🔧(summary) add setting to control Sentry traces sampling rate

Replace the deprecated `enable_tracing=True` with `traces_sample_rate`, read from a new `sentry_traces_sample_rate` setting (default 0.1, validated to the 0.0–1.0 range). Previously, tracing sampled 100% of transactions, which is costly and unnecessary in production. The rate can now be tuned per environment without a code change.
🔒️(summary) redact meeting content from Sentry events
2026-10-02 15:38:22 +00:00 · 2026-10-02 17:37:11 +02:00 · 2026-10-02 17:37:11 +02:00 · 2026-10-02 17:36:07 +02:00 · 2026-10-02 17:35:32 +02:00 · 2026-10-02 17:35:32 +02:00
115 changed files with 5444 additions and 3205 deletions
@@ -0,0 +1,9 @@
+[codespell]
+# Files that are not English, or generated
+skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
+  ./LICENSES,
+  ./src/summary/summary/core/locales,
+  ./src/summary/summary/core/prompt.py
+# Valid words in French (connexion) or in the code (statics)
+ignore-words-list = connexion,statics
+check-filenames = true
@@ -0,0 +1,20 @@
+# Debian 13 base image (python:3.14-slim): no fixed version available yet.
+# Review regularly and remove entries once Debian ships a fix.
+
+# util-linux
+CVE-2026-76642
+CVE-2026-78408
+CVE-2026-78409
+CVE-2026-78410
+
+# acl
+CVE-2026-54369
+
+# ncurses
+CVE-2025-69720
+
+# systemd
+CVE-2026-16742
+
+# perl-base (fix deferred by Debian)
+CVE-2026-9538
@@ -1,28 +0,0 @@
---
-name: 🐛 Bug Report
-about: If something is not working as expected 🤔.
-
---
-
-## Bug Report
-
-**Problematic behavior**
-A clear and concise description of the behavior.
-
-**Expected behavior/code**
-A clear and concise description of what you expected to happen (or code).
-
-**Steps to Reproduce**
-1. Do this...
-2. Then this...
-3. And then the bug happens!
-
-**Environment**
- Meet version:
- Platform:
-
-**Possible Solution**
-<!--- Only if you have suggestions on a fix for the bug -->
-
-**Additional context/Screenshots**
-Add any other context about the problem here. If applicable, add screenshots to help explain.
@@ -1,23 +0,0 @@
---
-name: ✨ Feature Request
-about: I have a suggestion (and may want to build it 💪)!
-
---
-
-## Feature Request
-
-**Is your feature request related to a problem or unsupported use case? Please describe.**
-A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen. Add any considered drawbacks.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Discovery, Documentation, Adoption, Migration Strategy**
-If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
-Maybe a screenshot or design?
-
-**Do you want to work on it through a Pull Request?**
-<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->
@@ -1,22 +0,0 @@
---
-name: 🤗 Support Question
-about: If you have a question 💬, or something was not clear from the docs!
-
---
-
-<!-- ^ Click "Preview" for a nicer view! ^
-We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
-
---
-
-Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
-
-Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
-
-If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
-
-**Topic**
-What's the general area of your question: for example, docker setup, database schema, search functionality,...
-
-**Question**
-Try to be as specific as possible so we can help you as best we can. Please be patient 🙏
@@ -1,11 +0,0 @@
-## Purpose
-
-Description...
-
-
-## Proposal
-
-Description...
-
- [] item 1...
- [] item 2...
@@ -0,0 +1,19 @@
+name: Changelog Workflow
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  changelog:
+    uses: suitenumerique/ci/.github/workflows/_changelog.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
@@ -11,180 +11,30 @@ permissions:
  contents: read

 jobs:
-  lint-git:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 0
-      - name: show
-        run: git log
-      - name: Enforce absence of print statements in code
-        if: always()
-        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
-      - name: Check absence of fixup commits
-        if: always()
-        run: |
-          ! git log | grep 'fixup!'
-      - name: Install uv
-        if: always()
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Lint commit messages added to main
-        if: always()
-        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD

-  check-changelog:
-    runs-on: ubuntu-latest
-    if: |
-      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
-      github.event_name == 'pull_request'
-    permissions:
-        contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 50
-      - name: Check that the CHANGELOG has been modified in the current branch
-        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
-
-  lint-changelog:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Check CHANGELOG max line length
-        run: |
-          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
-          if [ $max_line_length -ge 80 ]; then
-            echo "ERROR: CHANGELOG has lines longer than 80 characters."
-            exit 1
-          fi
-
-  build-mails:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/mail
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: "22"
-
-      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-      - name: Install yarn
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g --ignore-scripts yarn@1.22.22
-
-      - name: Install node dependencies
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile --ignore-scripts
-
-      - name: Build mails
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn build
-
-      - name: Cache mail templates
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-  lint-back:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/backend
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
-
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
-      - name: Lint code with pylint
-        run: uv run --no-sync --no-build pylint meet demo core
-
-  lint-agents:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/agents
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras --no-build
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
-
-  lint-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/summary
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the project
-        run: uv sync --locked --all-extras
-      - name: Check code formatting with ruff
-        run: uv run --no-sync --no-build ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run --no-sync --no-build ruff check .
+  lint-python:
+    name: lint ${{ matrix.service }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - service: backend
+            working_directory: src/backend
+            pylint_targets: meet demo core
+          - service: agents
+            working_directory: src/agents
+            pylint_targets: ""
+          - service: summary
+            working_directory: src/summary
+            pylint_targets: ""
+    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      working_directory: ${{ matrix.working_directory }}
+      python_version: "3.13"
+      pylint_targets: ${{ matrix.pylint_targets }}

  test-back:
    runs-on: ubuntu-latest
-    needs: build-mails
    permissions:
      contents: read
    defaults:
@@ -226,8 +76,9 @@ jobs:
      REDIS_URL: redis://localhost:6379/1
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
      AWS_S3_ENDPOINT_URL: http://localhost:9000
-      AWS_S3_ACCESS_KEY_ID: meet
-      AWS_S3_SECRET_ACCESS_KEY: password
+      AWS_S3_ACCESS_KEY_ID: meet-access-key
+      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
+      AWS_S3_REGION_NAME: local
      OIDC_RS_CLIENT_ID: meet
      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
@@ -243,41 +94,25 @@ jobs:
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static

-      - name: Restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+      - name: Build or restore the mail templates
+        uses: suitenumerique/ci/actions/mail-templates@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1

-      - name: Start MinIO
+      # Creates the access key and the bucket on startup
+      - name: Start Garage
        run: |
-          docker pull quay.io/minio/minio
-          docker run -d --name minio \
+          docker run -d --name garage \
            -p 9000:9000 \
-            -e "MINIO_ACCESS_KEY=meet" \
-            -e "MINIO_SECRET_KEY=password" \
-            -v /data/media:/data \
-            quay.io/minio/minio server --console-address :9001 /data
+            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
+            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
+            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
+            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
+            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
+            dxflrs/garage:v2.4.1 \
+            /garage server --single-node --default-bucket

-      # Tool to wait for a service to be ready
-      - name: Install Dockerize
+      - name: Wait for Garage to be ready
        run: |
-          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
-            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
-            sudo tar -C /usr/local/bin -xzv
-
-      - name: Wait for MinIO to be ready
-        run: |
-          dockerize -wait tcp://localhost:9000 -timeout 10s
-
-      - name: Configure MinIO
-        run: |
-          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
-          docker exec ${MINIO} sh -c \
-            "mc alias set meet http://localhost:9000 meet password && \
-            mc alias ls && \
-            mc mb meet/meet-media-storage"
+          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'

      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -310,9 +145,9 @@ jobs:
    env:
      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
-      AWS_S3_ENDPOINT_URL: "minio:9000"
-      AWS_S3_ACCESS_KEY_ID: "meet"
-      AWS_S3_SECRET_ACCESS_KEY: "password"
+      AWS_S3_ENDPOINT_URL: "garage:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
+      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
      WHISPERX_BASE_URL: "https://configure-your-url.com"
      WHISPERX_ASR_MODEL: "large-v2"
      WHISPERX_API_KEY: "test-whisperx-secret"
@@ -0,0 +1,14 @@
+name: Project quality Workflow
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      print_check_paths: src/backend src/summary src/agents
+      codespell_ignore_words: "unsecure"
@@ -1,33 +0,0 @@
-name: Download Crowdin translations
-
-on:
-  workflow_dispatch:
-    types: [file-fully-translated]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  crowdin:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Download Crowdin files
-        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
-        with:
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          localization_branch_name: l10n_crowdin_translations
-          create_pull_request: true
-          pull_request_title: "New Crowdin translations"
-          pull_request_body: "New Crowdin pull request with translations"
-          pull_request_base_branch_name: "main"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-          CROWDIN_BASE_PATH: ${{ github.workspace }}
@@ -1,5 +1,5 @@
-name: Docker Hub Workflow
-run-name: Docker Hub Workflow
+name: Docker images
+run-name: Docker images

 on:
  workflow_dispatch:
@@ -15,265 +15,62 @@ on:
 permissions:
  contents: read

-env:
-  DOCKER_USER: 1001:127
-  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
-  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
-  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
-  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-
 jobs:
-  build-and-push-backend:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          target: backend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend-generic:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./src/frontend/Dockerfile
-          target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend-dinum:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        with:
-          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./docker/dinum-frontend/Dockerfile
-          target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/summary/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
-          docker-context: './src/summary'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: ./src/summary
-          file: ./src/summary/Dockerfile
-          target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-agents:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      -
-        name: Set up QEMU
-        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: lasuite/meet-agents
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Run trivy scan
-        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
-        continue-on-error: true
-        with:
-          docker-build-args: '-f src/agents/Dockerfile --target production'
-          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
-          docker-context: './src/agents'
-      -
-        name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: ./src/agents
-          file: ./src/agents/Dockerfile
-          target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+  build-and-push:
+    name: ${{ matrix.service }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - service: backend
+            image_name: lasuite/meet-backend
+            context: .
+            file: ./Dockerfile
+            target: backend-production
+          - service: frontend
+            image_name: lasuite/meet-frontend
+            context: .
+            file: ./src/frontend/Dockerfile
+            target: frontend-production
+          - service: frontend-dinum
+            image_name: lasuite/meet-frontend-dinum
+            context: .
+            file: ./docker/dinum-frontend/Dockerfile
+            target: frontend-production
+          - service: summary
+            image_name: lasuite/meet-summary
+            context: ./src/summary
+            file: ./src/summary/Dockerfile
+            target: production
+          - service: agents
+            image_name: lasuite/meet-agents
+            context: ./src/agents
+            file: ./src/agents/Dockerfile
+            target: production
+    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      image_name: ${{ matrix.image_name }}
+      context: ${{ matrix.context }}
+      file: ${{ matrix.file }}
+      target: ${{ matrix.target }}
+      docker_user: "1001:127"
+      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
+      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+      trivy_scan: true
+      trivy_ignore_files: ./.github/.trivyignore
+    secrets:
+      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
+      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}

  notify-argocd:
    permissions:
      contents: read
    needs:
-      - build-and-push-frontend-generic
-      - build-and-push-frontend-dinum
-      - build-and-push-backend
-      - build-and-push-summary
-      - build-and-push-agents
+      - build-and-push
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
+      - uses: suitenumerique/ci/actions/argocd-webhook-notification@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
        id: notify
        with:
          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
@@ -1,33 +1,17 @@
-name: Release Chart
-run-name: Release Chart
+name: Release Helm chart

 on:
  push:
+    branches:
+      - main
    paths:
      - src/helm/meet/**

+permissions:
+  contents: read
+
 jobs:
  release:
    permissions:
      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 0
-
-      - name: Cleanup
-        run: rm -rf ./src/helm/extra
-
-      - name: Install Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
-        with:
-          charts_dir: ./src/helm
-          linting: on
-          token: ${{ secrets.GITHUB_TOKEN }}
+    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
@@ -0,0 +1,21 @@
+name: Security analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - "**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    with:
+      config: .github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "suitenumerique/*": ref-pin
@@ -10,6 +10,53 @@ and this project adheres to

 ### Added

+- 🔒(backend) throttle meeting link generation
+- 🔒️(backend) add a daily cap on room creation
+- 🔧(summary) add setting to control Sentry traces sampling rate
+
+### Fixed
+
+- 🐛(frontend) enforce recording-mode permissions on the checkboxes
+- 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
+- 🔒️(backend) fix HIGH CVEs in Django and urllib3
+- 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
+- 🔒️(frontend) upgrade pcre2 to fix CVE-2026-103111
+- 🐛(summary) disable default S3 checksums for GCS-compatible storage
+- 🔒️(summary) redact meeting content from Sentry events
+
+## [1.33.0] - 2026-09-30
+
+### Added
+
+- ✨(backend) purge rooms inactive for a configurable period
+- 🔨(makefile) add targets to list and download files stored in Garage
+
+### Changed
+
+- ⬆️(backend) update python dependencies
+- ⬆️(summary) update python dependencies
+- ⬆️(agents) update python dependencies
+- ♻️(agents) replace the minio client by boto3
+- 🔧(compose) replace MinIO by Garage for local development
+- 🔧(helm) point media services to Garage by default
+- 💥(backend) replace recording encoding options with a profile model
+
+### Fixed
+
+- 🔒️(backend) fix critical and high CVEs in PyJWT
+- ⚡️(frontend) disable posthog-js periodic feature flag reloads
+
+## [1.32.1] - 2026-09-25
+
+### Fixed
+
+- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
+- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
+
+## [1.32.0] - 2026-09-25
+
+### Added
+
 - ✨(backend) make the LiveKit default video codec configurable
 - 🔧(dev) add support for Bureautix workstations
 - ✨(frontend) add screen share zoom controls #1498
@@ -28,7 +75,7 @@ and this project adheres to
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.1
+- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
 - 🔖(helm) release chart 0.0.28
 - ♻️(backend) decouple recording event handling from LiveKit egress statuses

@@ -365,7 +412,7 @@ and this project adheres to

 ### Fixed

- ♿️(frontend) improve accessibilty of the Effects panel #1401
+- ♿️(frontend) improve accessibility of the Effects panel #1401

 ## [1.20.0] - 2026-06-12

@@ -37,14 +37,13 @@ RUN --mount=type=cache,target=/root/.cache/uv \
  uv sync --locked --no-dev

 # ---- mails ----
-FROM node:22 AS mail-builder
+FROM node:22-alpine AS mail-builder

 COPY ./src/mail /mail/app

 WORKDIR /mail/app

-RUN yarn install --frozen-lockfile && \
-  yarn build
+RUN npm ci --ignore-scripts && npm run build


 # ---- static link collector ----
@@ -69,6 +69,22 @@ LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT)
 # -- Frontend
 PATH_FRONT          = ./src/frontend

+# -- Storage
+GARAGE_BUCKET       = meet-media-storage
+STORAGE_FOLDERS     = recordings transcripts summaries
+STORAGE_DIRS        = $(addprefix data/,$(STORAGE_FOLDERS))
+COMPOSE_RUN_AWS     = $(COMPOSE_RUN) --user $(DOCKER_USER)
+AWS_CLI             = garage-cors --endpoint-url=http://garage:9000
+# Extensions listed in each folder (skips the Egress manifests in recordings/)
+recordings_EXTENSIONS  = mp4 ogg
+transcripts_EXTENSIONS = json
+summaries_EXTENSIONS   = txt
+# $(1): folder. Lists its objects with a known extension, most recent first
+storage_list        = s3api list-objects-v2 --bucket $(GARAGE_BUCKET) \
+  --prefix $(1)/
+storage_query       = reverse(sort_by(Contents[?$(foreach ext,$($(1)_EXTENSIONS), \
+  ends_with(Key, `".$(ext)"`) ||) `false`] || `[]`, &LastModified))
+
 # ==============================================================================
 # RULES

@@ -77,6 +93,9 @@ default: help
 data/media:
 	@mkdir -p data/media

+$(STORAGE_DIRS):
+	@mkdir -p $@
+
 data/static:
 	@mkdir -p data/static

@@ -85,6 +104,7 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
+	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
@@ -317,12 +337,38 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret

+env.d/development/garage:
+	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
+		env.d/development/garage.dist > env.d/development/garage
+
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber

 env.d/development/metadata_collector:
 	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector

+# -- Storage
+
+recordings-download-latest: ## download the latest recording from Garage into data/recordings
+transcripts-download-latest: ## download the latest transcript from Garage into data/transcripts
+summaries-download-latest: ## download the latest summary from Garage into data/summaries
+$(STORAGE_FOLDERS:%=%-download-latest): %-download-latest: data/%
+	@key=$$($(COMPOSE_RUN_AWS) -T $(AWS_CLI) $(call storage_list,$*) \
+		--query '$(call storage_query,$*)[0].Key' --output text) && \
+	if [ "$$key" = "None" ]; then echo "No $* found"; exit 1; fi && \
+	$(COMPOSE_RUN_AWS) --volume $(CURDIR)/data/$*:/aws/data/$* \
+		$(AWS_CLI) s3 cp "s3://$(GARAGE_BUCKET)/$$key" data/$*/
+.PHONY: $(STORAGE_FOLDERS:%=%-download-latest)
+
+recordings-list: ## list recordings stored in Garage, most recent first
+transcripts-list: ## list transcripts stored in Garage, most recent first
+summaries-list: ## list summaries stored in Garage, most recent first
+$(STORAGE_FOLDERS:%=%-list): %-list:
+	@$(COMPOSE_RUN_AWS) $(AWS_CLI) $(call storage_list,$*) \
+		--query '$(call storage_query,$*)[].{Date: LastModified, Key: Key, "Size (bytes)": Size}' \
+		--output table
+.PHONY: $(STORAGE_FOLDERS:%=%-list)
+
 # -- Internationalization

 env.d/development/crowdin:
@@ -16,6 +16,165 @@ the following command inside your docker container:

