# Supabase compose stack

Vendored from the official Supabase self-hosting bundle, with two deliberate
changes:

1. The bundled `db` service is removed. Every service that talks to Postgres
   reads `POSTGRES_HOST` / `POSTGRES_PORT` from the environment and connects to
   the external `db-host`. The systemd unit (`nix/modules/gebos-supabase.nix`)
   injects these from `/etc/gebos/secrets.env`.

2. Studio is bound to `127.0.0.1` only. There is **no public route** to it.
   To use it from your laptop:

   ```
   ssh -L 3000:127.0.0.1:3000 app-host
   open http://localhost:3000
   ```

   This is intentional — Studio runs with the `service_role` JWT and bypasses
   RLS. Putting it on the public internet behind only HTTP basic auth (the
   default) is too thin.

## What's in here

- `docker-compose.yml` — the stack itself
- `init.sql` — schemas, roles, and extensions Postgres needs before the
  compose services come up. Loaded by `nix/modules/gebos-postgres.nix`.
- `kong.yml` — Kong's declarative routing (to be vendored alongside the compose
  file when we copy it in).

## Updating the vendored compose

When upstream Supabase ships a new compose layout, re-vendor by:

1. Copy upstream `docker/docker-compose.yml` over `docker-compose.yml`.
2. Remove the `db:` service block.
3. Replace every `db:5432` / `postgres:5432` reference with
   `${POSTGRES_HOST}:${POSTGRES_PORT}`.
4. Bind Studio to `${STUDIO_BIND}:3000` instead of `0.0.0.0:3000`.
5. Commit, deploy, smoke-test through the SSH tunnel.