20-alpine AS addons-builder
 WORKDIR /home/addons/outlook
 COPY ./src/addons/outlook/package.json ./package.json
 COPY ./src/addons/outlook/package-lock.json ./package-lock.json
 RUN npm ci
 COPY ./src/addons/outlook/ .
 RUN npx webpack --mode production
 # ---- Front-end image ----
 FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 USER root
 RUN apk upgrade --no-cache libexpat && \
    apk del curl
 USER nginx
 USER nginx
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
 COPY --from=meet-builder \
    /home/frontend/dist \
    /usr/share/nginx/html
 COPY --from=addons-builder \
    /home/addons/outlook/dist \
    /usr/share/nginx/html/addons/outlook
 COPY ./docker/dinum-frontend/nginx/default.conf /etc/nginx/conf.d
 COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
 ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
 CMD ["nginx", "-g", "daemon off;"]
@@ -1,61 +0,0 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg
   width="38.194309mm"
   height="3.4877367mm"
   viewBox="0 0 38.194309 3.4877367"
   version="1.1"
   id="svg1"
   sodipodi:docname="gouvernement.svg"
   inkscape:version="1.4.1 (93de688d07, 2025-03-30)"
   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
   xmlns="http://www.w3.org/2000/svg"
   xmlns:svg="http://www.w3.org/2000/svg">
  <sodipodi:namedview
     id="namedview1"
     pagecolor="#ffffff"
     bordercolor="#666666"
     borderopacity="1.0"
     inkscape:showpageshadow="2"
     inkscape:pageopacity="0.0"
     inkscape:pagecheckerboard="0"
     inkscape:deskcolor="#d1d1d1"
     inkscape:document-units="mm"
     inkscape:zoom="6.1918409"
     inkscape:cx="79.620909"
     inkscape:cy="44.332534"
     inkscape:window-width="1901"
     inkscape:window-height="1037"
     inkscape:window-x="5"
     inkscape:window-y="5"
     inkscape:window-maximized="0"
     inkscape:current-layer="layer1" />
  <defs
     id="defs1">
    <rect
       x="111.07374"
       y="333.22122"
       width="541.4845"
       height="297.51895"
       id="rect2" />
    <rect
       x="158.10136"
       y="358.3631"
       width="425.55618"
       height="204.21426"
       id="rect1" />
  </defs>
  <g
     inkscape:label="Layer 1"
     inkscape:groupmode="layer"
     id="layer1"
     transform="translate(-53.656101,-100.08408)">
    <path
       d="m 55.435527,103.08144 c -0.72898,0 -1.249045,-0.56007 -1.249045,-1.25349 0,-0.69342 0.502285,-1.25349 1.204595,-1.25349 0.41783,0 0.760095,0.20447 0.96901,0.50673 l 0.333375,-0.25781 c -0.28448,-0.38227 -0.742315,-0.64008 -1.302385,-0.64008 -0.973455,0 -1.63576,0.75565 -1.63576,1.64465 0,0.889 0.680085,1.64465 1.68021,1.64465 0.582295,0 1.05791,-0.24892 1.346835,-0.64008 v -1.21349 h -1.31572 v 0.36005 h 0.89789 v 0.70231 c -0.217805,0.24447 -0.54229,0.40005 -0.929005,0.40005 z m 3.569334,-2.89814 c -0.973455,0 -1.63576,0.75565 -1.63576,1.64465 0,0.889 0.662305,1.64465 1.63576,1.64465 0.96901,0 1.631315,-0.75565 1.631315,-1.64465 0,-0.889 -0.662305,-1.64465 -1.631315,-1.64465 z m 0,2.89814 c -0.70231,0 -1.204595,-0.56007 -1.204595,-1.25349 0,-0.69342 0.502285,-1.25349 1.204595,-1.25349 0.697865,0 1.20015,0.56007 1.20015,1.25349 0,0.69342 -0.502285,1.25349 -1.20015,1.25349 z m 4.276088,-0.84455 c 0,0.53784 -0.31115,0.84455 -0.786765,0.84455 -0.48006,0 -0.79121,-0.30671 -0.79121,-0.84455 v -1.96469 h -0.41783 v 1.93802 c 0,0.8001 0.48006,1.26238 1.20904,1.26238 0.72898,0 1.204595,-0.46228 1.204595,-1.26238 v -1.93802 h -0.41783 z m 0.942341,-1.96469 1.2446,3.1115 h 0.55118 l 1.2446,-3.1115 h -0.4445 l -1.07569,2.68922 -1.07569,-2.68922 z m 3.653795,3.1115 h 1.67132 v -0.3556 h -1.25349 v -1.05347 h 1.07569 v -0.35115 h -1.07569 v -0.99568 h 1.25349 v -0.3556 h -1.67132 z m 2.502533,0 h 0.41783 v -1.36462 h 0.40894 c 0.03111,0 0.06667,0 0.09779,-0.004 l 0.902335,1.36906 h 0.493395 l -1.00457,-1.44907 c 0.333375,-0.13335 0.52451,-0.41339 0.52451,-0.78677 0,-0.5334 -0.386715,-0.87566 -1.01346,-0.87566 h -0.82677 z m 0.84455,-2.7559 c 0.3556,0 0.564515,0.19558 0.564515,0.51117 0,0.33338 -0.208915,0.52451 -0.564515,0.52451 h -0.42672 v -1.03568 z m 2.004699,2.7559 h 0.41783 v -2.60033 l 1.76022,2.60033 h 0.546735 v -3.1115 h -0.41783 v 2.60032 l -1.76022,-2.60032 h -0.546735 z m 3.71158,0 h 1.67132 v -0.3556 h -1.25349 v -1.05347 h 1.07569 v -0.35115 h -1.07569 v -0.99568 h 1.25349 v -0.3556 h -1.67132 z m 2.502533,0 h 0.41783 v -2.55143 l 0.90678,1.48463 h 0.32004 l 0.90678,-1.48463 v 2.55143 h 0.41783 v -3.1115 h -0.5334 l -0.95123,1.56908 -0.95123,-1.56908 h -0.5334 z m 3.951605,0 h 1.67132 v -0.3556 h -1.25349 v -1.05347 h 1.07569 v -0.35115 h -1.07569 v -0.99568 h 1.25349 v -0.3556 h -1.67132 z m 2.502535,0 h 0.41783 v -2.60033 l 1.76022,2.60033 h 0.546735 v -3.1115 h -0.41783 v 2.60032 l -1.76022,-2.60032 H 85.89712 Z m 3.373758,-2.72923 h 1.03124 v 2.72923 h 0.41783 v -2.72923 h 1.03124 v -0.38227 h -2.48031 z"
       id="text3"
       style="font-size:4.445px;line-height:0.661464px;font-family:Marianne;-inkscape-font-specification:'Marianne, Normal';letter-spacing:0px;word-spacing:0px;display:inline;stroke:#000000;stroke-width:0.198437"
       aria-label="GOUVERNEMENT" />
  </g>
 </svg>
@@ -1,71 +0,0 @@
 :root {
    --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
    --avatar-cap-height: 0.7;
 }
 .Header-beforeLogo {
    display: block;
 }
 .Header-beforeLogo::before {
    content: '';
    display: block;
    background-image: url(/assets/marianne.svg);
    background-position: 0 -0.046875rem;
    background-size: 2.0625rem 0.84375rem;
    height: 0.75rem;
    margin-bottom: 0.1rem;
    width: 2.0625rem;
 }
 .Header-beforeLogo::after {
    content: '';
    display: block;
    background-image: url(/assets/gouvernement.svg), url(/assets/devise.svg);
    background-repeat: no-repeat, no-repeat;
    background-size: 108.8px 10px, 40px 29px;
    background-position: 0 3px, 0 18.9px;
    width: 108.8px;
    height: 48px;
    margin-top: 0.25rem;
 }
@font-face {
    font-family: 'Marianne';
    src: url('/assets/fonts/Marianne-Regular-subset.woff2') format('woff2');
    font-weight: 400;
    font-style: normal;
    font-display: swap;
 }
@font-face {
    font-family: 'Marianne';
    src: url('/assets/fonts/Marianne-Regular_Italic-subset.woff2') format('woff2');
    font-weight: 400;
    font-style: italic;
    font-display: swap;
 }
@font-face {
    font-family: 'Marianne';
    src: url('/assets/fonts/Marianne-Medium-subset.woff2') format('woff2');
    font-weight: 500;
    font-style: normal;
    font-display: swap;
 }
@font-face {
    font-family: 'Marianne';
    src: url('/assets/fonts/Marianne-Bold-subset.woff2') format('woff2');
    font-weight: 700;
    font-style: normal;
    font-display: swap;
 }
@font-face {
    font-family: 'Marianne';
    src: url('/assets/fonts/Marianne-ExtraBold-subset.woff2') format('woff2');
    font-weight: 800;
    font-style: normal;
    font-display: swap;
 }
@@ -1,6 +0,0 @@
 <svg width="448" height="172" viewBox="0 0 448 172" fill="none" xmlns="http://www.w3.org/2000/svg">
 <path d="M5.61135 65.6951C5 68.832 5 72.6949 5 79.1656V94.7307C5 102.759 5 106.773 6.16756 110.366C7.20062 113.546 8.89041 116.472 11.1274 118.957C13.6555 121.765 17.1318 123.772 24.0842 127.786L37.564 135.568C43.7169 139.121 47.1472 141.101 50.4165 142.054V94.0288C50.4165 91.6281 49.1052 89.4192 46.9976 88.2696L5.61135 65.6951Z" fill="#C9191E"/>
 <path d="M118.313 72.7489V97.7898C118.313 101.252 119.818 104.544 122.436 106.809L140.459 122.406C141.513 123.298 142.608 124.028 143.744 124.596C144.92 125.123 146.056 125.387 147.151 125.387C149.503 125.387 151.389 124.616 152.809 123.075C154.269 121.493 154.999 119.445 154.999 116.93V53.6577C154.999 51.1431 154.269 49.1151 152.809 47.5738C151.389 45.992 149.503 45.2011 147.151 45.2011C146.056 45.2011 144.92 45.4647 143.744 45.992C142.608 46.5193 141.513 47.2494 140.459 48.1822L122.45 63.7172C119.823 65.983 118.313 69.28 118.313 72.7489Z" fill="#000091"/>
 <path d="M11.6345 56.7522C11.1333 56.4788 10.6078 56.2937 10.0757 56.1915C10.4114 55.7628 10.7622 55.3452 11.1276 54.9394C13.6558 52.1315 17.132 50.1245 24.0845 46.1105L37.5643 38.3279C44.5167 34.3139 47.993 32.3069 51.6887 31.5213C54.9587 30.8262 58.3383 30.8262 61.6083 31.5213C65.304 32.3069 68.7803 34.3139 75.7327 38.3279L89.0535 46.0187C89.1066 46.0492 89.1597 46.0798 89.2129 46.1105C96.1653 50.1245 99.6416 52.1316 102.17 54.9394C104.407 57.4238 106.096 60.3506 107.13 63.5301C108.297 67.1235 108.297 71.1375 108.297 79.1656V94.7307C108.297 102.759 108.297 106.773 107.13 110.366C106.096 113.546 104.407 116.473 102.17 118.957C99.6416 121.765 96.1655 123.772 89.2133 127.785C89.1537 127.82 89.0936 127.855 89.0341 127.889L75.7327 135.568C68.7803 139.582 65.304 141.589 61.6083 142.375C61.4564 142.407 61.3043 142.438 61.1519 142.467L61.1519 94.0288C61.1519 87.6997 57.6948 81.8761 52.1386 78.8455L11.6345 56.7522Z" fill="#000091"/>
