43 lines
1.4 KiB
Markdown
43 lines
1.4 KiB
Markdown
# Supabase Self-Hosting
|
|
|
|
We do NOT vendor the Supabase docker-compose here — we track the official repo instead.
|
|
|
|
## Bootstrap on a fresh Hetzner VPS (Debian/Ubuntu)
|
|
|
|
```bash
|
|
# 1. Install Docker + Compose plugin
|
|
curl -fsSL https://get.docker.com | sh
|
|
sudo usermod -aG docker $USER
|
|
|
|
# 2. Clone Supabase's official self-host setup
|
|
git clone --depth 1 https://github.com/supabase/supabase.git
|
|
cd supabase/docker
|
|
|
|
# 3. Seed env
|
|
cp .env.example .env
|
|
# Edit .env: set POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY, SMTP creds,
|
|
# SITE_URL, API_EXTERNAL_URL, STUDIO_DEFAULT_ORGANIZATION etc.
|
|
|
|
# 4. Pull + run
|
|
docker compose pull
|
|
docker compose up -d
|
|
```
|
|
|
|
## Our repo owns
|
|
|
|
- `migrations/` — SQL migrations applied via Supabase CLI (`supabase db push`) to the self-hosted DB.
|
|
- `.env.example` — the subset of Supabase env vars our client code depends on.
|
|
- This README.
|
|
|
|
## Reverse proxy
|
|
|
|
Caddy setup lives in a separate directory (not part of this milestone). The public edge
|
|
terminates TLS and routes `/auth/*`, `/rest/*`, `/realtime/*`, `/storage/*`, `/functions/*`
|
|
to the compose stack, and `/` to Supabase Studio (ACL-restricted).
|
|
|
|
## Security notes
|
|
|
|
- Rotate JWT_SECRET at first boot; never reuse the example.
|
|
- SERVICE_ROLE_KEY never ships to any client — only edge functions / admin scripts.
|
|
- Enable RLS on every user-facing table. Invite-only enforced via `invites` table + policy.
|