🔒️(backend) upgrade base image to python:3.13.15-alpine3.24

Fixes an XML injection attack in libexpat (CVE-2026-93990)
🚸(frontend) inform user that recording waits until a track is published
2026-09-30 06:28:59 +00:00 · 2026-09-24 19:52:33 +02:00 · 2026-09-24 00:24:40 +02:00 · 2026-09-22 16:21:00 +02:00 · 2026-09-22 16:21:00 +02:00 · 2026-09-22 16:21:00 +02:00
65 changed files with 1874 additions and 220 deletions
@@ -86,3 +86,6 @@ docker/livekit/rootCA.pem

 # Frontend rollup-plugin-visualizer
 /src/frontend/rollup-plugin-visualizer/*
+
+# NixOS
+.devenv
@@ -11,9 +11,14 @@ and this project adheres to
 ### Added

 - ✨(backend) make the LiveKit default video codec configurable
+- 🔧(dev) add support for Bureautix workstations
+- ✨(frontend) add screen share zoom controls #1498

 ### Changed

+- 🔊(backend) pin the dockerflow logger level to WARNING
+- 🚑️(summary) serve health endpoints with the dockerflow router
+- ♻️(backend) serve the dockerflow views early in the middleware stack
 - 📈(frontend) include LiveKit SIDs in the connection analytics event
 - 🔇(backend) silence expected 401 warnings on /me
 - 🔇(backend) silence noisy request summary info logs
@@ -22,12 +27,22 @@ and this project adheres to
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
+- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.1
+- 🔖(helm) release chart 0.0.28

 ### Fixed

+- 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
+- 🐛(helm) render periodSeconds and failureThreshold on probes
+- 🐛(backend) report the app release to Sentry instead of "NA"
+- 🐛(frontend) play the waiting room notification sound on every arrival
+- 🐛(frontend) apply saved reception resolution when joining a meeting #1714
 - 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
 - 🔒️(backend) enforce display name setting on rename API
 - 🔒️(backend) reject inactive users in resource server backend
+- 🐛(frontend) fix file permissions in the Docker image
+- 🚸(frontend) inform user that recording waits until a track is published
+- 🔒(backend) upgrade base image to python:3.13.15-alpine3.24

 ## [1.31.0] - 2026-09-08

@@ -1,7 +1,7 @@
 # Django Meet

 # ---- base image to inherit from ----
-FROM python:3.13.5-alpine3.21 AS base
+FROM python:3.13.15-alpine3.24 AS base

 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip
@@ -292,7 +292,7 @@ shell: ## connect to database shell
 # -- Database

 dbshell: ## connect to database shell
-	docker compose exec app-dev python manage.py dbshell
+	@$(COMPOSE_EXEC_APP) python manage.py dbshell
 .PHONY: dbshell

 resetdb: FLUSH_ARGS ?=
@@ -5,7 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0

-COMPOSE_FILE="${REPO_DIR}/compose.yml"
+export COMPOSE_FILE="${COMPOSE_FILE:-${REPO_DIR}/compose.yml}"
 COMPOSE_PROJECT="meet"


@@ -42,7 +42,6 @@ function _docker_compose() {
    echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
    docker compose \
        -p "${COMPOSE_PROJECT}" \
-        -f "${COMPOSE_FILE}" \
        --project-directory "${REPO_DIR}" \
        "$@"
 }
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_docker_compose "$@"
@@ -0,0 +1,47 @@
+{
+  "nodes": {
+    "devenv": {
+      "locked": {
+        "dir": "src/modules",
+        "lastModified": 1778705847,
+        "narHash": "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=",
+        "ref": "refs/tags/v2.1.2",
+        "rev": "ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be",
+        "revCount": 6569,
+        "type": "git",
+        "url": "https://github.com/cachix/devenv"
+      },
+      "original": {
+        "dir": "src/modules",
+        "ref": "refs/tags/v2.1.2",
+        "type": "git",
+        "url": "https://github.com/cachix/devenv"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1789542786,
+        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
+        "ref": "nixos-26.05",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
+        "shallow": true,
+        "type": "git",
+        "url": "https://github.com/NixOS/nixpkgs"
+      },
+      "original": {
+        "ref": "nixos-26.05",
+        "shallow": true,
+        "type": "git",
+        "url": "https://github.com/NixOS/nixpkgs"
+      }
+    },
+    "root": {
+      "inputs": {
+        "devenv": "devenv",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
@@ -0,0 +1,265 @@
+# =============================================================================
+#  devenv.nix — La Suite Meet ("Visio") developer environment
+# =============================================================================
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  python = pkgs.python313;
+  nodejs = pkgs.nodejs_22;
+
+  backendDir = "src/backend";
+  agentsDir = "src/agents";
+  summaryDir = "src/summary";
+  frontendDir = "src/frontend";
+
+  readDotEnv =
+    file:
+    let
+      lines = lib.splitString "\n" (builtins.readFile file);
+      unquote =
+        v:
+        let
+          len = builtins.stringLength v;
+        in
+        if len >= 2 && lib.hasPrefix "\"" v && lib.hasSuffix "\"" v then
+          builtins.substring 1 (len - 2) v
+        else if len >= 2 && lib.hasPrefix "'" v && lib.hasSuffix "'" v then
+          builtins.substring 1 (len - 2) v
+        else
+          v;
+      parseLine =
+        line:
+        let
+          m = builtins.match "[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)" line;
+        in
+        if m == null then null else { name = builtins.elemAt m 0; value = unquote (builtins.elemAt m 1); };
+    in
+    builtins.listToAttrs (builtins.filter (x: x != null) (map parseLine lines));
+
+  # Reuse existing .env
+  dotEnv =
+    (readDotEnv ./env.d/development/common.dist)
+    // (readDotEnv ./env.d/development/postgresql.dist);
+
+  sharedEnv = builtins.removeAttrs dotEnv [ "PYTHONPATH" ]; # only makes sense inside the backend container.
+in
+{
+  options.meet = {
+    agents.enable = lib.mkEnableOption "tooling for the LiveKit agents in src/agents";
+    summary.enable = lib.mkEnableOption "tooling for the summary service in src/summary";
+    k8s.enable = lib.mkEnableOption "Kubernetes dev utilities";
+  };
+
+  config = {
+    # Profile can be activated with devenv --profile <profile> shell
+    profiles = {
+      agents.module = {
+        meet.agents.enable = true;
+      };
+      summary.module = {
+        meet.summary.enable = true;
+      };
+      k8s.module = {
+        meet.k8s.enable = true;
+      };
+    };
+    languages.python = {
+      enable = true;
+      package = python;
+      directory = backendDir;
+      manylinux.enable = pkgs.stdenv.hostPlatform.isLinux;
+
+      libraries = [
+        "${config.devenv.dotfile}/profile"
+        pkgs.file
+        pkgs.zlib
+        pkgs.libffi
+        pkgs.openssl
+      ];
+
+      uv.enable = true;
+      uv.sync.enable = false;
+      venv.enable = false;
+      lsp.enable = true;
+    };
+
+    languages.javascript = {
+      enable = true;
+      package = nodejs;
+      directory = frontendDir;
+
+      npm.enable = true;
+      yarn.enable = true;
+      corepack.enable = false;
+    };
+
+    languages.typescript.enable = false;
+    languages.nix.enable = true;
+
+    packages =
+      with pkgs;
+      [
+        gnumake
+        file
+        shared-mime-info
+        gettext
+        postgresql_16
+        git
+        curl
+        jq
+        podman
+        podman-compose
+        docker-client
+      ]
+
+      # -- LiveKit agents
+      ++ lib.optionals config.meet.agents.enable [
+        glib
+        portaudio
+        livekit-cli
+      ]
+
+      # -- summary service
+      ++ lib.optionals config.meet.summary.enable [
+        redis
+      ]
+
+      # -- Kubernetes tools
+      ++ lib.optionals config.meet.k8s.enable [
+        kubectl
+        kubernetes-helm
+        helmfile
+        tilt
+        kind
+        mkcert
+      ];
+
+    env = sharedEnv // {
+      UV_LINK_MODE = "copy";
+
+      PYTHONDONTWRITEBYTECODE = "1";
+      PYTHONUNBUFFERED = "1";
+
+      UV_PROJECT_ENVIRONMENT = lib.mkForce ".venv";
+
+      COMPOSE_PROJECT_NAME = "meet";
+
+      DJANGO_DATA_DIR = "${config.devenv.root}/data";
+
+      # Database / Pgsql
+      DB_HOST = "127.0.0.1";
+      DB_PORT = "15432";
+      PGHOST = "127.0.0.1";
+      PGPORT = "15432";
+      PGDATABASE = sharedEnv.DB_NAME;
+      PGUSER = sharedEnv.DB_USER;
+      PGPASSWORD = sharedEnv.DB_PASSWORD;
+
+      REDIS_URL = "redis://127.0.0.1:6379/1";
+      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
+
+      # S3 / MinIO
+      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
+
+      # OIDC
+      OIDC_OP_JWKS_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/certs";
+      OIDC_OP_TOKEN_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token";
+      OIDC_OP_USER_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/userinfo";
+      OIDC_OP_INTROSPECTION_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token/introspect";
+
+      # summary service
+      SUMMARY_SERVICE_ENDPOINT = "http://127.0.0.1:8001/api/v2/async-jobs/transcribe/";
+      SUMMARY_SERVICE_VERSION = "2";
+
+      # Mail
+      DJANGO_EMAIL_HOST = "127.0.0.1";
+    };
+
+    scripts = {
+
+      meet-venv = {
+        description = "Create/refresh meet uv virtualenvs for backend, agents and summary";
+        exec = ''
+          set -euo pipefail
+          cd "$DEVENV_ROOT"
+
+          echo "==> ${backendDir} (uv sync --locked, dependency-groups)"
+          ( cd "${backendDir}" && uv sync --locked --all-groups )
+
+          echo "==> ${agentsDir} (uv sync --locked --all-extras)"
+          ( cd "${agentsDir}" && uv sync --locked --all-extras )
+
+          echo "==> ${summaryDir} (uv sync --locked --all-extras)"
+          ( cd "${summaryDir}" && uv sync --locked --all-extras )
+
+          echo
+          echo "Synced the following virtualenvs successfully:"
+          echo "  ${backendDir}/.venv"
+          echo "  ${agentsDir}/.venv"
+          echo "  ${summaryDir}/.venv"
+        '';
+      };
+    };
+
+    enterShell = ''
+      # Make podman socket accessible in order to launch regular docker commands.
+      # Set MEET_PODMAN_SOCKET=0 to keep the DOCKER_HOST of the calling environment.
+      case "''${MEET_PODMAN_SOCKET:-1}" in
+        0|false|no|off) ;;
+        *)
+          _rundir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+          export DOCKER_HOST="unix://$_rundir/podman/podman.sock"
+          unset _rundir
+          ;;
+      esac
+
+      # Compose files to merge
+      _compose_dir="${config.devenv.root}/docker/compose.d"
+      _compose_files="${config.devenv.root}/compose.yml"
+
+      export DOCKER_USER="$(id -u):$(id -g)"
+
+      case "''${DOCKER_HOST:-}" in
+        *podman*)
+          _compose_files="$_compose_files:$_compose_dir/compose.podman.yml"
+
+          # Build images with Podman/Buildah rather than BuildKit. `docker
+          # compose build` otherwise has buildx boot a moby/buildkit container,
+          # and that container lands in its own network namespace with neither
+          # the proxy in its environment nor any route to it.
+          # Buildah has neither problem: base images are resolved by the Podman systemd
+          # service, which inherits the proxy from its systemd socket activated unit, and
+          # RUN steps execute in the *host* network namespace
+
+          export DOCKER_BUILDKIT=0
+          export COMPOSE_BAKE=false
+          ;;
+      esac
+
+
+      # Apply Bureautix override
+      if [ -n "''${http_proxy:-}" ]; then
+        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
+      fi
+
+      export COMPOSE_FILE="$_compose_files"
+      unset _compose_dir _compose_files
+
+      # Make binaries accessible
+      for _d in \
+        "$DEVENV_ROOT/${backendDir}/.venv/bin" \
+        "$DEVENV_ROOT/${agentsDir}/.venv/bin" \
+        "$DEVENV_ROOT/${summaryDir}/.venv/bin" \
+        "$DEVENV_ROOT/${frontendDir}/node_modules/.bin"
+      do
+        [ -d "$_d" ] && export PATH="$_d:$PATH"
+      done
+      unset _d
+    '';
+  };
+}
@@ -0,0 +1,5 @@
+inputs:
+  nixpkgs:
+    url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
+  devenv:
+    url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules
@@ -0,0 +1,48 @@
+# Bureautix proxy overrides
+#
+# Builds submitted through the Docker API of the Podman service get none of
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# otherwise all connections fail during the build.
+
+x-proxy-vars: &proxy-vars
+  http_proxy: ${http_proxy:-}
+  https_proxy: ${https_proxy:-}
+  no_proxy: ${no_proxy:-}
+
+services:
+  app:
+    build:
+      args:
+        <<: *proxy-vars
+  app-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  frontend:
+    build:
+      args:
+        <<: *proxy-vars
+  metadata-collector-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  multi-user-transcriber-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  app-summary-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  celery-summary-transcribe:
+    build:
+      args:
+        <<: *proxy-vars
+  celery-summary-summarize:
+    build:
+      args:
+        <<: *proxy-vars
+  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
+  keycloak:
+    ports: !override
+      - "8081:8080"
@@ -0,0 +1,33 @@
+# Rootless Podman override for compose.yml.
+#
+# Rootless Podman maps container UID 0 to the host user and every other
+# container UID to a subuid that owns nothing in the worktree. Meet compose.ymlruns
+# its containers as DOCKER_USER=$(id -u):$(id -g), which would land on such a
+# subuid and make every bind mount effectively read-only.
+#
+# `userns_mode: keep-id` maps the host user to the same UID and GID inside the
+# container instead, so DOCKER_USER keeps its Docker value and files written
+# through a bind mount are owned by the host user on both sides.
+#
+# Only the services that mount the worktree and run as DOCKER_USER are listed.
+
+x-keep-id: &keep-id
+  userns_mode: keep-id
+
+services:
+  app-dev:
+    <<: *keep-id
+  celery-dev:
+    <<: *keep-id
+  minio:
+    <<: *keep-id
+  node:
+    <<: *keep-id
+  crowdin:
+    <<: *keep-id
+  metadata-collector-dev:
+    <<: *keep-id
+  multi-user-transcriber-dev:
+    <<: *keep-id
+  app-summary-dev:
+    <<: *keep-id
@@ -21,3 +21,10 @@ turn:
    - 192.168.0.0/16
    - 172.16.0.0/12

+rtc:
+  node_ip: 127.0.0.1
+  advertise_internal_ip: true
+  udp_port: 7882
+  tcp_port: 7881
+  use_external_ip: false
+
@@ -10,7 +10,7 @@
      "license": "MIT",
      "dependencies": {
        "core-js": "3.50.0",
-        "i18next": "26.4.0",
+        "i18next": "26.4.1",
        "i18next-browser-languagedetector": "8.2.1",
        "regenerator-runtime": "0.14.1"
      },
@@ -9367,9 +9367,9 @@
      }
    },
    "node_modules/i18next": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.0.tgz",
-      "integrity": "sha512-rsmK5bFqsD1AetSFSIa43wtNR4WpvvH4p0tLEsTxkC7QTrfdFm06nbQ95bh8Og4wwaCnUEcm9DVYL2cgxitiQg==",
+      "version": "26.4.1",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.1.tgz",
+      "integrity": "sha512-9YbX5E6gd1H+yaOSX3izCsPj5iWXyH7X4oC+iuHHJJw8AeHglzOK5SJf+1CHxaYKYigcea+8jvzSxqYx46YvyA==",
      "funding": [
        {
          "type": "individual",
@@ -27,7 +27,7 @@
  },
  "dependencies": {
    "core-js": "3.50.0",
-    "i18next": "26.4.0",
+    "i18next": "26.4.1",
    "i18next-browser-languagedetector": "8.2.1",
    "regenerator-runtime": "0.14.1"
  },
@@ -1,7 +1,8 @@
 FROM python:3.14.6-slim AS base

-# Install system dependencies required by LiveKit
-RUN apt-get update && apt-get install -y \
+# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
+RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
+    && apt-get update && apt-get install -y --no-install-recommends  \
    libglib2.0-0 \
    libgobject-2.0-0 \
    && rm -rf /var/lib/apt/lists/*
@@ -117,9 +117,11 @@ def test_start_subtitle_invalid_token():
    assert response.json() == {"detail": "Invalid LiveKit token: Not enough segments"}


-def test_start_subtitle_disabled_by_default(mock_livekit_token):
+def test_start_subtitle_disabled_by_default(mock_livekit_token, settings):
    """Test that subtitle functionality is disabled when feature flag is off."""