 <path d="M193.72 45.7333H211.035L234.771 108.456L258.507 45.7333H275.821L245.435 126H224.107L193.72 45.7333ZM289.019 58.1173C283.859 58.1173 279.501 53.76 279.501 48.6C279.501 43.44 283.859 39.0827 289.019 39.0827C294.179 39.0827 298.421 43.44 298.421 48.6C298.421 53.76 294.179 58.1173 289.019 58.1173ZM281.68 126V68.208H296.243V126H281.68ZM303.29 117.629L312.922 108.915C316.477 113.387 320.72 116.597 326.224 116.597C330.925 116.597 333.333 113.845 333.333 110.405C333.333 100.315 305.698 104.099 305.698 83.8027C305.698 73.5973 314.298 65.9147 326.338 65.9147C335.168 65.9147 343.194 70.1573 347.322 75.776L337.69 84.2613C334.709 80.592 330.925 77.6107 326.453 77.6107C321.866 77.6107 319.688 80.1333 319.688 83.1147C319.688 92.976 347.322 89.536 347.322 109.488C347.093 121.643 337.346 128.293 326.453 128.293C316.133 128.293 308.794 124.165 303.29 117.629ZM363.494 58.1173C358.334 58.1173 353.977 53.76 353.977 48.6C353.977 43.44 358.334 39.0827 363.494 39.0827C368.654 39.0827 372.897 43.44 372.897 48.6C372.897 53.76 368.654 58.1173 363.494 58.1173ZM356.155 126V68.208H370.718V126H356.155ZM411.115 65.9147C429.92 65.9147 442.763 79.7893 442.763 97.104C442.763 114.419 429.92 128.293 411.115 128.293C392.309 128.293 379.467 114.419 379.467 97.104C379.467 79.7893 392.309 65.9147 411.115 65.9147ZM411.344 114.533C420.632 114.533 427.627 107.08 427.627 97.104C427.627 87.0133 420.632 79.6747 411.344 79.6747C401.712 79.6747 394.603 87.0133 394.603 97.104C394.603 107.195 401.712 114.533 411.344 114.533Z" fill="#000091"/>
 </svg>
@@ -1,90 +0,0 @@
 server {
  listen 8080;
  server_name localhost;
  server_tokens off;
  root /usr/share/nginx/html;
  location = /.well-known/windows-app-web-link {
      default_type application/json;
      alias /usr/share/nginx/html/.well-known/windows-app-web-link;
      add_header Content-Disposition "attachment; filename=windows-app-web-link";
  }
  # Manifest — fetched, never iframed
  location = /addons/outlook/manifest.xml {
      alias /usr/share/nginx/html/addons/outlook/manifest.xml;
      add_header Access-Control-Allow-Origin "*";
      add_header Cache-Control "no-cache, no-store, must-revalidate";
      add_header X-Frame-Options "DENY";
      add_header Content-Security-Policy "frame-ancestors 'none'";
  }
  location = /addons/outlook/assets/ {
      return 404;
  }
  location ~* ^/addons/outlook/assets/(.+\.(?:css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot))/?$ {
      root /usr/share/nginx/html;
      expires 30d;
      add_header Cache-Control "public, max-age=2592000, immutable" always;
      add_header Access-Control-Allow-Origin "*";
      add_header Vary "Origin" always;
  }
  location = /addons/outlook/ {
      return 404;
  }
  location ~ ^/addons/outlook(/.*)?$ {
      alias /usr/share/nginx/html/addons/outlook$1;
      error_page 404 =200 /index.html;
      add_header Cache-Control "no-cache, no-store, must-revalidate";
      add_header Pragma "no-cache" always;
      add_header Expires 0 always;
      set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com";
      set $nonce $request_id;
      set $csp "default-src 'self'; upgrade-insecure-requests; ";
      set $csp "${csp}frame-ancestors ${ms_domains}; ";
      set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
      set $csp "${csp}style-src 'self' 'unsafe-inline'; ";
      set $csp "${csp}img-src 'self' data:; ";
      set $csp "${csp}font-src 'self' data:; ";
      set $csp "${csp}connect-src 'self' ${ms_domains}; ";
      set $csp "${csp}frame-src 'none'; ";
      set $csp "${csp}object-src 'none'; ";
      set $csp "${csp}base-uri 'none'; ";
      add_header Content-Security-Policy $csp;
      sub_filter 'NONCE_PLACEHOLDER' $nonce;
      sub_filter_once off;
  }
  location ^~ /assets/mediapipe/wasm/ {
      expires 30d;
      add_header Cache-Control "public, max-age=2592000";
  }
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
      add_header Cache-Control "public, max-age=2592000";
  }
  # Serve static files
  location / {
      try_files $uri $uri/ /index.html;
      # Add no-cache headers
      add_header Cache-Control "no-cache, no-store, must-revalidate";
      add_header Pragma "no-cache";  # HTTP 1.0 header for backward compatibility
      add_header Expires 0;
  }
  # Optionally, handle 404 errors by redirecting to index.html
  error_page 404 =200 /index.html;
 }
@@ -4,47 +4,10 @@ server {
    server_name localhost;
    charset utf-8;
    # Proxy auth for media
    location /media/ {
        # Auth request configuration
        auth_request /media-auth;
        auth_request_set $authHeader $upstream_http_authorization;
        auth_request_set $authDate $upstream_http_x_amz_date;
        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
        # Pass specific headers from the auth response
        proxy_set_header Authorization $authHeader;
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
        # Get resource from Minio
        proxy_pass http://minio:9000/meet-media-storage/;
        proxy_set_header Host minio:9000;
        # To use with ds_proxy
        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
        # proxy_set_header Host ds-proxy:4444;
        add_header Content-Disposition "attachment";
    }
    location /media-auth {
        proxy_pass http://app-dev:8000/api/v1.0/files/media-auth/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Original-URL $request_uri;
        # Prevent the body from being passed
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-Method $request_method;
    }
    location / {
        proxy_pass http://keycloak:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
    }
 }
@@ -1,50 +0,0 @@
 upstream meet_backend {
    server ${BACKEND_INTERNAL_HOST}:8000 fail_timeout=0;
 }
 upstream meet_frontend {
    server ${FRONTEND_INTERNAL_HOST}:8080 fail_timeout=0;
 }
 server {
    listen 8083;
    server_name localhost;
    charset utf-8;
    # Disables server version feedback on pages and in headers
    server_tokens off;
    proxy_ssl_server_name on;
    location @proxy_to_meet_backend {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_redirect off;
        proxy_pass http://meet_backend;
    }
    location @proxy_to_meet_frontend {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_redirect off;
        proxy_pass http://meet_frontend;
    }
    location / {
        try_files $uri @proxy_to_meet_frontend;
    }
    location /api {
        try_files $uri @proxy_to_meet_backend;
    }
    location /admin {
        try_files $uri @proxy_to_meet_backend;
    }
    location /static {
        try_files $uri @proxy_to_meet_backend;
    }
 }
@@ -14,4 +14,3 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
 access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'
@@ -1,6 +0,0 @@
 FROM livekit/livekit-server:v1.13.6
 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
 ENTRYPOINT ["/livekit-server"]
@@ -3,28 +3,3 @@ redis:
  address: redis:6379
 keys:
  devkey: secret
 webhook:
  api_key: devkey
  urls:
      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
 turn:
  enabled: true
  domain: turn.127.0.0.1.nip.io
  udp_port: 3478
  tls_port: 0
  external_tls: false
  relay_range_start: 30000
  relay_range_end: 30100
  allow_restricted_peer_cidrs:
    - 192.168.0.0/16
    - 172.16.0.0/12
 rtc:
  node_ip: 127.0.0.1
  advertise_internal_ip: true
  udp_port: 7882
  tcp_port: 7881
  use_external_ip: false
@@ -1,23 +0,0 @@
 version: '3'
 # You can add any necessary service here that will join the same docker network
 # sharing keycloak. Services added to the 'meet_resource-server' network will be
 # able to communicate with keycloak and the backend on that network.
 services:
  # busybox service is only used for testing purposes. It provides curl to test
  # connectivity to the backend and keycloak services. Replace this with your
  # relevant application services that need to communicate with keycloak.
  busybox:
    image: alpine:latest
    privileged: true
    command: sh -c "apk add --no-cache curl && sleep infinity"
    stdin_open: true
    tty: true
    networks:
      - default
      - meet_resource-server
 networks:
  default: {}
  meet_resource-server:
    external: true
@@ -1,145 +0,0 @@
 # Getting Started
 Before setting up, let's review Visio's architecture.
