############

# Docker compose override files to layer on top of docker-compose.yml.

# Native docker compose COMPOSE_FILE: colon-separated list, base file first.

# Manage with: ./run.sh config add|remove <name>

#

# Examples:

# COMPOSE_FILE=docker-compose.yml

# COMPOSE_FILE=docker-compose.yml:docker-compose.pg17.yml

#

############

COMPOSE_FILE=docker-compose.yml

############

# Secrets

#

# YOU MUST CHANGE ALL THE DEFAULT VALUES BELOW BEFORE STARTING

# THE CONTAINERS FOR THE FIRST TIME!

#

# Documentation:

# https://supabase.com/docs/guides/self-hosting/docker#configuring-and-securing-supabase

#

# To generate secrets and API keys:

# 1. sh utils/generate-keys.sh

# 2. sh utils/add-new-auth-keys.sh

#

############

# Postgres

POSTGRES_PASSWORD=your-super-secret-and-long-postgres-password

# Legacy symmetric HS256 key

JWT_SECRET=your-super-secret-jwt-token-with-at-least-32-characters-long

# Legacy API keys (HS256-signed JWTs)

ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE

SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q

# Asymmetric key pair (ES256) and opaque API keys

#

# Documentation:

# https://supabase.com/docs/guides/self-hosting/self-hosted-auth-keys

#

# To generate:

# sh ./utils/add-new-auth-keys.sh

#

# Opaque API key for client-side use (anon role).

SUPABASE_PUBLISHABLE_KEY=

# Opaque API key for server-side use (service_role). Never expose in client code.

SUPABASE_SECRET_KEY=

# JSON array of signing JWKs (EC private + legacy symmetric).

# Used by Auth.

JWT_KEYS=

# JWKS for token verification (EC public + legacy symmetric).

# Used by PostgREST, Realtime, Storage to verify tokens.

JWT_JWKS=

# Access to Dashboard

DASHBOARD_USERNAME=supabase

DASHBOARD_PASSWORD=this_password_is_insecure_and_should_be_updated

# Encryption key for securing Realtime and Supavisor communications.

# (Must be at least 64 characters; generate with: openssl rand -base64 48)

SECRET_KEY_BASE=UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq

# Encryption key used by Realtime for sensitive fields in the `_realtime` schema.

# (Must be exactly 16 characters; generate with: `openssl rand -hex 8`)

REALTIME_DB_ENC_KEY=supabaserealtime

# Encryption key used by Supavisor for storing encrypted configuration.

# (Must be exactly 32 characters; generate with: openssl rand -hex 16)

VAULT_ENC_KEY=your-32-character-encryption-key

# Encryption key for securing connection strings used by Studio against postgres-meta.

# (Must be at least 32 characters; generate with openssl rand -base64 24)

PG_META_CRYPTO_KEY=your-encryption-key-32-chars-min

# API token for log ingestion used by Logflare and Vector.

# (Must be at least 32 characters; generate with openssl rand -base64 24)

LOGFLARE_PUBLIC_ACCESS_TOKEN=your-super-secret-and-long-logflare-key-public

# API token used for Logflare management operations. Never expose client-side.

# (Must be at least 32 characters; generate with openssl rand -base64 24)

LOGFLARE_PRIVATE_ACCESS_TOKEN=your-super-secret-and-long-logflare-key-private

# Access key ID (username-like) for accessing the S3 protocol endpoint in Storage.

# (Generate with: openssl rand -hex 16)

S3_PROTOCOL_ACCESS_KEY_ID=625729a08b95bf1b7ff351a663f3a23c

# Secret key (password-like) used with S3_PROTOCOL_ACCESS_KEY_ID.

# (Generate with: openssl rand -hex 32)

S3_PROTOCOL_ACCESS_KEY_SECRET=850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907

