diff --git a/bin/yunoprompt b/bin/yunoprompt
index de05dd6fa..2705dbcdc 100755
--- a/bin/yunoprompt
+++ b/bin/yunoprompt
@@ -56,7 +56,7 @@ else
     echo "$LOGO_AND_FINGERPRINTS"
     echo -e "\e[m Post-installation \e[0m"
     echo "Congratulations! YunoHost has been successfully installed.\nTwo more steps are required to activate the services of your server."
-    read -p "Proceed to post-installation? (y/n) " -n 1
+    read -p "Proceed to post-installation? (y/n)\nAlternatively, you can proceed the post-installation on https://${ip}" -n 1
     RESULT=1
     while [ $RESULT -gt 0 ]; do
         if [[ $REPLY =~ ^[Nn]$ ]]; then
diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml
index ec4a6bf08..bb51c6f7f 100644
--- a/data/actionsmap/yunohost.yml
+++ b/data/actionsmap/yunohost.yml
@@ -105,7 +105,7 @@ user:
                         ask: ask_lastname
                         required: True
                         pattern: &pattern_lastname
-                            - !!str ^([^\W\d_]{2,30}[ ,.']{0,3})+$
+                            - !!str ^([^\W\d_]{2,30}[ ,.'-]{0,3})+$
                             - "pattern_lastname"
                 -m:
                     full: --mail
diff --git a/data/helpers.d/filesystem b/data/helpers.d/filesystem
index d4146ad8f..c07de2ece 100644
--- a/data/helpers.d/filesystem
+++ b/data/helpers.d/filesystem
@@ -299,6 +299,23 @@ ynh_backup_if_checksum_is_different () {
 	fi
 }
 