 Visio consists of four main components that run simultaneously:
 - React frontend, built with Vite.js
 - Django server
 - LiveKit server
 - FastAPI server (optional, required for AI beta features)
 These components rely on a few key services:
 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
 - MinIO for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)
 We provide two stack options for getting Visio up and running for development:
 - Docker Compose stack (recommended for most users)
 - Kubernetes stack powered by Tilt (Advanced)
 We recommend starting with the **Docker Compose** option for simplicity. However, if you're comfortable with running Kubernetes locally, the advanced option mirrors the production environment and provides most of the tools required for development (e.g., hot reloading).
 These instructions are for macOS or Ubuntu. For other distros, adjust as needed.
 If any steps are outdated, please let us know!
 ---
 We also provide **GNU make utilities**. To view all available Make rules, run:
 ```shellscript
 $ make help
 ```
 ---
 ## Need Help?
 If you need any assistance or have questions while getting started, feel free to reach out to @lebaudantoine anytime! Antoine is available to help you onboard and guide you through the process. Chat with him @antoine.lebaud:matrix.org, or from the [support hotline](https://go.crisp.chat/chat/embed/?website_id=58ea6697-8eba-4492-bc59-ad6562585041).
 ---
 ## Option 1: Developing with Docker
 ### Prerequisites
 1. Ensure you have a recent version of **Docker** and **Docker Compose** installed:
 ```shellscript
 $ docker -v
 Docker version 20.10.2, build 2291f61
 $ docker compose version
 Docker Compose version v2.32.4
 ```
 2. Install **LiveKit CLI** by following the instructions available in the [official repository](https://github.com/livekit/livekit-cli). After installation, verify that it's working:
 ```shellscript
 $ lk --version
 lk version 2.3.1
 ```
 ---
 ### Project Bootstrap
 1. Bootstrap the project using the **Make** command. This will build the `app` container, install dependencies, run database migrations, and compile translations:
 ```shellscript
 $ make bootstrap FLUSH_ARGS='--no-input'
 ```
 2. Access the project:
 - The frontend is available at [http://localhost:3000](http://localhost:3000) with the default credentials:
    - username: meet
    - password: meet
 - The Django backend is available at [http://localhost:8071](http://localhost:8071)
 ---
 ## Developing
 - To **stop** the application:
 ```shellscript
 $ make stop
 ```
 - To **restart** the application:
 ```shellscript
 $ make run
 ```
 - For **frontend development**, start all backend services without the frontend container:
 ```shellscript
 $ make run-backend
 ```
 Then:
 ```shellscript
 $ make frontend-development-install
 $ make run-frontend-development
 ```
 Which is equivalent to these direct npm commands:
 ```shellscript
 $ cd src/frontend
 $ npm i
 $ npm run dev
 ```
 ---
 ## Adding Content
 You can bootstrap demo data with a single command:
 ```shellscript
 $ make demo
 ```
 ---
 ## Option 2: Developing with Kubernetes
 Visio is deployed across staging, preprod, and production environments using **Kubernetes (K8s)**. Reproducing the environment locally is crucial for developing new features or debugging.
 This is facilitated by [Tilt](https://tilt.dev/), which provides Kubernetes-like development for local environments, enabling smart rebuilds and live updates.
 ### Getting Started
 Make sure you have the following installed:
 - kubectl
 - helm
 - helmfile
 - tilt
 To build and start the Kubernetes cluster using **Kind**:
 ```shellscript
 $ make build-k8s-cluster 
 ```
 Once the Kubernetes cluster is ready, start the application stack locally:
 ```shellscript
 $ make start-tilt-keycloak
 ```
 Monitor Tilt’s progress at [http://localhost:10350/](http://localhost:10350/). After Tilt actions finish, you can access the app at [https://meet.127.0.0.1.nip.io/](https://meet.127.0.0.1.nip.io/).
@@ -0,0 +1,81 @@
 # LiveKit Egress
 LiveKit offers Universal Egress, designed to provide universal exports of LiveKit sessions or tracks to a file or stream data.
 It is kept in a separate system to keep the load off the [Single Forwarding Unit (SFU)](https://docs.livekit.io/reference/internals/livekit-sfu/) and avoid impacting real-time audio or video performance/quality.
 ## Getting started
 ### Prerequisite
 1. **Verify Services**: Ensure the LiveKit server and Egress service are both up and running.
 2. **Install CLI**: Confirm that the LiveKit CLI utility is installed on your system.
 3. **Set Permissions**: Since the Egress service does not run as the root user, you need to grant write permissions to all users for the output directory. Update the permissions of the `docker/livekit/out` folder before starting the docker-compose stack:
 ```bash
 $ chmod o+w ./docker/livekit/out
 ```
 ### Make a recording
 LiveKit provides examples for creating Egress requests, which you can find [here](https://github.com/livekit/livekit-cli/tree/main/cmd/livekit-cli/examples). One of these examples has been added to the repository under `docker/livekit/egress-example`.
 Follow these steps to start an Egress request:
 1. **Create a Room**: Create a room either through the frontend or using the `livekit-cli` command.
 2. **Retrieve Room Name**: Get the room's name (e.g., the UUID4 in the URL from the frontend).
 3. **Update Configuration**: Edit the `docker/livekit/egress-example/room-composite-file.json` file with your room's name.
 4. **Start Egress Request**: Initiate a new Egress request.
 ```bash
 $ livekit-cli start-room-composite-egress --request ./docker/livekit/egress-example/room-composite-file.json
 Using default project meet
 EgressID: EG_XXXXXXXXXXXX Status: EGRESS_STARTING
 ```
 You can list running Egress:
 ```Bash
 $ livekit-cli list-egress
 Using default project meet
 +-----------------+---------------+----------------+--------------------------------------+--------------------------------+-------+
 |    EGRESSID     |    STATUS     |      TYPE      |                SOURCE                |           STARTED AT           | ERROR |
 +-----------------+---------------+----------------+--------------------------------------+--------------------------------+-------+
 | EG_XXXXXXXXXXXX | EGRESS_ACTIVE | room_composite | your-room-name-XXXXXXXXXXX-XXXXXXXXX | 2024-07-05 18:11:37.073847924  |       |
 |                 |               |                |                                      | +0200 CEST                     |       |
 +-----------------+---------------+----------------+--------------------------------------+--------------------------------+-------+
 ```
 You can stop the Egress at any time once your recording is finished:
 ```Bash
 $ livekit-cli stop-egress --id EG_XXXXXXXXXXXX
 Using default project meet
 Stopping Egress EG_XXXXXXXXXXXX
 ```
 The Egress should be marked as completed:
 ```bash
 $ livekit-cli list-egress
 Using default project meet
 +-----------------+-----------------+----------------+--------------------------------------+--------------------------------+-------+
 |    EGRESSID     |     STATUS      |      TYPE      |                SOURCE                |           STARTED AT           | ERROR |
 +-----------------+-----------------+----------------+--------------------------------------+--------------------------------+-------+
 | EG_XXXXXXXXXXXX | EGRESS_COMPLETE | room_composite | your-room-name-XXXXXXXXXXX-XXXXXXXXX | 2024-07-05 18:11:37.073847924  |       |
 |                 |                 |                |                                      | +0200 CEST                     |       |
 +-----------------+-----------------+----------------+--------------------------------------+--------------------------------+-------+
 ```
 Finally, you should find two new files in the `./docker/livekit/out directory`: an `.mp4` recording and its associated metadata in a `.json` file:
 ```bash
 $ ls ./docker/livekit/out
 your-room-name-YYYY-MM-DDTHHMMSS.mp4
 your-room-name-YYYY-MM-DDTHHMMSS.mp4.json
 ```
 ### Resources
 [Official Egress repository](https://github.com/livekit/egress)
@@ -1,89 +0,0 @@
 services:
  postgresql:
    image: postgres:16
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 1s
      timeout: 2s
      retries: 300
    env_file:
    - env.d/postgresql
    - env.d/common
    volumes:
    - ./data/databases/backend:/var/lib/postgresql/data
  redis:
    image: redis:5
  backend:
    image: lasuite/meet-backend:latest
    user: ${DOCKER_USER:-1000}
    restart: always
    env_file:
    - .env
    - env.d/common
    - env.d/postgresql
    healthcheck:
      test: ["CMD", "python", "manage.py", "check"]
      interval: 15s
      timeout: 30s
      retries: 20
      start_period: 10s
    depends_on:
      postgresql:
        condition: service_healthy
        restart: true
      redis:
        condition: service_started
      livekit:
        condition: service_started
  frontend:
    image: lasuite/meet-frontend:latest
    user: "${DOCKER_USER:-1000}"
    entrypoint:
    - /docker-entrypoint.sh
    command: ["nginx", "-g", "daemon off;"]
    env_file:
    - .env
    - env.d/common
    # Uncomment and set your values if using our nginx proxy example
    # environment:
    # - VIRTUAL_HOST=${MEET_HOST} # used by nginx proxy 
    # - VIRTUAL_PORT=8083 # used by nginx proxy
    # - LETSENCRYPT_HOST=${MEET_HOST} # used by lets encrypt to generate TLS certificate
    depends_on:
      backend:
        condition: service_healthy
    volumes:
    - ./default.conf.template:/etc/nginx/templates/docs.conf.template
 # Uncomment if using our nginx proxy example
 #    networks:
 #    - proxy-tier
 #    - default
  livekit:
    image: livekit/livekit-server:latest
    command: --config /config.yaml
    ports:
    - 7881:7881/tcp
    - 7882:7882/udp
    volumes:
      - ./livekit-server.yaml:/config.yaml
    # Uncomment and set your values if using our nginx proxy example
    # environment:
    # - VIRTUAL_HOST=${LIVEKIT_HOST} # used by nginx proxy 
    # - VIRTUAL_PORT=7880 # used by nginx proxy
    # - LETSENCRYPT_HOST=${LIVEKIT_HOST} # used by lets encrypt to generate TLS certificate
    depends_on:
      redis:
        condition: service_started
 # Uncomment if using our nginx proxy example
 #    networks:
 #    - proxy-tier
 #    - default
 # Uncomment if using our nginx proxy example
 #networks:
 #  proxy-tier:
 #    external: true
@@ -1,91 +0,0 @@
 # Deploy and Configure Keycloak for Meet
 ## Installation
 > [!CAUTION]
 > We provide those instructions as an example, for production environments, you should follow the [official documentation](https://www.keycloak.org/documentation).
