diff --git a/modules/supabase/module.json b/modules/supabase/module.json
new file mode 100644
index 0000000..95358cd
--- /dev/null
+++ b/modules/supabase/module.json
@@ -0,0 +1,538 @@
+{
+  "module": "supabase",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "api",
+      "port": 8000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Kong gateway: the REST, auth, storage, realtime, functions and GraphQL APIs under their /\u2026/v1 paths, and Studio at / behind the dashboard password. The one surface people and apps use, reached through the route"
+    },
+    {
+      "name": "pooler-session",
+      "port": 5432,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "Supavisor's session-mode Postgres port, for clients that connect to the database directly as <user>.<tenant>"
+    },
+    {
+      "name": "pooler-transaction",
+      "port": 6543,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "Supavisor's transaction-mode Postgres port"
+    }
+  ],
+  "requires": [
+    "route",
+    "secret"
+  ],
+  "contributes": {
+    "route": {
+      "label": "supabase",
+      "endpoint": "api"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "secret": {
+      "postgres": "${dir:state}/postgres.secret",
+      "jwt": "${dir:state}/jwt.secret",
+      "anon-key": "${dir:state}/anon-key.secret",
+      "service-role-key": "${dir:state}/service-role-key.secret",
+      "dashboard-user": "${dir:state}/dashboard-user.secret",
+      "dashboard": "${dir:state}/dashboard.secret",
+      "logflare": "${dir:state}/logflare.secret",
+      "pooler-vault": "${dir:state}/pooler-vault.secret",
+      "key-base-a": "${dir:state}/key-base-a.secret",
+      "key-base-b": "${dir:state}/key-base-b.secret",
+      "openai": "${dir:state}/openai.secret"
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "db-init",
+      "type": "directory",
+      "path": "${dir:state}/db-init",
+      "mode": "0755"
+    },
+    {
+      "id": "functions-main-dir",
+      "type": "directory",
+      "path": "${dir:state}/functions-main",
+      "mode": "0755"
+    },
+    {
+      "id": "db-data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "105:106"
+    },
+    {
+      "id": "db-config",
+      "type": "directory",
+      "mode": "0755",
+      "owner": "105:106"
+    },
+    {
+      "id": "storage",
+      "type": "directory",
+      "mode": "0755"
+    },
+    {
+      "id": "functions",
+      "type": "directory",
+      "mode": "0755"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0644",
+      "merge": "json",
+      "content": "{\n  \"pooler\": {\n    \"tenant\": \"default\",\n    \"pool-size\": 20,\n    \"max-client-connections\": 100\n  }\n}\n"
+    },
+    {
+      "id": "kong-conf",
+      "type": "file",
+      "path": "${dir:state}/kong.yml",
+      "mode": "0600",
+      "owner": "100:65533",
+      "content": "# Written by the mesh (modules/supabase): the gateway's declarative config, credentials rendered in.\n_format_version: '2.1'\n_transform: true\n\n###\n### Consumers / Users\n###\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n      - key: \"${secret:anon-key}\"\n  - username: service_role\n    keyauth_credentials:\n      - key: \"${secret:service-role-key}\"\n\n###\n### Access Control List\n###\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\n\n###\n### Dashboard credentials\n###\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: \"${secret:dashboard-user}\"\n    password: \"${secret:dashboard}\"\n\n###\n### API Routes\n###\nservices:\n  ## Open Auth routes\n  - name: auth-v1-open\n    url: http://supabase-auth:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths:\n          - /auth/v1/verify\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://supabase-auth:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths:\n          - /auth/v1/callback\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://supabase-auth:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths:\n          - /auth/v1/authorize\n    plugins:\n      - name: cors\n\n  ## Secure Auth routes\n  - name: auth-v1\n    _comment: 'GoTrue: /auth/v1/* -> http://auth:9999/*'\n    url: http://supabase-auth:9999/\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths:\n          - /auth/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n\n  ## Secure REST routes\n  - name: rest-v1\n    _comment: 'PostgREST: /rest/v1/* -> http://rest:3000/*'\n    url: http://supabase-rest:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths:\n          - /rest/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n\n  ## Secure GraphQL routes\n  - name: graphql-v1\n    _comment: 'PostgREST: /graphql/v1/* -> http://rest:3000/rpc/graphql'\n    url: http://supabase-rest:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths:\n          - /graphql/v1\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - Content-Profile:graphql_public\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n\n  ## Secure Realtime routes\n  - name: realtime-v1-ws\n    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'\n    url: http://realtime-dev.supabase-realtime:4000/socket\n    protocol: ws\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths:\n          - /realtime/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-rest\n    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'\n    url: http://realtime-dev.supabase-realtime:4000/api\n    protocol: http\n    routes:\n      - name: realtime-v1-rest\n        strip_path: true\n        paths:\n          - /realtime/v1/api\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  ## Storage routes: the storage server manages its own auth\n  - name: storage-v1\n    _comment: 'Storage: /storage/v1/* -> http://storage:5000/*'\n    url: http://supabase-storage:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths:\n          - /storage/v1/\n    plugins:\n      - name: cors\n\n  ## Edge Functions routes\n  - name: functions-v1\n    _comment: 'Edge Functions: /functions/v1/* -> http://functions:9000/*'\n    url: http://supabase-edge-functions:9000/\n    routes:\n      - name: functions-v1-all\n        strip_path: true\n        paths:\n          - /functions/v1/\n    plugins:\n      - name: cors\n\n  ## Analytics routes\n  - name: analytics-v1\n    _comment: 'Analytics: /analytics/v1/* -> http://logflare:4000/*'\n    url: http://supabase-analytics:4000/\n    routes:\n      - name: analytics-v1-all\n        strip_path: true\n        paths:\n          - /analytics/v1/\n\n  ## Secure Database routes\n  - name: meta\n    _comment: 'pg-meta: /pg/* -> http://pg-meta:8080/*'\n    url: http://supabase-meta:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths:\n          - /pg/\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n\n  ## Protected Dashboard - catch all remaining routes\n  - name: dashboard\n    _comment: 'Studio: /* -> http://studio:3000/*'\n    url: http://supabase-studio:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths:\n          - /\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n"
+    },
+    {
+      "id": "auth-conf",
+      "type": "file",
+      "path": "${dir:state}/gotrue.env",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "content": "GOTRUE_API_HOST=0.0.0.0\nGOTRUE_API_PORT=9999\nAPI_EXTERNAL_URL=https://${bound:route:name}\nGOTRUE_DB_DRIVER=postgres\nGOTRUE_DB_DATABASE_URL=postgres://supabase_auth_admin:${secret:postgres}@supabase-db:5432/postgres\nGOTRUE_SITE_URL=https://${bound:route:name}\nGOTRUE_URI_ALLOW_LIST=\nGOTRUE_DISABLE_SIGNUP=true\nGOTRUE_JWT_ADMIN_ROLES=service_role\nGOTRUE_JWT_AUD=authenticated\nGOTRUE_JWT_DEFAULT_GROUP_NAME=authenticated\nGOTRUE_JWT_EXP=3600\nGOTRUE_JWT_SECRET=${secret:jwt}\nGOTRUE_EXTERNAL_EMAIL_ENABLED=false\nGOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED=false\nGOTRUE_MAILER_AUTOCONFIRM=false\nGOTRUE_SMTP_ADMIN_EMAIL=admin@example.com\nGOTRUE_SMTP_HOST=supabase-mail\nGOTRUE_SMTP_PORT=2500\nGOTRUE_SMTP_USER=fake_mail_user\nGOTRUE_SMTP_PASS=fake_mail_password\nGOTRUE_SMTP_SENDER_NAME=fake_sender\nGOTRUE_MAILER_URLPATHS_INVITE=/auth/v1/verify\nGOTRUE_MAILER_URLPATHS_CONFIRMATION=/auth/v1/verify\nGOTRUE_MAILER_URLPATHS_RECOVERY=/auth/v1/verify\nGOTRUE_MAILER_URLPATHS_EMAIL_CHANGE=/auth/v1/verify\nGOTRUE_EXTERNAL_PHONE_ENABLED=false\nGOTRUE_SMS_AUTOCONFIRM=true\n"
+    },
+    {
+      "id": "rest-conf",
+      "type": "file",
+      "path": "${dir:state}/postgrest.conf",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "content": "db-uri = \"postgres://authenticator:${secret:postgres}@supabase-db:5432/postgres\"\ndb-schemas = \"public,storage,graphql_public\"\ndb-anon-role = \"anon\"\njwt-secret = \"${secret:jwt}\"\ndb-use-legacy-gucs = false\napp.settings.jwt_secret = \"${secret:jwt}\"\napp.settings.jwt_exp = \"3600\"\n"
+    },
+    {
+      "id": "vector-conf",
+      "type": "file",
+      "path": "${dir:state}/vector.yml",
+      "mode": "0600",
+      "content": "# Written by the mesh (modules/supabase).\napi:\n  enabled: true\n  address: 0.0.0.0:9001\n\nsources:\n  docker_host:\n    type: docker_logs\n    include_containers:\n      - supabase-kong\n      - supabase-auth\n      - supabase-rest\n      - realtime-dev.supabase-realtime\n      - supabase-storage\n      - supabase-edge-functions\n      - supabase-db\n\ntransforms:\n  project_logs:\n    type: remap\n    inputs:\n      - docker_host\n    source: |-\n      .project = \"default\"\n      .event_message = del(.message)\n      .appname = del(.container_name)\n      del(.container_created_at)\n      del(.container_id)\n      del(.source_type)\n      del(.stream)\n      del(.label)\n      del(.image)\n      del(.host)\n      del(.stream)\n  router:\n    type: route\n    inputs:\n      - project_logs\n    route:\n      kong: '.appname == \"supabase-kong\"'\n      auth: '.appname == \"supabase-auth\"'\n      rest: '.appname == \"supabase-rest\"'\n      realtime: '.appname == \"realtime-dev.supabase-realtime\"'\n      storage: '.appname == \"supabase-storage\"'\n      functions: '.appname == \"supabase-edge-functions\"'\n      db: '.appname == \"supabase-db\"'\n  # Ignores non nginx errors since they are related with kong booting up\n  kong_logs:\n    type: remap\n    inputs:\n      - router.kong\n    source: |-\n      req, err = parse_nginx_log(.event_message, \"combined\")\n      if err == null {\n          .timestamp = req.timestamp\n          .metadata.request.headers.referer = req.referer\n          .metadata.request.headers.user_agent = req.agent\n          .metadata.request.headers.cf_connecting_ip = req.client\n          .metadata.request.method = req.method\n          .metadata.request.path = req.path\n          .metadata.request.protocol = req.protocol\n          .metadata.response.status_code = req.status\n      }\n      if err != null {\n        abort\n      }\n  # Ignores non nginx errors since they are related with kong booting up\n  kong_err:\n    type: remap\n    inputs:\n      - router.kong\n    source: |-\n      .metadata.request.method = \"GET\"\n      .metadata.response.status_code = 200\n      parsed, err = parse_nginx_log(.event_message, \"error\")\n      if err == null {\n          .timestamp = parsed.timestamp\n          .severity = parsed.severity\n          .metadata.request.host = parsed.host\n          .metadata.request.headers.cf_connecting_ip = parsed.client\n          url, err = split(parsed.request, \" \")\n          if err == null {\n              .metadata.request.method = url[0]\n              .metadata.request.path = url[1]\n              .metadata.request.protocol = url[2]\n          }\n      }\n      if err != null {\n        abort\n      }\n  # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.\n  auth_logs:\n    type: remap\n    inputs:\n      - router.auth\n    source: |-\n      parsed, err = parse_json(.event_message)\n      if err == null {\n          .metadata.timestamp = parsed.time\n          .metadata = merge!(.metadata, parsed)\n      }\n  # PostgREST logs are structured so we separate timestamp from message using regex\n  rest_logs:\n    type: remap\n    inputs:\n      - router.rest\n    source: |-\n      parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')\n      if err == null {\n          .event_message = parsed.msg\n          .timestamp = to_timestamp!(parsed.time)\n          .metadata.host = .project\n      }\n  # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)\n  realtime_logs:\n    type: remap\n    inputs:\n      - router.realtime\n    source: |-\n      .metadata.project = del(.project)\n      .metadata.external_id = .metadata.project\n      parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')\n      if err == null {\n          .event_message = parsed.msg\n          .metadata.level = parsed.level\n      }\n  # Storage logs may contain json objects so we parse them for completeness\n  storage_logs:\n    type: remap\n    inputs:\n      - router.storage\n    source: |-\n      .metadata.project = del(.project)\n      .metadata.tenantId = .metadata.project\n      parsed, err = parse_json(.event_message)\n      if err == null {\n          .event_message = parsed.msg\n          .metadata.level = parsed.level\n          .metadata.timestamp = parsed.time\n          .metadata.context[0].host = parsed.hostname\n          .metadata.context[0].pid = parsed.pid\n      }\n  # Postgres logs some messages to stderr which we map to warning severity level\n  db_logs:\n    type: remap\n    inputs:\n      - router.db\n    source: |-\n      .metadata.host = \"db-default\"\n      .metadata.parsed.timestamp = .timestamp\n\n      parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)\n\n      if err != null || parsed == null {\n        .metadata.parsed.error_severity = \"info\"\n      }\n      if parsed != null {\n       .metadata.parsed.error_severity = parsed.level\n      }\n      if .metadata.parsed.error_severity == \"info\" {\n          .metadata.parsed.error_severity = \"log\"\n      }\n      .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)\n\nsinks:\n  logflare_auth:\n    type: 'http'\n    inputs:\n      - auth_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=${secret:logflare}'\n  logflare_realtime:\n    type: 'http'\n    inputs:\n      - realtime_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=${secret:logflare}'\n  logflare_rest:\n    type: 'http'\n    inputs:\n      - rest_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=${secret:logflare}'\n  logflare_db:\n    type: 'http'\n    inputs:\n      - db_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    # We must route the sink through kong because ingesting logs before logflare is fully initialised will\n    # lead to broken queries from studio. This works by the assumption that containers are started in the\n    # following order: vector > db > logflare > kong\n    uri: 'http://supabase-kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=${secret:logflare}'\n  logflare_functions:\n    type: 'http'\n    inputs:\n      - router.functions\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=deno-relay-logs&api_key=${secret:logflare}'\n  logflare_storage:\n    type: 'http'\n    inputs:\n      - storage_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=${secret:logflare}'\n  logflare_kong:\n    type: 'http'\n    inputs:\n      - kong_logs\n      - kong_err\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 10\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=${secret:logflare}'\n"
+    },
+    {
+      "id": "pooler-conf",
