diff --git a/olhar-api/.env.example b/olhar-api/.env.example
deleted file mode 100644
index 635bf4b..0000000
--- a/olhar-api/.env.example
+++ /dev/null
@@ -1,4 +0,0 @@
-# Mot de passe PostgreSQL partagé entre le container db et l'API Spring Boot.
-# Copier ce fichier en .env et définir une valeur sécurisée avant de démarrer.
-#   cp .env.example .env
-POSTGRES_PASSWORD=changeme
diff --git a/olhar-api/docker-compose.yml b/olhar-api/docker-compose.yml
deleted file mode 100644
index 826a53d..0000000
--- a/olhar-api/docker-compose.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: olhar-api-stack
-
-services:
-  db:
-    image: postgres:16-alpine
-    container_name: olhar-api-db
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: olhar
-      POSTGRES_USER: olhar
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      TZ: Europe/Paris
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U olhar -d olhar"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    volumes:
-      - ~/Applications/data/olhar-api/db_data:/var/lib/postgresql/data
-    networks:
-      - olhar-api-net
-
-  api:
-    image: git.goutailler-olivier.com/gato/olhar-api:latest
-    container_name: olhar-api
-    restart: unless-stopped
-    depends_on:
-      db:
-        condition: service_healthy
-    environment:
-      DATASOURCE_URL: jdbc:postgresql://db:5432/olhar
-      DATASOURCE_USERNAME: olhar
-      DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD}
-      KEYCLOAK_JWKS_URI: https://auth.goutailler-olivier.com/realms/olhar/protocol/openid-connect/certs
-      CORS_ALLOWED_ORIGIN_PROD: https://olhar.goutailler-olivier.com
-      PHOTOS_STORAGE_PATH: /app/uploads
-      TZ: Europe/Paris
-    volumes:
-      - ~/Applications/data/olhar-api/uploads:/app/uploads
-    networks:
-      - olhar-api-net
-      - proxy
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.olhar-api.rule=Host(`olhar.goutailler-olivier.com`) && PathPrefix(`/api`)
-      - traefik.http.routers.olhar-api.entrypoints=websecure
-      - traefik.http.routers.olhar-api.tls.certresolver=le
-      - traefik.http.services.olhar-api.loadbalancer.server.port=8080
-      - traefik.docker.network=proxy
-      - com.centurylinklabs.watchtower.enable=true
-
-networks:
-  olhar-api-net:
-    driver: bridge
-  proxy:
-    external: true
-    name: proxy
diff --git a/olhar/.env.example b/olhar/.env.example
new file mode 100644
index 0000000..48ebfd0
--- /dev/null
+++ b/olhar/.env.example
@@ -0,0 +1,9 @@
+# Copier ce fichier en .env et définir des valeurs sécurisées avant de démarrer.
+#   cp .env.example .env
+
+# Mot de passe PostgreSQL partagé entre le container db et l'API Spring Boot.
+POSTGRES_PASSWORD=changeme
+
+# Secret JWT utilisé pour signer les tokens d'authentification.
+# Générer une valeur forte : openssl rand -hex 32
+JWT_SECRET=changeme-in-production-use-a-long-random-string-at-least-256-bits
diff --git a/olhar/docker-compose.yml b/olhar/docker-compose.yml
index 94c6a8f..30e1fd8 100644
--- a/olhar/docker-compose.yml
+++ b/olhar/docker-compose.yml
@@ -1,17 +1,62 @@
 name: olhar
 
 services:
-  oalhar:
-    image: git.goutailler-olivier.com/gato/olhar-pwa:latest
-    container_name: olhar
+  db:
+    image: postgres:16-alpine
+    container_name: olhar-db
     restart: unless-stopped
+    environment:
+      POSTGRES_DB: olhar
+      POSTGRES_USER: olhar
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      TZ: Europe/Paris
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U olhar -d olhar"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    volumes:
+      - ~/Applications/data/olhar/db_data:/var/lib/postgresql/data
+    networks:
+      - olhar-net
 
+  api:
+    image: git.goutailler-olivier.com/gato/olhar-api:latest
+    container_name: olhar-api
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      DATASOURCE_URL: jdbc:postgresql://db:5432/olhar
+      DATASOURCE_USERNAME: olhar
+      DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+      CORS_ALLOWED_ORIGIN_PROD: https://olhar.goutailler-olivier.com
+      PHOTOS_STORAGE_PATH: /app/uploads
+      TZ: Europe/Paris
+    volumes:
+      - ~/Applications/data/olhar/uploads:/app/uploads
+    networks:
+      - olhar-net
+      - proxy
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.olhar-api.rule=Host(`olhar.goutailler-olivier.com`) && PathPrefix(`/api`)
+      - traefik.http.routers.olhar-api.entrypoints=websecure
+      - traefik.http.routers.olhar-api.tls.certresolver=le
+      - traefik.http.services.olhar-api.loadbalancer.server.port=8080
+      - traefik.docker.network=proxy
+      - com.centurylinklabs.watchtower.enable=true
+
+  pwa:
+    image: git.goutailler-olivier.com/gato/olhar-pwa:latest
+    container_name: olhar-pwa
+    restart: unless-stopped
     environment:
       TZ: Europe/Paris
-
     networks:
       - proxy
-
     labels:
       - traefik.enable=true
       - traefik.http.routers.olhar.rule=Host(`olhar.goutailler-olivier.com`)
@@ -22,6 +67,8 @@ services:
       - com.centurylinklabs.watchtower.enable=true
 
 networks:
+  olhar-net:
+    driver: bridge
   proxy:
     external: true
     name: proxy