diff --git a/apps/ignis/chart/templates/basic-auth.yaml b/apps/ignis/chart/templates/basic-auth.yaml
new file mode 100644
index 0000000..829fc8b
--- /dev/null
+++ b/apps/ignis/chart/templates/basic-auth.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.auth.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+type: Opaque
+stringData:
+  .htpasswd: {{ .Values.auth.htpasswd | quote }}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: {{ .Release.Name }}
+  basicAuth:
+    users:
+      name: {{ .Release.Name }}-basic-auth
+{{- end }}
diff --git a/apps/ignis/chart/templates/httproute.yaml b/apps/ignis/chart/templates/httproute.yaml
index d974dc9..11f0adb 100644
--- a/apps/ignis/chart/templates/httproute.yaml
+++ b/apps/ignis/chart/templates/httproute.yaml
@@ -3,8 +3,9 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ .Release.Name }}
-  # No built-in auth in Ignis itself — LAN-only exposure, same tradeoff
-  # already accepted for Vault in cluster-platform.
+  # Ignis has no built-in auth — basic-auth enforced at the gateway via
+  # SecurityPolicy (see basic-auth.yaml), required since one hostname is
+  # public-facing (ignis.fireflylab.cc).
 spec:
   parentRefs:
     - name: envoy-gateway
diff --git a/apps/ignis/chart/values.yaml b/apps/ignis/chart/values.yaml
index 78e77a1..d61fa18 100644
--- a/apps/ignis/chart/values.yaml
+++ b/apps/ignis/chart/values.yaml
@@ -40,3 +40,9 @@ httpRoute:
   hostnames:
     - ignis.fireflylab.local
     - ignis.fireflylab.cc
+
+auth:
+  enabled: true
+  # bcrypt htpasswd line, e.g. output of: htpasswd -nB <user>
+  # Generate this yourself — do not put the plaintext password here.
+  htpasswd: "duynguyen:$2y$05$0hgFpQXdm1arjoEG5Gqs5.Q0Bl8YGOgXVLzBXdQjCnBTRgR1sYb9O"