diff --git a/conf/app.src b/conf/app.src
index f68466a..c5eb901 100644
--- a/conf/app.src
+++ b/conf/app.src
@@ -1,5 +1,5 @@
-SOURCE_URL=https://github.com/tulir/mautrix-telegram/archive/v0.9.0.tar.gz
-SOURCE_SUM=e0fb30bf448f1bec6f27f73662c1dcddd36986367dcbe4f34509b23af67142a9
+SOURCE_URL=https://github.com/tulir/mautrix-telegram/archive/refs/tags/v0.10.0-rc1.tar.gz
+SOURCE_SUM=8b1bd2d66d8c5d1f12d34a14f39f4831a0c9fb8e7e82a1de686d88257cda90a6
 SOURCE_SUM_PRG=sha256sum
 SOURCE_FORMAT=tar.gz
 SOURCE_IN_SUBDIR=true
diff --git a/manifest.json b/manifest.json
index ccbc168..6d4e779 100644
--- a/manifest.json
+++ b/manifest.json
@@ -6,7 +6,7 @@
 		"en": "A Telegram puppeting bridge for Matrix/Synapse.",
 		"fr": "Passerelle Telegram pour Matrix/Synapse."
 	},
-	"version": "0.1.1~ynh1",
+	"version": "0.10.0-rc1~ynh1",
 	"url": "https://github.com/tulir/mautrix-telegram",
 	"license": "AGPL-3.0-or-later",
 	"maintainer": {
diff --git a/scripts/_common.sh b/scripts/_common.sh
index de3e43f..02779f9 100644
--- a/scripts/_common.sh
+++ b/scripts/_common.sh
@@ -12,6 +12,33 @@ pkg_dependencies="postgresql python3 zlib1g-dev libjpeg-dev libwebp-dev"
 # PERSONAL HELPERS
 #=================================================
 
+write_bridge_config () {
+	domain="https://$domain"
+	if [ "$botusers" = "local" ]
+	then
+		# ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$server_name --target_file="$mautrix_config_path"
+		botusers="$server_name"
+	# else
+	# ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$botusers --target_file="$mautrix_config_path"
+	fi
+	# ynh_replace_string --match_string=__VERIFY_SERVER_SSL_CERTIFICATES__ --replace_string=true --target_file="$mautrix_config_path"
+	verify_server_ssl_certificates="true"
+	# ynh_replace_string --match_string=__MATRIX_SERVER_SUPPORTS_ASMUX__ --replace_string=false --target_file="$mautrix_config_path"
+	matrix_server_supports_asmux="false"
+	# ynh_replace_string --match_string=__LOG_FILENAME__ --replace_string="/var/log/$app/$app.log" --target_file="$mautrix_config_path"
+	log_filename="/var/log/$app/$app.log"
+	# TODO rename these settings
+	# ynh_replace_string --match_string=__TELEGRAM_API_ID__ --replace_string=$apiid --target_file="$mautrix_config_path"
+	# ynh_replace_string --match_string=__TELEGRAM_API_HASH__ --replace_string=$apihash --target_file="$mautrix_config_path"
+	# ynh_replace_string --match_string=__TELEGRAM_BOT_TOKEN__ --replace_string=$bottoken --target_file="$mautrix_config_path"
+	telegram_api_id="$apiid"
+	telegram_api_hash="$apihash"
+	telegram_bot_token="$bottoken"
+	# ynh_replace_string --match_string=__LOG_LEVEL__ --replace_string="error" --target_file="$mautrix_config_path"
+	log_level="error"
+	ynh_add_config --template="config.yaml" --destination="$mautrix_config_path"
+}
+
 #=================================================
 # EXPERIMENTAL HELPERS
 #=================================================
diff --git a/scripts/install b/scripts/install
index 2f855e7..a70be0b 100755
--- a/scripts/install
+++ b/scripts/install
@@ -186,40 +186,40 @@ ynh_script_progression --message="Configuring Mautrix-Bridge..." --weight=2
 
 mautrix_config_path="$final_path/config.yaml"
 
