Supabase
Supabase is an open-source backend built on Postgres. It provides authentication, an auto-generated REST API, realtime subscriptions, file storage, and the Studio dashboard. Quave ONE ships self-hosted Supabase as a Solution: one install creates every service, wires them together, and generates the secrets and API keys.
What gets created
| Component | Image | Role |
|---|---|---|
| Postgres | docker.io/quaveone/supabase-postgres | The Supabase Postgres image with the self-hosting init SQL built in. Data and the pgsodium root key (used by Vault) live on a persistent volume. |
| Postgres Meta | supabase/postgres-meta | The database management API used by Studio. |
| Auth | supabase/gotrue | User sign-up, sign-in, and JWT issuing. |
| REST API | postgrest/postgrest | The REST API generated from your schema. |
| Realtime | supabase/realtime | WebSocket subscriptions to database changes, broadcast, and presence. |
| Storage | supabase/storage-api | S3-compatible file storage. Files live on a persistent volume. |
| Studio | supabase/studio | The Supabase dashboard. |
| API Gateway | docker.io/quaveone/supabase-kong | Kong. The only public component. It serves the API and Studio from one URL. |
Only the API Gateway gets a public host. Every other component is reachable only inside your account's private network.
The default size is 11 zClouds in total, plus a 1 GB volume each for Postgres, Storage, and Studio snippets. Volumes can grow later; see disk autoresize.
Edge Functions, Analytics (Logflare), and the Supavisor connection pooler are not included. Studio pages for those features show an error.
Install
- Start a new project in your account and choose Solutions.
- Pick Supabase.
- Fill in the inputs, or leave them empty to accept the defaults:
| Input | Default | Notes |
|---|---|---|
| Site URL | http://localhost:3000 | Your application URL. Auth redirects here after sign-in and email confirmation. |
| Additional redirect URLs | Empty | Comma-separated URLs that Auth may also redirect to. |
| Studio username | supabase | Username for the Studio dashboard. The password is generated. |
- Confirm. Quave ONE creates Postgres first and the API Gateway last. It then sets the gateway's public URL on Auth, Storage, and Studio, which restarts those three components once.
- Copy the generated values shown when the install finishes:
| Value | Use |
|---|---|
ANON_KEY | Public API key for your frontend (supabase-js anonKey). Row Level Security applies. |
SERVICE_ROLE_KEY | Admin API key. It bypasses Row Level Security, so keep it on the server. |
DASHBOARD_PASSWORD | Studio password, used with the Studio username. |
JWT_SECRET | Signs every JWT. Both API keys are derived from it. |
POSTGRES_PASSWORD | Password for the database roles. |
S3_PROTOCOL_ACCESS_KEY_ID / S3_PROTOCOL_ACCESS_KEY_SECRET | Credentials for Storage's S3-compatible endpoint. |
These values are also stored as secret env vars on the created environments. For
example, SUPABASE_ANON_KEY and DASHBOARD_PASSWORD are on the API Gateway.
Use it
Your Supabase URL is the API Gateway's public host. Open the API Gateway environment and copy its host from Hosts.
import { createClient } from '@supabase/supabase-js';
const supabase = createClient('https://YOUR-API-GATEWAY-HOST', 'ANON_KEY');
Studio is served at the same URL. Open it in a browser and sign in with the
Studio username and DASHBOARD_PASSWORD.
The gateway routes these paths:
| Path | Service |
|---|---|
/auth/v1/ | Auth |
/rest/v1/ | REST API |
/realtime/v1/ | Realtime |
/storage/v1/ | Storage |
/pg/ | Postgres Meta (service role key only) |
/ | Studio (basic auth) |
Email and SMTP
No email provider is configured at install time, so Auth confirms email sign-ups
automatically (GOTRUE_MAILER_AUTOCONFIRM=true). To send confirmation, magic
link, and recovery emails, set these env vars on the Auth environment and apply
the changes:
GOTRUE_SMTP_HOST,GOTRUE_SMTP_PORT,GOTRUE_SMTP_USER,GOTRUE_SMTP_PASSGOTRUE_SMTP_ADMIN_EMAIL,GOTRUE_SMTP_SENDER_NAMEGOTRUE_MAILER_AUTOCONFIRM=false
OAuth providers use the GOTRUE_EXTERNAL_<PROVIDER>_* variables described in the
Supabase self-hosting docs.
Set each provider's redirect URI to https://YOUR-API-GATEWAY-HOST/auth/v1/callback.
Connect to Postgres directly
Postgres is not exposed to the internet. Inside the account, other environments
reach it at the Postgres component's internal host on port 5432, with user
postgres and POSTGRES_PASSWORD. From your machine, use the environment
console, or bring it into your tailnet with
Headscale Stack.
Day 2
- Rotating secrets.
ANON_KEYandSERVICE_ROLE_KEYare JWTs signed withJWT_SECRET. If you change the secret, sign new keys and update every component that holds them: Auth, REST API, Realtime, Storage, Studio, and API Gateway. - Scaling. Postgres and Storage keep state on volumes, so run a single container of each. Auth, REST API, and the API Gateway are stateless.
- Upgrades. Change the image tag of a component and redeploy it. Before you change the Postgres major version, read Supabase's upgrade notes.