diff --git a/README.md b/README.md
index 661dcd3..28a38c5 100755
--- a/README.md
+++ b/README.md
@@ -32,7 +32,7 @@ Castopod is easy to install and was built on top of CodeIgniter4, a powerful PHP
 - Multi-tenant: host as many podcasts as you want
 - Multi-user: add contributors and set roles
 
-**Shipped version:** 1.1.2~ynh2
+**Shipped version:** 1.6.5~ynh1
 
 **Demo:** https://podcast.podlibre.org/@podlibre_fr
 
diff --git a/README_fr.md b/README_fr.md
index 57f4a77..aa23611 100755
--- a/README_fr.md
+++ b/README_fr.md
@@ -31,7 +31,7 @@ Castopod est une plate-forme d'hébergement gratuite et open source conçue pour
 - Multi-locataire : hébergez autant de podcasts que vous le souhaitez
 - Multi-utilisateur : ajouter des contributeurs et définir des rôles
 
-**Version incluse :** 1.1.2~ynh2
+**Version incluse :** 1.6.5~ynh1
 
 **Démo :** https://podcast.podlibre.org/@podlibre_fr
 
diff --git a/check_process b/check_process
deleted file mode 100755
index cd87891..0000000
--- a/check_process
+++ /dev/null
@@ -1,27 +0,0 @@
-;; Test complet
-	; Manifest
-		domain="domain.tld"
-		path="/path"
-		is_public=1
-		admin="john"
-		password="strongpassword"
-	; Checks
-		pkg_linter=1
-		setup_sub_dir=0
-		setup_root=1
-		setup_nourl=0
-		setup_private=1
-		setup_public=1
-		upgrade=1
-		#1.0.0 alpha.80
-		#upgrade=1	from_commit=074aac0f8caa4597bdc34c0e9355cf898546f0df
-		backup_restore=1
-		multi_instance=1
-		change_url=1
-;;; Options
-Email=
-Notification=none
-;;; Upgrade options
-		; commit=074aac0f8caa4597bdc34c0e9355cf898546f0df
-		name=1.0.0 alpha.80
-		manifest_arg=domain=DOMAIN&path=PATH&admin=USER&language=fr&is_public=1&password=pass&
diff --git a/conf/.env.example b/conf/.env.example
index bf496f9..2ce11f4 100644
--- a/conf/.env.example
+++ b/conf/.env.example
@@ -18,6 +18,9 @@ media.baseURL="https://__DOMAIN__"
 admin.gateway="cp-admin"
 auth.gateway="cp-auth"
 
+media.root="media"
+media.storage="__DATA_DIR__"
+
 #--------------------------------------------------------------------
 # Database configuration
 #--------------------------------------------------------------------
@@ -30,12 +33,13 @@ database.default.DBPrefix="cp_"
 #--------------------------------------------------------------------
 # Email configuration
 #--------------------------------------------------------------------
-# email.fromEmail="your_email_address"
-# email.fromName="Castopod"
-# email.SMTPHost="localhost"
-# email.SMTPPort="25"
-# email.SMTPUser="your_smtp_user"
-# email.SMTPPass="your_smtp_password"
+email.fromEmail="__APP__@__DOMAIN__"
+email.fromName="Castopod"
+email.SMTPHost="localhost"
+email.SMTPPort="25"
+email.SMTPUser="__APP__"
+email.SMTPPass="__MAIL_PWD__"
+email.SMTPCrypto="tls"
 
 #--------------------------------------------------------------------
 # Cache configuration (advanced)
@@ -53,7 +57,19 @@ cache.redis.password=null
 cache.redis.port=6379
 cache.redis.database=__REDIS_DB__
 