+# Delete a file checksum from the app settings
+#
+# $app should be defined when calling this helper
+#
+# usage: ynh_remove_file_checksum file
+# | arg: -f, --file= - The file for which the checksum will be deleted
+ynh_delete_file_checksum () {
+	# Declare an array to define the options of this helper.
+	declare -Ar args_array=( [f]=file= )
+	local file
+	# Manage arguments with getopts
+	ynh_handle_getopts_args "$@"
+
+	local checksum_setting_name=checksum_${file//[\/ ]/_}	# Replace all '/' and ' ' by '_'
+	ynh_app_setting_delete $app $checksum_setting_name
+}
+
 # Remove a file or a directory securely
 #
 # usage: ynh_secure_remove path_to_remove
diff --git a/data/helpers.d/getopts b/data/helpers.d/getopts
new file mode 100644
index 000000000..1cc66da8a
--- /dev/null
+++ b/data/helpers.d/getopts
@@ -0,0 +1,194 @@
+#!/bin/bash
+
+# Internal helper design to allow helpers to use getopts to manage their arguments
+#
+# [internal]
+#
+# example: function my_helper()
+# {
+#     declare -Ar args_array=( [a]=arg1= [b]=arg2= [c]=arg3 )
+#     local arg1
+#     local arg2
+#     local arg3
+#     ynh_handle_getopts_args "$@"
+#
+#     [...]
+# }
+# my_helper --arg1 "val1" -b val2 -c
+#
+# usage: ynh_handle_getopts_args "$@"
+# | arg: $@    - Simply "$@" to tranfert all the positionnal arguments to the function
+#
+# This helper need an array, named "args_array" with all the arguments used by the helper
+# 	that want to use ynh_handle_getopts_args
+# Be carreful, this array has to be an associative array, as the following example:
+# declare -Ar args_array=( [a]=arg1 [b]=arg2= [c]=arg3 )
+# Let's explain this array:
+# a, b and c are short options, -a, -b and -c
+# arg1, arg2 and arg3 are the long options associated to the previous short ones. --arg1, --arg2 and --arg3
+# For each option, a short and long version has to be defined.
+# Let's see something more significant
+# declare -Ar args_array=( [u]=user [f]=finalpath= [d]=database )
+#
+# NB: Because we're using 'declare' without -g, the array will be declared as a local variable.
+#
+# Please keep in mind that the long option will be used as a variable to store the values for this option.
+# For the previous example, that means that $finalpath will be fill with the value given as argument for this option.
+#
+# Also, in the previous example, finalpath has a '=' at the end. That means this option need a value.
+# So, the helper has to be call with --finalpath /final/path, --finalpath=/final/path or -f /final/path, the variable $finalpath will get the value /final/path
+# If there's many values for an option, -f /final /path, the value will be separated by a ';' $finalpath=/final;/path
+# For an option without value, like --user in the example, the helper can be called only with --user or -u. $user will then get the value 1.
+#
+# To keep a retrocompatibility, a package can still call a helper, using getopts, with positional arguments.
+# The "legacy mode" will manage the positional arguments and fill the variable in the same order than they are given in $args_array.
+# e.g. for `my_helper "val1" val2`, arg1 will be filled with val1, and arg2 with val2.
+ynh_handle_getopts_args () {
+	# Manage arguments only if there's some provided
+	set +x
+	if [ $# -ne 0 ]
+	then
+		# Store arguments in an array to keep each argument separated
+		local arguments=("$@")
+
+		# For each option in the array, reduce to short options for getopts (e.g. for [u]=user, --user will be -u)
+		# And built parameters string for getopts
+		# ${!args_array[@]} is the list of all keys in the array (A key is 'u' in [u]=user, user is a value)
+		local getopts_parameters=""
+		local key=""
+		for key in "${!args_array[@]}"
+		do
+			# Concatenate each keys of the array to build the string of arguments for getopts
+			# Will looks like 'abcd' for -a -b -c -d
+			# If the value of a key finish by =, it's an option with additionnal values. (e.g. --user bob or -u bob)
+			# Check the last character of the value associate to the key
+			if [ "${args_array[$key]: -1}" = "=" ]
+			then
+				# For an option with additionnal values, add a ':' after the letter for getopts.
+				getopts_parameters="${getopts_parameters}${key}:"
+			else
+				getopts_parameters="${getopts_parameters}${key}"
+			fi
+			# Check each argument given to the function
+			local arg=""
+			# ${#arguments[@]} is the size of the array
+			for arg in `seq 0 $(( ${#arguments[@]} - 1 ))`
+			do
+				# And replace long option (value of the key) by the short option, the key itself
+				# (e.g. for [u]=user, --user will be -u)
+				# Replace long option with =
+				arguments[arg]="${arguments[arg]//--${args_array[$key]}/-${key} }"
+				# And long option without =
+				arguments[arg]="${arguments[arg]//--${args_array[$key]%=}/-${key}}"
+			done
+		done
+
+		# Read and parse all the arguments
+		# Use a function here, to use standart arguments $@ and be able to use shift.
+		parse_arg () {
+			# Read all arguments, until no arguments are left
+			while [ $# -ne 0 ]
+			do
+				# Initialize the index of getopts
+				OPTIND=1
+				# Parse with getopts only if the argument begin by -, that means the argument is an option
+				# getopts will fill $parameter with the letter of the option it has read.
+				local parameter=""
+				getopts ":$getopts_parameters" parameter || true
+
+				if [ "$parameter" = "?" ]
+				then
+					ynh_die "Invalid argument: -${OPTARG:-}"
+				elif [ "$parameter" = ":" ]
+				then
+					ynh_die "-$OPTARG parameter requires an argument."
+				else
+					local shift_value=1
+					# Use the long option, corresponding to the short option read by getopts, as a variable
+					# (e.g. for [u]=user, 'user' will be used as a variable)
+					# Also, remove '=' at the end of the long option
+					# The variable name will be stored in 'option_var'
+					local option_var="${args_array[$parameter]%=}"
+					# If this option doesn't take values
+					# if there's a '=' at the end of the long option name, this option takes values
+					if [ "${args_array[$parameter]: -1}" != "=" ]
+					then
+						# 'eval ${option_var}' will use the content of 'option_var'
+						eval ${option_var}=1
+					else
+						# Read all other arguments to find multiple value for this option.
+						# Load args in a array
+						local all_args=("$@")
+
+						# If the first argument is longer than 2 characters,
+						# There's a value attached to the option, in the same array cell
+						if [ ${#all_args[0]} -gt 2 ]; then
+							# Remove the option and the space, so keep only the value itself.
+							all_args[0]="${all_args[0]#-${parameter} }"
+							# Reduce the value of shift, because the option has been removed manually
+							shift_value=$(( shift_value - 1 ))
+						fi
+
+						# Then read the array value per value
+						for i in `seq 0 $(( ${#all_args[@]} - 1 ))`
+						do
+							# If this argument is an option, end here.
+							if [ "${all_args[$i]:0:1}" == "-" ] || [ -z "${all_args[$i]}" ]
+							then
+								# Ignore the first value of the array, which is the option itself
+								if [ "$i" -ne 0 ]; then
+									break
+								fi
+							else
+								# Declare the content of option_var as a variable.
+								eval ${option_var}=""
+								# Else, add this value to this option
+								# Each value will be separated by ';'
+								if [ -n "${!option_var}" ]
+								then
+									# If there's already another value for this option, add a ; before adding the new value
+									eval ${option_var}+="\;"
+								fi
+								eval ${option_var}+=\"${all_args[$i]}\"
+								shift_value=$(( shift_value + 1 ))
+							fi
+						done
+					fi
+				fi
+
+				# Shift the parameter and its argument(s)
+				shift $shift_value
+			done
+		}
+
+		# LEGACY MODE
+		# Check if there's getopts arguments
+		if [ "${arguments[0]:0:1}" != "-" ]
+		then
+			# If not, enter in legacy mode and manage the arguments as positionnal ones.
+			echo "! Helper used in legacy mode !"
+			for i in `seq 0 $(( ${#arguments[@]} -1 ))`
+			do
+				# Use getopts_parameters as a list of key of the array args_array
+				# Remove all ':' in getopts_parameters
+				getopts_parameters=${getopts_parameters//:}
+				# Get the key from getopts_parameters, by using the key according to the position of the argument.
+				key=${getopts_parameters:$i:1}
+				# Use the long option, corresponding to the key, as a variable
+				# (e.g. for [u]=user, 'user' will be used as a variable)
+				# Also, remove '=' at the end of the long option
+				# The variable name will be stored in 'option_var'
+				local option_var="${args_array[$key]%=}"
+
+				# Store each value given as argument in the corresponding variable
+				# The values will be stored in the same order than $args_array
+				eval ${option_var}+=\"${arguments[$i]}\"
+			done
+		else
+			# END LEGACY MODE
+			# Call parse_arg and pass the modified list of args as an array of arguments.
+			parse_arg "${arguments[@]}"
+		fi
+	fi
+	set -x
+}
diff --git a/data/helpers.d/utils b/data/helpers.d/utils
index 595da3c2d..eef9f2a8e 100644
--- a/data/helpers.d/utils
+++ b/data/helpers.d/utils
@@ -173,7 +173,7 @@ ynh_setup_source () {
     then    # Use the local source file if it is present
         cp $local_src $src_filename
     else    # If not, download the source
-        wget -nv -O $src_filename $src_url
+        local out=`wget -nv -O $src_filename $src_url 2>&1` || ynh_print_err $out
     fi
 
