sudo chown -R www-data:www-data /var/www/html*
sudo find /var/www/html/ -type d -exec chmod 775 {} \;
sudo find /var/www/html/ -type f -exec chmod 664 {} \;
sudo find /var/www/html -type d -exec chmod g+s {} \;
sudo systemctl restart nginx

Generate Basic Auth Credentials

sudo apt update
sudp apt install htpasswd

insecure default MD5

htpasswd -n testuser                                # generate cerdentials for user "werner" and display the results 
                                                    # on standard output rather than updating a file
htpasswd -c ~/public_html/.htpasswd testuser        # generate ".htpasswd" file and create credentials for user "werner"
htpasswd ~/public_html/.htpasswd testuser           # create or modify credentials for user "werner" in ".htpasswd" file

secure bcrypt

htpasswd -nBC 10 testuser
#        -n        Show ouput on stdout
#         -B       Use bcrypt encryption algorithm
#          -C 10   Computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)

Don't forget to escape dollar signs ($ → $$) in traefik docker compose files!

use this command:

echo $(htpasswd -nB werner) | sed -e s/\\$/\\$\\$/g

in the docker compose file:

...
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-prod"
      - "traefik.http.services.nginx-web-prod.loadbalancer.server.port=8180"
      - "traefik.http.routers.nginx-web-prod.middlewares=basicauth-prod"
      - "traefik.http.middlewares.basicauth-prod.basicauth.users=werner:$$apr1$$3FS0FG.s$$rc0h/7C36ABYDS45XKEQ."
...