Skip to main content
Category: baas · database · postgres · self-hosted OS: Ubuntu 24.04 · Version: 0.7.0

​
Overview

Supabase is an open-source Firebase alternative used for Postgres with authentication, storage, realtime subscriptions, and auto-generated APIs, all in one stack. This image comes with the whole stack installed but switched off, and the gateway closed, so nobody can reach your database before you do. There is nothing to answer during setup, it runs automatically the first time you log in and takes about five minutes since it’s starting eleven services.

​
What is on this image

Everything below sits on top of a stock Ubuntu 24.04 server.

​
1. Connect

Once your Compute is running, SSH in as root:
The root password and SSH key are in the Strettch Cloud console. Setup starts automatically when you log in. If you’d rather work from the browser console, run /opt/sc/supabase/setup.sh there instead. Setup generates this Compute’s own secrets and API keys, starts the stack, and waits until the database, auth, and Studio are all answering.

​
2. Open Studio

Setup prints your URL, username, and password when it finishes:
If your Compute has a public IP, use that one — you’ll find it in the console.
Copy the password into your password manager immediately. That login is the only thing standing between the internet and your database dashboard.

​
3. Get your API keys

Your anon and service_role keys, the database password, and the connection strings all come from one command:
Point your app at http://YOUR_COMPUTE_IP:8000 using the anon key.
Keep the service_role key on your server only, never in client code. It bypasses row-level security entirely.

​
4. Add a domain and HTTPS

Worth doing early, until you do traffic to Studio and to your APIs travels unencrypted. Point an A record at your Compute’s public IP, then run:
nginx works too, if you prefer it. Supabase documents both approaches at supabase.com/docs/guides/self-hosting.

​
Managing it

​
Security

The firewall allows SSH, the Supabase gateway, and the Strettch Cloud agent. Everything else coming in is blocked. fail2ban watches SSH, ten failed logins bans an IP for six hours, with longer bans for repeat offenders, up to a week.
Postgres access depends on how the Supabase stack’s Docker ports are configured. Verify your own exposure with nc -zv YOUR_COMPUTE_IP 5432 from an external machine since Docker’s own port publishing can bypass ufw rules even when ufw status shows the port as blocked.
If setup is interrupted partway through, nothing is exposed. Log in again and it starts over.