fix prod docker compose

deploy/.env.prod.template

···
 # REQUIRED: Update with your domain
 APPVIEW_DOMAIN=atcr.io
 
-# Hold service domain (presigned URL generator)
-# REQUIRED: Update with your domain
-HOLD_DOMAIN=hold01.atcr.io
-
 # ==============================================================================
 # Hold Service Configuration
 # ==============================================================================
+
+# Hold service domain (REQUIRED)
+# The hostname where the hold service will be accessible
+# Used by docker-compose.prod.yml to derive:
+#   - HOLD_PUBLIC_URL: https://${HOLD_DOMAIN}
+#   - ATCR_DEFAULT_HOLD_DID: did:web:${HOLD_DOMAIN}
+# Example: hold01.atcr.io
+HOLD_DOMAIN=hold01.atcr.io
 
 # Your ATProto DID (REQUIRED for hold registration)
 # Get your DID from: https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=yourhandle.bsky.social
···
 # AppView Configuration
 # ==============================================================================
 
-# Default hold service DID (REQUIRED)
-# This is automatically set by docker-compose.prod.yml to did:web:${HOLD_DOMAIN}
-# Only override this if you want to use a different default hold
-# Format: did:web:hostname[:port]
-# Example: did:web:hold01.atcr.io
-# Note: This is set automatically - no need to configure manually
+# Default hold service DID (derived from HOLD_DOMAIN in docker-compose.prod.yml)
+# Uncomment to override if you want to use a different hold service as the default
+# ATCR_DEFAULT_HOLD_DID=did:web:some-other-hold.example.com
 
 # JWT token expiration in seconds
 # Default: 300 (5 minutes)

deploy/docker-compose.prod.yml

···
       ATCR_BASE_URL: https://${APPVIEW_DOMAIN:-atcr.io}
       ATCR_SERVICE_NAME: ${APPVIEW_DOMAIN:-atcr.io}
 
-      # Storage configuration
-      ATCR_DEFAULT_HOLD_DID: did:web:${HOLD_DOMAIN:-hold01.atcr.io}
+      # Storage configuration (derived from HOLD_DOMAIN)
+      ATCR_DEFAULT_HOLD_DID: ${ATCR_DEFAULT_HOLD_DID:-did:web:${HOLD_DOMAIN:-hold01.atcr.io}}
 
       # Authentication
       ATCR_AUTH_KEY_PATH: /var/lib/atcr/auth/private-key.pem
···
     container_name: atcr-hold
     restart: unless-stopped
     environment:
-      # Hold service configuration
-      HOLD_PUBLIC_URL: https://${HOLD_DOMAIN:-hold01.atcr.io}
+      # Hold service configuration (derived from HOLD_DOMAIN)
+      HOLD_PUBLIC_URL: ${HOLD_PUBLIC_URL:-https://${HOLD_DOMAIN:-hold01.atcr.io}}
       HOLD_SERVER_ADDR: :8080
       HOLD_ALLOW_ALL_CREW: ${HOLD_ALLOW_ALL_CREW:-false}
       HOLD_PUBLIC: ${HOLD_PUBLIC:-false}