Password protection

Set the CI variable BASIC_AUTH_HTPASSWD to the password and redeploy: the site asks for it (user admin) on every path, assets and search index included. Remove the variable and redeploy to make the site public again. The password is hashed when the container starts and never lands in the image.

The knowledge-base template already passes the variable through docker-compose.yml; a landing page that wants a password adds the same lines:

environment:
  BASIC_AUTH_HTPASSWD: ${BASIC_AUTH_HTPASSWD}

Do not write a fallback value there (${BASIC_AUTH_HTPASSWD:-secret}): with the variable unset, that fallback silently becomes the production password.

How the runtime image turns the variable into an nginx rule is shown on How it works.