♻️(tilt) use the helm dev-backend chart

Use the shared helm `dev-backend` chart to deploy the backend in
the Tilt dev stack, instead of maintaining our own copy.

The goal is to share more common pieces of the dev experience and
dev stack across projects, so we do not maintain N different
versions of similar setups.

The only adjustment needed was to backport Garage into the shared
chart.

Originally started by @rouja.

CHANGELOG.md

@@ -16,6 +16,11 @@ and this project adheres to
 - ✨(frontend) let signed-out visitors start a meeting
 - ✨(backend) expose `allow_unregistered_rooms` in the frontend configuration
 
+### Changed
+
+- ✨(frontend) warn users when the connection falls back to TURN
+- 🔧(backend) configure the technical documentation url
+
 ### Fixed
 
 - 🐛(frontend) enforce recording-mode permissions on the checkboxes
@@ -156,7 +161,6 @@ and this project adheres to
 ### Added
 
 - ✨(any) let any authenticated user manage the lobby on trusted rooms
-
 ### Changed
 
 - 📱(frontend) collapse mobile control bar items on narrow viewports

bin/Tiltfile

@@ -104,15 +104,16 @@ k8s_yaml(secret_yaml_generic(
 
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
 
-k8s_resource('garage-cors', resource_deps=['garage'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
-k8s_resource('meet-celery-backend', resource_deps=['redis'])
-k8s_resource('meet-celery-summarize', resource_deps=['redis'])
-k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
-k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
-k8s_resource('livekit-livekit-server', resource_deps=['redis'])
+k8s_resource('dev-backend-garage-cors', resource_deps=['dev-backend-garage'])
+k8s_resource('dev-backend-keycloak', resource_deps=['dev-backend-keycloak-pg'])
+k8s_resource('meet-backend', resource_deps=['dev-backend-postgres', 'dev-backend-garage-cors', 'dev-backend-redis', 'dev-backend-keycloak', 'livekit-livekit-server'])
+k8s_resource('meet-celery-backend', resource_deps=['dev-backend-redis'])
+k8s_resource('meet-celery-summarize', resource_deps=['dev-backend-redis'])
+k8s_resource('meet-celery-summary-backend', resource_deps=['dev-backend-redis'])
+k8s_resource('meet-celery-transcribe-default', resource_deps=['dev-backend-redis'])
+k8s_resource('livekit-livekit-server', resource_deps=['dev-backend-redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
-k8s_resource('keycloak', resource_deps=['kc-postgresql'])
+k8s_resource('livekit-egress', resource_deps=['livekit-livekit-server'])
 # Trigger once on launch
 k8s_resource(
     'meet-backend-createsuperuser',

docs/installation/kubernetes.md

@@ -347,6 +347,7 @@ These are the environmental options available on meet backend.
 | FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                         |
 | FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                           |
 | FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                              |
+| FRONTEND_TECHNICAL_DOCUMENTATION_URL            | URL of the technical documentation (network prerequisites) linked from the footer and the connection test. If unset, both links are hidden                   |                                                                                                                                                              |
 | FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                        |
 | FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                        |
 | DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                  |

src/backend/meet/settings.py

@@ -466,6 +466,11 @@ class Base(Configuration):
         "documentation_url": values.Value(
             None, environ_name="FRONTEND_DOCUMENTATION_URL", environ_prefix=None
         ),
+        "technical_documentation_url": values.Value(
+            None,
+            environ_name="FRONTEND_TECHNICAL_DOCUMENTATION_URL",
+            environ_prefix=None,
+        ),
         "external_home_url": values.Value(
             None, environ_name="FRONTEND_EXTERNAL_HOME_URL", environ_prefix=None
         ),

src/frontend/src/api/useConfig.ts

@@ -22,6 +22,7 @@ export interface ApiConfig {
     url: string
   }
   documentation_url?: string
+  technical_documentation_url?: string
   external_home_url?: string
   silence_livekit_debug_logs?: boolean
   is_silent_login_enabled?: boolean

src/frontend/src/features/diagnostics/checks/selectedCandidate.ts

@@ -22,6 +22,12 @@ export type IceCandidateInfo = {
   port?: number
   /** Local candidates only, and not reported by every browser. */
   networkType?: string
+  /**
+   * For a local relay candidate, the TURN URL it was gathered from
+   * (e.g. `turns:turn.example.com:443?transport=tcp`). Used as a fallback
+   * when the browser does not report `relayProtocol`.
+   */
+  url?: string
 }
 
 export type IceCandidatePair = {
@@ -42,6 +48,57 @@ export type IceCandidateReport = {
   working: IceCandidatePair[]
 }
 
