chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 12:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
03bb7310b4
prole/supabase/helm/knoe-supabase/values.yaml
chrisfu 03bb7310b4 fix(supabase): chart cleanups exposed during live helm upgrade 
Two follow-ups to commit c3fae73 (queue #15) surfaced when applying
the DASHBOARD removal to live `supabase` release on knoe-dev-0:

1. **Delete `templates/test/kong.yaml`.** This was a Helm Test Job that
   validated the Studio dashboard's basic-auth gate. The basic-auth
   plugin was retired in commit 25f1b2e (oauth2-proxy fronting); the
   consumer + credentials in commit c3fae73. The test has nothing
   left to test — it referenced `supabase.secret.dashboard` template
   (gone) and `.Values.secret.dashboard.{secretRef,secretRefKey}`
   (gone), causing `helm template`/`upgrade` to fail. Removing the
   file is the right move; if dashboard auth ever comes back as
   something else, write a fresh test for that.

2. **Add `secret.oauth2proxy` + clarify `deployment.oauth2proxy`
   defaults in values.yaml.** The chart has
   `templates/studio/oauth2proxy-{deployment,service}.yaml` and
   `templates/secrets/oauth2proxy.yaml` (Junie's Phase 2 OIDC adds)
   guarded by `if .Values.deployment.oauth2proxy.enabled`. The guard
   short-circuits when the parent map exists, but if the map itself
   is undefined helm fails with `nil pointer evaluating interface{}.enabled`.

   Added a `secret.oauth2proxy` block (empty defaults) so the secrets
   template guard can evaluate cleanly. `deployment.oauth2proxy.enabled`
   was already `false` in values.yaml; added a comment explaining the
   chart oauth2-proxy templates are vestigial — the deployed
   oauth2-proxy lives in `deploy/gcp/gke/oauth2-proxy-deployment.yaml`,
   in FRONT of supabase-kong (commit 25f1b2e), not as a Kong upstream.

Live state after this commit:
  - `helm upgrade supabase ./supabase/helm/knoe-supabase
     --reset-then-reuse-values` succeeds.
  - revision 3 deployed; configmap field manager = `helm` (sole owner).
  - `kubectl get cm supabase-kong -o yaml | grep DASHBOARD` returns 0
    matches.
  - All Kong env vars on the new pod are clean (no DASHBOARD_*).
  - External smoke tests:
      /onboard.html → 200
      /rest/v1/ no auth → 401
      / (Studio gate) → 302 to Google
      /healthz → 302
      svc.knoe.dev/grafana/login → 200
  - cnpg-grafana panels still populate (PodMonitor migration verified
    earlier in same session: 3 postgres exporter targets up; cluster
    label injection working).

Side-finding handled live: nodes lacked the new
`knoe.dev/node-role=general` label that Junie's chart defaults to in
nodeAffinity. Added the label to all 3 knoe-dev-0 nodes alongside the
legacy `prole.org/node-role=general`. The label rename has been
tracked in CLAUDE.md as a follow-up; this is partial closure for the
app cluster (DB cluster nodes still need the same treatment when next
relevant).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 03:40:14 -07:00

1101 lines
26 KiB
YAML
Raw Blame History