 ## [Unreleased]

+### Purging inactive rooms
+
+Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
+
+- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
+- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
+- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
+- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
+- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
+
+* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
+* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
+
+### Local development: MinIO replaced by Garage
+
+The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
+
+To migrate a local environment:
+
+1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
+2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
+3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
+4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
+5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
+
+### Summary service and metadata collector: boto3 replaces the minio client
+
+The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
+Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
+
+Also:
+- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
+- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
+
+### Helm chart: media services default to Garage
+
+The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
+### Recording encoding settings replaced by a resolution/profile model
+
+The `RECORDING_ENCODING_*` settings introduced in v1.16.0 exposed raw encoder
+values (width, height, framerate, bitrate). They are replaced by two named and configurable sets of
+dimensions, a **resolution** (default: `540p`, `720p`, `1080p`) and a **profile**
+(default: `talking_heads`, `text`, `mixed`, `full`), which are resolved to the width, height,
+fps and video bitrate.
+
+**The following environment variables are no longer read. If they are still set in
+your deployment they are silently ignored, and your recordings will be encoded with
+the new defaults instead of your tuned values.**
+
+| Removed variable                        | Replaced by                                                                                                   |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| `RECORDING_ENCODING_ENABLED`            | Nothing. A default encoding is now always built (see below). **Not** `RECORDING_CUSTOM_ENCODING_ENABLED`, which gates a different feature. |
+| `RECORDING_ENCODING_WIDTH`              | The `width` of the entry selected by `RECORDING_ENCODING_DEFAULT_RESOLUTION` in `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`. |
+| `RECORDING_ENCODING_HEIGHT`             | The `height` of that same entry.                                                                              |
+| `RECORDING_ENCODING_FRAMERATE`          | The `fps` of the profile selected by `RECORDING_ENCODING_DEFAULT_PROFILE` in `RECORDING_ENCODING_AVAILABLE_PROFILES`. |
+| `RECORDING_ENCODING_VIDEO_BITRATE_KBPS` | That profile's `kbps`.                                                                  |
+
+`RECORDING_ENCODING_AUDIO_BITRATE_KBPS` and `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S`
+keep their names and meaning. The keyframe interval now defaults to `0` (unset,
+encoder's choice) instead of `4.0`.
+
+#### If you never set `RECORDING_ENCODING_ENABLED=True`
+
+The shipped defaults (`RECORDING_ENCODING_DEFAULT_PROFILE=full`,
+`RECORDING_ENCODING_DEFAULT_RESOLUTION=720p`) match LiveKit's built-in
+`H264_720P_30` preset: 1280×720, 30 fps, 3000 kbps H.264 MAIN, 128 kbps AAC.
+Video output is therefore unchanged.
+
+Audio and keyframing may not be. These values are now sent explicitly as advanced
+`EncodingOptions` rather than relying on LiveKit's preset, so
+`RECORDING_ENCODING_AUDIO_BITRATE_KBPS` and `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S`
+now apply to every recording. They previously applied only when
+`RECORDING_ENCODING_ENABLED` was `True`. **If you set either of them while the
+feature was disabled, they had no effect and now do**; check them before upgrading.
+
+If you never set them, no action is required: 128 kbps AAC is what the preset used,
+and the keyframe interval now defaults to `0`, which leaves the field unset so the
+encoder keeps picking it as before. Set `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0`
+if you want fixed 4-second keyframes (the value the setting defaulted to while it
+was gated behind `RECORDING_ENCODING_ENABLED`).
+
+To keep letting LiveKit pick the encoding instead, set either default to an empty
+value:
+
+```
+RECORDING_ENCODING_DEFAULT_RESOLUTION=
+RECORDING_ENCODING_DEFAULT_PROFILE=
+```
+
+#### If you had tuned `RECORDING_ENCODING_*` values
+
+Translate your old values into a default resolution and a default profile. Declare your own resolution and/or profile. Both maps are read from the
+environment as a single-line Python/JSON dict literal (parsed with
+`ast.literal_eval`, so use double-quoted keys and no trailing commas, and do not
+add outer quotes in `.env`-style files):
+
+```bash
+RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}
+RECORDING_ENCODING_AVAILABLE_PROFILES={"my_old_profile": {"fps": 15, "kbps": {"540p": 350, "720p": 600, "1080p": 1100}}}
+RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
+RECORDING_ENCODING_DEFAULT_PROFILE=my_old_profile
+```
+
+Both maps are validated at startup and a malformed one raises a `ValueError`:
+
+- every entry of `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS` must declare `width` and
+  `height`, and every entry of `RECORDING_ENCODING_AVAILABLE_PROFILES` an `fps` and a
+  `kbps` map;
+- every profile must define a `kbps` entry for **exactly** the keys of
+  `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`; overriding one of the two maps usually
+  means overriding both;
+- `RECORDING_ENCODING_DEFAULT_RESOLUTION` and `RECORDING_ENCODING_DEFAULT_PROFILE`,
+  when non-empty, must be keys of their respective map.
+
+#### Breaking: custom worker services must accept `encoding_options`
+
+Only concerns deployments pointing `RECORDING_WORKER_CLASSES` at their own worker
+class. The shipped `VideoCompositeEgressService` and `AudioCompositeEgressService`
+are already updated.
+
+The `WorkerService` protocol's `start()` takes a third argument, and the mediator
+now always passes it as a keyword when the recording carries no per-recording encoding:
+
+```python
+# before
+def start(self, room_id: str, recording_id: str) -> str: ...
+
+# now
+def start(
+    self,
+    room_id: str,
+    recording_id: str,
+    encoding_options: Optional[Dict[str, Any]] = None,
+) -> str: ...
+```
+
+#### Optional: per-recording encoding
+
+`RECORDING_CUSTOM_ENCODING_ENABLED` (default `False`) toggles whether the
+start-recording API accepts an `encoding` object
+(`{"resolution": "720p", "profile": "talking_heads"}`, `profile` optional. It
+falls back to `RECORDING_ENCODING_DEFAULT_PROFILE`) that overrides the default for
+a single recording. It does not enable or disable the
+default encoding, which is built from the two `RECORDING_ENCODING_DEFAULT_*`
+settings either way. Leaving it at `False` preserves the previous behaviour, where
+every recording uses the server-side encoding: requests carrying
+`options.encoding` are rejected with a `400` before the recording is created, so
+nothing is persisted and no egress is started.
+
+Before enabling it:
+
+- clients can only pick keys you declared; there is no way to send a raw width or bitrate
+- as of this implementation, the frontend never sends `encoding` 
+- `encoding` is accepted but ignored for `transcript` recordings, whose audio-only
+  egress has no video encoding to configure.
+
+See [docs/features/recording.md](docs/features/recording.md#tuning-recording-encoding)
+for the full setting reference, the shipped profile table and the tuning caveats.
+
 ## v1.30.0

 ### Removing S3 storage-event webhooks for recordings
@@ -104,8 +104,8 @@ k8s_yaml(secret_yaml_generic(

 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))

-k8s_resource('minio-bucket', resource_deps=['minio'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
+k8s_resource('garage-cors', resource_deps=['garage'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
@@ -55,12 +55,12 @@ function _docker_compose() {
 function _dc_run() {
    _set_user

-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
+    user_args=()
+    if [ -n "$USER_ID" ]; then
+        user_args=("--user=$USER_ID")
    fi

-    _docker_compose run --rm $user_args "$@"
+    _docker_compose run --rm "${user_args[@]}" "$@"
 }

 # _dc_exec: wrap docker compose exec command
@@ -74,12 +74,12 @@ function _dc_exec() {

    echo "🐳(compose) exec command: '\$@'"

-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
+    user_args=()
+    if [ -n "$USER_ID" ]; then
+        user_args=("--user=$USER_ID")
    fi

-    _docker_compose exec $user_args "$@"
+    _docker_compose exec "${user_args[@]}" "$@"
 }

 # _django_manage: wrap django's manage.py command with docker compose
@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1

    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
+    echo "[custom-logo] INFO: Custom logo downloaded successfully"
 fi

 mv src/backend/* ./
@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &

 # if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
+trap 'pkill -TERM -P $$' SIGTERM

 # wait for a single child to finish,
 wait -n
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -o errexit

-CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -30,10 +29,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
    echo "Please provide the following information:"
-    read -p "Enter your Vaultwarden email login: " LOGIN
-    read -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -r -p "Enter your Vaultwarden email login: " LOGIN
+    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
    echo
-    read -p "Enter your Vaultwarden server url: " URL
+    read -r -p "Enter your Vaultwarden server url: " URL
 }

 # Create and apply the secret
@@ -77,7 +76,7 @@ main() {
        exit 0
    fi

-    echo -e ${TEMP_SECRET_FILE}
+    echo -e "${TEMP_SECRET_FILE}"

    get_user_input
    echo -e "\nCreating Vaultwarden secret…"
@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"

-cat <<'EOF' >$PRE_COMMIT_FILE
+cat <<'EOF' >"$PRE_COMMIT_FILE"
 #!/bin/bash

 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF

-chmod +x $PRE_COMMIT_FILE
+chmod +x "$PRE_COMMIT_FILE"
@@ -68,7 +68,7 @@ fi

 # Ask user for release version number
 echo ""
-read -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -r -p "Enter release version number (e.g., 1.2.3): " VERSION

 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash

 git submodule update --init --recursive
+# shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=

 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done
@@ -15,36 +15,44 @@ services:
    ports:
      - "1081:1080"

-  minio:
+  garage:
    user: ${DOCKER_USER:-1000}
-    image: quay.io/minio/minio
+    image: dxflrs/garage:v2.4.1
+    command: /garage server --single-node --default-bucket
+    env_file:
+      - env.d/development/garage
    environment:
-      - MINIO_ROOT_USER=meet
-      - MINIO_ROOT_PASSWORD=password
+      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
+      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
+      - GARAGE_DEFAULT_BUCKET=meet-media-storage
    ports:
-      - '9000:9000'
-      - '9001:9001'
+      - '127.0.0.1:9000:9000'
    healthcheck:
-      test: [ "CMD", "mc", "ready", "local" ]
+      test: [ "CMD", "/garage", "health" ]
      interval: 1s
      timeout: 20s
      retries: 300
-    entrypoint: ""
-    command: minio server --console-address :9001 /data
    volumes:
-      - ./data/media:/data
+      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
+      - ./data/media:/var/lib/garage

-  createbuckets:
-    image: quay.io/minio/mc
+  # Garage denies cross-origin requests by default: allow the frontend to upload files
+  garage-cors:
+    image: amazon/aws-cli:2.37.1
+    environment:
+      - AWS_ACCESS_KEY_ID=meet-access-key
+      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
+      - AWS_DEFAULT_REGION=local
    depends_on:
-      minio:
+      garage:
        condition: service_healthy
        restart: true
-    entrypoint: >
-      sh -c "
-      /usr/bin/mc alias set meet http://minio:9000 meet password && \
-      /usr/bin/mc mb meet/meet-media-storage && \
-      exit 0;"
+    command:
+      - s3api
+      - put-bucket-cors
+      - --endpoint-url=http://garage:9000
+      - --bucket=meet-media-storage
+      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'

  app-dev:
    build:
@@ -70,7 +78,7 @@ services:
        - postgresql
        - mailcatcher
        - redis
-        - createbuckets
+        - garage-cors
    extra_hosts:
      - "127.0.0.1.nip.io:host-gateway"
    networks:
@@ -110,7 +118,7 @@ services:
      - postgresql
      - redis
      - livekit
-      - minio
+      - garage

  celery:
    user: ${DOCKER_USER:-1000}
@@ -145,6 +153,7 @@ services:
      target: frontend-production
      args:
        VITE_API_BASE_URL: "http://localhost:8071"
+        VITE_MEDIA_BASE_URL: "http://localhost:8083"
        VITE_APP_TITLE: "LaSuite Meet"
    image: meet:frontend-development
    ports:
@@ -164,7 +173,7 @@ services:
    working_dir: /app

  node:
-    image: node:22
+    image: node:22-alpine
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
@@ -244,7 +253,7 @@ services:
      - /app/.venv
    depends_on:
      - livekit
-      - minio
+      - garage
    develop:
      watch:
        - action: rebuild
@@ -263,7 +272,7 @@ services:
      - /app/.venv

  redis-summary:
-    image: redis
+    image: redis:5
    ports:
      - "6379:6379"

@@ -297,7 +306,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - minio
+      - garage
    develop:
      watch:
        - action: rebuild
@@ -317,7 +326,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - minio
+      - garage
    develop:
      watch:
        - action: rebuild
@@ -163,7 +163,7 @@ in
      REDIS_URL = "redis://127.0.0.1:6379/1";
      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";

-      # S3 / MinIO
+      # S3 / Garage
      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";

      # OIDC
@@ -1,7 +1,7 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
 # otherwise all connections fail during the build.

 x-proxy-vars: &proxy-vars
@@ -19,7 +19,9 @@ services:
    <<: *keep-id
  celery-dev:
    <<: *keep-id
-  minio:
+  garage:
+    <<: *keep-id
+  garage-cors:
    <<: *keep-id
  node:
    <<: *keep-id
@@ -58,6 +58,7 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production

 USER root
 RUN apk upgrade --no-cache libexpat && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' && \
    apk del curl
 USER nginx

@@ -0,0 +1,15 @@
+# Garage configuration for local development only: single node, no replication.
+# See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+db_engine = "lmdb"
+
+replication_factor = 1
+
+rpc_bind_addr = "127.0.0.1:3901"
+rpc_public_addr = "127.0.0.1:3901"
+
+[s3_api]
+api_bind_addr = "[::]:9000"
+# Clients must sign their requests for this region (AWS_S3_REGION_NAME)
+s3_region = "local"
@@ -4,6 +4,36 @@ server {
    server_name localhost;
    charset utf-8;

+    # Proxy auth for recordings (authorized by the recordings viewset)
+    location /media/recordings/ {
+        auth_request /media-auth-recordings;
+        auth_request_set $authHeader $upstream_http_authorization;
+        auth_request_set $authDate $upstream_http_x_amz_date;
+        auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+        proxy_set_header Authorization $authHeader;
+        proxy_set_header X-Amz-Date $authDate;
+        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+        proxy_pass http://garage:9000/meet-media-storage/recordings/;
+        proxy_set_header Host garage:9000;
+        proxy_hide_header Content-Disposition;
+        add_header Content-Disposition "attachment";
+    }
+
+    location = /media-auth-recordings {
+        internal;
+        proxy_pass http://app-dev:8000/api/v1.0/recordings/media-auth/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Original-URL $request_uri;
+
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-Method $request_method;
+    }
+
    # Proxy auth for media
    location /media/ {
        # Auth request configuration
@@ -17,9 +47,9 @@ server {
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;

-        # Get resource from Minio
-        proxy_pass http://minio:9000/meet-media-storage/;
-        proxy_set_header Host minio:9000;
+        # Get resource from Garage
+        proxy_pass http://garage:9000/meet-media-storage/;
+        proxy_set_header Host garage:9000;
        # To use with ds_proxy
        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
        # proxy_set_header Host ds-proxy:4444;
@@ -13,7 +13,7 @@ These components rely on a few key services:

 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
- MinIO for storing files (room recordings)
+- Garage for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)

 We provide two stack options for getting Visio up and running for development:
@@ -93,13 +93,13 @@ sequenceDiagram
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |
 | **RECORDING_MAX_DURATION**              | Integer     | `None`                                                                                                                                                             | Maximum duration of a recording in milliseconds. Must be synced with the LiveKit Egress configuration. Set to None for unlimited duration. When the maximum duration is reached, the recording is automatically stopped and saved, and the user is prompted in the frontend with an alert message. |
-| **RECORDING_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | When `False`, LiveKit Egress uses its built-in `H264_720P_30` preset. When `True`, the `RECORDING_ENCODING_*` values below are sent to LiveKit as advanced `EncodingOptions`. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
-| **RECORDING_ENCODING_WIDTH**            | Integer     | `1280`                                                                                                                                                             | Recording video width in pixels. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                         |
-| **RECORDING_ENCODING_HEIGHT**           | Integer     | `720`                                                                                                                                                              | Recording video height in pixels. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                        |
-| **RECORDING_ENCODING_FRAMERATE**        | Integer     | `30`                                                                                                                                                               | Recording video framerate (fps). Directly impacts egress worker CPU (roughly linear). Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                    |
-| **RECORDING_ENCODING_VIDEO_BITRATE_KBPS** | Integer   | `3000`                                                                                                                                                             | H.264 MAIN video bitrate in kbps. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                        |
-| **RECORDING_ENCODING_AUDIO_BITRATE_KBPS** | Integer   | `128`                                                                                                                                                              | AAC audio bitrate in kbps. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                               |
-| **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `4.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `4.0` is a standard VOD value. Only applied when `RECORDING_ENCODING_ENABLED` is `True`. |
+| **RECORDING_CUSTOM_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | Whether the start-recording API accepts a per-recording `encoding` object (resolution/profile) that overrides the default. When `False`, the API rejects per-recording `encoding`; when `True`, clients may pick from the available resolutions/profiles. The default encoding below is applied regardless of this flag. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
+| **RECORDING_ENCODING_AVAILABLE_RESOLUTIONS** | Dict      | `{"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}`                                        | Maps a resolution name to its `{"width", "height"}` in pixels. Both the default encoding and the per-recording start-recording API pick from these keys.                                                                                                                                          |
+| **RECORDING_ENCODING_AVAILABLE_PROFILES** | Dict      | `{"full": {"fps": 30, "kbps": {…}}, …}`               | Maps a profile name to `{"fps", "kbps": {resolution: video_bitrate_kbps}}`. Every profile must define a bitrate for each available resolution (validated at startup).                                                                                                                              |
+| **RECORDING_ENCODING_DEFAULT_RESOLUTION** | String    | `"720p"`                                                                                                                                                          | Resolution used by the default encoding. When set, must be a key of `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`. Leave unset (together with, or instead of, the default profile) to disable the custom default encoding and fall back to LiveKit's built-in preset (a startup warning is emitted).                                                                                                                                                                  |
+| **RECORDING_ENCODING_DEFAULT_PROFILE**  | String    | `"full"`                                                                                                                                                          | Profile used by the default encoding. When set, must be a key of `RECORDING_ENCODING_AVAILABLE_PROFILES`. Leave unset (together with, or instead of, the default resolution) to disable the custom default encoding and fall back to LiveKit's built-in preset (a startup warning is emitted).                                                                                                                                                                        |
+| **RECORDING_ENCODING_AUDIO_BITRATE_KBPS** | Integer   | `128`                                                                                                                                                              | AAC audio bitrate in kbps used in the default encoding.                                                                                                                                                                                                               |
+| **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `0.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `0` leaves the field unset, letting the encoder pick; `4.0` is a standard VOD value. |


 > [!NOTE]
@@ -130,52 +130,59 @@ This allows you to verify which recordings are in progress, troubleshoot egress

 ## Tuning recording encoding

-By default, LiveKit Egress records with the built-in `H264_720P_30` preset: 1280×720 at 30 fps, 3000 kbps H.264 MAIN video and 128 kbps AAC audio. For a one-hour meeting this produces a file of roughly **1.4 GB**, which is often heavier than necessary for talking-head content and screen sharing.
+Every video recording is encoded from a default resolved from `RECORDING_ENCODING_DEFAULT_PROFILE` + `RECORDING_ENCODING_DEFAULT_RESOLUTION` and passed to LiveKit as advanced `EncodingOptions`. The shipped defaults (`full` profile) match LiveKit's built-in `H264_720P_30` preset. For a one-hour meeting that produces a file of roughly **1.4 GB**, which is often heavier than necessary for talking-head content and screen sharing; lowering the default profile/resolution shrinks it. If either default is left unset, no custom default encoding is built: a warning is logged at startup and LiveKit's built-in preset is used instead.

-The `RECORDING_ENCODING_*` settings let operators override this preset without modifying the source. Values are passed straight through LiveKit's `EncodingOptions.advanced` to the GStreamer pipeline (`x264enc` for video, `faac` for audio), so there are no hidden conversions — what you set is what the encoder receives.
+Encoding is chosen from two maps: `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS` (`resolution → {"width", "height"}`) and `RECORDING_ENCODING_AVAILABLE_PROFILES` (`profile → {"fps", "kbps": {resolution: video_bitrate_kbps}}`):
+
+- **Default**: `RECORDING_ENCODING_DEFAULT_PROFILE` + `RECORDING_ENCODING_DEFAULT_RESOLUTION` set the encoding used by every recording that doesn't override it. Leave either unset to fall back to LiveKit's built-in preset (a startup warning is emitted).
+- **Per recording (opt-in)**: set `RECORDING_CUSTOM_ENCODING_ENABLED=True` to let clients override the default per recording. The start-recording API then accepts an `encoding` object selecting a `resolution` (required) and `profile` (optional): a resolution-only request keeps `RECORDING_ENCODING_DEFAULT_PROFILE` for fps and bitrate, so clients can only pick from pre-defined values. When `RECORDING_CUSTOM_ENCODING_ENABLED=False`, the API rejects any per-recording `encoding` and the default is used.
+
+The resolved values are passed straight through LiveKit's `EncodingOptions.advanced` to the GStreamer pipeline (`x264enc` for video, `faac` for audio), so there are no hidden conversions — what the profile/resolution resolve to is what the encoder receives.

 ### How values map to GStreamer

-| Setting                               | GStreamer element | Property                           |
-| ------------------------------------- | ----------------- | ---------------------------------- |
-| `RECORDING_ENCODING_WIDTH/HEIGHT`     | capsfilter        | `video/x-raw,width=W,height=H`     |
-| `RECORDING_ENCODING_FRAMERATE`        | capsfilter        | `framerate=F/1`                    |
-| `RECORDING_ENCODING_VIDEO_BITRATE_KBPS` | `x264enc`       | `bitrate=kbps` (kilobits)          |
-| `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S` | `x264enc`     | `key-int-max = interval × fps`     |
-| `RECORDING_ENCODING_AUDIO_BITRATE_KBPS` | `faac`          | `bitrate = kbps × 1000` (bits)     |
+| Resolved value                            | GStreamer element | Property                           |
+| ----------------------------------------- | ----------------- | ---------------------------------- |
+| resolution `width` / `height`             | capsfilter        | `video/x-raw,width=W,height=H`     |
+| profile `fps`                             | capsfilter        | `framerate=F/1`                    |
+| profile `kbps[resolution]`                | `x264enc`         | `bitrate=kbps` (kilobits)          |
+| `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S` | `x264enc`         | `key-int-max = interval × fps`     |
+| `RECORDING_ENCODING_AUDIO_BITRATE_KBPS`   | `faac`            | `bitrate = kbps × 1000` (bits)     |

 The H.264 profile is fixed to MAIN and the x264 `speed-preset` to `veryfast` by LiveKit (real-time constraint) — lowering the framerate is therefore the main lever to save CPU, while lowering the bitrate is the main lever to shrink the output file.

-### Reference profiles
+### Built-in profiles

-Rough 30-minute file-size estimates assume video + audio bitrate multiplied by duration. Actual sizes vary with content (static talking heads compress better than heavy screen motion). Egress CPU figures are indicative, measured on a single Ryzen laptop core saturated by the default preset (= 100 %); scaling is roughly linear with `framerate × bitrate` but the absolute numbers depend on the host hardware.
+The default `RECORDING_ENCODING_AVAILABLE_PROFILES` ship four profiles. Framerate is fixed per profile; video bitrate (kbps) scales with resolution so quality stays consistent across sizes. File size scales roughly with `framerate × bitrate`, and so does egress CPU cost.

