jochen
b87dc29706
vector handed logflare its API key as ?api_key= in every sink URL, and logflare 1.4.0 prints a failed request's whole URL in its Plug.Cowboy error report. Its ingest fails on every request here, so the key was in the analytics log about every ten seconds. The report is an error, so no log level hides it. Every sink now sends the key in the x-api-key header, which logflare reads first. A start script refuses to start logflare while the vector config it is given still puts the key in a URL. The key is marked "applied", not "at-start": logflare writes it into its default user once and never updates it, so the mesh must not rotate it by restarting.
558 lines
49 KiB
JSON
558 lines
49 KiB
JSON
{
|
|
"module": "supabase",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"listens": [
|
|
{
|
|
"name": "api",
|
|
"port": 8000,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the Kong gateway: the REST, auth, storage, realtime, functions and GraphQL APIs under their /\u2026/v1 paths, and Studio at / behind the dashboard password. The one surface people and apps use, reached through the route"
|
|
},
|
|
{
|
|
"name": "pooler-session",
|
|
"port": 5432,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "Supavisor's session-mode Postgres port, for clients that connect to the database directly as <user>.<tenant>"
|
|
},
|
|
{
|
|
"name": "pooler-transaction",
|
|
"port": 6543,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "Supavisor's transaction-mode Postgres port"
|
|
}
|
|
],
|
|
"requires": [
|
|
"route"
|
|
],
|
|
"own-secrets": {
|
|
"postgres": "${dir:state}/postgres.secret",
|
|
"jwt": "${dir:state}/jwt.secret",
|
|
"anon-key": "${dir:state}/anon-key.secret",
|
|
"service-role-key": "${dir:state}/service-role-key.secret",
|
|
"dashboard-user": "${dir:state}/dashboard-user.secret",
|
|
"dashboard": "${dir:state}/dashboard.secret",
|
|
"logflare": {
|
|
"path": "${dir:state}/logflare.secret",
|
|
"taken": "applied"
|
|
},
|
|
"pooler-vault": "${dir:state}/pooler-vault.secret",
|
|
"key-base-a": "${dir:state}/key-base-a.secret",
|
|
"key-base-b": "${dir:state}/key-base-b.secret",
|
|
"openai": "${dir:state}/openai.secret"
|
|
},
|
|
"contributes": {
|
|
"route": {
|
|
"label": "supabase",
|
|
"endpoint": "api"
|
|
}
|
|
},
|
|
"binds": {
|
|
"route": "${dir:state}/route.json"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "db-init",
|
|
"type": "directory",
|
|
"path": "${dir:state}/db-init",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "functions-main-dir",
|
|
"type": "directory",
|
|
"path": "${dir:state}/functions-main",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "db-data",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "105:106"
|
|
},
|
|
{
|
|
"id": "db-config",
|
|
"type": "directory",
|
|
"mode": "0755",
|
|
"owner": "105:106"
|
|
},
|
|
{
|
|
"id": "storage",
|
|
"type": "directory",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "functions",
|
|
"type": "directory",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "settings",
|
|
"type": "file",
|
|
"path": "${dir:state}/settings.json",
|
|
"mode": "0644",
|
|
"merge": "json",
|
|
"content": "{\n \"pooler\": {\n \"tenant\": \"default\",\n \"pool-size\": 20,\n \"max-client-connections\": 100\n }\n}\n"
|
|
},
|
|
{
|
|
"id": "kong-conf",
|
|
"type": "file",
|
|
"path": "${dir:state}/kong.yml",
|
|
"mode": "0600",
|
|
"owner": "100:65533",
|
|
"content": "# Written by the mesh (modules/supabase): the gateway's declarative config, credentials rendered in.\n_format_version: '2.1'\n_transform: true\n\n###\n### Consumers / Users\n###\nconsumers:\n - username: DASHBOARD\n - username: anon\n keyauth_credentials:\n - key: \"${secret:anon-key}\"\n - username: service_role\n keyauth_credentials:\n - key: \"${secret:service-role-key}\"\n\n###\n### Access Control List\n###\nacls:\n - consumer: anon\n group: anon\n - consumer: service_role\n group: admin\n\n###\n### Dashboard credentials\n###\nbasicauth_credentials:\n - consumer: DASHBOARD\n username: \"${secret:dashboard-user}\"\n password: \"${secret:dashboard}\"\n\n###\n### API Routes\n###\nservices:\n ## Open Auth routes\n - name: auth-v1-open\n url: http://supabase-auth:9999/verify\n routes:\n - name: auth-v1-open\n strip_path: true\n paths:\n - /auth/v1/verify\n plugins:\n - name: cors\n - name: auth-v1-open-callback\n url: http://supabase-auth:9999/callback\n routes:\n - name: auth-v1-open-callback\n strip_path: true\n paths:\n - /auth/v1/callback\n plugins:\n - name: cors\n - name: auth-v1-open-authorize\n url: http://supabase-auth:9999/authorize\n routes:\n - name: auth-v1-open-authorize\n strip_path: true\n paths:\n - /auth/v1/authorize\n plugins:\n - name: cors\n\n ## Secure Auth routes\n - name: auth-v1\n _comment: 'GoTrue: /auth/v1/* -> http://auth:9999/*'\n url: http://supabase-auth:9999/\n routes:\n - name: auth-v1-all\n strip_path: true\n paths:\n - /auth/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n\n ## Secure REST routes\n - name: rest-v1\n _comment: 'PostgREST: /rest/v1/* -> http://rest:3000/*'\n url: http://supabase-rest:3000/\n routes:\n - name: rest-v1-all\n strip_path: true\n paths:\n - /rest/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: true\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n\n ## Secure