fix registry link

docs/DOCKER.md

@@ -8,6 +8,7 @@ Three Docker environments are available:
 - `docker-compose.pgmanage.yml` for a standalone pgManage container
 - `docker-compose.portainer.production.yml` for a standalone production Portainer deployment behind Traefik
 - `docker-compose.registry.production.yml` for a standalone production Docker registry behind Traefik
+- `docker-compose.registry.local.yml` for a Docker registry running on a separate local server with port `5000` exposed directly
 
 ### Development
 
@@ -165,7 +166,8 @@ Production now derives `DATABASE_URL` inside the app container from `POSTGRES_HO
 The example file uses `rentaldrivego.ma` for the marketplace and public site. The dashboard and admin panel are routed under that same host at `/dashboard` and `/admin`.
 Set `PORTAINER_DOMAIN=portainer.rentaldrivego.ma` in `.env.docker.production` to expose Portainer through Traefik.
 Set `PGMANAGE_DOMAIN=pgmanage.rentaldrivego.ma` to expose pgManage through Traefik, and set `PGMANAGE_LICENSE_KEY` if you are running the enterprise image.
-Set `REGISTRY_DOMAIN=registry.rentaldrivego.ma` to expose the local Docker registry through Traefik.
+Set `REGISTRY_DOMAIN=registry.rentaldrivego.ma` to expose the Docker registry through Traefik.
+Set `REGISTRY_UPSTREAM_URL=http://<local-registry-server-ip>:5000` on the VPS when the registry itself runs on a different server and Traefik should reverse-proxy to it.
 
 If you want to use a self-hosted registry on the same VPS, also set these values in `.env.docker.production`:
 
@@ -265,21 +267,47 @@ Equivalent raw Docker Compose command:
 docker compose -p rentaldrivego-portainer-prod --env-file .env.docker.production -f docker-compose.portainer.production.yml up -d
 ```
 
-#### 6b. Deploy the local registry
+#### 6b. Deploy the registry on a separate local server
 
-The registry is deployed separately from the main app stack and reuses the shared `traefik-proxy` network managed by Traefik.
+For the split setup:
+
+1. Run the registry on your local server with port `5000` exposed directly.
+2. Set `REGISTRY_UPSTREAM_URL` on the VPS to `http://<local-registry-server-ip>:5000`.
+3. Restart Traefik on the VPS so it renders the dynamic registry upstream file and serves TLS for `REGISTRY_DOMAIN`.
+
+On the local registry server:
 
 ```bash
-npm run docker:prod:start:registry
+npm run docker:registry:local:start
 ```
 
 Equivalent raw Docker Compose command:
 
 ```bash
-docker compose -p rentaldrivego-registry-prod --env-file .env.docker.production -f docker-compose.registry.production.yml up -d
+docker compose -p rentaldrivego-registry-local --env-file .env.docker.production -f docker-compose.registry.local.yml up -d
 ```
 
-On first start, the script generates `docker/registry/auth/htpasswd` from `REGISTRY_USER` and `REGISTRY_PASSWORD` in `.env.docker.production`. After the registry is up, verify it with:
+On first start, the script generates `docker/registry/auth/htpasswd` from `REGISTRY_USER` and `REGISTRY_PASSWORD` in `.env.docker.production`.
+
+From the VPS, verify the upstream directly before involving Traefik:
+
+```bash
+curl -I http://<local-registry-server-ip>:5000/v2/
+```
+
+Expected response:
+
+```text
+HTTP/1.1 401 Unauthorized
+```
+
+Then on the VPS restart Traefik:
+
+```bash
+bash scripts/docker-prod-up-traefik.sh
+```
+
+After that, verify the public route and login flow:
 
 ```bash
 docker login registry.rentaldrivego.ma