diff --git a/stacks/photos.opytex.org/docker-compose.yml b/stacks/photos.opytex.org/docker-compose.yml
new file mode 100644
index 0000000..708112b
--- /dev/null
+++ b/stacks/photos.opytex.org/docker-compose.yml
@@ -0,0 +1,84 @@
+# Le nom de projet ne suit PAS le dossier : les volumes existants sont
+# préfixés `immich_`. Retirer cette ligne rendrait la photothèque invisible.
+name: immich
+
+services:
+  immich-server:
+    image: ghcr.io/immich-app/immich-server:v2.2.1
+    container_name: immich_server
+    restart: always
+    volumes:
+      - immich_upload:/data
+      - /etc/localtime:/etc/localtime:ro
+    env_file:
+      - env_file
+    environment:
+      DB_PASSWORD: ${DB_PASSWORD:?}
+    depends_on:
+      - redis
+      - database
+    healthcheck:
+      disable: false
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.immich.entrypoints=web-secure
+      - traefik.http.routers.immich.rule=Host(`photos.opytex.org`)
+      - traefik.http.routers.immich.tls.certresolver=letsencrypt
+      - traefik.http.services.immich.loadbalancer.server.port=2283
+
+  immich-machine-learning:
+    image: ghcr.io/immich-app/immich-machine-learning:v2.2.1
+    container_name: immich_machine_learning
+    restart: always
+    volumes:
+      - model-cache:/cache
+    env_file:
+      - env_file
+    healthcheck:
+      disable: false
+    networks:
+      - default
+
+  redis:
+    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
+    container_name: immich_redis
+    restart: always
+    healthcheck:
+      test: redis-cli ping || exit 1
+    networks:
+      - default
+
+  database:
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    container_name: immich_postgres
+    restart: always
+    environment:
+      # En dur : `env_file:` n'alimente pas l'interpolation ${...}, ces trois
+      # valeurs doivent être lisibles ici. Seul le mot de passe vient de sops.
+      POSTGRES_USER: postgres
+      POSTGRES_DB: immich
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?}
+      POSTGRES_INITDB_ARGS: "--data-checksums"
+    volumes:
+      - db:/var/lib/postgresql/data
+    shm_size: 128mb
+    networks:
+      - default
+    labels:
+      backup.enable: true
+      backup.type: postgres
+
+volumes:
+  model-cache:
+  immich_upload:
+    labels:
+      backup.enable: true
+  db:
+
+networks:
+  traefik-proxy:
+    external: true
diff --git a/stacks/photos.opytex.org/env_file b/stacks/photos.opytex.org/env_file
new file mode 100644
index 0000000..3308823
--- /dev/null
+++ b/stacks/photos.opytex.org/env_file
@@ -0,0 +1,9 @@
+# Immich — configuration non sensible.
+# DB_PASSWORD est dans secrets.env.yaml.
+#
+# UPLOAD_LOCATION et DB_DATA_LOCATION, présents dans l'ancien .env, ne sont
+# pas repris : ce compose utilise des volumes nommés, pas les bind mounts du
+# compose amont, et ces deux variables n'étaient donc lues par personne.
+
+DB_USERNAME=postgres
+DB_DATABASE_NAME=immich
diff --git a/stacks/photos.opytex.org/secrets.env.yaml b/stacks/photos.opytex.org/secrets.env.yaml
new file mode 100644
index 0000000..04d086c
--- /dev/null
+++ b/stacks/photos.opytex.org/secrets.env.yaml
@@ -0,0 +1,25 @@
+DB_PASSWORD: ENC[AES256_GCM,data:Qn9XIoBiNCmc+4UZNfXm115/rF04lEJBO62JRNLHtfOs9WoTaz0K06LgPNFL88YCI1A=,iv:kvMJfhv30BJS6d8U9IDppki5ua0sTt6dbbfcWzJI18o=,tag:mNVCECKVHkH6bS7JmaFNhw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwUW0wOGFSUGUwRVVUeDRF
+            UTduTEIxMGdwcW1ieEpja3M4amV6SVJoMUhrCjlGZVFGMFc5dDRQM0dOMytPeEdp
+            RXZqbHpJV2prYjRybG0wQ2JkWnh3S0UKLS0tIFN0U3NERjdOU3FxdlBxS2NJdU80
+            NlRTUWZCd3lnc2lseEZJRjlBMTZFQW8KqyNE3WGK7ExTQ+CYvW0H4U5NMbNQdyaX
+            Tzk0/3X3r2jCBRwVl1Tdj2OL65+SA0mDjnjyD0J5YsC0JB33SIeUaQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18m2zl3pwgw97djshzcf4wmhrqxksl4erqse6edkpxpkg5rcz0ujs8u4c7s
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVkdRQ2FUbmpIMW5UQ2F5
+            TmhsU1gzTkxYWWVQektteGdnNkFRVzJ4eVdjCk5uaXk4YTRNK3ZpbzRZNEliVnFH
+            MzZMLzdmaWhMV1VDUXVteEwra3o5d00KLS0tIGZoOGtydUtpN01YbG1ZckdlMGVa
+            VktyYlBOMThkQ0RxVGsrZXNoYThtVmsKrHVtCsBB+OSo1aMHlmqz9oMy0nCFJVfa
+            TzxOt2VIexjX3Qu4x/VP0E000Dgme8KdU7EW8QRhxQd4VCeRCP0ICg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fh70nny5hzz8a8g9077kgfca0lhlh3wsjf4fjrv4klx5ucdtpdmsazuqdj
+    lastmodified: "2026-08-13T14:15:16Z"
+    mac: ENC[AES256_GCM,data:cgvXcNRZr8G0l0WVpaxY6TG3lAuRLSIEY467Oudb/qsLOnSADnK8xoOXLTwyqcIb4HYmFhB9ZOdWjY3rq6bnuRXEdVUm79I0tJs82kGg5+hPGpit0vpyuk14jbF40fjfkgY3FMvPurT1IU2ulnJX+jKjyL0J2EQMlxGFaDn+U7M=,iv:5IRGdFcVR5pN5F+ubCmlhSeYk9ivUKUS0QCjX0zMHPs=,tag:9tcjMv7ZG63JZ2Z/aT1+pA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3