techgopal · Nov 8, 2026 · Nov 8, 2026 · Nov 9, 2026 · Nov 9, 2026
diff --git a/.sqlx/query-283975d29d5e20e97935b047e6e21b3250515d013a5b94d781e0d0a74b7e5643.json b/.sqlx/query-283975d29d5e20e97935b047e6e21b3250515d013a5b94d781e0d0a74b7e5643.json
diff --git a/.sqlx/query-3899586f164bbc4e4870f8fd249bfd481f6862f020588f520999680879472c93.json b/.sqlx/query-3899586f164bbc4e4870f8fd249bfd481f6862f020588f520999680879472c93.json
diff --git a/.sqlx/query-a3c0c816deffa02b368fc1426338a7c4a8534576181016d86797412df21c8b0b.json b/.sqlx/query-a3c0c816deffa02b368fc1426338a7c4a8534576181016d86797412df21c8b0b.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,17 @@
 All notable changes to Setu. Release notes are cut from the section
 matching the tag.
 
+## 0.1.7 — Unreleased
+
+### Added
+
+- **Per-site HTTP basic auth.** `PUT /api/v1/sites/{id}/basic-auth` with a
+  user name and password puts a login in front of one site; `DELETE`
+  removes it and `GET` shows the user name. Caddy enforces it on the
+  site's route. Only a bcrypt hash is stored, and no response or log
+  carries the password or the hash. A change runs as a `route_update` job
+  and leaves the site's status alone.
+
 ## 0.1.6 — 2026-10-23
 
 ### Fixed

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -51,6 +51,7 @@ tracing = { version = "0.1" }
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 utoipa = { version = "5", features = ["axum_extras", "chrono"] }
 argon2 = { version = "0.5" }
+bcrypt = { version = "0.19", default-features = false, features = ["std"] }
 chacha20poly1305 = { version = "0.10" }
 rand = { version = "0.9" }
 base64 = { version = "0.22" }