+      "type": "file",
+      "path": "${dir:state}/pooler.exs",
+      "mode": "0644",
+      "content": "{:ok, _} = Application.ensure_all_started(:supavisor)\n\n# Written by the mesh (modules/supabase). Per-machine values come from settings.json (the module's\n# one merge:json file); secrets come from the environment the image reads.\nsettings = \"/etc/pooler/settings.json\" |> File.read!() |> Jason.decode!() |> Map.get(\"pooler\", %{})\n\n{:ok, version} =\n  case Supavisor.Repo.query!(\"select version()\") do\n    %{rows: [[ver]]} -> Supavisor.Helpers.parse_pg_version(ver)\n    _ -> nil\n  end\n\nparams = %{\n  \"external_id\" => to_string(settings[\"tenant\"] || \"default\"),\n  \"db_host\" => \"supabase-db\",\n  \"db_port\" => System.get_env(\"POSTGRES_PORT\"),\n  \"db_database\" => System.get_env(\"POSTGRES_DB\"),\n  \"require_user\" => false,\n  \"auth_query\" => \"SELECT * FROM pgbouncer.get_auth($1)\",\n  \"default_max_clients\" => settings[\"max-client-connections\"] || 100,\n  \"default_pool_size\" => settings[\"pool-size\"] || 20,\n  \"default_parameter_status\" => %{\"server_version\" => version},\n  \"users\" => [%{\n    \"db_user\" => \"pgbouncer\",\n    \"db_password\" => System.get_env(\"POSTGRES_PASSWORD\"),\n    \"mode_type\" => System.get_env(\"POOLER_POOL_MODE\"),\n    \"pool_size\" => settings[\"pool-size\"] || 20,\n    \"is_manager\" => true\n  }]\n}\n\ncase Supavisor.Tenants.get_tenant_by_external_id(params[\"external_id\"]) do\n  nil ->\n    {:ok, _} = Supavisor.Tenants.create_tenant(params)\n\n  # A tenant made elsewhere (HAL named the database host \"db\") is pointed at this module's\n  # database container; nothing else it holds is changed.\n  %{db_host: host} = tenant when host != \"supabase-db\" ->\n    {:ok, _} = Supavisor.Tenants.update_tenant(tenant, %{\"db_host\" => \"supabase-db\"})\n\n  _ ->\n    :ok\nend\n"
+    },
+    {
+      "id": "db-init-roles",
+      "type": "file",
+      "path": "${dir:state}/db-init/roles.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "\\set pgpass `echo \"$POSTGRES_PASSWORD\"`\n\nALTER USER authenticator WITH PASSWORD :'pgpass';\nALTER USER pgbouncer WITH PASSWORD :'pgpass';\nALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';\n"
+    },
+    {
+      "id": "db-init-jwt",
+      "type": "file",
+      "path": "${dir:state}/db-init/jwt.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "ALTER DATABASE postgres SET \"app.settings.jwt_secret\" TO '${secret:jwt}';\nALTER DATABASE postgres SET \"app.settings.jwt_exp\" TO '3600';\n"
+    },
+    {
+      "id": "db-init-realtime",
+      "type": "file",
+      "path": "${dir:state}/db-init/realtime.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\ncreate schema if not exists _realtime;\nalter schema _realtime owner to :pguser;\n"
+    },
+    {
+      "id": "db-init-supabase",
+      "type": "file",
+      "path": "${dir:state}/db-init/supabase.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\nCREATE DATABASE _supabase WITH OWNER :pguser;\n"
+    },
+    {
+      "id": "db-init-logs",
+      "type": "file",
+      "path": "${dir:state}/db-init/logs.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\n\\c _supabase\ncreate schema if not exists _analytics;\nalter schema _analytics owner to :pguser;\n\\c postgres\n"
+    },
+    {
+      "id": "db-init-pooler",
+      "type": "file",
+      "path": "${dir:state}/db-init/pooler.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\n\\c _supabase\ncreate schema if not exists _supavisor;\nalter schema _supavisor owner to :pguser;\n\\c postgres\n"
+    },
+    {
+      "id": "db-init-webhooks",
+      "type": "file",
+      "path": "${dir:state}/db-init/webhooks.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "content": "BEGIN;\n  -- Create pg_net extension\n  CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;\n  -- Create supabase_functions schema\n  CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;\n  GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;\n  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;\n  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;\n  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;\n  -- supabase_functions.migrations definition\n  CREATE TABLE supabase_functions.migrations (\n    version text PRIMARY KEY,\n    inserted_at timestamptz NOT NULL DEFAULT NOW()\n  );\n  -- Initial supabase_functions migration\n  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');\n  -- supabase_functions.hooks definition\n  CREATE TABLE supabase_functions.hooks (\n    id bigserial PRIMARY KEY,\n    hook_table_id integer NOT NULL,\n    hook_name text NOT NULL,\n    created_at timestamptz NOT NULL DEFAULT NOW(),\n    request_id bigint\n  );\n  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);\n  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);\n  COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';\n  CREATE FUNCTION supabase_functions.http_request()\n    RETURNS trigger\n    LANGUAGE plpgsql\n    AS $function$\n    DECLARE\n      request_id bigint;\n      payload jsonb;\n      url text := TG_ARGV[0]::text;\n      method text := TG_ARGV[1]::text;\n      headers jsonb DEFAULT '{}'::jsonb;\n      params jsonb DEFAULT '{}'::jsonb;\n      timeout_ms integer DEFAULT 1000;\n    BEGIN\n      IF url IS NULL OR url = 'null' THEN\n        RAISE EXCEPTION 'url argument is missing';\n      END IF;\n\n      IF method IS NULL OR method = 'null' THEN\n        RAISE EXCEPTION 'method argument is missing';\n      END IF;\n\n      IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN\n        headers = '{\"Content-Type\": \"application/json\"}'::jsonb;\n      ELSE\n        headers = TG_ARGV[2]::jsonb;\n      END IF;\n\n      IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN\n        params = '{}'::jsonb;\n      ELSE\n        params = TG_ARGV[3]::jsonb;\n      END IF;\n\n      IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN\n        timeout_ms = 1000;\n      ELSE\n        timeout_ms = TG_ARGV[4]::integer;\n      END IF;\n\n      CASE\n        WHEN method = 'GET' THEN\n          SELECT http_get INTO request_id FROM net.http_get(\n            url,\n            params,\n            headers,\n            timeout_ms\n          );\n        WHEN method = 'POST' THEN\n          payload = jsonb_build_object(\n            'old_record', OLD,\n            'record', NEW,\n            'type', TG_OP,\n            'table', TG_TABLE_NAME,\n            'schema', TG_TABLE_SCHEMA\n          );\n\n          SELECT http_post INTO request_id FROM net.http_post(\n            url,\n            payload,\n            params,\n            headers,\n            timeout_ms\n          );\n        ELSE\n          RAISE EXCEPTION 'method argument % is invalid', method;\n      END CASE;\n\n      INSERT INTO supabase_functions.hooks\n        (hook_table_id, hook_name, request_id)\n      VALUES\n        (TG_RELID, TG_NAME, request_id);\n\n      RETURN NEW;\n    END\n  $function$;\n  -- Supabase super admin\n  DO\n  $$\n  BEGIN\n    IF NOT EXISTS (\n      SELECT 1\n      FROM pg_roles\n      WHERE rolname = 'supabase_functions_admin'\n    )\n    THEN\n      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;\n    END IF;\n  END\n  $$;\n  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;\n  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;\n  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;\n  ALTER USER supabase_functions_admin SET search_path = \"supabase_functions\";\n  ALTER table \"supabase_functions\".migrations OWNER TO supabase_functions_admin;\n  ALTER table \"supabase_functions\".hooks OWNER TO supabase_functions_admin;\n  ALTER function \"supabase_functions\".http_request() OWNER TO supabase_functions_admin;\n  GRANT supabase_functions_admin TO postgres;\n  -- Remove unused supabase_pg_net_admin role\n  DO\n  $$\n  BEGIN\n    IF EXISTS (\n      SELECT 1\n      FROM pg_roles\n      WHERE rolname = 'supabase_pg_net_admin'\n    )\n    THEN\n      REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;\n      DROP OWNED BY supabase_pg_net_admin;\n      DROP ROLE supabase_pg_net_admin;\n    END IF;\n  END\n  $$;\n  -- pg_net grants when extension is already enabled\n  DO\n  $$\n  BEGIN\n    IF EXISTS (\n      SELECT 1\n      FROM pg_extension\n      WHERE extname = 'pg_net'\n    )\n    THEN\n      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n    END IF;\n  END\n  $$;\n  -- Event trigger for pg_net\n  CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()\n  RETURNS event_trigger\n  LANGUAGE plpgsql\n  AS $$\n  BEGIN\n    IF EXISTS (\n      SELECT 1\n      FROM pg_event_trigger_ddl_commands() AS ev\n      JOIN pg_extension AS ext\n      ON ev.objid = ext.oid\n      WHERE ext.extname = 'pg_net'\n    )\n    THEN\n      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n    END IF;\n  END;\n  $$;\n  COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';\n  DO\n  $$\n  BEGIN\n    IF NOT EXISTS (\n      SELECT 1\n      FROM pg_event_trigger\n      WHERE evtname = 'issue_pg_net_access'\n    ) THEN\n      CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')\n      EXECUTE PROCEDURE extensions.grant_pg_net_access();\n    END IF;\n  END\n  $$;\n  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');\n  ALTER function supabase_functions.http_request() SECURITY DEFINER;\n  ALTER function supabase_functions.http_request() SET search_path = supabase_functions;\n  REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;\n  GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;\nCOMMIT;\n"
+    },
+    {
+      "id": "functions-main",
+      "type": "file",
+      "path": "${dir:state}/functions-main/index.ts",
+      "mode": "0644",