     # Check the control sum
@@ -253,6 +253,9 @@ ynh_local_curl () {
 		# Add --data arg and remove the last character, which is an unecessary '&'
 		POST_data="--data ${POST_data::-1}"
 	fi
+	
+	# Wait untils nginx has fully reloaded (avoid curl fail with http2)
+	sleep 2
 
 	# Curl the URL
 	curl --silent --show-error -kL -H "Host: $domain" --resolve $domain:443:127.0.0.1 $POST_data "$full_page_url"
diff --git a/data/hooks/conf_regen/15-nginx b/data/hooks/conf_regen/15-nginx
index 1aafcbfa2..461c10c0c 100755
--- a/data/hooks/conf_regen/15-nginx
+++ b/data/hooks/conf_regen/15-nginx
@@ -2,6 +2,8 @@
 
 set -e
 
+. /usr/share/yunohost/helpers.d/utils
+
 do_init_regen() {
   if [[ $EUID -ne 0 ]]; then
     echo "You must be root to run this script" 1>&2
@@ -42,18 +44,18 @@ do_pre_regen() {
     mkdir -p "$mail_autoconfig_dir"
 
     # NGINX server configuration
-    cat server.tpl.conf \
-      | sed "s/{{ domain }}/${domain}/g" \
-      > "${nginx_conf_dir}/${domain}.conf"
-
-    cat autoconfig.tpl.xml \
-      | sed "s/{{ domain }}/${domain}/g" \
-      > "${mail_autoconfig_dir}/config-v1.1.xml"
+    export domain
+    export domain_cert_ca=$(yunohost domain cert-status $domain --json \
+                            | jq ".certificates.\"$domain\".CA_type" \
+                            | tr -d '"')
 
+    ynh_render_template "server.tpl.conf" "${nginx_conf_dir}/${domain}.conf"
+    ynh_render_template "autoconfig.tpl.xml" "${mail_autoconfig_dir}/config-v1.1.xml"
 
     [[ $main_domain != $domain ]] \
       && touch "${domain_conf_dir}/yunohost_local.conf" \
       || cp yunohost_local.conf "${domain_conf_dir}/yunohost_local.conf"
+
   done
 
   # remove old domain conf files
diff --git a/data/templates/metronome/metronome.cfg.lua b/data/templates/metronome/metronome.cfg.lua
index 012f427ef..0640ef9d5 100644
--- a/data/templates/metronome/metronome.cfg.lua
+++ b/data/templates/metronome/metronome.cfg.lua
@@ -9,16 +9,64 @@
 -- A table is a list of values, except each value has a name. An 
 -- example would be:
 --
--- ssl = { key = "keyfile.key", certificate = "certificate.crt" }
+-- ssl = { key = "keyfile.key", certificate = "certificate.cert" }
 --
 -- Tip: You can check that the syntax of this file is correct when you have finished
 -- by running: luac -p metronome.cfg.lua
 -- If there are any errors, it will let you know what and where they are, otherwise it 
 -- will keep quiet.
 
----------- Server-wide settings ----------
--- Settings in this section apply to the whole server and are the default settings
--- for any virtual hosts
+-- Global settings go in this section
+ 
+-- This is the list of modules Metronome will load on startup.
+-- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
+
+modules_enabled = {
+	-- Generally required
+		"roster"; -- Allow users to have a roster. Recommended.
+		"saslauth"; -- Authentication for clients. Recommended if you want to log in.
+		"tls"; -- Add support for secure TLS on c2s/s2s connections
+		"disco"; -- Service discovery
+ 
+	-- Not essential, but recommended
+		"private"; -- Private XML storage (for room bookmarks, etc.)
+		"vcard"; -- Allow users to set vCards
+		"pep"; -- Allows setting of mood, tune, etc.
+		"posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
+		"bidi"; -- Enables Bidirectional Server-to-Server Streams.
+ 
+	-- Nice to have
+		"version"; -- Replies to server version requests
+		"uptime"; -- Report how long server has been running
+		"time"; -- Let others know the time here on this server
+		"ping"; -- Replies to XMPP pings with pongs
+		"register"; -- Allow users to register on this server using a client and change passwords
+		"stream_management"; -- Allows clients and servers to use Stream Management
+		"stanza_optimizations"; -- Allows clients to use Client State Indication and SIFT
+		"message_carbons"; -- Allows clients to enable carbon copies of messages
+		"mam"; -- Enable server-side message archives using Message Archive Management
+		"push"; -- Enable Push Notifications via PubSub using XEP-0357
+		"lastactivity"; -- Enables clients to know the last presence status of an user
+		"adhoc_cm"; -- Allow to set client certificates to login through SASL External via adhoc
+		"admin_adhoc"; -- administration adhoc commands
+		"bookmarks"; -- XEP-0048 Bookmarks synchronization between PEP and Private Storage
+		"sec_labels"; -- Allows to use a simplified version XEP-0258 Security Labels and related ACDFs.
+		"privacy"; -- Add privacy lists and simple blocking command support
+
+		-- Other specific functionality
+		--"admin_telnet"; -- administration console, telnet to port 5582
+		--"admin_web"; -- administration web interface
+		"bosh"; -- Enable support for BOSH clients, aka "XMPP over Bidirectional Streams over Synchronous HTTP"
+		--"compression"; -- Allow clients to enable Stream Compression
+		--"spim_block"; -- Require authorization via OOB form for messages from non-contacts and block unsollicited messages
+		--"gate_guard"; -- Enable config-based blacklisting and hit-based auto-banning features
+		--"incidents_handling"; -- Enable Incidents Handling support (can be administered via adhoc commands)
+		--"server_presence"; -- Enables Server Buddies extension support
+		--"service_directory"; -- Enables Service Directories extension support
+		--"public_service"; -- Enables Server vCard support for public services in directories and advertises in features
+		--"register_api"; -- Provides secure API for both Out-Of-Band and In-Band registration for E-Mail verification
+		"websocket"; -- Enable support for WebSocket clients, aka "XMPP over WebSockets"
+};
 
