archetecture security fix

scripts/docker-prod-up-pgmanage.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ROOT_DIR}/scripts/docker-prod-common.sh"
+
+ensure_env_file
+
+pgmanage_user="$(read_env_value PGMANAGE_DEFAULT_USERNAME)"
+pgmanage_password="$(read_env_value PGMANAGE_DEFAULT_PASSWORD)"
+if [[ -z "${pgmanage_user}" || -z "${pgmanage_password}" || "${pgmanage_user}" == "admin" || "${pgmanage_password}" == replace-with-* ]]; then
+  echo "Set strong PGMANAGE_DEFAULT_USERNAME and PGMANAGE_DEFAULT_PASSWORD before starting pgManage." >&2
+  exit 1
+fi
+
+echo "Starting pgManage on the private Docker network only."
+echo "Access it with an SSH tunnel or VPN path to the Docker host, not through public Traefik."
+prod_compose --profile private-tools up --build -d pgmanage
+
+echo "pgManage is starting as a private tool."