-| Profile                | Resolution | FPS | Video (kbps) | Audio (kbps) | Keyframe (s) | ~ size / 30 min | Egress CPU (vs. default) | Suitable for                                        |
-| ---------------------- | ---------- | --- | ------------ | ------------ | ------------ | --------------- | ------------------------ | --------------------------------------------------- |
-| Default (preset)       | 1280×720   | 30  | 3000         | 128          | 4            | **~690 MB**     | 100 %                    | Unchanged LiveKit behaviour                         |
-| Balanced               | 1280×720   | 20  | 1000         | 96           | 4            | ~240 MB         | ~67 %                    | Mixed content, moderate motion                      |
-| **Low CPU / small file** | 1280×720 | 15  | 600          | 64           | 4            | **~150 MB**     | ~50 %                    | Talking-head dominant meetings + occasional slides ★ |
-| Slide-heavy            | 1280×720   | 15  | 900          | 64           | 4            | ~210 MB         | ~55 %                    | Frequent dense screen sharing (decks, IDE, docs)    |
-| Minimum CPU            | 960×540    | 15  | 500          | 64           | 4            | ~125 MB         | ~30 %                    | Voice-first meetings, readable text not required    |
-| Audio-heavy fallback   | 1280×720   | 10  | 400          | 96           | 4            | ~110 MB         | ~35 %                    | Long webinars, low motion                           |
+| Profile         | FPS | 540p (kbps) | 720p (kbps) | 1080p (kbps) | Suitable for                                       |
+| --------------- | --- | ----------- | ----------- | ------------ | -------------------------------------------------- |
+| `talking_heads` | 15  | 400         | 700         | 1200         | Talking-head dominant meetings + occasional slides |
+| `text`          | 15  | 600         | 1000        | 1800         | Frequent dense screen sharing (decks, IDE, docs)   |
+| `mixed`         | 20  | 900         | 1500        | 2500         | Mixed content, moderate motion                     |
+| `full`          | 30  | 2000        | 3000        | 4500         | Highest fidelity; closest to the LiveKit default preset    |

-★ Recommended starting point for typical LaSuite Meet usage.
+To pick a profile per recording (requires `RECORDING_CUSTOM_ENCODING_ENABLED=True`), the client sends it in the start-recording request:

-Environment variables for the **Low CPU / small file** profile:
+```json
+{
+  "mode": "screen_recording",
+  "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}}
+}
+```
+
+To change the default encoding applied to every recording:

 ```bash
-RECORDING_ENCODING_ENABLED=True
-RECORDING_ENCODING_WIDTH=1280
-RECORDING_ENCODING_HEIGHT=720
-RECORDING_ENCODING_FRAMERATE=15
-RECORDING_ENCODING_VIDEO_BITRATE_KBPS=600
+RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
+RECORDING_ENCODING_DEFAULT_PROFILE=talking_heads
 RECORDING_ENCODING_AUDIO_BITRATE_KBPS=64
 RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0
 ```

 ### Caveats

- **Screen-share readability — think bits/frame, not bitrate**: at 720p, text legibility starts to break down below ~40 kbits/frame (= `bitrate ÷ framerate`). The recommended preset (600 kbps × 15 fps) sits at exactly that threshold, comfortable for talking heads with occasional slide sharing. The same 600 kbps at 30 fps would only deliver 20 kbits/frame and visibly blur dense slides — which is why **lowering framerate is a more screen-share-friendly lever than lowering bitrate**. For deck-heavy or IDE-share meetings, prefer the **Slide-heavy** profile (900 kbps × 15 fps ≈ 60 kbits/frame).
+- **Screen-share readability — think bits/frame, not bitrate**: at 720p, text legibility starts to break down below ~40 kbits/frame (= `bitrate ÷ framerate`). The `talking_heads` profile (700 kbps × 15 fps) sits just above that threshold, comfortable for talking heads with occasional slide sharing. The same bitrate at 30 fps would only deliver ~23 kbits/frame and visibly blur dense slides — which is why **lowering framerate is a more screen-share-friendly lever than lowering bitrate**. For deck-heavy or IDE-share meetings, prefer the **`text`** profile (1000 kbps × 15 fps ≈ 67 kbits/frame).
 - **Motion handling**: the `veryfast` x264 preset is set by LiveKit and cannot be overridden here. Low-bitrate settings will therefore show more artefacts on fast motion than an offline re-encode with a slower preset would. This is the other reason FPS reduction is the safer tuning lever for meeting recordings.
 - **Audio**: AAC at 64 kbps stereo is transparent for voice but starts to compress music noticeably. Keep 128 kbps if you expect music playback in meetings.
 - **Codec choice**: H.264 MAIN is hardcoded on purpose. Switching to HEVC or VP9 would increase egress CPU cost 2×–5×, defeating the goal of this tuning.
@@ -0,0 +1,40 @@
+# Room purge
+
+Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
+
+## How it works
+
+Each time LiveKit tells the backend that a room has started (`room_started` webhook), the backend records the date on the room (`last_started_at`).
+A room is inactive when:
+
+- it was last started more than `ROOM_INACTIVITY_DELETION_DAYS` days ago, or
+- it was never started and was created more than `ROOM_INACTIVITY_DELETION_DAYS` days ago.
+
+Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
+
+The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
+
+```bash
+python manage.py purge_inactive_rooms            # delete the inactive rooms
+python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
+```
+
+## Rooms that are kept
+
+A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
+
+- with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
+- with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
+
+## What happens to a purged room
+
+The room is deleted from the database, along with its accesses, its telephony PIN code, and the recording entries it still holds — the expired ones and those that were never saved, since any other recording would have protected the room — together with their own accesses.
+
+The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
+
+⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
+and can be reused when a meeting is created from that same URL.
+
+* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
+
+* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
@@ -42,7 +42,7 @@ sequenceDiagram
  participant Backend as Backend API
  participant Summary as Summary Service
  participant Celery as Celery Workers (transcribe-queue)
-  participant MinIO as MinIO (Object Storage)
+  participant S3 as S3 (Object Storage)
  participant STT as WhisperX API
  participant Docs as LaSuite Docs

@@ -50,7 +50,7 @@ sequenceDiagram
  Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time

  Summary->>Celery: Register task (transcribe-queue)
-  Celery->>MinIO: Fetch audio file
+  Celery->>S3: Fetch audio file
  Celery->>STT: Transcribe audio (WhisperX)
  STT-->>Celery: Segmented transcript

@@ -72,11 +72,12 @@ sequenceDiagram
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
-| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
-| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
-| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
-| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
-| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
+| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3 bucket used for storing recordings.                                                                                                                      |
+| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3 storage.                                                                                                                                         |
+| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3.                                                                                                                                                      |
+| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3.                                                                                                                                                      |
+| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3 requests.                                                                                                                                              |
+| aws_s3_region_name       | String    | —                                                                     | Region used to sign S3 requests, passed as-is to boto3.                                                                                                                 |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |
@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |

-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.


 ## Software Requirements
@@ -14,7 +14,7 @@ This document is a step-by-step guide that describes how to install LaSuite Meet

 If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.

-IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed.

 To be able to use the script, you will need to install the following components:

@@ -311,119 +311,122 @@ frontend:

 These are the environmental options available on meet backend.

-| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                       |
-|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                         |
-| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
-| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
-| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
-| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
-| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
-| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |
-| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                          |
-| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                     |
-| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                          |
-| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
-| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                               |
-| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                               |
-| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                               |
-| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                               |
-| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                            |
-| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                         |
-| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                          |
-| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                              |
-| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                    |
-| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                    |
-| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                         |
-| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                            |
-| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                               |
-| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                            |
-| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                            |
-| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                         |
-| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                          |
-| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                            |
-| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                               |
-| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                         |
-| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                         |
-| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
-| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                               |
-| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                               |
-| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                         |
-| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                         |
-| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                              |
-| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                               |
-| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                               |
-| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                               |
-| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                               |
-| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                               |
-| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                         |
-| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                            |
-| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                            |
-| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                               |
-| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                          |
-| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                            |
-| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                          |
-| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                          |
-| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                         |
-| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                         |
-| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                          |
-| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                               |
-| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                               |
-| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                               |
-| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                               |
-| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                               |
-| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                          |
-| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                               |
-| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                            |
-| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                  |
-| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                          |
-| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                         |
-| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                            |
-| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                          |
-| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                      |
-| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                  |
-| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                    |
-| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                            |
-| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                         |
-| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                          |
-| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                            |
-| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                               |
-| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                               |
-| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                               |
-| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                          |
-| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                               |
-| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                               |
-| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                               |
-| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                          |
-| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                         |
-| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
-| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
-| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
-| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
-| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
+| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                      |
+|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                        |
+| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                           |
+| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
+| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                           |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                        |
+| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                       |
+| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                         |
+| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                        |
+| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                         |
+| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                    |
+| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                         |
+| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                      |
+| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                              |
+| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                              |
+| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                              |
+| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                              |
+| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                           |
+| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                        |
+| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                         |
+| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
+| ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
+| ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
+| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
+| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
+| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
+| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                           |
+| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                              |
+| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                           |
+| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                           |
+| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                           |
+| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                        |
+| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                         |
+| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                           |
+| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                              |
+| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                        |
+| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                        |
+| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                  |
+| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                              |
+| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                              |
+| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                              |
+| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                              |
+| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                        |
+| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                        |
+| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                             |
+| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                              |
+| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                              |
+| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                              |
+| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                              |
+| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                              |
+| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                        |
+| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                           |
+| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                           |
+| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                              |
+| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                         |
+| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                           |
+| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                         |
+| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                         |
+| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                        |
+| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                        |
+| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                         |
+| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                              |
+| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                              |
+| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                              |
+| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                              |
+| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                              |
+| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                         |
+| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                              |
+| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                           |
+| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                 |
+| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                         |
+| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                        |
+| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                           |
+| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                         |
+| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                     |
+| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                 |
+| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                   |
+| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                           |
+| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                        |
+| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                         |
+| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                           |
+| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                              |
+| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                              |
+| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                              |
+| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                         |
+| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                              |
+| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                              |
+| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                              |
+| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                         |
+| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                        |
+| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                        |
+| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                       |
+| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
+| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
+| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
+| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
-| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                               |
-| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                               |
-| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                               |
-| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                               |
-| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                               |
-| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                         |
-| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                 |
-| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                               |
-| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                            |
-| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                          |
-| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                             |
-| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                    |
-| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                             |
-| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                             |
-| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                               |
-| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                            |
-| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                            |
-| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                              |
-| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                         |
-| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                            |
-| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                             |
+| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
+| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                              |
+| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                              |
+| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                              |
+| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                              |
+| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                        |
+| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                |
+| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                              |
+| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                           |
+| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                         |
+| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                            |
+| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                   |
+| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                            |
+| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                            |
+| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                              |
+| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                           |
+| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                           |
+| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                             |
+| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                        |
+| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                           |
+| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                            |
@@ -24,9 +24,10 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=http://garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True

@@ -63,23 +64,39 @@ ALLOW_UNREGISTERED_ROOMS=False

 # Recording
 RECORDING_ENABLE=True
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
+SUMMARY_SERVICE_VERSION=2
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording

+
 # Recording encoding (LiveKit Egress advanced options).
-# When RECORDING_ENCODING_ENABLED is False (default), LiveKit uses its built-in
-# H264_720P_30 preset (1280x720, 30fps, 3000 kbps). Enable and tune to reduce
-# file size and CPU load on the egress worker.
-# RECORDING_ENCODING_ENABLED=False
-# RECORDING_ENCODING_WIDTH=1280
-# RECORDING_ENCODING_HEIGHT=720
-# RECORDING_ENCODING_FRAMERATE=30
-# RECORDING_ENCODING_VIDEO_BITRATE_KBPS=3000
+# Every video recording is encoded with parameters (height, width, fps, kbps) derived
+# from the pair (profile, resolution) and passed to LiveKit as advanced EncodingOptions.
+# Choose the available resolutions and profiles that default settings and users can 
+# pick from. They must be defined as a single-line dict literal (parsed with 
+# ast.literal_eval: double-quoted keys, no trailing comma, no outer quotes). 
+# Every profile must define a kbps entry for exactly the keys of
+# RECORDING_ENCODING_AVAILABLE_RESOLUTIONS (validated at startup).
+# RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}
+# RECORDING_ENCODING_AVAILABLE_PROFILES={"talking_heads": {"fps": 15, "kbps": {"540p": 400, "720p": 700, "1080p": 1200}}, "text": {"fps": 15, "kbps": {"540p": 600, "720p": 1000, "1080p": 1800}}, "mixed": {"fps": 20, "kbps": {"540p": 900, "720p": 1500, "1080p": 2500}}, "full": {"fps": 30, "kbps": {"540p": 2000, "720p": 3000, "1080p": 4500}}}
+
+
+# Choose the default named resolution and profile to use by default. These values must
+# be keys of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS and RECORDING_ENCODING_AVAILABLE_PROFILES.
+# RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
+# RECORDING_ENCODING_DEFAULT_PROFILE=full
+
+# Default encoding values independent of resolution/profile
 # RECORDING_ENCODING_AUDIO_BITRATE_KBPS=128
 # RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0

+# Set to True to let the start-recording API override that default per recording
+# with an `encoding` object, e.g. {"resolution": "720p", "profile": "talking_heads"}.
+# RECORDING_CUSTOM_ENCODING_ENABLED=False
+
+
 # Telephony
 ROOM_TELEPHONY_ENABLED=True

@@ -0,0 +1,2 @@
+# Filled with a random value by `make create-env-files`
+GARAGE_RPC_SECRET=
@@ -2,8 +2,9 @@ LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret

-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 AWS_STORAGE_BUCKET_NAME=meet-media-storage
 AWS_S3_SECURE_ACCESS=False
@@ -1,6 +1,7 @@
-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local

 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
@@ -2,11 +2,12 @@ APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"

 AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="minio:9000"
+AWS_S3_ENDPOINT_URL="garage:9000"
 AWS_S3_SECURE_ACCESS=false

-AWS_S3_ACCESS_KEY_ID="meet"
-AWS_S3_SECRET_ACCESS_KEY="password"
+AWS_S3_ACCESS_KEY_ID="meet-access-key"
+AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
+AWS_S3_REGION_NAME="local"

 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"
@@ -1,5 +1,5 @@
 {
-  "extends": ["github>numerique-gouv/renovate-configuration"],
+  "extends": ["github>suitenumerique/ci//renovate/default"],
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
@@ -10,7 +10,7 @@
      "license": "MIT",
      "dependencies": {
        "core-js": "3.50.0",
-        "i18next": "26.4.1",
+        "i18next": "26.4.2",
        "i18next-browser-languagedetector": "8.2.1",
        "regenerator-runtime": "0.14.1"
      },
@@ -9367,9 +9367,9 @@
      }
    },
    "node_modules/i18next": {
-      "version": "26.4.1",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.1.tgz",
-      "integrity": "sha512-9YbX5E6gd1H+yaOSX3izCsPj5iWXyH7X4oC+iuHHJJw8AeHglzOK5SJf+1CHxaYKYigcea+8jvzSxqYx46YvyA==",
+      "version": "26.4.2",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
+      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
      "funding": [
        {
          "type": "individual",
@@ -27,7 +27,7 @@
  },
  "dependencies": {
    "core-js": "3.50.0",
-    "i18next": "26.4.1",
+    "i18next": "26.4.2",
    "i18next-browser-languagedetector": "8.2.1",
    "regenerator-runtime": "0.14.1"
  },
@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
        document.querySelector("#close-msg").style.display = "block";
      })
      .catch((e) => {
-        console.error(`Error occured: ${e}`);
+        console.error(`Error occurred: ${e}`);
      })
      .finally(() => {
        // NOTE: doesn't work with the desktop client — the browser considers
@@ -1,10 +1,12 @@
-FROM python:3.14.6-slim AS base
+FROM python:3.14.7-slim AS base

 # Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
 RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
    && apt-get update && apt-get install -y --no-install-recommends  \
    libglib2.0-0 \
    libgobject-2.0-0 \
+    libpcre2-8-0 \
+    libssl3t64 \
    && rm -rf /var/lib/apt/lists/*


@@ -6,9 +6,11 @@ import logging
 import os
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
-from io import BytesIO
 from typing import List, Optional

+import boto3
+from botocore.config import Config
+from botocore.exceptions import BotoCoreError, ClientError
 from dotenv import load_dotenv
 from livekit import api, rtc
 from livekit.agents import (
@@ -28,8 +30,6 @@ from livekit.agents import (
    room_io as lk_room_io,
 )
 from livekit.plugins import silero
-from minio import Minio
-from minio.error import S3Error

 from exceptions import MissingConfigError
 from observability import configure_sentry, set_job_context
@@ -59,6 +59,30 @@ server = AgentServer(
 server.setup_fnc = prewarm


+def create_s3_client():
+    """Create an S3 client for the configured endpoint and region.
+
+    The endpoint may be given with or without a scheme: the scheme always
+    follows AWS_S3_SECURE_ACCESS.
+    """
+    endpoint = (
+        os.getenv("AWS_S3_ENDPOINT_URL", "")
+        .removeprefix("https://")
+        .removeprefix("http://")
+        .rstrip("/")
+    )
+    secure = os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true"
+
+    return boto3.client(
+        "s3",
+        endpoint_url=f"{'https' if secure else 'http'}://{endpoint}",
+        aws_access_key_id=os.getenv("AWS_S3_ACCESS_KEY_ID"),
+        aws_secret_access_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
+        region_name=os.getenv("AWS_S3_REGION_NAME"),
+        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
+    )
+
+
@dataclass
 class MetadataEvent:
    """A single timestamped event recorded during a meeting."""
@@ -121,18 +145,13 @@ class MetadataCollector:

    def __init__(self, ctx: JobContext, recording_id: str):
        """Initialize metadata agent."""
-        self.minio_client = Minio(
-            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
-            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
-            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
-            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
-        )
-
        if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
            self.bucket_name = bucket_name
        else:
            raise MissingConfigError

+        self.s3_client = create_s3_client()
+
        self.ctx = ctx
        self._sessions: dict[str, AgentSession] = {}
        self._tasks: set[asyncio.Task] = set()
@@ -201,20 +220,18 @@ class MetadataCollector:
        }

        data = json.dumps(payload, indent=2).encode("utf-8")
-        stream = BytesIO(data)

        try:
-            self.minio_client.put_object(
-                self.bucket_name,
-                self.output_filename,
-                stream,
-                length=len(data),
-                content_type="application/json",
+            self.s3_client.put_object(
+                Bucket=self.bucket_name,
+                Key=self.output_filename,
+                Body=data,
+                ContentType="application/json",
            )
            logger.info(
                "Uploaded speaker meeting metadata",
            )
-        except S3Error:
+        except (BotoCoreError, ClientError):
            logger.exception(
                "Failed to upload meeting metadata",
            )
@@ -1,24 +1,24 @@

 [project]
 name = "agents"
-version = "1.31.0"
+version = "1.33.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.6.7",
-    "livekit-plugins-deepgram==1.6.7",
-    "livekit-plugins-silero==1.6.7",
+    "livekit-agents==1.7.0",
+    "livekit-plugins-deepgram==1.7.0",
+    "livekit-plugins-silero==1.7.0",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.2",
-    "protobuf==6.33.6",
-    "minio==7.2.20",
-    "sentry-sdk==2.66.1",
+    "boto3==1.43.56",
+    "python-dotenv==1.2.3",
+    "protobuf==7.36.0",
+    "sentry-sdk==2.68.1",
    "websockets==17.1",
    "httpx==0.28.1",
 ]

 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.0",
+    "ruff==0.16.4",
 ]

 [tool.uv]
@@ -279,9 +279,16 @@ class RoomAdmin(admin.ModelAdmin):

    inlines = (ResourceAccessInline,)
    search_fields = ["name", "slug", "=id"]
-    list_display = ["name", "slug", "access_level", "get_owner", "created_at"]
-    list_filter = ["access_level", "created_at"]
-    readonly_fields = ["id", "created_at", "updated_at"]
+    list_display = [
+        "name",
+        "slug",
+        "access_level",
+        "get_owner",
+        "created_at",
+        "last_started_at",
+    ]
+    list_filter = ["access_level", "created_at", "last_started_at"]
+    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]

    def get_queryset(self, request):
        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
@@ -13,7 +13,12 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _

 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import BaseModel, Field, field_serializer
+from pydantic import (
+    BaseModel,
+    Field,
+    field_serializer,
+    field_validator,
+)
 from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
@@ -244,6 +249,49 @@ class BaseValidationOnlySerializer(serializers.Serializer):
        raise NotImplementedError(f"{self.__class__.__name__} is validation-only")


+class EncodingConfig(BaseModel):
+    """Configuration options for recording encoding.
+
+    The allowed `resolution` and `profile` values are derived at validation time
+    from ``settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`` and
+    ``settings.RECORDING_ENCODING_AVAILABLE_PROFILES``, so adding a resolution or profile
+    to those maps is enough to make it accepted here.
+
+    Attributes:
+        resolution: Target video resolution.
+        profile: Encoding profile to fps and kbps. When `None`,
+        `settings.RECORDING_ENCODING_DEFAULT_PROFILE` applies.
+    """
+
+    resolution: str
+    profile: str | None = None
+    model_config = {"extra": "forbid"}
+
+    @field_validator("resolution")
+    @classmethod
+    def _validate_resolution(cls, value):
+        """Reject resolutions absent from RECORDING_ENCODING_AVAILABLE_RESOLUTIONS."""
+        allowed = set(settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS)
+        if value not in allowed:
+            raise ValueError(
+                f"Invalid resolution '{value}'. Choose from {sorted(allowed)}."
+            )
+        return value
+
+    @field_validator("profile")
+    @classmethod
+    def _validate_profile(cls, value):
+        """Reject profiles absent from RECORDING_ENCODING_AVAILABLE_PROFILES."""
+        if value is None:
+            return None
+        allowed = set(settings.RECORDING_ENCODING_AVAILABLE_PROFILES)
+        if value not in allowed:
+            raise ValueError(
+                f"Invalid profile '{value}'. Choose from {sorted(allowed)}."
+            )
+        return value
+
+
 class RecordingOptions(BaseModel):
    """Configuration options for recording.