+const isObject = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null
+
+/** Narrows the loosely typed `data` stored on a step result. */
+export const isIceCandidateReport = (
+  data: unknown
+): data is IceCandidateReport =>
+  isObject(data) &&
+  Array.isArray(data.working) &&
+  (data.selected === null ||
+    (isObject(data.selected) && isObject(data.selected.local)))
+
+/**
+ * Transport between the browser and the TURN server for a local relay
+ * candidate: udp, tcp or tls, or undefined when it cannot be determined.
+ *
+ * `protocol` is deliberately not used here: on a relay candidate it describes
+ * the TURN allocation (server to peer), which is UDP even when the client
+ * reaches the TURN server over TLS.
+ */
+export const getRelayTransport = (
+  candidate: IceCandidateInfo
+): string | undefined => {
+  if (candidate.relayProtocol) return candidate.relayProtocol.toLowerCase()
+  if (!candidate.url) return undefined
+
+  const url = candidate.url.toLowerCase()
+  if (url.startsWith('turns:')) return 'tls'
+  if (!url.startsWith('turn:')) return undefined
+  const transport = /[?&]transport=(udp|tcp)\b/.exec(url)?.[1]
+  // RFC 7065: a turn: URI without a transport parameter defaults to UDP.
+  return transport ?? 'udp'
+}
+
+/**
+ * True when the selected pair goes through a TURN relay reached over TCP or
+ * TLS. Media still flows, but TCP head-of-line blocking usually degrades
+ * audio and video under packet loss.
+ *
+ * Direct routes (host, srflx, prflx), including ICE-TCP to the SFU, are out of
+ * scope: the warning and its documentation are about TURN fallbacks.
+ * An undetermined transport is not evidence of a bad route.
+ */
+export const isRelayedOverTcp = (data: unknown): boolean => {
+  if (!isIceCandidateReport(data) || !data.selected) return false
+  const { local } = data.selected
+  if (local.type !== 'relay') return false
+  const transport = getRelayTransport(local)
+  return transport === 'tcp' || transport === 'tls'
+}
+
 const PROBE_WIDTH = 320
 const PROBE_HEIGHT = 180
 const PROBE_FPS = 15
@@ -57,6 +114,7 @@ const readCandidate = (stats?: Stats): IceCandidateInfo => {
     protocol: stats.protocol as string | undefined,
     relayProtocol: stats.relayProtocol as string | undefined,
     networkType: stats.networkType as string | undefined,
+    url: stats.url as string | undefined,
     ...(INCLUDE_CANDIDATE_ADDRESSES
       ? {
           address: stats.address as string | undefined,
@@ -67,7 +125,10 @@ const readCandidate = (stats?: Stats): IceCandidateInfo => {
 }
 
 const describeCandidate = (candidate: IceCandidateInfo) => {
-  const transport = candidate.relayProtocol ?? candidate.protocol ?? 'unknown'
+  const transport =
+    (candidate.type === 'relay' ? getRelayTransport(candidate) : undefined) ??
+    candidate.protocol ??
+    'unknown'
   const endpoint =
     candidate.address === undefined
       ? ''

src/frontend/src/features/diagnostics/components/ConnectionTestSummary.tsx

@@ -2,18 +2,44 @@ import type { ReactNode } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ProgressBar } from 'react-aria-components'
 import { css, cx } from '@/styled-system/css'
+import { A } from '@/primitives'
+import { useConfig } from '@/api/useConfig'
 import type { ConnectionTestStats } from '../types'
 import { statusSquareClass } from './stepAppearance'
 
-type SummaryState = 'idle' | 'running' | 'passed' | 'partial' | 'failed'
+type SummaryState =
+  | 'idle'
+  | 'running'
+  | 'passed'
+  | 'partial'
+  | 'failed'
+  | 'warning'
 
-/** Only a failure earns a colour: everything else stays near-black. */
+/** Only a failure or a degraded route earns a colour: everything else stays near-black. */
 const stateColorClass: Record<SummaryState, string> = {
   idle: css({ color: 'greyscale.1000' }),
   running: css({ color: 'greyscale.1000' }),
   passed: css({ color: 'greyscale.1000' }),
   partial: css({ color: 'greyscale.1000' }),
   failed: css({ color: 'danger.600' }),
+  warning: css({ color: 'warning' }),
+}
+
+/**
+ * A hard failure still outranks a warning step; a warning outranks 'partial'
+ * because a measured degraded route matters more than skipped camera or
+ * microphone checks.
+ */
+const getSummaryState = (
+  stats: ConnectionTestStats,
+  isRunning: boolean
+): SummaryState => {
+  if (isRunning) return 'running'
+  if (!stats.hasStarted) return 'idle'
+  if (stats.failed > 0) return 'failed'
+  if (stats.warnings > 0) return 'warning'
+  if (stats.skipped > 0) return 'partial'
+  return 'passed'
 }
 
 const cardClass = css({
@@ -183,16 +209,15 @@ export const ConnectionTestSummary = ({
   children?: ReactNode
 }) => {
   const { t } = useTranslation('connectionTest')
+  const { data: config } = useConfig()
 
-  const state: SummaryState = isRunning
-    ? 'running'
-    : !stats.hasStarted
-      ? 'idle'
-      : stats.failed > 0
-        ? 'failed'
-        : stats.skipped > 0
-          ? 'partial'
-          : 'passed'
+  // Network prerequisites for the reader's IT department. Instance specific,
+  // so it comes from the backend; without it the warning shows no link.
+  const networkDocUrl = config?.technical_documentation_url
+
+  const state = getSummaryState(stats, isRunning)
+  // Skipped device checks still deserve their hint under a route warning.
+  const showPartialHint = state === 'warning' && stats.skipped > 0
 
   return (
     <section className={cardClass}>
@@ -206,7 +231,27 @@ export const ConnectionTestSummary = ({
             : t(`summary.${state}`)}
         </p>
 
-        <p className={hintClass}>{t(`summary.${state}Hint`)}</p>
+        <p className={hintClass}>
+          {t(`summary.${state}Hint`)}
+          {state === 'warning' && networkDocUrl && (
+            <>
+              {' '}
+              <A
+                href={networkDocUrl}
+                target="_blank"
+                rel="noopener noreferrer"
+                size="sm"
+                externalIcon
+                aria-label={t('summary.warningDocLinkAriaLabel')}
+              >
+                {t('summary.warningDocLink')}
+              </A>
+            </>
+          )}
+        </p>
+        {showPartialHint && (
+          <p className={hintClass}>{t('summary.partialHint')}</p>
+        )}
       </div>
 
       {stats.hasStarted && (
@@ -237,6 +282,13 @@ export const ConnectionTestSummary = ({
               value={stats.passed}
               label={t('counts.passed')}
             />
+            {stats.warnings > 0 && (
+              <Counter
+                squareClass={statusSquareClass.warning}
+                value={stats.warnings}
+                label={t('counts.warnings')}
+              />
+            )}
             <Counter
               squareClass={statusSquareClass.skipped}
               value={stats.skipped}

src/frontend/src/features/diagnostics/components/stepAppearance.ts

@@ -15,15 +15,20 @@ export const statusSquareClass: Record<ConnectionTestStepStatus, string> = {
     animation: 'pulse_background 1.2s ease-in-out infinite',
   }),
   success: css({ backgroundColor: 'success.600' }),
+  warning: css({ backgroundColor: 'warning' }),
   failed: css({ backgroundColor: 'danger.600' }),
   skipped: css({ backgroundColor: 'greyscale.300' }),
 }
 
-/** Colour is carried by the square; the label stays near-black except on failure. */
+/**
+ * Colour is carried by the square; the label stays near-black except on
+ * failure and warning.
+ */
 export const statusTextClass: Record<ConnectionTestStepStatus, string> = {
   pending: css({ color: 'greyscale.500' }),
   running: css({ color: 'greyscale.700' }),
   success: css({ color: 'greyscale.1000' }),
+  warning: css({ color: 'warning', fontWeight: 'medium' }),
   failed: css({ color: 'danger.600', fontWeight: 'medium' }),
   skipped: css({ color: 'greyscale.500' }),
 }

src/frontend/src/features/diagnostics/hooks/useConnectionTestRunner.ts

@@ -8,7 +8,10 @@ import {
   type CheckInfo,
 } from 'livekit-client'
 import { fetchConnectionTestDetails } from '../api/fetchConnectionTestDetails'
-import { SelectedCandidateCheck } from '../checks/selectedCandidate'
+import {
+  isRelayedOverTcp,
+  SelectedCandidateCheck,
+} from '../checks/selectedCandidate'
 import {
   createInitialSteps,
   type ConnectionTestLog,
@@ -49,10 +52,23 @@ const getErrorMessage = (error: unknown, fallback = 'Unknown error') =>
 const isPermissionError = (error: unknown) =>
   error instanceof Error && PERMISSION_ERROR_NAMES.has(error.name)
 
+const toStepStatus = (info: CheckInfo): ConnectionTestStepStatus => {
+  const status = CHECK_STATUS_TO_STEP[info.status] ?? 'failed'
+  return status === 'success' && isRelayedOverTcp(info.data)
+    ? 'warning'
+    : status
+}
+
 const fromCheckInfo = (info: CheckInfo): Partial<ConnectionTestStepResult> => ({
-  status: CHECK_STATUS_TO_STEP[info.status] ?? 'failed',
+  status: toStepStatus(info),
   summary: info.description,
   logs: info.logs,
+  // Only SelectedCandidateCheck sets `data` (the ICE candidate report).
+  // Consumers narrow it with a type guard (see isIceCandidateReport).
+  data:
+    typeof info.data === 'object' && info.data !== null
+      ? (info.data as Record<string, unknown>)
+      : undefined,
 })
 
 const groupDevicesByKind = (devices: MediaDeviceInfo[]) => {

src/frontend/src/features/diagnostics/types.ts

@@ -15,6 +15,7 @@ export type ConnectionTestStepStatus =
   | 'pending'
   | 'running'
   | 'success'
+  | 'warning'
   | 'failed'
   | 'skipped'
 
@@ -63,6 +64,7 @@ export type ConnectionTestStats = {
   total: number
   settled: number
   passed: number
+  warnings: number
   failed: number
   skipped: number
   hasStarted: boolean
@@ -77,24 +79,27 @@ export const summarizeSteps = (
   steps: ConnectionTestStepResult[]
 ): ConnectionTestStats => {
   let passed = 0
+  let warnings = 0
   let failed = 0
   let skipped = 0
   let pending = 0
 
   for (const step of steps) {
     if (step.status === 'success') passed += 1
+    else if (step.status === 'warning') warnings += 1
     else if (step.status === 'failed') failed += 1
     else if (step.status === 'skipped') skipped += 1
     else if (step.status === 'pending') pending += 1
   }
 
   const total = steps.length
-  const settled = passed + failed + skipped
+  const settled = passed + warnings + failed + skipped
 
   return {
     total,
     settled,
     passed,
+    warnings,
     failed,
     skipped,
     hasStarted: pending < total,

