add portainer to production

.env.docker.production.example

@@ -3,6 +3,7 @@ ACME_EMAIL=rentaldrivego@gmail.com
 API_DOMAIN=api.rentaldrivego.ma
 PUBLIC_SITE_DOMAIN=rentaldrivego.ma
 PGMANAGE_DOMAIN=pgmanage.rentaldrivego.ma
+PORTAINER_DOMAIN=portainer.rentaldrivego.ma
 
 # ── Optional prebuilt image source ────────────────────────────────────────────
 # Used for pull-based deployments. CI injects APP_IMAGE and APP_VERSION

docker-compose.pgmanage.yml

@@ -9,6 +9,8 @@ services:
       - "8000:8000"
     environment:
       PGMANAGE_LISTEN_PORT: "8000"
+      PGMANAGE_DEFAULT_USERNAME: ${PGMANAGE_DEFAULT_USERNAME:-admin}
+      PGMANAGE_DEFAULT_PASSWORD: ${PGMANAGE_DEFAULT_PASSWORD:-admin}
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:

docker-compose.portainer.production.yml

@@ -0,0 +1,27 @@
+name: rentaldrivego-portainer-prod
+
+services:
+  portainer:
+    image: portainer/portainer-ce:lts
+    command: -H unix:///var/run/docker.sock
+    restart: unless-stopped
+    networks:
+      - traefik-proxy
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - portainer_prod_data:/data
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.portainer.rule=Host(`${PORTAINER_DOMAIN:-portainer.rentaldrivego.ma}`)
+      - traefik.http.routers.portainer.entrypoints=websecure
+      - traefik.http.routers.portainer.tls=true
+      - traefik.http.routers.portainer.tls.certresolver=letsencrypt
+      - traefik.http.routers.portainer.service=portainer-svc
+      - traefik.http.services.portainer-svc.loadbalancer.server.port=9000
+
+networks:
+  traefik-proxy:
+    external: true
+
+volumes:
+  portainer_prod_data: