Self-hosted: Getting no encryption error while start supabase helm chart even with 'DB_SSL=true', tenant migrations fail against Postgres that requires TLS (RDS)

[muralikumar4015]

Environment

• Realtime image: supabase/realtime:v2.102.3
• Deployment: Kubernetes (supabase-community/supabase-kubernetes chart), only Realtime enabled
• Database: AWS RDS PostgreSQL, rds.force_ssl=1, rds.logical_replication=1
• SEED_SELF_HOST=true, DB_SSL="true"

What happens

Startup migrations for _realtime and the seed succeed, and the process connects
to Postgres over TLS (DB_SSL=true). The seed then creates the tenant, and the
tenant's own connection (used to apply the realtime schema migrations) fails:

project=<tenant> external_id=<tenant> [info] Applying migrations to <rds-host>
** (Postgrex.Error) FATAL 28000 (invalid_authorization_specification)
   no pg_hba.conf entry for host "<ip>", user "<role>", database "<db>", no encryption
[info] Failed to set-up tenant: {:error, :shutdown}

Querying the seeded row shows the cause:

select settings->>'ssl_enforced' from _realtime.extensions;   -- false

Expected

With DB_SSL=true, the seeded tenant extension should have ssl_enforced: true
(or the docs should say that this value is independent of DB_SSL).

Questions

1. Is DB_SSL meant to control the seeded tenant's ssl_enforced?
2. Does the seed overwrite existing tenant settings on every start?
3. Which variable or setting should be used so Realtime trusts the RDS CA
   (verification against the AWS global bundle)?
4. What are custom values we can use to connect supabase realtime with AWS RDS Database??

