🧑‍💻(bin) update release tooling to support uv-based deps management

Following the switch from pip to uv, prepare the release workflow
to automatically run `uv lock` on backend and
keep dependencies up to date.

CHANGELOG.md

@@ -15,7 +15,6 @@ and this project adheres to
 ### Fixed
 
 - 🔒️(backend) fix email disclosure in room invitation endpoint #1200
-- 🐛(backend) fix regression in update-participant endpoint #1204
 
 ## [1.12.0] - 2026-03-24
 

bin/prepare-release.sh

@@ -101,6 +101,12 @@ update_npm_version "mail"
 # Update backend pyproject.toml
 update_python_version "backend"
 
+# Run uv lock in backend
+print_info "Running uv lock in backend..."
+cd "src/backend"
+uv lock
+cd -
+
 # Update summary pyproject.toml
 update_python_version "summary"
 
@@ -149,6 +155,7 @@ echo "      - src/frontend/package.json"
 echo "      - src/sdk/package.json"
 echo "      - src/mail/package.json"
 echo "      - src/backend/pyproject.toml"
+echo "      - src/backend/uv.lock"
 echo "      - src/summary/pyproject.toml"
 echo "      - src/agents/pyproject.toml"
 echo "      - CHANGELOG.md"

src/backend/core/api/serializers.py

@@ -303,9 +303,6 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
     )
 
 
-TrackSource = Literal["SCREEN_SHARE", "SCREEN_SHARE_AUDIO", "CAMERA", "MICROPHONE"]
-
-
 class ParticipantPermission(BaseModel):
     """Mirror the LiveKit ParticipantPermission protobuf.
 
@@ -316,7 +313,9 @@ class ParticipantPermission(BaseModel):
     can_subscribe: bool | None = None
     can_publish: bool | None = None
     can_publish_data: bool | None = None
-    can_publish_sources: list[TrackSource] = Field(default_factory=list)
+    can_publish_sources: list[int] = Field(
+        default_factory=list
+    )  # TrackSource enum values
     hidden: bool | None = None
     recorder: bool | None = None
     can_update_metadata: bool | None = None
@@ -367,6 +366,14 @@ class UpdateParticipantSerializer(BaseParticipantsManagementSerializer):
                 f"Setting the following participant permissions is not allowed: "
                 f"{', '.join(suspicious_fields)}."
             )
+        if permission.can_subscribe_metrics is not None:
+            raise serializers.ValidationError(
+                {
+                    "permission": {
+                        "can_subscribe_metrics": "This permission is not implemented."
+                    }
+                }
+            )
 
         return permission
 

src/backend/core/tests/rooms/test_api_rooms_participants_management.py

@@ -130,11 +130,10 @@ def test_update_participant_success(mock_livekit_client):
             "can_publish": True,
             "can_publish_data": True,
             "can_publish_sources": [
-                "CAMERA",
-                "MICROPHONE",
-            ],
+                1,
+                2,
+            ],  # [TrackSource.CAMERA, TrackSource.MICROPHONE]
             "can_update_metadata": True,
-            "can_subscribe_metrics": True,
         },
         "name": "John Doe",
     }
@@ -156,14 +155,8 @@ def test_update_participant_success(mock_livekit_client):
         {"can_subscribe": True},
         {"can_publish": True},
         {"can_publish_data": True},
-        {
-            "can_publish_sources": [
-                "CAMERA",
-                "MICROPHONE",
-            ]
-        },
+        {"can_publish_sources": [1, 2]},
         {"can_update_metadata": True},
-        {"can_subscribe_metrics": False},
     ],
 )
 def test_update_participant_permission_fields_are_optional(
@@ -271,6 +264,35 @@ def test_update_participant_suspicious_permission_multiple(mock_suspicious):
     )
 
 
+@pytest.mark.parametrize("value", (False, True))
+def test_update_participant_unimplemented_can_subscribe_metrics(value):
+    """Test update participant raises 400 when can_subscribe_metrics is set."""
+    client = APIClient()
+    room = RoomFactory()
+    user = UserFactory()
+    UserResourceAccessFactory(
+        resource=room, user=user, role=random.choice(["administrator", "owner"])
+    )
+    client.force_authenticate(user=user)
+
+    payload = {
+        "participant_identity": str(uuid4()),
+        "permission": {
+            "can_subscribe": True,
+            "can_publish": True,
+            "can_publish_data": True,
+            "can_update_metadata": False,
+            "can_subscribe_metrics": value,
+        },
+    }
+
+    url = reverse("rooms-update-participant", kwargs={"pk": room.id})
+    response = client.post(url, payload, format="json")
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "can_subscribe_metrics" in str(response.data)
+
+
 def test_update_participant_forbidden_without_access():
     """Test update participant returns 403 when user lacks room privileges."""
     client = APIClient()