 -- Server PID
 pidfile = "/var/run/metronome/metronome.pid"
@@ -33,156 +81,76 @@ http_interfaces = { "127.0.0.1", "::1" }
 -- Enable IPv6
 use_ipv6 = true
 
--- This is the list of modules Metronome will load on startup.
--- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too.
-modules_enabled = {
-
-    -- Generally required
-        "roster"; -- Allow users to have a roster. Recommended ;)
-        "saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
-        "tls"; -- Add support for secure TLS on c2s/s2s connections
-        "dialback"; -- s2s dialback support
-        "disco"; -- Service discovery
-        --"discoitems"; -- Service discovery items
-        --"extdisco"; -- External Service Discovery
-
-    -- Not essential, but recommended
-        "private"; -- Private XML storage (for room bookmarks, etc.)
-        "vcard"; -- Allow users to set vCards
-        "privacy"; -- Support privacy lists
-
-    -- These are commented by default as they have a performance impact
-        --"compression"; -- Stream compression (Debian: requires lua-zlib module to work)
-
-    -- Nice to have
-        "version"; -- Replies to server version requests
-        "uptime"; -- Report how long server has been running
-        "time"; -- Let others know the time here on this server
-        "ping"; -- Replies to XMPP pings with pongs
-        "pep"; -- Enables users to publish their mood, activity, playing music and more
-        "message_carbons"; -- Allow clients to keep in sync with messages send on other resources
-        "register"; -- Allow users to register on this server using a client and change passwords
-        "adhoc"; -- Support for "ad-hoc commands" that can be executed with an XMPP client
-
-    -- Admin interfaces
-        "admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
-        "admin_telnet"; -- Opens telnet console interface on localhost port 5582
-
-    -- HTTP modules
-        "bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
-        --"websockets"; -- Enable WebSocket clients
-        --"http_files"; -- Serve static files from a directory over HTTP
-
-    -- Other specific functionality
---        "bidi"; -- Bidirectional Streams for S2S connections
---        "stream_management"; -- Stream Management support
-        --"groups"; -- Shared roster support
-        --"announce"; -- Send announcement to all online users
-        --"welcome"; -- Welcome users who register accounts
-        --"watchregistrations"; -- Alert admins of registrations
-        --"motd"; -- Send a message to users when they log in
-        "mam"; -- Nice archive management
-        --"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
-        "offline"; -- Store offline messages
-        "c2s"; -- Handle client connections
-        "s2s"; -- Handle server-to-server connections
-
-    -- Debian: do not remove this module, or you lose syslog
-    -- support
-        "posix"; -- POSIX functionality, sends server to background, enables syslog, etc.
-};
-
 -- Discovery items
 disco_items = {
-    { "muc.{{ main_domain }}" },
-    { "pubsub.{{ main_domain }}" },
-    { "vjud.{{ main_domain }}" }
+	{ "muc.{{ main_domain }}" },
+	{ "pubsub.{{ main_domain }}" },
+	{ "upload.{{ main_domain }}" },
+	{ "vjud.{{ main_domain }}" }
 };
 
 -- BOSH configuration (mod_bosh)
-bosh_max_inactivity = 30
 consider_bosh_secure = true
 cross_domain_bosh = true
 
+-- WebSocket configuration (mod_websocket)
+consider_websocket_secure = true
+cross_domain_websocket = true
+
 -- Disable account creation by default, for security
 allow_registration = false
 
--- SSL/TLS configuration
-ssl = {
-    options = {
-        "no_sslv2",
-        "no_sslv3",
-        "no_ticket",
-        "no_compression",
-        "cipher_server_preference"
-    };
-}
-
--- Force clients to use encrypted connections? This option will
--- prevent clients from authenticating unless they are using encryption.
-c2s_require_encryption = true
-
--- Force servers to use encrypted connections? This option will
--- prevent servers from connecting unless they are using encryption.
-s2s_require_encryption = true
-
--- Allow servers to use an unauthenticated encryption channel
-s2s_allow_encryption = true
-
-allow_unencrypted_plain_auth = false;
-
-s2s_secure = true
-s2s_secure_auth = false
-
---anonymous_login = false
-
 -- Use LDAP storage backend for all stores
 storage = "ldap"
 