+#--------------------------------------------------------------------
+# S3 configuration
+#--------------------------------------------------------------------
+# media.fileManager="s3"
+# media.s3.endpoint="your_s3_host"
+# media.s3.key="your_s3_key"
+# media.s3.secret="your_s3_secret"
+# media.s3.region="your_s3_region"
+
 #--------------------------------------------------------------------
 # REST API configuration
 #--------------------------------------------------------------------
 # restapi.enabled=true
+# restapi.basicAuthUsername=castopod
+# restapi.basicAuthPassword=password
+# restapi.basicAuth=true
\ No newline at end of file
diff --git a/conf/app.src b/conf/app.src
deleted file mode 100755
index b55216a..0000000
--- a/conf/app.src
+++ /dev/null
@@ -1,6 +0,0 @@
-SOURCE_URL=https://code.castopod.org/adaures/castopod/uploads/ab09b21e1e0f3ef02518fc0794d6a3be/castopod-1.1.2.zip
-SOURCE_SUM=1412a4d272826355c039ac045055ce33a0c00d238ac860c7761d8f2555b4241a
-SOURCE_SUM_PRG=sha256sum
-SOURCE_FORMAT=zip
-SOURCE_IN_SUBDIR=true
-SOURCE_EXTRACT=true
diff --git a/conf/cron b/conf/cron
index cd2baf3..8996e3c 100644
--- a/conf/cron
+++ b/conf/cron
@@ -1,4 +1 @@
-* * * * * __APP__ /usr/bin/php__PHPVERSION__ __INSTALL_DIR__/public/index.php scheduled-activities
-* * * * * __APP__ /usr/bin/php__PHPVERSION__ __INSTALL_DIR__/public/index.php scheduled-video-clips
-* * * * * __APP__ /usr/bin/php__PHPVERSION__ __INSTALL_DIR__/public/index.php scheduled-websub-publish
-
+* * * * * __APP__ /usr/bin/php__PHPVERSION__ __INSTALL_DIR__/spark tasks:run >> /dev/null 2>&1
diff --git a/conf/nginx.conf b/conf/nginx.conf
index 950c275..3557942 100755
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -24,3 +24,8 @@ location __PATH__/ {
   # Include SSOWAT user panel.
   include conf.d/yunohost_panel.conf.inc;
 }
+
+location ^~ /media/ {
+  alias __DATA_DIR__/media/;
+  more_set_headers "Access-Control-Allow-Origin: *";
+}
diff --git a/conf/sql/v1.5.2.sql b/conf/sql/v1.5.2.sql
new file mode 100644
index 0000000..024cab9
--- /dev/null
+++ b/conf/sql/v1.5.2.sql
@@ -0,0 +1,14 @@
+-- change Twitter to X
+INSERT IGNORE INTO `cp_platforms` (`slug`, `type`, `label`, `home_url`, `submit_url`) VALUES
+('x', 'social', 'X', 'https://x.com/', 'https://x.com/i/flow/signup');
+
+UPDATE `cp_podcasts_platforms`
+SET `platform_slug` = 'x'
+WHERE `platform_slug` = 'twitter';
+
+DELETE FROM `cp_platforms` WHERE `slug` = 'twitter';
+
+-- add buymeacoffee and kofi as funding platforms
+INSERT IGNORE INTO `cp_platforms` (`slug`, `type`, `label`, `home_url`, `submit_url`) VALUES
+('buymeacoffee', 'funding', 'Buy Me a Coffee', 'https://www.buymeacoffee.com/', 'https://www.buymeacoffee.com/signup'),
+('kofi', 'funding', 'Ko-fi', 'https://ko-fi.com/', 'https://ko-fi.com/account/register');
diff --git a/conf/sql/v1.6.1.sql b/conf/sql/v1.6.1.sql
new file mode 100644
index 0000000..49d797e
--- /dev/null
+++ b/conf/sql/v1.6.1.sql
@@ -0,0 +1,2 @@
+INSERT IGNORE INTO `cp_platforms` (`slug`, `type`, `label`, `home_url`, `submit_url`) VALUES
+('tiktok', 'social', 'Tiktok', 'https://www.tiktok.com/', 'https://www.tiktok.com/signup');
diff --git a/doc/POST_INSTALL.md b/doc/POST_INSTALL.md
index 04f51ca..fab9f60 100644
--- a/doc/POST_INSTALL.md
+++ b/doc/POST_INSTALL.md
@@ -1 +1,2 @@
-After post-installation configuration, go to `__DOMAIN__/cp-admin` to connect to the administration panel.
\ No newline at end of file
+To complete installation: `__DOMAIN__/cp-install`
+To connect to the administration panel: `__DOMAIN__/cp-admin`
diff --git a/doc/POST_INSTALL_fr.md b/doc/POST_INSTALL_fr.md
index 5468339..776e181 100644
--- a/doc/POST_INSTALL_fr.md
+++ b/doc/POST_INSTALL_fr.md
@@ -1 +1,2 @@
-Après la configuration post-installation, accédez à `__DOMAIN__/cp-admin` pour vous connecter au panneau d'administration.
\ No newline at end of file
+Pour finir l'installation: `__DOMAIN__/cp-install`
+Pour vous connecter au panneau d'administration : `__DOMAIN__/cp-admin`
diff --git a/manifest.toml b/manifest.toml
index 0816022..de6c3ef 100644
--- a/manifest.toml
+++ b/manifest.toml
@@ -5,7 +5,7 @@ name = "Castopod"
 description.en = "Hosting platform made for podcasters"
 description.fr = "Plateforme d'hébergement conçue pour les podcasteurs"
 
