Basic Auth

To generate the user:password string, use the following command (note the $ is escaped as $$):

echo $(htpasswd -nbB <user> "<password>") | sed -e s/\$/\$\$/g

Add a section labels:to the web service in your docker-compose.yml (note the literals http-webserver-demo, https-webserver-demo and https-webserver-demo-api can be replaced by any other literals, as long as they are unique names within your setup. You may as well leave them as they are, though) with the following contents:

# docker-compose.yml
services:
    ...
    web:
        ...
        labels:
            - traefik.enable=true
            - 'traefik.http.middlewares.auth.basicauth.users=<user:password>'
            - traefik.http.middlewares.gzip.compress=true
            - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
            - traefik.http.routers.http-webserver-demo.entryPoints=http
            - traefik.http.routers.http-webserver-demo.middlewares=redirect-to-https
            - 'traefik.http.routers.http-webserver-demo.rule=Host(`<your.site>`) && PathPrefix(`/`)'
            - traefik.http.routers.http-webserver-demo.service=http-webserver-demo
            - traefik.http.routers.https-webserver-demo.entryPoints=https
            - 'traefik.http.routers.https-webserver-demo.middlewares=gzip,auth'
            - 'traefik.http.routers.https-webserver-demo.rule=Host(`<your.site>`) && PathPrefix(`/`) && !PathPrefix(`/api`)'
            - traefik.http.routers.https-webserver-demo.service=https-webserver-demo
            - traefik.http.routers.https-webserver-demo.tls.certresolver=letsencrypt
            - traefik.http.routers.https-webserver-demo.tls=true
            - 'traefik.http.routers.https-webserver-demo-api.rule=Host(`<your.site>`) && PathPrefix(`/api`)'
            - traefik.http.routers.https-webserver-demo-api.service=https-webserver-demo-api
            - traefik.http.routers.https-webserver-demo-api.tls.certresolver=letsencrypt
            - traefik.http.routers.https-webserver-demo-api.tls=true
            - traefik.http.services.http-webserver-demo.loadbalancer.server.port=8000
            - traefik.http.services.https-webserver-demo.loadbalancer.server.port=8000
            - traefik.http.services.https-webserver-demo-api.loadbalancer.server.port=8000
    ...

Remove the domain setting for the web container in the resource setup (if you forget to do so, Coolify most likely will remove it automatically for you).