deploiement de snowshare

inventory/hosts.ini

@@ -14,3 +14,19 @@ docker-test ansible_host=10.100.5.90 ansible_user=ansible ansible_python_interpr
 [tracearr_servers]
 tracearr ansible_host=10.100.5.102 ansible_user=ansible ansible_python_interpreter=/usr/bin/python3
 # END ANSIBLE MANAGED tracearr
+# BEGIN ANSIBLE MANAGED stirling-pdf
+[stirling_pdf_servers]
+stirling-pdf ansible_host=10.100.5.105 ansible_user=ansible ansible_python_interpreter=/usr/bin/python3
+# END ANSIBLE MANAGED stirling-pdf
+# BEGIN ANSIBLE MANAGED passwordpusher
+[passwordpusher_servers]
+passwordpusher ansible_host=10.100.5.104 ansible_user=ansible ansible_python_interpreter=/usr/bin/python3
+# END ANSIBLE MANAGED passwordpusher
+# BEGIN ANSIBLE MANAGED immich
+[immich_servers]
+immich ansible_host=10.100.5.111 ansible_user=ansible ansible_python_interpreter=/usr/bin/python3
+# END ANSIBLE MANAGED immich
+# BEGIN ANSIBLE MANAGED snowshare
+[snowshare_servers]
+snowshare ansible_host=10.100.5.112 ansible_user=ansible ansible_python_interpreter=/usr/bin/python3
+# END ANSIBLE MANAGED snowshare

playbooks/create-lxc.yml

@@ -1,5 +1,5 @@
 ---
-# Playbook: create-docker-lxc.yml
+# Playbook: create-docker.yml
 #
 # But:
 # - Creer un conteneur LXC Proxmox pret pour Docker
@@ -21,18 +21,18 @@
 #   -e lxc_disk=20 \
 #   -e lxc_inventory_group=tracearr_servers
 
-- name: Creer un LXC pret pour Docker
+- name: Creer un LXC pret
   hosts: "{{ target_node }}"
   become: false
   gather_facts: false
 
   vars:
     # Identite du conteneur LXC
-    lxc_ctid: 900
-    lxc_hostname: docker-test
+    lxc_ctid: 111
+    lxc_hostname: immichprod
 
     # Configuration reseau du conteneur
-    lxc_ip: 10.100.5.90/24
+    lxc_ip: 10.100.5.111/24
     lxc_gateway: 10.100.5.1
     lxc_bridge: vmbr0
 
@@ -46,10 +46,10 @@
     lxc_template: debian-13-standard_13.1-2_amd64.tar.zst
 
     # Ressources du conteneur
-    lxc_cores: 1
-    lxc_memory: 512
-    lxc_swap: 512
-    lxc_disk: 8
+    lxc_cores: 2
+    lxc_memory: 2048
+    lxc_swap: 1024
+    lxc_disk: 250
 
     # IP du serveur Ansible
     # Cette IP sera utilisee dans authorized_keys pour limiter la cle SSH
@@ -60,7 +60,7 @@
 
     # Groupe Ansible ajoute dans inventory/hosts.ini
     # Exemple:
-    # lxc_hostname=tracearr -> tracearr_servers
+    # lxc_hostname=tracearr -> immich_servers
     lxc_inventory_group: "{{ lxc_hostname | replace('-', '_') }}_servers"
 
     # Parametres Ansible du futur conteneur
@@ -218,6 +218,29 @@
       delegate_to: localhost
       become: false
 
+    - name: Supprimer l ancienne cle SSH connue
+      known_hosts:
+        name: "{{ lxc_ip_address }}"
+        state: absent
+      delegate_to: localhost
+      become: false
+
+    - name: Scanner la nouvelle cle SSH du LXC
+      command: ssh-keyscan -H {{ lxc_ip_address }}
+      register: lxc_ssh_keyscan
+      changed_when: false
+      delegate_to: localhost
+      become: false
+
+    - name: Ajouter la nouvelle cle SSH du LXC dans known_hosts
+      known_hosts:
+        name: "{{ lxc_ip_address }}"
+        key: "{{ item }}"
+        state: present
+      loop: "{{ lxc_ssh_keyscan.stdout_lines }}"
+      delegate_to: localhost
+      become: false
+
     # Ajout automatique du nouveau LXC dans inventory/hosts.ini.
     #
     # blockinfile evite les doublons:

playbooks/deploy-immich.yml

@@ -0,0 +1,125 @@
+---
+# Playbook: deploy-immich.yml
+#
+# But:
+# - Deployer Immich dans le LXC immich
+# - Copier le docker-compose.yml depuis Git
+# - Verifier que le fichier .env.runtime existe deja sur le LXC
+# - Creer les dossiers runtime locaux
+# - Demarrer la stack Docker Compose
+# - Verifier que le port 2283 repond
+#
+# Important:
+# - Le fichier .env.runtime ne doit pas etre dans Git
+# - Le fichier .env.runtime doit etre sur le LXC:
+#   /opt/stacks/immich/.env.runtime
+# - Ce playbook ne touche pas encore aux bibliotheques NAS
+
+- name: Deployer Immich
+  hosts: immich_servers
+  become: true
+  gather_facts: false
+
+  vars:
+    stack_name: immich
+    stack_path: /opt/stacks/immich
+    compose_source: "{{ playbook_dir }}/../services/immich/docker-compose.yml"
+
+  tasks:
+    - name: Verifier que Docker est installe
+      command: docker --version
+      changed_when: false
+
+    - name: Verifier que Docker Compose est installe
+      command: docker compose version
+      changed_when: false
+
+    - name: Creer le dossier de la stack
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Creer le dossier library Immich
+      file:
+        path: "{{ stack_path }}/library"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Creer le dossier postgres Immich
+      file:
+        path: "{{ stack_path }}/postgres"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Verifier que le fichier env runtime existe
+      stat:
+        path: "{{ stack_path }}/.env.runtime"
+      register: immich_env_runtime
+
+    - name: Arreter si le fichier env runtime est absent
+      fail:
+        msg: "Le fichier {{ stack_path }}/.env.runtime est absent. Il doit etre cree sur le LXC, pas dans Git."
+      when: not immich_env_runtime.stat.exists
+
+    - name: Securiser le fichier env runtime
+      file:
+        path: "{{ stack_path }}/.env.runtime"
+        owner: root
+        group: root
+        mode: "0600"
+        
+    - name: Creer le lien env pour Docker Compose
+      file:
+        src: "{{ stack_path }}/.env.runtime"
+        dest: "{{ stack_path }}/.env"
+        state: link
+        owner: root
+        group: root
+
+    - name: Copier le fichier Docker Compose
+      copy:
+        src: "{{ compose_source }}"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Valider la configuration Docker Compose
+      command: docker compose config
+      args:
+        chdir: "{{ stack_path }}"
+      changed_when: false
+
+    - name: Telecharger les images Docker
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Demarrer la stack Immich
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Attendre le port Immich
+      wait_for:
+        host: 127.0.0.1
+        port: 2283
+        timeout: 300
+
+    - name: Afficher les conteneurs de la stack
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Afficher le statut Docker Compose
+      debug:
+        var: compose_ps.stdout_lines