 ### Step 1: Prepare your working environment:
 ```bash
 mkdir -p keycloak/env.d && cd keycloak
 curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/compose/keycloak/compose.yaml
 curl -o env.d/kc_postgresql https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/kc_postgresql
 curl -o env.d/keycloak https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/keycloak
 ```
 ### Step 2:. Update `env.d/` files
 The following variables need to be updated with your own values, others can be left as is:
 ```env
 POSTGRES_PASSWORD=<generate postgres password>
 KC_HOSTNAME=https://id.yourdomain.tld # Change with your own URL
 KC_BOOTSTRAP_ADMIN_PASSWORD=<generate your password>
 ```
 ### Step 3: Expose keycloak instance on https
 > [!NOTE]
 > You can skip this section if you already have your own setup.
 To access your Keycloak instance on the public network, it needs to be exposed on a domain with SSL termination. You can use our [example with nginx proxy and Let's Encrypt companion](../nginx-proxy/README.md) for automated creation/renewal of certificates using [acme.sh](http://acme.sh).
 If following our example, uncomment the environment and network sections in compose file and update it with your values.
 ```yaml
 version: '3'
 services:
  keycloak:
   ...
    # Uncomment and set your values if using our nginx proxy example
    # environment:
    # - VIRTUAL_HOST=id.yourdomain.tld # used by nginx proxy 
    # - VIRTUAL_PORT=8080 # used by nginx proxy
    # - LETSENCRYPT_HOST=id.yourdomain.tld # used by lets encrypt to generate TLS certificate
   ...
 # Uncomment if using our nginx proxy example
 #    networks:
 #    - proxy-tier
 #    - default
 # Uncomment if using our nginx proxy example
 #networks:
 #  proxy-tier:
 #    external: true
 ```
 ### Step 4: Start the service
 ```bash
 `docker compose up -d`
 ```
 Your keycloak instance is now available on https://id.yourdomain.tld
 > [!CAUTION]
 > Version of the images are set to latest, you should pin it to the desired version to avoid unwanted upgrades when pulling latest image. You can find available versions on [Keycloak registry](https://quay.io/repository/keycloak/keycloak?tab=tags).
 ## Creating an OIDC Client for Meet Application
 ### Step 1: Create a New Realm
 1. Log in to the Keycloak administration console.
 2. Navigate to the realm tab and click on the "Create realm" button.
 3. Enter the name of the realm  - `meet`.
 4. Click "Create".
 ### Step 2: Create a New Client
 1. Navigate to the "Clients" tab.
 2. Click on the "Create client" button.
 3. Enter the client ID - e.g. `meet`.
 4. Enable "Client authentication" option.
 6. Set the "Valid redirect URIs" to the URL of your meet application suffixed with `/*` - e.g., "https://meet.example.com/*".
 1. Set the "Web Origins" to the URL of your meet application - e.g. `https://meet.example.com`.
 1. Click "Save".
 ### Step 3: Get Client Credentials
 1. Go to the "Credentials" tab.
 2. Copy the client ID (`meet` in this example) and the client secret.
@@ -1,36 +0,0 @@
 services:
  postgresql:
    image: postgres:16
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 1s
      timeout: 2s
      retries: 300
    env_file:
    - env.d/kc_postgresql
    volumes:
    - ./data/keycloak:/var/lib/postgresql/data/pgdata
  keycloak:
    image: quay.io/keycloak/keycloak:latest
    command: ["start"]
    env_file:
    - env.d/kc_postgresql
    - env.d/keycloak
    # Uncomment and set your values if using our nginx proxy example
    # environment:
    # - VIRTUAL_HOST=id.yourdomain.tld # used by nginx proxy 
    # - VIRTUAL_PORT=8080 # used by nginx proxy
    # - LETSENCRYPT_HOST=id.yourdomain.tld # used by lets encrypt to generate TLS certificate
    depends_on:
      postgresql:
        condition: service_healthy
        restart: true
 # Uncomment if using our nginx proxy example
 #    networks:
 #    - proxy-tier
 #    - default
 #
 #networks:
 #  proxy-tier:
 #    external: true
@@ -1,39 +0,0 @@
 # Nginx proxy with automatic SSL certificates
 > [!CAUTION]
 > We provide those instructions as an example, for extended development or production environments, you should follow the [official documentation](https://github.com/nginx-proxy/acme-companion/tree/main/docs).
 Nginx-proxy sets up a container running nginx and docker-gen. docker-gen generates reverse proxy configs for nginx and reloads nginx when containers are started and stopped.
 Acme-companion is a lightweight companion container for nginx-proxy. It handles the automated creation, renewal and use of SSL certificates for proxied Docker containers through the ACME protocol.
 ## Installation
 ### Step 1: Prepare your working environment:
 ```bash
 mkdir nginx-proxy && cd nginx-proxy
 curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/compose/nginx-proxy/compose.yaml
 ```
 ### Step 2: Edit `DEFAULT_EMAIL` in the compose file.
 Albeit optional, it is recommended to provide a valid default email address through the `DEFAULT_EMAIL` environment variable, so that Let's Encrypt can warn you about expiring certificates and allow you to recover your account.
 ### Step 3: Create docker network
 Containers need share the same network for auto-discovery.
 ```bash
 docker network create proxy-tier
 ```
 ### Step 4: Start service
 ```bash
 docker compose up -d
 ```
 ## Usage
 Once both nginx-proxy and acme-companion containers are up and running, start any container you want proxied with environment variables `VIRTUAL_HOST` and `LETSENCRYPT_HOST` both set to the domain(s) your proxied container is going to use.
@@ -1,36 +0,0 @@
 services:
  nginx-proxy:
    image: nginxproxy/nginx-proxy
    container_name: nginx-proxy
    ports:
    - "80:80"
    - "443:443"
    volumes:
    - html:/usr/share/nginx/html
    - certs:/etc/nginx/certs:ro
    - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
    - proxy-tier
  acme-companion:
    image: nginxproxy/acme-companion
    container_name: nginx-proxy-acme
    environment:
    - DEFAULT_EMAIL=mail@yourdomain.tld
    volumes_from:
    - nginx-proxy
    volumes:
    - certs:/etc/nginx/certs:rw
    - acme:/etc/acme.sh
    - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
    - proxy-tier
 networks:
  proxy-tier:
    external: true
 volumes:
  html:
  certs:
  acme:
@@ -1,7 +0,0 @@
 auth:
  username: dinum
  password: pass
  database: meet
 tls:
  enabled: true
  autoGenerated: true
@@ -1,3 +0,0 @@
 auth:
  password: pass
 architecture: standalone
@@ -1,22 +0,0 @@
 port: 7880
 redis:
  address: redis:6379
 keys:
  meet: <your livekit secret key>
 # WebRTC configuration
 rtc:
  # # when set, LiveKit will attempt to use a UDP mux so all UDP traffic goes through
  # # listed port(s). To maximize system performance, we recommend using a range of ports
  # # greater or equal to the number of vCPUs on the machine.
  # # port_range_start & end must not be set for this config to take effect
  udp_port: 7882
  # when set, LiveKit enable WebRTC ICE over TCP when UDP isn't available
  # this port *cannot* be behind load balancer or TLS, and must be exposed on the node
  # WebRTC transports are encrypted and do not require additional encryption
  # only 80/443 on public IP are allowed if less than 1024
  tcp_port: 7881
  # use_external_ip should be set to true for most cloud environments where
  # the host has a public IP address, but is not exposed to the process.
  # LiveKit will attempt to use STUN to discover the true IP, and advertise
  # that IP with its clients
  use_external_ip: true
@@ -1,53 +0,0 @@
 # Authentication (OIDC)
 La Suite Meet supports **OIDC authentication** using the Authorization Code Flow.
 Authentication relies on [django-lasuite](https://github.com/suitenumerique/django-lasuite) for OIDC integration, token validation, and user management.