Logs

• ulimit -n
  65536
• '[' -n 10000 ']'
• echo 'Setting RLIMIT_NOFILE to 10000'
• ulimit -Sn 10000
  Setting RLIMIT_NOFILE to 10000
• export ERL_CRASH_DUMP=/tmp/erl_crash.dump
• ERL_CRASH_DUMP=/tmp/erl_crash.dump
• '[' false = true ']'
• [[ -n '' ]]
• echo 'Running migrations'
• sudo -E -u nobody /app/bin/migrate
  Running migrations
  08:47:41.981 [info] == Running 20210706140551 Realtime.Repo.Migrations.CreateTenants.change/0 forward
  08:47:41.981 [info] create table tenants
  08:47:41.987 [info] create index tenants_external_id_index
  08:47:41.990 [info] == Migrated 20210706140551 in 0.0s
  08:47:42.036 [info] == Running 20220329161857 Realtime.Repo.Migrations.AddExtensionsTable.change/0 forward
  08:47:42.037 [info] create table extensions
  08:47:42.044 [info] create index extensions_tenant_external_id_type_index
  08:47:42.046 [info] == Migrated 20220329161857 in 0.0s
  08:47:42.053 [info] == Running 20220410212326 Realtime.Repo.Migrations.AddTenantMaxEps.up/0 forward
  08:47:42.054 [info] alter table tenants
  08:47:42.056 [info] == Migrated 20220410212326 in 0.0s
  08:47:42.062 [info] == Running 20220506102948 Realtime.Repo.Migrations.RenamePollIntervalToPollIntervalMs.up/0 forward
  08:47:42.074 [info] == Migrated 20220506102948 in 0.0s
  08:47:42.081 [info] == Running 20220527210857 Realtime.Repo.Migrations.AddExternalIdUniqIndex.change/0 forward
  08:47:42.083 [info] execute "alter table tenants add constraint uniq_external_id unique (external_id)"
  08:47:42.087 [info] == Migrated 20220527210857 in 0.0s
  08:47:42.094 [info] == Running 20220815211129 Realtime.Repo.Migrations.NewMaxEventsPerSecondDefault.change/0 forward
  08:47:42.094 [info] alter table tenants
  08:47:42.096 [info] == Migrated 20220815211129 in 0.0s
  08:47:42.103 [info] == Running 20220815215024 Realtime.Repo.Migrations.SetCurrentMaxEventsPerSecond.change/0 forward
  08:47:42.103 [info] execute "update tenants set max_events_per_second = 1000"
  08:47:42.106 [info] == Migrated 20220815215024 in 0.0s
  08:47:42.112 [info] == Running 20220818141501 Realtime.Repo.Migrations.ChangeLimitsDefaults.change/0 forward
  08:47:42.112 [info] alter table tenants
  08:47:42.117 [info] == Migrated 20220818141501 in 0.0s
  08:47:42.124 [info] == Running 20221018173709 Realtime.Repo.Migrations.AddCdcDefault.up/0 forward
  08:47:42.124 [info] alter table tenants
  08:47:42.126 [info] == Migrated 20221018173709 in 0.0s
  08:47:42.133 [info] == Running 20221102172703 Realtime.Repo.Migrations.RenamePgType.up/0 forward
  08:47:42.133 [info] execute "update extensions set type = 'postgres_cdc_rls'"
  08:47:42.139 [info] == Migrated 20221102172703 in 0.0s
  08:47:42.145 [info] == Running 20221223010058 Realtime.Repo.Migrations.DropTenantsUniqExternalIdIndex.change/0 forward
  08:47:42.145 [info] execute "ALTER TABLE IF EXISTS tenants DROP CONSTRAINT IF EXISTS uniq_external_id"
  08:47:42.148 [info] == Migrated 20221223010058 in 0.0s
  08:47:42.156 [info] == Running 20230110180046 Realtime.Repo.Migrations.AddLimitsFieldsToTenants.change/0 forward
  08:47:42.156 [info] alter table tenants
  08:47:42.159 [info] == Migrated 20230110180046 in 0.0s
  08:47:42.167 [info] == Running 20230810220907 Realtime.Repo.Migrations.AlterTenantsTableColumnsToText.change/0 forward
  08:47:42.167 [info] alter table tenants
  08:47:42.171 [info] == Migrated 20230810220907 in 0.0s
  08:47:42.177 [info] == Running 20230810220924 Realtime.Repo.Migrations.AlterExtensionsTableColumnsToText.change/0 forward
  08:47:42.177 [info] alter table extensions
  08:47:42.183 [info] == Migrated 20230810220924 in 0.0s
  08:47:42.191 [info] == Running 20231024094642 :"Elixir.Realtime.Repo.Migrations.Add-tenant-suspend-flag".change/0 forward
  08:47:42.192 [info] alter table tenants
  08:47:42.195 [info] == Migrated 20231024094642 in 0.0s
  08:47:42.203 [info] == Running 20240306114423 Realtime.Repo.Migrations.AdddTenantJwtJwksColumn.change/0 forward