+    settings.ROOM_SUBTITLE_ENABLED = False
+
    room = RoomFactory()
    user = UserFactory()
    client = APIClient()
@@ -0,0 +1,78 @@
+"""Tests for the Dockerflow health endpoints backing the Kubernetes probes."""
+
+from unittest import mock
+
+from django.core import checks
+from django.test.utils import override_settings
+
+import pytest
+from dockerflow.django.views import django_check_registry
+
+pytestmark = pytest.mark.django_db
+
+
+@pytest.mark.parametrize("path", ["/__lbheartbeat__", "/__heartbeat__"])
+def test_dockerflow_endpoints_are_anonymous(client, path):
+    """Both endpoints answer without authentication."""
+    response = client.get(path)
+
+    assert response.status_code == 200
+
+
+def test_dockerflow_lbheartbeat_is_a_liveness_signal(client, django_assert_num_queries):
+    """The load balancer heartbeat answers 200 without touching the database."""
+    with django_assert_num_queries(0):
+        response = client.get("/__lbheartbeat__")
+
+    assert response.status_code == 200
+
+
+def test_dockerflow_lbheartbeat_ignores_allowed_hosts(client):
+    """The probes are served before ALLOWED_HOSTS is enforced."""
+    response = client.get("/__lbheartbeat__", headers={"host": "1.2.3.4:8000"})
+
+    assert response.status_code == 200
+
+
+def test_dockerflow_heartbeat_reports_the_configured_checks(client):
+    """The heartbeat runs the database, migrations and redis checks."""
+    with override_settings(DEBUG=True):
+        response = client.get("/__heartbeat__")
+
+    assert response.status_code == 200
+
+    payload = response.json()
+    assert payload["status"] == "ok"
+    assert payload["details"] == {}
+    assert payload["checks"]["check_database_connected"] == "ok"
+    assert payload["checks"]["check_migrations_applied"] == "ok"
+
+
+def test_dockerflow_heartbeat_is_a_readiness_signal(client):
+    """A check reporting an error takes the heartbeat down with a 500."""
+
+    def failing_check(**kwargs):
+        return [checks.Error("Could not connect to database", id="health.E001")]
+
+    with mock.patch.object(
+        django_check_registry, "get_checks", return_value=[failing_check]
+    ):
+        response = client.get("/__heartbeat__")
+
+    assert response.status_code == 500
+    assert response.json()["status"] == "error"
+
+
+def test_dockerflow_heartbeat_tolerates_warnings(client):
+    """A warning in the check should not affect the probes."""
+
+    def warning_check(**kwargs):
+        return [checks.Warning("Unapplied migration", id="health.W001")]
+
+    with mock.patch.object(
+        django_check_registry, "get_checks", return_value=[warning_check]
+    ):
+        response = client.get("/__heartbeat__")
+
+    assert response.status_code == 200
+    assert response.json()["status"] == "warning"
@@ -0,0 +1,47 @@
+"""Unit tests for the get_release settings helper."""
+
+import re
+
+import pytest
+
+from meet.settings import get_release
+
+
+@pytest.fixture(name="base_dir")
+def fixture_empty_base_dir(tmp_path, monkeypatch):
+    """Point get_release at an empty directory."""
+    monkeypatch.setattr("meet.settings.BASE_DIR", str(tmp_path))
+    return tmp_path
+
+
+def test_get_release_reads_project_pyproject():
+    """Should return the semantic version of the backend's pyproject.toml."""
+    assert re.fullmatch(r"\d+\.\d+\.\d+", get_release())
+
+
+def test_get_release_reads_pyproject_version(base_dir):
+    """Should return the version declared in the [project] table."""
+    (base_dir / "pyproject.toml").write_text(
+        '[project]\nname = "meet"\nversion = "1.2.3"\n', encoding="utf-8"
+    )
+    assert get_release() == "1.2.3"
+
+
+@pytest.mark.usefixtures("base_dir")
+def test_get_release_missing_pyproject():
+    """Should fall back to "NA" without a pyproject.toml."""
+    assert get_release() == "NA"
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        '[project]\nname = "meet"\n',  # no version
+        "[tool.uv]\npackage = true\n",  # no [project] table
+        "[project\nversion = ",  # malformed TOML
+    ],
+)
+def test_get_release_unreadable_version(base_dir, content):
+    """Should fall back to "NA" without a readable version in pyproject.toml."""
+    (base_dir / "pyproject.toml").write_text(content, encoding="utf-8")
+    assert get_release() == "NA"
@@ -12,7 +12,7 @@ https://docs.djangoproject.com/en/3.1/ref/settings/

 # pylint: disable=too-many-lines

-import json
+import tomllib
 import warnings
 from os import path
 from socket import gethostbyname, gethostname
@@ -37,19 +37,11 @@ GB = 1024 * MB
 def get_release():
    """
    Get the current release of the application
-
-    By release, we mean the release from the version.json file à la Mozilla [1]
-    (if any). If this file has not been found, it defaults to "NA".
-
-    [1]
-    https://github.com/mozilla-services/Dockerflow/blob/master/docs/version_object.md
    """
-    # Try to get the current release from the version.json file generated by the
-    # CI during the Docker image build
    try:
-        with open(path.join(BASE_DIR, "version.json"), encoding="utf8") as version:
-            return json.load(version)["version"]
-    except FileNotFoundError:
+        with open(path.join(BASE_DIR, "pyproject.toml"), "rb") as pyproject:
+            return tomllib.load(pyproject)["project"]["version"]
+    except (FileNotFoundError, KeyError, tomllib.TOMLDecodeError):
        return "NA"  # Default: not available


@@ -295,6 +287,7 @@ class Base(Configuration):

    MIDDLEWARE = [
        "django.middleware.security.SecurityMiddleware",
+        "dockerflow.django.middleware.DockerflowMiddleware",
        "whitenoise.middleware.WhiteNoiseMiddleware",
        "django.contrib.sessions.middleware.SessionMiddleware",
        "django.middleware.locale.LocaleMiddleware",
@@ -304,7 +297,6 @@ class Base(Configuration):
        "django.middleware.csrf.CsrfViewMiddleware",
        "django.contrib.auth.middleware.AuthenticationMiddleware",
        "django.contrib.messages.middleware.MessageMiddleware",
-        "dockerflow.django.middleware.DockerflowMiddleware",
    ]

    AUTHENTICATION_BACKENDS = [
@@ -1181,6 +1173,13 @@ class Base(Configuration):
                    environ_prefix="",
                )
            },
+            "dockerflow": {
+                "level": values.Value(
+                    "WARNING",
+                    environ_name="LOGGING_LEVEL_DOCKERFLOW",
+                    environ_prefix="",
+                )
+            },
            "core": {
                "handlers": ["console"],
                "level": values.Value(
@@ -4,12 +4,12 @@ USER node

 WORKDIR /home/frontend/

-COPY ./src/frontend/package.json ./package.json
-COPY ./src/frontend/package-lock.json ./package-lock.json
+COPY --chown=node:node ./src/frontend/package.json ./package.json
+COPY --chown=node:node ./src/frontend/package-lock.json ./package-lock.json

 RUN npm ci

-COPY .dockerignore ./.dockerignore
+COPY --chown=node:node .dockerignore ./.dockerignore
 COPY --chown=node:node ./src/frontend/ .

 ### ---- Front-end builder image ----
@@ -1,5 +1,6 @@
 import { Div } from '@/primitives'
 import { ToastProvider } from './components/ToastProvider'
+import { RecordingWaitingForTracksNotification } from './components/RecordingWaitingForTracksNotification'
 import { WaitingParticipantNotification } from './components/WaitingParticipantNotification'

 export const NotificationProvider = ({
@@ -12,5 +13,6 @@ export const NotificationProvider = ({
  <Div position="absolute" bottom={bottom} right={right} zIndex={1000}>
    <ToastProvider />
    <WaitingParticipantNotification />
+    <RecordingWaitingForTracksNotification />
  </Div>
 )
@@ -0,0 +1,41 @@
+import { useTranslation } from 'react-i18next'
+import { Text } from '@/primitives'
+import { css } from '@/styled-system/css'
+import { HStack } from '@/styled-system/jsx'
+import { RecordingMode } from '@/features/recording'
+import { useRecordingWaitingForTracks } from '@/features/recording/hooks/useRecordingWaitingForTracks'
+import { StyledToastContainer } from './StyledToastContainer'
+
+export const RecordingWaitingForTracksNotification = () => {
+  const { t } = useTranslation('notifications')
+  const isTranscriptWaiting = useRecordingWaitingForTracks(
+    RecordingMode.Transcript
+  )
+  const isScreenRecordingWaiting = useRecordingWaitingForTracks(
+    RecordingMode.ScreenRecording
+  )
+
+  if (!isTranscriptWaiting && !isScreenRecordingWaiting) return null
+
+  return (
+    <StyledToastContainer role="status">
+      <HStack padding={14}>
+        <Text
+          margin={false}
+          className={css({
+            maxWidth: '22rem',
+            wordBreak: 'break-word',
+            overflowWrap: 'break-word',
+            whiteSpace: 'normal',
+          })}
+        >
+          {t(
+            isTranscriptWaiting
+              ? 'transcript.waitingForTracks'
+              : 'screenRecording.waitingForTracks'
+          )}
+        </Text>
+      </HStack>
+    </StyledToastContainer>
+  )
+}
@@ -34,6 +34,15 @@ export const WaitingParticipantNotification = () => {
  const isParticipantListEmpty = (p?: WaitingParticipant[]) => p?.length == 0

  useEffect(() => {
+    const previousIds = new Set(prevWaitingParticipant?.map(({ id }) => id))
+    const hasNewWaitingParticipant = waitingParticipants.some(
+      ({ id }) => !previousIds.has(id)
+    )
+
+    if (hasNewWaitingParticipant) {
+      triggerNotificationSound(NotificationType.ParticipantWaiting)
+    }
+
    // Show notification when the first participant enters the waiting room
    if (
      !isParticipantListEmpty(waitingParticipants) &&
@@ -42,8 +51,6 @@ export const WaitingParticipantNotification = () => {
    ) {
      setShowQuickActionsMessage(true)

-      triggerNotificationSound(NotificationType.ParticipantJoined)
-
      if (timerRef.current !== null) {
        clearTimeout(timerRef.current)
      }
@@ -11,7 +11,7 @@ export const useNotificationSound = () => {
      participantJoined: [0, 1150],
      handRaised: [1400, 180],
      messageReceived: [1580, 300],
-      waiting: [2039, 710],
+      participantWaiting: [2039, 710],
      success: [2740, 1304],
    },
    volume: notificationsSnap.soundNotificationVolume,
@@ -20,6 +20,7 @@ import { Track } from 'livekit-client'
 import { ParticipantPlaceholder } from './ParticipantPlaceholder'
 import { ParticipantTileFocus } from './participantTileFocus/ParticipantTileFocus'
 import { FullScreenShareWarning } from './FullScreenShareWarning'
+import { ScreenShareZoomableVideo } from '@/features/rooms/livekit/components/ScreenShareZoomableVideo'
 import { useTranslation } from 'react-i18next'
 import { getShortcutDescriptorById } from '@/features/shortcuts/catalog'
 import { formatShortcutLabel } from '@/features/shortcuts/formatLabels'
@@ -89,6 +90,8 @@ export const ParticipantTile: (
  )

  const isScreenShare = trackReference.source != Track.Source.Camera
+  const isRemoteScreenShare =
+    isScreenShare && !trackReference.participant.isLocal
  const [hasKeyboardFocus, setHasKeyboardFocus] = React.useState(false)

  const participantColor = getParticipantColor(trackReference.participant)
@@ -98,11 +101,23 @@ export const ParticipantTile: (
  })
  const participantName = name || identity || 'Unknown'

+  // tileRef: fullscreen target, and the node the focus overlay listens on.
+  // setRefs merges it with the forwarded ref on the same node.
+  const tileRef = React.useRef<HTMLDivElement>(null)
+  const setRefs = React.useCallback(
+    (node: HTMLDivElement | null) => {
+      ;(tileRef as React.MutableRefObject<HTMLDivElement | null>).current = node
+      if (typeof ref === 'function') ref(node)
+      else if (ref)
+        (ref as React.MutableRefObject<HTMLDivElement | null>).current = node
+    },
+    [ref]
+  )
+
  const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })

  const interactiveProps = {
    ...elementProps,
-    // Ensure the tile is focusable to expose contextual controls to keyboard users.
    tabIndex: 0,
    'aria-label': t('containerLabel', { name: participantName }),
    onFocus: (event: React.FocusEvent<HTMLDivElement>) => {
@@ -120,8 +135,41 @@ export const ParticipantTile: (
    },
  }

