diff --git a/docs/lab/prod/on-router/README.md b/docs/lab/prod/on-router/README.md
index a16e348..87d87c5 100644
--- a/docs/lab/prod/on-router/README.md
+++ b/docs/lab/prod/on-router/README.md
@@ -47,6 +47,50 @@ The API has no authentication and announces into a real AS, so do not expose
 port 8080. Put a reverse proxy in front with TLS and a class password. The
 event stream is long-lived, so the proxy must not buffer it.
 
+Apache (tested against a local instance: 401 without the password, pages,
+API and POSTs through the proxy, and events arriving within 50 ms):
+
+    <VirtualHost *:80>
+        ServerName lab.example.net
+        Redirect permanent "/" "https://lab.example.net/"
+    </VirtualHost>
+
+    <VirtualHost *:443>
+        ServerName lab.example.net
+
+        SSLEngine on
+        SSLCertificateFile    /etc/letsencrypt/live/lab.example.net/fullchain.pem
+        SSLCertificateKeyFile /etc/letsencrypt/live/lab.example.net/privkey.pem
+
+        # Everything behind one class password.
+        <Location "/">
+            AuthType Basic
+            AuthName "BGP lab"
+            AuthUserFile /etc/apache2/ferrix.htpasswd
+            Require valid-user
+        </Location>
+
+        ProxyPreserveHost On
+        ProxyPass        "/" "http://127.0.0.1:8080/"
+        ProxyPassReverse "/" "http://127.0.0.1:8080/"
+
+        # ferrix has no use for the password; do not pass it on.
+        RequestHeader unset Authorization
+
+        # The status page follows a long-lived event stream. If mod_deflate
+        # compresses it, events sit in the compressor and never arrive.
+        SetEnvIf Request_URI "^/api/events" no-gzip=1
+    </VirtualHost>
+
+Modules: `proxy proxy_http ssl headers setenvif auth_basic authn_file`.
+Create the password file with `htpasswd -c -B /etc/apache2/ferrix.htpasswd student`.
+To also limit it to known networks, replace `Require valid-user` with
+
+    <RequireAll>
+        Require valid-user
+        Require ip 192.0.2.0/24 2001:db8::/32
+    </RequireAll>
+
 Caddy:
 
     lab.example.net {
@@ -70,7 +114,7 @@ nginx, inside a TLS `server` block:
     }
 
 Restricting the proxy to the university's address ranges as well is cheap
-and worth doing.
+and worth doing. Only the Apache example has been tested.
 
 ## Things to know