  08:47:42.203 [info] alter table tenants
  08:47:42.209 [info] == Migrated 20240306114423 in 0.0s
  08:47:42.215 [info] == Running 20240418082835 Realtime.Repo.Migrations.AddAuthorizationFlag.change/0 forward
  08:47:42.215 [info] alter table tenants
  08:47:42.217 [info] == Migrated 20240418082835 in 0.0s
  08:47:42.224 [info] == Running 20240625211759 Realtime.Repo.Migrations.RemoveEnableAuthorizationFlag.change/0 forward
  08:47:42.224 [info] alter table tenants
  08:47:42.226 [info] == Migrated 20240625211759 in 0.0s
  08:47:42.232 [info] == Running 20240704172020 :"Elixir.Realtime.Repo.Migrations.Add-notify-private-alpha".change/0 forward
  08:47:42.233 [info] alter table tenants
  08:47:42.235 [info] == Migrated 20240704172020 in 0.0s
  08:47:42.245 [info] == Running 20240902173232 Realtime.Repo.Migrations.AddExtensionExternalIdIndex.change/0 forward
  08:47:42.245 [info] create index if not exists extensions_tenant_external_id_index
  08:47:42.247 [info] == Migrated 20240902173232 in 0.0s
  08:47:42.255 [info] == Running 20241106103258 Realtime.Repo.Migrations.AddPrivateOnlyFlagColumnToTenant.change/0 forward
  08:47:42.255 [info] alter table tenants
  08:47:42.257 [info] == Migrated 20241106103258 in 0.0s
  08:47:42.263 [info] == Running 20250424203323 Realtime.Repo.Migrations.AddMigrationsRanToTenant.change/0 forward
  08:47:42.263 [info] alter table tenants
  08:47:42.266 [info] == Migrated 20250424203323 in 0.0s
  08:47:42.273 [info] == Running 20250613072131 Realtime.Repo.Migrations.AddTenantBroadcastAdapter.change/0 forward
  08:47:42.273 [info] alter table tenants
  08:47:42.275 [info] == Migrated 20250613072131 in 0.0s
  08:47:42.282 [info] == Running 20250711044927 Realtime.Repo.Migrations.ChangeDefaultBroadcastAdapterToGenRpc.change/0 forward
  08:47:42.282 [info] alter table tenants
  08:47:42.285 [info] == Migrated 20250711044927 in 0.0s
  08:47:42.291 [info] == Running 20250811121559 Realtime.Repo.Migrations.AddMaxPresenceEventsPerSecond.change/0 forward
  08:47:42.292 [info] alter table tenants
  08:47:42.294 [info] == Migrated 20250811121559 in 0.0s
  08:47:42.299 [info] == Running 20250926223044 Realtime.Repo.Migrations.SetDefaultPresenceValue.change/0 forward
  08:47:42.300 [info] alter table tenants
  08:47:42.304 [info] == Migrated 20250926223044 in 0.0s
  08:47:42.312 [info] == Running 20251204170944 Realtime.Repo.Migrations.NullableJwtSecrets.change/0 forward
  08:47:42.313 [info] alter table tenants
  08:47:42.315 [info] create check constraint jwt_secret_or_jwt_jwks_required on table tenants
  08:47:42.320 [info] == Migrated 20251204170944 in 0.0s
  08:47:42.327 [info] == Running 20251218000543 Realtime.Repo.Migrations.EnsureJwtSecretIsText.change/0 forward
  08:47:42.327 [info] alter table tenants
  08:47:42.329 [info] == Migrated 20251218000543 in 0.0s
  08:47:42.335 [info] == Running 20260209232800 Realtime.Repo.Migrations.AddMaxClientPresenceEventsPerSecond.change/0 forward
  08:47:42.335 [info] alter table tenants
  08:47:42.337 [info] == Migrated 20260209232800 in 0.0s
  08:47:42.343 [info] == Running 20260304000000 Realtime.Repo.Migrations.AddPresenceEnabledToTenants.change/0 forward
  08:47:42.343 [info] alter table tenants
  08:47:42.345 [info] == Migrated 20260304000000 in 0.0s
  08:47:42.351 [info] == Running 20260422000000 Realtime.Repo.Migrations.CreateFeatureFlags.change/0 forward
  08:47:42.351 [info] create table feature_flags
  08:47:42.354 [info] create index feature_flags_name_index
  08:47:42.356 [info] alter table tenants
  08:47:42.375 [info] == Migrated 20260422000000 in 0.0s
• '[' true = true ']'
• echo 'Seeding selfhosted Realtime'
• sudo -E -u nobody /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)'
  Seeding selfhosted Realtime
  08:47:42.893 [warning] Failed to load OTP-trusted CAs: :error::function_clause, falling back to hardcoded authorities
  08:47:42.942 [info] Loading 146 CA(s) from :hardcoded store
  08:47:43.042 [info] event=server_setup_successfully driver=tcp port=5369 socket="#Port<0.6>"
  08:47:43.046 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.047 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.048 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:43.196 [notice] :alarm_handler: {:set, {{:disk_almost_full, ~c"/usr/local/sbin/modprobe"}, []}}
  08:47:43.280 [notice] SYN[nonode@nohost] Adding node to scope <Elixir.RegionNodes>
  08:47:43.283 [notice] SYN[nonode@nohost] Creating tables for scope <Elixir.RegionNodes>
  08:47:43.286 [notice] SYN[nonode@nohost|registry<Elixir.RegionNodes>] Discovering the cluster
  08:47:43.288 [notice] SYN[nonode@nohost|pg<Elixir.RegionNodes>] Discovering the cluster
  08:47:43.289 [notice] SYN[nonode@nohost] Adding node to scope <Elixir.Realtime.Tenants.Connect>
  08:47:43.289 [notice] SYN[nonode@nohost] Creating tables for scope <Elixir.Realtime.Tenants.Connect>
  08:47:43.289 [notice] SYN[nonode@nohost|registry<Elixir.Realtime.Tenants.Connect>] Discovering the cluster
  08:47:43.289 [notice] SYN[nonode@nohost|pg<Elixir.Realtime.Tenants.Connect>] Discovering the cluster
  08:47:43.914 [warning] MFA {Realtime.PromEx.Plugins.TenantGlobal, :execute_global_connection_metrics, []} encountered an error but has not been detached: %ArgumentError{message: "errors were found at the given arguments:\n\n * 1st argument: the table identifier does not refer to an existing ETS table\n"}
  08:47:43.923 [warning] MFA {Realtime.PromEx.Plugins.Tenant, :execute_tenant_metrics, []} encountered an error but has not been detached: %ArgumentError{message: "errors were found at the given arguments:\n\n * 1st argument: the table identifier does not refer to an existing ETS table\n"}
  08:47:43.938 [info] Beacon[nonode@nohost|users] Starting
  08:47:44.006 [info] [libcluster:postgres] Connected to Postgres database
  08:47:44.008 [info] Running RealtimeWeb.Endpoint with cowboy 2.15.0 at :::4000 (http)
  08:47:44.013 [info] Access RealtimeWeb.Endpoint at http://realtime.supabase.co:443
  08:47:44.115 [notice] SYN[nonode@nohost] Adding node to scope <realtime_postgres_cdc_0>
  08:47:44.115 [notice] SYN[nonode@nohost] Creating tables for scope <realtime_postgres_cdc_0>
  08:47:44.115 [notice] SYN[nonode@nohost|registry<realtime_postgres_cdc_0>] Discovering the cluster
  08:47:44.116 [notice] SYN[nonode@nohost|pg<realtime_postgres_cdc_0>] Discovering the cluster
  08:47:44.116 [notice] SYN[nonode@nohost] Adding node to scope <realtime_postgres_cdc_1>
  08:47:44.116 [notice] SYN[nonode@nohost] Creating tables for scope <realtime_postgres_cdc_1>
  08:47:44.116 [notice] SYN[nonode@nohost|registry<realtime_postgres_cdc_1>] Discovering the cluster
  08:47:44.116 [notice] SYN[nonode@nohost|pg<realtime_postgres_cdc_1>] Discovering the cluster
  08:47:44.116 [notice] SYN[nonode@nohost] Adding node to scope <realtime_postgres_cdc_2>
  08:47:44.117 [notice] SYN[nonode@nohost] Creating tables for scope <realtime_postgres_cdc_2>
  08:47:44.117 [notice] SYN[nonode@nohost|registry<realtime_postgres_cdc_2>] Discovering the cluster
  08:47:44.117 [notice] SYN[nonode@nohost|pg<realtime_postgres_cdc_2>] Discovering the cluster
  08:47:44.117 [notice] SYN[nonode@nohost] Adding node to scope <realtime_postgres_cdc_3>
  08:47:44.117 [notice] SYN[nonode@nohost] Creating tables for scope <realtime_postgres_cdc_3>
  08:47:44.117 [notice] SYN[nonode@nohost|registry<realtime_postgres_cdc_3>] Discovering the cluster
  08:47:44.117 [notice] SYN[nonode@nohost|pg<realtime_postgres_cdc_3>] Discovering the cluster
  08:47:44.117 [notice] SYN[nonode@nohost] Adding node to scope <realtime_postgres_cdc_4>
  08:47:44.118 [notice] SYN[nonode@nohost] Creating tables for scope <realtime_postgres_cdc_4>
  08:47:44.118 [notice] SYN[nonode@nohost|registry<realtime_postgres_cdc_4>] Discovering the cluster
  08:47:44.118 [notice] SYN[nonode@nohost|pg<realtime_postgres_cdc_4>] Discovering the cluster
  08:47:44.118 [info] Janitor started
  08:47:44.118 [info] Starting MetricsCleaner
  08:47:44.234 [warning] Zero region nodes for us-east-1 using :nonode@nohost
  08:47:44.241 project=abc-supabase-supabase-realtime external_id=abc-supabase-supabase-realtime [info] Applying migrations to demo-01.cpigcymdsfsdz.ap-south-1.rds.amazonaws.com
  08:47:44.253 [error] :gen_statem #PID<0.801.0> terminating
  ** (Postgrex.Error) FATAL 28000 (invalid_authorization_specification) no pg_hba.conf entry for host "10.10.10.24", user "abc_supadmin", database "abc-data-qa", no encryption
  (db_connection 2.9.0) lib/db_connection/connection.ex:110: DBConnection.Connection.handle_event/4
  (stdlib 6.2.1) gen_statem.erl:3737: :gen_statem.loop_state_callback/11
  (stdlib 6.2.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3
  Process Label: "db_conn_1"
  Queue: [internal: {:connect, :init}]
  Postponed: []
  08:47:44.254 [error] :gen_statem #PID<0.802.0> terminating
  ** (Postgrex.Error) FATAL 28000 (invalid_authorization_specification) no pg_hba.conf entry for host "10.10.10.24", user "abc_supadmin", database "abc-data-qa", no encryption
  (db_connection 2.9.0) lib/db_connection/connection.ex:110: DBConnection.Connection.handle_event/4
  (stdlib 6.2.1) gen_statem.erl:3737: :gen_statem.loop_state_callback/11
  (stdlib 6.2.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3
  Process Label: "db_conn_2"
  Queue: [internal: {:connect, :init}]
  Postponed: []
  08:47:44.258 [error] :gen_statem #PID<0.803.0> terminating
  ** (Postgrex.Error) FATAL 28000 (invalid_authorization_specification) no pg_hba.conf entry for host "10.10.10.24", user "abc_supadmin", database "abc-data-qa", no encryption
  (db_connection 2.9.0) lib/db_connection/connection.ex:110: DBConnection.Connection.handle_event/4
  (stdlib 6.2.1) gen_statem.erl:3737: :gen_statem.loop_state_callback/11
  (stdlib 6.2.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3
  Process Label: "db_conn_1"
  Queue: [internal: {:connect, :init}]
  Postponed: []
  08:47:44.259 [error] :gen_statem #PID<0.804.0> terminating
  ** (Postgrex.Error) FATAL 28000 (invalid_authorization_specification) no pg_hba.conf entry for host "10.10.10.24", user "abc_supadmin", database "abc-data-qa", no encryption
  (db_connection 2.9.0) lib/db_connection/connection.ex:110: DBConnection.Connection.handle_event/4
  (stdlib 6.2.1) gen_statem.erl:3737: :gen_statem.loop_state_callback/11
  (stdlib 6.2.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3
  Process Label: "db_conn_2"
  Queue: [internal: {:connect, :init}]
  Postponed: []
  08:47:44.263 [error] :gen_statem #PID<0.805.0> terminating
  ** (Postgrex.Error) FATAL 28000 (invalid_authorization_specification) no pg_hba.conf entry for host "10.10.10.24", user "abc_supadmin", database "abc-data-qa", no encryption
  (db_connection 2.9.0) lib/db_connection/connection.ex:110: DBConnection.Connection.handle_event/4
  (stdlib 6.2.1) gen_statem.erl:3737: :gen_statem.loop_state_callback/11
  (stdlib 6.2.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3
  Process Label: "db_conn_1"
  Queue: [internal: {:connect, :init}]
  Postponed: []
  08:47:44.269 [info] Failed to set-up tenant: {:error, :shutdown}
  [os_mon] memory supervisor port (memsup): Erlang has closed
  [os_mon] cpu supervisor port (cpu_sup): Erlang has closed
• echo 'Starting Realtime'
  Starting Realtime
• ulimit -n
  10000
• exec /app/bin/server
  =WARNING REPORT==== 27-Oct-2026::08:47:46.840622 ===
  Failed to load OTP-trusted CAs: error:function_clause, falling back to hardcoded authorities
  08:47:46.892 [info] event=server_setup_successfully driver=tcp port=5369 socket="#Port<0.8>"
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.893 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.894 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.894 [info] ["$kind": :gen_rpc_dispatcher_start]
  08:47:46.925 [notice] SYN[realtime@127.0.0.1] Adding node to scope <Elixir.RegionNodes>
  08:47:46.925 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <Elixir.RegionNodes>
  08:47:46.926 [notice] :alarm_handler: {:set, {{:disk_almost_full, ~c"/usr/local/sbin/modprobe"}, []}}
  08:47:46.926 [notice] SYN[realtime@127.0.0.1|registry<Elixir.RegionNodes>] Discovering the cluster
  08:47:46.926 [notice] SYN[realtime@127.0.0.1] Adding node to scope <Elixir.Realtime.Tenants.Connect>
  08:47:46.926 [notice] SYN[realtime@127.0.0.1|pg<Elixir.RegionNodes>] Discovering the cluster
  08:47:46.926 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <Elixir.Realtime.Tenants.Connect>
  08:47:46.927 [notice] SYN[realtime@127.0.0.1|registry<Elixir.Realtime.Tenants.Connect>] Discovering the cluster
  08:47:46.927 [notice] SYN[realtime@127.0.0.1|pg<Elixir.Realtime.Tenants.Connect>] Discovering the cluster
  08:47:47.118 [warning] MFA {Realtime.PromEx.Plugins.TenantGlobal, :execute_global_connection_metrics, []} encountered an error but has not been detached: %ArgumentError{message: "errors were found at the given arguments:\n\n * 1st argument: the table identifier does not refer to an existing ETS table\n"}
  08:47:47.138 [warning] MFA {Realtime.PromEx.Plugins.Tenant, :execute_tenant_metrics, []} encountered an error but has not been detached: %ArgumentError{message: "errors were found at the given arguments:\n\n * 1st argument: the table identifier does not refer to an existing ETS table\n"}
  08:47:47.140 [info] Beacon[realtime@127.0.0.1|users] Starting
  08:47:47.149 [info] Running RealtimeWeb.Endpoint with cowboy 2.15.0 at :::4000 (http)
  08:47:47.154 [info] Access RealtimeWeb.Endpoint at http://realtime.supabase.co:443
  08:47:47.155 [notice] SYN[realtime@127.0.0.1] Adding node to scope <realtime_postgres_cdc_0>
  08:47:47.155 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <realtime_postgres_cdc_0>
  08:47:47.155 [notice] SYN[realtime@127.0.0.1|registry<realtime_postgres_cdc_0>] Discovering the cluster
  08:47:47.155 [notice] SYN[realtime@127.0.0.1|pg<realtime_postgres_cdc_0>] Discovering the cluster
  08:47:47.156 [notice] SYN[realtime@127.0.0.1] Adding node to scope <realtime_postgres_cdc_1>
  08:47:47.156 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <realtime_postgres_cdc_1>
  08:47:47.156 [notice] SYN[realtime@127.0.0.1|registry<realtime_postgres_cdc_1>] Discovering the cluster
  08:47:47.156 [notice] SYN[realtime@127.0.0.1|pg<realtime_postgres_cdc_1>] Discovering the cluster
  08:47:47.156 [notice] SYN[realtime@127.0.0.1] Adding node to scope <realtime_postgres_cdc_2>
  08:47:47.156 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <realtime_postgres_cdc_2>
  08:47:47.157 [notice] SYN[realtime@127.0.0.1|registry<realtime_postgres_cdc_2>] Discovering the cluster
  08:47:47.157 [notice] SYN[realtime@127.0.0.1|pg<realtime_postgres_cdc_2>] Discovering the cluster
  08:47:47.157 [notice] SYN[realtime@127.0.0.1] Adding node to scope <realtime_postgres_cdc_3>
  08:47:47.157 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <realtime_postgres_cdc_3>
  08:47:47.157 [notice] SYN[realtime@127.0.0.1|registry<realtime_postgres_cdc_3>] Discovering the cluster
  08:47:47.157 [notice] SYN[realtime@127.0.0.1|pg<realtime_postgres_cdc_3>] Discovering the cluster
  08:47:47.158 [notice] SYN[realtime@127.0.0.1] Adding node to scope <realtime_postgres_cdc_4>
  08:47:47.158 [notice] SYN[realtime@127.0.0.1] Creating tables for scope <realtime_postgres_cdc_4>
  08:47:47.158 [notice] SYN[realtime@127.0.0.1|registry<realtime_postgres_cdc_4>] Discovering the cluster
  08:47:47.158 [notice] SYN[realtime@127.0.0.1|pg<realtime_postgres_cdc_4>] Discovering the cluster
  08:47:47.160 [info] Janitor started
  08:47:47.160 [info] Starting MetricsCleaner
  08:47:47.208 [info] [libcluster:postgres] Connected to Postgres database

Custom Values example

secret:
jwt:
secretRef: "abc-jwt"
db:
secretRef: "abc-db"
host: "demo-01.cpigcymdsfsdz.ap-south-1.rds.amazonaws.com"
port: "5042"
database: "abc-data-qa"
realtime:
secretRef: "abc-realtime"
deployment:
analytics:
enabled: false
auth:
enabled: false
db:
enabled: false
functions:
enabled: false
imgproxy:
enabled: false
kong:
enabled: false
meta:
enabled: false
minio:
enabled: false
realtime:
enabled: true
rest:
enabled: false
storage:
enabled: false
studio:
enabled: false
vector:
enabled: false

persistence:
db:
enabled: false
pgsodium:
enabled: false
functions:
enabled: false
imgproxy:
enabled: false
minio:
enabled: false
snippets:
enabled: false
storage:
enabled: false
deno:
enabled: false

ingress:
enabled: false

environment:
realtime:
- name: DB_USER
value: abc_supaadmin
- name: DB_SSL
value: "true"
- name: PORT
value: "4000"
- name: FLY_ALLOC_ID
value: fly123
- name: FLY_APP_NAME
value: realtime
- name: ENABLE_TAILSCALE
value: "false"
- name: DB_AFTER_CONNECT_QUERY
value: "SET search_path TO _realtime"
- name: ERL_AFLAGS
value: -proto_dist inet_tcp
- name: DNS_NODES
value: "''"
- name: RLIMIT_NOFILE
value: "10000"
- name: APP_NAME
value: realtime
- name: SEED_SELF_HOST
value: true
- name: RUN_JANITOR
value: true

[aantti]

@luizfelmach

[nicholas-greenwood]

no, DB_SSL configures realtime's metadata connection in v2.102.3. the seed hardcodes the tenant's ssl_enforced: false, just as your query shows

the seed also deletes and recreates the tenant matching SELF_HOST_TENANT_NAME. with SEED_SELF_HOST=true, it resets that tenant's settings on every start

for the tenant you've already created, i'd set SEED_SELF_HOST="false" before saving the correction through the authenticated PUT /api/tenants/{external_id} route. send the complete tenant.extensions configuration with boolean ssl_enforced: true in the postgres_cdc_rls settings. keep every other extension and setting, and use your original plaintext connection values. don't copy the GET response back into PUT: the stored connection values are encrypted, and GET omits db_password

for metadata, DB_SSL_CA_CERT points at the mounted ca bundle, such as /etc/rds/global-bundle.pem, alongside DB_SSL="true". the tenant connection uses verify: :verify_none when ssl_enforced is true. that enables encryption but doesn't verify the rds certificate, and DB_SSL_CA_CERT doesn't change that tenant path

if your chart matches current main, use environment.realtime for those env entries and deployment.realtime.volumes / volumeMounts for the ca mount. keep the rest of your env list when changing it

[luizfelmach]

Thanks, @nicholas-greenwood, for explaining the metadata and tenant connection behavior. Building on your answer, I’ve grouped the configuration details around the four questions above, including the Helm setup.

1. Does DB_SSL configure the seeded tenant?

In v2.102.3, DB_SSL configures Realtime’s metadata database connection, while the self-hosted seed explicitly sets the tenant extension’s ssl_enforced to false.

These are separate connection configurations, even when they connect to the same RDS instance. That explains why _realtime migrations succeed but tenant migrations fail with no encryption: the tenant connection is attempting to connect without TLS.

Starting with v2.137.0, the seed reads DB_SSL when setting ssl_enforced, as described in the release notes.

For this startup error, I would first test a compatible release containing that change in staging, keeping DB_SSL="true".

2. Are tenant settings overwritten on startup?

Yes, when using the standard entrypoint with SEED_SELF_HOST="true".

The seed deletes and recreates the tenant matching SELF_HOST_TENANT_NAME, including its extension configuration. This still happens after the TLS fix; the fix changes how ssl_enforced is populated, but does not make the seed preserve custom tenant settings.

3. How should the AWS CA bundle be configured?

For the metadata connection, configure:

DB_SSL=true
DB_SSL_CA_CERT=/etc/rds/global-bundle.pem

DB_SSL_CA_CERT is a local file path. Mount the AWS CA bundle there and ensure the container user can read it.

For tenant connections, ssl_enforced=true results in verify: :verify_none. This encrypts the connection but does not verify the server certificate. DB_SSL_CA_CERT does not configure that tenant connection path.

That behavior also remains in the inspected v2.148.2 source. Therefore, upgrading to fix the seed does not provide server certificate verification for tenant connections. If that verification is required, it needs a separate implementation change; Helm values alone cannot enable it in this code path.

4. Which Helm values should be used for RDS?

For chart 0.8.0, the relevant values are:

Value	Purpose
deployment.db.enabled: false	Use an external database
secret.db.host	Actual RDS hostname
secret.db.port	Actual RDS port
secret.db.database	Target database
secret.db.secretRef	Existing database credentials Secret
environment.realtime	Configure DB_USER, DB_SSL, DB_SSL_CA_CERT, and SEED_SELF_HOST
image.realtime.tag	Explicitly select a tested release containing the seed fix
deployment.realtime.volumes / volumeMounts	Mount the CA bundle

The inspected chart defaults to v2.134.10, which predates the fix. Updating the chart alone is therefore not sufficient; check the Realtime image tag explicitly.

For example, this fragment mounts the CA bundle:

deployment:
  db:
    enabled: false

  realtime:
    volumes:
      - name: rds-ca
        configMap:
          name: rds-ca
    volumeMounts:
      - name: rds-ca
        mountPath: /etc/rds
        readOnly: true

This assumes a ConfigMap named rds-ca already exists in the release namespace with a key named global-bundle.pem. Merge these entries with any existing volumes and mounts.

In your existing environment.realtime list, set or update:

- name: DB_SSL
  value: "true"
- name: DB_SSL_CA_CERT
  value: /etc/rds/global-bundle.pem

Preserve the other environment entries, including your database user and DB_AFTER_CONNECT_QUERY. Helm replaces lists when overriding them, so the two entries above should not replace your entire environment list.

Keep your existing settings that disable the other Supabase components. Setting only deployment.db.enabled: false does not make the deployment Realtime-only.

When referencing existing Secrets, ensure secretRefKey mappings match their actual keys. The external database must also already have the required Supabase schemas, roles and grants; enabling logical replication alone does not provide those.

Validation

After upgrading, check that:

• The intended tenant has ssl_enforced=true, including after a restart.
• Tenant migrations complete without the no encryption error.
• A subscription receives events successfully.
• Realtime database sessions use TLS, as observable through pg_stat_ssl.

The last check confirms encryption, not certificate verification by the client.

Could you share your exact chart version and confirm whether certificate verification is required for tenant connections as well? That would help narrow down the remaining configuration.