src/frontend/src/layout/Footer.tsx

@@ -126,6 +126,9 @@ export const Footer = () => {
     return null
   }
 
+  const isConnectionTestEnabled = !!data.diagnostics?.connection_test_enabled
+  const technicalDocumentationUrl = data.technical_documentation_url
+
   return (
     <footer
       className={css({
@@ -256,7 +259,9 @@ export const Footer = () => {
               {t('links.data')}
             </A>
           </StyledLi>
-          <StyledLi divider>
+          <StyledLi
+            divider={isConnectionTestEnabled || !!technicalDocumentationUrl}
+          >
             <Link
               underline={false}
               footer="minor"
@@ -266,8 +271,8 @@ export const Footer = () => {
               {t('links.accessibility')}
             </Link>
           </StyledLi>
-          {data?.diagnostics?.connection_test_enabled && (
-            <StyledLi divider>
+          {isConnectionTestEnabled && (
+            <StyledLi divider={!!technicalDocumentationUrl}>
               <Link
                 underline={false}
                 footer="minor"
@@ -278,19 +283,21 @@ export const Footer = () => {
               </Link>
             </StyledLi>
           )}
-          <StyledLi>
-            <A
-              externalIcon
-              underline={false}
-              footer="minor"
-              href="https://docs.numerique.gouv.fr/docs/f2baa1b9-f29e-4d58-959d-65d4376fc6b8/"
-              aria-label={
-                t('links.technicalDetails') + ' - ' + t('links.ariaLabel')
-              }
-            >
-              {t('links.technicalDetails')}
-            </A>
-          </StyledLi>
+          {technicalDocumentationUrl && (
+            <StyledLi>
+              <A
+                externalIcon
+                underline={false}
+                footer="minor"
+                href={technicalDocumentationUrl}
+                aria-label={
+                  t('links.technicalDetails') + ' - ' + t('links.ariaLabel')
+                }
+              >
+                {t('links.technicalDetails')}
+              </A>
+            </StyledLi>
+          )}
         </SecondRow>
         <ThirdRow>
           {t('mentions')}{' '}

src/frontend/src/locales/de/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "Ausstehend",
     "running": "Läuft…",
     "success": "Erfolgreich",
+    "warning": "Nicht optimal",
     "failed": "Fehlgeschlagen",
     "skipped": "Übersprungen"
   },
   "counts": {
     "passed": "erfolgreich",
+    "warnings": "nicht optimal",
     "failed": "fehlgeschlagen",
     "skipped": "übersprungen"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Ihr Browser, Ihre Geräte und Ihr Netzwerk sind für eine Besprechung bereit.",
     "partial": "Teilweiser Test",
     "partialHint": "Einige Prüfungen wurden übersprungen. Erlauben Sie den Zugriff auf Ihre Kamera und Ihr Mikrofon, um diese zu testen.",
+    "warning": "Verbindung nicht optimal",
+    "warningHint": "Sie können an Ihren Besprechungen teilnehmen, aber die Bild- und Tonqualität kann aufgrund Ihrer Netzwerkeinstellungen beeinträchtigt sein. Ihre IT-Abteilung kann hier Abhilfe schaffen.",
+    "warningDocLink": "Netzwerkanforderungen für Ihre IT-Abteilung",
+    "warningDocLinkAriaLabel": "Netzwerkanforderungen für Ihre IT-Abteilung öffnen – öffnet in neuem Tab",
     "failed_one": "{{count}} Prüfung fehlgeschlagen",
     "failed_other": "{{count}} Prüfungen fehlgeschlagen",
     "failedHint": "Öffnen Sie die fehlgeschlagenen Prüfungen für weitere Details und senden Sie den Bericht an Ihre IT-Abteilung."

src/frontend/src/locales/en/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "Pending",
     "running": "Running…",
     "success": "Passed",
+    "warning": "Not optimal",
     "failed": "Failed",
     "skipped": "Skipped"
   },
   "counts": {
     "passed": "passed",
+    "warnings": "not optimal",
     "failed": "failed",
     "skipped": "skipped"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Your browser, your devices and your network are ready for a meeting.",
     "partial": "Partially tested",
     "partialHint": "Some checks were skipped. Allow access to your camera and microphone to test them.",
+    "warning": "Suboptimal connection",
+    "warningHint": "You can join your meetings, but video and audio quality may be reduced because of your network settings. Your IT department can improve this.",
+    "warningDocLink": "Network requirements for your IT department",
+    "warningDocLinkAriaLabel": "Open the network requirements for your IT department - opens in new window",
     "failed_one": "{{count}} check failed",
     "failed_other": "{{count}} checks failed",
     "failedHint": "Open the failed checks below for details, then send the report to your IT department."

src/frontend/src/locales/es/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "En espera",
     "running": "En curso…",
     "success": "Correcto",
+    "warning": "No óptimo",
     "failed": "Error",
     "skipped": "Omitido"
   },
   "counts": {
     "passed": "correctas",
+    "warnings": "no óptimas",
     "failed": "con errores",
     "skipped": "omitidas"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Tu navegador, tus dispositivos y tu red están listos para una reunión.",
     "partial": "Prueba parcial",
     "partialHint": "Se han omitido algunas comprobaciones. Autoriza el acceso a tu cámara y a tu micrófono para probarlos.",
+    "warning": "Conexión no óptima",
+    "warningHint": "Puedes participar en tus reuniones, pero la calidad de la imagen y del sonido puede verse reducida por la configuración de tu red. Tu servicio informático puede mejorar la situación.",
+    "warningDocLink": "Requisitos de red para tu servicio informático",
+    "warningDocLinkAriaLabel": "Abrir los requisitos de red para tu servicio informático - se abre en una nueva ventana",
     "failed_one": "{{count}} verificación en error",
     "failed_other": "{{count}} verificaciones en error",
     "failedHint": "Abre las verificaciones en error para ver el detalle y transmite después el informe a tu servicio informático."

