chore(main): release 0.34.0 (#859)

* fix: remove max_tokens cap to support thinking models (Kimi-K2.5)

Thinking/reasoning models like Kimi-K2.5 use output tokens for internal
chain-of-thought before generating the visible response. When max_tokens
was set (500 or 2048), the thinking budget consumed all available tokens,
leaving an empty response — causing TreeSummarize to return '' and
crashing the topic detection retry workflow.

Set max_tokens default to None so the model controls its own output
budget, allowing thinking models to complete both reasoning and response.

Also fix process.py CLI tool to import the Celery worker app before
dispatching tasks, ensuring the Redis broker config is used instead of
Celery's default AMQP transport.

* fix: remove max_tokens=200 cap from final title processor

Same thinking model issue — 200 tokens is especially tight and would be
entirely consumed by chain-of-thought reasoning, producing an empty title.

* Update server/reflector/tools/process.py

Co-authored-by: pr-agent-monadical[bot] <198624643+pr-agent-monadical[bot]@users.noreply.github.com>

* fix: remove max_tokens=500 cap from topic detector processor

Same thinking model fix — this is the original callsite that was failing
with Kimi-K2.5, producing empty TreeSummarize responses.

---------

Co-authored-by: pr-agent-monadical[bot] <198624643+pr-agent-monadical[bot]@users.noreply.github.com>

.gitignore

@@ -1,5 +1,6 @@
 .DS_Store
 server/.env
+server/.env.production
 .env
 Caddyfile
 server/exportdanswer
@@ -22,3 +23,5 @@ www/.env.production
 docs/pnpm-lock.yaml
 .secrets
 opencode.json
+
+vibedocs/

.gitleaksignore

@@ -3,3 +3,5 @@ docs/docs/installation/auth-setup.md:curl-auth-header:250
 docs/docs/installation/daily-setup.md:curl-auth-header:277
 gpu/self_hosted/DEV_SETUP.md:curl-auth-header:74
 gpu/self_hosted/DEV_SETUP.md:curl-auth-header:83
+server/reflector/worker/process.py:generic-api-key:465
+server/reflector/worker/process.py:generic-api-key:594

CHANGELOG.md

@@ -1,5 +1,99 @@
 # Changelog
 
+## [0.34.0](https://github.com/Monadical-SAS/reflector/compare/v0.33.0...v0.34.0) (2026-02-20)
+
+
+### Features
+
+* add Caddy reverse proxy with auto HTTPS for LAN access and auto-derive WebSocket URL ([#863](https://github.com/Monadical-SAS/reflector/issues/863)) ([7f2a401](https://github.com/Monadical-SAS/reflector/commit/7f2a4013cbb3d3ee3e76885f28d73331dcaf325c))
+* add change_seq to transcripts for ingestion support ([#868](https://github.com/Monadical-SAS/reflector/issues/868)) ([d4cc6be](https://github.com/Monadical-SAS/reflector/commit/d4cc6be1fed56ea7fba06acb8d50c9de43b26b07))
+* local llm support + standalone-script doc/draft ([#856](https://github.com/Monadical-SAS/reflector/issues/856)) ([b468427](https://github.com/Monadical-SAS/reflector/commit/b468427f1bb12634f5840990e9d64b2c145d7c1a))
+* remove network_mode host for standalone WebRTC ([#864](https://github.com/Monadical-SAS/reflector/issues/864)) ([9dbf155](https://github.com/Monadical-SAS/reflector/commit/9dbf155be4de7c059035a75f90c7bf0845344b74))
+* standalone frontend uses production build instead of dev server ([#862](https://github.com/Monadical-SAS/reflector/issues/862)) ([5bca925](https://github.com/Monadical-SAS/reflector/commit/5bca92510a5c33f8baeeaac2c346fb1978366ac8))
+
+
+### Bug Fixes
+
+* auto-rebuild standalone images and blank Hatchet vars ([3d13e5d](https://github.com/Monadical-SAS/reflector/commit/3d13e5d42fc53ce3c005841265ed1e8735a61518))
+* check compose version output, not just exit code ([e57c618](https://github.com/Monadical-SAS/reflector/commit/e57c6186f92d66e4525786e56b018c08cf792d2f))
+* check for Docker BuildKit (buildx) before building images ([14a8b58](https://github.com/Monadical-SAS/reflector/commit/14a8b5808e5aed860e55aaed35a0fdf8b2f4afa3))
+* check for Docker Compose plugin before running standalone setup ([36a8dae](https://github.com/Monadical-SAS/reflector/commit/36a8daee61c2b7a0937fd0914d51fb4ea8212ae7))
+* live flow real-time updates during processing ([#861](https://github.com/Monadical-SAS/reflector/issues/861)) ([972a52d](https://github.com/Monadical-SAS/reflector/commit/972a52d22f989f9e2c6f52362b3f1a4e17773663))
+* remove max_tokens cap to support thinking models (Kimi-K2.5) ([#869](https://github.com/Monadical-SAS/reflector/issues/869)) ([527a069](https://github.com/Monadical-SAS/reflector/commit/527a069ba9eff6717ccd4bb1e839674edebffceb))
+* standalone on ubuntu ([#865](https://github.com/Monadical-SAS/reflector/issues/865)) ([a8ad237](https://github.com/Monadical-SAS/reflector/commit/a8ad237d8571d5ef5c78fb4427c538592d6a7b43))
+* standalone server networking and setup diagnostics ([695f3c4](https://github.com/Monadical-SAS/reflector/commit/695f3c49285254869f6a6cbd5f860d1169fa4daa))
+
+## [0.33.0](https://github.com/Monadical-SAS/reflector/compare/v0.32.2...v0.33.0) (2026-02-05)
+
+
+### Features
+
+* Daily+hatchet default ([#846](https://github.com/Monadical-SAS/reflector/issues/846)) ([15ab2e3](https://github.com/Monadical-SAS/reflector/commit/15ab2e306eacf575494b4b5d2b2ad779d44a1c7f))
+
+
+### Bug Fixes
+
+* websocket tests ([#825](https://github.com/Monadical-SAS/reflector/issues/825)) ([1ce1c7a](https://github.com/Monadical-SAS/reflector/commit/1ce1c7a910b6c374115d2437b17f9d288ef094dc))
+
+## [0.32.2](https://github.com/Monadical-SAS/reflector/compare/v0.32.1...v0.32.2) (2026-02-03)
+
+
+### Bug Fixes
+
+* increase TIMEOUT_MEDIUM from 2m to 5m for LLM tasks ([#843](https://github.com/Monadical-SAS/reflector/issues/843)) ([4acde4b](https://github.com/Monadical-SAS/reflector/commit/4acde4b7fdef88cc02ca12cf38c9020b05ed96ac))
+* make caddy optional ([#841](https://github.com/Monadical-SAS/reflector/issues/841)) ([a2ed7d6](https://github.com/Monadical-SAS/reflector/commit/a2ed7d60d557b551a5b64e4dfd909b63a791d9fc))
+* use Daily API recording.duration as master source for transcript duration ([#844](https://github.com/Monadical-SAS/reflector/issues/844)) ([8707c66](https://github.com/Monadical-SAS/reflector/commit/8707c6694a80c939b6214bbc13331741f192e082))
+
+## [0.32.1](https://github.com/Monadical-SAS/reflector/compare/v0.32.0...v0.32.1) (2026-01-30)
+
+
+### Bug Fixes
+
+* daily multitrack pipeline finalze dependency fix ([23eb137](https://github.com/Monadical-SAS/reflector/commit/23eb1371cb9348c4b81eb12ad506b582f8a4799e))
+* match httpx pad with hatchet audio timeout ([c05d1f0](https://github.com/Monadical-SAS/reflector/commit/c05d1f03cd8369fc06efd455527e50246887efd0))
+
+## [0.32.0](https://github.com/Monadical-SAS/reflector/compare/v0.31.0...v0.32.0) (2026-01-30)
+
+
+### Features
+
+* modal padding ([#837](https://github.com/Monadical-SAS/reflector/issues/837)) ([7fde64e](https://github.com/Monadical-SAS/reflector/commit/7fde64e2529a1d37b0f7507c62d983a7bd0b5b89))
+
+## [0.31.0](https://github.com/Monadical-SAS/reflector/compare/v0.30.0...v0.31.0) (2026-01-23)
+
+
+### Features
+
+* mixdown optional ([#834](https://github.com/Monadical-SAS/reflector/issues/834)) ([fc3ef6c](https://github.com/Monadical-SAS/reflector/commit/fc3ef6c8933231c731fad84e7477a476a6220a5e))
+
+## [0.30.0](https://github.com/Monadical-SAS/reflector/compare/v0.29.0...v0.30.0) (2026-01-23)
+
+
+### Features
+
+* brady bunch ([#816](https://github.com/Monadical-SAS/reflector/issues/816)) ([6c175a1](https://github.com/Monadical-SAS/reflector/commit/6c175a11d8a3745095bfad06a4ad3ccdfd278433))
+
+## [0.29.0](https://github.com/Monadical-SAS/reflector/compare/v0.28.1...v0.29.0) (2026-01-21)
+
+
+### Features
+
+* set hatchet as default for multitracks ([#822](https://github.com/Monadical-SAS/reflector/issues/822)) ([c723752](https://github.com/Monadical-SAS/reflector/commit/c723752b7e15aa48a41ad22856f147a5517d3f46))
+
+## [0.28.1](https://github.com/Monadical-SAS/reflector/compare/v0.28.0...v0.28.1) (2026-01-21)
+
+
+### Bug Fixes
+
+* ics non-sync bugfix ([#823](https://github.com/Monadical-SAS/reflector/issues/823)) ([23d2bc2](https://github.com/Monadical-SAS/reflector/commit/23d2bc283d4d02187b250d2055103e0374ee93d6))
+
+## [0.28.0](https://github.com/Monadical-SAS/reflector/compare/v0.27.0...v0.28.0) (2026-01-20)
+
+
+### Features
+
+* worker affinity ([#819](https://github.com/Monadical-SAS/reflector/issues/819)) ([3b6540e](https://github.com/Monadical-SAS/reflector/commit/3b6540eae5b597449f98661bdf15483b77be3268))
+
 ## [0.27.0](https://github.com/Monadical-SAS/reflector/compare/v0.26.0...v0.27.0) (2025-12-26)
 
 

Caddyfile.example

@@ -1,6 +1,8 @@
-# Reflector Caddyfile
-# Replace example.com with your actual domains
-# CORS is handled by the backend - Caddy just proxies
+# Reflector Caddyfile (optional reverse proxy)
+# Use this only when you run Caddy via: docker compose -f docker-compose.prod.yml --profile caddy up -d
+# If Coolify, Traefik, or nginx already use ports 80/443, do NOT start Caddy; point your proxy at web:3000 and server:1250.
+#
+# Replace example.com with your actual domains. CORS is handled by the backend - Caddy just proxies.
 #
 # For environment variable substitution, set:
 #   FRONTEND_DOMAIN=app.example.com

Caddyfile.selfhosted.example

@@ -0,0 +1,25 @@
+# Reflector self-hosted production — HTTPS via Caddy reverse proxy
+# Copy to Caddyfile: cp Caddyfile.selfhosted.example Caddyfile
+# Run: ./scripts/setup-selfhosted.sh --ollama-gpu --garage --caddy
+#
+# DOMAIN defaults to localhost (self-signed cert).
+# Set to your real domain for automatic Let's Encrypt:
+#   export DOMAIN=reflector.example.com
+#
+# TLS_MODE defaults to "internal" (self-signed).
+# Set to "" for automatic Let's Encrypt (requires real domain + ports 80/443 open):
+#   export TLS_MODE=""
+
+{$DOMAIN:localhost} {
+    tls {$TLS_MODE:internal}
+
+    handle /v1/* {
+        reverse_proxy server:1250
+    }
+    handle /health {
+        reverse_proxy server:1250
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}

Caddyfile.standalone.example

@@ -0,0 +1,42 @@
+# Reflector standalone — HTTPS via Caddy (droplet / IP access)
+# Copy to Caddyfile: cp Caddyfile.standalone.example Caddyfile
+# Run: docker compose -f docker-compose.standalone.yml --profile ollama-cpu up -d
+#
+# :443 = catch-all inside container; Docker maps host port 3043 → container 443
+# on_demand = generate self-signed cert for IP/SNI on first request (required for bare IP access)
+# Browser will warn. Click Advanced → Proceed.
+# Access at https://localhost:3043 (or https://YOUR_IP:3043 on droplet)
+# Update www/.env.local with: API_URL=https://YOUR_IP:3043, WEBSOCKET_URL=wss://YOUR_IP:3043, SITE_URL=https://YOUR_IP:3043, NEXTAUTH_URL=https://YOUR_IP:3043
+
+:443 {
+    tls internal {
+        on_demand
+    }
+    handle /v1/* {
+        reverse_proxy server:1250
+    }
+    handle /health {
+        reverse_proxy server:1250
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}
+
+# Option B: localhost (comment Option A, uncomment this)
+# app.localhost {
+#     tls internal
+#     reverse_proxy web:3000
+# }
+# api.localhost {
+#     tls internal
+#     reverse_proxy server:1250
+# }
+
+# Option C: Real domain (uncomment and replace example.com)
+# app.example.com {
+#     reverse_proxy web:3000
+# }
+# api.example.com {
+#     reverse_proxy server:1250
+# }

docker-compose.prod.yml

@@ -1,9 +1,14 @@
 # Production Docker Compose configuration
 # Usage: docker compose -f docker-compose.prod.yml up -d
 #
+# Caddy (reverse proxy on ports 80/443) is OPTIONAL and behind the "caddy" profile:
+# - With Caddy (self-hosted, you manage SSL): docker compose -f docker-compose.prod.yml --profile caddy up -d
+# - Without Caddy (Coolify/Traefik/nginx already on 80/443): docker compose -f docker-compose.prod.yml up -d
+#   Then point your proxy at web:3000 (frontend) and server:1250 (API).
+#
 # Prerequisites:
 # 1. Copy .env.example to .env and configure for both server/ and www/
-# 2. Copy Caddyfile.example to Caddyfile and edit with your domains
+# 2. If using Caddy: copy Caddyfile.example to Caddyfile and edit your domains
 # 3. Deploy Modal GPU functions (see gpu/modal_deployments/deploy-all.sh)
 
 services:
@@ -84,6 +89,8 @@ services:
       retries: 3
 
   caddy:
+    profiles:
+      - caddy
     image: caddy:2-alpine
     restart: unless-stopped
     ports:

docker-compose.selfhosted.yml

@@ -0,0 +1,315 @@
+# Self-hosted production Docker Compose — single file for everything.
+#
+# Usage: ./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy
+#   or:  docker compose -f docker-compose.selfhosted.yml --profile gpu [--profile ollama-gpu] [--profile garage] [--profile caddy] up -d
+#
+# Specialized models (pick ONE — required):
+#   --profile gpu          NVIDIA GPU for transcription/diarization/translation
+#   --profile cpu          CPU-only for transcription/diarization/translation
+#
+# Local LLM (optional — for summarization/topics):
+#   --profile ollama-gpu   Local Ollama with NVIDIA GPU
+#   --profile ollama-cpu   Local Ollama on CPU only
+#
+# Other optional services:
+#   --profile garage       Local S3-compatible storage (Garage)
+#   --profile caddy        Reverse proxy with auto-SSL
+#
+# Prerequisites:
+#   1. Run ./scripts/setup-selfhosted.sh to generate env files and secrets
+#   2. Or manually create server/.env and www/.env from the .selfhosted.example templates
+
+services:
+  # ===========================================================
+  # Always-on core services (no profile required)
+  # ===========================================================
+
+  server:
+    build:
+      context: ./server
+      dockerfile: Dockerfile
+    image: monadicalsas/reflector-backend:latest
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:1250:1250"
+      - "50000-50100:50000-50100/udp"
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: server
+      # Docker-internal overrides (always correct inside compose network)
+      DATABASE_URL: postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
+      REDIS_HOST: redis
+      CELERY_BROKER_URL: redis://redis:6379/1
+      CELERY_RESULT_BACKEND: redis://redis:6379/1
+      HATCHET_CLIENT_SERVER_URL: ""
+      HATCHET_CLIENT_HOST_PORT: ""
+      # Specialized models via gpu/cpu container (aliased as "transcription")
+      TRANSCRIPT_BACKEND: modal
+      TRANSCRIPT_URL: http://transcription:8000
+      TRANSCRIPT_MODAL_API_KEY: selfhosted
+      DIARIZATION_BACKEND: modal
+      DIARIZATION_URL: http://transcription:8000
+      TRANSLATION_BACKEND: modal
+      TRANSLATE_URL: http://transcription:8000
+      # WebRTC: fixed UDP port range for ICE candidates (mapped above)
+      WEBRTC_PORT_RANGE: "50000-50100"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    volumes:
+      - server_data:/app/data
+
+  worker:
+    build:
+      context: ./server
+      dockerfile: Dockerfile
+    image: monadicalsas/reflector-backend:latest
+    restart: unless-stopped
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: worker
+      DATABASE_URL: postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
+      REDIS_HOST: redis
+      CELERY_BROKER_URL: redis://redis:6379/1
+      CELERY_RESULT_BACKEND: redis://redis:6379/1
+      HATCHET_CLIENT_SERVER_URL: ""
+      HATCHET_CLIENT_HOST_PORT: ""
+      TRANSCRIPT_BACKEND: modal
+      TRANSCRIPT_URL: http://transcription:8000
+      TRANSCRIPT_MODAL_API_KEY: selfhosted
+      DIARIZATION_BACKEND: modal
+      DIARIZATION_URL: http://transcription:8000
+      TRANSLATION_BACKEND: modal
+      TRANSLATE_URL: http://transcription:8000
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    volumes:
+      - server_data:/app/data
+
+  beat:
+    build:
+      context: ./server
+      dockerfile: Dockerfile
+    image: monadicalsas/reflector-backend:latest
+    restart: unless-stopped
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: beat
+      DATABASE_URL: postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
+      REDIS_HOST: redis
+      CELERY_BROKER_URL: redis://redis:6379/1
+      CELERY_RESULT_BACKEND: redis://redis:6379/1
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+
+  web:
+    build:
+      context: ./www
+      dockerfile: Dockerfile
+    image: monadicalsas/reflector-frontend:latest
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:3000:3000"
+    env_file:
+      - ./www/.env
+    environment:
+      NODE_ENV: production
+      SERVER_API_URL: http://server:1250
+      KV_URL: redis://redis:6379
+      KV_USE_TLS: "false"
+      AUTHENTIK_ISSUER: ""
+      AUTHENTIK_REFRESH_TOKEN_URL: ""
+    depends_on:
+      - redis
+
+  redis:
+    image: redis:7.2-alpine
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+    volumes:
+      - redis_data:/data
+
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: reflector
+      POSTGRES_PASSWORD: reflector
+      POSTGRES_DB: reflector
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U reflector"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+
+  # ===========================================================
+  # Specialized model containers (transcription, diarization, translation)
+  # Both gpu and cpu get alias "transcription" so server config never changes.
+  # ===========================================================
+
+  gpu:
+    build:
+      context: ./gpu/self_hosted
+      dockerfile: Dockerfile
+    profiles: [gpu]
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8000:8000"
+    environment:
+      HF_TOKEN: ${HF_TOKEN:-}
+    volumes:
+      - gpu_cache:/root/.cache
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/docs"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 120s
+    networks:
+      default:
+        aliases:
+          - transcription
+
+  cpu:
+    build:
+      context: ./gpu/self_hosted
+      dockerfile: Dockerfile.cpu
+    profiles: [cpu]
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8000:8000"
+    environment:
+      HF_TOKEN: ${HF_TOKEN:-}
+    volumes:
+      - gpu_cache:/root/.cache
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/docs"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 120s
+    networks:
+      default:
+        aliases:
+          - transcription
+
+  # ===========================================================
+  # Ollama — local LLM for summarization & topic detection
+  # Only started with --ollama-gpu or --ollama-cpu modes.
+  # ===========================================================
+
+  ollama:
+    image: ollama/ollama:latest
+    profiles: [ollama-gpu]
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:11434:11434"
+    volumes:
+      - ollama_data:/root/.ollama
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:11434/api/tags"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  ollama-cpu:
+    image: ollama/ollama:latest
+    profiles: [ollama-cpu]
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:11434:11434"
+    volumes:
+      - ollama_data:/root/.ollama
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:11434/api/tags"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # ===========================================================
+  # Garage — local S3-compatible object storage (optional)
+  # ===========================================================
+
+  garage:
+    image: dxflrs/garage:v1.1.0
+    profiles: [garage]
+    restart: unless-stopped
+    ports:
+      - "3900:3900"   # S3 API
+      - "3903:3903"   # Admin API
+    volumes:
+      - garage_data:/var/lib/garage/data
+      - garage_meta:/var/lib/garage/meta
+      - ./data/garage.toml:/etc/garage.toml:ro
+    healthcheck:
+      test: ["CMD", "/garage", "stats"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+
+  # ===========================================================
+  # Caddy — reverse proxy with automatic SSL (optional)
+  # Maps 80:80 and 443:443 — only exposed ports in the stack.
+  # ===========================================================
+
+  caddy:
+    image: caddy:2-alpine
+    profiles: [caddy]
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - web
+      - server
+
+volumes:
+  postgres_data:
+  redis_data:
+  server_data:
+  gpu_cache:
+  garage_data:
+  garage_meta:
+  ollama_data:
+  caddy_data:
+  caddy_config:
+
+networks:
+  default:
+    attachable: true

docker-compose.standalone.yml

@@ -0,0 +1,241 @@
+# Self-contained standalone compose for fully local deployment (no external dependencies).
+# Usage: docker compose -f docker-compose.standalone.yml up -d
+#
+# On Linux with NVIDIA GPU, also pass: --profile ollama-gpu
+# On Linux without GPU:                --profile ollama-cpu
+# On Mac: Ollama runs natively (Metal GPU) — no profile needed, services here unused.
+
+services:
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "3043:443"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - web
+      - server
+
+  server:
+    build:
+      context: server
+    ports:
+      - "1250:1250"
+      - "50000-50100:50000-50100/udp"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - ./server/:/app/
+      - /app/.venv
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: server
+      # Docker DNS names instead of localhost
+      DATABASE_URL: postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
+      REDIS_HOST: redis
+      CELERY_BROKER_URL: redis://redis:6379/1
+      CELERY_RESULT_BACKEND: redis://redis:6379/1
+      # Standalone doesn't run Hatchet
+      HATCHET_CLIENT_SERVER_URL: ""
+      HATCHET_CLIENT_HOST_PORT: ""
+      # Self-hosted transcription/diarization via CPU service
+      TRANSCRIPT_BACKEND: modal
+      TRANSCRIPT_URL: http://cpu:8000
+      TRANSCRIPT_MODAL_API_KEY: local
+      DIARIZATION_BACKEND: modal
+      DIARIZATION_URL: http://cpu:8000
+      # Caddy reverse proxy prefix
+      ROOT_PATH: /server-api
+      # WebRTC: fixed UDP port range for ICE candidates (mapped above).
+      # WEBRTC_HOST is set by setup-standalone.sh in server/.env (LAN IP detection).
+      WEBRTC_PORT_RANGE: "50000-50100"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+
+  worker:
+    build:
+      context: server
+    volumes:
+      - ./server/:/app/
+      - /app/.venv
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: worker
+      HATCHET_CLIENT_SERVER_URL: ""
+      HATCHET_CLIENT_HOST_PORT: ""
+      TRANSCRIPT_BACKEND: modal
+      TRANSCRIPT_URL: http://cpu:8000
+      TRANSCRIPT_MODAL_API_KEY: local
+      DIARIZATION_BACKEND: modal
+      DIARIZATION_URL: http://cpu:8000
+    depends_on:
+      redis:
+        condition: service_started
+
+  beat:
+    build:
+      context: server
+    volumes:
+      - ./server/:/app/
+      - /app/.venv
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: beat
+    depends_on:
+      redis:
+        condition: service_started
+
+  redis:
+    image: redis:7.2
+    ports:
+      - 6379:6379
+
+  postgres:
+    image: postgres:17
+    command: postgres -c 'max_connections=200'
+    ports:
+      - 5432:5432
+    environment:
+      POSTGRES_USER: reflector
+      POSTGRES_PASSWORD: reflector
+      POSTGRES_DB: reflector
+    volumes:
+      - ./data/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d reflector -U reflector"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 15s
+
+  web:
+    image: reflector-frontend-standalone
+    build:
+      context: ./www
+    ports:
+      - "3000:3000"
+    command: ["node", "server.js"]
+    env_file:
+      - ./www/.env.local
+    environment:
+      NODE_ENV: production
+      # API_URL, WEBSOCKET_URL, SITE_URL, NEXTAUTH_URL from www/.env.local (allows HTTPS)
+      # Server-side URLs (docker-network internal)
+      SERVER_API_URL: http://server:1250
+      KV_URL: redis://redis:6379
+      KV_USE_TLS: "false"
+      # Standalone: no external auth provider
+      FEATURE_REQUIRE_LOGIN: "false"
+      FEATURE_ROOMS: "false"
+      NEXTAUTH_SECRET: standalone-local-secret
+      # Nullify partial auth vars inherited from base env_file
+      AUTHENTIK_ISSUER: ""
+      AUTHENTIK_REFRESH_TOKEN_URL: ""
+
+  garage:
+    image: dxflrs/garage:v1.1.0
+    ports:
+      - "3900:3900"   # S3 API
+      - "3903:3903"   # Admin API
+    volumes:
+      - garage_data:/var/lib/garage/data
+      - garage_meta:/var/lib/garage/meta
+      - ./data/garage.toml:/etc/garage.toml:ro
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "/garage", "stats"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+
+  cpu:
+    build:
+      context: ./gpu/self_hosted
+      dockerfile: Dockerfile.cpu
+    ports:
+      - "8100:8000"
+    volumes:
+      - gpu_cache:/root/.cache
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/docs"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 120s
+
+  gpu-nvidia:
+    build:
+      context: ./gpu/self_hosted
+    profiles: ["gpu-nvidia"]
+    volumes:
+      - gpu_cache:/root/.cache
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/docs"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 120s
+
+  ollama:
+    image: ollama/ollama:latest
+    profiles: ["ollama-gpu"]
+    ports:
+      - "11434:11434"
+    volumes:
+      - ollama_data:/root/.ollama
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:11434/api/tags"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  ollama-cpu:
+    image: ollama/ollama:latest
+    profiles: ["ollama-cpu"]
+    ports:
+      - "11434:11434"
+    volumes:
+      - ollama_data:/root/.ollama
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:11434/api/tags"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  garage_data:
+  garage_meta:
+  ollama_data:
+  gpu_cache:
+  caddy_data:
+  caddy_config:

docker-compose.yml

@@ -2,8 +2,7 @@ services:
   server:
     build:
       context: server
-    ports:
-      - 1250:1250
+    network_mode: host
     volumes:
       - ./server/:/app/
       - /app/.venv
@@ -11,6 +10,12 @@ services:
       - ./server/.env
     environment:
       ENTRYPOINT: server
+      DATABASE_URL: postgresql+asyncpg://reflector:reflector@localhost:5432/reflector
+      REDIS_HOST: localhost
+      CELERY_BROKER_URL: redis://localhost:6379/1
+      CELERY_RESULT_BACKEND: redis://localhost:6379/1
+      HATCHET_CLIENT_SERVER_URL: http://localhost:8889
+      HATCHET_CLIENT_HOST_PORT: localhost:7078
 
   worker:
     build:
@@ -22,6 +27,11 @@ services:
       - ./server/.env
     environment:
       ENTRYPOINT: worker
+      HATCHET_CLIENT_SERVER_URL: http://hatchet:8888
+      HATCHET_CLIENT_HOST_PORT: hatchet:7077
+    depends_on:
+      redis:
+        condition: service_started
 
   beat:
     build:
@@ -33,8 +43,11 @@ services:
       - ./server/.env
     environment:
       ENTRYPOINT: beat
+    depends_on:
+      redis:
+        condition: service_started
 
-  hatchet-worker:
+  hatchet-worker-cpu:
     build:
       context: server
     volumes:
@@ -43,7 +56,24 @@ services:
     env_file:
       - ./server/.env
     environment:
-      ENTRYPOINT: hatchet-worker
+      ENTRYPOINT: hatchet-worker-cpu
+      HATCHET_CLIENT_SERVER_URL: http://hatchet:8888
+      HATCHET_CLIENT_HOST_PORT: hatchet:7077
+    depends_on:
+      hatchet:
+        condition: service_healthy
+  hatchet-worker-llm:
+    build:
+      context: server
+    volumes:
+      - ./server/:/app/
+      - /app/.venv
+    env_file:
+      - ./server/.env
+    environment:
+      ENTRYPOINT: hatchet-worker-llm
+      HATCHET_CLIENT_SERVER_URL: http://hatchet:8888
+      HATCHET_CLIENT_HOST_PORT: hatchet:7077
     depends_on:
       hatchet:
         condition: service_healthy
@@ -62,10 +92,16 @@ services:
     volumes:
       - ./www:/app/
       - /app/node_modules
+      - next_cache:/app/.next
     env_file:
       - ./www/.env.local
     environment:
       - NODE_ENV=development
+      - SERVER_API_URL=http://host.docker.internal:1250
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    depends_on:
+      - server
 
   postgres:
     image: postgres:17
@@ -81,13 +117,14 @@ services:
       - ./server/docker/init-hatchet-db.sql:/docker-entrypoint-initdb.d/init-hatchet-db.sql:ro
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -d reflector -U reflector"]
-      interval: 10s
-      timeout: 10s
-      retries: 5
-      start_period: 10s
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 15s
 
   hatchet:
     image: ghcr.io/hatchet-dev/hatchet/hatchet-lite:latest
+    restart: on-failure
     ports:
       - "8889:8888"
       - "7078:7077"
@@ -95,7 +132,7 @@ services:
       postgres:
         condition: service_healthy
     environment:
-      DATABASE_URL: "postgresql://reflector:reflector@postgres:5432/hatchet?sslmode=disable"
+      DATABASE_URL: "postgresql://reflector:reflector@postgres:5432/hatchet?sslmode=disable&connect_timeout=30"
       SERVER_AUTH_COOKIE_DOMAIN: localhost
       SERVER_AUTH_COOKIE_INSECURE: "t"
       SERVER_GRPC_BIND_ADDRESS: "0.0.0.0"
@@ -115,6 +152,5 @@ services:
       retries: 5
       start_period: 30s
 
-networks:
-  default:
-    attachable: true
+volumes:
+  next_cache:

docs/docs/installation/docker-setup.md

@@ -11,15 +11,15 @@ This page documents the Docker Compose configuration for Reflector. For the comp
 
 The `docker-compose.prod.yml` includes these services:
 
-| Service | Image | Purpose |
-|---------|-------|---------|
-| `web` | `monadicalsas/reflector-frontend` | Next.js frontend |
-| `server` | `monadicalsas/reflector-backend` | FastAPI backend |
-| `worker` | `monadicalsas/reflector-backend` | Celery worker for background tasks |
-| `beat` | `monadicalsas/reflector-backend` | Celery beat scheduler |
-| `redis` | `redis:7.2-alpine` | Message broker and cache |
-| `postgres` | `postgres:17-alpine` | Primary database |
-| `caddy` | `caddy:2-alpine` | Reverse proxy with auto-SSL |
+| Service    | Image                             | Purpose                                                                     |
+| ---------- | --------------------------------- | --------------------------------------------------------------------------- |
+| `web`      | `monadicalsas/reflector-frontend` | Next.js frontend                                                            |
+| `server`   | `monadicalsas/reflector-backend`  | FastAPI backend                                                             |
+| `worker`   | `monadicalsas/reflector-backend`  | Celery worker for background tasks                                          |
+| `beat`     | `monadicalsas/reflector-backend`  | Celery beat scheduler                                                       |
+| `redis`    | `redis:7.2-alpine`                | Message broker and cache                                                    |
+| `postgres` | `postgres:17-alpine`              | Primary database                                                            |
+| `caddy`    | `caddy:2-alpine`                  | Reverse proxy with auto-SSL (optional; see [Caddy profile](#caddy-profile)) |
 
 ## Environment Files
 
@@ -30,6 +30,7 @@ Reflector uses two separate environment files:
 Used by: `server`, `worker`, `beat`
 
 Key variables:
+
 ```env
 # Database connection
 DATABASE_URL=postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
@@ -54,6 +55,7 @@ TRANSCRIPT_MODAL_API_KEY=...
 Used by: `web`
 
 Key variables:
+
 ```env
 # Domain configuration
 SITE_URL=https://app.example.com
@@ -70,26 +72,42 @@ Note: `API_URL` is used client-side (browser), `SERVER_API_URL` is used server-s
 
 ## Volumes
 
-| Volume | Purpose |
-|--------|---------|
-| `redis_data` | Redis persistence |
-| `postgres_data` | PostgreSQL data |
-| `server_data` | Uploaded files, local storage |
-| `caddy_data` | SSL certificates |
-| `caddy_config` | Caddy configuration |
+| Volume          | Purpose                       |
+| --------------- | ----------------------------- |
+| `redis_data`    | Redis persistence             |
+| `postgres_data` | PostgreSQL data               |
+| `server_data`   | Uploaded files, local storage |
+| `caddy_data`    | SSL certificates              |
+| `caddy_config`  | Caddy configuration           |
 
 ## Network
 
 All services share the default network. The network is marked `attachable: true` to allow external containers (like Authentik) to join.
 
+## Caddy profile
+
+Caddy (ports 80 and 443) is **optional** and behind the `caddy` profile so it does not conflict with an existing reverse proxy (e.g. Coolify, Traefik, nginx).
+
+- **With Caddy** (you want Reflector to handle SSL):
+  `docker compose -f docker-compose.prod.yml --profile caddy up -d`
+- **Without Caddy** (Coolify or another proxy already on 80/443):
+  `docker compose -f docker-compose.prod.yml up -d`
+  Then configure your proxy to send traffic to `web:3000` (frontend) and `server:1250` (API).
+
 ## Common Commands
 
 ### Start all services
+
 ```bash
+# Without Caddy (e.g. when using Coolify)
 docker compose -f docker-compose.prod.yml up -d
+
+# With Caddy as reverse proxy
+docker compose -f docker-compose.prod.yml --profile caddy up -d
 ```
 
 ### View logs
+
 ```bash
 # All services
 docker compose -f docker-compose.prod.yml logs -f
@@ -99,6 +117,7 @@ docker compose -f docker-compose.prod.yml logs server --tail 50
 ```
 
 ### Restart a service
+
 ```bash
 # Quick restart (doesn't reload .env changes)
 docker compose -f docker-compose.prod.yml restart server
@@ -108,27 +127,32 @@ docker compose -f docker-compose.prod.yml up -d server
 ```
 
 ### Run database migrations
+
 ```bash
 docker compose -f docker-compose.prod.yml exec server uv run alembic upgrade head
 ```
 
 ### Access database
+
 ```bash
 docker compose -f docker-compose.prod.yml exec postgres psql -U reflector
 ```
 
 ### Pull latest images
+
 ```bash
 docker compose -f docker-compose.prod.yml pull
 docker compose -f docker-compose.prod.yml up -d
 ```
 
 ### Stop all services
+
 ```bash
 docker compose -f docker-compose.prod.yml down
 ```
 
 ### Full reset (WARNING: deletes data)
+
 ```bash
 docker compose -f docker-compose.prod.yml down -v
 ```
@@ -187,6 +211,7 @@ The Caddyfile supports environment variable substitution:
 Set `FRONTEND_DOMAIN` and `API_DOMAIN` environment variables, or edit the file directly.
 
 ### Reload Caddy after changes
+
 ```bash
 docker compose -f docker-compose.prod.yml exec caddy caddy reload --config /etc/caddy/Caddyfile
 ```

docs/docs/installation/overview.md

@@ -26,7 +26,7 @@ flowchart LR
 
 Before starting, you need:
 
-- **Production server** -  4+ cores, 8GB+ RAM, public IP
+- **Production server** - 4+ cores, 8GB+ RAM, public IP
 - **Two domain names** - e.g., `app.example.com` (frontend) and `api.example.com` (backend)
 - **GPU processing** - Choose one:
   - Modal.com account, OR
@@ -60,16 +60,17 @@ Type: A    Name: api    Value: <your-server-ip>
 
 Reflector requires GPU processing for transcription and speaker diarization. Choose one option:
 
-| | **Modal.com (Cloud)** | **Self-Hosted GPU** |
-|---|---|---|
+|              | **Modal.com (Cloud)**             | **Self-Hosted GPU**          |
+| ------------ | --------------------------------- | ---------------------------- |
 | **Best for** | No GPU hardware, zero maintenance | Own GPU server, full control |
-| **Pricing** | Pay-per-use | Fixed infrastructure cost |
+| **Pricing**  | Pay-per-use                       | Fixed infrastructure cost    |
 
 ### Option A: Modal.com (Serverless Cloud GPU)
 
 #### Accept HuggingFace Licenses
 
 Visit both pages and click "Accept":
+
 - https://huggingface.co/pyannote/speaker-diarization-3.1
 - https://huggingface.co/pyannote/segmentation-3.0
 
@@ -179,6 +180,7 @@ Save these credentials - you'll need them in the next step.
 ## Configure Environment
 
 Reflector has two env files:
+
 - `server/.env` - Backend configuration
 - `www/.env` - Frontend configuration
 
@@ -190,6 +192,7 @@ nano server/.env
 ```
 
 **Required settings:**
+
 ```env
 # Database (defaults work with docker-compose.prod.yml)
 DATABASE_URL=postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
@@ -249,6 +252,7 @@ nano www/.env
 ```
 
 **Required settings:**
+
 ```env
 # Your domains
 SITE_URL=https://app.example.com
@@ -266,7 +270,11 @@ FEATURE_REQUIRE_LOGIN=false
 
 ---
 
-## Configure Caddy
+## Reverse proxy (Caddy or existing)
+
+**If Coolify, Traefik, or nginx already use ports 80/443** (e.g. Coolify on your host): skip Caddy. Start the stack without the Caddy profile (see [Start Services](#start-services) below), then point your proxy at `web:3000` (frontend) and `server:1250` (API).
+
+**If you want Reflector to provide the reverse proxy and SSL:**
 
 ```bash
 cp Caddyfile.example Caddyfile
@@ -289,10 +297,18 @@ Replace `example.com` with your domains. The `{$VAR:default}` syntax uses Caddy'
 
 ## Start Services
 
+**Without Caddy** (e.g. Coolify already on 80/443):
+
 ```bash
 docker compose -f docker-compose.prod.yml up -d
 ```
 
+**With Caddy** (Reflector handles SSL):
+
+```bash
+docker compose -f docker-compose.prod.yml --profile caddy up -d
+```
+
 Wait for containers to start (first run may take 1-2 minutes to pull images and initialize).
 
 ---
@@ -300,18 +316,21 @@ Wait for containers to start (first run may take 1-2 minutes to pull images and
 ## Verify Deployment
 
 ### Check services
+
 ```bash
 docker compose -f docker-compose.prod.yml ps
 # All should show "Up"
 ```
 
 ### Test API
+
 ```bash
 curl https://api.example.com/health
 # Should return: {"status":"healthy"}
 ```
 
 ### Test Frontend
+
 - Visit https://app.example.com
 - You should see the Reflector interface
 - Try uploading an audio file to test transcription
@@ -327,6 +346,7 @@ By default, Reflector is open (no login required). **Authentication is required
 See [Authentication Setup](./auth-setup) for full Authentik OAuth configuration.
 
 Quick summary:
+
 1. Deploy Authentik on your server
 2. Create OAuth provider in Authentik
 3. Extract public key for JWT verification
@@ -358,6 +378,7 @@ DAILYCO_STORAGE_AWS_ROLE_ARN=<arn:aws:iam::ACCOUNT:role/DailyCo>
 ```
 
 Reload env and restart:
+
 ```bash
 docker compose -f docker-compose.prod.yml up -d server worker
 ```
@@ -367,35 +388,43 @@ docker compose -f docker-compose.prod.yml up -d server worker
 ## Troubleshooting
 
 ### Check logs for errors
+
 ```bash
 docker compose -f docker-compose.prod.yml logs server --tail 20
 docker compose -f docker-compose.prod.yml logs worker --tail 20
 ```
 
 ### Services won't start
+
 ```bash
 docker compose -f docker-compose.prod.yml logs
 ```
 
 ### CORS errors in browser
+
 - Verify `CORS_ORIGIN` in `server/.env` matches your frontend domain exactly (including `https://`)
 - Reload env: `docker compose -f docker-compose.prod.yml up -d server`
 
-### SSL certificate errors
+### SSL certificate errors (when using Caddy)
+
 - Caddy auto-provisions Let's Encrypt certificates
-- Ensure ports 80 and 443 are open
+- Ensure ports 80 and 443 are open and not used by another proxy
 - Check: `docker compose -f docker-compose.prod.yml logs caddy`
+- If port 80 is already in use (e.g. by Coolify), run without Caddy: `docker compose -f docker-compose.prod.yml up -d` and use your existing proxy
 
 ### Transcription not working
+
 - Check Modal dashboard: https://modal.com/apps
 - Verify URLs in `server/.env` match deployed functions
 - Check worker logs: `docker compose -f docker-compose.prod.yml logs worker`
 
 ### "Login required" but auth not configured
+
 - Set `FEATURE_REQUIRE_LOGIN=false` in `www/.env`
 - Rebuild frontend: `docker compose -f docker-compose.prod.yml up -d --force-recreate web`
 
 ### Database migrations or connectivity issues
+
 Migrations run automatically on server startup. To check database connectivity or debug migration failures:
 
 ```bash
@@ -408,4 +437,3 @@ docker compose -f docker-compose.prod.yml exec server uv run python -c "from ref
 # Manually run migrations (if needed)
 docker compose -f docker-compose.prod.yml exec server uv run alembic upgrade head
 ```
-

docs/docs/installation/setup-standalone.md

@@ -0,0 +1,310 @@
+---
+sidebar_position: 2
+title: Standalone Local Setup
+---
+
+# Standalone Local Setup
+
+**The goal**: a clueless user clones the repo, runs one script, and has a working Reflector instance locally. No cloud accounts, no API keys, no manual env file editing.
+
+```bash
+git clone https://github.com/monadical-sas/reflector.git
+cd reflector
+./scripts/setup-standalone.sh
+```
+
+On Ubuntu, the setup script installs Docker automatically if missing.
+
+The script is idempotent — safe to re-run at any time. It detects what's already set up and skips completed steps.
+
+## Prerequisites
+
+- Docker with Compose V2 plugin (Docker Desktop, OrbStack, or Docker Engine + compose plugin)
+- Mac (Apple Silicon) or Linux
+- 16GB+ RAM (32GB recommended for 14B LLM models)
+- **Mac only**: [Ollama](https://ollama.com/download) installed (`brew install ollama`)
+
+### Installing Docker (if not already installed)
+
+**Ubuntu**: The setup script runs `install-docker-ubuntu.sh` automatically when Docker is missing. Or run it manually:
+
+```bash
+./scripts/install-docker-ubuntu.sh
+```
+
+**Mac**: Install [Docker Desktop](https://www.docker.com/products/docker-desktop/) or [OrbStack](https://orbstack.dev/).
+
+## What the script does
+
+### 1. LLM inference via Ollama
+
+**Mac**: starts Ollama natively (Metal GPU acceleration). Pulls the LLM model. Docker containers reach it via `host.docker.internal:11434`.
+
+**Linux**: starts containerized Ollama via `docker-compose.standalone.yml` profile (`ollama-gpu` with NVIDIA, `ollama-cpu` without). Pulls model inside the container.
+
+### 2. Environment files
+
+Generates `server/.env` and `www/.env.local` with standalone defaults:
+
+**`server/.env`** — key settings:
+
+| Variable              | Value                                              | Why                                 |
+| --------------------- | -------------------------------------------------- | ----------------------------------- |
+| `DATABASE_URL`        | `postgresql+asyncpg://...@postgres:5432/reflector` | Docker-internal hostname            |
+| `REDIS_HOST`          | `redis`                                            | Docker-internal hostname            |
+| `CELERY_BROKER_URL`   | `redis://redis:6379/1`                             | Docker-internal hostname            |
+| `AUTH_BACKEND`        | `none`                                             | No Authentik in standalone          |
+| `TRANSCRIPT_BACKEND`  | `modal`                                            | HTTP API to self-hosted CPU service |
+| `TRANSCRIPT_URL`      | `http://cpu:8000`                                  | Docker-internal CPU service         |
+| `DIARIZATION_BACKEND` | `modal`                                            | HTTP API to self-hosted CPU service |
+| `DIARIZATION_URL`     | `http://cpu:8000`                                  | Docker-internal CPU service         |
+| `TRANSLATION_BACKEND` | `passthrough`                                      | No Modal                            |
+| `LLM_URL`             | `http://host.docker.internal:11434/v1` (Mac)       | Ollama endpoint                     |
+
+**`www/.env.local`** — key settings:
+
+| Variable                | Value                                      |
+| ----------------------- | ------------------------------------------ |
+| `API_URL`               | `https://localhost:3043` or `https://YOUR_IP:3043` (Linux) |
+| `SERVER_API_URL`        | `http://server:1250`                       |
+| `WEBSOCKET_URL`         | `auto`                                    |
+| `FEATURE_REQUIRE_LOGIN` | `false`                                    |
+| `NEXTAUTH_SECRET`       | `standalone-dev-secret-not-for-production` |
+
+If env files already exist (including symlinks from worktree setup), the script resolves symlinks and ensures all standalone-critical vars are set. Existing vars not related to standalone are preserved.
+
+### 3. Object storage (Garage)
+
+Standalone uses [Garage](https://garagehq.deuxfleurs.fr/) — a lightweight S3-compatible object store running in Docker. The setup script starts Garage, initializes the layout, creates a bucket and access key, and writes the credentials to `server/.env`.
+
+**`server/.env`** — storage settings added by the script:
+
+| Variable                                   | Value                | Why                                   |
+| ------------------------------------------ | -------------------- | ------------------------------------- |
+| `TRANSCRIPT_STORAGE_BACKEND`               | `aws`                | Uses the S3-compatible storage driver |
+| `TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL`      | `http://garage:3900` | Docker-internal Garage S3 API         |
+| `TRANSCRIPT_STORAGE_AWS_BUCKET_NAME`       | `reflector-media`    | Created by the script                 |
+| `TRANSCRIPT_STORAGE_AWS_REGION`            | `garage`             | Must match Garage config              |
+| `TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID`     | _(auto-generated)_   | Created by `garage key create`        |
+| `TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY` | _(auto-generated)_   | Created by `garage key create`        |
+
+The `TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL` setting enables S3-compatible backends. When set, the storage driver uses path-style addressing and routes all requests to the custom endpoint. When unset (production AWS), behavior is unchanged.
+
+Garage config template lives at `scripts/garage.toml`. The setup script generates `data/garage.toml` (gitignored) with a random RPC secret and mounts it read-only into the container. Single-node, `replication_factor=1`.
+
+> **Note**: Presigned URLs embed the Garage Docker hostname (`http://garage:3900`). This is fine — the server proxies S3 responses to the browser. Modal GPU workers cannot reach internal Garage, but standalone doesn't use Modal.
+
+### 4. Transcription and diarization
+
+Standalone runs the self-hosted ML service (`gpu/self_hosted/`) in a CPU-only Docker container named `cpu`. This is the same FastAPI service used for Modal.com GPU deployments, but built with `Dockerfile.cpu` (no NVIDIA CUDA dependencies). The compose service is named `cpu` (not `gpu`) to make clear it runs without GPU acceleration; the source code lives in `gpu/self_hosted/` because it's shared with the GPU deployment.
+
+The `modal` backend name is reused — it just means "HTTP API client". Setting `TRANSCRIPT_URL` / `DIARIZATION_URL` to `http://cpu:8000` routes requests to the local container instead of Modal.com.
+
+On first start, the service downloads pyannote speaker diarization models (~1GB) from a public S3 bundle. Models are cached in a Docker volume (`gpu_cache`) so subsequent starts are fast. No HuggingFace token or API key needed.
+
+> **Performance**: CPU-only transcription and diarization work but are slow (~15 min for a 3 min file). For faster processing on Linux with NVIDIA GPU, use `--profile gpu-nvidia` instead (see `docker-compose.standalone.yml`).
+
+### 5. Docker services
+
+```bash
+docker compose up -d postgres redis garage cpu server worker beat web
+```
+
+All services start in a single command. Garage and `cpu` are already started by earlier steps but included for idempotency. No Hatchet in standalone mode — LLM processing (summaries, topics, titles) runs via Celery tasks.
+
+### 6. Database migrations
+
+Run automatically by the `server` container on startup (`runserver.sh` calls `alembic upgrade head`). No manual step needed.
+
+### 7. Health check
+
+Verifies:
+
+- CPU service responds (transcription + diarization ready)
+- Server responds at `http://localhost:1250/health`
+- Frontend serves at `http://localhost:3000` (or via Caddy at `https://localhost:3043`)
+- LLM endpoint reachable from inside containers
+
+## Services
+
+| Service    | Port       | Purpose                                            |
+| ---------- | ---------- | -------------------------------------------------- |
+| `caddy`    | 3043       | Reverse proxy (HTTPS, self-signed cert)            |
+| `server`   | 1250       | FastAPI backend (runs migrations on start)         |
+| `web`      | 3000       | Next.js frontend                                   |
+| `postgres` | 5432       | PostgreSQL database                                |
+| `redis`    | 6379       | Cache + Celery broker                              |
+| `garage`   | 3900, 3903 | S3-compatible object storage (S3 API + admin API)  |
+| `cpu`      | —          | Self-hosted transcription + diarization (CPU-only) |
+| `worker`   | —          | Celery worker (live pipeline post-processing)      |
+| `beat`     | —          | Celery beat (scheduled tasks)                      |
+
+## Testing programmatically
+
+After the setup script completes, verify the full pipeline (upload, transcription, diarization, LLM summary) via the API:
+
+```bash
+# 1. Create a transcript
+TRANSCRIPT_ID=$(curl -s -X POST 'http://localhost:1250/v1/transcripts' \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"test-upload"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+echo "Created: $TRANSCRIPT_ID"
+
+# 2. Upload an audio file (single-chunk upload)
+curl -s "http://localhost:1250/v1/transcripts/${TRANSCRIPT_ID}/record/upload?chunk_number=0&total_chunks=1" \
+  -X POST -F "chunk=@/path/to/audio.mp3"
+
+# 3. Poll until processing completes (status: ended or error)
+while true; do
+  STATUS=$(curl -s "http://localhost:1250/v1/transcripts/${TRANSCRIPT_ID}" \
+    | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
+  echo "Status: $STATUS"
+  case "$STATUS" in ended|error) break;; esac
+  sleep 10
+done
+
+# 4. Check the result
+curl -s "http://localhost:1250/v1/transcripts/${TRANSCRIPT_ID}" | python3 -m json.tool
+```
+
+Expected result: status `ended`, auto-generated `title`, `short_summary`, `long_summary`, and `transcript` text with `Speaker 0` / `Speaker 1` labels.
+
+CPU-only processing is slow (~15 min for a 3 min audio file). Diarization finishes in ~3 min, transcription takes the rest.
+
+## Enabling HTTPS (droplet via IP)
+
+To serve Reflector over HTTPS on a droplet accessed by IP (self-signed certificate):
+
+1. **Copy the Caddyfile** (no edits needed — `:443` catches all HTTPS inside container, mapped to host port 3043):
+   ```bash
+   cp Caddyfile.standalone.example Caddyfile
+   ```
+
+2. **Update `www/.env.local`** with HTTPS URLs (port 3043):
+   ```env
+   API_URL=https://YOUR_IP:3043
+   WEBSOCKET_URL=wss://YOUR_IP:3043
+   SITE_URL=https://YOUR_IP:3043
+   NEXTAUTH_URL=https://YOUR_IP:3043
+   ```
+
+3. **Restart services**:
+   ```bash
+   docker compose -f docker-compose.standalone.yml --profile ollama-cpu up -d
+   ```
+   (Use `ollama-gpu` instead of `ollama-cpu` if you have an NVIDIA GPU.)
+
+4. **Access** at `https://YOUR_IP:3043`. The browser will warn about the self-signed cert — click **Advanced** → **Proceed to YOUR_IP (unsafe)**. All traffic (page, API, WebSocket) uses the same origin, so accepting once is enough.
+
+## Troubleshooting
+
+### ERR_SSL_PROTOCOL_ERROR when accessing https://YOUR_IP
+
+You do **not** need a domain — the setup works with an IP address. This error usually means Caddy isn't serving TLS on port 3043. Check in order:
+
+1. **Caddyfile** — must use the `:443` catch-all (container-internal; Docker maps host 3043 → container 443):
+   ```bash
+   cp Caddyfile.standalone.example Caddyfile
+   ```
+
+2. **Firewall** — allow port 3043 (common on DigitalOcean):
+   ```bash
+   sudo ufw allow 3043
+   sudo ufw status
+   ```
+
+3. **Caddy running** — verify and restart:
+   ```bash
+   docker compose -f docker-compose.standalone.yml ps
+   docker compose -f docker-compose.standalone.yml logs caddy --tail 20
+   docker compose -f docker-compose.standalone.yml --profile ollama-cpu up -d
+   ```
+
+4. **Test from the droplet** — if this works, the issue is external (firewall, network):
+   ```bash
+   curl -vk https://localhost:3043
+   ```
+
+5. **localhost works but external IP fails** — Re-run the setup script; it generates a Caddyfile with your droplet IP explicitly, so Caddy provisions the cert at startup:
+   ```bash
+   ./scripts/setup-standalone.sh
+   ```
+   Or manually create `Caddyfile` with your IP (replace 138.197.162.116):
+   ```
+   https://138.197.162.116, localhost {
+       tls internal
+       handle /v1/* { reverse_proxy server:1250 }
+       handle /health { reverse_proxy server:1250 }
+       handle { reverse_proxy web:3000 }
+   }
+   ```
+   Then restart: `docker compose -f docker-compose.standalone.yml --profile ollama-cpu up -d`
+
+6. **Still failing?** Try HTTP (no TLS) — create `Caddyfile`:
+   ```
+   :80 {
+       handle /v1/* { reverse_proxy server:1250 }
+       handle /health { reverse_proxy server:1250 }
+       handle { reverse_proxy web:3000 }
+   }
+   ```
+   Update `www/.env.local`: `API_URL=http://YOUR_IP:3043`, `WEBSOCKET_URL=ws://YOUR_IP:3043`, `SITE_URL=http://YOUR_IP:3043`, `NEXTAUTH_URL=http://YOUR_IP:3043`. Restart, then access `http://YOUR_IP:3043`.
+
+### Docker not ready
+
+If setup fails with "Docker not ready", on Ubuntu run `./scripts/install-docker-ubuntu.sh`. If Docker is installed but you're not root, run `newgrp docker` then run the setup script again.
+
+### Port conflicts (most common issue)
+
+If the frontend or backend behaves unexpectedly (e.g., env vars seem ignored, changes don't take effect), **check for port conflicts first**:
+
+```bash
+# Check what's listening on key ports
+lsof -i :3000   # frontend
+lsof -i :1250   # backend
+lsof -i :5432   # postgres
+lsof -i :3900   # Garage S3 API
+lsof -i :6379   # Redis
+
+# Kill stale processes on a port
+lsof -ti :3000 | xargs kill
+```
+
+Common causes:
+
+- A stale `next dev` or `pnpm dev` process from another terminal/worktree
+- Another Docker Compose project (different worktree) with containers on the same ports — the setup script only manages its own project; containers from other projects must be stopped manually (`docker ps` to find them, `docker stop` to kill them)
+
+The setup script checks ports 3000, 1250, 5432, 6379, 3900, 3903 for conflicts before starting services. It ignores OrbStack/Docker Desktop port forwarding processes (which always bind these ports but are not real conflicts).
+
+### OrbStack false port-conflict warnings (Mac)
+
+If you use OrbStack as your Docker runtime, `lsof` will show OrbStack binding ports like 3000, 1250, etc. even when no containers are running. This is OrbStack's port forwarding mechanism — not a real conflict. The setup script filters these out automatically.
+
+### Re-enabling authentication
+
+Standalone runs without authentication (`FEATURE_REQUIRE_LOGIN=false`, `AUTH_BACKEND=none`). To re-enable:
+
+1. In `www/.env.local`: set `FEATURE_REQUIRE_LOGIN=true`, uncomment `AUTHENTIK_ISSUER` and `AUTHENTIK_REFRESH_TOKEN_URL`
+2. In `server/.env`: set `AUTH_BACKEND=authentik` (or your backend), configure `AUTH_JWT_AUDIENCE`
+3. Restart: `docker compose -f docker-compose.standalone.yml up -d --force-recreate web server`
+
+## What's NOT covered
+
+These require external accounts and infrastructure that can't be scripted:
+
+- **Live meeting rooms** — requires Daily.co account, S3 bucket, IAM roles
+- **Authentication** — requires Authentik deployment and OAuth configuration
+- **Hatchet workflows** — requires separate Hatchet setup for multitrack processing
+- **Production deployment** — see [Deployment Guide](./overview)
+
+## Current status
+
+All steps implemented. The setup script handles everything end-to-end:
+
+- Step 1 (Ollama/LLM) — implemented
+- Step 2 (environment files) — implemented
+- Step 3 (object storage / Garage) — implemented
+- Step 4 (transcription/diarization) — implemented (self-hosted GPU service)
+- Steps 5-7 (Docker, migrations, health) — implemented
+- **Unified script**: `scripts/setup-standalone.sh`

