How to protect a web application running in a Docker container by username and password?

Question

I have written a Node.js web application that gets packaged as a Docker image. I can run this image, and everything is perfectly fine.

Now I would like to show the web application so someone else, so I would like to run the Docker image on a server on the internet - but I do not want it to be publicly available to everyone. As a minimal level of protection I'd like to add that you need to enter your username and password - without the need to change the web application or its Docker image.

How could I do this?

One option I can think of is not to expose the Docker image at all to the public, but have a second image using e.g. Nginx, which then uses the Node.js image as upstream, but handles authentication before passing through.

Does this sound reasonable, or is there an easier way?