Gebos/nix/supabase

Supabase compose stack

Vendored from the official Supabase self-hosting bundle, with two deliberate changes:

1. The bundled db service is removed. Every service that talks to Postgres reads POSTGRES_HOST / POSTGRES_PORT from the environment and connects to the external db-host. The systemd unit (nix/modules/gebos-supabase.nix) injects these from /etc/gebos/secrets.env.

2. Studio is bound to 127.0.0.1 only. There is no public route to it. To use it from your laptop:

   ssh -L 3000:127.0.0.1:3000 app-host
   open http://localhost:3000
   

   This is intentional — Studio runs with the service_role JWT and bypasses RLS. Putting it on the public internet behind only HTTP basic auth (the default) is too thin.

What's in here

• docker-compose.yml — the stack itself
• init.sql — schemas, roles, and extensions Postgres needs before the compose services come up. Loaded by nix/modules/gebos-postgres.nix.
• kong.yml — Kong's declarative routing (to be vendored alongside the compose file when we copy it in).

Updating the vendored compose

When upstream Supabase ships a new compose layout, re-vendor by:

1. Copy upstream docker/docker-compose.yml over docker-compose.yml.
2. Remove the db: service block.
3. Replace every db:5432 / postgres:5432 reference with ${POSTGRES_HOST}:${POSTGRES_PORT}.
4. Bind Studio to ${STUDIO_BIND}:3000 instead of 0.0.0.0:3000.
5. Commit, deploy, smoke-test through the SSH tunnel.