+  const isVideoTrack =
+    isTrackReference(trackReference) &&
+    trackReference.publication.kind === 'video'
+
+  let trackMedia: React.ReactNode = null
+  if (isVideoTrack) {
+    const videoTrack = (
+      <VideoTrack
+        trackRef={trackReference}
+        onSubscriptionStatusChanged={handleSubscribe}
+        manageSubscription={autoManageSubscription}
+      />
+    )
+    // Zoom toolbar stays out of picture-in-picture: that window has its own
+    // document and the fullscreen API is off. Follow-up PR can restore zoom
+    // there without the dead fullscreen button.
+    trackMedia =
+      isRemoteScreenShare && !disableTileControls ? (
+        <ScreenShareZoomableVideo tileRef={tileRef}>
+          {videoTrack}
+        </ScreenShareZoomableVideo>
+      ) : (
+        videoTrack
+      )
+  } else if (isTrackReference(trackReference)) {
+    trackMedia = (
+      <AudioTrack
+        trackRef={trackReference}
+        onSubscriptionStatusChanged={handleSubscribe}
+      />
+    )
+  }
+
  return (
-    <div ref={ref} style={{ position: 'relative' }} {...interactiveProps}>
+    <div ref={setRefs} style={{ position: 'relative' }} {...interactiveProps}>
      <TrackRefContextIfNeeded trackRef={trackReference}>
        <ParticipantContextIfNeeded participant={trackReference.participant}>
          {trackReference.participant.isLocal && (
@@ -129,23 +177,7 @@ export const ParticipantTile: (
          )}
          {children ?? (
            <>
-              {isTrackReference(trackReference) &&
-              (trackReference.publication?.kind === 'video' ||
-                trackReference.source === Track.Source.Camera ||
-                trackReference.source === Track.Source.ScreenShare) ? (
-                <VideoTrack
-                  trackRef={trackReference}
-                  onSubscriptionStatusChanged={handleSubscribe}
-                  manageSubscription={autoManageSubscription}
-                />
-              ) : (
-                isTrackReference(trackReference) && (
-                  <AudioTrack
-                    trackRef={trackReference}
-                    onSubscriptionStatusChanged={handleSubscribe}
-                  />
-                )
-              )}
+              {trackMedia}
              <div className="lk-participant-placeholder">
                <ParticipantPlaceholder
                  color={participantColor}
@@ -164,6 +196,7 @@ export const ParticipantTile: (
          {!disableMetadata && !disableTileControls && (
            <ParticipantTileFocus
              trackRef={trackReference}
+              tileRef={tileRef}
              hasKeyboardFocus={hasKeyboardFocus}
            />
          )}
@@ -7,38 +7,64 @@ import { useCanMute } from '@/features/rooms/livekit/hooks/useCanMute'
 import { FocusButton } from './FocusButton'
 import { EffectsButton } from './EffectsButton'
 import { MuteButton } from './MuteButton'
-import { ZoomButton } from './ZoomButton'

 const MOUSE_IDLE_TIME = 3000

 type FadeOverlayProps = {
  children: ReactNode
  hasKeyboardFocus: boolean
+  tileRef: React.RefObject<HTMLDivElement | null>
 }

-const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
+// Pointer-events none so this overlay doesn't block the zoom surface below.
+// The tile node still gets the mouse events, so we listen on it directly
+// rather than lifting the state up: this keeps mouse moves from re-rendering
+// the tile and the video it contains.
+const FadeOverlay = ({
+  children,
+  hasKeyboardFocus,
+  tileRef,
+}: FadeOverlayProps) => {
  const [active, setActive] = useState(false)
  const idleTimerRef = useRef<number | null>(null)

-  const clearIdleTimer = () => {
-    if (idleTimerRef.current) window.clearTimeout(idleTimerRef.current)
-  }
+  useEffect(() => {
+    const tile = tileRef.current
+    if (!tile) return

-  const armIdleTimer = () => {
-    clearIdleTimer()
-    idleTimerRef.current = window.setTimeout(() => {
+    const clearIdleTimer = () => {
+      if (idleTimerRef.current) window.clearTimeout(idleTimerRef.current)
+      idleTimerRef.current = null
+    }
+
+    const handleActivity = () => {
+      setActive(true)
+      clearIdleTimer()
+      idleTimerRef.current = window.setTimeout(
+        () => setActive(false),
+        MOUSE_IDLE_TIME
+      )
+    }
+
+    const handleLeave = () => {
+      clearIdleTimer()
      setActive(false)
-    }, MOUSE_IDLE_TIME)
-  }
+    }

-  const handleActivity = () => {
-    setActive(true)
-    armIdleTimer()
-  }
+    tile.addEventListener('mouseenter', handleActivity)
+    tile.addEventListener('mousemove', handleActivity)
+    tile.addEventListener('mouseleave', handleLeave)

-  useEffect(() => clearIdleTimer, [])
+    return () => {
+      clearIdleTimer()
+      tile.removeEventListener('mouseenter', handleActivity)
+      tile.removeEventListener('mousemove', handleActivity)
+      tile.removeEventListener('mouseleave', handleLeave)
+    }
+  }, [tileRef])

  const isVisible = hasKeyboardFocus || active
+
  return (
    <div
      className={css({
@@ -50,15 +76,10 @@ const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {
        alignItems: 'center',
        width: '100%',
        height: '100%',
+        pointerEvents: 'none',
      })}
      data-visible={isVisible || undefined}
      aria-hidden={!isVisible}
-      onMouseEnter={handleActivity}
-      onMouseMove={handleActivity}
-      onMouseLeave={() => {
-        clearIdleTimer()
-        setActive(false)
-      }}
    >
      {isVisible && children}
    </div>
@@ -67,9 +88,11 @@ const FadeOverlay = ({ children, hasKeyboardFocus }: FadeOverlayProps) => {

 export const ParticipantTileFocus = ({
  trackRef,
+  tileRef,
  hasKeyboardFocus,
 }: {
  trackRef: TrackReferenceOrPlaceholder
+  tileRef: React.RefObject<HTMLDivElement | null>
  hasKeyboardFocus: boolean
 }) => {
  const participant = trackRef.participant
@@ -78,7 +101,7 @@ export const ParticipantTileFocus = ({
  const canMute = useCanMute(participant)

  return (
-    <FadeOverlay hasKeyboardFocus={hasKeyboardFocus}>
+    <FadeOverlay hasKeyboardFocus={hasKeyboardFocus} tileRef={tileRef}>
      <div
        className={css({
          backgroundColor: 'primaryDark.50',
@@ -87,6 +110,7 @@ export const ParticipantTileFocus = ({
          display: 'flex',
          opacity: 0.6,
          animation: 'overlayIn 200ms linear 300ms backwards',
+          pointerEvents: 'auto',
          _hover: {
            opacity: 0.95,
          },
@@ -94,7 +118,7 @@ export const ParticipantTileFocus = ({
      >
        <HStack gap={0.5} padding={0.5}>
          <FocusButton trackRef={trackRef} />
-          {!isScreenShare ? (
+          {!isScreenShare && (
            <>
              {isLocal ? (
                <EffectsButton />
@@ -102,8 +126,6 @@ export const ParticipantTileFocus = ({
                canMute && <MuteButton participant={participant} />
              )}
            </>
-          ) : (
-            !isLocal && <ZoomButton trackRef={trackRef} />
          )}
        </HStack>
      </div>
@@ -1,32 +0,0 @@
-import { TrackReferenceOrPlaceholder } from '@livekit/components-core'
-import { useTranslation } from 'react-i18next'
-import { useFullScreen } from '@/features/rooms/livekit/hooks/useFullScreen'
-import { Button } from '@/primitives'
-import { RiFullscreenLine } from '@remixicon/react'
-
-export const ZoomButton = ({
-  trackRef,
-}: {
-  trackRef: TrackReferenceOrPlaceholder
-}) => {
-  const { t } = useTranslation('rooms', { keyPrefix: 'participantTileFocus' })
-  const { toggleFullScreen, isFullscreenAvailable } = useFullScreen({
-    trackRef,
-  })
-
-  if (!isFullscreenAvailable) {
-    return
-  }
-
-  return (
-    <Button
-      size="sm"
-      variant="primaryTextDark"
-      square
-      tooltip={t('fullScreen')}
-      onPress={() => toggleFullScreen()}
-    >
-      <RiFullscreenLine />
-    </Button>
-  )
-}
@@ -0,0 +1,29 @@
+import { useEffect, useState } from 'react'
+import { useTracks } from '@livekit/components-react'
+import { Track } from 'livekit-client'
+import { RecordingMode } from '@/features/recording'
+import { useRecordingStatuses } from './useRecordingStatuses'
+
+const STARTING_NOTIFICATION_DELAY = 15_000
+
+export const useRecordingWaitingForTracks = (mode: RecordingMode) => {
+  const { isStarting } = useRecordingStatuses(mode)
+  const tracks = useTracks(
+    mode === RecordingMode.Transcript ? [Track.Source.Microphone] : undefined,
+    { onlySubscribed: false }
+  )
+  const [delayElapsed, setDelayElapsed] = useState(false)
+
+  useEffect(() => {
+    setDelayElapsed(false)
+    if (!isStarting) return
+
+    const timeout = window.setTimeout(
+      () => setDelayElapsed(true),
+      STARTING_NOTIFICATION_DELAY
+    )
+    return () => window.clearTimeout(timeout)
+  }, [isStarting, mode])
+
+  return isStarting && delayElapsed && tracks.length === 0
+}
@@ -0,0 +1,76 @@
+import { Button } from '@/primitives'
+import { RiCollapseDiagonalLine, RiExpandDiagonalLine } from '@remixicon/react'
+import { memo, useCallback, useEffect, useRef, useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+
+// Keeps the fullscreen state here rather than on the toolbar, so entering or
+// leaving fullscreen does not re-render the zoom controls.
+export const ScreenShareFullscreenButton = memo(
+  ({
+    containerRef,
+  }: {
+    containerRef: React.RefObject<HTMLDivElement | null>
+  }) => {
+    const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+    const announce = useScreenReaderAnnounce()
+
+    const [isFullscreen, setIsFullscreen] = useState(false)
+    // Tracks whether this tile's container triggered fullscreen (vs another share's).
+    const wasThisTileFullscreen = useRef(false)
+
+    // Covers Esc and browser UI exits, not just this button.
+    // Only this tile's instance announces to avoid duplicates with multiple shares.
+    useEffect(() => {
+      const onChange = () => {
+        const isThisTileFullscreen =
+          document.fullscreenElement === containerRef.current
+        setIsFullscreen(isThisTileFullscreen)
+
+        if (isThisTileFullscreen) {
+          wasThisTileFullscreen.current = true
+          announce(t('fullScreenEntered'), 'assertive')
+        } else if (wasThisTileFullscreen.current) {
+          wasThisTileFullscreen.current = false
+          announce(t('fullScreenExited'), 'assertive')
+        }
+      }
+      document.addEventListener('fullscreenchange', onChange)
+      return () => document.removeEventListener('fullscreenchange', onChange)
+    }, [announce, t, containerRef])
+
+    const toggleFullScreen = useCallback(async () => {
+      try {
+        if (document.fullscreenElement === containerRef.current) {
+          await document.exitFullscreen()
+        } else {
+          // Tile container so zoom controls stay visible in fullscreen.
+          await containerRef.current?.requestFullscreen()
+        }
+      } catch (error) {
+        console.error('Error toggling fullscreen:', error)
+      }
+    }, [containerRef])
+
+    if (!document.fullscreenEnabled) return null
+
+    return (
+      <Button
+        size="sm"
+        variant="primaryTextDark"
+        square
+        tooltip={isFullscreen ? t('exitFullScreen') : t('fullScreen')}
+        aria-label={isFullscreen ? t('exitFullScreen') : t('fullScreen')}
+        onPress={toggleFullScreen}
+      >
+        {isFullscreen ? (
+          <RiCollapseDiagonalLine size={20} />
+        ) : (
+          <RiExpandDiagonalLine size={20} />
+        )}
+      </Button>
+    )
+  }
+)
+
+ScreenShareFullscreenButton.displayName = 'ScreenShareFullscreenButton'
@@ -0,0 +1,165 @@
+import { css } from '@/styled-system/css'
+import { Button } from '@/primitives'
+import {
+  RiFullscreenExitLine,
+  RiZoomInLine,
+  RiZoomOutLine,
+} from '@remixicon/react'
+import { useTranslation } from 'react-i18next'
+import { Toolbar } from 'react-aria-components'
+import { useEffect, useRef } from 'react'
+import { isMacintosh } from '@/utils/livekit'
+import { srOnly } from '@/styles/a11y'
+import { ScreenShareFullscreenButton } from './ScreenShareFullscreenButton'
+
+interface ScreenShareZoomControlsProps {
+  containerRef: React.RefObject<HTMLDivElement | null>
+  isZoomed: boolean
+  zoomPercentage: number
+  canZoomIn: boolean
+  canZoomOut: boolean
+  onZoomIn: () => void
+  onZoomOut: () => void
+  onResetZoom: () => void
+}
+
+export const ScreenShareZoomControls = ({
+  containerRef,
+  isZoomed,
+  zoomPercentage,
+  canZoomIn,
+  canZoomOut,
+  onZoomIn,
+  onZoomOut,
+  onResetZoom,
+}: ScreenShareZoomControlsProps) => {
+  const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+
+  const zoomInButtonRef = useRef<HTMLButtonElement>(null)
+  const hadFocusInCollapsibleRef = useRef(false)
+
+  // Back at 100 % the collapsible controls are disabled and hidden, which drops
+  // keyboard focus on the body. Hand it to the zoom in button instead, the only
+  // control of that group still reachable.
+  useEffect(() => {
+    if (isZoomed || !hadFocusInCollapsibleRef.current) return
+    hadFocusInCollapsibleRef.current = false
+    zoomInButtonRef.current?.focus()
+  }, [isZoomed])
+
+  const wheelShortcut = t(isMacintosh() ? 'wheelShortcutMac' : 'wheelShortcut')
+
+  return (
+    <div
+      className={css({
+        position: 'absolute',
+        bottom: '12px',
+        right: '12px',
+        zIndex: 2,
+        pointerEvents: 'auto',
+      })}
+    >
+      <Toolbar
+        aria-label={t('toolbarLabel')}
+        className={css({
+          display: 'flex',
+          alignItems: 'center',
+          backgroundColor: 'primaryDark.50',
+          borderRadius: '2rem',
+          padding: '0.5rem',
+          opacity: 0.7,
+          transition: 'opacity 200ms linear',
+          _hover: {
+            opacity: 0.95,
+          },
+        })}
+      >
+        <span className={srOnly}>
+          {t(isMacintosh() ? 'wheelShortcutHintMac' : 'wheelShortcutHint')}
+        </span>
+        {/* Animated wrapper: collapses to 0 when not zoomed. padding/margin
+            trick keeps overflow:hidden from clipping focus rings. */}
+        <div
+          className={css({
+            display: 'flex',
+            alignItems: 'center',
+            overflow: 'hidden',
+            transition: 'max-width 200ms ease-out, opacity 200ms ease-out',
+            padding: '3px',
+            margin: '-3px',
+          })}
+          style={{
+            maxWidth: isZoomed ? '12rem' : '0',
+            opacity: isZoomed ? 1 : 0,
+          }}
+          aria-hidden={!isZoomed}
+          onFocus={() => {
+            hadFocusInCollapsibleRef.current = true
+          }}
+          onBlur={(e) => {
+            // Disabling a focused button blurs it with no relatedTarget, so the
+            // flag must survive that case for the effect above to rescue focus.
+            if (e.relatedTarget) hadFocusInCollapsibleRef.current = false
+          }}
+        >
+          <Button
+            size="sm"
+            variant="primaryTextDark"
+            square
+            tooltip={t('fitToWindow')}
+            aria-label={t('fitToWindow')}
+            isDisabled={!isZoomed}
+            onPress={onResetZoom}
+          >
+            <RiFullscreenExitLine size={20} />
+          </Button>
+          <Button
+            size="sm"
+            variant="primaryTextDark"
+            square
+            tooltip={t('zoomOutWithShortcut', {
+              shortcut: wheelShortcut,
+            })}
+            aria-label={t('zoomOut')}
+            isDisabled={!isZoomed || !canZoomOut}
+            onPress={onZoomOut}
+          >
+            <RiZoomOutLine size={20} />
+          </Button>
+          {/* Visual only - zoom level is announced via useScreenReaderAnnounce. */}
+          <span
+            aria-hidden="true"
+            className={css({
+              color: 'white',
+              fontSize: '0.8125rem',
+              fontWeight: 500,
+              minWidth: '3.25rem',
+              textAlign: 'center',
+              userSelect: 'none',
+              display: 'flex',
+              alignItems: 'center',
+              justifyContent: 'center',
+              padding: '0 0.25rem',
+              whiteSpace: 'nowrap',
+            })}
+          >
+            {zoomPercentage} %
+          </span>
+        </div>
+        <Button
+          ref={zoomInButtonRef}
+          size="sm"
+          variant="primaryTextDark"
+          square
+          tooltip={t('zoomInWithShortcut', { shortcut: wheelShortcut })}
+          aria-label={t('zoomIn')}
+          isDisabled={!canZoomIn}
+          onPress={onZoomIn}
+        >
+          <RiZoomInLine size={20} />
+        </Button>
+        <ScreenShareFullscreenButton containerRef={containerRef} />
+      </Toolbar>
+    </div>
+  )
+}
@@ -0,0 +1,98 @@
+import { css } from '@/styled-system/css'
+import { useEffect, useRef, type ReactNode } from 'react'
+import { useTranslation } from 'react-i18next'
+import { useScreenShareZoom } from '../hooks/useScreenShareZoom'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import { ScreenShareZoomControls } from './ScreenShareZoomControls'
+
+interface ScreenShareZoomableVideoProps {
+  tileRef: React.RefObject<HTMLDivElement | null>
+  children: ReactNode
+}
+
+// The video comes in as children so that a zoom change, which only re-renders
+// this wrapper, leaves the video subtree untouched.
+export const ScreenShareZoomableVideo = ({
+  tileRef,
+  children,
+}: ScreenShareZoomableVideoProps) => {
+  const zoom = useScreenShareZoom()
+  const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+  const announce = useScreenReaderAnnounce()
+
+  // SR announcement: announce zoom level on change, with a one-time pan hint
+  // on the first zoom above 100 % per session.
+  const prevZoomRef = useRef(zoom.zoomPercentage)
+  const hasAnnouncedPanHint = useRef(false)
+  useEffect(() => {
+    if (prevZoomRef.current === zoom.zoomPercentage) return
+    const wasAtDefault = prevZoomRef.current <= 100
+    prevZoomRef.current = zoom.zoomPercentage
+
+    if (wasAtDefault && zoom.isZoomed && !hasAnnouncedPanHint.current) {
+      hasAnnouncedPanHint.current = true
+      announce(t('panHint', { level: zoom.zoomPercentage }), 'polite')
+    } else {
+      announce(t('currentZoomLevel', { level: zoom.zoomPercentage }), 'polite')
+    }
+
+    if (!zoom.isZoomed) hasAnnouncedPanHint.current = false
+  }, [zoom.zoomPercentage, zoom.isZoomed, announce, t])
+
+  // Attach keyboard listener on the tile container (has tabIndex=0).
+  useEffect(() => {
+    const el = tileRef.current
+    if (!el) return
+    el.addEventListener('keydown', zoom.handleKeyDown)
+    return () => el.removeEventListener('keydown', zoom.handleKeyDown)
+  }, [tileRef, zoom.handleKeyDown])
+
+  // Native wheel listener with { passive: false } so preventDefault works.
+  useEffect(() => {
+    const el = zoom.surfaceElRef.current
+    if (!el) return
+    el.addEventListener('wheel', zoom.handleWheel, { passive: false })
+    return () => el.removeEventListener('wheel', zoom.handleWheel)
+  }, [zoom.handleWheel, zoom.surfaceElRef])
+
+  return (
+    <>
+      <div
+        ref={zoom.surfaceElRef}
+        className={css({
+          width: '100%',
+          height: '100%',
+          overflow: 'hidden',
+          position: 'relative',
+          userSelect: 'none',
+          // Leaves the browser's native pinch-zoom available on touch devices
+          // while still routing single-pointer drags to useMove for panning.
+          touchAction: 'pinch-zoom',
+        })}
+        {...zoom.moveProps}
+      >
+        <div
+          ref={zoom.transformElRef}
+          style={{
+            width: '100%',
+            height: '100%',
+            pointerEvents: 'none',
+            transformOrigin: 'center center',
+          }}
+        >
+          {children}
+        </div>
+      </div>
+      <ScreenShareZoomControls
+        containerRef={tileRef}
+        isZoomed={zoom.isZoomed}
+        zoomPercentage={zoom.zoomPercentage}
+        canZoomIn={zoom.canZoomIn}
+        canZoomOut={zoom.canZoomOut}
+        onZoomIn={zoom.zoomIn}
+        onZoomOut={zoom.zoomOut}
+        onResetZoom={zoom.resetZoom}
+      />
+    </>
+  )
+}
@@ -1,17 +1,16 @@
 import { useEffect } from 'react'
 import { useRoomContext } from '@livekit/components-react'
 import {
-  type RemoteParticipant,
+  type RemoteTrack,
  type RemoteTrackPublication,
  RoomEvent,
  Track,
-  VideoQuality,
 } from 'livekit-client'
 import { useSnapshot } from 'valtio'
 import { userChoicesStore } from '@/stores/userChoices'

