> ## Documentation Index
> Fetch the complete documentation index at: https://cloud.strettch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Supabase

> Deploy a private Supabase stack featuring Postgres, Auth, Storage, Realtime, and autogenerated APIs, preinstalled on a Strettch Cloud Compute.

<Info>
  **Category:** baas · database · postgres · self-hosted
  **OS:** Ubuntu 24.04 · **Version:** 0.7.0
</Info>

## Overview

Supabase is an open-source Firebase alternative used for Postgres with authentication, storage, realtime subscriptions, and auto-generated APIs, all in one stack.

This image comes with the whole stack installed but switched off, and the gateway closed, so nobody can reach your database before you do. There is nothing to answer during setup, it runs automatically the first time you log in and takes about five minutes since it's starting eleven services.

## What is on this image

Everything below sits on top of a stock Ubuntu 24.04 server.

| Software               | What it does                                                                                   |
| ---------------------- | ---------------------------------------------------------------------------------------------- |
| Supabase               | All eleven services: Postgres, Auth, Storage, Realtime, Studio, the Kong gateway, and the rest |
| Docker and Compose     | Runs the stack                                                                                 |
| `git`, `jq`, `openssl` | Used by the setup and management scripts                                                       |
| `ufw`                  | Firewall, already configured(see Security below)                                               |
| `fail2ban`             | Blocks IPs that keep failing SSH logins                                                        |
| `unattended-upgrades`  | Applies Ubuntu security updates on its own                                                     |
| `sc-console-agent`     | Runs the browser console in the Strettch Cloud dashboard                                       |
| `sc-metrics-agent`     | Sends CPU, memory, and disk metrics to your dashboard                                          |

## 1. Connect

Once your Compute is running, SSH in as root:

```bash theme={null}
ssh root@YOUR_COMPUTE_IP
```

The root password and SSH key are in the Strettch Cloud console. Setup starts automatically when you log in. If you'd rather work from the browser console, run `/opt/sc/supabase/setup.sh` there instead.

Setup generates this Compute's own secrets and API keys, starts the stack, and waits until the database, auth, and Studio are all answering.

## 2. Open Studio

Setup prints your URL, username, and password when it finishes:

```
http://YOUR_COMPUTE_IP:8000
```

If your Compute has a public IP, use that one — you'll find it in the console.

<Warning>
  Copy the password into your password manager immediately. That login is the only thing standing between the internet and your database dashboard.
</Warning>

## 3. Get your API keys

Your `anon` and `service_role` keys, the database password, and the connection strings all come from one command:

```bash theme={null}
cd /root/supabase-project && sh run.sh secrets
```

Point your app at `http://YOUR_COMPUTE_IP:8000` using the `anon` key.

<Warning>
  Keep the `service_role` key on your server only, never in client code. It bypasses row-level security entirely.
</Warning>

## 4. Add a domain and HTTPS

Worth doing early, until you do traffic to Studio and to your APIs travels unencrypted. Point an A record at your Compute's public IP, then run:

```bash theme={null}
cd /root/supabase-project && sh run.sh config add caddy
```

nginx works too, if you prefer it. Supabase documents both approaches at [supabase.com/docs/guides/self-hosting](https://supabase.com/docs/guides/self-hosting).

## Managing it

| Command                                                        | What it does                                                             |
| -------------------------------------------------------------- | ------------------------------------------------------------------------ |
| `/opt/sc/supabase/info.sh`                                     | Prints your Studio URL and login again                                   |
| `/opt/sc/supabase/status.sh`                                   | Shows whether the stack is running, which ports are open, and disk usage |
| `/opt/sc/supabase/debug.sh`                                    | Collects logs for support, with secrets stripped out                     |
| `cd /root/supabase-project && sh run.sh {status,logs,restart}` | Manage individual services                                               |

## Security

The firewall allows SSH, the Supabase gateway, and the Strettch Cloud agent. Everything else coming in is blocked.

`fail2ban` watches SSH, ten failed logins bans an IP for six hours, with longer bans for repeat offenders, up to a week.

```bash theme={null}
fail2ban-client status sshd
ufw status
```

<Note>
  Postgres access depends on how the Supabase stack's Docker ports are configured.
  Verify your own exposure with `nc -zv YOUR_COMPUTE_IP 5432` from an external
  machine since Docker's own port publishing can bypass `ufw` rules even when
  `ufw status` shows the port as blocked.
</Note>

If setup is interrupted partway through, nothing is exposed. Log in again and it starts over.