I use Nginx as a reverse proxy on my Ubuntu server. There is a web app running on localhost:3456, and I want to expose it to the internet using the hostname chat.botond.online. I also want to protect it using HTTP Basic authentication. I have the Apache tools for managing htpasswd files installed.

Could you please write an Nginx config file for this site, and also explain how I can create a htpasswd file and use it in this nginx config to protect it?

Sure, I can certainly help with that. We will perform these tasks in two steps:

1. Create an htpasswd file
2. Write an Nginx config file

Let’s start with the first one.

Step 1: Create an htpasswd file

You can create a .htpasswd file by using the htpasswd command that comes with the Apache httpd server. In your case, you can create a user (let’s say user1) like this:

sudo htpasswd -c /etc/nginx/.htpasswd user1

This will prompt you to enter and confirm a password for the user user1. The -c option tells htpasswd to create a new file.

Please note: This will overwrite the file if it already exists. If you want to add additional users to an existing .htpasswd file, do not use the -c flag.

Step 2: Write an Nginx config file

Now, let’s create an Nginx configuration. You can add a new server block in your Nginx config, or create a new config file under /etc/nginx/sites-available/ and symlink it to /etc/nginx/sites-enabled/. I’ll create a new server block as an example:

server {
    listen 80;
    server_name something.somewhere.com;

    location / {
        auth_basic "Restricted Content";  # This is the message that will be shown in the login prompt
        auth_basic_user_file /etc/nginx/.htpasswd;  # The file you created earlier

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://localhost:3456;
    }
}

This will set up basic HTTP authentication on your site and also reverse proxy requests to your web app running on localhost:3456.

Note: If you’re planning to expose this to the internet, I would strongly recommend setting up SSL as well. You can use a free service like Let’s Encrypt to get an SSL certificate. If you don’t secure your site with HTTPS, the HTTP Basic authentication credentials will be sent in plain text, which is a significant security risk.

Sure, let’s start by creating the htpasswd file for HTTP basic authentication. You can create a .htpasswd file using htpasswd command that comes with the apache2-utils package. If it’s not installed, you can install it via apt-get install apache2-utils.

To create a .htpasswd file, run the following command:

htpasswd -c /etc/nginx/.htpasswd username

Replace username with the username you want. After running this command, you will be prompted to enter and confirm a password for this user. The -c flag is used to create a new file. Do not use this flag if you already have a .htpasswd file and just want to add a new user.

Now, let’s create a Nginx configuration file. Using your favorite text editor (nano, vim, etc.), open up a new configuration file in /etc/nginx/sites-available/, for example:

sudo nano /etc/nginx/sites-available/something.somewhere.com

Then, paste the following configuration:

server {
    listen 80;
    server_name something.somewhere.com;

    location / {
        auth_basic "Restricted Content";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://localhost:3456;
    }
}

In this configuration:

• listen 80; means Nginx is listening on port 80 for incoming connections.
• server_name something.somewhere.com; specifies the hostname.
• auth_basic "Restricted Content"; enables HTTP basic authentication with the message “Restricted Content”.
• auth_basic_user_file /etc/nginx/.htpasswd; specifies the location of the .htpasswd file.
• The proxy_set_header directives are used to pass on some client information to the proxied server.
• proxy_pass http://localhost:3456; is used to forward requests to your web app running at localhost:3456.

Save and close the file.

To enable this site, create a symbolic link of it in the sites-enabled directory:

sudo ln -s /etc/nginx/sites-available/something.somewhere.com /etc/nginx/sites-enabled/

Finally, test the configuration and restart Nginx:

sudo nginx -t
sudo systemctl restart nginx

Now your web app should be accessible from the internet at http://something.somewhere.com, and it should ask for a username and password as you specified in the .htpasswd file.