From 5430eb19fc10800316b0fcf1647a24d4d4dfb80a Mon Sep 17 00:00:00 2001
From: Bertrand Benjamin <benjamin.bertrand@opytex.org>
Date: Thu, 13 Aug 2026 21:10:17 +0200
Subject: [PATCH] feat(stacks): migrate brodeuse-voyageuse

---
 .../brodeuse-voyageuse.com/docker-compose.yml | 56 +++++++++++++++++++
 stacks/brodeuse-voyageuse.com/env_file        | 13 +++++
 .../brodeuse-voyageuse.com/secrets.env.yaml   | 27 +++++++++
 3 files changed, 96 insertions(+)
 create mode 100644 stacks/brodeuse-voyageuse.com/docker-compose.yml
 create mode 100644 stacks/brodeuse-voyageuse.com/env_file
 create mode 100644 stacks/brodeuse-voyageuse.com/secrets.env.yaml

diff --git a/stacks/brodeuse-voyageuse.com/docker-compose.yml b/stacks/brodeuse-voyageuse.com/docker-compose.yml
new file mode 100644
index 0000000..f1204b2
--- /dev/null
+++ b/stacks/brodeuse-voyageuse.com/docker-compose.yml
@@ -0,0 +1,56 @@
+# Le dossier a été renommé (il s'appelait `test.brodeuse-voyageuse.com` alors
+# que la stack sert le domaine apex en production). Ce `name:` fige l'ancien
+# nom de projet pour que les volumes existants restent trouvables.
+name: testbrodeuse-voyageusecom
+
+services:
+  db:
+    image: mariadb:12
+    restart: always
+    env_file:
+      - env_file
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?}
+    volumes:
+      - db:/var/lib/mysql
+    networks:
+      - default
+    labels:
+      # Absents jusqu'ici : la base était copiée à chaud, sans dump.
+      - backup.enable=true
+      - backup.type=mariadb
+
+  wordpress:
+    image: wordpress:6.9-php8.4-apache
+    restart: always
+    depends_on:
+      - db
+    env_file:
+      - env_file
+    environment:
+      WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD:?}
+    volumes:
+      - wp:/var/www/html
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.tBV.entrypoints=web-secure
+      - traefik.http.routers.tBV.rule=Host(`brodeuse-voyageuse.com`)
+      - traefik.http.routers.tBV.tls.certresolver=letsencrypt
+      - traefik.http.services.tBV.loadbalancer.server.port=80
+
+volumes:
+  db:
+    labels:
+      - backup.enable=true
+  wp:
+    labels:
+      - backup.enable=true
+
+networks:
+  traefik-proxy:
+    external: true
diff --git a/stacks/brodeuse-voyageuse.com/env_file b/stacks/brodeuse-voyageuse.com/env_file
new file mode 100644
index 0000000..9fa1306
--- /dev/null
+++ b/stacks/brodeuse-voyageuse.com/env_file
@@ -0,0 +1,13 @@
+# WordPress + MariaDB — configuration non sensible.
+# Les trois mots de passe sont dans secrets.env.yaml.
+#
+# Ces noms `MYSQL_*` sont ceux que le script de sauvegarde cherche via
+# `docker exec printenv` pour construire le dump : ne pas les passer aux
+# noms modernes `MARIADB_*` sans adapter tools/backup_docker.sh.
+
+MYSQL_DATABASE=wordpress
+MYSQL_USER=wordpress
+
+WORDPRESS_DB_HOST=db:3306
+WORDPRESS_DB_USER=wordpress
+WORDPRESS_DB_NAME=wordpress
diff --git a/stacks/brodeuse-voyageuse.com/secrets.env.yaml b/stacks/brodeuse-voyageuse.com/secrets.env.yaml
new file mode 100644
index 0000000..a694207
--- /dev/null
+++ b/stacks/brodeuse-voyageuse.com/secrets.env.yaml
@@ -0,0 +1,27 @@
+MYSQL_ROOT_PASSWORD: ENC[AES256_GCM,data:yhglwGMXQ+y1L1A69s1fEEDylYpFWjIAsuPzYaUL,iv:+46Ggg9HtbML20fDUelSuiyTqyv851ZZRD4vVaBYCvc=,tag:kv+LoiV19aTtAs8WkUlxPQ==,type:str]
+MYSQL_PASSWORD: ENC[AES256_GCM,data:R7jA3R/1X9ZDqttmcd+qA5qZLId3VW2a5vNXSpzi,iv:cGrppAstRmK8blx5Hn8ax6eTdVVqurTRriotYJc3ACA=,tag:sQ90lI67TYoRWbDqaJBtww==,type:str]
+WORDPRESS_DB_PASSWORD: ENC[AES256_GCM,data:aPGCAnZL4j6KpZK07gyvUOTr3nXQkMAdxTO7NFwC,iv:AzjO68Cg3NcN/hbtaXe2HPH+YmQLBoa/YmRvKqymoaM=,tag:VJ1o8srOT1cCsywgsMJ5GA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaU3p4TElQenZHTEdKWVdV
+            UTdJUEpyQWhIc2pMSTlGZkFPK1crbEV1TW00Cm9UN2JjTTdGZkZxaXovTWlpbjFm
+            QW9OdytBU1ZVTXV3Zk5lanZXZWZFY00KLS0tIDhRcWlEN3hGWjJJTDlWaUdVZ1pE
+            VHZKS2J4WWNpZWlmZ1MveUZrMFBXMlEKXsmQJOtM3/5DOjzx6xfh4dhtfarVWBcR
+            Zm9dEPHQqg6kpZqZy0q6/UsoQd0WPidoaFhekfz/SbLbN2hx1n0b8g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18m2zl3pwgw97djshzcf4wmhrqxksl4erqse6edkpxpkg5rcz0ujs8u4c7s
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuandVYWJwS0tGM3RVZFlZ
+            bDFIajMydi9KWXRwaU5PK1U2cDdoa2l4eDJFCnliSFNpR01rR0Nldmw0VE5MTjdD
+            RldEMnEwMEorU2VSbmVqcjh0akF3Z0EKLS0tIEE5a3hYVnZUSVE4dXZiKzVDbjRj
+            RDhPNVhiNUxKd0pIaVBYWE5PTTZ1VVkKxMOeeOe7EglOs22dZCPX10YcFUaC2eO7
+            GRPSKGaYHfKqbU1cRp1nklE50feHA7mDdYGE3eImsUphrQmrdt49qw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fh70nny5hzz8a8g9077kgfca0lhlh3wsjf4fjrv4klx5ucdtpdmsazuqdj
+    lastmodified: "2026-08-13T18:50:21Z"
+    mac: ENC[AES256_GCM,data:a+IaAanjtL7KSdf68bu8yrhHyObn+5hFWC5xHdq2utHgSZdqmKoMrtz24NfopXfli/Bby9Ryibz1A9yKJCEamz/9F0gFazQBIE7FTmjCF6+zqmjlY8MtX9Y6q7Pl7k/AeWlfH7ZykYuLvbQFS3u59TSNnOsLO7UuEdkeDVPaxUI=,iv:cq5Zl4U33j+fjjrelq50f+STEcRQL8Oq/56HDmIR7j8=,tag:VuDy32LgLGI5QuGN4aptPw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3