-version = "1.1.2~ynh2"
+version = "1.6.5~ynh1"
 
 maintainers = ["eric_G"]
 
@@ -17,38 +17,45 @@ admindoc = "https://docs.castopod.org/"
 code = "https://code.castopod.org/adaures/castopod"
 
 [integration]
-yunohost = ">= 11.1.13"
+yunohost = ">= 11.2"
 architectures = "all"
 multi_instance = true
 ldap = false
 sso = false
 disk = "50M"
-ram.build = "100M"
+ram.build = "150M"
 ram.runtime = "50M"
 
 [install]
     [install.domain]
-    help.en = "Castopod needs to be installed in a dedicated domain or sub-domain."
-    help.fr = "Castopod doit être installé dans un domaine ou sous-domaine dédié."
     type = "domain"
-    full_domain = true
 
     [install.init_main_permission]
-    help.en = "If enabled, Castopod will be accessible by people who do not have an account. This can be changed later via the webadmin."
-    help.fr = "Si cette case est cochée, Castopod sera accessible aux personnes n’ayant pas de compte. Vous pourrez changer ceci plus tard via la webadmin."
     type = "group"
     default = "visitors"
 
 [resources]
+
+    [resources.sources]
+
+        [resources.sources.main]
+        url = "https://code.castopod.org/adaures/castopod/uploads/fe7be588c53a9e1ed63af47e6e624ad1/castopod-1.6.5.zip"
+        sha256 = "3618afa82605dda4f791efe5bb312d1fab3c4b0d702086f9cb75e57d627b6306"
+        in_subdir = true
+
     [resources.system_user]
+    allow_email = true
 
     [resources.install_dir]
 
+    [resources.data_dir]
+    subdirs = ["media"]
+
     [resources.permissions]
     main.url = "/"
 
     [resources.apt]
-    packages = "mariadb-server ffmpeg php8.1-fpm php8.1-mysql php8.1-gd php8.1-intl php8.1-curl php8.1-mbstring php8.1-xml php8.1-mysqlnd"
+    packages = "mariadb-server, ffmpeg, php8.2-mysql, php8.2-gd, php8.2-intl, php8.2-curl, php8.2-mbstring, php8.2-xml, php8.2-mysqlnd"
 
     [resources.database]
     type = "mysql"
diff --git a/scripts/backup b/scripts/backup
index 8af0451..3c8d0e4 100755
--- a/scripts/backup
+++ b/scripts/backup
@@ -20,6 +20,12 @@ ynh_print_info --message="Declaring files to be backed up..."
 
 ynh_backup --src_path="$install_dir"
 