GraphQL routes\n - name: graphql-v1\n _comment: 'PostgREST: /graphql/v1/* -> http://rest:3000/rpc/graphql'\n url: http://supabase-rest:3000/rpc/graphql\n routes:\n - name: graphql-v1-all\n strip_path: true\n paths:\n - /graphql/v1\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: true\n - name: request-transformer\n config:\n add:\n headers:\n - Content-Profile:graphql_public\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n\n ## Secure Realtime routes\n - name: realtime-v1-ws\n _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'\n url: http://realtime-dev.supabase-realtime:4000/socket\n protocol: ws\n routes:\n - name: realtime-v1-ws\n strip_path: true\n paths:\n - /realtime/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: realtime-v1-rest\n _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'\n url: http://realtime-dev.supabase-realtime:4000/api\n protocol: http\n routes:\n - name: realtime-v1-rest\n strip_path: true\n paths:\n - /realtime/v1/api\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n ## Storage routes: the storage server manages its own auth\n - name: storage-v1\n _comment: 'Storage: /storage/v1/* -> http://storage:5000/*'\n url: http://supabase-storage:5000/\n routes:\n - name: storage-v1-all\n strip_path: true\n paths:\n - /storage/v1/\n plugins:\n - name: cors\n\n ## Edge Functions routes\n - name: functions-v1\n _comment: 'Edge Functions: /functions/v1/* -> http://functions:9000/*'\n url: http://supabase-edge-functions:9000/\n routes:\n - name: functions-v1-all\n strip_path: true\n paths:\n - /functions/v1/\n plugins:\n - name: cors\n\n ## Analytics routes\n - name: analytics-v1\n _comment: 'Analytics: /analytics/v1/* -> http://logflare:4000/*'\n url: http://supabase-analytics:4000/\n routes:\n - name: analytics-v1-all\n strip_path: true\n paths:\n - /analytics/v1/\n\n ## Secure Database routes\n - name: meta\n _comment: 'pg-meta: /pg/* -> http://pg-meta:8080/*'\n url: http://supabase-meta:8080/\n routes:\n - name: meta-all\n strip_path: true\n paths:\n - /pg/\n plugins:\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n\n ## Protected Dashboard - catch all remaining routes\n - name: dashboard\n _comment: 'Studio: /* -> http://studio:3000/*'\n url: http://supabase-studio:3000/\n routes:\n - name: dashboard-all\n strip_path: true\n paths:\n - /\n plugins:\n - name: cors\n - name: basic-auth\n config:\n hide_credentials: true\n"
|
|
},
|
|
{
|
|
"id": "auth-conf",
|
|
"type": "file",
|
|
"path": "${dir:state}/gotrue.env",
|
|
"mode": "0600",
|
|
"owner": "1000:1000",
|
|
"content": "GOTRUE_API_HOST=0.0.0.0\nGOTRUE_API_PORT=9999\nAPI_EXTERNAL_URL=https://${bound:route:name}\nGOTRUE_DB_DRIVER=postgres\nGOTRUE_DB_DATABASE_URL=postgres://supabase_auth_admin:${secret:postgres}@supabase-db:5432/postgres\nGOTRUE_SITE_URL=https://${bound:route:name}\nGOTRUE_URI_ALLOW_LIST=\nGOTRUE_DISABLE_SIGNUP=true\nGOTRUE_JWT_ADMIN_ROLES=service_role\nGOTRUE_JWT_AUD=authenticated\nGOTRUE_JWT_DEFAULT_GROUP_NAME=authenticated\nGOTRUE_JWT_EXP=3600\nGOTRUE_JWT_SECRET=${secret:jwt}\nGOTRUE_EXTERNAL_EMAIL_ENABLED=false\nGOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED=false\nGOTRUE_MAILER_AUTOCONFIRM=false\nGOTRUE_SMTP_ADMIN_EMAIL=admin@example.com\nGOTRUE_SMTP_HOST=supabase-mail\nGOTRUE_SMTP_PORT=2500\nGOTRUE_SMTP_USER=fake_mail_user\nGOTRUE_SMTP_PASS=fake_mail_password\nGOTRUE_SMTP_SENDER_NAME=fake_sender\nGOTRUE_MAILER_URLPATHS_INVITE=/auth/v1/verify\nGOTRUE_MAILER_URLPATHS_CONFIRMATION=/auth/v1/verify\nGOTRUE_MAILER_URLPATHS_RECOVERY=/auth/v1/verify\nGOTRUE_MAILER_URLPATHS_EMAIL_CHANGE=/auth/v1/verify\nGOTRUE_EXTERNAL_PHONE_ENABLED=false\nGOTRUE_SMS_AUTOCONFIRM=true\n"
|
|
},
|
|
{
|
|
"id": "rest-conf",
|
|
"type": "file",
|
|
"path": "${dir:state}/postgrest.conf",
|
|
"mode": "0600",
|
|
"owner": "1000:1000",
|
|
"content": "db-uri = \"postgres://authenticator:${secret:postgres}@supabase-db:5432/postgres\"\ndb-schemas = \"public,storage,graphql_public\"\ndb-anon-role = \"anon\"\njwt-secret = \"${secret:jwt}\"\ndb-use-legacy-gucs = false\napp.settings.jwt_secret = \"${secret:jwt}\"\napp.settings.jwt_exp = \"3600\"\n"
|
|
},
|
|
{
|
|
"id": "vector-conf",
|
|
"type": "file",
|
|
"path": "${dir:state}/vector.yml",
|
|
"mode": "0600",
|
|
"content": "# Written by the mesh (modules/supabase).\n#\n# Every sink hands logflare its API key in the x-api-key header, never as an api_key query parameter:\n# logflare prints a failed request's whole URL, query string included, in its error report, so a\n# key in the URL is a key in its log (novox/hq issue 268). supabase-analytics refuses to start\n# while this file still puts the key in a URL.