+# ynh_replace_string --match_string=__AS_TOKEN__ --replace_string="$generated" --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__HS_TOKEN__ --replace_string="$generated" --target_file="$mautrix_config_path"
+as_token="\"This value is generated when generating the registration\""
+hs_token="\"This value is generated when generating the registration\""
+
+write_bridge_config
+
 #Copy example-config.yaml to config.yaml
-cp ../conf/config.yaml "$mautrix_config_path"
-
-
-ynh_replace_string --match_string=__DOMAIN__ --replace_string="https://$domain" --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__SERVER_NAME__ --replace_string=$server_name --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__VERIFY_SERVER_SSL_CERTIFICATES__ --replace_string=true --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__MATRIX_SERVER_SUPPORTS_ASMUX__ --replace_string=false --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__PORT__ --replace_string=$port --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__MAUTRIX_BRIDGE_USER__ --replace_string=$mautrix_bridge_user --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__MAUTRIX_BRIDGE_DB_PWD__ --replace_string=$mautrix_bridge_db_pwd --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__MAUTRIX_BRIDGE_DB_NAME__ --replace_string=$mautrix_bridge_db_name --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__BOTNAME__ --replace_string=$botname --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__ENCRYPTION__ --replace_string=$encryption --target_file="$mautrix_config_path"
-if [ "$botusers" = "local" ]
-then
-ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$server_name --target_file="$mautrix_config_path"
-else
-ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$botusers --target_file="$mautrix_config_path"
-fi
-ynh_replace_string --match_string=__BOTADMIN__ --replace_string=$botadmin --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__LOG_FILENAME__ --replace_string="/var/log/$app/$app.log" --target_file="$mautrix_config_path"
-    # Options: debug, info, warn, error, fatal
-ynh_replace_string --match_string=__LOG_LEVEL__ --replace_string="error" --target_file="$mautrix_config_path"
-
-ynh_replace_string --match_string=__TELEGRAM_API_ID__ --replace_string=$apiid --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__TELEGRAM_API_HASH__ --replace_string=$apihash --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__TELEGRAM_BOT_TOKEN__ --replace_string=$bottoken --target_file="$mautrix_config_path"
-
-generated="\"This value is generated when generating the registration\""
-ynh_replace_string --match_string=__AS_TOKEN__ --replace_string="$generated" --target_file="$mautrix_config_path"
-ynh_replace_string --match_string=__HS_TOKEN__ --replace_string="$generated" --target_file="$mautrix_config_path"
+# cp ../conf/config.yaml "$mautrix_config_path"
+# ynh_replace_string --match_string=__DOMAIN__ --replace_string="$domain" --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__SERVER_NAME__ --replace_string=$server_name --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__VERIFY_SERVER_SSL_CERTIFICATES__ --replace_string=true --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__MATRIX_SERVER_SUPPORTS_ASMUX__ --replace_string=false --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__PORT__ --replace_string=$port --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__MAUTRIX_BRIDGE_USER__ --replace_string=$mautrix_bridge_user --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__MAUTRIX_BRIDGE_DB_PWD__ --replace_string=$mautrix_bridge_db_pwd --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__MAUTRIX_BRIDGE_DB_NAME__ --replace_string=$mautrix_bridge_db_name --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__BOTNAME__ --replace_string=$botname --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__ENCRYPTION__ --replace_string=$encryption --target_file="$mautrix_config_path"
+# if [ "$botusers" = "local" ]
+# then
+# ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$server_name --target_file="$mautrix_config_path"
+# else
+# ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$botusers --target_file="$mautrix_config_path"
+# fi
+# ynh_replace_string --match_string=__BOTADMIN__ --replace_string=$botadmin --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__LOG_FILENAME__ --replace_string="/var/log/$app/$app.log" --target_file="$mautrix_config_path"
+#     # Options: debug, info, warn, error, fatal
+# ynh_replace_string --match_string=__LOG_LEVEL__ --replace_string="error" --target_file="$mautrix_config_path"
 
+# ynh_replace_string --match_string=__TELEGRAM_API_ID__ --replace_string=$apiid --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__TELEGRAM_API_HASH__ --replace_string=$apihash --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__TELEGRAM_BOT_TOKEN__ --replace_string=$bottoken --target_file="$mautrix_config_path"
 
