Putting a password on staging is one PATCH

The client wants to see the staging site. Nobody else should. Your Next.js app has no auth yet, and you're not adding a fake login screen for a review.

You PATCH a password group onto the container's proxy permissions and give it access to http: [3000]. The proxy now asks for HTTP Basic Auth before anything reaches your process. The app didn't change. The build didn't change. You send the client the URL and the password in two messages.

When the site launches, you delete the group. When the next client comes along, you add a different one. The same container can carry an IP allowlist for the office and a password for outsiders at once.

The password lives in front of the app, not inside it.