+#=================================================
+# BACKUP DATA DIR
+#=================================================
+
+ynh_backup --src_path="$data_dir" --is_big=1
+
 #=================================================
 # BACKUP THE NGINX CONFIGURATION
 #=================================================
diff --git a/scripts/install b/scripts/install
index 58de286..94c4a4c 100755
--- a/scripts/install
+++ b/scripts/install
@@ -48,7 +48,7 @@ ynh_add_fpm_config --usage=$fpm_usage --footprint=$fpm_footprint
 # Create a dedicated NGINX config
 ynh_add_nginx_config
 
-ynh_add_config --template="../conf/cron" --destination="/etc/cron.d/$app"
+ynh_add_config --template="cron" --destination="/etc/cron.d/$app"
 chown root: "/etc/cron.d/$app"
 chmod 644 "/etc/cron.d/$app"
 
@@ -64,10 +64,28 @@ redis_db=$(ynh_redis_get_free_db)
 ynh_app_setting_set --app="$app" --key=redis_db --value="$redis_db"
 
 #redis_number=$(( $YNH_APP_INSTANCE_NUMBER - 1 ))
-ynh_add_config --template="../conf/.env.example" --destination="$install_dir/.env"
+ynh_add_config --template=".env.example" --destination="$install_dir/.env"
+
 chmod 600 $install_dir/.env
 chown $app:www-data "$install_dir/.env"
 
+mkdir -p $data_dir/media
+cp -rf $install_dir/public/media/* $data_dir/media
+chmod -R 750 $data_dir
+chgrp -R www-data $data_dir
+
+ynh_secure_remove --file="$install_dir/public/media" 
+
+#=================================================
+# RUN MIGRATIONS
+#=================================================
+ynh_script_progression --message="Configuring $app database..." --weight=1
+
+pushd $install_dir
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark castopod:database-update
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark db:seed AppSeeder
+popd
+
 #=================================================
 # END OF SCRIPT
 #=================================================
diff --git a/scripts/remove b/scripts/remove
index e101710..5de38ad 100755
--- a/scripts/remove
+++ b/scripts/remove
@@ -9,13 +9,6 @@
 source _common.sh
 source /usr/share/yunohost/helpers
 
-#=================================================
-# LOAD SETTINGS
-#=================================================
-# ynh_script_progression --message="Loading installation settings..." --weight=1
-
-# redis_db=$(ynh_app_setting_get --app=$app --key=redis_db)
-
 #=================================================
 # REMOVE THE REDIS DATABASE
 #=================================================
@@ -29,10 +22,6 @@ ynh_remove_nginx_config
 # Remove the dedicated PHP-FPM config
 ynh_remove_fpm_config
 
-#=================================================
-# REMOVE VARIOUS FILES
-#=================================================
-
 # Remove a cron file
 ynh_secure_remove --file="/etc/cron.d/$app"
 
diff --git a/scripts/upgrade b/scripts/upgrade
index 17e52ec..2fd85bc 100755
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -38,6 +38,24 @@ if [ -z "${fpm_usage:-}" ]; then
     ynh_app_setting_set --app=$app --key=fpm_usage --value=$fpm_usage
 fi
 
+#=================================================
+# MOVE DATA TO __DATA_DIR__
+#=================================================
+
+if ynh_compare_current_package_version --comparison le --version "1.1.2~ynh2"; then
+    ynh_script_progression --message="Moving data..." --weight=3
+    mkdir -p $data_dir/media
+    cp -rf $install_dir/public/media/* $data_dir/media
+    chmod -R 750 $data_dir
+    chgrp -R www-data $data_dir
+
+    ynh_secure_remove --file="$install_dir/public/media"
+
+    ynh_script_progression --message="Fixing migrations..." --weight=1
+    # this will fail is `cp-install` was not run on prev version - just ignore, DB schema is (re)generated later.
+    ynh_mysql_execute_as_root --database=$db_name --sql="UPDATE cp_migrations SET class='Media\\\\Database\\\\Migrations\\\\AddMedia', namespace='Media' where class='App\\\\Database\\\\Migrations\\\\AddMedia'" || true
+fi
+
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
 #=================================================
@@ -46,10 +64,8 @@ if [ "$upgrade_type" == "UPGRADE_APP" ]
 then
 	ynh_script_progression --message="Upgrading source files..." --weight=1
 
-	ynh_secure_remove --file="$install_dir/app"
-	ynh_secure_remove --file="$install_dir/public/assets"
 	# Download, check integrity, uncompress and patch the source from app.src
-	ynh_setup_source --dest_dir="$install_dir" --keep=".env"
+	ynh_setup_source --dest_dir="$install_dir" --full_replace=1
 fi
 
 chmod -R o-rwx "$install_dir"
@@ -63,23 +79,40 @@ chown -R $app:www-data "$install_dir"
 ynh_script_progression --message="Updating a configuration file..." --weight=1
 
 # Create a dedicated PHP-FPM config
-ynh_add_fpm_config --phpversion=$phpversion --usage=$fpm_usage --footprint=$fpm_footprint
+ynh_add_fpm_config --usage=$fpm_usage --footprint=$fpm_footprint
 
 # Create a dedicated NGINX config
 ynh_add_nginx_config
 
-ynh_add_config --template="../conf/cron" --destination="/etc/cron.d/$app"
+ynh_add_config --template="cron" --destination="/etc/cron.d/$app"
 chown root: "/etc/cron.d/$app"
 chmod 644 "/etc/cron.d/$app"
 
 #=================================================
 # CONFIGURE CASTOPOD
 #=================================================
-# ynh_script_progression --message="Configuring Castopod..." --weight=1
+ynh_script_progression --message="Configuring $app..." --weight=1
 
-# ynh_add_config --template="../conf/.env.example" --destination="$install_dir/.env"
-# chmod 600 $install_dir/.env
-# chown $app:www-data "$install_dir/.env"
+ynh_add_config --template=".env.example" --destination="$install_dir/.env"
+chmod 600 $install_dir/.env
+chown $app:www-data "$install_dir/.env"
+
+#=================================================
+# RUN MIGRATIONS
+#=================================================
+ynh_script_progression --message="Configuring $app database..." --weight=1
+
+pushd $install_dir
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark cache:clear
+  ynh_exec_warn_less ynh_exec_as $app php${phpversion} spark castopod:database-update
+popd
+
+if ynh_compare_current_package_version --comparison le --version "1.6.5~ynh1"; then
+    # cf https://code.castopod.org/adaures/castopod/-/releases/v1.5.2
+    ynh_mysql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < "../conf/sql/v1.5.2.sql"
+    # cf https://code.castopod.org/adaures/castopod/-/releases/v1.6.1
+    ynh_mysql_connect_as --user=$db_user --password=$db_pwd --database=$db_name < "../conf/sql/v1.6.1.sql"
+fi
 
 #=================================================
 # END OF SCRIPT
diff --git a/sources/patches/main-001-allow-unsafe-login.patch b/sources/patches/main-001-allow-unsafe-login.patch
new file mode 100644
index 0000000..7574678
--- /dev/null
+++ b/sources/patches/main-001-allow-unsafe-login.patch
@@ -0,0 +1,12 @@
+diff -ruN castopod.old/vendor/codeigniter4/shield/src/Config/Auth.php castopod/vendor/codeigniter4/shield/src/Config/Auth.php
+--- castopod.old/vendor.old/codeigniter4/shield/src/Config/Auth.php	2023-10-31 13:05:34
++++ castopod/vendor/codeigniter4/shield/src/Config/Auth.php	2023-10-31 12:57:04
+@@ -375,7 +375,7 @@
+      *
+      * @deprecated This is only for backward compatibility.
+      */
+-    public bool $supportOldDangerousPassword = false;
++    public bool $supportOldDangerousPassword = true;
+ 
+     /**
+      * ////////////////////////////////////////////////////////////////////