src/helm/env.d/dev-dinum/values.meet.yaml.gotmpl

@@ -1,29 +1,3 @@
-_summaryEnvVars: &summaryEnvVars
-  APP_NAME: summary-microservice
-  APP_API_TOKEN: password
-  AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
-  AWS_S3_ACCESS_KEY_ID: meet
-  AWS_S3_SECRET_ACCESS_KEY: password
-  AWS_S3_SECURE_ACCESS: False
-  WHISPERX_API_KEY: your-secret-value
-  WHISPERX_BASE_URL: https://configure-your-url.com
-  WHISPERX_ASR_MODEL: large-v2
-  WHISPERX_DEFAULT_LANGUAGE: fr
-  LLM_BASE_URL: https://configure-your-url.com
-  LLM_API_KEY: your-secret-value
-  LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
-  WEBHOOK_API_TOKEN: password
-  WEBHOOK_URL: https://www.mock-impress.com/webhook/
-  CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
-  CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
-  TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-
-_summaryImage: &summaryImage
-  repository: localhost:5001/meet-summary
-  pullPolicy: Always
-  tag: "latest"
-
 image:
   repository: localhost:5001/meet-backend
   pullPolicy: Always
@@ -168,15 +142,66 @@ posthog:
 
 summary:
   replicas: 1
-  image: *summaryImage
   envVars:
-    <<: *summaryEnvVars
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+  
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+  
+  command:
+    - "uvicorn"
+    - "summary.main:app"
+    - "--host"
+    - "0.0.0.0"
+    - "--port"
+    - "8000"
+    - "--reload"
 
 celeryTranscribe:
   replicas: 1
-  image: *summaryImage
   envVars:
-    <<: *summaryEnvVars
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
   command:
     - "celery"
     - "-A"
@@ -188,9 +213,31 @@ celeryTranscribe:
 
 celerySummarize:
   replicas: 1
-  image: *summaryImage
   envVars:
-    <<: *summaryEnvVars
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
   command:
     - "celery"
     - "-A"

src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

@@ -1,29 +1,3 @@
-_summaryEnvVars: &summaryEnvVars
-  APP_NAME: summary-microservice
-  APP_API_TOKEN: password
-  AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
-  AWS_S3_ACCESS_KEY_ID: meet
-  AWS_S3_SECRET_ACCESS_KEY: password
-  AWS_S3_SECURE_ACCESS: False
-  WHISPERX_API_KEY: your-secret-value
-  WHISPERX_BASE_URL: https://configure-your-url.com
-  WHISPERX_ASR_MODEL: large-v2
-  WHISPERX_DEFAULT_LANGUAGE: fr
-  LLM_BASE_URL: https://configure-your-url.com
-  LLM_API_KEY: your-secret-value
-  LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
-  WEBHOOK_API_TOKEN: password
-  WEBHOOK_URL: https://www.mock-impress.com/webhook/
-  CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
-  CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
-  TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
-
-_summaryImage: &summaryImage
-  repository: localhost:5001/meet-summary
-  pullPolicy: Always
-  tag: "latest"
-
 image:
   repository: localhost:5001/meet-backend
   pullPolicy: Always
@@ -186,15 +160,69 @@ posthog:
 
 summary:
   replicas: 1
-  image: *summaryImage
   envVars:
-    <<: *summaryEnvVars
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    WHISPERX_DEFAULT_LANGUAGE: fr
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+  
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+  
+  command:
+    - "uvicorn"
+    - "summary.main:app"
+    - "--host"
+    - "0.0.0.0"
+    - "--port"
+    - "8000"
+    - "--reload"
 
 celeryTranscribe:
   replicas: 1
-  image: *summaryImage
   envVars:
-    <<: *summaryEnvVars
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    WHISPERX_DEFAULT_LANGUAGE: fr
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+  
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
   command:
     - "celery"
     - "-A"
@@ -207,9 +235,32 @@ celeryTranscribe:
 
 celerySummarize:
   replicas: 1
-  image: *summaryImage
   envVars:
-    <<: *summaryEnvVars
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    WHISPERX_DEFAULT_LANGUAGE: fr
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
   command:
     - "celery"
     - "-A"

src/helm/env.d/dev/values.egress.yaml.gotmpl

@@ -0,0 +1,43 @@
+replicaCount: 1
+terminationGracePeriodSeconds: 18000
+
+egress:
+  log_level: debug
+  ws_url: ws://livekit-livekit-server:80
+  insecure: true
+  enable_chrome_sandbox: true
+  {{- with .Values.livekit.keys }}
+  {{- range $key, $value := . }}
+  api_key: {{ $key }}
+  api_secret: {{ $value }}
+  {{- end }}
+  {{- end }}
+  redis:
+    address: redis-master:6379
+    password: pass
+  s3:
+    access_key: meet
+    secret: password
+    region: local
+    bucket: meet-media-storage
+    endpoint: http://minio:9000
+    force_path_style: true
+
+loadBalancer:
+  type: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+  tls:
+    - hosts:
+        - livekit-egress.127.0.0.1.nip.io
+      secretName: livekit-egress-dinum-cert
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
+
+nodeSelector: {}
+resources: {}