 #=================================================
 # INSTALL MAUTRIX-BRIDGE PYTHON MODULE
@@ -229,7 +229,7 @@ mkdir -p /var/log/$app
 # Configure Mautrix-Bridge
 python3 -m venv $final_path
 $final_path/bin/pip3 install --upgrade setuptools wheel # HACK fixes "error: invalid command 'bdist_wheel'"
-$final_path/bin/pip3 install --upgrade $final_path/src/mautrix-telegram.tar.gz[postgres,speedups,webp_convert,qr_login] # metrics
+$final_path/bin/pip3 install --upgrade $final_path/src/mautrix-telegram.tar.gz[postgres,speedups,qr_login,hq_thumbnails] # metrics
 # -r optional-requirements.txt
 $final_path/bin/python3 -m mautrix_telegram -g -c "$mautrix_config_path" -r "$app_service_registration_path/$app.yaml"
 # initialize the database
@@ -253,8 +253,9 @@ $final_path/bin/alembic  -c "$final_path/alembic.ini" -x config="$mautrix_config
 ### you can make a backup of this file before modifying it again if the admin had modified it.
 
 # Calculate and store the config file checksum into the app settings
-ynh_store_file_checksum --file="$app_service_registration_path/$app.yaml"
 ynh_store_file_checksum --file="$mautrix_config_path"
+ynh_store_file_checksum --file="$app_service_registration_path/$app.yaml"
+ynh_store_file_checksum --file="$final_path/alembic.ini"
 
 #=================================================
 # GENERIC FINALIZATION
@@ -266,9 +267,6 @@ ynh_store_file_checksum --file="$mautrix_config_path"
 ### Then, if write authorization is needed, any access should be given only to directories
 ### that really need such authorization.
 
-# Set permissions to app files
-chown -R root: $final_path
-
 # WARNING : theses command are used in INSTALL, UPGRADE, RESTORE
 # For any update do it in all files
 chown $mautrix_bridge_user:root -R $final_path
@@ -279,6 +277,7 @@ chown $mautrix_bridge_user:root -R $final_path
 ynh_script_progression --message="Configuring log rotation..." --weight=3
 
 # Use logrotate to manage application logfile(s)
+# TODO maybe --specific-user??
 ynh_use_logrotate --logfile "/var/log/$app/$app.log"
 chown $mautrix_bridge_user:root -R /var/log/$app
 
diff --git a/scripts/upgrade b/scripts/upgrade
index fbd6aab..3b170ce 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -16,13 +16,25 @@ ynh_script_progression --message="Loading installation settings..." --time --wei
 
 app=$YNH_APP_INSTANCE_NAME
 
-domain=$(ynh_app_setting_get --app=$app --key=domain)
-path_url=$(ynh_app_setting_get --app=$app --key=path)
-admin=$(ynh_app_setting_get --app=$app --key=admin)
-is_public=$(ynh_app_setting_get --app=$app --key=is_public)
-final_path=$(ynh_app_setting_get --app=$app --key=final_path)
-language=$(ynh_app_setting_get --app=$app --key=language)
-db_name=$(ynh_app_setting_get --app=$app --key=db_name)
+domain=$(ynh_app_setting_ --app=$app --key=domain)
+server_name=$(ynh_app_setting_ --app=$app --key=server_name)
+port=$(ynh_app_setting_ --app=$app --key=port)
+botname=$(ynh_app_setting_ --app=$app --key=botname)
+synapse_instance=$(ynh_app_setting_ --app=$app --key=synapse_instance)
+app_service_registration_path=$(ynh_app_setting_ --app=$app --key=app_service_registration_path)
+encryption=$(ynh_app_setting_ --app=$app --key=encryption)
+mautrix_bridge_db_name=$(ynh_app_setting_ --app=$app --key=mautrix_bridge_db_name)
+botadmin=$(ynh_app_setting_ --app=$app --key=botadmin)
+botusers=$(ynh_app_setting_ --app=$app --key=botusers)
+
+apiid=$(ynh_app_setting_ --app=$app --key=apiid)
+apihash=$(ynh_app_setting_ --app=$app --key=apihash)
+bottoken=$(ynh_app_setting_ --app=$app --key=bottoken)
+
+upstream_version=$(ynh_app_setting_ --app=$app --key=mautrix_version)
+final_path=$(ynh_app_setting_ --app=$app --key=final_path)
+
+
 
