1+ ---
2+ # ==============================================================#
3+ # File : supa.yml
4+ # Desc : Pigsty configuration for self-hosting supabase
5+ # Ctime : 2023-09-19
6+ # Mtime : 2025-01-12
7+ # Docs : https://pigsty.io/docs/kernel/supabase/
8+ # License : AGPLv3 @ https://pigsty.io/docs/about/license
9+ # Copyright : 2018-2025 Ruohang Feng / Vonng (rh@vonng.com)
10+ # ==============================================================#
11+
12+ # supabase is available on el8/el9/u22/u24/d12 with pg15,16,17
13+ # To install supabase on fresh node, run:
14+ #
15+ # curl -fsSL https://repo.pigsty.io/get | bash
16+ # ./bootstrap # prepare local repo & ansible
17+ # ./configure -c app/supa # IMPORTANT: CHANGE CREDENTIALS!!
18+ # ./install.yml # install pigsty & pgsql & minio
19+ # ./docker.yml # install docker & docker compose
20+ # ./app.yml # launch supabase with docker compose
21+
22+ all :
23+
24+ # ==============================================================#
25+ # Clusters, Nodes, and Modules
26+ # ==============================================================#
27+ children :
28+
29+ # launch supabase stateless part with docker compose:
30+ # ./docker.yml -l app
31+ # ./app.yml -l app
32+ app :
33+ hosts :
34+ 10.10.10.10 : { supa_seq: 1 } # instance id
35+ vars :
36+ docker_enabled : true # enable docker
37+ # docker_registry_mirrors: [https://docker.m.daocloud.io, https://dockerproxy.com]
38+
39+ # these configuration entries will OVERWRITE or APPEND to /opt/supabase/.env file (src template: app/supabase/.env)
40+ # check https://github.com/Vonng/pigsty/blob/main/app/supabase/.env for default values
41+ app : supabase
42+ app_config :
43+ # IMPORTANT: CHANGE JWT_SECRET AND REGENERATE CREDENTIAL ACCORDING!!!!!!!!!!!
44+ # https://supabase.com/docs/guides/self-hosting/docker#securing-your-services
45+ jwt_secret : your-super-secret-jwt-token-with-at-least-32-characters-long
46+ anon_key : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE
47+ service_role_key : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
48+ dashboard_username : supabase
49+ dashboard_password : pigsty
50+
51+ # postgres connection string (use the correct ip and port)
52+ postgres_host : 10.10.10.10
53+ postgres_port : 5436 # access via the 'default' service, which always route to the primary postgres
54+ postgres_db : postgres
55+ postgres_password : DBUser.Supa # password for supabase_admin and multiple supabase users
56+
57+ # expose supabase via domain name
58+ site_url : http://supa.pigsty
59+ api_external_url : http://supa.pigsty
60+ supabase_public_url : http://supa.pigsty
61+
62+ # if using s3/minio as file storage
63+ s3_bucket : supa
64+ s3_endpoint : https://sss.pigsty:9000
65+ s3_access_key : supabase
66+ s3_secret_key : S3User.Supabase
67+ s3_force_path_style : true
68+ s3_protocol : https
69+ s3_region : stub
70+ minio_domain_ip : 10.10.10.10 # sss.pigsty domain name will resolve to this ip statically
71+
72+ # if using SMTP (optional)
73+ # smtp_admin_email: admin@example.com
74+ # smtp_host: supabase-mail
75+ # smtp_port: 2500
76+ # smtp_user: fake_mail_user
77+ # smtp_pass: fake_mail_password
78+ # smtp_sender_name: fake_sender
79+ # enable_anonymous_users: false
80+
81+
82+ # infra cluster for proxy, monitor, alert, etc..
83+ infra : { hosts: { 10.10.10.10: { infra_seq: 1 } } }
84+
85+ # etcd cluster for ha postgres
86+ etcd : { hosts: { 10.10.10.10: { etcd_seq: 1 } }, vars: { etcd_cluster: etcd } }
87+
88+ # minio cluster, s3 compatible object storage
89+ minio : { hosts: { 10.10.10.10: { minio_seq: 1 } }, vars: { minio_cluster: minio } }
90+
91+ # pg-meta, the underlying postgres database for supabase
92+ pg-meta :
93+ hosts : { 10.10.10.10: { pg_seq: 1, pg_role: primary } }
94+ vars :
95+ pg_cluster : pg-meta
96+ pg_users :
97+ # supabase roles: anon, authenticated, dashboard_user
98+ - { name: anon ,login: false }
99+ - { name: authenticated ,login: false }
100+ - { name: dashboard_user ,login: false ,replication: true ,createdb: true ,createrole: true }
101+ - { name: service_role ,login: false ,bypassrls: true }
102+ # supabase users: please use the same password
103+ - { name: supabase_admin ,password: 'DBUser.Supa' ,pgbouncer: true ,inherit: true ,roles: [ dbrole_admin ] ,superuser: true ,replication: true ,createdb: true ,createrole: true ,bypassrls: true }
104+ - { name: authenticator ,password: 'DBUser.Supa' ,pgbouncer: true ,inherit: false ,roles: [ dbrole_admin, authenticated ,anon ,service_role ] }
105+ - { name: supabase_auth_admin ,password: 'DBUser.Supa' ,pgbouncer: true ,inherit: false ,roles: [ dbrole_admin ] ,createrole: true }
106+ - { name: supabase_storage_admin ,password: 'DBUser.Supa' ,pgbouncer: true ,inherit: false ,roles: [ dbrole_admin, authenticated ,anon ,service_role ] ,createrole: true }
107+ - { name: supabase_functions_admin ,password: 'DBUser.Supa' ,pgbouncer: true ,inherit: false ,roles: [ dbrole_admin ] ,createrole: true }
108+ - { name: supabase_replication_admin ,password: 'DBUser.Supa' ,replication: true ,roles: [ dbrole_admin ]}
109+ - { name: supabase_read_only_user ,password: 'DBUser.Supa' ,bypassrls: true ,roles: [ dbrole_readonly, pg_read_all_data ] }
110+ pg_databases :
111+ - name : postgres
112+ baseline : supabase.sql
113+ owner : supabase_admin
114+ comment : supabase postgres database
115+ schemas : [ extensions ,auth ,realtime ,storage ,graphql_public ,supabase_functions ,_analytics ,_realtime ]
116+ extensions :
117+ - { name: pgcrypto ,schema: extensions } # 1.3 : cryptographic functions
118+ - { name: pg_net ,schema: extensions } # 0.9.2 : async HTTP
119+ - { name: pgjwt ,schema: extensions } # 0.2.0 : json web token API for postgres
120+ - { name: uuid-ossp ,schema: extensions } # 1.1 : generate universally unique identifiers (UUIDs)
121+ - { name: pgsodium } # 3.1.9 : pgsodium is a modern cryptography library for Postgres.
122+ - { name: supabase_vault } # 0.2.8 : Supabase Vault Extension
123+ - { name: pg_graphql } # 1.5.9 : pg_graphql: GraphQL support
124+ - { name: pg_jsonschema } # 0.3.3 : pg_jsonschema: Validate json schema
125+ - { name: wrappers } # 0.4.3 : wrappers: FDW collections
126+ - { name: http } # 1.6 : http: allows web page retrieval inside the database.
127+ - { name: pg_cron } # 1.6 : pg_cron: Job scheduler for PostgreSQL
128+ - { name: timescaledb } # 2.17 : timescaledb: Enables scalable inserts and complex queries for time-series data
129+ - { name: pg_tle } # 1.2 : pg_tle: Trusted Language Extensions for PostgreSQL
130+ - { name: vector } # 0.8.0 : pgvector: the vector similarity search
131+ - { name: pgmq } # 1.4.4 : pgmq: A lightweight message queue like AWS SQS and RSMQ
132+ # supabase required extensions
133+ pg_libs : ' timescaledb, plpgsql, plpgsql_check, pg_cron, pg_net, pg_stat_statements, auto_explain, pg_tle, plan_filter'
134+ pg_parameters :
135+ cron.database_name : postgres
136+ pgsodium.enable_event_trigger : off
137+ pg_hba_rules : # supabase hba rules, require access from docker network
138+ - { user: all ,db: postgres ,addr: intra ,auth: pwd ,title: 'allow supabase access from intranet' }
139+ - { user: all ,db: postgres ,addr: 172.17.0.0/16 ,auth: pwd ,title: 'allow access from local docker network' }
140+ node_crontab : [ '00 01 * * * postgres /pg/bin/pg-backup full' ] # make a full backup every 1am
141+
142+
143+
144+ # ==============================================================#
145+ # Global Parameters
146+ # ==============================================================#
147+ vars :
148+ version : v3.2.1 # pigsty version string
149+ admin_ip : 10.10.10.10 # admin node ip address
150+ region : default # upstream mirror region: default|china|europe
151+ node_tune : oltp # node tuning specs: oltp,olap,tiny,crit
152+ pg_conf : oltp.yml # pgsql tuning specs: {oltp,olap,tiny,crit}.yml
153+ infra_portal : # domain names and upstream servers
154+ home : { domain: h.pigsty }
155+ grafana : { domain: g.pigsty ,endpoint: "${admin_ip}:3000" , websocket: true }
156+ prometheus : { domain: p.pigsty ,endpoint: "${admin_ip}:9090" }
157+ alertmanager : { domain: a.pigsty ,endpoint: "${admin_ip}:9093" }
158+ minio : { domain: m.pigsty ,endpoint: "10.10.10.10:9001", https: true, websocket: true }
159+ blackbox : { endpoint: "${admin_ip}:9115" }
160+ loki : { endpoint: "${admin_ip}:3100" } # expose supa studio UI and API via nginx
161+ supa : { domain: supa.pigsty ,endpoint: "10.10.10.10:8000", websocket: true }
162+
163+ # ----------------------------------#
164+ # Credential: CHANGE THESE PASSWORDS
165+ # ----------------------------------#
166+ # grafana_admin_username: admin
167+ grafana_admin_password : pigsty
168+ # pg_admin_username: dbuser_dba
169+ pg_admin_password : DBUser.DBA
170+ # pg_monitor_username: dbuser_monitor
171+ pg_monitor_password : DBUser.Monitor
172+ # pg_replication_username: replicator
173+ pg_replication_password : DBUser.Replicator
174+ # patroni_username: postgres
175+ patroni_password : Patroni.API
176+ # haproxy_admin_username: admin
177+ haproxy_admin_password : pigsty
178+
179+ # use minio as supabase file storage, single node single driver mode for demonstration purpose
180+ minio_access_key : minioadmin # root access key, `minioadmin` by default
181+ minio_secret_key : minioadmin # root secret key, `minioadmin` by default
182+ minio_buckets : [ { name: pgsql }, { name: supa } ]
183+ minio_users :
184+ - { access_key: dba , secret_key: S3User.DBA, policy: consoleAdmin }
185+ - { access_key: pgbackrest , secret_key: S3User.Backup, policy: readwrite }
186+ - { access_key: supabase , secret_key: S3User.Supabase, policy: readwrite }
187+ minio_endpoint : https://sss.pigsty:9000 # explicit overwrite minio endpoint with haproxy port
188+ node_etc_hosts : ["10.10.10.10 sss.pigsty"] # domain name to access minio from all nodes (required)
189+
190+ # use minio as default backup repo for PostgreSQL
191+ pgbackrest_method : minio # pgbackrest repo method: local,minio,[user-defined...]
192+ pgbackrest_repo : # pgbackrest repo: https://pgbackrest.org/configuration.html#section-repository
193+ local : # default pgbackrest repo with local posix fs
194+ path : /pg/backup # local backup directory, `/pg/backup` by default
195+ retention_full_type : count # retention full backups by count
196+ retention_full : 2 # keep 2, at most 3 full backup when using local fs repo
197+ minio : # optional minio repo for pgbackrest
198+ type : s3 # minio is s3-compatible, so s3 is used
199+ s3_endpoint : sss.pigsty # minio endpoint domain name, `sss.pigsty` by default
200+ s3_region : us-east-1 # minio region, us-east-1 by default, useless for minio
201+ s3_bucket : pgsql # minio bucket name, `pgsql` by default
202+ s3_key : pgbackrest # minio user access key for pgbackrest
203+ s3_key_secret : S3User.Backup # minio user secret key for pgbackrest
204+ s3_uri_style : path # use path style uri for minio rather than host style
205+ path : /pgbackrest # minio backup path, default is `/pgbackrest`
206+ storage_port : 9000 # minio port, 9000 by default
207+ storage_ca_file : /pg/cert/ca.crt # minio ca file path, `/pg/cert/ca.crt` by default
208+ bundle : y # bundle small files into a single file
209+ cipher_type : aes-256-cbc # enable AES encryption for remote backup repo
210+ cipher_pass : pgBackRest # AES encryption password, default is 'pgBackRest'
211+ retention_full_type : time # retention full backup by time on minio repo
212+ retention_full : 14 # keep full backup for last 14 days
213+
214+ # download docker and all available extensions
215+ pg_version : 17
216+ repo_modules : node,pgsql,infra,docker
217+ repo_packages : [node-bootstrap, infra-package, infra-addons, node-package1, node-package2, pgsql-utility, docker ]
218+ repo_extra_packages : [pg17-core ,pg17-time ,pg17-gis ,pg17-rag ,pg17-fts ,pg17-olap ,pg17-feat ,pg17-lang ,pg17-type ,pg17-util ,pg17-func ,pg17-admin ,pg17-stat ,pg17-sec ,pg17-fdw ,pg17-sim ,pg17-etl, pg17-citus ]
219+ pg_extensions : [ pg17-time ,pg17-gis ,pg17-rag ,pg17-fts ,pg17-olap ,pg17-feat ,pg17-lang ,pg17-type ,pg17-util ,pg17-func ,pg17-admin ,pg17-stat ,pg17-sec ,pg17-fdw ,pg17-sim ,pg17-etl ]
220+ ...
0 commit comments