HTTP Basic authentication

HTTP Basic authentication is an optional web-server layer. It does not replace the tinymash sign-in. An administrator passes both checks.

Serve the site only over HTTPS. Keep the password file outside the document root and readable by the web server. Use htpasswd or an equivalent tool to manage its entries.

Nginx, top-level installation

Put the map in Nginx's http context:

map $uri $tinymash_admin_realm {
    default off;
    ~^/admin(?:/|$) "tinymash admin";
}

Add the policy to the existing site server block without replacing its front-controller locations:

auth_basic $tinymash_admin_realm;
auth_basic_user_file /etc/tinymash/admin.htpasswd;

Nginx, sub-URL installation

Use the browser-visible prefix in the map:

map $uri $tinymash_admin_realm {
    default off;
    ~^/tinymash/admin(?:/|$) "tinymash admin";
}

The server block uses the same auth_basic and auth_basic_user_file directives. Use only one applicable map for an installation.

Apache, top-level installation

Add this inside the existing VirtualHost:

<LocationMatch "^/admin(?:/|$)">
    AuthType Basic
    AuthName "tinymash admin"
    AuthBasicProvider file
    AuthUserFile /etc/tinymash/admin.htpasswd
    Require valid-user
</LocationMatch>

Apache, sub-URL installation

Use the browser-visible prefix:

<LocationMatch "^/tinymash/admin(?:/|$)">
    AuthType Basic
    AuthName "tinymash admin"
    AuthBasicProvider file
    AuthUserFile /etc/tinymash/admin.htpasswd
    Require valid-user
</LocationMatch>

The sub-URL examples scope authentication only. The installation must already route correctly below that prefix.

Whole-site protection

A private or development site can protect the complete virtual host. Visitors then need the web-server credential before tinymash can evaluate any route.

Whole-site protection prevents ordinary secret links from bypassing the outer prompt. Do not use it when secret-link guests must enter without the HTTP Basic credential.

Markdown Sync supports a whole-site prompt. Put the separate web-server username and password in the profile's http_basic object; the client sends them independently from the scoped sync token.

After reloading the server, verify the admin prompt, tinymash sign-in, public pages, /s/<token>, routed media, and any Markdown Sync connection separately.