 -- Logging configuration
 log = {
-    info = "/var/log/metronome/metronome.log"; -- Change 'info' to 'debug' for verbose logging
-    error = "/var/log/metronome/metronome.err";
-    -- "*syslog"; -- Uncomment this for logging to syslog
-    -- "*console"; -- Log to the console, useful for debugging with daemonize=false
+	info = "/var/log/metronome/metronome.log"; -- Change 'info' to 'debug' for verbose logging
+	error = "/var/log/metronome/metronome.err";
+	-- "*syslog"; -- Uncomment this for logging to syslog
+	-- "*console"; -- Log to the console, useful for debugging with daemonize=false
 }
 
-
 ------ Components ------
 -- You can specify components to add hosts that provide special services,
 -- like multi-user conferences, and transports.
 
 ---Set up a local BOSH service
 Component "localhost" "http"
-    modules_enabled = { "bosh" }
+	modules_enabled = { "bosh" }
 
 ---Set up a MUC (multi-user chat) room server
 Component "muc.{{ main_domain }}" "muc"
-    name = "{{ main_domain }} Chatrooms"
+	name = "{{ main_domain }} Chatrooms"
 
-    modules_enabled = {
-        "muc_limits";
-        "muc_log";
-        "muc_log_http";
+	modules_enabled = {
+		"muc_limits";
+		"muc_log";
+		"muc_log_mam";
+		"muc_log_http";
+		"muc_vcard";
     }
 
-    muc_event_rate = 0.5
-    muc_burst_factor = 10
-
-    muc_log_http_config = {
-        url_base = "logs";
-        theme = "metronome";
-    }
+	muc_event_rate = 0.5
+	muc_burst_factor = 10
 
 ---Set up a PubSub server
 Component "pubsub.{{ main_domain }}" "pubsub"
-    name = "{{ main_domain }} Publish/Subscribe"
+	name = "{{ main_domain }} Publish/Subscribe"
+
+	unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server)
+
+---Set up a HTTP Upload service
+Component "upload.{{ main_domain }}" "http_upload"
+	name = "{{ main_domain }} Sharing Service"
+
+	http_file_size_limit = 6*1024*1024
+	http_file_quota = 60*1024*1024
 
-    unrestricted_node_creation = true -- Anyone can create a PubSub node (from any server)
 
 ---Set up a VJUD service
 Component "vjud.{{ main_domain }}" "vjud"
-    ud_disco_name = "{{ main_domain }} User Directory"
+	ud_disco_name = "{{ main_domain }} User Directory"
 
 
 ----------- Virtual hosts -----------
@@ -190,4 +158,3 @@ Component "vjud.{{ main_domain }}" "vjud"
 -- Settings under each VirtualHost entry apply *only* to that host.
 
 Include "conf.d/*.cfg.lua"
-
diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf
index 41065d2bc..3de66e3e6 100644
--- a/data/templates/nginx/plain/yunohost_admin.conf
+++ b/data/templates/nginx/plain/yunohost_admin.conf
@@ -73,6 +73,6 @@ server {
         access_by_lua_file /usr/share/ssowat/access.lua;
     }
 
-    include conf.d/yunohost_admin.conf.inc;
-    include conf.d/yunohost_api.conf.inc;
+    include /etc/nginx/conf.d/yunohost_admin.conf.inc;
+    include /etc/nginx/conf.d/yunohost_api.conf.inc;
 }
diff --git a/data/templates/nginx/plain/yunohost_api.conf.inc b/data/templates/nginx/plain/yunohost_api.conf.inc
index 35cd0090c..4d7887cc6 100644
--- a/data/templates/nginx/plain/yunohost_api.conf.inc
+++ b/data/templates/nginx/plain/yunohost_api.conf.inc
@@ -4,6 +4,7 @@ location /yunohost/api/ {
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";
+    proxy_set_header Host $http_host;
 
     # Custom 502 error page
     error_page 502 /yunohost/api/error/502;
diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf
index 78909e3f6..9acc641ae 100644
--- a/data/templates/nginx/server.tpl.conf
+++ b/data/templates/nginx/server.tpl.conf
@@ -5,7 +5,7 @@ server {
 
     access_by_lua_file /usr/share/ssowat/access.lua;
 
-    include conf.d/{{ domain }}.d/*.conf;
+    include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
 
     location /yunohost/admin {
         return 301 https://$http_host$request_uri;
@@ -68,12 +68,21 @@ server {
     add_header X-Permitted-Cross-Domain-Policies none;
     add_header X-Frame-Options "SAMEORIGIN";
 
+    {% if domain_cert_ca == "Let's Encrypt" %}
+    # OCSP settings
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
+    resolver 127.0.0.1 127.0.1.1 valid=300s;
+    resolver_timeout 5s;
+    {% endif %}
+
     access_by_lua_file /usr/share/ssowat/access.lua;
 
-    include conf.d/{{ domain }}.d/*.conf;
+    include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
 
-    include conf.d/yunohost_admin.conf.inc;
-    include conf.d/yunohost_api.conf.inc;
+    include /etc/nginx/conf.d/yunohost_admin.conf.inc;
+    include /etc/nginx/conf.d/yunohost_api.conf.inc;
 
     access_log /var/log/nginx/{{ domain }}-access.log;
     error_log /var/log/nginx/{{ domain }}-error.log;
diff --git a/data/templates/slapd/ldap.conf b/data/templates/slapd/ldap.conf
index 406b5c175..09aeb8b4f 100644
--- a/data/templates/slapd/ldap.conf
+++ b/data/templates/slapd/ldap.conf
@@ -5,8 +5,8 @@
 # See ldap.conf(5) for details
 # This file should be world readable but not world writable.
 
