diff --git a/.env.sample b/.env.sample
index 8a07293..2de110c 100644
--- a/.env.sample
+++ b/.env.sample
@@ -36,6 +36,10 @@ DB_DOCKER_IMAGE=ghcr.io/baosystems/postgis:${DB_DOCKER_VERSION}
 # TODO: maybe to use for Upgrading to a new Postgres version? (NOTE: does not work with postgis data)
 # DB_DOCKER_IMAGE=pgautoupgrade/pgautoupgrade:16-alpine
 
+## BASIC_AUTH
+## Use 'echo $(htpasswd -nB username)' to generate the secret and store it in secret 'usersfile', multiple user/hashedpassword combinations can be added as comma separated list
+#COMPOSE_FILE="$COMPOSE_FILE:compose.basicauth.yml"
+#SECRET_USERSFILE_VERSION=v1
 
 # enter your instance's domain name
 DOMAIN=bonfire.example.com
diff --git a/compose.basicauth.yml b/compose.basicauth.yml
new file mode 100644
index 0000000..ed0278d
--- /dev/null
+++ b/compose.basicauth.yml
@@ -0,0 +1,14 @@
+version: "3.8"
+services:
+  app:
+    secrets:
+      - usersfile
+    deploy:
+      labels:
+        - "traefik.http.middlewares.${STACK_NAME}_basicauth.basicauth.usersFile=/run/secrets/usersfile"
+        - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_basicauth"
+
+secrets:
+  usersfile:
+    name: ${STACK_NAME}_usersfile_${SECRET_USERSFILE_VERSION}
+    external: true
\ No newline at end of file