@@ -264,7 +312,7 @@ class RecordingOptions(BaseModel):
    transcribe: bool | None = None
    collect_metadata: bool | None = None
    original_mode: Literal["screen_recording", "transcript"] | None = None
-
+    encoding: EncodingConfig | None = None
    model_config = {"extra": "forbid"}


@@ -287,6 +335,22 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
        help_text="Recording options",
    )

+    def validate_options(self, value: RecordingOptions):
+        """Validate that custom encoding is enabled if encoding options are passed."""
+        if (
+            value is not None
+            and value.encoding is not None
+            and not settings.RECORDING_CUSTOM_ENCODING_ENABLED
+        ):
+            # Per-recording encoding selection is gated by
+            # RECORDING_CUSTOM_ENCODING_ENABLED. When disabled, recordings use
+            # encoding defined by RECORDING_ENCODING_DEFAULT_RESOLUTION
+            # and RECORDING_ENCODING_DEFAULT_PROFILE.
+            raise serializers.ValidationError(
+                "Per-recording encoding selection is disabled."
+            )
+        return value
+

 class RequestEntrySerializer(BaseValidationOnlySerializer):
    """Validate request entry data."""
@@ -20,6 +20,33 @@ class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
    """Throttle for the monitored scoped rate throttle."""


+class RoomCreationUserRateThrottle(MonitoredUserRateThrottle):
+    """Throttle room creation per authenticated user.
+
+    Can be declared at the viewset level: every action other than "create"
+    is left unthrottled, so the same class can be reused on any viewset
+    exposing a room creation endpoint.
+    """
+
+    scope = "room_creation"
+
+    def get_cache_key(self, request, view):
+        """Throttle only room creations."""
+        if getattr(view, "action", None) != "create":
+            return None
+        return super().get_cache_key(request, view)
+
+
+class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
+    """Cap room creation per authenticated user over a day.
+
+    Complements the short-term RoomCreationUserRateThrottle, which absorbs
+    bursts but lets a user steadily create rooms over hours or days.
+    """
+
+    scope = "room_creation_daily"
+
+
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
    """Throttle authenticated user requesting room entry"""

@@ -55,6 +55,7 @@ from core.recording.worker.exceptions import (
    RecordingStopError,
 )
 from core.recording.worker.factories import (
+    build_encoding_options,
    get_worker_service,
 )
 from core.recording.worker.mediator import (
@@ -180,6 +181,10 @@ class RoomViewSet(
    permission_classes = [permissions.RoomPermissions]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
+    throttle_classes = [
+        throttling.RoomCreationUserRateThrottle,
+        throttling.RoomCreationDailyUserRateThrottle,
+    ]

    def get_object(self):
        """Allow getting a room by its slug."""
@@ -323,12 +328,20 @@ class RoomViewSet(
        options = serializer.validated_data.get("options")
        room = self.get_object()

+        options_data = options.model_dump(exclude_none=True) if options else {}
+        if options is not None and options.encoding is not None:
+            # Persist the resolved encoding (concrete width/height/framerate/
+            # bitrate) alongside the requested resolution/profile for traceability.
+            options_data["encoding"]["resolved"] = build_encoding_options(
+                options.encoding.resolution, options.encoding.profile
+            )
+
        try:
            with transaction.atomic():
                recording = models.Recording.objects.create(
                    room=room,
                    mode=mode,
-                    options=options.model_dump(exclude_none=True) if options else {},
+                    options=options_data,
                )
                models.RecordingAccess.objects.create(
                    user=self.request.user,
@@ -0,0 +1,94 @@
+"""Purge inactive rooms."""
+
+from datetime import timedelta
+from itertools import batched
+from logging import getLogger
+
+from django.conf import settings
+from django.core.management.base import BaseCommand
+from django.db.models import Exists, OuterRef, Q
+from django.utils import timezone
+
+from core.models import Recording, RecordingStatusChoices, Room
+
+logger = getLogger(__name__)
+
+CHUNK_SIZE = 500
+
+
+class Command(BaseCommand):
+    """
+    Delete rooms that have not been started for ROOM_INACTIVITY_DELETION_DAYS days:
+    - rooms which were last started before that period
+    - rooms never started and created before that period
+
+    Rooms holding a saved recording that has not expired are kept.
+    """
+
+    help = "Purge inactive rooms"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="List the rooms that would be purged without deleting them",
+        )
+
+    def handle(self, *args, **options):
+        """Browse inactive rooms and delete them chunk by chunk."""
+
+        if not settings.ROOM_INACTIVITY_DELETION_DAYS:
+            self.stdout.write(
+                "Purging inactive rooms is disabled "
+                "(ROOM_INACTIVITY_DELETION_DAYS is not set)."
+            )
+            return
+
+        now = timezone.now()
+        inactive_rooms = self.get_inactive_rooms(now)
+
+        inactive_count = inactive_rooms.count()
+        if not inactive_count:
+            self.stdout.write("No inactive room to purge.")
+            return
+
+        if options["dry_run"]:
+            self.stdout.write(
+                f"[dry-run] {inactive_count} inactive room(s) would be purged:"
+            )
+            names = inactive_rooms.values_list("name", flat=True)
+            for name in names.iterator(chunk_size=CHUNK_SIZE):
+                self.stdout.write(f"- {name}")
+            return
+
+        purged_count = 0
+        rooms = inactive_rooms.values_list("pk", "slug").iterator(chunk_size=CHUNK_SIZE)
+        for chunk in batched(rooms, CHUNK_SIZE, strict=False):
+            for room_id, slug in chunk:
+                logger.info("Purging inactive room %s (%s)", room_id, slug)
+
+            _, deleted_by_model = inactive_rooms.filter(
+                pk__in=[room_id for room_id, _ in chunk]
+            ).delete()
+            purged_count += deleted_by_model.get("core.Room", 0)
+
+        self.stdout.write(f"Purged {purged_count} inactive room(s).")
+
+    @staticmethod
+    def get_inactive_rooms(now):
+        """Return the rooms inactive for too long that no recording protects."""
+
+        threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
+        is_inactive = Q(last_started_at__lt=threshold) | Q(
+            last_started_at__isnull=True, created_at__lt=threshold
+        )
+
+        protected_recordings = Recording.objects.filter(
+            room=OuterRef("pk"), status__in=RecordingStatusChoices.saved_statuses()
+        )
+        if settings.RECORDING_EXPIRATION_DAYS:
+            protected_recordings = protected_recordings.filter(
+                created_at__gte=now - timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
+            )
+
+        return Room.objects.filter(is_inactive, ~Exists(protected_recordings))
@@ -0,0 +1,18 @@
+from django.db import migrations, models
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0023_alter_recording_status'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='room',
+            name='last_started_at',
+            field=models.DateTimeField(blank=True, default=django.utils.timezone.now, editable=False, help_text='date and time at which the room was last started', null=True, verbose_name='last started at'),
+            preserve_default=False,
+        ),
+    ]
@@ -87,6 +87,17 @@ class RecordingStatusChoices(models.TextChoices):
            cls.FAILED_TO_STOP,
        }

+    @classmethod
+    def saved_statuses(cls):
+        """Return the statuses of a recording whose file users can access."""
+
+        return {
+            cls.NOTIFICATION_SUCCEEDED,
+            cls.SAVED,
+            cls.EXTERNAL_PROCESS_SUCCESSFUL,
+            cls.EXTERNAL_PROCESS_FAILED,
+        }
+

 class RecordingModeChoices(models.TextChoices):
    """Recording mode choices."""
@@ -426,6 +437,13 @@ class Room(Resource):
        verbose_name=_("Room PIN code"),
        help_text=_("Unique n-digit code that identifies this room in telephony mode."),
    )
+    last_started_at = models.DateTimeField(
+        verbose_name=_("last started at"),
+        help_text=_("date and time at which the room was last started"),
+        blank=True,
+        null=True,
+        editable=False,
+    )

    class Meta:
        db_table = "meet_room"
@@ -682,12 +700,7 @@ class Recording(BaseModel):
    @property
    def is_saved(self) -> bool:
        """Check if the recording is in a saved state."""
-        return self.status in {
-            RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
-            RecordingStatusChoices.SAVED,
-            RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL,
-            RecordingStatusChoices.EXTERNAL_PROCESS_FAILED,
-        }
+        return self.status in RecordingStatusChoices.saved_statuses()

    @property
    def extension(self):
@@ -22,6 +22,46 @@ _RECORDING_AUDIO_CODEC = livekit_api.AudioCodec.AAC
 _RECORDING_AUDIO_FREQUENCY_HZ = 48000


+def build_encoding_options(resolution, profile=None):
+    """Assemble the LiveKit ``EncodingOptions`` kwargs for a resolution/profile.
+
+    Single source of truth shared by the default encoding
+    (``WorkerServiceConfig.from_settings``) and the per-recording encoding
+    persisted by the start-recording API, so both paths always produce the
+    same shape.
+
+    The profile-independent fields (audio bitrate, keyframe interval and the
+    pinned codec / frequency constants) are always included.
+
+    An omitted profile falls back to RECORDING_ENCODING_DEFAULT_PROFILE.
+    Framerate and bitrate are left to LiveKit only when the operator
+    declared no default profile at all.
+    """
+    profile = profile or settings.RECORDING_ENCODING_DEFAULT_PROFILE
+
+    options: Dict[str, Any] = {
+        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
+        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
+        "video_codec": _RECORDING_VIDEO_CODEC,
+        "audio_codec": _RECORDING_AUDIO_CODEC,
+        "audio_frequency": _RECORDING_AUDIO_FREQUENCY_HZ,
+    }
+
+    if resolution:
+        resolution_config = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[
+            resolution
+        ]
+        options["width"] = resolution_config["width"]
+        options["height"] = resolution_config["height"]
+
+    if resolution and profile:
+        profile_config = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
+        options["framerate"] = profile_config["fps"]
+        options["video_bitrate"] = profile_config["kbps"][resolution]
+
+    return options
+
+
@dataclass(frozen=True)
 class WorkerServiceConfig:
    """Declare Worker Service common configurations"""
@@ -38,22 +78,16 @@ class WorkerServiceConfig:

        logger.debug("Loading WorkerServiceConfig from settings.")

+        # The default encoding is resolved from the default profile/resolution and
+        # applied to every recording that carries no per-recording encoding.
+        # When either default is missing, we leave this as None so LiveKit falls
+        # back to its built-in preset.
+        resolution = settings.RECORDING_ENCODING_DEFAULT_RESOLUTION
+        profile = settings.RECORDING_ENCODING_DEFAULT_PROFILE
+
        encoding_options: Optional[Dict[str, Any]] = None
-        if settings.RECORDING_ENCODING_ENABLED:
-            # Single source of truth for the EncodingOptions kwargs:
-            # operator-tunable values live in Django settings, codec / frequency
-            # are pinned constants. The services layer only unpacks this dict.
-            encoding_options = {
-                "width": settings.RECORDING_ENCODING_WIDTH,
-                "height": settings.RECORDING_ENCODING_HEIGHT,
-                "framerate": settings.RECORDING_ENCODING_FRAMERATE,
-                "video_bitrate": settings.RECORDING_ENCODING_VIDEO_BITRATE_KBPS,
-                "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
-                "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
-                "video_codec": _RECORDING_VIDEO_CODEC,
-                "audio_codec": _RECORDING_AUDIO_CODEC,
-                "audio_frequency": _RECORDING_AUDIO_FREQUENCY_HZ,
-            }
+        if resolution and profile:
+            encoding_options = build_encoding_options(resolution, profile)

        return cls(
            output_folder=settings.RECORDING_OUTPUT_FOLDER,
@@ -78,7 +112,12 @@ class WorkerService(Protocol):
    def __init__(self, config: WorkerServiceConfig):
        """Initialize the service with the given configuration."""

-    def start(self, room_id: str, recording_id: str) -> str:
+    def start(
+        self,
+        room_id: str,
+        recording_id: str,
+        encoding_options: Optional[Dict[str, Any]] = None,
+    ) -> str:
        """Start a recording for a specified room."""

    def stop(self, worker_id: str) -> str:
@@ -51,8 +51,11 @@ class WorkerServiceMediator:
            raise RecordingStartError()

        room_name = str(recording.room.id)
+        encoding_options = (recording.options.get("encoding") or {}).get("resolved")
        try:
-            worker_id = self._worker_service.start(room_name, recording.id)
+            worker_id = self._worker_service.start(
+                room_name, recording.id, encoding_options=encoding_options
+            )
        except (WorkerRequestError, WorkerConnectionError, WorkerResponseError) as e:
            logger.exception(
                "Failed to start recording for room %s: %s", recording.room.slug, e
@@ -9,7 +9,7 @@ from livekit import api as livekit_api

 from ... import utils
 from ..enums import FileExtension
-from .exceptions import WorkerConnectionError, WorkerResponseError
+from .exceptions import WorkerConnectionError, WorkerRequestError, WorkerResponseError
 from .factories import WorkerServiceConfig

 logger = logging.getLogger(__name__)
@@ -24,7 +24,7 @@ class BaseEgressService:

    def _get_filepath(self, filename: str, extension: str) -> str:
        """Construct the file path for a given filename and extension.
-        Unsecure method, doesn't handle paths robustly and securely.
+        Insecure method, doesn't handle paths robustly and securely.
        """
        return f"{self._config.output_folder}/{filename}.{extension}"

@@ -108,28 +108,33 @@ class BaseEgressService:
        self._log_egress_error(response, "failed to stop")
        return "FAILED_TO_STOP"

-    def start(self, room_name, recording_id):
+    def start(self, room_name, recording_id, encoding_options=None):
        """Start the egress process for a recording (not implemented in the base class).
        Each derived class must implement this method, providing the necessary parameters for
        its specific egress type (e.g. audio_only, streaming output).
        """
        raise NotImplementedError("Subclass must implement this method.")

-    def _build_encoding_options(self):
-        """Build a LiveKit EncodingOptions from the service config, or None.
+    def _resolve_encoding_options(self, encoding_options):
+        """Build a LiveKit EncodingOptions from a resolved kwargs dict, or None.
+
+        ``encoding_options`` is the per-recording dict persisted by the API in
+        ``recording.options["encoding"]["resolved"]``; it falls back to the
+        default encoding carried by the service config.

        When None is returned, the caller should omit the `advanced` field so
        LiveKit Egress falls back to its built-in preset (H264_720P_30).
-
-        The full EncodingOptions kwargs (operator-tunable values + pinned
-        codec / frequency constants) are assembled in `WorkerServiceConfig`,
-        so this method is a thin protobuf adapter.
        """
-        opts = self._config.encoding_options
-        if not opts:
+        encoding_options = encoding_options or self._config.encoding_options
+        if not encoding_options:
            return None

-        return livekit_api.EncodingOptions(**opts)
+        try:
+            return livekit_api.EncodingOptions(**encoding_options)
+        except (TypeError, ValueError) as e:
+            # Protobuf raises TypeError on a wrongly typed value (e.g. a float
+            # framerate) and ValueError on an unknown field or an out-of-range int.
+            raise WorkerRequestError(f"Invalid encoding options: {e}") from e


 class VideoCompositeEgressService(BaseEgressService):
@@ -137,7 +142,7 @@ class VideoCompositeEgressService(BaseEgressService):

    hrid = "video-recording-composite-livekit-egress"

-    def start(self, room_name, recording_id):
+    def start(self, room_name, recording_id, encoding_options=None):
        """Start the video composite egress process for a recording."""

        # Save room's recording as a mp4 video file.
@@ -158,7 +163,7 @@ class VideoCompositeEgressService(BaseEgressService):
            "layout": "speaker-light",
        }

-        advanced = self._build_encoding_options()
+        advanced = self._resolve_encoding_options(encoding_options)
        if advanced is not None:
            request_kwargs["advanced"] = advanced

@@ -177,8 +182,13 @@ class AudioCompositeEgressService(BaseEgressService):

    hrid = "audio-recording-composite-livekit-egress"

-    def start(self, room_name, recording_id):
-        """Start the audio composite egress process for a recording."""
+    def start(self, room_name, recording_id, encoding_options=None):
+        """Start the audio composite egress process for a recording.
+
+        ``encoding_options`` is accepted for signature compatibility with the
+        WorkerService protocol but ignored: audio-only egress has no
+        encoding to configure.
+        """

        # Save room's recording as an ogg audio file.
        file_type = livekit_api.EncodedFileType.OGG
@@ -8,6 +8,7 @@ from enum import Enum
 from logging import getLogger

 from django.conf import settings
+from django.utils import timezone

 from livekit import api

@@ -270,12 +271,20 @@ class LiveKitEventsService:
            )
            raise ActionFailedError("Failed to process room started event") from e

-        try:
-            room = models.Room.objects.get(id=room_id)
-        except models.Room.DoesNotExist as err:
-            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
+        room_updated_count = models.Room.objects.filter(pk=room_id).update(
+            last_started_at=timezone.now()
+        )
+        if not room_updated_count:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist")

        if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
+            try:
+                room = models.Room.objects.get(pk=room_id)
+            except models.Room.DoesNotExist as err:
+                raise ActionFailedError(
+                    f"Room with ID {room_id} does not exist"
+                ) from err
+
            try:
                self.sip_management.ensure_dispatch_rule(room)
            except SIPException as e:
@@ -0,0 +1,239 @@
+"""Tests for the purge_inactive_rooms management command."""
+
+import logging
+from datetime import timedelta
+from io import StringIO
+from unittest import mock
+
+from django.core.management import call_command
+from django.utils import timezone
+
+import pytest
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+COMMAND_MODULE = "core.management.commands.purge_inactive_rooms"
+
+BEFORE_PERIOD = timedelta(days=366)
+WITHIN_PERIOD = timedelta(days=364)
+
+
+@pytest.fixture(name="purge_enabled", autouse=True)
+def fixture_purge_enabled(settings):
+    """Enable the purge of the rooms inactive for a year."""
+    settings.ROOM_INACTIVITY_DELETION_DAYS = 365
+    settings.RECORDING_EXPIRATION_DAYS = 30
+
+
+def create_at(date, factory, **kwargs):
+    """Build an object with the factory as if it was created at the given date."""
+    with mock.patch("django.utils.timezone.now", return_value=date):
+        return factory(**kwargs)
+
+
+def call_purge(*args):
+    """Run the purge command and return what it wrote on stdout."""
+    out = StringIO()
+    call_command("purge_inactive_rooms", *args, stdout=out)
+    return out.getvalue()
+
+
+def room_exists(room):
+    """Tell whether the room is still in database."""
+    return models.Room.objects.filter(pk=room.pk).exists()
+
+
+def test_purge_inactive_rooms_disabled(settings):
+    """Should delete nothing when no inactivity period is configured."""
+    settings.ROOM_INACTIVITY_DELETION_DAYS = None
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+
+    assert "disabled" in call_purge()
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_without_recording_expiration(settings):
+    """Should purge when recordings never expire, keeping rooms with a saved one."""
+    settings.RECORDING_EXPIRATION_DAYS = None
+    long_ago = timezone.now() - BEFORE_PERIOD
+    room = create_at(long_ago, factories.RoomFactory)
+    room_with_recording = create_at(long_ago, factories.RoomFactory)
+    create_at(
+        long_ago,
+        factories.RecordingFactory,
+        room=room_with_recording,
+        status=models.RecordingStatusChoices.SAVED,
+    )
+
+    assert call_purge() == "Purged 1 inactive room(s).\n"
+
+    assert not room_exists(room)
+    assert room_exists(room_with_recording)
+
+
+def test_purge_inactive_rooms_without_recording_expiration_not_saved(settings):
+    """Should delete a room whose recordings were never saved when none expire."""
+    settings.RECORDING_EXPIRATION_DAYS = None
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+def test_purge_inactive_rooms_started_before_period(caplog):
+    """Should delete a room that was last started before the inactivity period."""
+    now = timezone.now()
+    room = create_at(
+        now - timedelta(days=800),
+        factories.RoomFactory,
+        last_started_at=now - BEFORE_PERIOD,
+    )
+
+    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
+        output = call_purge()
+
+    assert output == "Purged 1 inactive room(s).\n"
+    assert not room_exists(room)
+    assert f"Purging inactive room {room.pk} ({room.slug})" in caplog.text
+
+
+def test_purge_inactive_rooms_never_started_created_before_period():
+    """Should delete a room that was never started and created before the period."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+def test_purge_inactive_rooms_started_within_period():
+    """Should keep a room created long ago that was started within the period."""
+    now = timezone.now()
+    room = create_at(
+        now - timedelta(days=800),
+        factories.RoomFactory,
+        last_started_at=now - WITHIN_PERIOD,
+    )
+
+    assert call_purge() == "No inactive room to purge.\n"
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_never_started_created_within_period():
+    """Should keep a room that was never started but created within the period."""
+    room = create_at(timezone.now() - WITHIN_PERIOD, factories.RoomFactory)
+
+    assert call_purge() == "No inactive room to purge.\n"
+
+    assert room_exists(room)
+
+
+@pytest.mark.parametrize(
+    "status", sorted(models.RecordingStatusChoices.saved_statuses())
+)
+def test_purge_inactive_rooms_recording_not_expired(settings, status):
+    """Should keep a room holding a saved recording that has not expired yet."""
+    settings.RECORDING_EXPIRATION_DAYS = 400
+    long_ago = timezone.now() - BEFORE_PERIOD
+    room = create_at(long_ago, factories.RoomFactory)
+    create_at(long_ago, factories.RecordingFactory, room=room, status=status)
+
+    call_purge()
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_recording_expired(settings):
+    """Should delete a room along with its recordings when they all have expired."""
+    settings.RECORDING_EXPIRATION_DAYS = 30
+    long_ago = timezone.now() - BEFORE_PERIOD
+    room = create_at(long_ago, factories.RoomFactory)
+    recording = create_at(
+        long_ago,
+        factories.RecordingFactory,
+        room=room,
+        status=models.RecordingStatusChoices.SAVED,
+    )
+
+    call_purge()
+
+    assert not room_exists(room)
+    assert not models.Recording.objects.filter(pk=recording.pk).exists()
+
+
+@pytest.mark.parametrize(
+    "status",
+    [
+        status
+        for status in models.RecordingStatusChoices
+        if status not in models.RecordingStatusChoices.saved_statuses()
+    ],
+)
+def test_purge_inactive_rooms_recording_not_saved(status):
+    """Should delete a room whose recordings were never saved, even unexpired."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    factories.RecordingFactory(room=room, status=status)
+
+    call_purge()
+
+    assert not room_exists(room)
+
+
+def test_purge_inactive_rooms_recording_saved_among_others():
+    """Should keep a room holding a saved recording next to a failed one."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
+    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.SAVED)
+
+    call_purge()
+
+    assert room_exists(room)
+
+
+def test_purge_inactive_rooms_deletes_accesses_and_resource():
+    """Should delete the last owner access and the resource of a purged room."""
+    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
+    access = factories.UserResourceAccessFactory(
+        resource=room, role=models.RoleChoices.OWNER
+    )
+
+    call_purge()
+
+    assert not room_exists(room)
+    assert not models.Resource.objects.filter(pk=room.pk).exists()
+    assert not models.ResourceAccess.objects.filter(pk=access.pk).exists()
+    assert models.User.objects.filter(pk=access.user.pk).exists()
+
+
+def test_purge_inactive_rooms_dry_run():
+    """Should list the inactive rooms by name without deleting them on a dry run."""
+    long_ago = timezone.now() - BEFORE_PERIOD
+    rooms = [
+        create_at(long_ago, factories.RoomFactory, name=name)
+        for name in ("Alpha room", "Beta room")
+    ]
+    factories.RoomFactory(name="Recent room")
+
+    assert call_purge("--dry-run") == (
+        "[dry-run] 2 inactive room(s) would be purged:\n- Alpha room\n- Beta room\n"
+    )
+
+    assert all(room_exists(room) for room in rooms)
+
+
+def test_purge_inactive_rooms_several_chunks():
+    """Should delete every inactive room when they span several chunks."""
+    long_ago = timezone.now() - BEFORE_PERIOD
+    rooms = [create_at(long_ago, factories.RoomFactory) for _ in range(5)]
+
+    with mock.patch(f"{COMMAND_MODULE}.CHUNK_SIZE", 2):
+        output = call_purge()
+
+    assert output == "Purged 5 inactive room(s).\n"
+    assert not any(room_exists(room) for room in rooms)
@@ -117,14 +117,14 @@ def test_api_files_create_file_authenticated_success():
    policy_parsed = urlparse(policy)

    assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
+    assert policy_parsed.netloc in ["garage:9000", "localhost:9000"]
    assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"

    query_params = parse_qs(policy_parsed.query)

    assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
    assert query_params.pop("X-Amz-Credential") == [
-        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
+        f"meet-access-key/{now.strftime('%Y%m%d')}/local/s3/aws4_request"
    ]
    assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
    assert query_params.pop("X-Amz-Expires") == ["60"]
@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():

 def test_api_files_list_authentificated_user_allowed():
    """
-    Authentificated users should be allowed to list files
+    Authenticated users should be allowed to list files
    """
    user = factories.UserFactory()
    client = APIClient()
@@ -0,0 +1,184 @@
+"""Tests for the per-recording encoding resolution in BaseEgressService."""
+
+# pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member
+
+from unittest.mock import Mock
+
+from django.conf import settings
+from django.test import override_settings
+
+import pytest
+from livekit import api as livekit_api
+from pydantic import ValidationError as PydanticValidationError
+
+from core.api.serializers import EncodingConfig
+from core.recording.worker.exceptions import WorkerRequestError
+from core.recording.worker.factories import build_encoding_options
+from core.recording.worker.services import VideoCompositeEgressService
+
+
+def make_config():
+    """Build a minimal WorkerServiceConfig-like mock for service instantiation."""
+    config = Mock()
+    config.bucket_args = {
+        "endpoint": "https://s3.test.com",
+        "access_key": "test_key",
+        "secret": "test_secret",
+        "region": "test-region",
+        "bucket": "test-bucket",
+        "force_path_style": True,
+    }
+    config.encoding_options = None
+    return config
+
+
+@pytest.fixture
+def service():
+    """Return a VideoCompositeEgressService with mocked handle_request."""
+    svc = VideoCompositeEgressService(make_config())
+    svc._handle_request = Mock()
+    return svc
+
+
+# --- build_encoding_options ---
+
+
+def test_build_options_without_profile_uses_default_profile():
+    """A resolution-only config should fall back to the default profile.
+
+    Left unset, framerate and video_bitrate take LiveKit's own EncodingOptions
+    defaults. The profile-independent fields (audio bitrate, keyframe interval,
+    codec/frequency pins) are always present, matching the default encoding.
+    """
+    default_profile = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[
+        settings.RECORDING_ENCODING_DEFAULT_PROFILE
+    ]
+
+    resolved = build_encoding_options("540p")
+
+    assert resolved == {
+        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
+        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
+        "video_codec": livekit_api.VideoCodec.H264_MAIN,
+        "audio_codec": livekit_api.AudioCodec.AAC,
+        "audio_frequency": 48000,
+        "width": 960,
+        "height": 540,
+        "framerate": default_profile["fps"],
+        "video_bitrate": default_profile["kbps"]["540p"],
+    }
+
+
+@override_settings(RECORDING_ENCODING_DEFAULT_PROFILE="")
+def test_build_options_omits_profile_fields_without_default_profile():
+    """With no default profile declared, framerate/bitrate are left to LiveKit."""
+    resolved = build_encoding_options("720p", None)
+
+    assert resolved == {
+        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
+        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
+        "video_codec": livekit_api.VideoCodec.H264_MAIN,
+        "audio_codec": livekit_api.AudioCodec.AAC,
+        "audio_frequency": 48000,
+        "width": 1280,
+        "height": 720,
+    }
+    assert "framerate" not in resolved
+    assert "video_bitrate" not in resolved
+
+
+def test_encoding_config_requires_resolution():
+    """A profile-only or empty encoding config should be rejected at validation."""
+    with pytest.raises(PydanticValidationError):
+        EncodingConfig(profile="mixed")
+    with pytest.raises(PydanticValidationError):
+        EncodingConfig()
+
+
+# --- _resolve_encoding_options ---
+
+
+@pytest.mark.parametrize("encoding_options", [None, {}])
+def test_resolve_options_returns_none_when_empty(service, encoding_options):
+    """Resolver should return None when the resolved dict is empty or missing."""
+    assert service._resolve_encoding_options(encoding_options) is None
+
+
+@pytest.mark.parametrize(
+    "encoding_options",
+    [
+        {"framerate": 29.97},
+        {"width": "1280"},
+        {"unknown_field": 1},
+    ],
+)
+def test_resolve_options_invalid_raises_worker_request_error(service, encoding_options):
+    """Malformed encoding options should surface as a WorkerRequestError."""
+    with pytest.raises(WorkerRequestError):
+        service._resolve_encoding_options(encoding_options)
+
+
+@pytest.mark.parametrize(
+    "resolution",
+    list(settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS),
+)
+@pytest.mark.parametrize(
+    "profile",
+    list(settings.RECORDING_ENCODING_AVAILABLE_PROFILES),
+)
+def test_resolve_profile_resolution_combinations(service, profile, resolution):
+    """Every (profile, resolution) pair should resolve to the values from settings."""
+    resolution_config = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[resolution]
+    expected_width = resolution_config["width"]
+    expected_height = resolution_config["height"]
+    profile_config = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
+    expected_fps = profile_config["fps"]
+    expected_bitrate = profile_config["kbps"][resolution]
+
+    resolved = build_encoding_options(resolution, profile)
+    result = service._resolve_encoding_options(resolved)
+
+    assert result.width == expected_width
+    assert result.height == expected_height
+    assert result.framerate == expected_fps
+    assert result.video_bitrate == expected_bitrate
+    # Profile-independent fields match the default encoding, never dropped.
+    assert result.audio_bitrate == settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS
+    assert result.video_codec == livekit_api.VideoCodec.H264_MAIN
+    assert result.audio_codec == livekit_api.AudioCodec.AAC
+    assert result.audio_frequency == 48000
+
+
+def test_resolve_options_none_profile_uses_default_profile(service):
+    """A missing profile should resolve to the default profile's fps/bitrate."""
+    default_profile = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[
+        settings.RECORDING_ENCODING_DEFAULT_PROFILE
+    ]
+
+    resolved = build_encoding_options("720p", None)
+    result = service._resolve_encoding_options(resolved)
+
+    assert result.width == 1280
+    assert result.height == 720
+    assert result.framerate == default_profile["fps"]
+    assert result.video_bitrate == default_profile["kbps"]["720p"]
+    assert result.audio_bitrate == settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS
+    assert result.video_codec == livekit_api.VideoCodec.H264_MAIN
+
+
+@override_settings(RECORDING_ENCODING_DEFAULT_PROFILE="")
+def test_resolve_options_passes_zero_when_no_default_profile(service):
+    """With no default profile, fps/bitrate reach LiveKit unset (protobuf 0).
+
+    The pinned codec / audio fields are still applied.
+    """
+    resolved = build_encoding_options("720p", None)
+    result = service._resolve_encoding_options(resolved)
+
+    assert result.width == 1280
+    assert result.height == 720
+    assert result.framerate == 0
+    assert result.video_bitrate == 0
+    assert result.audio_bitrate == settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS
+    assert result.video_codec == livekit_api.VideoCodec.H264_MAIN
+    assert result.audio_codec == livekit_api.AudioCodec.AAC
@@ -40,6 +40,16 @@ def test_settings():
        "AWS_S3_SECRET_ACCESS_KEY": "test_secret",
        "AWS_S3_REGION_NAME": "test-region",
        "AWS_STORAGE_BUCKET_NAME": "test-bucket",
+        "RECORDING_ENCODING_AVAILABLE_RESOLUTIONS": {
+            "720p": {"width": 1280, "height": 720}
+        },
+        "RECORDING_ENCODING_AVAILABLE_PROFILES": {
+            "full": {"fps": 30, "kbps": {"720p": 3000}}
+        },
+        "RECORDING_ENCODING_DEFAULT_RESOLUTION": "720p",
+        "RECORDING_ENCODING_DEFAULT_PROFILE": "full",
+        "RECORDING_ENCODING_AUDIO_BITRATE_KBPS": 128,
+        "RECORDING_ENCODING_KEY_FRAME_INTERVAL_S": 4.0,
    }

    # Use override_settings to properly patch Django settings
@@ -66,8 +76,18 @@ def test_config_initialization(default_config):
        "bucket": "test-bucket",
        "force_path_style": True,
    }
-    # Encoding override is opt-in; disabled by default.
-    assert default_config.encoding_options is None
+    # The default encoding is always resolved from the default profile/resolution.
+    assert default_config.encoding_options == {
+        "width": 1280,
+        "height": 720,
+        "framerate": 30,
+        "video_bitrate": 3000,
+        "audio_bitrate": 128,
+        "key_frame_interval": 4.0,
+        "video_codec": livekit_api_codec.VideoCodec.H264_MAIN,
+        "audio_codec": livekit_api_codec.AudioCodec.AAC,
+        "audio_frequency": 48000,
+    }


 def test_config_immutability(default_config):
@@ -76,6 +96,7 @@ def test_config_immutability(default_config):
        default_config.output_folder = "new/path"


+@pytest.mark.parametrize("custom_encoding_enabled", [True, False])
@override_settings(
    RECORDING_OUTPUT_FOLDER="/test/output",
    LIVEKIT_CONFIGURATION={"server": "test.example.com"},
@@ -84,23 +105,25 @@ def test_config_immutability(default_config):
    AWS_S3_SECRET_ACCESS_KEY="test_secret",
    AWS_S3_REGION_NAME="test-region",
    AWS_STORAGE_BUCKET_NAME="test-bucket",
-    RECORDING_ENCODING_ENABLED=True,
-    RECORDING_ENCODING_WIDTH=1280,
-    RECORDING_ENCODING_HEIGHT=720,
-    RECORDING_ENCODING_FRAMERATE=15,
-    RECORDING_ENCODING_VIDEO_BITRATE_KBPS=600,
+    RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"720p": {"width": 1280, "height": 720}},
+    RECORDING_ENCODING_AVAILABLE_PROFILES={"low": {"fps": 15, "kbps": {"720p": 600}}},
+    RECORDING_ENCODING_DEFAULT_RESOLUTION="720p",
+    RECORDING_ENCODING_DEFAULT_PROFILE="low",
    RECORDING_ENCODING_AUDIO_BITRATE_KBPS=64,
    RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=10.0,
 )
-def test_config_encoding_options_enabled():
-    """When RECORDING_ENCODING_ENABLED is True, encoding options are populated.
+def test_config_encoding_options_default(custom_encoding_enabled):
+    """The default encoding is always resolved from the default profile/resolution.

-    The dict mixes operator-tunable values from settings with pinned codec /
-    frequency constants, so the services layer can simply unpack it.
+    The default fallback resolves the default profile/resolution and mixes those
+    operator-tunable values with pinned codec / frequency constants. This works
+    regardless of RECORDING_CUSTOM_ENCODING_ENABLED, which only gates the
+    per-recording API, so both toggle states produce the same default.
    """

-    WorkerServiceConfig.from_settings.cache_clear()
-    config = WorkerServiceConfig.from_settings()
+    with override_settings(RECORDING_CUSTOM_ENCODING_ENABLED=custom_encoding_enabled):
+        WorkerServiceConfig.from_settings.cache_clear()
+        config = WorkerServiceConfig.from_settings()

    assert config.encoding_options == {
        "width": 1280,
@@ -115,6 +138,27 @@ def test_config_encoding_options_enabled():
    }


+@pytest.mark.parametrize(
+    ("default_resolution", "default_profile"),
+    [("", "full"), ("720p", ""), ("", "")],
+)
+def test_config_encoding_options_none_when_default_missing(
+    test_settings, default_resolution, default_profile
+):
+    """A missing default resolution/profile leaves encoding_options None.
+
+    The service then omits the `advanced` field so LiveKit uses its built-in preset.
+    """
+    with override_settings(
+        RECORDING_ENCODING_DEFAULT_RESOLUTION=default_resolution,
+        RECORDING_ENCODING_DEFAULT_PROFILE=default_profile,
+    ):
+        WorkerServiceConfig.from_settings.cache_clear()
+        config = WorkerServiceConfig.from_settings()
+
+    assert config.encoding_options is None
+
+
@override_settings(
    RECORDING_OUTPUT_FOLDER="/test/output",
    LIVEKIT_CONFIGURATION={"server": "test.example.com"},
@@ -50,7 +50,7 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
    # Verify worker service call
    expected_room_name = str(mock_recording.room.id)
    mock_worker_service.start.assert_called_once_with(
-        expected_room_name, mock_recording.id
+        expected_room_name, mock_recording.id, encoding_options=None
    )

    # Verify recording updates
@@ -64,6 +64,38 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
    )


+@mock.patch("core.services.room_management.RoomManagement.update_metadata")
+def test_start_recording_passes_resolved_encoding(
+    mock_update_metadata, mediator, mock_worker_service
+):
+    """The resolved encoding persisted in recording.options reaches the worker."""
+    mock_worker_service.start.return_value = "test-worker-123"
+
+    resolved = {
+        "key_frame_interval": 4.0,
+        "width": 1280,
+        "height": 720,
+        "framerate": 15,
+        "video_bitrate": 700,
+    }
+    mock_recording = RecordingFactory(
+        status=RecordingStatusChoices.INITIATED,
+        worker_id=None,
+        options={
+            "encoding": {
+                "resolution": "720p",
+                "profile": "talking_heads",
+                "resolved": resolved,
+            }
+        },
+    )
+    mediator.start(mock_recording)
+
+    mock_worker_service.start.assert_called_once_with(
+        str(mock_recording.room.id), mock_recording.id, encoding_options=resolved
+    )
+
+
@pytest.mark.parametrize(
    "error_class", [WorkerRequestError, WorkerConnectionError, WorkerResponseError]
 )
@@ -9,6 +9,10 @@ from django.core.cache import cache
 import pytest
 from rest_framework.test import APIClient

+from ...api.throttling import (
+    RoomCreationDailyUserRateThrottle,
+    RoomCreationUserRateThrottle,
+)
 from ...factories import RoomFactory, UserFactory
 from ...models import Room, RoomAccessLevel

@@ -312,3 +316,145 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
    assert response.status_code == 201
    room = Room.objects.get()
    assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
+
+
+@pytest.fixture
+def room_creation_throttle(monkeypatch):
+    """Lower the room creation rate for the duration of a test."""
+    monkeypatch.setitem(
+        settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"], "room_creation", "2/minute"
+    )
+
+
+def test_api_rooms_create_throttled(room_creation_throttle):
+    """Excess requests are rejected and create no room."""
+
+    client = APIClient()
+    client.force_login(UserFactory())
+
+    for index in range(2):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+    assert 0 < int(response["Retry-After"]) <= 60
+    assert Room.objects.count() == 2
+
+
+def test_api_rooms_create_throttle_per_user(room_creation_throttle):
+    """Users sharing an IP have independent creation limits."""
+
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(2):
+        response = client.post("/api/v1.0/rooms/", {"name": f"First user room {index}"})
+        assert response.status_code == 201
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+
+    client.force_login(UserFactory())
+    response = client.post("/api/v1.0/rooms/", {"name": "Second user room"})
+    assert response.status_code == 201
+
+
+def test_api_rooms_create_throttle_does_not_limit_other_actions(room_creation_throttle):
+    """Exhausting creation capacity leaves listing and updating available."""
+
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(2):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+    room_id = response.json()["id"]
+
+    assert client.post("/api/v1.0/rooms/", {"name": "Blocked room"}).status_code == 429
+    assert client.get("/api/v1.0/rooms/").status_code == 200
+    assert (
+        client.patch(
+            f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed room"}
+        ).status_code
+        == 200
+    )
+
+
+@pytest.fixture
+def daily_room_creation_throttle(monkeypatch):
+    """Use a tiny daily cap, a loose burst limit and a controllable clock.
+
+    Rates are patched with monkeypatch.setitem so they are restored after the
+    test. Returns a one-item list holding the current fake timestamp.
+    """
+    rates = RoomCreationDailyUserRateThrottle.THROTTLE_RATES
+    monkeypatch.setitem(rates, "room_creation", "100/minute")
+    monkeypatch.setitem(rates, "room_creation_daily", "3/day")
+    now = [1_000_000.0]
+    monkeypatch.setattr(RoomCreationUserRateThrottle, "timer", lambda self: now[0])
+    return now
+
+
+def test_api_rooms_create_daily_throttled(daily_room_creation_throttle):
+    """The daily cap still applies once the short-term window has elapsed."""
+    now = daily_room_creation_throttle
+    client = APIClient()
+    client.force_login(UserFactory())
+
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+        now[0] += 120  # Spread creations beyond the short-term window.
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+    assert int(response["Retry-After"]) > 60
+    assert Room.objects.count() == 3
+
+
+def test_api_rooms_create_daily_throttle_resets(daily_room_creation_throttle):
+    """Room creation is allowed again once a day has passed."""
+    now = daily_room_creation_throttle
+    client = APIClient()
+    client.force_login(UserFactory())
+
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+
+    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
+    assert response.status_code == 429
+
+    now[0] += 24 * 60 * 60 + 1
+    response = client.post("/api/v1.0/rooms/", {"name": "Next day room"})
+    assert response.status_code == 201
+
+
+def test_api_rooms_create_daily_throttle_per_user(daily_room_creation_throttle):
+    """Each user has its own daily cap."""
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
+
+    client.force_login(UserFactory())
+    response = client.post("/api/v1.0/rooms/", {"name": "Other user room"})
+    assert response.status_code == 201
+
+
+def test_api_rooms_create_daily_throttle_does_not_limit_other_actions(
+    daily_room_creation_throttle,
+):
+    """Reaching the daily cap leaves listing and updating available."""
+    client = APIClient()
+    client.force_login(UserFactory())
+    for index in range(3):
+        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
+        assert response.status_code == 201
+    room_id = response.json()["id"]
+
+    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
+    assert client.get("/api/v1.0/rooms/").status_code == 200
+    response = client.patch(f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed"})
+    assert response.status_code == 200
@@ -458,7 +458,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
    room = RoomFactory()

    mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occured", code="not_found", status=500
+        msg="an error occurred", code="not_found", status=500
    )

    user = AnonymousUser()
@@ -7,6 +7,7 @@ from unittest import mock

 from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
+from django.utils import timezone

 import pytest
 from rest_framework.test import APIClient
@@ -507,3 +508,20 @@ def test_api_rooms_retrieve_administrators(
        role=str(user_access.role),
        participant_id=None,
    )
+
+
+@pytest.mark.parametrize("access_level", RoomAccessLevel)
+@pytest.mark.parametrize("role", [None, *RoleChoices])
+def test_api_rooms_retrieve_last_started_at_not_exposed(role, access_level):
+    """Should not expose when the room was last started, whoever the requester is."""
+    room = RoomFactory(access_level=access_level, last_started_at=timezone.now())
+    client = APIClient()
+    user = UserFactory()
+    if role is not None:
+        UserResourceAccessFactory(resource=room, user=user, role=role)
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
+
+    assert response.status_code == 200
+    assert "last_started_at" not in response.json()
@@ -2,11 +2,12 @@
 Test rooms API endpoints in the Meet core app: start recording.
 """