 /**
- * Sets initial video quality for new participants as they join.
+ * Applies the saved reception quality to every remote camera.
 * LiveKit doesn't allow handling video quality preferences at the room level.
 */
 export const VideoResolutionSubscription = () => {
@@ -19,30 +18,40 @@ export const VideoResolutionSubscription = () => {
  const room = useRoomContext()

  useEffect(() => {
-    if (!room) return
+    if (!room || videoSubscribeQuality === undefined) return

-    const handleTrackPublished = (
-      publication: RemoteTrackPublication,
-      _participant: RemoteParticipant
-    ) => {
-      // By default, the maximum quality is set to high
+    const applyQuality = (publication: RemoteTrackPublication) => {
      if (
-        videoSubscribeQuality === undefined ||
-        videoSubscribeQuality === VideoQuality.HIGH
-      )
-        return
-
-      if (
-        publication.kind === Track.Kind.Video &&
-        publication.source !== Track.Source.ScreenShare
+        publication.kind !== Track.Kind.Video ||
+        publication.source === Track.Source.ScreenShare ||
+        publication.videoQuality === videoSubscribeQuality
      ) {
-        publication.setVideoQuality(videoSubscribeQuality)
+        return
      }
+      publication.setVideoQuality(videoSubscribeQuality)
    }

+    // Cameras we are already receiving: those published before this effect ran,
+    // and all of them again whenever the preference changes mid-call.
+    room.remoteParticipants.forEach((participant) =>
+      participant.videoTrackPublications.forEach(applyQuality)
+    )
+
+    const handleTrackPublished = (publication: RemoteTrackPublication) =>
+      applyQuality(publication)
+
+    // TrackPublished is not raised for cameras that were already sending when we
+    // joined, but it is the earliest point for the ones that start after us.
+    const handleTrackSubscribed = (
+      _track: RemoteTrack,
+      publication: RemoteTrackPublication
+    ) => applyQuality(publication)
+
    room.on(RoomEvent.TrackPublished, handleTrackPublished)
+    room.on(RoomEvent.TrackSubscribed, handleTrackSubscribed)
    return () => {
      room.off(RoomEvent.TrackPublished, handleTrackPublished)
+      room.off(RoomEvent.TrackSubscribed, handleTrackSubscribed)
    }
  }, [room, videoSubscribeQuality])

@@ -0,0 +1,270 @@
+import { useCallback, useRef, useState } from 'react'
+import { useMove } from 'react-aria'
+import type { MoveMoveEvent } from '@react-types/shared'
+import {
+  FULL_PICTURE_RATIO,
+  MAX_ZOOM,
+  MIN_ZOOM,
+  PAN_STEP,
+  WHEEL_ZOOM_SPEED,
+  ZOOM_STEP,
+  type PanOffset,
+  clampPan,
+  clampZoom,
+  getCursorFromZoomState,
+  getCursorPercentsFromWheelEvent,
+  getPanDeltaPercentsFromMove,
+  getPictureRatio,
+  getWheelPanOffset,
+  getZoomTransform,
+} from '../utils/screenShareZoom'
+
+/**
+ * Manages zoom and pan state for a remote screen share.
+ *
+ * Performance: zoom/pan live in refs and are applied imperatively to the DOM
+ * (via transformElRef / surfaceElRef) so dragging and panning never re-render.
+ * React state only tracks what the toolbar displays, and only updates when
+ * the zoom level actually changes.
+ *
+ * Drag/touch panning is handled by react-aria's useMove (moveProps).
+ * The wheel listener (non-passive) zooms on Ctrl/Cmd+scroll and pans on a
+ * two-finger trackpad scroll once zoomed.
+ * Arrow key panning and +/-/0 zoom are on a keydown listener attached to the
+ * tile container (which has tabIndex=0 and focus).
+ */
+export const useScreenShareZoom = () => {
+  const zoomRef = useRef(MIN_ZOOM)
+  const panRef = useRef<PanOffset>({ x: 0, y: 0 })
+  const draggingRef = useRef(false)
+
+  // The consumer binds these to the inner transform div and the outer drag surface.
+  const transformElRef = useRef<HTMLDivElement | null>(null)
+  const surfaceElRef = useRef<HTMLDivElement | null>(null)
+
+  // Mirrors zoomRef for the toolbar. Panning never publishes: the toolbar
+  // shows the zoom level, not the position.
+  const [zoomLevel, setZoomLevel] = useState(MIN_ZOOM)
+
+  const syncToolbar = useCallback(() => setZoomLevel(zoomRef.current), [])
+
+  const applyTransform = useCallback(() => {
+    const el = transformElRef.current
+    if (!el) return
+    el.style.transform = getZoomTransform(zoomRef.current, panRef.current)
+  }, [])
+
+  // The video is letterboxed inside the surface by object-fit: contain, so the
+  // pan bounds depend on how much of the surface the picture actually covers.
+  // Read live rather than cached: both the tile and the shared resolution can
+  // change at any time.
+  const readPictureRatio = useCallback(() => {
+    const surface = surfaceElRef.current
+    const video = transformElRef.current?.querySelector('video')
+    if (!surface || !video) return FULL_PICTURE_RATIO
+    return getPictureRatio(
+      surface.clientWidth,
+      surface.clientHeight,
+      video.videoWidth,
+      video.videoHeight
+    )
+  }, [])
+
+  const applyCursor = useCallback(() => {
+    const el = surfaceElRef.current
+    if (!el) return
+    el.style.cursor = getCursorFromZoomState(
+      zoomRef.current,
+      draggingRef.current
+    )
+  }, [])
+
+  const setZoom = useCallback(
+    (next: number) => {
+      zoomRef.current = next
+      panRef.current =
+        next <= MIN_ZOOM
+          ? { x: 0, y: 0 }
+          : clampPan(panRef.current, next, readPictureRatio())
+      applyTransform()
+      applyCursor()
+      syncToolbar()
+    },
+    [applyTransform, applyCursor, syncToolbar, readPictureRatio]
+  )
+
+  const zoomIn = useCallback(
+    () => setZoom(clampZoom(zoomRef.current + ZOOM_STEP)),
+    [setZoom]
+  )
+
+  const zoomOut = useCallback(
+    () => setZoom(clampZoom(zoomRef.current - ZOOM_STEP)),
+    [setZoom]
+  )
+
+  const resetZoom = useCallback(() => setZoom(MIN_ZOOM), [setZoom])
+
+  // Cancels the scale() that multiplies translate(), so the picture follows
+  // the pointer 1:1 and keyboard steps keep the same visual size.
+  const panBy = useCallback(
+    (dx: number, dy: number) => {
+      const zoom = zoomRef.current
+      panRef.current = clampPan(
+        {
+          x: panRef.current.x + dx / zoom,
+          y: panRef.current.y + dy / zoom,
+        },
+        zoom,
+        readPictureRatio()
+      )
+      applyTransform()
+    },
+    [applyTransform, readPictureRatio]
+  )
+
+  // Must be attached with { passive: false } so preventDefault() blocks
+  // the browser's native Ctrl+scroll page zoom. Trackpad pinch arrives
+  // here as a wheel event with ctrl/cmd already set.
+  const handleWheel = useCallback(
+    (e: WheelEvent) => {
+      if (e.ctrlKey || e.metaKey) {
+        e.preventDefault()
+        e.stopPropagation()
+
+        const target = e.currentTarget as HTMLElement
+        const prev = zoomRef.current
+        const delta = -e.deltaY * WHEEL_ZOOM_SPEED
+        const next = clampZoom(prev + delta)
+
+        if (next <= MIN_ZOOM) {
+          zoomRef.current = MIN_ZOOM
+          panRef.current = { x: 0, y: 0 }
+        } else {
+          const { cursorXPercent, cursorYPercent } =
+            getCursorPercentsFromWheelEvent(e, target)
+          zoomRef.current = next
+          panRef.current = getWheelPanOffset({
+            pan: panRef.current,
+            prevZoom: prev,
+            nextZoom: next,
+            cursorXPercent,
+            cursorYPercent,
+            ratio: readPictureRatio(),
+          })
+        }
+
+        applyTransform()
+        applyCursor()
+        syncToolbar()
+        return
+      }
+
+      // Two-finger trackpad scroll: pan only once zoomed, otherwise leave
+      // the event alone so the page can still scroll.
+      if (zoomRef.current <= MIN_ZOOM) return
+
+      const el = surfaceElRef.current
+      if (!el) return
+
+      e.preventDefault()
+      e.stopPropagation()
+
+      const { deltaXPercent, deltaYPercent } = getPanDeltaPercentsFromMove(
+        -e.deltaX,
+        -e.deltaY,
+        el
+      )
+      panBy(deltaXPercent, deltaYPercent)
+    },
+    [applyTransform, applyCursor, syncToolbar, readPictureRatio, panBy]
+  )
+
+  // useMove handles mouse drag + touch pan. Keyboard arrows are not handled
+  // here because moveProps is on the zoom surface, while focus is on the tile
+  // container, see handleKeyDown below.
+  const { moveProps } = useMove({
+    onMoveStart() {
+      if (zoomRef.current <= MIN_ZOOM) return
+      draggingRef.current = true
+      applyCursor()
+    },
+    onMove(e: MoveMoveEvent) {
+      if (zoomRef.current <= MIN_ZOOM) return
+
+      const el = surfaceElRef.current
+      if (!el) return
+
+      const { deltaXPercent, deltaYPercent } = getPanDeltaPercentsFromMove(
+        e.deltaX,
+        e.deltaY,
+        el
+      )
+      panBy(deltaXPercent, deltaYPercent)
+    },
+    onMoveEnd() {
+      draggingRef.current = false
+      applyTransform()
+      applyCursor()
+    },
+  })
+
+  // Attached to the tile container (not the zoom surface) where keyboard
+  // focus lives. Arrows pan, +/-/0 zoom.
+  const handleKeyDown = useCallback(
+    (e: KeyboardEvent) => {
+      const isZoomed = zoomRef.current > MIN_ZOOM
+      if (!isZoomed && e.key !== '+' && e.key !== '=') return
+
+      if (e.key.startsWith('Arrow') && e.target !== e.currentTarget) return
+
+      switch (e.key) {
+        case 'ArrowLeft':
+          e.preventDefault()
+          panBy(PAN_STEP, 0)
+          break
+        case 'ArrowRight':
+          e.preventDefault()
+          panBy(-PAN_STEP, 0)
+          break
+        case 'ArrowUp':
+          e.preventDefault()
+          panBy(0, PAN_STEP)
+          break
+        case 'ArrowDown':
+          e.preventDefault()
+          panBy(0, -PAN_STEP)
+          break
+        case '+':
+        case '=':
+          e.preventDefault()
+          zoomIn()
+          break
+        case '-':
+          e.preventDefault()
+          zoomOut()
+          break
+        case '0':
+          e.preventDefault()
+          resetZoom()
+          break
+      }
+    },
+    [panBy, zoomIn, zoomOut, resetZoom]
+  )
+
+  return {
+    zoomPercentage: Math.round(zoomLevel * 100),
+    isZoomed: zoomLevel > MIN_ZOOM,
+    canZoomIn: zoomLevel < MAX_ZOOM,
+    canZoomOut: zoomLevel > MIN_ZOOM,
+    transformElRef,
+    surfaceElRef,
+    moveProps,
+    zoomIn,
+    zoomOut,
+    resetZoom,
+    handleWheel,
+    handleKeyDown,
+  }
+}
@@ -0,0 +1,128 @@
+export const MIN_ZOOM = 1
+export const MAX_ZOOM = 4
+export const ZOOM_STEP = 0.1
+export const WHEEL_ZOOM_SPEED = 0.002
+export const PAN_STEP = 5
+
+// Half of a 100 % axis. Geometry, not a tunable: it is both the centre the
+// cursor offset is measured from and the half extent the pan is clamped
+// against, so the two stay consistent by construction.
+export const HALF_EXTENT_PERCENT = 50
+
+export interface PanOffset {
+  x: number
+  y: number
+}
+
+// Fraction of the surface each axis of the picture covers, in [0, 1].
+export interface PictureRatio {
+  x: number
+  y: number
+}
+
+export const FULL_PICTURE_RATIO: PictureRatio = { x: 1, y: 1 }
+
+export const clampZoom = (value: number) => {
+  return Math.max(MIN_ZOOM, Math.min(MAX_ZOOM, value))
+}
+
+// Restrict pan so the picture always covers the view. Pan is a % of the
+// surface, in which object-fit: contain letterboxes the picture: its half
+// extent is `ratio * 50` against a view half extent of 50, and scaling by
+// `zoom` must keep `zoom * (ratio * 50 - |pan|) >= 50`. An axis whose picture
+// is still smaller than the view is pinned to 0, keeping the bars symmetric.
+export const clampPan = (
+  pan: PanOffset,
+  zoom: number,
+  ratio: PictureRatio
+): PanOffset => {
+  const maxPanX = Math.max(0, (ratio.x - 1 / zoom) * HALF_EXTENT_PERCENT)
+  const maxPanY = Math.max(0, (ratio.y - 1 / zoom) * HALF_EXTENT_PERCENT)
+  return {
+    x: Math.max(-maxPanX, Math.min(maxPanX, pan.x)),
+    y: Math.max(-maxPanY, Math.min(maxPanY, pan.y)),
+  }
+}
+
+// Per-axis fraction of the surface covered by an object-fit: contain picture.
+export const getPictureRatio = (
+  surfaceWidth: number,
+  surfaceHeight: number,
+  videoWidth: number,
+  videoHeight: number
+): PictureRatio => {
+  if (!surfaceWidth || !surfaceHeight || !videoWidth || !videoHeight) {
+    return FULL_PICTURE_RATIO
+  }
+  const surfaceRatio = surfaceWidth / surfaceHeight
+  const videoRatio = videoWidth / videoHeight
+  return surfaceRatio > videoRatio
+    ? { x: videoRatio / surfaceRatio, y: 1 }
+    : { x: 1, y: surfaceRatio / videoRatio }
+}
+
+export const getZoomTransform = (zoom: number, pan: PanOffset) => {
+  return `scale(${zoom}) translate(${pan.x}%, ${pan.y}%)`
+}
+
+export const getCursorFromZoomState = (zoom: number, dragging: boolean) => {
+  if (zoom <= MIN_ZOOM) return 'default'
+  return dragging ? 'grabbing' : 'grab'
+}
+
+// Keep the content point under the cursor anchored while zooming. With
+// `scale(z) translate(pan%)`, a point at `offset` from the center renders at
+// `z * (offset + pan)`, so holding it still gives:
+// pan' = pan + cursor * (1 / zoom' - 1 / zoom).
+export const getWheelPanOffset = ({
+  pan,
+  prevZoom,
+  nextZoom,
+  cursorXPercent,
+  cursorYPercent,
+  ratio,
+}: {
+  pan: PanOffset
+  prevZoom: number
+  nextZoom: number
+  cursorXPercent: number
+  cursorYPercent: number
+  ratio: PictureRatio
+}): PanOffset => {
+  const panShift = 1 / nextZoom - 1 / prevZoom
+  return clampPan(
+    {
+      x: pan.x + cursorXPercent * panShift,
+      y: pan.y + cursorYPercent * panShift,
+    },
+    nextZoom,
+    ratio
+  )
+}
+
+// Convert cursor pixel position to a % offset from the surface center.
+export const getCursorPercentsFromWheelEvent = (
+  e: WheelEvent,
+  target: HTMLElement
+) => {
+  const rect = target.getBoundingClientRect()
+  return {
+    cursorXPercent:
+      ((e.clientX - rect.left) / rect.width) * 100 - HALF_EXTENT_PERCENT,
+    cursorYPercent:
+      ((e.clientY - rect.top) / rect.height) * 100 - HALF_EXTENT_PERCENT,
+  }
+}
+
+// Convert useMove pixel deltas to % of the surface dimensions.
+export const getPanDeltaPercentsFromMove = (
+  deltaX: number,
+  deltaY: number,
+  surface: HTMLElement
+) => {
+  const rect = surface.getBoundingClientRect()
+  return {
+    deltaXPercent: (deltaX / rect.width) * 100,
+    deltaYPercent: (deltaY / rect.height) * 100,
+  }
+}
@@ -34,7 +34,7 @@ const EMPTY_PROPS = {}
 export const VideoTab = ({ id }: VideoTabProps) => {
  const { t } = useTranslation('settings', { keyPrefix: 'video' })
  const room = useRoomContext()
-  const { localParticipant, remoteParticipants } = room
+  const { localParticipant } = room