+      "content": "import { serve } from 'https://deno.land/std@0.131.0/http/server.ts'\nimport * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'\n\nconsole.log('main function started')\n\nconst JWT_SECRET = Deno.env.get('JWT_SECRET')\nconst VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'\n\nfunction getAuthToken(req: Request) {\n  const authHeader = req.headers.get('authorization')\n  if (!authHeader) {\n    throw new Error('Missing authorization header')\n  }\n  const [bearer, token] = authHeader.split(' ')\n  if (bearer !== 'Bearer') {\n    throw new Error(`Auth header is not 'Bearer {token}'`)\n  }\n  return token\n}\n\nasync function verifyJWT(jwt: string): Promise<boolean> {\n  const encoder = new TextEncoder()\n  const secretKey = encoder.encode(JWT_SECRET)\n  try {\n    await jose.jwtVerify(jwt, secretKey)\n  } catch (err) {\n    console.error(err)\n    return false\n  }\n  return true\n}\n\nserve(async (req: Request) => {\n  if (req.method !== 'OPTIONS' && VERIFY_JWT) {\n    try {\n      const token = getAuthToken(req)\n      const isValidJWT = await verifyJWT(token)\n\n      if (!isValidJWT) {\n        return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {\n          status: 401,\n          headers: { 'Content-Type': 'application/json' },\n        })\n      }\n    } catch (e) {\n      console.error(e)\n      return new Response(JSON.stringify({ msg: e.toString() }), {\n        status: 401,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  const url = new URL(req.url)\n  const { pathname } = url\n  const path_parts = pathname.split('/')\n  const service_name = path_parts[1]\n\n  if (!service_name || service_name === '') {\n    const error = { msg: 'missing function name in request' }\n    return new Response(JSON.stringify(error), {\n      status: 400,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n\n  const servicePath = `/home/deno/functions/${service_name}`\n  console.error(`serving the request with ${servicePath}`)\n\n  const memoryLimitMb = 150\n  const workerTimeoutMs = 1 * 60 * 1000\n  const noModuleCache = false\n  const importMapPath = null\n  const envVarsObj = Deno.env.toObject()\n  const envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])\n\n  try {\n    const worker = await EdgeRuntime.userWorkers.create({\n      servicePath,\n      memoryLimitMb,\n      workerTimeoutMs,\n      noModuleCache,\n      importMapPath,\n      envVars,\n    })\n    return await worker.fetch(req)\n  } catch (e) {\n    const error = { msg: e.toString() }\n    return new Response(JSON.stringify(error), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n"
+    },
+    {
+      "id": "realtime-env",
+      "type": "file",
+      "path": "${dir:state}/realtime-env.env",
+      "mode": "0600",
+      "content": "PORT=4000\nDB_HOST=supabase-db\nDB_PORT=5432\nDB_USER=supabase_admin\nDB_PASSWORD=${secret:postgres}\nDB_NAME=postgres\nDB_AFTER_CONNECT_QUERY=SET search_path TO _realtime\nDB_ENC_KEY=supabaserealtime\nAPI_JWT_SECRET=${secret:jwt}\nSECRET_KEY_BASE=${secret:key-base-a}${secret:key-base-b}\nERL_AFLAGS=-proto_dist inet_tcp\nDNS_NODES=''\nRLIMIT_NOFILE=10000\nAPP_NAME=realtime\nSEED_SELF_HOST=true\nRUN_JANITOR=true\n"
+    },
+    {
+      "id": "storage-env",
+      "type": "file",
+      "path": "${dir:state}/storage-env.env",
+      "mode": "0600",
+      "content": "ANON_KEY=${secret:anon-key}\nSERVICE_KEY=${secret:service-role-key}\nPOSTGREST_URL=http://supabase-rest:3000\nPGRST_JWT_SECRET=${secret:jwt}\nDATABASE_URL=postgres://supabase_storage_admin:${secret:postgres}@supabase-db:5432/postgres\nFILE_SIZE_LIMIT=52428800\nSTORAGE_BACKEND=file\nFILE_STORAGE_BACKEND_PATH=/var/lib/storage\nTENANT_ID=stub\nREGION=stub\nGLOBAL_S3_BUCKET=stub\nENABLE_IMAGE_TRANSFORMATION=true\nIMGPROXY_URL=http://supabase-imgproxy:5001\n"
+    },
+    {
+      "id": "meta-env",
+      "type": "file",
+      "path": "${dir:state}/meta-env.env",
+      "mode": "0600",
+      "content": "PG_META_PORT=8080\nPG_META_DB_HOST=supabase-db\nPG_META_DB_PORT=5432\nPG_META_DB_NAME=postgres\nPG_META_DB_USER=supabase_admin\nPG_META_DB_PASSWORD=${secret:postgres}\n"
+    },
+    {
+      "id": "functions-env",
+      "type": "file",
+      "path": "${dir:state}/functions-env.env",
+      "mode": "0600",
+      "content": "JWT_SECRET=${secret:jwt}\nSUPABASE_URL=http://supabase-kong:8000\nSUPABASE_ANON_KEY=${secret:anon-key}\nSUPABASE_SERVICE_ROLE_KEY=${secret:service-role-key}\nSUPABASE_DB_URL=postgresql://postgres:${secret:postgres}@supabase-db:5432/postgres\nVERIFY_JWT=false\n"
+    },
+    {
+      "id": "analytics-env",
+      "type": "file",
+      "path": "${dir:state}/analytics-env.env",
+      "mode": "0600",
+      "content": "LOGFLARE_NODE_HOST=127.0.0.1\nDB_USERNAME=supabase_admin\nDB_DATABASE=_supabase\nDB_HOSTNAME=supabase-db\nDB_PORT=5432\nDB_PASSWORD=${secret:postgres}\nDB_SCHEMA=_analytics\nLOGFLARE_API_KEY=${secret:logflare}\nLOGFLARE_SINGLE_TENANT=true\nLOGFLARE_SUPABASE_MODE=true\nLOGFLARE_MIN_CLUSTER_SIZE=1\nPOSTGRES_BACKEND_URL=postgresql://supabase_admin:${secret:postgres}@supabase-db:5432/_supabase\nPOSTGRES_BACKEND_SCHEMA=_analytics\nLOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true\n"
+    },
+    {
+      "id": "studio-env",
+      "type": "file",
+      "path": "${dir:state}/studio-env.env",
+      "mode": "0600",
+      "content": "STUDIO_PG_META_URL=http://supabase-meta:8080\nPOSTGRES_PASSWORD=${secret:postgres}\nDEFAULT_ORGANIZATION_NAME=Default Organization\nDEFAULT_PROJECT_NAME=Default Project\nOPENAI_API_KEY=${secret:openai}\nSUPABASE_URL=http://supabase-kong:8000\nSUPABASE_PUBLIC_URL=https://${bound:route:name}\nSUPABASE_ANON_KEY=${secret:anon-key}\nSUPABASE_SERVICE_KEY=${secret:service-role-key}\nAUTH_JWT_SECRET=${secret:jwt}\nLOGFLARE_API_KEY=${secret:logflare}\nLOGFLARE_URL=http://supabase-analytics:4000\nNEXT_PUBLIC_ENABLE_LOGS=true\nNEXT_ANALYTICS_BACKEND_PROVIDER=postgres\n"
