From 560da1cadffa0898b31c16c202552f4a25fc2eb8 Mon Sep 17 00:00:00 2001
From: root <melabidi@alrahmaisgl.org>
Date: Thu, 4 Jun 2026 14:19:37 -0400
Subject: [PATCH] fix prod domain mismatch

---
 .env.docker.production.example | 10 +++---
 scripts/docker-prod-common.sh  | 60 ++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 5 deletions(-)

diff --git a/.env.docker.production.example b/.env.docker.production.example
index df4413c..6b966a2 100644
--- a/.env.docker.production.example
+++ b/.env.docker.production.example
@@ -1,9 +1,9 @@
 # ── Traefik domains — used in docker-compose labels ──────────────────────────
 ACME_EMAIL=ops@example.com
-API_DOMAIN=api.example.com
-PUBLIC_SITE_DOMAIN=example.com
-PGMANAGE_DOMAIN=pgmanage.example.com
-PORTAINER_DOMAIN=portainer.example.com
+API_DOMAIN=api.rentaldrivego.ma
+PUBLIC_SITE_DOMAIN=rentaldrivego.ma
+PGMANAGE_DOMAIN=pgmanage.rentaldrivego.ma
+PORTAINER_DOMAIN=portainer.rentaldrivego.ma
 REGISTRY_DOMAIN=registry.rentaldrivego.ma
 REGISTRY_UPSTREAM_URL=http://10.0.0.10:5000
 
@@ -59,7 +59,7 @@ ADMIN_URL=https://rentaldrivego.ma/admin
 
 # ── CORS ──────────────────────────────────────────────────────────────────────
 # Comma-separated list of allowed browser origins. REQUIRED in production.
-CORS_ORIGINS=https://example.com,https://www.example.com
+CORS_ORIGINS=https://rentaldrivego.ma,https://www.rentaldrivego.ma
 
 # ── Auth ──────────────────────────────────────────────────────────────────────
 JWT_SECRET=PMPS5k0D7rUeJOk0NkhI5bRtoGjkUqjK
diff --git a/scripts/docker-prod-common.sh b/scripts/docker-prod-common.sh
index 060fa52..a000777 100755
--- a/scripts/docker-prod-common.sh
+++ b/scripts/docker-prod-common.sh
@@ -25,6 +25,66 @@ ensure_env_file() {
     echo "Create it from .env.docker.production.example before starting production containers." >&2
     exit 1
   fi
+
+  validate_prod_env_file
+}
+
+read_env_value() {
+  local key="$1"
+  local value
+
+  value="$(
+    awk -F= -v key="$key" '
+      $1 == key {
+        value = substr($0, index($0, "=") + 1)
+      }
+      END {
+        if (value != "") {
+          print value
+        }
+      }
+    ' "${ENV_FILE}"
+  )"
+
+  value="${value%$'\r'}"
+  value="${value#\"}"
+  value="${value%\"}"
+  printf '%s' "${value}"
+}
+
+validate_prod_env_file() {
+  local api_domain public_site_domain cors_origins pgmanage_domain portainer_domain
+
+  api_domain="$(read_env_value API_DOMAIN)"
+  public_site_domain="$(read_env_value PUBLIC_SITE_DOMAIN)"
+  cors_origins="$(read_env_value CORS_ORIGINS)"
+  pgmanage_domain="$(read_env_value PGMANAGE_DOMAIN)"
+  portainer_domain="$(read_env_value PORTAINER_DOMAIN)"
+
+  if [[ -z "${api_domain}" || "${api_domain}" == *example.com* ]]; then
+    echo "Invalid API_DOMAIN in ${ENV_FILE}. Set it to the real production API hostname, not example.com." >&2
+    exit 1
+  fi
+
+  if [[ -z "${public_site_domain}" || "${public_site_domain}" == *example.com* ]]; then
+    echo "Invalid PUBLIC_SITE_DOMAIN in ${ENV_FILE}. Set it to the real production site hostname, not example.com." >&2
+    exit 1
+  fi
+
+  if [[ -z "${cors_origins}" || "${cors_origins}" == *example.com* ]]; then
+    echo "Invalid CORS_ORIGINS in ${ENV_FILE}. Replace example.com origins with the real production domains." >&2
+    exit 1
+  fi
+
+  if [[ -n "${pgmanage_domain}" && "${pgmanage_domain}" == *example.com* ]]; then
+    echo "Invalid PGMANAGE_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the pgmanage router." >&2
+    exit 1
+  fi
+
+  if [[ -n "${portainer_domain}" && "${portainer_domain}" == *example.com* ]]; then
+    echo "Invalid PORTAINER_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the portainer router." >&2
+    exit 1
+  fi
 }
 
 ensure_traefik_network() {