🐛(frontend) close the screen share window when leaving the meeting

Quit and dropped connections navigate internally, so the page
doesn't unload or close the separate window.

.codespellrc

@@ -1,9 +0,0 @@
-[codespell]
-# Files that are not English, or generated
-skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
-  ./LICENSES,
-  ./src/summary/summary/core/locales,
-  ./src/summary/summary/core/prompt.py
-# Valid words in French (connexion) or in the code (statics)
-ignore-words-list = connexion,statics
-check-filenames = true

.github/.trivyignore

@@ -1,20 +0,0 @@
-# Debian 13 base image (python:3.14-slim): no fixed version available yet.
-# Review regularly and remove entries once Debian ships a fix.
-
-# util-linux
-CVE-2026-76642
-CVE-2026-78408
-CVE-2026-78409
-CVE-2026-78410
-
-# acl
-CVE-2026-54369
-
-# ncurses
-CVE-2025-69720
-
-# systemd
-CVE-2026-16742
-
-# perl-base (fix deferred by Debian)
-CVE-2026-9538

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -0,0 +1,28 @@
+---
+name: 🐛 Bug Report
+about: If something is not working as expected 🤔.
+
+---
+
+## Bug Report
+
+**Problematic behavior**
+A clear and concise description of the behavior.
+
+**Expected behavior/code**
+A clear and concise description of what you expected to happen (or code).
+
+**Steps to Reproduce**
+1. Do this...
+2. Then this...
+3. And then the bug happens!
+
+**Environment**
+- Meet version:
+- Platform:
+
+**Possible Solution**
+<!--- Only if you have suggestions on a fix for the bug -->
+
+**Additional context/Screenshots**
+Add any other context about the problem here. If applicable, add screenshots to help explain.

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -0,0 +1,23 @@
+---
+name: ✨ Feature Request
+about: I have a suggestion (and may want to build it 💪)!
+
+---
+
+## Feature Request
+
+**Is your feature request related to a problem or unsupported use case? Please describe.**
+A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen. Add any considered drawbacks.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Discovery, Documentation, Adoption, Migration Strategy**
+If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
+Maybe a screenshot or design?
+
+**Do you want to work on it through a Pull Request?**
+<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->

.github/ISSUE_TEMPLATE/Support_question.md

@@ -0,0 +1,22 @@
+---
+name: 🤗 Support Question
+about: If you have a question 💬, or something was not clear from the docs!
+
+---
+
+<!-- ^ Click "Preview" for a nicer view! ^
+We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
+
+---
+
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
+
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
+
+If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
+
+**Topic**
+What's the general area of your question: for example, docker setup, database schema, search functionality,...
+
+**Question**
+Try to be as specific as possible so we can help you as best we can. Please be patient 🙏

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Purpose
+
+Description...
+
+
+## Proposal
+
+Description...
+
+- [] item 1...
+- [] item 2...

.github/workflows/changelog.yml

@@ -1,19 +0,0 @@
-name: Changelog Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  changelog:
-    uses: suitenumerique/ci/.github/workflows/_changelog.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1

.github/workflows/ci.yml

@@ -11,30 +11,180 @@ permissions:
   contents: read
 
 jobs:
+  lint-git:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+      - name: show
+        run: git log
+      - name: Enforce absence of print statements in code
+        if: always()
+        run: |
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
+      - name: Check absence of fixup commits
+        if: always()
+        run: |
+          ! git log | grep 'fixup!'
+      - name: Install uv
+        if: always()
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Lint commit messages added to main
+        if: always()
+        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
 
-  lint-python:
-    name: lint ${{ matrix.service }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - service: backend
-            working_directory: src/backend
-            pylint_targets: meet demo core
-          - service: agents
-            working_directory: src/agents
-            pylint_targets: ""
-          - service: summary
-            working_directory: src/summary
-            pylint_targets: ""
-    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      working_directory: ${{ matrix.working_directory }}
-      python_version: "3.13"
-      pylint_targets: ${{ matrix.pylint_targets }}
+  check-changelog:
+    runs-on: ubuntu-latest
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
+      github.event_name == 'pull_request'
+    permissions:
+        contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 50
+      - name: Check that the CHANGELOG has been modified in the current branch
+        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
+
+  lint-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Check CHANGELOG max line length
+        run: |
+          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
+          if [ $max_line_length -ge 80 ]; then
+            echo "ERROR: CHANGELOG has lines longer than 80 characters."
+            exit 1
+          fi
+
+  build-mails:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/mail
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Install Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "22"
+
+      - name: Restore the mail templates
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        id: mail-templates
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+      - name: Install yarn
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: npm install -g --ignore-scripts yarn@1.22.22
+
+      - name: Install node dependencies
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: yarn install --frozen-lockfile --ignore-scripts
+
+      - name: Build mails
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: yarn build
+
+      - name: Cache mail templates
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+  lint-back:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/backend
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install the project
+        run: uv sync --locked --all-extras
+
+      - name: Check code formatting with ruff
+        run: uv run --no-sync --no-build ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run --no-sync --no-build ruff check .
+      - name: Lint code with pylint
+        run: uv run --no-sync --no-build pylint meet demo core
+
+  lint-agents:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/agents
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install the project
+        run: uv sync --locked --all-extras --no-build
+      - name: Check code formatting with ruff
+        run: uv run --no-sync --no-build ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run --no-sync --no-build ruff check .
+
+  lint-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/summary
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install the project
+        run: uv sync --locked --all-extras
+      - name: Check code formatting with ruff
+        run: uv run --no-sync --no-build ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run --no-sync --no-build ruff check .
 
   test-back:
     runs-on: ubuntu-latest
+    needs: build-mails
     permissions:
       contents: read
     defaults:
@@ -76,9 +226,8 @@ jobs:
       REDIS_URL: redis://localhost:6379/1
       STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
       AWS_S3_ENDPOINT_URL: http://localhost:9000
-      AWS_S3_ACCESS_KEY_ID: meet-access-key
-      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
-      AWS_S3_REGION_NAME: local
+      AWS_S3_ACCESS_KEY_ID: meet
+      AWS_S3_SECRET_ACCESS_KEY: password
       OIDC_RS_CLIENT_ID: meet
       OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
       OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
@@ -94,25 +243,41 @@ jobs:
           sudo mkdir -p /data/media && \
           sudo mkdir -p /data/static
 
-      - name: Build or restore the mail templates
-        uses: suitenumerique/ci/actions/mail-templates@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+      - name: Restore the mail templates
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        id: mail-templates
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
 
-      # Creates the access key and the bucket on startup
-      - name: Start Garage
+      - name: Start MinIO
         run: |
-          docker run -d --name garage \
+          docker pull quay.io/minio/minio
+          docker run -d --name minio \
             -p 9000:9000 \
-            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
-            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
-            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
-            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
-            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
-            dxflrs/garage:v2.4.1 \
-            /garage server --single-node --default-bucket
+            -e "MINIO_ACCESS_KEY=meet" \
+            -e "MINIO_SECRET_KEY=password" \
+            -v /data/media:/data \
+            quay.io/minio/minio server --console-address :9001 /data
 
-      - name: Wait for Garage to be ready
+      # Tool to wait for a service to be ready
+      - name: Install Dockerize
         run: |
-          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'
+          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
+            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
+            sudo tar -C /usr/local/bin -xzv
+
+      - name: Wait for MinIO to be ready
+        run: |
+          dockerize -wait tcp://localhost:9000 -timeout 10s
+
+      - name: Configure MinIO
+        run: |
+          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
+          docker exec ${MINIO} sh -c \
+            "mc alias set meet http://localhost:9000 meet password && \
+            mc alias ls && \
+            mc mb meet/meet-media-storage"
 
       - name: Install Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -145,9 +310,9 @@ jobs:
     env:
       AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
       AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
-      AWS_S3_ENDPOINT_URL: "garage:9000"
-      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
-      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
+      AWS_S3_ENDPOINT_URL: "minio:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet"
+      AWS_S3_SECRET_ACCESS_KEY: "password"
       WHISPERX_BASE_URL: "https://configure-your-url.com"
       WHISPERX_ASR_MODEL: "large-v2"
       WHISPERX_API_KEY: "test-whisperx-secret"

.github/workflows/code-quality.yml

@@ -1,14 +0,0 @@
-name: Project quality Workflow
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  quality:
-    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      print_check_paths: src/backend src/summary src/agents
-      codespell_ignore_words: "unsecure"

.github/workflows/crowdin-download.yml

@@ -0,0 +1,33 @@
+name: Download Crowdin translations
+
+on:
+  workflow_dispatch:
+    types: [file-fully-translated]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  crowdin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Download Crowdin files
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
+        with:
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          localization_branch_name: l10n_crowdin_translations
+          create_pull_request: true
+          pull_request_title: "New Crowdin translations"
+          pull_request_body: "New Crowdin pull request with translations"
+          pull_request_base_branch_name: "main"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_BASE_PATH: ${{ github.workspace }}

.github/workflows/docker-hub.yml

@@ -1,5 +1,5 @@
-name: Docker images
-run-name: Docker images
+name: Docker Hub Workflow
+run-name: Docker Hub Workflow
 
 on:
   workflow_dispatch:
@@ -15,62 +15,265 @@ on:
 permissions:
   contents: read
 
+env:
+  DOCKER_USER: 1001:127
+  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
+  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
+  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
+  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
+
 jobs:
-  build-and-push:
-    name: ${{ matrix.service }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - service: backend
-            image_name: lasuite/meet-backend
-            context: .
-            file: ./Dockerfile
-            target: backend-production
-          - service: frontend
-            image_name: lasuite/meet-frontend
-            context: .
-            file: ./src/frontend/Dockerfile
-            target: frontend-production
-          - service: frontend-dinum
-            image_name: lasuite/meet-frontend-dinum
-            context: .
-            file: ./docker/dinum-frontend/Dockerfile
-            target: frontend-production
-          - service: summary
-            image_name: lasuite/meet-summary
-            context: ./src/summary
-            file: ./src/summary/Dockerfile
-            target: production
-          - service: agents
-            image_name: lasuite/meet-agents
-            context: ./src/agents
-            file: ./src/agents/Dockerfile
-            target: production
-    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      image_name: ${{ matrix.image_name }}
-      context: ${{ matrix.context }}
-      file: ${{ matrix.file }}
-      target: ${{ matrix.target }}
-      docker_user: "1001:127"
-      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
-      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-      trivy_scan: true
-      trivy_ignore_files: ./.github/.trivyignore
-    secrets:
-      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
-      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+  build-and-push-backend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          target: backend-production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend-generic:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        with:
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          file: ./src/frontend/Dockerfile
+          target: frontend-production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend-dinum:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          file: ./docker/dinum-frontend/Dockerfile
+          target: frontend-production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+          docker-context: './src/summary'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: ./src/summary
+          file: ./src/summary/Dockerfile
+          target: production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-agents:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      -
+        name: Set up QEMU
+        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: lasuite/meet-agents
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
+      -
+        name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: ./src/agents
+          file: ./src/agents/Dockerfile
+          target: production
+          platforms: ${{ env.BUILD_PLATFORMS }}
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
 
   notify-argocd:
     permissions:
       contents: read
     needs:
-      - build-and-push
+      - build-and-push-frontend-generic
+      - build-and-push-frontend-dinum
+      - build-and-push-backend
+      - build-and-push-summary
+      - build-and-push-agents
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     steps:
-      - uses: suitenumerique/ci/actions/argocd-webhook-notification@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
         id: notify
         with:
           deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"

.github/workflows/release-helm-chart.yaml

@@ -1,17 +1,33 @@
-name: Release Helm chart
+name: Release Chart
+run-name: Release Chart
 
 on:
   push:
-    branches:
-      - main
     paths:
       - src/helm/meet/**
 
-permissions:
-  contents: read
-
 jobs:
   release:
     permissions:
       contents: write
-    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+
+      - name: Cleanup
+        run: rm -rf ./src/helm/extra
+
+      - name: Install Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Publish Helm charts
+        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
+        with:
+          charts_dir: ./src/helm
+          linting: on
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security.yml

@@ -1,21 +0,0 @@
-name: Security analysis
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "**"
-
-permissions: {}
-
-jobs:
-  zizmor:
-    permissions:
-      contents: read
-      actions: read
-      security-events: write
-    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      config: .github/zizmor.yml

.github/zizmor.yml

@@ -1,5 +0,0 @@
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        "suitenumerique/*": ref-pin

CHANGELOG.md

@@ -10,51 +10,10 @@ and this project adheres to
 
 ### Added
 
-- 🔒(backend) throttle meeting link generation
-- 🔒️(backend) add a daily cap on room creation
-
-### Fixed
-
-- 🐛(frontend) enforce recording-mode permissions on the checkboxes
-- 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
-- 🔒️(backend) fix HIGH CVEs in Django and urllib3
-- 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
-
-## [1.33.0] - 2026-09-30
-
-### Added
-
-- ✨(backend) purge rooms inactive for a configurable period
-- 🔨(makefile) add targets to list and download files stored in Garage
-
-### Changed
-
-- ⬆️(backend) update python dependencies
-- ⬆️(summary) update python dependencies
-- ⬆️(agents) update python dependencies
-- ♻️(agents) replace the minio client by boto3
-- 🔧(compose) replace MinIO by Garage for local development
-- 🔧(helm) point media services to Garage by default
-
-### Fixed
-
-- 🔒️(backend) fix critical and high CVEs in PyJWT
-- ⚡️(frontend) disable posthog-js periodic feature flag reloads
-
-## [1.32.1] - 2026-09-25
-
-### Fixed
-
-- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
-- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
-
-## [1.32.0] - 2026-09-25
-
-### Added
-
 - ✨(backend) make the LiveKit default video codec configurable
 - 🔧(dev) add support for Bureautix workstations
 - ✨(frontend) add screen share zoom controls #1498
+- ✨(frontend) open screen share in a separate window #1734
 
 ### Changed
 
@@ -70,13 +29,13 @@ and this project adheres to
 - ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
 - ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
 - ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
-- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
+- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.1
 - 🔖(helm) release chart 0.0.28
 - ♻️(backend) decouple recording event handling from LiveKit egress statuses
 
 ### Fixed
 
-- 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
+- 🐛(helm) probe liveness on **lbheartbeat** and readiness on **heartbeat**
 - 🐛(helm) render periodSeconds and failureThreshold on probes
 - 🐛(backend) report the app release to Sentry instead of "NA"
 - 🐛(frontend) play the waiting room notification sound on every arrival
@@ -407,7 +366,7 @@ and this project adheres to
 
 ### Fixed
 
-- ♿️(frontend) improve accessibility of the Effects panel #1401
+- ♿️(frontend) improve accessibilty of the Effects panel #1401
 
 ## [1.20.0] - 2026-06-12
 

Dockerfile

@@ -37,13 +37,14 @@ RUN --mount=type=cache,target=/root/.cache/uv \
   uv sync --locked --no-dev
 
 # ---- mails ----
-FROM node:22-alpine AS mail-builder
+FROM node:22 AS mail-builder
 
 COPY ./src/mail /mail/app
 
 WORKDIR /mail/app
 
-RUN npm ci --ignore-scripts && npm run build
+RUN yarn install --frozen-lockfile && \
+  yarn build
 
 
 # ---- static link collector ----

Makefile

@@ -69,22 +69,6 @@ LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT)
 # -- Frontend
 PATH_FRONT          = ./src/frontend
 
-# -- Storage
-GARAGE_BUCKET       = meet-media-storage
-STORAGE_FOLDERS     = recordings transcripts summaries
-STORAGE_DIRS        = $(addprefix data/,$(STORAGE_FOLDERS))
-COMPOSE_RUN_AWS     = $(COMPOSE_RUN) --user $(DOCKER_USER)
-AWS_CLI             = garage-cors --endpoint-url=http://garage:9000
-# Extensions listed in each folder (skips the Egress manifests in recordings/)
-recordings_EXTENSIONS  = mp4 ogg
-transcripts_EXTENSIONS = json
-summaries_EXTENSIONS   = txt
-# $(1): folder. Lists its objects with a known extension, most recent first
-storage_list        = s3api list-objects-v2 --bucket $(GARAGE_BUCKET) \
-  --prefix $(1)/
-storage_query       = reverse(sort_by(Contents[?$(foreach ext,$($(1)_EXTENSIONS), \
-  ends_with(Key, `".$(ext)"`) ||) `false`] || `[]`, &LastModified))
-
 # ==============================================================================
 # RULES
 
