Igor K.
d4fedd718f
- Traefik is a first-class ingress controller choice: per-instance Middleware caps uploads at 50 MiB, nginx keeps its proxy-* annotations; picked in setup - Let's Encrypt is optional: off skips the ClusterIssuer and gives each instance a 10-year self-signed certificate instead of a Let's Encrypt one - New port_bind setting: lan (default, LAN IP only), all (LAN + localhost), local (localhost only) - Hostname slots are keyed by the digit in the name (supa4 -> slot 4), so the instance number, ports and hostname stay in step on every machine - The log-retention job installs dblink and its helper into the extensions schema instead of public: in public they break the app's REVOKE ALL ON ALL ROUTINES IN SCHEMA public for the non-superuser postgres role (42501 permission denied for function dblink_connect_u)
85 lines
3.1 KiB
Smarty
85 lines
3.1 KiB
Smarty
# Generic Helm values for one supaspin instance (upstream supabase-kubernetes chart).
|
|
# Every dollar-brace placeholder below (for example the ANON_KEY one) is replaced by supaspin
|
|
# with a quoted string before Helm sees this file.
|
|
# Memory limits, priority class and volume sizes are added by supaspin itself (see
|
|
# instance_values() in the supaspin script) so they stay in one place next to the caps.
|
|
secret:
|
|
jwt:
|
|
anonKey: ${ANON_KEY}
|
|
serviceKey: ${SERVICE_KEY}
|
|
secret: ${JWT_SECRET}
|
|
db:
|
|
password: ${DB_PASSWORD}
|
|
database: postgres
|
|
analytics:
|
|
publicAccessToken: ${LOGFLARE_PUBLIC}
|
|
privateAccessToken: ${LOGFLARE_PRIVATE}
|
|
dashboard:
|
|
username: ${DASHBOARD_USERNAME}
|
|
password: ${DASHBOARD_PASSWORD}
|
|
s3:
|
|
keyId: ${S3_KEY_ID}
|
|
accessKey: ${S3_ACCESS_KEY}
|
|
realtime:
|
|
secretKeyBase: ${REALTIME_SECRET_KEY_BASE}
|
|
dbEncKey: ${REALTIME_DB_ENC_KEY}
|
|
meta:
|
|
cryptoKey: ${META_CRYPTO_KEY}
|
|
smtp:
|
|
username: ${SMTP_USER}
|
|
password: ${SMTP_PASS}
|
|
|
|
deployment:
|
|
analytics:
|
|
enabled: true
|
|
vector:
|
|
enabled: true
|
|
|
|
environment:
|
|
auth:
|
|
- {name: API_EXTERNAL_URL, value: ${PUBLIC_URL}}
|
|
- {name: GOTRUE_API_HOST, value: "0.0.0.0"}
|
|
- {name: GOTRUE_API_PORT, value: "9999"}
|
|
- {name: GOTRUE_SITE_URL, value: ${PUBLIC_URL}}
|
|
- {name: GOTRUE_URI_ALLOW_LIST, value: "*"}
|
|
- {name: GOTRUE_DISABLE_SIGNUP, value: "false"}
|
|
- {name: GOTRUE_JWT_DEFAULT_GROUP_NAME, value: authenticated}
|
|
- {name: GOTRUE_JWT_ADMIN_ROLES, value: service_role}
|
|
- {name: GOTRUE_JWT_AUD, value: authenticated}
|
|
- {name: GOTRUE_JWT_EXP, value: "3600"}
|
|
- {name: GOTRUE_EXTERNAL_EMAIL_ENABLED, value: "true"}
|
|
- {name: GOTRUE_MAILER_AUTOCONFIRM, value: "true"}
|
|
- {name: GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED, value: "false"}
|
|
- {name: GOTRUE_SMTP_ADMIN_EMAIL, value: ${SMTP_ADMIN_EMAIL}}
|
|
- {name: GOTRUE_SMTP_HOST, value: ${SMTP_HOST}}
|
|
- {name: GOTRUE_SMTP_PORT, value: ${SMTP_PORT}}
|
|
- {name: GOTRUE_EXTERNAL_PHONE_ENABLED, value: "false"}
|
|
- {name: GOTRUE_SMS_AUTOCONFIRM, value: "false"}
|
|
- {name: GOTRUE_SMTP_SENDER_NAME, value: ${SMTP_SENDER_NAME}}
|
|
- {name: GOTRUE_MAILER_URLPATHS_INVITE, value: /auth/v1/verify}
|
|
- {name: GOTRUE_MAILER_URLPATHS_CONFIRMATION, value: /auth/v1/verify}
|
|
- {name: GOTRUE_MAILER_URLPATHS_RECOVERY, value: /auth/v1/verify}
|
|
- {name: GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE, value: /auth/v1/verify}
|
|
studio:
|
|
- {name: HOSTNAME, value: "::"}
|
|
- {name: STUDIO_PORT, value: "3000"}
|
|
- {name: DEFAULT_ORGANIZATION_NAME, value: Default Organization}
|
|
- {name: DEFAULT_PROJECT_NAME, value: ${PROJECT_NAME}}
|
|
- {name: SUPABASE_PUBLIC_URL, value: ${PUBLIC_URL}}
|
|
- {name: NEXT_ANALYTICS_BACKEND_PROVIDER, value: postgres}
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: ${INGRESS_CLASS}
|
|
# The annotation map is built in code (ingress_annotations): nginx gets proxy-* and a
|
|
# nulled rewrite-target, Traefik gets its Middleware reference, cert-manager its issuer.
|
|
annotations: ${INGRESS_ANNOTATIONS}
|
|
tls:
|
|
- hosts: [${HOST}]
|
|
secretName: ${TLS_SECRET}
|
|
hosts:
|
|
- host: ${HOST}
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|