src/helm/env.d/dev/values.livekit.yaml.gotmpl

@@ -0,0 +1,49 @@
+replicaCount: 1
+terminationGracePeriodSeconds: 18000
+
+image:
+    repository: localhost:5001/meet-livekit
+    pullPolicy: Always
+    tag: "latest"
+
+livekit:
+  log_level: debug
+  rtc:
+    use_external_ip: false
+    port_range_start: 50000
+    port_range_end: 60000
+    tcp_port: 7881
+  redis:
+    address: redis-master:6379
+    password: pass
+  keys:
+  turn:
+    enabled: true
+    udp_port: 443
+    domain: livekit.127.0.0.1.nip.io
+    loadBalancerAnnotations: {}
+
+  webhook:
+    api_key:
+    urls:
+        - https://meet.127.0.0.1.nip.io/api/v1.0/rooms/webhooks-livekit/
+
+loadBalancer:
+  type: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+  tls:
+    - hosts:
+        - livekit.127.0.0.1.nip.io
+      secretName: livekit-dinum-cert
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
+  targetCPUUtilizationPercentage: 60
+
+nodeSelector: {}
+resources: {}

src/helm/env.d/dev/values.meet.yaml.gotmpl

@@ -0,0 +1,290 @@
+secrets:
+  - name: oidcLogin
+    itemId: a25effec-eaea-4ce1-9ed8-3a3cc1c734db
+    field: username
+    podVariable: OIDC_RP_CLIENT_ID
+    clusterSecretStore: bitwarden-login-meet
+  - name: oidcPass
+    itemId: a25effec-eaea-4ce1-9ed8-3a3cc1c734db
+    field: password
+    podVariable: OIDC_RP_CLIENT_SECRET
+    clusterSecretStore: bitwarden-login-meet
+  - name: brevoApiKey
+    itemId: 99107889-6124-4436-97cc-a5193f28443f
+    field: password
+    podVariable: BREVO_API_KEY
+    clusterSecretStore: bitwarden-login-meet
+image:
+  repository: localhost:5001/meet-backend
+  pullPolicy: Always
+  tag: "latest"
+
+backend:
+  replicas: 1
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: https://meet.127.0.0.1.nip.io,http://meet.127.0.0.1.nip.io
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: meet.127.0.0.1.nip.io
+    DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
+    DJANGO_SETTINGS_MODULE: meet.settings
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W004, security.W008
+    DJANGO_SUPERUSER_PASSWORD: admin
+    DJANGO_EMAIL_HOST: "mailcatcher"
+    DJANGO_EMAIL_PORT: 1025
+    DJANGO_EMAIL_USE_SSL: False
+    DJANGO_EMAIL_BRAND_NAME: "La Suite Numérique"
+    DJANGO_EMAIL_SUPPORT_EMAIL: "test@yopmail.com"
+    DJANGO_EMAIL_LOGO_IMG: https://meet.127.0.0.1.nip.io/assets/logo-suite-numerique.png
+    DJANGO_EMAIL_DOMAIN: meet.127.0.0.1.nip.io
+    DJANGO_EMAIL_APP_BASE_URL: https://meet.127.0.0.1.nip.io
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email given_name usual_name"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://meet.127.0.0.1.nip.io
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
+    LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
+    LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
+    DB_HOST: postgres
+    DB_NAME: meet
+    DB_USER: dinum
+    DB_PASSWORD: pass
+    DB_PORT: 5432
+    REDIS_URL: redis://default:pass@redis-master:6379/1
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+    {{- with .Values.livekit.keys }}
+    {{- range $key, $value := . }}
+    LIVEKIT_API_SECRET: {{ $value }}
+    LIVEKIT_API_KEY: {{ $key }}
+    {{- end }}
+    {{- end }}
+    LIVEKIT_API_URL: https://livekit.127.0.0.1.nip.io/
+    LIVEKIT_WEBHOOK_EVENTS_FILTER_REGEX: "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+    ALLOW_UNREGISTERED_ROOMS: False
+    FRONTEND_SILENCE_LIVEKIT_DEBUG: False
+    FRONTEND_SUPPORT: "{'id': '58ea6697-8eba-4492-bc59-ad6562585041'}"
+    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_REGION_NAME: local
+    MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
+    RECORDING_ENABLE: True
+    RECORDING_STORAGE_EVENT_ENABLE: True
+    RECORDING_STORAGE_EVENT_TOKEN: password
+    SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v1/tasks/
+    SUMMARY_SERVICE_API_TOKEN: password
+    RECORDING_DOWNLOAD_BASE_URL: https://meet.127.0.0.1.nip.io/recording