playbooks/deploy-snowshare.yml

@@ -0,0 +1,118 @@
+---
+# Playbook: deploy-snowshare.yml
+#
+# But:
+# - Deployer Snowshare dans le LXC snowshare
+# - Copier le docker-compose.yml depuis Git
+# - Generer .env.runtime si absent
+# - Creer un lien .env pour Docker Compose
+# - Demarrer la stack Docker Compose
+# - Verifier que le port 3000 repond
+#
+# Important:
+# - Les secrets ne doivent pas etre dans Git
+# - Le fichier .env.runtime reste sur le LXC
+
+- name: Deployer Snowshare
+  hosts: snowshare_servers
+  become: true
+  gather_facts: false
+
+  vars:
+    stack_name: snowshare
+    stack_path: /opt/stacks/snowshare
+    compose_source: "{{ playbook_dir }}/../services/snowshare/docker-compose.yml"
+    snowshare_domain: snowshare.thomasmlg.fr
+
+  tasks:
+    - name: Verifier que Docker est installe
+      command: docker --version
+      changed_when: false
+
+    - name: Verifier que Docker Compose est installe
+      command: docker compose version
+      changed_when: false
+
+    - name: Creer le dossier de la stack
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Generer le fichier env runtime si absent
+      shell: |
+        set -e
+        umask 077
+
+        if [ ! -f "{{ stack_path }}/.env.runtime" ]; then
+          POSTGRES_PASSWORD="$(openssl rand -hex 32)"
+          NEXTAUTH_SECRET="$(openssl rand -hex 32)"
+
+          {
+            printf 'POSTGRES_USER=snowshare\n'
+            printf 'POSTGRES_PASSWORD=%s\n' "$POSTGRES_PASSWORD"
+            printf 'POSTGRES_DB=snowshare\n'
+            printf 'DATABASE_URL=postgres://snowshare:%s@db:5432/snowshare\n' "$POSTGRES_PASSWORD"
+            printf 'NEXTAUTH_URL=https://{{ snowshare_domain }}\n'
+            printf 'NEXTAUTH_SECRET=%s\n' "$NEXTAUTH_SECRET"
+            printf 'ALLOW_SIGNUP=true\n'
+          } > "{{ stack_path }}/.env.runtime"
+        fi
+
+        chown root:root "{{ stack_path }}/.env.runtime"
+        chmod 600 "{{ stack_path }}/.env.runtime"
+      args:
+        executable: /bin/bash
+      no_log: true
+      changed_when: true
+
+    - name: Creer le lien env pour Docker Compose
+      file:
+        src: "{{ stack_path }}/.env.runtime"
+        dest: "{{ stack_path }}/.env"
+        state: link
+        owner: root
+        group: root
+
+    - name: Copier le fichier Docker Compose
+      copy:
+        src: "{{ compose_source }}"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Valider la configuration Docker Compose
+      command: docker compose config
+      args:
+        chdir: "{{ stack_path }}"
+      changed_when: false
+
+    - name: Telecharger les images Docker
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Demarrer la stack Snowshare
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Attendre le port Snowshare
+      wait_for:
+        host: 127.0.0.1
+        port: 3000
+        timeout: 180
+
+    - name: Afficher les conteneurs de la stack
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Afficher le statut Docker Compose
+      debug:
+        var: compose_ps.stdout_lines

playbooks/deploy-stirling-pdf.yml

@@ -0,0 +1,94 @@
+---
+# Playbook: deploy-stirling-pdf.yml
+#
+# But:
+# - Copier le docker-compose.yml Stirling PDF sur le LXC
+# - Creer les dossiers de donnees
+# - Demarrer la stack Docker Compose
+# - Verifier que le port 8080 repond
+#
+# Le docker-compose.yml reste dans Git.
+# Les donnees de Stirling PDF restent sur le LXC dans /opt/stacks/stirling-pdf.
+
+- name: Deployer Stirling PDF
+  hosts: stirling_pdf_servers
+  become: true
+  gather_facts: false
+
+  vars:
+    stack_name: stirling-pdf
+    stack_path: /opt/stacks/stirling-pdf
+    compose_source: "{{ playbook_dir }}/../services/stirling-pdf/docker-compose.yml"
+
+  tasks:
+    - name: Verifier que Docker est installe
+      command: docker --version
+      changed_when: false
+
+    - name: Verifier que Docker Compose est installe
+      command: docker compose version
+      changed_when: false
+
+    - name: Creer le dossier de la stack
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Creer le dossier de donnees
+      file:
+        path: "{{ stack_path }}/stirling-data"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Creer les sous dossiers de donnees
+      file:
+        path: "{{ stack_path }}/stirling-data/{{ item }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+      loop:
+        - tessdata
+        - configs
+        - logs
+        - pipeline
+
+    - name: Copier le fichier Docker Compose
+      copy:
+        src: "{{ compose_source }}"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Telecharger les images Docker
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Demarrer la stack Stirling PDF
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Attendre le port Stirling PDF
+      wait_for:
+        host: 127.0.0.1
+        port: 8080
+        timeout: 180
+
+    - name: Afficher les conteneurs de la stack
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Afficher le statut Docker Compose
+      debug:
+        var: compose_ps.stdout_lines

