add caddy and nginx configs for self-hosted#43291
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
5 Skipped Deployments
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Central YAML (base), Repository UI (inherited), Organization UI (inherited) Review profile: CHILL Plan: Pro Cache: Disabled due to Reviews > Disable Cache setting Disabled knowledge base sources:
📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds optional reverse-proxy support for Docker deployments via new Caddy and Nginx compose files, proxy configuration templates, and env example entries. Introduces PROXY_DOMAIN and CERTBOT_EMAIL in docker/.env.example. New compose files run Caddy or an nginx+certbot image dependent on kong's health, persist TLS/config volumes, and hash dashboard credentials at startup. New proxy configs route API paths to kong, storage paths to storage (with CORS/preflight handling and X-Forwarded-Prefix), and dashboard requests to studio behind basic auth. No application logic or public APIs were changed. Sequence Diagram(s)sequenceDiagram
participant Client
participant Proxy as Caddy/Nginx
participant Kong
participant Storage
participant Studio
participant LetsEncrypt as "Let's Encrypt / Certbot"
Client->>Proxy: TLS handshake / HTTPS request
Proxy->>LetsEncrypt: Obtain/renew certs (ACME) -- async/setup-->
alt Request to API paths (/auth,/rest,/graphql,/functions,/mcp,/realtime)
Proxy->>Kong: Reverse proxy to kong:8000
Kong-->>Proxy: Response
Proxy-->>Client: Forward response
else Request to storage (/storage/v1)
alt OPTIONS (preflight)
Proxy->>Client: Respond with CORS headers
else Other methods
Proxy->>Storage: Reverse proxy to storage:5000 (add X-Forwarded-Prefix)
Storage-->>Proxy: Response
Proxy-->>Client: Forward response (with CORS headers)
end
else Request to dashboard root (/ or default)
Client->>Proxy: Request with Basic Auth
Proxy->>Proxy: Validate basic_auth (hashed password)
Proxy->>Studio: Reverse proxy to studio:3000
Studio-->>Proxy: Response
Proxy-->>Client: Forward response
end
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docker/docker-compose.nginx.yml`:
- Line 25: The openssl passwd invocation uses an unquoted environment variable
so PASSWORDs with spaces/special chars get word-split; update the command that
writes to /etc/nginx/user_conf.d/dashboard-passwd to quote PROXY_AUTH_PASSWORD
(e.g., use "$${PROXY_AUTH_PASSWORD}" in the openssl passwd -apr1 call) so
openssl receives the password as a single argument when generating the hash.
ℹ️ Review info
Configuration used: Central YAML (base), Repository UI (inherited), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Cache: Disabled due to Reviews > Disable Cache setting
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
docker/.env.exampledocker/docker-compose.caddy.ymldocker/docker-compose.nginx.ymldocker/volumes/proxy/caddy/Caddyfiledocker/volumes/proxy/nginx/supabase-nginx.conf.tpl
|
Hi team, I'll add Caddy and Nginx configs for self-hosted. This will help users deploy easier. Please assign! |
Braintrust eval report
|
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - Add a new how-to guide covering PR #43291 - Explain how to use an https proxy on top of [self-hosted Supabase](https://supabase.com/docs/guides/self-hosting) API gateway (Kong) --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
3 participants
I have read the CONTRIBUTING.md file.
YES
What kind of change does this PR introduce?
.env.example