fix prod domain mismatch

.env.docker.production.example

@@ -1,9 +1,9 @@
 # ── Traefik domains — used in docker-compose labels ──────────────────────────
 ACME_EMAIL=ops@example.com
-API_DOMAIN=api.example.com
-PUBLIC_SITE_DOMAIN=example.com
-PGMANAGE_DOMAIN=pgmanage.example.com
-PORTAINER_DOMAIN=portainer.example.com
+API_DOMAIN=api.rentaldrivego.ma
+PUBLIC_SITE_DOMAIN=rentaldrivego.ma
+PGMANAGE_DOMAIN=pgmanage.rentaldrivego.ma
+PORTAINER_DOMAIN=portainer.rentaldrivego.ma
 REGISTRY_DOMAIN=registry.rentaldrivego.ma
 REGISTRY_UPSTREAM_URL=http://10.0.0.10:5000
 
@@ -59,7 +59,7 @@ ADMIN_URL=https://rentaldrivego.ma/admin
 
 # ── CORS ──────────────────────────────────────────────────────────────────────
 # Comma-separated list of allowed browser origins. REQUIRED in production.
-CORS_ORIGINS=https://example.com,https://www.example.com
+CORS_ORIGINS=https://rentaldrivego.ma,https://www.rentaldrivego.ma
 
 # ── Auth ──────────────────────────────────────────────────────────────────────
 JWT_SECRET=PMPS5k0D7rUeJOk0NkhI5bRtoGjkUqjK

scripts/docker-prod-common.sh

@@ -25,6 +25,66 @@ ensure_env_file() {
     echo "Create it from .env.docker.production.example before starting production containers." >&2
     exit 1
   fi
+
+  validate_prod_env_file
+}
+
+read_env_value() {
+  local key="$1"
+  local value
+
+  value="$(
+    awk -F= -v key="$key" '
+      $1 == key {
+        value = substr($0, index($0, "=") + 1)
+      }
+      END {
+        if (value != "") {
+          print value
+        }
+      }
+    ' "${ENV_FILE}"
+  )"
+
+  value="${value%$'\r'}"
+  value="${value#\"}"
+  value="${value%\"}"
+  printf '%s' "${value}"
+}
+
+validate_prod_env_file() {
+  local api_domain public_site_domain cors_origins pgmanage_domain portainer_domain
+
+  api_domain="$(read_env_value API_DOMAIN)"
+  public_site_domain="$(read_env_value PUBLIC_SITE_DOMAIN)"
+  cors_origins="$(read_env_value CORS_ORIGINS)"
+  pgmanage_domain="$(read_env_value PGMANAGE_DOMAIN)"
+  portainer_domain="$(read_env_value PORTAINER_DOMAIN)"
+
+  if [[ -z "${api_domain}" || "${api_domain}" == *example.com* ]]; then
+    echo "Invalid API_DOMAIN in ${ENV_FILE}. Set it to the real production API hostname, not example.com." >&2
+    exit 1
+  fi
+
+  if [[ -z "${public_site_domain}" || "${public_site_domain}" == *example.com* ]]; then
+    echo "Invalid PUBLIC_SITE_DOMAIN in ${ENV_FILE}. Set it to the real production site hostname, not example.com." >&2
+    exit 1
+  fi
+
+  if [[ -z "${cors_origins}" || "${cors_origins}" == *example.com* ]]; then
+    echo "Invalid CORS_ORIGINS in ${ENV_FILE}. Replace example.com origins with the real production domains." >&2
+    exit 1
+  fi
+
+  if [[ -n "${pgmanage_domain}" && "${pgmanage_domain}" == *example.com* ]]; then
+    echo "Invalid PGMANAGE_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the pgmanage router." >&2
+    exit 1
+  fi
+
+  if [[ -n "${portainer_domain}" && "${portainer_domain}" == *example.com* ]]; then
+    echo "Invalid PORTAINER_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the portainer router." >&2
+    exit 1
+  fi
 }
 
 ensure_traefik_network() {