feat(stacks): migrate nuage

stacks/brodeuse-voyageuse.com/docker-compose.yml

@@ -0,0 +1,56 @@
+# Le dossier a été renommé (il s'appelait `test.brodeuse-voyageuse.com` alors
+# que la stack sert le domaine apex en production). Ce `name:` fige l'ancien
+# nom de projet pour que les volumes existants restent trouvables.
+name: testbrodeuse-voyageusecom
+
+services:
+  db:
+    image: mariadb:12
+    restart: always
+    env_file:
+      - env_file
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?}
+    volumes:
+      - db:/var/lib/mysql
+    networks:
+      - default
+    labels:
+      # Absents jusqu'ici : la base était copiée à chaud, sans dump.
+      - backup.enable=true
+      - backup.type=mariadb
+
+  wordpress:
+    image: wordpress:6.9-php8.4-apache
+    restart: always
+    depends_on:
+      - db
+    env_file:
+      - env_file
+    environment:
+      WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD:?}
+    volumes:
+      - wp:/var/www/html
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.tBV.entrypoints=web-secure
+      - traefik.http.routers.tBV.rule=Host(`brodeuse-voyageuse.com`)
+      - traefik.http.routers.tBV.tls.certresolver=letsencrypt
+      - traefik.http.services.tBV.loadbalancer.server.port=80
+
+volumes:
+  db:
+    labels:
+      - backup.enable=true
+  wp:
+    labels:
+      - backup.enable=true
+
+networks:
+  traefik-proxy:
+    external: true

stacks/brodeuse-voyageuse.com/env_file

@@ -0,0 +1,13 @@
+# WordPress + MariaDB — configuration non sensible.
+# Les trois mots de passe sont dans secrets.env.yaml.
+#
+# Ces noms `MYSQL_*` sont ceux que le script de sauvegarde cherche via
+# `docker exec printenv` pour construire le dump : ne pas les passer aux
+# noms modernes `MARIADB_*` sans adapter tools/backup_docker.sh.
+
+MYSQL_DATABASE=wordpress
+MYSQL_USER=wordpress
+
+WORDPRESS_DB_HOST=db:3306
+WORDPRESS_DB_USER=wordpress
+WORDPRESS_DB_NAME=wordpress

stacks/brodeuse-voyageuse.com/secrets.env.yaml

@@ -0,0 +1,27 @@
+MYSQL_ROOT_PASSWORD: ENC[AES256_GCM,data:yhglwGMXQ+y1L1A69s1fEEDylYpFWjIAsuPzYaUL,iv:+46Ggg9HtbML20fDUelSuiyTqyv851ZZRD4vVaBYCvc=,tag:kv+LoiV19aTtAs8WkUlxPQ==,type:str]
+MYSQL_PASSWORD: ENC[AES256_GCM,data:R7jA3R/1X9ZDqttmcd+qA5qZLId3VW2a5vNXSpzi,iv:cGrppAstRmK8blx5Hn8ax6eTdVVqurTRriotYJc3ACA=,tag:sQ90lI67TYoRWbDqaJBtww==,type:str]
+WORDPRESS_DB_PASSWORD: ENC[AES256_GCM,data:aPGCAnZL4j6KpZK07gyvUOTr3nXQkMAdxTO7NFwC,iv:AzjO68Cg3NcN/hbtaXe2HPH+YmQLBoa/YmRvKqymoaM=,tag:VJ1o8srOT1cCsywgsMJ5GA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaU3p4TElQenZHTEdKWVdV
+            UTdJUEpyQWhIc2pMSTlGZkFPK1crbEV1TW00Cm9UN2JjTTdGZkZxaXovTWlpbjFm
+            QW9OdytBU1ZVTXV3Zk5lanZXZWZFY00KLS0tIDhRcWlEN3hGWjJJTDlWaUdVZ1pE
+            VHZKS2J4WWNpZWlmZ1MveUZrMFBXMlEKXsmQJOtM3/5DOjzx6xfh4dhtfarVWBcR
+            Zm9dEPHQqg6kpZqZy0q6/UsoQd0WPidoaFhekfz/SbLbN2hx1n0b8g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18m2zl3pwgw97djshzcf4wmhrqxksl4erqse6edkpxpkg5rcz0ujs8u4c7s
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuandVYWJwS0tGM3RVZFlZ
+            bDFIajMydi9KWXRwaU5PK1U2cDdoa2l4eDJFCnliSFNpR01rR0Nldmw0VE5MTjdD
+            RldEMnEwMEorU2VSbmVqcjh0akF3Z0EKLS0tIEE5a3hYVnZUSVE4dXZiKzVDbjRj
+            RDhPNVhiNUxKd0pIaVBYWE5PTTZ1VVkKxMOeeOe7EglOs22dZCPX10YcFUaC2eO7
+            GRPSKGaYHfKqbU1cRp1nklE50feHA7mDdYGE3eImsUphrQmrdt49qw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fh70nny5hzz8a8g9077kgfca0lhlh3wsjf4fjrv4klx5ucdtpdmsazuqdj
+    lastmodified: "2026-08-13T18:50:21Z"
+    mac: ENC[AES256_GCM,data:a+IaAanjtL7KSdf68bu8yrhHyObn+5hFWC5xHdq2utHgSZdqmKoMrtz24NfopXfli/Bby9Ryibz1A9yKJCEamz/9F0gFazQBIE7FTmjCF6+zqmjlY8MtX9Y6q7Pl7k/AeWlfH7ZykYuLvbQFS3u59TSNnOsLO7UuEdkeDVPaxUI=,iv:cq5Zl4U33j+fjjrelq50f+STEcRQL8Oq/56HDmIR7j8=,tag:VuDy32LgLGI5QuGN4aptPw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

stacks/nuage.aibertrand.fr/docker-compose.yml

@@ -0,0 +1,52 @@
+services:
+  db:
+    image: postgres:18
+    restart: always
+    env_file:
+      - env_file
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
+    volumes:
+      # Sans `/data` : postgres:18 a déplacé son PGDATA et déclare son volume
+      # sur /var/lib/postgresql.
+      - db:/var/lib/postgresql/
+    networks:
+      - default
+    labels:
+      - backup.enable=true
+      - backup.type=postgres
+
+  nextcloud:
+    image: nextcloud:33
+    restart: always
+    hostname: nuage.aibertrand.fr
+    depends_on:
+      - db
+    env_file:
+      - env_file
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
+      NEXTCLOUD_ADMIN_PASSWORD: ${NEXTCLOUD_ADMIN_PASSWORD:?}
+    volumes:
+      - data:/var/www/html
+      - ./php/override.ini:/usr/local/etc/php/conf.d/override.ini:ro
+    networks:
+      - default
+      - traefik-proxy
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik-proxy
+      - traefik.http.routers.aicloud.entrypoints=web-secure
+      - traefik.http.routers.aicloud.rule=Host(`nuage.aibertrand.fr`)
+      - traefik.http.routers.aicloud.tls.certresolver=letsencrypt
+      - traefik.http.services.aicloud.loadbalancer.server.port=80
+
+volumes:
+  db:
+  data:
+    labels:
+      - backup.enable=true
+
+networks:
+  traefik-proxy:
+    external: true

stacks/nuage.aibertrand.fr/env_file

@@ -0,0 +1,17 @@
+# Nextcloud + PostgreSQL — configuration non sensible.
+# POSTGRES_PASSWORD et NEXTCLOUD_ADMIN_PASSWORD sont dans secrets.env.yaml.
+
+POSTGRES_HOST=db
+POSTGRES_DB=nextcloud
+POSTGRES_USER=nextcloud
+
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_TRUSTED_DOMAINS=nuage.aibertrand.fr
+
+# Sous-réseau du bridge Docker de cette stack, en dur. Si le réseau est
+# recréé avec un autre sous-réseau, Nextcloud cesse de faire confiance au
+# proxy : les IP clientes deviennent celles de Traefik.
+TRUSTED_PROXIES=172.22.0.0/16
+
+OVERWRITEHOST=nuage.aibertrand.fr
+OVERWRITEPROTOCOL=https

stacks/nuage.aibertrand.fr/php/override.ini

@@ -0,0 +1 @@
+memory_limit=1G

stacks/nuage.aibertrand.fr/secrets.env.yaml

@@ -0,0 +1,26 @@
+POSTGRES_PASSWORD: ENC[AES256_GCM,data:TF0kcYPnhRi6IX4U+LGfEpNkDv4=,iv:b/uLLFua7QJ7yPsnFqDuXoG8a/djrL59Qgk6fURCWoA=,tag:S2SXwqk6rjMFkab/tUfL5Q==,type:str]
+NEXTCLOUD_ADMIN_PASSWORD: ENC[AES256_GCM,data:2bo+0JHBQpdHw9h9DNN+e9rke1PdiQ4UHalgocGS,iv:EqwAk+FKuKcIUpuWpTp36exYF25Qxwoku3xfjegBXhU=,tag:gykV7l5AxpqREv32YqUqxA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVRkwyN3M0ejJxQWxaOGxO
+            Vmw4RzhUVzBjazJQUE9TdkxDYU9RMnJ1OUNRCkR1Ymd1ZFpkVmg4TEpPRWg3NTUr
+            a3l5aGNiOWFpaG1Xa0R3L3dyOUpmeWsKLS0tIGVPOS94WHJxMGF2MUJVSGxaTThV
+            ak5JTFN0ZEtJVzg4YTkvTk9KQ2JoSUkKyYWOzZ2vo1S900Eg0iUA+1pC9jjflsvt
+            mL+JDFo7rM7PamOwZbfrnwopWH2l8lWNVq3xbjd85QhVs315PPeVBQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18m2zl3pwgw97djshzcf4wmhrqxksl4erqse6edkpxpkg5rcz0ujs8u4c7s
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBndDNGZlhqMUQrU1lsZS96
+            dUJNQXEvQWhlL05SRnkvOTlKUDV5MGFJRkNVCk5vWE55NE9LbDkvSm1RcGxqYkN4
+            aW1rbytZait2OEtOYXY4cDlNd1AxbGcKLS0tIE5WOU5UUWwxRVErcCt2cXdtYkF5
+            SnpiNWtFTnd6L3hYMjdlQitBREwvWFUK8T4URC04nuhPCn+AQyOPpkImSBa2jL4k
+            Cvkra5YsR+hnwRO7WovTkWUeDCWJ1G+NSq5gheWbO6Pm7z5JphZb6Q==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fh70nny5hzz8a8g9077kgfca0lhlh3wsjf4fjrv4klx5ucdtpdmsazuqdj
+    lastmodified: "2026-08-13T18:55:58Z"
+    mac: ENC[AES256_GCM,data:yztEewyaMh23v69PEJlNEa2aLfqpw+OO2Kf49pq2cvvGsWZJRGhqSGZ5nxogsTUeMMMoYWBJTlpHslM/hxc116pIToDCy0glXFbtgCxN07xXNcjwOuhhWW8+dR7JH+Yv8mbn5zcqpV43kps2kQIYAnppBMgtgpZV51Z8CbiwECY=,iv:l13s4ZwxZT5iWtyTmGEejnH3CirUzg0bw4w/9CZUt+Y=,tag:/K10XKA5SZooRnvNjsvhJQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3