@@ -93,9 +77,6 @@ default: help
 data/media:
 	@mkdir -p data/media
 
-$(STORAGE_DIRS):
-	@mkdir -p $@
-
 data/static:
 	@mkdir -p data/static
 
@@ -104,7 +85,6 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
-	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
@@ -337,38 +317,12 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret
 
-env.d/development/garage:
-	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
-		env.d/development/garage.dist > env.d/development/garage
-
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber
 
 env.d/development/metadata_collector:
 	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector
 
-# -- Storage
-
-recordings-download-latest: ## download the latest recording from Garage into data/recordings
-transcripts-download-latest: ## download the latest transcript from Garage into data/transcripts
-summaries-download-latest: ## download the latest summary from Garage into data/summaries
-$(STORAGE_FOLDERS:%=%-download-latest): %-download-latest: data/%
-	@key=$$($(COMPOSE_RUN_AWS) -T $(AWS_CLI) $(call storage_list,$*) \
-		--query '$(call storage_query,$*)[0].Key' --output text) && \
-	if [ "$$key" = "None" ]; then echo "No $* found"; exit 1; fi && \
-	$(COMPOSE_RUN_AWS) --volume $(CURDIR)/data/$*:/aws/data/$* \
-		$(AWS_CLI) s3 cp "s3://$(GARAGE_BUCKET)/$$key" data/$*/
-.PHONY: $(STORAGE_FOLDERS:%=%-download-latest)
-
-recordings-list: ## list recordings stored in Garage, most recent first
-transcripts-list: ## list transcripts stored in Garage, most recent first
-summaries-list: ## list summaries stored in Garage, most recent first
-$(STORAGE_FOLDERS:%=%-list): %-list:
-	@$(COMPOSE_RUN_AWS) $(AWS_CLI) $(call storage_list,$*) \
-		--query '$(call storage_query,$*)[].{Date: LastModified, Key: Key, "Size (bytes)": Size}' \
-		--output table
-.PHONY: $(STORAGE_FOLDERS:%=%-list)
-
 # -- Internationalization
 
 env.d/development/crowdin:

UPGRADE.md

@@ -16,44 +16,6 @@ the following command inside your docker container:
 
 ## [Unreleased]
 
-### Purging inactive rooms
-
-Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
-
-- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
-- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
-- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
-- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
-- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
-
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
-
-### Local development: MinIO replaced by Garage
-
-The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
-
-To migrate a local environment:
-
-1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
-2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
-3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
-4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
-5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
-
-### Summary service and metadata collector: boto3 replaces the minio client
-
-The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
-Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
-
-Also:
-- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
-- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
-
-### Helm chart: media services default to Garage
-
-The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
-
 ## v1.30.0
 
 ### Removing S3 storage-event webhooks for recordings

bin/Tiltfile

@@ -104,8 +104,8 @@ k8s_yaml(secret_yaml_generic(
 
 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))
 
-k8s_resource('garage-cors', resource_deps=['garage'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
+k8s_resource('minio-bucket', resource_deps=['minio'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])

bin/_config.sh

@@ -55,12 +55,12 @@ function _docker_compose() {
 function _dc_run() {
     _set_user
 
-    user_args=()
-    if [ -n "$USER_ID" ]; then
-        user_args=("--user=$USER_ID")
+    user_args="--user=$USER_ID"
+    if [ -z $USER_ID ]; then
+        user_args=""
     fi
 
-    _docker_compose run --rm "${user_args[@]}" "$@"
+    _docker_compose run --rm $user_args "$@"
 }
 
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +74,12 @@ function _dc_exec() {
 
     echo "🐳(compose) exec command: '\$@'"
 
-    user_args=()
-    if [ -n "$USER_ID" ]; then
-        user_args=("--user=$USER_ID")
+    user_args="--user=$USER_ID"
+    if [ -z $USER_ID ]; then
+        user_args=""
     fi
 
-    _docker_compose exec "${user_args[@]}" "$@"
+    _docker_compose exec $user_args "$@"
 }
 
 # _django_manage: wrap django's manage.py command with docker compose

bin/buildpack_postfrontend.sh

@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
     [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
 
     mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfully"
+    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
 fi
 
 mv src/backend/* ./

bin/buildpack_start.sh

@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &
 
 # if the current shell is killed, also terminate all its children     
-trap 'pkill -TERM -P $$' SIGTERM
+trap "pkill SIGTERM -P $$" SIGTERM
 
 # wait for a single child to finish,
 wait -n

bin/install-external-secrets.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -o errexit
 
+CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -29,10 +30,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
     echo "Please provide the following information:"
-    read -r -p "Enter your Vaultwarden email login: " LOGIN
-    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -p "Enter your Vaultwarden email login: " LOGIN
+    read -s -p "Enter your Vaultwarden password: " PASSWORD
     echo
-    read -r -p "Enter your Vaultwarden server url: " URL
+    read -p "Enter your Vaultwarden server url: " URL
 }
 
 # Create and apply the secret
@@ -76,7 +77,7 @@ main() {
         exit 0
     fi
 
-    echo -e "${TEMP_SECRET_FILE}"
+    echo -e ${TEMP_SECRET_FILE}
 
     get_user_input
     echo -e "\nCreating Vaultwarden secret…"

bin/install-hooks.sh

@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
 
-cat <<'EOF' >"$PRE_COMMIT_FILE"
+cat <<'EOF' >$PRE_COMMIT_FILE
 #!/bin/bash
 
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
 
-chmod +x "$PRE_COMMIT_FILE"
+chmod +x $PRE_COMMIT_FILE

bin/prepare-release.sh

@@ -68,7 +68,7 @@ fi
 
 # Ask user for release version number
 echo ""
-read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -p "Enter release version number (e.g., 1.2.3): " VERSION
 
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then

bin/update-git-submodule.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 
 git submodule update --init --recursive
-# shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

bin/validate-helm-configuration.sh

@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=
 
 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done

compose.yml

@@ -15,44 +15,36 @@ services:
     ports:
       - "1081:1080"
 
-  garage:
+  minio:
     user: ${DOCKER_USER:-1000}
-    image: dxflrs/garage:v2.4.1
-    command: /garage server --single-node --default-bucket
-    env_file:
-      - env.d/development/garage
+    image: quay.io/minio/minio
     environment:
-      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
-      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
-      - GARAGE_DEFAULT_BUCKET=meet-media-storage
+      - MINIO_ROOT_USER=meet
+      - MINIO_ROOT_PASSWORD=password
     ports:
-      - '127.0.0.1:9000:9000'
+      - '9000:9000'
+      - '9001:9001'
     healthcheck:
-      test: [ "CMD", "/garage", "health" ]
+      test: [ "CMD", "mc", "ready", "local" ]
       interval: 1s
       timeout: 20s
       retries: 300
+    entrypoint: ""
+    command: minio server --console-address :9001 /data
     volumes:
-      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
-      - ./data/media:/var/lib/garage
+      - ./data/media:/data
 
-  # Garage denies cross-origin requests by default: allow the frontend to upload files
-  garage-cors:
-    image: amazon/aws-cli:2.37.1
-    environment:
-      - AWS_ACCESS_KEY_ID=meet-access-key
-      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
-      - AWS_DEFAULT_REGION=local
+  createbuckets:
+    image: quay.io/minio/mc
     depends_on:
-      garage:
+      minio:
         condition: service_healthy
         restart: true
-    command:
-      - s3api
-      - put-bucket-cors
-      - --endpoint-url=http://garage:9000
-      - --bucket=meet-media-storage
-      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
+    entrypoint: >
+      sh -c "
+      /usr/bin/mc alias set meet http://minio:9000 meet password && \
+      /usr/bin/mc mb meet/meet-media-storage && \
+      exit 0;"
 
   app-dev:
     build:
@@ -78,7 +70,7 @@ services:
         - postgresql
         - mailcatcher
         - redis
-        - garage-cors
+        - createbuckets
     extra_hosts:
       - "127.0.0.1.nip.io:host-gateway"
     networks:
@@ -118,7 +110,7 @@ services:
       - postgresql
       - redis
       - livekit
-      - garage
+      - minio
 
   celery:
     user: ${DOCKER_USER:-1000}
@@ -172,7 +164,7 @@ services:
     working_dir: /app
 
   node:
-    image: node:22-alpine
+    image: node:22
     user: "${DOCKER_USER:-1000}"
     environment:
       HOME: /tmp
@@ -252,7 +244,7 @@ services:
       - /app/.venv
     depends_on:
       - livekit
-      - garage
+      - minio
     develop:
       watch:
         - action: rebuild
@@ -271,7 +263,7 @@ services:
       - /app/.venv
 
   redis-summary:
-    image: redis:5
+    image: redis
     ports:
       - "6379:6379"
 
@@ -305,7 +297,7 @@ services:
     depends_on:
       - redis-summary
       - app-summary-dev
-      - garage
+      - minio
     develop:
       watch:
         - action: rebuild
@@ -325,7 +317,7 @@ services:
     depends_on:
       - redis-summary
       - app-summary-dev
-      - garage
+      - minio
     develop:
       watch:
         - action: rebuild

devenv.nix

@@ -163,7 +163,7 @@ in
       REDIS_URL = "redis://127.0.0.1:6379/1";
       CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
 
-      # S3 / Garage
+      # S3 / MinIO
       AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
 
       # OIDC

docker/compose.d/compose.bureautix.yml

@@ -1,7 +1,7 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
 # otherwise all connections fail during the build.
 
 x-proxy-vars: &proxy-vars

docker/compose.d/compose.podman.yml

@@ -19,9 +19,7 @@ services:
     <<: *keep-id
   celery-dev:
     <<: *keep-id
-  garage:
-    <<: *keep-id
-  garage-cors:
+  minio:
     <<: *keep-id
   node:
     <<: *keep-id

docker/files/etc/garage/garage.toml

@@ -1,15 +0,0 @@
-# Garage configuration for local development only: single node, no replication.
-# See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "lmdb"
-
-replication_factor = 1
-
-rpc_bind_addr = "127.0.0.1:3901"
-rpc_public_addr = "127.0.0.1:3901"
-
-[s3_api]
-api_bind_addr = "[::]:9000"
-# Clients must sign their requests for this region (AWS_S3_REGION_NAME)
-s3_region = "local"

docker/files/etc/nginx/conf.d/default.conf

@@ -17,9 +17,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from Garage
-        proxy_pass http://garage:9000/meet-media-storage/;
-        proxy_set_header Host garage:9000;
+        # Get resource from Minio
+        proxy_pass http://minio:9000/meet-media-storage/;
+        proxy_set_header Host minio:9000;
         # To use with ds_proxy
         # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
         # proxy_set_header Host ds-proxy:4444;

docs/developping_locally.md

@@ -13,7 +13,7 @@ These components rely on a few key services:
 
 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
-- Garage for storing files (room recordings)
+- MinIO for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)
 
 We provide two stack options for getting Visio up and running for development:

docs/features/room-purge.md

@@ -1,40 +0,0 @@
-# Room purge
-
-Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
-
-## How it works
-
-Each time LiveKit tells the backend that a room has started (`room_started` webhook), the backend records the date on the room (`last_started_at`).
-A room is inactive when:
-
-- it was last started more than `ROOM_INACTIVITY_DELETION_DAYS` days ago, or
-- it was never started and was created more than `ROOM_INACTIVITY_DELETION_DAYS` days ago.
-
-Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
-
-The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
-
-```bash
-python manage.py purge_inactive_rooms            # delete the inactive rooms
-python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
-```
-
-## Rooms that are kept
-
-A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
-
-- with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
-- with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
-
-## What happens to a purged room
-
-The room is deleted from the database, along with its accesses, its telephony PIN code, and the recording entries it still holds — the expired ones and those that were never saved, since any other recording would have protected the room — together with their own accesses.
-
-The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
-
-⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
-and can be reused when a meeting is created from that same URL.
-
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.

docs/features/transcription.md

@@ -42,7 +42,7 @@ sequenceDiagram
   participant Backend as Backend API
   participant Summary as Summary Service
   participant Celery as Celery Workers (transcribe-queue)
-  participant S3 as S3 (Object Storage)
+  participant MinIO as MinIO (Object Storage)
   participant STT as WhisperX API
   participant Docs as LaSuite Docs
 
@@ -50,7 +50,7 @@ sequenceDiagram
   Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time
 
   Summary->>Celery: Register task (transcribe-queue)
-  Celery->>S3: Fetch audio file
+  Celery->>MinIO: Fetch audio file
   Celery->>STT: Transcribe audio (WhisperX)
   STT-->>Celery: Segmented transcript
 
@@ -72,12 +72,11 @@ sequenceDiagram
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
-| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3 bucket used for storing recordings.                                                                                                                      |
-| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3 storage.                                                                                                                                         |
-| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3.                                                                                                                                                      |
-| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3.                                                                                                                                                      |
-| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3 requests.                                                                                                                                              |
-| aws_s3_region_name       | String    | —                                                                     | Region used to sign S3 requests, passed as-is to boto3.                                                                                                                 |
+| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
+| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
+| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
+| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
+| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |

docs/installation/compose.md

@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |
 
-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
 
 
 ## Software Requirements

docs/installation/kubernetes.md

@@ -14,7 +14,7 @@ This document is a step-by-step guide that describes how to install LaSuite Meet
 
 If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.
 
-IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed.
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 
 
 To be able to use the script, you will need to install the following components:
 
@@ -311,122 +311,119 @@ frontend:
 
 These are the environmental options available on meet backend.
 
-| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                      |
-|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                        |
-| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                           |
-| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
-| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                           |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                        |
-| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                       |
-| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                         |
-| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                        |
-| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                         |
-| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                    |
-| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                         |
-| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                      |
-| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                              |
-| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                              |
-| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                              |
-| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                              |
-| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                           |
-| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                        |
-| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                         |
-| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
-| ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
-| ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
-| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
-| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
-| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
-| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                           |
-| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                              |
-| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                           |
-| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                           |
-| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                           |
-| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                        |
-| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                         |
-| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                           |
-| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                              |
-| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                        |
-| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                        |
-| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                  |
-| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                              |
-| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                              |
-| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                              |
-| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                              |
-| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                        |
-| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                        |
-| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                             |
-| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                              |
-| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                              |
-| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                              |
-| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                              |
-| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                              |
-| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                        |
-| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                           |
-| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                           |
-| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                              |
-| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                         |
-| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                           |
-| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                         |
-| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                         |
-| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                        |
-| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                        |
-| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                         |
-| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                              |
-| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                              |
-| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                              |
-| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                              |
-| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                              |
-| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                         |
-| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                              |
-| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                           |
-| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                 |
-| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                         |
-| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                        |
-| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                           |
-| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                         |
-| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                     |
-| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                 |
-| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                   |
-| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                           |
-| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                        |
-| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                         |
-| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                           |
-| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                              |
-| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                              |
-| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                              |
-| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                         |
-| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                              |
-| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                              |
-| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                              |
-| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                         |
-| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                        |
-| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                        |
-| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                       |
-| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
-| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
-| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
-| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
+| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                       |
+|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                         |
+| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
+| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
+| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
+| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
+| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
+| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |
+| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                          |
+| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                     |
+| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                          |
+| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
+| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                               |
+| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                               |
+| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                               |
+| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                               |
+| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                            |
+| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                         |
+| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                          |
+| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                              |
+| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                    |
+| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                    |
+| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                         |
+| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                            |
+| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                               |
+| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                            |
+| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                            |
+| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                            |
+| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                         |
+| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                          |
+| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                            |
+| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                               |
+| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                         |
+| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                         |
+| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
+| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                               |
+| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                               |
+| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                               |
+| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                               |
+| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                         |
+| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                         |
+| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                              |
+| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                               |
+| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                               |
+| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                               |
+| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                               |
+| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                               |
+| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                         |
+| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                            |
+| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                            |
+| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                               |
+| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                          |
+| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                            |
+| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                          |
+| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                          |
+| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                         |
+| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                         |
+| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                          |
+| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                               |
+| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                               |
+| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                               |
+| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                               |
+| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                               |
+| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                          |
+| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                               |
+| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                            |
+| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                  |
+| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                          |
+| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                         |
+| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                            |
+| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                          |
+| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                      |
+| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                  |
+| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                    |
+| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                            |
+| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                         |
+| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                          |
+| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                            |
+| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                               |
+| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                               |
+| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                               |
+| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                          |
+| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                               |
+| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                               |
+| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                               |
+| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                          |
+| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                         |
+| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
+| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
+| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
+| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
+| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
-| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
-| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                              |
-| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                              |
-| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                              |
-| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                              |
-| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                        |
-| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                |
-| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                              |
-| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                           |
-| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                         |
-| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                            |
-| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                   |
-| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                            |
-| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                            |
-| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                              |
-| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                           |
-| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                           |
-| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                             |
-| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                        |
-| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                           |
-| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                            |
+| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                               |
+| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                               |
+| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                               |
+| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                               |
+| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                               |
+| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                         |
+| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                 |
+| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                               |
+| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                            |
+| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                          |
+| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                             |
+| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                    |
+| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                             |
+| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                             |
+| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                               |
+| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                            |
+| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                            |
+| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                              |
+| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                         |
+| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                            |
+| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                             |

env.d/development/common.dist

@@ -24,10 +24,9 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=http://minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True
 
@@ -64,8 +63,7 @@ ALLOW_UNREGISTERED_ROOMS=False
 
 # Recording
 RECORDING_ENABLE=True
-SUMMARY_SERVICE_VERSION=2
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording

env.d/development/garage.dist

@@ -1,2 +0,0 @@
-# Filled with a random value by `make create-env-files`
-GARAGE_RPC_SECRET=

env.d/development/metadata_collector.dist

@@ -2,9 +2,8 @@ LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret
 
-AWS_S3_ENDPOINT_URL=garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 AWS_STORAGE_BUCKET_NAME=meet-media-storage
 AWS_S3_SECURE_ACCESS=False

env.d/development/multi_user_transcriber.dist

@@ -1,7 +1,6 @@
-AWS_S3_ENDPOINT_URL=garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 
 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey

env.d/development/summary.dist

@@ -2,12 +2,11 @@ APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"
 
 AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="garage:9000"
+AWS_S3_ENDPOINT_URL="minio:9000"
 AWS_S3_SECURE_ACCESS=false
 
-AWS_S3_ACCESS_KEY_ID="meet-access-key"
-AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
-AWS_S3_REGION_NAME="local"
+AWS_S3_ACCESS_KEY_ID="meet"
+AWS_S3_SECRET_ACCESS_KEY="password"
 
 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"

renovate.json

@@ -1,5 +1,5 @@
 {
-  "extends": ["github>suitenumerique/ci//renovate/default"],
+  "extends": ["github>numerique-gouv/renovate-configuration"],
   "dependencyDashboard": true,
   "labels": ["dependencies", "noChangeLog"],
   "packageRules": [

src/addons/outlook/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "core-js": "3.50.0",
-        "i18next": "26.4.2",
+        "i18next": "26.4.1",
         "i18next-browser-languagedetector": "8.2.1",
         "regenerator-runtime": "0.14.1"
       },
@@ -9367,9 +9367,9 @@
       }
     },
     "node_modules/i18next": {
-      "version": "26.4.2",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
+      "version": "26.4.1",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.1.tgz",
+      "integrity": "sha512-9YbX5E6gd1H+yaOSX3izCsPj5iWXyH7X4oC+iuHHJJw8AeHglzOK5SJf+1CHxaYKYigcea+8jvzSxqYx46YvyA==",
       "funding": [
         {
           "type": "individual",

src/addons/outlook/package.json

@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "core-js": "3.50.0",
-    "i18next": "26.4.2",
+    "i18next": "26.4.1",
     "i18next-browser-languagedetector": "8.2.1",
     "regenerator-runtime": "0.14.1"
   },

src/addons/outlook/src/success/success.js

@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
         document.querySelector("#close-msg").style.display = "block";
       })
       .catch((e) => {
-        console.error(`Error occurred: ${e}`);
+        console.error(`Error occured: ${e}`);
       })
       .finally(() => {
         // NOTE: doesn't work with the desktop client — the browser considers

src/agents/Dockerfile

@@ -1,12 +1,10 @@
-FROM python:3.14.7-slim AS base
+FROM python:3.14.6-slim AS base
 
 # Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
 RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
     && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
-    libpcre2-8-0 \
-    libssl3t64 \
     && rm -rf /var/lib/apt/lists/*
 
 

src/agents/metadata_collector.py

@@ -6,11 +6,9 @@ import logging
 import os
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
+from io import BytesIO
 from typing import List, Optional
 
-import boto3
-from botocore.config import Config
-from botocore.exceptions import BotoCoreError, ClientError
 from dotenv import load_dotenv
 from livekit import api, rtc
 from livekit.agents import (
@@ -30,6 +28,8 @@ from livekit.agents import (
     room_io as lk_room_io,
 )
 from livekit.plugins import silero
+from minio import Minio
+from minio.error import S3Error
 
 from exceptions import MissingConfigError
 from observability import configure_sentry, set_job_context
@@ -59,30 +59,6 @@ server = AgentServer(
 server.setup_fnc = prewarm
 
 
-def create_s3_client():
-    """Create an S3 client for the configured endpoint and region.
-
-    The endpoint may be given with or without a scheme: the scheme always
-    follows AWS_S3_SECURE_ACCESS.
-    """
-    endpoint = (
-        os.getenv("AWS_S3_ENDPOINT_URL", "")
-        .removeprefix("https://")
-        .removeprefix("http://")
-        .rstrip("/")
-    )
-    secure = os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true"
-
-    return boto3.client(
-        "s3",
-        endpoint_url=f"{'https' if secure else 'http'}://{endpoint}",
-        aws_access_key_id=os.getenv("AWS_S3_ACCESS_KEY_ID"),
-        aws_secret_access_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
-        region_name=os.getenv("AWS_S3_REGION_NAME"),
-        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
-    )
-
-
 @dataclass
 class MetadataEvent:
     """A single timestamped event recorded during a meeting."""
@@ -145,13 +121,18 @@ class MetadataCollector:
 
     def __init__(self, ctx: JobContext, recording_id: str):
         """Initialize metadata agent."""
+        self.minio_client = Minio(
+            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
+            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
+            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
+            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
+        )
+
         if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
             self.bucket_name = bucket_name
         else:
             raise MissingConfigError
 
-        self.s3_client = create_s3_client()
-
         self.ctx = ctx
         self._sessions: dict[str, AgentSession] = {}
         self._tasks: set[asyncio.Task] = set()
@@ -220,18 +201,20 @@ class MetadataCollector:
         }
 
         data = json.dumps(payload, indent=2).encode("utf-8")
+        stream = BytesIO(data)
 
         try:
-            self.s3_client.put_object(
-                Bucket=self.bucket_name,
-                Key=self.output_filename,
-                Body=data,
-                ContentType="application/json",
+            self.minio_client.put_object(
+                self.bucket_name,
+                self.output_filename,
+                stream,
+                length=len(data),
+                content_type="application/json",
             )
             logger.info(
                 "Uploaded speaker meeting metadata",
             )
-        except (BotoCoreError, ClientError):
+        except S3Error:
             logger.exception(
                 "Failed to upload meeting metadata",
             )

src/agents/pyproject.toml

@@ -1,24 +1,24 @@
 
 [project]
 name = "agents"
-version = "1.33.0"
+version = "1.31.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.7.0",
-    "livekit-plugins-deepgram==1.7.0",
-    "livekit-plugins-silero==1.7.0",
+    "livekit-agents==1.6.7",
+    "livekit-plugins-deepgram==1.6.7",
+    "livekit-plugins-silero==1.6.7",
     "livekit-plugins-kyutai-lasuite==0.0.6",
-    "boto3==1.43.56",
-    "python-dotenv==1.2.3",
-    "protobuf==7.36.0",
-    "sentry-sdk==2.68.1",
+    "python-dotenv==1.2.2",
+    "protobuf==6.33.6",
+    "minio==7.2.20",
+    "sentry-sdk==2.66.1",
     "websockets==17.1",
     "httpx==0.28.1",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.4",
+    "ruff==0.16.0",
 ]
 
 [tool.uv]

src/backend/core/admin.py

@@ -279,16 +279,9 @@ class RoomAdmin(admin.ModelAdmin):
 
     inlines = (ResourceAccessInline,)
     search_fields = ["name", "slug", "=id"]
-    list_display = [
-        "name",
-        "slug",
-        "access_level",
-        "get_owner",
-        "created_at",
-        "last_started_at",
-    ]
-    list_filter = ["access_level", "created_at", "last_started_at"]
-    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]
+    list_display = ["name", "slug", "access_level", "get_owner", "created_at"]
+    list_filter = ["access_level", "created_at"]
+    readonly_fields = ["id", "created_at", "updated_at"]
 
     def get_queryset(self, request):
         """Optimize queries by prefetching related access and user data to avoid N+1 queries."""

src/backend/core/api/throttling.py

@@ -20,33 +20,6 @@ class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
     """Throttle for the monitored scoped rate throttle."""
 
 
-class RoomCreationUserRateThrottle(MonitoredUserRateThrottle):
-    """Throttle room creation per authenticated user.
-
-    Can be declared at the viewset level: every action other than "create"
-    is left unthrottled, so the same class can be reused on any viewset
-    exposing a room creation endpoint.
-    """
-
-    scope = "room_creation"
-
-    def get_cache_key(self, request, view):
-        """Throttle only room creations."""
-        if getattr(view, "action", None) != "create":
-            return None
-        return super().get_cache_key(request, view)
-
-
-class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
-    """Cap room creation per authenticated user over a day.
-
-    Complements the short-term RoomCreationUserRateThrottle, which absorbs
-    bursts but lets a user steadily create rooms over hours or days.
-    """
-
-    scope = "room_creation_daily"
-
-
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
     """Throttle authenticated user requesting room entry"""
 

src/backend/core/api/viewsets.py

@@ -180,10 +180,6 @@ class RoomViewSet(
     permission_classes = [permissions.RoomPermissions]
     queryset = models.Room.objects.all()
     serializer_class = serializers.RoomSerializer
-    throttle_classes = [
-        throttling.RoomCreationUserRateThrottle,
-        throttling.RoomCreationDailyUserRateThrottle,
-    ]
 
     def get_object(self):
         """Allow getting a room by its slug."""

src/backend/core/management/commands/purge_inactive_rooms.py

@@ -1,94 +0,0 @@
-"""Purge inactive rooms."""
-
-from datetime import timedelta
-from itertools import batched
-from logging import getLogger
-
-from django.conf import settings
-from django.core.management.base import BaseCommand
-from django.db.models import Exists, OuterRef, Q
-from django.utils import timezone
-
-from core.models import Recording, RecordingStatusChoices, Room
-
-logger = getLogger(__name__)
-
-CHUNK_SIZE = 500
-
-
-class Command(BaseCommand):
-    """
-    Delete rooms that have not been started for ROOM_INACTIVITY_DELETION_DAYS days:
-    - rooms which were last started before that period
-    - rooms never started and created before that period
-
-    Rooms holding a saved recording that has not expired are kept.
-    """
-
-    help = "Purge inactive rooms"
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "--dry-run",
-            action="store_true",
-            help="List the rooms that would be purged without deleting them",
-        )
-
-    def handle(self, *args, **options):
-        """Browse inactive rooms and delete them chunk by chunk."""
-
-        if not settings.ROOM_INACTIVITY_DELETION_DAYS:
-            self.stdout.write(
-                "Purging inactive rooms is disabled "
-                "(ROOM_INACTIVITY_DELETION_DAYS is not set)."
-            )
-            return
-
-        now = timezone.now()
-        inactive_rooms = self.get_inactive_rooms(now)
-
-        inactive_count = inactive_rooms.count()
-        if not inactive_count:
-            self.stdout.write("No inactive room to purge.")
-            return
-
-        if options["dry_run"]:
-            self.stdout.write(
-                f"[dry-run] {inactive_count} inactive room(s) would be purged:"
-            )
-            names = inactive_rooms.values_list("name", flat=True)
-            for name in names.iterator(chunk_size=CHUNK_SIZE):
-                self.stdout.write(f"- {name}")
-            return
-
-        purged_count = 0
-        rooms = inactive_rooms.values_list("pk", "slug").iterator(chunk_size=CHUNK_SIZE)
-        for chunk in batched(rooms, CHUNK_SIZE, strict=False):
-            for room_id, slug in chunk:
-                logger.info("Purging inactive room %s (%s)", room_id, slug)
-
-            _, deleted_by_model = inactive_rooms.filter(
-                pk__in=[room_id for room_id, _ in chunk]
-            ).delete()
-            purged_count += deleted_by_model.get("core.Room", 0)
-
-        self.stdout.write(f"Purged {purged_count} inactive room(s).")
-
-    @staticmethod
-    def get_inactive_rooms(now):
-        """Return the rooms inactive for too long that no recording protects."""
-
-        threshold = now - timedelta(days=settings.ROOM_INACTIVITY_DELETION_DAYS)
-        is_inactive = Q(last_started_at__lt=threshold) | Q(
-            last_started_at__isnull=True, created_at__lt=threshold
-        )
-
-        protected_recordings = Recording.objects.filter(
-            room=OuterRef("pk"), status__in=RecordingStatusChoices.saved_statuses()
-        )
-        if settings.RECORDING_EXPIRATION_DAYS:
-            protected_recordings = protected_recordings.filter(
-                created_at__gte=now - timedelta(days=settings.RECORDING_EXPIRATION_DAYS)
-            )
-
-        return Room.objects.filter(is_inactive, ~Exists(protected_recordings))

src/backend/core/migrations/0024_room_last_started_at.py

@@ -1,18 +0,0 @@
-from django.db import migrations, models
-import django.utils.timezone
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('core', '0023_alter_recording_status'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='room',
-            name='last_started_at',
-            field=models.DateTimeField(blank=True, default=django.utils.timezone.now, editable=False, help_text='date and time at which the room was last started', null=True, verbose_name='last started at'),
-            preserve_default=False,
-        ),
-    ]

src/backend/core/models.py

@@ -87,17 +87,6 @@ class RecordingStatusChoices(models.TextChoices):
             cls.FAILED_TO_STOP,
         }
 
-    @classmethod
-    def saved_statuses(cls):
-        """Return the statuses of a recording whose file users can access."""
-
-        return {
-            cls.NOTIFICATION_SUCCEEDED,
-            cls.SAVED,
-            cls.EXTERNAL_PROCESS_SUCCESSFUL,
-            cls.EXTERNAL_PROCESS_FAILED,
-        }
-
 
 class RecordingModeChoices(models.TextChoices):
     """Recording mode choices."""
@@ -437,13 +426,6 @@ class Room(Resource):
         verbose_name=_("Room PIN code"),
         help_text=_("Unique n-digit code that identifies this room in telephony mode."),
     )
-    last_started_at = models.DateTimeField(
-        verbose_name=_("last started at"),
-        help_text=_("date and time at which the room was last started"),
-        blank=True,
-        null=True,
-        editable=False,
-    )
 
     class Meta:
         db_table = "meet_room"
@@ -700,7 +682,12 @@ class Recording(BaseModel):
     @property
     def is_saved(self) -> bool:
         """Check if the recording is in a saved state."""
-        return self.status in RecordingStatusChoices.saved_statuses()
+        return self.status in {
+            RecordingStatusChoices.NOTIFICATION_SUCCEEDED,
+            RecordingStatusChoices.SAVED,
+            RecordingStatusChoices.EXTERNAL_PROCESS_SUCCESSFUL,
+            RecordingStatusChoices.EXTERNAL_PROCESS_FAILED,
+        }
 