src/frontend/src/locales/fr/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "En attente",
     "running": "En cours…",
     "success": "Réussi",
+    "warning": "Non optimal",
     "failed": "Échec",
     "skipped": "Ignoré"
   },
   "counts": {
     "passed": "réussis",
+    "warnings": "non optimaux",
     "failed": "en échec",
     "skipped": "ignorés"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Votre navigateur, vos périphériques et votre réseau sont prêts pour une réunion.",
     "partial": "Test partiel",
     "partialHint": "Certaines vérifications ont été ignorées. Autorisez l'accès à votre caméra et à votre microphone pour les tester.",
+    "warning": "Connexion non optimale",
+    "warningHint": "Vous pouvez participer à vos réunions, mais la qualité de l'image et du son risque d'être réduite à cause des réglages de votre réseau. Votre service informatique peut améliorer la situation.",
+    "warningDocLink": "Prérequis réseau à transmettre à votre service informatique",
+    "warningDocLinkAriaLabel": "Ouvrir les prérequis réseau à transmettre à votre service informatique - ouvre dans une nouvelle fenêtre",
     "failed_one": "{{count}} vérification en échec",
     "failed_other": "{{count}} vérifications en échec",
     "failedHint": "Ouvrez les vérifications en échec pour voir le détail, puis transmettez le rapport à votre service informatique."

src/frontend/src/locales/nl/connectionTest.json

@@ -29,11 +29,13 @@
     "pending": "In afwachting",
     "running": "Bezig…",
     "success": "Geslaagd",
+    "warning": "Niet optimaal",
     "failed": "Mislukt",
     "skipped": "Overgeslagen"
   },
   "counts": {
     "passed": "geslaagd",
+    "warnings": "niet optimaal",
     "failed": "mislukt",
     "skipped": "overgeslagen"
   },
@@ -46,6 +48,10 @@
     "passedHint": "Je browser, apparaten en netwerk zijn klaar voor een vergadering.",
     "partial": "Gedeeltelijke test",
     "partialHint": "Sommige controles zijn overgeslagen. Geef toegang tot je camera en microfoon om deze te testen.",
+    "warning": "Verbinding niet optimaal",
+    "warningHint": "Je kunt deelnemen aan je vergaderingen, maar de beeld- en geluidskwaliteit kan minder zijn door de instellingen van je netwerk. Je IT-afdeling kan dit verbeteren.",
+    "warningDocLink": "Netwerkvereisten voor je IT-afdeling",
+    "warningDocLinkAriaLabel": "Netwerkvereisten voor je IT-afdeling openen - opent in nieuw venster",
     "failed_one": "{{count}} controle mislukt",
     "failed_other": "{{count}} controles mislukt",
     "failedHint": "Open de mislukte controles voor meer details en stuur het rapport door naar je IT-afdeling."

src/helm/env.d/common.yaml.gotmpl

@@ -24,7 +24,7 @@ _summaryEnvVars: &summaryEnvVars
   APP_NAME: summary-microservice
   APP_API_TOKEN: password
   AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000/
+  AWS_S3_ENDPOINT_URL: http://dev-backend-garage.meet.svc.cluster.local:9000/
   AWS_S3_ACCESS_KEY_ID: meet-access-key
   AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
   AWS_S3_SECURE_ACCESS: False
@@ -69,9 +69,9 @@ _summaryEnvVars: &summaryEnvVars
   LLM_MODEL: Qwen/Qwen3-Coder-30B-A3B-Instruct
   WEBHOOK_API_TOKEN: password
   WEBHOOK_URL: https://www.mock-impress.com/webhook/
-  CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
-  CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
-  TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+  CELERY_BROKER_URL: redis://user:pass@dev-backend-redis:6379/1
+  CELERY_RESULT_BACKEND: redis://user:pass@dev-backend-redis:6379/1
+  TASK_TRACKER_REDIS_URL: redis://user:pass@dev-backend-redis:6379/1
   IS_RESOLVE_SPEAKER_IDENTITIES_ENABLED: true
   RESOLVE_SPEAKER_IDENTITIES_DEFAULT_OVERLAP: 0.5
   RESOLVE_SPEAKER_ENABLE_SPLIT_ON_WORDS: true
@@ -127,12 +127,21 @@ backend:
     LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
     LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
     # Databases
-    DB_HOST: postgres
-    DB_NAME: meet
-    DB_USER: dinum
-    DB_PASSWORD: pass
+    DB_HOST: dev-backend-postgres
+    DB_NAME:
+      secretKeyRef:
+        name: dev-backend-postgres
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: dev-backend-postgres
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: dev-backend-postgres
+        key: password
     DB_PORT: 5432
-    REDIS_URL: redis://default:pass@redis-master:6379/1
+    REDIS_URL: redis://user:pass@dev-backend-redis:6379/1
     # Static files
     STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
     # Permissions
@@ -157,12 +166,13 @@ backend:
     FRONTEND_SUPPORT: "{'id': '58ea6697-8eba-4492-bc59-ad6562585041', 'help_article_transcript': 'https://lasuite.crisp.help/fr/article/visio-transcript-1sjq43x', 'help_article_recording': 'https://lasuite.crisp.help/fr/article/visio-enregistrement-wgc8o0', 'help_article_more_tools': 'https://lasuite.crisp.help/fr/article/visio-tools-bvxj23'}"
     FRONTEND_FEEDBACK: "{'url': 'https://grist.numerique.gouv.fr/o/docs/cbMv4G7pLY3Z/USER-RESEARCH-or-LA-SUITE/f/26'}"
     FRONTEND_DOCUMENTATION_URL: "https://docs.numerique.gouv.fr/docs/7c5bd65d-3c21-486f-bce1-26e0a921d642/"
+    FRONTEND_TECHNICAL_DOCUMENTATION_URL: "https://docs.numerique.gouv.fr/docs/f2baa1b9-f29e-4d58-959d-65d4376fc6b8/"
     FRONTEND_MANIFEST_LINK: "https://docs.numerique.gouv.fr/docs/1ef86abf-f7e0-46ce-b6c7-8be8b8af4c3d/"
     FRONTEND_IDLE_DISCONNECT_WARNING_DELAY: 9000
     FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
     FRONTEND_IS_SILENT_LOGIN_ENABLED: False
     # S3 Storage
-    AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000
+    AWS_S3_ENDPOINT_URL: http://dev-backend-garage.meet.svc.cluster.local:9000
     AWS_S3_ACCESS_KEY_ID: meet-access-key
     AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
     AWS_STORAGE_BUCKET_NAME: meet-media-storage
@@ -185,7 +195,7 @@ backend:
     MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
     FILE_UPLOAD_ENABLED: True
     CELERY_ENABLED: True
-    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_BROKER_URL: redis://user:pass@dev-backend-redis:6379/1
     # Recording & Transcription
     RECORDING_ENABLE: True
     SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v2/async-jobs/transcribe/
@@ -265,11 +275,11 @@ ingressMedia:
   annotations:
     nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: dev-backend-garage.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1
 
