$ show singh-inder/supabase-automated-self-host
This repository provides a fully automated, one-command deployment of a self-hosted Supabase stack. The setup script (`setup.sh`) orchestrates the entire process: it installs dependencies, clones the repository, generates cryptographic secrets and JWT tokens, configures environment variables, and layers optional docker-compose overrides for Authelia 2FA, Nginx or Caddy reverse proxy, and SSL via Let's Encrypt. The architecture is a Docker Compose multi-service deployment including Supabase Studio, Kong API gateway, GoTrue auth, PostgREST, Realtime, Storage, Edge Functions, and a custom Postgres image. The code is production-grade with robust error handling, CI/CD pipelines (GitHub Actions) that test every configuration matrix (caddy/nginx, basic auth/authelia/redis), and comprehensive integration tests covering CRUD operations, storage, realtime subscriptions, and edge functions. The repository also includes advanced utilities for key management (asymmetric JWTs, opaque API keys) and a sophisticated Postgres 15-to-17 upgrade script (`upgrade-pg17.sh`) that handles binary extraction, pg_upgrade, and post-migration patches. While primarily a deployment tool, the scripts demonstrate high craftsmanship and are safely reusable as templates for similar self-hosting scenarios.
The LLM identified 4 files worth highlighting for reuse:
A comprehensive, self-contained Bash script that upgrades a self-hosted Supabase Postgres database from version 15 to 17 inside Docker. It pulls the target image, extracts binaries and libraries to a tarball, runs pg_upgrade via Supabase's own initiate.sh/complete.sh scripts, swaps data directories, starts the new container, and applies post-migration patches. Handles edge cases like incompatible extensions, disk space checks, and rollback guidance. This is a reusable pattern for any PostgreSQL major version upgrade in a Docker environment.
The primary entry point: a Bash script that performs an unattended setup of the entire Supabase self-hosted stack. It detects the OS and architecture, installs required packages, downloads external binaries (yq, url-parser), prompts for domain and credentials, generates cryptographic secrets and JWT tokens (supporting both symmetric and asymmetric keys), writes environment variables, dynamically updates docker-compose YAML files via yq, and configures reverse proxy and Authelia. Robust argument parsing (--with-authelia, --proxy), error handling, and CI support. This script could be adapted to bootstrap other multi-container stacks.
A utility that generates asymmetric key pairs (EC P-256) and opaque API keys for a running Supabase instance. It runs a Node.js script inside a temporary container to avoid local dependencies: creates an EC private/public key pair, produces JWKS with both symmetric (HS256) and asymmetric (ES256) keys, signs JWTs, and writes results to .env. Demonstrates a clean pattern for generating cryptographically strong credentials that can be reused in any project needing JWK rotation or API key management.
A custom Kong entrypoint that builds dynamic Lua expressions for request-transformer to translate opaque API keys into asymmetric JWTs. It uses environment variable substitution with awk to preserve YAML quoting, then injects the Lua logic into Kong's declarative config. This enables seamless upgrade from legacy symmetric JWT authentication to modern asymmetric (ES256) verification without breaking existing clients. The pattern is applicable to any Kong deployment needing dynamic API key translation.