  const {
    videoDeviceId,
@@ -88,22 +88,6 @@ export const VideoTab = ({ id }: VideoTabProps) => {
    })
  }

-  /**
-   * Updates video quality for all existing remote video tracks when user preference changes.
-   * LiveKit doesn't support setting video quality preferences at the room level for remote participants,
-   * so this function applies the selected quality to all existing remote video tracks.
-   * Hook useVideoResolutionSubscription updates quality preferences of new participants joining.
-   */
-  const updateExistingRemoteVideoQuality = (selectedQuality: VideoQuality) => {
-    remoteParticipants.forEach((participant) => {
-      participant.videoTrackPublications.forEach((publication) => {
-        if (publication.videoQuality !== selectedQuality) {
-          publication.setVideoQuality(selectedQuality)
-        }
-      })
-    })
-  }
-
  useEffect(() => {
    let videoTrack: LocalVideoTrack | null = null

@@ -231,9 +215,7 @@ export const VideoTab = ({ id }: VideoTabProps) => {
          selectedKey={videoSubscribeQuality?.toString()}
          onSelectionChange={(key) => {
            if (key == undefined) return
-            const selectedQuality = Number(String(key))
-            saveVideoSubscribeQuality(selectedQuality)
-            updateExistingRemoteVideoQuality(selectedQuality)
+            saveVideoSubscribeQuality(Number(String(key)))
          }}
          style={{
            width: '100%',
@@ -16,6 +16,10 @@ export type ShortcutId =
  | 'recording'
  | 'reaction'
  | 'fullscreen'
+  | 'zoom-in'
+  | 'zoom-out'
+  | 'zoom-reset'
+  | 'zoom-pan'

 export const getShortcutDescriptorById = (id: ShortcutId) =>
  shortcutCatalog.find((item) => item.id === id)
@@ -24,7 +28,7 @@ export type ShortcutDescriptor = {
  id: ShortcutId
  category: ShortcutCategory
  shortcut?: Shortcut
-  kind?: 'press' | 'longPress'
+  kind?: 'press' | 'longPress' | 'arrows'
  code?: string // used when kind === 'longPress' (KeyboardEvent.code)
  description?: string
 }
@@ -86,4 +90,27 @@ export const shortcutCatalog: ShortcutDescriptor[] = [
    category: 'interaction',
    shortcut: { key: 'P', ctrlKey: true, shiftKey: true },
  },
+  // Screen share zoom keys are unmodified, so they are bound on the focused
+  // tile instead of being registered globally. They are listed here so the
+  // shortcuts panel stays exhaustive.
+  {
+    id: 'zoom-in',
+    category: 'interaction',
+    shortcut: { key: '+' },
+  },
+  {
+    id: 'zoom-out',
+    category: 'interaction',
+    shortcut: { key: '-' },
+  },
+  {
+    id: 'zoom-reset',
+    category: 'interaction',
+    shortcut: { key: '0' },
+  },
+  {
+    id: 'zoom-pan',
+    category: 'interaction',
+    kind: 'arrows',
+  },
 ]
@@ -25,6 +25,7 @@ export const formatShortcutLabelForSR = (
    shiftLabel,
    plusLabel,
    noShortcutLabel,
+    keyLabels,
  }: {
    controlLabel: string
    commandLabel: string
@@ -33,10 +34,12 @@ export const formatShortcutLabelForSR = (
    shiftLabel: string
    plusLabel: string
    noShortcutLabel: string
+    // Spelled-out names for keys screen readers may skip or mispronounce.
+    keyLabels?: Record<string, string>
  }
 ) => {
  if (!shortcut) return noShortcutLabel
-  const key = shortcut.key?.toUpperCase()
+  const key = keyLabels?.[shortcut.key] ?? shortcut.key?.toUpperCase()
  if (!key) return noShortcutLabel
  const ctrlWord = isMacintosh() ? commandLabel : controlLabel
  const altWord = isMacintosh() ? optionLabel : altLabel
@@ -12,6 +12,9 @@ export const useShortcutFormatting = () => {

  const formatVisual = useCallback(
    (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (kind === 'arrows') {
+        return t('shortcutsPanel.visual.arrows')
+      }
      if (code && kind === 'longPress') {
        const label = getKeyLabelFromCode(code)
        return t('shortcutsPanel.visual.hold', { key: label || '?' })
@@ -23,6 +26,9 @@ export const useShortcutFormatting = () => {