 serviceMedia:
-  host: garage.meet.svc.cluster.local
+  host: dev-backend-garage.meet.svc.cluster.local
   port: 9000
 
 # ---- Extra ingress/service for background file uploads ------------
@@ -281,11 +291,11 @@ ingressMediaFiles:
   annotations:
     nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: dev-backend-garage.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1
 
 serviceMediaFiles:
-  host: garage.meet.svc.cluster.local
+  host: dev-backend-garage.meet.svc.cluster.local
   port: 9000
 
 # ---- STT Orchestration Microservice Components --------------------
@@ -363,7 +373,7 @@ agentMetadata:
     {{- end }}
     {{- end }}
     ENABLE_SILERO_VAD: "false"
-    AWS_S3_ENDPOINT_URL: garage.meet.svc.cluster.local:9000
+    AWS_S3_ENDPOINT_URL: dev-backend-garage.meet.svc.cluster.local:9000
     AWS_S3_ACCESS_KEY_ID: meet-access-key
     AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
     AWS_S3_SECURE_ACCESS: False

src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl

@@ -13,14 +13,15 @@ egress:
   {{- end }}
   {{- end }}
   redis:
-    address: redis-master:6379
+    address: dev-backend-redis:6379
+    username: user
     password: pass
   s3:
     access_key: meet-access-key
     secret: meet-secret-access-key
     region: local
     bucket: meet-media-storage
-    endpoint: http://garage:9000
+    endpoint: http://dev-backend-garage:9000
     force_path_style: true
 
 loadBalancer:

src/helm/env.d/dev-dinum/values.livekit.yaml.gotmpl

@@ -14,7 +14,8 @@ livekit:
     port_range_end: 60000
     tcp_port: 7881
   redis:
-    address: redis-master:6379
+    address: dev-backend-redis:6379
+    username: user
     password: pass
   keys:
   turn:

src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl

@@ -16,14 +16,15 @@ egress:
   {{- end }}
   {{- end }}
   redis:
-    address: redis-master:6379
+    address: dev-backend-redis:6379
+    username: user
     password: pass
   s3:
     access_key: meet-access-key
     secret: meet-secret-access-key
     region: local
     bucket: meet-media-storage
-    endpoint: http://garage:9000
+    endpoint: http://dev-backend-garage:9000
     force_path_style: true
 
 loadBalancer:

src/helm/env.d/dev-keycloak/values.livekit.yaml.gotmpl

@@ -14,7 +14,8 @@ livekit:
     port_range_end: 60000
     tcp_port: 7881
   redis:
-    address: redis-master:6379
+    address: dev-backend-redis:6379
+    username: user
     password: pass
   keys:
   turn:

