¬ just serendipity 🍀 (not just serendipity)

Problem statement: You want to expose a HTTPS service from your cloud VPS to the public Internet. You do not wish to use a VPN (e.g. tailscale) to do so – which is a great way to address this, but it’s out of scope in this particular instance. How to proceed?

Here’s a simple yet effective way: use / configure nginx as a reverse proxy.

Then add HTTP basic auth to it:

% doas htpasswd -c /etc/nginx/.htpasswd myuser

The command will prompt for a password.

Once it’s set, add two lines to the corresponding server {} block in your nginx config:

server {
[...]
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
[...]
}

And finally: run nginx -s reload.

Now, whenever you navigate to that host, you’ll be prompted to enter the basic HTTP auth creds above.

The beauty of this approach is that it works for any HTTPS server, as it is service agnostic.

The next level would be to integrate an SSO solution such as Authentik, however it’s quite more complex.