-#BASE	dc=example,dc=com
-#URI	ldap://ldap.example.com ldap://ldap-master.example.com:666
+BASE   dc=yunohost,dc=org
+URI    ldap://localhost:389
 
 #SIZELIMIT	12
 #TIMELIMIT	15
diff --git a/data/templates/ssl/openssl.cnf b/data/templates/ssl/openssl.cnf
index fa5d19fa3..ac8c422e3 100644
--- a/data/templates/ssl/openssl.cnf
+++ b/data/templates/ssl/openssl.cnf
@@ -43,7 +43,7 @@ unique_subject	= no			# Set to 'no' to allow creation of
 new_certs_dir	= $dir/newcerts		# default place for new certs.
 
 certificate	= $dir/ca/cacert.pem 	# The CA certificate
-serial		= $dir/serial 		# The current serial number
+#serial		= $dir/serial 		# The current serial number
 #crlnumber	= $dir/crlnumber	# the current crl number
 					# must be commented out to leave a V1 CRL
 crl		= $dir/crl.pem 		# The current CRL
diff --git a/debian/changelog b/debian/changelog
index 8b57aeee0..1562c4d2f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+yunohost (3.2.2) stable; urgency=low
+
+  * [hotfix] mod_auth_ldap: reflect SASL API changes in latest Metronome (#546)
+  * [enh] Add the internal helper ynh_handle_getopts_args (#520)
+
+ Thanks to all contributors (Maranda, Maniack) ! <3
+
+ -- Alexandre Aubin <alex.aubin@mailoo.org>  Fri, 28 Sep 2018 23:04:00 +0000
+
+yunohost (3.2.1) stable; urgency=low
+
+  * Don't send an email if no certificate needs to be renewed (#540)
+  * Fix an issue with home backups (#541)
+  * Fix an issue with installs on OVH VPS
+  * Tell the user about post-install available in browser in bootprompt (#544)
+  * Improve Arabic translation
+
+ Thanks to all contributors (BoF, ljf, Aleks) ! <3
+
+ -- Alexandre Aubin <alex.aubin@mailoo.org>  Mon, 17 Sep 2018 18:06:00 +0000
+
 yunohost (3.2.0) stable; urgency=low
 
   * Add many print and exec helpers (#523)
diff --git a/lib/metronome/modules/mod_auth_ldap2.lua b/lib/metronome/modules/mod_auth_ldap2.lua
index bb62ca546..f961885da 100644
--- a/lib/metronome/modules/mod_auth_ldap2.lua
+++ b/lib/metronome/modules/mod_auth_ldap2.lua
@@ -56,8 +56,9 @@ function new_default_provider(host)
      return nil, "Account creation/modification not available with LDAP.";
  end
 
- function provider.get_sasl_handler()
+ function provider.get_sasl_handler(session)
      local testpass_authentication_profile = {
+         session = session,
          plain_test = function(sasl, username, password, realm)
              return provider.test_password(username, password), true;
          end,
diff --git a/locales/en.json b/locales/en.json
index ebbe08943..0cacc5f82 100644
--- a/locales/en.json
+++ b/locales/en.json
@@ -255,6 +255,7 @@
     "mail_domain_unknown": "Unknown mail address domain '{domain:s}'",
     "mail_forward_remove_failed": "Unable to remove mail forward '{mail:s}'",
     "mailbox_used_space_dovecot_down": "Dovecot mailbox service need to be up, if you want to get mailbox used space",
+    "mail_unavailable": "This email address is reserved and shall be automatically allocated to the very first user",
     "maindomain_change_failed": "Unable to change the main domain",
     "maindomain_changed": "The main domain has been changed",
     "migrate_tsig_end": "Migration to hmac-sha512 finished",
diff --git a/src/yunohost/app.py b/src/yunohost/app.py
index 8c35d5e39..de15c1116 100644
--- a/src/yunohost/app.py
+++ b/src/yunohost/app.py
@@ -346,7 +346,8 @@ def app_info(app, show_status=False, raw=False):
         ret['settings'] = _get_app_settings(app)
 