## Supabase Helm Chart Configuration
##
## Supabase is composed of multiple services running together
## to provide a full backend platform. This chart deploys and
## configures the following components:
##
## - Kong (API Gateway)
## - Studio (Admin UI)
## - Postgres (Database)
## - PostgREST (REST API)
## - Realtime (WebSocket server)
## - Storage API
## - Postgres Meta
## - GoTrue (Authentication)
## - Edge Functions (Deno runtime)
## - Logflare (Analytics)
## - Vector (Logs pipeline)
## - Imgproxy (Image transformation)
## - MinIO (S3-compatible storage)
##
## This chart mirrors the official Supabase
## Docker setup, adapted for Kubernetes.
##
## Reference:
## https://github.com/supabase/supabase/tree/master/docker
##
## Configuration is grouped by domain rather than by component.
## Each section contains per-component blocks where applicable.
##
## 1. secret - All credentials and sensitive values
## 2. deployment - Pod configuration per component
## 3. image - Container image settings per component
## 4. environment - Environment variables per component
## 5. persistence - PVC configuration per component
## 6. service - Kubernetes Service configuration per component
## 7. autoscaling - HPA configuration per component
## 8. ingress - External access configuration
## 9. serviceAccount - ServiceAccount configuration per component
## 10. migration - Optional SQL migration scripts
## 11. bigQuery - Optional BigQuery backend configuration
secret:
## JSON Web Tokens
## Used to sign and validate access tokens across all Supabase services
## Docs: https://supabase.com/docs/guides/self-hosting/docker#generate-and-configure-api-keys
##
jwt:
anonKey: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE"
serviceKey: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q"
secret: "your-super-secret-jwt-token-with-at-least-32-characters-long"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# anonKey: anonKey
# serviceKey: serviceKey
# secret: secret
## PostgreSQL credentials
## Required even when using an external database
##
db:
password: "your-super-secret-and-long-postgres-password"
database: "postgres"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# password: password
# database: database
## Logflare credentials
##
analytics:
publicAccessToken: "your-super-secret-and-long-logflare-key-public"
privateAccessToken: "your-super-secret-and-long-logflare-key-private"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# publicAccessToken: publicAccessToken
# privateAccessToken: privateAccessToken
## SMTP credentials
##
smtp:
username: "fake_mail_user"
password: "fake_mail_password"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# username: username
# password: password
## OpenAI API key — passed to Studio's AI Assist sidebar.
## Optional; if absent, the AI Assist panel renders an error toast but
## the rest of Studio works fine. Replace via secretRef in production.
openai:
apiKey: "key_super_secret"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# apiKey: apiKey
## oauth2-proxy credentials. **Defaults present only to satisfy template
## guards in `templates/studio/oauth2proxy-{deployment,service}.yaml` and
## `templates/secrets/oauth2proxy.yaml`.**
##
## The deployed oauth2-proxy runs OUTSIDE this chart at
## `deploy/gcp/gke/oauth2-proxy-deployment.yaml` (in FRONT of supabase-kong,
## not as a Kong upstream). The chart templates here reflect an alternate
## architecture that was never deployed; gating `deployment.oauth2proxy.enabled`
## off keeps them dormant. If a fresh deploy of THIS chart's oauth2-proxy
## flavour is ever wanted, populate these values + flip enabled true.
oauth2proxy:
secretRef: ""
secretRefKey: {}
clientId: ""
clientSecret: ""
cookieSecret: ""
## S3-compatible credentials
##
s3:
keyId: "625729a08b95bf1b7ff351a663f3a23c"
accessKey: "850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# keyId: keyId
# accessKey: accessKey
## Realtime service
## Docs: https://supabase.com/docs/guides/realtime
##
realtime:
## Used by Supabase Realtime (Phoenix) to sign and encrypt internal data,
## sessions and tokens. Equivalent to Phoenix SECRET_KEY_BASE.
## Generate with: openssl rand -base64 64
secretKeyBase: "UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# secretKeyBase: secretKeyBase
## Meta service
## Docs: https://github.com/supabase/postgres-meta
##
meta:
## Used to encrypt sensitive metadata at rest.
## Generate with: openssl rand -hex 32
cryptoKey: "your-encryption-key-32-chars-min"
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# cryptoKey: cryptoKey
minio:
user: supa-storage
password: secret1234
## Reference to existing secret
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# user: user
# password: password
## oauth2-proxy credentials for Supabase Studio OIDC login.
## Used when deployment.oauth2proxy.enabled=true.
## In production, point secretRef at a pre-existing K8s secret instead of
## storing plaintext values here.
##
oauth2proxy:
clientId: ""
clientSecret: ""
cookieSecret: ""
## Reference to existing secret (skips creating the Secret resource above)
# secretRef: ""
## Map to actual keys inside secretRef if they differ
# secretRefKey:
# clientId: clientId
# clientSecret: clientSecret
# cookieSecret: cookieSecret
scheduling:
enforceGeneralNodeRole: true
deployment:
analytics:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
auth:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
db:
enabled: false
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
functions:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
imgproxy:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
kong:
enabled: false
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
meta:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
minio:
enabled: false
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
realtime:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
rest:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
storage:
enabled: false
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
studio:
enabled: false
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
## oauth2-proxy sits in front of Studio and handles Google Workspace OIDC.
## When enabled, the Kong dashboard route proxies through oauth2proxy instead
## of directly to Studio. Disabled by default; enable in values-gke.yaml.
##
oauth2proxy:
enabled: false
nameOverride: ""
fullnameOverride: ""
image:
repository: quay.io/oauth2-proxy/oauth2-proxy
tag: "v7.7.1"
port: 4180
## Google Workspace domain restriction (--email-domain)
emailDomain: "knoey.com"
## Full redirect URL registered in GCP Console
## e.g. https://db.0.knoe.dev/oauth2/callback
redirectUrl: ""
vector:
enabled: true
replicaCount: 1
nameOverride: ""
fullnameOverride: ""
livenessProbe: {}
readinessProbe: {}
podAnnotations: {}
podSecurityContext:
securityContext: {}
nodeSelector: {}
tolerations: []
affinity: {}
volumeMounts: {}
volumes: {}
resources: {}
## External Kong — shared Kong gateway in kube-system (local kong deployment is disabled)
externalKong:
enabled: true
host: kong-proxy.kube-system.svc.cluster.local
port: 80
externalDatabase:
enabled: false
host: ""
port: 5432
database: postgres
existingSecret: ""
existingSecretPasswordKey: password
ssl: disable
createAliasService: true
aliasServiceName: db
image:
analytics:
repository: supabase/logflare
pullPolicy: IfNotPresent
tag: "1.31.2"
pullSecrets: []
auth:
repository: supabase/gotrue
pullPolicy: IfNotPresent
tag: "v2.186.0"
pullSecrets: []
db:
repository: supabase/postgres
pullPolicy: IfNotPresent
tag: "15.8.1.085"
pullSecrets: []
functions:
repository: supabase/edge-runtime
pullPolicy: IfNotPresent
tag: "v1.70.3"
pullSecrets: []
imgproxy:
repository: darthsim/imgproxy
pullPolicy: IfNotPresent
tag: "v3.30.1"
pullSecrets: []
kong:
repository: kong
pullPolicy: IfNotPresent
tag: "2.8.1"
pullSecrets: []
meta:
repository: supabase/postgres-meta
pullPolicy: IfNotPresent
tag: "v0.95.2"
pullSecrets: []
minio:
repository: cgr.dev/chainguard/minio
pullPolicy: IfNotPresent
tag: "latest"
pullSecrets: []
realtime:
repository: supabase/realtime
pullPolicy: IfNotPresent
tag: "v2.76.5"
pullSecrets: []
rest:
repository: postgrest/postgrest
pullPolicy: IfNotPresent
tag: "v14.5"
pullSecrets: []
storage:
repository: supabase/storage-api
pullPolicy: IfNotPresent
tag: "v1.37.8"
pullSecrets: []
studio:
repository: supabase/studio
pullPolicy: IfNotPresent
tag: "2026.02.16-sha-26c615c"
pullSecrets: []
vector:
repository: timberio/vector
pullPolicy: IfNotPresent
tag: "0.53.0-alpine"
pullSecrets: []
environment:
analytics:
LOGFLARE_NODE_HOST: 127.0.0.1
DB_USERNAME: supabase_admin
DB_DATABASE: _supabase
DB_PORT: 5432
DB_DRIVER: postgresql
DB_SCHEMA: _analytics
POSTGRES_BACKEND_SCHEMA: _analytics
LOGFLARE_SINGLE_TENANT: "true"
LOGFLARE_SUPABASE_MODE: "true"
LOGFLARE_FEATURE_FLAG_OVERRIDE: multibackend=true
auth:
DB_USER: supabase_auth_admin
DB_PORT: 5432
DB_DRIVER: postgres
## SSL mode options: disable, allow, prefer, require, verify-ca, verify-full
DB_SSL: disable
API_EXTERNAL_URL: http://supabase.local
GOTRUE_API_HOST: "0.0.0.0"
GOTRUE_API_PORT: "9999"
GOTRUE_SITE_URL: http://supabase.local
GOTRUE_URI_ALLOW_LIST: "*"
GOTRUE_DISABLE_SIGNUP: "false"
GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
GOTRUE_JWT_ADMIN_ROLES: service_role
GOTRUE_JWT_AUD: authenticated
GOTRUE_JWT_EXP: "3600"
GOTRUE_EXTERNAL_EMAIL_ENABLED: "true"
GOTRUE_MAILER_AUTOCONFIRM: "true"
GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: "false"
# GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED: true
# GOTRUE_SMTP_MAX_FREQUENCY: 1s
GOTRUE_SMTP_ADMIN_EMAIL: "SMTP_ADMIN_MAIL"
GOTRUE_SMTP_HOST: "SMTP_HOST"
GOTRUE_SMTP_PORT: "123"
GOTRUE_EXTERNAL_PHONE_ENABLED: "false"
GOTRUE_SMS_AUTOCONFIRM: "false"
GOTRUE_SMTP_SENDER_NAME: "SMTP_SENDER_NAME"
GOTRUE_MAILER_URLPATHS_INVITE: "/auth/v1/verify"
GOTRUE_MAILER_URLPATHS_CONFIRMATION: "/auth/v1/verify"
GOTRUE_MAILER_URLPATHS_RECOVERY: "/auth/v1/verify"
GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: "/auth/v1/verify"
## Uncomment to enable custom access token hook. Please see: https://supabase.com/docs/guides/auth/auth-hooks
## for full list of hooks and additional details about custom_access_token_hook
# GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED: "true"
# GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI: "pg-functions://postgres/public/custom_access_token_hook"
# GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_SECRETS: "<standard-base64-secret>"
# GOTRUE_HOOK_MFA_VERIFICATION_ATTEMPT_ENABLED: "true"
# GOTRUE_HOOK_MFA_VERIFICATION_ATTEMPT_URI: "pg-functions://postgres/public/mfa_verification_attempt"
# GOTRUE_HOOK_PASSWORD_VERIFICATION_ATTEMPT_ENABLED: "true"
# GOTRUE_HOOK_PASSWORD_VERIFICATION_ATTEMPT_URI: "pg-functions://postgres/public/password_verification_attempt"
# GOTRUE_HOOK_SEND_SMS_ENABLED: "false"
# GOTRUE_HOOK_SEND_SMS_URI: "pg-functions://postgres/public/custom_access_token_hook"
# GOTRUE_HOOK_SEND_SMS_SECRETS: "v1,whsec_VGhpcyBpcyBhbiBleGFtcGxlIG9mIGEgc2hvcnRlciBCYXNlNjQgc3RyaW5n"
# GOTRUE_HOOK_SEND_EMAIL_ENABLED: "false"
# GOTRUE_HOOK_SEND_EMAIL_URI: "http://host.docker.internal:54321/functions/v1/email_sender"
# GOTRUE_HOOK_SEND_EMAIL_SECRETS: "v1,whsec_VGhpcyBpcyBhbiBleGFtcGxlIG9mIGEgc2hvcnRlciBCYXNlNjQgc3RyaW5n"
db:
POSTGRES_HOST: /var/run/postgresql
PGPORT: "5432"
POSTGRES_PORT: "5432"
JWT_EXP: 3600
# POSTGRES_HOST_AUTH_METHOD: md5
## Enable SSL for postgres by specifying paths for mounted certificate key pair
# POSTGRES_SSL_CERT: /path/to/ssl/server.crt
# POSTGRES_SSL_KEY: /path/to/ssl/server.key
functions:
DB_USERNAME: postgres
DB_PORT: 5432
DB_DRIVER: postgresql
## SSL mode options: disable, allow, prefer, require, verify-ca, verify-full
DB_SSL: disable
VERIFY_JWT: false
imgproxy:
IMGPROXY_BIND: ":5001"
IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
IMGPROXY_USE_ETAG: "true"
IMGPROXY_ENABLE_WEBP_DETECTION: "true"
kong:
KONG_DATABASE: "off"