src/helm/extra/templates/garage.yaml

@@ -1,172 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: garage
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 10m
-spec:
-  rules:
-  - host: "garage.127.0.0.1.nip.io"
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: garage
-            port:
-              number: 9000
-  tls:
-  - hosts:
-    - garage.127.0.0.1.nip.io
-    secretName: meet-tls
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: garage
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: client
-    port: 9000
-    protocol: TCP
-    targetPort: 9000
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: garage
-  type: ClusterIP
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: garage-config
-  namespace: {{ .Release.Namespace | quote }}
-data:
-  garage.toml: |
-    metadata_dir = "/var/lib/garage/meta"
-    data_dir = "/var/lib/garage/data"
-    db_engine = "lmdb"
-
-    replication_factor = 1
-
-    rpc_bind_addr = "127.0.0.1:3901"
-    rpc_public_addr = "127.0.0.1:3901"
-
-    [s3_api]
-    api_bind_addr = "[::]:9000"
-    # Clients must sign their requests for this region (AWS_S3_REGION_NAME)
-    s3_region = "local"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: garage-dev
-  namespace: {{ .Release.Namespace | quote }}
-type: Opaque
-data:
-  GARAGE_RPC_SECRET: {{ printf "%s/garage-rpc-secret" .Release.Namespace | sha256sum | b64enc }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: garage
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: garage
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: garage
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: garage
-    spec:
-      containers:
-      - name: garage
-        command:
-          - /garage
-          - server
-          - --single-node
-          - --default-bucket
-        env:
-          - name: GARAGE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: garage-dev
-                key: GARAGE_RPC_SECRET
-          - name: GARAGE_DEFAULT_ACCESS_KEY
-            value: meet-access-key
-          - name: GARAGE_DEFAULT_SECRET_KEY
-            value: meet-secret-access-key
-          - name: GARAGE_DEFAULT_BUCKET
-            value: meet-media-storage
-        image: "dxflrs/garage:v2.4.1"
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9000
-          name: client
-        readinessProbe:
-          exec:
-            command:
-              - /garage
-              - health
-        volumeMounts:
-        - mountPath: /etc/garage.toml
-          name: config
-          subPath: garage.toml
-        - mountPath: /var/lib/garage
-          name: data
-      volumes:
-      - name: config
-        configMap:
-          name: garage-config
-      - name: data
-        emptyDir:
----
-# Garage denies cross-origin requests by default: allow the frontend to upload
-# files straight to the bucket
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: garage-cors
-spec:
-  template:
-    spec:
-      containers:
-      - name: aws-cli
-        image: amazon/aws-cli:2.37.1
-        env:
-          - name: AWS_ACCESS_KEY_ID
-            value: meet-access-key
-          - name: AWS_SECRET_ACCESS_KEY
-            value: meet-secret-access-key
-          - name: AWS_DEFAULT_REGION
-            value: local
-          - name: AWS_ENDPOINT_URL
-            value: http://garage:9000
-          - name: BUCKET
-            value: meet-media-storage
-        command:
-          - /bin/sh
-          - -c
-          - |
-            deadline=$(($(date +%s) + 300))
-            until aws s3api head-bucket --bucket="$BUCKET" --cli-connect-timeout=5; do
-              if [ "$(date +%s)" -ge "$deadline" ]; then
-                echo "Bucket $BUCKET still unavailable on $AWS_ENDPOINT_URL" >&2
-                exit 1
-              fi
-              echo "Waiting for bucket $BUCKET on $AWS_ENDPOINT_URL"
-              sleep 5
-            done
-            exec aws s3api put-bucket-cors --bucket="$BUCKET" \
-              --cors-configuration='{"CORSRules": [{"AllowedOrigins": ["https://meet.127.0.0.1.nip.io"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
-      restartPolicy: Never
-  backoffLimit: 3

src/helm/extra/templates/kc-postgresql-sts.yaml

@@ -1,61 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kc-postgres
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: tcp-postgresql
-    port: 5432
-    protocol: TCP
-    targetPort: tcp-postgresql
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: kc-postgresql
-  type: ClusterIP
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kc-postgresql
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: kc-postgresql
-  serviceName: "kc-postgres"
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: kc-postgresql
-    spec:
-      terminationGracePeriodSeconds: 10
-      containers:
-      - name: pg
-        image: postgres:16-alpine
-        ports:
-        - containerPort: 5432
-          name: tcp-postgresql
-        env:
-          - name: POSTGRES_PASSWORD
-            value: pass
-          - name: POSTGRES_USER
-            value: dinum
-          - name: POSTGRES_DB
-            value: keycloak
-        volumeMounts:
-        - name: data
-          mountPath: /var/lib/postgresql
-  volumeClaimTemplates:
-  - metadata:
-      name: data
-    spec:
-      accessModes: [ "ReadWriteOnce" ]
-      resources:
-        requests:
-          storage: 1Gi
-

src/helm/extra/templates/keycloak-sts.yaml

@@ -1,104 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: keycloak
-spec:
-  rules:
-  - host: "keycloak.127.0.0.1.nip.io"
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: keycloak
-            port:
-              number: 8080
-  tls:
-  - hosts:
-    - keycloak.127.0.0.1.nip.io
-    secretName: meet-tls
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: keycloak
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: tcp-keycloak
-    port: 8080
-    protocol: TCP
-    targetPort: tcp-keycloak
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: keycloak
-  type: ClusterIP
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: realm
-data:
-  meet.json: |
-{{ .Values.realm | indent 4 }}
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: keycloak
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: keycloak
-  serviceName: "keycloak"
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: keycloak
-    spec:
-      terminationGracePeriodSeconds: 10
-      containers:
-      - name: keycloak
-        image: quay.io/keycloak/keycloak:20.0.1
-        args:
-          - start-dev
-          - --features=preview
-          - --import-realm
-          - --proxy=edge
-          - --hostname=keycloak.127.0.0.1.nip.io
-          - --hostname-strict=false
-          - --hostname-strict-https=false
-        ports:
-        - containerPort: 8080
-          name: tcp-keycloak
-        env:
-          - name: KEYCLOAK_ADMIN
-            value: admin
-          - name: KEYCLOAK_ADMIN_PASSWORD
-            value: admin
-          - name: PROXY_ADDRESS_FORWARDING
-            value: 'true'
-          - name: KC_DB_URL_HOST
-            value: kc_postgresql
-          - name: KC_DB_URL_DATABASE
-            value: keycloak
-          - name: KC_DB_PASSWORD
-            value: pass
-          - name: KC_DB_USERNAME
-            value: dinum
-          - name: KC_DB_SCHEMA
-            value: public
-        volumeMounts:
-        - name: realm
-          mountPath: "/opt/keycloak/data/import"
-          readOnly: true
-      volumes:
-      - name: realm
-        configMap:
-          name: realm