         # Determine upgradability
-        local_update_time = ret['settings'].get('update_time', ret['settings']['install_time'])
+        # In case there is neither update_time nor install_time, we assume the app can/has to be upgraded
+        local_update_time = ret['settings'].get('update_time', ret['settings'].get('install_time', 0))
 
         if 'lastUpdate' not in ret or 'git' not in ret:
             upgradable = "url_required"
diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py
index 0749312d3..6ef9a0554 100644
--- a/src/yunohost/backup.py
+++ b/src/yunohost/backup.py
@@ -2187,7 +2187,7 @@ def backup_list(with_info=False, human_readable=False):
             except ValueError:
                 continue
             result.append(name)
-        result.sort()
+        result.sort(key=lambda x: os.path.getctime(os.path.join(ARCHIVES_PATH, x+".tar.gz")))
 
     if result and with_info:
         d = OrderedDict()
diff --git a/src/yunohost/domain.py b/src/yunohost/domain.py
index 560a6fda5..685e60517 100644
--- a/src/yunohost/domain.py
+++ b/src/yunohost/domain.py
@@ -209,6 +209,11 @@ def domain_dns_conf(domain, ttl=None):
     for record in dns_conf["mail"]:
         result += "\n{name} {ttl} IN {type} {value}".format(**record)
 
+    result += "\n\n"
+    result += "; Extra"
+    for record in dns_conf["extra"]:
+        result += "\n{name} {ttl} IN {type} {value}".format(**record)
+
     is_cli = True if msettings.get('interface') == 'cli' else False
     if is_cli:
         logger.info(m18n.n("domain_dns_conf_is_just_a_recommendation"))
@@ -334,6 +339,9 @@ def _build_dns_conf(domain, ttl=3600):
             {"type": "TXT", "name": "mail._domainkey", "value": "\"v=DKIM1; k=rsa; p=some-super-long-key\"", "ttl": 3600},
             {"type": "TXT", "name": "_dmarc", "value": "\"v=DMARC1; p=none\"", "ttl": 3600}
         ],
+        "extra": [
+            {"type": "CAA", "name": "@", "value": "128 issue 'letsencrypt.org", "ttl": 3600},
+        ],
     }
     """
 
@@ -387,10 +395,16 @@ def _build_dns_conf(domain, ttl=3600):
             ["_dmarc", ttl, "TXT", '"v=DMARC1; p=none"'],
         ]
 
+    # Extra
+    extra = [
+        ["@", ttl, "CAA", "128 issue 'letsencrypt.org'"]
+    ]
+
     return {
         "basic": [{"name": name, "ttl": ttl, "type": type_, "value": value} for name, ttl, type_, value in basic],
         "xmpp": [{"name": name, "ttl": ttl, "type": type_, "value": value} for name, ttl, type_, value in xmpp],
         "mail": [{"name": name, "ttl": ttl, "type": type_, "value": value} for name, ttl, type_, value in mail],
+        "extra": [{"name": name, "ttl": ttl, "type": type_, "value": value} for name, ttl, type_, value in extra],
     }
 
 
diff --git a/src/yunohost/dyndns.py b/src/yunohost/dyndns.py
index 88547b4db..3e040d682 100644
--- a/src/yunohost/dyndns.py
+++ b/src/yunohost/dyndns.py
@@ -37,6 +37,8 @@ from moulinette.core import MoulinetteError
 from moulinette.utils.log import getActionLogger
 from moulinette.utils.filesystem import read_file, write_to_file, rm
 from moulinette.utils.network import download_json
+from moulinette.utils.process import check_output
+
 
 from yunohost.domain import _get_maindomain, _build_dns_conf
 from yunohost.utils.network import get_public_ip
@@ -44,8 +46,6 @@ from yunohost.log import is_unit_operation
 
 logger = getActionLogger('yunohost.dyndns')
 
-OLD_IPV4_FILE = '/etc/yunohost/dyndns/old_ip'
-OLD_IPV6_FILE = '/etc/yunohost/dyndns/old_ipv6'
 DYNDNS_ZONE = '/etc/yunohost/dyndns/zone'
 
 RE_DYNDNS_PRIVATE_KEY_MD5 = re.compile(
@@ -96,7 +96,7 @@ def _dyndns_available(provider, domain):
         domain -- The full domain that you'd like.. e.g. "foo.nohost.me"
 
     Returns:
-        True if the domain is avaible, False otherwise.
+        True if the domain is available, False otherwise.
     """
     logger.debug("Checking if domain %s is available on %s ..."
                  % (domain, provider))
@@ -193,32 +193,6 @@ def dyndns_update(operation_logger, dyn_host="dyndns.yunohost.org", domain=None,
 
     old_ipv4, old_ipv6 = (None, None)  # (default values)
 
-    if os.path.isfile(OLD_IPV4_FILE):
-        old_ipv4 = read_file(OLD_IPV4_FILE).rstrip()
-
-    if os.path.isfile(OLD_IPV6_FILE):
-        old_ipv6 = read_file(OLD_IPV6_FILE).rstrip()
-
-    # Get current IPv4 and IPv6
-    ipv4_ = get_public_ip()
-    ipv6_ = get_public_ip(6)
-
-    if ipv4 is None:
-        ipv4 = ipv4_
-
-    if ipv6 is None:
-        ipv6 = ipv6_
-
-    logger.debug("Old IPv4/v6 are (%s, %s)" % (old_ipv4, old_ipv6))
-    logger.debug("Requested IPv4/v6 are (%s, %s)" % (ipv4, ipv6))
-
-    # no need to update
-    if old_ipv4 == ipv4 and old_ipv6 == ipv6:
-        logger.info("No updated needed.")
-        return
-    else:
-        logger.info("Updated needed, going on...")
-
     # If domain is not given, try to guess it from keys available...
     if domain is None:
         (domain, key) = _guess_current_dyndns_domain(dyn_host)
@@ -262,7 +236,32 @@ def dyndns_update(operation_logger, dyn_host="dyndns.yunohost.org", domain=None,
         'zone %s' % host,
     ]
 