     @property
     def extension(self):

src/backend/core/recording/worker/services.py

@@ -24,7 +24,7 @@ class BaseEgressService:
 
     def _get_filepath(self, filename: str, extension: str) -> str:
         """Construct the file path for a given filename and extension.
-        Insecure method, doesn't handle paths robustly and securely.
+        Unsecure method, doesn't handle paths robustly and securely.
         """
         return f"{self._config.output_folder}/{filename}.{extension}"
 

src/backend/core/services/livekit_events.py

@@ -8,7 +8,6 @@ from enum import Enum
 from logging import getLogger
 
 from django.conf import settings
-from django.utils import timezone
 
 from livekit import api
 
@@ -271,20 +270,12 @@ class LiveKitEventsService:
             )
             raise ActionFailedError("Failed to process room started event") from e
 
-        room_updated_count = models.Room.objects.filter(pk=room_id).update(
-            last_started_at=timezone.now()
-        )
-        if not room_updated_count:
-            raise ActionFailedError(f"Room with ID {room_id} does not exist")
+        try:
+            room = models.Room.objects.get(id=room_id)
+        except models.Room.DoesNotExist as err:
+            raise ActionFailedError(f"Room with ID {room_id} does not exist") from err
 
         if settings.ROOM_TELEPHONY_ENABLED or settings.ROOMKIT_ENABLED:
-            try:
-                room = models.Room.objects.get(pk=room_id)
-            except models.Room.DoesNotExist as err:
-                raise ActionFailedError(
-                    f"Room with ID {room_id} does not exist"
-                ) from err
-
             try:
                 self.sip_management.ensure_dispatch_rule(room)
             except SIPException as e:

src/backend/core/tests/commands/test_purge_inactive_rooms.py

@@ -1,239 +0,0 @@
-"""Tests for the purge_inactive_rooms management command."""
-
-import logging
-from datetime import timedelta
-from io import StringIO
-from unittest import mock
-
-from django.core.management import call_command
-from django.utils import timezone
-
-import pytest
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-COMMAND_MODULE = "core.management.commands.purge_inactive_rooms"
-
-BEFORE_PERIOD = timedelta(days=366)
-WITHIN_PERIOD = timedelta(days=364)
-
-
-@pytest.fixture(name="purge_enabled", autouse=True)
-def fixture_purge_enabled(settings):
-    """Enable the purge of the rooms inactive for a year."""
-    settings.ROOM_INACTIVITY_DELETION_DAYS = 365
-    settings.RECORDING_EXPIRATION_DAYS = 30
-
-
-def create_at(date, factory, **kwargs):
-    """Build an object with the factory as if it was created at the given date."""
-    with mock.patch("django.utils.timezone.now", return_value=date):
-        return factory(**kwargs)
-
-
-def call_purge(*args):
-    """Run the purge command and return what it wrote on stdout."""
-    out = StringIO()
-    call_command("purge_inactive_rooms", *args, stdout=out)
-    return out.getvalue()
-
-
-def room_exists(room):
-    """Tell whether the room is still in database."""
-    return models.Room.objects.filter(pk=room.pk).exists()
-
-
-def test_purge_inactive_rooms_disabled(settings):
-    """Should delete nothing when no inactivity period is configured."""
-    settings.ROOM_INACTIVITY_DELETION_DAYS = None
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-
-    assert "disabled" in call_purge()
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_without_recording_expiration(settings):
-    """Should purge when recordings never expire, keeping rooms with a saved one."""
-    settings.RECORDING_EXPIRATION_DAYS = None
-    long_ago = timezone.now() - BEFORE_PERIOD
-    room = create_at(long_ago, factories.RoomFactory)
-    room_with_recording = create_at(long_ago, factories.RoomFactory)
-    create_at(
-        long_ago,
-        factories.RecordingFactory,
-        room=room_with_recording,
-        status=models.RecordingStatusChoices.SAVED,
-    )
-
-    assert call_purge() == "Purged 1 inactive room(s).\n"
-
-    assert not room_exists(room)
-    assert room_exists(room_with_recording)
-
-
-def test_purge_inactive_rooms_without_recording_expiration_not_saved(settings):
-    """Should delete a room whose recordings were never saved when none expire."""
-    settings.RECORDING_EXPIRATION_DAYS = None
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
-
-    call_purge()
-
-    assert not room_exists(room)
-
-
-def test_purge_inactive_rooms_started_before_period(caplog):
-    """Should delete a room that was last started before the inactivity period."""
-    now = timezone.now()
-    room = create_at(
-        now - timedelta(days=800),
-        factories.RoomFactory,
-        last_started_at=now - BEFORE_PERIOD,
-    )
-
-    with caplog.at_level(logging.INFO, logger=COMMAND_MODULE):
-        output = call_purge()
-
-    assert output == "Purged 1 inactive room(s).\n"
-    assert not room_exists(room)
-    assert f"Purging inactive room {room.pk} ({room.slug})" in caplog.text
-
-
-def test_purge_inactive_rooms_never_started_created_before_period():
-    """Should delete a room that was never started and created before the period."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-
-    call_purge()
-
-    assert not room_exists(room)
-
-
-def test_purge_inactive_rooms_started_within_period():
-    """Should keep a room created long ago that was started within the period."""
-    now = timezone.now()
-    room = create_at(
-        now - timedelta(days=800),
-        factories.RoomFactory,
-        last_started_at=now - WITHIN_PERIOD,
-    )
-
-    assert call_purge() == "No inactive room to purge.\n"
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_never_started_created_within_period():
-    """Should keep a room that was never started but created within the period."""
-    room = create_at(timezone.now() - WITHIN_PERIOD, factories.RoomFactory)
-
-    assert call_purge() == "No inactive room to purge.\n"
-
-    assert room_exists(room)
-
-
-@pytest.mark.parametrize(
-    "status", sorted(models.RecordingStatusChoices.saved_statuses())
-)
-def test_purge_inactive_rooms_recording_not_expired(settings, status):
-    """Should keep a room holding a saved recording that has not expired yet."""
-    settings.RECORDING_EXPIRATION_DAYS = 400
-    long_ago = timezone.now() - BEFORE_PERIOD
-    room = create_at(long_ago, factories.RoomFactory)
-    create_at(long_ago, factories.RecordingFactory, room=room, status=status)
-
-    call_purge()
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_recording_expired(settings):
-    """Should delete a room along with its recordings when they all have expired."""
-    settings.RECORDING_EXPIRATION_DAYS = 30
-    long_ago = timezone.now() - BEFORE_PERIOD
-    room = create_at(long_ago, factories.RoomFactory)
-    recording = create_at(
-        long_ago,
-        factories.RecordingFactory,
-        room=room,
-        status=models.RecordingStatusChoices.SAVED,
-    )
-
-    call_purge()
-
-    assert not room_exists(room)
-    assert not models.Recording.objects.filter(pk=recording.pk).exists()
-
-
-@pytest.mark.parametrize(
-    "status",
-    [
-        status
-        for status in models.RecordingStatusChoices
-        if status not in models.RecordingStatusChoices.saved_statuses()
-    ],
-)
-def test_purge_inactive_rooms_recording_not_saved(status):
-    """Should delete a room whose recordings were never saved, even unexpired."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    factories.RecordingFactory(room=room, status=status)
-
-    call_purge()
-
-    assert not room_exists(room)
-
-
-def test_purge_inactive_rooms_recording_saved_among_others():
-    """Should keep a room holding a saved recording next to a failed one."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.FAILED)
-    factories.RecordingFactory(room=room, status=models.RecordingStatusChoices.SAVED)
-
-    call_purge()
-
-    assert room_exists(room)
-
-
-def test_purge_inactive_rooms_deletes_accesses_and_resource():
-    """Should delete the last owner access and the resource of a purged room."""
-    room = create_at(timezone.now() - BEFORE_PERIOD, factories.RoomFactory)
-    access = factories.UserResourceAccessFactory(
-        resource=room, role=models.RoleChoices.OWNER
-    )
-
-    call_purge()
-
-    assert not room_exists(room)
-    assert not models.Resource.objects.filter(pk=room.pk).exists()
-    assert not models.ResourceAccess.objects.filter(pk=access.pk).exists()
-    assert models.User.objects.filter(pk=access.user.pk).exists()
-
-
-def test_purge_inactive_rooms_dry_run():
-    """Should list the inactive rooms by name without deleting them on a dry run."""
-    long_ago = timezone.now() - BEFORE_PERIOD
-    rooms = [
-        create_at(long_ago, factories.RoomFactory, name=name)
-        for name in ("Alpha room", "Beta room")
-    ]
-    factories.RoomFactory(name="Recent room")
-
-    assert call_purge("--dry-run") == (
-        "[dry-run] 2 inactive room(s) would be purged:\n- Alpha room\n- Beta room\n"
-    )
-
-    assert all(room_exists(room) for room in rooms)
-
-
-def test_purge_inactive_rooms_several_chunks():
-    """Should delete every inactive room when they span several chunks."""
-    long_ago = timezone.now() - BEFORE_PERIOD
-    rooms = [create_at(long_ago, factories.RoomFactory) for _ in range(5)]
-
-    with mock.patch(f"{COMMAND_MODULE}.CHUNK_SIZE", 2):
-        output = call_purge()
-
-    assert output == "Purged 5 inactive room(s).\n"
-    assert not any(room_exists(room) for room in rooms)

src/backend/core/tests/files/test_api_files_create.py

@@ -117,14 +117,14 @@ def test_api_files_create_file_authenticated_success():
     policy_parsed = urlparse(policy)
 
     assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc in ["garage:9000", "localhost:9000"]
+    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
     assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"
 
     query_params = parse_qs(policy_parsed.query)
 
     assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
     assert query_params.pop("X-Amz-Credential") == [
-        f"meet-access-key/{now.strftime('%Y%m%d')}/local/s3/aws4_request"
+        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
     ]
     assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
     assert query_params.pop("X-Amz-Expires") == ["60"]

src/backend/core/tests/files/test_api_files_list.py

@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():
 
 def test_api_files_list_authentificated_user_allowed():
     """
-    Authenticated users should be allowed to list files
+    Authentificated users should be allowed to list files
     """
     user = factories.UserFactory()
     client = APIClient()

src/backend/core/tests/rooms/test_api_rooms_create.py

@@ -9,10 +9,6 @@ from django.core.cache import cache
 import pytest
 from rest_framework.test import APIClient
 
-from ...api.throttling import (
-    RoomCreationDailyUserRateThrottle,
-    RoomCreationUserRateThrottle,
-)
 from ...factories import RoomFactory, UserFactory
 from ...models import Room, RoomAccessLevel
 
@@ -316,145 +312,3 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
     assert response.status_code == 201
     room = Room.objects.get()
     assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
-
-
-@pytest.fixture
-def room_creation_throttle(monkeypatch):
-    """Lower the room creation rate for the duration of a test."""
-    monkeypatch.setitem(
-        settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"], "room_creation", "2/minute"
-    )
-
-
-def test_api_rooms_create_throttled(room_creation_throttle):
-    """Excess requests are rejected and create no room."""
-
-    client = APIClient()
-    client.force_login(UserFactory())
-
-    for index in range(2):
-        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
-        assert response.status_code == 201
-
-    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
-    assert response.status_code == 429
-    assert 0 < int(response["Retry-After"]) <= 60
-    assert Room.objects.count() == 2
-
-
-def test_api_rooms_create_throttle_per_user(room_creation_throttle):
-    """Users sharing an IP have independent creation limits."""
-
-    client = APIClient()
-    client.force_login(UserFactory())
-    for index in range(2):
-        response = client.post("/api/v1.0/rooms/", {"name": f"First user room {index}"})
-        assert response.status_code == 201
-
-    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
-    assert response.status_code == 429
-
-    client.force_login(UserFactory())
-    response = client.post("/api/v1.0/rooms/", {"name": "Second user room"})
-    assert response.status_code == 201
-
-
-def test_api_rooms_create_throttle_does_not_limit_other_actions(room_creation_throttle):
-    """Exhausting creation capacity leaves listing and updating available."""
-
-    client = APIClient()
-    client.force_login(UserFactory())
-    for index in range(2):
-        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
-        assert response.status_code == 201
-    room_id = response.json()["id"]
-
-    assert client.post("/api/v1.0/rooms/", {"name": "Blocked room"}).status_code == 429
-    assert client.get("/api/v1.0/rooms/").status_code == 200
-    assert (
-        client.patch(
-            f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed room"}
-        ).status_code
-        == 200
-    )
-
-
-@pytest.fixture
-def daily_room_creation_throttle(monkeypatch):
-    """Use a tiny daily cap, a loose burst limit and a controllable clock.
-
-    Rates are patched with monkeypatch.setitem so they are restored after the
-    test. Returns a one-item list holding the current fake timestamp.
-    """
-    rates = RoomCreationDailyUserRateThrottle.THROTTLE_RATES
-    monkeypatch.setitem(rates, "room_creation", "100/minute")
-    monkeypatch.setitem(rates, "room_creation_daily", "3/day")
-    now = [1_000_000.0]
-    monkeypatch.setattr(RoomCreationUserRateThrottle, "timer", lambda self: now[0])
-    return now
-
-
-def test_api_rooms_create_daily_throttled(daily_room_creation_throttle):
-    """The daily cap still applies once the short-term window has elapsed."""
-    now = daily_room_creation_throttle
-    client = APIClient()
-    client.force_login(UserFactory())
-
-    for index in range(3):
-        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
-        assert response.status_code == 201
-        now[0] += 120  # Spread creations beyond the short-term window.
-
-    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
-    assert response.status_code == 429
-    assert int(response["Retry-After"]) > 60
-    assert Room.objects.count() == 3
-
-
-def test_api_rooms_create_daily_throttle_resets(daily_room_creation_throttle):
-    """Room creation is allowed again once a day has passed."""
-    now = daily_room_creation_throttle
-    client = APIClient()
-    client.force_login(UserFactory())
-
-    for index in range(3):
-        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
-        assert response.status_code == 201
-
-    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
-    assert response.status_code == 429
-
-    now[0] += 24 * 60 * 60 + 1
-    response = client.post("/api/v1.0/rooms/", {"name": "Next day room"})
-    assert response.status_code == 201
-
-
-def test_api_rooms_create_daily_throttle_per_user(daily_room_creation_throttle):
-    """Each user has its own daily cap."""
-    client = APIClient()
-    client.force_login(UserFactory())
-    for index in range(3):
-        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
-        assert response.status_code == 201
-    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
-
-    client.force_login(UserFactory())
-    response = client.post("/api/v1.0/rooms/", {"name": "Other user room"})
-    assert response.status_code == 201
-
-
-def test_api_rooms_create_daily_throttle_does_not_limit_other_actions(
-    daily_room_creation_throttle,
-):
-    """Reaching the daily cap leaves listing and updating available."""
-    client = APIClient()
-    client.force_login(UserFactory())
-    for index in range(3):
-        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
-        assert response.status_code == 201
-    room_id = response.json()["id"]
-
-    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
-    assert client.get("/api/v1.0/rooms/").status_code == 200
-    response = client.patch(f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed"})
-    assert response.status_code == 200

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -458,7 +458,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
     room = RoomFactory()
 
     mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occurred", code="not_found", status=500
+        msg="an error occured", code="not_found", status=500
     )
 
     user = AnonymousUser()

src/backend/core/tests/rooms/test_api_rooms_retrieve.py

@@ -7,7 +7,6 @@ from unittest import mock
 
 from django.contrib.auth.models import AnonymousUser
 from django.test.utils import override_settings
-from django.utils import timezone
 
 import pytest
 from rest_framework.test import APIClient
@@ -508,20 +507,3 @@ def test_api_rooms_retrieve_administrators(
         role=str(user_access.role),
         participant_id=None,
     )
-
-
-@pytest.mark.parametrize("access_level", RoomAccessLevel)
-@pytest.mark.parametrize("role", [None, *RoleChoices])
-def test_api_rooms_retrieve_last_started_at_not_exposed(role, access_level):
-    """Should not expose when the room was last started, whoever the requester is."""
-    room = RoomFactory(access_level=access_level, last_started_at=timezone.now())
-    client = APIClient()
-    user = UserFactory()
-    if role is not None:
-        UserResourceAccessFactory(resource=room, user=user, role=role)
-    client.force_login(user)
-
-    response = client.get(f"/api/v1.0/rooms/{room.id!s}/")
-
-    assert response.status_code == 200
-    assert "last_started_at" not in response.json()

src/backend/core/tests/rooms/test_api_rooms_update.py

@@ -3,11 +3,8 @@ Test rooms API endpoints in the Meet core app: update.
 """
 
 import random
-from datetime import timedelta
 from unittest.mock import patch
 
-from django.utils import timezone
-
 import pytest
 from rest_framework.test import APIClient
 
