add registry setup

docs/DOCKER.md

@@ -7,6 +7,7 @@ Three Docker environments are available:
 - `Dockerfile.production` with `docker-compose.production.yml`
 - `docker-compose.pgmanage.yml` for a standalone pgManage container
 - `docker-compose.portainer.production.yml` for a standalone production Portainer deployment behind Traefik
+- `docker-compose.registry.production.yml` for a standalone production Docker registry behind Traefik
 
 ### Development
 
@@ -123,6 +124,7 @@ Add an A record for every subdomain to your server's public IP before deploying
 | `api.rentaldrivego.ma` | API |
 | `pgmanage.rentaldrivego.ma` | pgManage (DB admin) |
 | `portainer.rentaldrivego.ma` | Portainer |
+| `registry.rentaldrivego.ma` | Docker registry |
 
 #### 2. Install Docker and clone the repo
 
@@ -163,6 +165,18 @@ Production now derives `DATABASE_URL` inside the app container from `POSTGRES_HO
 The example file uses `rentaldrivego.ma` for the marketplace and public site. The dashboard and admin panel are routed under that same host at `/dashboard` and `/admin`.
 Set `PORTAINER_DOMAIN=portainer.rentaldrivego.ma` in `.env.docker.production` to expose Portainer through Traefik.
 Set `PGMANAGE_DOMAIN=pgmanage.rentaldrivego.ma` to expose pgManage through Traefik, and set `PGMANAGE_LICENSE_KEY` if you are running the enterprise image.
+Set `REGISTRY_DOMAIN=registry.rentaldrivego.ma` to expose the local Docker registry through Traefik.
+
+If you want to use a self-hosted registry on the same VPS, also set these values in `.env.docker.production`:
+
+```text
+REGISTRY_HOST=registry.rentaldrivego.ma
+REGISTRY_USER=<registry-user>
+REGISTRY_PASSWORD=<strong-registry-password>
+REGISTRY_IMAGE=registry.rentaldrivego.ma/rentaldrivego/car_management_system
+```
+
+The registry bootstrap script uses `REGISTRY_USER` and `REGISTRY_PASSWORD` to generate the htpasswd file mounted into the registry container, so the same credentials can be used by GitLab CI for `docker login`.
 
 #### 4a. Configure the registry for CI deploys
 
@@ -173,13 +187,13 @@ If you want GitLab CI to build once and deploy by pulling a prebuilt image on th
 - Explicit registry variables:
   Set `REGISTRY_HOST`, `REGISTRY_USER`, `REGISTRY_PASSWORD`, and `REGISTRY_IMAGE` yourself. This works for GitLab Registry, Docker Hub, GHCR, or another OCI registry.
 
-Example explicit values for GitLab's hosted registry:
+Example explicit values for a local registry exposed through Traefik:
 
 ```text
-REGISTRY_HOST=gitlab.rentaldrivego.ma:5050
-REGISTRY_IMAGE=gitlab.rentaldrivego.ma:5050/rental_car/car_management_system
-REGISTRY_USER=<deploy-user-or-token-name>
-REGISTRY_PASSWORD=<personal-access-token-or-deploy-token>
+REGISTRY_HOST=registry.rentaldrivego.ma
+REGISTRY_IMAGE=registry.rentaldrivego.ma/rentaldrivego/car_management_system
+REGISTRY_USER=<registry-user>
+REGISTRY_PASSWORD=<registry-password>
 ```
 
 The production compose file reads `APP_IMAGE` and `APP_VERSION` for pull-based deploys. The GitLab deploy job injects those values automatically and now syncs the deployment assets to the VPS before running the server-side deploy script. Production no longer depends on `git pull` during release.
@@ -215,6 +229,7 @@ npm run docker:prod:start:admin
 npm run docker:prod:start:frontends
 npm run docker:prod:start:pgmanage
 npm run docker:prod:start:portainer
+npm run docker:prod:start:registry
 npm run docker:prod:start:all
 npm run docker:prod:start:api && npm run docker:prod:start:frontends
 ```
@@ -250,6 +265,29 @@ Equivalent raw Docker Compose command:
 docker compose -p rentaldrivego-portainer-prod --env-file .env.docker.production -f docker-compose.portainer.production.yml up -d
 ```
 
+#### 6b. Deploy the local registry
+
+The registry is deployed separately from the main app stack and reuses the shared `traefik-proxy` network managed by Traefik.
+
+```bash
+npm run docker:prod:start:registry
+```
+
+Equivalent raw Docker Compose command:
+
+```bash
+docker compose -p rentaldrivego-registry-prod --env-file .env.docker.production -f docker-compose.registry.production.yml up -d
+```
+
+On first start, the script generates `docker/registry/auth/htpasswd` from `REGISTRY_USER` and `REGISTRY_PASSWORD` in `.env.docker.production`. After the registry is up, verify it with:
+
+```bash
+docker login registry.rentaldrivego.ma
+docker pull registry:2
+docker tag registry:2 registry.rentaldrivego.ma/smoke-test:latest
+docker push registry.rentaldrivego.ma/smoke-test:latest
+```
+
 Uploaded assets handled by the API, including vehicle photos and company branding images, are persisted in the named Docker volume `api_uploads`, mounted inside the API container at `/var/lib/rentaldrivego/storage`. Rebuilding or redeploying the API no longer clears those files as long as that volume is kept.
 
 The production helper scripts and the GitLab deploy job now explicitly create the Docker volume `${DOCKER_PROD_PROJECT_NAME:-rentaldrivego-prod}_api_uploads` before starting or redeploying the API stack, so a fresh server bootstrap does not accidentally start the API without its upload storage volume.