playbooks/deploy-tracearr.yml

@@ -0,0 +1,106 @@
+---
+# Playbook: deploy-tracearr.yml
+#
+# But:
+# - Copier le docker-compose.yml Tracearr sur le LXC
+# - Generer les secrets si absents
+# - Demarrer la stack Tracearr
+# - Verifier que le port 3000 repond
+#
+# Les secrets sont crees directement sur le LXC.
+# Ils ne sont pas stockes dans Git.
+
+- name: Deploy Tracearr stack
+  hosts: tracearr_servers
+  become: true
+  gather_facts: false
+
+  vars:
+    stack_name: tracearr
+    stack_path: /opt/stacks/tracearr
+
+  tasks:
+    - name: Create stack directory
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Create secrets directory
+      file:
+        path: "{{ stack_path }}/secrets"
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Copy Docker Compose file
+      copy:
+        src: "{{ playbook_dir }}/../services/tracearr/docker-compose.yml"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Generate Tracearr secrets if missing
+      shell: |
+        set -e
+        umask 077
+
+        if [ ! -s "{{ stack_path }}/secrets/db_password" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/db_password"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/jwt_secret" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/jwt_secret"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/cookie_secret" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/cookie_secret"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/better_auth_secret" ]; then
+          openssl rand -hex 32 > "{{ stack_path }}/secrets/better_auth_secret"
+        fi
+
+        if [ ! -s "{{ stack_path }}/secrets/database_url" ]; then
+          DB_PASSWORD="$(cat "{{ stack_path }}/secrets/db_password")"
+          printf "postgres://tracearr:%s@timescale:5432/tracearr" "$DB_PASSWORD" > "{{ stack_path }}/secrets/database_url"
+        fi
+
+        chown -R root:root "{{ stack_path }}/secrets"
+        chmod 700 "{{ stack_path }}/secrets"
+        chmod 644 "{{ stack_path }}/secrets/"*
+      args:
+        executable: /bin/bash
+      no_log: true
+      changed_when: true
+
+    - name: Pull Tracearr stack images
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Start Tracearr stack
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Wait for Tracearr port
+      wait_for:
+        host: 127.0.0.1
+        port: 3000
+        timeout: 180
+
+    - name: Show Tracearr containers
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Show compose status
+      debug:
+        var: compose_ps.stdout_lines