@@ -228,39 +225,6 @@ def test_api_rooms_update_administrators_name_only(mock_update_metadata):
     mock_update_metadata.assert_not_called()
 
 
-@pytest.mark.parametrize("method", ["put", "patch"])
-def test_api_rooms_update_last_started_at_ignored(method):
-    """Should ignore a "last_started_at" value sent by a client.
-
-    The field is only ever written by the LiveKit "room_started" webhook: it is not
-    declared on the serializer and is "editable=False" on the model. A client must
-    not be able to keep a room alive by postponing its last start date.
-    """
-    user = UserFactory()
-    last_started_at = timezone.now() - timedelta(days=30)
-    room = RoomFactory(
-        name="Old name",
-        last_started_at=last_started_at,
-        users=[(user, random.choice(["administrator", "owner"]))],
-    )
-    client = APIClient()
-    client.force_login(user)
-
-    response = getattr(client, method)(
-        f"/api/v1.0/rooms/{room.id!s}/",
-        {"name": "New name", "last_started_at": timezone.now().isoformat()},
-        format="json",
-    )
-
-    assert response.status_code == 200
-    assert "last_started_at" not in response.json()
-
-    room.refresh_from_db()
-    # The rest of the payload was applied, so the request was not simply rejected
-    assert room.name == "New name"
-    assert room.last_started_at == last_started_at
-
-
 @pytest.mark.parametrize(
     "configuration",
     [

src/backend/core/tests/services/test_livekit_events.py

@@ -5,16 +5,12 @@ Test LiveKitEvents service.
 
 import logging
 import uuid
-from datetime import timedelta
 from unittest import mock
 
-from django.utils import timezone
-
 import pytest
 from livekit.api import EgressStatus
 
 from core.factories import RecordingFactory, RoomFactory
-from core.models import Room
 from core.recording.enums import RecordingWorkerEvent
 from core.recording.services.recording_events import RecordingEventsService
 from core.services.livekit_events import (
@@ -700,82 +696,6 @@ def test_handle_room_started_skips_dispatch_rule_when_telephony_disabled(
     mock_ensure_dispatch_rule.assert_not_called()
 
 
-def test_handle_room_started_records_access(service, settings):
-    """Should record the access on a room that is started for the first time."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    settings.ROOMKIT_ENABLED = False
-    room = RoomFactory()
-    other_room = RoomFactory()
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    now = timezone.now()
-    with mock.patch("django.utils.timezone.now", return_value=now):
-        service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at == now
-
-    other_room.refresh_from_db()
-    assert other_room.last_started_at is None
-
-
-def test_handle_room_started_overwrites_previous_access(service, settings):
-    """Should overwrite the previous access each time the room is started again."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    settings.ROOMKIT_ENABLED = False
-    now = timezone.now()
-    room = RoomFactory(last_started_at=now - timedelta(days=30))
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    with mock.patch("django.utils.timezone.now", return_value=now):
-        service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at == now
-
-
-def test_handle_room_started_only_updates_access(service, settings):
-    """Should leave the slug and the update date untouched when recording the access."""
-    settings.ROOM_TELEPHONY_ENABLED = False
-    settings.ROOMKIT_ENABLED = False
-    room = RoomFactory()
-    Room.objects.filter(pk=room.pk).update(slug="𓆑")
-    room.refresh_from_db()
-    updated_at = room.updated_at
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at is not None
-    assert room.slug == "𓆑"
-    assert room.updated_at == updated_at
-
-
-@mock.patch.object(
-    SIPManagement,
-    "ensure_dispatch_rule",
-    side_effect=SIPException("Test error"),
-)
-def test_handle_room_started_records_access_when_dispatch_rule_creation_fails(
-    mock_ensure_dispatch_rule, service, settings
-):
-    """Should still record the access when ensuring the dispatch rule fails."""
-    settings.ROOM_TELEPHONY_ENABLED = True
-    room = RoomFactory()
-    mock_data = mock.MagicMock()
-    mock_data.room.name = str(room.id)
-
-    with pytest.raises(ActionFailedError):
-        service._handle_room_started(mock_data)
-
-    room.refresh_from_db()
-    assert room.last_started_at is not None
-
-
 def test_handle_room_started_raises_error_for_invalid_room_name(service):
     """Should raise ActionFailedError when room name format is invalid  when room starts."""
     mock_data = mock.MagicMock()

src/backend/core/tests/services/test_sip_management.py

@@ -1,5 +1,5 @@
 """
-Test SIP management service.
+Test SIP mamagement service.
 """
 
 # pylint: disable=W0212

src/backend/core/tests/test_models_rooms.py

@@ -92,12 +92,6 @@ def test_models_rooms_access_level_default():
     assert room.access_level == RoomAccessLevel.PUBLIC
 
 
-def test_models_rooms_last_started_at_default():
-    """Should have no last access date until the room is started."""
-    room = Room.objects.create(name="room")
-    assert room.last_started_at is None
-
-
 # Access rights methods
 
 

src/backend/meet/settings.py

@@ -361,16 +361,6 @@ class Base(Configuration):
         "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.URLPathVersioning",
         "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
         "DEFAULT_THROTTLE_RATES": {
-            "room_creation": values.Value(
-                default="50/minute",
-                environ_name="ROOM_CREATION_THROTTLE_RATES",
-                environ_prefix=None,
-            ),
-            "room_creation_daily": values.Value(
-                default="1000/day",
-                environ_name="ROOM_CREATION_DAILY_THROTTLE_RATES",
-                environ_prefix=None,
-            ),
             "request_entry": values.Value(
                 default="150/minute",
                 environ_name="REQUEST_ENTRY_THROTTLE_RATES",
@@ -740,9 +730,6 @@ class Base(Configuration):
     ALLOW_UNREGISTERED_ROOMS = values.BooleanValue(
         True, environ_name="ALLOW_UNREGISTERED_ROOMS", environ_prefix=None
     )
-    ROOM_INACTIVITY_DELETION_DAYS = values.PositiveIntegerValue(
-        None, environ_name="ROOM_INACTIVITY_DELETION_DAYS", environ_prefix=None
-    )
     # if provided, treat as suspicious (possible privilege escalation attempt).
     PARTICIPANT_FORBIDDEN_PERMISSION_FIELDS = values.ListValue(
         ["hidden", "recorder", "agent"],
@@ -1262,25 +1249,6 @@ class Base(Configuration):
                 stacklevel=2,
             )
 
-        if cls.ROOM_INACTIVITY_DELETION_DAYS:
-            if not cls.RECORDING_EXPIRATION_DAYS:
-                warnings.warn(
-                    "ROOM_INACTIVITY_DELETION_DAYS is set but "
-                    "RECORDING_EXPIRATION_DAYS is not. Recordings never expire, so "
-                    "inactive rooms holding a saved recording will never be purged.",
-                    UserWarning,
-                    stacklevel=2,
-                )
-            elif cls.RECORDING_EXPIRATION_DAYS >= cls.ROOM_INACTIVITY_DELETION_DAYS:
-                warnings.warn(
-                    "RECORDING_EXPIRATION_DAYS is greater than or equal to "
-                    "ROOM_INACTIVITY_DELETION_DAYS. Inactive rooms holding a saved "
-                    "recording will be kept past the inactivity period, until their "
-                    "recordings expire.",
-                    UserWarning,
-                    stacklevel=2,
-                )
-
         # The SENTRY_DSN setting should be available to activate sentry for an environment
         if cls.SENTRY_DSN is not None:
             sentry_sdk.init(

src/backend/pyproject.toml

@@ -2,12 +2,12 @@
 # Meet package
 #
 [build-system]
-requires = ["uv_build>=0.12.6,<0.13.0"]
+requires = ["uv_build>=0.11.16,<0.12.0"]
 build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.33.0"
+version = "1.31.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -24,7 +24,7 @@ keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.43.80",
+    "boto3==1.43.56",
     "Brotli==1.2.0",
     "brevo-python==1.2.0",
     "celery[redis]==5.6.3",
@@ -33,38 +33,38 @@ dependencies = [
     "django-cors-headers==4.9.0",
     "django-countries==9.0.0",
     "django-filter==26.1",
-    "django-lasuite[all]==0.0.29",
+    "django-lasuite[all]==0.0.27",
     "django-parler==2.4",
     "redis==5.2.1",
     "django-redis==7.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
-    "django==5.2.17",
-    "djangorestframework==3.18.0",
+    "django==5.2.16",
+    "djangorestframework==3.17.1",
     "drf_spectacular==0.30.0",
     "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
-    "gunicorn==26.2.0",
+    "gunicorn==26.0.0",
     "jsonschema==4.26.0",
-    "markdown==3.10.3",
+    "markdown==3.10.2",
     "nested-multipart-parser==1.6.0",
-    "posthog==7.44.0",
+    "posthog==7.29.0",
     "psycopg[binary]==3.3.4",
     "pydantic==2.13.4",
-    "PyJWT==2.14.0",
+    "PyJWT==2.13.0",
     "python-frontmatter==1.3.0",
     "python-magic==0.4.27",
     "requests==2.34.2",
-    "sentry-sdk==2.68.1",
+    "sentry-sdk==2.66.1",
     "whitenoise==6.12.0",
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.2.0",
     "aiohttp==3.14.3",
-    "urllib3==2.8.0",
-    "phonenumbers==9.0.37",
-    "cryptography==50.0.1", # CVE-2026-69247
+    "urllib3==2.7.0",
+    "phonenumbers==9.0.34",
+    "cryptography==50.0.0", # CVE-2026-69247
 ]
 
 [project.urls]
@@ -76,20 +76,20 @@ dependencies = [
 [dependency-groups]
 dev = [
     "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.8.1",
+    "drf-spectacular-sidecar==2026.7.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.16.1",
+    "ipython==9.15.0",
     "pyfakefs==6.2.0",
     "pylint-django==2.8.0",
     "pylint<4.0.0",
     "pytest-cov==7.1.0",
-    "pytest-django==4.14.0",
+    "pytest-django==4.12.0",
     "pytest==9.1.1",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.26.2",
-    "ruff==0.16.4",
+    "ruff==0.16.0",
     "types-requests==2.33.0.20260712",
 ]
 

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.33.0",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.33.0",
+      "version": "1.31.0",
       "dependencies": {
         "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
         "@fontsource-variable/lexend": "5.3.0",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.33.0",
+  "version": "1.31.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/frontend/panda.config.ts

@@ -121,7 +121,7 @@ const config: Config = {
     },
     tokens: defineTokens({
       /* we take a few things from the panda preset but for now we clear out some stuff.
-       * This way we'll only add the things we need step by step and prevent using lots of different things.
+       * This way we'll only add the things we need step by step and prevent using lots of differents things.
        */
       ...pandaPreset.theme.tokens,
       colors: defineTokens.colors({

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -41,7 +41,6 @@ export const useAnalytics = ({
         api_host: host,
         flags_api_host: flags_api_host,
         person_profiles: 'always',
-        remote_config_refresh_interval_ms: 0,
         capture_pageview: 'history_change',
         capture_pageleave: true,
         capture_exceptions: {

src/frontend/src/features/layout/components/StageLayout.tsx

@@ -12,6 +12,10 @@ import {
 import { Track } from 'livekit-client'
 import { useSnapshot } from 'valtio'
 import { clearPinnedTrack, layoutStore, setPinnedTrack } from '@/stores/layout'
+import {
+  closeScreenSharePopout,
+  screenSharePopoutStore,
+} from '@/stores/screenSharePopout'
 import { useEffect, useRef } from 'react'
 
 export const StageLayout = () => {
@@ -31,8 +35,26 @@ export const StageLayout = () => {
     .filter((track) => track.publication.source === Track.Source.ScreenShare)
 
   const { pinnedTrackRef } = useSnapshot(layoutStore)
+  const { entry: popoutEntry } = useSnapshot(screenSharePopoutStore)
+  const detachedSid = popoutEntry?.trackSid
 
-  const carouselTracks = tracks.filter(
+  // The popped-out share stays mounted below, but out of the grid and the
+  // carousel. It comes back with the other tracks when its window closes.
+  const visibleTracks = detachedSid
+    ? tracks.filter(
+        (track) =>
+          !isTrackReference(track) || track.publication.trackSid !== detachedSid
+      )
+    : tracks
+
+  const detachedTrack = detachedSid
+    ? tracks.find(
+        (track) =>
+          isTrackReference(track) && track.publication.trackSid === detachedSid
+      )
+    : undefined
+
+  const carouselTracks = visibleTracks.filter(
     (track) => !isEqualTrackRef(track, pinnedTrackRef)
   )
 
@@ -85,11 +107,36 @@ export const StageLayout = () => {
   ])
   /* eslint-enable react-hooks/exhaustive-deps */
 
+  const screenShareKey = screenShareTracks
+    .map((track) => track.publication.trackSid)
+    .join()
+
+  // The popped-out tile is kept mounted below, so nothing else notices when
+  // the share stops. Close the window here instead.
+  useEffect(() => {
+    const entry = screenSharePopoutStore.entry
+    if (!entry) return
+    const alive = screenShareTracks.some(
+      (track) => track.publication.trackSid === entry.trackSid
+    )
+    if (!alive) closeScreenSharePopout({ restorePin: false })
+    // screenShareKey is the sid list; the array itself is new every render.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [screenShareKey])
+
   return (
     <>
+      {/* Out of the layout, but still mounted: this subtree is what renders
+          into the separate window. hidden also takes it off the a11y tree
+          and out of the tab order. */}
+      {detachedTrack && (
+        <div hidden>
+          <ParticipantTile trackRef={detachedTrack} />
+        </div>
+      )}
       {!pinnedTrackRef ? (
         <div className="lk-grid-layout-wrapper" style={{ height: 'auto' }}>
-          <GridLayout tracks={tracks} style={{ padding: 0 }}>
+          <GridLayout tracks={visibleTracks} style={{ padding: 0 }}>
             <ParticipantTile />
           </GridLayout>
         </div>

src/frontend/src/features/participantTile/components/ParticipantTile.tsx

@@ -153,7 +153,12 @@ export const ParticipantTile: (
     // there without the dead fullscreen button.
     trackMedia =
       isRemoteScreenShare && !disableTileControls ? (
-        <ScreenShareZoomableVideo tileRef={tileRef}>
+        <ScreenShareZoomableVideo
+          tileRef={tileRef}
+          participantName={participantName}
+          trackSid={trackReference.publication.trackSid}
+          windowName={`meet-screen-share-${trackReference.publication.trackSid || trackReference.participant.identity}`}
+        >
           {videoTrack}
         </ScreenShareZoomableVideo>
       ) : (

src/frontend/src/features/recording/components/ScreenRecordingSidePanel.tsx

@@ -45,10 +45,6 @@ export const ScreenRecordingSidePanel = () => {
     FeatureFlags.ScreenRecording
   )
 