docsv2/selfhosted-architecture.md

@@ -0,0 +1,468 @@
+# How the Self-Hosted Setup Works
+
+This document explains the internals of the self-hosted deployment: how the setup script orchestrates everything, how the Docker Compose profiles work, how services communicate, and how configuration flows from flags to running containers.
+
+> For quick-start instructions and flag reference, see [Self-Hosted Production Deployment](selfhosted-production.md).
+
+## Table of Contents
+
+- [Overview](#overview)
+- [The Setup Script Step by Step](#the-setup-script-step-by-step)
+- [Docker Compose Profile System](#docker-compose-profile-system)
+- [Service Architecture](#service-architecture)
+- [Configuration Flow](#configuration-flow)
+- [Storage Architecture](#storage-architecture)
+- [SSL/TLS and Reverse Proxy](#ssltls-and-reverse-proxy)
+- [Build vs Pull Workflow](#build-vs-pull-workflow)
+- [Background Task Processing](#background-task-processing)
+- [Network and Port Layout](#network-and-port-layout)
+
+---
+
+## Overview
+
+The self-hosted deployment runs the entire Reflector platform on a single server using Docker Compose. A single bash script (`scripts/setup-selfhosted.sh`) handles all configuration and orchestration. The key design principles are:
+
+- **One command to deploy** — flags select which features to enable
+- **Idempotent** — safe to re-run without losing existing configuration
+- **Profile-based composition** — Docker Compose profiles activate optional services
+- **No external dependencies required** — with `--garage` and `--ollama-*`, everything runs locally
+
+## The Setup Script Step by Step
+
+The script (`scripts/setup-selfhosted.sh`) runs 7 sequential steps. Here's what each one does and why.
+
+### Step 0: Prerequisites
+
+Validates the environment before doing anything:
+
+- **Docker Compose V2** — checks `docker compose version` output (not the legacy `docker-compose`)
+- **Docker daemon** — verifies `docker info` succeeds
+- **NVIDIA GPU** — only checked when `--gpu` or `--ollama-gpu` is used; runs `nvidia-smi` to confirm drivers are installed
+- **Compose file** — verifies `docker-compose.selfhosted.yml` exists at the expected path
+
+If any check fails, the script exits with a clear error message and remediation steps.
+
+### Step 1: Generate Secrets
+
+Creates cryptographic secrets needed by the backend and frontend:
+
+- **`SECRET_KEY`** — used by the FastAPI server for session signing (64 hex chars via `openssl rand -hex 32`)
+- **`NEXTAUTH_SECRET`** — used by Next.js NextAuth for JWT signing
+
+Secrets are only generated if they don't already exist or are still set to the placeholder value `changeme`. This is what makes the script idempotent for secrets.
+
+### Step 2: Generate `server/.env`
+
+Creates or updates the backend environment file from `server/.env.selfhosted.example`. Sets:
+
+- **Infrastructure** — PostgreSQL URL, Redis host, Celery broker (all pointing to Docker-internal hostnames)
+- **Public URLs** — `BASE_URL` and `CORS_ORIGIN` computed from the domain (if `--domain`), IP (if detected on Linux), or `localhost`
+- **WebRTC** — `WEBRTC_HOST` set to the server's LAN IP so browsers can reach UDP ICE candidates
+- **Specialized models** — always points to `http://transcription:8000` (the Docker network alias shared by GPU and CPU containers)
+- **HuggingFace token** — prompts interactively for pyannote model access; writes to root `.env` so Docker Compose can inject it into GPU/CPU containers
+- **LLM** — if `--ollama-*` is used, configures `LLM_URL` pointing to the Ollama container. Otherwise, warns that the user needs to configure an external LLM
+- **Public mode** — sets `PUBLIC_MODE=true` so the app is accessible without authentication by default
+
+The script uses `env_set` for each variable, which either updates an existing line or appends a new one. This means re-running the script updates values in-place without duplicating keys.
+
+### Step 3: Generate `www/.env`
+
+Creates or updates the frontend environment file from `www/.env.selfhosted.example`. Sets:
+
+- **`SITE_URL` / `NEXTAUTH_URL` / `API_URL`** — all set to the same public-facing URL (with `https://` if Caddy is enabled)
+- **`WEBSOCKET_URL`** — set to `auto`, which tells the frontend to derive the WebSocket URL from the page URL automatically
+- **`SERVER_API_URL`** — always `http://server:1250` (Docker-internal, used for server-side rendering)
+- **`KV_URL`** — Redis URL for Next.js caching
+- **`FEATURE_REQUIRE_LOGIN`** — `false` by default (matches `PUBLIC_MODE=true` on the backend)
+
+### Step 4: Storage Setup
+
+Branches based on whether `--garage` was passed:
+
+**With `--garage` (local S3):**
+
+1. Generates `data/garage.toml` from a template, injecting a random RPC secret
+2. Starts only the Garage container (`docker compose --profile garage up -d garage`)
+3. Waits for the Garage admin API to respond on port 3903
+4. Assigns the node to a storage layout (1GB capacity, zone `dc1`)
+5. Creates the `reflector-media` bucket
+6. Creates an access key named `reflector` and grants it read/write on the bucket
+7. Writes all S3 credentials (`ENDPOINT_URL`, `BUCKET_NAME`, `REGION`, `ACCESS_KEY_ID`, `SECRET_ACCESS_KEY`) to `server/.env`
+
+The Garage endpoint is `http://garage:3900` (Docker-internal), and the region is set to `garage` (arbitrary, Garage ignores it). The boto3 client uses path-style addressing when an endpoint URL is configured, which is required for S3-compatible services like Garage.
+
+**Without `--garage` (external S3):**
+
+1. Checks `server/.env` for the four required S3 variables
+2. If any are missing, prompts interactively for each one
+3. Optionally prompts for an endpoint URL (for MinIO, Backblaze B2, etc.)
+
+### Step 5: Caddyfile
+
+Only runs when `--caddy` or `--domain` is used. Generates a Caddy configuration file:
+
+**With `--domain`:** Creates a named site block (`reflector.example.com { ... }`). Caddy automatically provisions a Let's Encrypt certificate for this domain. Requires DNS pointing to the server and ports 80/443 open.
+
+**Without `--domain` (IP access):** Creates a catch-all `:443 { tls internal ... }` block. Caddy generates a self-signed certificate. Browsers will show a security warning.
+
+Both configurations route:
+- `/v1/*` and `/health` to the backend (`server:1250`)
+- Everything else to the frontend (`web:3000`)
+
+### Step 6: Start Services
+
+1. **Always builds the GPU/CPU model image** — these are never prebuilt because they contain ML model download logic specific to the host's hardware
+2. **With `--build`:** Also builds backend (server, worker, beat) and frontend (web) images from source
+3. **Without `--build`:** Pulls prebuilt images from the Docker registry (`monadicalsas/reflector-backend:latest`, `monadicalsas/reflector-frontend:latest`)
+4. **Starts all services** — `docker compose up -d` with the active profiles
+5. **Quick sanity check** — after 3 seconds, checks for any containers that exited immediately
+
+### Step 7: Health Checks
+
+Waits for each service in order, with generous timeouts:
+
+| Service | Check | Timeout | Notes |
+|---------|-------|---------|-------|
+| GPU/CPU models | `curl http://localhost:8000/docs` | 10 min (120 x 5s) | First start downloads ~1GB of models |
+| Ollama | `curl http://localhost:11434/api/tags` | 3 min (60 x 3s) | Then pulls the selected model |
+| Server API | `curl http://localhost:1250/health` | 7.5 min (90 x 5s) | First start runs database migrations |
+| Frontend | `curl http://localhost:3000` | 1.5 min (30 x 3s) | Next.js build on first start |
+| Caddy | `curl -k https://localhost` | Quick check | After other services are up |
+
+If the server container exits during the health check, the script dumps diagnostics (container statuses + logs) before exiting.
+
+After the Ollama health check passes, the script checks if the selected model is already pulled. If not, it runs `ollama pull <model>` inside the container.
+
+---
+
+## Docker Compose Profile System
+
+The compose file (`docker-compose.selfhosted.yml`) uses Docker Compose profiles to make services optional. Only services whose profiles match the active `--profile` flags are started.
+
+### Always-on Services (no profile)
+
+These start regardless of which flags you pass:
+
+| Service | Role | Image |
+|---------|------|-------|
+| `server` | FastAPI backend, API endpoints, WebRTC | `monadicalsas/reflector-backend:latest` |
+| `worker` | Celery worker for background processing | Same image, `ENTRYPOINT=worker` |
+| `beat` | Celery beat scheduler for periodic tasks | Same image, `ENTRYPOINT=beat` |
+| `web` | Next.js frontend | `monadicalsas/reflector-frontend:latest` |
+| `redis` | Message broker + caching | `redis:7.2-alpine` |
+| `postgres` | Primary database | `postgres:17-alpine` |
+
+### Profile-Based Services
+
+| Profile | Service | Role |
+|---------|---------|------|
+| `gpu` | `gpu` | NVIDIA GPU-accelerated transcription/diarization/translation |
+| `cpu` | `cpu` | CPU-only transcription/diarization/translation |
+| `ollama-gpu` | `ollama` | Local Ollama LLM with GPU |
+| `ollama-cpu` | `ollama-cpu` | Local Ollama LLM on CPU |
+| `garage` | `garage` | Local S3-compatible object storage |
+| `caddy` | `caddy` | Reverse proxy with SSL |
+
+### The "transcription" Alias
+
+Both the `gpu` and `cpu` services define a Docker network alias of `transcription`. This means the backend always connects to `http://transcription:8000` regardless of which profile is active. The alias is defined in the compose file's `networks.default.aliases` section.
+
+---
+
+## Service Architecture
+
+```
+                    ┌─────────────┐
+  Internet ────────>│    Caddy     │ :80/:443   (profile: caddy)
+                    └──────┬──────┘
+                           │
+              ┌────────────┼────────────┐
+              │            │            │
+              v            v            │
+         ┌─────────┐  ┌─────────┐      │
+         │   web   │  │ server  │      │
+         │ :3000   │  │ :1250   │      │
+         └─────────┘  └────┬────┘      │
+                           │            │
+                      ┌────┴────┐       │
+                      │ worker  │       │
+                      │  beat   │       │
+                      └────┬────┘       │
+                           │            │
+            ┌──────────────┼────────────┤
+            │              │            │
+            v              v            v
+      ┌───────────┐  ┌─────────┐  ┌─────────┐
+      │transcription│ │postgres │  │  redis  │
+      │ (gpu/cpu) │  │ :5432   │  │ :6379   │
+      │ :8000     │  └─────────┘  └─────────┘
+      └───────────┘
+            │
+      ┌─────┴─────┐     ┌─────────┐
+      │  ollama   │     │ garage  │
+      │(optional) │     │(optional│
+      │ :11434    │     │  S3)    │
+      └───────────┘     └─────────┘
+```
+
+### How Services Interact
+
+1. **User request** hits Caddy (if enabled), which routes to `web` (pages) or `server` (API)
+2. **`web`** renders pages server-side using `SERVER_API_URL=http://server:1250` and client-side using the public `API_URL`
+3. **`server`** handles API requests, file uploads, WebRTC streaming. Dispatches background work to Celery via Redis
+4. **`worker`** picks up Celery tasks (transcription pipelines, audio processing). Calls `transcription:8000` for ML inference and uploads results to S3 storage
+5. **`beat`** schedules periodic tasks (cleanup, webhook retries) by pushing them onto the Celery queue
+6. **`transcription` (gpu/cpu)** runs Whisper/Parakeet (transcription), Pyannote (diarization), and translation models. Stateless HTTP API
+7. **`ollama`** provides an OpenAI-compatible API for summarization and topic detection. Called by the worker during post-processing
+8. **`garage`** provides S3-compatible storage for audio files and processed results. Accessed by the worker via boto3
+
+---
+
+## Configuration Flow
+
+Environment variables flow through multiple layers. Understanding this prevents confusion when debugging:
+
+```
+Flags (--gpu, --garage, etc.)
+  │
+  ├── setup-selfhosted.sh interprets flags
+  │     │
+  │     ├── Writes server/.env (backend config)
+  │     ├── Writes www/.env (frontend config)
+  │     ├── Writes .env (HF_TOKEN for compose interpolation)
+  │     └── Writes Caddyfile (proxy routes)
+  │
+  └── docker-compose.selfhosted.yml reads:
+        ├── env_file: ./server/.env   (loaded into server, worker, beat)
+        ├── env_file: ./www/.env      (loaded into web)
+        ├── .env                      (compose variable interpolation, e.g. ${HF_TOKEN})
+        └── environment: {...}        (hardcoded overrides, always win over env_file)
+```
+
+### Precedence Rules
+
+Docker Compose `environment:` keys **always override** `env_file:` values. This is by design — the compose file hardcodes infrastructure values that must be correct inside the Docker network (like `DATABASE_URL=postgresql+asyncpg://...@postgres:5432/...`) regardless of what's in `server/.env`.
+
+The `server/.env` file is still useful for:
+- Values not overridden in the compose file (LLM config, storage credentials, auth settings)
+- Running the server outside Docker during development
+
+### The Three `.env` Files
+
+| File | Used By | Contains |
+|------|---------|----------|
+| `server/.env` | server, worker, beat | Backend config: database, Redis, S3, LLM, auth, public URLs |
+| `www/.env` | web | Frontend config: site URL, auth, feature flags |
+| `.env` (root) | Docker Compose interpolation | Only `HF_TOKEN` — injected into GPU/CPU container env |
+
+---
+
+## Storage Architecture
+
+All audio files and processing results are stored in S3-compatible object storage. The backend uses boto3 (via aioboto3) with automatic path-style addressing when a custom endpoint URL is configured.
+
+### How Garage Works
+
+Garage is a lightweight, self-hosted S3-compatible storage engine. In this deployment:
+
+- Runs as a single-node cluster with 1GB capacity allocation
+- Listens on port 3900 (S3 API) and 3903 (admin API)
+- Data persists in Docker volumes (`garage_data`, `garage_meta`)
+- Accessed by the worker at `http://garage:3900` (Docker-internal)
+
+The setup script creates:
+- A bucket called `reflector-media`
+- An access key called `reflector` with read/write permissions on that bucket
+
+### Path-Style vs Virtual-Hosted Addressing
+
+AWS S3 uses virtual-hosted addressing by default (`bucket.s3.amazonaws.com`). S3-compatible services like Garage require path-style addressing (`endpoint/bucket`). The `AwsStorage` class detects this automatically: when `TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL` is set, it configures boto3 with `addressing_style: "path"`.
+
+---
+
+## SSL/TLS and Reverse Proxy
+
+### With `--domain` (Production)
+
+Caddy automatically obtains and renews a Let's Encrypt certificate. Requirements:
+- DNS A record pointing to the server
+- Ports 80 (HTTP challenge) and 443 (HTTPS) open to the internet
+
+The generated Caddyfile uses the domain as the site address, which triggers Caddy's automatic HTTPS.
+
+### Without `--domain` (Development/LAN)
+
+Caddy generates a self-signed certificate and listens on `:443` as a catch-all. Browsers will show a security warning that must be accepted manually.
+
+### Without `--caddy` (BYO Proxy)
+
+No ports are exposed to the internet. The services listen on `127.0.0.1` only:
+- Frontend: `localhost:3000`
+- Backend API: `localhost:1250`
+
+You can point your own reverse proxy (nginx, Traefik, etc.) at these ports.
+
+### WebRTC and UDP
+
+The server exposes UDP ports 50000-50100 for WebRTC ICE candidates. The `WEBRTC_HOST` variable tells the server which IP to advertise in ICE candidates — this must be the server's actual IP address (not a domain), because WebRTC uses UDP which doesn't go through the HTTP reverse proxy.
+
+---
+
+## Build vs Pull Workflow
+
+### Default (no `--build` flag)
+
+```
+GPU/CPU model image: Always built from source (./gpu/self_hosted/)
+Backend image:       Pulled from monadicalsas/reflector-backend:latest
+Frontend image:      Pulled from monadicalsas/reflector-frontend:latest
+```
+
+The GPU/CPU image is always built because it contains hardware-specific build steps and ML model download logic.
+
+### With `--build`
+
+```
+GPU/CPU model image: Built from source (./gpu/self_hosted/)
+Backend image:       Built from source (./server/)
+Frontend image:      Built from source (./www/)
+```
+
+Use `--build` when:
+- You've made local code changes
+- The prebuilt registry images are outdated
+- You want to verify the build works on your hardware
+
+### Rebuilding Individual Services
+
+```bash
+# Rebuild just the backend
+docker compose -f docker-compose.selfhosted.yml build server worker beat
+
+# Rebuild just the frontend
+docker compose -f docker-compose.selfhosted.yml build web
+
+# Rebuild the GPU model container
+docker compose -f docker-compose.selfhosted.yml build gpu
+
+# Force a clean rebuild (no cache)
+docker compose -f docker-compose.selfhosted.yml build --no-cache server
+```
+
+---
+
+## Background Task Processing
+
+### Celery Architecture
+
+The backend uses Celery for all background work, with Redis as the message broker:
+
+- **`worker`** — picks up tasks from the Redis queue and executes them
+- **`beat`** — schedules periodic tasks (cron-like) by pushing them onto the queue
+- **`Redis`** — acts as both message broker and result backend
+
+### The Audio Processing Pipeline
+
+When a file is uploaded, the worker runs a multi-step pipeline:
+
+```
+Upload → Extract Audio → Upload to S3
+                           │
+                    ┌──────┼──────┐
+                    │      │      │
+                    v      v      v
+              Transcribe  Diarize  Waveform
+                    │      │      │
+                    └──────┼──────┘
+                           │
+                       Assemble
+                           │
+                    ┌──────┼──────┐
+                    v      v      v
+                Topics  Title  Summaries
+                           │
+                         Done
+```
+
+Transcription, diarization, and waveform generation run in parallel. After assembly, topic detection, title generation, and summarization also run in parallel. Each step calls the appropriate service (transcription container for ML, Ollama/external LLM for text generation, S3 for storage).
+
+### Event Loop Management
+
+Each Celery task runs in its own `asyncio.run()` call, which creates a fresh event loop. The `asynctask` decorator in `server/reflector/asynctask.py` handles:
+
+1. **Database connections** — resets the connection pool before each task (connections from a previous event loop would cause "Future attached to a different loop" errors)
+2. **Redis connections** — resets the WebSocket manager singleton so Redis pub/sub reconnects on the current loop
+3. **Cleanup** — disconnects the database and clears the context variable in the `finally` block
+
+---
+
+## Network and Port Layout
+
+All services communicate over Docker's default bridge network. Only specific ports are exposed to the host:
+
+| Port | Service | Binding | Purpose |
+|------|---------|---------|---------|
+| 80 | Caddy | `0.0.0.0:80` | HTTP (redirect to HTTPS / Let's Encrypt challenge) |
+| 443 | Caddy | `0.0.0.0:443` | HTTPS (main entry point) |
+| 1250 | Server | `127.0.0.1:1250` | Backend API (localhost only) |
+| 3000 | Web | `127.0.0.1:3000` | Frontend (localhost only) |
+| 3900 | Garage | `0.0.0.0:3900` | S3 API (for admin/debug access) |
+| 3903 | Garage | `0.0.0.0:3903` | Garage admin API |
+| 8000 | GPU/CPU | `127.0.0.1:8000` | ML model API (localhost only) |
+| 11434 | Ollama | `127.0.0.1:11434` | Ollama API (localhost only) |
+| 50000-50100/udp | Server | `0.0.0.0:50000-50100` | WebRTC ICE candidates |
+
+Services bound to `127.0.0.1` are only accessible from the host itself (not from the network). Caddy is the only service exposed to the internet on standard HTTP/HTTPS ports.
+
+### Docker-Internal Hostnames
+
+Inside the Docker network, services reach each other by their compose service name:
+
+| Hostname | Resolves To |
+|----------|-------------|
+| `server` | Backend API container |
+| `web` | Frontend container |
+| `postgres` | PostgreSQL container |
+| `redis` | Redis container |
+| `transcription` | GPU or CPU container (network alias) |
+| `ollama` / `ollama-cpu` | Ollama container |
+| `garage` | Garage S3 container |
+
+---
+
+## Diagnostics and Error Handling
+
+The setup script includes an `ERR` trap that automatically dumps diagnostics when any command fails:
+
+1. Lists all container statuses
+2. Shows the last 30 lines of logs for any stopped/exited containers
+3. Shows the last 40 lines of the specific failing service
+
+This means if something goes wrong during setup, you'll see the relevant logs immediately without having to run manual debug commands.
+
+### Common Debug Commands
+
+```bash
+# Overall status
+docker compose -f docker-compose.selfhosted.yml ps
+
+# Logs for a specific service
+docker compose -f docker-compose.selfhosted.yml logs server --tail 50
+docker compose -f docker-compose.selfhosted.yml logs worker --tail 50
+
+# Check environment inside a container
+docker compose -f docker-compose.selfhosted.yml exec server env | grep TRANSCRIPT
+
+# Health check from inside the network
+docker compose -f docker-compose.selfhosted.yml exec server curl http://localhost:1250/health
+
+# Check S3 storage connectivity
+docker compose -f docker-compose.selfhosted.yml exec server curl http://garage:3900
+
+# Database access
+docker compose -f docker-compose.selfhosted.yml exec postgres psql -U reflector -c "SELECT id, status FROM transcript ORDER BY created_at DESC LIMIT 5;"
+
+# List files in server data directory
+docker compose -f docker-compose.selfhosted.yml exec server ls -la /app/data/
+```

docsv2/selfhosted-production.md

@@ -0,0 +1,373 @@
+# Self-Hosted Production Deployment
+
+Deploy Reflector on a single server with everything running in Docker. Transcription, diarization, and translation use specialized ML models (Whisper/Parakeet, Pyannote); only summarization and topic detection require an LLM.
+
+> For a detailed walkthrough of how the setup script and infrastructure work under the hood, see [How the Self-Hosted Setup Works](selfhosted-architecture.md).
+
+## Prerequisites
+
+### Hardware
+- **With GPU**: Linux server with NVIDIA GPU (8GB+ VRAM recommended), 16GB+ RAM, 50GB+ disk
+- **CPU-only**: 8+ cores, 32GB+ RAM (transcription is slower but works)
+- Disk space for ML models (~2GB on first run) + audio storage
+
+### Software
+- Docker Engine 24+ with Compose V2
+- NVIDIA drivers + `nvidia-container-toolkit` (GPU modes only)
+- `curl`, `openssl` (usually pre-installed)
+
+### Accounts & Credentials (depending on options)
+
+**Always recommended:**
+- **HuggingFace token** — For downloading pyannote speaker diarization models. Get one at https://huggingface.co/settings/tokens and accept the model licenses:
+  - https://huggingface.co/pyannote/speaker-diarization-3.1
+  - https://huggingface.co/pyannote/segmentation-3.0
+  - The setup script will prompt for this. If skipped, diarization falls back to a public model bundle (may be less reliable).
+
+**LLM for summarization & topic detection (pick one):**
+- **With `--ollama-gpu` or `--ollama-cpu`**: Nothing extra — Ollama runs locally and pulls the model automatically
+- **Without `--ollama-*`**: An OpenAI-compatible LLM API key and endpoint. Examples:
+  - OpenAI: `LLM_URL=https://api.openai.com/v1`, `LLM_API_KEY=sk-...`, `LLM_MODEL=gpt-4o-mini`
+  - Anthropic, Together, Groq, or any OpenAI-compatible API
+  - A self-managed vLLM or Ollama instance elsewhere on the network
+
+**Object storage (pick one):**
+- **With `--garage`**: Nothing extra — Garage (local S3-compatible storage) is auto-configured by the script
+- **Without `--garage`**: S3-compatible storage credentials. The script will prompt for these, or you can pre-fill `server/.env`. Options include:
+  - **AWS S3**: Access Key ID, Secret Access Key, bucket name, region
+  - **MinIO**: Same credentials + `TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL=http://your-minio:9000`
+  - **Any S3-compatible provider** (Backblaze B2, Cloudflare R2, DigitalOcean Spaces, etc.): same fields + custom endpoint URL
+
+**Optional add-ons (configure after initial setup):**
+- **Daily.co** (live meeting rooms): Requires a Daily.co account (https://www.daily.co/), API key, subdomain, and an AWS S3 bucket + IAM Role for recording storage. See [Enabling Daily.co Live Rooms](#enabling-dailyco-live-rooms) below.
+- **Authentik** (user authentication): Requires an Authentik instance with an OAuth2/OIDC application configured for Reflector. See [Enabling Authentication](#enabling-authentication-authentik) below.
+
+## Quick Start
+
+```bash
+git clone https://github.com/Monadical-SAS/reflector.git
+cd reflector
+
+# GPU + local Ollama LLM + local Garage storage + Caddy SSL (with domain):
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy --domain reflector.example.com
+
+# Same but without a domain (self-signed cert, access via IP):
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy
+
+# CPU-only (same, but slower):
+./scripts/setup-selfhosted.sh --cpu --ollama-cpu --garage --caddy
+
+# Build from source instead of pulling prebuilt images:
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy --build
+```
+
+That's it. The script generates env files, secrets, starts all containers, waits for health checks, and prints the URL.
+
+## Specialized Models (Required)
+
+Pick `--gpu` or `--cpu`. This determines how **transcription, diarization, and translation** run:
+
+| Flag | What it does | Requires |
+|------|-------------|----------|
+| `--gpu` | NVIDIA GPU acceleration for ML models | NVIDIA GPU + drivers + `nvidia-container-toolkit` |
+| `--cpu` | CPU-only (slower but works without GPU) | 8+ cores, 32GB+ RAM recommended |
+
+## Local LLM (Optional)
+
+Optionally add `--ollama-gpu` or `--ollama-cpu` for a **local Ollama instance** that handles summarization and topic detection. If omitted, configure an external OpenAI-compatible LLM in `server/.env`.
+
+| Flag | What it does | Requires |
+|------|-------------|----------|
+| `--ollama-gpu` | Local Ollama with NVIDIA GPU acceleration | NVIDIA GPU |
+| `--ollama-cpu` | Local Ollama on CPU only | Nothing extra |
+| `--llm-model MODEL` | Choose which Ollama model to download (default: `qwen2.5:14b`) | `--ollama-gpu` or `--ollama-cpu` |
+| *(omitted)* | User configures external LLM (OpenAI, Anthropic, etc.) | LLM API key |
+
+### Choosing an Ollama model
+
+The default model is `qwen2.5:14b` (~9GB download, good multilingual support and summary quality). Override with `--llm-model`:
+
+```bash
+# Default (qwen2.5:14b)
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy
+
+# Mistral — good balance of speed and quality (~4.1GB)
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --llm-model mistral --garage --caddy
+
+# Phi-4 — smaller and faster (~9.1GB)
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --llm-model phi4 --garage --caddy
+
+# Llama 3.3 70B — best quality, needs 48GB+ RAM or GPU VRAM (~43GB)
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --llm-model llama3.3:70b --garage --caddy
+
+# Gemma 2 9B (~5.4GB)
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --llm-model gemma2 --garage --caddy
+
+# DeepSeek R1 8B — reasoning model, verbose but thorough summaries (~4.9GB)
+./scripts/setup-selfhosted.sh --gpu --ollama-gpu --llm-model deepseek-r1:8b --garage --caddy
+```
+
+Browse all available models at https://ollama.com/library.
+
+### Recommended combinations
+
+- **`--gpu --ollama-gpu`**: Best for servers with NVIDIA GPU. Fully self-contained, no external API keys needed.
+- **`--cpu --ollama-cpu`**: No GPU available but want everything self-contained. Slower but works.
+- **`--gpu --ollama-cpu`**: GPU for transcription, CPU for LLM. Saves GPU VRAM for ML models.
+- **`--gpu`**: Have NVIDIA GPU but prefer a cloud LLM (faster/better summaries with GPT-4, Claude, etc.).
+- **`--cpu`**: No GPU, prefer cloud LLM. Slowest transcription but best summary quality.
+
+## Other Optional Flags
+
+| Flag | What it does |
+|------|-------------|
+| `--garage` | Starts Garage (local S3-compatible storage). Auto-configures bucket, keys, and env vars. |
+| `--caddy` | Starts Caddy reverse proxy on ports 80/443 with self-signed cert. |
+| `--domain DOMAIN` | Use a real domain with Let's Encrypt auto-HTTPS (implies `--caddy`). Requires DNS A record pointing to this server and ports 80/443 open. |
+| `--build` | Build backend (server, worker, beat) and frontend (web) Docker images from source instead of pulling prebuilt images from the registry. Useful for development or when running a version with local changes. |
+
+Without `--garage`, you **must** provide S3-compatible credentials (the script will prompt interactively or you can pre-fill `server/.env`).
+
+Without `--caddy` or `--domain`, no ports are exposed. Point your own reverse proxy at `web:3000` (frontend) and `server:1250` (API).
+
+**Using a domain (recommended for production):** Point a DNS A record at your server's IP, then pass `--domain your.domain.com`. Caddy will automatically obtain and renew a Let's Encrypt certificate. Ports 80 and 443 must be open.
+
+**Without a domain:** `--caddy` alone uses a self-signed certificate. Browsers will show a security warning that must be accepted.
+
+## What the Script Does
+
+1. **Prerequisites check** — Docker, NVIDIA GPU (if needed), compose file exists
+2. **Generate secrets** — `SECRET_KEY`, `NEXTAUTH_SECRET` via `openssl rand`
+3. **Generate `server/.env`** — From template, sets infrastructure defaults, configures LLM based on mode, enables `PUBLIC_MODE`
+4. **Generate `www/.env`** — Auto-detects server IP, sets URLs
+5. **Storage setup** — Either initializes Garage (bucket, keys, permissions) or prompts for external S3 credentials
+6. **Caddyfile** — Generates domain-specific (Let's Encrypt) or IP-specific (self-signed) configuration
+7. **Build & start** — Always builds GPU/CPU model image from source. With `--build`, also builds backend and frontend from source; otherwise pulls prebuilt images from the registry
+8. **Health checks** — Waits for each service, pulls Ollama model if needed, warns about missing LLM config
+
+> For a deeper dive into each step, see [How the Self-Hosted Setup Works](selfhosted-architecture.md).
+
+## Configuration Reference
+
+### Server Environment (`server/.env`)
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `DATABASE_URL` | PostgreSQL connection | Auto-set (Docker internal) |
+| `REDIS_HOST` | Redis hostname | Auto-set (`redis`) |
+| `SECRET_KEY` | App secret | Auto-generated |
+| `AUTH_BACKEND` | Authentication method | `none` |
+| `PUBLIC_MODE` | Allow unauthenticated access | `true` |
+| `WEBRTC_HOST` | IP advertised in WebRTC ICE candidates | Auto-detected (server IP) |
+| `TRANSCRIPT_URL` | Specialized model endpoint | `http://transcription:8000` |
+| `LLM_URL` | OpenAI-compatible LLM endpoint | Auto-set for Ollama modes |
+| `LLM_API_KEY` | LLM API key | `not-needed` for Ollama |
+| `LLM_MODEL` | LLM model name | `qwen2.5:14b` for Ollama (override with `--llm-model`) |
+| `TRANSCRIPT_STORAGE_BACKEND` | Storage backend | `aws` |
+| `TRANSCRIPT_STORAGE_AWS_*` | S3 credentials | Auto-set for Garage |
+
+### Frontend Environment (`www/.env`)
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `SITE_URL` | Public-facing URL | Auto-detected |
+| `API_URL` | API URL (browser-side) | Same as SITE_URL |
+| `SERVER_API_URL` | API URL (server-side) | `http://server:1250` |
+| `NEXTAUTH_SECRET` | Auth secret | Auto-generated |
+| `FEATURE_REQUIRE_LOGIN` | Require authentication | `false` |
+
+## Storage Options
+
+### Garage (Recommended for Self-Hosted)
+
+Use `--garage` flag. The script automatically:
+- Generates `data/garage.toml` with a random RPC secret
+- Starts the Garage container
+- Creates the `reflector-media` bucket
+- Creates an access key with read/write permissions
+- Writes all S3 credentials to `server/.env`
+
+### External S3 (AWS, MinIO, etc.)
+
+Don't use `--garage`. The script will prompt for:
+- Access Key ID
+- Secret Access Key
+- Bucket Name
+- Region
+- Endpoint URL (for non-AWS like MinIO)
+
+Or pre-fill in `server/.env`:
+```env
+TRANSCRIPT_STORAGE_BACKEND=aws
+TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID=your-key
+TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY=your-secret
+TRANSCRIPT_STORAGE_AWS_BUCKET_NAME=reflector-media
+TRANSCRIPT_STORAGE_AWS_REGION=us-east-1
+# For non-AWS S3 (MinIO, etc.):
+TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL=http://minio:9000
+```
+
+## Enabling Authentication (Authentik)
+
+By default, authentication is disabled (`AUTH_BACKEND=none`, `FEATURE_REQUIRE_LOGIN=false`). To enable:
+
+1. Deploy an Authentik instance (see [Authentik docs](https://goauthentik.io/docs/installation))
+2. Create an OAuth2/OIDC application for Reflector
+3. Update `server/.env`:
+   ```env
+   AUTH_BACKEND=jwt
+   AUTH_JWT_AUDIENCE=your-client-id
+   ```
+4. Update `www/.env`:
+   ```env
+   FEATURE_REQUIRE_LOGIN=true
+   AUTHENTIK_ISSUER=https://authentik.example.com/application/o/reflector
+   AUTHENTIK_REFRESH_TOKEN_URL=https://authentik.example.com/application/o/token/
+   AUTHENTIK_CLIENT_ID=your-client-id
+   AUTHENTIK_CLIENT_SECRET=your-client-secret
+   ```
+5. Restart: `docker compose -f docker-compose.selfhosted.yml down && ./scripts/setup-selfhosted.sh <same-flags>`
+
+## Enabling Daily.co Live Rooms
+
+Daily.co enables real-time meeting rooms with automatic recording and transcription.
+
+1. Create a [Daily.co](https://www.daily.co/) account
+2. Add to `server/.env`:
+   ```env
+   DEFAULT_VIDEO_PLATFORM=daily
+   DAILY_API_KEY=your-daily-api-key
+   DAILY_SUBDOMAIN=your-subdomain
+   DAILY_WEBHOOK_SECRET=your-webhook-secret
+   DAILYCO_STORAGE_AWS_BUCKET_NAME=reflector-dailyco
+   DAILYCO_STORAGE_AWS_REGION=us-east-1
+   DAILYCO_STORAGE_AWS_ROLE_ARN=arn:aws:iam::role/DailyCoAccess
+   ```
+3. Restart the server: `docker compose -f docker-compose.selfhosted.yml restart server worker`
+
+## Enabling Real Domain with Let's Encrypt
+
+By default, Caddy uses self-signed certificates. For a real domain:
+
+1. Point your domain's DNS to your server's IP
+2. Ensure ports 80 and 443 are open
+3. Edit `Caddyfile`:
+   ```
+   reflector.example.com {
+       handle /v1/* {
+           reverse_proxy server:1250
+       }
+       handle /health {
+           reverse_proxy server:1250
+       }
+       handle {
+           reverse_proxy web:3000
+       }
+   }
+   ```
+4. Update `www/.env`:
+   ```env
+   SITE_URL=https://reflector.example.com
+   NEXTAUTH_URL=https://reflector.example.com
+   API_URL=https://reflector.example.com
+   ```
+5. Restart Caddy: `docker compose -f docker-compose.selfhosted.yml restart caddy web`
+
+## Troubleshooting
+
+### Check service status
+```bash
+docker compose -f docker-compose.selfhosted.yml ps
+```
+
+### View logs for a specific service
+```bash
+docker compose -f docker-compose.selfhosted.yml logs server --tail 50
+docker compose -f docker-compose.selfhosted.yml logs gpu --tail 50
+docker compose -f docker-compose.selfhosted.yml logs web --tail 50
+```
+
+### GPU service taking too long
+First start downloads ~1-2GB of ML models. Check progress:
+```bash
+docker compose -f docker-compose.selfhosted.yml logs gpu -f
+```
+
+### Server exits immediately
+Usually a database migration issue. Check:
+```bash
+docker compose -f docker-compose.selfhosted.yml logs server --tail 50
+```
+
+### Caddy certificate issues
+For self-signed certs, your browser will warn. Click Advanced > Proceed.
+For Let's Encrypt, ensure ports 80/443 are open and DNS is pointed correctly.
+
+### Summaries/topics not generating
+Check LLM configuration:
+```bash
+grep LLM_ server/.env
+```
+If you didn't use `--ollama-gpu` or `--ollama-cpu`, you must set `LLM_URL`, `LLM_API_KEY`, and `LLM_MODEL`.
+
+### Health check from inside containers
+```bash
+docker compose -f docker-compose.selfhosted.yml exec server curl http://localhost:1250/health
+docker compose -f docker-compose.selfhosted.yml exec gpu curl http://localhost:8000/docs
+```
+
+## Updating
+
+```bash
+# Option A: Pull latest prebuilt images and restart
+docker compose -f docker-compose.selfhosted.yml down
+./scripts/setup-selfhosted.sh <same-flags-as-before>
+
+# Option B: Build from source (after git pull) and restart
+git pull
+docker compose -f docker-compose.selfhosted.yml down
+./scripts/setup-selfhosted.sh <same-flags-as-before> --build
+
+# Rebuild only the GPU/CPU model image (picks up model updates)
+docker compose -f docker-compose.selfhosted.yml build gpu  # or cpu
+```
+
+The setup script is idempotent — it won't overwrite existing secrets or env vars that are already set.
+
+## Architecture Overview
+
+```
+                    ┌─────────┐
+  Internet ────────>│  Caddy  │ :80/:443
+                    └────┬────┘
+                         │
+            ┌────────────┼────────────┐
+            │            │            │
+            v            v            │
+       ┌─────────┐  ┌─────────┐      │
+       │   web   │  │ server  │      │
+       │ :3000   │  │ :1250   │      │
+       └─────────┘  └────┬────┘      │
+                         │            │
+                    ┌────┴────┐       │
+                    │ worker  │       │
+                    │  beat   │       │
+                    └────┬────┘       │
+                         │            │
+          ┌──────────────┼────────────┤
+          │              │            │
+          v              v            v
+    ┌───────────┐  ┌─────────┐  ┌─────────┐
+    │transcription│  │postgres │  │  redis  │
+    │(gpu/cpu)  │  │ :5432   │  │ :6379   │
+    │ :8000     │  └─────────┘  └─────────┘
+    └───────────┘
+          │
+    ┌─────┴─────┐     ┌─────────┐
+    │  ollama   │     │ garage  │
+    │ (optional)│     │(optional│
+    │ :11434    │     │ S3)     │
+    └───────────┘     └─────────┘
+```
+
+All services communicate over Docker's internal network. Only Caddy (if enabled) exposes ports to the internet.

gpu/modal_deployments/deploy-all.sh

@@ -131,6 +131,15 @@ if [ -z "$DIARIZER_URL" ]; then
 fi
 echo "  -> $DIARIZER_URL"
 
+echo ""
+echo "Deploying padding (CPU audio processing via Modal SDK)..."
+modal deploy reflector_padding.py
+if [ $? -ne 0 ]; then
+    echo "Error: Failed to deploy padding. Check Modal dashboard for details."
+    exit 1
+fi
+echo "  -> reflector-padding.pad_track (Modal SDK function)"
+
 # --- Output Configuration ---
 echo ""
 echo "=========================================="
@@ -147,4 +156,6 @@ echo ""
 echo "DIARIZATION_BACKEND=modal"
 echo "DIARIZATION_URL=$DIARIZER_URL"
 echo "DIARIZATION_MODAL_API_KEY=$API_KEY"
+echo ""
+echo "# Padding uses Modal SDK (requires MODAL_TOKEN_ID/SECRET in worker containers)"
 echo "# --- End Modal Configuration ---"

gpu/modal_deployments/reflector_padding.py

@@ -0,0 +1,277 @@
+"""
+Reflector GPU backend - audio padding
+======================================
+
+CPU-intensive audio padding service for adding silence to audio tracks.
+Uses PyAV filter graph (adelay) for precise track synchronization.
+
+IMPORTANT: This padding logic is duplicated from server/reflector/utils/audio_padding.py
+for Modal deployment isolation (Modal can't import from server/reflector/). If you modify
+the PyAV filter graph or padding algorithm, you MUST update both:
+  - gpu/modal_deployments/reflector_padding.py (this file)
+  - server/reflector/utils/audio_padding.py
+
+Constants duplicated from server/reflector/utils/audio_constants.py for same reason.
+"""
+
+import os
+import tempfile
+from fractions import Fraction
+import math
+import asyncio
+
+import modal
+
+S3_TIMEOUT = 60 # happens 2 times
+PADDING_TIMEOUT = 600 + (S3_TIMEOUT * 2)
+SCALEDOWN_WINDOW = 60  # The maximum duration (in seconds) that individual containers can remain idle when scaling down.
+DISCONNECT_CHECK_INTERVAL = 2  # Check for client disconnect
+
+
+app = modal.App("reflector-padding")
+
+# CPU-based image
+image = (
+    modal.Image.debian_slim(python_version="3.12")
+    .apt_install("ffmpeg")  # Required by PyAV
+    .pip_install(
+        "av==13.1.0",  # PyAV for audio processing
+        "requests==2.32.3",  # HTTP for presigned URL downloads/uploads
+        "fastapi==0.115.12",  # API framework
+    )
+)
+
+# ref B0F71CE8-FC59-4AA5-8414-DAFB836DB711
+OPUS_STANDARD_SAMPLE_RATE = 48000
+# ref B0F71CE8-FC59-4AA5-8414-DAFB836DB711
+OPUS_DEFAULT_BIT_RATE = 128000
+
+
+@app.function(
+    cpu=2.0,
+    timeout=PADDING_TIMEOUT,
+    scaledown_window=SCALEDOWN_WINDOW,
+    image=image,
+)
+@modal.asgi_app()
+def web():
+    from fastapi import FastAPI, Request, HTTPException
+    from pydantic import BaseModel
+
+    class PaddingRequest(BaseModel):
+        track_url: str
+        output_url: str
+        start_time_seconds: float
+        track_index: int
+
+    class PaddingResponse(BaseModel):
+        size: int
+        cancelled: bool = False
+
+    web_app = FastAPI()
+
+    @web_app.post("/pad")
+    async def pad_track_endpoint(request: Request, req: PaddingRequest) -> PaddingResponse:
+        """Modal web endpoint for padding audio tracks with disconnect detection.
+        """
+        import logging
+
+        logging.basicConfig(level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s")
+        logger = logging.getLogger(__name__)
+
+        if not req.track_url:
+            raise HTTPException(status_code=400, detail="track_url cannot be empty")
+        if not req.output_url:
+            raise HTTPException(status_code=400, detail="output_url cannot be empty")
+        if req.start_time_seconds <= 0:
+            raise HTTPException(status_code=400, detail=f"start_time_seconds must be positive, got {req.start_time_seconds}")
+        if req.start_time_seconds > 18000:
+            raise HTTPException(status_code=400, detail=f"start_time_seconds exceeds maximum 18000s (5 hours)")
+
+        logger.info(f"Padding request: track {req.track_index}, delay={req.start_time_seconds}s")
+
+        # Thread-safe cancellation flag shared between async disconnect checker and blocking thread
+        import threading
+        cancelled = threading.Event()
+
+        async def check_disconnect():
+            """Background task to check for client disconnect every 2 seconds."""
+            while not cancelled.is_set():
+                await asyncio.sleep(DISCONNECT_CHECK_INTERVAL)
+                if await request.is_disconnected():
+                    logger.warning("Client disconnected, setting cancellation flag")
+                    cancelled.set()
+                    break
+
+        # Start disconnect checker in background
+        disconnect_task = asyncio.create_task(check_disconnect())
+
+        try:
+            result = await asyncio.get_event_loop().run_in_executor(
+                None, _pad_track_blocking, req, cancelled, logger
+            )
+            return PaddingResponse(**result)
+        finally:
+            cancelled.set()
+            disconnect_task.cancel()
+            try:
+                await disconnect_task
+            except asyncio.CancelledError:
+                pass
+
+    def _pad_track_blocking(req, cancelled, logger) -> dict:
+        """Blocking CPU-bound padding work with periodic cancellation checks.
+
+        Args:
+            cancelled: threading.Event for thread-safe cancellation signaling
+        """
+        import av
+        import requests
+        from av.audio.resampler import AudioResampler
+        import time
+
+        temp_dir = tempfile.mkdtemp()
+        input_path = None
+        output_path = None
+        last_check = time.time()
+
+        try:
+            logger.info("Downloading track for padding")
+            response = requests.get(req.track_url, stream=True, timeout=S3_TIMEOUT)
+            response.raise_for_status()
+
+            input_path = os.path.join(temp_dir, "track.webm")
+            total_bytes = 0
+            chunk_count = 0
+            with open(input_path, "wb") as f:
+                for chunk in response.iter_content(chunk_size=8192):
+                    if chunk:
+                        f.write(chunk)
+                        total_bytes += len(chunk)
+                        chunk_count += 1
+
+                        # Check for cancellation every arbitrary amount of chunks
+                        if chunk_count % 12 == 0:
+                            now = time.time()
+                            if now - last_check >= DISCONNECT_CHECK_INTERVAL:
+                                if cancelled.is_set():
+                                    logger.info("Cancelled during download, exiting early")
+                                    return {"size": 0, "cancelled": True}
+                                last_check = now
+            logger.info(f"Track downloaded: {total_bytes} bytes")
+
+            if cancelled.is_set():
+                logger.info("Cancelled after download, exiting early")
+                return {"size": 0, "cancelled": True}
+
+            # Apply padding using PyAV
+            output_path = os.path.join(temp_dir, "padded.webm")
+            delay_ms = math.floor(req.start_time_seconds * 1000)
+            logger.info(f"Padding track {req.track_index} with {delay_ms}ms delay using PyAV")
+
+            in_container = av.open(input_path)
+            in_stream = next((s for s in in_container.streams if s.type == "audio"), None)
+            if in_stream is None:
+                raise ValueError("No audio stream in input")
+
+            with av.open(output_path, "w", format="webm") as out_container:
+                out_stream = out_container.add_stream("libopus", rate=OPUS_STANDARD_SAMPLE_RATE)
+                out_stream.bit_rate = OPUS_DEFAULT_BIT_RATE
+                graph = av.filter.Graph()
+
+                abuf_args = (
+                    f"time_base=1/{OPUS_STANDARD_SAMPLE_RATE}:"
+                    f"sample_rate={OPUS_STANDARD_SAMPLE_RATE}:"
+                    f"sample_fmt=s16:"
+                    f"channel_layout=stereo"
+                )
+                src = graph.add("abuffer", args=abuf_args, name="src")
+                aresample_f = graph.add("aresample", args="async=1", name="ares")
+                delays_arg = f"{delay_ms}|{delay_ms}"
+                adelay_f = graph.add("adelay", args=f"delays={delays_arg}:all=1", name="delay")
+                sink = graph.add("abuffersink", name="sink")
+
+                src.link_to(aresample_f)
+                aresample_f.link_to(adelay_f)
+                adelay_f.link_to(sink)
+                graph.configure()
+
+                resampler = AudioResampler(
+                    format="s16", layout="stereo", rate=OPUS_STANDARD_SAMPLE_RATE
+                )
+
+                for frame in in_container.decode(in_stream):
+                    # Check for cancellation periodically
+                    now = time.time()
+                    if now - last_check >= DISCONNECT_CHECK_INTERVAL:
+                        if cancelled.is_set():
+                            logger.info("Cancelled during processing, exiting early")
+                            in_container.close()
+                            return {"size": 0, "cancelled": True}
+                        last_check = now
+
+                    out_frames = resampler.resample(frame) or []
+                    for rframe in out_frames:
+                        rframe.sample_rate = OPUS_STANDARD_SAMPLE_RATE
+                        rframe.time_base = Fraction(1, OPUS_STANDARD_SAMPLE_RATE)
+                        src.push(rframe)
+
+                        while True:
+                            try:
+                                f_out = sink.pull()
+                            except Exception:
+                                break
+                            f_out.sample_rate = OPUS_STANDARD_SAMPLE_RATE
+                            f_out.time_base = Fraction(1, OPUS_STANDARD_SAMPLE_RATE)
+                            for packet in out_stream.encode(f_out):
+                                out_container.mux(packet)
+
+                # Flush filter graph
+                src.push(None)
+                while True:
+                    try:
+                        f_out = sink.pull()
+                    except Exception:
+                        break
+                    f_out.sample_rate = OPUS_STANDARD_SAMPLE_RATE
+                    f_out.time_base = Fraction(1, OPUS_STANDARD_SAMPLE_RATE)
+                    for packet in out_stream.encode(f_out):
+                        out_container.mux(packet)
+
+                # Flush encoder
+                for packet in out_stream.encode(None):
+                    out_container.mux(packet)
+
+            in_container.close()
+
+            file_size = os.path.getsize(output_path)
+            logger.info(f"Padding complete: {file_size} bytes")
+
+            logger.info("Uploading padded track to S3")
+
+            with open(output_path, "rb") as f:
+                upload_response = requests.put(req.output_url, data=f, timeout=S3_TIMEOUT)
+
+            upload_response.raise_for_status()
+            logger.info(f"Upload complete: {file_size} bytes")
+
+            return {"size": file_size}
+
+        finally:
+            if input_path and os.path.exists(input_path):
+                try:
+                    os.unlink(input_path)
+                except Exception as e:
+                    logger.warning(f"Failed to cleanup input file: {e}")
+            if output_path and os.path.exists(output_path):
+                try:
+                    os.unlink(output_path)
+                except Exception as e:
+                    logger.warning(f"Failed to cleanup output file: {e}")
+            try:
+                os.rmdir(temp_dir)
+            except Exception as e:
+                logger.warning(f"Failed to cleanup temp directory: {e}")
+
+    return web_app
+

gpu/self_hosted/Dockerfile

@@ -4,27 +4,31 @@ ENV PYTHONUNBUFFERED=1 \
     UV_LINK_MODE=copy \
     UV_NO_CACHE=1
 
+# patch until nvidia updates the sha1 repo
+ADD sequoia.config /etc/crypto-policies/back-ends/sequoia.config
+
 WORKDIR /tmp
-RUN apt-get update \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt,sharing=locked \
+ apt-get update \
  && apt-get install -y \
     ffmpeg \
     curl \
     ca-certificates \
     gnupg \
-    wget \
- && apt-get clean
+    wget
 # Add NVIDIA CUDA repo for Debian 12 (bookworm) and install cuDNN 9 for CUDA 12
 ADD https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64/cuda-keyring_1.1-1_all.deb /cuda-keyring.deb
-RUN dpkg -i /cuda-keyring.deb \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt,sharing=locked \
+ dpkg -i /cuda-keyring.deb \
  && rm /cuda-keyring.deb \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
     cuda-cudart-12-6 \
     libcublas-12-6 \
     libcudnn9-cuda-12 \
-    libcudnn9-dev-cuda-12 \
- && apt-get clean \
- && rm -rf /var/lib/apt/lists/*
+    libcudnn9-dev-cuda-12
 ADD https://astral.sh/uv/install.sh /uv-installer.sh
 RUN sh /uv-installer.sh && rm /uv-installer.sh
 ENV PATH="/root/.local/bin/:$PATH"
@@ -39,6 +43,13 @@ COPY ./app /app/app
 COPY ./main.py /app/
 COPY ./runserver.sh /app/
 
+# prevent uv failing with too many open files on big cpus
+ENV UV_CONCURRENT_INSTALLS=16
+
+# first install
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --compile-bytecode --locked
+
 EXPOSE 8000
 
 CMD ["sh", "/app/runserver.sh"]

gpu/self_hosted/Dockerfile.cpu

@@ -0,0 +1,39 @@
+FROM python:3.12-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    UV_NO_CACHE=1
+
+WORKDIR /tmp
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt,sharing=locked \
+ apt-get update \
+ && apt-get install -y \
+    ffmpeg \
+    curl \
+    ca-certificates \
+    gnupg \
+    wget
+ADD https://astral.sh/uv/install.sh /uv-installer.sh
+RUN sh /uv-installer.sh && rm /uv-installer.sh
+ENV PATH="/root/.local/bin/:$PATH"
+
+RUN mkdir -p /app
+WORKDIR /app
+COPY pyproject.toml uv.lock /app/
+
+
+COPY ./app /app/app
+COPY ./main.py /app/
+COPY ./runserver.sh /app/
+
+# prevent uv failing with too many open files on big cpus
+ENV UV_CONCURRENT_INSTALLS=16
+
+# first install
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --compile-bytecode --locked
+
+EXPOSE 8000
+
+CMD ["sh", "/app/runserver.sh"]

gpu/self_hosted/app/auth.py

@@ -3,14 +3,14 @@ import os
 from fastapi import Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordBearer
 
-oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token", auto_error=False)
 
 
-def apikey_auth(apikey: str = Depends(oauth2_scheme)):
+def apikey_auth(apikey: str | None = Depends(oauth2_scheme)):
     required_key = os.environ.get("REFLECTOR_GPU_APIKEY")
     if not required_key:
         return
-    if apikey == required_key:
+    if apikey and apikey == required_key:
         return
     raise HTTPException(
         status_code=status.HTTP_401_UNAUTHORIZED,

gpu/self_hosted/app/services/diarizer.py

@@ -1,10 +1,65 @@
+import logging
 import os
+import tarfile
 import threading
+from pathlib import Path
+from urllib.request import urlopen
 
 import torch
 import torchaudio
+import yaml
 from pyannote.audio import Pipeline
 
+logger = logging.getLogger(__name__)
+
+S3_BUNDLE_URL = "https://reflector-public.s3.us-east-1.amazonaws.com/pyannote-speaker-diarization-3.1.tar.gz"
+BUNDLE_CACHE_DIR = Path("/root/.cache/pyannote-bundle")
+
+
+def _ensure_model(cache_dir: Path) -> str:
+    """Download and extract S3 model bundle if not cached."""
+    model_dir = cache_dir / "pyannote-speaker-diarization-3.1"
+    config_path = model_dir / "config.yaml"
+
+    if config_path.exists():
+        logger.info("Using cached model bundle at %s", model_dir)
+        return str(model_dir)
+
+    cache_dir.mkdir(parents=True, exist_ok=True)
+    tarball_path = cache_dir / "model.tar.gz"
+
+    logger.info("Downloading model bundle from %s", S3_BUNDLE_URL)
+    with urlopen(S3_BUNDLE_URL) as response, open(tarball_path, "wb") as f:
+        while chunk := response.read(8192):
+            f.write(chunk)
+
+    logger.info("Extracting model bundle")
+    with tarfile.open(tarball_path, "r:gz") as tar:
+        tar.extractall(path=cache_dir, filter="data")
+    tarball_path.unlink()
+
+    _patch_config(model_dir, cache_dir)
+    return str(model_dir)
+
+
+def _patch_config(model_dir: Path, cache_dir: Path) -> None:
+    """Rewrite config.yaml to reference local pytorch_model.bin paths."""
+    config_path = model_dir / "config.yaml"
+    with open(config_path) as f:
+        config = yaml.safe_load(f)
+
+    config["pipeline"]["params"]["segmentation"] = str(
+        cache_dir / "pyannote-segmentation-3.0" / "pytorch_model.bin"
+    )
+    config["pipeline"]["params"]["embedding"] = str(
+        cache_dir / "pyannote-wespeaker-voxceleb-resnet34-LM" / "pytorch_model.bin"
+    )
+
+    with open(config_path, "w") as f:
+        yaml.dump(config, f)
+
+    logger.info("Patched config.yaml with local model paths")
+
 
 class PyannoteDiarizationService:
     def __init__(self):
@@ -14,10 +69,20 @@ class PyannoteDiarizationService:
 
     def load(self):
         self._device = "cuda" if torch.cuda.is_available() else "cpu"
-        self._pipeline = Pipeline.from_pretrained(
-            "pyannote/speaker-diarization-3.1",
-            use_auth_token=os.environ.get("HF_TOKEN"),
-        )
+        hf_token = os.environ.get("HF_TOKEN")
+
+        if hf_token:
+            logger.info("Loading pyannote model from HuggingFace (HF_TOKEN set)")
+            self._pipeline = Pipeline.from_pretrained(
+                "pyannote/speaker-diarization-3.1",
+                use_auth_token=hf_token,
+            )
+        else:
+            logger.info("HF_TOKEN not set — loading model from S3 bundle")
+            model_path = _ensure_model(BUNDLE_CACHE_DIR)
+            config_path = Path(model_path) / "config.yaml"
+            self._pipeline = Pipeline.from_pretrained(str(config_path))
+
         self._pipeline.to(torch.device(self._device))
 
     def diarize_file(self, file_path: str, timestamp: float = 0.0) -> dict:

gpu/self_hosted/sequoia.config

@@ -0,0 +1,2 @@
+[hash_algorithms]
+sha1 = "always"

node_modules/.yarn-integrity

@@ -0,0 +1,10 @@
+{
+  "systemParams": "darwin-x64-83",
+  "modulesFolders": [],
+  "flags": [],
+  "linkedModules": [],
+  "topLevelPatterns": [],
+  "lockfileEntries": {},
+  "files": [],
+  "artifacts": {}
+}

scripts/garage.toml

@@ -0,0 +1,14 @@
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+replication_factor = 1
+
+rpc_secret = "__GARAGE_RPC_SECRET__"
+rpc_bind_addr = "[::]:3901"
+
+[s3_api]
+api_bind_addr = "[::]:3900"
+s3_region = "garage"
+root_domain = ".s3.garage.localhost"
+
+[admin]
+api_bind_addr = "[::]:3903"

scripts/install-docker-ubuntu.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+#
+# Install Docker Engine + Compose plugin on Ubuntu.
+# Ubuntu's default repos don't include docker-compose-plugin, so we add Docker's official repo.
+#
+# Usage:
+#   ./scripts/install-docker-ubuntu.sh
+#
+# Requires: root or sudo
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# --- Colors ---
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+info()  { echo -e "${CYAN}==>${NC} $*"; }
+ok()    { echo -e "${GREEN}  ✓${NC} $*"; }
+warn()  { echo -e "${YELLOW}  !${NC} $*"; }
+err()   { echo -e "${RED}  ✗${NC} $*" >&2; }
+
+# Use sudo if available and not root; otherwise run directly
+if [[ $(id -u) -eq 0 ]]; then
+    MAYBE_SUDO=""
+elif command -v sudo &>/dev/null; then
+    MAYBE_SUDO="sudo "
+else
+    err "Need root. Run as root or install sudo: apt install sudo"
+    exit 1
+fi
+
+# Check Ubuntu
+if [[ ! -f /etc/os-release ]]; then
+    err "Cannot detect OS. This script is for Ubuntu."
+    exit 1
+fi
+source /etc/os-release
+if [[ "${ID:-}" != "ubuntu" ]] && [[ "${ID_LIKE:-}" != *"ubuntu"* ]]; then
+    err "This script is for Ubuntu. Detected: ${ID:-unknown}"
+    exit 1
+fi
+
+info "Adding Docker's official repository..."
+${MAYBE_SUDO}apt update
+${MAYBE_SUDO}apt install -y ca-certificates curl
+${MAYBE_SUDO}install -m 0755 -d /etc/apt/keyrings
+${MAYBE_SUDO}rm -f /etc/apt/sources.list.d/docker.list /etc/apt/sources.list.d/docker.sources
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | ${MAYBE_SUDO}tee /etc/apt/keyrings/docker.asc > /dev/null
+${MAYBE_SUDO}chmod a+r /etc/apt/keyrings/docker.asc
+CODENAME="$(. /etc/os-release && echo "${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}")"
+[[ -z "$CODENAME" ]] && { err "Could not detect Ubuntu version codename."; exit 1; }
+${MAYBE_SUDO}tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
+Types: deb
+URIs: https://download.docker.com/linux/ubuntu
+Suites: ${CODENAME}
+Components: stable
+Signed-By: /etc/apt/keyrings/docker.asc
+EOF
+
+info "Installing Docker Engine and Compose plugin..."
+${MAYBE_SUDO}apt update
+${MAYBE_SUDO}apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
+if [[ -d /run/systemd/system ]]; then
+    info "Enabling and starting Docker..."
+    ${MAYBE_SUDO}systemctl enable --now docker
+else
+    err "No systemd. This script requires Ubuntu with systemd (e.g. DigitalOcean droplet)."
+    exit 1
+fi
+
+DOCKER_USER="${SUDO_USER:-${USER:-root}}"
+if [[ "$DOCKER_USER" != "root" ]]; then
+    info "Adding $DOCKER_USER to docker group..."
+    ${MAYBE_SUDO}usermod -aG docker "$DOCKER_USER"
+fi
+
+ok "Docker installed successfully."
+echo ""
+echo "  Log out and back in (or run: newgrp docker) so the group change takes effect."
+echo "  Then verify with: docker compose version"
+echo ""

scripts/setup-selfhosted.sh

@@ -0,0 +1,945 @@
+#!/usr/bin/env bash
+#
+# Self-hosted production setup for Reflector.
+# Single script to configure and launch everything on one server.
+#
+# Usage:
+#   ./scripts/setup-selfhosted.sh <--gpu|--cpu> [--ollama-gpu|--ollama-cpu] [--llm-model MODEL] [--garage] [--caddy] [--domain DOMAIN] [--build]
+#
+# Specialized models (pick ONE — required):
+#   --gpu              NVIDIA GPU for transcription/diarization/translation
+#   --cpu              CPU-only for transcription/diarization/translation (slower)
+#
+# Local LLM (optional — for summarization & topic detection):
+#   --ollama-gpu       Local Ollama with NVIDIA GPU acceleration
+#   --ollama-cpu       Local Ollama on CPU only
+#   --llm-model MODEL  Ollama model to use (default: qwen2.5:14b)
+#   (If omitted, configure an external OpenAI-compatible LLM in server/.env)
+#
+# Optional flags:
+#   --garage           Use Garage for local S3-compatible storage
+#   --caddy            Enable Caddy reverse proxy with auto-SSL
+#   --domain DOMAIN    Use a real domain for Caddy (enables Let's Encrypt auto-HTTPS)
+#                      Requires: DNS pointing to this server + ports 80/443 open
+#                      Without --domain: Caddy uses self-signed cert for IP access
+#   --build            Build backend and frontend images from source instead of pulling
+#
+# Examples:
+#   ./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy
+#   ./scripts/setup-selfhosted.sh --gpu --ollama-gpu --garage --caddy --domain reflector.example.com
+#   ./scripts/setup-selfhosted.sh --cpu --ollama-cpu --garage --caddy
+#   ./scripts/setup-selfhosted.sh --gpu --ollama-gpu --llm-model mistral --garage --caddy
+#   ./scripts/setup-selfhosted.sh --gpu --garage --caddy
+#   ./scripts/setup-selfhosted.sh --cpu
+#
+# Idempotent — safe to re-run at any time.
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+COMPOSE_FILE="$ROOT_DIR/docker-compose.selfhosted.yml"
+SERVER_ENV="$ROOT_DIR/server/.env"
+WWW_ENV="$ROOT_DIR/www/.env"
+
+OLLAMA_MODEL="qwen2.5:14b"
+OS="$(uname -s)"
+
+# --- Colors ---
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+info()  { echo -e "${CYAN}==>${NC} $*"; }
+ok()    { echo -e "${GREEN}  ✓${NC} $*"; }
+warn()  { echo -e "${YELLOW}  !${NC} $*"; }
+err()   { echo -e "${RED}  ✗${NC} $*" >&2; }
+
+# --- Helpers ---
+
+dump_diagnostics() {
+    local failed_svc="${1:-}"
+    echo ""
+    err "========== DIAGNOSTICS =========="
+
+    err "Container status:"
+    compose_cmd ps -a --format "table {{.Name}}\t{{.Status}}" 2>/dev/null || true
+    echo ""
+
+    local stopped
+    stopped=$(compose_cmd ps -a --format '{{.Name}}\t{{.Status}}' 2>/dev/null \
+        | grep -iv 'up\|running' | awk -F'\t' '{print $1}' || true)
+    for c in $stopped; do
+        err "--- Logs for $c (exited/unhealthy) ---"
+        docker logs --tail 30 "$c" 2>&1 || true
+        echo ""
+    done
+
+    if [[ -n "$failed_svc" ]]; then
+        err "--- Logs for $failed_svc (last 40) ---"
+        compose_cmd logs "$failed_svc" --tail 40 2>&1 || true
+    fi
+
+    err "================================="
+}
+
+trap 'dump_diagnostics' ERR
+
+detect_lan_ip() {
+    case "$OS" in
+        Darwin)
+            for iface in en0 en1 en2 en3; do
+                local ip
+                ip=$(ipconfig getifaddr "$iface" 2>/dev/null || true)
+                if [[ -n "$ip" ]]; then
+                    echo "$ip"
+                    return
+                fi
+            done
+            ;;
+        Linux)
+            ip route get 1.1.1.1 2>/dev/null | sed -n 's/.*src \([^ ]*\).*/\1/p'
+            return
+            ;;
+    esac
+    echo ""
+}
+
+wait_for_url() {
+    local url="$1" label="$2" retries="${3:-30}" interval="${4:-2}"
+    for i in $(seq 1 "$retries"); do
+        if curl -sf "$url" > /dev/null 2>&1; then
+            return 0
+        fi
+        echo -ne "\r  Waiting for $label... ($i/$retries)"
+        sleep "$interval"
+    done
+    echo ""
+    err "$label not responding at $url after $retries attempts"
+    return 1
+}
+
+env_has_key() {
+    local file="$1" key="$2"
+    grep -q "^${key}=" "$file" 2>/dev/null
+}
+
+env_get() {
+    local file="$1" key="$2"
+    grep "^${key}=" "$file" 2>/dev/null | head -1 | cut -d= -f2-
+}
+
+env_set() {
+    local file="$1" key="$2" value="$3"
+    if env_has_key "$file" "$key"; then
+        if [[ "$OS" == "Darwin" ]]; then
+            sed -i '' "s|^${key}=.*|${key}=${value}|" "$file"
+        else
+            sed -i "s|^${key}=.*|${key}=${value}|" "$file"
+        fi
+    else
+        echo "${key}=${value}" >> "$file"
+    fi
+}
+
+compose_cmd() {
+    local profiles=""
+    for p in "${COMPOSE_PROFILES[@]}"; do
+        profiles="$profiles --profile $p"
+    done
+    docker compose -f "$COMPOSE_FILE" $profiles "$@"
+}
+
+# Compose command with only garage profile (for garage-only operations before full stack start)
+compose_garage_cmd() {
+    docker compose -f "$COMPOSE_FILE" --profile garage "$@"
+}
+
+# --- Parse arguments ---
+MODEL_MODE=""       # gpu or cpu (required, mutually exclusive)
+OLLAMA_MODE=""      # ollama-gpu or ollama-cpu (optional)
+USE_GARAGE=false
+USE_CADDY=false
+CUSTOM_DOMAIN=""    # optional domain for Let's Encrypt HTTPS
+BUILD_IMAGES=false  # build backend/frontend from source
+
+SKIP_NEXT=false
+ARGS=("$@")
+for i in "${!ARGS[@]}"; do
+    if [[ "$SKIP_NEXT" == "true" ]]; then
+        SKIP_NEXT=false
+        continue
+    fi
+    arg="${ARGS[$i]}"
+    case "$arg" in
+        --gpu)
+            [[ -n "$MODEL_MODE" ]] && { err "Cannot combine --gpu and --cpu. Pick one."; exit 1; }
+            MODEL_MODE="gpu" ;;
+        --cpu)
+            [[ -n "$MODEL_MODE" ]] && { err "Cannot combine --gpu and --cpu. Pick one."; exit 1; }
+            MODEL_MODE="cpu" ;;
+        --ollama-gpu)
+            [[ -n "$OLLAMA_MODE" ]] && { err "Cannot combine --ollama-gpu and --ollama-cpu. Pick one."; exit 1; }
+            OLLAMA_MODE="ollama-gpu" ;;
+        --ollama-cpu)
+            [[ -n "$OLLAMA_MODE" ]] && { err "Cannot combine --ollama-gpu and --ollama-cpu. Pick one."; exit 1; }
+            OLLAMA_MODE="ollama-cpu" ;;
+        --llm-model)
+            next_i=$((i + 1))
+            if [[ $next_i -ge ${#ARGS[@]} ]] || [[ "${ARGS[$next_i]}" == --* ]]; then
+                err "--llm-model requires a model name (e.g. --llm-model mistral)"
+                exit 1
+            fi
+            OLLAMA_MODEL="${ARGS[$next_i]}"
+            SKIP_NEXT=true ;;
+        --garage)       USE_GARAGE=true ;;
+        --caddy)        USE_CADDY=true ;;
+        --build)        BUILD_IMAGES=true ;;
+        --domain)
+            next_i=$((i + 1))
+            if [[ $next_i -ge ${#ARGS[@]} ]] || [[ "${ARGS[$next_i]}" == --* ]]; then
+                err "--domain requires a domain name (e.g. --domain reflector.example.com)"
+                exit 1
+            fi
+            CUSTOM_DOMAIN="${ARGS[$next_i]}"
+            USE_CADDY=true  # --domain implies --caddy
+            SKIP_NEXT=true ;;
+        *)
+            err "Unknown argument: $arg"
+            err "Usage: $0 <--gpu|--cpu> [--ollama-gpu|--ollama-cpu] [--llm-model MODEL] [--garage] [--caddy] [--domain DOMAIN] [--build]"
+            exit 1
+            ;;
+    esac
+done
+
+if [[ -z "$MODEL_MODE" ]]; then
+    err "No model mode specified. You must choose --gpu or --cpu."
+    err ""
+    err "Usage: $0 <--gpu|--cpu> [--ollama-gpu|--ollama-cpu] [--llm-model MODEL] [--garage] [--caddy] [--domain DOMAIN] [--build]"
+    err ""
+    err "Specialized models (required):"
+    err "  --gpu              NVIDIA GPU for transcription/diarization/translation"
+    err "  --cpu              CPU-only (slower but works without GPU)"
+    err ""
+    err "Local LLM (optional):"
+    err "  --ollama-gpu       Local Ollama with GPU (for summarization/topics)"
+    err "  --ollama-cpu       Local Ollama on CPU (for summarization/topics)"
+    err "  --llm-model MODEL  Ollama model to download (default: qwen2.5:14b)"
+    err "  (omit --ollama-* for external OpenAI-compatible LLM)"
+    err ""
+    err "Other options:"
+    err "  --garage           Local S3-compatible storage (Garage)"
+    err "  --caddy            Caddy reverse proxy with self-signed cert"
+    err "  --domain DOMAIN    Use a real domain with Let's Encrypt HTTPS (implies --caddy)"
+    err "  --build            Build backend/frontend images from source instead of pulling"
+    exit 1
+fi
+
+# Build profiles list — one profile per feature
+COMPOSE_PROFILES=("$MODEL_MODE")
+[[ -n "$OLLAMA_MODE" ]] && COMPOSE_PROFILES+=("$OLLAMA_MODE")
+[[ "$USE_GARAGE" == "true" ]] && COMPOSE_PROFILES+=("garage")
+[[ "$USE_CADDY" == "true" ]] && COMPOSE_PROFILES+=("caddy")
+
+# Derived flags
+NEEDS_NVIDIA=false
+[[ "$MODEL_MODE" == "gpu" ]] && NEEDS_NVIDIA=true
+[[ "$OLLAMA_MODE" == "ollama-gpu" ]] && NEEDS_NVIDIA=true
+
+USES_OLLAMA=false
+OLLAMA_SVC=""
+[[ "$OLLAMA_MODE" == "ollama-gpu" ]] && USES_OLLAMA=true && OLLAMA_SVC="ollama"
+[[ "$OLLAMA_MODE" == "ollama-cpu" ]] && USES_OLLAMA=true && OLLAMA_SVC="ollama-cpu"
+
+# Human-readable mode string for display
+MODE_DISPLAY="$MODEL_MODE"
+[[ -n "$OLLAMA_MODE" ]] && MODE_DISPLAY="$MODEL_MODE + $OLLAMA_MODE"
+
+# =========================================================
+# Step 0: Prerequisites
+# =========================================================
+step_prerequisites() {
+    info "Step 0: Checking prerequisites"
+
+    # Docker
+    if ! docker compose version 2>/dev/null | grep -qi compose; then
+        err "Docker Compose V2 not found."
+        err "Install Docker with Compose V2: https://docs.docker.com/engine/install/"
+        exit 1
+    fi
+    if ! docker info &>/dev/null; then
+        err "Docker daemon not running."
+        exit 1
+    fi
+    ok "Docker + Compose V2 ready"
+
+    # NVIDIA GPU check
+    if [[ "$NEEDS_NVIDIA" == "true" ]]; then
+        if ! command -v nvidia-smi &>/dev/null || ! nvidia-smi &>/dev/null; then
+            err "NVIDIA GPU required (model=$MODEL_MODE, ollama=$OLLAMA_MODE) but nvidia-smi failed."
+            err "Install NVIDIA drivers and nvidia-container-toolkit."
+            exit 1
+        fi
+        ok "NVIDIA GPU detected"
+    fi
+
+    # Compose file
+    if [[ ! -f "$COMPOSE_FILE" ]]; then
+        err "docker-compose.selfhosted.yml not found at $COMPOSE_FILE"
+        err "Run this script from the repo root: ./scripts/setup-selfhosted.sh"
+        exit 1
+    fi
+
+    ok "Prerequisites OK (models=$MODEL_MODE, ollama=$OLLAMA_MODE, garage=$USE_GARAGE, caddy=$USE_CADDY)"
+}
+
+# =========================================================
+# Step 1: Generate secrets
+# =========================================================
+step_secrets() {
+    info "Step 1: Generating secrets"
+
+    # These are used in later steps — generate once, reuse
+    if [[ -f "$SERVER_ENV" ]] && env_has_key "$SERVER_ENV" "SECRET_KEY"; then
+        SECRET_KEY=$(env_get "$SERVER_ENV" "SECRET_KEY")
+        if [[ "$SECRET_KEY" != "changeme"* ]]; then
+            ok "SECRET_KEY already set"
+        else
+            SECRET_KEY=$(openssl rand -hex 32)
+        fi
+    else
+        SECRET_KEY=$(openssl rand -hex 32)
+    fi
+
+    if [[ -f "$WWW_ENV" ]] && env_has_key "$WWW_ENV" "NEXTAUTH_SECRET"; then
+        NEXTAUTH_SECRET=$(env_get "$WWW_ENV" "NEXTAUTH_SECRET")
+        if [[ "$NEXTAUTH_SECRET" != "changeme"* ]]; then
+            ok "NEXTAUTH_SECRET already set"
+        else
+            NEXTAUTH_SECRET=$(openssl rand -hex 32)
+        fi
+    else
+        NEXTAUTH_SECRET=$(openssl rand -hex 32)
+    fi
+
+    ok "Secrets ready"
+}
+
+# =========================================================
+# Step 2: Generate server/.env
+# =========================================================
+step_server_env() {
+    info "Step 2: Generating server/.env"
+
+    if [[ -f "$SERVER_ENV" ]]; then
+        ok "server/.env already exists — ensuring required vars"
+    else
+        cp "$ROOT_DIR/server/.env.selfhosted.example" "$SERVER_ENV"
+        ok "Created server/.env from template"
+    fi
+
+    # Core infrastructure
+    env_set "$SERVER_ENV" "DATABASE_URL" "postgresql+asyncpg://reflector:reflector@postgres:5432/reflector"
+    env_set "$SERVER_ENV" "REDIS_HOST" "redis"
+    env_set "$SERVER_ENV" "CELERY_BROKER_URL" "redis://redis:6379/1"
+    env_set "$SERVER_ENV" "CELERY_RESULT_BACKEND" "redis://redis:6379/1"
+    env_set "$SERVER_ENV" "SECRET_KEY" "$SECRET_KEY"
+    env_set "$SERVER_ENV" "AUTH_BACKEND" "none"
+    env_set "$SERVER_ENV" "PUBLIC_MODE" "true"
+
+    # Public-facing URLs
+    local server_base_url
+    if [[ -n "$CUSTOM_DOMAIN" ]]; then
+        server_base_url="https://$CUSTOM_DOMAIN"
+    elif [[ "$USE_CADDY" == "true" ]]; then
+        if [[ -n "$PRIMARY_IP" ]]; then
+            server_base_url="https://$PRIMARY_IP"
+        else
+            server_base_url="https://localhost"
+        fi
+    else
+        if [[ -n "$PRIMARY_IP" ]]; then
+            server_base_url="http://$PRIMARY_IP"
+        else
+            server_base_url="http://localhost:1250"
+        fi
+    fi
+    env_set "$SERVER_ENV" "BASE_URL" "$server_base_url"
+    env_set "$SERVER_ENV" "CORS_ORIGIN" "$server_base_url"
+
+    # WebRTC: advertise host IP in ICE candidates so browsers can reach the server
+    if [[ -n "$PRIMARY_IP" ]]; then
+        env_set "$SERVER_ENV" "WEBRTC_HOST" "$PRIMARY_IP"
+    fi
+
+    # Specialized models (always via gpu/cpu container aliased as "transcription")
+    env_set "$SERVER_ENV" "TRANSCRIPT_BACKEND" "modal"
+    env_set "$SERVER_ENV" "TRANSCRIPT_URL" "http://transcription:8000"
+    env_set "$SERVER_ENV" "TRANSCRIPT_MODAL_API_KEY" "selfhosted"
+    env_set "$SERVER_ENV" "DIARIZATION_ENABLED" "true"
+    env_set "$SERVER_ENV" "DIARIZATION_BACKEND" "modal"
+    env_set "$SERVER_ENV" "DIARIZATION_URL" "http://transcription:8000"
+    env_set "$SERVER_ENV" "TRANSLATION_BACKEND" "modal"
+    env_set "$SERVER_ENV" "TRANSLATE_URL" "http://transcription:8000"
+
+    # HuggingFace token for gated models (pyannote diarization)
+    # Written to root .env so docker compose picks it up for gpu/cpu containers
+    local root_env="$ROOT_DIR/.env"
+    local current_hf_token="${HF_TOKEN:-}"
+    if [[ -f "$root_env" ]] && env_has_key "$root_env" "HF_TOKEN"; then
+        current_hf_token=$(env_get "$root_env" "HF_TOKEN")
+    fi
+    if [[ -z "$current_hf_token" ]]; then
+        echo ""
+        warn "HF_TOKEN not set. Diarization will use a public model fallback."
+        warn "For best results, get a token at https://huggingface.co/settings/tokens"
+        warn "and accept pyannote licenses at https://huggingface.co/pyannote/speaker-diarization-3.1"
+        read -rp "  HuggingFace token (or press Enter to skip): " current_hf_token
+    fi
+    if [[ -n "$current_hf_token" ]]; then
+        touch "$root_env"
+        env_set "$root_env" "HF_TOKEN" "$current_hf_token"
+        export HF_TOKEN="$current_hf_token"
+        ok "HF_TOKEN configured"
+    else
+        touch "$root_env"
+        env_set "$root_env" "HF_TOKEN" ""
+        ok "HF_TOKEN skipped (using public model fallback)"
+    fi
+
+    # LLM configuration
+    if [[ "$USES_OLLAMA" == "true" ]]; then
+        local llm_host="$OLLAMA_SVC"
+        env_set "$SERVER_ENV" "LLM_URL" "http://${llm_host}:11434/v1"
+        env_set "$SERVER_ENV" "LLM_MODEL" "$OLLAMA_MODEL"
+        env_set "$SERVER_ENV" "LLM_API_KEY" "not-needed"
+        ok "LLM configured for local Ollama ($llm_host, model=$OLLAMA_MODEL)"
+    else
+        # Check if user already configured LLM
+        local current_llm_url=""
+        if env_has_key "$SERVER_ENV" "LLM_URL"; then
+            current_llm_url=$(env_get "$SERVER_ENV" "LLM_URL")
+        fi
+        if [[ -z "$current_llm_url" ]] || [[ "$current_llm_url" == "http://host.docker.internal"* ]]; then
+            warn "LLM not configured. Summarization and topic detection will NOT work."
+            warn "Edit server/.env and set LLM_URL, LLM_API_KEY, LLM_MODEL"
+            warn "Example: LLM_URL=https://api.openai.com/v1  LLM_MODEL=gpt-4o-mini"
+        else
+            ok "LLM already configured: $current_llm_url"
+        fi
+    fi
+
+    ok "server/.env ready"
+}
+
+# =========================================================
+# Step 3: Generate www/.env
+# =========================================================
+step_www_env() {
+    info "Step 3: Generating www/.env"
+
+    if [[ -f "$WWW_ENV" ]]; then
+        ok "www/.env already exists — ensuring required vars"
+    else
+        cp "$ROOT_DIR/www/.env.selfhosted.example" "$WWW_ENV"
+        ok "Created www/.env from template"
+    fi
+
+    # Public-facing URL for frontend
+    local base_url
+    if [[ -n "$CUSTOM_DOMAIN" ]]; then
+        base_url="https://$CUSTOM_DOMAIN"
+    elif [[ "$USE_CADDY" == "true" ]]; then
+        if [[ -n "$PRIMARY_IP" ]]; then
+            base_url="https://$PRIMARY_IP"
+        else
+            base_url="https://localhost"
+        fi
+    else
+        # No Caddy — user's proxy handles SSL. Use http for now, they'll override.
+        if [[ -n "$PRIMARY_IP" ]]; then
+            base_url="http://$PRIMARY_IP"
+        else
+            base_url="http://localhost"
+        fi
+    fi
+
+    env_set "$WWW_ENV" "SITE_URL" "$base_url"
+    env_set "$WWW_ENV" "NEXTAUTH_URL" "$base_url"
+    env_set "$WWW_ENV" "NEXTAUTH_SECRET" "$NEXTAUTH_SECRET"
+    env_set "$WWW_ENV" "API_URL" "$base_url"
+    env_set "$WWW_ENV" "WEBSOCKET_URL" "auto"
+    env_set "$WWW_ENV" "SERVER_API_URL" "http://server:1250"
+    env_set "$WWW_ENV" "KV_URL" "redis://redis:6379"
+    env_set "$WWW_ENV" "FEATURE_REQUIRE_LOGIN" "false"
+
+    ok "www/.env ready (URL=$base_url)"
+}
+
+# =========================================================
+# Step 4: Storage setup
+# =========================================================
+step_storage() {
+    info "Step 4: Storage setup"
+
+    if [[ "$USE_GARAGE" == "true" ]]; then
+        step_garage
+    else
+        step_external_s3
+    fi
+}
+
+step_garage() {
+    info "Configuring Garage (local S3)"
+
+    # Generate garage.toml from template
+    local garage_toml="$ROOT_DIR/scripts/garage.toml"
+    local garage_runtime="$ROOT_DIR/data/garage.toml"
+    mkdir -p "$ROOT_DIR/data"
+
+    if [[ -d "$garage_runtime" ]]; then
+        rm -rf "$garage_runtime"
+    fi
+    if [[ ! -f "$garage_runtime" ]]; then
+        local rpc_secret
+        rpc_secret=$(openssl rand -hex 32)
+        sed "s|__GARAGE_RPC_SECRET__|${rpc_secret}|" "$garage_toml" > "$garage_runtime"
+        ok "Generated data/garage.toml"
+    else
+        ok "data/garage.toml already exists"
+    fi
+
+    # Start garage container only
+    compose_garage_cmd up -d garage
+
+    # Wait for admin API (port 3903 exposed to host for health checks)
+    local garage_ready=false
+    for i in $(seq 1 30); do
+        if curl -sf http://localhost:3903/metrics > /dev/null 2>&1; then
+            garage_ready=true
+            break
+        fi
+        echo -ne "\r  Waiting for Garage admin API... ($i/30)"
+        sleep 2
+    done
+    echo ""
+    if [[ "$garage_ready" != "true" ]]; then
+        err "Garage not responding. Check: docker compose logs garage"
+        exit 1
+    fi
+
+    # Layout
+    local node_id
+    node_id=$(compose_garage_cmd exec -T garage /garage node id -q 2>/dev/null | tr -d '[:space:]')
+    local layout_status
+    layout_status=$(compose_garage_cmd exec -T garage /garage layout show 2>&1 || true)
+    if echo "$layout_status" | grep -q "No nodes"; then
+        compose_garage_cmd exec -T garage /garage layout assign "$node_id" -c 1G -z dc1
+        compose_garage_cmd exec -T garage /garage layout apply --version 1
+    fi
+
+    # Bucket
+    if ! compose_garage_cmd exec -T garage /garage bucket info reflector-media &>/dev/null; then
+        compose_garage_cmd exec -T garage /garage bucket create reflector-media
+    fi
+
+    # Key
+    local created_key=false
+    if compose_garage_cmd exec -T garage /garage key info reflector &>/dev/null; then
+        ok "Key 'reflector' already exists"
+    else
+        KEY_OUTPUT=$(compose_garage_cmd exec -T garage /garage key create reflector)
+        created_key=true
+    fi
+
+    # Permissions
+    compose_garage_cmd exec -T garage /garage bucket allow reflector-media --read --write --key reflector
+
+    # Write S3 credentials to server/.env
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_BACKEND" "aws"
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL" "http://garage:3900"
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_BUCKET_NAME" "reflector-media"
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_REGION" "garage"
+    if [[ "$created_key" == "true" ]]; then
+        local key_id key_secret
+        key_id=$(echo "$KEY_OUTPUT" | grep -i "key id" | awk '{print $NF}')
+        key_secret=$(echo "$KEY_OUTPUT" | grep -i "secret key" | awk '{print $NF}')
+        env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID" "$key_id"
+        env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY" "$key_secret"
+    fi
+
+    ok "Garage storage ready"
+}
+
+step_external_s3() {
+    info "Checking external S3 configuration"
+
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_BACKEND" "aws"
+
+    local s3_vars=("TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID" "TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY" "TRANSCRIPT_STORAGE_AWS_BUCKET_NAME" "TRANSCRIPT_STORAGE_AWS_REGION")
+    local missing=()
+
+    for var in "${s3_vars[@]}"; do
+        if ! env_has_key "$SERVER_ENV" "$var" || [[ -z "$(env_get "$SERVER_ENV" "$var")" ]]; then
+            missing+=("$var")
+        fi
+    done
+
+    if [[ ${#missing[@]} -gt 0 ]]; then
+        warn "S3 storage is REQUIRED. The following vars are missing in server/.env:"
+        for var in "${missing[@]}"; do
+            warn "  $var"
+        done
+        echo ""
+        info "Enter S3 credentials (or press Ctrl+C to abort and edit server/.env manually):"
+        echo ""
+
+        for var in "${missing[@]}"; do
+            local prompt_label
+            case "$var" in
+                *ACCESS_KEY_ID)      prompt_label="Access Key ID" ;;
+                *SECRET_ACCESS_KEY)  prompt_label="Secret Access Key" ;;
+                *BUCKET_NAME)        prompt_label="Bucket Name" ;;
+                *REGION)             prompt_label="Region (e.g. us-east-1)" ;;
+            esac
+            local value=""
+            while [[ -z "$value" ]]; do
+                read -rp "  $prompt_label: " value
+            done
+            env_set "$SERVER_ENV" "$var" "$value"
+        done
+
+        # Optional: endpoint URL for non-AWS S3
+        echo ""
+        read -rp "  S3 Endpoint URL (leave empty for AWS, or enter for MinIO/etc.): " endpoint_url
+        if [[ -n "$endpoint_url" ]]; then
+            env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL" "$endpoint_url"
+        fi
+    fi
+
+    ok "S3 storage configured"
+}
+
+# =========================================================
+# Step 5: Caddyfile
+# =========================================================
+step_caddyfile() {
+    if [[ "$USE_CADDY" != "true" ]]; then
+        return
+    fi
+
+    info "Step 5: Caddyfile setup"
+
+    local caddyfile="$ROOT_DIR/Caddyfile"
+    if [[ -d "$caddyfile" ]]; then
+        rm -rf "$caddyfile"
+    fi
+
+    if [[ -n "$CUSTOM_DOMAIN" ]]; then
+        # Real domain: Caddy auto-provisions Let's Encrypt certificate
+        cat > "$caddyfile" << CADDYEOF
+# Generated by setup-selfhosted.sh — Let's Encrypt HTTPS for $CUSTOM_DOMAIN
+$CUSTOM_DOMAIN {
+    handle /v1/* {
+        reverse_proxy server:1250
+    }
+    handle /health {
+        reverse_proxy server:1250
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}
+CADDYEOF
+        ok "Created Caddyfile for $CUSTOM_DOMAIN (Let's Encrypt auto-HTTPS)"
+    elif [[ -n "$PRIMARY_IP" ]]; then
+        # No domain, IP only: catch-all :443 with self-signed cert
+        # (IP connections don't send SNI, so we can't match by address)
+        cat > "$caddyfile" << CADDYEOF
+# Generated by setup-selfhosted.sh — self-signed cert for IP access
+:443 {
+    tls internal
+    handle /v1/* {
+        reverse_proxy server:1250
+    }
+    handle /health {
+        reverse_proxy server:1250
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}
+CADDYEOF
+        ok "Created Caddyfile for $PRIMARY_IP (catch-all :443 with self-signed cert)"
+    elif [[ ! -f "$caddyfile" ]]; then
+        cp "$ROOT_DIR/Caddyfile.selfhosted.example" "$caddyfile"
+        ok "Created Caddyfile from template"
+    else
+        ok "Caddyfile already exists"
+    fi
+}
+
+# =========================================================
+# Step 6: Start services
+# =========================================================
+step_services() {
+    info "Step 6: Starting Docker services"
+
+    # Build GPU/CPU image from source (always needed — no prebuilt image)
+    local build_svc="$MODEL_MODE"
+    info "Building $build_svc image (first build downloads ML models, may take a while)..."
+    compose_cmd build "$build_svc"
+    ok "$build_svc image built"
+
+    # Build or pull backend and frontend images
+    if [[ "$BUILD_IMAGES" == "true" ]]; then
+        info "Building backend image from source (server, worker, beat)..."
+        compose_cmd build server worker beat
+        ok "Backend image built"
+        info "Building frontend image from source..."
+        compose_cmd build web
+        ok "Frontend image built"
+    else
+        info "Pulling latest backend and frontend images..."
+        compose_cmd pull server web || warn "Pull failed — using cached images"
+    fi
+
+    # Start all services
+    compose_cmd up -d
+    ok "Containers started"
+
+    # Quick sanity check
+    sleep 3
+    local exited
+    exited=$(compose_cmd ps -a --format '{{.Name}} {{.Status}}' 2>/dev/null \
+        | grep -i 'exit' || true)
+    if [[ -n "$exited" ]]; then
+        warn "Some containers exited immediately:"
+        echo "$exited" | while read -r line; do warn "  $line"; done
+        dump_diagnostics
+    fi
+}
+
+# =========================================================
+# Step 7: Health checks
+# =========================================================
+step_health() {
+    info "Step 7: Health checks"
+
+    # Specialized model service (gpu or cpu)
+    local model_svc="$MODEL_MODE"
+
+    info "Waiting for $model_svc service (first start downloads ~1GB of models)..."
+    local model_ok=false
+    for i in $(seq 1 120); do
+        if curl -sf http://localhost:8000/docs > /dev/null 2>&1; then
+            model_ok=true
+            break
+        fi
+        echo -ne "\r  Waiting for $model_svc service... ($i/120)"
+        sleep 5
+    done
+    echo ""
+    if [[ "$model_ok" == "true" ]]; then
+        ok "$model_svc service healthy (transcription + diarization)"
+    else
+        warn "$model_svc service not ready yet — it will keep loading in the background"
+        warn "Check with: docker compose -f docker-compose.selfhosted.yml logs $model_svc"
+    fi
+
+    # Ollama (if applicable)
+    if [[ "$USES_OLLAMA" == "true" ]]; then
+        info "Waiting for Ollama service..."
+        local ollama_ok=false
+        for i in $(seq 1 60); do
+            if curl -sf http://localhost:11434/api/tags > /dev/null 2>&1; then
+                ollama_ok=true
+                break
+            fi
+            echo -ne "\r  Waiting for Ollama... ($i/60)"
+            sleep 3
+        done
+        echo ""
+        if [[ "$ollama_ok" == "true" ]]; then
+            ok "Ollama service healthy"
+
+            # Pull model if not present
+            if compose_cmd exec -T "$OLLAMA_SVC" ollama list 2>/dev/null | awk '{print $1}' | grep -qxF "$OLLAMA_MODEL"; then
+                ok "Model $OLLAMA_MODEL already pulled"
+            else
+                info "Pulling model $OLLAMA_MODEL (this may take a while)..."
+                compose_cmd exec -T "$OLLAMA_SVC" ollama pull "$OLLAMA_MODEL"
+                ok "Model $OLLAMA_MODEL pulled"
+            fi
+        else
+            warn "Ollama not ready yet. Check: docker compose logs $OLLAMA_SVC"
+        fi
+    fi
+
+    # Server API
+    info "Waiting for Server API (first run includes database migrations)..."
+    local server_ok=false
+    for i in $(seq 1 90); do
+        local svc_status
+        svc_status=$(compose_cmd ps server --format '{{.Status}}' 2>/dev/null || true)
+        if [[ -z "$svc_status" ]] || echo "$svc_status" | grep -qi 'exit'; then
+            echo ""
+            err "Server container exited unexpectedly"
+            dump_diagnostics server
+            exit 1
+        fi
+        if curl -sf http://localhost:1250/health > /dev/null 2>&1; then
+            server_ok=true
+            break
+        fi
+        echo -ne "\r  Waiting for Server API... ($i/90)"
+        sleep 5
+    done
+    echo ""
+    if [[ "$server_ok" == "true" ]]; then
+        ok "Server API healthy"
+    else
+        err "Server API not ready after ~7 minutes"
+        dump_diagnostics server
+        exit 1
+    fi
+
+    # Frontend
+    info "Waiting for Frontend..."
+    local web_ok=false
+    for i in $(seq 1 30); do
+        if curl -sf http://localhost:3000 > /dev/null 2>&1; then
+            web_ok=true
+            break
+        fi
+        echo -ne "\r  Waiting for Frontend... ($i/30)"
+        sleep 3
+    done
+    echo ""
+    if [[ "$web_ok" == "true" ]]; then
+        ok "Frontend healthy"
+    else
+        warn "Frontend not responding. Check: docker compose logs web"
+    fi
+
+    # Caddy
+    if [[ "$USE_CADDY" == "true" ]]; then
+        sleep 2
+        if curl -sfk "https://localhost" > /dev/null 2>&1; then
+            ok "Caddy proxy healthy"
+        else
+            warn "Caddy proxy not responding. Check: docker compose logs caddy"
+        fi
+    fi
+
+    # LLM warning for non-Ollama modes
+    if [[ "$USES_OLLAMA" == "false" ]]; then
+        local llm_url=""
+        if env_has_key "$SERVER_ENV" "LLM_URL"; then
+            llm_url=$(env_get "$SERVER_ENV" "LLM_URL")
+        fi
+        if [[ -z "$llm_url" ]]; then
+            echo ""
+            warn "LLM is not configured. Transcription will work, but:"
+            warn "  - Summaries will NOT be generated"
+            warn "  - Topics will NOT be detected"
+            warn "  - Titles will NOT be auto-generated"
+            warn "Configure in server/.env: LLM_URL, LLM_API_KEY, LLM_MODEL"
+        fi
+    fi
+}
+
+# =========================================================
+# Main
+# =========================================================
+main() {
+    echo ""
+    echo "=========================================="
+    echo " Reflector — Self-Hosted Production Setup"
+    echo "=========================================="
+    echo ""
+    echo "  Models:  $MODEL_MODE"
+    echo "  LLM:     ${OLLAMA_MODE:-external}"
+    echo "  Garage:  $USE_GARAGE"
+    echo "  Caddy:   $USE_CADDY"
+    [[ -n "$CUSTOM_DOMAIN" ]] && echo "  Domain:  $CUSTOM_DOMAIN"
+    [[ "$BUILD_IMAGES" == "true" ]] && echo "  Build:   from source"
+    echo ""
+
+    # Detect primary IP
+    PRIMARY_IP=""
+    if [[ "$OS" == "Linux" ]]; then
+        PRIMARY_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || true)
+        if [[ "$PRIMARY_IP" == "127."* ]] || [[ -z "$PRIMARY_IP" ]]; then
+            PRIMARY_IP=$(ip -4 route get 1 2>/dev/null | sed -n 's/.*src \([0-9.]*\).*/\1/p' || true)
+        fi
+    fi
+
+    # Touch env files so compose doesn't complain about missing env_file
+    mkdir -p "$ROOT_DIR/data"
+    touch "$SERVER_ENV" "$WWW_ENV"
+
+    # Ensure garage.toml exists if garage profile is active (compose needs it for volume mount)
+    if [[ "$USE_GARAGE" == "true" ]]; then
+        local garage_runtime="$ROOT_DIR/data/garage.toml"
+        if [[ ! -f "$garage_runtime" ]]; then
+            local rpc_secret
+            rpc_secret=$(openssl rand -hex 32)
+            sed "s|__GARAGE_RPC_SECRET__|${rpc_secret}|" "$ROOT_DIR/scripts/garage.toml" > "$garage_runtime"
+        fi
+    fi
+
+    step_prerequisites
+    echo ""
+    step_secrets
+    echo ""
+    step_server_env
+    echo ""
+    step_www_env
+    echo ""
+    step_storage
+    echo ""
+    step_caddyfile
+    echo ""
+    step_services
+    echo ""
+    step_health
+
+    echo ""
+    echo "=========================================="
+    echo -e " ${GREEN}Reflector is running!${NC}"
+    echo "=========================================="
+    echo ""
+    if [[ "$USE_CADDY" == "true" ]]; then
+        if [[ -n "$CUSTOM_DOMAIN" ]]; then
+            echo "  App:   https://$CUSTOM_DOMAIN"
+            echo "  API:   https://$CUSTOM_DOMAIN/v1/"
+        elif [[ -n "$PRIMARY_IP" ]]; then
+            echo "  App:   https://$PRIMARY_IP  (accept self-signed cert in browser)"
+            echo "  API:   https://$PRIMARY_IP/v1/"
+            echo "  Local: https://localhost"
+        else
+            echo "  App:   https://localhost  (accept self-signed cert in browser)"
+            echo "  API:   https://localhost/v1/"
+        fi
+    else
+        echo "  No Caddy — point your reverse proxy at:"
+        echo "    Frontend:  web:3000   (or localhost:3000 from host)"
+        echo "    API:       server:1250 (or localhost:1250 from host)"
+    fi
+    echo ""
+    echo "  Models:  $MODEL_MODE (transcription/diarization/translation)"
+    [[ "$USE_GARAGE" == "true" ]] && echo "  Storage: Garage (local S3)"
+    [[ "$USE_GARAGE" != "true" ]] && echo "  Storage: External S3"
+    [[ "$USES_OLLAMA" == "true" ]] && echo "  LLM:     Ollama ($OLLAMA_MODEL) for summarization/topics"
+    [[ "$USES_OLLAMA" != "true" ]] && echo "  LLM:     External (configure in server/.env)"
+    echo ""
+    echo "  To stop:   docker compose -f docker-compose.selfhosted.yml down"
+    echo "  To re-run: ./scripts/setup-selfhosted.sh $*"
+    echo ""
+}
+
+main "$@"

scripts/setup-standalone.sh

@@ -0,0 +1,675 @@
+#!/usr/bin/env bash
+#
+# Standalone local development setup for Reflector.
+# Takes a fresh clone to a working instance — no cloud accounts, no API keys.
+#
+# Usage:
+#   ./scripts/setup-standalone.sh
+#
+# Idempotent — safe to re-run at any time.
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+SERVER_ENV="$ROOT_DIR/server/.env"
+WWW_ENV="$ROOT_DIR/www/.env.local"
+
+MODEL="${LLM_MODEL:-qwen2.5:14b}"
+OLLAMA_PORT="${OLLAMA_PORT:-11434}"
+
+OS="$(uname -s)"
+
+# --- Colors ---
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+info()  { echo -e "${CYAN}==>${NC} $*"; }
+ok()    { echo -e "${GREEN}  ✓${NC} $*"; }
+warn()  { echo -e "${YELLOW}  !${NC} $*"; }
+err()   { echo -e "${RED}  ✗${NC} $*" >&2; }
+
+# --- Helpers ---
+
+dump_diagnostics() {
+    local failed_svc="${1:-}"
+    echo ""
+    err "========== DIAGNOSTICS =========="
+
+    err "Container status:"
+    compose_cmd ps -a --format "table {{.Name}}\t{{.Status}}" 2>/dev/null || true
+    echo ""
+
+    # Show logs for any container that exited
+    local stopped
+    stopped=$(compose_cmd ps -a --format '{{.Name}}\t{{.Status}}' 2>/dev/null \
+        | grep -iv 'up\|running' | awk -F'\t' '{print $1}' || true)
+    for c in $stopped; do
+        err "--- Logs for $c (exited/unhealthy) ---"
+        docker logs --tail 30 "$c" 2>&1 || true
+        echo ""
+    done
+
+    # If a specific service failed, always show its logs
+    if [[ -n "$failed_svc" ]]; then
+        err "--- Logs for $failed_svc (last 40) ---"
+        compose_cmd logs "$failed_svc" --tail 40 2>&1 || true
+        echo ""
+        # Try health check from inside the container as extra signal
+        err "--- Internal health check ($failed_svc) ---"
+        compose_cmd exec -T "$failed_svc" \
+            curl -sf http://localhost:1250/health 2>&1 || echo "(not reachable internally either)"
+    fi
+
+    err "================================="
+}
+
+trap 'dump_diagnostics' ERR
+
+# Get the image ID for a compose service (works even when containers are not running).
+svc_image_id() {
+    local svc="$1"
+    # Extract image name from compose config YAML, fall back to <project>-<service>
+    local img_name
+    img_name=$(compose_cmd config 2>/dev/null \
+        | sed -n "/^  ${svc}:/,/^  [a-z]/p" | grep '^\s*image:' | awk '{print $2}')
+    img_name="${img_name:-reflector-$svc}"
+    docker images -q "$img_name" 2>/dev/null | head -1
+}
+
+# Ensure images with build contexts are up-to-date.
+# Docker layer cache makes this fast (~seconds) when source hasn't changed.
+rebuild_images() {
+    local svc
+    for svc in web cpu; do
+        local old_id
+        old_id=$(svc_image_id "$svc")
+        old_id="${old_id:-<none>}"
+
+        info "Building $svc..."
+        compose_cmd build "$svc"
+
+        local new_id
+        new_id=$(svc_image_id "$svc")
+
+        if [[ "$old_id" == "$new_id" ]]; then
+            ok "$svc unchanged (${new_id:0:12})"
+        else
+            ok "$svc rebuilt (${old_id:0:12} -> ${new_id:0:12})"
+        fi
+    done
+}
+
+detect_lan_ip() {
+    # Returns the host's LAN IP — used for WebRTC ICE candidate rewriting.
+    case "$OS" in
+        Darwin)
+            # Try common interfaces: en0 (Wi-Fi), en1 (Ethernet)
+            for iface in en0 en1 en2 en3; do
+                local ip
+                ip=$(ipconfig getifaddr "$iface" 2>/dev/null || true)
+                if [[ -n "$ip" ]]; then
+                    echo "$ip"
+                    return
+                fi
+            done
+            ;;
+        Linux)
+            ip route get 1.1.1.1 2>/dev/null | sed -n 's/.*src \([^ ]*\).*/\1/p'
+            return
+            ;;
+    esac
+    # Fallback — empty means "not detected"
+    echo ""
+}
+
+wait_for_url() {
+    local url="$1" label="$2" retries="${3:-30}" interval="${4:-2}"
+    for i in $(seq 1 "$retries"); do
+        if curl -sf "$url" > /dev/null 2>&1; then
+            return 0
+        fi
+        echo -ne "\r  Waiting for $label... ($i/$retries)"
+        sleep "$interval"
+    done
+    echo ""
+    err "$label not responding at $url after $retries attempts"
+    return 1
+}
+
+env_has_key() {
+    local file="$1" key="$2"
+    grep -q "^${key}=" "$file" 2>/dev/null
+}
+
+env_set() {
+    local file="$1" key="$2" value="$3"
+    if env_has_key "$file" "$key"; then
+        # Replace existing value (portable sed)
+        if [[ "$OS" == "Darwin" ]]; then
+            sed -i '' "s|^${key}=.*|${key}=${value}|" "$file"
+        else
+            sed -i "s|^${key}=.*|${key}=${value}|" "$file"
+        fi
+    else
+        echo "${key}=${value}" >> "$file"
+    fi
+}
+
+resolve_symlink() {
+    local file="$1"
+    if [[ -L "$file" ]]; then
+        warn "$(basename "$file") is a symlink — creating standalone copy"
+        cp -L "$file" "$file.tmp"
+        rm "$file"
+        mv "$file.tmp" "$file"
+    fi
+}
+
+compose_cmd() {
+    local compose_files="-f $ROOT_DIR/docker-compose.standalone.yml"
+    if [[ "$OS" == "Linux" ]] && [[ -n "${OLLAMA_PROFILE:-}" ]]; then
+        docker compose $compose_files --profile "$OLLAMA_PROFILE" "$@"
+    else
+        docker compose $compose_files "$@"
+    fi
+}
+
+# =========================================================
+# Step 1: LLM / Ollama
+# =========================================================
+step_llm() {
+    info "Step 1: LLM setup (Ollama + $MODEL)"
+
+    case "$OS" in
+        Darwin)
+            if ! command -v ollama &> /dev/null; then
+                err "Ollama not found. Install it:"
+                err "  brew install ollama"
+                err "  # or https://ollama.com/download"
+                exit 1
+            fi
+
+            # Start if not running
+            if ! curl -sf "http://localhost:$OLLAMA_PORT/api/tags" > /dev/null 2>&1; then
+                info "Starting Ollama..."
+                ollama serve &
+                disown
+            fi
+
+            wait_for_url "http://localhost:$OLLAMA_PORT/api/tags" "Ollama"
+            echo ""
+
+            # Pull model if not already present
+            if ollama list 2>/dev/null | awk '{print $1}' | grep -qxF "$MODEL"; then
+                ok "Model $MODEL already pulled"
+            else
+                info "Pulling model $MODEL (this may take a while)..."
+                ollama pull "$MODEL"
+            fi
+
+            LLM_URL_VALUE="http://host.docker.internal:$OLLAMA_PORT/v1"
+            ;;
+
+        Linux)
+            if command -v nvidia-smi &> /dev/null && nvidia-smi > /dev/null 2>&1; then
+                ok "NVIDIA GPU detected — using ollama-gpu profile"
+                OLLAMA_PROFILE="ollama-gpu"
+                OLLAMA_SVC="ollama"
+                LLM_URL_VALUE="http://ollama:$OLLAMA_PORT/v1"
+            else
+                warn "No NVIDIA GPU — using ollama-cpu profile"
+                OLLAMA_PROFILE="ollama-cpu"
+                OLLAMA_SVC="ollama-cpu"
+                LLM_URL_VALUE="http://ollama-cpu:$OLLAMA_PORT/v1"
+            fi
+
+            info "Starting Ollama container..."
+            compose_cmd up -d
+
+            wait_for_url "http://localhost:$OLLAMA_PORT/api/tags" "Ollama"
+            echo ""
+
+            # Pull model inside container
+            if compose_cmd exec "$OLLAMA_SVC" ollama list 2>/dev/null | awk '{print $1}' | grep -qxF "$MODEL"; then
+                ok "Model $MODEL already pulled"
+            else
+                info "Pulling model $MODEL inside container (this may take a while)..."
+                compose_cmd exec "$OLLAMA_SVC" ollama pull "$MODEL"
+            fi
+            ;;
+
+        *)
+            err "Unsupported OS: $OS"
+            exit 1
+            ;;
+    esac
+
+    ok "LLM ready ($MODEL via Ollama)"
+}
+
+# =========================================================
+# Step 2: Generate server/.env
+# =========================================================
+step_server_env() {
+    info "Step 2: Generating server/.env"
+
+    resolve_symlink "$SERVER_ENV"
+
+    if [[ -f "$SERVER_ENV" ]]; then
+        ok "server/.env already exists — ensuring standalone vars"
+    else
+        cat > "$SERVER_ENV" << 'ENVEOF'
+# Generated by setup-standalone.sh — standalone local development
+# Source of truth for settings: server/reflector/settings.py
+ENVEOF
+        ok "Created server/.env"
+    fi
+
+    # Ensure all standalone-critical vars (appends if missing, replaces if present)
+    env_set "$SERVER_ENV" "DATABASE_URL" "postgresql+asyncpg://reflector:reflector@postgres:5432/reflector"
+    env_set "$SERVER_ENV" "REDIS_HOST" "redis"
+    env_set "$SERVER_ENV" "CELERY_BROKER_URL" "redis://redis:6379/1"
+    env_set "$SERVER_ENV" "CELERY_RESULT_BACKEND" "redis://redis:6379/1"
+    env_set "$SERVER_ENV" "AUTH_BACKEND" "none"
+    env_set "$SERVER_ENV" "PUBLIC_MODE" "true"
+    # TRANSCRIPT_BACKEND, TRANSCRIPT_URL, DIARIZATION_BACKEND, DIARIZATION_URL
+    # are set via docker-compose.standalone.yml `environment:` overrides — not written here
+    # so we don't clobber the user's server/.env for non-standalone use.
+    env_set "$SERVER_ENV" "TRANSLATION_BACKEND" "passthrough"
+    env_set "$SERVER_ENV" "LLM_URL" "$LLM_URL_VALUE"
+    env_set "$SERVER_ENV" "LLM_MODEL" "$MODEL"
+    env_set "$SERVER_ENV" "LLM_API_KEY" "not-needed"
+
+    # WebRTC: detect LAN IP for ICE candidate rewriting (bridge networking)
+    local lan_ip
+    lan_ip=$(detect_lan_ip)
+    if [[ -n "$lan_ip" ]]; then
+        env_set "$SERVER_ENV" "WEBRTC_HOST" "$lan_ip"
+        ok "WebRTC host IP: $lan_ip"
+    else
+        warn "Could not detect LAN IP — WebRTC recording from other devices may not work"
+        warn "Set WEBRTC_HOST=<your-lan-ip> in server/.env manually"
+    fi
+
+    ok "Standalone vars set (LLM_URL=$LLM_URL_VALUE)"
+}
+
+# =========================================================
+# Step 3: Object storage (Garage)
+# =========================================================
+step_storage() {
+    info "Step 3: Object storage (Garage)"
+
+    # Generate garage.toml from template (fill in RPC secret)
+    GARAGE_TOML="$ROOT_DIR/scripts/garage.toml"
+    GARAGE_TOML_RUNTIME="$ROOT_DIR/data/garage.toml"
+    mkdir -p "$ROOT_DIR/data"
+    if [[ -d "$GARAGE_TOML_RUNTIME" ]]; then
+        rm -rf "$GARAGE_TOML_RUNTIME"
+    fi
+    if [[ ! -f "$GARAGE_TOML_RUNTIME" ]]; then
+        RPC_SECRET=$(openssl rand -hex 32)
+        sed "s|__GARAGE_RPC_SECRET__|${RPC_SECRET}|" "$GARAGE_TOML" > "$GARAGE_TOML_RUNTIME"
+    fi
+
+    compose_cmd up -d garage
+
+    # Use /metrics for readiness — /health returns 503 until layout is applied
+    if ! wait_for_url "http://localhost:3903/metrics" "Garage admin API"; then
+        echo ""
+        err "Garage container logs:"
+        compose_cmd logs garage --tail 30 2>&1 || true
+        exit 1
+    fi
+    echo ""
+
+    # Layout: get node ID, assign, apply (skip if already applied)
+    NODE_ID=$(compose_cmd exec -T garage /garage node id -q 2>/dev/null | tr -d '[:space:]')
+    LAYOUT_STATUS=$(compose_cmd exec -T garage /garage layout show 2>&1 || true)
+    if echo "$LAYOUT_STATUS" | grep -q "No nodes"; then
+        compose_cmd exec -T garage /garage layout assign "$NODE_ID" -c 1G -z dc1
+        compose_cmd exec -T garage /garage layout apply --version 1
+    fi
+
+    # Create bucket (idempotent — skip if exists)
+    if ! compose_cmd exec -T garage /garage bucket info reflector-media &>/dev/null; then
+        compose_cmd exec -T garage /garage bucket create reflector-media
+    fi
+
+    # Create key (idempotent — skip if exists)
+    CREATED_KEY=false
+    if compose_cmd exec -T garage /garage key info reflector &>/dev/null; then
+        ok "Key 'reflector' already exists"
+    else
+        KEY_OUTPUT=$(compose_cmd exec -T garage /garage key create reflector)
+        CREATED_KEY=true
+    fi
+
+    # Grant bucket permissions (idempotent)
+    compose_cmd exec -T garage /garage bucket allow reflector-media --read --write --key reflector
+
+    # Set env vars (only parse key on first create — key info redacts the secret)
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_BACKEND" "aws"
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL" "http://garage:3900"
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_BUCKET_NAME" "reflector-media"
+    env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_REGION" "garage"
+    if [[ "$CREATED_KEY" == "true" ]]; then
+        KEY_ID=$(echo "$KEY_OUTPUT" | grep -i "key id" | awk '{print $NF}')
+        KEY_SECRET=$(echo "$KEY_OUTPUT" | grep -i "secret key" | awk '{print $NF}')
+        env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID" "$KEY_ID"
+        env_set "$SERVER_ENV" "TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY" "$KEY_SECRET"
+    fi
+
+    ok "Object storage ready (Garage)"
+}
+
+# =========================================================
+# Step 4: Generate www/.env.local
+# =========================================================
+step_www_env() {
+    info "Step 4: Generating www/.env.local"
+
+    resolve_symlink "$WWW_ENV"
+
+    if [[ -f "$WWW_ENV" ]]; then
+        ok "www/.env.local already exists — ensuring standalone vars"
+    else
+        cat > "$WWW_ENV" << 'ENVEOF'
+# Generated by setup-standalone.sh — standalone local development
+ENVEOF
+        ok "Created www/.env.local"
+    fi
+
+    # Caddyfile.standalone.example serves API at /v1, /health — use base URL
+    if [[ -n "${PRIMARY_IP:-}" ]]; then
+        BASE_URL="https://$PRIMARY_IP:3043"
+    else
+        BASE_URL="https://localhost:3043"
+    fi
+    env_set "$WWW_ENV" "SITE_URL" "$BASE_URL"
+    env_set "$WWW_ENV" "NEXTAUTH_URL" "$BASE_URL"
+    env_set "$WWW_ENV" "NEXTAUTH_SECRET" "standalone-dev-secret-not-for-production"
+    env_set "$WWW_ENV" "API_URL" "$BASE_URL"
+    env_set "$WWW_ENV" "WEBSOCKET_URL" "auto"
+    env_set "$WWW_ENV" "SERVER_API_URL" "http://server:1250"
+    env_set "$WWW_ENV" "FEATURE_REQUIRE_LOGIN" "false"
+
+    ok "Standalone www vars set"
+}
+
+# =========================================================
+# Step 5: Start all services
+# =========================================================
+step_services() {
+    info "Step 5: Starting Docker services"
+
+    # Check for port conflicts — stale processes silently shadow Docker port mappings.
+    # OrbStack/Docker Desktop bind ports for forwarding; ignore those PIDs.
+    local ports_ok=true
+    for port in 3043 3000 1250 5432 6379 3900 3903; do
+        local pids
+        pids=$(lsof -ti :"$port" 2>/dev/null || true)
+        for pid in $pids; do
+            local pname
+            pname=$(ps -p "$pid" -o comm= 2>/dev/null || true)
+            # OrbStack and Docker Desktop own port forwarding — not real conflicts
+            if [[ "$pname" == *"OrbStack"* ]] || [[ "$pname" == *"com.docker"* ]] || [[ "$pname" == *"vpnkit"* ]]; then
+                continue
+            fi
+            warn "Port $port already in use by PID $pid ($pname)"
+            warn "Kill it with: lsof -ti :$port | xargs kill"
+            ports_ok=false
+        done
+    done
+    if [[ "$ports_ok" == "false" ]]; then
+        warn "Port conflicts detected — Docker containers may not be reachable"
+        warn "Continuing anyway (services will start but may be shadowed)"
+    fi
+
+    # Rebuild images if source has changed (Docker layer cache makes this fast when unchanged)
+    rebuild_images
+
+    # server runs alembic migrations on startup automatically (see runserver.sh)
+    compose_cmd up -d postgres redis garage cpu server worker beat web caddy
+    ok "Containers started"
+
+    # Quick sanity check — catch containers that exit immediately (bad image, missing file, etc.)
+    sleep 3
+    local exited
+    exited=$(compose_cmd ps -a --format '{{.Name}} {{.Status}}' 2>/dev/null \
+        | grep -i 'exit' || true)
+    if [[ -n "$exited" ]]; then
+        warn "Some containers exited immediately:"
+        echo "$exited" | while read -r line; do warn "  $line"; done
+        dump_diagnostics
+    fi
+
+    info "Server is running migrations (alembic upgrade head)..."
+}
+
+# =========================================================
+# Step 6: Health checks
+# =========================================================
+step_health() {
+    info "Step 6: Health checks"
+
+    # CPU service may take a while on first start (model download + load).
+    # No host port exposed — check via docker exec.
+    info "Waiting for CPU service (first start downloads ~1GB of models)..."
+    local cpu_ok=false
+    for i in $(seq 1 120); do
+        if compose_cmd exec -T cpu curl -sf http://localhost:8000/docs > /dev/null 2>&1; then
+            cpu_ok=true
+            break
+        fi
+        echo -ne "\r  Waiting for CPU service... ($i/120)"
+        sleep 5
+    done
+    echo ""
+    if [[ "$cpu_ok" == "true" ]]; then
+        ok "CPU service healthy (transcription + diarization)"
+    else
+        warn "CPU service not ready yet — it will keep loading in the background"
+        warn "Check with: docker compose logs cpu"
+    fi
+
+    # Server may take a long time on first run — alembic migrations run before uvicorn starts.
+    # Use docker exec so this works regardless of network_mode or port mapping.
+    info "Waiting for Server API (first run includes database migrations)..."
+    local server_ok=false
+    for i in $(seq 1 90); do
+        # Check if container is still running
+        local svc_status
+        svc_status=$(compose_cmd ps server --format '{{.Status}}' 2>/dev/null || true)
+        if [[ -z "$svc_status" ]] || echo "$svc_status" | grep -qi 'exit'; then
+            echo ""
+            err "Server container exited unexpectedly"
+            dump_diagnostics server
+            exit 1
+        fi
+        # Health check from inside container (avoids host networking issues)
+        if compose_cmd exec -T server curl -sf http://localhost:1250/health > /dev/null 2>&1; then
+            server_ok=true
+            break
+        fi
+        echo -ne "\r  Waiting for Server API... ($i/90)"
+        sleep 5
+    done
+    echo ""
+    if [[ "$server_ok" == "true" ]]; then
+        ok "Server API healthy"
+    else
+        err "Server API not ready after ~7 minutes"
+        dump_diagnostics server
+        exit 1
+    fi
+
+    wait_for_url "http://localhost:3000" "Frontend" 90 3
+    echo ""
+    ok "Frontend responding"
+
+    # Caddy reverse proxy (self-signed TLS — curl needs -k)
+    if curl -sfk "https://localhost:3043" > /dev/null 2>&1; then
+        ok "Caddy proxy healthy (https://localhost:3043)"
+    else
+        warn "Caddy proxy not responding on https://localhost:3043"
+        warn "Check with: docker compose logs caddy"
+    fi
+
+    # Check LLM reachability from inside a container
+    if compose_cmd exec -T server \
+        curl -sf "$LLM_URL_VALUE/models" > /dev/null 2>&1; then
+        ok "LLM reachable from containers"
+    else
+        warn "LLM not reachable from containers at $LLM_URL_VALUE"
+        warn "Summaries/topics/titles won't work until LLM is accessible"
+    fi
+}
+
+# =========================================================
+# Main
+# =========================================================
+main() {
+    echo ""
+    echo "=========================================="
+    echo " Reflector — Standalone Local Setup"
+    echo "=========================================="
+    echo ""
+
+    # Ensure we're in the repo root
+    if [[ ! -f "$ROOT_DIR/docker-compose.yml" ]]; then
+        err "docker-compose.yml not found in $ROOT_DIR"
+        err "Run this script from the repo root: ./scripts/setup-standalone.sh"
+        exit 1
+    fi
+
+    # Docker: Compose plugin, buildx, and daemon. On Ubuntu, auto-install if missing.
+    docker_ready() {
+        docker compose version 2>/dev/null | grep -qi compose \
+            && docker buildx version &>/dev/null \
+            && docker info &>/dev/null
+    }
+
+    if ! docker_ready; then
+        RAN_INSTALL=false
+        if [[ "$OS" == "Linux" ]] && [[ -f /etc/os-release ]] && (source /etc/os-release 2>/dev/null; [[ "${ID:-}" == "ubuntu" || "${ID_LIKE:-}" == *"ubuntu"* ]]); then
+            info "Docker not ready. Running install-docker-ubuntu.sh..."
+            "$SCRIPT_DIR/install-docker-ubuntu.sh" || true
+            RAN_INSTALL=true
+            [[ -d /run/systemd/system ]] && command -v systemctl &>/dev/null && systemctl start docker 2>/dev/null || true
+            sleep 2
+        fi
+        if ! docker_ready; then
+            # Docker may be installed but current shell lacks docker group (needs newgrp)
+            if [[ "$RAN_INSTALL" == "true" ]] && [[ $(id -u) -ne 0 ]] && command -v sg &>/dev/null && getent group docker &>/dev/null; then
+                info "Re-running with docker group..."
+                exec sg docker -c "$(printf '%q' "$0" && printf ' %q' "$@")"
+            fi
+            if [[ "$OS" == "Darwin" ]]; then
+                err "Docker not ready. Install Docker Desktop or OrbStack."
+            elif [[ "$OS" == "Linux" ]]; then
+                err "Docker not ready. Run: ./scripts/install-docker-ubuntu.sh"
+                err "Then run: newgrp docker   (or log out and back in), then run this script again."
+            else
+                err "Docker not ready. Install Docker with Compose V2 and buildx."
+            fi
+            exit 1
+        fi
+    fi
+
+    # LLM_URL_VALUE is set by step_llm, used by later steps
+    LLM_URL_VALUE=""
+    OLLAMA_PROFILE=""
+
+    # docker-compose.yml may reference env_files that don't exist yet;
+    # touch them so compose_cmd works before the steps that populate them.
+    touch "$SERVER_ENV" "$WWW_ENV"
+
+    # Ensure garage.toml exists before any compose up (step_llm starts all services including garage)
+    GARAGE_TOML="$ROOT_DIR/scripts/garage.toml"
+    GARAGE_TOML_RUNTIME="$ROOT_DIR/data/garage.toml"
+    mkdir -p "$ROOT_DIR/data"
+    if [[ -d "$GARAGE_TOML_RUNTIME" ]]; then
+        rm -rf "$GARAGE_TOML_RUNTIME"
+    fi
+    if [[ ! -f "$GARAGE_TOML_RUNTIME" ]]; then
+        RPC_SECRET=$(openssl rand -hex 32)
+        sed "s|__GARAGE_RPC_SECRET__|${RPC_SECRET}|" "$GARAGE_TOML" > "$GARAGE_TOML_RUNTIME"
+    fi
+
+    # Remove containers that may have bad mounts (was directory); force recreate
+    compose_cmd rm -f -s garage caddy 2>/dev/null || true
+
+    # Detect primary IP for droplet (used for Caddyfile, step_www_env, success message)
+    PRIMARY_IP=""
+    if [[ "$OS" == "Linux" ]]; then
+        PRIMARY_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || true)
+        if [[ "$PRIMARY_IP" == "127."* ]] || [[ -z "$PRIMARY_IP" ]]; then
+            PRIMARY_IP=$(ip -4 route get 1 2>/dev/null | sed -n 's/.*src \([0-9.]*\).*/\1/p' || true)
+        fi
+    fi
+
+    # Ensure Caddyfile exists before any compose up (step_llm starts caddy)
+    # On droplet: explicit IP + localhost so Caddy provisions cert at startup (avoids on_demand/SNI issues)
+    CADDYFILE="$ROOT_DIR/Caddyfile"
+    if [[ -d "$CADDYFILE" ]]; then
+        rm -rf "$CADDYFILE"
+    fi
+    if [[ -n "$PRIMARY_IP" ]]; then
+        cat > "$CADDYFILE" << CADDYEOF
+# Generated by setup-standalone.sh — explicit IP for droplet (provisions cert at startup)
+https://$PRIMARY_IP, localhost {
+    tls internal
+    handle /v1/* {
+        reverse_proxy server:1250
+    }
+    handle /health {
+        reverse_proxy server:1250
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}
+CADDYEOF
+        ok "Created Caddyfile for $PRIMARY_IP and localhost"
+    elif [[ ! -f "$CADDYFILE" ]]; then
+        cp "$ROOT_DIR/Caddyfile.standalone.example" "$CADDYFILE"
+    fi
+
+    step_llm
+    echo ""
+    step_server_env
+    echo ""
+    step_storage
+    echo ""
+    step_www_env
+    echo ""
+    step_services
+    echo ""
+    step_health
+
+    echo ""
+    echo "=========================================="
+    echo -e " ${GREEN}Reflector is running!${NC}"
+    echo "=========================================="
+    echo ""
+    if [[ -n "$PRIMARY_IP" ]]; then
+        echo "  App:       https://$PRIMARY_IP:3043  (accept self-signed cert in browser)"
+        echo "  API:       https://$PRIMARY_IP:3043/v1/"
+        echo "  Local:     https://localhost:3043"
+    else
+        echo "  App:       https://localhost:3043  (accept self-signed cert in browser)"
+        echo "  API:       https://localhost:3043/v1/"
+    fi
+    echo ""
+    echo "  To stop:   docker compose down"
+    echo "  To re-run: ./scripts/setup-standalone.sh"
+    echo ""
+}
+
+main "$@"

server/.env.example

@@ -66,15 +66,22 @@ TRANSLATE_URL=https://monadical-sas--reflector-translator-web.modal.run
 ## LLM backend (Required)
 ##
 ## Responsible for generating titles, summaries, and topic detection
-## Requires OpenAI API key
+## Supports any OpenAI-compatible endpoint.
 ## =======================================================
 
-## OpenAI API key - get from https://platform.openai.com/account/api-keys
-LLM_API_KEY=sk-your-openai-api-key
-LLM_MODEL=gpt-4o-mini
+## --- Option A: Local LLM via Ollama (recommended for dev) ---
+## Setup: ./scripts/setup-standalone.sh
+## Mac: Ollama runs natively (Metal GPU). Containers reach it via host.docker.internal.
+## Linux: docker compose --profile ollama-gpu up -d (or ollama-cpu for no GPU)
+LLM_URL=http://host.docker.internal:11434/v1
+LLM_MODEL=qwen2.5:14b
+LLM_API_KEY=not-needed
+## Linux with containerized Ollama: LLM_URL=http://ollama:11434/v1
 
-## Optional: Custom endpoint (defaults to OpenAI)
-# LLM_URL=https://api.openai.com/v1
+## --- Option B: Remote/cloud LLM ---
+#LLM_API_KEY=sk-your-openai-api-key
+#LLM_MODEL=gpt-4o-mini
+## LLM_URL defaults to OpenAI when unset
 
 ## Context size for summary generation (tokens)
 LLM_CONTEXT_WINDOW=16000

server/.env.selfhosted.example

@@ -0,0 +1,112 @@
+# =======================================================
+# Reflector Self-Hosted Production — Backend Configuration
+# Generated by: ./scripts/setup-selfhosted.sh
+# Reference: server/reflector/settings.py
+# =======================================================
+
+# =======================================================
+# Database & Infrastructure
+# Pre-filled for Docker internal networking (docker-compose.selfhosted.yml)
+# =======================================================
+DATABASE_URL=postgresql+asyncpg://reflector:reflector@postgres:5432/reflector
+REDIS_HOST=redis
+REDIS_PORT=6379
+CELERY_BROKER_URL=redis://redis:6379/1
+CELERY_RESULT_BACKEND=redis://redis:6379/1
+
+# Secret key — auto-generated by setup script
+# Generate manually with: openssl rand -hex 32
+SECRET_KEY=changeme-generate-a-secure-random-string
+
+# =======================================================
+# Authentication
+# Disabled by default. Enable Authentik for multi-user access.
+# See docsv2/selfhosted-production.md for setup instructions.
+# =======================================================
+AUTH_BACKEND=none
+# AUTH_BACKEND=jwt
+# AUTH_JWT_AUDIENCE=
+
+# =======================================================
+# Specialized Models (Transcription, Diarization, Translation)
+# These run in the gpu/cpu container — NOT an LLM.
+# The "modal" backend means "HTTP API client" — it talks to
+# the self-hosted container, not Modal.com cloud.
+# =======================================================
+TRANSCRIPT_BACKEND=modal
+TRANSCRIPT_URL=http://transcription:8000
+TRANSCRIPT_MODAL_API_KEY=selfhosted
+
+DIARIZATION_ENABLED=true
+DIARIZATION_BACKEND=modal
+DIARIZATION_URL=http://transcription:8000
+
+TRANSLATION_BACKEND=modal
+TRANSLATE_URL=http://transcription:8000
+
+# HuggingFace token — optional, for gated models (e.g. pyannote).
+# Falls back to public S3 model bundle if not set.
+# HF_TOKEN=hf_xxxxx
+
+# =======================================================
+# LLM for Summarization & Topic Detection
+# Only summaries and topics use an LLM. Everything else
+# (transcription, diarization, translation) uses specialized models above.
+#
+# Supports any OpenAI-compatible endpoint.
+# Auto-configured by setup script if using --ollama-gpu or --ollama-cpu.
+# For --gpu or --cpu modes, you MUST configure an external LLM.
+# =======================================================
+
+# --- Option A: External OpenAI-compatible API ---
+# LLM_URL=https://api.openai.com/v1
+# LLM_API_KEY=sk-your-api-key
+# LLM_MODEL=gpt-4o-mini
+
+# --- Option B: Local Ollama (auto-set by --ollama-gpu/--ollama-cpu) ---
+# LLM_URL=http://ollama:11434/v1
+# LLM_API_KEY=not-needed
+# LLM_MODEL=llama3.1
+
+LLM_CONTEXT_WINDOW=16000
+
+# =======================================================
+# S3 Storage (REQUIRED)
+# Where to store audio files and transcripts.
+#
+# Option A: Use --garage flag (auto-configured by setup script)
+# Option B: Any S3-compatible endpoint (AWS, MinIO, etc.)
+#           Set TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL for non-AWS endpoints.
+# =======================================================
+TRANSCRIPT_STORAGE_BACKEND=aws
+TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID=
+TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY=
+TRANSCRIPT_STORAGE_AWS_BUCKET_NAME=reflector-media
+TRANSCRIPT_STORAGE_AWS_REGION=us-east-1
+
+# For non-AWS S3-compatible endpoints (Garage, MinIO, etc.):
+# TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL=http://garage:3900
+
+# =======================================================
+# Daily.co Live Rooms (Optional)
+# Enable real-time meeting rooms with Daily.co integration.
+# Requires a Daily.co account: https://www.daily.co/
+# =======================================================
+# DEFAULT_VIDEO_PLATFORM=daily
+# DAILY_API_KEY=your-daily-api-key
+# DAILY_SUBDOMAIN=your-subdomain
+# DAILY_WEBHOOK_SECRET=your-daily-webhook-secret
+# DAILYCO_STORAGE_AWS_BUCKET_NAME=reflector-dailyco
+# DAILYCO_STORAGE_AWS_REGION=us-east-1
+# DAILYCO_STORAGE_AWS_ROLE_ARN=arn:aws:iam::role/DailyCoAccess
+
+# =======================================================
+# Feature Flags
+# =======================================================
+PUBLIC_MODE=true
+# FEATURE_ROOMS=true
+
+# =======================================================
+# Sentry (Optional)
+# =======================================================
+# SENTRY_DSN=

server/docs/DAILY_REFLECTOR_DATA_MODEL.md

@@ -0,0 +1,496 @@
+# Daily.co and Reflector Data Model
+
+This document explains the data model relationships between Daily.co's API concepts and Reflector's database schema, clarifying common sources of confusion.
+
+---
+
+## Table of Contents
+
+1. [Core Entities Overview](#core-entities-overview)
+2. [Daily.co vs Reflector Terminology](#dailyco-vs-reflector-terminology)
+3. [Entity Relationships](#entity-relationships)
+4. [Recording Multiplicity](#recording-multiplicity)
+5. [Session Identifiers Explained](#session-identifiers-explained)
+6. [Time-Based Matching](#time-based-matching)
+7. [Multitrack Recording Details](#multitrack-recording-details)
+8. [Verified Example](#verified-example)
+
+---
+
+## Core Entities Overview
+
+### Reflector's Four Primary Entities
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│ Room (Reflector)                                                │
+│ - Persistent meeting template                                   │
+│ - User-created configuration                                    │
+│ - Example: "team-standup"                                       │
+└────────────────────┬────────────────────────────────────────────┘
+                     │ 1:N
+                     ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ Meeting (Reflector)                                             │
+│ - Single session instance                                       │
+│ - Creates NEW Daily.co room with timestamp                      │
+│ - Example: "team-standup-20260115120000"                        │
+└────────────────────┬────────────────────────────────────────────┘
+                     │ 1:N
+                     ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ Recording (Reflector + Daily.co)                                │
+│ - One segment of audio/video                                    │
+│ - New recording created on stop/restart                         │
+│ - track_keys: JSON array of S3 file paths                       │
+└────────────────────┬────────────────────────────────────────────┘
+                     │ 1:1
+                     ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ Transcript (Reflector)                                          │
+│ - Processed audio with transcription                            │
+│ - Diarization, summaries, topics                                │
+│ - One transcript per recording                                  │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Daily.co vs Reflector Terminology
+
+### Room
+
+| Aspect | Daily.co | Reflector |
+|--------|----------|-----------|
+| **Definition** | Virtual meeting space on Daily.co platform | User-created meeting template/configuration |
+| **Lifetime** | Configurable expiration | Persistent until user deletes |
+| **Creation** | API call for each meeting | Pre-created by user once |
+| **Reuse** | Can host multiple sessions | Generates new Daily.co room per meeting |
+| **Name Format** | `room-name` (reusable) | `room-name` (base identifier) |
+| **Timestamping** | Not required | Meeting adds timestamp: `{name}-YYYYMMDDHHMMSS` |
+
+**Example:**
+```
+Reflector Room: "daily-private-igor" (persistent config)
+    ↓ starts meeting
+Daily.co Room: "daily-private-igor-20260110042117"
+```
+
+### Meeting
+
+| Aspect | Daily.co | Reflector |
+|--------|----------|-----------|
+| **Definition** | Session that starts when first participant joins | Explicit database record of a session |
+| **Identifier** | `mtgSessionId` (generated by Daily.co) | `meeting.id` (UUID, generated by Reflector) |
+| **Creation** | Implicit (first participant join) | Explicit API call before participants join |
+| **Purpose** | Tracks active session state | Links recordings, transcripts, participants |
+| **Scope** | Per room instance | Per Reflector room + timestamp |
+
+**Critical Limitation:** Daily.co's recordings API often does NOT return `mtgSessionId`, requiring time-based matching (see [Time-Based Matching](#time-based-matching)).
+
+### Recording
+
+| Aspect | Daily.co | Reflector |
+|--------|----------|-----------|
+| **Definition** | Audio/video files on S3 | Metadata + processing status |
+| **Types** | `cloud` (composed video), `raw-tracks` (multitrack) | Stores references + `track_keys` array |
+| **Multiplicity** | One recording object per start/stop cycle | One DB row per Daily.co recording object |
+| **Identifier** | Daily.co `recording_id` | Same `recording_id` (stored in DB) |
+| **Multitrack** | Array of `.webm` files (one per participant) | `track_keys` JSON array with S3 paths |
+| **Linkage** | Via `room_name` + `start_ts` | FK `meeting_id` (set via time-based match) |
+
+**Critical Behavior:** Recording **stops/restarts** create **separate recording objects** with unique IDs.
+
+---
+
+## Entity Relationships
+
+### Database Schema Relationships
+
+```sql
+-- Simplified schema showing key relationships
+
+TABLE room (
+    id VARCHAR PRIMARY KEY,
+    name VARCHAR UNIQUE,
+    platform VARCHAR  -- 'whereby' | 'daily'
+)
+
+TABLE meeting (
+    id VARCHAR PRIMARY KEY,
+    room_id VARCHAR REFERENCES room(id) ON DELETE CASCADE,  -- nullable
+    room_name VARCHAR,  -- Daily.co room name (timestamped)
+    start_date TIMESTAMP,
+    platform VARCHAR
+)
+
+TABLE recording (
+    id VARCHAR PRIMARY KEY,  -- Daily.co recording_id
+    meeting_id VARCHAR,      -- FK to meeting (set via time-based match)
+    bucket_name VARCHAR,
+    object_key VARCHAR,      -- S3 prefix
+    track_keys JSON,         -- Array of S3 keys for multitrack
+    recorded_at TIMESTAMP
+)
+
+TABLE transcript (
+    id VARCHAR PRIMARY KEY,
+    recording_id VARCHAR,    -- nullable FK
+    meeting_id VARCHAR,      -- nullable FK
+    room_id VARCHAR,         -- nullable FK
+    participants JSON,       -- [{id, speaker, name, user_id}, ...]
+    title VARCHAR,
+    long_summary VARCHAR,
+    webvtt TEXT
+)
+```
+
+**Relationship Cardinalities:**
+```
+1 Room → N Meetings
+1 Meeting → N Recordings (common: 1-21 recordings per meeting)
+1 Recording → 1 Transcript
+1 Meeting → N Transcripts (via recordings)
+```
+
+---
+
+## Recording Multiplicity
+
+### Why Multiple Recordings Per Meeting?
+
+Daily.co creates a **new recording object** (new ID, new files) whenever recording stops and restarts. This happens due to:
+
+1. **Manual stop/start** - User clicks stop, then start recording again
+2. **Network reconnection** - Participant drops, reconnects → triggers restart
+3. **Participant rejoin** - Last participant leaves, new one joins → new session
+
+---
+
+## Session Identifiers Explained
+
+### The Hidden Entity: Daily.co Meeting Session
+
+Daily.co has an **implicit ephemeral entity** that sits between Room and Recording:
+
+```
+Daily.co Room: "daily-private-igor-20260110042117"
+    │
+    ├─ Daily.co Meeting Session #1 (mtgSessionId: c04334de...)
+    │   └─ Recording #3 (f4a50f94) - 4s, 1 track
+    │
+    └─ Daily.co Meeting Session #2 (mtgSessionId: 4cdae3c0...)
+        ├─ Recording #2 (b0fa94da) - 80s, 2 tracks  ← recording stopped
+        └─ Recording #1 (05edf519) - 62s, 1 track   ← then restarted
+```
+
+**Daily.co Meeting Session:**
+- **Lifecycle:** Starts when first participant joins, ends when last participant leaves
+- **Identifier:** `mtgSessionId` (generated by Daily.co)
+- **Persistence:** Ephemeral - new ID if everyone leaves and someone rejoins
+- **Relationship:** 1 Session → N Recordings (if recording stops/restarts during session)
+
+**Key Insight:** Multiple recordings can share the same `mtgSessionId` if recording was stopped and restarted while participants remained connected.
+
+### mtgSessionId (Meeting Session Identifier)
+
+`mtgSessionId` identifies a **Daily.co meeting session** (not individual participants, not a room).
+
+### session_id (Per-Participant)
+
+**Different concept:** Per-participant connection identifier from webhooks.
+
+**Reflector Tracking:** `daily_participant_session` table
+```sql
+TABLE daily_participant_session (
+    id VARCHAR PRIMARY KEY,        -- {meeting_id}:{user_id}:{joined_at_ms}
+    meeting_id VARCHAR,
+    session_id VARCHAR,            -- From webhook (per-participant)
+    user_id VARCHAR,
+    user_name VARCHAR,
+    joined_at TIMESTAMP,
+    left_at TIMESTAMP
+)
+```
+---
+
+## Time-Based Matching
+
+### Problem Statement
+
+Daily.co's recordings API does not reliably return `mtgSessionId`, making it impossible to directly link recordings to meetings via Daily.co's identifiers.
+
+**Example API response:**
+```json
+{
+  "id": "recording-uuid",
+  "room_name": "daily-private-igor-20260110042117",
+  "start_ts": 1768018896,
+  "mtgSessionId": null  ← Missing!
+}
+```
+
+### Solution: Time-Based Matching
+
+**Implementation:** `reflector/db/meetings.py:get_by_room_name_and_time()`
+
+
+---
+
+## Multitrack Recording Details
+
+### track_keys JSON Array
+
+**Schema:** `recording.track_keys` (JSON, nullable)
+```sql
+-- Example recording with 2 audio tracks
+{
+  "id": "b0fa94da-73b5-4f95-9239-5216a682a505",
+  "track_keys": [
+    "igormonadical/daily-private-igor-20260110042117/1768018896877-890c0eae-e186-4534-a7bd-7c794b7d6d7f-cam-audio-1768018914565",
+    "igormonadical/daily-private-igor-20260110042117/1768018896877-9660e8e9-4297-4f17-951d-0b2bf2401803-cam-audio-1768018899286"
+  ]
+}
+```
+
+**Semantics:**
+- `track_keys = null` → Not multitrack (cloud recording)
+- `track_keys = []` → Multitrack recording with no audio captured (silence/muted)
+- `track_keys = [...]` → Multitrack with N audio tracks
+
+**Property:** `recording.is_multitrack` (Python)
+```python
+@property
+def is_multitrack(self) -> bool:
+    return self.track_keys is not None and len(self.track_keys) > 0
+```
+
+### Track Filename Format
+
+Daily.co multitrack filenames encode timing and participant information:
+
+**Format:** `{recording_start_ts}-{participant_id}-cam-audio-{track_start_ts}`
+
+**Example:** `1768018896877-890c0eae-e186-4534-a7bd-7c794b7d6d7f-cam-audio-1768018914565`
+
+**Parsed Components:**
+```python
+# reflector/utils/daily.py:25-60
+class DailyRecordingFilename(NamedTuple):
+    recording_start_ts: int  # 1768018896877 (milliseconds)
+    participant_id: str      # 890c0eae-e186-4534-a7bd-7c794b7d6d7f
+    track_start_ts: int      # 1768018914565 (milliseconds)
+```
+
+**Note:** Browser downloads from S3 add `.webm` extension due to MIME headers, but S3 object keys have no extension.
+
+### Video Track Filtering
+
+Daily.co API returns both audio and video tracks, but Reflector only processes audio.
+
+**Filtering Logic:** `reflector/worker/process.py:660`
+```python
+track_keys = [t.s3Key for t in recording.tracks if t.type == "audio"]
+```
+
+**Example API Response:**
+```json
+{
+  "tracks": [
+    {"type": "audio", "s3Key": "...cam-audio-1768018914565"},
+    {"type": "audio", "s3Key": "...cam-audio-1768018899286"},
+    {"type": "video", "s3Key": "...cam-video-1768018897095"}  ← Filtered out
+  ]
+}
+```
+
+**Result:** Only 2 audio tracks stored in `recording.track_keys`, video track discarded.
+
+**Rationale:** Reflector is audio transcription system; video not needed for processing.
+
+### Track-to-Participant Mapping
+
+**Flow:**
+1. Daily.co webhook/polling provides `track_keys` array
+2. Each track filename contains `participant_id`
+3. Reflector queries Daily.co API: `GET /meetings/{mtgSessionId}/participants`
+4. Maps `participant_id` → `user_name`
+5. Stores in `transcript.participants` JSON:
+```json
+[
+  {
+    "id": "890c0eae-e186-4534-a7bd-7c794b7d6d7f",
+    "speaker": 0,
+    "name": "test2",
+    "user_id": "907f2cc1-eaab-435f-8ee2-09185f416b22"
+  },
+  {
+    "id": "9660e8e9-4297-4f17-951d-0b2bf2401803",
+    "speaker": 1,
+    "name": "test",
+    "user_id": "907f2cc1-eaab-435f-8ee2-09185f416b22"
+  }
+]
+```
+
+**Diarization:** Multitrack recordings don't need speaker diarization AI — speaker identity comes from separate audio tracks.
+
+---
+
+## Example
+
+### Meeting: daily-private-igor-20260110042117
+
+**Context:** User conducted test recording with start/stop cycles, producing 3 recordings.
+
+#### Database State
+
+```sql
+-- Meeting
+id: 034804b8-cee2-4fb4-94d7-122f6f068a61
+room_name: daily-private-igor-20260110042117
+start_date: 2026-01-10 04:21:17+00
+```
+
+#### Daily.co API Response
+
+```json
+[
+  {
+    "id": "f4a50f94-053c-4f9d-bda6-78ad051fbc36",
+    "room_name": "daily-private-igor-20260110042117",
+    "start_ts": 1768018885,
+    "duration": 4,
+    "status": "finished",
+    "mtgSessionId": "c04334de-42a0-4c2a-96be-a49b068dca85",
+    "tracks": [
+      {"type": "audio", "s3Key": "...62e8f3ae...cam-audio-1768018885417"}
+    ]
+  },
+  {
+    "id": "b0fa94da-73b5-4f95-9239-5216a682a505",
+    "room_name": "daily-private-igor-20260110042117",
+    "start_ts": 1768018896,
+    "duration": 80,
+    "status": "finished",
+    "mtgSessionId": "4cdae3c0-86cb-4578-8a6d-3a228bb48345",
+    "tracks": [
+      {"type": "audio", "s3Key": "...890c0eae...cam-audio-1768018914565"},
+      {"type": "audio", "s3Key": "...9660e8e9...cam-audio-1768018899286"},
+      {"type": "video", "s3Key": "...9660e8e9...cam-video-1768018897095"}
+    ]
+  },
+  {
+    "id": "05edf519-9048-4b49-9a75-73e9826fd950",
+    "room_name": "daily-private-igor-20260110042117",
+    "start_ts": 1768018914,
+    "duration": 62,
+    "status": "finished",
+    "mtgSessionId": "4cdae3c0-86cb-4578-8a6d-3a228bb48345",
+    "tracks": [
+      {"type": "audio", "s3Key": "...890c0eae...cam-audio-1768018914948"}
+    ]
+  }
+]
+```
+
+**Key Observations:**
+- 3 recording objects returned by Daily.co
+- 2 different `mtgSessionId` values (2 different meeting instances)
+- Recording #2 has 3 tracks (2 audio + 1 video)
+- Timestamps: 1768018885 → 1768018896 (+11s) → 1768018914 (+18s)
+
+#### Reflector Database
+
+**Recordings:**
+```
+┌──────────────────────────────────────┬──────────────┬────────────┬──────────────────────────────────────┐
+│ id                                   │ track_count  │ duration   │ mtgSessionId                         │
+├──────────────────────────────────────┼──────────────┼────────────┼──────────────────────────────────────┤
+│ f4a50f94-053c-4f9d-bda6-78ad051fbc36 │ 1            │ 4s         │ c04334de-42a0-4c2a-96be-a49b068dca85 │
+│ b0fa94da-73b5-4f95-9239-5216a682a505 │ 2 (video=0)  │ 80s        │ 4cdae3c0-86cb-4578-8a6d-3a228bb48345 │
+│ 05edf519-9048-4b49-9a75-73e9826fd950 │ 1            │ 62s        │ 4cdae3c0-86cb-4578-8a6d-3a228bb48345 │
+└──────────────────────────────────────┴──────────────┴────────────┴──────────────────────────────────────┘
+```
+**Note:** Recording #2 has 2 audio tracks (video filtered out), not 3.
+
+**Transcripts:**
+```
+┌──────────────────────────────────────┬──────────────────────────────────────┬──────────────┬──────────────────────────────────────────────┐
+│ id                                   │ recording_id                         │ participants │ title                                        │
+├──────────────────────────────────────┼──────────────────────────────────────┼──────────────┼──────────────────────────────────────────────┤
+│ 17149b1f-546c-4837-80a0-f8140bd16592 │ f4a50f94-053c-4f9d-bda6-78ad051fbc36 │ 1 (test)     │ (empty - no speech)                          │
+│ 49801332-3222-4c11-bdb2-375479fc87f2 │ b0fa94da-73b5-4f95-9239-5216a682a505 │ 2 (test,     │ "Examination and Validation Procedures       │
+│                                      │                                      │   test2)     │  Review"                                     │
+│ e5271e12-20fb-42d2-b5a8-21438abadef9 │ 05edf519-9048-4b49-9a75-73e9826fd950 │ 1 (test2)    │ "Technical Sound Check Procedure Review"     │
+└──────────────────────────────────────┴──────────────────────────────────────┴──────────────┴──────────────────────────────────────────────┘
+```
+
+**Transcript Content:**
+
+*Transcript #1* (17149b1f): Empty WebVTT (no audio captured)
+
+*Transcript #2* (49801332):
+```webvtt
+WEBVTT
+
+00:00:03.109 --> 00:00:05.589
+<v Speaker1>Test, test, test. Test, test, test, test, test.
+
+00:00:19.829 --> 00:00:22.710
+<v Speaker0>Test test test test test test test test test test test.
+```
+**AI-Generated Summary:**
+> "The meeting focused on the critical importance of rigorous testing for ensuring reliability and quality, with test and test2 emphasizing the need for a structured testing framework and meticulous documentation..."
+
+*Transcript #3* (e5271e12):
+```webvtt
+WEBVTT
+
+00:00:02.029 --> 00:00:04.910
+<v Speaker0>Test, test, test, test, test, test, test, test, test, test, test.
+```
+
+#### Validation: track_keys → participants
+
+**Recording #2 (b0fa94da) tracks:**
+```json
+[
+  ".../890c0eae-e186-4534-a7bd-7c794b7d6d7f-cam-audio-...",
+  ".../9660e8e9-4297-4f17-951d-0b2bf2401803-cam-audio-..."
+]
+```
+
+**Transcript #2 (49801332) participants:**
+```json
+[
+  {"id": "890c0eae-e186-4534-a7bd-7c794b7d6d7f", "speaker": 0, "name": "test2"},
+  {"id": "9660e8e9-4297-4f17-951d-0b2bf2401803", "speaker": 1, "name": "test"}
+]
+```
+
+### Data Flow
+
+```
+Daily.co API: 3 recordings
+    ↓
+Polling: _poll_raw_tracks_recordings()
+    ↓
+Worker: process_multitrack_recording.delay() × 3
+    ↓
+DB: 3 recording rows created
+    ↓
+Pipeline: Audio processing + transcription × 3
+    ↓
+DB: 3 transcript rows created (1:1 with recordings)
+    ↓
+UI: User sees 3 separate transcripts
+```
+
+**Result:** ✅ 1:1 Recording → Transcript relationship maintained.
+
+
+---
+**Document Version:** 1.0
+**Last Verified:** 2026-01-15
+**Data Source:** Production database + Daily.co API inspection

server/migrations/versions/1b1e6a6fc465_add_cloud_recording_support.py

@@ -0,0 +1,40 @@
+"""add cloud recording support
+
+Revision ID: 1b1e6a6fc465
+Revises: bd3a729bb379
+Create Date: 2026-01-09 17:17:33.535620
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "1b1e6a6fc465"
+down_revision: Union[str, None] = "bd3a729bb379"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table("meeting", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column("daily_composed_video_s3_key", sa.String(), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column("daily_composed_video_duration", sa.Integer(), nullable=True)
+        )
+
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table("meeting", schema=None) as batch_op:
+        batch_op.drop_column("daily_composed_video_duration")
+        batch_op.drop_column("daily_composed_video_s3_key")
+
+    # ### end Alembic commands ###

server/migrations/versions/3aa20b96d963_drop_use_celery_column.py

@@ -0,0 +1,35 @@
+"""drop_use_celery_column
+
+Revision ID: 3aa20b96d963
+Revises: e69f08ead8ea
+Create Date: 2026-02-05 10:12:44.065279
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "3aa20b96d963"
+down_revision: Union[str, None] = "e69f08ead8ea"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("room", schema=None) as batch_op:
+        batch_op.drop_column("use_celery")
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("room", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "use_celery",
+                sa.Boolean(),
+                server_default=sa.text("false"),
+                nullable=False,
+            )
+        )

server/migrations/versions/623af934249a_add_change_seq_to_transcript.py

@@ -0,0 +1,74 @@
+"""add_change_seq_to_transcript
+
+Revision ID: 623af934249a
+Revises: 3aa20b96d963
+Create Date: 2026-02-19 18:53:12.315440
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "623af934249a"
+down_revision: Union[str, None] = "3aa20b96d963"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Sequence
+    op.execute("CREATE SEQUENCE IF NOT EXISTS transcript_change_seq;")
+
+    # Column (nullable first for backfill)
+    op.add_column("transcript", sa.Column("change_seq", sa.BigInteger(), nullable=True))
+
+    # Backfill existing rows with sequential values (ordered by created_at for determinism)
+    op.execute("""
+        UPDATE transcript SET change_seq = sub.seq FROM (
+            SELECT id, nextval('transcript_change_seq') AS seq
+            FROM transcript ORDER BY created_at ASC
+        ) sub WHERE transcript.id = sub.id;
+    """)
+
+    # Now make NOT NULL
+    op.alter_column("transcript", "change_seq", nullable=False)
+
+    # Default for any inserts between now and trigger creation
+    op.alter_column(
+        "transcript",
+        "change_seq",
+        server_default=sa.text("nextval('transcript_change_seq')"),
+    )
+
+    # Trigger function
+    op.execute("""
+        CREATE OR REPLACE FUNCTION set_transcript_change_seq()
+        RETURNS TRIGGER AS $$
+        BEGIN
+            NEW.change_seq := nextval('transcript_change_seq');
+            RETURN NEW;
+        END;
+        $$ LANGUAGE plpgsql;
+    """)
+
+    # Trigger (fires on every INSERT or UPDATE)
+    op.execute("""
+        CREATE TRIGGER trigger_transcript_change_seq
+            BEFORE INSERT OR UPDATE ON transcript
+            FOR EACH ROW
+            EXECUTE FUNCTION set_transcript_change_seq();
+    """)
+
+    # Index for efficient polling
+    op.create_index("idx_transcript_change_seq", "transcript", ["change_seq"])
+
+
+def downgrade() -> None:
+    op.execute("DROP TRIGGER IF EXISTS trigger_transcript_change_seq ON transcript;")
+    op.execute("DROP FUNCTION IF EXISTS set_transcript_change_seq();")
+    op.drop_index("idx_transcript_change_seq", table_name="transcript")
+    op.drop_column("transcript", "change_seq")
+    op.execute("DROP SEQUENCE IF EXISTS transcript_change_seq;")

server/migrations/versions/80beb1ea3269_replace_use_hatchet_with_use_celery.py

@@ -0,0 +1,44 @@
+"""replace_use_hatchet_with_use_celery
+
+Revision ID: 80beb1ea3269
+Revises: bd3a729bb379
+Create Date: 2026-01-20 16:26:25.555869
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "80beb1ea3269"
+down_revision: Union[str, None] = "bd3a729bb379"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("room", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "use_celery",
+                sa.Boolean(),
+                server_default=sa.text("false"),
+                nullable=False,
+            )
+        )
+        batch_op.drop_column("use_hatchet")
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("room", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "use_hatchet",
+                sa.Boolean(),
+                server_default=sa.text("false"),
+                nullable=False,
+            )
+        )
+        batch_op.drop_column("use_celery")

server/migrations/versions/e69f08ead8ea_merge_cloud_recording_and_celery_heads.py

@@ -0,0 +1,23 @@
+"""merge cloud recording and celery heads
+
+Revision ID: e69f08ead8ea
+Revises: 1b1e6a6fc465, 80beb1ea3269
+Create Date: 2026-01-21 21:39:10.326841
+
+"""
+
+from typing import Sequence, Union
+
+# revision identifiers, used by Alembic.
+revision: str = "e69f08ead8ea"
+down_revision: Union[str, None] = ("1b1e6a6fc465", "80beb1ea3269")
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

server/pyproject.toml

@@ -8,7 +8,7 @@ readme = "README.md"
 dependencies = [
     "aiohttp>=3.9.0",
     "aiohttp-cors>=0.7.0",
-    "av>=10.0.0",
+    "av>=15.0.0",
     "requests>=2.31.0",
     "aiortc>=1.5.0",
     "sortedcontainers>=2.4.0",
@@ -68,7 +68,6 @@ evaluation = [
     "pydantic>=2.1.1",
 ]
 local = [
-    "pyannote-audio>=3.3.2",
     "faster-whisper>=0.10.0",
 ]
 silero-vad = [

server/reflector/app.py

@@ -18,7 +18,6 @@ from reflector.views.rooms import router as rooms_router
 from reflector.views.rtc_offer import router as rtc_offer_router
 from reflector.views.transcripts import router as transcripts_router
 from reflector.views.transcripts_audio import router as transcripts_audio_router
-from reflector.views.transcripts_chat import router as transcripts_chat_router
 from reflector.views.transcripts_participants import (
     router as transcripts_participants_router,
 )
@@ -38,6 +37,13 @@ try:
 except ImportError:
     sentry_sdk = None
 
+# Patch aioice port range if configured (must happen before any RTCPeerConnection)
+if settings.WEBRTC_PORT_RANGE:
+    from reflector.webrtc_ports import parse_port_range, patch_aioice_port_range
+
+    _min, _max = parse_port_range(settings.WEBRTC_PORT_RANGE)
+    patch_aioice_port_range(_min, _max)
+
 
 # lifespan events
 @asynccontextmanager
@@ -60,7 +66,7 @@ else:
     logger.info("Sentry disabled")
 
 # build app
-app = FastAPI(lifespan=lifespan)
+app = FastAPI(lifespan=lifespan, root_path=settings.ROOT_PATH)
 app.add_middleware(
     CORSMiddleware,
     allow_credentials=settings.CORS_ALLOW_CREDENTIALS or False,
@@ -91,7 +97,6 @@ app.include_router(transcripts_participants_router, prefix="/v1")
 app.include_router(transcripts_speaker_router, prefix="/v1")
 app.include_router(transcripts_upload_router, prefix="/v1")
 app.include_router(transcripts_websocket_router, prefix="/v1")
-app.include_router(transcripts_chat_router, prefix="/v1")
 app.include_router(transcripts_webrtc_router, prefix="/v1")
 app.include_router(transcripts_process_router, prefix="/v1")
 app.include_router(user_router, prefix="/v1")

server/reflector/asynctask.py

@@ -4,8 +4,9 @@ from uuid import uuid4
 
 from celery import current_task
 
-from reflector.db import get_database
+from reflector.db import _database_context, get_database
 from reflector.llm import llm_session_id
+from reflector.ws_manager import reset_ws_manager
 
 
 def asynctask(f):
@@ -20,8 +21,18 @@ def asynctask(f):
                 return await f(*args, **kwargs)
             finally:
                 await database.disconnect()
+                _database_context.set(None)
+
+        if current_task:
+            # Reset cached connections before each Celery task.
+            # Each asyncio.run() creates a new event loop, making connections
+            # from previous tasks stale ("Future attached to a different loop").
+            _database_context.set(None)
+            reset_ws_manager()
 
         coro = run_with_db()
+        if current_task:
+            return asyncio.run(coro)
         try:
             loop = asyncio.get_running_loop()
         except RuntimeError:

server/reflector/auth/__init__.py

@@ -12,3 +12,5 @@ AccessTokenInfo = auth_module.AccessTokenInfo
 authenticated = auth_module.authenticated
 current_user = auth_module.current_user
 current_user_optional = auth_module.current_user_optional
+parse_ws_bearer_token = auth_module.parse_ws_bearer_token
+current_user_ws_optional = auth_module.current_user_ws_optional

server/reflector/auth/auth_jwt.py

@@ -1,6 +1,9 @@
-from typing import Annotated, List, Optional
+from typing import TYPE_CHECKING, Annotated, List, Optional
 
 from fastapi import Depends, HTTPException
+
+if TYPE_CHECKING:
+    from fastapi import WebSocket
 from fastapi.security import APIKeyHeader, OAuth2PasswordBearer
 from jose import JWTError, jwt
 from pydantic import BaseModel
@@ -124,3 +127,20 @@ async def current_user_optional(
     jwtauth: JWTAuth = Depends(),
 ):
     return await _authenticate_user(jwt_token, api_key, jwtauth)
+
+
+def parse_ws_bearer_token(
+    websocket: "WebSocket",
+) -> tuple[Optional[str], Optional[str]]:
+    raw = websocket.headers.get("sec-websocket-protocol") or ""
+    parts = [p.strip() for p in raw.split(",") if p.strip()]
+    if len(parts) >= 2 and parts[0].lower() == "bearer":
+        return parts[1], "bearer"
+    return None, None
+
+
+async def current_user_ws_optional(websocket: "WebSocket") -> Optional[UserInfo]:
+    token, _ = parse_ws_bearer_token(websocket)
+    if not token:
+        return None
+    return await _authenticate_user(token, None, JWTAuth())

server/reflector/auth/auth_none.py

@@ -1,11 +1,5 @@
-from typing import Annotated
-
-from fastapi import Depends
-from fastapi.security import OAuth2PasswordBearer
 from pydantic import BaseModel
 
-oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token", auto_error=False)
-
 
 class UserInfo(BaseModel):
     sub: str
@@ -15,13 +9,21 @@ class AccessTokenInfo(BaseModel):
     pass
 
 
-def authenticated(token: Annotated[str, Depends(oauth2_scheme)]):
+def authenticated():
     return None
 
 
-def current_user(token: Annotated[str, Depends(oauth2_scheme)]):
+def current_user():
     return None
 
 
-def current_user_optional(token: Annotated[str, Depends(oauth2_scheme)]):
+def current_user_optional():
+    return None
+
+
+def parse_ws_bearer_token(websocket):
+    return None, None
+
+
+async def current_user_ws_optional(websocket):
     return None

server/reflector/dailyco_api/__init__.py

@@ -3,7 +3,7 @@ Daily.co API Module
 """
 
 # Client
-from .client import DailyApiClient, DailyApiError
+from .client import DailyApiClient, DailyApiError, RecordingType
 
 # Request models
 from .requests import (
@@ -64,6 +64,7 @@ __all__ = [
     # Client
     "DailyApiClient",
     "DailyApiError",
+    "RecordingType",
     # Requests
     "CreateRoomRequest",
     "RoomProperties",

server/reflector/dailyco_api/client.py

@@ -7,7 +7,8 @@ Reference: https://docs.daily.co/reference/rest-api
 """
 
 from http import HTTPStatus
-from typing import Any
+from typing import Any, Literal
+from uuid import UUID
 
 import httpx
 import structlog
@@ -32,6 +33,8 @@ from .responses import (
 
 logger = structlog.get_logger(__name__)
 
+RecordingType = Literal["cloud", "raw-tracks"]
+
 
 class DailyApiError(Exception):
     """Daily.co API error with full request/response context."""
@@ -143,6 +146,8 @@ class DailyApiClient:
             )
             raise DailyApiError(operation, response)
 
+        if not response.content:
+            return {}
         return response.json()
 
     # ============================================================================
@@ -395,6 +400,38 @@ class DailyApiClient:
 
         return [RecordingResponse(**r) for r in data["data"]]
 
+    async def start_recording(
+        self,
+        room_name: NonEmptyString,
+        recording_type: RecordingType,
+        instance_id: UUID,
+    ) -> dict[str, Any]:
+        """Start recording via REST API.
+
+        Reference: https://docs.daily.co/reference/rest-api/rooms/recordings/start
+
+        Args:
+            room_name: Daily.co room name
+            recording_type: Recording type
+            instance_id: UUID for this recording session
+
+        Returns:
+            Recording start confirmation from Daily.co API
+
+        Raises:
+            DailyApiError: If API request fails
+        """
+        client = await self._get_client()
+        response = await client.post(
+            f"{self.base_url}/rooms/{room_name}/recordings/start",
+            headers=self.headers,
+            json={
+                "type": recording_type,
+                "instanceId": str(instance_id),
+            },
+        )
+        return await self._handle_response(response, "start_recording")
+
     # ============================================================================
     # MEETING TOKENS
     # ============================================================================

server/reflector/dailyco_api/instance_id.py

@@ -0,0 +1,37 @@
+"""
+Daily.co recording instanceId generation utilities.
+
+Deterministic instance ID generation for cloud and raw-tracks recordings.
+MUST match frontend logic
+"""
+
+from uuid import UUID, uuid5
+
+from reflector.utils.string import NonEmptyString
+
+# Namespace UUID for UUIDv5 generation of raw-tracks instanceIds
+# DO NOT CHANGE: Breaks instanceId determinism across deployments and frontend/backend matching
+RAW_TRACKS_NAMESPACE = UUID("a1b2c3d4-e5f6-7890-abcd-ef1234567890")
+
+
+def generate_cloud_instance_id(meeting_id: NonEmptyString) -> UUID:
+    """
+    Generate instanceId for cloud recording.
+
+    Cloud recordings use meeting ID directly as instanceId.
+    This ensures each meeting has one unique cloud recording.
+    """
+    return UUID(meeting_id)
+
+
+def generate_raw_tracks_instance_id(meeting_id: NonEmptyString) -> UUID:
+    """
+    Generate instanceId for raw-tracks recording.
+
+    Raw-tracks recordings use UUIDv5(meeting_id, namespace) to ensure
+    different instanceId from cloud while remaining deterministic.
+
+    Daily.co requires cloud and raw-tracks to have different instanceIds
+    for concurrent recording.
+    """
+    return uuid5(RAW_TRACKS_NAMESPACE, meeting_id)

server/reflector/dailyco_api/requests.py

@@ -88,13 +88,6 @@ class MeetingTokenProperties(BaseModel):
     is_owner: bool = Field(
         default=False, description="Grant owner privileges to token holder"
     )
-    start_cloud_recording: bool = Field(
-        default=False, description="Automatically start cloud recording on join"
-    )
-    start_cloud_recording_opts: dict | None = Field(
-        default=None,
-        description="Options for startRecording when start_cloud_recording is true (e.g., maxDuration)",
-    )
     enable_recording_ui: bool = Field(
         default=True, description="Show recording controls in UI"
     )

server/reflector/dailyco_api/responses.py

@@ -116,6 +116,7 @@ class RecordingS3Info(BaseModel):
 
     bucket_name: NonEmptyString
     bucket_region: NonEmptyString
+    key: NonEmptyString | None = None
     endpoint: NonEmptyString | None = None
 
 
@@ -132,6 +133,9 @@ class RecordingResponse(BaseModel):
     id: NonEmptyString = Field(description="Recording identifier")
     room_name: NonEmptyString = Field(description="Room where recording occurred")
     start_ts: int = Field(description="Recording start timestamp (Unix epoch seconds)")
+    type: Literal["cloud", "raw-tracks"] | None = Field(
+        None, description="Recording type (may be missing from API)"
+    )
     status: RecordingStatus = Field(
         description="Recording status ('in-progress' or 'finished')"
     )
@@ -145,6 +149,9 @@ class RecordingResponse(BaseModel):
         None, description="Token for sharing recording"
     )
     s3: RecordingS3Info | None = Field(None, description="S3 bucket information")
+    s3key: NonEmptyString | None = Field(
+        None, description="S3 key for cloud recordings (top-level field)"
+    )
     tracks: list[DailyTrack] = Field(
         default_factory=list,
         description="Track list for raw-tracks recordings (always array, never null)",

server/reflector/dailyco_api/webhook_utils.py

@@ -99,7 +99,7 @@ def extract_room_name(event: DailyWebhookEvent) -> str | None:
         >>> event = DailyWebhookEvent(**webhook_payload)
         >>> room_name = extract_room_name(event)
     """
-    room = event.payload.get("room_name")
+    room = event.payload.get("room_name") or event.payload.get("room")
     # Ensure we return a string, not any falsy value that might be in payload
     return room if isinstance(room, str) else None
 

server/reflector/dailyco_api/webhooks.py

@@ -6,7 +6,7 @@ Reference: https://docs.daily.co/reference/rest-api/webhooks
 
 from typing import Annotated, Any, Dict, Literal, Union
 
-from pydantic import BaseModel, Field, field_validator
+from pydantic import AliasChoices, BaseModel, ConfigDict, Field, field_validator
 
 from reflector.utils.string import NonEmptyString
 
@@ -41,6 +41,8 @@ class DailyTrack(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/recordings
     """
 
+    model_config = ConfigDict(extra="ignore")
+
     type: Literal["audio", "video"]
     s3Key: NonEmptyString = Field(description="S3 object key for the track file")
     size: int = Field(description="File size in bytes")
@@ -54,6 +56,8 @@ class DailyWebhookEvent(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/webhooks
     """
 
+    model_config = ConfigDict(extra="ignore")
+
     version: NonEmptyString = Field(
         description="Represents the version of the event. This uses semantic versioning to inform a consumer if the payload has introduced any breaking changes"
     )
@@ -82,7 +86,13 @@ class ParticipantJoinedPayload(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/webhooks/events/participant-joined
     """
 
-    room_name: NonEmptyString | None = Field(None, description="Daily.co room name")
+    model_config = ConfigDict(extra="ignore")
+
+    room_name: NonEmptyString | None = Field(
+        None,
+        description="Daily.co room name",
+        validation_alias=AliasChoices("room_name", "room"),
+    )
     session_id: NonEmptyString = Field(description="Daily.co session identifier")
     user_id: NonEmptyString = Field(description="User identifier (may be encoded)")
     user_name: NonEmptyString | None = Field(None, description="User display name")
@@ -100,7 +110,13 @@ class ParticipantLeftPayload(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/webhooks/events/participant-left
     """
 
-    room_name: NonEmptyString | None = Field(None, description="Daily.co room name")
+    model_config = ConfigDict(extra="ignore")
+
+    room_name: NonEmptyString | None = Field(
+        None,
+        description="Daily.co room name",
+        validation_alias=AliasChoices("room_name", "room"),
+    )
     session_id: NonEmptyString = Field(description="Daily.co session identifier")
     user_id: NonEmptyString = Field(description="User identifier (may be encoded)")
     user_name: NonEmptyString | None = Field(None, description="User display name")
@@ -112,6 +128,9 @@ class ParticipantLeftPayload(BaseModel):
     _normalize_joined_at = field_validator("joined_at", mode="before")(
         normalize_timestamp_to_int
     )
+    _normalize_duration = field_validator("duration", mode="before")(
+        normalize_timestamp_to_int
+    )
 
 
 class RecordingStartedPayload(BaseModel):
@@ -121,6 +140,8 @@ class RecordingStartedPayload(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/webhooks/events/recording-started
     """
 
+    model_config = ConfigDict(extra="ignore")
+
     room_name: NonEmptyString | None = Field(None, description="Daily.co room name")
     recording_id: NonEmptyString = Field(description="Recording identifier")
     start_ts: int | None = Field(None, description="Recording start timestamp")
@@ -138,7 +159,9 @@ class RecordingReadyToDownloadPayload(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/webhooks/events/recording-ready-to-download
     """
 
-    type: Literal["cloud", "raw-tracks"] = Field(
+    model_config = ConfigDict(extra="ignore")
+
+    type: Literal["cloud", "cloud-audio-only", "raw-tracks"] = Field(
         description="The type of recording that was generated"
     )
     recording_id: NonEmptyString = Field(
@@ -153,8 +176,9 @@ class RecordingReadyToDownloadPayload(BaseModel):
     status: Literal["finished"] = Field(
         description="The status of the given recording (always 'finished' in ready-to-download webhook, see RecordingStatus in responses.py for full API statuses)"
     )
-    max_participants: int = Field(
-        description="The number of participants on the call that were recorded"
+    max_participants: int | None = Field(
+        None,
+        description="The number of participants on the call that were recorded (optional; Daily may omit it in some webhook versions)",
     )
     duration: int = Field(description="The duration in seconds of the call")
     s3_key: NonEmptyString = Field(
@@ -180,6 +204,8 @@ class RecordingErrorPayload(BaseModel):
     Reference: https://docs.daily.co/reference/rest-api/webhooks/events/recording-error
     """
 
+    model_config = ConfigDict(extra="ignore")
+
     action: Literal["clourd-recording-err", "cloud-recording-error"] = Field(
         description="A string describing the event that was emitted (both variants are documented)"
     )
@@ -200,6 +226,8 @@ class RecordingErrorPayload(BaseModel):
 
 
 class ParticipantJoinedEvent(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
     version: NonEmptyString
     type: Literal["participant.joined"]
     id: NonEmptyString
@@ -212,6 +240,8 @@ class ParticipantJoinedEvent(BaseModel):
 
 
 class ParticipantLeftEvent(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
     version: NonEmptyString
     type: Literal["participant.left"]
     id: NonEmptyString
@@ -224,6 +254,8 @@ class ParticipantLeftEvent(BaseModel):
 
 
 class RecordingStartedEvent(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
     version: NonEmptyString
     type: Literal["recording.started"]
     id: NonEmptyString
@@ -236,6 +268,8 @@ class RecordingStartedEvent(BaseModel):
 
 
 class RecordingReadyEvent(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
     version: NonEmptyString
     type: Literal["recording.ready-to-download"]
     id: NonEmptyString
@@ -248,6 +282,8 @@ class RecordingReadyEvent(BaseModel):
 
 
 class RecordingErrorEvent(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
     version: NonEmptyString
     type: Literal["recording.error"]
     id: NonEmptyString

server/reflector/db/meetings.py

@@ -1,4 +1,4 @@
-from datetime import datetime
+from datetime import datetime, timedelta
 from typing import Any, Literal
 
 import sqlalchemy as sa
@@ -9,7 +9,7 @@ from reflector.db import get_database, metadata
 from reflector.db.rooms import Room
 from reflector.schemas.platform import WHEREBY_PLATFORM, Platform
 from reflector.utils import generate_uuid4
-from reflector.utils.string import assert_equal
+from reflector.utils.string import NonEmptyString, assert_equal
 
 meetings = sa.Table(
     "meeting",
@@ -63,6 +63,9 @@ meetings = sa.Table(
         nullable=False,
         server_default=assert_equal(WHEREBY_PLATFORM, "whereby"),
     ),
+    # Daily.co composed video (Brady Bunch grid layout) - Daily.co only, not Whereby
+    sa.Column("daily_composed_video_s3_key", sa.String, nullable=True),
+    sa.Column("daily_composed_video_duration", sa.Integer, nullable=True),
     sa.Index("idx_meeting_room_id", "room_id"),
     sa.Index("idx_meeting_calendar_event", "calendar_event_id"),
 )
@@ -110,6 +113,9 @@ class Meeting(BaseModel):
     calendar_event_id: str | None = None
     calendar_metadata: dict[str, Any] | None = None
     platform: Platform = WHEREBY_PLATFORM
+    # Daily.co composed video (Brady Bunch grid) - Daily.co only
+    daily_composed_video_s3_key: str | None = None
+    daily_composed_video_duration: int | None = None
 
 
 class MeetingController:
@@ -171,6 +177,90 @@ class MeetingController:
             return None
         return Meeting(**result)
 
+    async def get_by_room_name_all(self, room_name: str) -> list[Meeting]:
+        """Get all meetings for a room name (not just most recent)."""
+        query = meetings.select().where(meetings.c.room_name == room_name)
+        results = await get_database().fetch_all(query)
+        return [Meeting(**r) for r in results]
+
+    async def get_by_room_name_and_time(
+        self,
+        room_name: NonEmptyString,
+        recording_start: datetime,
+        time_window_hours: int = 168,
+    ) -> Meeting | None:
+        """
+        Get meeting by room name closest to recording timestamp.
+
+        HACK ALERT: Daily.co doesn't return instanceId in recordings API response,
+        and mtgSessionId is separate from our instanceId. Time-based matching is
+        the least-bad workaround.
+
+        This handles edge case of duplicate room_name values in DB (race conditions,
+        double-clicks, etc.) by matching based on temporal proximity.
+
+        Algorithm:
+        1. Find meetings within time_window_hours of recording_start
+        2. Return meeting with start_date closest to recording_start
+        3. If tie, return first by meeting.id (deterministic)
+
+        Args:
+            room_name: Daily.co room name from recording
+            recording_start: Timezone-aware datetime from recording.start_ts
+            time_window_hours: Search window (default 168 = 1 week)
+
+        Returns:
+            Meeting closest to recording timestamp, or None if no matches
+
+        Failure modes:
+        - Multiple meetings in same room within ~5 minutes: picks closest
+        - All meetings outside time window: returns None
+        - Clock skew between Daily.co and DB: 1-week window tolerates this
+
+        Why 1 week window:
+        - Handles webhook failures (recording discovered days later)
+        - Tolerates clock skew
+        - Rejects unrelated meetings from weeks ago
+
+        """
+        # Validate timezone-aware datetime
+        if recording_start.tzinfo is None:
+            raise ValueError(
+                f"recording_start must be timezone-aware, got naive datetime: {recording_start}"
+            )
+
+        window_start = recording_start - timedelta(hours=time_window_hours)
+        window_end = recording_start + timedelta(hours=time_window_hours)
+
+        query = (
+            meetings.select()
+            .where(
+                sa.and_(
+                    meetings.c.room_name == room_name,
+                    meetings.c.start_date >= window_start,
+                    meetings.c.start_date <= window_end,
+                )
+            )
+            .order_by(meetings.c.start_date)
+        )
+
+        results = await get_database().fetch_all(query)
+        if not results:
+            return None
+
+        candidates = [Meeting(**r) for r in results]
+
+        # Find meeting with start_date closest to recording_start
+        closest = min(
+            candidates,
+            key=lambda m: (
+                abs((m.start_date - recording_start).total_seconds()),
+                m.id,  # Tie-breaker: deterministic by UUID
+            ),
+        )
+
+        return closest
+
     async def get_active(self, room: Room, current_time: datetime) -> Meeting | None:
         """
         Get latest active meeting for a room.
@@ -260,6 +350,44 @@ class MeetingController:
         query = meetings.update().where(meetings.c.id == meeting_id).values(**kwargs)
         await get_database().execute(query)
 
+    async def set_cloud_recording_if_missing(
+        self,
+        meeting_id: NonEmptyString,
+        s3_key: NonEmptyString,
+        duration: int,
+    ) -> bool:
+        """
+        Set cloud recording only if not already set.
+
+        Returns True if updated, False if already set.
+        Prevents webhook/polling race condition via atomic WHERE clause.
+        """
+        # Check current value before update to detect actual change
+        meeting_before = await self.get_by_id(meeting_id)
+        if not meeting_before:
+            return False
+
+        was_null = meeting_before.daily_composed_video_s3_key is None
+
+        query = (
+            meetings.update()
+            .where(
+                sa.and_(
+                    meetings.c.id == meeting_id,
+                    meetings.c.daily_composed_video_s3_key.is_(None),
+                )
+            )
+            .values(
+                daily_composed_video_s3_key=s3_key,
+                daily_composed_video_duration=duration,
+            )
+        )
+        await get_database().execute(query)
+
+        # Return True only if value was NULL before (actual update occurred)
+        # If was_null=False, the WHERE clause prevented the update
+        return was_null
+
     async def increment_num_clients(self, meeting_id: str) -> None:
         """Atomically increment participant count."""
         query = (

server/reflector/db/recordings.py

@@ -7,6 +7,7 @@ from sqlalchemy import or_
 
 from reflector.db import get_database, metadata
 from reflector.utils import generate_uuid4
+from reflector.utils.string import NonEmptyString
 
 recordings = sa.Table(
     "recording",
@@ -71,6 +72,19 @@ class RecordingController:
         query = recordings.delete().where(recordings.c.id == id)
         await get_database().execute(query)
 
+    async def set_meeting_id(
+        self,
+        recording_id: NonEmptyString,
+        meeting_id: NonEmptyString,
+    ) -> None:
+        """Link recording to meeting."""
+        query = (
+            recordings.update()
+            .where(recordings.c.id == recording_id)
+            .values(meeting_id=meeting_id)
+        )
+        await get_database().execute(query)
+
     # no check for existence
     async def get_by_ids(self, recording_ids: list[str]) -> list[Recording]:
         if not recording_ids:

server/reflector/db/rooms.py

@@ -57,12 +57,6 @@ rooms = sqlalchemy.Table(
         sqlalchemy.String,
         nullable=False,
     ),
-    sqlalchemy.Column(
-        "use_hatchet",
-        sqlalchemy.Boolean,
-        nullable=False,
-        server_default=false(),
-    ),
     sqlalchemy.Column(
         "skip_consent",
         sqlalchemy.Boolean,
@@ -97,7 +91,6 @@ class Room(BaseModel):
     ics_last_sync: datetime | None = None
     ics_last_etag: str | None = None
     platform: Platform = Field(default_factory=lambda: settings.DEFAULT_VIDEO_PLATFORM)
-    use_hatchet: bool = False
     skip_consent: bool = False
 
 

server/reflector/db/search.py

@@ -26,6 +26,7 @@ from reflector.db.rooms import rooms
 from reflector.db.transcripts import SourceKind, TranscriptStatus, transcripts
 from reflector.db.utils import is_postgresql
 from reflector.logger import logger
+from reflector.settings import settings
 from reflector.utils.string import NonEmptyString, try_parse_non_empty_string
 
 DEFAULT_SEARCH_LIMIT = 20
@@ -150,6 +151,7 @@ class SearchResultDB(BaseModel):
     title: str | None = None
     source_kind: SourceKind
     room_id: str | None = None
+    change_seq: int | None = None
     rank: float = Field(..., ge=0, le=1)
 
 
@@ -172,6 +174,7 @@ class SearchResult(BaseModel):
     total_match_count: NonNegativeInt = Field(
         default=0, description="Total number of matches found in the transcript"
     )
+    change_seq: int | None = None
 
     @field_serializer("created_at", when_used="json")
     def serialize_datetime(self, dt: datetime) -> str:
@@ -355,6 +358,7 @@ class SearchController:
             transcripts.c.user_id,
             transcripts.c.room_id,
             transcripts.c.source_kind,
+            transcripts.c.change_seq,
             transcripts.c.webvtt,
             transcripts.c.long_summary,
             sqlalchemy.case(
@@ -396,7 +400,7 @@ class SearchController:
                     transcripts.c.user_id == params.user_id, rooms.c.is_shared
                 )
             )
-        else:
+        elif not settings.PUBLIC_MODE:
             base_query = base_query.where(rooms.c.is_shared)
         if params.room_id:
             base_query = base_query.where(transcripts.c.room_id == params.room_id)

server/reflector/db/transcripts.py

@@ -5,7 +5,10 @@ import shutil
 from contextlib import asynccontextmanager
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
-from typing import Any, Literal, Sequence
+from typing import TYPE_CHECKING, Any, Literal, Sequence
+
+if TYPE_CHECKING:
+    from reflector.ws_events import TranscriptEventName
 
 import sqlalchemy
 from fastapi import HTTPException
@@ -32,6 +35,8 @@ class SourceKind(enum.StrEnum):
     FILE = enum.auto()
 
 
+transcript_change_seq = sqlalchemy.Sequence("transcript_change_seq", metadata=metadata)
+
 transcripts = sqlalchemy.Table(
     "transcript",
     metadata,
@@ -86,6 +91,12 @@ transcripts = sqlalchemy.Table(
     sqlalchemy.Column("webvtt", sqlalchemy.Text),
     # Hatchet workflow run ID for resumption of failed workflows
     sqlalchemy.Column("workflow_run_id", sqlalchemy.String),
+    sqlalchemy.Column(
+        "change_seq",
+        sqlalchemy.BigInteger,
+        transcript_change_seq,
+        server_default=transcript_change_seq.next_value(),
+    ),
     sqlalchemy.Index("idx_transcript_recording_id", "recording_id"),
     sqlalchemy.Index("idx_transcript_user_id", "user_id"),
     sqlalchemy.Index("idx_transcript_created_at", "created_at"),
@@ -184,7 +195,7 @@ class TranscriptWaveform(BaseModel):
 
 
 class TranscriptEvent(BaseModel):
-    event: str
+    event: str  # Typed at call sites via ws_events.TranscriptEventName; str here for DB compat
     data: dict
 
 
@@ -226,6 +237,7 @@ class Transcript(BaseModel):
     audio_deleted: bool | None = None
     webvtt: str | None = None
     workflow_run_id: str | None = None  # Hatchet workflow run ID for resumption
+    change_seq: int | None = None
 
     @field_serializer("created_at", when_used="json")
     def serialize_datetime(self, dt: datetime) -> str:
@@ -233,7 +245,9 @@ class Transcript(BaseModel):
             dt = dt.replace(tzinfo=timezone.utc)
         return dt.isoformat()
 
-    def add_event(self, event: str, data: BaseModel) -> TranscriptEvent:
+    def add_event(
+        self, event: "TranscriptEventName", data: BaseModel
+    ) -> TranscriptEvent:
         ev = TranscriptEvent(event=event, data=data.model_dump())
         self.events.append(ev)
         return ev
@@ -376,6 +390,7 @@ class TranscriptController:
         source_kind: SourceKind | None = None,
         room_id: str | None = None,
         search_term: str | None = None,
+        change_seq_from: int | None = None,
         return_query: bool = False,
         exclude_columns: list[str] = [
             "topics",
@@ -396,6 +411,7 @@ class TranscriptController:
         - `filter_recording`: filter out transcripts that are currently recording
         - `room_id`: filter transcripts by room ID
         - `search_term`: filter transcripts by search term
+        - `change_seq_from`: filter transcripts with change_seq > this value
         """
 
         query = transcripts.select().join(
@@ -406,7 +422,7 @@ class TranscriptController:
             query = query.where(
                 or_(transcripts.c.user_id == user_id, rooms.c.is_shared)
             )
-        else:
+        elif not settings.PUBLIC_MODE:
             query = query.where(rooms.c.is_shared)
 
         if source_kind:
@@ -418,6 +434,9 @@ class TranscriptController:
         if search_term:
             query = query.where(transcripts.c.title.ilike(f"%{search_term}%"))
 
+        if change_seq_from is not None:
+            query = query.where(transcripts.c.change_seq > change_seq_from)
+
         # Exclude heavy JSON columns from list queries
         transcript_columns = [
             col for col in transcripts.c if col.name not in exclude_columns
@@ -431,9 +450,10 @@ class TranscriptController:
         )
 
         if order_by is not None:
-            field = getattr(transcripts.c, order_by[1:])
             if order_by.startswith("-"):
-                field = field.desc()
+                field = getattr(transcripts.c, order_by[1:]).desc()
+            else:
+                field = getattr(transcripts.c, order_by)
             query = query.order_by(field)
 
         if filter_empty:
@@ -688,7 +708,7 @@ class TranscriptController:
     async def append_event(
         self,
         transcript: Transcript,
-        event: str,
+        event: "TranscriptEventName",
         data: Any,
     ) -> TranscriptEvent:
         """

server/reflector/hatchet/broadcast.py

@@ -12,10 +12,11 @@ import structlog
 
 from reflector.db.transcripts import Transcript, TranscriptEvent, transcripts_controller
 from reflector.utils.string import NonEmptyString
+from reflector.ws_events import TranscriptEventName
 from reflector.ws_manager import get_ws_manager
 
 # Events that should also be sent to user room (matches Celery behavior)
-USER_ROOM_EVENTS = {"STATUS", "FINAL_TITLE", "DURATION"}
+USER_ROOM_EVENTS: set[TranscriptEventName] = {"STATUS", "FINAL_TITLE", "DURATION"}
 
 
 async def broadcast_event(
@@ -81,8 +82,7 @@ async def set_status_and_broadcast(
 async def append_event_and_broadcast(
     transcript_id: NonEmptyString,
     transcript: Transcript,
-    event_name: NonEmptyString,
-    # TODO proper dictionary event => type
+    event_name: TranscriptEventName,
     data: Any,
     logger: structlog.BoundLogger,
 ) -> TranscriptEvent:

server/reflector/hatchet/client.py

@@ -12,7 +12,9 @@ import threading
 
 from hatchet_sdk import ClientConfig, Hatchet
 from hatchet_sdk.clients.rest.models import V1TaskStatus
+from hatchet_sdk.rate_limit import RateLimitDuration
 
+from reflector.hatchet.constants import LLM_RATE_LIMIT_KEY, LLM_RATE_LIMIT_PER_SECOND
 from reflector.logger import logger
 from reflector.settings import settings
 
@@ -113,3 +115,26 @@ class HatchetClientManager:
         """Reset the client instance (for testing)."""
         with cls._lock:
             cls._instance = None
+
+    @classmethod
+    async def ensure_rate_limit(cls) -> None:
+        """Ensure the LLM rate limit exists in Hatchet.
+
+        Uses the Hatchet SDK rate_limits client (aio_put). See:
+        https://docs.hatchet.run/sdks/python/feature-clients/rate_limits
+        """
+        logger.info(
+            "[Hatchet] Ensuring rate limit exists",
+            rate_limit_key=LLM_RATE_LIMIT_KEY,
+            limit=LLM_RATE_LIMIT_PER_SECOND,
+        )
+        client = cls.get_client()
+        await client.rate_limits.aio_put(
+            key=LLM_RATE_LIMIT_KEY,
+            limit=LLM_RATE_LIMIT_PER_SECOND,
+            duration=RateLimitDuration.SECOND,
+        )
+        logger.info(
+            "[Hatchet] Rate limit put successfully",
+            rate_limit_key=LLM_RATE_LIMIT_KEY,
+        )

server/reflector/hatchet/constants.py

@@ -35,7 +35,9 @@ LLM_RATE_LIMIT_PER_SECOND = 10
 
 # Task execution timeouts (seconds)
 TIMEOUT_SHORT = 60  # Quick operations: API calls, DB updates
-TIMEOUT_MEDIUM = 120  # Single LLM calls, waveform generation
+TIMEOUT_MEDIUM = (
+    300  # Single LLM calls, waveform generation (5m for slow LLM responses)
+)
 TIMEOUT_LONG = 180  # Action items (larger context LLM)
-TIMEOUT_AUDIO = 300  # Audio processing: padding, mixdown
+TIMEOUT_AUDIO = 720  # Audio processing: padding, mixdown
 TIMEOUT_HEAVY = 600  # Transcription, fan-out LLM tasks

server/reflector/hatchet/run_workers.py

@@ -1,77 +0,0 @@
-"""
-Run Hatchet workers for the multitrack pipeline.
-Runs as a separate process, just like Celery workers.
-
-Usage:
-    uv run -m reflector.hatchet.run_workers
-
-    # Or via docker:
-    docker compose exec server uv run -m reflector.hatchet.run_workers
-"""
-
-import signal
-import sys
-
-from hatchet_sdk.rate_limit import RateLimitDuration
-
-from reflector.hatchet.constants import LLM_RATE_LIMIT_KEY, LLM_RATE_LIMIT_PER_SECOND
-from reflector.logger import logger
-from reflector.settings import settings
-
-
-def main() -> None:
-    """Start Hatchet worker polling."""
-    if not settings.HATCHET_ENABLED:
-        logger.error("HATCHET_ENABLED is False, not starting workers")
-        sys.exit(1)
-
-    if not settings.HATCHET_CLIENT_TOKEN:
-        logger.error("HATCHET_CLIENT_TOKEN is not set")
-        sys.exit(1)
-
-    logger.info(
-        "Starting Hatchet workers",
-        debug=settings.HATCHET_DEBUG,
-    )
-
-    # Import here (not top-level) - workflow modules call HatchetClientManager.get_client()
-    # at module level because Hatchet SDK decorators (@workflow.task) bind at import time.
-    # Can't use lazy init: decorators need the client object when function is defined.
-    from reflector.hatchet.client import HatchetClientManager  # noqa: PLC0415
-    from reflector.hatchet.workflows import (  # noqa: PLC0415
-        daily_multitrack_pipeline,
-        subject_workflow,
-        topic_chunk_workflow,
-        track_workflow,
-    )
-
-    hatchet = HatchetClientManager.get_client()
-
-    hatchet.rate_limits.put(
-        LLM_RATE_LIMIT_KEY, LLM_RATE_LIMIT_PER_SECOND, RateLimitDuration.SECOND
-    )
-
-    worker = hatchet.worker(
-        "reflector-pipeline-worker",
-        workflows=[
-            daily_multitrack_pipeline,
-            subject_workflow,
-            topic_chunk_workflow,
-            track_workflow,
-        ],
-    )
-
-    def shutdown_handler(signum: int, frame) -> None:
-        logger.info("Received shutdown signal, stopping workers...")
-        # Worker cleanup happens automatically on exit
-        sys.exit(0)
-
-    signal.signal(signal.SIGINT, shutdown_handler)
-    signal.signal(signal.SIGTERM, shutdown_handler)
-
-    logger.info("Starting Hatchet worker polling...")
-    worker.start()
-
-
-if __name__ == "__main__":
-    main()

server/reflector/hatchet/run_workers_cpu.py

@@ -0,0 +1,43 @@
+"""
+CPU-heavy worker pool for audio processing tasks.
+Handles ONLY: mixdown_tracks
+
+Configuration:
+- slots=1: Only mixdown (already serialized globally with max_runs=1)
+- Worker affinity: pool=cpu-heavy
+"""
+
+from reflector.hatchet.client import HatchetClientManager
+from reflector.hatchet.workflows.daily_multitrack_pipeline import (
+    daily_multitrack_pipeline,
+)
+from reflector.logger import logger
+
+
+def main():
+    hatchet = HatchetClientManager.get_client()
+
+    logger.info(
+        "Starting Hatchet CPU worker pool (mixdown only)",
+        worker_name="cpu-worker-pool",
+        slots=1,
+        labels={"pool": "cpu-heavy"},
+    )
+
+    cpu_worker = hatchet.worker(
+        "cpu-worker-pool",
+        slots=1,  # Only 1 mixdown at a time (already serialized globally)
+        labels={
+            "pool": "cpu-heavy",
+        },
+        workflows=[daily_multitrack_pipeline],
+    )
+
+    try:
+        cpu_worker.start()
+    except KeyboardInterrupt:
+        logger.info("Received shutdown signal, stopping CPU workers...")
+
+
+if __name__ == "__main__":
+    main()

server/reflector/hatchet/run_workers_llm.py

@@ -0,0 +1,62 @@
+"""
+LLM/I/O worker pool for all non-CPU tasks.
+Handles: all tasks except mixdown_tracks (transcription, LLM inference, orchestration)
+"""
+
+import asyncio
+
+from reflector.hatchet.client import HatchetClientManager
+from reflector.hatchet.workflows.daily_multitrack_pipeline import (
+    daily_multitrack_pipeline,
+)
+from reflector.hatchet.workflows.subject_processing import subject_workflow
+from reflector.hatchet.workflows.topic_chunk_processing import topic_chunk_workflow
+from reflector.hatchet.workflows.track_processing import track_workflow
+from reflector.logger import logger
+
+SLOTS = 10
+WORKER_NAME = "llm-worker-pool"
+POOL = "llm-io"
+
+
+def main():
+    hatchet = HatchetClientManager.get_client()
+
+    try:
+        asyncio.run(HatchetClientManager.ensure_rate_limit())
+    except Exception as e:
+        logger.warning(
+            "[Hatchet] Rate limit initialization failed, but continuing. "
+            "If workflows fail to register, rate limits may need to be created manually.",
+            error=str(e),
+        )
+
+    logger.info(
+        "Starting Hatchet LLM worker pool (all tasks except mixdown)",
+        worker_name=WORKER_NAME,
+        slots=SLOTS,
+        labels={"pool": POOL},
+    )
+
+    llm_worker = hatchet.worker(
+        WORKER_NAME,
+        slots=SLOTS,  # not all slots are probably used
+        labels={
+            "pool": POOL,
+        },
+        workflows=[
+            daily_multitrack_pipeline,
+            topic_chunk_workflow,
+            subject_workflow,
+            track_workflow,
+        ],
+    )
+
+    try:
+        llm_worker.start()
+    except KeyboardInterrupt:
+        logger.info("Received shutdown signal, stopping LLM workers...")
+
+
+if __name__ == "__main__":
+    main()

server/reflector/hatchet/workflows/daily_multitrack_pipeline.py

@@ -23,7 +23,12 @@ from pathlib import Path
 from typing import Any, Callable, Coroutine, Protocol, TypeVar
 
 import httpx
-from hatchet_sdk import Context
+from hatchet_sdk import (
+    ConcurrencyExpression,
+    ConcurrencyLimitStrategy,
+    Context,
+)
+from hatchet_sdk.labels import DesiredWorkerLabel
 from pydantic import BaseModel
 
 from reflector.dailyco_api.client import DailyApiClient
@@ -166,11 +171,13 @@ async def set_workflow_error_status(transcript_id: NonEmptyString) -> bool:
 
 def _spawn_storage():
     """Create fresh storage instance."""
+    # TODO: replace direct AwsStorage construction with get_transcripts_storage() factory
     return AwsStorage(
         aws_bucket_name=settings.TRANSCRIPT_STORAGE_AWS_BUCKET_NAME,
         aws_region=settings.TRANSCRIPT_STORAGE_AWS_REGION,
         aws_access_key_id=settings.TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID,
         aws_secret_access_key=settings.TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY,
+        aws_endpoint_url=settings.TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL,
     )
 
 
@@ -317,6 +324,7 @@ async def get_participants(input: PipelineInput, ctx: Context) -> ParticipantsRe
     mtg_session_id = recording.mtg_session_id
     async with fresh_db_connection():
         from reflector.db.transcripts import (  # noqa: PLC0415
+            TranscriptDuration,
             TranscriptParticipant,
             transcripts_controller,
         )
@@ -325,15 +333,26 @@ async def get_participants(input: PipelineInput, ctx: Context) -> ParticipantsRe
         if not transcript:
             raise ValueError(f"Transcript {input.transcript_id} not found")
         # Note: title NOT cleared - preserves existing titles
+        # Duration from Daily API (seconds -> milliseconds) - master source
+        duration_ms = recording.duration * 1000 if recording.duration else 0
         await transcripts_controller.update(
             transcript,
             {
                 "events": [],
                 "topics": [],
                 "participants": [],
+                "duration": duration_ms,
             },
         )
 
+        await append_event_and_broadcast(
+            input.transcript_id,
+            transcript,
+            "DURATION",
+            TranscriptDuration(duration=duration_ms),
+            logger=logger,
+        )
+
         mtg_session_id = assert_non_none_and_non_empty(
             mtg_session_id, "mtg_session_id is required"
         )
@@ -467,6 +486,20 @@ async def process_tracks(input: PipelineInput, ctx: Context) -> ProcessTracksRes
     parents=[process_tracks],
     execution_timeout=timedelta(seconds=TIMEOUT_AUDIO),
     retries=3,
+    desired_worker_labels={
+        "pool": DesiredWorkerLabel(
+            value="cpu-heavy",
+            required=True,
+            weight=100,
+        ),
+    },
+    concurrency=[
+        ConcurrencyExpression(
+            expression="'mixdown-global'",
+            max_runs=1,  # serialize mixdown to prevent resource contention
+            limit_strategy=ConcurrencyLimitStrategy.GROUP_ROUND_ROBIN,  # Queue
+        )
+    ],
 )
 @with_error_handling(TaskName.MIXDOWN_TRACKS)
 async def mixdown_tracks(input: PipelineInput, ctx: Context) -> MixdownResult:
@@ -1076,7 +1109,7 @@ async def identify_action_items(
 
 
 @daily_multitrack_pipeline.task(
-    parents=[generate_waveform, generate_title, generate_recap, identify_action_items],
+    parents=[process_tracks, generate_title, generate_recap, identify_action_items],
     execution_timeout=timedelta(seconds=TIMEOUT_SHORT),
     retries=3,
 )
@@ -1089,12 +1122,8 @@ async def finalize(input: PipelineInput, ctx: Context) -> FinalizeResult:
     """
     ctx.log("finalize: saving transcript and setting status to 'ended'")
 
-    mixdown_result = ctx.task_output(mixdown_tracks)
     track_result = ctx.task_output(process_tracks)
 
-    duration = mixdown_result.duration
-    all_words = track_result.all_words
-
     # Cleanup temporary padded S3 files (deferred until finalize for semantic parity with Celery)
     created_padded_files = track_result.created_padded_files
     if created_padded_files:
@@ -1114,7 +1143,6 @@ async def finalize(input: PipelineInput, ctx: Context) -> FinalizeResult:
 
     async with fresh_db_connection():
         from reflector.db.transcripts import (  # noqa: PLC0415
-            TranscriptDuration,
             TranscriptText,
             transcripts_controller,
         )
@@ -1123,34 +1151,26 @@ async def finalize(input: PipelineInput, ctx: Context) -> FinalizeResult:
         if transcript is None:
             raise ValueError(f"Transcript {input.transcript_id} not found in database")
 
-        merged_transcript = TranscriptType(words=all_words, translation=None)
-
         await append_event_and_broadcast(
             input.transcript_id,
             transcript,
             "TRANSCRIPT",
             TranscriptText(
-                text=merged_transcript.text,
-                translation=merged_transcript.translation,
+                text="",
+                translation=None,
             ),
             logger=logger,
         )
 
-        # Save duration and clear workflow_run_id (workflow completed successfully)
-        # Note: title/long_summary/short_summary already saved by their callbacks
+        # Clear workflow_run_id (workflow completed successfully)
+        # Note: title/long_summary/short_summary/duration already saved by their callbacks
         await transcripts_controller.update(
             transcript,
             {
-                "duration": duration,
                 "workflow_run_id": None,  # Clear on success - no need to resume
             },
         )
 
-        duration_data = TranscriptDuration(duration=duration)
-        await append_event_and_broadcast(
-            input.transcript_id, transcript, "DURATION", duration_data, logger=logger
-        )
-
         await set_status_and_broadcast(input.transcript_id, "ended", logger=logger)
 
         ctx.log(
@@ -1328,14 +1348,34 @@ async def send_webhook(input: PipelineInput, ctx: Context) -> WebhookResult:
             f"participants={len(payload.transcript.participants)})"
         )
 
-        response = await send_webhook_request(
-            url=room.webhook_url,
-            payload=payload,
-            event_type="transcript.completed",
-            webhook_secret=room.webhook_secret,
-            timeout=30.0,
-        )
+        try:
+            response = await send_webhook_request(
+                url=room.webhook_url,
+                payload=payload,
+                event_type="transcript.completed",
+                webhook_secret=room.webhook_secret,
+                timeout=30.0,
+            )
 
-        ctx.log(f"send_webhook complete: status_code={response.status_code}")
+            ctx.log(f"send_webhook complete: status_code={response.status_code}")
+            return WebhookResult(webhook_sent=True, response_code=response.status_code)
 
-        return WebhookResult(webhook_sent=True, response_code=response.status_code)
+        except httpx.HTTPStatusError as e:
+            ctx.log(
+                f"send_webhook failed (HTTP {e.response.status_code}), continuing anyway"
+            )
+            return WebhookResult(
+                webhook_sent=False, response_code=e.response.status_code
+            )
+
+        except httpx.ConnectError as e:
+            ctx.log(f"send_webhook failed (connection error), continuing anyway: {e}")
+            return WebhookResult(webhook_sent=False)
+
+        except httpx.TimeoutException as e:
+            ctx.log(f"send_webhook failed (timeout), continuing anyway: {e}")
+            return WebhookResult(webhook_sent=False)
+
+        except Exception as e:
+            ctx.log(f"send_webhook unexpected error, continuing anyway: {e}")
+            return WebhookResult(webhook_sent=False)

server/reflector/hatchet/workflows/padding_workflow.py

@@ -0,0 +1,167 @@
+"""
+Hatchet child workflow: PaddingWorkflow
+Handles individual audio track padding via Modal.com backend.
+"""
+
+from datetime import timedelta
+
+import av
+from hatchet_sdk import Context
+from pydantic import BaseModel
+
+from reflector.hatchet.client import HatchetClientManager
+from reflector.hatchet.constants import TIMEOUT_AUDIO
+from reflector.hatchet.workflows.models import PadTrackResult
+from reflector.logger import logger
+from reflector.utils.audio_constants import PRESIGNED_URL_EXPIRATION_SECONDS
+from reflector.utils.audio_padding import extract_stream_start_time_from_container
+
+
+class PaddingInput(BaseModel):
+    """Input for individual track padding."""
+
+    track_index: int
+    s3_key: str
+    bucket_name: str
+    transcript_id: str
+
+
+hatchet = HatchetClientManager.get_client()
+
+padding_workflow = hatchet.workflow(
+    name="PaddingWorkflow", input_validator=PaddingInput
+)
+
+
+@padding_workflow.task(execution_timeout=timedelta(seconds=TIMEOUT_AUDIO), retries=3)
+async def pad_track(input: PaddingInput, ctx: Context) -> PadTrackResult:
+    """Pad audio track with silence based on WebM container start_time."""
+    ctx.log(f"pad_track: track {input.track_index}, s3_key={input.s3_key}")
+    logger.info(
+        "[Hatchet] pad_track",
+        track_index=input.track_index,
+        s3_key=input.s3_key,
+        transcript_id=input.transcript_id,
+    )
+
+    try:
+        # Create fresh storage instance to avoid aioboto3 fork issues
+        from reflector.settings import settings  # noqa: PLC0415
+        from reflector.storage.storage_aws import AwsStorage  # noqa: PLC0415
+
+        # TODO: replace direct AwsStorage construction with get_transcripts_storage() factory
+        storage = AwsStorage(
+            aws_bucket_name=settings.TRANSCRIPT_STORAGE_AWS_BUCKET_NAME,
+            aws_region=settings.TRANSCRIPT_STORAGE_AWS_REGION,
+            aws_access_key_id=settings.TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID,
+            aws_secret_access_key=settings.TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY,
+            aws_endpoint_url=settings.TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL,
+        )
+
+        source_url = await storage.get_file_url(
+            input.s3_key,
+            operation="get_object",
+            expires_in=PRESIGNED_URL_EXPIRATION_SECONDS,
+            bucket=input.bucket_name,
+        )
+
+        # Extract start_time to determine if padding needed
+        with av.open(source_url) as in_container:
+            if in_container.duration:
+                try:
+                    duration = timedelta(seconds=in_container.duration // 1_000_000)
+                    ctx.log(
+                        f"pad_track: track {input.track_index}, duration={duration}"
+                    )
+                except (ValueError, TypeError, OverflowError) as e:
+                    ctx.log(
+                        f"pad_track: track {input.track_index}, duration error: {str(e)}"
+                    )
+
+            start_time_seconds = extract_stream_start_time_from_container(
+                in_container, input.track_index, logger=logger
+            )
+
+        if start_time_seconds <= 0:
+            logger.info(
+                f"Track {input.track_index} requires no padding",
+                track_index=input.track_index,
+            )
+            return PadTrackResult(
+                padded_key=input.s3_key,
+                bucket_name=input.bucket_name,
+                size=0,
+                track_index=input.track_index,
+            )
+
+        storage_path = f"file_pipeline_hatchet/{input.transcript_id}/tracks/padded_{input.track_index}.webm"
+
+        # Presign PUT URL for output (Modal will upload directly)
+        output_url = await storage.get_file_url(
+            storage_path,
+            operation="put_object",
+            expires_in=PRESIGNED_URL_EXPIRATION_SECONDS,
+        )
+
+        import httpx  # noqa: PLC0415
+
+        from reflector.processors.audio_padding_modal import (  # noqa: PLC0415
+            AudioPaddingModalProcessor,
+        )
+
+        try:
+            processor = AudioPaddingModalProcessor()
+            result = await processor.pad_track(
+                track_url=source_url,
+                output_url=output_url,
+                start_time_seconds=start_time_seconds,
+                track_index=input.track_index,
+            )
+            file_size = result.size
+
+            ctx.log(f"pad_track: Modal returned size={file_size}")
+        except httpx.HTTPStatusError as e:
+            error_detail = e.response.text if hasattr(e.response, "text") else str(e)
+            logger.error(
+                "[Hatchet] Modal padding HTTP error",
+                transcript_id=input.transcript_id,
+                track_index=input.track_index,
+                status_code=e.response.status_code if hasattr(e, "response") else None,
+                error=error_detail,
+                exc_info=True,
+            )
+            raise Exception(
+                f"Modal padding failed: HTTP {e.response.status_code}"
+            ) from e
+        except httpx.TimeoutException as e:
+            logger.error(
+                "[Hatchet] Modal padding timeout",
+                transcript_id=input.transcript_id,
+                track_index=input.track_index,
+                error=str(e),
+                exc_info=True,
+            )
+            raise Exception("Modal padding timeout") from e
+
+        logger.info(
+            "[Hatchet] pad_track complete",
+            track_index=input.track_index,
+            padded_key=storage_path,
+        )
+
+        return PadTrackResult(
+            padded_key=storage_path,
+            bucket_name=None,  # None = use default transcript storage bucket
+            size=file_size,
+            track_index=input.track_index,
+        )
+
+    except Exception as e:
+        logger.error(
+            "[Hatchet] pad_track failed",
+            transcript_id=input.transcript_id,
+            track_index=input.track_index,
+            error=str(e),
+            exc_info=True,
+        )
+        raise

server/reflector/hatchet/workflows/topic_chunk_processing.py

@@ -7,7 +7,11 @@ Spawned dynamically by detect_topics via aio_run_many() for parallel processing.
 
 from datetime import timedelta
 
-from hatchet_sdk import ConcurrencyExpression, ConcurrencyLimitStrategy, Context
+from hatchet_sdk import (
+    ConcurrencyExpression,
+    ConcurrencyLimitStrategy,
+    Context,
+)
 from hatchet_sdk.rate_limit import RateLimit
 from pydantic import BaseModel
 
@@ -34,11 +38,13 @@ hatchet = HatchetClientManager.get_client()
 topic_chunk_workflow = hatchet.workflow(
     name="TopicChunkProcessing",
     input_validator=TopicChunkInput,
-    concurrency=ConcurrencyExpression(
-        expression="'global'",  # constant string = global limit across all runs
-        max_runs=20,
-        limit_strategy=ConcurrencyLimitStrategy.GROUP_ROUND_ROBIN,
-    ),
+    concurrency=[
+        ConcurrencyExpression(
+            expression="'global'",  # constant string = global limit across all runs
+            max_runs=20,
+            limit_strategy=ConcurrencyLimitStrategy.GROUP_ROUND_ROBIN,
+        )
+    ],
 )
 
 
@@ -65,7 +71,7 @@ async def detect_chunk_topic(input: TopicChunkInput, ctx: Context) -> TopicChunk
     from reflector.settings import settings  # noqa: PLC0415
     from reflector.utils.text import clean_title  # noqa: PLC0415
 
-    llm = LLM(settings=settings, temperature=0.9, max_tokens=500)
+    llm = LLM(settings=settings, temperature=0.9)
 
     prompt = TOPIC_PROMPT.format(text=input.chunk_text)
     response = await llm.get_structured_response(

server/reflector/hatchet/workflows/track_processing.py

@@ -14,9 +14,7 @@ Hatchet workers run in forked processes; fresh imports per task ensure
 storage/DB connections are not shared across forks.
 """
 
-import tempfile
 from datetime import timedelta
-from pathlib import Path
 
 import av
 from hatchet_sdk import Context
@@ -27,10 +25,7 @@ from reflector.hatchet.constants import TIMEOUT_AUDIO, TIMEOUT_HEAVY
 from reflector.hatchet.workflows.models import PadTrackResult, TranscribeTrackResult
 from reflector.logger import logger
 from reflector.utils.audio_constants import PRESIGNED_URL_EXPIRATION_SECONDS
-from reflector.utils.audio_padding import (
-    apply_audio_padding_to_file,
-    extract_stream_start_time_from_container,
-)
+from reflector.utils.audio_padding import extract_stream_start_time_from_container
 
 
 class TrackInput(BaseModel):
@@ -65,6 +60,7 @@ async def pad_track(input: TrackInput, ctx: Context) -> PadTrackResult:
 
     try:
         # Create fresh storage instance to avoid aioboto3 fork issues
+        # TODO: replace direct AwsStorage construction with get_transcripts_storage() factory
         from reflector.settings import settings  # noqa: PLC0415
         from reflector.storage.storage_aws import AwsStorage  # noqa: PLC0415
 
@@ -73,6 +69,7 @@ async def pad_track(input: TrackInput, ctx: Context) -> PadTrackResult:
             aws_region=settings.TRANSCRIPT_STORAGE_AWS_REGION,
             aws_access_key_id=settings.TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID,
             aws_secret_access_key=settings.TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY,
+            aws_endpoint_url=settings.TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL,
         )
 
         source_url = await storage.get_file_url(
@@ -83,63 +80,44 @@ async def pad_track(input: TrackInput, ctx: Context) -> PadTrackResult:
         )
 
         with av.open(source_url) as in_container:
-            if in_container.duration:
-                try:
-                    duration = timedelta(seconds=in_container.duration // 1_000_000)
-                    ctx.log(
-                        f"pad_track: track {input.track_index}, duration={duration}"
-                    )
-                except Exception:
-                    ctx.log(f"pad_track: track {input.track_index}, duration=ERROR")
-
             start_time_seconds = extract_stream_start_time_from_container(
                 in_container, input.track_index, logger=logger
             )
 
-            # If no padding needed, return original S3 key
-            if start_time_seconds <= 0:
-                logger.info(
-                    f"Track {input.track_index} requires no padding",
-                    track_index=input.track_index,
-                )
-                return PadTrackResult(
-                    padded_key=input.s3_key,
-                    bucket_name=input.bucket_name,
-                    size=0,
-                    track_index=input.track_index,
-                )
+        # If no padding needed, return original S3 key
+        if start_time_seconds <= 0:
+            logger.info(
+                f"Track {input.track_index} requires no padding",
+                track_index=input.track_index,
+            )
+            return PadTrackResult(
+                padded_key=input.s3_key,
+                bucket_name=input.bucket_name,
+                size=0,
+                track_index=input.track_index,
+            )
 
-            with tempfile.NamedTemporaryFile(suffix=".webm", delete=False) as temp_file:
-                temp_path = temp_file.name
+        storage_path = f"file_pipeline_hatchet/{input.transcript_id}/tracks/padded_{input.track_index}.webm"
 
-            try:
-                apply_audio_padding_to_file(
-                    in_container,
-                    temp_path,
-                    start_time_seconds,
-                    input.track_index,
-                    logger=logger,
-                )
+        # Presign PUT URL for output (Modal uploads directly)
+        output_url = await storage.get_file_url(
+            storage_path,
+            operation="put_object",
+            expires_in=PRESIGNED_URL_EXPIRATION_SECONDS,
+        )
 
-                file_size = Path(temp_path).stat().st_size
-                storage_path = f"file_pipeline_hatchet/{input.transcript_id}/tracks/padded_{input.track_index}.webm"
+        from reflector.processors.audio_padding_modal import (  # noqa: PLC0415
+            AudioPaddingModalProcessor,
+        )
 
-                logger.info(
-                    f"About to upload padded track",
-                    key=storage_path,
-                    size=file_size,
-                )
-
-                with open(temp_path, "rb") as padded_file:
-                    await storage.put_file(storage_path, padded_file)
-
-                logger.info(
-                    f"Uploaded padded track to S3",
-                    key=storage_path,
-                    size=file_size,
-                )
-            finally:
-                Path(temp_path).unlink(missing_ok=True)
+        processor = AudioPaddingModalProcessor()
+        result = await processor.pad_track(
+            track_url=source_url,
+            output_url=output_url,
+            start_time_seconds=start_time_seconds,
+            track_index=input.track_index,
+        )
+        file_size = result.size
 
         ctx.log(f"pad_track complete: track {input.track_index} -> {storage_path}")
         logger.info(
@@ -183,6 +161,7 @@ async def transcribe_track(input: TrackInput, ctx: Context) -> TranscribeTrackRe
             raise ValueError("Missing padded_key from pad_track")
 
         # Presign URL on demand (avoids stale URLs on workflow replay)
+        # TODO: replace direct AwsStorage construction with get_transcripts_storage() factory
         from reflector.settings import settings  # noqa: PLC0415
         from reflector.storage.storage_aws import AwsStorage  # noqa: PLC0415
 
@@ -191,6 +170,7 @@ async def transcribe_track(input: TrackInput, ctx: Context) -> TranscribeTrackRe
             aws_region=settings.TRANSCRIPT_STORAGE_AWS_REGION,
             aws_access_key_id=settings.TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID,
             aws_secret_access_key=settings.TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY,
+            aws_endpoint_url=settings.TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL,
         )
 
         audio_url = await storage.get_file_url(

server/reflector/llm.py

@@ -144,7 +144,18 @@ class StructuredOutputWorkflow(Workflow, Generic[OutputT]):
         )
 
         # Network retries handled by OpenAILike (max_retries=3)
-        response = await Settings.llm.acomplete(json_prompt)
+        # response_format enables grammar-based constrained decoding on backends
+        # that support it (DMR/llama.cpp, vLLM, Ollama, OpenAI).
+        response = await Settings.llm.acomplete(
+            json_prompt,
+            response_format={
+                "type": "json_schema",
+                "json_schema": {
+                    "name": self.output_cls.__name__,
+                    "schema": self.output_cls.model_json_schema(),
+                },
+            },
+        )
         return ExtractionDone(output=response.text)
 
     @step
@@ -191,7 +202,9 @@ class StructuredOutputWorkflow(Workflow, Generic[OutputT]):
 
 
 class LLM:
-    def __init__(self, settings, temperature: float = 0.4, max_tokens: int = 2048):
+    def __init__(
+        self, settings, temperature: float = 0.4, max_tokens: int | None = None
+    ):
         self.settings_obj = settings
         self.model_name = settings.LLM_MODEL
         self.url = settings.LLM_URL

server/reflector/pipelines/main_live_pipeline.py

@@ -62,6 +62,8 @@ from reflector.processors.types import (
 from reflector.processors.types import Transcript as TranscriptProcessorType
 from reflector.settings import settings
 from reflector.storage import get_transcripts_storage
+from reflector.views.transcripts import GetTranscriptTopic
+from reflector.ws_events import TranscriptEventName
 from reflector.ws_manager import WebsocketManager, get_ws_manager
 from reflector.zulip import (
     get_zulip_message,
@@ -89,7 +91,11 @@ def broadcast_to_sockets(func):
         if transcript and transcript.user_id:
             # Emit only relevant events to the user room to avoid noisy updates.
             # Allowed: STATUS, FINAL_TITLE, DURATION. All are prefixed with TRANSCRIPT_
-            allowed_user_events = {"STATUS", "FINAL_TITLE", "DURATION"}
+            allowed_user_events: set[TranscriptEventName] = {
+                "STATUS",
+                "FINAL_TITLE",
+                "DURATION",
+            }
             if resp.event in allowed_user_events:
                 await self.ws_manager.send_json(
                     room_id=f"user:{transcript.user_id}",
@@ -244,13 +250,14 @@ class PipelineMainBase(PipelineRunner[PipelineMessage], Generic[PipelineMessage]
         )
         if isinstance(data, TitleSummaryWithIdProcessorType):
             topic.id = data.id
+        get_topic = GetTranscriptTopic.from_transcript_topic(topic)
         async with self.transaction():
             transcript = await self.get_transcript()
             await transcripts_controller.upsert_topic(transcript, topic)
             return await transcripts_controller.append_event(
                 transcript=transcript,
                 event="TOPIC",
-                data=topic,
+                data=get_topic,
             )
 
     @broadcast_to_sockets

server/reflector/processors/audio_diarization_pyannote.py

@@ -1,74 +0,0 @@
-import os
-
-import torch
-import torchaudio
-from pyannote.audio import Pipeline
-
-from reflector.processors.audio_diarization import AudioDiarizationProcessor
-from reflector.processors.audio_diarization_auto import AudioDiarizationAutoProcessor
-from reflector.processors.types import AudioDiarizationInput, DiarizationSegment
-
-
-class AudioDiarizationPyannoteProcessor(AudioDiarizationProcessor):
-    """Local diarization processor using pyannote.audio library"""
-
-    def __init__(
-        self,
-        model_name: str = "pyannote/speaker-diarization-3.1",
-        pyannote_auth_token: str | None = None,
-        device: str | None = None,
-        **kwargs,
-    ):
-        super().__init__(**kwargs)
-        self.model_name = model_name
-        self.auth_token = pyannote_auth_token or os.environ.get("HF_TOKEN")
-        self.device = device
-
-        if device is None:
-            self.device = "cuda" if torch.cuda.is_available() else "cpu"
-
-        self.logger.info(f"Loading pyannote diarization model: {self.model_name}")
-        self.diarization_pipeline = Pipeline.from_pretrained(
-            self.model_name, use_auth_token=self.auth_token
-        )
-        self.diarization_pipeline.to(torch.device(self.device))
-        self.logger.info(f"Diarization model loaded on device: {self.device}")
-
-    async def _diarize(self, data: AudioDiarizationInput) -> list[DiarizationSegment]:
-        try:
-            # Load audio file (audio_url is assumed to be a local file path)
-            self.logger.info(f"Loading local audio file: {data.audio_url}")
-            waveform, sample_rate = torchaudio.load(data.audio_url)
-            audio_input = {"waveform": waveform, "sample_rate": sample_rate}
-            self.logger.info("Running speaker diarization")
-            diarization = self.diarization_pipeline(audio_input)
-
-            # Convert pyannote diarization output to our format
-            segments = []
-            for segment, _, speaker in diarization.itertracks(yield_label=True):
-                # Extract speaker number from label (e.g., "SPEAKER_00" -> 0)
-                speaker_id = 0
-                if speaker.startswith("SPEAKER_"):
-                    try:
-                        speaker_id = int(speaker.split("_")[-1])
-                    except (ValueError, IndexError):
-                        # Fallback to hash-based ID if parsing fails
-                        speaker_id = hash(speaker) % 1000
-
-                segments.append(
-                    {
-                        "start": round(segment.start, 3),
-                        "end": round(segment.end, 3),
-                        "speaker": speaker_id,
-                    }
-                )
-
-            self.logger.info(f"Diarization completed with {len(segments)} segments")
-            return segments
-
-        except Exception as e:
-            self.logger.exception(f"Diarization failed: {e}")
-            raise
-
-
-AudioDiarizationAutoProcessor.register("pyannote", AudioDiarizationPyannoteProcessor)

server/reflector/processors/audio_padding_modal.py

@@ -0,0 +1,113 @@
+"""
+Modal.com backend for audio padding.
+"""
+
+import asyncio
+import os
+
+import httpx
+from pydantic import BaseModel
+
+from reflector.hatchet.constants import TIMEOUT_AUDIO
+from reflector.logger import logger
+
+
+class PaddingResponse(BaseModel):
+    size: int
+    cancelled: bool = False
+
+
+class AudioPaddingModalProcessor:
+    """Audio padding processor using Modal.com CPU backend via HTTP."""
+
+    def __init__(
+        self, padding_url: str | None = None, modal_api_key: str | None = None
+    ):
+        self.padding_url = padding_url or os.getenv("PADDING_URL")
+        if not self.padding_url:
+            raise ValueError(
+                "PADDING_URL required to use AudioPaddingModalProcessor. "
+                "Set PADDING_URL environment variable or pass padding_url parameter."
+            )
+
+        self.modal_api_key = modal_api_key or os.getenv("MODAL_API_KEY")
+
+    async def pad_track(
+        self,
+        track_url: str,
+        output_url: str,
+        start_time_seconds: float,
+        track_index: int,
+    ) -> PaddingResponse:
+        """Pad audio track with silence via Modal backend.
+
+        Args:
+            track_url: Presigned GET URL for source audio track
+            output_url: Presigned PUT URL for output WebM
+            start_time_seconds: Amount of silence to prepend
+            track_index: Track index for logging
+        """
+        if not track_url:
+            raise ValueError("track_url cannot be empty")
+        if start_time_seconds <= 0:
+            raise ValueError(
+                f"start_time_seconds must be positive, got {start_time_seconds}"
+            )
+
+        log = logger.bind(track_index=track_index, padding_seconds=start_time_seconds)
+        log.info("Sending Modal padding HTTP request")
+
+        url = f"{self.padding_url}/pad"
+
+        headers = {}
+        if self.modal_api_key:
+            headers["Authorization"] = f"Bearer {self.modal_api_key}"
+
+        try:
+            async with httpx.AsyncClient(timeout=TIMEOUT_AUDIO) as client:
+                response = await client.post(
+                    url,
+                    headers=headers,
+                    json={
+                        "track_url": track_url,
+                        "output_url": output_url,
+                        "start_time_seconds": start_time_seconds,
+                        "track_index": track_index,
+                    },
+                    follow_redirects=True,
+                )
+
+                if response.status_code != 200:
+                    error_body = response.text
+                    log.error(
+                        "Modal padding API error",
+                        status_code=response.status_code,
+                        error_body=error_body,
+                    )
+
+                response.raise_for_status()
+                result = response.json()
+
+            # Check if work was cancelled
+            if result.get("cancelled"):
+                log.warning("Modal padding was cancelled by disconnect detection")
+                raise asyncio.CancelledError(
+                    "Padding cancelled due to client disconnect"
+                )
+
+            log.info("Modal padding complete", size=result["size"])
+            return PaddingResponse(**result)
+        except asyncio.CancelledError:
+            log.warning(
+                "Modal padding cancelled (Hatchet timeout, disconnect detected on Modal side)"
+            )
+            raise
+        except httpx.TimeoutException as e:
+            log.error("Modal padding timeout", error=str(e), exc_info=True)
+            raise Exception(f"Modal padding timeout: {e}") from e
+        except httpx.HTTPStatusError as e:
+            log.error("Modal padding HTTP error", error=str(e), exc_info=True)
+            raise Exception(f"Modal padding HTTP error: {e}") from e
+        except Exception as e:
+            log.error("Modal padding unexpected error", error=str(e), exc_info=True)
+            raise

server/reflector/processors/transcript_final_title.py

@@ -39,7 +39,7 @@ class TranscriptFinalTitleProcessor(Processor):
     def __init__(self, **kwargs):
         super().__init__(**kwargs)
         self.chunks: list[TitleSummary] = []
-        self.llm = LLM(settings=settings, temperature=0.5, max_tokens=200)
+        self.llm = LLM(settings=settings, temperature=0.5)
 
     async def _push(self, data: TitleSummary):
         self.chunks.append(data)

server/reflector/processors/transcript_topic_detector.py

@@ -35,7 +35,7 @@ class TranscriptTopicDetectorProcessor(Processor):
         super().__init__(**kwargs)
         self.transcript = None
         self.min_transcript_length = min_transcript_length
-        self.llm = LLM(settings=settings, temperature=0.9, max_tokens=500)
+        self.llm = LLM(settings=settings, temperature=0.9)
 
     async def _push(self, data: Transcript):
         if self.transcript is None:

server/reflector/services/ics_sync.py

@@ -319,21 +319,6 @@ class ICSSyncService:
             calendar = self.fetch_service.parse_ics(ics_content)
 
             content_hash = hashlib.md5(ics_content.encode()).hexdigest()
-            if room.ics_last_etag == content_hash:
-                logger.info("No changes in ICS for room", room_id=room.id)
-                room_url = f"{settings.UI_BASE_URL}/{room.name}"
-                events, total_events = self.fetch_service.extract_room_events(
-                    calendar, room.name, room_url
-                )
-                return {
-                    "status": SyncStatus.UNCHANGED,
-                    "hash": content_hash,
-                    "events_found": len(events),
-                    "total_events": total_events,
-                    "events_created": 0,
-                    "events_updated": 0,
-                    "events_deleted": 0,
-                }
 
             # Extract matching events
             room_url = f"{settings.UI_BASE_URL}/{room.name}"
@@ -371,6 +356,44 @@ class ICSSyncService:
         time_since_sync = datetime.now(timezone.utc) - room.ics_last_sync
         return time_since_sync.total_seconds() >= room.ics_fetch_interval
 
+    def _event_data_changed(self, existing: CalendarEvent, new_data: EventData) -> bool:
+        """Check if event data has changed by comparing relevant fields.
+
+        IMPORTANT: When adding fields to CalendarEvent/EventData, update this method
+        and the _COMPARED_FIELDS set below for runtime validation.
+        """
+        # Fields that come from ICS and should trigger updates when changed
+        _COMPARED_FIELDS = {
+            "title",
+            "description",
+            "start_time",
+            "end_time",
+            "location",
+            "attendees",
+            "ics_raw_data",
+        }
+
+        # Runtime exhaustiveness check: ensure we're comparing all EventData fields
+        event_data_fields = set(EventData.__annotations__.keys()) - {"ics_uid"}
+        if event_data_fields != _COMPARED_FIELDS:
+            missing = event_data_fields - _COMPARED_FIELDS
+            extra = _COMPARED_FIELDS - event_data_fields
+            raise RuntimeError(
+                f"_event_data_changed() field mismatch: "
+                f"missing={missing}, extra={extra}. "
+                f"Update the comparison logic when adding/removing fields."
+            )
+
+        return (
+            existing.title != new_data["title"]
+            or existing.description != new_data["description"]
+            or existing.start_time != new_data["start_time"]
+            or existing.end_time != new_data["end_time"]
+            or existing.location != new_data["location"]
+            or existing.attendees != new_data["attendees"]
+            or existing.ics_raw_data != new_data["ics_raw_data"]
+        )
+
     async def _sync_events_to_database(
         self, room_id: str, events: list[EventData]
     ) -> SyncStats:
@@ -386,11 +409,14 @@ class ICSSyncService:
             )
 
             if existing:
-                updated += 1
+                # Only count as updated if data actually changed
+                if self._event_data_changed(existing, event_data):
+                    updated += 1
+                    await calendar_events_controller.upsert(calendar_event)
             else:
                 created += 1
+                await calendar_events_controller.upsert(calendar_event)
 
-            await calendar_events_controller.upsert(calendar_event)
             current_ics_uids.append(event_data["ics_uid"])
 
         # Soft delete events that are no longer in calendar

server/reflector/services/transcript_process.py

@@ -11,19 +11,14 @@ from typing import Literal, Union, assert_never
 
 import celery
 from celery.result import AsyncResult
-from hatchet_sdk.clients.rest.exceptions import ApiException
+from hatchet_sdk.clients.rest.exceptions import ApiException, NotFoundException
 from hatchet_sdk.clients.rest.models import V1TaskStatus
 
 from reflector.db.recordings import recordings_controller
-from reflector.db.rooms import rooms_controller
 from reflector.db.transcripts import Transcript, transcripts_controller
 from reflector.hatchet.client import HatchetClientManager
 from reflector.logger import logger
 from reflector.pipelines.main_file_pipeline import task_pipeline_file_process
-from reflector.pipelines.main_multitrack_pipeline import (
-    task_pipeline_multitrack_process,
-)
-from reflector.settings import settings
 from reflector.utils.string import NonEmptyString
 
 
@@ -102,8 +97,11 @@ async def validate_transcript_for_processing(
     if transcript.locked:
         return ValidationLocked(detail="Recording is locked")
 
-    # hatchet is idempotent anyways + if it wasn't dispatched successfully
-    if transcript.status == "idle" and not settings.HATCHET_ENABLED:
+    if (
+        transcript.status == "idle"
+        and not transcript.workflow_run_id
+        and not transcript.recording_id
+    ):
         return ValidationNotReady(detail="Recording is not ready for processing")
 
     # Check Celery tasks
@@ -116,7 +114,8 @@ async def validate_transcript_for_processing(
     ):
         return ValidationAlreadyScheduled(detail="already running")
 
-    if settings.HATCHET_ENABLED and transcript.workflow_run_id:
+    # Check Hatchet workflow status if workflow_run_id exists
+    if transcript.workflow_run_id:
         try:
             status = await HatchetClientManager.get_workflow_run_status(
                 transcript.workflow_run_id
@@ -181,42 +180,24 @@ async def dispatch_transcript_processing(
     Returns AsyncResult for Celery tasks, None for Hatchet workflows.
     """
     if isinstance(config, MultitrackProcessingConfig):
-        # Check if room has use_hatchet=True (overrides env vars)
-        room_forces_hatchet = False
-        if config.room_id:
-            room = await rooms_controller.get_by_id(config.room_id)
-            room_forces_hatchet = room.use_hatchet if room else False
-
-        # Start durable workflow if enabled (Hatchet)
-        # and if room has use_hatchet=True
-        use_hatchet = settings.HATCHET_ENABLED and room_forces_hatchet
-
-        if room_forces_hatchet:
-            logger.info(
-                "Room forces Hatchet workflow",
-                room_id=config.room_id,
-                transcript_id=config.transcript_id,
+        # Multitrack processing always uses Hatchet (no Celery fallback)
+        # First check if we can replay (outside transaction since it's read-only)
+        transcript = await transcripts_controller.get_by_id(config.transcript_id)
+        if transcript and transcript.workflow_run_id and not force:
+            can_replay = await HatchetClientManager.can_replay(
+                transcript.workflow_run_id
             )
-
-        if use_hatchet:
-            # First check if we can replay (outside transaction since it's read-only)
-            transcript = await transcripts_controller.get_by_id(config.transcript_id)
-            if transcript and transcript.workflow_run_id and not force:
-                can_replay = await HatchetClientManager.can_replay(
-                    transcript.workflow_run_id
+            if can_replay:
+                await HatchetClientManager.replay_workflow(transcript.workflow_run_id)
+                logger.info(
+                    "Replaying Hatchet workflow",
+                    workflow_id=transcript.workflow_run_id,
                 )
-                if can_replay:
-                    await HatchetClientManager.replay_workflow(
-                        transcript.workflow_run_id
-                    )
-                    logger.info(
-                        "Replaying Hatchet workflow",
-                        workflow_id=transcript.workflow_run_id,
-                    )
-                    return None
-                else:
-                    # Workflow exists but can't replay (CANCELLED, COMPLETED, etc.)
-                    # Log and proceed to start new workflow
+                return None
+            else:
+                # Workflow can't replay (CANCELLED, COMPLETED, or 404 deleted)
+                # Log and proceed to start new workflow
+                try:
                     status = await HatchetClientManager.get_workflow_run_status(
                         transcript.workflow_run_id
                     )
@@ -225,68 +206,72 @@ async def dispatch_transcript_processing(
                         old_workflow_id=transcript.workflow_run_id,
                         old_status=status.value,
                     )
+                except NotFoundException:
+                    # Workflow deleted from Hatchet but ID still in DB
+                    logger.info(
+                        "Old workflow not found in Hatchet, starting new",
+                        old_workflow_id=transcript.workflow_run_id,
+                    )
 
-            # Force: cancel old workflow if exists
-            if force and transcript and transcript.workflow_run_id:
+        # Force: cancel old workflow if exists
+        if force and transcript and transcript.workflow_run_id:
+            try:
                 await HatchetClientManager.cancel_workflow(transcript.workflow_run_id)
                 logger.info(
                     "Cancelled old workflow (--force)",
                     workflow_id=transcript.workflow_run_id,
                 )
-                await transcripts_controller.update(
-                    transcript, {"workflow_run_id": None}
+            except NotFoundException:
+                logger.info(
+                    "Old workflow already deleted (--force)",
+                    workflow_id=transcript.workflow_run_id,
                 )
+            await transcripts_controller.update(transcript, {"workflow_run_id": None})
 
-            # Re-fetch and check for concurrent dispatch (optimistic approach).
-            # No database lock - worst case is duplicate dispatch, but Hatchet
-            # workflows are idempotent so this is acceptable.
-            transcript = await transcripts_controller.get_by_id(config.transcript_id)
-            if transcript and transcript.workflow_run_id:
-                # Another process started a workflow between validation and now
-                try:
-                    status = await HatchetClientManager.get_workflow_run_status(
-                        transcript.workflow_run_id
+        # Re-fetch and check for concurrent dispatch (optimistic approach).
+        # No database lock - worst case is duplicate dispatch, but Hatchet
+        # workflows are idempotent so this is acceptable.
+        transcript = await transcripts_controller.get_by_id(config.transcript_id)
+        if transcript and transcript.workflow_run_id:
+            # Another process started a workflow between validation and now
+            try:
+                status = await HatchetClientManager.get_workflow_run_status(
+                    transcript.workflow_run_id
+                )
+                if status in (V1TaskStatus.RUNNING, V1TaskStatus.QUEUED):
+                    logger.info(
+                        "Concurrent workflow detected, skipping dispatch",
+                        workflow_id=transcript.workflow_run_id,
                     )
-                    if status in (V1TaskStatus.RUNNING, V1TaskStatus.QUEUED):
-                        logger.info(
-                            "Concurrent workflow detected, skipping dispatch",
-                            workflow_id=transcript.workflow_run_id,
-                        )
-                        return None
-                except ApiException:
-                    # Workflow might be gone (404) or API issue - proceed with new workflow
-                    pass
+                    return None
+            except ApiException:
+                # Workflow might be gone (404) or API issue - proceed with new workflow
+                pass
 
-            workflow_id = await HatchetClientManager.start_workflow(
-                workflow_name="DiarizationPipeline",
-                input_data={
-                    "recording_id": config.recording_id,
-                    "tracks": [{"s3_key": k} for k in config.track_keys],
-                    "bucket_name": config.bucket_name,
-                    "transcript_id": config.transcript_id,
-                    "room_id": config.room_id,
-                },
-                additional_metadata={
-                    "transcript_id": config.transcript_id,
-                    "recording_id": config.recording_id,
-                    "daily_recording_id": config.recording_id,
-                },
+        workflow_id = await HatchetClientManager.start_workflow(
+            workflow_name="DiarizationPipeline",
+            input_data={
+                "recording_id": config.recording_id,
+                "tracks": [{"s3_key": k} for k in config.track_keys],
+                "bucket_name": config.bucket_name,
+                "transcript_id": config.transcript_id,
+                "room_id": config.room_id,
+            },
+            additional_metadata={
+                "transcript_id": config.transcript_id,
+                "recording_id": config.recording_id,
+                "daily_recording_id": config.recording_id,
+            },
+        )
+
+        if transcript:
+            await transcripts_controller.update(
+                transcript, {"workflow_run_id": workflow_id}
             )
 
-            if transcript:
-                await transcripts_controller.update(
-                    transcript, {"workflow_run_id": workflow_id}
-                )
+        logger.info("Hatchet workflow dispatched", workflow_id=workflow_id)
+        return None
 
-            logger.info("Hatchet workflow dispatched", workflow_id=workflow_id)
-            return None
-
-        # Celery pipeline (durable workflows disabled)
-        return task_pipeline_multitrack_process.delay(
-            transcript_id=config.transcript_id,
-            bucket_name=config.bucket_name,
-            track_keys=config.track_keys,
-        )
     elif isinstance(config, FileProcessingConfig):
         return task_pipeline_file_process.delay(transcript_id=config.transcript_id)
     else:

server/reflector/settings.py

@@ -1,7 +1,7 @@
 from pydantic.types import PositiveInt
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-from reflector.schemas.platform import WHEREBY_PLATFORM, Platform
+from reflector.schemas.platform import DAILY_PLATFORM, Platform
 from reflector.utils.string import NonEmptyString
 
 
@@ -12,6 +12,17 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
+    ROOT_PATH: str = "/"
+
+    # WebRTC port range for ICE candidates (e.g. "50000-50100").
+    # When set, monkey-patches aioice to bind UDP sockets within this range,
+    # allowing Docker port mapping instead of network_mode: host.
+    WEBRTC_PORT_RANGE: str | None = None
+    # Host IP or hostname to advertise in ICE candidates instead of the
+    # container's internal IP. Use "host.docker.internal" in Docker with
+    # extra_hosts, or a specific LAN IP. Resolved at connection time.
+    WEBRTC_HOST: str | None = None
+
     # CORS
     UI_BASE_URL: str = "http://localhost:3000"
     CORS_ORIGIN: str = "*"
@@ -49,6 +60,7 @@ class Settings(BaseSettings):
     TRANSCRIPT_STORAGE_AWS_REGION: str = "us-east-1"
     TRANSCRIPT_STORAGE_AWS_ACCESS_KEY_ID: str | None = None
     TRANSCRIPT_STORAGE_AWS_SECRET_ACCESS_KEY: str | None = None
+    TRANSCRIPT_STORAGE_AWS_ENDPOINT_URL: str | None = None
 
     # Platform-specific recording storage (follows {PREFIX}_STORAGE_AWS_{CREDENTIAL} pattern)
     # Whereby storage configuration
@@ -84,9 +96,7 @@ class Settings(BaseSettings):
     )
 
     # Diarization
-    # backends:
-    #   - pyannote: in-process model loading (no HTTP, runs in same process)
-    #   - modal: HTTP API client (works with Modal.com OR self-hosted gpu/self_hosted/)
+    # backend: modal — HTTP API client (works with Modal.com OR self-hosted gpu/self_hosted/)
     DIARIZATION_ENABLED: bool = True
     DIARIZATION_BACKEND: str = "modal"
     DIARIZATION_URL: str | None = None
@@ -95,8 +105,9 @@ class Settings(BaseSettings):
     # Diarization: modal backend
     DIARIZATION_MODAL_API_KEY: str | None = None
 
-    # Diarization: local pyannote.audio
-    DIARIZATION_PYANNOTE_AUTH_TOKEN: str | None = None
+    # Audio Padding (Modal.com backend)
+    PADDING_URL: str | None = None
+    PADDING_MODAL_API_KEY: str | None = None
 
     # Sentry
     SENTRY_DSN: str | None = None
@@ -151,26 +162,17 @@ class Settings(BaseSettings):
         None  # Webhook UUID for this environment. Not used by production code
     )
     # Platform Configuration
-    DEFAULT_VIDEO_PLATFORM: Platform = WHEREBY_PLATFORM
+    DEFAULT_VIDEO_PLATFORM: Platform = DAILY_PLATFORM
 
     # Zulip integration
     ZULIP_REALM: str | None = None
     ZULIP_API_KEY: str | None = None
     ZULIP_BOT_EMAIL: str | None = None
 
-    # Durable workflow orchestration
-    # Provider: "hatchet" (or "none" to disable)
-    DURABLE_WORKFLOW_PROVIDER: str = "none"
-
-    # Hatchet workflow orchestration
+    # Hatchet workflow orchestration (always enabled for multitrack processing)
     HATCHET_CLIENT_TOKEN: str | None = None
     HATCHET_CLIENT_TLS_STRATEGY: str = "none"  # none, tls, mtls
     HATCHET_DEBUG: bool = False
 
-    @property
-    def HATCHET_ENABLED(self) -> bool:
-        """True if Hatchet is the active provider."""
-        return self.DURABLE_WORKFLOW_PROVIDER == "hatchet"
-
 
 settings = Settings()

server/reflector/storage/storage_aws.py

@@ -53,6 +53,7 @@ class AwsStorage(Storage):
         aws_access_key_id: str | None = None,
         aws_secret_access_key: str | None = None,
         aws_role_arn: str | None = None,
+        aws_endpoint_url: str | None = None,
     ):
         if not aws_bucket_name:
             raise ValueError("Storage `aws_storage` require `aws_bucket_name`")
@@ -73,17 +74,26 @@ class AwsStorage(Storage):
         self._access_key_id = aws_access_key_id
         self._secret_access_key = aws_secret_access_key
         self._role_arn = aws_role_arn
+        self._endpoint_url = aws_endpoint_url
 
         self.aws_folder = ""
         if "/" in aws_bucket_name:
             self._bucket_name, self.aws_folder = aws_bucket_name.split("/", 1)
-        self.boto_config = Config(retries={"max_attempts": 3, "mode": "adaptive"})
+
+        config_kwargs: dict = {"retries": {"max_attempts": 3, "mode": "adaptive"}}
+        if aws_endpoint_url:
+            config_kwargs["s3"] = {"addressing_style": "path"}
+        self.boto_config = Config(**config_kwargs)
+
         self.session = aioboto3.Session(
             aws_access_key_id=aws_access_key_id,
             aws_secret_access_key=aws_secret_access_key,
             region_name=aws_region,
         )
-        self.base_url = f"https://{self._bucket_name}.s3.amazonaws.com/"
+        if aws_endpoint_url:
+            self.base_url = f"{aws_endpoint_url}/{self._bucket_name}/"
+        else:
+            self.base_url = f"https://{self._bucket_name}.s3.amazonaws.com/"
 
     # Implement credential properties
     @property
@@ -139,7 +149,9 @@ class AwsStorage(Storage):
         s3filename = f"{folder}/{filename}" if folder else filename
         logger.info(f"Uploading {filename} to S3 {actual_bucket}/{folder}")
 
-        async with self.session.client("s3", config=self.boto_config) as client:
+        async with self.session.client(
+            "s3", config=self.boto_config, endpoint_url=self._endpoint_url
+        ) as client:
             if isinstance(data, bytes):
                 await client.put_object(Bucket=actual_bucket, Key=s3filename, Body=data)
             else:
@@ -162,7 +174,9 @@ class AwsStorage(Storage):
         actual_bucket = bucket or self._bucket_name
         folder = self.aws_folder
         s3filename = f"{folder}/{filename}" if folder else filename
-        async with self.session.client("s3", config=self.boto_config) as client:
+        async with self.session.client(
+            "s3", config=self.boto_config, endpoint_url=self._endpoint_url
+        ) as client:
             presigned_url = await client.generate_presigned_url(
                 operation,
                 Params={"Bucket": actual_bucket, "Key": s3filename},
@@ -177,7 +191,9 @@ class AwsStorage(Storage):
         folder = self.aws_folder
         logger.info(f"Deleting {filename} from S3 {actual_bucket}/{folder}")
         s3filename = f"{folder}/{filename}" if folder else filename
-        async with self.session.client("s3", config=self.boto_config) as client:
+        async with self.session.client(
+            "s3", config=self.boto_config, endpoint_url=self._endpoint_url
+        ) as client:
             await client.delete_object(Bucket=actual_bucket, Key=s3filename)
 
     @handle_s3_client_errors("download")
@@ -186,7 +202,9 @@ class AwsStorage(Storage):
         folder = self.aws_folder
         logger.info(f"Downloading {filename} from S3 {actual_bucket}/{folder}")
         s3filename = f"{folder}/{filename}" if folder else filename
-        async with self.session.client("s3", config=self.boto_config) as client:
+        async with self.session.client(
+            "s3", config=self.boto_config, endpoint_url=self._endpoint_url
+        ) as client:
             response = await client.get_object(Bucket=actual_bucket, Key=s3filename)
             return await response["Body"].read()
 
@@ -201,7 +219,9 @@ class AwsStorage(Storage):
         logger.info(f"Listing objects from S3 {actual_bucket} with prefix '{s3prefix}'")
 
         keys = []
-        async with self.session.client("s3", config=self.boto_config) as client:
+        async with self.session.client(
+            "s3", config=self.boto_config, endpoint_url=self._endpoint_url
+        ) as client:
             paginator = client.get_paginator("list_objects_v2")
             async for page in paginator.paginate(Bucket=actual_bucket, Prefix=s3prefix):
                 if "Contents" in page:
@@ -227,7 +247,9 @@ class AwsStorage(Storage):
         folder = self.aws_folder
         logger.info(f"Streaming {filename} from S3 {actual_bucket}/{folder}")
         s3filename = f"{folder}/{filename}" if folder else filename
-        async with self.session.client("s3", config=self.boto_config) as client:
+        async with self.session.client(
+            "s3", config=self.boto_config, endpoint_url=self._endpoint_url
+        ) as client:
             await client.download_fileobj(
                 Bucket=actual_bucket, Key=s3filename, Fileobj=fileobj
             )

server/reflector/tools/process.py

@@ -24,6 +24,9 @@ from reflector.pipelines.main_live_pipeline import (
     pipeline_process as live_pipeline_process,
 )
 from reflector.storage import Storage
+from reflector.worker.app import (
+    app as celery_app,  # noqa: F401 - ensure Celery uses Redis broker
+)
 
 
 def validate_s3_bucket_name(bucket: str) -> None:

server/reflector/utils/audio_constants.py

@@ -5,7 +5,9 @@ Used by both Hatchet workflows and Celery pipelines for consistent audio encodin
 """
 
 # Opus codec settings
+# ref B0F71CE8-FC59-4AA5-8414-DAFB836DB711
 OPUS_STANDARD_SAMPLE_RATE = 48000
+# ref B0F71CE8-FC59-4AA5-8414-DAFB836DB711
 OPUS_DEFAULT_BIT_RATE = 128000  # 128kbps for good speech quality
 
 # S3 presigned URL expiration

server/reflector/video_platforms/daily.py

@@ -1,4 +1,5 @@
 from datetime import datetime
+from uuid import UUID
 
 from reflector.dailyco_api import (
     CreateMeetingTokenRequest,
@@ -12,9 +13,11 @@ from reflector.dailyco_api import (
     RoomProperties,
     verify_webhook_signature,
 )
+from reflector.dailyco_api import RecordingType as DailyRecordingType
 from reflector.db.daily_participant_sessions import (
     daily_participant_sessions_controller,
 )
+from reflector.db.meetings import meetings_controller
 from reflector.db.rooms import Room
 from reflector.logger import logger
 from reflector.storage import get_dailyco_storage
@@ -58,10 +61,9 @@ class DailyClient(VideoPlatformClient):
         enable_recording = None
         if room.recording_type == self.RECORDING_LOCAL:
             enable_recording = "local"
-        elif (
-            room.recording_type == self.RECORDING_CLOUD
-        ):  # daily "cloud" is not our "cloud"
-            enable_recording = "raw-tracks"
+        elif room.recording_type == self.RECORDING_CLOUD:
+            # Don't set enable_recording - recordings started via REST API (not auto-start)
+            enable_recording = None
 
         properties = RoomProperties(
             enable_recording=enable_recording,
@@ -106,8 +108,6 @@ class DailyClient(VideoPlatformClient):
         Daily.co doesn't provide historical session API, so we query our database
         where participant.joined/left webhooks are stored.
         """
-        from reflector.db.meetings import meetings_controller  # noqa: PLC0415
-
         meeting = await meetings_controller.get_by_room_name(room_name)
         if not meeting:
             return []
@@ -179,21 +179,14 @@ class DailyClient(VideoPlatformClient):
     async def create_meeting_token(
         self,
         room_name: DailyRoomName,
-        start_cloud_recording: bool,
         enable_recording_ui: bool,
         user_id: NonEmptyString | None = None,
         is_owner: bool = False,
         max_recording_duration_seconds: int | None = None,
     ) -> NonEmptyString:
-        start_cloud_recording_opts = None
-        if start_cloud_recording and max_recording_duration_seconds:
-            start_cloud_recording_opts = {"maxDuration": max_recording_duration_seconds}
-
         properties = MeetingTokenProperties(
             room_name=room_name,
             user_id=user_id,
-            start_cloud_recording=start_cloud_recording,
-            start_cloud_recording_opts=start_cloud_recording_opts,
             enable_recording_ui=enable_recording_ui,
             is_owner=is_owner,
         )
@@ -201,6 +194,23 @@ class DailyClient(VideoPlatformClient):
         result = await self._api_client.create_meeting_token(request)
         return result.token
 
+    async def start_recording(
+        self,
+        room_name: DailyRoomName,
+        recording_type: DailyRecordingType,
+        instance_id: UUID,
+    ) -> dict:
+        """Start recording via Daily.co REST API.
+
+        Args:
+            instance_id: UUID for this recording session - one UUID per "room" in Daily (which is "meeting" in Reflector)
+        """
+        return await self._api_client.start_recording(
+            room_name=room_name,
+            recording_type=recording_type,
+            instance_id=instance_id,
+        )
+
     async def close(self):
         """Clean up API client resources."""
         await self._api_client.close()

server/reflector/views/daily.py

@@ -19,6 +19,7 @@ from reflector.video_platforms.factory import create_platform_client
 from reflector.worker.process import (
     poll_daily_room_presence_task,
     process_multitrack_recording,
+    store_cloud_recording,
 )
 
 router = APIRouter()
@@ -79,7 +80,14 @@ async def webhook(request: Request):
     try:
         event = event_adapter.validate_python(body_json)
     except Exception as e:
-        logger.error("Failed to parse webhook event", error=str(e), body=body.decode())
+        err_detail = str(e)
+        if hasattr(e, "errors"):
+            err_detail = f"{err_detail}; errors={e.errors()!r}"
+        logger.error(
+            "Failed to parse webhook event",
+            error=err_detail,
+            body=body.decode(),
+        )
         raise HTTPException(status_code=422, detail="Invalid event format")
 
     match event:
@@ -174,46 +182,64 @@ async def _handle_recording_started(event: RecordingStartedEvent):
 async def _handle_recording_ready(event: RecordingReadyEvent):
     room_name = event.payload.room_name
     recording_id = event.payload.recording_id
-    tracks = event.payload.tracks
-
-    if not tracks:
-        logger.warning(
-            "recording.ready-to-download: missing tracks",
-            room_name=room_name,
-            recording_id=recording_id,
-            payload=event.payload,
-        )
-        return
+    recording_type = event.payload.type
 
     logger.info(
         "Recording ready for download",
         room_name=room_name,
         recording_id=recording_id,
-        num_tracks=len(tracks),
+        recording_type=recording_type,
         platform="daily",
     )
 
     bucket_name = settings.DAILYCO_STORAGE_AWS_BUCKET_NAME
     if not bucket_name:
-        logger.error(
-            "DAILYCO_STORAGE_AWS_BUCKET_NAME not configured; cannot process Daily recording"
-        )
+        logger.error("DAILYCO_STORAGE_AWS_BUCKET_NAME not configured")
         return
 
-    track_keys = [t.s3Key for t in tracks if t.type == "audio"]
+    if recording_type == "cloud":
+        await store_cloud_recording(
+            recording_id=recording_id,
+            room_name=room_name,
+            s3_key=event.payload.s3_key,
+            duration=event.payload.duration,
+            start_ts=event.payload.start_ts,
+            source="webhook",
+        )
 
-    logger.info(
-        "Recording webhook queuing processing",
-        recording_id=recording_id,
-        room_name=room_name,
-    )
+    elif recording_type == "raw-tracks":
+        tracks = event.payload.tracks
+        if not tracks:
+            logger.warning(
+                "raw-tracks recording: missing tracks array",
+                room_name=room_name,
+                recording_id=recording_id,
+            )
+            return
 
-    process_multitrack_recording.delay(
-        bucket_name=bucket_name,
-        daily_room_name=room_name,
-        recording_id=recording_id,
-        track_keys=track_keys,
-    )
+        track_keys = [t.s3Key for t in tracks if t.type == "audio"]
+
+        logger.info(
+            "Raw-tracks recording queuing processing",
+            recording_id=recording_id,
+            room_name=room_name,
+            num_tracks=len(track_keys),
+        )
+
+        process_multitrack_recording.delay(
+            bucket_name=bucket_name,
+            daily_room_name=room_name,
+            recording_id=recording_id,
+            track_keys=track_keys,
+            recording_start_ts=event.payload.start_ts,
+        )
+
+    else:
+        logger.warning(
+            "Unknown recording type",
+            recording_type=recording_type,
+            recording_id=recording_id,
+        )
 
 
 async def _handle_recording_error(event: RecordingErrorEvent):

server/reflector/views/meetings.py

@@ -1,16 +1,23 @@
+import json
 from datetime import datetime, timezone
-from typing import Annotated, Optional
+from typing import Annotated, Any, Optional
+from uuid import UUID
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
 
 import reflector.auth as auth
+from reflector.dailyco_api import RecordingType
+from reflector.dailyco_api.client import DailyApiError
 from reflector.db.meetings import (
     MeetingConsent,
     meeting_consent_controller,
     meetings_controller,
 )
 from reflector.db.rooms import rooms_controller
+from reflector.logger import logger
+from reflector.utils.string import NonEmptyString
+from reflector.video_platforms.factory import create_platform_client
 
 router = APIRouter()
 
@@ -73,3 +80,72 @@ async def meeting_deactivate(
     await meetings_controller.update_meeting(meeting_id, is_active=False)
 
     return {"status": "success", "meeting_id": meeting_id}
+
+
+class StartRecordingRequest(BaseModel):
+    type: RecordingType
+    instanceId: UUID
+
+
+@router.post("/meetings/{meeting_id}/recordings/start")
+async def start_recording(
+    meeting_id: NonEmptyString, body: StartRecordingRequest
+) -> dict[str, Any]:
+    """Start cloud or raw-tracks recording via Daily.co REST API.
+
+    Both cloud and raw-tracks are started via REST API to bypass enable_recording limitation of allowing only 1 recording at a time.
+    Uses different instanceIds for cloud vs raw-tracks (same won't work)
+
+    Note: No authentication required - anonymous users supported. TODO this is a DOS vector
+    """
+    meeting = await meetings_controller.get_by_id(meeting_id)
+    if not meeting:
+        raise HTTPException(status_code=404, detail="Meeting not found")
+
+    log = logger.bind(
+        meeting_id=meeting_id,
+        room_name=meeting.room_name,
+        recording_type=body.type,
+        instance_id=body.instanceId,
+    )
+
+    try:
+        client = create_platform_client("daily")
+        result = await client.start_recording(
+            room_name=meeting.room_name,
+            recording_type=body.type,
+            instance_id=body.instanceId,
+        )
+
+        log.info(f"Started {body.type} recording via REST API")
+
+        return {"status": "ok", "result": result}
+
+    except DailyApiError as e:
+        # Parse Daily.co error response to detect "has an active stream"
+        try:
+            error_body = json.loads(e.response_body)
+            error_info = error_body.get("info", "")
+
+            # "has an active stream" means recording already started by another participant
+            # This is SUCCESS from business logic perspective - return 200
+            if "has an active stream" in error_info:
+                log.info(
+                    f"{body.type} recording already active (started by another participant)"
+                )
+                return {"status": "already_active", "instanceId": str(body.instanceId)}
+        except (json.JSONDecodeError, KeyError):
+            pass  # Fall through to error handling
+
+        # All other Daily.co API errors
+        log.error(f"Failed to start {body.type} recording", error=str(e))
+        raise HTTPException(
+            status_code=500, detail=f"Failed to start recording: {str(e)}"
+        )
+
+    except Exception as e:
+        # Non-Daily.co errors
+        log.error(f"Failed to start {body.type} recording", error=str(e))
+        raise HTTPException(
+            status_code=500, detail=f"Failed to start recording: {str(e)}"
+        )

server/reflector/views/rooms.py

@@ -73,6 +73,8 @@ class Meeting(BaseModel):
     calendar_event_id: str | None = None
     calendar_metadata: dict[str, Any] | None = None
     platform: Platform
+    daily_composed_video_s3_key: str | None = None
+    daily_composed_video_duration: int | None = None
 
 
 class CreateRoom(BaseModel):
@@ -586,7 +588,6 @@ async def rooms_join_meeting(
         )
         token = await client.create_meeting_token(
             meeting.room_name,
-            start_cloud_recording=meeting.recording_type == "cloud",
             enable_recording_ui=enable_recording_ui,
             user_id=user_id,
             is_owner=user_id == room.user_id,

server/reflector/views/rtc_offer.py

@@ -10,6 +10,7 @@ from pydantic import BaseModel
 from reflector.events import subscribers_shutdown
 from reflector.logger import logger
 from reflector.pipelines.runner import PipelineRunner
+from reflector.settings import settings
 
 sessions = []
 router = APIRouter()
@@ -123,7 +124,16 @@ async def rtc_offer_base(
     # update metrics
     m_rtc_sessions.inc()
 
-    return RtcOffer(sdp=pc.localDescription.sdp, type=pc.localDescription.type)
+    sdp = pc.localDescription.sdp
+
+    # Rewrite ICE candidate IPs when running behind Docker bridge networking
+    if settings.WEBRTC_HOST:
+        from reflector.webrtc_ports import resolve_webrtc_host, rewrite_sdp_host
+
+        host_ip = resolve_webrtc_host(settings.WEBRTC_HOST)
+        sdp = rewrite_sdp_host(sdp, host_ip)
+
+    return RtcOffer(sdp=sdp, type=pc.localDescription.type)
 
 
 @subscribers_shutdown.append

server/reflector/views/transcripts.py

@@ -111,6 +111,7 @@ class GetTranscriptMinimal(BaseModel):
     room_id: str | None = None
     room_name: str | None = None
     audio_deleted: bool | None = None
+    change_seq: int | None = None
 
 
 class TranscriptParticipantWithEmail(TranscriptParticipant):
@@ -266,12 +267,22 @@ async def transcripts_list(
     source_kind: SourceKind | None = None,
     room_id: str | None = None,
     search_term: str | None = None,
+    change_seq_from: int | None = None,
+    sort_by: Literal["created_at", "change_seq"] | None = None,
 ):
     if not user and not settings.PUBLIC_MODE:
         raise HTTPException(status_code=401, detail="Not authenticated")
 
     user_id = user["sub"] if user else None
 
+    # Default behavior preserved: sort_by=None → "-created_at"
+    if sort_by == "change_seq":
+        order_by = "change_seq"  # ASC (ascending for checkpoint-based polling)
+    elif sort_by == "created_at":
+        order_by = "-created_at"  # DESC (newest first, same as current default)
+    else:
+        order_by = "-created_at"  # default, backward compatible
+
     return await apaginate(
         get_database(),
         await transcripts_controller.get_all(
@@ -279,7 +290,8 @@ async def transcripts_list(
             source_kind=SourceKind(source_kind) if source_kind else None,
             room_id=room_id,
             search_term=search_term,
-            order_by="-created_at",
+            order_by=order_by,
+            change_seq_from=change_seq_from,
             return_query=True,
         ),
     )
@@ -512,6 +524,7 @@ async def transcript_get(
         "room_id": transcript.room_id,
         "room_name": room_name,
         "audio_deleted": transcript.audio_deleted,
+        "change_seq": transcript.change_seq,
         "participants": participants,
     }
 

server/reflector/views/transcripts_chat.py

@@ -1,133 +0,0 @@
-"""
-Transcripts chat API
-====================
-
-WebSocket endpoint for bidirectional chat with LLM about transcript content.
-"""
-
-from typing import Optional
-
-from fastapi import APIRouter, WebSocket, WebSocketDisconnect
-from llama_index.core import Settings
-from llama_index.core.base.llms.types import ChatMessage, MessageRole
-
-from reflector.auth.auth_jwt import JWTAuth
-from reflector.db.recordings import recordings_controller
-from reflector.db.transcripts import transcripts_controller
-from reflector.db.users import user_controller
-from reflector.llm import LLM
-from reflector.settings import settings
-from reflector.utils.transcript_formats import topics_to_webvtt_named
-
-router = APIRouter()
-
-
-async def _get_is_multitrack(transcript) -> bool:
-    """Detect if transcript is from multitrack recording."""
-    if not transcript.recording_id:
-        return False
-    recording = await recordings_controller.get_by_id(transcript.recording_id)
-    return recording is not None and recording.is_multitrack
-
-
-@router.websocket("/transcripts/{transcript_id}/chat")
-async def transcript_chat_websocket(
-    transcript_id: str,
-    websocket: WebSocket,
-):
-    """WebSocket endpoint for chatting with LLM about transcript content."""
-    # 1. Auth check (optional) - extract token from WebSocket subprotocol header
-    # Browser can't send Authorization header for WS; use subprotocol: ["bearer", token]
-    raw_subprotocol = websocket.headers.get("sec-websocket-protocol") or ""
-    parts = [p.strip() for p in raw_subprotocol.split(",") if p.strip()]
-    token: Optional[str] = None
-    negotiated_subprotocol: Optional[str] = None
-    if len(parts) >= 2 and parts[0].lower() == "bearer":
-        negotiated_subprotocol = "bearer"
-        token = parts[1]
-
-    user_id: Optional[str] = None
-    if token:
-        try:
-            payload = JWTAuth().verify_token(token)
-            authentik_uid = payload.get("sub")
-
-            if authentik_uid:
-                user = await user_controller.get_by_authentik_uid(authentik_uid)
-                if user:
-                    user_id = user.id
-        except Exception:
-            # Auth failed - continue as anonymous
-            pass
-
-    # Get transcript (respects user_id for private transcripts)
-    transcript = await transcripts_controller.get_by_id_for_http(
-        transcript_id, user_id=user_id
-    )
-    if not transcript:
-        await websocket.close(code=1008)  # Policy violation (not found/unauthorized)
-        return
-
-    # 2. Accept connection (with negotiated subprotocol if present)
-    await websocket.accept(subprotocol=negotiated_subprotocol)
-
-    # 3. Generate WebVTT context
-    is_multitrack = await _get_is_multitrack(transcript)
-    webvtt = topics_to_webvtt_named(
-        transcript.topics, transcript.participants, is_multitrack
-    )
-
-    # Truncate if needed (15k char limit for POC)
-    webvtt_truncated = webvtt[:15000] if len(webvtt) > 15000 else webvtt
-
-    # 4. Configure LLM
-    llm = LLM(settings=settings, temperature=0.7)
-
-    # 5. System message with transcript context
-    system_msg = f"""You are analyzing this meeting transcript (WebVTT):
-
-{webvtt_truncated}
-
-Answer questions about content, speakers, timeline. Include timestamps when relevant."""
-
-    # 6. Conversation history
-    conversation_history = [ChatMessage(role=MessageRole.SYSTEM, content=system_msg)]
-
-    try:
-        # 7. Message loop
-        while True:
-            data = await websocket.receive_json()
-
-            if data.get("type") == "get_context":
-                # Return WebVTT context (for debugging/testing)
-                await websocket.send_json({"type": "context", "webvtt": webvtt})
-                continue
-
-            if data.get("type") != "message":
-                # Echo unknown types for backward compatibility
-                await websocket.send_json({"type": "echo", "data": data})
-                continue
-
-            # Add user message to history
-            user_msg = ChatMessage(role=MessageRole.USER, content=data.get("text", ""))
-            conversation_history.append(user_msg)
-
-            # Stream LLM response
-            assistant_msg = ""
-            chat_stream = await Settings.llm.astream_chat(conversation_history)
-            async for chunk in chat_stream:
-                token = chunk.delta or ""
-                if token:
-                    await websocket.send_json({"type": "token", "text": token})
-                    assistant_msg += token
-
-            # Save assistant response to history
-            conversation_history.append(
-                ChatMessage(role=MessageRole.ASSISTANT, content=assistant_msg)
-            )
-            await websocket.send_json({"type": "done"})
-
-    except WebSocketDisconnect:
-        pass
-    except Exception as e:
-        await websocket.send_json({"type": "error", "message": str(e)})

server/reflector/views/transcripts_upload.py

@@ -5,7 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, UploadFile
 from pydantic import BaseModel
 
 import reflector.auth as auth
-from reflector.db.transcripts import transcripts_controller
+from reflector.db.transcripts import SourceKind, transcripts_controller
 from reflector.pipelines.main_file_pipeline import task_pipeline_file_process
 
 router = APIRouter()
@@ -88,8 +88,10 @@ async def transcript_record_upload(
     finally:
         container.close()
 
-    # set the status to "uploaded"
-    await transcripts_controller.update(transcript, {"status": "uploaded"})
+    # set the status to "uploaded" and mark as file source
+    await transcripts_controller.update(
+        transcript, {"status": "uploaded", "source_kind": SourceKind.FILE}
+    )
 
     # launch a background task to process the file
     task_pipeline_file_process.delay(transcript_id=transcript_id)

server/reflector/views/transcripts_websocket.py

@@ -4,18 +4,22 @@ Transcripts websocket API
 
 """
 
-from typing import Optional
-
-from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisconnect
+from fastapi import APIRouter, HTTPException, WebSocket, WebSocketDisconnect
 
 import reflector.auth as auth
 from reflector.db.transcripts import transcripts_controller
+from reflector.ws_events import TranscriptWsEvent
 from reflector.ws_manager import get_ws_manager
 
 router = APIRouter()
 
 
-@router.get("/transcripts/{transcript_id}/events")
+@router.get(
+    "/transcripts/{transcript_id}/events",
+    response_model=TranscriptWsEvent,
+    summary="Transcript WebSocket event schema",
+    description="Stub exposing the discriminated union of all transcript-level WS events for OpenAPI type generation. Real events are delivered over the WebSocket at the same path.",
+)
 async def transcript_get_websocket_events(transcript_id: str):
     pass
 
@@ -24,8 +28,9 @@ async def transcript_get_websocket_events(transcript_id: str):
 async def transcript_events_websocket(
     transcript_id: str,
     websocket: WebSocket,
-    user: Optional[auth.UserInfo] = Depends(auth.current_user_optional),
 ):
+    _, negotiated_subprotocol = auth.parse_ws_bearer_token(websocket)
+    user = await auth.current_user_ws_optional(websocket)
     user_id = user["sub"] if user else None
     transcript = await transcripts_controller.get_by_id_for_http(
         transcript_id, user_id=user_id
@@ -37,7 +42,9 @@ async def transcript_events_websocket(
     # use ts:transcript_id as room id
     room_id = f"ts:{transcript_id}"
     ws_manager = get_ws_manager()
-    await ws_manager.add_user_to_room(room_id, websocket)
+    await ws_manager.add_user_to_room(
+        room_id, websocket, subprotocol=negotiated_subprotocol
+    )
 
     try:
         # on first connection, send all events only to the current user

server/reflector/views/user_websocket.py

@@ -1,13 +1,25 @@
 from typing import Optional
 
-from fastapi import APIRouter, WebSocket
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 
 from reflector.auth.auth_jwt import JWTAuth  # type: ignore
 from reflector.db.users import user_controller
+from reflector.ws_events import UserWsEvent
 from reflector.ws_manager import get_ws_manager
 
 router = APIRouter()
 
+
+@router.get(
+    "/events",
+    response_model=UserWsEvent,
+    summary="User WebSocket event schema",
+    description="Stub exposing the discriminated union of all user-level WS events for OpenAPI type generation. Real events are delivered over the WebSocket at the same path.",
+)
+async def user_get_websocket_events():
+    pass
+
+
 # Close code for unauthorized WebSocket connections
 UNAUTHORISED = 4401
 
@@ -60,6 +72,8 @@ async def user_events_websocket(websocket: WebSocket):
     try:
         while True:
             await websocket.receive()
+    except (RuntimeError, WebSocketDisconnect):
+        pass
     finally:
         if room_id:
             await ws_manager.remove_user_from_room(room_id, websocket)

server/reflector/webrtc_ports.py

@@ -0,0 +1,111 @@
+"""
+Monkey-patch aioice to use a fixed UDP port range for ICE candidates,
+and optionally rewrite SDP to advertise a different host IP.
+
+This allows running the server in Docker with bridge networking
+(no network_mode: host) by:
+  1. Restricting ICE UDP ports to a known range that can be mapped in Docker
+  2. Replacing container-internal IPs with the Docker host IP in SDP answers
+"""
+
+import asyncio
+import socket
+
+from reflector.logger import logger
+
+
+def parse_port_range(range_str: str) -> tuple[int, int]:
+    """Parse a 'min-max' string into (min_port, max_port)."""
+    parts = range_str.split("-")
+    if len(parts) != 2:
+        raise ValueError(f"WEBRTC_PORT_RANGE must be 'min-max', got: {range_str!r}")
+    min_port, max_port = int(parts[0]), int(parts[1])
+    if not (1024 <= min_port <= max_port <= 65535):
+        raise ValueError(
+            f"Invalid port range: {min_port}-{max_port} "
+            "(must be 1024-65535 with min <= max)"
+        )
+    return min_port, max_port
+
+
+def patch_aioice_port_range(min_port: int, max_port: int) -> None:
+    """
+    Monkey-patch aioice so that ICE candidate UDP sockets bind to ports
+    within [min_port, max_port] instead of OS-assigned ephemeral ports.
+
+    Works by temporarily wrapping loop.create_datagram_endpoint() during
+    aioice's get_component_candidates() to intercept bind(addr, 0) calls.
+    """
+    import aioice.ice as _ice
+
+    _original = _ice.Connection.get_component_candidates
+    _state = {"next_port": min_port}
+
+    async def _patched_get_component_candidates(self, component, addresses, timeout=5):
+        loop = asyncio.get_event_loop()
+        _orig_create = loop.create_datagram_endpoint
+
+        async def _create_with_port_range(*args, **kwargs):
+            local_addr = kwargs.get("local_addr")
+            if local_addr and local_addr[1] == 0:
+                addr = local_addr[0]
+                # Try each port in the range (wrapping around)
+                attempts = max_port - min_port + 1
+                for _ in range(attempts):
+                    port = _state["next_port"]
+                    _state["next_port"] = (
+                        min_port
+                        if _state["next_port"] >= max_port
+                        else _state["next_port"] + 1
+                    )
+                    try:
+                        kwargs["local_addr"] = (addr, port)
+                        return await _orig_create(*args, **kwargs)
+                    except OSError:
+                        continue
+                # All ports exhausted, fall back to OS assignment
+                logger.warning(
+                    "All WebRTC ports in range exhausted, falling back to OS",
+                    min_port=min_port,
+                    max_port=max_port,
+                )
+                kwargs["local_addr"] = (addr, 0)
+            return await _orig_create(*args, **kwargs)
+
+        loop.create_datagram_endpoint = _create_with_port_range
+        try:
+            return await _original(self, component, addresses, timeout)
+        finally:
+            loop.create_datagram_endpoint = _orig_create
+
+    _ice.Connection.get_component_candidates = _patched_get_component_candidates
+    logger.info(
+        "aioice patched for WebRTC port range",
+        min_port=min_port,
+        max_port=max_port,
+    )
+
+
+def resolve_webrtc_host(host: str) -> str:
+    """Resolve a hostname or IP to an IP address for ICE candidate rewriting."""
+    try:
+        ip = socket.gethostbyname(host)
+        logger.info("Resolved WEBRTC_HOST", host=host, ip=ip)
+        return ip
+    except socket.gaierror:
+        logger.warning("Could not resolve WEBRTC_HOST, using as-is", host=host)
+        return host
+
+
+def rewrite_sdp_host(sdp: str, target_ip: str) -> str:
+    """
+    Replace container-internal IPs in SDP with target_ip so that
+    ICE candidates advertise a routable address.
+    """
+    import aioice.ice
+
+    container_ips = aioice.ice.get_host_addresses(use_ipv4=True, use_ipv6=False)
+    for ip in container_ips:
+        if ip != "127.0.0.1" and ip != target_ip:
+            sdp = sdp.replace(ip, target_ip)
+    return sdp

server/reflector/worker/app.py

@@ -6,6 +6,11 @@ from celery.schedules import crontab
 from reflector.settings import settings
 
 logger = structlog.get_logger(__name__)
+
+# Polling intervals (seconds)
+# Webhook-aware: 180s when webhook configured (backup mode), 15s when no webhook (primary discovery)
+POLL_DAILY_RECORDINGS_INTERVAL_SEC = 180.0 if settings.DAILY_WEBHOOK_SECRET else 15.0
+
 if celery.current_app.main != "default":
     logger.info(f"Celery already configured ({celery.current_app})")
     app = celery.current_app
@@ -44,7 +49,7 @@ else:
         },
         "poll_daily_recordings": {
             "task": "reflector.worker.process.poll_daily_recordings",
-            "schedule": 180.0,  # Every 3 minutes (configurable lookback window)
+            "schedule": POLL_DAILY_RECORDINGS_INTERVAL_SEC,
         },
         "trigger_daily_reconciliation": {
             "task": "reflector.worker.process.trigger_daily_reconciliation",

server/reflector/worker/process.py

@@ -2,7 +2,7 @@ import json
 import os
 import re
 from datetime import datetime, timezone
-from typing import List
+from typing import List, Literal
 from urllib.parse import unquote
 
 import av
@@ -27,9 +27,6 @@ from reflector.db.transcripts import (
 from reflector.hatchet.client import HatchetClientManager
 from reflector.pipelines.main_file_pipeline import task_pipeline_file_process
 from reflector.pipelines.main_live_pipeline import asynctask
-from reflector.pipelines.main_multitrack_pipeline import (
-    task_pipeline_multitrack_process,
-)
 from reflector.pipelines.topic_processing import EmptyPipeline
 from reflector.processors import AudioFileWriterProcessor
 from reflector.processors.audio_waveform_processor import AudioWaveformProcessor
@@ -42,6 +39,7 @@ from reflector.utils.daily import (
     filter_cam_audio_tracks,
     recording_lock_key,
 )
+from reflector.utils.string import NonEmptyString
 from reflector.video_platforms.factory import create_platform_client
 from reflector.video_platforms.whereby_utils import (
     parse_whereby_recording_filename,
@@ -175,13 +173,18 @@ async def process_multitrack_recording(
     daily_room_name: DailyRoomName,
     recording_id: str,
     track_keys: list[str],
+    recording_start_ts: int,
 ):
+    """
+    Process raw-tracks (multitrack) recording from Daily.co.
+    """
     logger.info(
         "Processing multitrack recording",
         bucket=bucket_name,
         room_name=daily_room_name,
         recording_id=recording_id,
         provided_keys=len(track_keys),
+        recording_start_ts=recording_start_ts,
     )
 
     if not track_keys:
@@ -212,7 +215,7 @@ async def process_multitrack_recording(
         )
 
         await _process_multitrack_recording_inner(
-            bucket_name, daily_room_name, recording_id, track_keys
+            bucket_name, daily_room_name, recording_id, track_keys, recording_start_ts
         )
 
 
@@ -221,8 +224,18 @@ async def _process_multitrack_recording_inner(
     daily_room_name: DailyRoomName,
     recording_id: str,
     track_keys: list[str],
+    recording_start_ts: int,
 ):
-    """Inner function containing the actual processing logic."""
+    """
+    Process multitrack recording (first time or reprocessing).
+
+    For first processing (webhook/polling):
+    - Uses recording_start_ts for time-based meeting matching (no instanceId available)
+
+    For reprocessing:
+    - Uses recording.meeting_id directly (already linked during first processing)
+    - recording_start_ts is ignored
+    """
 
     tz = timezone.utc
     recorded_at = datetime.now(tz)
@@ -240,7 +253,53 @@ async def _process_multitrack_recording_inner(
             exc_info=True,
         )
 
-    meeting = await meetings_controller.get_by_room_name(daily_room_name)
+    # Check if recording already exists (reprocessing path)
+    recording = await recordings_controller.get_by_id(recording_id)
+
+    if recording and recording.meeting_id:
+        # Reprocessing: recording exists with meeting already linked
+        meeting = await meetings_controller.get_by_id(recording.meeting_id)
+        if not meeting:
+            logger.error(
+                "Reprocessing: meeting not found for recording - skipping",
+                meeting_id=recording.meeting_id,
+                recording_id=recording_id,
+            )
+            return
+
+        logger.info(
+            "Reprocessing: using existing recording.meeting_id",
+            recording_id=recording_id,
+            meeting_id=meeting.id,
+            room_name=daily_room_name,
+        )
+    else:
+        # First processing: recording doesn't exist, need time-based matching
+        # (Daily.co doesn't return instanceId in API, must match by timestamp)
+        recording_start = datetime.fromtimestamp(recording_start_ts, tz=timezone.utc)
+        meeting = await meetings_controller.get_by_room_name_and_time(
+            room_name=daily_room_name,
+            recording_start=recording_start,
+            time_window_hours=168,  # 1 week
+        )
+        if not meeting:
+            logger.error(
+                "Raw-tracks: no meeting found within 1-week window (time-based match) - skipping",
+                recording_id=recording_id,
+                room_name=daily_room_name,
+                recording_start_ts=recording_start_ts,
+                recording_start=recording_start.isoformat(),
+            )
+            return  # Skip processing, will retry on next poll
+        logger.info(
+            "First processing: found meeting via time-based matching",
+            meeting_id=meeting.id,
+            room_name=daily_room_name,
+            recording_id=recording_id,
+            time_delta_seconds=abs(
+                (meeting.start_date - recording_start).total_seconds()
+            ),
+        )
 
     room_name_base = extract_base_room_name(daily_room_name)
 
@@ -248,18 +307,8 @@ async def _process_multitrack_recording_inner(
     if not room:
         raise Exception(f"Room not found: {room_name_base}")
 
-    if not meeting:
-        raise Exception(f"Meeting not found: {room_name_base}")
-
-    logger.info(
-        "Found existing Meeting for recording",
-        meeting_id=meeting.id,
-        room_name=daily_room_name,
-        recording_id=recording_id,
-    )
-
-    recording = await recordings_controller.get_by_id(recording_id)
     if not recording:
+        # Create recording (only happens during first processing)
         object_key_dir = os.path.dirname(track_keys[0]) if track_keys else ""
         recording = await recordings_controller.create(
             Recording(
@@ -271,7 +320,19 @@ async def _process_multitrack_recording_inner(
                 track_keys=track_keys,
             )
         )
-    # else: Recording already exists; metadata set at creation time
+    elif not recording.meeting_id:
+        # Recording exists but meeting_id is null (failed first processing)
+        # Update with meeting from time-based matching
+        await recordings_controller.set_meeting_id(
+            recording_id=recording.id,
+            meeting_id=meeting.id,
+        )
+        recording.meeting_id = meeting.id
+        logger.info(
+            "Updated existing recording with meeting_id",
+            recording_id=recording.id,
+            meeting_id=meeting.id,
+        )
 
     transcript = await transcripts_controller.get_by_recording_id(recording.id)
     if not transcript:
@@ -287,48 +348,29 @@ async def _process_multitrack_recording_inner(
             room_id=room.id,
         )
 
-    use_hatchet = settings.HATCHET_ENABLED and room and room.use_hatchet
-
-    if room and room.use_hatchet and not settings.HATCHET_ENABLED:
-        logger.info(
-            "Room forces Hatchet workflow",
-            room_id=room.id,
-            transcript_id=transcript.id,
-        )
-
-    if use_hatchet:
-        workflow_id = await HatchetClientManager.start_workflow(
-            workflow_name="DiarizationPipeline",
-            input_data={
-                "recording_id": recording_id,
-                "tracks": [{"s3_key": k} for k in filter_cam_audio_tracks(track_keys)],
-                "bucket_name": bucket_name,
-                "transcript_id": transcript.id,
-                "room_id": room.id,
-            },
-            additional_metadata={
-                "transcript_id": transcript.id,
-                "recording_id": recording_id,
-                "daily_recording_id": recording_id,
-            },
-        )
-        logger.info(
-            "Started Hatchet workflow",
-            workflow_id=workflow_id,
-            transcript_id=transcript.id,
-        )
-
-        await transcripts_controller.update(
-            transcript, {"workflow_run_id": workflow_id}
-        )
-        return
-
-    # Celery pipeline (runs when durable workflows disabled)
-    task_pipeline_multitrack_process.delay(
-        transcript_id=transcript.id,
-        bucket_name=bucket_name,
-        track_keys=filter_cam_audio_tracks(track_keys),
+    # Multitrack processing always uses Hatchet (no Celery fallback)
+    workflow_id = await HatchetClientManager.start_workflow(
+        workflow_name="DiarizationPipeline",
+        input_data={
+            "recording_id": recording_id,
+            "tracks": [{"s3_key": k} for k in filter_cam_audio_tracks(track_keys)],
+            "bucket_name": bucket_name,
+            "transcript_id": transcript.id,
+            "room_id": room.id,
+        },
+        additional_metadata={
+            "transcript_id": transcript.id,
+            "recording_id": recording_id,
+            "daily_recording_id": recording_id,
+        },
     )
+    logger.info(
+        "Started Hatchet workflow",
+        workflow_id=workflow_id,
+        transcript_id=transcript.id,
+    )
+
+    await transcripts_controller.update(transcript, {"workflow_run_id": workflow_id})
 
 
 @shared_task
@@ -337,9 +379,11 @@ async def poll_daily_recordings():
     """Poll Daily.co API for recordings and process missing ones.
 
     Fetches latest recordings from Daily.co API (default limit 100), compares with DB,
-    and queues processing for recordings not already in DB.
+    and stores/queues missing recordings:
+    - Cloud recordings: Store S3 key in meeting table
+    - Raw-tracks recordings: Queue multitrack processing
 
-    For each missing recording, uses audio tracks from API response.
+    Acts as fallback when webhooks active, primary discovery when webhooks unavailable.
 
     Worker-level locking provides idempotency (see process_multitrack_recording).
     """
@@ -380,51 +424,222 @@ async def poll_daily_recordings():
         )
         return
 
-    recording_ids = [rec.id for rec in finished_recordings]
+    # Separate cloud and raw-tracks recordings
+    cloud_recordings = []
+    raw_tracks_recordings = []
+    for rec in finished_recordings:
+        if rec.type:
+            # Daily.co API returns null type - make sure this assumption stays
+            # If this logs, Daily.co API changed - we can remove inference logic.
+            recording_type = rec.type
+            logger.warning(
+                "Recording has explicit type field from Daily.co API (unexpected, API may have changed)",
+                recording_id=rec.id,
+                room_name=rec.room_name,
+                recording_type=recording_type,
+                has_s3key=bool(rec.s3key),
+                tracks_count=len(rec.tracks),
+            )
+        else:
+            # DAILY.CO API LIMITATION:
+            # GET /recordings response does NOT include type field.
+            # Daily.co docs mention type field exists, but API never returns it.
+            # Verified: 84 recordings from Nov 2025 - Jan 2026 ALL have type=None.
+            #
+            # This is not a recent API change - Daily.co has never returned type.
+            # Must infer from structural properties.
+            #
+            # Inference heuristic (reliable for finished recordings):
+            # - Has tracks array → raw-tracks
+            # - Has s3key but no tracks → cloud
+            # - Neither → failed/incomplete recording
+            if len(rec.tracks) > 0:
+                recording_type = "raw-tracks"
+            elif rec.s3key and len(rec.tracks) == 0:
+                recording_type = "cloud"
+            else:
+                logger.warning(
+                    "Recording has no type, no s3key, and no tracks - likely failed recording",
+                    recording_id=rec.id,
+                    room_name=rec.room_name,
+                    status=rec.status,
+                    duration=rec.duration,
+                    mtg_session_id=rec.mtgSessionId,
+                )
+                continue
+
+        if recording_type == "cloud":
+            cloud_recordings.append(rec)
+        else:
+            raw_tracks_recordings.append(rec)
+
+    logger.debug(
+        "Poll results",
+        total=len(finished_recordings),
+        cloud=len(cloud_recordings),
+        raw_tracks=len(raw_tracks_recordings),
+    )
+
+    # Process cloud recordings
+    await _poll_cloud_recordings(cloud_recordings)
+
+    # Process raw-tracks recordings
+    await _poll_raw_tracks_recordings(raw_tracks_recordings, bucket_name)
+
+
+async def store_cloud_recording(
+    recording_id: NonEmptyString,
+    room_name: NonEmptyString,
+    s3_key: NonEmptyString,
+    duration: int,
+    start_ts: int,
+    source: Literal["webhook", "polling"],
+) -> bool:
+    """
+    Store cloud recording reference in meeting table.
+
+    Common function for both webhook and polling code paths.
+    Uses time-based matching to handle duplicate room_name values.
+
+    Args:
+        recording_id: Daily.co recording ID
+        room_name: Daily.co room name
+        s3_key: S3 key where recording is stored
+        duration: Recording duration in seconds
+        start_ts: Unix timestamp when recording started
+        source: "webhook" or "polling" (for logging)
+
+    Returns:
+        True if stored, False if skipped/failed
+    """
+    recording_start = datetime.fromtimestamp(start_ts, tz=timezone.utc)
+
+    meeting = await meetings_controller.get_by_room_name_and_time(
+        room_name=room_name,
+        recording_start=recording_start,
+        time_window_hours=168,  # 1 week
+    )
+
+    if not meeting:
+        logger.warning(
+            f"Cloud recording ({source}): no meeting found within 1-week window",
+            recording_id=recording_id,
+            room_name=room_name,
+            recording_start_ts=start_ts,
+            recording_start=recording_start.isoformat(),
+        )
+        return False
+
+    success = await meetings_controller.set_cloud_recording_if_missing(
+        meeting_id=meeting.id,
+        s3_key=s3_key,
+        duration=duration,
+    )
+
+    if not success:
+        logger.debug(
+            f"Cloud recording ({source}): already set (race lost)",
+            recording_id=recording_id,
+            room_name=room_name,
+            meeting_id=meeting.id,
+        )
+        return False
+
+    logger.info(
+        f"Cloud recording stored via {source} (time-based match)",
+        meeting_id=meeting.id,
+        recording_id=recording_id,
+        s3_key=s3_key,
+        duration=duration,
+        time_delta_seconds=abs((meeting.start_date - recording_start).total_seconds()),
+    )
+    return True
+
+
+async def _poll_cloud_recordings(cloud_recordings: List[FinishedRecordingResponse]):
+    """
+    Store cloud recordings missing from meeting table via polling.
+
+    Uses time-based matching via store_cloud_recording().
+    """
+    if not cloud_recordings:
+        return
+
+    stored_count = 0
+    for recording in cloud_recordings:
+        # Extract S3 key from recording (cloud recordings use s3key field)
+        s3_key = recording.s3key or (recording.s3.key if recording.s3 else None)
+        if not s3_key:
+            logger.warning(
+                "Cloud recording: missing S3 key",
+                recording_id=recording.id,
+                room_name=recording.room_name,
+            )
+            continue
+
+        stored = await store_cloud_recording(
+            recording_id=recording.id,
+            room_name=recording.room_name,
+            s3_key=s3_key,
+            duration=recording.duration,
+            start_ts=recording.start_ts,
+            source="polling",
+        )
+        if stored:
+            stored_count += 1
+
+    logger.info(
+        "Cloud recording polling complete",
+        total=len(cloud_recordings),
+        stored=stored_count,
+    )
+
+
+async def _poll_raw_tracks_recordings(
+    raw_tracks_recordings: List[FinishedRecordingResponse],
+    bucket_name: str,
+):
+    """Queue raw-tracks recordings missing from DB (existing logic)."""
+    if not raw_tracks_recordings:
+        return
+
+    recording_ids = [rec.id for rec in raw_tracks_recordings]
     existing_recordings = await recordings_controller.get_by_ids(recording_ids)
     existing_ids = {rec.id for rec in existing_recordings}
 
     missing_recordings = [
-        rec for rec in finished_recordings if rec.id not in existing_ids
+        rec for rec in raw_tracks_recordings if rec.id not in existing_ids
     ]
 
     if not missing_recordings:
         logger.debug(
-            "All recordings already in DB",
-            api_count=len(finished_recordings),
+            "All raw-tracks recordings already in DB",
+            api_count=len(raw_tracks_recordings),
             existing_count=len(existing_recordings),
         )
         return
 
     logger.info(
-        "Found recordings missing from DB",
+        "Found raw-tracks recordings missing from DB",
         missing_count=len(missing_recordings),
-        total_api_count=len(finished_recordings),
+        total_api_count=len(raw_tracks_recordings),
         existing_count=len(existing_recordings),
     )
 
     for recording in missing_recordings:
         if not recording.tracks:
-            if recording.status == "finished":
-                logger.warning(
-                    "Finished recording has no tracks (no audio captured)",
-                    recording_id=recording.id,
-                    room_name=recording.room_name,
-                )
-            else:
-                logger.debug(
-                    "No tracks in recording yet",
-                    recording_id=recording.id,
-                    room_name=recording.room_name,
-                    status=recording.status,
-                )
+            logger.warning(
+                "Finished raw-tracks recording has no tracks (no audio captured)",
+                recording_id=recording.id,
+                room_name=recording.room_name,
+            )
             continue
 
         track_keys = [t.s3Key for t in recording.tracks if t.type == "audio"]
 
         if not track_keys:
             logger.warning(
-                "No audio tracks found in recording (only video tracks)",
+                "No audio tracks found in raw-tracks recording",
                 recording_id=recording.id,
                 room_name=recording.room_name,
                 total_tracks=len(recording.tracks),
@@ -432,7 +647,7 @@ async def poll_daily_recordings():
             continue
 
         logger.info(
-            "Queueing missing recording for processing",
+            "Queueing missing raw-tracks recording for processing",
             recording_id=recording.id,
             room_name=recording.room_name,
             track_count=len(track_keys),
@@ -443,6 +658,7 @@ async def poll_daily_recordings():
             daily_room_name=recording.room_name,
             recording_id=recording.id,
             track_keys=track_keys,
+            recording_start_ts=recording.start_ts,
         )
 
 
@@ -810,7 +1026,6 @@ async def reprocess_failed_daily_recordings():
                 )
                 continue
 
-            # Fetch room to check use_hatchet flag
             room = None
             if meeting.room_id:
                 room = await rooms_controller.get_by_id(meeting.room_id)
@@ -834,61 +1049,43 @@ async def reprocess_failed_daily_recordings():
                 )
                 continue
 
-            use_hatchet = settings.HATCHET_ENABLED and room and room.use_hatchet
-
-            if use_hatchet:
-                # Hatchet requires a transcript for workflow_run_id tracking
-                if not transcript:
-                    logger.warning(
-                        "No transcript for Hatchet reprocessing, skipping",
-                        recording_id=recording.id,
-                    )
-                    continue
-
-                workflow_id = await HatchetClientManager.start_workflow(
-                    workflow_name="DiarizationPipeline",
-                    input_data={
-                        "recording_id": recording.id,
-                        "tracks": [
-                            {"s3_key": k}
-                            for k in filter_cam_audio_tracks(recording.track_keys)
-                        ],
-                        "bucket_name": bucket_name,
-                        "transcript_id": transcript.id,
-                        "room_id": room.id if room else None,
-                    },
-                    additional_metadata={
-                        "transcript_id": transcript.id,
-                        "recording_id": recording.id,
-                        "reprocess": True,
-                    },
-                )
-                await transcripts_controller.update(
-                    transcript, {"workflow_run_id": workflow_id}
-                )
-
-                logger.info(
-                    "Queued Daily recording for Hatchet reprocessing",
+            # Multitrack reprocessing always uses Hatchet (no Celery fallback)
+            if not transcript:
+                logger.warning(
+                    "No transcript for Hatchet reprocessing, skipping",
                     recording_id=recording.id,
-                    workflow_id=workflow_id,
-                    room_name=meeting.room_name,
-                    track_count=len(recording.track_keys),
-                )
-            else:
-                logger.info(
-                    "Queueing Daily recording for Celery reprocessing",
-                    recording_id=recording.id,
-                    room_name=meeting.room_name,
-                    track_count=len(recording.track_keys),
-                    transcript_status=transcript.status if transcript else None,
                 )
+                continue
 
-                process_multitrack_recording.delay(
-                    bucket_name=bucket_name,
-                    daily_room_name=meeting.room_name,
-                    recording_id=recording.id,
-                    track_keys=recording.track_keys,
-                )
+            workflow_id = await HatchetClientManager.start_workflow(
+                workflow_name="DiarizationPipeline",
+                input_data={
+                    "recording_id": recording.id,
+                    "tracks": [
+                        {"s3_key": k}
+                        for k in filter_cam_audio_tracks(recording.track_keys)
+                    ],
+                    "bucket_name": bucket_name,
+                    "transcript_id": transcript.id,
+                    "room_id": room.id if room else None,
+                },
+                additional_metadata={
+                    "transcript_id": transcript.id,
+                    "recording_id": recording.id,
+                    "reprocess": True,
+                },
+            )
+            await transcripts_controller.update(
+                transcript, {"workflow_run_id": workflow_id}
+            )
+
+            logger.info(
+                "Queued Daily recording for Hatchet reprocessing",
+                recording_id=recording.id,
+                workflow_id=workflow_id,
+                room_name=meeting.room_name,
+                track_count=len(recording.track_keys),
+            )
 
             reprocessed_count += 1
 

server/reflector/ws_events.py

@@ -0,0 +1,188 @@
+"""Typed WebSocket event models.
+
+Defines Pydantic models with Literal discriminators for all WS events.
+Exposed via stub GET endpoints so ``pnpm openapi`` generates TS discriminated unions.
+"""
+
+from typing import Annotated, Literal, Union
+
+from pydantic import BaseModel, Discriminator
+
+from reflector.db.transcripts import (
+    TranscriptActionItems,
+    TranscriptDuration,
+    TranscriptFinalLongSummary,
+    TranscriptFinalShortSummary,
+    TranscriptFinalTitle,
+    TranscriptStatus,
+    TranscriptText,
+    TranscriptWaveform,
+)
+from reflector.utils.string import NonEmptyString
+from reflector.views.transcripts import GetTranscriptTopic
+
+# ---------------------------------------------------------------------------
+# Transcript-level event name literal
+# ---------------------------------------------------------------------------
+
+TranscriptEventName = Literal[
+    "TRANSCRIPT",
+    "TOPIC",
+    "STATUS",
+    "FINAL_TITLE",
+    "FINAL_LONG_SUMMARY",
+    "FINAL_SHORT_SUMMARY",
+    "ACTION_ITEMS",
+    "DURATION",
+    "WAVEFORM",
+]
+
+# ---------------------------------------------------------------------------
+# Transcript-level WS event wrappers
+# ---------------------------------------------------------------------------
+
+
+class TranscriptWsTranscript(BaseModel):
+    event: Literal["TRANSCRIPT"] = "TRANSCRIPT"
+    data: TranscriptText
+
+
+class TranscriptWsTopic(BaseModel):
+    event: Literal["TOPIC"] = "TOPIC"
+    data: GetTranscriptTopic
+
+
+class TranscriptWsStatusData(BaseModel):
+    value: TranscriptStatus
+
+
+class TranscriptWsStatus(BaseModel):
+    event: Literal["STATUS"] = "STATUS"
+    data: TranscriptWsStatusData
+
+
+class TranscriptWsFinalTitle(BaseModel):
+    event: Literal["FINAL_TITLE"] = "FINAL_TITLE"
+    data: TranscriptFinalTitle
+
+
+class TranscriptWsFinalLongSummary(BaseModel):
+    event: Literal["FINAL_LONG_SUMMARY"] = "FINAL_LONG_SUMMARY"
+    data: TranscriptFinalLongSummary
+
+
+class TranscriptWsFinalShortSummary(BaseModel):
+    event: Literal["FINAL_SHORT_SUMMARY"] = "FINAL_SHORT_SUMMARY"
+    data: TranscriptFinalShortSummary
+
+
+class TranscriptWsActionItems(BaseModel):
+    event: Literal["ACTION_ITEMS"] = "ACTION_ITEMS"
+    data: TranscriptActionItems
+
+
+class TranscriptWsDuration(BaseModel):
+    event: Literal["DURATION"] = "DURATION"
+    data: TranscriptDuration
+
+
+class TranscriptWsWaveform(BaseModel):
+    event: Literal["WAVEFORM"] = "WAVEFORM"
+    data: TranscriptWaveform
+
+
+TranscriptWsEvent = Annotated[
+    Union[
+        TranscriptWsTranscript,
+        TranscriptWsTopic,
+        TranscriptWsStatus,
+        TranscriptWsFinalTitle,
+        TranscriptWsFinalLongSummary,
+        TranscriptWsFinalShortSummary,
+        TranscriptWsActionItems,
+        TranscriptWsDuration,
+        TranscriptWsWaveform,
+    ],
+    Discriminator("event"),
+]
+
+# ---------------------------------------------------------------------------
+# User-level event name literal
+# ---------------------------------------------------------------------------
+
+UserEventName = Literal[
+    "TRANSCRIPT_CREATED",
+    "TRANSCRIPT_DELETED",
+    "TRANSCRIPT_STATUS",
+    "TRANSCRIPT_FINAL_TITLE",
+    "TRANSCRIPT_DURATION",
+]
+
+# ---------------------------------------------------------------------------
+# User-level WS event data models
+# ---------------------------------------------------------------------------
+
+
+class UserTranscriptCreatedData(BaseModel):
+    id: NonEmptyString
+
+
+class UserTranscriptDeletedData(BaseModel):
+    id: NonEmptyString
+
+
+class UserTranscriptStatusData(BaseModel):
+    id: NonEmptyString
+    value: TranscriptStatus
+
+
+class UserTranscriptFinalTitleData(BaseModel):
+    id: NonEmptyString
+    title: NonEmptyString
+
+
+class UserTranscriptDurationData(BaseModel):
+    id: NonEmptyString
+    duration: float
+
+
+# ---------------------------------------------------------------------------
+# User-level WS event wrappers
+# ---------------------------------------------------------------------------
+
+
+class UserWsTranscriptCreated(BaseModel):
+    event: Literal["TRANSCRIPT_CREATED"] = "TRANSCRIPT_CREATED"
+    data: UserTranscriptCreatedData
+
+
+class UserWsTranscriptDeleted(BaseModel):
+    event: Literal["TRANSCRIPT_DELETED"] = "TRANSCRIPT_DELETED"
+    data: UserTranscriptDeletedData
+
+
+class UserWsTranscriptStatus(BaseModel):
+    event: Literal["TRANSCRIPT_STATUS"] = "TRANSCRIPT_STATUS"
+    data: UserTranscriptStatusData
+
+
+class UserWsTranscriptFinalTitle(BaseModel):
+    event: Literal["TRANSCRIPT_FINAL_TITLE"] = "TRANSCRIPT_FINAL_TITLE"
+    data: UserTranscriptFinalTitleData
+
+
+class UserWsTranscriptDuration(BaseModel):
+    event: Literal["TRANSCRIPT_DURATION"] = "TRANSCRIPT_DURATION"
+    data: UserTranscriptDurationData
+
+
+UserWsEvent = Annotated[
+    Union[
+        UserWsTranscriptCreated,
+        UserWsTranscriptDeleted,
+        UserWsTranscriptStatus,
+        UserWsTranscriptFinalTitle,
+        UserWsTranscriptDuration,
+    ],
+    Discriminator("event"),
+]

server/reflector/ws_manager.py

@@ -11,7 +11,6 @@ broadcast messages to all connected websockets.
 
 import asyncio
 import json
-import threading
 
 import redis.asyncio as redis
 from fastapi import WebSocket
@@ -49,7 +48,15 @@ class RedisPubSubManager:
         if not self.redis_connection:
             await self.connect()
         message = json.dumps(message)
-        await self.redis_connection.publish(room_id, message)
+        try:
+            await self.redis_connection.publish(room_id, message)
+        except RuntimeError:
+            # Celery workers run each task in a new event loop (asyncio.run),
+            # which closes the previous loop. Cached Redis connection is dead.
+            # Reconnect on the current loop and retry.
+            self.redis_connection = None
+            await self.connect()
+            await self.redis_connection.publish(room_id, message)
 
     async def subscribe(self, room_id: str) -> redis.Redis:
         await self.pubsub.subscribe(room_id)
@@ -98,6 +105,7 @@ class WebsocketManager:
 
     async def _pubsub_data_reader(self, pubsub_subscriber):
         while True:
+            # timeout=1.0 prevents tight CPU loop when no messages available
             message = await pubsub_subscriber.get_message(
                 ignore_subscribe_messages=True
             )
@@ -109,29 +117,38 @@ class WebsocketManager:
                     await socket.send_json(data)
 
 
+# Process-global singleton to ensure only one WebsocketManager instance exists.
+# Multiple instances would cause resource leaks and CPU issues.
+_ws_manager: WebsocketManager | None = None
+
+
 def get_ws_manager() -> WebsocketManager:
     """
-    Returns the WebsocketManager instance for managing websockets.
+    Returns the global WebsocketManager singleton.
 
-    This function initializes and returns the WebsocketManager instance,
-    which is responsible for managing websockets and handling websocket
-    connections.
+    Creates instance on first call, subsequent calls return cached instance.
+    Thread-safe via GIL. Concurrent initialization may create duplicate
+    instances but last write wins (acceptable for this use case).
 
     Returns:
-        WebsocketManager: The initialized WebsocketManager instance.
-
-    Raises:
-        ImportError: If the 'reflector.settings' module cannot be imported.
-        RedisConnectionError: If there is an error connecting to the Redis server.
+        WebsocketManager: The global WebsocketManager instance.
     """
-    local = threading.local()
-    if hasattr(local, "ws_manager"):
-        return local.ws_manager
+    global _ws_manager
 
+    if _ws_manager is not None:
+        return _ws_manager
+
+    # No lock needed - GIL makes this safe enough
+    # Worst case: race creates two instances, last assignment wins
     pubsub_client = RedisPubSubManager(
         host=settings.REDIS_HOST,
         port=settings.REDIS_PORT,
     )
-    ws_manager = WebsocketManager(pubsub_client=pubsub_client)
-    local.ws_manager = ws_manager
-    return ws_manager
+    _ws_manager = WebsocketManager(pubsub_client=pubsub_client)
+    return _ws_manager
+
+
+def reset_ws_manager() -> None:
+    """Reset singleton for testing. DO NOT use in production."""
+    global _ws_manager
+    _ws_manager = None

server/runserver.sh

@@ -7,8 +7,10 @@ elif [ "${ENTRYPOINT}" = "worker" ]; then
     uv run celery -A reflector.worker.app worker --loglevel=info
 elif [ "${ENTRYPOINT}" = "beat" ]; then
     uv run celery -A reflector.worker.app beat --loglevel=info
-elif [ "${ENTRYPOINT}" = "hatchet-worker" ]; then
-    uv run python -m reflector.hatchet.run_workers
+elif [ "${ENTRYPOINT}" = "hatchet-worker-cpu" ]; then
+    uv run python -m reflector.hatchet.run_workers_cpu
+elif [ "${ENTRYPOINT}" = "hatchet-worker-llm" ]; then
+    uv run python -m reflector.hatchet.run_workers_llm
 else
     echo "Unknown command"
 fi

server/scripts/recreate_daily_webhook.py

@@ -15,8 +15,7 @@ from reflector.settings import settings
 
 async def setup_webhook(webhook_url: str):
     """
-    Create or update Daily.co webhook for this environment using dailyco_api module.
-    Uses DAILY_WEBHOOK_UUID to identify existing webhook.
+    Create Daily.co webhook. Deletes any existing webhooks first, then creates the new one.
     """
     if not settings.DAILY_API_KEY:
         print("Error: DAILY_API_KEY not set")
@@ -35,79 +34,37 @@ async def setup_webhook(webhook_url: str):
     ]
 
     async with DailyApiClient(api_key=settings.DAILY_API_KEY) as client:
-        webhook_uuid = settings.DAILY_WEBHOOK_UUID
+        webhooks = await client.list_webhooks()
+        for wh in webhooks:
+            await client.delete_webhook(wh.uuid)
+            print(f"Deleted webhook {wh.uuid}")
 
-        if webhook_uuid:
-            print(f"Updating existing webhook {webhook_uuid}...")
-            try:
-                # Note: Daily.co doesn't support PATCH well, so we delete + recreate
-                await client.delete_webhook(webhook_uuid)
-                print(f"Deleted old webhook {webhook_uuid}")
+        request = CreateWebhookRequest(
+            url=webhook_url,
+            eventTypes=event_types,
+            hmac=settings.DAILY_WEBHOOK_SECRET,
+        )
+        result = await client.create_webhook(request)
+        webhook_uuid = result.uuid
 
-                request = CreateWebhookRequest(
-                    url=webhook_url,
-                    eventTypes=event_types,
-                    hmac=settings.DAILY_WEBHOOK_SECRET,
-                )
-                result = await client.create_webhook(request)
+        print(f"✓ Created webhook {webhook_uuid} (state: {result.state})")
+        print(f"  URL: {result.url}")
 
-                print(
-                    f"✓ Created replacement webhook {result.uuid} (state: {result.state})"
-                )
-                print(f"  URL: {result.url}")
+        env_file = Path(__file__).parent.parent / ".env"
+        if env_file.exists():
+            lines = env_file.read_text().splitlines()
+            updated = False
+            for i, line in enumerate(lines):
+                if line.startswith("DAILY_WEBHOOK_UUID="):
+                    lines[i] = f"DAILY_WEBHOOK_UUID={webhook_uuid}"
+                    updated = True
+                    break
+            if not updated:
+                lines.append(f"DAILY_WEBHOOK_UUID={webhook_uuid}")
+            env_file.write_text("\n".join(lines) + "\n")
+            print("✓ Saved DAILY_WEBHOOK_UUID to .env")
 
-                webhook_uuid = result.uuid
-
-            except Exception as e:
-                if hasattr(e, "response") and e.response.status_code == 404:
-                    print(f"Webhook {webhook_uuid} not found, creating new one...")
-                    webhook_uuid = None  # Fall through to creation
-                else:
-                    print(f"Error updating webhook: {e}")
-                    return 1
-
-        if not webhook_uuid:
-            print("Creating new webhook...")
-            request = CreateWebhookRequest(
-                url=webhook_url,
-                eventTypes=event_types,
-                hmac=settings.DAILY_WEBHOOK_SECRET,
-            )
-            result = await client.create_webhook(request)
-            webhook_uuid = result.uuid
-
-            print(f"✓ Created webhook {webhook_uuid} (state: {result.state})")
-            print(f"  URL: {result.url}")
-            print()
-            print("=" * 60)
-            print("IMPORTANT: Add this to your environment variables:")
-            print("=" * 60)
-            print(f"DAILY_WEBHOOK_UUID: {webhook_uuid}")
-            print("=" * 60)
-            print()
-
-            # Try to write UUID to .env file
-            env_file = Path(__file__).parent.parent / ".env"
-            if env_file.exists():
-                lines = env_file.read_text().splitlines()
-                updated = False
-
-                # Update existing DAILY_WEBHOOK_UUID line or add it
-                for i, line in enumerate(lines):
-                    if line.startswith("DAILY_WEBHOOK_UUID="):
-                        lines[i] = f"DAILY_WEBHOOK_UUID={webhook_uuid}"
-                        updated = True
-                        break
-
-                if not updated:
-                    lines.append(f"DAILY_WEBHOOK_UUID={webhook_uuid}")
-
-                env_file.write_text("\n".join(lines) + "\n")
-                print(f"✓ Also saved to local .env file")
-            else:
-                print(f"⚠ Local .env file not found - please add manually")
-
-            return 0
+        return 0
 
 
 if __name__ == "__main__":
@@ -117,11 +74,7 @@ if __name__ == "__main__":
             "Example: python recreate_daily_webhook.py https://example.com/v1/daily/webhook"
         )
         print()
-        print("Behavior:")
-        print("  - If DAILY_WEBHOOK_UUID set: Deletes old webhook, creates new one")
-        print(
-            "  - If DAILY_WEBHOOK_UUID empty: Creates new webhook, saves UUID to .env"
-        )
+        print("Deletes all existing webhooks, then creates a new one.")
         sys.exit(1)
 
     sys.exit(asyncio.run(setup_webhook(sys.argv[1])))

server/tests/conftest.py

@@ -1,11 +1,10 @@
 import os
 from contextlib import asynccontextmanager
-from tempfile import NamedTemporaryFile
 from unittest.mock import patch
 
 import pytest
 
-from reflector.schemas.platform import WHEREBY_PLATFORM
+from reflector.schemas.platform import DAILY_PLATFORM, WHEREBY_PLATFORM
 
 
 @pytest.fixture(scope="session", autouse=True)
@@ -15,6 +14,7 @@ def register_mock_platform():
     from reflector.video_platforms.registry import register_platform
 
     register_platform(WHEREBY_PLATFORM, MockPlatformClient)
+    register_platform(DAILY_PLATFORM, MockPlatformClient)
     yield
 
 
@@ -333,11 +333,14 @@ def celery_enable_logging():
 
 @pytest.fixture(scope="session")
 def celery_config():
-    with NamedTemporaryFile() as f:
-        yield {
-            "broker_url": "memory://",
-            "result_backend": f"db+sqlite:///{f.name}",
-        }
+    redis_host = os.environ.get("REDIS_HOST", "localhost")
+    redis_port = os.environ.get("REDIS_PORT", "6379")
+    # Use db 2 to avoid conflicts with main app
+    redis_url = f"redis://{redis_host}:{redis_port}/2"
+    yield {
+        "broker_url": redis_url,
+        "result_backend": redis_url,
+    }
 
 
 @pytest.fixture(scope="session")
@@ -370,9 +373,12 @@ async def ws_manager_in_memory(monkeypatch):
         def __init__(self, queue: asyncio.Queue):
             self.queue = queue
 
-        async def get_message(self, ignore_subscribe_messages: bool = True):
+        async def get_message(
+            self, ignore_subscribe_messages: bool = True, timeout: float | None = None
+        ):
+            wait_timeout = timeout if timeout is not None else 0.05
             try:
-                return await asyncio.wait_for(self.queue.get(), timeout=0.05)
+                return await asyncio.wait_for(self.queue.get(), timeout=wait_timeout)
             except Exception:
                 return None
 

server/tests/test_dailyco_instance_id.py

@@ -0,0 +1,147 @@
+"""
+Tests for Daily.co instanceId generation.
+
+Verifies deterministic behavior and frontend/backend consistency.
+"""
+
+import pytest
+
+from reflector.dailyco_api.instance_id import (
+    RAW_TRACKS_NAMESPACE,
+    generate_cloud_instance_id,
+    generate_raw_tracks_instance_id,
+)
+
+
+class TestInstanceIdDeterminism:
+    """Test deterministic generation of instanceIds."""
+
+    def test_cloud_instance_id_is_meeting_id(self):
+        """Cloud instanceId is meeting ID directly (implicitly tests determinism)."""
+        meeting_id = "550e8400-e29b-41d4-a716-446655440000"
+        result1 = generate_cloud_instance_id(meeting_id)
+        result2 = generate_cloud_instance_id(meeting_id)
+        assert str(result1) == meeting_id
+        assert result1 == result2
+
+    def test_raw_tracks_instance_id_deterministic(self):
+        """Raw-tracks instanceId generation is deterministic."""
+        meeting_id = "550e8400-e29b-41d4-a716-446655440000"
+        result1 = generate_raw_tracks_instance_id(meeting_id)
+        result2 = generate_raw_tracks_instance_id(meeting_id)
+        assert result1 == result2
+
+    def test_raw_tracks_different_from_cloud(self):
+        """Raw-tracks instanceId differs from cloud instanceId."""
+        meeting_id = "550e8400-e29b-41d4-a716-446655440000"
+        cloud_id = generate_cloud_instance_id(meeting_id)
+        raw_tracks_id = generate_raw_tracks_instance_id(meeting_id)
+        assert cloud_id != raw_tracks_id
+
+    def test_different_meetings_different_instance_ids(self):
+        """Different meetings generate different instanceIds."""
+        meeting_id1 = "550e8400-e29b-41d4-a716-446655440000"
+        meeting_id2 = "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+
+        cloud1 = generate_cloud_instance_id(meeting_id1)
+        cloud2 = generate_cloud_instance_id(meeting_id2)
+        assert cloud1 != cloud2
+
+        raw1 = generate_raw_tracks_instance_id(meeting_id1)
+        raw2 = generate_raw_tracks_instance_id(meeting_id2)
+        assert raw1 != raw2
+
+
+class TestFrontendBackendConsistency:
+    """Test that backend matches frontend logic."""
+
+    def test_namespace_matches_frontend(self):
+        """Namespace UUID matches frontend RAW_TRACKS_NAMESPACE constant."""
+        # From www/app/[roomName]/components/DailyRoom.tsx
+        frontend_namespace = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+        assert str(RAW_TRACKS_NAMESPACE) == frontend_namespace
+
+    def test_raw_tracks_generation_matches_frontend_logic(self):
+        """Backend UUIDv5 generation matches frontend uuidv5() call."""
+        # Example meeting ID
+        meeting_id = "550e8400-e29b-41d4-a716-446655440000"
+
+        # Backend result
+        backend_result = generate_raw_tracks_instance_id(meeting_id)
+
+        # Expected result from frontend: uuidv5(meeting.id, RAW_TRACKS_NAMESPACE)
+        # Python uuid5 uses (namespace, name) argument order
+        # JavaScript uuid.v5(name, namespace) - same args, different order
+        # Frontend: uuidv5(meeting.id, "a1b2c3d4-e5f6-7890-abcd-ef1234567890")
+        # Backend: uuid5(UUID("a1b2c3d4-e5f6-7890-abcd-ef1234567890"), meeting.id)
+
+        # Verify it's a valid UUID (will raise if not)
+        assert len(str(backend_result)) == 36
+        assert backend_result.version == 5
+
+
+class TestEdgeCases:
+    """Test edge cases and error conditions."""
+
+    def test_invalid_uuid_format_raises(self):
+        """Invalid UUID format raises ValueError."""
+        with pytest.raises(ValueError):
+            generate_cloud_instance_id("not-a-uuid")
+
+    def test_lowercase_uuid_normalized_for_cloud(self):
+        """Cloud instanceId: lowercase/uppercase UUIDs produce same result."""
+        meeting_id_lower = "550e8400-e29b-41d4-a716-446655440000"
+        meeting_id_upper = "550E8400-E29B-41D4-A716-446655440000"
+
+        cloud_lower = generate_cloud_instance_id(meeting_id_lower)
+        cloud_upper = generate_cloud_instance_id(meeting_id_upper)
+        assert cloud_lower == cloud_upper
+
+    def test_uuid5_is_case_sensitive_warning(self):
+        """
+        Documents uuid5 case sensitivity - different case UUIDs produce different hashes.
+
+        Not a problem: meeting.id always lowercase from DB and API.
+        Frontend generates raw-tracks instanceId from lowercase meeting.id.
+        Backend receives lowercase meeting_id when matching.
+
+        This test documents the behavior, not a requirement.
+        """
+        meeting_id_lower = "550e8400-e29b-41d4-a716-446655440000"
+        meeting_id_upper = "550E8400-E29B-41D4-A716-446655440000"
+
+        raw_lower = generate_raw_tracks_instance_id(meeting_id_lower)
+        raw_upper = generate_raw_tracks_instance_id(meeting_id_upper)
+        assert raw_lower != raw_upper
+
+
+class TestMtgSessionIdVsInstanceId:
+    """
+    Documents that Daily.co's mtgSessionId differs from our instanceId.
+
+    Why this matters: We investigated using mtgSessionId for matching but discovered
+    it's Daily.co-generated and unrelated to instanceId we send. This test documents
+    that finding so we don't investigate it again.
+
+    Production data from 2026-01-13:
+    - Meeting ID:            4ad503b6-8189-4910-a8f7-68cdd1b7f990
+    - Cloud instanceId:      4ad503b6-8189-4910-a8f7-68cdd1b7f990 (same as meeting ID)
+    - Raw-tracks instanceId: 784b3af3-c7dd-57f0-ac54-2ee91c6927cb (UUIDv5 derived)
+    - Recording mtgSessionId: f25a2e09-740f-4932-9c0d-b1bebaa669c6 (different!)
+
+    Conclusion: Cannot use mtgSessionId for recording-to-meeting matching.
+    """
+
+    def test_mtg_session_id_differs_from_our_instance_ids(self):
+        """mtgSessionId (Daily.co) != instanceId (ours) for both cloud and raw-tracks."""
+        meeting_id = "4ad503b6-8189-4910-a8f7-68cdd1b7f990"
+        expected_raw_tracks_id = "784b3af3-c7dd-57f0-ac54-2ee91c6927cb"
+        mtg_session_id = "f25a2e09-740f-4932-9c0d-b1bebaa669c6"
+
+        cloud_instance_id = generate_cloud_instance_id(meeting_id)
+        raw_tracks_instance_id = generate_raw_tracks_instance_id(meeting_id)
+
+        assert str(cloud_instance_id) == meeting_id
+        assert str(raw_tracks_instance_id) == expected_raw_tracks_id
+        assert str(cloud_instance_id) != mtg_session_id
+        assert str(raw_tracks_instance_id) != mtg_session_id

server/tests/test_hatchet_dispatch.py

@@ -2,10 +2,9 @@
 Tests for Hatchet workflow dispatch and routing logic.
 
 These tests verify:
-1. Routing to Hatchet when HATCHET_ENABLED=True
-2. Replay logic for failed workflows
-3. Force flag to cancel and restart
-4. Validation prevents concurrent workflows
+1. Hatchet workflow validation and replay logic
+2. Force flag to cancel and restart workflows
+3. Validation prevents concurrent workflows
 """
 
 from unittest.mock import AsyncMock, patch
@@ -34,25 +33,22 @@ async def test_hatchet_validation_blocks_running_workflow():
         workflow_run_id="running-workflow-123",
     )
 
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = True
+    with patch(
+        "reflector.services.transcript_process.HatchetClientManager"
+    ) as mock_hatchet:
+        mock_hatchet.get_workflow_run_status = AsyncMock(
+            return_value=V1TaskStatus.RUNNING
+        )
 
         with patch(
-            "reflector.services.transcript_process.HatchetClientManager"
-        ) as mock_hatchet:
-            mock_hatchet.get_workflow_run_status = AsyncMock(
-                return_value=V1TaskStatus.RUNNING
-            )
+            "reflector.services.transcript_process.task_is_scheduled_or_active"
+        ) as mock_celery_check:
+            mock_celery_check.return_value = False
 
-            with patch(
-                "reflector.services.transcript_process.task_is_scheduled_or_active"
-            ) as mock_celery_check:
-                mock_celery_check.return_value = False
+            result = await validate_transcript_for_processing(mock_transcript)
 
-                result = await validate_transcript_for_processing(mock_transcript)
-
-            assert isinstance(result, ValidationAlreadyScheduled)
-            assert "running" in result.detail.lower()
+        assert isinstance(result, ValidationAlreadyScheduled)
+        assert "running" in result.detail.lower()
 
 
 @pytest.mark.usefixtures("setup_database")
@@ -72,24 +68,21 @@ async def test_hatchet_validation_blocks_queued_workflow():
         workflow_run_id="queued-workflow-123",
     )
 
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = True
+    with patch(
+        "reflector.services.transcript_process.HatchetClientManager"
+    ) as mock_hatchet:
+        mock_hatchet.get_workflow_run_status = AsyncMock(
+            return_value=V1TaskStatus.QUEUED
+        )
 
         with patch(
-            "reflector.services.transcript_process.HatchetClientManager"
-        ) as mock_hatchet:
-            mock_hatchet.get_workflow_run_status = AsyncMock(
-                return_value=V1TaskStatus.QUEUED
-            )
+            "reflector.services.transcript_process.task_is_scheduled_or_active"
+        ) as mock_celery_check:
+            mock_celery_check.return_value = False
 
-            with patch(
-                "reflector.services.transcript_process.task_is_scheduled_or_active"
-            ) as mock_celery_check:
-                mock_celery_check.return_value = False
+            result = await validate_transcript_for_processing(mock_transcript)
 
-                result = await validate_transcript_for_processing(mock_transcript)
-
-            assert isinstance(result, ValidationAlreadyScheduled)
+        assert isinstance(result, ValidationAlreadyScheduled)
 
 
 @pytest.mark.usefixtures("setup_database")
@@ -110,25 +103,22 @@ async def test_hatchet_validation_allows_failed_workflow():
         recording_id="test-recording-id",
     )
 
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = True
+    with patch(
+        "reflector.services.transcript_process.HatchetClientManager"
+    ) as mock_hatchet:
+        mock_hatchet.get_workflow_run_status = AsyncMock(
+            return_value=V1TaskStatus.FAILED
+        )
 
         with patch(
-            "reflector.services.transcript_process.HatchetClientManager"
-        ) as mock_hatchet:
-            mock_hatchet.get_workflow_run_status = AsyncMock(
-                return_value=V1TaskStatus.FAILED
-            )
+            "reflector.services.transcript_process.task_is_scheduled_or_active"
+        ) as mock_celery_check:
+            mock_celery_check.return_value = False
 
-            with patch(
-                "reflector.services.transcript_process.task_is_scheduled_or_active"
-            ) as mock_celery_check:
-                mock_celery_check.return_value = False
+            result = await validate_transcript_for_processing(mock_transcript)
 
-                result = await validate_transcript_for_processing(mock_transcript)
-
-            assert isinstance(result, ValidationOk)
-            assert result.transcript_id == "test-transcript-id"
+        assert isinstance(result, ValidationOk)
+        assert result.transcript_id == "test-transcript-id"
 
 
 @pytest.mark.usefixtures("setup_database")
@@ -149,24 +139,21 @@ async def test_hatchet_validation_allows_completed_workflow():
         recording_id="test-recording-id",
     )
 
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = True
+    with patch(
+        "reflector.services.transcript_process.HatchetClientManager"
+    ) as mock_hatchet:
+        mock_hatchet.get_workflow_run_status = AsyncMock(
+            return_value=V1TaskStatus.COMPLETED
+        )
 
         with patch(
-            "reflector.services.transcript_process.HatchetClientManager"
-        ) as mock_hatchet:
-            mock_hatchet.get_workflow_run_status = AsyncMock(
-                return_value=V1TaskStatus.COMPLETED
-            )
+            "reflector.services.transcript_process.task_is_scheduled_or_active"
+        ) as mock_celery_check:
+            mock_celery_check.return_value = False
 
-            with patch(
-                "reflector.services.transcript_process.task_is_scheduled_or_active"
-            ) as mock_celery_check:
-                mock_celery_check.return_value = False
+            result = await validate_transcript_for_processing(mock_transcript)
 
-                result = await validate_transcript_for_processing(mock_transcript)
-
-            assert isinstance(result, ValidationOk)
+        assert isinstance(result, ValidationOk)
 
 
 @pytest.mark.usefixtures("setup_database")
@@ -187,26 +174,23 @@ async def test_hatchet_validation_allows_when_status_check_fails():
         recording_id="test-recording-id",
     )
 
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = True
+    with patch(
+        "reflector.services.transcript_process.HatchetClientManager"
+    ) as mock_hatchet:
+        # Status check fails (workflow might be deleted)
+        mock_hatchet.get_workflow_run_status = AsyncMock(
+            side_effect=ApiException("Workflow not found")
+        )
 
         with patch(
-            "reflector.services.transcript_process.HatchetClientManager"
-        ) as mock_hatchet:
-            # Status check fails (workflow might be deleted)
-            mock_hatchet.get_workflow_run_status = AsyncMock(
-                side_effect=ApiException("Workflow not found")
-            )
+            "reflector.services.transcript_process.task_is_scheduled_or_active"
+        ) as mock_celery_check:
+            mock_celery_check.return_value = False
 
-            with patch(
-                "reflector.services.transcript_process.task_is_scheduled_or_active"
-            ) as mock_celery_check:
-                mock_celery_check.return_value = False
+            result = await validate_transcript_for_processing(mock_transcript)
 
-                result = await validate_transcript_for_processing(mock_transcript)
-
-            # Should allow processing when we can't get status
-            assert isinstance(result, ValidationOk)
+        # Should allow processing when we can't get status
+        assert isinstance(result, ValidationOk)
 
 
 @pytest.mark.usefixtures("setup_database")
@@ -227,47 +211,11 @@ async def test_hatchet_validation_skipped_when_no_workflow_id():
         recording_id="test-recording-id",
     )
 
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = True
-
-        with patch(
-            "reflector.services.transcript_process.HatchetClientManager"
-        ) as mock_hatchet:
-            # Should not be called
-            mock_hatchet.get_workflow_run_status = AsyncMock()
-
-            with patch(
-                "reflector.services.transcript_process.task_is_scheduled_or_active"
-            ) as mock_celery_check:
-                mock_celery_check.return_value = False
-
-                result = await validate_transcript_for_processing(mock_transcript)
-
-            # Should not check Hatchet status
-            mock_hatchet.get_workflow_run_status.assert_not_called()
-            assert isinstance(result, ValidationOk)
-
-
-@pytest.mark.usefixtures("setup_database")
-@pytest.mark.asyncio
-async def test_hatchet_validation_skipped_when_disabled():
-    """Test that Hatchet validation is skipped when HATCHET_ENABLED is False."""
-    from reflector.services.transcript_process import (
-        ValidationOk,
-        validate_transcript_for_processing,
-    )
-
-    mock_transcript = Transcript(
-        id="test-transcript-id",
-        name="Test",
-        status="uploaded",
-        source_kind="room",
-        workflow_run_id="some-workflow-123",
-        recording_id="test-recording-id",
-    )
-
-    with patch("reflector.services.transcript_process.settings") as mock_settings:
-        mock_settings.HATCHET_ENABLED = False  # Hatchet disabled
+    with patch(
+        "reflector.services.transcript_process.HatchetClientManager"
+    ) as mock_hatchet:
+        # Should not be called
+        mock_hatchet.get_workflow_run_status = AsyncMock()
 
         with patch(
             "reflector.services.transcript_process.task_is_scheduled_or_active"
@@ -276,7 +224,8 @@ async def test_hatchet_validation_skipped_when_disabled():
 
             result = await validate_transcript_for_processing(mock_transcript)
 
-        # Should not check Hatchet at all
+        # Should not check Hatchet status
+        mock_hatchet.get_workflow_run_status.assert_not_called()
         assert isinstance(result, ValidationOk)
 
 
@@ -306,7 +255,7 @@ async def test_validation_locked_transcript():
 @pytest.mark.usefixtures("setup_database")
 @pytest.mark.asyncio
 async def test_validation_idle_transcript():
-    """Test that validation rejects idle transcripts (not ready)."""
+    """Test that validation rejects idle transcripts without recording (file upload not ready)."""
     from reflector.services.transcript_process import (
         ValidationNotReady,
         validate_transcript_for_processing,
@@ -325,6 +274,34 @@ async def test_validation_idle_transcript():
     assert "not ready" in result.detail.lower()
 
 
+@pytest.mark.usefixtures("setup_database")
+@pytest.mark.asyncio
+async def test_validation_idle_transcript_with_recording_allowed():
+    """Test that validation allows idle transcripts with recording_id (multitrack ready/retry)."""
+    from reflector.services.transcript_process import (
+        ValidationOk,
+        validate_transcript_for_processing,
+    )
+
+    mock_transcript = Transcript(
+        id="test-transcript-id",
+        name="Test",
+        status="idle",
+        source_kind="room",
+        recording_id="test-recording-id",
+    )
+
+    with patch(
+        "reflector.services.transcript_process.task_is_scheduled_or_active"
+    ) as mock_celery_check:
+        mock_celery_check.return_value = False
+
+        result = await validate_transcript_for_processing(mock_transcript)
+
+    assert isinstance(result, ValidationOk)
+    assert result.recording_id == "test-recording-id"
+
+
 @pytest.mark.usefixtures("setup_database")
 @pytest.mark.asyncio
 async def test_prepare_multitrack_config():

server/tests/test_ics_sync.py

@@ -189,14 +189,17 @@ async def test_ics_sync_service_sync_room_calendar():
         assert events[0].ics_uid == "sync-event-1"
         assert events[0].title == "Sync Test Meeting"
 
-        # Second sync with same content (should be unchanged)
+        # Second sync with same content (calendar unchanged, but sync always runs)
         # Refresh room to get updated etag and force sync by setting old sync time
         room = await rooms_controller.get_by_id(room.id)
         await rooms_controller.update(
             room, {"ics_last_sync": datetime.now(timezone.utc) - timedelta(minutes=10)}
         )
         result = await sync_service.sync_room_calendar(room)
-        assert result["status"] == "unchanged"
+        assert result["status"] == "success"
+        assert result["events_created"] == 0
+        assert result["events_updated"] == 0
+        assert result["events_deleted"] == 0
 
         # Third sync with updated event
         event["summary"] = "Updated Meeting Title"
@@ -288,3 +291,43 @@ async def test_ics_sync_service_error_handling():
         result = await sync_service.sync_room_calendar(room)
         assert result["status"] == "error"
         assert "Network error" in result["error"]
+
+
+@pytest.mark.asyncio
+async def test_event_data_changed_exhaustiveness():
+    """Test that _event_data_changed compares all EventData fields (except ics_uid).
+
+    This test ensures programmers don't forget to update the comparison logic
+    when adding new fields to EventData/CalendarEvent.
+    """
+    from reflector.services.ics_sync import EventData
+
+    sync_service = ICSSyncService()
+
+    from reflector.db.calendar_events import CalendarEvent
+
+    now = datetime.now(timezone.utc)
+    event_data: EventData = {
+        "ics_uid": "test-123",
+        "title": "Test",
+        "description": "Desc",
+        "location": "Loc",
+        "start_time": now,
+        "end_time": now + timedelta(hours=1),
+        "attendees": [],
+        "ics_raw_data": "raw",
+    }
+
+    existing = CalendarEvent(
+        room_id="room1",
+        **event_data,
+    )
+
+    # Will raise RuntimeError if fields are missing from comparison
+    result = sync_service._event_data_changed(existing, event_data)
+    assert result is False
+
+    modified_data = event_data.copy()
+    modified_data["title"] = "Changed Title"
+    result = sync_service._event_data_changed(existing, modified_data)
+    assert result is True

server/tests/test_storage.py

@@ -319,3 +319,51 @@ def test_aws_storage_constructor_rejects_mixed_auth():
             aws_secret_access_key="test-secret",
             aws_role_arn="arn:aws:iam::123456789012:role/test-role",
         )
+
+
+@pytest.mark.asyncio
+async def test_aws_storage_custom_endpoint_url():
+    """Test that custom endpoint_url configures path-style addressing and passes endpoint to client."""
+    storage = AwsStorage(
+        aws_bucket_name="reflector-media",
+        aws_region="garage",
+        aws_access_key_id="GKtest",
+        aws_secret_access_key="secret",
+        aws_endpoint_url="http://garage:3900",
+    )
+    assert storage._endpoint_url == "http://garage:3900"
+    assert storage.boto_config.s3["addressing_style"] == "path"
+    assert storage.base_url == "http://garage:3900/reflector-media/"
+    # retries config preserved (merge, not replace)
+    assert storage.boto_config.retries["max_attempts"] == 3
+
+    mock_client = AsyncMock()
+    mock_client.put_object = AsyncMock()
+    mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+    mock_client.__aexit__ = AsyncMock(return_value=None)
+    mock_client.generate_presigned_url = AsyncMock(
+        return_value="http://garage:3900/reflector-media/test.txt"
+    )
+
+    with patch.object(
+        storage.session, "client", return_value=mock_client
+    ) as mock_session_client:
+        await storage.put_file("test.txt", b"data")
+        mock_session_client.assert_called_with(
+            "s3", config=storage.boto_config, endpoint_url="http://garage:3900"
+        )
+
+
+@pytest.mark.asyncio
+async def test_aws_storage_none_endpoint_url():
+    """Test that None endpoint preserves current AWS behavior."""
+    storage = AwsStorage(
+        aws_bucket_name="reflector-bucket",
+        aws_region="us-east-1",
+        aws_access_key_id="AKIAtest",
+        aws_secret_access_key="secret",
+    )
+    assert storage._endpoint_url is None
+    assert storage.base_url == "https://reflector-bucket.s3.amazonaws.com/"
+    # No s3 addressing_style override — boto_config should only have retries
+    assert not hasattr(storage.boto_config, "s3") or storage.boto_config.s3 is None

server/tests/test_time_based_meeting_matching.py

@@ -0,0 +1,374 @@
+"""
+Integration tests for time-based meeting-to-recording matching.
+
+Tests the critical path for matching Daily.co recordings to meetings when
+API doesn't return instanceId.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from reflector.db.meetings import meetings_controller
+from reflector.db.rooms import rooms_controller
+
+
+@pytest.fixture
+async def test_room():
+    """Create a test room for meetings."""
+    room = await rooms_controller.add(
+        name="test-room-time",
+        user_id="test-user-id",
+        zulip_auto_post=False,
+        zulip_stream="",
+        zulip_topic="",
+        is_locked=False,
+        room_mode="normal",
+        recording_type="cloud",
+        recording_trigger="automatic",
+        is_shared=False,
+        platform="daily",
+    )
+    return room
+
+
+@pytest.fixture
+def base_time():
+    """Fixed timestamp for deterministic tests."""
+    return datetime(2026, 1, 14, 9, 0, 0, tzinfo=timezone.utc)
+
+
+class TestTimeBasedMatching:
+    """Test get_by_room_name_and_time() matching logic."""
+
+    async def test_exact_time_match(self, test_room, base_time):
+        """Recording timestamp exactly matches meeting start_date."""
+        meeting = await meetings_controller.create(
+            id="meeting-exact",
+            room_name="daily-test-20260114090000",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-20260114090000",
+            recording_start=base_time,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == meeting.id
+
+    async def test_recording_slightly_after_meeting_start(self, test_room, base_time):
+        """Recording started 1 minute after meeting (participants joined late)."""
+        meeting = await meetings_controller.create(
+            id="meeting-late",
+            room_name="daily-test-20260114090100",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        recording_start = base_time + timedelta(minutes=1)
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-20260114090100",
+            recording_start=recording_start,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == meeting.id
+
+    async def test_duplicate_room_names_picks_closest(self, test_room, base_time):
+        """
+        Two meetings with same room_name (duplicate/race condition).
+        Should pick closest by timestamp.
+        """
+        meeting1 = await meetings_controller.create(
+            id="meeting-1-first",
+            room_name="daily-duplicate-room",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        meeting2 = await meetings_controller.create(
+            id="meeting-2-second",
+            room_name="daily-duplicate-room",  # Same room_name!
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time + timedelta(seconds=0.99),  # 0.99s later
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        # Recording started 0.5s after meeting1
+        # Distance: meeting1 = 0.5s, meeting2 = 0.49s → meeting2 is closer
+        recording_start = base_time + timedelta(seconds=0.5)
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-duplicate-room",
+            recording_start=recording_start,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == meeting2.id  # meeting2 is closer (0.49s vs 0.5s)
+
+    async def test_outside_time_window_returns_none(self, test_room, base_time):
+        """Recording outside 1-week window returns None."""
+        await meetings_controller.create(
+            id="meeting-old",
+            room_name="daily-test-old",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        # Recording 8 days later (outside 7-day window)
+        recording_start = base_time + timedelta(days=8)
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-old",
+            recording_start=recording_start,
+            time_window_hours=168,
+        )
+
+        assert result is None
+
+    async def test_tie_breaker_deterministic(self, test_room, base_time):
+        """When time delta identical, tie-breaker by meeting.id is deterministic."""
+        meeting_z = await meetings_controller.create(
+            id="zzz-last-uuid",
+            room_name="daily-test-tie",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        meeting_a = await meetings_controller.create(
+            id="aaa-first-uuid",
+            room_name="daily-test-tie",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,  # Exact same start_date
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-tie",
+            recording_start=base_time,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        # Tie-breaker: lexicographically first UUID
+        assert result.id == "aaa-first-uuid"
+
+    async def test_timezone_naive_datetime_raises(self, test_room, base_time):
+        """Timezone-naive datetime raises ValueError."""
+        await meetings_controller.create(
+            id="meeting-tz",
+            room_name="daily-test-tz",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        # Naive datetime (no timezone)
+        naive_dt = datetime(2026, 1, 14, 9, 0, 0)
+
+        with pytest.raises(ValueError, match="timezone-aware"):
+            await meetings_controller.get_by_room_name_and_time(
+                room_name="daily-test-tz",
+                recording_start=naive_dt,
+                time_window_hours=168,
+            )
+
+    async def test_one_week_boundary_after_included(self, test_room, base_time):
+        """Meeting 1-week AFTER recording is included (window_end boundary)."""
+        meeting_time = base_time + timedelta(hours=168)
+
+        await meetings_controller.create(
+            id="meeting-boundary-after",
+            room_name="daily-test-boundary-after",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=meeting_time,
+            end_date=meeting_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-boundary-after",
+            recording_start=base_time,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == "meeting-boundary-after"
+
+    async def test_one_week_boundary_before_included(self, test_room, base_time):
+        """Meeting 1-week BEFORE recording is included (window_start boundary)."""
+        meeting_time = base_time - timedelta(hours=168)
+
+        await meetings_controller.create(
+            id="meeting-boundary-before",
+            room_name="daily-test-boundary-before",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=meeting_time,
+            end_date=meeting_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-boundary-before",
+            recording_start=base_time,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == "meeting-boundary-before"
+
+    async def test_recording_before_meeting_start(self, test_room, base_time):
+        """Recording started before meeting (clock skew or early join)."""
+        await meetings_controller.create(
+            id="meeting-early",
+            room_name="daily-test-early",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        recording_start = base_time - timedelta(minutes=2)
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-early",
+            recording_start=recording_start,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == "meeting-early"
+
+    async def test_mixed_inside_outside_window(self, test_room, base_time):
+        """Multiple meetings, only one inside window - returns the inside one."""
+        await meetings_controller.create(
+            id="meeting-old",
+            room_name="daily-test-mixed",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time - timedelta(days=10),
+            end_date=base_time - timedelta(days=10, hours=-1),
+            room=test_room,
+        )
+
+        await meetings_controller.create(
+            id="meeting-inside",
+            room_name="daily-test-mixed",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time - timedelta(days=2),
+            end_date=base_time - timedelta(days=2, hours=-1),
+            room=test_room,
+        )
+
+        await meetings_controller.create(
+            id="meeting-future",
+            room_name="daily-test-mixed",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time + timedelta(days=10),
+            end_date=base_time + timedelta(days=10, hours=1),
+            room=test_room,
+        )
+
+        result = await meetings_controller.get_by_room_name_and_time(
+            room_name="daily-test-mixed",
+            recording_start=base_time,
+            time_window_hours=168,
+        )
+
+        assert result is not None
+        assert result.id == "meeting-inside"
+
+
+class TestAtomicCloudRecordingUpdate:
+    """Test atomic update prevents race conditions."""
+
+    async def test_first_update_succeeds(self, test_room, base_time):
+        """First call to set_cloud_recording_if_missing succeeds."""
+        meeting = await meetings_controller.create(
+            id="meeting-atomic-1",
+            room_name="daily-test-atomic",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        success = await meetings_controller.set_cloud_recording_if_missing(
+            meeting_id=meeting.id,
+            s3_key="first-s3-key",
+            duration=100,
+        )
+
+        assert success is True
+
+        updated = await meetings_controller.get_by_id(meeting.id)
+        assert updated.daily_composed_video_s3_key == "first-s3-key"
+        assert updated.daily_composed_video_duration == 100
+
+    async def test_second_update_fails_atomically(self, test_room, base_time):
+        """Second call to update same meeting doesn't overwrite (atomic check)."""
+        meeting = await meetings_controller.create(
+            id="meeting-atomic-2",
+            room_name="daily-test-atomic2",
+            room_url="https://example.daily.co/test",
+            host_room_url="https://example.daily.co/test?t=host",
+            start_date=base_time,
+            end_date=base_time + timedelta(hours=1),
+            room=test_room,
+        )
+
+        success1 = await meetings_controller.set_cloud_recording_if_missing(
+            meeting_id=meeting.id,
+            s3_key="first-s3-key",
+            duration=100,
+        )
+
+        assert success1 is True
+
+        after_first = await meetings_controller.get_by_id(meeting.id)
+        assert after_first.daily_composed_video_s3_key == "first-s3-key"
+
+        success2 = await meetings_controller.set_cloud_recording_if_missing(
+            meeting_id=meeting.id,
+            s3_key="bucket/path/should-not-overwrite",
+            duration=200,
+        )
+
+        assert success2 is False
+
+        final = await meetings_controller.get_by_id(meeting.id)
+        assert final.daily_composed_video_s3_key == "first-s3-key"
+        assert final.daily_composed_video_duration == 100

server/tests/test_transcripts_chat.py

@@ -1,234 +0,0 @@
-"""Tests for transcript chat WebSocket endpoint."""
-
-import asyncio
-import threading
-import time
-from pathlib import Path
-
-import pytest
-from httpx_ws import aconnect_ws
-from uvicorn import Config, Server
-
-from reflector.db.transcripts import (
-    SourceKind,
-    TranscriptParticipant,
-    TranscriptTopic,
-    transcripts_controller,
-)
-from reflector.processors.types import Word
-
-
-@pytest.fixture
-def chat_appserver(tmpdir, setup_database):
-    """Start a real HTTP server for WebSocket testing."""
-    from reflector.app import app
-    from reflector.db import get_database
-    from reflector.settings import settings
-
-    DATA_DIR = settings.DATA_DIR
-    settings.DATA_DIR = Path(tmpdir)
-
-    # Start server in separate thread with its own event loop
-    host = "127.0.0.1"
-    port = 1256  # Different port from rtc tests
-    server_started = threading.Event()
-    server_exception = None
-    server_instance = None
-
-    def run_server():
-        nonlocal server_exception, server_instance
-        try:
-            # Create new event loop for this thread
-            loop = asyncio.new_event_loop()
-            asyncio.set_event_loop(loop)
-
-            config = Config(app=app, host=host, port=port, loop=loop)
-            server_instance = Server(config)
-
-            async def start_server():
-                # Initialize database connection in this event loop
-                database = get_database()
-                await database.connect()
-                try:
-                    await server_instance.serve()
-                finally:
-                    await database.disconnect()
-
-            # Signal that server is starting
-            server_started.set()
-            loop.run_until_complete(start_server())
-        except Exception as e:
-            server_exception = e
-            server_started.set()
-        finally:
-            loop.close()
-
-    server_thread = threading.Thread(target=run_server, daemon=True)
-    server_thread.start()
-
-    # Wait for server to start
-    server_started.wait(timeout=30)
-    if server_exception:
-        raise server_exception
-
-    # Wait for server to be fully ready
-    time.sleep(1)
-
-    yield server_instance, host, port
-
-    # Stop server
-    if server_instance:
-        server_instance.should_exit = True
-        server_thread.join(timeout=30)
-
-    settings.DATA_DIR = DATA_DIR
-
-
-@pytest.fixture
-async def test_transcript(setup_database):
-    """Create a test transcript for WebSocket tests."""
-    transcript = await transcripts_controller.add(
-        name="Test Transcript for Chat", source_kind=SourceKind.FILE
-    )
-    return transcript
-
-
-@pytest.fixture
-async def test_transcript_with_content(setup_database):
-    """Create a test transcript with actual content for WebVTT generation."""
-    transcript = await transcripts_controller.add(
-        name="Test Transcript with Content", source_kind=SourceKind.FILE
-    )
-
-    # Add participants
-    await transcripts_controller.update(
-        transcript,
-        {
-            "participants": [
-                TranscriptParticipant(id="1", speaker=0, name="Alice").model_dump(),
-                TranscriptParticipant(id="2", speaker=1, name="Bob").model_dump(),
-            ]
-        },
-    )
-
-    # Add topic with words
-    await transcripts_controller.upsert_topic(
-        transcript,
-        TranscriptTopic(
-            title="Introduction",
-            summary="Opening remarks",
-            timestamp=0.0,
-            words=[
-                Word(text="Hello ", start=0.0, end=1.0, speaker=0),
-                Word(text="everyone.", start=1.0, end=2.0, speaker=0),
-                Word(text="Hi ", start=2.0, end=3.0, speaker=1),
-                Word(text="there!", start=3.0, end=4.0, speaker=1),
-            ],
-        ),
-    )
-
-    return transcript
-
-
-@pytest.mark.asyncio
-async def test_chat_websocket_connection_success(test_transcript, chat_appserver):
-    """Test successful WebSocket connection to chat endpoint."""
-    server, host, port = chat_appserver
-    base_url = f"ws://{host}:{port}/v1"
-
-    async with aconnect_ws(f"{base_url}/transcripts/{test_transcript.id}/chat") as ws:
-        # Send unknown message type to test echo behavior
-        await ws.send_json({"type": "test", "text": "Hello"})
-
-        # Should receive echo for unknown types
-        response = await ws.receive_json()
-        assert response["type"] == "echo"
-        assert response["data"]["type"] == "test"
-
-
-@pytest.mark.asyncio
-async def test_chat_websocket_nonexistent_transcript(chat_appserver):
-    """Test WebSocket connection fails for nonexistent transcript."""
-    server, host, port = chat_appserver
-    base_url = f"ws://{host}:{port}/v1"
-
-    # Connection should fail or disconnect immediately for non-existent transcript
-    # Different behavior from successful connection
-    with pytest.raises(Exception):  # Will raise on connection or first operation
-        async with aconnect_ws(f"{base_url}/transcripts/nonexistent-id/chat") as ws:
-            await ws.send_json({"type": "message", "text": "Hello"})
-            await ws.receive_json()
-
-
-@pytest.mark.asyncio
-async def test_chat_websocket_multiple_messages(test_transcript, chat_appserver):
-    """Test sending multiple messages through WebSocket."""
-    server, host, port = chat_appserver
-    base_url = f"ws://{host}:{port}/v1"
-
-    async with aconnect_ws(f"{base_url}/transcripts/{test_transcript.id}/chat") as ws:
-        # Send multiple unknown message types (testing echo behavior)
-        messages = ["First message", "Second message", "Third message"]
-
-        for i, msg in enumerate(messages):
-            await ws.send_json({"type": f"test{i}", "text": msg})
-            response = await ws.receive_json()
-            assert response["type"] == "echo"
-            assert response["data"]["type"] == f"test{i}"
-            assert response["data"]["text"] == msg
-
-
-@pytest.mark.asyncio
-async def test_chat_websocket_disconnect_graceful(test_transcript, chat_appserver):
-    """Test WebSocket disconnects gracefully."""
-    server, host, port = chat_appserver
-    base_url = f"ws://{host}:{port}/v1"
-
-    async with aconnect_ws(f"{base_url}/transcripts/{test_transcript.id}/chat") as ws:
-        await ws.send_json({"type": "message", "text": "Hello"})
-        await ws.receive_json()
-        # Close handled by context manager - should not raise
-
-
-@pytest.mark.asyncio
-async def test_chat_websocket_context_generation(
-    test_transcript_with_content, chat_appserver
-):
-    """Test WebVTT context is generated on connection."""
-    server, host, port = chat_appserver
-    base_url = f"ws://{host}:{port}/v1"
-
-    async with aconnect_ws(
-        f"{base_url}/transcripts/{test_transcript_with_content.id}/chat"
-    ) as ws:
-        # Request context
-        await ws.send_json({"type": "get_context"})
-
-        # Receive context response
-        response = await ws.receive_json()
-        assert response["type"] == "context"
-        assert "webvtt" in response
-
-        # Verify WebVTT format
-        webvtt = response["webvtt"]
-        assert webvtt.startswith("WEBVTT")
-        assert "<v Alice>" in webvtt
-        assert "<v Bob>" in webvtt
-        assert "Hello everyone." in webvtt
-        assert "Hi there!" in webvtt
-
-
-@pytest.mark.asyncio
-async def test_chat_websocket_unknown_message_type(test_transcript, chat_appserver):
-    """Test unknown message types are echoed back."""
-    server, host, port = chat_appserver
-    base_url = f"ws://{host}:{port}/v1"
-
-    async with aconnect_ws(f"{base_url}/transcripts/{test_transcript.id}/chat") as ws:
-        # Send unknown message type
-        await ws.send_json({"type": "unknown", "data": "test"})
-
-        # Should receive echo
-        response = await ws.receive_json()
-        assert response["type"] == "echo"
-        assert response["data"]["type"] == "unknown"

server/tests/test_transcripts_process.py

@@ -1,6 +1,6 @@
 import asyncio
 import time
-from unittest.mock import patch
+from unittest.mock import AsyncMock, patch
 
 import pytest
 from httpx import ASGITransport, AsyncClient
@@ -142,17 +142,17 @@ async def test_whereby_recording_uses_file_pipeline(client):
             "reflector.services.transcript_process.task_pipeline_file_process"
         ) as mock_file_pipeline,
         patch(
-            "reflector.services.transcript_process.task_pipeline_multitrack_process"
-        ) as mock_multitrack_pipeline,
+            "reflector.services.transcript_process.HatchetClientManager"
+        ) as mock_hatchet,
     ):
         response = await client.post(f"/transcripts/{transcript.id}/process")
 
         assert response.status_code == 200
         assert response.json()["status"] == "ok"
 
-        # Whereby recordings should use file pipeline
+        # Whereby recordings should use file pipeline, not Hatchet
         mock_file_pipeline.delay.assert_called_once_with(transcript_id=transcript.id)
-        mock_multitrack_pipeline.delay.assert_not_called()
+        mock_hatchet.start_workflow.assert_not_called()
 
 
 @pytest.mark.usefixtures("setup_database")
@@ -162,9 +162,22 @@ async def test_dailyco_recording_uses_multitrack_pipeline(client):
     from datetime import datetime, timezone
 
     from reflector.db.recordings import Recording, recordings_controller
+    from reflector.db.rooms import rooms_controller
     from reflector.db.transcripts import transcripts_controller
 
-    # Create transcript with Daily.co multitrack recording
+    room = await rooms_controller.add(
+        name="test-room",
+        user_id="test-user",
+        zulip_auto_post=False,
+        zulip_stream="",
+        zulip_topic="",
+        is_locked=False,
+        room_mode="normal",
+        recording_type="cloud",
+        recording_trigger="automatic-2nd-participant",
+        is_shared=False,
+    )
+
     transcript = await transcripts_controller.add(
         "",
         source_kind="room",
@@ -172,6 +185,7 @@ async def test_dailyco_recording_uses_multitrack_pipeline(client):
         target_language="en",
         user_id="test-user",
         share_mode="public",
+        room_id=room.id,
     )
 
     track_keys = [
@@ -197,18 +211,23 @@ async def test_dailyco_recording_uses_multitrack_pipeline(client):
             "reflector.services.transcript_process.task_pipeline_file_process"
         ) as mock_file_pipeline,
         patch(
-            "reflector.services.transcript_process.task_pipeline_multitrack_process"
-        ) as mock_multitrack_pipeline,
+            "reflector.services.transcript_process.HatchetClientManager"
+        ) as mock_hatchet,
     ):
+        mock_hatchet.start_workflow = AsyncMock(return_value="test-workflow-id")
+
         response = await client.post(f"/transcripts/{transcript.id}/process")
 
         assert response.status_code == 200
         assert response.json()["status"] == "ok"
 
-        # Daily.co multitrack recordings should use multitrack pipeline
-        mock_multitrack_pipeline.delay.assert_called_once_with(
-            transcript_id=transcript.id,
-            bucket_name="daily-bucket",
-            track_keys=track_keys,
-        )
+        # Daily.co multitrack recordings should use Hatchet workflow
+        mock_hatchet.start_workflow.assert_called_once()
+        call_kwargs = mock_hatchet.start_workflow.call_args.kwargs
+        assert call_kwargs["workflow_name"] == "DiarizationPipeline"
+        assert call_kwargs["input_data"]["transcript_id"] == transcript.id
+        assert call_kwargs["input_data"]["bucket_name"] == "daily-bucket"
+        assert call_kwargs["input_data"]["tracks"] == [
+            {"s3_key": k} for k in track_keys
+        ]
         mock_file_pipeline.delay.assert_not_called()