diff --git a/roles/nginx/files/kipasswd b/roles/nginx/files/kipasswd
new file mode 100644
index 0000000..0822591
--- /dev/null
+++ b/roles/nginx/files/kipasswd
@@ -0,0 +1 @@
+dev:$apr1$btDCHvFb$g/e8.gemqHTdLzKBtUDjW1
diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml
index 09e9ce5..66383c6 100644
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@@ -2,10 +2,13 @@
   apt:
     name: nginx
 
-- name: be sure the nginx config file is present
+- name: be sure the nginx files are present
   copy:
-    src: ../files/nginx.conf
-    dest: /etc/nginx/nginx.conf
+    src: "../files/{{ item }}"
+    dest: "/etc/nginx/{{ item }}"
+  with_items:
+    - nginx.conf
+    - kipasswd
 
 - name: be sure nginx site config files are present
   template:
diff --git a/roles/nginx/templates/sites/ki.conf.j2 b/roles/nginx/templates/sites/ki.conf.j2
index 8e290c8..0e3f52c 100644
--- a/roles/nginx/templates/sites/ki.conf.j2
+++ b/roles/nginx/templates/sites/ki.conf.j2
@@ -25,6 +25,9 @@ server {
     }
 
     location / {
+        auth_basic "KI";
+        auth_basic_user_file /etc/nginx/kipasswd;
+
         proxy_pass http://localhost:{{ ki_frontend_port }};
         proxy_set_header Host            $http_host;
         proxy_set_header X-Real-IP       $remote_addr;