\napi:\n enabled: true\n address: 0.0.0.0:9001\n\nsources:\n docker_host:\n type: docker_logs\n include_containers:\n - supabase-kong\n - supabase-auth\n - supabase-rest\n - realtime-dev.supabase-realtime\n - supabase-storage\n - supabase-edge-functions\n - supabase-db\n\ntransforms:\n project_logs:\n type: remap\n inputs:\n - docker_host\n source: |-\n .project = \"default\"\n .event_message = del(.message)\n .appname = del(.container_name)\n del(.container_created_at)\n del(.container_id)\n del(.source_type)\n del(.stream)\n del(.label)\n del(.image)\n del(.host)\n del(.stream)\n router:\n type: route\n inputs:\n - project_logs\n route:\n kong: '.appname == \"supabase-kong\"'\n auth: '.appname == \"supabase-auth\"'\n rest: '.appname == \"supabase-rest\"'\n realtime: '.appname == \"realtime-dev.supabase-realtime\"'\n storage: '.appname == \"supabase-storage\"'\n functions: '.appname == \"supabase-edge-functions\"'\n db: '.appname == \"supabase-db\"'\n # Ignores non nginx errors since they are related with kong booting up\n kong_logs:\n type: remap\n inputs:\n - router.kong\n source: |-\n req, err = parse_nginx_log(.event_message, \"combined\")\n if err == null {\n .timestamp = req.timestamp\n .metadata.request.headers.referer = req.referer\n .metadata.request.headers.user_agent = req.agent\n .metadata.request.headers.cf_connecting_ip = req.client\n .metadata.request.method = req.method\n .metadata.request.path = req.path\n .metadata.request.protocol = req.protocol\n .metadata.response.status_code = req.status\n }\n if err != null {\n abort\n }\n # Ignores non nginx errors since they are related with kong booting up\n kong_err:\n type: remap\n inputs:\n - router.kong\n source: |-\n .metadata.request.method = \"GET\"\n .metadata.response.status_code = 200\n parsed, err = parse_nginx_log(.event_message, \"error\")\n if err == null {\n .timestamp = parsed.timestamp\n .severity = parsed.severity\n .metadata.request.host = parsed.host\n .metadata.request.headers.cf_connecting_ip = parsed.client\n url, err = split(parsed.request, \" \")\n if err == null {\n .metadata.request.method = url[0]\n .metadata.request.path = url[1]\n .metadata.request.protocol = url[2]\n }\n }\n if err != null {\n abort\n }\n # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.\n auth_logs:\n type: remap\n inputs:\n - router.auth\n source: |-\n parsed, err = parse_json(.event_message)\n if err == null {\n .metadata.timestamp = parsed.time\n .metadata = merge!(.metadata, parsed)\n }\n # PostgREST logs are structured so we separate timestamp from message using regex\n rest_logs:\n type: remap\n inputs:\n - router.rest\n source: |-\n parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')\n if err == null {\n .event_message = parsed.msg\n .timestamp = to_timestamp!(parsed.time)\n .metadata.host = .project\n }\n # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)\n realtime_logs:\n type: remap\n inputs:\n - router.realtime\n source: |-\n .metadata.project = del(.project)\n .metadata.external_id = .metadata.project\n parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')\n if err == null {\n .event_message = parsed.msg\n .metadata.level = parsed.level\n }\n # Storage logs may contain json objects so we parse them for completeness\n storage_logs:\n type: remap\n inputs:\n - router.storage\n source: |-\n .metadata.project = del(.project)\n .metadata.tenantId = .metadata.project\n parsed, err = parse_json(.event_message)\n if err == null {\n .event_message = parsed.msg\n .metadata.level = parsed.level\n .metadata.timestamp = parsed.time\n .metadata.context[0].host = parsed.hostname\n .metadata.context[0].pid = parsed.pid\n }\n # Postgres logs some messages to stderr which we map to warning severity level\n db_logs:\n type: remap\n inputs:\n - router.db\n source: |-\n .metadata.host = \"db-default\"\n .metadata.parsed.timestamp = .timestamp\n\n parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)\n\n if err != null || parsed == null {\n .metadata.parsed.error_severity = \"info\"\n }\n if parsed != null {\n .metadata.parsed.error_severity = parsed.level\n }\n if .metadata.parsed.error_severity == \"info\" {\n .metadata.parsed.error_severity = \"log\"\n }\n .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)\n\nsinks:\n logflare_auth:\n type: 'http'\n inputs:\n - auth_logs\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n uri: 'http://supabase-analytics:4000/api/logs?source_name=gotrue.logs.prod'\n logflare_realtime:\n type: 'http'\n inputs:\n - realtime_logs\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n uri: 'http://supabase-analytics:4000/api/logs?source_name=realtime.logs.prod'\n logflare_rest:\n type: 'http'\n inputs:\n - rest_logs\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n uri: 'http://supabase-analytics:4000/api/logs?source_name=postgREST.logs.prod'\n logflare_db:\n type: 'http'\n inputs:\n - db_logs\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n # We must route the sink through kong because ingesting logs before logflare is fully initialised will\n # lead to broken queries from studio. This works by the assumption that containers are started in the\n # following order: vector > db > logflare > kong\n uri: 'http://supabase-kong:8000/analytics/v1/api/logs?source_name=postgres.logs'\n logflare_functions:\n type: 'http'\n inputs:\n - router.functions\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n uri: 'http://supabase-analytics:4000/api/logs?source_name=deno-relay-logs'\n logflare_storage:\n type: 'http'\n inputs:\n - storage_logs\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n uri: 'http://supabase-analytics:4000/api/logs?source_name=storage.logs.prod.2'\n logflare_kong:\n type: 'http'\n inputs:\n - kong_logs\n - kong_err\n encoding:\n codec: 'json'\n method: 'post'\n request:\n retry_max_duration_secs: 10\n headers:\n x-api-key: '${secret:logflare}'\n uri: 'http://supabase-analytics:4000/api/logs?source_name=cloudflare.logs.prod'\n"