-# pylint: disable=redefined-outer-name,unused-argument
+# pylint: disable=redefined-outer-name,unused-argument,no-member

 from unittest import mock

 import pytest
+from livekit import api as livekit_api
 from rest_framework.test import APIClient

 from ...factories import RoomFactory, UserFactory
@@ -470,6 +471,224 @@ def test_start_recording_options_unknown_field_rejected(settings):
    assert response.status_code == 400


+def test_start_recording_options_encoding_valid(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Should accept a valid encoding configuration."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {
+            "mode": "screen_recording",
+            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+
+
+def test_start_recording_options_encoding_rejected_when_custom_encoding_disabled(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Per-recording encoding is rejected when RECORDING_CUSTOM_ENCODING_ENABLED is off."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = False
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {
+            "mode": "screen_recording",
+            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+    assert not Recording.objects.filter(room=room).exists()
+
+
+def test_start_recording_persists_resolved_encoding(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """The resolved encoding should be persisted in recording.options alongside
+    the requested resolution/profile for traceability."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {
+            "mode": "screen_recording",
+            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options["encoding"] == {
+        "resolution": "720p",
+        "profile": "talking_heads",
+        "resolved": {
+            "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
+            "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
+            "video_codec": livekit_api.VideoCodec.H264_MAIN,
+            "audio_codec": livekit_api.AudioCodec.AAC,
+            "audio_frequency": 48000,
+            "width": 1280,
+            "height": 720,
+            "framerate": 15,
+            "video_bitrate": 700,
+        },
+    }
+
+
+def test_start_recording_resolution_only_uses_default_profile(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """An encoding without a profile should resolve the default profile."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
+    settings.RECORDING_ENCODING_DEFAULT_PROFILE = "talking_heads"
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"encoding": {"resolution": "540p"}}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    resolved = recording.options["encoding"]["resolved"]
+    assert resolved["width"] == 960
+    assert resolved["height"] == 540
+    assert resolved["framerate"] == 15
+    assert resolved["video_bitrate"] == 400
+    # The requested payload is persisted as sent: no profile was asked for.
+    assert "profile" not in recording.options["encoding"]
+
+
+def test_start_recording_forwards_resolved_encoding_to_worker(
+    settings, mock_worker_service, mock_worker_service_factory
+):
+    """The resolved encoding should passed on to the worker."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    mock_worker_service.start.return_value = "egress-123"
+
+    with mock.patch("core.services.room_management.RoomManagement.update_metadata"):
+        response = client.post(
+            f"/api/v1.0/rooms/{room.id}/start-recording/",
+            {
+                "mode": "screen_recording",
+                "options": {
+                    "encoding": {"resolution": "720p", "profile": "talking_heads"}
+                },
+            },
+            format="json",
+        )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    mock_worker_service.start.assert_called_once_with(
+        str(room.id),
+        recording.id,
+        encoding_options=recording.options["encoding"]["resolved"],
+    )
+
+
+def test_start_recording_options_encoding_invalid_resolution(settings):
+    """Should reject invalid encoding resolution values."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"encoding": {"resolution": "4K"}}},
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+def test_start_recording_options_encoding_unknown_key_rejected(settings):
+    """Should reject unknown keys in encoding configuration."""
+    settings.RECORDING_ENABLE = True
+    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {
+            "mode": "screen_recording",
+            "options": {"encoding": {"bitrate": 9000}},
+        },
+        format="json",
+    )
+
+    assert response.status_code == 400
+
+
+def test_start_recording_options_without_encoding_unchanged(
+    settings, mock_worker_service_factory, mock_worker_manager
+):
+    """Requests without encoding should keep existing options behavior."""
+    settings.RECORDING_ENABLE = True
+    room = RoomFactory()
+    user = UserFactory()
+    room.accesses.create(user=user, role="owner")
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/rooms/{room.id}/start-recording/",
+        {"mode": "screen_recording", "options": {"language": "fr"}},
+        format="json",
+    )
+
+    assert response.status_code == 201
+    recording = Recording.objects.get(room=room)
+    assert recording.options == {"language": "fr"}
+
+
@pytest.mark.parametrize("value", ["foo", 12])
 def test_start_recording_options_invalid_transcribe_type(settings, value):
    """Should reject non-boolean transcribe values."""
@@ -3,8 +3,11 @@ Test rooms API endpoints in the Meet core app: update.
 """

 import random
+from datetime import timedelta
 from unittest.mock import patch

+from django.utils import timezone
+
 import pytest
 from rest_framework.test import APIClient

@@ -225,6 +228,39 @@ def test_api_rooms_update_administrators_name_only(mock_update_metadata):
    mock_update_metadata.assert_not_called()


+@pytest.mark.parametrize("method", ["put", "patch"])
+def test_api_rooms_update_last_started_at_ignored(method):
+    """Should ignore a "last_started_at" value sent by a client.
+
+    The field is only ever written by the LiveKit "room_started" webhook: it is not
+    declared on the serializer and is "editable=False" on the model. A client must
+    not be able to keep a room alive by postponing its last start date.
+    """
+    user = UserFactory()
+    last_started_at = timezone.now() - timedelta(days=30)
+    room = RoomFactory(
+        name="Old name",
+        last_started_at=last_started_at,
+        users=[(user, random.choice(["administrator", "owner"]))],
+    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = getattr(client, method)(
+        f"/api/v1.0/rooms/{room.id!s}/",
+        {"name": "New name", "last_started_at": timezone.now().isoformat()},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    assert "last_started_at" not in response.json()
+
+    room.refresh_from_db()
+    # The rest of the payload was applied, so the request was not simply rejected
+    assert room.name == "New name"
+    assert room.last_started_at == last_started_at
+
+
@pytest.mark.parametrize(
    "configuration",
    [
@@ -5,12 +5,16 @@ Test LiveKitEvents service.

 import logging
 import uuid
+from datetime import timedelta
 from unittest import mock

+from django.utils import timezone
+
 import pytest
 from livekit.api import EgressStatus

 from core.factories import RecordingFactory, RoomFactory
+from core.models import Room
 from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import RecordingEventsService
 from core.services.livekit_events import (
@@ -696,6 +700,82 @@ def test_handle_room_started_skips_dispatch_rule_when_telephony_disabled(
    mock_ensure_dispatch_rule.assert_not_called()


+def test_handle_room_started_records_access(service, settings):
+    """Should record the access on a room that is started for the first time."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    settings.ROOMKIT_ENABLED = False
+    room = RoomFactory()
+    other_room = RoomFactory()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    now = timezone.now()
+    with mock.patch("django.utils.timezone.now", return_value=now):
+        service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at == now
+
+    other_room.refresh_from_db()
+    assert other_room.last_started_at is None
+
+
+def test_handle_room_started_overwrites_previous_access(service, settings):
+    """Should overwrite the previous access each time the room is started again."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    settings.ROOMKIT_ENABLED = False
+    now = timezone.now()
+    room = RoomFactory(last_started_at=now - timedelta(days=30))
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    with mock.patch("django.utils.timezone.now", return_value=now):
+        service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at == now
+
+
+def test_handle_room_started_only_updates_access(service, settings):
+    """Should leave the slug and the update date untouched when recording the access."""
+    settings.ROOM_TELEPHONY_ENABLED = False
+    settings.ROOMKIT_ENABLED = False
+    room = RoomFactory()
+    Room.objects.filter(pk=room.pk).update(slug="𓆑")
+    room.refresh_from_db()
+    updated_at = room.updated_at
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at is not None
+    assert room.slug == "𓆑"
+    assert room.updated_at == updated_at
+
+
+@mock.patch.object(
+    SIPManagement,
+    "ensure_dispatch_rule",
+    side_effect=SIPException("Test error"),
+)
+def test_handle_room_started_records_access_when_dispatch_rule_creation_fails(
+    mock_ensure_dispatch_rule, service, settings
+):
+    """Should still record the access when ensuring the dispatch rule fails."""
+    settings.ROOM_TELEPHONY_ENABLED = True
+    room = RoomFactory()
+    mock_data = mock.MagicMock()
+    mock_data.room.name = str(room.id)
+
+    with pytest.raises(ActionFailedError):
+        service._handle_room_started(mock_data)
+
+    room.refresh_from_db()
+    assert room.last_started_at is not None
+
+
 def test_handle_room_started_raises_error_for_invalid_room_name(service):
    """Should raise ActionFailedError when room name format is invalid  when room starts."""
    mock_data = mock.MagicMock()
@@ -1,5 +1,5 @@
 """
-Test SIP mamagement service.
+Test SIP management service.
 """

 # pylint: disable=W0212
@@ -92,6 +92,12 @@ def test_models_rooms_access_level_default():
    assert room.access_level == RoomAccessLevel.PUBLIC


+def test_models_rooms_last_started_at_default():
+    """Should have no last access date until the room is started."""
+    room = Room.objects.create(name="room")
+    assert room.last_started_at is None
+
+
 # Access rights methods


@@ -23,6 +23,8 @@ import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
+from pydantic import BaseModel, PositiveInt, TypeAdapter
+from pydantic import ValidationError as PydanticValidationError
 from sentry_sdk.integrations.django import DjangoIntegration
 from sentry_sdk.integrations.logging import ignore_logger

@@ -65,6 +67,27 @@ class VideoCodecValue(values.Value):
        return codec


+class ResolutionSpec(BaseModel):
+    """An value of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS."""
+
+    width: PositiveInt
+    height: PositiveInt
+
+
+class ProfileSpec(BaseModel):
+    """An value of RECORDING_ENCODING_AVAILABLE_PROFILES.
+
+    `kbps` maps each resolution key to its video bitrate.
+    """
+
+    fps: PositiveInt
+    kbps: dict[str, PositiveInt]
+
+
+RESOLUTION_MAP_ADAPTER = TypeAdapter(dict[str, ResolutionSpec])
+PROFILE_MAP_ADAPTER = TypeAdapter(dict[str, ProfileSpec])
+
+
 class Base(Configuration):
    """
    This is the base configuration every configuration (aka environment) should inherit from. It
@@ -361,6 +384,16 @@ class Base(Configuration):
        "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.URLPathVersioning",
        "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
        "DEFAULT_THROTTLE_RATES": {
+            "room_creation": values.Value(
+                default="50/minute",
+                environ_name="ROOM_CREATION_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
+            "room_creation_daily": values.Value(
+                default="1000/day",
+                environ_name="ROOM_CREATION_DAILY_THROTTLE_RATES",
+                environ_prefix=None,
+            ),
            "request_entry": values.Value(
                default="150/minute",
                environ_name="REQUEST_ENTRY_THROTTLE_RATES",
@@ -730,6 +763,9 @@ class Base(Configuration):
    ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
        True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
    )
+    ROOM_INACTIVITY_DELETION_DAYS = values.PositiveIntegerValue(
+        None, environ_name="ROOM_INACTIVITY_DELETION_DAYS", environ_prefix=None
+    )
    # if provided, treat as suspicious (possible privilege escalation attempt).
    PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
        ["hidden", "recorder", "agent"],
@@ -772,35 +808,81 @@ class Base(Configuration):
    # These settings affect screen recordings handled by VideoCompositeEgressService;
    # they are silently ignored by AudioCompositeEgressService (audio-only transcript
    # recordings), whose request never carries advanced EncodingOptions.
-    # When disabled, LiveKit falls back to its built-in H264_720P_30 preset
-    # (1280x720, 30 fps, 3000 kbps H.264 MAIN video, 128 kbps AAC audio).
-    # When enabled, the values below are passed to LiveKit as EncodingOptions
-    # (advanced) and replace the preset. Lowering framerate and bitrate reduces
-    # output file size and CPU load on the egress worker.
-    RECORDING_ENCODING_ENABLED = values.BooleanValue(
-        False, environ_name="RECORDING_ENCODING_ENABLED", environ_prefix=None
+    #
+    # A default encoding is applied to every recording: it is resolved from the default
+    # profile and resolution below and passed to LiveKit as EncodingOptions (advanced),
+    # replacing LiveKit's built-in H264_720P_30 preset. Lowering framerate and bitrate
+    # reduces output file size and CPU load on the egress worker. If either
+    # RECORDING_ENCODING_DEFAULT_RESOLUTION or RECORDING_ENCODING_DEFAULT_PROFILE is
+    # unset, no default encoding is built (a startup warning is emitted) and LiveKit's
+    # built-in preset is used instead.
+    #
+    # RECORDING_CUSTOM_ENCODING_ENABLED gates whether the start-recording API lets a
+    # client override that default per recording (via an `encoding` object selecting a
+    # resolution/profile). When False, the API rejects per-recording `encoding` and
+    # every recording uses the default; when True, clients may pick from the
+    # available resolutions/profiles below.
+    RECORDING_CUSTOM_ENCODING_ENABLED = values.BooleanValue(
+        False, environ_name="RECORDING_CUSTOM_ENCODING_ENABLED", environ_prefix=None
    )
-    RECORDING_ENCODING_WIDTH = values.PositiveIntegerValue(
-        1280, environ_name="RECORDING_ENCODING_WIDTH", environ_prefix=None
-    )
-    RECORDING_ENCODING_HEIGHT = values.PositiveIntegerValue(
-        720, environ_name="RECORDING_ENCODING_HEIGHT", environ_prefix=None
-    )
-    RECORDING_ENCODING_FRAMERATE = values.PositiveIntegerValue(
-        30, environ_name="RECORDING_ENCODING_FRAMERATE", environ_prefix=None
-    )
-    RECORDING_ENCODING_VIDEO_BITRATE_KBPS = values.PositiveIntegerValue(
-        3000,
-        environ_name="RECORDING_ENCODING_VIDEO_BITRATE_KBPS",
+
+    # Map resolution string -> {"width", "height"} in pixels.
+    RECORDING_ENCODING_AVAILABLE_RESOLUTIONS = values.DictValue(
+        {
+            "540p": {"width": 960, "height": 540},
+            "720p": {"width": 1280, "height": 720},
+            "1080p": {"width": 1920, "height": 1080},
+        },
+        environ_name="RECORDING_ENCODING_AVAILABLE_RESOLUTIONS",
        environ_prefix=None,
    )
+
+    # Map profile string -> {"fps", "kbps": {resolution: video_bitrate_kbps}}.
+    # Bitrate scales with resolution so quality stays consistent across sizes.
+    RECORDING_ENCODING_AVAILABLE_PROFILES = values.DictValue(
+        {
+            "talking_heads": {
+                "fps": 15,
+                "kbps": {"540p": 400, "720p": 700, "1080p": 1200},
+            },
+            "text": {
+                "fps": 15,
+                "kbps": {"540p": 600, "720p": 1000, "1080p": 1800},
+            },
+            "mixed": {
+                "fps": 20,
+                "kbps": {"540p": 900, "720p": 1500, "1080p": 2500},
+            },
+            "full": {
+                "fps": 30,
+                "kbps": {"540p": 2000, "720p": 3000, "1080p": 4500},
+            },
+        },
+        environ_name="RECORDING_ENCODING_AVAILABLE_PROFILES",
+        environ_prefix=None,
+    )
+
+    # Defaults used when no profile/resolution is specified per recording.
+    # Must be keys of the two dicts above (validated at startup).
+    RECORDING_ENCODING_DEFAULT_PROFILE = values.Value(
+        "full",
+        environ_name="RECORDING_ENCODING_DEFAULT_PROFILE",
+        environ_prefix=None,
+    )
+    RECORDING_ENCODING_DEFAULT_RESOLUTION = values.Value(
+        "720p",
+        environ_name="RECORDING_ENCODING_DEFAULT_RESOLUTION",
+        environ_prefix=None,
+    )
+
+    # Settings independent of profile/resolution.
    RECORDING_ENCODING_AUDIO_BITRATE_KBPS = values.PositiveIntegerValue(
        128,
        environ_name="RECORDING_ENCODING_AUDIO_BITRATE_KBPS",
        environ_prefix=None,
    )
    RECORDING_ENCODING_KEY_FRAME_INTERVAL_S = values.FloatValue(
-        4.0,
+        0.0,
        environ_name="RECORDING_ENCODING_KEY_FRAME_INTERVAL_S",
        environ_prefix=None,
    )
@@ -808,6 +890,7 @@ class Base(Configuration):
    SUMMARY_SERVICE_VERSION = values.PositiveIntegerValue(
        1, environ_name="SUMMARY_SERVICE_VERSION", environ_prefix=None
    )
+
    SUMMARY_SERVICE_ENDPOINT = values.Value(
        None, environ_name="SUMMARY_SERVICE_ENDPOINT", environ_prefix=None
    )
@@ -1222,6 +1305,86 @@ class Base(Configuration):
            },
        }

+    @classmethod
+    def _check_recording_encoding_maps(cls):
+        """Ensure the per-recording encoding maps are well-formed and consistent.
+
+        Each entry of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS must declare a width and
+        a height, each entry of RECORDING_ENCODING_AVAILABLE_PROFILES an fps and a kbps
+        map, and every profile must define a bitrate for each declared resolution.
+
+        The default profile / resolution feed the default encoding. When either is
+        missing, no custom default encoding can be built: a warning is emitted and
+        recordings fall back to LiveKit's built-in preset. When both are set, they
+        must reference keys that actually exist in the maps above.
+        """
+        resolutions = set(cls.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS)
+        profiles = set(cls.RECORDING_ENCODING_AVAILABLE_PROFILES)
+
+        for name, adapter in (
+            ("RECORDING_ENCODING_AVAILABLE_RESOLUTIONS", RESOLUTION_MAP_ADAPTER),
+            ("RECORDING_ENCODING_AVAILABLE_PROFILES", PROFILE_MAP_ADAPTER),
+        ):
+            try:
+                adapter.validate_python(getattr(cls, name), strict=True)
+            except PydanticValidationError as exc:
+                raise ValueError(f"{name} is malformed: {exc}") from exc
+
+        for (
+            profile,
+            profile_config,
+        ) in cls.RECORDING_ENCODING_AVAILABLE_PROFILES.items():  # pylint: disable=no-member
+            profile_resolutions = set(profile_config["kbps"])
+            if profile_resolutions != resolutions:
+                raise ValueError(
+                    f"Profile '{profile}' in RECORDING_ENCODING_AVAILABLE_PROFILES must "
+                    "define a bitrate for exactly the resolutions in "
+                    "RECORDING_ENCODING_AVAILABLE_RESOLUTIONS, mismatch on: "
+                    f"{resolutions ^ profile_resolutions}"
+                )
+
+        # Check that default resolutions and profiles are actually defined
+        if (
+            cls.RECORDING_ENCODING_DEFAULT_RESOLUTION
+            and cls.RECORDING_ENCODING_DEFAULT_RESOLUTION not in resolutions
+        ):
+            raise ValueError(
+                "RECORDING_ENCODING_DEFAULT_RESOLUTION "
+                f"'{cls.RECORDING_ENCODING_DEFAULT_RESOLUTION}' is not a key of "
+                f"RECORDING_ENCODING_AVAILABLE_RESOLUTIONS ({sorted(resolutions)})."
+            )
+        if (
+            cls.RECORDING_ENCODING_DEFAULT_PROFILE
+            and cls.RECORDING_ENCODING_DEFAULT_PROFILE not in profiles
+        ):
+            raise ValueError(
+                "RECORDING_ENCODING_DEFAULT_PROFILE "
+                f"'{cls.RECORDING_ENCODING_DEFAULT_PROFILE}' is not a key of "
+                f"RECORDING_ENCODING_AVAILABLE_PROFILES ({sorted(profiles)})."
+            )
+
+        missing = [
+            name
+            for name, value in (
+                (
+                    "RECORDING_ENCODING_DEFAULT_RESOLUTION",
+                    cls.RECORDING_ENCODING_DEFAULT_RESOLUTION,
+                ),
+                (
+                    "RECORDING_ENCODING_DEFAULT_PROFILE",
+                    cls.RECORDING_ENCODING_DEFAULT_PROFILE,
+                ),
+            )
+            if not value
+        ]
+        if missing:
+            warnings.warn(
+                f"{' and '.join(missing)} not set; recordings will use LiveKit's "
+                "built-in encoding preset instead of a custom default encoding.",
+                UserWarning,
+                stacklevel=2,
+            )
+
    @classmethod
    def post_setup(cls):
        """Post setup configuration.
@@ -1235,6 +1398,8 @@ class Base(Configuration):
                "FILE_UPLOAD_TMP_PATH cannot be the same as FILE_UPLOAD_PATH"
            )

