Move Away from Using Environment Variables for Secrets

[IcedTea2K]

Chore

Describe the chore

Currently, self-hosting supabase using docker is recommending environment variables for sensitive data (https://supabase.com/docs/guides/self-hosting/docker). This is generally discouraged, since exposing secrets as environment variables might be a security problem. Also a while back #6014, supabase began to make iterative changes to support *_FILE based environment to store paths to secrets. We should utilize this and start moving away from directly using environment variables for secrets.

(And of course, update the docs about this)

Additional context

For more context, this is what I mean. Currently, we store PGRST_JWT_SECRET=some_secret in .env file, and we load using

services:
 rest:
   image: postgrest/postgrest
   environment:
     PGRST_JWT_SECRET: ${JWT_SECRET}

A better way to go about this is:

services:
 rest:
   image: postgrest/postgrest
   environment:
     PGRST_JWT_SECRET_FILE: /run/secrets/jwt_secret
 secrets:
   - jwt_secret

secrets:
 jwt_secret:
   file: path/to/jwt_secret

Additional resources:
Docker' .env: https://docs.docker.com/compose/environment-variables/set-environment-variables/
Docker secrets: https://docs.docker.com/compose/use-secrets/
Supabase self-hosted: https://supabase.com/docs/guides/self-hosting/docker#configuring-services

[IcedTea2K]

This might have to wait for #22605, so that the changes wouldn't conflict each other.

[Hallidayo]

Hi all, going to move over to a discussion due to inactivity.