-  const hasTranscriptAccess = useHasRecordingAccess(
-    RecordingMode.Transcript,
-    FeatureFlags.Transcript
-  )
   const { notifyParticipants } = useNotifyParticipants()
   const { selectedLanguageKey, isLanguageSetToAuto } =
     useTranscriptionLanguage()
@@ -92,7 +88,7 @@ export const ScreenRecordingSidePanel = () => {
           ...(!isLanguageSetToAuto && {
             language: selectedLanguageKey,
           }),
-          ...(includeTranscript && hasTranscriptAccess && { transcribe: true }),
+          ...(includeTranscript && { transcribe: true }),
         }
 
         await startRecording({
@@ -186,26 +182,24 @@ export const ScreenRecordingSidePanel = () => {
         <RowWrapper iconName="mail" position="last">
           <Text variant="sm">{t('details.receiver')}</Text>
         </RowWrapper>
-        {hasTranscriptAccess && (
-          <>
-            <div className={css({ height: '15px' })} />
-            <div
-              className={css({
-                width: '100%',
-                marginLeft: '20px',
-              })}
-            >
-              <Checkbox
-                size="sm"
-                isSelected={includeTranscript}
-                onChange={setIncludeTranscript}
-                isDisabled={statuses.isActive || isPendingToStart}
-              >
-                <Text variant="sm">{t('details.transcription')}</Text>
-              </Checkbox>
-            </div>
-          </>
-        )}
+
+        <div className={css({ height: '15px' })} />
+
+        <div
+          className={css({
+            width: '100%',
+            marginLeft: '20px',
+          })}
+        >
+          <Checkbox
+            size="sm"
+            isSelected={includeTranscript}
+            onChange={setIncludeTranscript}
+            isDisabled={statuses.isActive || isPendingToStart}
+          >
+            <Text variant="sm">{t('details.transcription')}</Text>
+          </Checkbox>
+        </div>
       </VStack>
       <ControlsButton
         i18nKeyPrefix={keyPrefix}

src/frontend/src/features/recording/components/TranscriptSidePanel.tsx

@@ -53,10 +53,6 @@ export const TranscriptSidePanel = () => {
     FeatureFlags.Transcript
   )
 
-  const hasScreenRecordingAccess = useHasRecordingAccess(
-    RecordingMode.ScreenRecording,
-    FeatureFlags.ScreenRecording
-  )
   const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
     RecordingMode.Transcript,
     FeatureFlags.Transcript
@@ -101,9 +97,7 @@ export const TranscriptSidePanel = () => {
           room.localParticipant
         )
       } else {
-        const withScreenRecording =
-          includeScreenRecording && hasScreenRecordingAccess
-        const recordingMode = withScreenRecording
+        const recordingMode = includeScreenRecording
           ? RecordingMode.ScreenRecording
           : RecordingMode.Transcript
 
@@ -111,7 +105,7 @@ export const TranscriptSidePanel = () => {
           ...(!isLanguageSetToAuto && {
             language: selectedLanguageKey,
           }),
-          ...(withScreenRecording && {
+          ...(includeScreenRecording && {
             transcribe: true,
             original_mode: RecordingMode.Transcript,
           }),
@@ -128,7 +122,7 @@ export const TranscriptSidePanel = () => {
           type: NotificationType.TranscriptionStarted,
         })
         captureEvent('transcript-started', {
-          includeScreenRecording: withScreenRecording,
+          includeScreenRecording: includeScreenRecording,
           language: selectedLanguageKey,
         })
       }
@@ -240,26 +234,22 @@ export const TranscriptSidePanel = () => {
             </Button>
           </Text>
         </RowWrapper>
-        {hasScreenRecordingAccess && (
-          <>
-            <div className={css({ height: '15px' })} />
-            <div
-              className={css({
-                width: '100%',
-                marginLeft: '20px',
-              })}
-            >
-              <Checkbox
-                size="sm"
-                isSelected={includeScreenRecording}
-                onChange={setIncludeScreenRecording}
-                isDisabled={statuses.isActive || isPendingToStart}
-              >
-                <Text variant="sm">{t('details.recording')}</Text>
-              </Checkbox>
-            </div>
-          </>
-        )}
+        <div className={css({ height: '15px' })} />
+        <div
+          className={css({
+            width: '100%',
+            marginLeft: '20px',
+          })}
+        >
+          <Checkbox
+            size="sm"
+            isSelected={includeScreenRecording}
+            onChange={setIncludeScreenRecording}
+            isDisabled={statuses.isActive || isPendingToStart}
+          >
+            <Text variant="sm">{t('details.recording')}</Text>
+          </Checkbox>
+        </div>
       </VStack>
       <ControlsButton
         i18nKeyPrefix={keyPrefix}

src/frontend/src/features/rooms/components/Conference.tsx

@@ -45,6 +45,7 @@ import { userStore } from '@/stores/user'
 import { WatchMediaDeviceErrors } from './WatchMediaDeviceErrors'
 import { MeetDevtools } from '@/features/devtools'
 import { VOICE_AUDIO_CONSTRAINTS } from '@/features/rooms/livekit/utils/constants'
+import { closeScreenSharePopout } from '@/stores/screenSharePopout'
 
 export const Conference = ({
   roomId,
@@ -158,7 +159,7 @@ export const Conference = ({
            *
            * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
            * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
-           * Root Cause: Certificate/security issue where the initial request is considered insecure.
+           * Root Cause: Certificate/security issue where the initial request is considered unsecure.
            *
            * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
            * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.
@@ -266,6 +267,10 @@ export const Conference = ({
             }
           }}
           onDisconnected={(e) => {
+            // Quit and a dropped connection navigate inside the app, so the
+            // page never unloads and the separate window stays open.
+            closeScreenSharePopout({ restorePin: false })
+
             const metadata = {
               room_id: roomId,
             }

src/frontend/src/features/rooms/livekit/components/ScreenShareFullscreenButton.tsx

@@ -4,6 +4,8 @@ import { memo, useCallback, useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 
+const getOwnerDocument = (el: Element | null) => el?.ownerDocument ?? document
+
 // Keeps the fullscreen state here rather than on the toolbar, so entering or
 // leaving fullscreen does not re-render the zoom controls.
 export const ScreenShareFullscreenButton = memo(
@@ -16,15 +18,22 @@ export const ScreenShareFullscreenButton = memo(
     const announce = useScreenReaderAnnounce()
 
     const [isFullscreen, setIsFullscreen] = useState(false)
+    const [isFullscreenAvailable, setIsFullscreenAvailable] = useState(
+      () => document.fullscreenEnabled
+    )
     // Tracks whether this tile's container triggered fullscreen (vs another share's).
     const wasThisTileFullscreen = useRef(false)
 
     // Covers Esc and browser UI exits, not just this button.
+    // Listens on the element's own document, so it still works in the popup.
     // Only this tile's instance announces to avoid duplicates with multiple shares.
     useEffect(() => {
+      const doc = getOwnerDocument(containerRef.current)
+      setIsFullscreenAvailable(!!doc.fullscreenEnabled)
+
       const onChange = () => {
         const isThisTileFullscreen =
-          document.fullscreenElement === containerRef.current
+          doc.fullscreenElement === containerRef.current
         setIsFullscreen(isThisTileFullscreen)
 
         if (isThisTileFullscreen) {
@@ -35,16 +44,17 @@ export const ScreenShareFullscreenButton = memo(
           announce(t('fullScreenExited'), 'assertive')
         }
       }
-      document.addEventListener('fullscreenchange', onChange)
-      return () => document.removeEventListener('fullscreenchange', onChange)
+      doc.addEventListener('fullscreenchange', onChange)
+      return () => doc.removeEventListener('fullscreenchange', onChange)
     }, [announce, t, containerRef])
 
     const toggleFullScreen = useCallback(async () => {
+      const doc = getOwnerDocument(containerRef.current)
       try {
-        if (document.fullscreenElement === containerRef.current) {
-          await document.exitFullscreen()
+        if (doc.fullscreenElement === containerRef.current) {
+          await doc.exitFullscreen()
         } else {
-          // Tile container so zoom controls stay visible in fullscreen.
+          // Tile / pop-out chrome so zoom controls stay visible in fullscreen.
           await containerRef.current?.requestFullscreen()
         }
       } catch (error) {
@@ -52,7 +62,7 @@ export const ScreenShareFullscreenButton = memo(
       }
     }, [containerRef])
 
-    if (!document.fullscreenEnabled) return null
+    if (!isFullscreenAvailable) return null
 
     return (
       <Button

src/frontend/src/features/rooms/livekit/components/ScreenSharePopoutPortal.tsx

@@ -0,0 +1,30 @@
+import { createPortal } from 'react-dom'
+import { UNSAFE_PortalProvider } from '@react-aria/overlays'
+import { ScreenReaderAnnouncer } from '@/primitives'
+import { CrossDocumentOverlaysContext } from '@/primitives/CrossDocumentOverlaysContext'
+
+/**
+ * Render in the popup. Tooltips have to live there too, or they show up
+ * in the meeting window instead.
+ */
+export const ScreenSharePopoutPortal = ({
+  container,
+  children,
+}: {
+  container: HTMLElement
+  children: React.ReactNode
+}) => {
+  if (!container.isConnected) return null
+
+  return createPortal(
+    <UNSAFE_PortalProvider getContainer={() => container}>
+      <CrossDocumentOverlaysContext.Provider value={true}>
+        {/* The meeting live region sits in the other document, which a screen
+            reader stops reading once the focus is here. */}
+        <ScreenReaderAnnouncer />
+        {children}
+      </CrossDocumentOverlaysContext.Provider>
+    </UNSAFE_PortalProvider>,
+    container
+  )
+}

src/frontend/src/features/rooms/livekit/components/ScreenShareZoomControls.tsx

@@ -2,6 +2,8 @@ import { css } from '@/styled-system/css'
 import { Button } from '@/primitives'
 import {
   RiFullscreenExitLine,
+  RiArrowGoBackLine,
+  RiShareBoxLine,
   RiZoomInLine,
   RiZoomOutLine,
 } from '@remixicon/react'
@@ -10,6 +12,7 @@ import { Toolbar } from 'react-aria-components'
 import { useEffect, useRef } from 'react'
 import { isMacintosh } from '@/utils/livekit'
 import { srOnly } from '@/styles/a11y'
+import { useIsMobile } from '@/utils/useIsMobile'
 import { ScreenShareFullscreenButton } from './ScreenShareFullscreenButton'
 
 interface ScreenShareZoomControlsProps {
@@ -18,9 +21,12 @@ interface ScreenShareZoomControlsProps {
   zoomPercentage: number
   canZoomIn: boolean
   canZoomOut: boolean
+  isPoppedOut: boolean
+  popoutButtonRef: React.Ref<HTMLButtonElement>
   onZoomIn: () => void
   onZoomOut: () => void
   onResetZoom: () => void
+  onTogglePopout: () => void
 }
 
 export const ScreenShareZoomControls = ({
@@ -29,11 +35,15 @@ export const ScreenShareZoomControls = ({
   zoomPercentage,
   canZoomIn,
   canZoomOut,
+  isPoppedOut,
+  popoutButtonRef,
   onZoomIn,
   onZoomOut,
   onResetZoom,
+  onTogglePopout,
 }: ScreenShareZoomControlsProps) => {
   const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+  const isMobile = useIsMobile()
 
   const zoomInButtonRef = useRef<HTMLButtonElement>(null)
   const hadFocusInCollapsibleRef = useRef(false)
@@ -158,6 +168,28 @@ export const ScreenShareZoomControls = ({
         >
           <RiZoomInLine size={20} />
         </Button>
+        {/* Desktop only — popups on mobile are usually blocked. */}
+        {!isMobile && (
+          <Button
+            ref={popoutButtonRef}
+            size="sm"
+            variant="primaryTextDark"
+            square
+            tooltip={
+              isPoppedOut ? t('closeSeparateWindow') : t('openInSeparateWindow')
+            }
+            aria-label={
+              isPoppedOut ? t('closeSeparateWindow') : t('openInSeparateWindow')
+            }
+            onPress={onTogglePopout}
+          >
+            {isPoppedOut ? (
+              <RiArrowGoBackLine size={20} />
+            ) : (
+              <RiShareBoxLine size={20} />
+            )}
+          </Button>
+        )}
         <ScreenShareFullscreenButton containerRef={containerRef} />
       </Toolbar>
     </div>

src/frontend/src/features/rooms/livekit/components/ScreenShareZoomableVideo.tsx

@@ -1,24 +1,83 @@
 import { css } from '@/styled-system/css'
-import { useEffect, useRef, type ReactNode } from 'react'
+import {
+  cloneElement,
+  isValidElement,
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  type ReactNode,
+} from 'react'
 import { useTranslation } from 'react-i18next'
 import { useScreenShareZoom } from '../hooks/useScreenShareZoom'
+import { useScreenSharePopout } from '../hooks/useScreenSharePopout'
 import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
 import { ScreenShareZoomControls } from './ScreenShareZoomControls'
+import { ScreenSharePopoutPortal } from './ScreenSharePopoutPortal'
+import {
+  saveScreenShareZoom,
+  takePopoutButtonFocus,
+  takeScreenShareZoom,
+} from '@/stores/screenSharePopout'
 
 interface ScreenShareZoomableVideoProps {
   tileRef: React.RefObject<HTMLDivElement | null>
+  participantName: string
+  trackSid: string
+  windowName: string
   children: ReactNode
 }
 
-// The video comes in as children so that a zoom change, which only re-renders
-// this wrapper, leaves the video subtree untouched.
+const popoutChromeClassName = css({
+  width: '100%',
+  height: '100%',
+  position: 'relative',
+  backgroundColor: 'primaryDark.50',
+  outline: 'none',
+  _focusVisible: {
+    outline: '2px solid',
+    outlineColor: 'primary.500',
+    outlineOffset: '-2px',
+  },
+  '& .lk-participant-media-video': {
+    width: '100%',
+    height: '100%',
+    objectFit: 'contain',
+  },
+})
+
 export const ScreenShareZoomableVideo = ({
   tileRef,
+  participantName,
+  trackSid,
+  windowName,
   children,
 }: ScreenShareZoomableVideoProps) => {
   const zoom = useScreenShareZoom()
   const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
   const announce = useScreenReaderAnnounce()
+  const popoutChromeRef = useRef<HTMLDivElement>(null)
+  const popoutButtonRef = useRef<HTMLButtonElement>(null)
+  const wasPoppedOut = useRef(false)
+
+  const getVideoElement = useCallback(
+    () => zoom.transformElRef.current?.querySelector('video') ?? null,
+    [zoom.transformElRef]
+  )
+
+  const popout = useScreenSharePopout({
+    trackSid,
+    windowName,
+    title: t('separateWindowTitle', { name: participantName }),
+    getVideoElement,
+  })
+
+  // Moving the video in or out of the window remounts this tile, because the
+  // stage pin changes. Stash the zoom so the new instance picks it up.
+  const { capture, resync } = zoom
+  useLayoutEffect(() => {
+    return () => saveScreenShareZoom(trackSid, capture())
+  }, [trackSid, capture])
 
   // SR announcement: announce zoom level on change, with a one-time pan hint
   // on the first zoom above 100 % per session.
@@ -39,23 +98,45 @@ export const ScreenShareZoomableVideo = ({
     if (!zoom.isZoomed) hasAnnouncedPanHint.current = false
   }, [zoom.zoomPercentage, zoom.isZoomed, announce, t])
 
-  // Attach keyboard listener on the tile container (has tabIndex=0).
+  // Keys on the tile, or on the popup once the video is over there.
   useEffect(() => {
-    const el = tileRef.current
+    const el = popout.isOpen ? popoutChromeRef.current : tileRef.current
     if (!el) return
     el.addEventListener('keydown', zoom.handleKeyDown)
     return () => el.removeEventListener('keydown', zoom.handleKeyDown)
-  }, [tileRef, zoom.handleKeyDown])
+  }, [popout.isOpen, tileRef, zoom.handleKeyDown])
 
   // Native wheel listener with { passive: false } so preventDefault works.
+  // Re-attach when the video moves to the other window.
   useEffect(() => {
     const el = zoom.surfaceElRef.current
     if (!el) return
     el.addEventListener('wheel', zoom.handleWheel, { passive: false })
     return () => el.removeEventListener('wheel', zoom.handleWheel)
-  }, [zoom.handleWheel, zoom.surfaceElRef])
+  }, [zoom.handleWheel, zoom.surfaceElRef, popout.isOpen])
 