|
|
},
|
|
{
|
|
"id": "pooler-conf",
|
|
"type": "file",
|
|
"path": "${dir:state}/pooler.exs",
|
|
"mode": "0644",
|
|
"content": "{:ok, _} = Application.ensure_all_started(:supavisor)\n\n# Written by the mesh (modules/supabase). Per-machine values come from settings.json (the module's\n# one merge:json file); secrets come from the environment the image reads.\nsettings = \"/etc/pooler/settings.json\" |> File.read!() |> Jason.decode!() |> Map.get(\"pooler\", %{})\n\n{:ok, version} =\n case Supavisor.Repo.query!(\"select version()\") do\n %{rows: [[ver]]} -> Supavisor.Helpers.parse_pg_version(ver)\n _ -> nil\n end\n\nparams = %{\n \"external_id\" => to_string(settings[\"tenant\"] || \"default\"),\n \"db_host\" => \"supabase-db\",\n \"db_port\" => System.get_env(\"POSTGRES_PORT\"),\n \"db_database\" => System.get_env(\"POSTGRES_DB\"),\n \"require_user\" => false,\n \"auth_query\" => \"SELECT * FROM pgbouncer.get_auth($1)\",\n \"default_max_clients\" => settings[\"max-client-connections\"] || 100,\n \"default_pool_size\" => settings[\"pool-size\"] || 20,\n \"default_parameter_status\" => %{\"server_version\" => version},\n \"users\" => [%{\n \"db_user\" => \"pgbouncer\",\n \"db_password\" => System.get_env(\"POSTGRES_PASSWORD\"),\n \"mode_type\" => System.get_env(\"POOLER_POOL_MODE\"),\n \"pool_size\" => settings[\"pool-size\"] || 20,\n \"is_manager\" => true\n }]\n}\n\ncase Supavisor.Tenants.get_tenant_by_external_id(params[\"external_id\"]) do\n nil ->\n {:ok, _} = Supavisor.Tenants.create_tenant(params)\n\n # A tenant made elsewhere (HAL named the database host \"db\") is pointed at this module's\n # database container; nothing else it holds is changed.\n %{db_host: host} = tenant when host != \"supabase-db\" ->\n {:ok, _} = Supavisor.Tenants.update_tenant(tenant, %{\"db_host\" => \"supabase-db\"})\n\n _ ->\n :ok\nend\n"
|
|
},
|
|
{
|
|
"id": "db-init-roles",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/roles.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "\\set pgpass `echo \"$POSTGRES_PASSWORD\"`\n\nALTER USER authenticator WITH PASSWORD :'pgpass';\nALTER USER pgbouncer WITH PASSWORD :'pgpass';\nALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';\n"
|
|
},
|
|
{
|
|
"id": "db-init-jwt",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/jwt.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "ALTER DATABASE postgres SET \"app.settings.jwt_secret\" TO '${secret:jwt}';\nALTER DATABASE postgres SET \"app.settings.jwt_exp\" TO '3600';\n"
|
|
},
|
|
{
|
|
"id": "db-init-realtime",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/realtime.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\ncreate schema if not exists _realtime;\nalter schema _realtime owner to :pguser;\n"
|
|
},
|
|
{
|
|
"id": "db-init-supabase",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/supabase.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\nCREATE DATABASE _supabase WITH OWNER :pguser;\n"
|
|
},
|
|
{
|
|
"id": "db-init-logs",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/logs.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\n\\c _supabase\ncreate schema if not exists _analytics;\nalter schema _analytics owner to :pguser;\n\\c postgres\n"
|
|
},
|
|
{
|
|
"id": "db-init-pooler",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/pooler.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "\\set pguser `echo \"$POSTGRES_USER\"`\n\n\\c _supabase\ncreate schema if not exists _supavisor;\nalter schema _supavisor owner to :pguser;\n\\c postgres\n"
|
|
},
|
|
{
|
|
"id": "db-init-webhooks",
|
|
"type": "file",
|
|
"path": "${dir:state}/db-init/webhooks.sql",
|
|
"mode": "0600",
|
|
"owner": "105:106",
|
|
"content": "BEGIN;\n -- Create pg_net extension\n CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;\n -- Create supabase_functions schema\n CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;\n GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;\n ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;\n ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;\n ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;\n -- supabase_functions.migrations definition\n CREATE TABLE supabase_functions.migrations (\n version text PRIMARY KEY,\n inserted_at timestamptz NOT NULL DEFAULT NOW()\n );\n -- Initial supabase_functions migration\n INSERT INTO supabase_functions.migrations (version) VALUES ('initial');\n -- supabase_functions.hooks definition\n CREATE TABLE supabase_functions.hooks (\n id bigserial PRIMARY KEY,\n hook_table_id integer NOT NULL,\n hook_name text NOT NULL,\n created_at timestamptz NOT NULL DEFAULT NOW(),\n request_id bigint\n );\n CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);\n CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);\n COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';\n CREATE FUNCTION supabase_functions.http_request()\n RETURNS trigger\n LANGUAGE plpgsql\n AS $function$\n DECLARE\n request_id bigint;\n payload jsonb;\n url text := TG_ARGV[0]::text;\n method text := TG_ARGV[1]::text;\n headers jsonb DEFAULT '{}'::jsonb;\n params jsonb DEFAULT '{}'::jsonb;\n timeout_ms integer DEFAULT 1000;\n BEGIN\n IF url IS NULL OR url = 'null' THEN\n RAISE EXCEPTION 'url argument is missing';\n