+    },
+    {
+      "id": "pooler-env",
+      "type": "file",
+      "path": "${dir:state}/pooler-env.env",
+      "mode": "0600",
+      "content": "PORT=4000\nPOSTGRES_PORT=5432\nPOSTGRES_DB=postgres\nPOSTGRES_PASSWORD=${secret:postgres}\nDATABASE_URL=ecto://supabase_admin:${secret:postgres}@supabase-db:5432/_supabase\nCLUSTER_POSTGRES=true\nSECRET_KEY_BASE=${secret:key-base-a}${secret:key-base-b}\nVAULT_ENC_KEY=${secret:pooler-vault}\nAPI_JWT_SECRET=${secret:jwt}\nMETRICS_JWT_SECRET=${secret:jwt}\nREGION=local\nERL_AFLAGS=-proto_dist inet_tcp\nRELEASE_NODE=supavisor@127.0.0.1\nPOOLER_POOL_MODE=transaction\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "supabase"
+    },
+    {
+      "id": "vector",
+      "type": "container",
+      "name": "supabase-vector",
+      "image": "timberio/vector@sha256:4bc04aca94a44f04b427a490f346e7397ef7ce61fe589d718f744f7d92cb5c80",
+      "network": "supabase",
+      "args": [
+        "--config",
+        "/etc/vector/vector.yml"
+      ],
+      "volumes": [
+        "${dir:state}/vector.yml:/etc/vector/vector.yml:ro",
+        "/var/run/docker.sock:/var/run/docker.sock:ro"
+      ],
+      "restart-on": [
+        "vector-conf"
+      ]
+    },
+    {
+      "id": "db-config-seed",
+      "type": "container",
+      "name": "supabase-db-config-seed",
+      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "network": "supabase",
+      "run-once": true,
+      "args": [
+        "sh",
+        "-c",
+        "cp -rn /etc/postgresql-custom/. /seed/ && chown -R postgres:postgres /seed"
+      ],
+      "volumes": [
+        "${dir:db-config}:/seed"
+      ]
+    },
+    {
+      "id": "db",
+      "type": "container",
+      "name": "supabase-db",
+      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "network": "supabase",
+      "args": [
+        "postgres",
+        "-c",
+        "config_file=/etc/postgresql/postgresql.conf",
+        "-c",
+        "log_min_messages=fatal"
+      ],
+      "env": {
+        "POSTGRES_HOST": "/var/run/postgresql",
+        "PGPORT": "5432",
+        "POSTGRES_PORT": "5432",
+        "PGDATABASE": "postgres",
+        "POSTGRES_DB": "postgres",
+        "POSTGRES_PASSWORD_FILE": "/run/secrets/postgres"
+      },
+      "volumes": [
+        "${dir:state}/postgres.secret:/run/secrets/postgres:ro",
+        "${dir:state}/db-init/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:ro",
+        "${dir:state}/db-init/webhooks.sql:/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql:ro",
+        "${dir:state}/db-init/roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:ro",
+        "${dir:state}/db-init/jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:ro",
+        "${dir:state}/db-init/supabase.sql:/docker-entrypoint-initdb.d/migrations/97-_supabase.sql:ro",
+        "${dir:state}/db-init/logs.sql:/docker-entrypoint-initdb.d/migrations/99-logs.sql:ro",
+        "${dir:state}/db-init/pooler.sql:/docker-entrypoint-initdb.d/migrations/99-pooler.sql:ro",
+        "${dir:db-data}:/var/lib/postgresql/data",
+        "${dir:db-config}:/etc/postgresql-custom"
+      ]
+    },
+    {
+      "id": "db-ready",
+      "type": "container",
+      "name": "supabase-db-ready",
+      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "network": "supabase",
+      "run-once": true,
+      "args": [
+        "sh",
+        "-c",
+        "for i in $(seq 150); do pg_isready -h supabase-db -p 5432 -U postgres && exit 0; sleep 2; done; echo 'the database did not come up' >&2; exit 1"
+      ]
+    },
+    {
+      "id": "analytics",
+      "type": "container",
+      "name": "supabase-analytics",
+      "image": "supabase/logflare@sha256:e693c787ffe1ae17b6e4e920a3cdd212416d3e1f97e1bd7cb5b67de0abbb0264",
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/analytics-env.env"
+      ],
+      "secrets-in-environment": "Logflare reads its database password and API key from the environment only"
+    },
+    {
+      "id": "analytics-ready",
+      "type": "container",
+      "name": "supabase-analytics-ready",
+      "image": "supabase/logflare@sha256:e693c787ffe1ae17b6e4e920a3cdd212416d3e1f97e1bd7cb5b67de0abbb0264",
+      "network": "supabase",
+      "run-once": true,
+      "args": [
+        "sh",
+        "-c",
+        "for i in $(seq 150); do curl -fsS -o /dev/null http://supabase-analytics:4000/health && exit 0; sleep 2; done; echo 'analytics did not come up' >&2; exit 1"
+      ]
+    },
+    {
+      "id": "kong",
+      "type": "container",
+      "name": "supabase-kong",
+      "image": "kong@sha256:1b53405d8680a09d6f44494b7990bf7da2ea43f84a258c59717d4539abf09f6d",
+      "network": "supabase",
+      "ports": [
+        "8000"
+      ],
+      "env": {
+        "KONG_DATABASE": "off",
+        "KONG_DECLARATIVE_CONFIG": "/home/kong/kong.yml",
+        "KONG_DNS_ORDER": "LAST,A,CNAME",
+        "KONG_PLUGINS": "request-transformer,cors,key-auth,acl,basic-auth",
+        "KONG_NGINX_PROXY_PROXY_BUFFER_SIZE": "160k",
