Massed Compute

Adding authentication to web applications that lack built-in login systems is a common need. Whether you’re protecting a monitoring dashboard, admin interface, or internal tool, Nginx can provide that security layer as a reverse proxy.

This guide walks through setting up Nginx as an authentication gateway using HTTP Basic Auth (username/password prompts) and IP allowlisting. The proxy sits in front of your application, handling authentication before forwarding requests to the upstream service.

Tech Stack

Requirements

Massed Compute VM Pricing

Step-by-Step Deployment

curl -X POST https://api.massedcompute.com/v1/instances \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "sku": "cpu_mini_amd_epyc",
    "image": "ubuntu-22.04",
    "sshKeys": ["your-ssh-key-name"]
  }'

ssh ubuntu@YOUR_VM_IP

sudo apt-get update
sudo apt-get install -y nginx apache2-utils

sudo htpasswd -c /etc/nginx/.htpasswd admin
# Enter password when prompted

# Add additional users (without -c flag)
sudo htpasswd /etc/nginx/.htpasswd developer

sudo chown root:www-data /etc/nginx/.htpasswd
sudo chmod 640 /etc/nginx/.htpasswd

sudo tee /etc/nginx/sites-available/auth-gateway << 'EOF'
server {
    listen 80;
    server_name _;

    # Optional: IP allowlist (uncomment and modify)
    # allow 203.0.113.42;     # Your office IP
    # allow 10.0.0.0/8;       # Private network range
    # deny all;

    location / {
        # HTTP Basic Auth
        auth_basic "Protected Area";
        auth_basic_user_file /etc/nginx/.htpasswd;

        # Proxy to upstream service
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/auth-gateway /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx
sudo systemctl enable nginx

# Example: Start a simple Python server for testing
python3 -m http.server 3000 --bind 127.0.0.1

curl -u admin:your-password http://YOUR_VM_IP/

Troubleshooting

Login Prompt Not Appearing

Check the Nginx configuration syntax and service status:

sudo nginx -t
sudo systemctl status nginx
sudo journalctl -u nginx -f

403 Forbidden Errors

Verify password file permissions and content:

sudo ls -la /etc/nginx/.htpasswd
sudo cat /etc/nginx/.htpasswd

Upstream Connection Failed

Ensure your application is running and listening on localhost:

sudo netstat -tlnp | grep :3000
curl http://localhost:3000/

IP Allowlist Issues

Check your source IP and confirm allowlist configuration:

curl ifconfig.me  # Check your public IP
sudo tail -f /var/log/nginx/access.log

Skip All of This: Deploy with an AI Agent

This entire guide exists as a tested, machine-readable recipe in the Massed Compute MCP. Instead of running commands manually, connect an AI assistant and deploy with natural language.

Add this configuration to your MCP client:

{
  "mcpServers": {
    "massed-compute": {
      "type": "http",
      "url": "https://vm.massedcompute.com/api/mcp",
      "headers": { "Authorization": "Bearer MC_TOKEN" }
    }
  }
}

Then say:

The agent matches your request against the recipe catalog, provisions the right VM size, runs the setup and verification steps above, and reports back with the result. If any step fails, it stops and provides debugging information rather than continuing with a broken configuration.

This recipe was last tested on May 29, 2026.

Quick Setup Reference

For experienced users, here’s the condensed deployment sequence:

# 1. Launch VM and connect
ssh ubuntu@YOUR_VM_IP

# 2. Install packages
sudo apt-get update && sudo apt-get install -y nginx apache2-utils

# 3. Create credentials
sudo htpasswd -c /etc/nginx/.htpasswd admin
sudo chown root:www-data /etc/nginx/.htpasswd && sudo chmod 640 /etc/nginx/.htpasswd

# 4. Configure proxy (edit upstream port as needed)
sudo tee /etc/nginx/sites-available/auth-gateway << 'EOF'
server {
    listen 80;
    server_name _;
    location / {
        auth_basic "Protected Area";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
EOF

# 5. Enable and test
sudo ln -s /etc/nginx/sites-available/auth-gateway /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

Frequently Asked Questions