# Shared basic auth for every ingress whose backend has no auth of its own
# (Prometheus, Alertmanager, Loki, Tempo, Alloy UI, OTLP ingest). Grafana uses
# its own login instead. The htpasswd secret is created by create-secrets.sh,
# never committed.
#
# Ingresses reference it as:
#   traefik.ingress.kubernetes.io/router.middlewares: ledgerline-observability-basic-auth@kubernetescrd
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: basic-auth
spec:
  basicAuth:
    secret: obs-basic-auth