  const formatForSR = useCallback(
    (shortcut?: Shortcut, code?: string, kind?: string) => {
+      if (kind === 'arrows') {
+        return t('shortcutsPanel.sr.arrows')
+      }
      if (code && kind === 'longPress') {
        const label = getKeyLabelFromCode(code)
        return t('shortcutsPanel.sr.hold', { key: label || '?' })
@@ -35,6 +41,10 @@ export const useShortcutFormatting = () => {
        shiftLabel: t('shortcutsPanel.sr.shift'),
        plusLabel: t('shortcutsPanel.sr.plus'),
        noShortcutLabel: t('shortcutsPanel.sr.noShortcut'),
+        keyLabels: {
+          '+': t('shortcutsPanel.sr.plusKey'),
+          '-': t('shortcutsPanel.sr.minusKey'),
+        },
      })
    },
    [t]
@@ -33,12 +33,14 @@
    "accept": "Hereinlassen"
  },
  "transcript": {
+    "waitingForTracks": "Die Transkription wartet auf ein Mikrofon. Schalten Sie Ihr Mikrofon ein, damit die Transkription starten kann.",
    "started": "{{name}} hat die Meeting-Transkription gestartet.",
    "stopped": "{{name}} hat die Meeting-Transkription gestoppt.",
    "limitReached": "Die Transkription hat die maximal zulässige Dauer überschritten und wird automatisch gespeichert.",
    "requested": "{{name}} möchte die Meeting-Transkription starten."
  },
  "screenRecording": {
+    "waitingForTracks": "Die Aufnahme wartet auf Audio oder Video. Schalten Sie Ihr Mikrofon oder Ihre Kamera ein oder teilen Sie Ihren Bildschirm, damit die Aufnahme starten kann.",
    "started": "{{name}} hat die Meeting-Aufzeichnung gestartet.",
    "stopped": "{{name}} hat die Meeting-Aufzeichnung gestoppt.",
    "limitReached": "Die Aufzeichnung hat die maximal zulässige Dauer überschritten und wird automatisch gespeichert.",
@@ -756,6 +756,24 @@
    "muteParticipant": "{{name}} stummschalten",
    "fullScreen": "Vollbild"
  },
+  "screenShareZoom": {
+    "toolbarLabel": "Zoom-Steuerung für Bildschirmfreigabe",
+    "zoomIn": "Vergrößern",
+    "zoomInWithShortcut": "Vergrößern ({{shortcut}})",
+    "zoomOut": "Verkleinern",
+    "zoomOutWithShortcut": "Verkleinern ({{shortcut}})",
+    "wheelShortcut": "Steuerung plus Mausrad",
+    "wheelShortcutMac": "⌘+Mausrad",
+    "wheelShortcutHint": "Tastenkürzel: Steuerung plus Mausrad zum Vergrößern oder Verkleinern.",
+    "wheelShortcutHintMac": "Tastenkürzel: Befehl plus Mausrad zum Vergrößern oder Verkleinern.",
+    "fitToWindow": "An Fenster anpassen",
+    "fullScreen": "Vollbild",
+    "exitFullScreen": "Vollbild beenden",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Mit der Maus ziehen oder den Fokus zurück auf die Bildschirmfreigabe setzen und mit den Pfeiltasten im Bild navigieren.",
+    "fullScreenEntered": "Vollbild aktiviert",
+    "fullScreenExited": "Vollbild deaktiviert"
+  },
  "shortcutsPanel": {
    "title": "Tastenkürzel",
    "categories": {
@@ -775,7 +793,11 @@
      "raise-hand": "Hand heben oder senken",
      "toggle-chat": "Chat anzeigen/ausblenden",
      "toggle-participants": "Teilnehmende anzeigen/ausblenden",
-      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen"
+      "open-shortcuts-settings": "Tastenkürzel-Einstellungen öffnen",
+      "zoom-in": "In einen geteilten Bildschirm hineinzoomen",
+      "zoom-out": "Aus einem geteilten Bildschirm herauszoomen",
+      "zoom-reset": "Zoom des geteilten Bildschirms zurücksetzen",
+      "zoom-pan": "Im gezoomten geteilten Bildschirm navigieren"
    },
    "sr": {
      "control": "Steuerung",
@@ -785,10 +807,14 @@
      "shift": "Umschalt",
      "plus": "plus",
      "hold": "Halte {{key}} gedrückt",
+      "arrows": "Pfeiltasten",
+      "plusKey": "Plus-Taste",
+      "minusKey": "Minus-Taste",
      "noShortcut": "Kein Tastenkürzel"
    },
    "visual": {
-      "hold": "Halte {{key}} gedrückt"
+      "hold": "Halte {{key}} gedrückt",
+      "arrows": "↑ ↓ ← →"
    }
  },
  "fullScreenWarning": {
@@ -102,6 +102,9 @@
      },
      "messageReceived": {
        "label": "Nachricht erhalten"
+      },
+      "participantWaiting": {
+        "label": "Person im Warteraum"
      }
    }
  },
@@ -33,12 +33,14 @@
    "accept": "Accept"
  },
  "transcript": {
+    "waitingForTracks": "Transcription is waiting for a microphone. Turn on your microphone so the transcription can start.",
    "started": "{{name}} started the meeting transcription.",
    "stopped": "{{name}} stopped the meeting transcription.",
    "limitReached": "The transcription has exceeded the maximum allowed duration and will be automatically saved.",
    "requested": "{{name}} wants to start the meeting transcription."
  },
  "screenRecording": {
+    "waitingForTracks": "Recording is waiting for audio or video. Turn on your microphone or camera, or share your screen, so the recording can start.",
    "started": "{{name}} started the meeting recording.",
    "stopped": "{{name}} stopped the meeting recording.",
    "limitReached": "The recording has exceeded the maximum allowed duration and will be automatically saved.",
@@ -756,6 +756,24 @@
    "muteParticipant": "Mute {{name}}",
    "fullScreen": "Full screen"
  },
+  "screenShareZoom": {
+    "toolbarLabel": "Screen share zoom controls",
+    "zoomIn": "Zoom in",
+    "zoomInWithShortcut": "Zoom in ({{shortcut}})",
+    "zoomOut": "Zoom out",
+    "zoomOutWithShortcut": "Zoom out ({{shortcut}})",
+    "wheelShortcut": "Control plus scroll wheel",
+    "wheelShortcutMac": "⌘+scroll wheel",
+    "wheelShortcutHint": "Shortcut: Control plus scroll wheel to zoom in or out.",
+    "wheelShortcutHintMac": "Shortcut: Command plus scroll wheel to zoom in or out.",
+    "fitToWindow": "Fit to window",
+    "fullScreen": "Full screen",
+    "exitFullScreen": "Exit full screen",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Drag with mouse, or move focus back to the screen share and use arrow keys to navigate the picture.",
+    "fullScreenEntered": "Full screen enabled",
+    "fullScreenExited": "Full screen disabled"
+  },
  "shortcutsPanel": {
    "title": "Keyboard shortcuts",
    "categories": {
@@ -775,7 +793,11 @@
      "raise-hand": "Raise or lower hand",
      "toggle-chat": "Toggle chat",
      "toggle-participants": "Toggle participants",
-      "open-shortcuts-settings": "Open shortcuts settings"
+      "open-shortcuts-settings": "Open shortcuts settings",
+      "zoom-in": "Zoom in on a shared screen",
+      "zoom-out": "Zoom out on a shared screen",
+      "zoom-reset": "Reset the shared screen zoom",
+      "zoom-pan": "Move around a zoomed shared screen"
    },
    "sr": {
      "control": "Control",
@@ -785,10 +807,14 @@
      "shift": "Shift",
      "plus": "plus",
      "hold": "Hold {{key}}",
+      "arrows": "Arrow keys",
+      "plusKey": "Plus key",
+      "minusKey": "Minus key",
      "noShortcut": "No shortcut"
    },
    "visual": {
-      "hold": "Hold {{key}}"
+      "hold": "Hold {{key}}",
+      "arrows": "↑ ↓ ← →"
    }
  },
  "fullScreenWarning": {
@@ -102,6 +102,9 @@
      },
      "messageReceived": {
        "label": "Message received"
+      },
+      "participantWaiting": {
+        "label": "Participant waiting"
      }
    }
  },
@@ -33,12 +33,14 @@
    "accept": "Aceptar"
  },
  "transcript": {
+    "waitingForTracks": "La transcripción está esperando un micrófono. Activa el micrófono para que la transcripción pueda comenzar.",
    "started": "{{name}} ha iniciado la transcripción de la reunión.",
    "stopped": "{{name}} ha detenido la transcripción de la reunión.",
    "limitReached": "La transcripción ha superado la duración máxima permitida, se va a guardar automáticamente.",
    "requested": "{{name}} ha solicitado iniciar la transcripción."
  },
  "screenRecording": {
+    "waitingForTracks": "La grabación está esperando audio o vídeo. Activa el micrófono o la cámara, o comparte la pantalla, para que la grabación pueda comenzar.",
    "started": "{{name}} ha iniciado la grabación de la reunión.",
    "stopped": "{{name}} ha detenido la grabación de la reunión.",
    "limitReached": "La grabación ha superado la duración máxima permitida, se va a guardar automáticamente.",
@@ -755,6 +755,24 @@
    "muteParticipant": "Silenciar el micrófono de {{name}}",
    "fullScreen": "Pantalla completa"
  },
+  "screenShareZoom": {
+    "toolbarLabel": "Controles de zoom de la pantalla compartida",
+    "zoomIn": "Acercar",
+    "zoomInWithShortcut": "Acercar ({{shortcut}})",
+    "zoomOut": "Alejar",
+    "zoomOutWithShortcut": "Alejar ({{shortcut}})",
+    "wheelShortcut": "Control más rueda del ratón",
+    "wheelShortcutMac": "⌘+rueda del ratón",
+    "wheelShortcutHint": "Atajo: Control más rueda del ratón para acercar o alejar.",
+    "wheelShortcutHintMac": "Atajo: Comando más rueda del ratón para acercar o alejar.",
+    "fitToWindow": "Ajustar a la ventana",
+    "fullScreen": "Pantalla completa",
+    "exitFullScreen": "Salir de pantalla completa",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Arrastra con el ratón, o vuelve a la pantalla compartida y usa las flechas para moverte por la imagen.",
+    "fullScreenEntered": "Pantalla completa activada",
+    "fullScreenExited": "Pantalla completa desactivada"
+  },
  "shortcutsPanel": {
    "title": "Atajos de teclado",
    "categories": {
@@ -774,7 +792,11 @@
      "raise-hand": "Levantar o bajar la mano",
      "toggle-chat": "Mostrar/Ocultar el chat",
      "toggle-participants": "Mostrar/Ocultar los participantes",
-      "open-shortcuts-settings": "Abrir los ajustes de los atajos"
+      "open-shortcuts-settings": "Abrir los ajustes de los atajos",
+      "zoom-in": "Acercar una pantalla compartida",
+      "zoom-out": "Alejar una pantalla compartida",
+      "zoom-reset": "Restablecer el zoom de la pantalla compartida",
+      "zoom-pan": "Moverse por una pantalla compartida ampliada"
    },
    "sr": {
      "control": "Control",
@@ -102,6 +102,9 @@
      },
      "messageReceived": {
        "label": "Un mensaje recibido"
+      },
+      "participantWaiting": {
+        "label": "Una persona en la sala de espera"
      }
    }
  },
@@ -33,12 +33,14 @@
    "accept": "Accepter"
  },
  "transcript": {
+    "waitingForTracks": "La transcription attend un microphone. Activez votre microphone pour permettre à la transcription de démarrer.",
    "started": "{{name}} a démarré la transcription de la réunion.",
    "stopped": "{{name}} a arrêté la transcription de la réunion.",
    "limitReached": "La transcription a dépassé la durée maximale autorisée, elle va être automatiquement sauvegardée.",
    "requested": "{{name}} a demandé à démarrer la transcription."
  },
  "screenRecording": {
+    "waitingForTracks": "L’enregistrement attend un flux audio ou vidéo. Activez votre microphone ou votre caméra, ou partagez votre écran, pour permettre à l’enregistrement de démarrer.",
    "started": "{{name}} a démarré l'enregistrement de la réunion.",
    "stopped": "{{name}} a arrêté l'enregistrement de la réunion.",
    "limitReached": "L'enregistrement a dépassé la durée maximale autorisée, il va être automatiquement sauvegardé.",
@@ -756,6 +756,24 @@
    "muteParticipant": "Couper le micro de {{name}}",
    "fullScreen": "Plein écran"
  },
+  "screenShareZoom": {
+    "toolbarLabel": "Contrôles de zoom du partage d'écran",
+    "zoomIn": "Zoomer",
+    "zoomInWithShortcut": "Zoomer ({{shortcut}})",
+    "zoomOut": "Dézoomer",
+    "zoomOutWithShortcut": "Dézoomer ({{shortcut}})",
+    "wheelShortcut": "Contrôle plus molette",
+    "wheelShortcutMac": "⌘+molette",
+    "wheelShortcutHint": "Raccourci : Contrôle plus molette pour zoomer ou dézoomer.",
+    "wheelShortcutHintMac": "Raccourci : Commande plus molette pour zoomer ou dézoomer.",
+    "fitToWindow": "Ajuster à la fenêtre",
+    "fullScreen": "Plein écran",
+    "exitFullScreen": "Quitter le plein écran",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Glissez avec la souris, ou revenez sur le partage d'écran et utilisez les touches fléchées pour naviguer dans l'image.",
+    "fullScreenEntered": "Plein écran activé",
+    "fullScreenExited": "Plein écran désactivé"
+  },
  "shortcutsPanel": {
    "title": "Raccourcis clavier",
    "categories": {
@@ -775,7 +793,11 @@
      "raise-hand": "Lever ou baisser la main",
      "toggle-chat": "Afficher/Masquer le chat",
      "toggle-participants": "Afficher/Masquer les participants",
-      "open-shortcuts-settings": "Ouvrir les réglages des raccourcis"
+      "open-shortcuts-settings": "Ouvrir les réglages des raccourcis",
+      "zoom-in": "Zoomer sur un écran partagé",
+      "zoom-out": "Dézoomer sur un écran partagé",
+      "zoom-reset": "Réinitialiser le zoom de l’écran partagé",
+      "zoom-pan": "Se déplacer dans un écran partagé zoomé"
    },
    "sr": {
      "control": "Contrôle",
@@ -785,10 +807,14 @@
      "shift": "Majuscule",
      "plus": "plus",
      "hold": "Maintenir {{key}}",
+      "arrows": "Touches fléchées",
+      "plusKey": "Touche plus",
+      "minusKey": "Touche moins",
      "noShortcut": "Aucun raccourci"
    },
    "visual": {
-      "hold": "Maintenir {{key}}"
+      "hold": "Maintenir {{key}}",
+      "arrows": "↑ ↓ ← →"
    }
  },
  "fullScreenWarning": {
@@ -102,6 +102,9 @@
      },
      "messageReceived": {
        "label": "Un message reçu"
+      },
+      "participantWaiting": {
+        "label": "Une personne en salle d’attente"
      }
    }
  },
@@ -33,12 +33,14 @@
    "accept": "Accepteren"
  },
  "transcript": {
+    "waitingForTracks": "De transcriptie wacht op een microfoon. Zet uw microfoon aan, zodat de transcriptie kan starten.",
    "started": "{{name}} is de transcriptie van de vergadering gestart.",
    "stopped": "{{name}} heeft de transcriptie van de vergadering gestopt.",
    "limitReached": "De transcriptie heeft de maximaal toegestane duur overschreden en wordt automatisch opgeslagen.",
    "requested": "{{name}} wil graag de transcriptie starten."
  },
  "screenRecording": {
+    "waitingForTracks": "De opname wacht op audio of video. Zet uw microfoon of camera aan of deel uw scherm, zodat de opname kan starten.",
    "started": "{{name}} is begonnen met het opnemen van de vergadering.",
    "stopped": "{{name}} is gestopt met het opnemen van de vergadering.",
    "limitReached": "De opname heeft de maximaal toegestane duur overschreden en wordt automatisch opgeslagen.",
@@ -756,6 +756,24 @@
    "muteParticipant": "Demp {{name}}",
    "fullScreen": "Volledig scherm"
  },
+  "screenShareZoom": {
+    "toolbarLabel": "Zoombediening voor schermdeling",
+    "zoomIn": "Inzoomen",
+    "zoomInWithShortcut": "Inzoomen ({{shortcut}})",
+    "zoomOut": "Uitzoomen",
+    "zoomOutWithShortcut": "Uitzoomen ({{shortcut}})",
+    "wheelShortcut": "Control plus scrollwiel",
+    "wheelShortcutMac": "⌘+scrollwiel",
+    "wheelShortcutHint": "Sneltoets: Control plus scrollwiel om in of uit te zoomen.",
+    "wheelShortcutHintMac": "Sneltoets: Command plus scrollwiel om in of uit te zoomen.",
+    "fitToWindow": "Aanpassen aan venster",
+    "fullScreen": "Volledig scherm",
+    "exitFullScreen": "Volledig scherm verlaten",
+    "currentZoomLevel": "Zoom {{level}} %",
+    "panHint": "Zoom {{level}} %. Sleep met de muis, of zet de focus terug op de schermdeling en gebruik de pijltjestoetsen om door het beeld te navigeren.",
+    "fullScreenEntered": "Volledig scherm ingeschakeld",
+    "fullScreenExited": "Volledig scherm uitgeschakeld"
+  },
  "shortcutsPanel": {
    "title": "Sneltoetsen",
    "categories": {
@@ -775,7 +793,11 @@
      "raise-hand": "Hand opsteken of laten zakken",
      "toggle-chat": "Chat tonen/verbergen",
      "toggle-participants": "Deelnemers tonen/verbergen",
-      "open-shortcuts-settings": "Sneltoets-instellingen openen"
+      "open-shortcuts-settings": "Sneltoets-instellingen openen",
+      "zoom-in": "Inzoomen op een gedeeld scherm",
+      "zoom-out": "Uitzoomen op een gedeeld scherm",
+      "zoom-reset": "Zoom van het gedeelde scherm herstellen",
+      "zoom-pan": "Navigeren in een ingezoomd gedeeld scherm"
    },
    "sr": {
      "control": "Control",
@@ -785,10 +807,14 @@
      "shift": "Shift",
      "plus": "plus",
      "hold": "Houd {{key}} ingedrukt",
+      "arrows": "Pijltoetsen",
+      "plusKey": "Plus-toets",
+      "minusKey": "Min-toets",
      "noShortcut": "Geen sneltoets"
    },
    "visual": {
-      "hold": "Houd {{key}} ingedrukt"
+      "hold": "Houd {{key}} ingedrukt",
+      "arrows": "↑ ↓ ← →"
    }
  },
  "fullScreenWarning": {
@@ -102,6 +102,9 @@
      },
      "messageReceived": {
        "label": "Bericht ontvangen"
+      },
+      "participantWaiting": {
+        "label": "Deelnemer in de wachtkamer"
      }
    }
  },
@@ -16,6 +16,7 @@ const DEFAULT_STATE: State = {
      [NotificationType.ParticipantJoined, true],
      [NotificationType.HandRaised, true],
      [NotificationType.MessageReceived, true],
+      [NotificationType.ParticipantWaiting, true],
    ])
  ),
  soundNotificationVolume: 0.1,
@@ -74,7 +74,7 @@ spec:
            value: meet
          - name: MINIO_ROOT_PASSWORD
            value: password
-        image: "minio/minio"
+        image: "quay.io/minio/minio"
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9000
@@ -103,7 +103,7 @@ spec:
    spec:
      containers:
      - name: mc
-        image: minio/mc
+        image: quay.io/minio/mc
        command:
          - /bin/sh
          - -c
@@ -1,4 +1,4 @@
 apiVersion: v2
 type: application
 name: meet
-version: 0.0.27
+version: 0.0.28
@@ -81,18 +81,24 @@
 | `backend.migrate.restartPolicy`                       | backend migrate job restart policy                                                 | `Never`                                                                                                                                                                                                                                                                             |
 | `backend.createsuperuser.command`                     | backend migrate command                                                            | `["/bin/sh","-c","while ! python manage.py check --database default > /dev/null 2>&1\ndo\n  echo \"Database not ready\"\n  sleep 2\ndone\necho \"Database is ready\"\n\npython manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD\n"]` |
 | `backend.createsuperuser.restartPolicy`               | backend migrate job restart policy                                                 | `Never`                                                                                                                                                                                                                                                                             |
-| `backend.probes.liveness.path`                        | Configure path for backend HTTP liveness probe                                     | `/__heartbeat__`                                                                                                                                                                                                                                                                    |
+| `backend.probes.liveness.path`                        | Configure path for backend HTTP liveness probe                                     | `/__lbheartbeat__`                                                                                                                                                                                                                                                                  |
 | `backend.probes.liveness.targetPort`                  | Configure port for backend HTTP liveness probe                                     | `undefined`                                                                                                                                                                                                                                                                         |
-| `backend.probes.liveness.initialDelaySeconds`         | Configure initial delay for backend liveness probe                                 | `30`                                                                                                                                                                                                                                                                                |
-| `backend.probes.liveness.initialDelaySeconds`         | Configure timeout for backend liveness probe                                       | `30`                                                                                                                                                                                                                                                                                |
-| `backend.probes.startup.path`                         | Configure path for backend HTTP startup probe                                      | `undefined`                                                                                                                                                                                                                                                                         |
+| `backend.probes.liveness.initialDelaySeconds`         | Configure initial delay for backend liveness probe                                 | `undefined`                                                                                                                                                                                                                                                                         |
+| `backend.probes.liveness.periodSeconds`               | Configure period for backend liveness probe                                        | `30`                                                                                                                                                                                                                                                                                |
+| `backend.probes.liveness.timeoutSeconds`              | Configure timeout for backend liveness probe                                       | `5`                                                                                                                                                                                                                                                                                 |
+| `backend.probes.liveness.failureThreshold`            | Configure failure threshold for backend liveness probe                             | `undefined`                                                                                                                                                                                                                                                                         |
+| `backend.probes.startup.path`                         | Configure path for backend HTTP startup probe                                      | `/__lbheartbeat__`                                                                                                                                                                                                                                                                  |
 | `backend.probes.startup.targetPort`                   | Configure port for backend HTTP startup probe                                      | `undefined`                                                                                                                                                                                                                                                                         |
 | `backend.probes.startup.initialDelaySeconds`          | Configure initial delay for backend startup probe                                  | `undefined`                                                                                                                                                                                                                                                                         |
-| `backend.probes.startup.initialDelaySeconds`          | Configure timeout for backend startup probe                                        | `undefined`                                                                                                                                                                                                                                                                         |
-| `backend.probes.readiness.path`                       | Configure path for backend HTTP readiness probe                                    | `/__lbheartbeat__`                                                                                                                                                                                                                                                                  |
+| `backend.probes.startup.periodSeconds`                | Configure period for backend startup probe                                         | `5`                                                                                                                                                                                                                                                                                 |
+| `backend.probes.startup.timeoutSeconds`               | Configure timeout for backend startup probe                                        | `5`                                                                                                                                                                                                                                                                                 |
+| `backend.probes.startup.failureThreshold`             | Configure failure threshold for backend startup probe                              | `12`                                                                                                                                                                                                                                                                                |
+| `backend.probes.readiness.path`                       | Configure path for backend HTTP readiness probe                                    | `/__heartbeat__`                                                                                                                                                                                                                                                                    |
 | `backend.probes.readiness.targetPort`                 | Configure port for backend HTTP readiness probe                                    | `undefined`                                                                                                                                                                                                                                                                         |
-| `backend.probes.readiness.initialDelaySeconds`        | Configure initial delay for backend readiness probe                                | `30`                                                                                                                                                                                                                                                                                |
-| `backend.probes.readiness.initialDelaySeconds`        | Configure timeout for backend readiness probe                                      | `30`                                                                                                                                                                                                                                                                                |
+| `backend.probes.readiness.initialDelaySeconds`        | Configure initial delay for backend readiness probe                                | `undefined`                                                                                                                                                                                                                                                                         |
+| `backend.probes.readiness.periodSeconds`              | Configure period for backend readiness probe                                       | `30`                                                                                                                                                                                                                                                                                |
+| `backend.probes.readiness.timeoutSeconds`             | Configure timeout for backend readiness probe                                      | `5`                                                                                                                                                                                                                                                                                 |
+| `backend.probes.readiness.failureThreshold`           | Configure failure threshold for backend readiness probe                            | `3`                                                                                                                                                                                                                                                                                 |
 | `backend.resources`                                   | Resource requirements for the backend container                                    | `{}`                                                                                                                                                                                                                                                                                |
 | `backend.nodeSelector`                                | Node selector for the backend Pod                                                  | `{}`                                                                                                                                                                                                                                                                                |
 | `backend.tolerations`                                 | Tolerations for the backend Pod                                                    | `[]`                                                                                                                                                                                                                                                                                |
@@ -211,18 +217,24 @@
 | `summary.service.port`                                | summary Service listening port                                                     | `80`               |
 | `summary.service.targetPort`                          | summary container listening port                                                   | `8000`             |
 | `summary.service.annotations`                         | Annotations to add to the summary Service                                          | `{}`               |
-| `summary.probes.liveness.path`                        | Configure path for summary HTTP liveness probe                                     | `/__heartbeat__`   |
+| `summary.probes.liveness.path`                        | Configure path for summary HTTP liveness probe                                     | `/__lbheartbeat__` |
 | `summary.probes.liveness.targetPort`                  | Configure port for summary HTTP liveness probe                                     | `undefined`        |
-| `summary.probes.liveness.initialDelaySeconds`         | Configure initial delay for summary liveness probe                                 | `30`               |
-| `summary.probes.liveness.initialDelaySeconds`         | Configure timeout for summary liveness probe                                       | `30`               |
-| `summary.probes.startup.path`                         | Configure path for summary HTTP startup probe                                      | `undefined`        |
+| `summary.probes.liveness.initialDelaySeconds`         | Configure initial delay summary liveness probe                                     | `undefined`        |
+| `summary.probes.liveness.periodSeconds`               | Configure the period for the summary liveness probe                                | `30`               |
+| `summary.probes.liveness.timeoutSeconds`              | Configure timeout for summary liveness probe                                       | `5`                |
+| `summary.probes.liveness.failureThreshold`            | Configure failure threshold for summary liveness probe                             | `undefined`        |
+| `summary.probes.startup.path`                         | Configure path for summary HTTP startup probe                                      | `/__lbheartbeat__` |
 | `summary.probes.startup.targetPort`                   | Configure port for summary HTTP startup probe                                      | `undefined`        |
 | `summary.probes.startup.initialDelaySeconds`          | Configure initial delay for summary startup probe                                  | `undefined`        |
-| `summary.probes.startup.initialDelaySeconds`          | Configure timeout for summary startup probe                                        | `undefined`        |
-| `summary.probes.readiness.path`                       | Configure path for summary HTTP readiness probe                                    | `/__lbheartbeat__` |
+| `summary.probes.startup.periodSeconds`                | Configure period for the summary startup probe                                     | `5`                |
+| `summary.probes.startup.timeoutSeconds`               | Configure timeout for summary startup probe                                        | `5`                |
+| `summary.probes.startup.failureThreshold`             | Configure failure threshold for summary startup probe                              | `12`               |
+| `summary.probes.readiness.path`                       | Configure path for summary HTTP readiness probe                                    | `/__heartbeat__`   |
 | `summary.probes.readiness.targetPort`                 | Configure port for summary HTTP readiness probe                                    | `undefined`        |
-| `summary.probes.readiness.initialDelaySeconds`        | Configure initial delay for summary readiness probe                                | `30`               |
-| `summary.probes.readiness.initialDelaySeconds`        | Configure timeout for summary readiness probe                                      | `30`               |
+| `summary.probes.readiness.initialDelaySeconds`        | Configure initial delay for summary readiness probe                                | `undefined`        |
+| `summary.probes.readiness.periodSeconds`              | Configure period for the summary readiness probe                                   | `30`               |
+| `summary.probes.readiness.timeoutSeconds`             | Configure timeout for summary readiness probe                                      | `5`                |
+| `summary.probes.readiness.failureThreshold`           | Configure failure threshold for summary readiness probe                            | `3`                |
 | `summary.resources`                                   | Resource requirements for the summary container                                    | `{}`               |
 | `summary.nodeSelector`                                | Node selector for the summary Pod                                                  | `{}`               |
 | `summary.tolerations`                                 | Tolerations for the summary Pod                                                    | `[]`               |
@@ -128,6 +128,9 @@ httpGet:
 {{- end }}
 initialDelaySeconds: {{ .initialDelaySeconds | eq nil | ternary 0 .initialDelaySeconds }}
 timeoutSeconds: {{ .timeoutSeconds | eq nil | ternary 1 .timeoutSeconds }}
+periodSeconds: {{ .periodSeconds | eq nil | ternary 10 .periodSeconds }}
+failureThreshold: {{ .failureThreshold | eq nil | ternary 3 .failureThreshold }}
+successThreshold: {{ .successThreshold | eq nil | ternary 1 .successThreshold }}
 {{- end }}

