From d3850e559ae00d64987f67a8e9bc0fe688307079 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Thu, 6 Nov 2025 08:35:43 +0100
Subject: [PATCH] refactor: use inline basicauth for Traefik dashboard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changed dashboard authentication to use inline basicauth
like Scrapy instead of external .htpasswd file:

**Changes:**
- Updated proxy labels to use basicauth.users=${PROXY_AUTH_USERS}
- Removed .htpasswd file and auth directory
- Removed dashboard-auth middleware from security.yaml
- Removed .htpasswd volume mount from compose.yaml

**Benefits:**
- Consistent with Scrapy authentication pattern
- Simpler configuration (no external files)
- Auth credentials managed centrally via .env

Dashboard accessible at: https://proxy.pivoine.art
Credentials: valknar / ragnarok98 (via PROXY_AUTH_USERS)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 proxy/auth/.htpasswd        | 1 -
 proxy/compose.yaml          | 4 ++--
 proxy/dynamic/security.yaml | 5 -----
 3 files changed, 2 insertions(+), 8 deletions(-)
 delete mode 100644 proxy/auth/.htpasswd

diff --git a/proxy/auth/.htpasswd b/proxy/auth/.htpasswd
deleted file mode 100644
index d4e8f7e..0000000
--- a/proxy/auth/.htpasswd
+++ /dev/null
@@ -1 +0,0 @@
-valknar:$apr1$mPI9lhER$CIz4BtA8cQULi4McVZxfz.
diff --git a/proxy/compose.yaml b/proxy/compose.yaml
index d3f7e95..230275d 100644
--- a/proxy/compose.yaml
+++ b/proxy/compose.yaml
@@ -61,7 +61,6 @@ services:
       - letsencrypt_data:/letsencrypt
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./dynamic:/etc/traefik/dynamic:ro
-      - ./auth/.htpasswd:/etc/traefik/.htpasswd:ro
 
     labels:
       - 'traefik.enable=true'
@@ -70,7 +69,8 @@ services:
       - 'traefik.http.routers.${PROXY_COMPOSE_PROJECT_NAME}-dashboard.entrypoints=web-secure'
       - 'traefik.http.routers.${PROXY_COMPOSE_PROJECT_NAME}-dashboard.tls.certresolver=resolver'
       - 'traefik.http.routers.${PROXY_COMPOSE_PROJECT_NAME}-dashboard.service=api@internal'
-      - 'traefik.http.routers.${PROXY_COMPOSE_PROJECT_NAME}-dashboard.middlewares=dashboard-auth@file'
+      - 'traefik.http.middlewares.${PROXY_COMPOSE_PROJECT_NAME}-dashboard-auth.basicauth.users=${PROXY_AUTH_USERS}'
+      - 'traefik.http.routers.${PROXY_COMPOSE_PROJECT_NAME}-dashboard.middlewares=${PROXY_COMPOSE_PROJECT_NAME}-dashboard-auth'
 volumes:
   letsencrypt_data:
     name: ${PROXY_COMPOSE_PROJECT_NAME}_letsencrypt_data
diff --git a/proxy/dynamic/security.yaml b/proxy/dynamic/security.yaml
index 99f9e08..b6f925b 100644
--- a/proxy/dynamic/security.yaml
+++ b/proxy/dynamic/security.yaml
@@ -59,8 +59,3 @@ http:
         average: 30
         burst: 15
         period: 1s
-
-    # Basic Auth for Traefik Dashboard
-    dashboard-auth:
-      basicAuth:
-        usersFile: /etc/traefik/.htpasswd