# Persistent nginx/discourse.conf?
**URL:** https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363
**Category:** Self-hosting
**Created:** [April 15, 2018, 8:09am UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363 "2018-04-15T08:09:58Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ryanerwin](https://meta.discourse.org/u/ryanerwin)
#### Post date: [April 15, 2018, 8:09am UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363/1 "2018-04-15T08:09:58Z")
When I’m using the current default docker install of discourse, `./launcher enter app` the container, `/etc/nginx/conf.d/discourse.conf` contains:
```plaintext
location / {
root $public;
add_header ETag "";
# auth_basic on;
# auth_basic_user_file /etc/nginx/htpasswd;
location ~* (assets|plugins|uploads)/.*\.(eot|ttf|woff|woff2|ico)$ {
```
I would like to enable auth\_basic while working on my site, but I frequently end up doing `./launcher rebuild app` as there’s inevitably something else to reconfigure or something to change.
Unfortunately, each time this wipes out my basic auth, making my completely private site public. (other people looking at the site are especially interested in how registration for new users will work… so `basic auth` seems to be the best solution).
I’ve noticed that most of the “customizing nginx” discussion on meta talks about setting up a completely separate nginx instance, which certainly seems like overkill here considering what I want is already in the file, just commented out.
So what’s the right procedure so that my basic auth will survive reboots? Do I make my own pups template in /templates, or use write it at the bottom of my /containers/app.yml in the final `## Any custom commands to run after building` run: section?
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [April 15, 2018, 8:14am UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363/2 "2018-04-15T08:14:16Z")
Better choice can be to run your container behind an nginx reverse proxy to handle the auth\_basic
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [April 15, 2018, 8:46am UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363/3 "2018-04-15T08:46:10Z")
An alternative is to use [pups](https://github.com/discourse/pups) directives in your `app.yml` to have the modifications you need applied during rebuild 🙂
---
### Author:  [@ryanerwin](https://meta.discourse.org/u/ryanerwin)
#### Post date: [April 15, 2018, 8:51am UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363/4 "2018-04-15T08:51:04Z")
@fefrei thank you for your suggestion and for reading clearly 😄
---
### Author:  [@ryanerwin](https://meta.discourse.org/u/ryanerwin)
#### Post date: [April 15, 2018, 11:38am UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363/5 "2018-04-15T11:38:29Z")
If anyone else is looking to add auth\_basic to their site during development, and make it persistent across `./launcher rebuild app` just update your `containers/app.yml` with:
```plaintext
## Any custom commands to run after building
run:
- exec: echo "Beginning of custom commands"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# auth_basic on"
to: "auth_basic on"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# auth_basic_user_file /etc/nginx/htpasswd"
to: "auth_basic_user_file /etc/nginx/htpasswd"
- file:
path: "/etc/nginx/htpasswd"
contents: |
myuser:$apr1$pVrNvrxt$QvutzMrHfb2IYDNUOk54o0
# use: `openssl passwd -apr1` to generate password hash
```
Of course update **myuser** to be the actual username you want and run `openssl passwd -apr1` to generate a hash of your real password.
Or you could install a whole separate instance of nginx and create a reverse proxy just for this… Whichever is easier for you 😉
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 26, 2020, 8:57pm UTC](https://meta.discourse.org/t/persistent-nginx-discourse-conf/85363/6 "2020-08-26T20:57:12Z")
Thanks, @ryanerwin! This was a big help. If you’re counting on `/srv/status` to work for some reason, your solution breaks it. Here’s how to allow /srv/status to be served without `auth_basic`.
```plaintext
# basic auth
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# auth_basic on"
to: "auth_basic on"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# auth_basic_user_file /etc/nginx/htpasswd"
to: "auth_basic_user_file /etc/nginx/htpasswd"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "location = /srv/status {"
to: "location = /srv/status {
auth_basic off;"
- file:
path: "/etc/nginx/htpasswd"
contents: |
discourse:$apr1$y2JsCAxw$UuDgGdsoXNf.4Rl15Hp2b0
```
The above example is for user “discourse” and password “password”, though bad practice, we are just making sure that we get a password that a crawler won’t guess.
You can also generate a password something like this:
```
htpasswd -cb password_file user password
cat password_file
```