Add flag for enabling basic auth

README.md

@@ -69,3 +69,7 @@ Make sure you have the containers running:
     docker compose up
 
 Access [localhost:8000/{{ project_name }}/admin/](http://localhost:8000/{{ project_name }}/admin/).
+
+## Configuration / Environment Variables
+
+See `{{ project_name }}/config.py` for available configuration/environment variables.

project_name/config.py

@@ -33,6 +33,10 @@ class AppConfig(GoodConf):
         "test",
         description="Deploy environment",
     )
+    BASIC_AUTH_CREDENTIALS: str = Field(
+        default="",
+        description="Basic Auth credentials for the site in the format 'username:password'",
+    )
 
     class Config:
         default_files = ["{{ project_name }}.yml"]

project_name/wsgi.py

@@ -21,5 +21,14 @@
 # file. This includes Django's development server, if the WSGI_APPLICATION
 # setting points here.
 from django.core.wsgi import get_wsgi_application  # noqa: E402
+from {{ project }}.config import config  # noqa: E402
 
 application = get_wsgi_application()
+if config.BASIC_AUTH_CREDENTIALS:
+    import wsgi_basic_auth
+
+    application = wsgi_basic_auth.BasicAuth(
+        app=application,
+        users=dict([config.BASIC_AUTH_CREDENTIALS.split(":", 1)]),
+        exclude_paths=["/-/"],
+    )

pyproject.toml

@@ -12,6 +12,7 @@ dependencies = [
   "django-alive",
   "django-csp",
   "whitenoise",
+  "wsgi-basic-auth",
   "psycopg2",
 ]
 

requirements-dev.txt

@@ -270,6 +270,12 @@ typing-extensions==4.9.0 \
     #   django-stubs-ext
     #   mypy
     #   pydantic
+webob==1.8.7 \
+    --hash=sha256:73aae30359291c14fa3b956f8b5ca31960e420c28c1bec002547fb04928cf89b \
+    --hash=sha256:b64ef5141be559cfade448f044fa45c2260351edcb6a8ef6b7e00c7dcef0c323
+    # via
+    #   -c /app/requirements.txt
+    #   wsgi-basic-auth
 wheel==0.42.0 \
     --hash=sha256:177f9c9b0d45c47873b619f5b650346d632cdc35fb5e4d25058e09c9e581433d \
     --hash=sha256:c45be39f7882c9d34243236f2d63cbd58039e360f85d0913425fbd7ceea617a8
@@ -280,6 +286,12 @@ whitenoise==6.6.0 \
     # via
     #   -c /app/requirements.txt
     #   django-layout (pyproject.toml)
+wsgi-basic-auth==1.1.0 \
+    --hash=sha256:4afe7bafc2c8dae4d4232adca06d3cd49c833565378a3133a53d788cda5c37b3 \
+    --hash=sha256:956e61eaca26c5834bbce0097be5d4aaf19a86df3bc873988764ebf0f8422b66
+    # via
+    #   -c /app/requirements.txt
+    #   django-layout (pyproject.toml)
 
 # WARNING: The following packages were not pinned, but pip requires them to be
 # pinned when the requirements file includes hashes and the requirement is not

requirements.txt

@@ -151,7 +151,15 @@ typing-extensions==4.9.0 \
     # via
     #   dj-database-url
     #   pydantic
+webob==1.8.7 \
+    --hash=sha256:73aae30359291c14fa3b956f8b5ca31960e420c28c1bec002547fb04928cf89b \
+    --hash=sha256:b64ef5141be559cfade448f044fa45c2260351edcb6a8ef6b7e00c7dcef0c323
+    # via wsgi-basic-auth
 whitenoise==6.6.0 \
     --hash=sha256:8998f7370973447fac1e8ef6e8ded2c5209a7b1f67c1012866dbcd09681c3251 \
     --hash=sha256:b1f9db9bf67dc183484d760b99f4080185633136a273a03f6436034a41064146
     # via django-layout (pyproject.toml)
+wsgi-basic-auth==1.1.0 \
+    --hash=sha256:4afe7bafc2c8dae4d4232adca06d3cd49c833565378a3133a53d788cda5c37b3 \
+    --hash=sha256:956e61eaca26c5834bbce0097be5d4aaf19a86df3bc873988764ebf0f8422b66
+    # via django-layout (pyproject.toml)