 {{/*
@@ -320,26 +320,36 @@ backend:
  ## @param backend.probes.liveness.initialDelaySeconds [nullable] Configure initial delay for backend liveness probe
  ## @param backend.probes.liveness.periodSeconds [nullable] Configure period for backend liveness probe
  ## @param backend.probes.liveness.timeoutSeconds [nullable] Configure timeout for backend liveness probe
+  ## @param backend.probes.liveness.failureThreshold [nullable] Configure failure threshold for backend liveness probe
  ## @param backend.probes.startup.path [nullable] Configure path for backend HTTP startup probe
  ## @param backend.probes.startup.targetPort [nullable] Configure port for backend HTTP startup probe
  ## @param backend.probes.startup.initialDelaySeconds [nullable] Configure initial delay for backend startup probe
  ## @param backend.probes.startup.periodSeconds [nullable] Configure period for backend startup probe
  ## @param backend.probes.startup.timeoutSeconds [nullable] Configure timeout for backend startup probe
+  ## @param backend.probes.startup.failureThreshold [nullable] Configure failure threshold for backend startup probe
  ## @param backend.probes.readiness.path [nullable] Configure path for backend HTTP readiness probe
  ## @param backend.probes.readiness.targetPort [nullable] Configure port for backend HTTP readiness probe
  ## @param backend.probes.readiness.initialDelaySeconds [nullable] Configure initial delay for backend readiness probe
  ## @param backend.probes.readiness.periodSeconds [nullable] Configure period for backend readiness probe
  ## @param backend.probes.readiness.timeoutSeconds [nullable] Configure timeout for backend readiness probe
+  ## @param backend.probes.readiness.failureThreshold [nullable] Configure failure threshold for backend readiness probe
  probes:
+    startup:
+      path: /__lbheartbeat__
+      periodSeconds: 5
+      timeoutSeconds: 5
+      failureThreshold: 12
+
    liveness:
-      path: /__heartbeat__
-      initialDelaySeconds: 5
+      path: /__lbheartbeat__
      periodSeconds: 30
+      timeoutSeconds: 5

    readiness:
-      path: /__lbheartbeat__
-      initialDelaySeconds: 5
+      path: /__heartbeat__
      periodSeconds: 30
+      timeoutSeconds: 5
+      failureThreshold: 3

  ## @param backend.resources Resource requirements for the backend container
  resources: {}
@@ -623,25 +633,36 @@ summary:
  ## @param summary.probes.liveness.initialDelaySeconds [nullable] Configure initial delay summary liveness probe
  ## @param summary.probes.liveness.periodSeconds [nullable] Configure the period for the summary liveness probe
  ## @param summary.probes.liveness.timeoutSeconds [nullable] Configure timeout for summary liveness probe
+  ## @param summary.probes.liveness.failureThreshold [nullable] Configure failure threshold for summary liveness probe
  ## @param summary.probes.startup.path [nullable] Configure path for summary HTTP startup probe
  ## @param summary.probes.startup.targetPort [nullable] Configure port for summary HTTP startup probe
  ## @param summary.probes.startup.initialDelaySeconds [nullable] Configure initial delay for summary startup probe
  ## @param summary.probes.startup.periodSeconds [nullable] Configure period for the summary startup probe
  ## @param summary.probes.startup.timeoutSeconds [nullable] Configure timeout for summary startup probe
+  ## @param summary.probes.startup.failureThreshold [nullable] Configure failure threshold for summary startup probe
  ## @param summary.probes.readiness.path [nullable] Configure path for summary HTTP readiness probe
  ## @param summary.probes.readiness.targetPort [nullable] Configure port for summary HTTP readiness probe
  ## @param summary.probes.readiness.initialDelaySeconds [nullable] Configure initial delay for summary readiness probe
  ## @param summary.probes.readiness.periodSeconds [nullable] Configure period for the summary readiness probe
  ## @param summary.probes.readiness.timeoutSeconds [nullable] Configure timeout for summary readiness probe
+  ## @param summary.probes.readiness.failureThreshold [nullable] Configure failure threshold for summary readiness probe
  probes:
-    liveness:
-      path: /__heartbeat__
-      initialDelaySeconds: 5
-      periodSeconds: 30
-    readiness:
+    startup:
+      path: /__lbheartbeat__
+      periodSeconds: 5
+      timeoutSeconds: 5
+      failureThreshold: 12
+
+    liveness:
      path: /__lbheartbeat__
-      initialDelaySeconds: 5
      periodSeconds: 30
+      timeoutSeconds: 5
+
+    readiness:
+      path: /__heartbeat__
+      periodSeconds: 30
+      timeoutSeconds: 5
+      failureThreshold: 3


  ## @param summary.resources Resource requirements for the summary container
@@ -10,6 +10,7 @@ dependencies = [
    "pydantic-settings>=2.1.0",
    "celery==5.6.3",
    "redis==5.2.1",
+    "dockerflow==2026.3.4",
    "minio==7.2.20",
    "openai==2.48.0",
    "posthog==7.29.0",
@@ -1,17 +0,0 @@
-"""API routes related to application health checking."""
-
-from fastapi import APIRouter
-
-router = APIRouter()
-
-
-@router.get("/__heartbeat__")
-async def heartbeat():
-    """Health check endpoint for monitoring."""
-    return
-
-
-@router.get("/__lbheartbeat__")
-async def lbheartbeat():
-    """Health check endpoint for load balancer."""
-    return
@@ -0,0 +1,24 @@
+"""Dockerflow checks backing the /__heartbeat__ endpoint."""
+
+from celery.exceptions import OperationalError
+from dockerflow import checks
+
+from summary.core.celery_worker import celery
+
+BROKER_SOCKET_TIMEOUT = 2  # Should be under the readiness probe timeout (5s)
+
+
+@checks.register(name="broker_connected")
+def check_broker_connected():
+    """Report whether the Celery broker accepts a connection."""
+    try:
+        with celery.connection_for_write(
+            transport_options={
+                "socket_connect_timeout": BROKER_SOCKET_TIMEOUT,
+                "socket_timeout": BROKER_SOCKET_TIMEOUT,
+            }
+        ) as connection:
+            connection.ensure_connection(max_retries=0)
+    except OperationalError as exc:
+        return [checks.Error(str(exc), id="summary.health.E001")]
+    return []
@@ -1,10 +1,11 @@
 """Application."""

 import sentry_sdk
+from dockerflow.fastapi import router as dockerflow_router
 from fastapi import FastAPI

-from summary.api import health
 from summary.api.main import api_router_v2
+from summary.core import checks  # noqa: F401 -- registers the Dockerflow checks
 from summary.core.config import get_settings

 settings = get_settings()
@@ -18,4 +19,4 @@ app = FastAPI(
 )

 app.include_router(api_router_v2, prefix=settings.app_api_v2_str)
-app.include_router(health.router)
+app.include_router(dockerflow_router)
@@ -1,21 +1,54 @@
-"""Integration tests for the health check endpoints."""
+"""Tests for the health check endpoints."""
+
+from unittest import mock
+
+import pytest
+from celery.exceptions import OperationalError


-class TestHeartbeat:
-    """Tests for the /__heartbeat__ endpoint."""
-
-    def test_returns_200(self, client):
-        """The heartbeat endpoint responds with 200 OK without an api_key."""
-        response = client.get("/__heartbeat__")
-
-        assert response.status_code == 200
+@pytest.fixture(name="broker")
+def fixture_broker():
+    """Patch the Celery broker connection the heartbeat check opens."""
+    with mock.patch("summary.core.checks.celery.connection_for_write") as connect:
+        connection = connect.return_value
+        connection.__enter__.return_value = connection
+        yield connection


 class TestLBHeartbeat:
    """Tests for the /__lbheartbeat__ endpoint."""