############

# URLs - Configure hostnames below to reflect your actual domain name

############

# Access to Dashboard and REST API

SUPABASE_PUBLIC_URL=http://localhost:8000

# Full external URL of the Auth service, used to construct OAuth callbacks,

# SAML endpoints, and email links

API_EXTERNAL_URL=http://localhost:8000/auth/v1

# See also the Auth section below for Site URL and Redirect URLs configuration

############

# Database - Postgres configuration

############

# Using default user (postgres)

POSTGRES_HOST=db

POSTGRES_DB=postgres

# Default configuration includes Supavisor exposing POSTGRES_PORT

# Postgres uses POSTGRES_PORT inside the container

# Documentation:

# https://supabase.com/docs/guides/self-hosting/docker#accessing-postgres-through-supavisor

POSTGRES_PORT=5432

############

# Supavisor - Database pooler

############

# Supavisor exposes POSTGRES_PORT and POOLER_PROXY_PORT_TRANSACTION,

# POSTGRES_PORT is used for session mode pooling

#

# Port to use for transaction mode pooling connections

POOLER_PROXY_PORT_TRANSACTION=6543

# Maximum number of PostgreSQL connections Supavisor opens per pool

POOLER_DEFAULT_POOL_SIZE=20

# Maximum number of client connections Supavisor accepts per pool

POOLER_MAX_CLIENT_CONN=100

# Unique Supavisor tenant identifier

# Documentation:

# https://supabase.com/docs/guides/self-hosting/docker#accessing-postgres

POOLER_TENANT_ID=your-tenant-id

# Pool size for internal metadata storage used by Supavisor

# This is separate from client connections and used only by Supavisor itself

POOLER_DB_POOL_SIZE=5

############

# Studio - Configuration for the Dashboard

############

STUDIO_DEFAULT_ORGANIZATION=Default Organization

STUDIO_DEFAULT_PROJECT=Default Project

# Add your OpenAI API key to enable AI Assistant

OPENAI_API_KEY=sk-proj-xxxxxxxx

############

# Auth - Configuration for the authentication server

############

## General settings

# Equivalent to "Site URL" and "Redirect URLs" platform configuration options

# Documentation: https://supabase.com/docs/guides/auth/redirect-urls

SITE_URL=http://localhost:3000

ADDITIONAL_REDIRECT_URLS=

JWT_EXPIRY=3600

DISABLE_SIGNUP=false

## Mailer Config

MAILER_URLPATHS_CONFIRMATION="/auth/v1/verify"

MAILER_URLPATHS_INVITE="/auth/v1/verify"

MAILER_URLPATHS_RECOVERY="/auth/v1/verify"

MAILER_URLPATHS_EMAIL_CHANGE="/auth/v1/verify"

## Email auth

ENABLE_EMAIL_SIGNUP=true

ENABLE_EMAIL_AUTOCONFIRM=false

SMTP_HOST=supabase-mail

SMTP_PORT=2500

SMTP_USER=fake_mail_user

SMTP_PASS=fake_mail_password

SMTP_SENDER_NAME=fake_sender

ENABLE_ANONYMOUS_USERS=false

## Phone auth

ENABLE_PHONE_SIGNUP=true

ENABLE_PHONE_AUTOCONFIRM=true

## OAuth / Social login providers

# Uncomment and fill in the providers you want to enable.

# You must ALSO uncomment the matching GOTRUE_EXTERNAL_* lines in docker-compose.yml

# Documentation: https://supabase.com/docs/guides/self-hosting/self-hosted-oauth

# GOOGLE_ENABLED=false

# GOOGLE_CLIENT_ID=

# GOOGLE_SECRET=

# GITHUB_ENABLED=false

# GITHUB_CLIENT_ID=

# GITHUB_SECRET=

# AZURE_ENABLED=false

# AZURE_CLIENT_ID=

# AZURE_SECRET=

# Phone / SMS provider configuration

# Uncomment to configure SMS delivery for phone auth and phone MFA.

# You must ALSO uncomment the matching GOTRUE_SMS_* lines in docker-compose.yml

# Documentation: https://supabase.com/docs/guides/self-hosting/self-hosted-phone-mfa

# SMS_PROVIDER=twilio

# SMS_OTP_EXP=60

# SMS_OTP_LENGTH=6

# SMS_MAX_FREQUENCY=60s

# SMS_TEMPLATE=Your code is {{ .Code }}

# SMS_TWILIO_ACCOUNT_SID=

# SMS_TWILIO_AUTH_TOKEN=

# SMS_TWILIO_MESSAGE_SERVICE_SID=

# Test OTP: map phone numbers to fixed OTP codes for development

# Format: phone1:code1,phone2:code2

# SMS_TEST_OTP=

# Multi-factor authentication (MFA)

# Uncomment to change MFA defaults.

# You must ALSO uncomment the matching GOTRUE_MFA_* lines in docker-compose.yml

# App Authenticator (TOTP) - enabled by default

# MFA_TOTP_ENROLL_ENABLED=true

# MFA_TOTP_VERIFY_ENABLED=true

# Phone MFA - disabled by default (opt-in)

# MFA_PHONE_ENROLL_ENABLED=false

# MFA_PHONE_VERIFY_ENABLED=false

# Maximum MFA factors a user can enroll

# MFA_MAX_ENROLLED_FACTORS=10

## SAML SSO

# You must ALSO uncomment the matching GOTRUE_* lines in docker-compose.yml

# Documentation: https://supabase.com/docs/guides/self-hosting/self-hosted-saml-sso

# SAML_ENABLED=true

# SAML_PRIVATE_KEY=<your-base64-encoded-private-key>

# Optional: accept encrypted SAML assertions from IdPs (default: false)

# SAML_ALLOW_ENCRYPTED_ASSERTIONS=false

# Optional: how long relay state tokens remain valid (default: 2m0s)

# SAML_RELAY_STATE_VALIDITY_PERIOD=2m0s

# Optional: override the SAML entity ID / ACS base URL

# Defaults to API_EXTERNAL_URL if not set

# SAML_EXTERNAL_URL=https://supabase.example.com:8000/auth/v1

# Optional: rate limit on the ACS endpoint (requests per second, default: 15)

# SAML_RATE_LIMIT_ASSERTION=15

############

# Storage - Configuration for Storage

############

# Check the S3_PROTOCOL_ACCESS_KEY_ID/SECRET above, and

# refer to the documentation at:

# https://supabase.com/docs/guides/self-hosting/self-hosted-s3

# to learn how to configure the S3 protocol endpoint

# S3 bucket when using S3 backend, directory name when using 'file'

GLOBAL_S3_BUCKET=stub

# Used for S3 protocol endpoint configuration

REGION=stub

# Used by MinIO when added via:

# docker compose -f docker-compose.yml -f docker-compose.s3.yml up -d

MINIO_ROOT_USER=supa-storage

# Root administrator password for the RustFS or MinIO server.

# (Must be 8+ characters; generate with: openssl rand -hex 16)

MINIO_ROOT_PASSWORD=secret1234

# Equivalent to project_ref as described here:

# https://supabase.com/docs/guides/storage/s3/authentication#session-token

STORAGE_TENANT_ID=stub

############

# Functions - Configuration for Edge functions

############

# Documentation:

# https://supabase.com/docs/guides/self-hosting/self-hosted-functions

# NOTE: VERIFY_JWT applies to all functions

FUNCTIONS_VERIFY_JWT=false

############

# API - Configuration for PostgREST

############

# Postgres schemas exposed via the REST API

PGRST_DB_SCHEMAS=public,graphql_public

# Max number of rows returned by a request

PGRST_DB_MAX_ROWS=1000

# Extra schemas added to the search_path of every request

PGRST_DB_EXTRA_SEARCH_PATH=public

############

# Logs and Analytics

############

## Vector log collection and routing

# Docker socket location - required for proper Vector operation

DOCKER_SOCKET_LOCATION=/var/run/docker.sock

# For Podman use the following:

# DOCKER_SOCKET_LOCATION=/run/podman/podman.sock

## Analytics (Logflare)

# Check the LOGFLARE_* access token configuration _above_.

# If Logflare has to be externally exposed - configure securely!

# Google Cloud Project details

# Documentation:

# https://supabase.com/docs/reference/self-hosting-analytics/introduction

GOOGLE_PROJECT_ID=GOOGLE_PROJECT_ID

GOOGLE_PROJECT_NUMBER=GOOGLE_PROJECT_NUMBER

############

# API gateway

############

# Kong configuration variables

KONG_HTTP_PORT=8000

KONG_HTTPS_PORT=8443

# Used internally by the API gateway - DO NOT use in any client or server code.

# Pre-signed ES256 JWT "API key" for anon role.

ANON_KEY_ASYMMETRIC=

# Pre-signed ES256 JWT "API key" for service_role.

SERVICE_ROLE_KEY_ASYMMETRIC=

############

# imgproxy

############

# Enable webp support

IMGPROXY_AUTO_WEBP=true

############

# TLS Proxy - Optional Caddy or Nginx reverse proxy with Let's Encrypt

############

# Documentation:

# https://supabase.com/docs/guides/self-hosting/self-hosted-proxy-https

# Usage:

# docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d

# docker compose -f docker-compose.yml -f docker-compose.nginx.yml up -d

# Domain name for the proxy (must point to your server)

PROXY_DOMAIN=your-domain.example.com

# Email for Let's Encrypt certificate notifications (nginx only, Caddy uses PROXY_DOMAIN).

# This should be a valid email, not a placehoder (otherwise Certbot may fail to start).