END IF;\n\n IF method IS NULL OR method = 'null' THEN\n RAISE EXCEPTION 'method argument is missing';\n END IF;\n\n IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN\n headers = '{\"Content-Type\": \"application/json\"}'::jsonb;\n ELSE\n headers = TG_ARGV[2]::jsonb;\n END IF;\n\n IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN\n params = '{}'::jsonb;\n ELSE\n params = TG_ARGV[3]::jsonb;\n END IF;\n\n IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN\n timeout_ms = 1000;\n ELSE\n timeout_ms = TG_ARGV[4]::integer;\n END IF;\n\n CASE\n WHEN method = 'GET' THEN\n SELECT http_get INTO request_id FROM net.http_get(\n url,\n params,\n headers,\n timeout_ms\n );\n WHEN method = 'POST' THEN\n payload = jsonb_build_object(\n 'old_record', OLD,\n 'record', NEW,\n 'type', TG_OP,\n 'table', TG_TABLE_NAME,\n 'schema', TG_TABLE_SCHEMA\n );\n\n SELECT http_post INTO request_id FROM net.http_post(\n url,\n payload,\n params,\n headers,\n timeout_ms\n );\n ELSE\n RAISE EXCEPTION 'method argument % is invalid', method;\n END CASE;\n\n INSERT INTO supabase_functions.hooks\n (hook_table_id, hook_name, request_id)\n VALUES\n (TG_RELID, TG_NAME, request_id);\n\n RETURN NEW;\n END\n $function$;\n -- Supabase super admin\n DO\n $$\n BEGIN\n IF NOT EXISTS (\n SELECT 1\n FROM pg_roles\n WHERE rolname = 'supabase_functions_admin'\n )\n THEN\n CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;\n END IF;\n END\n $$;\n GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;\n GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;\n GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;\n ALTER USER supabase_functions_admin SET search_path = \"supabase_functions\";\n ALTER table \"supabase_functions\".migrations OWNER TO supabase_functions_admin;\n ALTER table \"supabase_functions\".hooks OWNER TO supabase_functions_admin;\n ALTER function \"supabase_functions\".http_request() OWNER TO supabase_functions_admin;\n GRANT supabase_functions_admin TO postgres;\n -- Remove unused supabase_pg_net_admin role\n DO\n $$\n BEGIN\n IF EXISTS (\n SELECT 1\n FROM pg_roles\n WHERE rolname = 'supabase_pg_net_admin'\n )\n THEN\n REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;\n DROP OWNED BY supabase_pg_net_admin;\n DROP ROLE supabase_pg_net_admin;\n END IF;\n END\n $$;\n -- pg_net grants when extension is already enabled\n DO\n $$\n BEGIN\n IF EXISTS (\n SELECT 1\n FROM pg_extension\n WHERE extname = 'pg_net'\n )\n THEN\n GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n END IF;\n END\n $$;\n -- Event trigger for pg_net\n CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()\n RETURNS event_trigger\n LANGUAGE plpgsql\n AS $$\n BEGIN\n IF EXISTS (\n SELECT 1\n FROM pg_event_trigger_ddl_commands() AS ev\n JOIN pg_extension AS ext\n ON ev.objid = ext.oid\n WHERE ext.extname = 'pg_net'\n )\n THEN\n GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;\n ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;\n REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;\n GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;\n END IF;\n END;\n $$;\n COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';\n DO\n $$\n BEGIN\n IF NOT EXISTS (\n SELECT 1\n FROM pg_event_trigger\n WHERE evtname = 'issue_pg_net_access'\n ) THEN\n CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')\n EXECUTE PROCEDURE extensions.grant_pg_net_access();\n END IF;\n END\n $$;\n INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');\n ALTER function supabase_functions.http_request() SECURITY DEFINER;\n ALTER function supabase_functions.http_request() SET search_path = supabase_functions;\n REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;\n GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;\nCOMMIT;\n"
|
|
},
|
|
{
|
|
"id": "functions-main",
|
|
"type": "file",
|
|
"path": "${dir:state}/functions-main/index.ts",
|
|
"mode": "0644",
|
|
"content": "import { serve } from 'https://deno.land/std@0.131.0/http/server.ts'\nimport * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'\n\nconsole.log('main function started')\n\nconst JWT_SECRET = Deno.env.get('JWT_SECRET')\nconst VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'\n\nfunction getAuthToken(req: Request) {\n const authHeader = req.headers.get('authorization')\n if (!authHeader) {\n throw new Error('Missing authorization header')\n }\n const [bearer, token] = authHeader.split(' ')\n if (bearer !== 'Bearer') {\n throw new Error(`Auth header is not 'Bearer {token}'`)\n }\n return token\n}\n\nasync function verifyJWT(jwt: string): Promise<boolean> {\n const encoder = new TextEncoder()\n const secretKey = encoder.encode(JWT_SECRET)\n try {\n await jose.jwtVerify(jwt, secretKey)\n } catch (err) {\n console.error(err)\n return false\n }\n return true\n}\n\nserve(async (req: Request) => {\n if (req.method !== 'OPTIONS' && VERIFY_JWT) {\n try {\n const token = getAuthToken(req)\n const isValidJWT = await verifyJWT(token)\n\n if (!isValidJWT) {\n return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {\n status: 401,\n headers: { 'Content-Type': 'application/json' },\n })\n }\n } catch (e) {\n console.error(e)\n return new Response(JSON.stringify({ msg: e.toString() }), {\n status: 401,\n headers: { 'Content-Type': 'application/json' },\n })\n }\n }\n\n const url = new URL(req.url)\n const { pathname } = url\n const path_parts = pathname.split('/')\n const service_name = path_parts[1]\n\n if (!service_name || service_name === '') {\n const error = { msg: 'missing function name in request' }\n return new Response(JSON.stringify(error), {\n status: 400,\n headers: { 'Content-Type': 'application/json' },\n })\n }\n\n const servicePath = `/home/deno/functions/${service_name}`\n console.error(`serving the request with ${servicePath}`)\n\n const memoryLimitMb = 150\n const workerTimeoutMs = 1 * 60 * 1000\n const noModuleCache = false\n const importMapPath = null\n const envVarsObj = Deno.env.toObject()\n const envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])\n\n try {\n const worker = await EdgeRuntime.userWorkers.create({\n servicePath,\n memoryLimitMb,\n workerTimeoutMs,\n noModuleCache,\n importMapPath,\n envVars,\n })\n return await worker.fetch(req)\n } catch (e) {\n const error = { msg: e.toString() }\n return new Response(JSON.stringify(error), {\n status: 500,\n headers: { 'Content-Type': 'application/json' },\n })\n }\n})\n"
|
|
},
|
|
{
|
|
"id": "realtime-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/realtime-env.env",
|
|
"mode": "0600",
|
|
"content": "PORT=4000\nDB_HOST=supabase-db\nDB_PORT=5432\nDB_USER=supabase_admin\nDB_PASSWORD=${secret:postgres}\nDB_NAME=postgres\nDB_AFTER_CONNECT_QUERY=SET search_path TO _realtime\nDB_ENC_KEY=supabaserealtime\nAPI_JWT_SECRET=${secret:jwt}\nSECRET_KEY_BASE=${secret:key-base-a}${secret:key-base-b}\nERL_AFLAGS=-proto_dist inet_tcp\nDNS_NODES=''\nRLIMIT_NOFILE=10000\nAPP_NAME=realtime\nSEED_SELF_HOST=true\nRUN_JANITOR=true\n"
|
|
},
|
|
{
|
|
"id": "storage-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/storage-env.env",
|
|
"mode": "0600",
|
|
"content": "ANON_KEY=${secret:anon-key}\nSERVICE_KEY=${secret:service-role-key}\nPOSTGREST_URL=http://supabase-rest:3000\nPGRST_JWT_SECRET=${secret:jwt}\nDATABASE_URL=postgres://supabase_storage_admin:${secret:postgres}@supabase-db:5432/postgres\nFILE_SIZE_LIMIT=52428800\nSTORAGE_BACKEND=file\nFILE_STORAGE_BACKEND_PATH=/var/lib/storage\nTENANT_ID=stub\nREGION=stub\nGLOBAL_S3_BUCKET=stub\nENABLE_IMAGE_TRANSFORMATION=true\nIMGPROXY_URL=http://supabase-imgproxy:5001\n"
|
|
},
|
|
{
|
|
"id": "meta-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/meta-env.env",
|
|
"mode": "0600",
|
|
"content": "PG_META_PORT=8080\nPG_META_DB_HOST=supabase-db\nPG_META_DB_PORT=5432\nPG_META_DB_NAME=postgres\nPG_META_DB_USER=supabase_admin\nPG_META_DB_PASSWORD=${secret:postgres}\n"
|
|
},
|
|
{
|
|
"id": "functions-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/functions-env.env",
|
|
"mode": "0600",
|
|
"content": "JWT_SECRET=${secret:jwt}\nSUPABASE_URL=http://supabase-kong:8000\nSUPABASE_ANON_KEY=${secret:anon-key}\nSUPABASE_SERVICE_ROLE_KEY=${secret:service-role-key}\nSUPABASE_DB_URL=postgresql://postgres:${secret:postgres}@supabase-db:5432/postgres\nVERIFY_JWT=false\n"
|
|
},
|
|
{
|
|
"id": "analytics-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/analytics-env.env",
|
|
"mode": "0600",
|
|
"content": "LOGFLARE_NODE_HOST=127.0.0.1\nDB_USERNAME=supabase_admin\nDB_DATABASE=_supabase\nDB_HOSTNAME=supabase-db\nDB_PORT=5432\nDB_PASSWORD=${secret:postgres}\nDB_SCHEMA=_analytics\nLOGFLARE_API_KEY=${secret:logflare}\nLOGFLARE_SINGLE_TENANT=true\nLOGFLARE_SUPABASE_MODE=true\nLOGFLARE_MIN_CLUSTER_SIZE=1\nPOSTGRES_BACKEND_URL=postgresql://supabase_admin:${secret:postgres}@supabase-db:5432/_supabase\nPOSTGRES_BACKEND_SCHEMA=_analytics\nLOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true\n"
|
|
},
|
|
{
|
|
"id": "analytics-start",
|
|
"type": "file",
|
|
"path": "${dir:state}/analytics-start.sh",
|
|
"mode": "0644",
|
|
"content": "#!/bin/sh\n# Generated by the mesh. Do not edit: module supabase writes this file and replaces it at every push.\n#\n# logflare 1.4.0 prints the whole URL of every request that fails, query string included, in the\n# error report Plug.Cowboy writes (\"Request: POST /api/logs?source_name=...&api_key=...\"). That is\n# an error, so no log level hides it while errors are logged at all (novox/hq issue 268). An API key\n# passed in the URL is therefore in this container's log. logflare reads the key from the\n# x-api-key header as well, and the mesh's caller, vector, sends it there; this refuses to start\n# logflare while the vector config it is given still passes the key in a URL: an analytics that\n# does not start says why here, and one that leaks says nothing.\nset -e\nconf=/run/logflare/vector.yml\nif [ ! -r \"$conf\" ]; then\n echo \"analytics: $conf is not there to check, so whether the API key travels in a URL is unknown; not starting (novox/hq issue 268)\" >&2\n exit 1\nfi\nif grep -v '^[[:space:]]*#' \"$conf\" | grep -q 'api_key='; then\n echo \"analytics: $conf passes the API key in a URL, and logflare prints a failed request's URL; not starting (novox/hq issue 268)\" >&2\n exit 1\nfi\ncd /opt/app/rel/logflare/bin\nexec sh run.sh\n"
|
|
},
|
|
{
|
|
"id": "studio-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/studio-env.env",
|
|
"mode": "0600",
|
|
"content": "# Next.js listens on the address HOSTNAME names, and docker sets HOSTNAME to the container's id,\n# so studio answered only on its network address while its image's health check asks localhost:\n# unhealthy for ever while working. Every address, as the upstream compose file has it.\nHOSTNAME=::\nSTUDIO_PG_META_URL=http://supabase-meta:8080\nPOSTGRES_PASSWORD=${secret:postgres}\nDEFAULT_ORGANIZATION_NAME=Default Organization\nDEFAULT_PROJECT_NAME=Default Project\nOPENAI_API_KEY=${secret:openai}\nSUPABASE_URL=http://supabase-kong:8000\nSUPABASE_PUBLIC_URL=https://${bound:route:name}\nSUPABASE_ANON_KEY=${secret:anon-key}\nSUPABASE_SERVICE_KEY=${secret:service-role-key}\nAUTH_JWT_SECRET=${secret:jwt}\nLOGFLARE_API_KEY=${secret:logflare}\nLOGFLARE_URL=http://supabase-analytics:4000\nNEXT_PUBLIC_ENABLE_LOGS=true\nNEXT_ANALYTICS_BACKEND_PROVIDER=postgres\n"
|
|
},
|
|
{
|
|
"id": "pooler-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/pooler-env.env",
|
|
"mode": "0600",
|
|
"content": "PORT=4000\nPOSTGRES_PORT=5432\nPOSTGRES_DB=postgres\nPOSTGRES_PASSWORD=${secret:postgres}\nDATABASE_URL=ecto://supabase_admin:${secret:postgres}@supabase-db:5432/_supabase\nCLUSTER_POSTGRES=true\nSECRET_KEY_BASE=${secret:key-base-a}${secret:key-base-b}\nVAULT_ENC_KEY=${secret:pooler-vault}\nAPI_JWT_SECRET=${secret:jwt}\nMETRICS_JWT_SECRET=${secret:jwt}\nREGION=local\nERL_AFLAGS=-proto_dist inet_tcp\nRELEASE_NODE=supavisor@127.0.0.1\nPOOLER_POOL_MODE=transaction\n"
|
|
},
|
|
{
|
|
"id": "net",
|
|
"type": "network",
|
|
"name": "supabase"
|
|
},
|
|
{
|
|
"id": "vector",
|
|
"type": "container",
|
|
"name": "supabase-vector",
|
|
"image": "timberio/vector@sha256:4bc04aca94a44f04b427a490f346e7397ef7ce61fe589d718f744f7d92cb5c80",
|
|
"network": "supabase",
|
|
"args": [
|
|
"--config",
|
|
"/etc/vector/vector.yml"
|
|
],
|
|
"volumes": [
|
|
"${dir:state}/vector.yml:/etc/vector/vector.yml:ro",
|
|
"/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
],
|
|
"restart-on": [
|
|
"vector-conf"
|
|
]
|
|
},
|
|
{
|
|
"id": "db-config-seed",
|
|
"type": "container",
|
|
"name": "supabase-db-config-seed",
|
|
"image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
|
|
"network": "supabase",
|
|
"run-once": true,
|
|
"args": [
|
|
"sh",
|
|
"-c",
|
|
"cp -rn /etc/postgresql-custom/. /seed/ && chown -R postgres:postgres /seed"
|
|
],
|
|
"volumes": [
|
|
"${dir:db-config}:/seed"
|
|
]
|
|
},
|
|
{
|
|
"id": "db",
|
|
"type": "container",
|
|
"name": "supabase-db",
|
|
"image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
|
|
"network": "supabase",
|
|
"args": [
|
|
"postgres",
|
|
"-c",
|
|
"config_file=/etc/postgresql/postgresql.conf",
|
|
"-c",
|
|
"log_min_messages=fatal"
|
|
],
|
|
"env": {
|
|
"POSTGRES_HOST": "/var/run/postgresql",
|
|
"PGPORT": "5432",
|
|
"POSTGRES_PORT": "5432",
|
|
"PGDATABASE": "postgres",
|
|
"POSTGRES_DB": "postgres",
|
|
"POSTGRES_PASSWORD_FILE": "/run/secrets/postgres"
|
|
},
|
|
"volumes": [
|
|
"${dir:state}/postgres.secret:/run/secrets/postgres:ro",
|
|
"${dir:state}/db-init/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:ro",
|
|
"${dir:state}/db-init/webhooks.sql:/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql:ro",
|
|
"${dir:state}/db-init/roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:ro",
|
|
"${dir:state}/db-init/jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:ro",
|
|
"${dir:state}/db-init/supabase.sql:/docker-entrypoint-initdb.d/migrations/97-_supabase.sql:ro",
|
|
"${dir:state}/db-init/logs.sql:/docker-entrypoint-initdb.d/migrations/99-logs.sql:ro",
|
|
"${dir:state}/db-init/pooler.sql:/docker-entrypoint-initdb.d/migrations/99-pooler.sql:ro",
|
|
"${dir:db-data}:/var/lib/postgresql/data",
|
|
"${dir:db-config}:/etc/postgresql-custom"
|
|
]
|
|
},
|
|
{
|
|
"id": "db-ready",
|
|
"type": "container",
|
|
"name": "supabase-db-ready",
|
|
"image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
|
|
"network": "supabase",
|
|
"run-once": true,
|
|
"args": [
|
|
"sh",
|
|
"-c",
|
|
"for i in $(seq 150); do pg_isready -h supabase-db -p 5432 -U postgres && exit 0; sleep 2; done; echo 'the database did not come up' >&2; exit 1"
|
|
]
|
|
},
|
|
{
|
|
"id": "analytics",
|
|
"type": "container",
|
|
"name": "supabase-analytics",
|
|
"image": "supabase/logflare@sha256:e693c787ffe1ae17b6e4e920a3cdd212416d3e1f97e1bd7cb5b67de0abbb0264",
|
|
"network": "supabase",
|
|
"env-file": [
|
|
"${dir:state}/analytics-env.env"
|
|
],
|
|
"volumes": [
|
|
"${dir:state}/analytics-start.sh:/run/logflare/start.sh:ro",
|
|
"${dir:state}/vector.yml:/run/logflare/vector.yml:ro"
|
|
],
|
|
"args": [
|
|
"sh",
|
|
"/run/logflare/start.sh"
|
|
],
|
|
"restart-on": [
|
|
"analytics-start",
|
|
"vector-conf"
|
|
],
|
|
"secrets-in-environment": "Logflare reads its database password and API key from the environment only. The API key is never in a URL the mesh writes: logflare prints a failed request's URL, so vector sends the key in the x-api-key header, and the start script refuses to start logflare while vector.yml says otherwise"
|
|
},
|
|
{
|
|
"id": "analytics-ready",
|
|
"type": "container",
|
|
"name": "supabase-analytics-ready",
|
|
"image": "supabase/logflare@sha256:e693c787ffe1ae17b6e4e920a3cdd212416d3e1f97e1bd7cb5b67de0abbb0264",
|
|
"network": "supabase",
|
|
"run-once": true,
|
|
"args": [
|
|
"sh",
|
|
"-c",
|
|
"for i in $(seq 150); do curl -fsS -o /dev/null http://supabase-analytics:4000/health && exit 0; sleep 2; done; echo 'analytics did not come up' >&2; exit 1"
|
|
]
|
|
},
|
|
{
|
|
"id": "kong",
|
|
"type": "container",
|
|
"name": "supabase-kong",
|
|
"image": "kong@sha256:1b53405d8680a09d6f44494b7990bf7da2ea43f84a258c59717d4539abf09f6d",
|
|
"network": "supabase",
|
|
"ports": [
|
|
"8000"
|
|
],
|
|
"env": {
|
|
"KONG_DATABASE": "off",
|
|
"KONG_DECLARATIVE_CONFIG": "/home/kong/kong.yml",
|
|
"KONG_DNS_ORDER": "LAST,A,CNAME",
|
|
"KONG_PLUGINS": "request-transformer,cors,key-auth,acl,basic-auth",
|
|
"KONG_NGINX_PROXY_PROXY_BUFFER_SIZE": "160k",
|
|
"KONG_NGINX_PROXY_PROXY_BUFFERS": "64 160k"
|
|
},
|
|
"volumes": [
|
|
"${dir:state}/kong.yml:/home/kong/kong.yml:ro"
|
|
],
|
|
"restart-on": [
|
|
"kong-conf"
|
|
]
|
|
},
|
|
{
|
|
"id": "auth",
|
|
"type": "container",
|
|
"name": "supabase-auth",
|
|
"image": "supabase/gotrue@sha256:f8b871f46f3f9c5306af00d2fb856fb5479db730bb6d4fd2757b2da8abe953f9",
|
|
"network": "supabase",
|
|
"args": [
|
|
"auth",
|
|
"-c",
|
|
"/etc/gotrue/gotrue.env"
|
|
],
|
|
"volumes": [
|
|
"${dir:state}/gotrue.env:/etc/gotrue/gotrue.env:ro"
|
|
],
|
|
"restart-on": [
|
|
"auth-conf"
|
|
]
|
|
},
|
|
{
|
|
"id": "rest",
|
|
"type": "container",
|
|
"name": "supabase-rest",
|
|
"image": "postgrest/postgrest@sha256:2cf1efd2c9c2e7606610c113cc73e936d8ce9ba089271cb9cbf11aa564bc30c7",
|
|
"network": "supabase",
|
|
"args": [
|
|
"postgrest",
|
|
"/etc/postgrest/postgrest.conf"
|
|
],
|
|
"volumes": [
|
|
"${dir:state}/postgrest.conf:/etc/postgrest/postgrest.conf:ro"
|
|
],
|
|
"restart-on": [
|
|
"rest-conf"
|
|
]
|
|
},
|
|
{
|
|
"id": "realtime",
|
|
"type": "container",
|
|
"name": "realtime-dev.supabase-realtime",
|
|
"image": "supabase/realtime@sha256:104fe2e4e09a7c81eebe0c39e3a9b9dca4684f55470ca01cb3c080d1d56453a1",
|
|
"network": "supabase",
|
|
"env-file": [
|
|
"${dir:state}/realtime-env.env"
|
|
],
|
|
"secrets-in-environment": "Supabase Realtime (Elixir release) reads DB_PASSWORD, API_JWT_SECRET and SECRET_KEY_BASE from its environment only; no file or _FILE form"
|
|
},
|
|
{
|
|
"id": "imgproxy",
|
|
"type": "container",
|
|
"name": "supabase-imgproxy",
|
|
"image": "darthsim/imgproxy@sha256:0facd355d50f3be665ebe674486f2b2e9cdaebd3f74404acd9b7fece2f661435",
|
|
"network": "supabase",
|
|
"env": {
|
|
"IMGPROXY_BIND": ":5001",
|
|
"IMGPROXY_LOCAL_FILESYSTEM_ROOT": "/",
|
|
"IMGPROXY_USE_ETAG": "true",
|
|
"IMGPROXY_ENABLE_WEBP_DETECTION": "true"
|
|
},
|
|
"volumes": [
|
|
"${dir:storage}:/var/lib/storage"
|
|
]
|
|
},
|
|
{
|
|
"id": "storage-api",
|
|
"type": "container",
|
|
"name": "supabase-storage",
|
|
"image": "supabase/storage-api@sha256:1e85dad48e8b3e85890a555e5114dc7ee48c2e8be4cfd97dd4e3564b4f104fcd",
|
|
"network": "supabase",
|
|
"volumes": [
|
|
"${dir:storage}:/var/lib/storage"
|
|
],
|
|
"env-file": [
|
|
"${dir:state}/storage-env.env"
|
|
],
|
|
"secrets-in-environment": "Supabase Storage reads its keys and DATABASE_URL from the environment only"
|
|
},
|
|
{
|
|
"id": "meta",
|
|
"type": "container",
|
|
"name": "supabase-meta",
|
|
"image": "supabase/postgres-meta@sha256:d0a96973e9f1b6303f7500421a459af3d7273b3f9f1db38610899f9f573da7c7",
|
|
"network": "supabase",
|
|
"env-file": [
|
|
"${dir:state}/meta-env.env"
|
|
],
|
|
"secrets-in-environment": "postgres-meta reads PG_META_DB_PASSWORD from the environment only"
|
|
},
|
|
{
|
|
"id": "edge-functions",
|
|
"type": "container",
|
|
"name": "supabase-edge-functions",
|
|
"image": "supabase/edge-runtime@sha256:6f7ac3b363f6b278ff9235672a81504ad07709a07f62c50cd4fffb6708842ff1",
|
|
"network": "supabase",
|
|
"args": [
|
|
"start",
|
|
"--main-service",
|
|
"/home/deno/main"
|
|
],
|
|
"volumes": [
|
|
"${dir:functions}:/home/deno/functions",
|
|
"${dir:state}/functions-main/index.ts:/home/deno/main/index.ts:ro"
|
|
],
|
|
"env-file": [
|
|
"${dir:state}/functions-env.env"
|
|
],
|
|
"secrets-in-environment": "the edge runtime's main service hands its own environment (JWT secret, service key, database URL) to every function worker by design; there is no other channel"
|
|
},
|
|
{
|
|
"id": "studio",
|
|
"type": "container",
|
|
"name": "supabase-studio",
|
|
"image": "supabase/studio@sha256:ebf492ba82db1fc9497f56e4cdebf5cddb464b61f6227e21c8f5f3693f9dbbc5",
|
|
"network": "supabase",
|
|
"env-file": [
|
|
"${dir:state}/studio-env.env"
|
|
],
|
|
"secrets-in-environment": "Studio (Next.js) reads its keys, the database password and the OpenAI key from the environment only"
|
|
},
|
|
{
|
|
"id": "pooler",
|
|
"type": "container",
|
|
"name": "supabase-pooler",
|
|
"image": "supabase/supavisor@sha256:2f24ab556380db7aaf402d2ec5db09d1974739e685781a91a77ab5ae0dadb3a5",
|
|
"network": "supabase",
|
|
"ports": [
|
|
"5432",
|
|
"6543"
|
|
],
|
|
"args": [
|
|
"/bin/sh",
|
|
"-c",
|
|
"/app/bin/migrate && /app/bin/supavisor eval \"$(cat /etc/pooler/pooler.exs)\" && /app/bin/server"
|
|
],
|
|
"volumes": [
|
|
"${dir:state}/pooler.exs:/etc/pooler/pooler.exs:ro",
|
|
"${dir:state}/settings.json:/etc/pooler/settings.json:ro"
|
|
],
|
|
"restart-on": [
|
|
"pooler-conf",
|
|
"settings"
|
|
],
|
|
"env-file": [
|
|
"${dir:state}/pooler-env.env"
|
|
],
|
|
"secrets-in-environment": "Supavisor reads DATABASE_URL, SECRET_KEY_BASE, VAULT_ENC_KEY and the JWT secret from the environment only"
|
|
}
|
|
]
|
|
}
|