+
+    old_ipv4 = check_output("dig @%s +short %s" % (dyn_host, domain)).strip() or None
+    old_ipv6 = check_output("dig @%s +short aaaa %s" % (dyn_host, domain)).strip() or None
+
+    # Get current IPv4 and IPv6
+    ipv4_ = get_public_ip()
+    ipv6_ = get_public_ip(6)
+
+    if ipv4 is None:
+        ipv4 = ipv4_
+
+    if ipv6 is None:
+        ipv6 = ipv6_
+
+    logger.debug("Old IPv4/v6 are (%s, %s)" % (old_ipv4, old_ipv6))
+    logger.debug("Requested IPv4/v6 are (%s, %s)" % (ipv4, ipv6))
+
+    # no need to update
+    if old_ipv4 == ipv4 and old_ipv6 == ipv6:
+        logger.info("No updated needed.")
+        return
+    else:
+        logger.info("Updated needed, going on...")
+
     dns_conf = _build_dns_conf(domain)
+    del dns_conf["extra"] # Ignore records from the 'extra' category
 
     # Delete the old records for all domain/subdomains
 
@@ -304,18 +303,11 @@ def dyndns_update(operation_logger, dyn_host="dyndns.yunohost.org", domain=None,
         command = ["/usr/bin/nsupdate", "-k", key, DYNDNS_ZONE]
         subprocess.check_call(command)
     except subprocess.CalledProcessError:
-        rm(OLD_IPV4_FILE, force=True)  # Remove file (ignore if non-existent)
-        rm(OLD_IPV6_FILE, force=True)  # Remove file (ignore if non-existent)
         raise MoulinetteError(errno.EPERM,
                               m18n.n('dyndns_ip_update_failed'))
 
     logger.success(m18n.n('dyndns_ip_updated'))
 
-    if ipv4 is not None:
-        write_to_file(OLD_IPV4_FILE, ipv4)
-    if ipv6 is not None:
-        write_to_file(OLD_IPV6_FILE, ipv6)
-
 
 def dyndns_installcron():
     """
diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py
index f9ee14994..ccf489a92 100644
--- a/src/yunohost/tools.py
+++ b/src/yunohost/tools.py
@@ -358,7 +358,6 @@ def tools_postinstall(operation_logger, domain, password, ignore_dyndns=False):
     service_regen_conf(['ssl'], force=True)
     ssl_dir = '/usr/share/yunohost/yunohost-config/ssl/yunoCA'
     commands = [
-        'echo "01" > %s/serial' % ssl_dir,
         'rm %s/index.txt' % ssl_dir,
         'touch %s/index.txt' % ssl_dir,
         'cp %s/openssl.cnf %s/openssl.ca.cnf' % (ssl_dir, ssl_dir),
diff --git a/src/yunohost/user.py b/src/yunohost/user.py
index 48065f70a..8fd445af1 100644
--- a/src/yunohost/user.py
+++ b/src/yunohost/user.py
@@ -127,6 +127,17 @@ def user_create(operation_logger, auth, username, firstname, lastname, mail, pas
     all_existing_usernames = {x.pw_name for x in pwd.getpwall()}
     if username in all_existing_usernames:
         raise MoulinetteError(errno.EEXIST, m18n.n('system_username_exists'))
+        
+    main_domain = _get_maindomain()
+    aliases = [
+        'root@' + main_domain,
+        'admin@' + main_domain,
+        'webmaster@' + main_domain,
+        'postmaster@' + main_domain,
+    ]
+    
+    if mail in aliases:
+        raise MoulinetteError(errno.EEXIST,m18n.n('mail_unavailable'))    
 
     # Check that the mail domain exists
     if mail.split("@")[1] not in domain_list(auth)['domains']:
@@ -166,13 +177,6 @@ def user_create(operation_logger, auth, username, firstname, lastname, mail, pas
 
     # If it is the first user, add some aliases
     if not auth.search(base='ou=users,dc=yunohost,dc=org', filter='uid=*'):
-        main_domain = _get_maindomain()
-        aliases = [
-            'root@' + main_domain,
-            'admin@' + main_domain,
-            'webmaster@' + main_domain,
-            'postmaster@' + main_domain,
-        ]
         attr_dict['mail'] = [attr_dict['mail']] + aliases
 
         # If exists, remove the redirection from the SSO
@@ -306,11 +310,21 @@ def user_update(operation_logger, auth, username, firstname=None, lastname=None,
         new_attr_dict['userPassword'] = _hash_user_password(change_password)
 
     if mail:
+        main_domain = _get_maindomain()
+        aliases = [
+            'root@' + main_domain,
+            'admin@' + main_domain,
+            'webmaster@' + main_domain,
+            'postmaster@' + main_domain,
+        ]
         auth.validate_uniqueness({'mail': mail})
         if mail[mail.find('@') + 1:] not in domains:
             raise MoulinetteError(errno.EINVAL,
                                   m18n.n('mail_domain_unknown',
                                          domain=mail[mail.find('@') + 1:]))
+        if mail in aliases:
+            raise MoulinetteError(errno.EEXIST,m18n.n('mail_unavailable'))
+            
         del user['mail'][0]
         new_attr_dict['mail'] = [mail] + user['mail']