+        cls._check_recording_encoding_maps()
+
        if (
            cls.SUMMARY_SERVICE_VERSION == 1
            and cls.SUMMARY_SERVICE_ENDPOINT is not None
@@ -1249,6 +1414,25 @@ class Base(Configuration):
                stacklevel=2,
            )

+        if cls.ROOM_INACTIVITY_DELETION_DAYS:
+            if not cls.RECORDING_EXPIRATION_DAYS:
+                warnings.warn(
+                    "ROOM_INACTIVITY_DELETION_DAYS is set but "
+                    "RECORDING_EXPIRATION_DAYS is not. Recordings never expire, so "
+                    "inactive rooms holding a saved recording will never be purged.",
+                    UserWarning,
+                    stacklevel=2,
+                )
+            elif cls.RECORDING_EXPIRATION_DAYS >= cls.ROOM_INACTIVITY_DELETION_DAYS:
+                warnings.warn(
+                    "RECORDING_EXPIRATION_DAYS is greater than or equal to "
+                    "ROOM_INACTIVITY_DELETION_DAYS. Inactive rooms holding a saved "
+                    "recording will be kept past the inactivity period, until their "
+                    "recordings expire.",
+                    UserWarning,
+                    stacklevel=2,
+                )
+
        # The SENTRY_DSN setting should be available to activate sentry for an environment
        if cls.SENTRY_DSN is not None:
            sentry_sdk.init(
@@ -2,12 +2,12 @@
 # Meet package
 #
 [build-system]
-requires = ["uv_build>=0.11.16,<0.12.0"]
+requires = ["uv_build>=0.12.6,<0.13.0"]
 build-backend = "uv_build"

 [project]
 name = "meet"
-version = "1.31.0"
+version = "1.33.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -24,7 +24,7 @@ keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.43.56",
+    "boto3==1.43.80",
    "Brotli==1.2.0",
    "brevo-python==1.2.0",
    "celery[redis]==5.6.3",
@@ -33,38 +33,38 @@ dependencies = [
    "django-cors-headers==4.9.0",
    "django-countries==9.0.0",
    "django-filter==26.1",
-    "django-lasuite[all]==0.0.27",
+    "django-lasuite[all]==0.0.29",
    "django-parler==2.4",
    "redis==5.2.1",
    "django-redis==7.0.0",
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
    "django-pydantic-field==0.5.4",
-    "django==5.2.16",
-    "djangorestframework==3.17.1",
+    "django==5.2.17",
+    "djangorestframework==3.18.0",
    "drf_spectacular==0.30.0",
    "dockerflow==2026.3.4",
    "easy_thumbnails==2.10.1",
    "factory_boy==3.3.3",
-    "gunicorn==26.0.0",
+    "gunicorn==26.2.0",
    "jsonschema==4.26.0",
-    "markdown==3.10.2",
+    "markdown==3.10.3",
    "nested-multipart-parser==1.6.0",
-    "posthog==7.29.0",
+    "posthog==7.44.0",
    "psycopg[binary]==3.3.4",
    "pydantic==2.13.4",
-    "PyJWT==2.13.0",
+    "PyJWT==2.14.0",
    "python-frontmatter==1.3.0",
    "python-magic==0.4.27",
    "requests==2.34.2",
-    "sentry-sdk==2.66.1",
+    "sentry-sdk==2.68.1",
    "whitenoise==6.12.0",
    "mozilla-django-oidc==5.0.2",
    "livekit-api==1.2.0",
    "aiohttp==3.14.3",
-    "urllib3==2.7.0",
-    "phonenumbers==9.0.34",
-    "cryptography==50.0.0", # CVE-2026-69247
+    "urllib3==2.8.0",
+    "phonenumbers==9.0.37",
+    "cryptography==50.0.1", # CVE-2026-69247
 ]

 [project.urls]
@@ -76,20 +76,20 @@ dependencies = [
 [dependency-groups]
 dev = [
    "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.7.1",
+    "drf-spectacular-sidecar==2026.8.1",
    "freezegun==1.5.5",
    "ipdb==0.13.13",
-    "ipython==9.15.0",
+    "ipython==9.16.1",
    "pyfakefs==6.2.0",
    "pylint-django==2.8.0",
    "pylint<4.0.0",
    "pytest-cov==7.1.0",
-    "pytest-django==4.12.0",
+    "pytest-django==4.14.0",
    "pytest==9.1.1",
    "pytest-icdiff==0.9",
    "pytest-xdist==3.8.0",
    "responses==0.26.2",
-    "ruff==0.16.0",
+    "ruff==0.16.4",
    "types-requests==2.33.0.20260712",
 ]

@@ -39,6 +39,9 @@ ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
 ARG VITE_APP_TITLE
 ENV VITE_APP_TITLE=${VITE_APP_TITLE}

+ARG VITE_MEDIA_BASE_URL
+ENV VITE_MEDIA_BASE_URL=${VITE_MEDIA_BASE_URL}
+
 RUN npm run build

 # ---- Front-end image ----
@@ -46,6 +49,7 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production

 USER root
 RUN apk upgrade --no-cache libexpat && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' && \
    apk del curl
 USER nginx

@@ -1,12 +1,12 @@
 {
  "name": "meet",
-  "version": "1.31.0",
+  "version": "1.33.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "meet",
-      "version": "1.31.0",
+      "version": "1.33.0",
      "dependencies": {
        "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
        "@fontsource-variable/lexend": "5.3.0",
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.31.0",
+  "version": "1.33.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -121,7 +121,7 @@ const config: Config = {
    },
    tokens: defineTokens({
      /* we take a few things from the panda preset but for now we clear out some stuff.
-       * This way we'll only add the things we need step by step and prevent using lots of differents things.
+       * This way we'll only add the things we need step by step and prevent using lots of different things.
       */
      ...pandaPreset.theme.tokens,
      colors: defineTokens.colors({
@@ -1,6 +1,6 @@
 export const mediaUrl = (path: string) => {
  const origin =
-    import.meta.env.VITE_API_BASE_URL ||
+    import.meta.env.VITE_MEDIA_BASE_URL ||
    (typeof window !== 'undefined' ? window.location.origin : '')

  // Remove leading/trailing slashes from origin/path if it exists
@@ -41,6 +41,7 @@ export const useAnalytics = ({
        api_host: host,
        flags_api_host: flags_api_host,
        person_profiles: 'always',
+        remote_config_refresh_interval_ms: 0,
        capture_pageview: 'history_change',
        capture_pageleave: true,
        capture_exceptions: {
@@ -45,6 +45,10 @@ export const ScreenRecordingSidePanel = () => {
    FeatureFlags.ScreenRecording
  )

+  const hasTranscriptAccess = useHasRecordingAccess(
+    RecordingMode.Transcript,
+    FeatureFlags.Transcript
+  )
  const { notifyParticipants } = useNotifyParticipants()
  const { selectedLanguageKey, isLanguageSetToAuto } =
    useTranscriptionLanguage()
@@ -88,7 +92,7 @@ export const ScreenRecordingSidePanel = () => {
          ...(!isLanguageSetToAuto && {
            language: selectedLanguageKey,
          }),
-          ...(includeTranscript && { transcribe: true }),
+          ...(includeTranscript && hasTranscriptAccess && { transcribe: true }),
        }

        await startRecording({
@@ -182,24 +186,26 @@ export const ScreenRecordingSidePanel = () => {
        <RowWrapper iconName="mail" position="last">
          <Text variant="sm">{t('details.receiver')}</Text>
        </RowWrapper>
-
-        <div className={css({ height: '15px' })} />
-
-        <div
-          className={css({
-            width: '100%',
-            marginLeft: '20px',
-          })}
-        >
-          <Checkbox
-            size="sm"
-            isSelected={includeTranscript}
-            onChange={setIncludeTranscript}
-            isDisabled={statuses.isActive || isPendingToStart}
-          >
-            <Text variant="sm">{t('details.transcription')}</Text>
-          </Checkbox>
-        </div>
+        {hasTranscriptAccess && (
+          <>
+            <div className={css({ height: '15px' })} />
+            <div
+              className={css({
+                width: '100%',
+                marginLeft: '20px',
+              })}
+            >
+              <Checkbox
+                size="sm"
+                isSelected={includeTranscript}
+                onChange={setIncludeTranscript}
+                isDisabled={statuses.isActive || isPendingToStart}
+              >
+                <Text variant="sm">{t('details.transcription')}</Text>
+              </Checkbox>
+            </div>
+          </>
+        )}
      </VStack>
      <ControlsButton
        i18nKeyPrefix={keyPrefix}
@@ -53,6 +53,10 @@ export const TranscriptSidePanel = () => {
    FeatureFlags.Transcript
  )

+  const hasScreenRecordingAccess = useHasRecordingAccess(
+    RecordingMode.ScreenRecording,
+    FeatureFlags.ScreenRecording
+  )
  const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
    RecordingMode.Transcript,
    FeatureFlags.Transcript
@@ -97,7 +101,9 @@ export const TranscriptSidePanel = () => {
          room.localParticipant
        )
      } else {
-        const recordingMode = includeScreenRecording
+        const withScreenRecording =
+          includeScreenRecording && hasScreenRecordingAccess
+        const recordingMode = withScreenRecording
          ? RecordingMode.ScreenRecording
          : RecordingMode.Transcript

@@ -105,7 +111,7 @@ export const TranscriptSidePanel = () => {
          ...(!isLanguageSetToAuto && {
            language: selectedLanguageKey,
          }),
-          ...(includeScreenRecording && {
+          ...(withScreenRecording && {
            transcribe: true,
            original_mode: RecordingMode.Transcript,
          }),
@@ -122,7 +128,7 @@ export const TranscriptSidePanel = () => {
          type: NotificationType.TranscriptionStarted,
        })
        captureEvent('transcript-started', {
-          includeScreenRecording: includeScreenRecording,
+          includeScreenRecording: withScreenRecording,
          language: selectedLanguageKey,
        })
      }
@@ -234,22 +240,26 @@ export const TranscriptSidePanel = () => {
            </Button>
          </Text>
        </RowWrapper>
-        <div className={css({ height: '15px' })} />
-        <div
-          className={css({
-            width: '100%',
-            marginLeft: '20px',
-          })}
-        >
-          <Checkbox
-            size="sm"
-            isSelected={includeScreenRecording}
-            onChange={setIncludeScreenRecording}
-            isDisabled={statuses.isActive || isPendingToStart}
-          >
-            <Text variant="sm">{t('details.recording')}</Text>
-          </Checkbox>
-        </div>
+        {hasScreenRecordingAccess && (
+          <>
+            <div className={css({ height: '15px' })} />
+            <div
+              className={css({
+                width: '100%',
+                marginLeft: '20px',
+              })}
+            >
+              <Checkbox
+                size="sm"
+                isSelected={includeScreenRecording}
+                onChange={setIncludeScreenRecording}
+                isDisabled={statuses.isActive || isPendingToStart}
+              >
+                <Text variant="sm">{t('details.recording')}</Text>
+              </Checkbox>
+            </div>
+          </>
+        )}
      </VStack>
      <ControlsButton
        i18nKeyPrefix={keyPrefix}
@@ -158,7 +158,7 @@ export const Conference = ({
           *
           * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
           * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
-           * Root Cause: Certificate/security issue where the initial request is considered unsecure.
+           * Root Cause: Certificate/security issue where the initial request is considered insecure.
           *
           * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
           * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.
@@ -6,6 +6,7 @@ declare const __MEDIAPIPE_VERSION__: string
 interface ImportMetaEnv {
  readonly VITE_API_BASE_URL: string
  readonly VITE_APP_TITLE: string
+  readonly VITE_MEDIA_BASE_URL?: string
 }

 interface ImportMeta {
@@ -24,10 +24,11 @@ _summaryEnvVars: &summaryEnvVars
  APP_NAME: summary-microservice
  APP_API_TOKEN: password
  AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
-  AWS_S3_ACCESS_KEY_ID: meet
-  AWS_S3_SECRET_ACCESS_KEY: password
+  AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000/
+  AWS_S3_ACCESS_KEY_ID: meet-access-key
+  AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
  AWS_S3_SECURE_ACCESS: False
+  AWS_S3_REGION_NAME: local
  AUTHORIZED_TENANTS: >
    [
      {
@@ -161,9 +162,9 @@ backend:
    FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
    FRONTEND_IS_SILENT_LOGIN_ENABLED: False
    # S3 Storage
-    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
-    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet-access-key
+    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
    # Telephony
    ROOM_TELEPHONY_ENABLED: True
@@ -180,7 +181,7 @@ backend:
    # Custom Background
    AWS_S3_REGION_NAME: local
    AWS_S3_SIGNATURE_VERSION: s3v4
-    AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io
+    AWS_S3_DOMAIN_REPLACE: https://garage.127.0.0.1.nip.io
    MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
    FILE_UPLOAD_ENABLED: True
    CELERY_ENABLED: True
@@ -264,11 +265,11 @@ ingressMedia:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1

 serviceMedia:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
  port: 9000

 # ---- Extra ingress/service for background file uploads ------------
@@ -280,11 +281,11 @@ ingressMediaFiles:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1

 serviceMediaFiles:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
  port: 9000

 # ---- STT Orchestration Microservice Components --------------------
@@ -362,10 +363,11 @@ agentMetadata:
    {{- end }}
    {{- end }}
    ENABLE_SILERO_VAD: "false"
-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
-    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_ENDPOINT_URL: garage.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet-access-key
+    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
    AWS_S3_SECURE_ACCESS: False
+    AWS_S3_REGION_NAME: local
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
    AWS_S3_OUTPUT_FOLDER: metadata

@@ -16,11 +16,11 @@ egress:
    address: redis-master:6379
    password: pass
  s3:
-    access_key: meet
-    secret: password
+    access_key: meet-access-key
+    secret: meet-secret-access-key
    region: local
    bucket: meet-media-storage
-    endpoint: http://minio:9000
+    endpoint: http://garage:9000
    force_path_style: true

 loadBalancer:
@@ -19,11 +19,11 @@ egress:
    address: redis-master:6379
    password: pass
  s3:
-    access_key: meet
-    secret: password
+    access_key: meet-access-key
+    secret: meet-secret-access-key
    region: local
    bucket: meet-media-storage
-    endpoint: http://minio:9000
+    endpoint: http://garage:9000
    force_path_style: true

 loadBalancer:
@@ -0,0 +1,172 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: garage
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 10m
+spec:
+  rules:
+  - host: "garage.127.0.0.1.nip.io"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: garage
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - garage.127.0.0.1.nip.io
+    secretName: meet-tls
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  ports:
+  - name: client
+    port: 9000
+    protocol: TCP
+    targetPort: 9000
+  selector:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: garage
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: garage-config
+  namespace: {{ .Release.Namespace | quote }}
+data:
+  garage.toml: |
+    metadata_dir = "/var/lib/garage/meta"
+    data_dir = "/var/lib/garage/data"
+    db_engine = "lmdb"
+
+    replication_factor = 1
+
+    rpc_bind_addr = "127.0.0.1:3901"
+    rpc_public_addr = "127.0.0.1:3901"
+
+    [s3_api]
+    api_bind_addr = "[::]:9000"
+    # Clients must sign their requests for this region (AWS_S3_REGION_NAME)
+    s3_region = "local"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: garage-dev
+  namespace: {{ .Release.Namespace | quote }}
+type: Opaque
+data:
+  GARAGE_RPC_SECRET: {{ printf "%s/garage-rpc-secret" .Release.Namespace | sha256sum | b64enc }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: garage
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: garage
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: extra
+      app.kubernetes.io/name: garage
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: extra
+        app.kubernetes.io/name: garage
+    spec:
+      containers:
+      - name: garage
+        command:
+          - /garage
+          - server
+          - --single-node
+          - --default-bucket
+        env:
+          - name: GARAGE_RPC_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: garage-dev
+                key: GARAGE_RPC_SECRET
+          - name: GARAGE_DEFAULT_ACCESS_KEY
+            value: meet-access-key
+          - name: GARAGE_DEFAULT_SECRET_KEY
+            value: meet-secret-access-key
+          - name: GARAGE_DEFAULT_BUCKET
+            value: meet-media-storage
+        image: "dxflrs/garage:v2.4.1"
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9000
+          name: client
+        readinessProbe:
+          exec:
+            command:
+              - /garage
+              - health
+        volumeMounts:
+        - mountPath: /etc/garage.toml
+          name: config
+          subPath: garage.toml
+        - mountPath: /var/lib/garage
+          name: data
+      volumes:
+      - name: config
+        configMap:
+          name: garage-config
+      - name: data
+        emptyDir:
+---
+# Garage denies cross-origin requests by default: allow the frontend to upload
+# files straight to the bucket
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: garage-cors
+spec:
+  template:
+    spec:
+      containers:
+      - name: aws-cli
+        image: amazon/aws-cli:2.37.1
+        env:
+          - name: AWS_ACCESS_KEY_ID
+            value: meet-access-key
+          - name: AWS_SECRET_ACCESS_KEY
+            value: meet-secret-access-key
+          - name: AWS_DEFAULT_REGION
+            value: local
+          - name: AWS_ENDPOINT_URL
+            value: http://garage:9000
+          - name: BUCKET
+            value: meet-media-storage
+        command:
+          - /bin/sh
+          - -c
+          - |
+            deadline=$(($(date +%s) + 300))
+            until aws s3api head-bucket --bucket="$BUCKET" --cli-connect-timeout=5; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "Bucket $BUCKET still unavailable on $AWS_ENDPOINT_URL" >&2
+                exit 1
+              fi
+              echo "Waiting for bucket $BUCKET on $AWS_ENDPOINT_URL"
+              sleep 5
+            done
+            exec aws s3api put-bucket-cors --bucket="$BUCKET" \
+              --cors-configuration='{"CORSRules": [{"AllowedOrigins": ["https://meet.127.0.0.1.nip.io"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
+      restartPolicy: Never
+  backoffLimit: 3
@@ -1,115 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: minio
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 10m
-spec:
-  rules:
-  - host: "minio.127.0.0.1.nip.io"
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: minio
-            port:
-              number: 9000
-  tls:
-  - hosts:
-    - minio.127.0.0.1.nip.io
-    secretName: meet-tls
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: client
-    port: 9000
-    protocol: TCP
-    targetPort: 9000
-  - name: console
-    port: 9001
-    protocol: TCP
-    targetPort: 9001
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: minio
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: minio
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: minio
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: minio
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: minio
-    spec:
-      containers:
-      - name: minio
-        command:
-          - /bin/sh
-          - -c
-          - |
-            minio server --console-address :9001 /data
-        env:
-          - name: MINIO_ROOT_USER
-            value: meet
-          - name: MINIO_ROOT_PASSWORD
-            value: password
-        image: "quay.io/minio/minio"
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9000
-          name: client
-        - containerPort: 9001
-          name: console
-        volumeMounts:
-        - mountPath: /data
-          name: data
-        - mountPath: /etc/ssl/certs/mkcert-ca.pem
-          name: mkcert
-          subPath: rootCA.pem
-      volumes:
-      - name: data
-        emptyDir:
-      - name: mkcert
-        secret:
-          secretName: mkcert
---
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: minio-bucket
-spec:
-  template:
-    spec:
-      containers:
-      - name: mc
-        image: quay.io/minio/mc
-        command:
-          - /bin/sh
-          - -c
-          - |
-            /usr/bin/mc alias set meet http://minio:9000 meet password && \
-            /usr/bin/mc mb meet/meet-media-storage && \
-            exit 0
-      restartPolicy: Never
-  backoffLimit: 3
@@ -45,10 +45,10 @@
 | `ingressMedia.tls.additional[].hosts[]`                                      | Hosts for additional TLS config                      |                                                                    |
 | `ingressMedia.annotations.nginx.ingress.kubernetes.io/auth-url`              |                                                      | `https://meet.example.com/api/v1.0/recordings/media-auth/`         |
 | `ingressMedia.annotations.nginx.ingress.kubernetes.io/auth-response-headers` |                                                      | `Authorization, X-Amz-Date, X-Amz-Content-SHA256`                  |
-| `ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost`        |                                                      | `minio.meet.svc.cluster.local:9000`                                |
+| `ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost`        |                                                      | `garage.meet.svc.cluster.local:9000`                               |
 | `ingressMedia.annotations.nginx.ingress.kubernetes.io/configuration-snippet` |                                                      | `add_header Content-Security-Policy "default-src 'none'" always;
 ` |
-| `serviceMedia.host`                                                          |                                                      | `minio.meet.svc.cluster.local`                                     |
+| `serviceMedia.host`                                                          |                                                      | `garage.meet.svc.cluster.local`                                    |
 | `serviceMedia.port`                                                          |                                                      | `9000`                                                             |
 | `serviceMedia.annotations`                                                   |                                                      | `{}`                                                               |

