HTTP BasicAuth at Traefik, not in the applications. Browsers get a login prompt; curl needs -u user:pass. Internal Docker traffic (storefront SSR → api:3001, container HEALTHCHECKs) does not pass through Traefik and is not gated.
Control
Detail
Middleware
bytebite-staging-auth (Docker provider)
Scope
staging.getbytebite.co and *.staging.getbytebite.co HTTPS routers in compose.deploy.yml
Realm
ByteBite Staging
Credential
Hashed user:hash in Dokploy env STAGING_BASIC_AUTH_USERS — never Git
Header forwarding
removeHeader=true — Authorization is not sent to the apps
Out of scope
dokploy.getbytebite.co (own login); HTTP entrypoint (redirect only); future production hosts
Generate the Dokploy value (SHA is Compose-safe because the hash has no $):
Set STAGING_BASIC_AUTH_USERS in the Dokploy compose environment, then redeploy (labels are interpolated at compose parse time; a container restart is not enough). Changing the password uses the same flow. Compose refuses to start if the variable is unset (:? interpolation).
This is a shared team gate, not application authentication (ADR-019). Rotate if the password is pasted into tickets or screenshots.
Requests such as /.env, /.git/HEAD, /.git/config to the dashboard return HTTP 200 with the SPA index.html (~566 bytes). This is not evidence of real file exposure but is undesirable HTTP semantics. Storefront and docs correctly return 404 for these paths.
Public internet scanners probe common paths (.env, .git, GraphQL, PHP, WordPress). This is normal for internet-exposed services and does not indicate compromise.