feat(stacks): migrate nuage

stacks/nuage.aibertrand.fr/docker-compose.yml

@@ -0,0 +1,52 @@
+services:
+  db:
+    image: postgres:18
+    restart: always
+    env_file:
+      - env_file
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
+    volumes:
+      # Sans `/data` : postgres:18 a déplacé son PGDATA et déclare son volume
+      # sur /var/lib/postgresql.
+      - db:/var/lib/postgresql/
+    networks:
+      - default
+    labels:
+      - backup.enable=true
+      - backup.type=postgres
+
+  nextcloud:
+    image: nextcloud:33
+    restart: always
+    hostname: nuage.aibertrand.fr
+    depends_on:
+      - db
+    env_file:
+      - env_file
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
+      NEXTCLOUD_ADMIN_PASSWORD: ${NEXTCLOUD_ADMIN_PASSWORD:?}
+    volumes:
+      - data:/var/www/html
+      - ./php/override.ini:/usr/local/etc/php/conf.d/override.ini:ro
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.aicloud.entrypoints=web-secure
+      - traefik.http.routers.aicloud.rule=Host(`nuage.aibertrand.fr`)
+      - traefik.http.routers.aicloud.tls.certresolver=letsencrypt
+      - traefik.http.services.aicloud.loadbalancer.server.port=80
+
+volumes:
+  db:
+  data:
+    labels:
+      - backup.enable=true
+
+networks:
+  traefik-proxy:
+    external: true

stacks/nuage.aibertrand.fr/env_file

@@ -0,0 +1,17 @@
+# Nextcloud + PostgreSQL — configuration non sensible.
+# POSTGRES_PASSWORD et NEXTCLOUD_ADMIN_PASSWORD sont dans secrets.env.yaml.
+
+POSTGRES_HOST=db
+POSTGRES_DB=nextcloud
+POSTGRES_USER=nextcloud
+
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_TRUSTED_DOMAINS=nuage.aibertrand.fr
+
+# Sous-réseau du bridge Docker de cette stack, en dur. Si le réseau est
+# recréé avec un autre sous-réseau, Nextcloud cesse de faire confiance au
+# proxy : les IP clientes deviennent celles de Traefik.
+TRUSTED_PROXIES=172.22.0.0/16
+
+OVERWRITEHOST=nuage.aibertrand.fr
+OVERWRITEPROTOCOL=https

stacks/nuage.aibertrand.fr/php/override.ini

@@ -0,0 +1 @@
+memory_limit=1G

stacks/nuage.aibertrand.fr/secrets.env.yaml

@@ -0,0 +1,26 @@
+POSTGRES_PASSWORD: ENC[AES256_GCM,data:TF0kcYPnhRi6IX4U+LGfEpNkDv4=,iv:b/uLLFua7QJ7yPsnFqDuXoG8a/djrL59Qgk6fURCWoA=,tag:S2SXwqk6rjMFkab/tUfL5Q==,type:str]
+NEXTCLOUD_ADMIN_PASSWORD: ENC[AES256_GCM,data:2bo+0JHBQpdHw9h9DNN+e9rke1PdiQ4UHalgocGS,iv:EqwAk+FKuKcIUpuWpTp36exYF25Qxwoku3xfjegBXhU=,tag:gykV7l5AxpqREv32YqUqxA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVRkwyN3M0ejJxQWxaOGxO
+            Vmw4RzhUVzBjazJQUE9TdkxDYU9RMnJ1OUNRCkR1Ymd1ZFpkVmg4TEpPRWg3NTUr
+            a3l5aGNiOWFpaG1Xa0R3L3dyOUpmeWsKLS0tIGVPOS94WHJxMGF2MUJVSGxaTThV
+            ak5JTFN0ZEtJVzg4YTkvTk9KQ2JoSUkKyYWOzZ2vo1S900Eg0iUA+1pC9jjflsvt
+            mL+JDFo7rM7PamOwZbfrnwopWH2l8lWNVq3xbjd85QhVs315PPeVBQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18m2zl3pwgw97djshzcf4wmhrqxksl4erqse6edkpxpkg5rcz0ujs8u4c7s
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBndDNGZlhqMUQrU1lsZS96
+            dUJNQXEvQWhlL05SRnkvOTlKUDV5MGFJRkNVCk5vWE55NE9LbDkvSm1RcGxqYkN4
+            aW1rbytZait2OEtOYXY4cDlNd1AxbGcKLS0tIE5WOU5UUWwxRVErcCt2cXdtYkF5
+            SnpiNWtFTnd6L3hYMjdlQitBREwvWFUK8T4URC04nuhPCn+AQyOPpkImSBa2jL4k
+            Cvkra5YsR+hnwRO7WovTkWUeDCWJ1G+NSq5gheWbO6Pm7z5JphZb6Q==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fh70nny5hzz8a8g9077kgfca0lhlh3wsjf4fjrv4klx5ucdtpdmsazuqdj
+    lastmodified: "2026-08-13T18:55:58Z"
+    mac: ENC[AES256_GCM,data:yztEewyaMh23v69PEJlNEa2aLfqpw+OO2Kf49pq2cvvGsWZJRGhqSGZ5nxogsTUeMMMoYWBJTlpHslM/hxc116pIToDCy0glXFbtgCxN07xXNcjwOuhhWW8+dR7JH+Yv8mbn5zcqpV43kps2kQIYAnppBMgtgpZV51Z8CbiwECY=,iv:l13s4ZwxZT5iWtyTmGEejnH3CirUzg0bw4w/9CZUt+Y=,tag:/K10XKA5SZooRnvNjsvhJQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3