prole/deploy/opentofu/k3s/manifests/knoe/supabase-studio.yaml

# supabase-studio.yaml
# Supabase Studio Deployment + Service for k3s (prole homelab).
#
# The upstream knoe-supabase Helm chart includes studio but with:
#   - nodeSelector: knoe.dev/node-role=general  (GKE-only label)
#   - POSTGRES_HOST: GKE pod IP (wrong for k3s)
#   - supabase-snippets PVC reference (not provisioned on k3s)
#
# This manifest is the k3s-compatible version:
#   - No nodeSelector / affinity (schedules freely on gandalf/merlin)
#   - POSTGRES_HOST: knoe-db-rw.knoe-db.svc.cluster.local
#   - Only supabase-functions PVC (supabase-snippets excluded)
#   - SUPABASE_PUBLIC_URL: https://db.prole.org
#
# Supabase Kong routes / → http://supabase-studio:3000/
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-studio
  namespace: supabase
  labels:
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: supabase
---
apiVersion: v1
kind: Service
metadata:
  name: supabase-studio
  namespace: supabase
  labels:
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: supabase
spec:
  type: ClusterIP
  ports:
    - port: 3000
      targetPort: 3000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-studio
    app.kubernetes.io/instance: supabase
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-studio
  namespace: supabase
  labels:
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: supabase
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-studio
      app.kubernetes.io/instance: supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-studio
        app.kubernetes.io/instance: supabase
    spec:
      serviceAccountName: supabase-studio
      containers:
        - name: knoe-supabase-studio
          image: supabase/studio:2026.02.16-sha-26c615c
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 3000
          env:
            - name: DEFAULT_ORGANIZATION_NAME
              value: "Default Organization"
            - name: DEFAULT_PROJECT_NAME
              value: "Default Project"
            - name: HOSTNAME
              value: "::"
            - name: NEXT_ANALYTICS_BACKEND_PROVIDER
              value: postgres
            - name: NEXT_PUBLIC_ENABLE_LOGS
              value: "true"
            - name: STUDIO_PORT
              value: "3000"
            - name: SUPABASE_PUBLIC_URL
              value: "https://db.prole.org"
            - name: SUPABASE_URL
              value: "http://supabase-kong:8000"
            - name: STUDIO_PG_META_URL
              value: "http://supabase-meta:8080"
            - name: POSTGRES_HOST
              value: "knoe-db-rw.knoe-db.svc.cluster.local"
            - name: POSTGRES_PORT
              value: "5432"
            - name: POSTGRES_DB
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: PG_META_CRYPTO_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-meta
                  key: cryptoKey
            - name: OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-dashboard
                  key: openAiApiKey
            - name: SUPABASE_ANON_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: anonKey
            - name: SUPABASE_SERVICE_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: serviceKey
            - name: AUTH_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: LOGFLARE_URL
              value: "http://supabase-analytics:4000"
            - name: LOGFLARE_PUBLIC_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: publicAccessToken
            - name: LOGFLARE_PRIVATE_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: privateAccessToken
            - name: EDGE_FUNCTIONS_MANAGEMENT_FOLDER
              value: "/home/deno/functions"
          volumeMounts:
            - name: functions-storage
              mountPath: /home/deno/functions
      volumes:
        - name: functions-storage
          persistentVolumeClaim:
            claimName: supabase-functions