feat: add nginx configuration and basic auth setup for documentation site

Author: cakeinpanic

.env.example

@@ -0,0 +1,3 @@
+# Required
+BASIC_AUTH_USER=
+BASIC_AUTH_PASS=

Dockerfile

@@ -9,7 +9,14 @@ RUN npm ci
 COPY . .
 RUN npm run build
 
-# ---- Production image: serves the prebuilt static site via nginx ----
+# ---- Production image: serves the prebuilt static site via nginx, behind basic auth ----
 FROM nginxinc/nginx-unprivileged:1.27-alpine AS prod
+USER root
+RUN apk add --no-cache apache2-utils
 COPY --from=build /app/build /usr/share/nginx/html
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY docker/start.sh /usr/local/bin/start.sh
+RUN chmod +x /usr/local/bin/start.sh
+USER nginx
 EXPOSE 8080
+CMD ["/usr/local/bin/start.sh"]

docker-compose.yml

@@ -2,5 +2,8 @@ services:
   docs-prod:
     build:
       context: .
+    environment:
+      BASIC_AUTH_USER: ${BASIC_AUTH_USER:?BASIC_AUTH_USER is required}
+      BASIC_AUTH_PASS: ${BASIC_AUTH_PASS:?BASIC_AUTH_PASS is required}
     ports:
       - '3000:8080'

docker/nginx.conf

@@ -0,0 +1,21 @@
+server {
+    listen 8080;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    auth_basic "Docs Preview";
+    auth_basic_user_file /tmp/.htpasswd;
+
+    location = /health {
+        auth_basic off;
+        access_log off;
+        default_type text/plain;
+        return 200 "ok";
+    }
+
+    location / {
+        try_files $uri $uri/ $uri.html =404;
+    }
+}

docker/start.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+# Source vault-injected secrets if present (K8s openbao/vault agent)
+[ -f /vault/secrets/auth ] && . /vault/secrets/auth
+
+: "${BASIC_AUTH_USER:?BASIC_AUTH_USER env var is required}"
+: "${BASIC_AUTH_PASS:?BASIC_AUTH_PASS env var is required}"
+
+htpasswd -bc /tmp/.htpasswd "$BASIC_AUTH_USER" "$BASIC_AUTH_PASS"
+
+exec nginx -g 'daemon off;'