 ## OIDC Configuration
 | Option                                    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Default                        |
 |-------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ------------------------------ |
 | **Client Settings**                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | OIDC_RP_CLIENT_ID                         | OIDC client identifier registered with your provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `meet`                         |
 | OIDC_RP_CLIENT_SECRET                     | OIDC client secret (keep confidential)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | —                              |
 | OIDC_CREATE_USER                          | Automatically create a local user if none exists                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `true`                         |
 | **Security & Verification**               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | OIDC_VERIFY_SSL                           | Verify SSL certificates when contacting the OIDC provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `true`                         |
 | OIDC_USE_NONCE                            | Use `nonce` to prevent replay attacks                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `true`                         |
 | OIDC_STORE_ID_TOKEN                       | Store the ID token returned by the OIDC provider (useful for backend validation)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `true`                         |
 | OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION | Fallback to identifying users by email if `sub` claim does not match. Enable only if emails are unique.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `false`                        |
 | **Endpoints**                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | OIDC_OP_JWKS_ENDPOINT                     | URL to retrieve JSON Web Key Sets (for token verification)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | —                              |
 | OIDC_OP_AUTHORIZATION_ENDPOINT            | URL for authorization requests                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | —                              |
 | OIDC_OP_TOKEN_ENDPOINT                    | URL to exchange authorization code for tokens                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | —                              |
 | OIDC_OP_USER_ENDPOINT                     | URL to fetch user information                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | —                              |
 | OIDC_OP_USER_ENDPOINT_FORMAT              | Format of user endpoint response. Options: `AUTO` (detect automatically), `JWT`, or `JSON`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `AUTO`                         |
 | OIDC_OP_LOGOUT_ENDPOINT                   | URL for logout requests                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | —                              |
 | **User Info Mapping**                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | OIDC_USERINFO_FULLNAME_FIELDS             | List of OIDC claims used to build user’s full name                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `["given_name", "usual_name"]` |
 | OIDC_USERINFO_SHORTNAME_FIELD             | OIDC claim used for the user’s short name                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `given_name`                   |
 | OIDC_USERINFO_ESSENTIAL_CLAIMS            | List of essential claims required from the provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `[]`                           |
 | **Redirects & Scopes**                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | OIDC_REDIRECT_REQUIRE_HTTPS               | Require HTTPS for OIDC redirect URIs (**recommended in production**)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `false`                        |
 | OIDC_REDIRECT_ALLOWED_HOSTS               | Allowed hosts for OIDC redirects                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `[]`                           |
 | OIDC_REDIRECT_FIELD_NAME                  | Query parameter name used for redirect after login                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `returnTo`                     |
 | OIDC_RP_SCOPES                            | Scopes to request during authentication                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `openid email`                 |
 | LOGIN_REDIRECT_URL                        | URL to redirect after successful login                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | —                              |
 | LOGIN_REDIRECT_URL_FAILURE                | URL to redirect after failed login                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | —                              |
 | LOGOUT_REDIRECT_URL                       | URL to redirect after logout                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | —                              |
 | ALLOW_LOGOUT_GET_METHOD                   | Allow logout through HTTP GET (POST is recommended for security)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `true`                         |
 | OIDC_AUTH_REQUEST_EXTRA_PARAMS            | Extra parameters to include in OIDC authentication requests                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `{}`                           |
 | **PKCE (Proof Key for Code Exchange)**    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | OIDC_USE_PKCE                             | Enable PKCE for enhanced security (**recommended**)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                        |
 | OIDC_PKCE_CODE_CHALLENGE_METHOD           | Method to generate PKCE code challenge (`S256` recommended)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `S256`                         |
 | OIDC_PKCE_CODE_VERIFIER_SIZE              | Length of the random string used as PKCE code verifier (43–128 characters)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `64`                           |
 | **Other**                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                |
 | FRONTEND_IS_SILENT_LOGIN_ENABLED          | Silent login allows La Suite Meet to authenticate users automatically without showing a login prompt, providing a seamless experience when an active session already exists with the OIDC provider. It works by replaying the authentication request with prompt=none: if the user has a valid session, login succeeds silently; otherwise, it fails gracefully and redirects the user to the initial page. Silent login is optional and enabled by default in standard deployments. The app retries silent login after any 401 response, with at least a 30-second interval between attempts (not configurable via environment variables). Controlled by the backend parameter. /!\ Your OIDC provider must support `prompt=none`. | `false`                        |
 ## Sessions
 * After login, users receive a **Django session cookie** to maintain authentication across requests.
 * Default session duration is 12 hours (`SESSION_COOKIE_AGE = 60 * 60 * 12`).
 * Ensure your session policy matches your security requirements.
@@ -1,6 +0,0 @@
 # Calendar integrations (WIP)
 These features are currently under active development and are not yet ready for official documentation. Comprehensive documentation will be provided as soon as possible.
 An initial integration with OpenExchange is already available and will be documented shortly.
@@ -1,181 +0,0 @@
 # Room Recording (Beta)
 La Suite Meet offers a room recording feature that is currently in beta, with ongoing improvements planned. 
 The feature allows users to record their room sessions. When a recording is complete, the room owner receives a notification with a link to download the recorded file. Recordings are automatically deleted after `RECORDING_EXPIRATION_DAYS`.
 It uses LiveKit Egress to record room sessions. For reference, see the [LiveKit Egress repository](https://github.com/livekit/egress) and the [official documentation](https://docs.livekit.io/home/egress/overview/).
 **Current Limitations**:
 * Users cannot record and transcribe simultaneously. ([Issue #527](https://github.com/suitenumerique/meet/issues/527)
 is on our backlog)
 * Recording layout cannot be configured from the frontend. By default, the egress captures the active speaker and any shared screens. (not yet planned)
 * Shareable links with an embedded video player are not yet supported. (not yet planned)
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).
 ## Special requirements
 To use the room recording feature, the following components are required:
 - A running [LiveKit Egress](https://github.com/livekit/egress) server capable of handling room composite recordings.
 - A S3-compatible object storage where the egress uploads the recorded files.
 - An email service to notify room owners when a recording is available for download.
 - Webhook events configured between LiveKit Server and the backend.
 > [!NOTE]
 > Celery isn’t in use for these async tasks yet. It’s something we’d like to add, but it’s not planned at this stage.
 ## How It Works
 ```mermaid
 sequenceDiagram
    participant User
    participant Frontend as Frontend (React)
    participant Backend as Django Backend
    participant LiveKit as LiveKit API
    participant Egress as LiveKit Egress
    participant Storage as Object Storage
    participant Room as LiveKit Room
    participant Email as Email Service
    User->>Frontend: Click start recording button
    Frontend->>Backend: POST /api/v1.0/rooms/{id}/start-recording/
    Backend->>LiveKit: Create egress request
    LiveKit->>Egress: Start room composite egress
    Egress->>Room: Join room as recording participant
    Note over Egress,Room: Egress joins room to capture audio/video
    LiveKit-->>Backend: Return egress_id
    Backend->>Backend: Update Recording with worker_id
    Backend-->>Frontend: HTTP 201 - Recording started
    Frontend->>Frontend: Update recording status
    Frontend->>Frontend: Notify other participants
    Note over Frontend: Via LiveKit data channel
    Note over Egress,Room: Recording in progress...
    User->>Frontend: Click stop recording button
    Frontend->>Backend: POST /api/v1.0/rooms/{id}/stop-recording/
    Backend->>LiveKit: Stop egress request
    LiveKit->>Egress: Stop recording
    Egress->>Storage: Upload recorded file
    LiveKit->>Backend: POST /api/v1.0/rooms/webhooks-livekit/ (egress_ended)
    Backend->>Backend: Update Recording status to SAVED
    Backend->>Email: Send notification to room owner
    Backend-->>Frontend: HTTP 200 - Recording stopped
    Frontend->>Frontend: Update UI and notify participants
    Email->>User: Send email with recording link
    User->>Frontend: Navigate to /recording/{id} to download file
    Frontend->>Frontend: Download recording file
 ```
 ## Configuration Options
 | Option                                  | Type        | Default                                                                                                                                                            | Description                                                                                                                                                                                                                                                                                        |
 | --------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | **RECORDING_ENABLE**                    | Boolean     | `False`                                                                                                                                                            | Enable or disable the room recording feature.                                                                                                                                                                                                                                                      |
 | **RECORDING_OUTPUT_FOLDER**             | String      | `"recordings"`                                                                                                                                                     | Folder/prefix where recordings are stored in the object storage.                                                                                                                                                                                                                                   |
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |
 | **RECORDING_MAX_DURATION**              | Integer     | `None`                                                                                                                                                             | Maximum duration of a recording in milliseconds. Must be synced with the LiveKit Egress configuration. Set to None for unlimited duration. When the maximum duration is reached, the recording is automatically stopped and saved, and the user is prompted in the frontend with an alert message. |
 | **RECORDING_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | When `False`, LiveKit Egress uses its built-in `H264_720P_30` preset. When `True`, the `RECORDING_ENCODING_*` values below are sent to LiveKit as advanced `EncodingOptions`. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
 | **RECORDING_ENCODING_WIDTH**            | Integer     | `1280`                                                                                                                                                             | Recording video width in pixels. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                         |
 | **RECORDING_ENCODING_HEIGHT**           | Integer     | `720`                                                                                                                                                              | Recording video height in pixels. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                        |
 | **RECORDING_ENCODING_FRAMERATE**        | Integer     | `30`                                                                                                                                                               | Recording video framerate (fps). Directly impacts egress worker CPU (roughly linear). Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                    |
 | **RECORDING_ENCODING_VIDEO_BITRATE_KBPS** | Integer   | `3000`                                                                                                                                                             | H.264 MAIN video bitrate in kbps. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                        |
 | **RECORDING_ENCODING_AUDIO_BITRATE_KBPS** | Integer   | `128`                                                                                                                                                              | AAC audio bitrate in kbps. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                               |
 | **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `4.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `4.0` is a standard VOD value. Only applied when `RECORDING_ENCODING_ENABLED` is `True`. |
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).
 ## LiveKit Egress
 La Suite Meet uses LiveKit Egress to record room sessions. For reference, see the [LiveKit Egress repository](https://github.com/livekit/egress) and the [official documentation](https://docs.livekit.io/home/egress/overview/).
 Currently, only `RoomCompositeEgress` is supported. This mode combines all video and audio tracks from the room into a single recording.
 To monitor egress workers and inspect recording status, it is recommended to install `livekit-cli`. For example, you can list active egress sessions using the following command:
 ```bash
 $ livekit-cli list-egress
 Using default project meet
 +-----------------+---------------+----------------+--------------------------------------+--------------------------------+-------+
 |    EGRESSID     |    STATUS     |      TYPE      |                SOURCE                |           STARTED AT           | ERROR |
 +-----------------+---------------+----------------+--------------------------------------+--------------------------------+-------+
 | EG_XXXXXXXXXXXX | EGRESS_ACTIVE | room_composite | your-room-name-XXXXXXXXXXX-XXXXXXXXX | 2024-07-05 18:11:37.073847924  |       |
 |                 |               |                |                                      | +0200 CEST                     |       |
 +-----------------+---------------+----------------+--------------------------------------+--------------------------------+-------+
 ```
 This allows you to verify which recordings are in progress, troubleshoot egress issues, and confirm that recordings are being processed correctly.
 ## Tuning recording encoding
 By default, LiveKit Egress records with the built-in `H264_720P_30` preset: 1280×720 at 30 fps, 3000 kbps H.264 MAIN video and 128 kbps AAC audio. For a one-hour meeting this produces a file of roughly **1.4 GB**, which is often heavier than necessary for talking-head content and screen sharing.
 The `RECORDING_ENCODING_*` settings let operators override this preset without modifying the source. Values are passed straight through LiveKit's `EncodingOptions.advanced` to the GStreamer pipeline (`x264enc` for video, `faac` for audio), so there are no hidden conversions — what you set is what the encoder receives.
 ### How values map to GStreamer
 | Setting                               | GStreamer element | Property                           |
 | ------------------------------------- | ----------------- | ---------------------------------- |
 | `RECORDING_ENCODING_WIDTH/HEIGHT`     | capsfilter        | `video/x-raw,width=W,height=H`     |
 | `RECORDING_ENCODING_FRAMERATE`        | capsfilter        | `framerate=F/1`                    |
 | `RECORDING_ENCODING_VIDEO_BITRATE_KBPS` | `x264enc`       | `bitrate=kbps` (kilobits)          |
 | `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S` | `x264enc`     | `key-int-max = interval × fps`     |
 | `RECORDING_ENCODING_AUDIO_BITRATE_KBPS` | `faac`          | `bitrate = kbps × 1000` (bits)     |
 The H.264 profile is fixed to MAIN and the x264 `speed-preset` to `veryfast` by LiveKit (real-time constraint) — lowering the framerate is therefore the main lever to save CPU, while lowering the bitrate is the main lever to shrink the output file.
 ### Reference profiles
 Rough 30-minute file-size estimates assume video + audio bitrate multiplied by duration. Actual sizes vary with content (static talking heads compress better than heavy screen motion). Egress CPU figures are indicative, measured on a single Ryzen laptop core saturated by the default preset (= 100 %); scaling is roughly linear with `framerate × bitrate` but the absolute numbers depend on the host hardware.
 | Profile                | Resolution | FPS | Video (kbps) | Audio (kbps) | Keyframe (s) | ~ size / 30 min | Egress CPU (vs. default) | Suitable for                                        |
 | ---------------------- | ---------- | --- | ------------ | ------------ | ------------ | --------------- | ------------------------ | --------------------------------------------------- |
 | Default (preset)       | 1280×720   | 30  | 3000         | 128          | 4            | **~690 MB**     | 100 %                    | Unchanged LiveKit behaviour                         |
 | Balanced               | 1280×720   | 20  | 1000         | 96           | 4            | ~240 MB         | ~67 %                    | Mixed content, moderate motion                      |
 | **Low CPU / small file** | 1280×720 | 15  | 600          | 64           | 4            | **~150 MB**     | ~50 %                    | Talking-head dominant meetings + occasional slides ★ |
 | Slide-heavy            | 1280×720   | 15  | 900          | 64           | 4            | ~210 MB         | ~55 %                    | Frequent dense screen sharing (decks, IDE, docs)    |
 | Minimum CPU            | 960×540    | 15  | 500          | 64           | 4            | ~125 MB         | ~30 %                    | Voice-first meetings, readable text not required    |
 | Audio-heavy fallback   | 1280×720   | 10  | 400          | 96           | 4            | ~110 MB         | ~35 %                    | Long webinars, low motion                           |
 ★ Recommended starting point for typical LaSuite Meet usage.
 Environment variables for the **Low CPU / small file** profile:
 ```bash
 RECORDING_ENCODING_ENABLED=True
 RECORDING_ENCODING_WIDTH=1280
 RECORDING_ENCODING_HEIGHT=720
 RECORDING_ENCODING_FRAMERATE=15
 RECORDING_ENCODING_VIDEO_BITRATE_KBPS=600
 RECORDING_ENCODING_AUDIO_BITRATE_KBPS=64
 RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0
 ```
 ### Caveats
 - **Screen-share readability — think bits/frame, not bitrate**: at 720p, text legibility starts to break down below ~40 kbits/frame (= `bitrate ÷ framerate`). The recommended preset (600 kbps × 15 fps) sits at exactly that threshold, comfortable for talking heads with occasional slide sharing. The same 600 kbps at 30 fps would only deliver 20 kbits/frame and visibly blur dense slides — which is why **lowering framerate is a more screen-share-friendly lever than lowering bitrate**. For deck-heavy or IDE-share meetings, prefer the **Slide-heavy** profile (900 kbps × 15 fps ≈ 60 kbits/frame).
 - **Motion handling**: the `veryfast` x264 preset is set by LiveKit and cannot be overridden here. Low-bitrate settings will therefore show more artefacts on fast motion than an offline re-encode with a slower preset would. This is the other reason FPS reduction is the safer tuning lever for meeting recordings.
 - **Audio**: AAC at 64 kbps stereo is transparent for voice but starts to compress music noticeably. Keep 128 kbps if you expect music playback in meetings.
 - **Codec choice**: H.264 MAIN is hardcoded on purpose. Switching to HEVC or VP9 would increase egress CPU cost 2×–5×, defeating the goal of this tuning.
@@ -1,24 +0,0 @@
 # Signaling
 Signaling is essential for LiveKit’s real-time communication. It enables peers to discover each other, exchange session descriptions, and negotiate network paths for audio and video streams.
 ## How Signaling Works
 LiveKit signaling relies on a WebSocket connection between the client and the LiveKit API server. This WebSocket is required for all signaling messages, including session descriptions, ICE candidates, and connection state updates.
 We do not cover internal signaling behavior. For full reference, see the [LiveKit client protocol](https://docs.livekit.io/reference/internals/client-protocol/).
 > [!IMPORTANT]
 > The WebSocket is the backbone of LiveKit signaling. All signaling messages rely on it, and without it, ICE candidate exchange and peer connection setup cannot occur. If the WebSocket connection is lost, the client automatically attempts to resume the RTC session once connectivity is restored.
 ## Environment Variables
 | Variable                                  | Type    | Default | Purpose                                                                                                                                                   |
 | ----------------------------------------- | ------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `LIVEKIT_FORCE_WSS_PROTOCOL`              | Boolean | `True`  | Forces the WebSocket URL to use `wss://`. Required for legacy browsers (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs in `WebSocket()` may fail. |
 | `LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND` | Boolean | `True`  | Workaround for Firefox clients behind proxies that fail to establish WebSocket connections. Pre-establishes a dummy connection to “prime” the WebSocket.  |
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).
@@ -1,4 +0,0 @@
 # Live subtitles (WIP)
 This feature is currently under development and not yet ready for production use. Documentation and detailed instructions will be provided once the feature is stable and officially released.
@@ -1,4 +0,0 @@
 # Meeting summarization (WIP)
 This feature is currently under development and not yet ready for production use. Documentation and detailed instructions will be provided once the feature is stable and officially released.
@@ -1,87 +0,0 @@
 # Telephony SIP (Beta)
 Enable participants to join a video conference via phone, allowing them to participate in the room even when their internet connection is poor or unavailable.
 **Current Limitations**:
 * Supports only a single SIP trunk provider per instance.
 * A participant joining over the phone cannot enter the room until the first WebRTC participant has connected.
 ## Special requirements
 To use the telephony feature, the following components are required:
 * A running [LiveKit SIP server](https://github.com/livekit/sip) ([documentation](https://docs.livekit.io/home/self-hosting/sip-server/)) to handle SIP participants and connect them to room sessions.
 * A SIP trunk to route incoming and outgoing phone calls.
 * Webhook events configured between the LiveKit server and the backend.