KONG_DECLARATIVE_CONFIG: /usr/local/kong/kong.yml
## https://github.com/supabase/cli/issues/14
KONG_DNS_ORDER: LAST,A,CNAME
# `request-termination` added for the /healthz route defined in
# templates/kong/config.yaml — Kong treats KONG_PLUGINS as an allowlist
# (only listed plugins can be referenced in the declarative config), so
# without this entry the Kong pod crashlooped with
# init_by_lua error: plugin 'request-termination' not enabled
# `response-transformer` added for the /support route, where it injects
# the `Location: mailto:support@knoe.dev` header onto the 302 synthesized
# by request-termination (request-termination alone can't set Location).
KONG_PLUGINS: request-transformer,response-transformer,cors,key-auth,acl,basic-auth,request-termination
KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
KONG_LOG_LEVEL: warn
meta:
DB_USER: supabase_admin
DB_PORT: 5432
DB_DRIVER: postgres
## SSL mode options: disable, allow, prefer, require, verify-ca, verify-full
DB_SSL: disable
PG_META_PORT: "8080"
minio: {}
realtime:
DB_USER: supabase_admin
DB_PORT: 5432
## Set to true to enforce TLS connections to Postgres
DB_SSL: false
PORT: "4000"
FLY_ALLOC_ID: fly123
FLY_APP_NAME: realtime
ENABLE_TAILSCALE: "false"
DB_AFTER_CONNECT_QUERY: "SET search_path TO _realtime"
DB_ENC_KEY: supabaserealtime
ERL_AFLAGS: -proto_dist inet_tcp
DNS_NODES: "''"
RLIMIT_NOFILE: "10000"
APP_NAME: realtime
SEED_SELF_HOST: true
RUN_JANITOR: true
rest:
DB_USER: authenticator
DB_PORT: 5432
DB_DRIVER: postgres
## SSL mode options: disable, allow, prefer, require, verify-ca, verify-full
DB_SSL: disable
PGRST_DB_SCHEMAS: public,storage,graphql_public
PGRST_DB_ANON_ROLE: anon
PGRST_DB_USE_LEGACY_GUCS: false
PGRST_APP_SETTINGS_JWT_EXP: 3600
storage:
DB_USER: supabase_storage_admin
DB_PORT: 5432
DB_DRIVER: postgres
## SSL mode options: disable, allow, prefer, require, verify-ca, verify-full
DB_SSL: disable
REQUEST_ALLOW_X_FORWARDED_PATH: "true"
FILE_SIZE_LIMIT: "52428800"
## Storage backend: rewired to shared Garage S3 (knoe-system)
STORAGE_BACKEND: s3
TENANT_ID: stub
REGION: garage
GLOBAL_S3_BUCKET: supabase-storage
# Set to an explicit private Garage endpoint in split APP/DB cluster deployments.
GLOBAL_S3_ENDPOINT: ""
GLOBAL_S3_PROTOCOL: http
GLOBAL_S3_FORCE_PATH_STYLE: "true"
ENABLE_IMAGE_TRANSFORMATION: "true"
studio:
HOSTNAME: "::"
STUDIO_PORT: "3000"
POSTGRES_PORT: 5432
DEFAULT_ORGANIZATION_NAME: Default Organization
DEFAULT_PROJECT_NAME: Default Project
SUPABASE_PUBLIC_URL: http://supabase.local
NEXT_PUBLIC_ENABLE_LOGS: true
## Set value to bigquery to use Big Query backend for analytics (postgres or bigquery)
NEXT_ANALYTICS_BACKEND_PROVIDER: postgres
vector: {}
persistence:
db:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 5Gi
accessModes:
- ReadWriteOnce
functions:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 1Gi
accessModes:
- ReadWriteOnce
imgproxy:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 1Gi
accessModes:
- ReadWriteOnce
minio:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 1Gi
accessModes:
- ReadWriteOnce
snippets:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 1Gi
accessModes:
- ReadWriteOnce
storage:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 1Gi
accessModes:
- ReadWriteOnce
deno:
enabled: true
storageClassName: ""
# existingClaim: ""
annotations: {}
size: 1Gi
accessModes:
- ReadWriteOnce
service:
analytics:
type: ClusterIP
port: 4000
targetPort: 4000
protocol: TCP
annotations: {}
labels: {}
portName: http
auth:
type: ClusterIP
port: 9999
targetPort: 9999
protocol: TCP
annotations: {}
labels: {}
portName: http
db:
type: ClusterIP
port: 5432
targetPort: 5432
protocol: TCP
annotations: {}
labels: {}
portName: http
functions:
type: ClusterIP
port: 9000
targetPort: 9000
protocol: TCP
annotations: {}
labels: {}
portName: http
imgproxy:
type: ClusterIP
port: 5001
targetPort: 5001
protocol: TCP
annotations: {}
labels: {}
portName: http
kong:
type: ClusterIP
port: 8000
targetPort: 8000
protocol: TCP
annotations: {}
labels: {}
portName: http
meta:
type: ClusterIP
port: 8080
targetPort: 8080
protocol: TCP
annotations: {}
labels: {}
portName: http
minio:
type: ClusterIP
port: 9000
targetPort: 9000
protocol: TCP
annotations: {}
labels: {}
portName: http
realtime:
type: ClusterIP
port: 4000
targetPort: 4000
protocol: TCP
annotations: {}
labels: {}
portName: http
rest:
type: ClusterIP
port: 3000
targetPort: 3000
protocol: TCP
annotations: {}
labels: {}
portName: http
storage:
type: ClusterIP
port: 5000
targetPort: 5000
protocol: TCP
annotations: {}
labels: {}
portName: http
studio:
type: ClusterIP
port: 3000
targetPort: 3000
protocol: TCP
annotations: {}
labels: {}
portName: http
vector:
type: ClusterIP
port: 9001
targetPort: 9001
protocol: TCP
annotations: {}
labels: {}
portName: http
autoscaling:
analytics:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
auth:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
db:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
functions:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
imgproxy:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
kong:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
meta:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
minio:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
realtime:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
rest:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
storage:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
studio:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
vector:
enabled: true
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
ingress:
enabled: true
className: "nginx"
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
# cert-manager.io/cluster-issuer: "letsencrypt-staging"
# kubernetes.io/tls-acme: "true"
tls: []
## Define TLS secret for SSL termination.
## This section can be left blank if using cluster certificate manager.
## Otherwise, setting this in tandem with certificate manager will overwrite the secret name.
# - secretName: example-com-tls
# hosts:
# - example.com
hosts:
- host: supabase.local
paths:
- path: /
pathType: Prefix
serviceAccount:
analytics:
create: true
annotations: {}
name: ""
auth:
create: true
annotations: {}
name: ""
db:
create: true
annotations: {}
name: ""
functions:
create: true
annotations: {}
name: ""
imgproxy:
create: true
annotations: {}
name: ""
kong:
create: true
annotations: {}
name: ""
meta:
create: true
annotations: {}
name: ""
minio:
create: true
annotations: {}
name: ""
realtime:
create: true
annotations: {}
name: ""
rest:
create: true
annotations: {}
name: ""
storage:
create: true
annotations: {}
name: ""
studio:
create: true
annotations: {}
name: ""
vector:
create: true
annotations: {}
name: ""
migration:
# example.sql: |
# \set pguser `echo "$POSTGRES_USER"`
# -- Create schema
# create schema if not exists app;
# alter schema app owner to :pguser;
# -- Create example table
# create table if not exists app.items (
# id serial primary key,
# name text not null
# );
# -- Set table owner
# alter table app.items owner to :pguser;
bigQuery:
enabled: false
projectId: google-project-id
projectNumber: google-project-number
gcloudJson: ""
Reference in New Issue View Git Blame Copy Permalink