+        "KONG_NGINX_PROXY_PROXY_BUFFERS": "64 160k"
+      },
+      "volumes": [
+        "${dir:state}/kong.yml:/home/kong/kong.yml:ro"
+      ],
+      "restart-on": [
+        "kong-conf"
+      ]
+    },
+    {
+      "id": "auth",
+      "type": "container",
+      "name": "supabase-auth",
+      "image": "supabase/gotrue@sha256:f8b871f46f3f9c5306af00d2fb856fb5479db730bb6d4fd2757b2da8abe953f9",
+      "network": "supabase",
+      "args": [
+        "auth",
+        "-c",
+        "/etc/gotrue/gotrue.env"
+      ],
+      "volumes": [
+        "${dir:state}/gotrue.env:/etc/gotrue/gotrue.env:ro"
+      ],
+      "restart-on": [
+        "auth-conf"
+      ]
+    },
+    {
+      "id": "rest",
+      "type": "container",
+      "name": "supabase-rest",
+      "image": "postgrest/postgrest@sha256:2cf1efd2c9c2e7606610c113cc73e936d8ce9ba089271cb9cbf11aa564bc30c7",
+      "network": "supabase",
+      "args": [
+        "postgrest",
+        "/etc/postgrest/postgrest.conf"
+      ],
+      "volumes": [
+        "${dir:state}/postgrest.conf:/etc/postgrest/postgrest.conf:ro"
+      ],
+      "restart-on": [
+        "rest-conf"
+      ]
+    },
+    {
+      "id": "realtime",
+      "type": "container",
+      "name": "realtime-dev.supabase-realtime",
+      "image": "supabase/realtime@sha256:104fe2e4e09a7c81eebe0c39e3a9b9dca4684f55470ca01cb3c080d1d56453a1",
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/realtime-env.env"
+      ],
+      "secrets-in-environment": "Supabase Realtime (Elixir release) reads DB_PASSWORD, API_JWT_SECRET and SECRET_KEY_BASE from its environment only; no file or _FILE form"
+    },
+    {
+      "id": "imgproxy",
+      "type": "container",
+      "name": "supabase-imgproxy",
+      "image": "darthsim/imgproxy@sha256:0facd355d50f3be665ebe674486f2b2e9cdaebd3f74404acd9b7fece2f661435",
+      "network": "supabase",
+      "env": {
+        "IMGPROXY_BIND": ":5001",
+        "IMGPROXY_LOCAL_FILESYSTEM_ROOT": "/",
+        "IMGPROXY_USE_ETAG": "true",
+        "IMGPROXY_ENABLE_WEBP_DETECTION": "true"
+      },
+      "volumes": [
+        "${dir:storage}:/var/lib/storage"
+      ]
+    },
+    {
+      "id": "storage",
+      "type": "container",
+      "name": "supabase-storage",
+      "image": "supabase/storage-api@sha256:1e85dad48e8b3e85890a555e5114dc7ee48c2e8be4cfd97dd4e3564b4f104fcd",
+      "network": "supabase",
+      "volumes": [
+        "${dir:storage}:/var/lib/storage"
+      ],
+      "env-file": [
+        "${dir:state}/storage-env.env"
+      ],
+      "secrets-in-environment": "Supabase Storage reads its keys and DATABASE_URL from the environment only"
+    },
+    {
+      "id": "meta",
+      "type": "container",
+      "name": "supabase-meta",
+      "image": "supabase/postgres-meta@sha256:d0a96973e9f1b6303f7500421a459af3d7273b3f9f1db38610899f9f573da7c7",
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/meta-env.env"
+      ],
+      "secrets-in-environment": "postgres-meta reads PG_META_DB_PASSWORD from the environment only"
+    },
+    {
+      "id": "functions",
+      "type": "container",
+      "name": "supabase-edge-functions",
+      "image": "supabase/edge-runtime@sha256:6f7ac3b363f6b278ff9235672a81504ad07709a07f62c50cd4fffb6708842ff1",
+      "network": "supabase",
+      "args": [
+        "start",
+        "--main-service",
+        "/home/deno/main"
+      ],
+      "volumes": [
+        "${dir:functions}:/home/deno/functions",
+        "${dir:state}/functions-main/index.ts:/home/deno/main/index.ts:ro"
+      ],
+      "env-file": [
+        "${dir:state}/functions-env.env"
+      ],
+      "secrets-in-environment": "the edge runtime's main service hands its own environment (JWT secret, service key, database URL) to every function worker by design; there is no other channel"
+    },
+    {
+      "id": "studio",
+      "type": "container",
+      "name": "supabase-studio",
+      "image": "supabase/studio@sha256:ebf492ba82db1fc9497f56e4cdebf5cddb464b61f6227e21c8f5f3693f9dbbc5",
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/studio-env.env"
+      ],
+      "secrets-in-environment": "Studio (Next.js) reads its keys, the database password and the OpenAI key from the environment only"
+    },
+    {
+      "id": "pooler",
+      "type": "container",
+      "name": "supabase-pooler",
+      "image": "supabase/supavisor@sha256:2f24ab556380db7aaf402d2ec5db09d1974739e685781a91a77ab5ae0dadb3a5",
+      "network": "supabase",
+      "ports": [
+        "5432",
+        "6543"
+      ],
+      "args": [
+        "/bin/sh",
+        "-c",
+        "/app/bin/migrate && /app/bin/supavisor eval \"$(cat /etc/pooler/pooler.exs)\" && /app/bin/server"
+      ],
+      "volumes": [
+        "${dir:state}/pooler.exs:/etc/pooler/pooler.exs:ro",
+        "${dir:state}/settings.json:/etc/pooler/settings.json:ro"
+      ],
+      "restart-on": [
+        "pooler-conf",
+        "settings"
+      ],
+      "env-file": [
+        "${dir:state}/pooler-env.env"
+      ],
+      "secrets-in-environment": "Supavisor reads DATABASE_URL, SECRET_KEY_BASE, VAULT_ENC_KEY and the JWT secret from the environment only"
+    }
+  ]
+}