feat: basic auth guide

Author: steveiliop56

docs/guides/advanced.md

@@ -1,4 +1,19 @@
-# Advanced configs
+# Advanced Guides
+
+## Authenticating to apps with basic auth
+
+Some apps already offer some sort of authentication method like basic auth (the browser pop-up). This can be inconvenient because you may need to login both in Tinyauth and in the protected app. Tinyauth supports authenticating to apps for you. This can be done by adding the basic auth labels to your protected app:
+
+```yaml
+tinyauth.basic.username: username
+tinyauth.basic.password.plain: password
+```
+
+After you restart your app and login to Tinyauth you should be automatically logged in to the protected app using basic auth.
+
+:::tip
+You can use the `tinyauth.basic.password.file` label instead of the plain one so as your password can remain safe in a secret file. Make sure to add the secret file as a volume to Tinyauth.
+:::
 
 ## Host network and Traefik
 

docs/reference/headers.md

@@ -45,7 +45,7 @@ Make sure to create a list of trusted proxy URLs that your app accepts headers f
 :::
 
 :::info
-In order for the labels to work the container name needs to be the same as the exposed domain. For example, if your app is exposed at `app.example.com`, then the container name has to be `app` else Tinyauth won't be able to pick up the labels. This is a temporary issue and it will be fixed in a future update.
+By default Tinyauth will use the subdomain name of the request and it will try to find a container with a matching name in order to search for the labels. For example, if the request host is `myapp.example.com`, Tinyauth will check for labels in the container named `myapp`. You can change this behavior using the `tinyauth.domain` label. For more information check the [access controls](../guides/access-controls.md#label-discovery) guide.
 :::
 
 ## Adding headers to proxy