feat(infra): add Supabase Terraform provider for managed Postgres

- Add supabase.tf: project resource with auto-generated DB password,
  lifecycle prevent_destroy, and API keys data source
- Update versions.tf: add supabase (~> 1.0) + hashicorp/random (~> 3.0)
- Update variables.tf: supabase_access_token, org_id, project_name, region
- Update outputs.tf: project ID, DB host, port, password, anon/service_role keys
- Update terraform.tfvars.example: supabase section with instructions

Author: Long104

infra/terraform/outputs.tf

@@ -22,3 +22,44 @@ output "cloudflare_record_senzen" {
   description = "Cloudflare CNAME record for the frontend"
   value       = cloudflare_record.senzen_frontend.hostname
 }
+
+# ─────────────────────────────────────────────────────────────
+# Supabase outputs
+# ─────────────────────────────────────────────────────────────
+output "supabase_project_id" {
+  description = "Supabase project reference ID"
+  value       = supabase_project.senzen.id
+}
+
+output "supabase_db_host" {
+  description = "Supabase Postgres connection host (pooler endpoint for serverless)"
+  value       = "aws-0-${var.supabase_region}.pooler.supabase.com"
+}
+
+output "supabase_db_direct_host" {
+  description = "Supabase Postgres direct connection host"
+  value       = "${supabase_project.senzen.id}.supabase.co"
+}
+
+output "supabase_db_port" {
+  description = "Supabase Postgres port"
+  value       = 5432
+}
+
+output "supabase_db_password" {
+  description = "Supabase Postgres password (auto-generated, stored in Terraform state)"
+  value       = random_password.db.result
+  sensitive   = true
+}
+
+output "supabase_anon_key" {
+  description = "Supabase anonymous (public) API key — safe to use in frontend"
+  value       = data.supabase_apikeys.senzen.anon_key
+  sensitive   = true
+}
+
+output "supabase_service_role_key" {
+  description = "Supabase service_role API key — full admin access, NEVER expose in frontend"
+  value       = data.supabase_apikeys.senzen.service_role_key
+  sensitive   = true
+}

infra/terraform/supabase.tf

@@ -0,0 +1,44 @@
+# =============================================================
+# Supabase — Managed Postgres Database
+# =============================================================
+# Terraform creates the entire Supabase project (Postgres DB,
+# Auth, Storage, Realtime) via the Supabase Management API.
+#
+# Prerequisites:
+#   1. Create a Personal Access Token at:
+#      https://supabase.com/dashboard/account/tokens
+#   2. Find your Organization slug at:
+#      Supabase Dashboard → Org Settings → General → Org slug
+#   3. Set supabase_access_token + supabase_org_id in
+#      terraform.tfvars (local) or Terraform Cloud variables.
+# =============================================================
+
+# ─────────────────────────────────────────────────────────────
+# Auto-generate a secure database password
+# ─────────────────────────────────────────────────────────────
+resource "random_password" "db" {
+  length  = 32
+  special = false
+}
+
+# ─────────────────────────────────────────────────────────────
+# Create the Supabase project
+# ─────────────────────────────────────────────────────────────
+resource "supabase_project" "senzen" {
+  organization_id   = var.supabase_org_id
+  name              = var.supabase_project_name
+  database_password = random_password.db.result
+  region            = var.supabase_region
+
+  lifecycle {
+    # Prevent accidental destruction of the production database
+    prevent_destroy = true
+  }
+}
+
+# ─────────────────────────────────────────────────────────────
+# Fetch API keys for the project (anon + service_role)
+# ─────────────────────────────────────────────────────────────
+data "supabase_apikeys" "senzen" {
+  project_ref = supabase_project.senzen.id
+}

infra/terraform/terraform.tfvars.example

@@ -44,6 +44,16 @@ github_repo = "Long104/Senzen"
 # frontend_domain    = "senzen.pantorn.site"
 # vercel_cname_target = "cname.vercel-dns.com"
 
+# ─────────────────────────────────────────────────────────────
+# Supabase (Managed Postgres Database)
+# Access Token: https://supabase.com/dashboard/account/tokens
+# Org Slug:    Dashboard → Org Settings → General → Organization slug
+# ─────────────────────────────────────────────────────────────
+supabase_access_token = "sbp-access-token-here"
+supabase_org_id       = "your-org-slug-here"
+# supabase_project_name defaults to "senzen"
+# supabase_region defaults to "ap-southeast-1" (Singapore)
+
 # ─────────────────────────────────────────────────────────────
 # Backend env vars — DOCUMENTATION ONLY.
 # These are NOT used by Terraform. They are listed here so you

infra/terraform/variables.tf

@@ -71,7 +71,33 @@ variable "render_service_name" {
 variable "vercel_cname_target" {
   description = "Vercel's CNAME target (cname.vercel-dns.com)"
   type        = string
-  default     = "cname.vercel-dns.com"
+  default     = "cname.vercel-dns.com" 
+}
+
+# ─────────────────────────────────────────────────────────────
+# Supabase (Managed Postgres Database)
+# ─────────────────────────────────────────────────────────────
+variable "supabase_access_token" {
+  description = "Supabase Personal Access Token — https://supabase.com/dashboard/account/tokens"
+  type        = string
+  sensitive   = true
+}
+
+variable "supabase_org_id" {
+  description = "Supabase organization slug — Dashboard → Org Settings → General → Organization slug"
+  type        = string
+}
+
+variable "supabase_project_name" {
+  description = "Name for the Supabase project"
+  type        = string
+  default     = "senzen"
+}
+
+variable "supabase_region" {
+  description = "Region for the Supabase project (e.g. ap-southeast-1 for Singapore, us-east-1 for N. Virginia)"
+  type        = string
+  default     = "ap-southeast-1"
 }
 
 # ─────────────────────────────────────────────────────────────

infra/terraform/versions.tf

@@ -18,6 +18,14 @@ terraform {
       source  = "cloudflare/cloudflare"
       version = "~> 4.0"
     }
+    supabase = {
+      source  = "supabase/supabase"
+      version = "~> 1.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
   }
 }
 
@@ -28,3 +36,7 @@ provider "vercel" {
 provider "cloudflare" {
   api_token = var.cloudflare_api_token
 }
+
+provider "supabase" {
+  access_token = var.supabase_access_token
+}