 ## How It Works
 ### Room Lifecycle
 ```mermaid
 sequenceDiagram
    participant Backend
    participant LiveKit as LiveKit Service
    participant SIP as LiveKit SIP
    participant Dispatch as SIP Dispatch
    Backend->>Backend: Create new room
    Backend->>Backend: Assign unique pin code to room
    LiveKit-->>Backend: Webhook room_started
    Backend->>Dispatch: Create LiveKit SIP dispatch rule
    LiveKit-->>Backend: Webhook room_ended
    Backend->>Dispatch: Clear LiveKit SIP dispatch rule
 ```
 ### Participant calling
 ```mermaid
 sequenceDiagram
    participant Caller as Caller
    participant SIPProvider as SIP Trunk Provider
    participant LiveKitSIP as LiveKit SIP
    participant Dispatch as SIP Dispatch
    participant Room as LiveKit Room
    Caller->>SIPProvider: Dial phone number
    SIPProvider->>LiveKitSIP: Route call to SIP server
    LiveKitSIP->>Caller: Prompt for room pin code
    Caller->>LiveKitSIP: Enter pin code
    LiveKitSIP->>Dispatch: Check dispatch rule for pin and trunk ID
    Dispatch-->>LiveKitSIP: Return room ID if found
    LiveKitSIP->>Room: Connect participant to room
 ```
 ## Configuration
 | Option                         | Type             | Default | Description                                                                                                     |
 | ------------------------------ | ---------------- | ------- |-----------------------------------------------------------------------------------------------------------------|
 | ROOM_TELEPHONY_ENABLED         | Boolean          | False   | Enable or disable telephony (phone call) support for rooms.                                                     |
 | ROOM_TELEPHONY_PIN_LENGTH      | Positive Integer | 10      | Length of the PIN code participants must enter to join a call.                                                  |
 | ROOM_TELEPHONY_PIN_MAX_RETRIES | Positive Integer | 5       | Maximum number of attempts a participant can make when entering the PIN.                                        |
 | ROOM_TELEPHONY_PHONE_NUMBER    | String           | None    | The phone number associated with the room for incoming calls. Required to route calls via the telephony system. |
 | ROOM_TELEPHONY_DEFAULT_COUNTRY | String           | "US"    | Default country code for phone numbers, used for parsing and formatting phone numbers.                          |
 ### SIP Trunk Authentication
 You may need to configure authentication between LiveKit SIP and your SIP trunk provider to enable participants to join via phone.
 Please refer to [the official documentation](https://docs.livekit.io/sip/quickstarts/configuring-sip-trunk/).
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).
 ### Language Customization for Audio Prompts
 You may need to configure the default LiveKit voice to match your locale. By default, all LiveKit audio instructions are in English.
 To customize the prompts, mount the appropriate audio files as a volume in your deployment. The audio resources are available here: [LiveKit SIP audio files](https://github.com/livekit/sip/tree/main/res).
 ## Documentation
 For detailed information on integrating and configuring SIP with LiveKit, refer to the official LiveKit SIP documentation: [LiveKit SIP Documentation](https://docs.livekit.io/sip/). This guide covers SIP server setup, trunk configuration, dispatch rules, etc.
@@ -1,91 +0,0 @@
 # Transcription
 La Suite Meet provides a room transcription capability, currently available in beta. This feature is under active development, with ongoing enhancements planned.
 The transcription feature enables users to record room sessions. Upon completion of a recording, the room owner receives a notification containing a link to LaSuite Docs, where the transcribed meeting content can be accessed.
 > [!NOTE]
 > Audio recordings are automatically deleted after the configured `RECORDING_EXPIRATION_DAYS` period.
 For configuration and setup details of the recording functionality, refer to the [Recording feature documentation](https://github.com/suitenumerique/meet/blob/main/docs/features/recording.md).
 This page only describes the supplementary tools required for audio processing.
 Example of a transcript : 
 ```
 **SPEAKER_00**: Hello everyone!
 **SPEAKER_01**: Yes, it works.
 ```
 ### Current Limitations
 * Participant identification is not yet implemented; participants are labeled generically (e.g., `PARTICIPANT_1`).
 * Transcription backend relies on [WhisperX](https://github.com/m-bain/whisperX), which does not provide an OpenAI-compatible API.
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).
 ## Special requirements
 To enable the transcription feature, the following components must be in place:
 * Recording feature components: All dependencies and configurations required for the [recording feature](https://github.com/suitenumerique/meet/blob/main/docs/features/recording.md).
 * LaSuite Docs instance: A running [LaSuite Docs](https://github.com/suitenumerique/docs) capable of handling requests to the `/create-for-owner` endpoint.
 * WhisperX API: A running WhisperX service. An open-source implementation combining WhisperX and FastAPI is available [here](https://github.com/suitenumerique/meet-whisperx).
 * Deployment of the [summary service](https://hub.docker.com/r/lasuite/meet-summary), a Celery worker, and a Redis instance.
 ## How It Works
 ```mermaid
 sequenceDiagram
  participant Backend as Backend API
  participant Summary as Summary Service
  participant Celery as Celery Workers (transcribe-queue)
  participant MinIO as MinIO (Object Storage)
  participant STT as WhisperX API
  participant Docs as LaSuite Docs
  Backend->>Summary: POST /api/v1/tasks/ (bearer token, payload)
  Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time
  Summary->>Celery: Register task (transcribe-queue)
  Celery->>MinIO: Fetch audio file
  Celery->>STT: Transcribe audio (WhisperX)
  STT-->>Celery: Segmented transcript
  Celery->>Celery: Format transcript (text)
  Celery->>Docs: POST /create-for-owner (title, content, email, sub, api token)
  Docs-->>Celery: Acknowledgement
 ```
 ## Configuration Options
 | Option                   | Type      | Default                                                               | Description                                                                                                                                                             |
 | ------------------------ | --------- |-----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | app_name                 | String    | `"app"`                                                               | Name of the application/service.                                                                                                                                        |
 | app_api_v1_str           | String    | `"/api/v1"`                                                           | Base path for the API endpoints.                                                                                                                                        |
 | app_api_token            | Secret    | —                                                                     | API token for authenticating requests.                                                                                                                                  |
 | recording_max_duration   | Integer   | `None`                                                                | Maximum duration of audio recordings in milliseconds. Set to `None` for unlimited. Audio recordings longer than the configured limit will be ignored and not processed. |
 | celery_broker_url        | String    | `"redis://redis/0"`                                                   | Celery broker URL.                                                                                                                                                      |
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
 | aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
 | aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
 | aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
 | aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
 | aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |
 | webhook_max_retries      | Integer   | `2`                                                                   | Maximum retries for webhook requests.                                                                                                                                   |
 | webhook_status_forcelist | List[Int] | `[502, 503, 504]`                                                     | HTTP status codes triggering webhook retry.                                                                                                                             |
 | webhook_backoff_factor   | Float     | `0.1`                                                                 | Exponential backoff factor for webhook retries.                                                                                                                         |
 | webhook_api_token        | Secret    | —                                                                     | Token to authenticate incoming webhook requests.                                                                                                                        |
 | webhook_url              | String    | —                                                                     | URL to which webhook events are sent.                                                                                                                                   |
 | document_default_title   | String    | `"Transcription"`                                                     | Default title for generated documents.                                                                                                                                  |
 | document_title_template  | String    | `'Réunion "{room}" du {room_recording_date} à {room_recording_time}'` | Template for document title.                                                                                                                                            |
 | sentry_is_enabled        | Boolean   | `False`                                                               | Enable or disable Sentry error tracking.                                                                                                                                |
 | sentry_dsn               | String    | `None`                                                                | DSN for Sentry integration.                                                                                                                                             |
@@ -1,29 +0,0 @@
 # Installation
 If you want to install La Suite Meet you've come to the right place.
 Here are a bunch of resources to help you install the project.
 ## Kubernetes
 La Suite Meet maintainers use only the Kubernetes deployment method in production, so advanced support is available exclusively for this setup. Please follow the instructions provided [here](/docs/installation/kubernetes.md).
 ## Docker Compose
 We understand that not everyone has a Kubernetes cluster available, please follow the instructions provided [here](/docs/installation/compose.md) to set up a docker compose instance.
 We also provide [Docker images](https://hub.docker.com/u/lasuite?page=1&search=meet) that can be deployed using Compose.
 ## Scalingo
 La Suite Meet can be deployed on Scalingo PaaS using the Suite Numérique buildpack. See the [Scalingo deployment guide](./scalingo.md) for detailed instructions.
 ## Other ways to install La Suite Meet
 Community members have contributed alternative ways to install La Suite Meet 🙏. While maintainers may not provide direct support, we help keep these instructions up to date, and you can reach out to contributors or the community for assistance.
 Here is the list of other methods in alphabetical order:
 - Nix: [Packages](https://search.nixos.org/packages?channel=unstable&show=lasuite-meet&query=lasuite-meet), ⚠️ unstable
 - Yunohost: [Packages](https://github.com/YunoHost-Apps/meet_ynh), ⚠️ under construction (for small instances only)
 > [!TIP]
 > Feel free to make a PR to add ones that are not listed above
 ## Cloud providers
 Currently, no cloud providers are listed for deploying La Suite Meet.
 > [!TIP]
 > Feel free to make a PR to add ones that are not listed above
@@ -1,236 +0,0 @@
 # Installation with docker compose
 We provide a sample configuration for running Meet using Docker Compose. Please note that this configuration is experimental, and the official way to deploy Meet in production is to use [k8s](../installation/kubernetes.md).
 ## Requirements
 All services are required to run the minimalist instance of LaSuite Meet. Click the links for ready-to-use configuration examples:
 | Service           | Purpose | Example Config                                           |
 |-------------------|---------|----------------------------------------------------------|
 | **PostgreSQL**    | Main database | [compose.yaml](../examples/compose/compose.yaml)         |
 | **Redis**         | Cache & sessions | [compose.yaml](../examples/compose/compose.yaml)         |
 | **Livekit**       | Real-time communication | [compose.yaml](../examples/compose/compose.yaml)         |
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |
 > [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
 ## Software Requirements
 Ensure you have Docker Compose(v2) installed on your host server. Follow the official guidelines for a reliable setup:
 Docker Compose is included with Docker Engine:
 - **Docker Engine:** We suggest adhering to the instructions provided by Docker
  for [installing Docker Engine](https://docs.docker.com/engine/install/).
 For older versions of Docker Engine that do not include Docker Compose:
 - **Docker Compose:** Install it as per the [official documentation](https://docs.docker.com/compose/install/).
 > [!NOTE]
 > `docker-compose` may not be supported. You are advised to use `docker compose` instead.