@@ -1,10 +1,9 @@
 #!/usr/bin/env bash

-docker image ls | grep readme-generator-for-helm
-if [ "$?" -ne "0" ]; then
+if ! docker image ls | grep readme-generator-for-helm; then
 	git clone https://github.com/bitnami/readme-generator-for-helm.git /tmp/readme-generator-for-helm
-	cd /tmp/readme-generator-for-helm
+	cd /tmp/readme-generator-for-helm || exit 1
 	docker build -t readme-generator-for-helm:latest .
-	cd $(dirname -- "${BASH_SOURCE[0]}")
+	cd "$(dirname -- "${BASH_SOURCE[0]}")" || exit 1
 fi
 docker run --rm -it -v .:/source -w /source readme-generator-for-helm:latest readme-generator -v values.yaml -r README.md
@@ -51,7 +51,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}

 {{/*
-transform dictionnary of environment variables
+transform dictionary of environment variables
 Usage : {{ include "meet.env.transformDict" .Values.envVars }}

 Example:
@@ -128,7 +128,7 @@ ingressMedia:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/recordings/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header Content-Security-Policy "default-src 'none'" always;

@@ -136,7 +136,7 @@ ingressMedia:
 ## @param serviceMedia.port
 ## @param serviceMedia.annotations
 serviceMedia:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
  port: 9000
  annotations: {}

@@ -171,7 +171,7 @@ ingressMediaFiles:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/files/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header Content-Security-Policy "default-src 'none'" always;
      add_header Content-Disposition "attachment";
@@ -180,7 +180,7 @@ ingressMediaFiles:
 ## @param serviceMediaFiles.port
 ## @param serviceMediaFiles.annotations
 serviceMediaFiles:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
  port: 9000
  annotations: {}

@@ -289,6 +289,9 @@ backend:
  ## @param backend.cronjobs[1].name Name of the CronJob
  ## @param backend.cronjobs[1].schedule Schedule in cron format
  ## @param backend.cronjobs[1].command The bash command to execute in the CronJob
+  ## @param backend.cronjobs[2].name Name of the CronJob
+  ## @param backend.cronjobs[2].schedule Schedule in cron format
+  ## @param backend.cronjobs[2].command The bash command to execute in the CronJob

  cronjobs:
    - name: clean-pending-files
@@ -303,6 +306,12 @@ backend:
        - "/bin/sh"
        - "-c"
        - "python manage.py purge_deleted_files"
+    - name: purge-inactive-rooms
+      schedule: "0 1 * * *"
+      command:
+        - "/bin/sh"
+        - "-c"
+        - "python manage.py purge_inactive_rooms"

  ## @param backend.mergeDuplicateUsers.command backend merge_duplicate_users command
  ## @param backend.mergeDuplicateUsers.restartPolicy backend merge_duplicate_users job restart policy
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
lebaudantoine	022a568a45	🔧(summary) add setting to control Sentry traces sampling rate Replace the deprecated `enable_tracing=True` with `traces_sample_rate`, read from a new `sentry_traces_sample_rate` setting (default 0.1, validated to the 0.0–1.0 range). Previously, tracing sampled 100% of transactions, which is costly and unnecessary in production. The rate can now be tuned per environment without a code change.	2026-10-02 17:37:11 +02:00
lebaudantoine	2a11c7473b	🔒️(summary) redact meeting content from Sentry events Sentry attaches stack frame locals to its events. When storing a transcript in S3 failed, the full transcript held in `data` and `transcript` was sent to Sentry. Keep locals for debugging, but scrub variables and nested dict keys known to hold transcripts, summaries, LLM prompts, participants' personal data or pre-signed URLs. Share the Sentry init between the API and the Celery worker, and never send request bodies.	2026-10-02 17:37:11 +02:00
lebaudantoine	308834fa25	🐛(summary) disable default S3 checksums for GCS-compatible storage Since boto3/botocore 1.36, the S3 client computes CRC32 checksums on uploads by default (request_checksum_calculation="when_supported"). PutObject requests are then sent with aws-chunked encoding, a trailing x-amz-checksum-crc32 header and a STREAMING-UNSIGNED-PAYLOAD-TRAILER content hash. Our production storage (S3NS, storage.s3nsapis.fr) is built on Google Cloud Storage and exposes it through GCS's S3-compatible XML API, which does not support these flexible checksums. It rejects the request with a 403 SignatureDoesNotMatch ("Invalid argument"), so storing transcripts failed in the Celery worker. Garage, used locally, supports them, which is why the issue only appeared in production after switching the client to boto3. Add aws_request_checksum_calculation and aws_response_checksum_validation settings, defaulting to "when_required", and pass them to the botocore Config of the summary S3 client and the backend S3 client. Checksums are then only sent for operations that require them, restoring the pre-1.36 behavior.	2026-10-02 17:36:07 +02:00
lebaudantoine	ddd5e3fce1	✏️(ci) fix a codespell in env variable Minor typo introduced by the recording configurations.	2026-10-02 17:35:32 +02:00
lebaudantoine	5a9e1cb012	🔒️(frontend) upgrade pcre2 to fix CVE-2026-103111 The nginx-unprivileged:1.30.4-alpine3.24 base image ships pcre2 10.48-r0, which is affected by CVE-2026-103111 (HIGH, out-of-bounds write via crafted regular expression). No newer base image tag is available yet. Upgrade pcre2 from the Alpine v3.24 repository with a minimum version constraint (>=10.49-r0) so the build fails instead of silently shipping a vulnerable version if the fix is unavailable.	2026-10-02 17:35:32 +02:00
lebaudantoine	c49cee3ab4	🧑‍💻(devex) fix local recording downloads Recordings were failing to download in the local stack because of several small issues stacked together: * nginx: add a `/media/recordings/` location that authorizes against `recordings/media-auth/`. Before, every media request went to `files/media-auth/`, which returned 403 for recording paths. * nginx: call `proxy_hide_header Content-Disposition` before `add_header Content-Disposition "attachment"`. Garage stored the header as `inline`, which combined with nginx's value into `inline, attachment` and broke browser downloads. * frontend: `mediaUrl()` now uses the frontend origin, so recording links go through the Vite `/media` proxy instead of hitting Django directly on `:8071`. * frontend: include the file extension in the download filename. co-author: cameldev	2026-10-02 17:35:32 +02:00
lebaudantoine	bbc30de490	⚡️(devx) switch devstack to node:22-alpine The devstack was pulling the full `node:22` image, around 1.6 GB. Switch to `node:22-alpine`, which is much smaller, to speed up the devstack bootstrap time and reduce disk usage.	2026-10-02 15:59:04 +02:00
lebaudantoine	14b3395e1c	⚡️(devx) use a single Redis image version in the devstack The devstack was pulling two different versions of the Redis image. Align everything on a single version to save a few MB of network bandwidth when bootstrapping the stack. Late-night minor optimization.	2026-10-02 15:59:04 +02:00
leo	f673c07cb8	✨(backend) add per-recording encoding config to start-recording API Add new options to query start-start recording API. A resolution ("540p", "720p", "1080p") and a profile ("talking_heads", "text", "mixed") are resolved to provide a width, height, fps and bitrate which are passed on to the encoder. Using profiles allows for some flexibility on quality if necessary without changing front facing user config. Co-authored-by: sarthakbahal <sarthakbahal.45@gmail.com>	2026-10-02 14:16:01 +02:00
lebaudantoine	bd0329d162	🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111 The python:3.14.7-slim base image ships libpcre2-8-0 10.46-1~deb13u2, which is affected by CVE-2026-103111 (HIGH): an out-of-bounds write triggered by a crafted regular expression. Explicitly install libpcre2-8-0 in the base stage so apt pulls the patched 10.46-1~deb13u3 from trixie-security. All stages (builder, development, production) inherit the fix. This line can be dropped once an upstream python slim image ships the patched package.	2026-10-01 16:37:29 +02:00
lebaudantoine	cedaa32ab7	🔒️(backend) fix HIGH CVEs in Django and urllib3 Address the following HIGH severity CVEs reported by Trivy on the backend image: * Django 5.2.16 → 5.2.17 - CVE-2026-15307 — remote code execution via GeoDjango spatial lookups. * urllib3 2.7.0 → 2.8.0 - CVE-2026-97687 — traffic interception via HTTPS proxy TLS configuration override. - CVE-2026-97689 — denial of service via unbounded memory allocation in the chunk parser.	2026-10-01 16:37:29 +02:00
lebaudantoine	22adccb353	👷(ci) ignore unfixed Debian CVEs in trivy scans The trivy scan fails on HIGH vulnerabilities found in the Debian 13 base images (util-linux, acl, ncurses, systemd and perl-base). None of them has a fixed version available yet, so there is nothing we can upgrade to clear them. List these CVEs in a shared .github/.trivyignore and pass it to every image scan, so the scan stays blocking for any new HIGH or CRITICAL vulnerability. Remove the entries once Debian ships a fix.	2026-10-01 00:13:36 +02:00
lebaudantoine	3ab651d6c7	👷(ci) pin the shared CI repo to v0.0.1 Instead of referencing the shared CI repo on `main`, pin it to the initial tagged version `v0.0.1`, so the CI behavior is stable and does not silently change when the shared repo is updated.	2026-10-01 00:13:36 +02:00
lebaudantoine	919af928aa	🚨(ci) fix the shellcheck job Get the shellcheck CI job to pass again by addressing the issues it flagged across our shell scripts. Note: I am not 100% sure of every fix applied here. Reviewers should feel free to challenge specific changes and suggest better ones where relevant.	2026-10-01 00:13:36 +02:00
lebaudantoine	3ed38f1c48	🚨(ci) fix the spellcheck job Get the spellcheck CI job to pass again by: * Fixing the actual spelling issues it caught in the project. * Excluding generated files from the scan, since they are not written by us. * Excluding translation files, whose content is not necessarily in English and would trigger false positives.	2026-10-01 00:13:36 +02:00
lebaudantoine	f172c5795e	👷(ci) add Menshen scan for GitHub Actions vulnerabilities Wire Menshen into the CI to scan the GitHub Actions we use and flag vulnerable ones, following the same approach as other projects that recently adopted it. Note: I am not fully sure about the current setup. Reviewers should feel free to adjust the configuration or the integration point as they see fit.	2026-10-01 00:13:36 +02:00
lebaudantoine	262b168414	🔥(ci) drop unused Crowdin workflows The Crowdin workflows were not used by the project and had turned into dead CI code. Remove them to reduce noise and keep the CI configuration limited to what is actually running.	2026-10-01 00:13:36 +02:00
lebaudantoine	6c371c8cb3	👷(ci) migrate CI to the shared workflows repository First iteration of a migration toward a centralized repository containing our shared CI logic. Goals: * Manage GitHub Actions version upgrades in one place. * Make it easier to audit what actually runs in CI from a security perspective. * Avoid duplicating CI logic across projects and having each repository slowly diverge over time. * Centralize as many of our custom GitHub Actions as possible, including some that still live in the old `numerique-gouv` organization. * Centralize the Renovate configuration alongside the workflows. Inspired by the Accounts project, which recently simplified and reorganized its CI setup. This PR starts moving meet's CI to the shared repository so we can validate the approach on a real project. For now, reusable workflows are pinned to `main`; once we agree on the structure and content of the central repository, they should be pinned to a specific commit SHA instead.	2026-10-01 00:13:36 +02:00
lebaudantoine	1a8906c0a1	🔒️(agents) fix util-linux CVEs reported by Cyberwatch Address the following CVEs in util-linux, reported by Cyberwatch on the agents image. The python:3.14.6-slim tag is no longer rebuilt and still ships util-linux 2.41-5. Bump the base image to python:3.14.7-slim, which ships the patched 2.41.5-0+deb13u1 (DSA-6442-1), to cover them all: * CVE-2026-53612 (7.0) — TOCTOU in mount post-mount ownership/mode changes. * CVE-2026-53613 (7.0) — TOCTOU in mount via ancestor directory swap. * CVE-2026-53614 (7.0) — SUID mount(8) nosuid/noexec bypass via `LIBMOUNT_FORCE_MOUNT2`. * CVE-2026-13595 (5.3) — flaw in the libblkid library. * CVE-2026-27456 (4.7) — TOCTOU in SUID mount(8) when setting up loop devices.	2026-09-30 16:21:22 +02:00
lebaudantoine	99ba8e330e	🐛(frontend) enforce recording-mode permissions on the checkboxes Permissions on the recording panel checkboxes were not properly enforced. A user with only partial access to some recording modes could still tick a mode's checkbox and, for example, launch a transcription from the recording panel even though they were not authorized to. Gate each checkbox on the user's actual permissions so that only authorized modes can be started from the panel.	2026-09-30 15:15:19 +02:00
lebaudantoine	059e5f1ec4	🔒️(backend) add a daily cap on room creation The per-minute room creation throttle absorbs bursts but does not stop a compromised account from steadily creating rooms over hours or days. Add RoomCreationDailyUserRateThrottle, a per-user throttle with its own "room_creation_daily" scope, applied to room creation only alongside the existing short-term throttle. It defaults to 1000 rooms per day and is configurable via ROOM_CREATION_DAILY_THROTTLE_RATES. Tests use a controllable clock and patch rates with monkeypatch so they are restored after each test.	2026-09-30 14:57:10 +02:00
Lebaud Antoine	39ab9359e4	🔒️(backend) throttle meeting link generation Add throttling on the endpoint used to generate meeting links, so a compromised authenticated account cannot silently generate thousands of links without hitting any suspicious errors or alerts. The limits are set high enough not to affect legitimate usage, while capping the damage a leaked account can do.	2026-09-30 14:57:10 +02:00
lebaudantoine	d0a0d60ece	🔖(minor) bump release to 1.33.0	2026-09-30 13:03:41 +02:00
lebaudantoine	27bd136741	🩹(doc) fix changelog organization after a bad rebase The CHANGELOG entries ended up in the wrong order after a rebase performed while merging a recent PR. Restore the intended organization of the entries so the file reads correctly again.	2026-09-30 12:29:39 +02:00
lebaudantoine	ad2ca6b4ef	🔒️(backend) fix critical and high CVEs in PyJWT Bump PyJWT from 2.13.0 to 2.14.0 to address the following CVEs reported by Trivy: * CVE-2026-102268 (CRITICAL) * CVE-2026-102266 (HIGH) — authentication bypass via empty HMAC key acceptance. * CVE-2026-102267 (HIGH) — verification key substitution via unvalidated JWKS redirects. * CVE-2026-102271 (HIGH) — authentication bypass via acceptance of DER public keys as HMAC. * CVE-2026-102272 (HIGH) — token forgery via improper Unicode byte-order mark handling. * CVE-2026-102273 (HIGH) — token forgery via acceptance of public JWK containers as HMAC.	2026-09-30 12:18:37 +02:00
leo	4071984f8e	⬆️(dependencies) update python dependencies Update python dependencies. Co-Authored-By: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-09-29 11:47:32 +02:00
lebaudantoine	2ae602606c	⚡️(frontend) disable posthog-js periodic feature flag reloads Since posthog-js 1.356.0, feature flags are reloaded every 5 minutes by default while the tab is visible. Meet sessions are long-lived visible tabs, so this multiplied the number of `/flags` requests we send. Restore the pre-1.356.0 behavior: only (re)load flags on init and on identity	2026-09-29 11:14:05 +02:00
briquet	f28389b624	👷(helm) run the inactive rooms purge command as cronjob Schedule `purge_inactive_rooms` every night along with the other housekeeping commands.	2026-09-29 11:08:38 +02:00
briquet	cbb8740f41	📝(docs) document the inactive rooms purge Add a basic documentation of the purge_inactive_rooms command	2026-09-29 11:08:38 +02:00
briquet	b4b9fe54fb	♻️(backend) add command to purge inactive rooms Add a `purge_inactive_rooms` management command which permanently deletes the rooms that were not started for `ROOM_INACTIVITY_DELETION_DAYS` days. Rooms never started are aged from their creation date. Important points : - The setting is unset by default, which disables the purge. - Rooms holding a recording their users may still access are kept, - It refuses to run while unregistered rooms are allowed, as the link of a purged room would turn into a public unregistered room,	2026-09-29 11:08:38 +02:00
briquet	88685d613a	🧐(backend) track room last start datetime from livekit webhook Rooms pile up in database with no way to tell the ones still in use from the abandoned ones. Record on the room the last time LiveKit reported it as started, in a new `last_started_at` field which stays NULL until the first time the room is started on a LiveKit node. The migration stamps existing rooms with the migration time to avoid deleting preexisting rooms.	2026-09-29 11:08:38 +02:00
briquet	6cde1b4461	🔨(dev) add Makefile targets to list and download files from Garage Garage has no web console, so inspecting recordings, transcripts and summaries locally meant writing aws-cli commands by hand. For each of recordings, transcripts and summaries: - `make <folder>-list` lists the files from the most recent, and - `make <folder>-download-latest` downloads the latest one into data/<folder>. Only files with the folder's expected extensions are kept, so the Egress manifests stored next to recordings are skipped.	2026-09-29 10:52:49 +02:00
briquet	68fe3f96fc	🔧(helm) point media services to Garage by default The media ingresses and their ExternalName services defaulted to the MinIO service of the development stack, which is now Garage. Self-hosted relying on these defaults must set serviceMedia*.host and the upstream-vhost annotations explicitly, see UPGRADE.md.	2026-09-29 10:52:49 +02:00
briquet	3f9942a61d	🔧(compose) replace MinIO by Garage for local development The development stacks now run Garage instead of MinIO which is deprecated. Garage is a bit stricter than MinIO: - key IDs and secrets must be at least 8 and 16 characters long - requests must be signed for its region, so every development env now sets AWS_S3_REGION_NAME=local; - cross-origin requests are denied unless the bucket CORS rules allow them, so a one-shot aws-cli container allows the frontend origin to upload files straight to the bucket.	2026-09-29 10:52:49 +02:00
briquet	62a2515c6b	✅(summary) test the S3 FileClient service Ensure that the new combination of boto + Garage work well together and honor the region and secure parameters.	2026-09-29 10:52:49 +02:00
briquet	fa9b30c6bf	♻️(agents) replace the minio client by boto3 Switch from the minio client to the boto3 python client, in the metadata collector agent and the summary service. AWS_S3_REGION_NAME is passed as-is to boto3, the region is not looked up from the bucket.	2026-09-29 10:52:49 +02:00
lebaudantoine	4d9ee4e9c5	🔧(devx) call summary v2 without trailing slash from dev backend In the dev stack, configure the backend to call the summary service using its v2 API by default. Also strip the trailing `/` from the task endpoint, which was triggering a redirect on every call.	2026-09-29 10:40:28 +02:00
lebaudantoine	72cd5a8f18	🔥(github) remove local GitHub PR and issue templates The organization now provides default GitHub templates for pull requests and issues at the org level, so individual repositories no longer need to duplicate the same Markdown files. Delete the local templates so this project uses the organization defaults, reducing the amount of code we maintain and centralizing the practice across repositories.	2026-09-28 17:03:41 +02:00
lebaudantoine	21dc63b8ce	🔖(patch) bump release to 1.32.1	2026-09-25 16:47:35 +02:00
lebaudantoine	8d5d42cfdb	🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64 Address the following CVEs reported by Trivy on the LiveKit agent image against `libssl3t64` 3.5.7-1~deb13u2: * CVE-2026-63073 — CRITICAL (CVSS 9.8) * CVE-2026-63072 Bump `libssl3t64` to the patched version to pick up both fixes.	2026-09-25 16:40:39 +02:00
lebaudantoine	2480a76b62	🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf Address the following MEDIUM severity CVEs reported against `djangorestframework` 3.17.1: * CVE-2026-73228 (CVSS 5.3) * CVE-2026-73229 (CVSS 4.3) Bump `djangorestframework` to the patched version to pick up the fixes.	2026-09-25 16:40:39 +02:00
lebaudantoine	31c8f3ec06	🔖(minor) bump release to 1.32.0	2026-09-25 15:18:15 +02:00
snyk-bot	a8c4aee0c2	⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2 Snyk has created this PR to upgrade i18next from 26.4.1 to 26.4.2. See this package in npm: i18next See this project in Snyk: https://app.eu.snyk.io/org/lasuite-dinum-default/project/af693e79-8c43-4c09-ab65-60580515c9e8?utm_source=github&utm_medium=referral&page=upgrade-pr	2026-09-25 11:56:59 +02:00