 #=================================================
 # CHECK VERSION
@@ -107,15 +119,7 @@ ynh_install_app_dependencies $pkg_dependencies
 ynh_script_progression --message="Making sure dedicated system user exists..." --time --weight=1
 
 # Create a dedicated user (if not existing)
-ynh_system_user_create --username=$app
-
-#=================================================
-# PHP-FPM CONFIGURATION
-#=================================================
-ynh_script_progression --message="Upgrading PHP-FPM configuration..." --time --weight=1
-
-# Create a dedicated PHP-FPM config
-ynh_add_fpm_config
+ynh_system_user_create --username=$mautrix_bridge_user
 
 #=================================================
 # SPECIFIC UPGRADE
@@ -125,8 +129,9 @@ ynh_add_fpm_config
 
 if [ "$upgrade_type" == "UPGRADE_APP" ]
 then
+ynh_script_progression --message="Upgrading python packages..." --time --weight=1
 $final_path/bin/pip3 install --upgrade setuptools wheel # HACK fixes "error: invalid command 'bdist_wheel'"
-$final_path/bin/pip3 install --upgrade $final_path/src/mautrix-telegram.tar.gz[postgres,speedups,webp_convert,qr_login]
+$final_path/bin/pip3 install --upgrade $final_path/src/mautrix-telegram.tar.gz[postgres,speedups,qr_login,hq_thumbnails]
 fi
 #
 #=================================================
@@ -138,77 +143,35 @@ ynh_script_progression --message="Upgrading systemd configuration..." --time --w
 ynh_add_systemd_config
 
 #=================================================
-# MODIFY A CONFIG FILE
+# UPDATE/MODIFY THE CONFIG FILE
 #=================================================
 
-### Verify the checksum of a file, stored by `ynh_store_file_checksum` in the install script.
-### And create a backup of this file if the checksum is different. So the file will be backed up if the admin had modified it.
+# main configuration
+ynh_backup_if_checksum_is_different --file="$mautrix_config_path"
+# as_token hs_token are autogenerated, save them before regenerating the config
+as_token=$(grep as_token "$mautrix_config_path" | sed "s/ *as_token: *//")
+hs_token=$(grep hs_token "$mautrix_config_path" | sed "s/ *hs_token: *//")
+# ynh_replace_string --match_string=__AS_TOKEN__ --replace_string="$as_token" --target_file="$mautrix_config_path"
+# ynh_replace_string --match_string=__HS_TOKEN__ --replace_string="$hs_token" --target_file="$mautrix_config_path"
+write_bridge_config
 
-server_name=$(ynh_app_setting_get --app=$app --key=server_name)
-port=$(ynh_app_setting_get --app=$app --key=port)
-mautrix_bridge_user=$(ynh_app_setting_get --app=$app --key=mautrix_bridge_user)
-mautrix_bridge_db_pwd=$(ynh_app_setting_get --app=$app --key=mautrix_bridge_db_pwd)
-mautrix_bridge_db_name=$(ynh_app_setting_get --app=$app --key=mautrix_bridge_db_name)
-botname=$(ynh_app_setting_get --app=$app --key=botname)
-botusers=$(ynh_app_setting_get --app=$app --key=botusers)
-botadmin=$(ynh_app_setting_get --app=$app --key=botadmin)
-apiid=$(ynh_app_setting_get --app=$app --key=apiid)
-apihash=$(ynh_app_setting_get --app=$app --key=apihash)
-bottoken=$(ynh_app_setting_get --app=$app --key=bottoken)
-
-# mautrix_config_path="$final_path/config.yaml"
-# cp ../conf/config.yaml "$mautrix_config_path"
-# ynh_replace_string --match_string=__DOMAIN__ --replace_string="https://$domain" --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__SERVER_NAME__ --replace_string=$server_name --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__VERIFY_SERVER_SSL_CERTIFICATES__ --replace_string=true --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__MATRIX_SERVER_SUPPORTS_ASMUX__ --replace_string=false --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__PORT__ --replace_string=$port --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__MAUTRIX_BRIDGE_USER__ --replace_string=$mautrix_bridge_user --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__MAUTRIX_BRIDGE_DB_PWD__ --replace_string=$mautrix_bridge_db_pwd --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__MAUTRIX_BRIDGE_DB_NAME__ --replace_string=$mautrix_bridge_db_name --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__BOTNAME__ --replace_string=$botname --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__ENCRYPTION__ --replace_string=$encryption --target_file="$mautrix_config_path"
-# if [ "$botusers" = "local" ]
-# then
-# ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$server_name --target_file="$mautrix_config_path"
-# else
-# ynh_replace_string --match_string=__BOTUSERS__ --replace_string=$botusers --target_file="$mautrix_config_path"
-# fi
-# ynh_replace_string --match_string=__BOTADMIN__ --replace_string=$botadmin --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__APP__ --replace_string=$app --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__LOG_FILENAME__ --replace_string="/var/log/$app/$app.log" --target_file="$mautrix_config_path"
-#     # Options: debug, info, warn, error, fatal
-# ynh_replace_string --match_string=__LOG_LEVEL__ --replace_string="error" --target_file="$mautrix_config_path"
-
-# ynh_replace_string --match_string=__TELEGRAM_API_ID__ --replace_string=$apiid --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__TELEGRAM_API_HASH__ --replace_string=$apihash --target_file="$mautrix_config_path"
-# ynh_replace_string --match_string=__TELEGRAM_BOT_TOKEN__ --replace_string=$bottoken --target_file="$mautrix_config_path"
-
-# ynh_backup_if_checksum_is_different --file="$mautrix_config_path"
-
-# ynh_replace_string --match_string="script_location = alembic" \
-#   --replace_string="script_location = $final_path/alembic" \
-#   --target_file="$final_path/alembic.ini"
-# ynh_backup_if_checksum_is_different --file="$final_path/alembic.ini"
-
-# upgrade the python stuff
+# upgrade the app-service-registration
+ynh_backup_if_checksum_is_different --file="$app_service_registration_path/$app.yaml"
 $final_path/bin/python3 -m mautrix_telegram -g -c "$mautrix_config_path" -r "$app_service_registration_path/$app.yaml"
 
-# update the registration file
-synapse_instance=$(ynh_app_setting_get --app=$app --key=synapse_instance)
-app_service_registration_path="/etc/matrix-$synapse_instance/app-service"
+# upgrade the alembic database
+# TODO remove on next upgrade
+# ynh_backup_if_checksum_is_different --file="$final_path/alembic.ini"
+ynh_replace_string --match_string="script_location = alembic" \
+  --replace_string="script_location = $final_path/alembic" \
+  --target_file="$final_path/alembic.ini"
 $final_path/bin/alembic  -c "$final_path/alembic.ini" -x config="$mautrix_config_path" upgrade head
 
-# upgrade the database
-ynh_backup_if_checksum_is_different --file="$app_service_registration_path/$app.yaml"
-
-
 # Recalculate and store the checksum of the file for the next upgrade.
 ynh_store_file_checksum --file="$mautrix_config_path"
+ynh_store_file_checksum --file="$app_service_registration_path/$app.yaml"
 ynh_store_file_checksum --file="$final_path/alembic.ini"
 
-
-
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
@@ -216,7 +179,7 @@ ynh_store_file_checksum --file="$final_path/alembic.ini"
 #=================================================
 
 # Set permissions on app files
-chown -R root: $final_path
+chown $mautrix_bridge_user:root -R $final_path
 
 #=================================================
 # SETUP LOGROTATE
@@ -224,21 +187,21 @@ chown -R root: $final_path
 ynh_script_progression --message="Upgrading logrotate configuration..." --time --weight=1
 
 # Use logrotate to manage app-specific logfile(s)
-ynh_use_logrotate --non-append
+ynh_use_logrotate --non-append --logfile "/var/log/$app/$app.log"
 
 #=================================================
 # INTEGRATE SERVICE IN YUNOHOST
 #=================================================
 ynh_script_progression --message="Integrating service in YunoHost..." --time --weight=1
 
-yunohost service add $app --description="A short description of the app" --log="/var/log/$app/$app.log"
+yunohost service add $app --description "$app daemon for bridging Telegram and Matrix messages" --log "/var/log/$app/$app.log"
 
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
 ynh_script_progression --message="Starting a systemd service..." --time --weight=1
 
-ynh_systemd_action --service_name=$app --action="start" --log_path="/var/log/$app/$app.log"
+ynh_systemd_action --service_name=$app --action="start"
 
 #=================================================
 # RELOAD synapse