Repository navigation
feat(nginx-proxy): Add wildcard HTTP auth support for WordPress multisite - #298
Merged
Merged
Conversation
Fix bug where blog.example.com incorrectly checked for _wildcard.blog.example.com instead of _wildcard.example.com. Changes: - 4+ part domains: check 3-part wildcard first, then 2-part fallback - 2-3 part domains: check 2-part wildcard directly - Fixed template formatting to match original style - Updated README with corrected lookup table
There was a problem hiding this comment.
Pull request overview
This pull request adds wildcard HTTP basic authentication support specifically designed for WordPress multisite subdomain configurations. It enables a single _wildcard.domain.com htpasswd file to protect both the main domain and all its subdomains.
Key changes:
- Implements cascading wildcard htpasswd lookup logic with support for multi-level TLDs (e.g.,
.co.in,.com.au) - Adds comprehensive documentation explaining the wildcard naming convention and lookup order
- Includes cleanup of trailing whitespace in unrelated parts of the template
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| nginx-proxy/nginx.tmpl | Implements wildcard htpasswd lookup with cascading logic for 2-4+ part domain names, replacing simple default fallback |
| nginx-proxy/README.md | Adds new README with detailed documentation of HTTP auth features, wildcard naming conventions, lookup order, and usage examples |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Sep 24, 2026
Merged
mrrobot47
added a commit
that referenced
this pull request
Sep 25, 2026
The wildcard lookup counted labels on the host instead of matching the site, so a subsite of a 4+ label subdomain multisite (*.ms.dev.example.com) never found _wildcard.ms.dev.example.com, while an unrelated site like shop.example.com picked up _wildcard.example.com and demanded another site's credentials. A _wildcard.X file now applies only to a host that is literally *.X; every other host uses its exact file or falls back to default. The ACL include uses the same mapping (vhost.d/_wildcard.X_acl for *.X hosts), including the mailhog and /ee-admin/ locations, so per-site IP whitelists also apply to subdomain hosts. BREAKING CHANGE: _wildcard.X now applies only to the literal *.X host, no longer to X itself, which needs its own exact htpasswd/X (and vhost.d/X_acl) file. The label-counting fallback from #298 (checking _wildcard.<last 3 labels>, then _wildcard.<last 2 labels>, for multi-level TLDs) is gone, so setups that relied on it to protect other hosts must add exact files for them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds wildcard htpasswd file support to enable HTTP basic authentication across WordPress multisite domains using a single htpasswd file.
Features
_wildcard.domain.comapplies HTTP auth todomain.comAND all subdomains (*.domain.com).co.in,.com.au, and other multi-level TLDsLookup Logic
blog.domain.co.in(4 parts)_wildcard.domain.co.in→_wildcard.co.in→defaultdomain.co.in(3 parts)_wildcard.co.in→defaultblog.example.com(3 parts)_wildcard.example.com→defaultexample.com(2 parts)_wildcard.example.com→default