# 🔐🔑 Nginx SSL with HTTP Basic Authentication

## 📄 Example Secure Server Block (HTTPS + Password Protection)

```nginx
listen 443 ssl;
server_name example.com www.example.com;

# 🔒 SSL Certificates (Generated by Certbot)
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; 
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; 

# 📂 Website Root
root /var/www/example.com/html;
index index.html;

# 🔑 Password-Protected Location
location / {
    auth_basic "Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    try_files $uri $uri/ =404;
}
```

---

## 🗂️ Explanation of Key Parts

| Directive              | Purpose                                                             |
| ---------------------- | ------------------------------------------------------------------- |
| `auth_basic "Admin";`  | Enables **HTTP Basic Authentication** with prompt title “Admin”.    |
| `auth_basic_user_file` | Points to the `.htpasswd` file containing username/password hashes. |
| `.htpasswd` file       | Stores encrypted credentials — created using `htpasswd` command.    |
| SSL lines              | Load the certificate and private key from **Certbot**.              |

---

## 🛠️ How to Set Up Password Protection

### 1️⃣ Install `apache2-utils` (for `htpasswd` tool)

```bash
apt install apache2-utils
```

### 2️⃣ Create the `.htpasswd` File

```bash
htpasswd -c /etc/nginx/.htpasswd <username>
```

* `-c` creates a **new file** (omit `-c` if adding more users).
* You’ll be prompted to set a password.

### 3️⃣ Adjust File Permissions

```bash
chmod 640 /etc/nginx/.htpasswd
chown root:www-data /etc/nginx/.htpasswd
```

### 4️⃣ Test and Reload Nginx

```bash
nginx -t
systemctl reload nginx
```

---

## ⚠️ Security Notes

* Always store `.htpasswd` **outside** your web root.
* Passwords in `.htpasswd` are hashed, but still protect the file with correct permissions.
* Works best for **admin panels**, **staging sites**, or private areas.