 ## Step 1: Prepare your working environment:
 ```bash
 mkdir -p meet/env.d && cd meet
 curl -o compose.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/compose/compose.yaml
 curl -o .env https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/hosts
 curl -o env.d/common https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/common
 curl -o env.d/postgresql https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/env.d/production.dist/postgresql
 curl -o livekit-server.yaml https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docs/examples/livekit/server.yaml
 curl -o default.conf.template https://raw.githubusercontent.com/suitenumerique/meet/refs/heads/main/docker/files/production/default.conf.template
 ```
 ## Step 2: Configuration
 Meet configuration is achieved through environment variables. We provide a [detailed description of all variables](../../src/helm/meet/README.md).
 In this example, we assume the following services:
 - OIDC provider on https://id.yourdomain.tld
 - Livekit server on https://livekit.yourdomain.tld
 - Meet server on https://meet.yourdomain.tld
 **Set your own values in `.env`**
 ### OIDC
 Authentication in Meet is managed through Open ID Connect protocol. A functional Identity Provider implementing this protocol is required.
 For guidance, refer to our [Keycloak deployment example](../examples/compose/keycloak/README.md).
 If using Keycloak as your Identity Provider, in `env.d/common` set `OIDC_RP_CLIENT_ID` and `OIDC_RP_CLIENT_SECRET` variables with those of the OIDC client created for Meet. By default we have set `meet` as the realm name, if you have named your realm differently, update the value `REALM_NAME` in `.env`
 For others OIDC providers, update the variables in `env.d/common`.
 ### Postgresql
 Meet uses PostgreSQL as its database. Although an external PostgreSQL can be used, our example provides a deployment method.
 If you are using the example provided, you need to generate a secure key for `DB_PASSWORD` and set it in `env.d/postgresql`. 
 If you are using an external service or not using our default values, you should update the variables in `env.d/postgresql`
 ### Redis
 Meet uses Redis for caching and inter-service communication. While an external Redis can be used, our example provides a deployment method.
 If you are using an external service, you need to set `REDIS_URL` environment variable in `env.d/common`.
 ### Livekit
 [LiveKit](https://github.com/livekit/livekit) server is used as the WebRTC SFU (Selective Forwarding Unit) allowing multi-user conferencing. For more information, head to [livekit documentation](https://docs.livekit.io/home/self-hosting/).
 Generate a secure key for `LIVEKIT_API_SECRET` in `env.d/common`.
 We provide a minimal recommended config for production environment in `livekit-server.yaml`. Set the previously generated API secret key in the config file.
 To view other customization options, see [config-sample.yaml](https://github.com/livekit/livekit/blob/master/config-sample.yaml)
 > [!NOTE]
 > In this example, we configured multiplexing on a single UDP port. For better performance, you can configure a range of UDP ports. 
 ### Meet
 The Meet backend is built on the Django Framework.
 Generate a [secure key](https://docs.djangoproject.com/en/5.2/ref/settings/#secret-key.) for `DJANGO_SECRET_KEY` in `env.d/common`. 
 ### Mail
 The following environment variables are required in `env.d/common` for the mail service to send invitations :
 ```env
 DJANGO_EMAIL_HOST=<smtp host> 
 DJANGO_EMAIL_HOST_USER=<smtp user> 
 DJANGO_EMAIL_HOST_PASSWORD=<smtp password>
 DJANGO_EMAIL_PORT=<smtp port> 
 DJANGO_EMAIL_FROM=<your email address>
 #DJANGO_EMAIL_USE_TLS=true # A flag to enable or disable TLS for email sending.
 #DJANGO_EMAIL_USE_SSL=true # A flag to enable or disable SSL for email sending.
 DJANGO_EMAIL_BRAND_NAME=<brand name used in email templates> # e.g. "La Suite Numérique"
 DJANGO_EMAIL_LOGO_IMG=<logo image to use in email templates.> # e.g. "https://meet.yourdomain.tld/assets/logo-suite-numerique.png" 
 ```
 ## Step 3: Configure your firewall
 If you are using a firewall as it is usually recommended in a production environment you will need to allow the webservice traffic on ports 80 and 443 but also to allow UDP traffic for the WebRTC service.
 The following ports will need to be opened:
 - 80/tcp - for TLS issuance
 - 443/tcp - for listening on HTTPS and TURN/TLS packets
 - 7881/tcp - WebRTC ICE over TCP
 - 7882/udp - for WebRTC multiplexing over UDP
 If you are using ufw, enter the following:
 ```
 ufw allow 80/tcp
 ufw allow 443/tcp
 ufw allow 443/udp
 ufw allow 7881/tcp
 ufw allow 7882/udp
 ufw enable
 ``` 
 ## Step 4: Reverse proxy and SSL/TLS
 > [!WARNING]
 > In a production environment, configure SSL/TLS termination to run your instance on https.
 If you have your own certificates and proxy setup, you can skip this part.
 You can follow our [nginx proxy example](../examples/compose/nginx-proxy/README.md) with automatic generation and renewal of certificate with Let's Encrypt. 
 You will need to uncomment the environment and network sections in compose file and update it with your values.
 ```yaml
  frontend:
    ...
    # Uncomment and set your values if using our nginx proxy example
    # environment:
    # - VIRTUAL_HOST=${MEET_HOST} # used by nginx proxy 
    # - VIRTUAL_PORT=8083 # used by nginx proxy
    # - LETSENCRYPT_HOST=${MEET_HOST} # used by lets encrypt to generate TLS certificate
    ...
 # Uncomment if using our nginx proxy example
 #    networks:
 #    - proxy-tier
 #    - default
 ...
    # environment:
    # - VIRTUAL_HOST=${LIVEKIT_HOST} # used by nginx proxy 
    # - VIRTUAL_PORT=7880 # used by nginx proxy
    # - LETSENCRYPT_HOST=${LIVEKIT_HOST} # used by lets encrypt to generate TLS certificate
 # Uncomment if using our nginx proxy example
 #    networks:
 #    - proxy-tier
 #    - default
 #networks:
 #  proxy-tier:
 #    external: true
 ```
 #### Caddy Reverse Proxy
 Expose the Frontend port to the host
 ```yaml
 frontend:
  …
  ports:
    - "8086:8086"
 ```
 ## Step 5: Start Meet
 You are ready to start your Meet application !
 ```bash
 docker compose up -d
 ```
 > [!NOTE]
 > Version of the images are set to latest, you should pin it to the desired version to avoid unwanted upgrades when pulling latest image.
 ## Step 6: Run the database migration and create Django admin user
 ```bash
 docker compose run --rm backend python manage.py migrate
 docker compose run --rm backend python manage.py createsuperuser --email <admin email> --password <admin password>
 ```
 Replace `<admin email>` with the email of your admin user and generate a secure password. 
 Your Meet instance is now available on the domain you defined, https://meet.yourdomain.tld.
 The admin interface is available on https://meet.yourdomain.tld/admin with the admin user you just created.
 ## How to upgrade your Meet application
 Before running an upgrade you must check the [Upgrade document](../../UPGRADE.md) for specific procedures that might be needed.
 You can also check the [Changelog](../../CHANGELOG.md) for brief summary of the changes.
 ### Step 1: Edit the images tag with the desired version
 ### Step 2: Pull the images
 ```bash
 docker compose pull
 ```
 ### Step 3: Restart your containers
 ```bash
 docker compose restart
 ```
 ### Step 4: Run the database migration
 Your database schema may need to be updated, run:
 ```bash
 docker compose run --rm backend python manage.py migrate
 ```
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
lebaudantoine	dc9dedb91b	wip update tag	2024-09-12 11:19:23 +02:00
lebaudantoine	3da3641a19	🚧 (frontend) Add start/stop audio recording menu item Functional but not mergeable—remote participants need to be informed when recording starts, including the egress ID to prevent collisions. Quick and dirty implementation.	2024-09-12 10:58:21 +02:00
lebaudantoine	21626b4c4c	🚧(frontend) show recording status indicator Room recording status triggers only when the egress worker is active. Querying the Egress API starts the worker, which joins the room as an invisible participant. The room is marked as "recording" only once the worker has fully joined. Not mergeable yet. Sadly the room event gives no information about the Egress worker’s ID.	2024-09-12 10:58:19 +02:00
lebaudantoine	f16cedf5a5	🚧(frontend) draft audio-only room recording method (roomId is wrongly named, and designates room’s slug) Room’s slug are passed in filenames to simplify post-processing. Thus, from filename, we can retrieve the room being recorded. Current limitation: audio tracks are mixed, requiring diarization. Future plans include full audio + video recording for a more complete meeting experience.	2024-09-12 10:49:00 +02:00
lebaudantoine	00e4679dc5	🚧(backend) allow room recording Added 'room_record' grant to LiveKit token to enable room recording. Initial implementation allows any authenticated user to record, but this needs refinement. Only admins and persisted room members should have this capability, as they are the ones notified post-recording. Not ready for merge.	2024-09-12 10:49:00 +02:00
		`@@ -1,2 +0,0 @@`
			`web: bin/buildpack_start.sh`
			`postdeploy: python manage.py migrate`
`@@ -1,3 +1,3 @@`
	`#!/usr/bin/env bash`	`#!/bin/bash`

	`find . -name ".enc." -exec sops updatekeys -y {} \;`	`find . -name ".enc." -exec sops updatekeys -y {} \;`
		`@@ -1,4 +0,0 @@`

			`# Live subtitles (WIP)`

			`This feature is currently under development and not yet ready for production use. Documentation and detailed instructions will be provided once the feature is stable and officially released.`
		`@@ -1,4 +0,0 @@`

			`# Meeting summarization (WIP)`

			`This feature is currently under development and not yet ready for production use. Documentation and detailed instructions will be provided once the feature is stable and officially released.`