-    def test_returns_200(self, client):
+    def test_returns_200(self, client, broker):
        """The LB heartbeat endpoint responds with 200 OK without an api_key."""
        response = client.get("/__lbheartbeat__")

+        broker.ensure_connection.assert_not_called()
        assert response.status_code == 200
+
+
+class TestHeartbeat:
+    """Tests for the /__heartbeat__ endpoint."""
+
+    def test_returns_200(self, client, broker):
+        """The heartbeat endpoint responds with 200 OK without an api_key."""
+        response = client.get("/__heartbeat__")
+
+        assert response.status_code == 200
+        assert response.json()["checks"]["broker_connected"] == "ok"
+        broker.ensure_connection.assert_called_once_with(max_retries=0)
+
+    def test_returns_500_when_the_broker_is_unreachable(self, client, broker):
+        """An unreachable celery broker takes the readiness probe down."""
+        broker.ensure_connection.side_effect = OperationalError("Connection refused")
+
+        response = client.get("/__heartbeat__")
+
+        assert response.status_code == 500
+
+        payload = response.json()
+        assert payload["status"] == "error"
+        assert payload["checks"]["broker_connected"] == "error"
+        assert (
+            payload["details"]["broker_connected"]["messages"]["summary.health.E001"]
+            == "Connection refused"
+        )
@@ -423,6 +423,15 @@ wheels = [
    { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" },
 ]

+[[package]]
+name = "dockerflow"
+version = "2026.3.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/9c/03/935f8399094611981b37634a7ee078484b3995f744135339e51385638f6c/dockerflow-2026.3.4.tar.gz", hash = "sha256:6cc7fcab2a078d06aeca8b02e22fd7f6766dca322fb30aed6910684dbc08690c", size = 68701, upload-time = "2026-03-04T09:01:28.178Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/86/b9/2d7bf30eb0c24e60e61e4f6ae7574e123d3fa51b39a612e146c94158446a/dockerflow-2026.3.4-py2.py3-none-any.whl", hash = "sha256:38fe0ad30a4aedf68e589919695d502fc6f584a761b56a91f56e80cbadfbf61a", size = 36424, upload-time = "2026-03-04T09:01:26.631Z" },
+]
+
 [[package]]
 name = "email-validator"
 version = "2.3.0"
@@ -1511,6 +1520,7 @@ version = "1.31.0"
 source = { editable = "." }
 dependencies = [
    { name = "celery" },
+    { name = "dockerflow" },
    { name = "fastapi", extra = ["standard"] },
    { name = "langfuse" },
    { name = "minio" },
@@ -1534,6 +1544,7 @@ dev = [
 [package.metadata]
 requires-dist = [
    { name = "celery", specifier = "==5.6.3" },
+    { name = "dockerflow", specifier = "==2026.3.4" },
    { name = "fastapi", extras = ["standard"], specifier = ">=0.105.0" },
    { name = "langfuse", specifier = "==4.14.1" },
    { name = "minio", specifier = "==7.2.20" },
Author	SHA1	Message	Date
briquet	ff662a1c8e	🔒️(backend) upgrade base image to python:3.13.15-alpine3.24 Fixes an XML injection attack in libexpat (CVE-2026-93990)	2026-09-24 19:52:33 +02:00
lebaudantoine	8d980192c8	🚸(frontend) inform user that recording waits until a track is published When a user starts a recording or a transcription while no track is published yet, the recording stays in a "starting" state until an appropriate track is available. Show an explicit message on start explaining that the recording will remain in "starting" state until a track of the required type is published. The expected track type depends on the recording type (audio-only vs. audio + video). This situation was generating a lot of support requests, with users asking why the recording did not actually start.	2026-09-24 00:24:40 +02:00
Ovgodd	de1f7158f5	📝(changelog) shorten the reception resolution entry The changelog check fails at 80 columns. Dropping "the" keeps the reception resolution entry under that limit.	2026-09-22 16:21:00 +02:00
Ovgodd	6e17c6533c	♿️(frontend) use i18n strings for screen share wheel zoom shortcuts Use i18n strings for displaying screen share zoom shortcuts in the UI controls.	2026-09-22 16:21:00 +02:00
Ovgodd	27e32c0370	♿️(frontend) add keyboard navigation to screen share zoom toolbar Arrows move between controls instead of panning, w/ en/fr/nl/de hint update.	2026-09-22 16:21:00 +02:00
Cyril	6d4403d4fa	♻️(frontend) refactor screen share zoom pan with useMove use react-aria useMove for pan, zoom/pan refs for DOM updates,	2026-09-22 16:21:00 +02:00
Cyril	37ae308825	♿️(frontend) add wheel zoom shortcut hints to screen share controls Show Ctrl/Cmd+scroll zoom shortcut in tooltips, aria, SR hints, w/ en/fr/nl/de.	2026-09-22 16:21:00 +02:00
Cyril	16fd2dc4e8	💄(frontend) improve screen share zoom toolbar sizing and containment Slightly enlarge toolbar controls while clipping hover states inside the pill, so buttons no longer overflow the bar.	2026-09-22 16:21:00 +02:00
Cyril	9791a8a3b2	💄(frontend) use distinct expand/collapse icons for fullscreen actions Replace fullscreen icons with expand-diagonal-line and collapse-diagonal-line	2026-09-22 16:21:00 +02:00
Cyril	5b0dece79b	🌐(frontend) add i18n keys for screen share zoom controls English and French labels, SR announcements and pan navigation hint.	2026-09-22 16:21:00 +02:00
Cyril	96135a0263	✨(frontend) add zoomable screen share video component Wraps VideoTrack with zoom/pan, keyboard nav and screen reader announcements.	2026-09-22 16:21:00 +02:00
Cyril	ce2e2a4d64	✨(frontend) add ScreenShareZoomControls toolbar component Bottom-right toolbar with zoom, fit-to-window and fullscreen buttons.	2026-09-22 16:21:00 +02:00
Cyril	e5dc9c2f15	✨(frontend) add useScreenShareZoom hook for zoom and pan Manages zoom level, pan offset, wheel zoom, drag-to-pan and keyboard panBy.	2026-09-22 16:21:00 +02:00
kaelvar	e97eab9b5e	🐛(frontend) apply the saved reception resolution when joining a meeting `VideoResolutionSubscription` applied the saved reception resolution on `RoomEvent.TrackPublished`. livekit-client does not raise that event for cameras that were already sending when the local participant joined, so a user who had chosen Low definition still received High definition from everyone already in the meeting, and Low definition only from whoever joined after them. Nothing in the UI showed the discrepancy: the setting kept displaying Low definition. Apply the preference to the publications we already know about when the effect runs, and keep listening on `TrackPublished` — which stays the earliest point to cap a camera that starts after us — plus `TrackSubscribed`, which is the first event raised for the cameras that were already sending. That initial pass also covers a change of preference mid-call, which `VideoTab.updateExistingRemoteVideoQuality` was doing separately. Removed, it is now the same code path for joining and for changing the setting. The three entry points overlap on purpose; the `publication.videoQuality` guard makes the repeats free. It reads as High definition when nothing was ever requested, so the default case costs no signal round trip either. Fixes #1606.	2026-09-22 15:07:47 +02:00
lebaudantoine	436b3dc9df	🔖(helm) release chart 0.0.28	2026-09-22 13:43:04 +02:00
briquet	6ea2a85810	🚑️(summary) serve health endpoints with the dockerflow router The dockerflow package ships with a FastAPI router to serve healthcheck endpoints. A specific Redis test was activated to check the broker.	2026-09-22 12:00:20 +02:00
briquet	3d1ea88e8f	✅(backend) test the dockerflow health endpoints Test kubernetes probes liveness/readiness endpoints	2026-09-22 12:00:20 +02:00
briquet	beb74af574	🔊(backend) change the dockerflow logger level to WARNING We want the liveness/readiness failure reason to show explicitly in logs	2026-09-22 12:00:20 +02:00
briquet	c785b4a627	♻️(backend) serve the dockerflow views early in the middleware stack `DockerflowMiddleware` serves the endpoints `/__heartbeat__`, `/__lbheartbeat__ that we use for the kubernetes probes. Sitting at the bottom of MIDDLEWARE, every Kubernetes probe traversed all middlewares which is not efficient.	2026-09-22 12:00:20 +02:00
briquet	a9a4246abb	🐛(helm) swap liveness and readiness probes The backend and summary probes had the two Dockerflow endpoints the wrong way round. `/__lbheartbeat__` returns an unconditional 200 as soon as the server is up and touches no dependency, while `/__heartbeat__` runs the Dockerflow checks and answers 500 when one of them errors. Wired as they were, a database error made `/__heartbeat__` fail on every backend pod at once, restarting them all. Since a restart cannot fix a database outage, it's better to use these check on the readiness probe and start routing traffic when the database is reachable. - Probe liveness on `/__lbheartbeat__` and readiness on `/__heartbeat__` - Add a startup probe on `/__lbheartbeat__`, polled every 5s with a `failureThreshold` of 12, leaving the pod a minute to boot - Drop `initialDelaySeconds` from liveness and readiness, now that the startup probe holds them off until the server answers - Set `timeoutSeconds` to 5s on every probe, up from the 1s Kubernetes default - Set the readiness `failureThreshold` to 3	2026-09-22 12:00:20 +02:00
briquet	3cf7f60eaa	🐛(helm) render periodSeconds and failureThreshold on probes The `meet.probes.abstract` helper was missing `periodSeconds` block which means Kubernetes fell back to its 10s default instead of the chart value. It's now possible to configure the `failureThreshold` and `successThreshold`.	2026-09-22 12:00:20 +02:00
snyk-bot	bf215f1513	⬆️(addons) upgrade i18next from 26.4.0 to 26.4.1 Snyk has created this PR to upgrade i18next from 26.4.0 to 26.4.1. See this package in npm: i18next See this project in Snyk: https://app.eu.snyk.io/org/lasuite-dinum-default/project/af693e79-8c43-4c09-ab65-60580515c9e8?utm_source=github&utm_medium=referral&page=upgrade-pr	2026-09-22 10:43:55 +02:00
lebaudantoine	75836fc817	⬆️(devx) update the MinIO image on the Tilt stack Bump the MinIO image used by the Tilt dev stack to a more recent version, since the previous public image we relied on was removed.	2026-09-19 20:54:42 +02:00
briquet	1affe65b4a	🔧(dev) configure bureautix proxy for image builds Builds through the Docker API of the Podman service receive none of the proxy variables in their RUN steps and fail systematically because of the proxy rejection. Plain HTTP connections are also rejected by the proxy with a HTTP 405 method error. - Passes http_proxy, https_proxy and no_proxy from the shell as build args - Make the Debian mirror of the agents image a build argument and override it for bureautix to force https usage	2026-09-18 16:10:31 +02:00
briquet	c34ecbd3ef	🔧(dev) remove the unused bin/compose wrapper Nothing in the repository nor the CI calls it	2026-09-18 15:17:58 +02:00
briquet	78960d9769	🔧(dev) use a dedicated folder for docker compose overrides Move extra compose files to docker/compose.d folder	2026-09-18 15:17:51 +02:00
briquet	41d07d36ee	🔧(dev) use port 8081 for keycloak admin on bureautix workstations The Bureautix workstation proxy listens on 8080, which collides with Keycloak's published admin port.	2026-09-18 15:17:44 +02:00
Briquet	f7386e1741	🔧(dev) add a devenv shell for nix-based workstations Add the minimal requirements to build and run the project locally on NixOS - `devenv update` update devenv using NixOS 26.05 stable repositories - `devenv shell` activates the devenv - `devenv --profile <profile>` shell uses additional packages when activated (profile=agent\|summary\|k8s)	2026-09-18 15:17:36 +02:00
briquet	f1da04eb27	🔧(podman) pin the livekit rtc section for local usage Pin the LiveKit rtc section: the browser reaches the server through podman's published ports on loopback while egress and the agents reach it over the podman network, and those two have no address in common. `advertise_internal_ip` keeps the container's own interface address as a host candidate alongside the node_ip one, so LiveKit offers both and ICE picks whichever works. Without it egress only ever sees 127.0.0.1, which is the egress container itself, and its peer connection timeouts `use_external_ip` is turned off since it would advertise the STUN-discovered public IP, which no local peer can hairpin to.	2026-09-18 15:17:29 +02:00
briquet	2970420b84	🔧(podman) make the dev stack work with rootless podman Rootless podman maps container UID 0 to the host user and every other container UID to a subuid that owns nothing in the worktree, so the usual DOCKER_USER=$(id -u):$(id -g) makes every bind mount effectively read-only. Add a compose.podman.yml to override the compose.yml and set `userns_mode: keep-id` in order to map the host user to the same UID and UID inside the container. The merge of the docker compose file is now done with the COMPOSE_FILE environment variable	2026-09-18 15:17:21 +02:00
tanguy chenier	771f58c0aa	🐛(frontend) play the waiting room notification sound on every arrival The waiting room has its own sound in notifications.mp3, and nothing could play it: the sprite is named "waiting" while triggerNotificationSound passes a NotificationType, and howler returns without playing when the sprite id is unknown. ParticipantWaiting was also absent from the sound settings, so the check on the store would have refused it first. The toast borrowed the participant joined sound instead. The sound was tied to the waiting list going from empty to non empty, so a second person arriving while someone was still waiting was silent, which is the case the issue describes. Name the sprite after the notification type, register the type in the settings, and sound every arrival, detected on the participant ids so that an admission and an arrival between two refreshes do not cancel each other out. closes #1705	2026-09-17 17:06:06 +02:00
briquet	b159b20695	🐛(backend) read the Sentry release from pyproject.toml get_release() read the version from a version.json file but nothing generates it during the CI Docker image build, therefore the release reported to Sentry was always "NA". Read the version from pyproject.toml instead, which is bumped at each release and copied into the image.	2026-09-16 15:54:40 +02:00
leo	226d004838	✅(agents) fix subtitle test Result of test for display of subtitles was depending on local env config, potentially failing. Fix this by overriding settings.	2026-09-16 14:20:44 +02:00
lebaudantoine	b723b7bb62	🐛(frontend) fix file permissions in the Docker image Incorrect file permissions in the frontend Docker image caused problems when running the project, and were surfaced by @briquet while setting it up with Podman. Adjust the ownership and permissions applied during the build so the image works cleanly under Docker and Podman alike.	2026-09-15 00:01:22 +02:00
lebaudantoine	cb36df9104	🔧(devx) pull the MinIO image from quay.io The quay.io/minio/minio mirror remains publicly available, accepts the same environment variables.	2026-09-14 20:38:44 +02:00