Self-Hosting Supabase on Docker Swarm

[Paillat-dev]

Hello Supabase community! I'm excited to share my experience of successfully setting up Supabase in a self-hosted Docker Swarm environment. Here's how I did it, along with my configuration details.

Environment Variables

I used the following environment variables, which I set using a simple bash script before running docker stack deploy:

############
# Secrets
# YOU MUST CHANGE THESE BEFORE GOING INTO PRODUCTION
############
POSTGRES_PASSWORD=[REDACTED]
JWT_SECRET=[REDACTED]
ANON_KEY=[REDACTED]
SERVICE_ROLE_KEY=[REDACTED]
DASHBOARD_USERNAME=supabase
DASHBOARD_PASSWORD=[REDACTED]

############
# Database
############
POSTGRES_HOST=db
POSTGRES_DB=postgres
POSTGRES_PORT=5432

############
# API Proxy
############
KONG_HTTP_PORT=8000
KONG_HTTPS_PORT=8443

############
# API
############
PGRST_DB_SCHEMAS=public,storage,graphql_public

############
# Auth
############
## General
SITE_URL=[REDACTED]
ADDITIONAL_REDIRECT_URLS=
JWT_EXPIRY=3600
DISABLE_SIGNUP=false
API_EXTERNAL_URL=[REDACTED]

## Mailer Config
MAILER_URLPATHS_CONFIRMATION="/auth/v1/verify"
MAILER_URLPATHS_INVITE="/auth/v1/verify"
MAILER_URLPATHS_RECOVERY="/auth/v1/verify"
MAILER_URLPATHS_EMAIL_CHANGE="/auth/v1/verify"

## Email auth
ENABLE_EMAIL_SIGNUP=true
ENABLE_EMAIL_AUTOCONFIRM=false
SMTP_ADMIN_EMAIL=[REDACTED]
SMTP_HOST=[REDACTED]
SMTP_PORT=465
SMTP_USER=[REDACTED]
SMTP_PASS=[REDACTED]
SMTP_SENDER_NAME=[REDACTED]

## Phone auth
ENABLE_ANONYMOUS_USERS=false
ENABLE_PHONE_SIGNUP=false
ENABLE_PHONE_AUTOCONFIRM=true

############
# Studio
############
STUDIO_DEFAULT_ORGANIZATION=My-Org
STUDIO_DEFAULT_PROJECT=My-Project
STUDIO_PORT=3000
SUPABASE_PUBLIC_URL=[REDACTED]

############
# Functions
############
FUNCTIONS_VERIFY_JWT=false

############
# Logs
############
LOGFLARE_LOGGER_BACKEND_API_KEY=[REDACTED]
LOGFLARE_API_KEY=[REDACTED]
DOCKER_SOCKET_LOCATION=/var/run/docker.sock
GOOGLE_PROJECT_ID=None
GOOGLE_PROJECT_NUMBER=None

############
# Additional Configuration
############
IMGPROXY_ENABLE_WEBP_DETECTION=true

Setup Process

1. I started by following the Supabase self-hosting guide to generate API keys and other sensitive information.

2. For generating secure passwords and keys, I used a password manager to ensure strong, unique values for each required field.

3. I created a simple bash script to set these environment variables before running docker stack deploy.

4. I modified the original Docker Compose file to work with Docker Swarm, mainly by adjusting the networking configuration and adding deployment constraints where necessary. You can find it below, at the end of this post.

5. After setting up the environment variables and modifying the Docker Compose file, I deployed the stack to my Swarm cluster using docker stack deploy.

Key Modifications

The main changes I made to the original setup were:

1. Adapting the Docker Compose file to work with Docker Swarm networking and removing the unsupported depends_on syntax.
2. Used absolute paths in bind volumes (/mnt/data/supabase), replace it with your own supabase directory, I copied the docker/volumes directory in it.
3. Adding deployment constraints to ensure certain services run on specific nodes.
4. Configuring the traefik reverse proxy to handle incoming traffic to the Supabase services.

Conclusion

Self-hosting Supabase on Docker Swarm has been a great experience. It provides the flexibility and control of self-hosting while leveraging the power and scalability of Docker Swarm.