src/helm/extra/templates/postgresql-sts.yaml

@@ -1,70 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: tcp-postgresql
-    port: 5432
-    protocol: TCP
-    targetPort: tcp-postgresql
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: postgresql
-  type: ClusterIP
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: postgresql
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: postgresql
-  serviceName: "postgres"
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: postgresql
-    spec:
-      terminationGracePeriodSeconds: 10
-      containers:
-      - name: pg
-        image: postgres:16-alpine
-        readinessProbe:
-          exec:
-            command: [ "pg_isready", "-U", "dinum", "-d", "meet", "-h", "127.0.0.1" ]
-          initialDelaySeconds: 5
-          periodSeconds: 5
-        livenessProbe:
-          exec:
-            command: [ "pg_isready", "-U", "dinum", "-d", "meet", "-h", "127.0.0.1" ]
-          initialDelaySeconds: 15
-          periodSeconds: 10
-        ports:
-        - containerPort: 5432
-          name: tcp-postgresql
-        env:
-          - name: POSTGRES_PASSWORD
-            value: pass
-          - name: POSTGRES_USER
-            value: dinum
-          - name: POSTGRES_DB
-            value: meet
-        volumeMounts:
-        - name: data
-          mountPath: /var/lib/postgresql/data
-  volumeClaimTemplates:
-  - metadata:
-      name: data
-    spec:
-      accessModes: [ "ReadWriteOnce" ]
-      resources:
-        requests:
-          storage: 1Gi

src/helm/extra/templates/redis.yaml

@@ -1,65 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis-master
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: tcp-redis
-    port: 6379
-    protocol: TCP
-    targetPort: tcp-redis
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: redis
-  type: ClusterIP
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: redis
-data:
-  redis.conf: |
-    bind 0.0.0.0
-    port 6379
-    user default on >pass ~* &* +@all
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: redis
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: redis
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: redis
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: redis
-    spec:
-      containers:
-      - name: redis
-        args:
-          - redis-server
-          - /usr/local/etc/redis/redis.conf
-        image: "redis:8.2-alpine"
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 6379
-          name: tcp-redis
-        volumeMounts:
-        - name: redis
-          mountPath: "/usr/local/etc/redis"
-          readOnly: true
-      volumes:
-      - name: redis
-        configMap:
-          name: redis

src/helm/helmfile.yaml.gotmpl

@@ -13,6 +13,9 @@ repositories:
 - name: livekit
   url: https://helm.livekit.io
 
+- name: dev-backends
+  url: https://suitenumerique.github.io/helm-dev-backend
+
 releases:
 - name: extra
   installed: {{ regexMatch "^dev.*" .Environment.Name }}
@@ -27,8 +30,59 @@ releases:
   - enablePermanentRedirect: {{ .Values | get "enablePermanentRedirect" "False"}}
   - oldDomain: {{ .Values | get "oldDomain" "demo.com" }}
   - newDomain: {{ .Values | get "newDomain" "demo.com" }}
-  - realm: |
-{{ readFile "../../docker/auth/realm.json" | replace "http://localhost:3200" "https://meet.127.0.0.1.nip.io" | indent 8 }}
+
+- name: dev-backend
+  installed: {{ regexMatch "^dev.*" .Environment.Name }}
+  namespace: {{ .Namespace }}
+  chart: dev-backends/dev-backend
+  version: 0.0.14
+  values:
+  - postgres:
+      enabled: true
+      username: dinum
+      password: pass
+      database: meet
+      size: 1Gi
+  - redis:
+      enabled: true
+      username: user
+      password: pass
+  - garage:
+      enabled: true
+      accessKey: meet-access-key
+      secretKey: meet-secret-access-key
+      bucket: meet-media-storage
+      region: local
+      persistence: false
+      ingress:
+        enabled: true
+        hostname: garage.127.0.0.1.nip.io
+        annotations:
+          nginx.ingress.kubernetes.io/proxy-body-size: 10m
+        tls:
+          enabled: true
+          secretName: meet-tls
+      cors:
+        allowedOrigins:
+        - https://meet.127.0.0.1.nip.io
+  - keycloak:
+      enabled: true
+      hostname: keycloak.127.0.0.1.nip.io
+      username: admin
+      password: admin
+      tls:
+        enabled: true
+        secretName: meet-tls
+      db:
+        username: dinum
+        password: pass
+        database: keycloak
+        size: 1Gi
+      realm:
+        name: meet
+        username: meet
+        password: meet
+        email: meet@example.com
 
 
 - name: meet