-  return (
+  // Open: focus the popup. Close: focus the button again (the toolbar remounts).
+  useLayoutEffect(() => {
+    resync(takeScreenShareZoom(trackSid) ?? undefined)
+    if (popout.isOpen) {
+      wasPoppedOut.current = true
+      popoutChromeRef.current?.focus()
+      return
+    }
+    if (!wasPoppedOut.current && !takePopoutButtonFocus(trackSid)) return
+    wasPoppedOut.current = false
+    popoutButtonRef.current?.focus()
+  }, [popout.isOpen, resync, trackSid])
+
+  // LiveKit unsubscribes tiles it believes are off-screen. Its observer
+  // cannot measure an element living in another window and reads it as
+  // hidden, which would drop the track a few seconds after opening.
+  const video =
+    popout.isOpen && isValidElement<{ manageSubscription?: boolean }>(children)
+      ? cloneElement(children, { manageSubscription: false })
+      : children
+
+  const media = (
     <>
       <div
         ref={zoom.surfaceElRef}
@@ -80,19 +161,44 @@ export const ScreenShareZoomableVideo = ({
             transformOrigin: 'center center',
           }}
         >
-          {children}
+          {video}
         </div>
       </div>
       <ScreenShareZoomControls
-        containerRef={tileRef}
+        containerRef={popout.isOpen ? popoutChromeRef : tileRef}
         isZoomed={zoom.isZoomed}
         zoomPercentage={zoom.zoomPercentage}
         canZoomIn={zoom.canZoomIn}
         canZoomOut={zoom.canZoomOut}
+        isPoppedOut={popout.isOpen}
+        popoutButtonRef={popoutButtonRef}
         onZoomIn={zoom.zoomIn}
         onZoomOut={zoom.zoomOut}
         onResetZoom={zoom.resetZoom}
+        onTogglePopout={popout.toggle}
       />
     </>
   )
+
+  // Video in the popup. The meeting layout does not keep a tile for it.
+  if (popout.isOpen && popout.container) {
+    return (
+      <ScreenSharePopoutPortal container={popout.container}>
+        <div
+          ref={popoutChromeRef}
+          role="group"
+          // Focusable on purpose: it carries the zoom key handler, and the
+          // popup body is an ancestor, so keys would never bubble to it.
+          // eslint-disable-next-line jsx-a11y/no-noninteractive-tabindex
+          tabIndex={0}
+          aria-label={t('separateWindowLabel', { name: participantName })}
+          className={popoutChromeClassName}
+        >
+          {media}
+        </div>
+      </ScreenSharePopoutPortal>
+    )
+  }
+
+  return media
 }

src/frontend/src/features/rooms/livekit/hooks/useScreenSharePopout.ts

@@ -0,0 +1,112 @@
+import { useCallback } from 'react'
+import { useSnapshot } from 'valtio'
+import { useTranslation } from 'react-i18next'
+import { reportError } from '@/features/analytics/telemetry'
+import { useScreenReaderAnnounce } from '@/hooks/useScreenReaderAnnounce'
+import {
+  closeScreenSharePopout,
+  openScreenSharePopout,
+  screenSharePopoutStore,
+} from '@/stores/screenSharePopout'
+import {
+  getAuxiliaryWindowFeatures,
+  getAuxiliaryWindowSize,
+  initializeAuxiliaryWindow,
+} from '@/utils/auxiliaryWindow'
+
+type UseScreenSharePopoutOptions = {
+  trackSid: string
+  windowName: string
+  title: string
+  getVideoElement?: () => HTMLVideoElement | null
+}
+
+/**
+ * Opens the screen share in another window. Closing it does not stop the
+ * share: the video just comes back into the meeting.
+ *
+ * The window lives in a store, not in this hook. Opening it drops the stage
+ * pin, so the tile moves from the focus layout into the grid and this
+ * component remounts. The store is what keeps the window open across that.
+ *
+ * A real popup, not the meeting PiP, that one is already taken, and a
+ * popup can be as large as another screen.
+ */
+export const useScreenSharePopout = ({
+  trackSid,
+  windowName,
+  title,
+  getVideoElement,
+}: UseScreenSharePopoutOptions) => {
+  const { t } = useTranslation('rooms', { keyPrefix: 'screenShareZoom' })
+  const announce = useScreenReaderAnnounce()
+  const { entry } = useSnapshot(screenSharePopoutStore)
+  const isOpen = entry?.trackSid === trackSid
+
+  // Brings the video back into the meeting, from the toolbar button as well as
+  // from the window's own close button. Safe to call after this hook's
+  // component has unmounted: the listener sits on the popup, not on the tile.
+  const release = useCallback(() => {
+    if (screenSharePopoutStore.entry?.trackSid !== trackSid) return
+    closeScreenSharePopout({ restorePin: true })
+    announce(t('separateWindowClosed'), 'assertive')
+  }, [announce, t, trackSid])
+
+  const open = useCallback(() => {
+    if (screenSharePopoutStore.entry) return
+
+    const { width, height } = getAuxiliaryWindowSize(getVideoElement?.())
+    // Open right away: waiting first (fullscreen, etc.) lets the browser
+    // block the popup.
+    const next = window.open(
+      '',
+      windowName,
+      getAuxiliaryWindowFeatures(width, height)
+    )
+
+    if (!next) {
+      announce(t('separateWindowBlocked'), 'assertive')
+      return
+    }
+
+    try {
+      const container = initializeAuxiliaryWindow(next, { title })
+
+      openScreenSharePopout({
+        trackSid,
+        popup: next,
+        container,
+        // The window X does not go through close() — still bring the video back.
+        onPopupClosed: release,
+      })
+      next.focus()
+      announce(t('separateWindowOpened'), 'assertive')
+      // Drop meeting fullscreen: the stage this share was filling goes away.
+      if (document.fullscreenElement) {
+        void document.exitFullscreen()
+      }
+    } catch (error) {
+      reportError('generic_failure', error, {
+        context: 'screen_share_popout_init',
+      })
+      next.close()
+    }
+  }, [announce, getVideoElement, release, t, title, trackSid, windowName])
+
+  const toggle = useCallback(() => {
+    if (screenSharePopoutStore.entry?.trackSid === trackSid) release()
+    else open()
+  }, [open, release, trackSid])
+
+  return {
+    isOpen,
+    // The snapshot deep-freezes the element. The portal needs the real node,
+    // which `ref()` kept out of the proxy.
+    container: isOpen
+      ? (screenSharePopoutStore.entry?.container ?? null)
+      : null,
+    open,
+    close: release,
+    toggle,
+  }
+}

src/frontend/src/features/rooms/livekit/hooks/useScreenShareZoom.ts

@@ -19,6 +19,8 @@ import {
   getZoomTransform,
 } from '../utils/screenShareZoom'
 
+export type ZoomState = { zoom: number; pan: PanOffset }
+
 /**
  * Manages zoom and pan state for a remote screen share.
  *
@@ -79,6 +81,28 @@ export const useScreenShareZoom = () => {
     )
   }, [])
 
+  // After the video moves to the other window, write the current zoom back
+  // on the new nodes (otherwise it looks like 100 % until the next scroll).
+  // Pass a state to adopt one captured before a remount; the pan is clamped
+  // against the new container either way.
+  const resync = useCallback(
+    (state?: ZoomState) => {
+      if (state) {
+        zoomRef.current = state.zoom
+        panRef.current = state.pan
+      }
+      panRef.current = clampPan(
+        panRef.current,
+        zoomRef.current,
+        readPictureRatio()
+      )
+      applyTransform()
+      applyCursor()
+      syncToolbar()
+    },
+    [applyCursor, applyTransform, syncToolbar, readPictureRatio]
+  )
+
   const setZoom = useCallback(
     (next: number) => {
       zoomRef.current = next
@@ -253,6 +277,13 @@ export const useScreenShareZoom = () => {
     [panBy, zoomIn, zoomOut, resetZoom]
   )
 
+  // The tile remounts when the layout switches. Callers stash this across
+  // that remount so the popup keeps the zoom the user already had.
+  const capture = useCallback(
+    (): ZoomState => ({ zoom: zoomRef.current, pan: { ...panRef.current } }),
+    []
+  )
+
   return {
     zoomPercentage: Math.round(zoomLevel * 100),
     isZoomed: zoomLevel > MIN_ZOOM,
@@ -264,6 +295,8 @@ export const useScreenShareZoom = () => {
     zoomIn,
     zoomOut,
     resetZoom,
+    resync,
+    capture,
     handleWheel,
     handleKeyDown,
   }

src/frontend/src/features/rooms/livekit/prefabs/VideoConference.tsx

@@ -1,7 +1,7 @@
 import { isWeb } from '@livekit/components-core'
 import { MediaDeviceFailure, Track } from 'livekit-client'
 import { getMediaDeviceFailure } from '../utils/mediaPermissions'
-import React, { useState } from 'react'
+import React, { useEffect, useState } from 'react'
 import {
   ConnectionStateToast,
   RoomAudioRenderer,
@@ -32,6 +32,7 @@ import { ChatProvider } from '@/features/chat/components/ChatProvider'
 import { SyncDevicePreferences } from '@/features/rooms/livekit/components/SyncDevicePreferences'
 import { RoomSilentMicDetector } from '@/features/rooms/components/SilentMicDetector'
 import { LobbyProvider } from '@/features/rooms/components/LobbyProvider'
+import { closeScreenSharePopout } from '@/stores/screenSharePopout'
 
 /**
  * @public
@@ -78,6 +79,12 @@ export function VideoConference({ ...props }: VideoConferenceProps) {
 
   const { isOpen: isPictureInPictureOpen } = usePictureInPicture()
 
+  // Picture-in-picture replaces the stage, which is what renders a popped-out
+  // share. Bring it back rather than leave an empty window behind.
+  useEffect(() => {
+    if (isPictureInPictureOpen) closeScreenSharePopout({ restorePin: true })
+  }, [isPictureInPictureOpen])
+
   const [isShareErrorVisible, setIsShareErrorVisible] = useState(false)
 
   const handleDeviceError = ({

src/frontend/src/locales/de/rooms.json

@@ -772,7 +772,14 @@
     "currentZoomLevel": "Zoom {{level}} %",
     "panHint": "Zoom {{level}} %. Mit der Maus ziehen oder den Fokus zurück auf die Bildschirmfreigabe setzen und mit den Pfeiltasten im Bild navigieren.",
     "fullScreenEntered": "Vollbild aktiviert",
-    "fullScreenExited": "Vollbild deaktiviert"
+    "fullScreenExited": "Vollbild deaktiviert",
+    "openInSeparateWindow": "In eigenem Fenster öffnen",
+    "closeSeparateWindow": "Bildschirmfreigabe zurück in die Besprechung holen",
+    "separateWindowOpened": "Bildschirmfreigabe in einem eigenen Fenster geöffnet",
+    "separateWindowClosed": "Bildschirmfreigabe zurück in die Besprechung geholt",
+    "separateWindowBlocked": "Der Browser hat das eigene Fenster blockiert. Erlauben Sie Pop-ups für diese Website und versuchen Sie es erneut.",
+    "separateWindowTitle": "Bildschirmfreigabe von {{name}}",
+    "separateWindowLabel": "Bildschirmfreigabe von {{name}} in einem eigenen Fenster"
   },
   "shortcutsPanel": {
     "title": "Tastenkürzel",

src/frontend/src/locales/en/rooms.json

@@ -772,7 +772,14 @@
     "currentZoomLevel": "Zoom {{level}} %",
     "panHint": "Zoom {{level}} %. Drag with mouse, or move focus back to the screen share and use arrow keys to navigate the picture.",
     "fullScreenEntered": "Full screen enabled",
-    "fullScreenExited": "Full screen disabled"
+    "fullScreenExited": "Full screen disabled",
+    "openInSeparateWindow": "Open in separate window",
+    "closeSeparateWindow": "Return screen share to meeting",
+    "separateWindowOpened": "Screen share opened in a separate window",
+    "separateWindowClosed": "Screen share returned to the meeting",
+    "separateWindowBlocked": "The browser blocked the separate window. Allow pop-ups for this site and try again.",
+    "separateWindowTitle": "{{name}}'s screen share",
+    "separateWindowLabel": "{{name}}'s screen share in a separate window"
   },
   "shortcutsPanel": {
     "title": "Keyboard shortcuts",

src/frontend/src/locales/es/rooms.json

@@ -771,7 +771,14 @@
     "currentZoomLevel": "Zoom {{level}} %",
     "panHint": "Zoom {{level}} %. Arrastra con el ratón, o vuelve a la pantalla compartida y usa las flechas para moverte por la imagen.",
     "fullScreenEntered": "Pantalla completa activada",
-    "fullScreenExited": "Pantalla completa desactivada"
+    "fullScreenExited": "Pantalla completa desactivada",
+    "openInSeparateWindow": "Abrir en una ventana separada",
+    "closeSeparateWindow": "Devolver la pantalla compartida a la reunión",
+    "separateWindowOpened": "Pantalla compartida abierta en una ventana separada",
+    "separateWindowClosed": "Pantalla compartida devuelta a la reunión",
+    "separateWindowBlocked": "El navegador bloqueó la ventana separada. Permite las ventanas emergentes para este sitio y vuelve a intentarlo.",
+    "separateWindowTitle": "Pantalla compartida de {{name}}",
+    "separateWindowLabel": "Pantalla compartida de {{name}} en una ventana separada"
   },
   "shortcutsPanel": {
     "title": "Atajos de teclado",

src/frontend/src/locales/fr/rooms.json

@@ -772,7 +772,14 @@
     "currentZoomLevel": "Zoom {{level}} %",
     "panHint": "Zoom {{level}} %. Glissez avec la souris, ou revenez sur le partage d'écran et utilisez les touches fléchées pour naviguer dans l'image.",
     "fullScreenEntered": "Plein écran activé",
-    "fullScreenExited": "Plein écran désactivé"
+    "fullScreenExited": "Plein écran désactivé",
+    "openInSeparateWindow": "Ouvrir dans une fenêtre séparée",
+    "closeSeparateWindow": "Ramener le partage d'écran dans la réunion",
+    "separateWindowOpened": "Partage d'écran ouvert dans une fenêtre séparée",
+    "separateWindowClosed": "Partage d'écran ramené dans la réunion",
+    "separateWindowBlocked": "Le navigateur a bloqué la fenêtre séparée. Autorisez les pop-ups pour ce site, puis réessayez.",
+    "separateWindowTitle": "Partage d'écran de {{name}}",
+    "separateWindowLabel": "Partage d'écran de {{name}} dans une fenêtre séparée"
   },
   "shortcutsPanel": {
     "title": "Raccourcis clavier",

src/frontend/src/locales/nl/rooms.json

@@ -772,7 +772,14 @@
     "currentZoomLevel": "Zoom {{level}} %",
     "panHint": "Zoom {{level}} %. Sleep met de muis, of zet de focus terug op de schermdeling en gebruik de pijltjestoetsen om door het beeld te navigeren.",
     "fullScreenEntered": "Volledig scherm ingeschakeld",
-    "fullScreenExited": "Volledig scherm uitgeschakeld"
+    "fullScreenExited": "Volledig scherm uitgeschakeld",
+    "openInSeparateWindow": "Openen in een apart venster",
+    "closeSeparateWindow": "Schermdeling terugzetten in de vergadering",
+    "separateWindowOpened": "Schermdeling geopend in een apart venster",
+    "separateWindowClosed": "Schermdeling teruggezet in de vergadering",
+    "separateWindowBlocked": "De browser heeft het aparte venster geblokkeerd. Sta pop-ups toe voor deze site en probeer het opnieuw.",
+    "separateWindowTitle": "Schermdeling van {{name}}",
+    "separateWindowLabel": "Schermdeling van {{name}} in een apart venster"
   },
   "shortcutsPanel": {
     "title": "Sneltoetsen",

src/frontend/src/stores/screenSharePopout.ts

@@ -0,0 +1,123 @@
+import { flushSync } from 'react-dom'
+import { proxy, ref } from 'valtio'
+import type { TrackReferenceOrPlaceholder } from '@livekit/components-core'
+import type { ZoomState } from '@/features/rooms/livekit/hooks/useScreenShareZoom'
+import { clearPinnedTrack, layoutStore, setPinnedTrack } from '@/stores/layout'
+
+type Entry = {
+  trackSid: string
+  window: Window
+  container: HTMLElement
+  // Pin that was on screen when the window opened. Restored on close so the
+  // share (or whichever tile was focused) comes back. Absent when the meeting
+  // was already in grid view.
+  pinnedTrack?: TrackReferenceOrPlaceholder
+  detachListeners: () => void
+}
+
+export const screenSharePopoutStore = proxy<{ entry: Entry | null }>({
+  entry: null,
+})
+
+// Opening and closing both move the video between documents, which remounts
+// the tile. These two slots carry what must survive that remount. They are
+// armed by the transitions below, so an unrelated remount keeps its previous
+// behaviour: the zoom resets and the focus stays where it was.
+let armedSid: string | null = null
+let carriedZoom: { trackSid: string; state: ZoomState } | null = null
+let pendingButtonFocusSid: string | null = null
+
+export const saveScreenShareZoom = (trackSid: string, state: ZoomState) => {
+  if (armedSid !== trackSid) return
+  // One save per transition, so a later unrelated remount starts from scratch.
+  armedSid = null
+  carriedZoom = { trackSid, state }
+}
+
+export const takeScreenShareZoom = (trackSid: string) => {
+  if (carriedZoom?.trackSid !== trackSid) return null
+  const { state } = carriedZoom
+  carriedZoom = null
+  return state
+}
+
+export const takePopoutButtonFocus = (trackSid: string) => {
+  if (pendingButtonFocusSid !== trackSid) return false
+  pendingButtonFocusSid = null
+  return true
+}
+
+export const openScreenSharePopout = ({
+  trackSid,
+  popup,
+  container,
+  onPopupClosed,
+}: {
+  trackSid: string
+  popup: Window
+  container: HTMLElement
+  onPopupClosed: () => void
+}) => {
+  const popupHidden = () => onPopupClosed()
+  // The meeting tab is going away: drop the window rather than run the
+  // bring-back flow, which would touch React while the page tears down.
+  const openerHidden = () => {
+    popup.removeEventListener('pagehide', popupHidden)
+    popup.close()
+  }
+  popup.addEventListener('pagehide', popupHidden, { once: true })
+  window.addEventListener('pagehide', openerHidden)
+
+  const pinnedTrack = layoutStore.pinnedTrackRef
+  armedSid = trackSid
+  screenSharePopoutStore.entry = {
+    trackSid,
+    window: ref(popup),
+    container: ref(container),
+    pinnedTrack: pinnedTrack ? ref(pinnedTrack) : undefined,
+    detachListeners: () => {
+      popup.removeEventListener('pagehide', popupHidden)
+      window.removeEventListener('pagehide', openerHidden)
+    },
+  }
+  // The share (or another pin) was filling the stage. Grid view leaves the
+  // rest of the meeting the whole window while the share is outside.
+  if (pinnedTrack) clearPinnedTrack()
+}
+
+// Clears the popout. The previous pin is restored only when the video is
+// coming back: if the share itself ended, that pin points at a dead track.
+export const closeScreenSharePopout = ({
+  restorePin,
+}: {
+  restorePin: boolean
+}) => {
+  const entry = screenSharePopoutStore.entry
+  if (!entry) return
+  const { window: popup, pinnedTrack, trackSid, detachListeners } = entry
+  detachListeners()
+
+  if (restorePin) {
+    // Both must be set before the render below: it remounts the tile, which
+    // reads them from its layout effect.
+    armedSid = trackSid
+    pendingButtonFocusSid = trackSid
+    // Put the cursor back in the meeting so the tile can focus its button.
+    window.focus()
+  } else {
+    armedSid = null
+    carriedZoom = null
+    pendingButtonFocusSid = null
+  }
+
+  // Unmount the portal while the other document is still alive, and put the
+  // pin back in the same render so the share doesn't flash through the grid.
+  flushSync(() => {
+    screenSharePopoutStore.entry = null
+    if (restorePin && pinnedTrack && !layoutStore.pinnedTrackRef) {
+      setPinnedTrack(pinnedTrack)
+    }
+  })
+  popup.close()
+  armedSid = null
+}

src/frontend/src/utils/auxiliaryWindow.ts

@@ -0,0 +1,89 @@
+// Helpers for a separate window. Not the meeting PiP: that API allows only
+// one window, and it is already used. A blank popup has no CSS, so we copy
+// styles from the meeting.
+
+const AUXILIARY_ROOT_ID = 'root'
+
+const copyDocumentChrome = (target: Window) => {
+  const { document: targetDoc } = target
+  document.head
+    .querySelectorAll('link[rel="stylesheet"], style')
+    .forEach((node) => {
+      targetDoc.head.appendChild(node.cloneNode(true))
+    })
+
+  targetDoc.documentElement.className = document.documentElement.className
+  targetDoc.documentElement.style.cssText =
+    document.documentElement.style.cssText
+  targetDoc.documentElement.setAttribute(
+    'lang',
+    document.documentElement.lang || 'en'
+  )
+
+  const theme = document.documentElement.dataset.lkTheme
+  if (theme) {
+    targetDoc.documentElement.dataset.lkTheme = theme
+  }
+}
+
+const ensureAuxiliaryRoot = (target: Window) => {
+  const existing = target.document.getElementById(AUXILIARY_ROOT_ID)
+  if (existing) return existing
+
+  const root = target.document.createElement('div')
+  root.id = AUXILIARY_ROOT_ID
+  root.style.width = '100%'
+  root.style.height = '100%'
+  target.document.body.appendChild(root)
+  return root
+}
+
+// Fill the window and reuse the meeting colors so it does not flash white.
+const applyLayout = (target: Window) => {
+  const { document: targetDoc } = target
+  const sourceBody = getComputedStyle(document.body)
+
+  targetDoc.documentElement.style.height = '100%'
+  targetDoc.body.style.margin = '0'
+  targetDoc.body.style.height = '100%'
+  targetDoc.body.style.overflow = 'hidden'
+  targetDoc.body.style.backgroundColor = sourceBody.backgroundColor
+  targetDoc.body.style.color = sourceBody.color
+}
+
+// Returns the element to portal into.
+export const initializeAuxiliaryWindow = (
+  target: Window,
+  { title }: { title: string }
+) => {
+  copyDocumentChrome(target)
+  target.document.title = title
+  applyLayout(target)
+  return ensureAuxiliaryRoot(target)
+}
+
+// Match the shared screen size, but keep the window on one display.
+export const getAuxiliaryWindowSize = (
+  video?: Pick<HTMLVideoElement, 'videoWidth' | 'videoHeight'> | null
+) => {
+  const maxWidth = Math.max(320, Math.round(window.screen.availWidth * 0.9))
+  const maxHeight = Math.max(240, Math.round(window.screen.availHeight * 0.9))
+  const videoWidth = video?.videoWidth ?? 0
+  const videoHeight = video?.videoHeight ?? 0
+
+  if (videoWidth > 0 && videoHeight > 0) {
+    const scale = Math.min(maxWidth / videoWidth, maxHeight / videoHeight, 1)
+    return {
+      width: Math.max(320, Math.round(videoWidth * scale)),
+      height: Math.max(240, Math.round(videoHeight * scale)),
+    }
+  }
+
+  return {
+    width: Math.min(1280, maxWidth),
+    height: Math.min(720, maxHeight),
+  }
+}
+
+export const getAuxiliaryWindowFeatures = (width: number, height: number) =>
+  `popup=yes,width=${width},height=${height},resizable=yes,scrollbars=no,status=no,location=no,toolbar=no,menubar=no`

src/helm/env.d/common.yaml.gotmpl

@@ -24,11 +24,10 @@ _summaryEnvVars: &summaryEnvVars
   APP_NAME: summary-microservice
   APP_API_TOKEN: password
   AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000/
-  AWS_S3_ACCESS_KEY_ID: meet-access-key
-  AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
+  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
+  AWS_S3_ACCESS_KEY_ID: meet
+  AWS_S3_SECRET_ACCESS_KEY: password
   AWS_S3_SECURE_ACCESS: False
-  AWS_S3_REGION_NAME: local
   AUTHORIZED_TENANTS: >
     [
       {
@@ -162,9 +161,9 @@ backend:
     FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
     FRONTEND_IS_SILENT_LOGIN_ENABLED: False
     # S3 Storage
-    AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet-access-key
-    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
     AWS_STORAGE_BUCKET_NAME: meet-media-storage
     # Telephony
     ROOM_TELEPHONY_ENABLED: True
@@ -181,7 +180,7 @@ backend:
     # Custom Background
     AWS_S3_REGION_NAME: local
     AWS_S3_SIGNATURE_VERSION: s3v4
-    AWS_S3_DOMAIN_REPLACE: https://garage.127.0.0.1.nip.io
+    AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io
     MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
     FILE_UPLOAD_ENABLED: True
     CELERY_ENABLED: True
@@ -265,11 +264,11 @@ ingressMedia:
   annotations:
     nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1
 
 serviceMedia:
-  host: garage.meet.svc.cluster.local
+  host: minio.meet.svc.cluster.local
   port: 9000
 
 # ---- Extra ingress/service for background file uploads ------------
@@ -281,11 +280,11 @@ ingressMediaFiles:
   annotations:
     nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
     nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
     nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1
 
 serviceMediaFiles:
-  host: garage.meet.svc.cluster.local
+  host: minio.meet.svc.cluster.local
   port: 9000
 
 # ---- STT Orchestration Microservice Components --------------------
@@ -363,11 +362,10 @@ agentMetadata:
     {{- end }}
     {{- end }}
     ENABLE_SILERO_VAD: "false"
-    AWS_S3_ENDPOINT_URL: garage.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet-access-key
-    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
     AWS_S3_SECURE_ACCESS: False
-    AWS_S3_REGION_NAME: local
     AWS_STORAGE_BUCKET_NAME: meet-media-storage
     AWS_S3_OUTPUT_FOLDER: metadata
 

src/helm/env.d/dev-dinum/values.egress.yaml.gotmpl

@@ -16,11 +16,11 @@ egress:
     address: redis-master:6379
     password: pass
   s3:
-    access_key: meet-access-key
-    secret: meet-secret-access-key
+    access_key: meet
+    secret: password
     region: local
     bucket: meet-media-storage
-    endpoint: http://garage:9000
+    endpoint: http://minio:9000
     force_path_style: true
 
 loadBalancer:

src/helm/env.d/dev-keycloak/values.egress.yaml.gotmpl

@@ -19,11 +19,11 @@ egress:
     address: redis-master:6379
     password: pass
   s3:
-    access_key: meet-access-key
-    secret: meet-secret-access-key
+    access_key: meet
+    secret: password
     region: local
     bucket: meet-media-storage
-    endpoint: http://garage:9000
+    endpoint: http://minio:9000
     force_path_style: true
 
 loadBalancer:

src/helm/extra/templates/garage.yaml

@@ -1,172 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: garage
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 10m
-spec:
-  rules:
-  - host: "garage.127.0.0.1.nip.io"
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: garage
-            port:
-              number: 9000
-  tls:
-  - hosts:
-    - garage.127.0.0.1.nip.io
-    secretName: meet-tls
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: garage
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: client
-    port: 9000
-    protocol: TCP
-    targetPort: 9000
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: garage
-  type: ClusterIP
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: garage-config
-  namespace: {{ .Release.Namespace | quote }}
-data:
-  garage.toml: |
-    metadata_dir = "/var/lib/garage/meta"
-    data_dir = "/var/lib/garage/data"
-    db_engine = "lmdb"
-
-    replication_factor = 1
-
-    rpc_bind_addr = "127.0.0.1:3901"
-    rpc_public_addr = "127.0.0.1:3901"
-
-    [s3_api]
-    api_bind_addr = "[::]:9000"
-    # Clients must sign their requests for this region (AWS_S3_REGION_NAME)
-    s3_region = "local"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: garage-dev
-  namespace: {{ .Release.Namespace | quote }}
-type: Opaque
-data:
-  GARAGE_RPC_SECRET: {{ printf "%s/garage-rpc-secret" .Release.Namespace | sha256sum | b64enc }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: garage
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: garage
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: garage
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: garage
-    spec:
-      containers:
-      - name: garage
-        command:
-          - /garage
-          - server
-          - --single-node
-          - --default-bucket
-        env:
-          - name: GARAGE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: garage-dev
-                key: GARAGE_RPC_SECRET
-          - name: GARAGE_DEFAULT_ACCESS_KEY
-            value: meet-access-key
-          - name: GARAGE_DEFAULT_SECRET_KEY
-            value: meet-secret-access-key
-          - name: GARAGE_DEFAULT_BUCKET
-            value: meet-media-storage
-        image: "dxflrs/garage:v2.4.1"
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9000
-          name: client
-        readinessProbe:
-          exec:
-            command:
-              - /garage
-              - health
-        volumeMounts:
-        - mountPath: /etc/garage.toml
-          name: config
-          subPath: garage.toml
-        - mountPath: /var/lib/garage
-          name: data
-      volumes:
-      - name: config
-        configMap:
-          name: garage-config
-      - name: data
-        emptyDir:
----
-# Garage denies cross-origin requests by default: allow the frontend to upload
-# files straight to the bucket
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: garage-cors
-spec:
-  template:
-    spec:
-      containers:
-      - name: aws-cli
-        image: amazon/aws-cli:2.37.1
-        env:
-          - name: AWS_ACCESS_KEY_ID
-            value: meet-access-key
-          - name: AWS_SECRET_ACCESS_KEY
-            value: meet-secret-access-key
-          - name: AWS_DEFAULT_REGION
-            value: local
-          - name: AWS_ENDPOINT_URL
-            value: http://garage:9000
-          - name: BUCKET
-            value: meet-media-storage
-        command:
-          - /bin/sh
-          - -c
-          - |
-            deadline=$(($(date +%s) + 300))
-            until aws s3api head-bucket --bucket="$BUCKET" --cli-connect-timeout=5; do
-              if [ "$(date +%s)" -ge "$deadline" ]; then
-                echo "Bucket $BUCKET still unavailable on $AWS_ENDPOINT_URL" >&2
-                exit 1
-              fi
-              echo "Waiting for bucket $BUCKET on $AWS_ENDPOINT_URL"
-              sleep 5
-            done
-            exec aws s3api put-bucket-cors --bucket="$BUCKET" \
-              --cors-configuration='{"CORSRules": [{"AllowedOrigins": ["https://meet.127.0.0.1.nip.io"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
-      restartPolicy: Never
-  backoffLimit: 3

src/helm/extra/templates/minio.yaml

@@ -0,0 +1,115 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 10m
+spec:
+  rules:
+  - host: "minio.127.0.0.1.nip.io"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: minio
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - minio.127.0.0.1.nip.io
+    secretName: meet-tls
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  ports:
+  - name: client
+    port: 9000
+    protocol: TCP
+    targetPort: 9000
+  - name: console
+    port: 9001
+    protocol: TCP
+    targetPort: 9001
+  selector:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: minio
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minio
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: minio
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: extra
+      app.kubernetes.io/name: minio
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: extra
+        app.kubernetes.io/name: minio
+    spec:
+      containers:
+      - name: minio
+        command:
+          - /bin/sh
+          - -c
+          - |
+            minio server --console-address :9001 /data
+        env:
+          - name: MINIO_ROOT_USER
+            value: meet
+          - name: MINIO_ROOT_PASSWORD
+            value: password
+        image: "quay.io/minio/minio"
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9000
+          name: client
+        - containerPort: 9001
+          name: console
+        volumeMounts:
+        - mountPath: /data
+          name: data
+        - mountPath: /etc/ssl/certs/mkcert-ca.pem
+          name: mkcert
+          subPath: rootCA.pem
+      volumes:
+      - name: data
+        emptyDir:
+      - name: mkcert
+        secret:
+          secretName: mkcert
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: minio-bucket
+spec:
+  template:
+    spec:
+      containers:
+      - name: mc
+        image: quay.io/minio/mc
+        command:
+          - /bin/sh
+          - -c
+          - |
+            /usr/bin/mc alias set meet http://minio:9000 meet password && \
+            /usr/bin/mc mb meet/meet-media-storage && \
+            exit 0
+      restartPolicy: Never
+  backoffLimit: 3