I hope this information helps others in the community who are looking to self-host Supabase in a similar environment. Feel free to ask any questions, and I'll do my best to answer based on my experience!

docker-compose.yaml

# Supabase Docker Compose Configuration
version: "3.8"

services:
  # Supabase Studio - Web-based UI
  studio:
    hostname: studio
    image: supabase/studio
    restart: unless-stopped
    networks:
      - supabase-net
    healthcheck:
      test: >
        node -e "require('http').get('http://localhost:3000/api/profile', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"
      timeout: 10s
      interval: 5s
      retries: 3
      start_period: 30s
    environment:
      HOSTNAME: 0.0.0.0
      STUDIO_PG_META_URL: http://meta:8080
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      DEFAULT_ORGANIZATION_NAME: ${STUDIO_DEFAULT_ORGANIZATION}
      DEFAULT_PROJECT_NAME: ${STUDIO_DEFAULT_PROJECT}
      SUPABASE_URL: http://kong:8000
      SUPABASE_PUBLIC_URL: ${SUPABASE_PUBLIC_URL}
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
      AUTH_JWT_SECRET: ${JWT_SECRET}
      LOGFLARE_API_KEY: ${LOGFLARE_API_KEY}
      LOGFLARE_URL: http://analytics:4000
      NEXT_PUBLIC_ENABLE_LOGS: 1
      NEXT_ANALYTICS_BACKEND_PROVIDER: postgres

  # Kong - API Gateway
  kong:
    hostname: kong
    networks:
      - supabase-net
      - traefik-public
    image: kong:2.8.1
    restart: unless-stopped
    entrypoint: bash -c 'eval "echo \"$$(cat ~/temp.yml)\"" > ~/kong.yml && /docker-entrypoint.sh kong docker-start'
    deploy:
      replicas: 1
      labels:
        - "traefik.enable=true"
        - "traefik.constraint-label=traefik-public"
        - "traefik.docker.network=traefik-public"
        - "traefik.http.routers.supabase-paill-at.rule=Host(`supabase.paill.at`)"
        - "traefik.http.routers.supabase-paill-at.entrypoints=http"
        - "traefik.http.routers.supabase-paill-at.middlewares=https-redirect"
        - "traefik.http.routers.supabase-paill-at-https.rule=Host(`supabase.paill.at`)"
        - "traefik.http.routers.supabase-paill-at-https.entrypoints=https"
        - "traefik.http.routers.supabase-paill-at-https.middlewares=crowdsec@file"
        - "traefik.http.routers.supabase-paill-at-https.tls=true"
        - "traefik.http.routers.supabase-paill-at-https.tls.certresolver=le"
        - "traefik.http.services.supabase-paill-at-https.loadbalancer.server.port=8000"
      placement:
        constraints: [node.labels.node-type == primary]
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth
      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
      DASHBOARD_USERNAME: ${DASHBOARD_USERNAME}
      DASHBOARD_PASSWORD: ${DASHBOARD_PASSWORD}
    volumes:
      - /mnt/data/supabase/api/kong.yml:/home/kong/temp.yml:ro

  # GoTrue - Auth Service
  auth:
    hostname: auth
    networks:
      - supabase-net
    image: supabase/gotrue:v2.151.0
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://auth:9999/health"
        ]
      timeout: 5s
      interval: 5s
      retries: 3
    restart: unless-stopped
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_API_PORT: 9999
      API_EXTERNAL_URL: ${API_EXTERNAL_URL}
      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      GOTRUE_SITE_URL: ${SITE_URL}
      GOTRUE_URI_ALLOW_LIST: ${ADDITIONAL_REDIRECT_URLS}
      GOTRUE_DISABLE_SIGNUP: ${DISABLE_SIGNUP}
      GOTRUE_JWT_ADMIN_ROLES: service_role
      GOTRUE_JWT_AUD: authenticated
      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
      GOTRUE_JWT_EXP: ${JWT_EXPIRY}
      GOTRUE_JWT_SECRET: ${JWT_SECRET}
      GOTRUE_EXTERNAL_EMAIL_ENABLED: ${ENABLE_EMAIL_SIGNUP}
      GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: ${ENABLE_ANONYMOUS_USERS}
      GOTRUE_MAILER_AUTOCONFIRM: ${ENABLE_EMAIL_AUTOCONFIRM}
      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_ADMIN_EMAIL}
      GOTRUE_SMTP_HOST: ${SMTP_HOST}
      GOTRUE_SMTP_PORT: ${SMTP_PORT}
      GOTRUE_SMTP_USER: ${SMTP_USER}
      GOTRUE_SMTP_PASS: ${SMTP_PASS}
      GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_NAME}
      GOTRUE_MAILER_URLPATHS_INVITE: ${MAILER_URLPATHS_INVITE}
      GOTRUE_MAILER_URLPATHS_CONFIRMATION: ${MAILER_URLPATHS_CONFIRMATION}
      GOTRUE_MAILER_URLPATHS_RECOVERY: ${MAILER_URLPATHS_RECOVERY}
      GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: ${MAILER_URLPATHS_EMAIL_CHANGE}
      GOTRUE_EXTERNAL_PHONE_ENABLED: ${ENABLE_PHONE_SIGNUP}
      GOTRUE_SMS_AUTOCONFIRM: ${ENABLE_PHONE_AUTOCONFIRM}

  # PostgREST - RESTful API
  rest:
    container_name: supabase-rest
    networks:
      - supabase-net
    image: postgrest/postgrest:v12.0.1
    restart: unless-stopped
    environment:
      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      PGRST_DB_SCHEMAS: ${PGRST_DB_SCHEMAS}
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: "false"
      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
      PGRST_APP_SETTINGS_JWT_EXP: ${JWT_EXPIRY}
    command: "postgrest"

  # Realtime - Real-time subscriptions
  realtime:
    container_name: realtime-dev.supabase-realtime
    networks:
      - supabase-net
    image: supabase/realtime:v2.28.32
    healthcheck:
      test: ["CMD-SHELL", 'curl -sSfL --head -o /dev/null -H "Authorization: Bearer $$ANON_KEY" http://localhost:4000/api/tenants/realtime-dev/health']
      timeout: 5s
      interval: 5s
      retries: 3
    restart: unless-stopped
    environment:
      PORT: 4000
      DB_HOST: ${POSTGRES_HOST}
      DB_PORT: ${POSTGRES_PORT}
      DB_USER: supabase_admin
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_NAME: ${POSTGRES_DB}
      DB_AFTER_CONNECT_QUERY: 'SET search_path TO _realtime'
      DB_ENC_KEY: supabaserealtime
      API_JWT_SECRET: ${JWT_SECRET}
      FLY_ALLOC_ID: fly123
      FLY_APP_NAME: realtime
      SECRET_KEY_BASE: UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq
      ERL_AFLAGS: -proto_dist inet_tcp
      ENABLE_TAILSCALE: "false"
      DNS_NODES: "''"
      ANON_KEY: ${ANON_KEY}
    command: >
      sh -c "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"

  # Storage API
  storage:
    hostname: storage
    networks:
      - supabase-net
    image: supabase/storage-api:v1.0.6
    deploy:
      placement:
        constraints: [node.labels.node-type == primary]
    healthcheck:
      test: >
        wget --no-verbose --tries=1 --spider http://0.0.0.0:5000/status
      timeout: 5s
      interval: 5s
      retries: 3
    restart: unless-stopped
    environment:
      ANON_KEY: ${ANON_KEY}
      SERVICE_KEY: ${SERVICE_ROLE_KEY}
      POSTGREST_URL: http://rest:3000
      PGRST_JWT_SECRET: ${JWT_SECRET}
      DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      FILE_SIZE_LIMIT: 52428800
      STORAGE_BACKEND: file
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      REGION: stub
      GLOBAL_S3_BUCKET: stub
      ENABLE_IMAGE_TRANSFORMATION: "true"
      IMGPROXY_URL: http://imgproxy:5001
    volumes:
      - /mnt/data/supabase/storage:/var/lib/storage:z

  # Image Proxy
  imgproxy:
    container_name: supabase-imgproxy
    networks:
      - supabase-net
    image: darthsim/imgproxy:v3.8.0
    deploy:
      placement:
        constraints: [node.labels.node-type == primary]
    healthcheck:
      test: [ "CMD", "imgproxy", "health" ]
      timeout: 5s
      interval: 5s
      retries: 3
    environment:
      IMGPROXY_BIND: ":5001"
      IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
      IMGPROXY_USE_ETAG: "true"
      IMGPROXY_ENABLE_WEBP_DETECTION: ${IMGPROXY_ENABLE_WEBP_DETECTION}
    volumes:
      - /mnt/data/supabase/storage:/var/lib/storage:z

  # Meta API
  meta:
    hostname: meta
    networks:
      - supabase-net
    image: supabase/postgres-meta:v0.80.0
    restart: unless-stopped
    environment:
      PG_META_PORT: 8080
      PG_META_DB_HOST: ${POSTGRES_HOST}
      PG_META_DB_PORT: ${POSTGRES_PORT}
      PG_META_DB_NAME: ${POSTGRES_DB}
      PG_META_DB_USER: supabase_admin
      PG_META_DB_PASSWORD: ${POSTGRES_PASSWORD}

  # Edge Functions
  functions:
    container_name: supabase-edge-functions
    image: supabase/edge-runtime:v1.54.2
    restart: unless-stopped
    deploy:
      placement:
        constraints: [node.labels.node-type == primary]
    environment:
      JWT_SECRET: ${JWT_SECRET}
      SUPABASE_URL: http://kong:8000
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
      SUPABASE_DB_URL: postgresql://postgres:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      VERIFY_JWT: "${FUNCTIONS_VERIFY_JWT}"
    volumes:
      - /mnt/data/supabase/functions:/home/deno/functions:Z
    command:
      - start
      - --main-service
      - /home/deno/functions/main

  # Analytics
  analytics:
    container_name: supabase-analytics
    networks:
      - supabase-net
    image: supabase/logflare:1.4.0
    healthcheck:
      test: [ "CMD", "curl", "http://localhost:4000/health" ]
      timeout: 5s
      interval: 5s
      retries: 10
    restart: unless-stopped
    environment:
      LOGFLARE_NODE_HOST: 127.0.0.1
      DB_USERNAME: supabase_admin
      DB_DATABASE: ${POSTGRES_DB}
      DB_HOSTNAME: ${POSTGRES_HOST}
      DB_PORT: ${POSTGRES_PORT}
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_SCHEMA: _analytics
      LOGFLARE_API_KEY: ${LOGFLARE_API_KEY}
      LOGFLARE_SINGLE_TENANT: "true"
      LOGFLARE_SUPABASE_MODE: "true"
      LOGFLARE_MIN_CLUSTER_SIZE: 1
      POSTGRES_BACKEND_URL: postgresql://supabase_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      POSTGRES_BACKEND_SCHEMA: _analytics
      LOGFLARE_FEATURE_FLAG_OVERRIDE: multibackend=true

  # Database
  db:
    container_name: supabase-db
    networks:
      - supabase-net
    deploy:
      placement:
        constraints: [node.labels.node-type == primary]
    image: supabase/postgres:15.1.1.61
    healthcheck:
      test: pg_isready -U postgres -h localhost
      interval: 5s
      timeout: 5s
      retries: 10
    command:
      - postgres
      - -c
      - config_file=/etc/postgresql/postgresql.conf
      - -c
      - log_min_messages=fatal
    restart: unless-stopped
    environment:
      POSTGRES_HOST: /var/run/postgresql
      PGPORT: ${POSTGRES_PORT}
      POSTGRES_PORT: ${POSTGRES_PORT}
      PGPASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATABASE: ${POSTGRES_DB}
      POSTGRES_DB: ${POSTGRES_DB}
      JWT_SECRET: ${JWT_SECRET}
      JWT_EXP: ${JWT_EXPIRY}
    volumes:
      - /mnt/data/supabase/db/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:Z
      - /mnt/data/supabase/db/webhooks.sql:/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql:Z
      - /mnt/data/supabase/db/roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:Z
      - /mnt/data/supabase/db/jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:Z
      - /mnt/data/supabase/db/data:/var/lib/postgresql/data:Z
      - /mnt/data/supabase/db/logs.sql:/docker-entrypoint-initdb.d/migrations/99-logs.sql:Z
      - db-config:/etc/postgresql-custom

  # Vector - Log collection and forwarding
  vector:
    hostname: vector
    networks:
      - supabase-net
    deploy:
      placement:
        constraints: [node.labels.node-type == primary]
    image: timberio/vector:0.28.1-alpine
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://vector:9001/health || exit 1
      timeout: 5s
      interval: 5s
      retries: 3
    volumes:
      - /mnt/data/supabase/logs/vector.yml:/etc/vector/vector.yml:ro
      - ${DOCKER_SOCKET_LOCATION}:/var/run/docker.sock:ro
    environment:
      LOGFLARE_API_KEY: ${LOGFLARE_API_KEY}
    command: [ "--config", "etc/vector/vector.yml" ]

volumes:
  db-config:

networks:
  supabase-net:
  traefik-public:
    external: true

[mundia416]

gotten it working, this needs to be on supabase's official docs!! 😄

[carloslencargorges]

Could you help me? I'm trying everything I can but unfortunately I'm not having success. What were the steps you took to be able to use the above stack? Did you make any changes? Do you have a stack to use the latest swarm?

any help is welcome!

[Witroch4]

Sorry for the ignorance, I'm trying to configure it, but I'm a beginner:
GOTRUE_SITE_URL: ${SITE_URL} refers to which site?
I created the following domains:
supabase.mysite.com
apisupabase.mysite.com

Can I disregard the authentication part?

[Paillat-dev]

So basically, that is the url of your actual app.

For example, if you have a todo list website att mytodolist.com, and its supabase instance at supabase.mytodolist.com. that would be mytodolist.com.

I believe it is only used for authentication, but I might be wrong.

[Witroch4]

Thank you very much for the response. I had problems with the GoTrue service and Kong T.T; they are not running. Later, when I try again (I spent all Sunday trying), I will share my stack, and any help will be greatly appreciated. Thank you so much for your post!

[RohithTechnoCIS]

This worked like a charm with my portainer setup, Thanks.

There was one more thing I would like to add. I originally had traefik labels with a different subdomain on supabase/studio also, and had the routing commented in kong.yml, it was a bad idea.