+    SIGNUP_NEW_USER_TO_MARKETING_EMAIL: True
+    BREVO_API_KEY:
+      secretKeyRef:
+        name: backend
+        key: BREVO_API_KEY
+    BREVO_API_CONTACT_LIST_IDS: 8
+    ROOM_TELEPHONY_ENABLED: True
+    SSL_CERT_FILE: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
+
+
+  migrate:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py migrate --no-input
+    restartPolicy: Never
+
+  command:
+    - "gunicorn"
+    - "-c"
+    - "/usr/local/etc/gunicorn/meet.py"
+    - "meet.wsgi:application"
+    - "--reload"
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email admin@example.com --password admin
+    restartPolicy: Never
+
+  # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
+  extraVolumeMounts:
+    - name: certs
+      mountPath: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
+      subPath: cacert.pem
+
+  # Extra volumes to manage our local custom CA and avoid to set ssl_verify: false
+  extraVolumes:
+    - name: certs
+      configMap:
+        name: certifi
+        items:
+        - key: cacert.pem
+          path: cacert.pem
+
+frontend:
+  envVars:
+    VITE_APP_TITLE: "LaSuite Meet"
+    VITE_PORT: 8080
+    VITE_HOST: 0.0.0.0
+    VITE_API_BASE_URL: https://meet.127.0.0.1.nip.io/
+
+  replicas: 1
+
+  image:
+    repository: localhost:5001/meet-frontend
+    pullPolicy: Always
+    tag: "latest"
+
+ingress:
+  enabled: true
+  host: meet.127.0.0.1.nip.io
+
+ingressAdmin:
+  enabled: true
+  host: meet.127.0.0.1.nip.io
+
+ingressWebhook:
+  enabled: true
+  host: meet.127.0.0.1.nip.io
+
+posthog:
+  ingress:
+    enabled: false
+
+  ingressAssets:
+    enabled: false
+
+summary:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
+  command:
+    - "uvicorn"
+    - "summary.main:app"
+    - "--host"
+    - "0.0.0.0"
+    - "--port"
+    - "8000"
+    - "--reload"
+
+celeryTranscribe:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
+  command:
+    - "celery"
+    - "-A"
+    - "summary.core.celery_worker"
+    - "worker"
+    - "--pool=solo"
+    - "--loglevel=info"
+    - "-Q transcribe-queue"
+
+celerySummarize:
+  replicas: 1
+  envVars:
+    APP_NAME: summary-microservice
+    APP_API_TOKEN: password
+    AWS_STORAGE_BUCKET_NAME: meet-media-storage
+    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_SECURE_ACCESS: False
+    WHISPERX_API_KEY: your-secret-value
+    WHISPERX_BASE_URL: https://configure-your-url.com
+    WHISPERX_ASR_MODEL: large-v2
+    LLM_BASE_URL: https://configure-your-url.com
+    LLM_API_KEY: your-secret-value
+    LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
+    WEBHOOK_API_TOKEN: password
+    WEBHOOK_URL: https://www.mock-impress.com/webhook/
+    CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
+    CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
+    TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
+
+  image:
+    repository: localhost:5001/meet-summary
+    pullPolicy: Always
+    tag: "latest"
+
+  command:
+    - "celery"
+    - "-A"
+    - "summary.core.celery_worker"
+    - "worker"
+    - "--pool=solo"
+    - "--loglevel=info"
+    - "-Q summarize-queue"
+
+ingressMedia:
+  enabled: true
+  host: meet.127.0.0.1.nip.io
+
+  annotations:
+    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
+    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
+    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1
+
+serviceMedia:
+  host: minio.meet.svc.cluster.local
+  port: 9000

src/helm/env.d/dev/values.secrets.yaml

@@ -0,0 +1,10 @@
+djangoSecretKey: 7K9mQ2xR8pL3vN6tY1sW4jH5cE0zF9bM2qA7uI3oP6rT1wErt12te12
+livekit:
+    keys:
+        devkey: secret
+    webhook:
+        api_key: devkey
+livekitApi:
+    key: devkey
+    secret: secret
+

src/helm/helmfile.yaml.gotmpl

@@ -7,6 +7,10 @@ environments:
     values:
       - version: 0.0.1
       - env.d/dev-dinum/values.secrets.yaml
+  dev:
+    values:
+      - version: 0.0.1
+      - env.d/dev/values.secrets.yaml
 
 ---
 repositories: