fix(supabase/k3d): disable node affinity, ingress, and TUI clutter

- render_supabase.py: k3d sets scheduling.enforceGeneralNodeRole=false so
  pods don't require knoe.dev/node-role=general label (k3d nodes unlabelled)
- render_supabase.py: disable kong and studio ingress for k3d (port-forwards
  are used instead; avoids db.knoe.org reference that doesn't exist
- deploy.sh: escape double quotes in SQL comment on lines 2114-2115 to fix
  bash prematurely closing the psql -c ... string
- supabase.py: remove broken node-selector text entry (black rectangle in Tk)
  and redundant Deploy button (enable checkbox already triggers deployment)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
EOF
)

knoe/ui/screens/supabase.py

@@ -62,41 +62,7 @@ class SupabaseScreenMixin:
         self._canvas_items.append(enable_window)
         self._overlay_widgets.append(enable_cb)
 
-        node_selector_var = getattr(self, "supabase_pv_node", None)
-        if hasattr(self, "_render_k3s_node_selector") and node_selector_var is not None:
-            y = self._render_k3s_node_selector(
-                y=280,
-                target_var=node_selector_var,
-                title="Node selector:",
-            )
-        else:
-            y = 280
-        if y == 280:
-            node_label = ui.canvas_text(
-                self,
-                48,
-                y,
-                "Node selector:",
-                fill="black",
-                font=("SF Pro Text", 12),
-            )
-            self._canvas_items.append(node_label)
-            node_entry = tk.Entry(
-                self.bg_canvas,
-                textvariable=self.supabase_pv_node,
-                font=("SF Pro Text", 11),
-                width=38,
-                relief="solid",
-                bd=1,
-            )
-            node_entry_window = self.bg_canvas.create_window(
-                190, y - 2, window=node_entry, anchor="nw"
-            )
-            self._canvas_items.append(node_entry_window)
-            self._overlay_widgets.append(node_entry)
-            y += 36
-
-        y += 16
+        y = 296
         initial_status = "Ready" if self.supabase_enabled.get() else "Disabled"
         self._supabase_status_var = tk.StringVar(value=initial_status)
         status_item = ui.canvas_text(
@@ -123,33 +89,6 @@ class SupabaseScreenMixin:
             y=390, title="Deployment Output", width=880, height=310
         )
 
-        y = 720
-
-        # Deploy Supabase Button
-        self._supabase_deploy_button = tk.Button(
-            self.bg_canvas,
-            text="Deploy Supabase",
-            command=self.run_supabase_deploy,
-            bg="#F5F5DC",
-            fg="black",
-            activebackground="#E5E5D5",
-            activeforeground="black",
-            highlightbackground="#F5F5DC",
-            highlightcolor="#F5F5DC",
-            highlightthickness=0,
-            relief="flat",
-            bd=0,
-            cursor="hand2",
-            disabledforeground="#8B8B7A",
-            font=("SF Pro Text", 11),
-            padx=20,
-            pady=10,
-        )
-        btn_window = self.bg_canvas.create_window(
-            48, y, window=self._supabase_deploy_button, anchor="nw"
-        )
-        self._overlay_widgets.append(self._supabase_deploy_button)
-        self._canvas_items.append(btn_window)
 
     def run_supabase_deploy(self):
         if getattr(self, "_supabase_deploying", False):
@@ -160,7 +99,6 @@ class SupabaseScreenMixin:
             return
 
         self._supabase_deploying = True
-        self._supabase_deploy_button.configure(state="disabled")
         self._supabase_status_var.set("Deploying...")
         self._supabase_success = False
         self._supabase_console.clear()
@@ -205,9 +143,6 @@ class SupabaseScreenMixin:
                 self.safe_after(
                     lambda: self._supabase_status_var.set("Failed (Script not found)")
                 )
-                self.safe_after(
-                    lambda: self._supabase_deploy_button.configure(state="normal")
-                )
                 self._supabase_deploying = False
                 return
 
@@ -274,9 +209,6 @@ class SupabaseScreenMixin:
                 self.safe_after(
                     lambda: self._supabase_status_var.set("Failed (Launch error)")
                 )
-                self.safe_after(
-                    lambda: self._supabase_deploy_button.configure(state="normal")
-                )
                 self._supabase_deploying = False
                 return
 
@@ -370,9 +302,6 @@ class SupabaseScreenMixin:
                 )
 
             self._supabase_deploying = False
-            self.safe_after(
-                lambda: self._supabase_deploy_button.configure(state="normal")
-            )
             self.safe_after(self.update_footer)
 
         threading.Thread(target=worker, daemon=True).start()

supabase/deploy.sh

@@ -2111,8 +2111,8 @@ setup_knoe_db_for_supabase() {
     -- supabase-storage runs `SET LOCAL role = 'service_role'` on every request
     -- (and 'authenticated' / 'anon' depending on the JWT). Without these grants
     -- the SET fails with 42501 inside guc.c:call_string_check_hook, which the
-    -- service surfaces as a misleading "new row violates row-level security
-    -- policy" error -- regardless of whether RLS is even involved. Mirrors what
+    -- service surfaces as a misleading \"new row violates row-level security
+    -- policy\" error -- regardless of whether RLS is even involved. Mirrors what
     -- the upstream supabase/postgres image's bootstrap does for `authenticator`.
     GRANT anon, authenticated, service_role TO supabase_storage_admin;
 

supabase/helm/render_supabase.py

@@ -992,7 +992,7 @@ def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) ->
             "s3": {"keyId": garage_s3_key_id, "accessKey": garage_s3_access_key},
         },
         "ingress": {
-            "enabled": True,
+            "enabled": mode != "k3d",
             # In k8s/GKE mode the chart-rendered supabase-kong Ingress kept
             # getting deleted from the cluster minutes after install (helm
             # thought it owned it, something on the cluster kept reaping it).
@@ -1030,7 +1030,7 @@ def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) ->
             #
             # Chart's studio/ingress.yaml is gated on `.Values.studioIngress.enabled`,
             # so `enabled: false` makes the chart no-op it cleanly.
-            "enabled": mode != "k8s",
+            "enabled": mode not in ("k8s", "k3d"),
             "className": "" if mode == "k8s" else studio_ingress_class,
             # Hosts are still tracked here so the standalone kong-ingress
             # generator below can merge them in as additional rules on the
@@ -1093,6 +1093,10 @@ def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) ->
         for pvc_key in ("db", "functions", "snippets", "deno", "imgproxy", "minio", "storage"):
             persistence.setdefault(pvc_key, {})["storageClassName"] = supabase_storage_class
 
+    if mode == "k3d":
+        # k3d nodes have no knoe.dev/node-role label — disable the enforced affinity
+        overlay.setdefault("scheduling", {})["enforceGeneralNodeRole"] = False
+
     if mode == "k3s" and supabase_node_selector:
         deployment = overlay.setdefault("deployment", {})
         for component in (