playbooks/deploy_passwordpusher.yml

@@ -0,0 +1,117 @@
+---
+# Playbook: deploy-passwordpusher.yml
+#
+# But:
+# - Copier le docker-compose.yml Password Pusher sur le LXC
+# - Generer le fichier .env.runtime sur le LXC si absent
+# - Garder les secrets hors Git
+# - Demarrer la stack Docker Compose
+# - Verifier que le port 5100 repond
+
+- name: Deployer Password Pusher
+  hosts: passwordpusher_servers
+  become: true
+  gather_facts: false
+
+  vars_prompt:
+    - name: smtp_address
+      prompt: "SMTP address"
+      private: false
+
+    - name: smtp_user
+      prompt: "SMTP username"
+      private: false
+
+    - name: smtp_password
+      prompt: "SMTP password"
+      private: true
+
+  vars:
+    stack_name: passwordpusher
+    stack_path: /opt/stacks/passwordpusher
+    compose_source: "{{ playbook_dir }}/../services/passwordpusher/docker-compose.yml"
+
+  tasks:
+    - name: Verifier que Docker est installe
+      command: docker --version
+      changed_when: false
+
+    - name: Verifier que Docker Compose est installe
+      command: docker compose version
+      changed_when: false
+
+    - name: Creer le dossier de la stack
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Creer le dossier de stockage
+      file:
+        path: "{{ stack_path }}/storage"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Generer le fichier env runtime si absent
+      shell: |
+        set -e
+        umask 077
+
+        if [ ! -f "{{ stack_path }}/.env.runtime" ]; then
+          SECRET_KEY_BASE="$(openssl rand -hex 64)"
+          PWPUSH_MASTER_KEY="$(openssl rand -hex 32)"
+
+          {
+            printf 'SECRET_KEY_BASE=%s\n' "$SECRET_KEY_BASE"
+            printf 'PWPUSH_MASTER_KEY=%s\n' "$PWPUSH_MASTER_KEY"
+            printf 'PWP__MAIL__SMTP_ADDRESS=%s\n' "{{ smtp_address }}"
+            printf 'PWP__MAIL__SMTP_USER_NAME=%s\n' "{{ smtp_user }}"
+            printf 'PWP__MAIL__SMTP_PASSWORD=%s\n' "{{ smtp_password }}"
+          } > "{{ stack_path }}/.env.runtime"
+        fi
+
+        chown root:root "{{ stack_path }}/.env.runtime"
+        chmod 600 "{{ stack_path }}/.env.runtime"
+      args:
+        executable: /bin/bash
+      no_log: true
+      changed_when: true
+      
+    - name: Copier le fichier Docker Compose
+      copy:
+        src: "{{ compose_source }}"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Telecharger les images Docker
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Demarrer la stack Password Pusher
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Attendre le port Password Pusher
+      wait_for:
+        host: 127.0.0.1
+        port: 5100
+        timeout: 180
+
+    - name: Afficher les conteneurs de la stack
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Afficher le statut Docker Compose
+      debug:
+        var: compose_ps.stdout_lines

services/immich/docker-compose.yml

@@ -0,0 +1,72 @@
+---
+services:
+  immich-server:
+    container_name: immich_server
+    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    restart: unless-stopped
+
+    volumes:
+      - ${UPLOAD_LOCATION}:/usr/src/app/upload
+      - /home/Immich:/mnt/photos:ro
+      - /etc/localtime:/etc/localtime:ro
+
+    env_file:
+      - .env.runtime
+
+    ports:
+      - "2283:2283"
+
+    depends_on:
+      - redis
+      - database
+
+    healthcheck:
+      disable: false
+
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    restart: unless-stopped
+
+    volumes:
+      - model-cache:/cache
+
+    env_file:
+      - .env.runtime
+
+    healthcheck:
+      disable: false
+
+  redis:
+    container_name: immich_redis
+    image: docker.io/redis:7-alpine
+    restart: unless-stopped
+
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+
+  database:
+    container_name: immich_postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
+    restart: unless-stopped
+
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: "--data-checksums"
+
+    volumes:
+      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
+
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME} -d ${DB_DATABASE_NAME}"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+
+volumes:
+  model-cache:

services/passwordpusher/docker-compose.yml

@@ -0,0 +1,84 @@
+---
+services:
+  passwordpusher:
+    image: docker.io/pglombardo/pwpush:stable
+    container_name: passwordpusher
+    restart: unless-stopped
+    platform: linux/amd64
+
+    ports:
+      - "5100:5100"
+
+    env_file:
+      - .env.runtime
+
+    environment:
+      TZ: Europe/Paris
+
+      # URL publique via Caddy
+      PWP__HOST_DOMAIN: passwordpusher.thomasmlg.fr
+      PWP__HOST_PROTOCOL: https
+      PWP__OVERRIDE_BASE_URL: https://passwordpusher.thomasmlg.fr
+      PWP__ALLOWED_HOSTS: "passwordpusher.thomasmlg.fr passwordpusher.thomasmlg.fr:443 10.100.5.104 10.100.5.104:5100 localhost localhost:5100"
+
+      # Cookies securises car l acces public passe par HTTPS via Caddy
+      PWP__SECURE_COOKIES: "true"
+
+      # Pas d acces anonyme
+      PWP__ALLOW_ANONYMOUS: "false"
+
+      # Phase initiale: inscriptions ouvertes pour creer ton compte
+      # Apres creation du compte, passer PWP__DISABLE_SIGNUPS a "true"
+      PWP__DISABLE_SIGNUPS: "false"
+      PWP__DISABLE_LOGINS: "false"
+      PWP__ENABLE_USER_ACCOUNT_EMAILS: "true"
+
+      # SMTP non sensible
+      PWP__MAIL__RAISE_DELIVERY_ERRORS: "true"
+      PWP__MAIL__SMTP_ADDRESS: ssl0.ovh.net
+      PWP__MAIL__SMTP_DOMAIN: thomasmlg.fr
+      PWP__MAIL__SMTP_PORT: "587"
+      PWP__MAIL__SMTP_AUTHENTICATION: plain
+      PWP__MAIL__SMTP_ENABLE_STARTTLS_AUTO: "true"
+      PWP__MAIL__SMTP_OPEN_TIMEOUT: "10"
+      PWP__MAIL__SMTP_READ_TIMEOUT: "10"
+      PWP__MAIL__MAILER_SENDER: passwordpusher@thomasmlg.fr
+
+      # Fonctionnalites
+      PWP__ENABLE_URL_PUSHES: "true"
+      PWP__ENABLE_FILE_PUSHES: "false"
+      PWP__ENABLE_QR_PUSHES: "true"
+      
+      # Branding
+      PWP__BRAND__TITLE: "Thomas MALGOUYRES"
+      PWP__BRAND__TAGLINE: "Partage securisé de mots de passe"
+      PWP__BRAND__DISCLAIMER: "Instance privée reservée a un usage personnel."
+      PWP__BRAND__SHOW_FOOTER_MENU: "false"
+
+      # Theme
+      PWP__THEME: darkly
+
+      # Securite et confidentialite
+      PWP__NOINDEX: "true"
+      PWP__SHOW_VERSION: "false"
+      PWP__THROTTLING__MINUTE: "60"
+      PWP__THROTTLING__SECOND: "10"
+
+      # Interface et logs
+      PWP__DEFAULT_LOCALE: fr
+      PWP__LOG_LEVEL: warn
+      PWP__LOG_TO_STDOUT: "true"
+    volumes:
+      - pwpush-storage:/opt/PasswordPusher/storage
+
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f -H 'Host: passwordpusher.thomasmlg.fr' || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+volumes:
+  pwpush-storage:
+    name: passwordpusher-storage
+    driver: local

services/snowshare/docker-compose.yml

@@ -0,0 +1,51 @@
+---
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: snowshare-db
+    restart: unless-stopped
+
+    env_file:
+      - .env.runtime
+
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+
+    volumes:
+      - db-data:/var/lib/postgresql/data
+
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  app:
+    image: turodev/snowshare:latest
+    container_name: snowshare-app
+    restart: unless-stopped
+
+    depends_on:
+      db:
+        condition: service_healthy
+
+    env_file:
+      - .env.runtime
+
+    environment:
+      DATABASE_URL: ${DATABASE_URL}
+      NEXTAUTH_URL: ${NEXTAUTH_URL}
+      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
+      ALLOW_SIGNUP: ${ALLOW_SIGNUP}
+
+    ports:
+      - "3000:3000"
+
+    volumes:
+      - uploads:/app/uploads
+
+volumes:
+  db-data:
+  uploads:

services/stirling-pdf/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  stirling-pdf:
+    image: stirlingtools/stirling-pdf:latest
+    container_name: stirling-pdf
+    ports:
+      - '8080:8080'
+    volumes:
+      - ./stirling-data/tessdata:/usr/share/tessdata  # OCR language files
+      - ./stirling-data/configs:/configs               # Settings & database
+      - ./stirling-data/logs:/logs                     # Application logs
+      - ./stirling-data/pipeline:/pipeline             # Automation configs
+    environment:
+      - SECURITY_ENABLELOGIN=true      
+      - SYSTEM_DEFAULTLOCALE=fr-FR
+    restart: unless-stopped

services/tracearr/docker-compose.yml

@@ -0,0 +1,128 @@
+---
+# Stack: tracearr
+#
+# But:
+# - Deployer Tracearr avec TimescaleDB et Redis
+# - Eviter les mots de passe en clair dans Git
+# - Stocker les secrets dans /opt/stacks/tracearr/secrets
+#
+# Notes:
+# - Le fichier .env de production n est pas utilise
+# - Les secrets sont lus depuis des fichiers Docker secrets
+
+services:
+  tracearr:
+    image: ghcr.io/connorgallopo/tracearr:latest
+    container_name: tracearr
+    restart: unless-stopped
+
+    depends_on:
+      timescale:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+    ports:
+      - "3000:3000"
+
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+      HOST: 0.0.0.0
+      TZ: Europe/Paris
+      DATABASE_URL_FILE: /run/secrets/database_url
+      REDIS_URL: redis://redis:6379
+      JWT_SECRET_FILE: /run/secrets/jwt_secret
+      COOKIE_SECRET_FILE: /run/secrets/cookie_secret
+      BETTER_AUTH_SECRET_FILE: /run/secrets/better_auth_secret
+      CORS_ORIGIN: https://tracearr.thomasmlg.fr
+      LOG_LEVEL: info
+
+    secrets:
+      - database_url
+      - jwt_secret
+      - cookie_secret
+      - better_auth_secret
+
+    volumes:
+      - tracearr_backups:/data/backup
+
+    networks:
+      - tracearr_network
+
+  timescale:
+    image: timescale/timescaledb-ha:pg18.1-ts2.25.0
+    container_name: tracearr-db
+    restart: unless-stopped
+    shm_size: 512mb
+
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
+
+    command: >
+      postgres
+      -c timescaledb.license=timescale
+      -c timescaledb.max_tuples_decompressed_per_dml_transaction=0
+      -c max_locks_per_transaction=4096
+      -c timescaledb.telemetry_level=off
+
+    environment:
+      POSTGRES_USER: tracearr
+      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
+      POSTGRES_DB: tracearr
+
+    secrets:
+      - db_password
+
+    volumes:
+      - timescale_data:/home/postgres/pgdata/data
+
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U tracearr"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+    networks:
+      - tracearr_network
+
+  redis:
+    image: redis:8-alpine
+    container_name: tracearr-redis
+    restart: unless-stopped
+    command: redis-server --appendonly yes
+
+    volumes:
+      - redis_data:/data
+
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+    networks:
+      - tracearr_network
+
+secrets:
+  db_password:
+    file: ./secrets/db_password
+  database_url:
+    file: ./secrets/database_url
+  jwt_secret:
+    file: ./secrets/jwt_secret
+  cookie_secret:
+    file: ./secrets/cookie_secret
+  better_auth_secret:
+    file: ./secrets/better_auth_secret
+
+networks:
+  tracearr_network:
+    driver: bridge
+
+volumes:
+  tracearr_backups:
+  timescale_data:
+  redis_data: