Add Supabase - #223
Conversation
WalkthroughAdds a complete Supabase self-hosted development stack including docker-compose orchestration with 13+ services, Kong API gateway routing, PostgreSQL initialization scripts, Deno edge functions, Vector logging pipeline, Elixir pooler configuration, and supporting documentation and environment files. Changes
Sequence Diagram(s)sequenceDiagram
actor Client
participant Kong as Kong<br/>(API Gateway)
participant Main as main/index.ts<br/>(Router)
participant Worker as EdgeRuntime<br/>(Service Worker)
Client->>Kong: HTTP Request
Kong->>Main: Route to main function
alt Non-OPTIONS Request
Main->>Main: Extract JWT from Authorization header
Main->>Main: Verify JWT with JWT_SECRET
alt JWT Invalid
Main->>Client: 403 Forbidden
end
end
Main->>Main: Parse service name from path
Main->>Main: Construct service path:<br/>/home/deno/functions/{service}
Main->>Main: Collect environment variables
Main->>Worker: Create EdgeRuntime worker<br/>(memory, timeout, importMap, env)
alt Worker Creation Success
Main->>Worker: Fetch with request
Worker->>Worker: Process request
Worker->>Main: Response
Main->>Client: Response
else Worker Creation/Fetch Error
Main->>Client: 500 Internal Server Error
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Areas requiring extra attention:
Possibly related PRs
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (17)
🚧 Files skipped from review as they are similar to previous changes (10)
🧰 Additional context used📓 Path-based instructions (3)**/*.{yml,yaml}📄 CodeRabbit inference engine (AGENTS.md)
Files:
{terraform/**/*.tf,docker/**/*.{yml,yaml}}📄 CodeRabbit inference engine (AGENTS.md)
Files:
docker/**/*.{yml,yaml}📄 CodeRabbit inference engine (AGENTS.md)
Files:
🧠 Learnings (1)📚 Learning: 2025-10-13T20:02:07.433ZApplied to files:
🧬 Code graph analysis (1)docker/dev/supabase.yaml (1)
🪛 dotenv-linter (4.0.0)config-example/docker/myhost/.env.supabase[warning] 10-10: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 15-15: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 20-20: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 26-26: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 31-31: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 32-32: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 32-32: [UnorderedKey] The SUPABASE_DASHBOARD_PASSWORD key should go before the SUPABASE_DASHBOARD_USERNAME key (UnorderedKey) [warning] 36-36: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 40-40: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 44-44: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 46-46: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 52-52: [UnorderedKey] The SUPABASE_POSTGRES_DB key should go before the SUPABASE_POSTGRES_HOST key (UnorderedKey) [warning] 56-56: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 63-63: [UnorderedKey] The SUPABASE_POOLER_DEFAULT_POOL_SIZE key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key (UnorderedKey) [warning] 65-65: [UnorderedKey] The SUPABASE_POOLER_MAX_CLIENT_CONN key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key (UnorderedKey) [warning] 70-70: [UnorderedKey] The SUPABASE_POOLER_DB_POOL_SIZE key should go before the SUPABASE_POOLER_DEFAULT_POOL_SIZE key (UnorderedKey) [warning] 72-72: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 77-77: [ValueWithoutQuotes] This value needs to be surrounded in quotes (ValueWithoutQuotes) [warning] 78-78: [UnorderedKey] The SUPABASE_KONG_HTTPS_PORT key should go before the SUPABASE_KONG_HTTP_PORT key (UnorderedKey) [warning] 78-78: [ValueWithoutQuotes] This value needs to be surrounded in quotes (ValueWithoutQuotes) [warning] 80-80: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 87-87: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 94-94: [UnorderedKey] The SUPABASE_ADDITIONAL_REDIRECT_URLS key should go before the SUPABASE_SITE_URL key (UnorderedKey) [warning] 95-95: [UnorderedKey] The SUPABASE_JWT_EXPIRY key should go before the SUPABASE_SITE_URL key (UnorderedKey) [warning] 96-96: [UnorderedKey] The SUPABASE_DISABLE_SIGNUP key should go before the SUPABASE_JWT_EXPIRY key (UnorderedKey) [warning] 97-97: [UnorderedKey] The SUPABASE_API_EXTERNAL_URL key should go before the SUPABASE_DISABLE_SIGNUP key (UnorderedKey) [warning] 100-100: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 101-101: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 102-102: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 103-103: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 103-103: [UnorderedKey] The SUPABASE_MAILER_URLPATHS_EMAIL_CHANGE key should go before the SUPABASE_MAILER_URLPATHS_INVITE key (UnorderedKey) [warning] 107-107: [UnorderedKey] The SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key should go before the SUPABASE_ENABLE_EMAIL_SIGNUP key (UnorderedKey) [warning] 112-112: [UnorderedKey] The SUPABASE_SMTP_PASS key should go before the SUPABASE_SMTP_PORT key (UnorderedKey) [warning] 113-113: [UnorderedKey] The SUPABASE_SMTP_SENDER_NAME key should go before the SUPABASE_SMTP_USER key (UnorderedKey) [warning] 114-114: [UnorderedKey] The SUPABASE_ENABLE_ANONYMOUS_USERS key should go before the SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key (UnorderedKey) [warning] 118-118: [UnorderedKey] The SUPABASE_ENABLE_PHONE_AUTOCONFIRM key should go before the SUPABASE_ENABLE_PHONE_SIGNUP key (UnorderedKey) [warning] 120-120: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 125-125: [ValueWithoutQuotes] This value needs to be surrounded in quotes (ValueWithoutQuotes) [warning] 126-126: [ValueWithoutQuotes] This value needs to be surrounded in quotes (ValueWithoutQuotes) [warning] 134-134: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 136-136: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 143-143: [ExtraBlankLine] Extra blank line detected (ExtraBlankLine) [warning] 154-154: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 155-155: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 155-155: [UnorderedKey] The SUPABASE_LOGFLARE_PRIVATE_ACCESS_TOKEN key should go before the SUPABASE_LOGFLARE_PUBLIC_ACCESS_TOKEN key (UnorderedKey) 🪛 LanguageTooldocs/PRPs/containers/supabase.md[uncategorized] ~11-~11: If this is a compound adjective that modifies the following noun, use a hyphen. (EN_COMPOUND_ADJECTIVE_INTERNAL) [style] ~88-~88: Consider an alternative to strengthen your wording. (IMPROVEMENTS_REFINEMENTS) 🪛 markdownlint-cli2 (0.18.1)docs/PRPs/containers/supabase.md4-4: Bare URL used (MD034, no-bare-urls) 5-5: Bare URL used (MD034, no-bare-urls) 6-6: Bare URL used (MD034, no-bare-urls) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (4)
Tip 📝 Customizable high-level summaries are now available in beta!You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.
Example instruction:
Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (4)
docker/dev/supabase.yaml (2)
11-15: Track TODOs in the backlog.The file contains several TODO items that should be tracked for future implementation. These are important operational concerns that will be needed for production readiness.
Do you want me to open separate issues to track these TODOs?
480-481: Add a comment documenting the Docker socket access requirement.The Vector container requires
label=disableto access the mounted Docker socket at${SUPABASE_DOCKER_SOCKET_LOCATION}:/var/run/docker.sock:ro. This is necessary functionality, but should be documented following the pattern used elsewhere in the codebase. Add a comment similar to the# kics-scan ignore-lineannotations found in other Docker Compose files (kasm.yaml, calibre.yaml, kopia-nas.yaml, kopia-b2.yaml).docker/dev/supabase/logs/vector.yml (1)
57-59: Consider logging parse failures before aborting.The
abortstatements at lines 58 and 82 silently drop log entries that fail to parse. While this prevents noise from Kong startup messages, it makes debugging parsing issues difficult.Consider logging failed parses to a separate stream:
if err != null { + .metadata.parse_error = err + log(.event_message, level: "debug") abort }Also applies to: 81-83
docs/PRPs/containers/supabase.md (1)
11-11: Consider hyphenating compound adjective.The phrase "enterprise-grade open source" should be "enterprise-grade open-source" when used as a compound adjective modifying "tools".
Apply this diff:
-Long description: Supabase is a Postgres development platform built on enterprise-grade open source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search. +Long description: Supabase is a Postgres development platform built on enterprise-grade open-source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
.claude/commands/implement-container-deployment.md(1 hunks).claude/commands/plan-container-deployment.md(2 hunks)docker/Taskfile.docker.yaml(1 hunks)docker/dev/supabase.yaml(1 hunks)docker/dev/supabase/api/kong.yml(1 hunks)docker/dev/supabase/db/_supabase.sql(1 hunks)docker/dev/supabase/db/jwt.sql(1 hunks)docker/dev/supabase/db/logs.sql(1 hunks)docker/dev/supabase/db/pooler.sql(1 hunks)docker/dev/supabase/db/realtime.sql(1 hunks)docker/dev/supabase/db/roles.sql(1 hunks)docker/dev/supabase/db/webhooks.sql(1 hunks)docker/dev/supabase/functions/hello/index.ts(1 hunks)docker/dev/supabase/functions/main/index.ts(1 hunks)docker/dev/supabase/logs/vector.yml(1 hunks)docker/dev/supabase/pooler/pooler.exs(1 hunks)docs/PRPs/containers/supabase.md(1 hunks)scripts/update-example-env.py(1 hunks)
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
All YAML files must be linted and validated
Files:
docker/dev/supabase/api/kong.ymldocker/dev/supabase/logs/vector.ymldocker/Taskfile.docker.yamldocker/dev/supabase.yaml
{terraform/**/*.tf,docker/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (AGENTS.md)
Run KICS security scanning on IaC files (Terraform and Docker Compose)
Files:
docker/dev/supabase/api/kong.ymldocker/dev/supabase/logs/vector.ymldocker/Taskfile.docker.yamldocker/dev/supabase.yaml
docker/**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Define each Docker service in a YAML file within the appropriate category under docker/
Files:
docker/dev/supabase/api/kong.ymldocker/dev/supabase/logs/vector.ymldocker/Taskfile.docker.yamldocker/dev/supabase.yaml
scripts/**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
Python code (e.g., labctl.py) must pass Ruff linting
Files:
scripts/update-example-env.py
🧠 Learnings (1)
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to docker/**/*.{yml,yaml} : Define each Docker service in a YAML file within the appropriate category under docker/
Applied to files:
.claude/commands/plan-container-deployment.mddocker/Taskfile.docker.yamldocker/dev/supabase.yaml.claude/commands/implement-container-deployment.md
🧬 Code graph analysis (1)
.claude/commands/implement-container-deployment.md (1)
docs/web/update-docs.py (1)
process_docker_compose_file(296-338)
🪛 LanguageTool
docs/PRPs/containers/supabase.md
[uncategorized] ~11-~11: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...ment platform built on enterprise-grade open source tools. It provides hosted Postgres data...
(EN_COMPOUND_ADJECTIVE_INTERNAL)
[style] ~88-~88: Consider an alternative to strengthen your wording.
Context: ... with SSL/TLS termination ### Possible Further Improvements 1. Reverse Proxy Integration: Plac...
(IMPROVEMENTS_REFINEMENTS)
.claude/commands/plan-container-deployment.md
[grammar] ~16-~16: The word ‘install’ is not a noun.
Context: ...p located in the git repository (if the install instructions refer to cloning a repo) 2...
(A_INSTALL)
[uncategorized] ~32-~32: Did you mean the formatting language “Markdown” (= proper noun)?
Context: ...a separate yaml file yet, only create a markdown document. If the Compose stack uses add...
(MARKDOWN_NNP)
.claude/commands/implement-container-deployment.md
[grammar] ~17-~17: The verb form ‘contains’ does not seem to match the subject ‘instructions’.
Context: ...ist. - If the installation instructions contains steps to fetch the Compose setup and/or...
(SUBJECT_VERB_AGREEMENT_PLURAL)
[grammar] ~18-~18: Probably a preposition is missing after ‘referenced’.
Context: ...a/container// and look the referenced compose and .env files there. - Use the compo...
(ATD_VERBS_TO_COLLOCATION)
[grammar] ~19-~19: The verb ‘compose’ does not usually follow articles like ‘the’. Check that ‘compose’ is spelled correctly; using ‘compose’ as a noun may be non-standard.
Context: ...d compose and .env files there. - Use the compose and .env files without any changes. -...
(A_INFINITIVE)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/supabase.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: check
- GitHub Check: build
🔇 Additional comments (26)
scripts/update-example-env.py (1)
50-63: LGTM! Clean implementation of optional file output.The conditional logic correctly handles both use cases: writing to a file when specified, or printing to stdout otherwise. The usage message clearly indicates the optional parameter.
.claude/commands/plan-container-deployment.md (1)
12-22: LGTM! Clear prioritization of installation methods.The three-step priority order (git repository → page-based → plain docker) provides clear guidance, and the ABORT condition prevents wasted effort when no container-based installation is available.
docker/Taskfile.docker.yaml (1)
72-76: Good use of environment variables for maintainability.Defining the directory paths and script location as environment variables improves readability and makes future changes easier.
.claude/commands/implement-container-deployment.md (1)
22-22: Excellent addition for container image tag specificity.Using the
get-most-specific-container-tagMCP tool ensures deployments pin to precise versions rather than floating tags, improving reproducibility and reducing unexpected updates.docker/dev/supabase/api/kong.yml (2)
229-268: Good security posture: MCP endpoint blocked by default.The configuration correctly blocks direct access to the MCP endpoint (lines 229-241) and provides a commented template for controlled local access (lines 243-268). The default-deny approach with explicit IP allowlisting is a security best practice.
11-11: Environment variable syntax is correct for Kong's declarative config.The
$VARIABLEsyntax (without curly braces) is correct for Kong's declarative configuration format. The docker-compose entrypoint at line 103 of supabase.yaml performs the variable substitution using shell evaluation before Kong processes the file.Also applies to: 14-14, 30-31
docker/dev/supabase.yaml (2)
459-459: Docker socket mount has security implications.Mounting the Docker socket (
/var/run/docker.sock) at line 459 gives the Vector container access to the Docker daemon, which effectively grants root access to the host system. While this is necessary for Vector to collect logs from other containers, it introduces a security risk.This is acceptable for a development environment but should be carefully reviewed before any production deployment.
24-34: Well-designed health check strategy.The health checks are properly configured across all services with appropriate timeouts, intervals, and retry counts. The health check commands use service-specific methods (HTTP endpoints, database connectivity, etc.) and the dependency conditions ensure proper startup sequencing.
Also applies to: 111-123, 204-219, 246-258, 291-300, 358-367, 416-428, 460-472, 494-507
docker/dev/supabase/logs/vector.yml (1)
202-216: Good workaround: routing db logs through Kong prevents initialization issues.The comment at lines 213-215 clearly explains why db logs must be routed through Kong rather than directly to analytics. This ensures proper service initialization order and prevents broken queries in Studio.
docs/PRPs/containers/supabase.md (2)
76-86: Excellent emphasis on security considerations.The documentation appropriately highlights the critical importance of changing default credentials and provides comprehensive security guidance. The warning is prominently placed and includes specific actionable items.
1-99: Comprehensive and well-structured documentation.The documentation provides a thorough overview of the Supabase deployment, covering installation, configuration, security, and future improvements. The structure is logical and easy to follow.
docker/dev/supabase/db/_supabase.sql (1)
1-3: LGTM: Database creation with environment-derived owner.The script follows the standard pattern used across other initialization scripts in this PR. The
POSTGRES_USERenvironment variable is typically guaranteed by the PostgreSQL Docker image, so the risk of it being unset is minimal.docker/dev/supabase/db/logs.sql (1)
1-6: LGTM: Schema creation with proper ownership.The script correctly switches to the
_supabasedatabase (which must be created first by_supabase.sql) to create and configure the_analyticsschema. The use ofCREATE SCHEMA IF NOT EXISTSmakes the script idempotent, and the ownership assignment follows the same environment-driven pattern as other initialization scripts.docker/dev/supabase/db/realtime.sql (1)
1-4: LGTM! Schema initialization follows the established pattern.The script correctly uses environment-based ownership and idempotent schema creation.
docker/dev/supabase/db/roles.sql (1)
1-8: LGTM! Appropriate for development environment.Using a shared password for all roles simplifies local development setup. The comment correctly warns that production environments require distinct passwords.
docker/dev/supabase/db/pooler.sql (1)
1-6: LGTM! Correct database context switching.The script properly switches to the
_supabasedatabase to create the pooler schema, then returns to the defaultpostgresdatabase. The ownership pattern is consistent with other initialization scripts.docker/dev/supabase/functions/main/index.ts (3)
34-52: LGTM! Proper JWT verification with OPTIONS bypass.The JWT verification correctly bypasses OPTIONS requests for CORS preflight handling and returns appropriate 401 responses for authentication failures.
54-65: LGTM! Service name extraction handles edge cases correctly.The path parsing correctly extracts the service name from the first path segment and validates that it exists before proceeding.
67-93: LGTM! Worker creation and error handling are appropriate.The worker configuration parameters are reasonable, and error handling correctly returns 500 for worker creation or execution failures. Note that
EdgeRuntime.userWorkersis provided by the Supabase edge runtime environment.docker/dev/supabase/db/webhooks.sql (7)
1-9: LGTM! Standard schema and extension initialization.The setup correctly creates the pg_net extension and supabase_functions schema with appropriate grants for development.
10-27: LGTM! Well-structured migration and audit tables.The tables are properly designed with appropriate indexes for tracking function migrations and webhook triggers.
41-65: Verify the intent of checking for the string 'null'.The function checks whether arguments are NULL or the literal string
'null'(e.g., line 41, 45, 49, 55, 61). While checking for NULL is standard, checking for the string'null'is unusual.In PostgreSQL trigger functions,
TG_ARGVcontains text values. If this check is intentional (e.g., to handle cases where someone passes'null'as a string argument), it's defensive. However, if someone legitimately needs to pass'null'as a value (though unlikely for URLs/methods), this would incorrectly treat it as missing.Consider whether the string
'null'checks are necessary, or if NULL checks alone are sufficient:-- Current approach IF url IS NULL OR url = 'null' THEN RAISE EXCEPTION 'url argument is missing'; END IF; -- Simpler alternative (if string 'null' is not a concern) IF url IS NULL THEN RAISE EXCEPTION 'url argument is missing'; END IF;
67-93: LGTM! Proper HTTP request handling for GET and POST methods.The function correctly builds webhook payloads for POST requests with trigger context (OLD/NEW records, operation type, table info) and uses pg_net's http_get/http_post functions appropriately.
95-102: LGTM! Proper audit trail recording.The function correctly stores the webhook trigger details in the hooks table for audit purposes and returns NEW to allow the triggering operation to complete.
104-140: LGTM! Proper role management with cleanup.The admin role is created with appropriate privileges, and the old
supabase_pg_net_adminrole is safely removed by reassigning and dropping owned objects first.
142-208: LGTM! Comprehensive pg_net security configuration.The script properly handles both cases: pg_net already installed (lines 142-162) and pg_net installed later via event trigger (lines 164-202). The security settings (SECURITY DEFINER, restricted search_path, PUBLIC revocation) appropriately protect against SQL injection and privilege escalation.
6b573ec to
c606da6
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.claude/commands/plan-container-deployment.md (1)
32-32: Capitalize "Markdown" as a proper noun.The word "markdown" should be capitalized as "Markdown" when referring to the formatting language.
Apply this diff:
-Do not save the Docker Compose stack as a separate yaml file yet, only create a markdown document. If the Compose stack uses additional configuration files, include them. +Do not save the Docker Compose stack as a separate yaml file yet, only create a Markdown document. If the Compose stack uses additional configuration files, include them.
🧹 Nitpick comments (1)
scripts/update-example-env.py (1)
58-63: Consider adding error handling for file write operations.The file write operation could fail due to permission issues or disk space. While letting exceptions bubble up is acceptable for scripts, catching and providing a user-friendly error message would improve the user experience.
Example enhancement:
if len(sys.argv) == 3: output_file = sys.argv[2] - with open(output_file, 'w') as f: - f.write(output) + try: + with open(output_file, 'w') as f: + f.write(output) + except (IOError, PermissionError) as e: + print(f"Error writing to {output_file}: {e}", file=sys.stderr) + sys.exit(1) else: print(output)
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
.claude/commands/implement-container-deployment.md(1 hunks).claude/commands/plan-container-deployment.md(2 hunks)docker/Taskfile.docker.yaml(1 hunks)docker/dev/supabase.yaml(1 hunks)docker/dev/supabase/api/kong.yml(1 hunks)docker/dev/supabase/db/_supabase.sql(1 hunks)docker/dev/supabase/db/jwt.sql(1 hunks)docker/dev/supabase/db/logs.sql(1 hunks)docker/dev/supabase/db/pooler.sql(1 hunks)docker/dev/supabase/db/realtime.sql(1 hunks)docker/dev/supabase/db/roles.sql(1 hunks)docker/dev/supabase/db/webhooks.sql(1 hunks)docker/dev/supabase/functions/hello/index.ts(1 hunks)docker/dev/supabase/functions/main/index.ts(1 hunks)docker/dev/supabase/logs/vector.yml(1 hunks)docker/dev/supabase/pooler/pooler.exs(1 hunks)docs/PRPs/containers/supabase.md(1 hunks)scripts/update-example-env.py(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (13)
- docker/dev/supabase/db/webhooks.sql
- docker/Taskfile.docker.yaml
- docker/dev/supabase/pooler/pooler.exs
- docker/dev/supabase.yaml
- docker/dev/supabase/db/roles.sql
- docker/dev/supabase/api/kong.yml
- docker/dev/supabase/db/_supabase.sql
- docker/dev/supabase/functions/main/index.ts
- docker/dev/supabase/logs/vector.yml
- docker/dev/supabase/db/realtime.sql
- docker/dev/supabase/db/jwt.sql
- docker/dev/supabase/functions/hello/index.ts
- docker/dev/supabase/db/logs.sql
🧰 Additional context used
📓 Path-based instructions (1)
scripts/**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
Python code (e.g., labctl.py) must pass Ruff linting
Files:
scripts/update-example-env.py
🧠 Learnings (1)
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to docker/**/*.{yml,yaml} : Define each Docker service in a YAML file within the appropriate category under docker/
Applied to files:
.claude/commands/implement-container-deployment.md.claude/commands/plan-container-deployment.md
🧬 Code graph analysis (2)
.claude/commands/implement-container-deployment.md (1)
docs/web/update-docs.py (1)
process_docker_compose_file(296-338)
.claude/commands/plan-container-deployment.md (1)
docs/web/update-docs.py (1)
process_docker_compose_file(296-338)
🪛 LanguageTool
docs/PRPs/containers/supabase.md
[grammar] ~11-~11: Use a hyphen to join words.
Context: ... platform built on enterprise-grade open source tools. It provides hosted Postgre...
(QB_NEW_EN_HYPHEN)
[style] ~88-~88: Consider an alternative to strengthen your wording.
Context: ... with SSL/TLS termination ### Possible Further Improvements 1. Reverse Proxy Integration: Plac...
(IMPROVEMENTS_REFINEMENTS)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/supabase.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check
🔇 Additional comments (8)
docker/dev/supabase/db/pooler.sql (1)
1-6: LGTM!The SQL initialization script follows the standard pattern used in other Supabase database initialization files. The schema creation and ownership assignment are correct and secure.
.claude/commands/plan-container-deployment.md (1)
12-21: LGTM! Good structural improvement.The renamed Part 1 with prioritized deployment source checklist and ABORT condition significantly improves the planning workflow. The priority order (git repo → instructions page → plain Docker) is logical and the early-exit ABORT condition prevents wasted effort.
.claude/commands/implement-container-deployment.md (3)
17-21: LGTM! Git repository handling is well-structured.The instructions for handling git-based installations are clear and logical. The grammar issues from the previous review (subject-verb agreement and missing preposition) have been correctly addressed.
22-22: Excellent addition for reproducible deployments.Using the
get-most-specific-container-tagMCP tool ensures reproducible deployments by selecting specific version tags over generic ones. This improves security and predictability.
30-32: LGTM! Comprehensive validation workflow.The post-generation validation steps provide excellent safety checks: pre-commit for code quality, labctl.py for config validation, and image pull with timeout to verify availability. This catches issues early.
docs/PRPs/containers/supabase.md (3)
19-32: LGTM! Clear and accurate deployment instructions.The Docker Compose setup instructions are well-structured and follow best practices (shallow clone with
--depth 1, proper file organization). The step-by-step commands are accurate and easy to follow.
38-52: LGTM! Comprehensive environment variable documentation.The environment variables are well-organized into logical categories with clear emphasis on security-critical settings that must be changed from defaults. This makes configuration straightforward and secure.
76-87: LGTM! Excellent security guidance.The security considerations section provides comprehensive, actionable guidance with appropriate emphasis on the critical nature of changing defaults. The inclusion of the official warning and specific tool recommendations (Doppler, Infisical) strengthens the documentation.
c606da6 to
d5af13f
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (2)
docs/PRPs/containers/supabase.md (1)
11-11: Fix compound adjective hyphenation."Open source" used as a compound adjective before a noun should be hyphenated as "open-source". This issue was flagged in the previous review and should be corrected.
Apply this diff:
-Long description: Supabase is a Postgres development platform built on enterprise-grade open source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search. +Long description: Supabase is a Postgres development platform built on enterprise-grade open-source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search.docker/dev/supabase/db/jwt.sql (1)
1-5: Add validation for JWT environment variables (Critical — Previously Flagged).This comment duplicates a critical issue raised in the previous review. The script reads
JWT_SECRETandJWT_EXPwithout validating they are set and non-empty. Per the documentation,JWT_SECRETis a critical security setting. If either variable is undefined, the database initializes with empty authentication configuration, causing auth failures throughout the Supabase stack.Add psql-level validation using
\if :{?var}checks, or perform shell-level validation before running psql with a clear error message.\set jwt_secret `echo "$JWT_SECRET"` \set jwt_exp `echo "$JWT_EXP"` -- Validate required variables \if :{?jwt_secret} \else \q \endif \if :{?jwt_exp} \else \q \endif ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret'; ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
🧹 Nitpick comments (1)
docker/dev/supabase/db/webhooks.sql (1)
164-188: Review event trigger logic for DDL CREATE EXTENSION.The event trigger and its handler function look well-constructed with proper defensive checks:
- Line 170-175: DDL command inspection correctly filters for 'pg_net' extension creation.
- Lines 177-185: Replicates the same grants/security setup as the earlier conditional block (142-162), avoiding duplication if pg_net is installed post-initialization.
Minor note: The grants block is duplicated in two places (142-162 and 177-185). Consider extracting as a separate function/procedure to reduce maintenance burden, but current design is acceptable for a one-time initialization.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (21)
.claude/commands/implement-container-deployment.md(1 hunks).claude/commands/plan-container-deployment.md(2 hunks)config-example/docker/myhost/.env(2 hunks)config-example/docker/myhost/.env.supabase(1 hunks)config-example/docker/myhost/services.yaml(1 hunks)docker/Taskfile.docker.yaml(1 hunks)docker/dev/supabase.yaml(1 hunks)docker/dev/supabase/api/kong.yml(1 hunks)docker/dev/supabase/db/_supabase.sql(1 hunks)docker/dev/supabase/db/jwt.sql(1 hunks)docker/dev/supabase/db/logs.sql(1 hunks)docker/dev/supabase/db/pooler.sql(1 hunks)docker/dev/supabase/db/realtime.sql(1 hunks)docker/dev/supabase/db/roles.sql(1 hunks)docker/dev/supabase/db/webhooks.sql(1 hunks)docker/dev/supabase/functions/hello/index.ts(1 hunks)docker/dev/supabase/functions/main/index.ts(1 hunks)docker/dev/supabase/logs/vector.yml(1 hunks)docker/dev/supabase/pooler/pooler.exs(1 hunks)docs/PRPs/containers/supabase.md(1 hunks)scripts/update-example-env.py(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- docker/dev/supabase/logs/vector.yml
- docker/dev/supabase/functions/hello/index.ts
🚧 Files skipped from review as they are similar to previous changes (10)
- docker/dev/supabase/api/kong.yml
- docker/dev/supabase/db/realtime.sql
- scripts/update-example-env.py
- docker/dev/supabase.yaml
- docker/Taskfile.docker.yaml
- docker/dev/supabase/functions/main/index.ts
- docker/dev/supabase/pooler/pooler.exs
- .claude/commands/plan-container-deployment.md
- docker/dev/supabase/db/pooler.sql
- docker/dev/supabase/db/logs.sql
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
All YAML files must be linted and validated
Files:
config-example/docker/myhost/services.yaml
🧠 Learnings (1)
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to docker/**/*.{yml,yaml} : Define each Docker service in a YAML file within the appropriate category under docker/
Applied to files:
.claude/commands/implement-container-deployment.md
🪛 dotenv-linter (4.0.0)
config-example/docker/myhost/.env.supabase
[warning] 8-8: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [UnorderedKey] The SUPABASE_JWT_SECRET key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 10-10: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 10-10: [UnorderedKey] The SUPABASE_ANON_KEY key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 11-11: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [UnorderedKey] The SUPABASE_DASHBOARD_USERNAME key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 13-13: [UnorderedKey] The SUPABASE_DASHBOARD_PASSWORD key should go before the SUPABASE_DASHBOARD_USERNAME key
(UnorderedKey)
[warning] 14-14: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 14-14: [UnorderedKey] The SUPABASE_SECRET_KEY_BASE key should go before the SUPABASE_SERVICE_ROLE_KEY key
(UnorderedKey)
[warning] 15-15: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [UnorderedKey] The SUPABASE_PG_META_CRYPTO_KEY key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 18-18: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 24-24: [UnorderedKey] The SUPABASE_POSTGRES_DB key should go before the SUPABASE_POSTGRES_HOST key
(UnorderedKey)
[warning] 28-28: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 35-35: [UnorderedKey] The SUPABASE_POOLER_DEFAULT_POOL_SIZE key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 37-37: [UnorderedKey] The SUPABASE_POOLER_MAX_CLIENT_CONN key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 42-42: [UnorderedKey] The SUPABASE_POOLER_DB_POOL_SIZE key should go before the SUPABASE_POOLER_DEFAULT_POOL_SIZE key
(UnorderedKey)
[warning] 44-44: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 49-49: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 50-50: [UnorderedKey] The SUPABASE_KONG_HTTPS_PORT key should go before the SUPABASE_KONG_HTTP_PORT key
(UnorderedKey)
[warning] 50-50: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 52-52: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 59-59: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 66-66: [UnorderedKey] The SUPABASE_ADDITIONAL_REDIRECT_URLS key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 67-67: [UnorderedKey] The SUPABASE_JWT_EXPIRY key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 68-68: [UnorderedKey] The SUPABASE_DISABLE_SIGNUP key should go before the SUPABASE_JWT_EXPIRY key
(UnorderedKey)
[warning] 69-69: [UnorderedKey] The SUPABASE_API_EXTERNAL_URL key should go before the SUPABASE_DISABLE_SIGNUP key
(UnorderedKey)
[warning] 72-72: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 73-73: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 74-74: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [UnorderedKey] The SUPABASE_MAILER_URLPATHS_EMAIL_CHANGE key should go before the SUPABASE_MAILER_URLPATHS_INVITE key
(UnorderedKey)
[warning] 79-79: [UnorderedKey] The SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key should go before the SUPABASE_ENABLE_EMAIL_SIGNUP key
(UnorderedKey)
[warning] 84-84: [UnorderedKey] The SUPABASE_SMTP_PASS key should go before the SUPABASE_SMTP_PORT key
(UnorderedKey)
[warning] 85-85: [UnorderedKey] The SUPABASE_SMTP_SENDER_NAME key should go before the SUPABASE_SMTP_USER key
(UnorderedKey)
[warning] 86-86: [UnorderedKey] The SUPABASE_ENABLE_ANONYMOUS_USERS key should go before the SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key
(UnorderedKey)
[warning] 90-90: [UnorderedKey] The SUPABASE_ENABLE_PHONE_AUTOCONFIRM key should go before the SUPABASE_ENABLE_PHONE_SIGNUP key
(UnorderedKey)
[warning] 92-92: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 97-97: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 98-98: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 107-107: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 109-109: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 116-116: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 124-124: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [UnorderedKey] The SUPABASE_LOGFLARE_PRIVATE_ACCESS_TOKEN key should go before the SUPABASE_LOGFLARE_PUBLIC_ACCESS_TOKEN key
(UnorderedKey)
🪛 LanguageTool
docs/PRPs/containers/supabase.md
[uncategorized] ~11-~11: If this is a compound adjective that modifies the following noun, use a hyphen.
Context: ...ment platform built on enterprise-grade open source tools. It provides hosted Postgres data...
(EN_COMPOUND_ADJECTIVE_INTERNAL)
[style] ~88-~88: Consider an alternative to strengthen your wording.
Context: ... with SSL/TLS termination ### Possible Further Improvements 1. Reverse Proxy Integration: Plac...
(IMPROVEMENTS_REFINEMENTS)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/supabase.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check
🔇 Additional comments (7)
config-example/docker/myhost/services.yaml (1)
106-116: LGTM on YAML structure and service configuration.The dev service group changes maintain proper YAML formatting and consistency with existing services. The addition of supabase alongside other dev services is properly indented and structured. No syntax issues detected.
config-example/docker/myhost/.env (1)
105-116: Documentation updates are accurate.The comment header style adjustment and updated Claude/Anthropic API key URL to the current platform.claude.com domain are both appropriate. These are non-functional documentation improvements.
.claude/commands/implement-container-deployment.md (1)
17-22: Clear documentation of git-based install and tag resolution workflows.The new git repository handling and per-container tag resolution instructions are well-articulated and provide practical guidance for container deployments. The grammar issues flagged in the previous review have been corrected.
docker/dev/supabase/db/webhooks.sql (4)
28-102: Verify http_request function payload construction and null handling.The function logic is sound overall, but several details warrant verification:
- Lines 41-47, 45-47: Null/string checks compare against both NULL and the string
'null'. Verify this is the intended behavior (e.g., if shell substitution produces the literal string"null").- Lines 76-82: POST payload construction uses
OLDandNEW, which are only available in AFTER/BEFORE trigger context. Verify this function is always used in that context and not as a called function.- Lines 69-74 & 84-90: The calls to
net.http_get()andnet.http_post()expect return type includingrequest_id, but these are from the pg_net extension. Ensure the function signatures at lines 152-153 and 178-179 (where SECURITY DEFINER is applied) match this usage.No immediate syntax errors detected. If possible, test the function with sample trigger scenarios to confirm correct behavior with NULL and string-literal inputs.
104-124: Role creation and grants are correct.The conditional role creation (lines 107-114), privilege grants (lines 117-119), and ownership transfer (lines 121-123) follow best practices:
- Safe idempotent design using
IF NOT EXISTS.- Appropriate search_path configuration for supabase_functions_admin (line 120).
- Grant to postgres for role inheritance (line 124) is correct.
1-3: Transaction and extension creation are well-structured.The transaction wrapper and defensive extension creation (
IF NOT EXISTS) are correct. The AUTHORIZATION clause on line 5 properly assigns schema ownership.
142-162: I need to verify how PostgreSQL's ALTER FUNCTION handles signatures with default parameters.The ALTER FUNCTION statements are correct as written.
PostgreSQL ALTER FUNCTION only requires parameter definitions (specifically, only the parameter types are needed), not the default clause. ALTER FUNCTION does not pay attention to argument names—only argument data types determine the function's identity. The code correctly specifies the parameter types:
url text, params jsonb, headers jsonb, timeout_milliseconds integer. This matches the pg_net function signatures, and default parameters in the extension functions are irrelevant for ALTER FUNCTION resolution. The function calls (lines 69–90) correctly pass four arguments matching this signature.
5adfcb8 to
c83aecb
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (7)
docker/dev/supabase/db/_supabase.sql (1)
1-3: The environment variable validation issue was previously flagged.As noted in the previous review,
POSTGRES_USERshould be validated before use to prevent initialization failures. This remains unresolved.config-example/docker/myhost/.env.supabase (2)
49-50: Unquoted port values were previously flagged.As noted in the previous review, numeric port values should be quoted for consistent parsing. This remains unresolved.
97-98: Unquoted string values were previously flagged.As noted in the previous review, string values with spaces (organization and project names) should be quoted. This remains unresolved.
docker/dev/supabase/functions/main/index.ts (2)
9-19: Token validation issue was previously flagged.As noted in the previous review, the function should validate that a token exists after splitting the authorization header. An authorization header like
"Bearer "(with trailing space but no actual token) will result in an empty or undefined token value. This remains unresolved.
21-31: JWT_SECRET validation issue was previously flagged.As noted in the previous review, when
VERIFY_JWTis enabled,JWT_SECRETmust be validated at startup to prevent runtime failures. The current code will fail when attempting to encode an undefined secret. This critical issue remains unresolved.docs/PRPs/containers/supabase.md (2)
4-6: Bare URL formatting issue was previously flagged.As noted in the previous review, bare URLs should be wrapped in angle brackets or converted to proper markdown links. This remains unresolved.
11-11: Compound adjective hyphenation issue was previously flagged.As noted in the previous review, "open source" should be hyphenated as "open-source" when used as a compound adjective before "tools". This remains unresolved.
🧹 Nitpick comments (1)
docker/dev/supabase.yaml (1)
1-15: Comprehensive service documentation with actionable TODOs.The header provides excellent context about Supabase and includes well-defined TODO items for production readiness.
Do you want me to help implement any of the TODOs (SMTP configuration, backup strategy, monitoring setup, connection pooler optimization, or custom domain configuration)?
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (17)
-
config-example/docker/myhost/.env(2 hunks) -
config-example/docker/myhost/.env.supabase(1 hunks) -
config-example/docker/myhost/services.yaml(1 hunks) -
docker/dev/supabase.yaml(1 hunks) -
docker/dev/supabase/api/kong.yml(1 hunks) -
docker/dev/supabase/db/_supabase.sql(1 hunks) -
docker/dev/supabase/db/jwt.sql(1 hunks) -
docker/dev/supabase/db/logs.sql(1 hunks) -
docker/dev/supabase/db/pooler.sql(1 hunks) -
docker/dev/supabase/db/realtime.sql(1 hunks) -
docker/dev/supabase/db/roles.sql(1 hunks) -
docker/dev/supabase/db/webhooks.sql(1 hunks) -
docker/dev/supabase/functions/hello/index.ts(1 hunks) -
docker/dev/supabase/functions/main/index.ts(1 hunks) -
docker/dev/supabase/logs/vector.yml(1 hunks) -
docker/dev/supabase/pooler/pooler.exs(1 hunks) -
docs/PRPs/containers/supabase.md(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (11)
- docker/dev/supabase/api/kong.yml
- docker/dev/supabase/db/realtime.sql
- docker/dev/supabase/db/logs.sql
- docker/dev/supabase/db/pooler.sql
- docker/dev/supabase/db/roles.sql
- docker/dev/supabase/functions/hello/index.ts
- docker/dev/supabase/db/jwt.sql
- docker/dev/supabase/db/webhooks.sql
- docker/dev/supabase/logs/vector.yml
- config-example/docker/myhost/services.yaml
- docker/dev/supabase/pooler/pooler.exs
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
All YAML files must be linted and validated
Files:
docker/dev/supabase.yaml
{terraform/**/*.tf,docker/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (AGENTS.md)
Run KICS security scanning on IaC files (Terraform and Docker Compose)
Files:
docker/dev/supabase.yaml
docker/**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Define each Docker service in a YAML file within the appropriate category under docker/
Files:
docker/dev/supabase.yaml
🧠 Learnings (2)
📚 Learning: 2025-10-19T06:28:46.128Z
Learnt from: bubacoder
Repo: bubacoder/infra PR: 213
File: docker/ai/litellm/config.yaml:19-21
Timestamp: 2025-10-19T06:28:46.128Z
Learning: Anthropic rebranded its developer offerings under the Claude brand in mid-September 2025. The official URLs are now: docs.claude.com (Claude Docs), platform.claude.com (Claude Console), and support.claude.com (Claude Help Center). The old console.anthropic.com URL redirects to platform.claude.com after December 16, 2025.
Applied to files:
config-example/docker/myhost/.env
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to docker/**/*.{yml,yaml} : Define each Docker service in a YAML file within the appropriate category under docker/
Applied to files:
docker/dev/supabase.yaml
🧬 Code graph analysis (1)
docker/dev/supabase.yaml (1)
docs/web/update-docs.py (1)
process_docker_compose_file(296-338)
🪛 dotenv-linter (4.0.0)
config-example/docker/myhost/.env.supabase
[warning] 8-8: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [UnorderedKey] The SUPABASE_JWT_SECRET key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 10-10: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 10-10: [UnorderedKey] The SUPABASE_ANON_KEY key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 11-11: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [UnorderedKey] The SUPABASE_DASHBOARD_USERNAME key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 13-13: [UnorderedKey] The SUPABASE_DASHBOARD_PASSWORD key should go before the SUPABASE_DASHBOARD_USERNAME key
(UnorderedKey)
[warning] 14-14: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 14-14: [UnorderedKey] The SUPABASE_SECRET_KEY_BASE key should go before the SUPABASE_SERVICE_ROLE_KEY key
(UnorderedKey)
[warning] 15-15: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [UnorderedKey] The SUPABASE_PG_META_CRYPTO_KEY key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 18-18: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 24-24: [UnorderedKey] The SUPABASE_POSTGRES_DB key should go before the SUPABASE_POSTGRES_HOST key
(UnorderedKey)
[warning] 28-28: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 35-35: [UnorderedKey] The SUPABASE_POOLER_DEFAULT_POOL_SIZE key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 37-37: [UnorderedKey] The SUPABASE_POOLER_MAX_CLIENT_CONN key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 42-42: [UnorderedKey] The SUPABASE_POOLER_DB_POOL_SIZE key should go before the SUPABASE_POOLER_DEFAULT_POOL_SIZE key
(UnorderedKey)
[warning] 44-44: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 49-49: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 50-50: [UnorderedKey] The SUPABASE_KONG_HTTPS_PORT key should go before the SUPABASE_KONG_HTTP_PORT key
(UnorderedKey)
[warning] 50-50: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 52-52: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 59-59: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 66-66: [UnorderedKey] The SUPABASE_ADDITIONAL_REDIRECT_URLS key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 67-67: [UnorderedKey] The SUPABASE_JWT_EXPIRY key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 68-68: [UnorderedKey] The SUPABASE_DISABLE_SIGNUP key should go before the SUPABASE_JWT_EXPIRY key
(UnorderedKey)
[warning] 69-69: [UnorderedKey] The SUPABASE_API_EXTERNAL_URL key should go before the SUPABASE_DISABLE_SIGNUP key
(UnorderedKey)
[warning] 72-72: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 73-73: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 74-74: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [UnorderedKey] The SUPABASE_MAILER_URLPATHS_EMAIL_CHANGE key should go before the SUPABASE_MAILER_URLPATHS_INVITE key
(UnorderedKey)
[warning] 79-79: [UnorderedKey] The SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key should go before the SUPABASE_ENABLE_EMAIL_SIGNUP key
(UnorderedKey)
[warning] 84-84: [UnorderedKey] The SUPABASE_SMTP_PASS key should go before the SUPABASE_SMTP_PORT key
(UnorderedKey)
[warning] 85-85: [UnorderedKey] The SUPABASE_SMTP_SENDER_NAME key should go before the SUPABASE_SMTP_USER key
(UnorderedKey)
[warning] 86-86: [UnorderedKey] The SUPABASE_ENABLE_ANONYMOUS_USERS key should go before the SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key
(UnorderedKey)
[warning] 90-90: [UnorderedKey] The SUPABASE_ENABLE_PHONE_AUTOCONFIRM key should go before the SUPABASE_ENABLE_PHONE_SIGNUP key
(UnorderedKey)
[warning] 92-92: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 97-97: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 98-98: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 107-107: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 109-109: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 116-116: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 124-124: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [UnorderedKey] The SUPABASE_LOGFLARE_PRIVATE_ACCESS_TOKEN key should go before the SUPABASE_LOGFLARE_PUBLIC_ACCESS_TOKEN key
(UnorderedKey)
🪛 LanguageTool
docs/PRPs/containers/supabase.md
[grammar] ~11-~11: Use a hyphen to join words.
Context: ... platform built on enterprise-grade open source tools. It provides hosted Postgre...
(QB_NEW_EN_HYPHEN)
[style] ~88-~88: Consider an alternative to strengthen your wording.
Context: ... with SSL/TLS termination ### Possible Further Improvements 1. Reverse Proxy Integration: Plac...
(IMPROVEMENTS_REFINEMENTS)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/supabase.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: check
🔇 Additional comments (9)
config-example/docker/myhost/.env (2)
105-105: LGTM!The header formatting change improves consistency with other single-line comments in the file.
122-122: URL update correctly reflects Claude rebranding.The change from
console.anthropic.comtoplatform.claude.comaligns with Anthropic's rebranding under the Claude brand in mid-September 2025.Based on learnings
config-example/docker/myhost/.env.supabase (1)
1-132: Environment configuration file structure is well-organized.The file provides comprehensive Supabase configuration with clear section headers and inline documentation. The placeholder values appropriately guide users on what needs to be customized.
docker/dev/supabase.yaml (4)
459-459: Docker socket mount is appropriate for Vector logging.The read-only Docker socket mount allows Vector to collect container logs. This is a standard pattern for log aggregation, and the read-only mode limits the security risk.
480-482: Security opt documented with KICS ignore marker.The
security_opt: label=disablewithkics-scan ignore-lineindicates this is an intentional configuration decision, likely required for Vector's Docker socket access.
491-492: Verify port mapping conflicts.Port
${SUPABASE_POSTGRES_PORT}is mapped to the supavisor pooler on line 491, which may conflict with direct database access expectations. Ensure documentation clearly explains that database connections should use the pooler ports (5432 for session, 6543 for transaction pooling) rather than connecting directly to the db service.
103-103: <!-- [scratchpad_start]
[task verify_kong_config_templating 2/3]
[observations]
- File confirmed: docker/dev/supabase/api/kong.yml exists (6625 bytes)
- Directory structure: docker/dev/supabase/api/ contains only kong.yml
- First regex search for
\${[A-Z_]+}returned nothing- Need to examine actual file content to see variable format
[analysis]- Empty regex results could mean:
- No env vars in this format in kong.yml
- Variables use different syntax (e.g., ${var}, $var, {{var}})
- Variables are in a separate template file (temp.yml)
- The entrypoint comment suggests temp.yml is the source, not kong.yml directly
[pending]- Read kong.yml content to see variable references
- Search for different variable patterns (
${...}, $ (...), etc.)- Look for temp.yml or understand the templating flow
[actions]- cat docker/dev/supabase/api/kong.yml to inspect content
- Search for various variable patterns in the file
- Check entrypoint behavior: ~/temp.yml → ~/kong.yml
docker/dev/supabase/functions/main/index.ts (1)
33-94: Main request handler logic is well-structured.The handler appropriately performs JWT verification when enabled, extracts service names from the path, and delegates to worker functions with proper error handling.
docs/PRPs/containers/supabase.md (1)
13-99: Comprehensive and well-structured documentation.The documentation provides excellent coverage of deployment, configuration, security considerations, and future improvements. The emphasis on changing default credentials and security best practices is particularly valuable.
c83aecb to
29e5e8e
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (7)
config-example/docker/myhost/.env.supabase (1)
49-50: Resolve unquoted environment variable values (from prior review).This issue was flagged in the previous review and remains unresolved. Port numbers and multi-word values must be quoted to prevent parsing and type-coercion issues.
Apply this diff:
-SUPABASE_KONG_HTTP_PORT=7000 # default: 8000 -SUPABASE_KONG_HTTPS_PORT=7443 # default: 8443 +SUPABASE_KONG_HTTP_PORT="7000" # default: 8000 +SUPABASE_KONG_HTTPS_PORT="7443" # default: 8443-SUPABASE_STUDIO_DEFAULT_ORGANIZATION=Default Organization -SUPABASE_STUDIO_DEFAULT_PROJECT=Default Project +SUPABASE_STUDIO_DEFAULT_ORGANIZATION="Default Organization" +SUPABASE_STUDIO_DEFAULT_PROJECT="Default Project"Also applies to: 97-98
docker/dev/supabase/db/roles.sql (1)
2-8: Validate POSTGRES_PASSWORD environment variable (unresolved from previous review).A previous review flagged that this script reads
POSTGRES_PASSWORDwithout validation. If unset or empty, all five role passwords will be invalid, causing authentication failures across the entire stack.Apply the previously suggested fix:
\set pgpass `echo "$POSTGRES_PASSWORD"` -- Validate pgpass is set \if :{?pgpass} \else \q \endif ALTER USER authenticator WITH PASSWORD :'pgpass'; -- ... (rest unchanged)docs/PRPs/containers/supabase.md (2)
4-6: Use angle brackets or markdown links for URLs (unresolved from previous review).Bare URLs should be wrapped for proper markdown rendering and linting compliance.
Apply this diff:
-Homepage: https://supabase.com -GitHub page: https://github.com/supabase/supabase -Install instructions URL: https://supabase.com/docs/guides/self-hosting/docker +Homepage: <https://supabase.com> +GitHub page: <https://github.com/supabase/supabase> +Install instructions URL: <https://supabase.com/docs/guides/self-hosting/docker>
11-11: Use hyphenated form for compound adjective (unresolved from previous review).When "open source" is used as a compound adjective before a noun, it should be hyphenated.
Apply this diff:
-Long description: Supabase is a Postgres development platform built on enterprise-grade open source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search. +Long description: Supabase is a Postgres development platform built on enterprise-grade open-source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search.docker/dev/supabase/functions/hello/index.ts (1)
7-11: Adjust the response body to a more conventional JSON or text format.The body is currently a JSON string literal (
"Hello from Edge Functions!") while theContent-Typeisapplication/json, which can be surprising for clients expecting either a JSON object or plain text.You can simplify this by returning a JSON object:
-serve(async () => { - return new Response( - `"Hello from Edge Functions!"`, - { headers: { "Content-Type": "application/json" } }, - ) -}) +serve(async () => { + return new Response( + JSON.stringify({ message: "Hello from Edge Functions!" }), + { headers: { "Content-Type": "application/json" } }, + ) +})Alternatively, switch to
text/plainand drop the extra quotes if you just want a plain string.docker/dev/supabase/functions/main/index.ts (2)
9-18: HardengetAuthTokenagainst missing/empty bearer token.If the header is just
"Bearer"or"Bearer ",tokenwill beundefined/empty aftersplit, and you’ll return that intoverifyJWT. It’s safer to validate the token explicitly and give a clear error.const [bearer, token] = authHeader.split(' ') - if (bearer !== 'Bearer') { + if (bearer !== 'Bearer') { throw new Error(`Auth header is not 'Bearer {token}'`) } - return token + if (!token || token.trim().length === 0) { + throw new Error('Missing token in authorization header') + } + return tokenYou may also want to make the bearer check case-insensitive if you expect mixed casing from clients.
6-8: ValidateJWT_SECRETwhen JWT verification is enabled.When
VERIFY_JWTistruebutJWT_SECRETis unset, you still construct a key from it and attempt verification. This silently verifies against an unintended secret, which makes misconfiguration harder to detect.Fail fast when verification is enabled but the secret is missing:
const JWT_SECRET = Deno.env.get('JWT_SECRET') const VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true' + +if (VERIFY_JWT && !JWT_SECRET) { + throw new Error('JWT_SECRET environment variable is required when VERIFY_JWT is enabled') +}Optionally, you could also guard inside
verifyJWTand returnfalseor throw ifJWT_SECRETis somehow undefined at that point.Also applies to: 21-30
🧹 Nitpick comments (1)
docker/dev/supabase/db/webhooks.sql (1)
142-162: Code duplication between conditional pg_net setup and event trigger.Lines 142–162 contain the same GRANT/ALTER statements that are repeated verbatim in the event trigger (lines 178–185). While not a functional bug, this duplication increases maintenance burden and risk of drift. Consider extracting the shared logic.
Extract the repeated grants and alterations into a separate function that both the conditional block and event trigger can call:
CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access_impl() RETURNS void LANGUAGE plpgsql AS $$ BEGIN GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role; -- ... (shared statements from lines 151–159) END; $$; -- Then in conditional block (lines 142–162): DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net') THEN PERFORM extensions.grant_pg_net_access_impl(); END IF; END $$; -- And in event trigger (lines 164–202): CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access() RETURNS event_trigger LANGUAGE plpgsql AS $$ BEGIN IF EXISTS (...) THEN PERFORM extensions.grant_pg_net_access_impl(); END IF; END $$;Also applies to: 164-202
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (17)
config-example/docker/myhost/.env(2 hunks)config-example/docker/myhost/.env.supabase(1 hunks)config-example/docker/myhost/services.yaml(1 hunks)docker/dev/supabase.yaml(1 hunks)docker/dev/supabase/api/kong.yml(1 hunks)docker/dev/supabase/db/_supabase.sql(1 hunks)docker/dev/supabase/db/jwt.sql(1 hunks)docker/dev/supabase/db/logs.sql(1 hunks)docker/dev/supabase/db/pooler.sql(1 hunks)docker/dev/supabase/db/realtime.sql(1 hunks)docker/dev/supabase/db/roles.sql(1 hunks)docker/dev/supabase/db/webhooks.sql(1 hunks)docker/dev/supabase/functions/hello/index.ts(1 hunks)docker/dev/supabase/functions/main/index.ts(1 hunks)docker/dev/supabase/logs/vector.yml(1 hunks)docker/dev/supabase/pooler/pooler.exs(1 hunks)docs/PRPs/containers/supabase.md(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (10)
- docker/dev/supabase/db/realtime.sql
- config-example/docker/myhost/services.yaml
- docker/dev/supabase/db/_supabase.sql
- config-example/docker/myhost/.env
- docker/dev/supabase/logs/vector.yml
- docker/dev/supabase/api/kong.yml
- docker/dev/supabase/pooler/pooler.exs
- docker/dev/supabase.yaml
- docker/dev/supabase/db/jwt.sql
- docker/dev/supabase/db/pooler.sql
🧰 Additional context used
🪛 dotenv-linter (4.0.0)
config-example/docker/myhost/.env.supabase
[warning] 8-8: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [UnorderedKey] The SUPABASE_JWT_SECRET key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 10-10: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 10-10: [UnorderedKey] The SUPABASE_ANON_KEY key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 11-11: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [UnorderedKey] The SUPABASE_DASHBOARD_USERNAME key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 13-13: [UnorderedKey] The SUPABASE_DASHBOARD_PASSWORD key should go before the SUPABASE_DASHBOARD_USERNAME key
(UnorderedKey)
[warning] 14-14: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 14-14: [UnorderedKey] The SUPABASE_SECRET_KEY_BASE key should go before the SUPABASE_SERVICE_ROLE_KEY key
(UnorderedKey)
[warning] 15-15: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [UnorderedKey] The SUPABASE_PG_META_CRYPTO_KEY key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 18-18: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 24-24: [UnorderedKey] The SUPABASE_POSTGRES_DB key should go before the SUPABASE_POSTGRES_HOST key
(UnorderedKey)
[warning] 28-28: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 35-35: [UnorderedKey] The SUPABASE_POOLER_DEFAULT_POOL_SIZE key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 37-37: [UnorderedKey] The SUPABASE_POOLER_MAX_CLIENT_CONN key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 42-42: [UnorderedKey] The SUPABASE_POOLER_DB_POOL_SIZE key should go before the SUPABASE_POOLER_DEFAULT_POOL_SIZE key
(UnorderedKey)
[warning] 44-44: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 49-49: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 50-50: [UnorderedKey] The SUPABASE_KONG_HTTPS_PORT key should go before the SUPABASE_KONG_HTTP_PORT key
(UnorderedKey)
[warning] 50-50: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 52-52: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 59-59: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 66-66: [UnorderedKey] The SUPABASE_ADDITIONAL_REDIRECT_URLS key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 67-67: [UnorderedKey] The SUPABASE_JWT_EXPIRY key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 68-68: [UnorderedKey] The SUPABASE_DISABLE_SIGNUP key should go before the SUPABASE_JWT_EXPIRY key
(UnorderedKey)
[warning] 69-69: [UnorderedKey] The SUPABASE_API_EXTERNAL_URL key should go before the SUPABASE_DISABLE_SIGNUP key
(UnorderedKey)
[warning] 72-72: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 73-73: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 74-74: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [UnorderedKey] The SUPABASE_MAILER_URLPATHS_EMAIL_CHANGE key should go before the SUPABASE_MAILER_URLPATHS_INVITE key
(UnorderedKey)
[warning] 79-79: [UnorderedKey] The SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key should go before the SUPABASE_ENABLE_EMAIL_SIGNUP key
(UnorderedKey)
[warning] 84-84: [UnorderedKey] The SUPABASE_SMTP_PASS key should go before the SUPABASE_SMTP_PORT key
(UnorderedKey)
[warning] 85-85: [UnorderedKey] The SUPABASE_SMTP_SENDER_NAME key should go before the SUPABASE_SMTP_USER key
(UnorderedKey)
[warning] 86-86: [UnorderedKey] The SUPABASE_ENABLE_ANONYMOUS_USERS key should go before the SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key
(UnorderedKey)
[warning] 90-90: [UnorderedKey] The SUPABASE_ENABLE_PHONE_AUTOCONFIRM key should go before the SUPABASE_ENABLE_PHONE_SIGNUP key
(UnorderedKey)
[warning] 92-92: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 97-97: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 98-98: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 107-107: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 109-109: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 116-116: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 124-124: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [UnorderedKey] The SUPABASE_LOGFLARE_PRIVATE_ACCESS_TOKEN key should go before the SUPABASE_LOGFLARE_PUBLIC_ACCESS_TOKEN key
(UnorderedKey)
🪛 LanguageTool
docs/PRPs/containers/supabase.md
[grammar] ~11-~11: Use a hyphen to join words.
Context: ... platform built on enterprise-grade open source tools. It provides hosted Postgre...
(QB_NEW_EN_HYPHEN)
[style] ~88-~88: Consider an alternative to strengthen your wording.
Context: ... with SSL/TLS termination ### Possible Further Improvements 1. Reverse Proxy Integration: Plac...
(IMPROVEMENTS_REFINEMENTS)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/supabase.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check
🔇 Additional comments (4)
docker/dev/supabase/db/webhooks.sql (1)
203-207: LGTM – Strong initialization design.The migration tracking, role management, and event-driven pg_net access setup are well-structured. The use of conditionals and idempotent operations ensures the script is safely re-runnable.
docs/PRPs/containers/supabase.md (2)
13-52: LGTM – Clear deployment and configuration guidance.The Docker Compose setup instructions and environment variable documentation are well-organized, comprehensive, and appropriately highlight security-critical variables and their defaults.
53-99: LGTM – Comprehensive architecture and security documentation.The service access points, database connection options, architectural components, security considerations, and future improvements are all well-documented and appropriate for deployment guidance. The security warnings are appropriately prominent.
docker/dev/supabase/functions/main/index.ts (1)
33-94: Main handler flow looks solid for routing and JWT gating.The high-level flow—optional JWT check (skipping OPTIONS), extraction of the first path segment as
service_name, worker creation with env propagation, and consistent JSON error responses (401/400/500)—is clear and cohesive for a dev function host.Once the JWT secret validation and token presence checks are in place, this should behave predictably for both happy path and error conditions.
29e5e8e to
bf3c073
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (6)
config-example/docker/myhost/.env.supabase (1)
49-50: Quote numeric and string environment variable values.Environment variable values for ports and text fields should be quoted to ensure correct parsing and avoid type coercion issues. This was previously flagged and needs correction.
Apply this diff:
-SUPABASE_KONG_HTTP_PORT=7000 # default: 8000 -SUPABASE_KONG_HTTPS_PORT=7443 # default: 8443 +SUPABASE_KONG_HTTP_PORT="7000" # default: 8000 +SUPABASE_KONG_HTTPS_PORT="7443" # default: 8443-SUPABASE_STUDIO_DEFAULT_ORGANIZATION=Default Organization -SUPABASE_STUDIO_DEFAULT_PROJECT=Default Project +SUPABASE_STUDIO_DEFAULT_ORGANIZATION="Default Organization" +SUPABASE_STUDIO_DEFAULT_PROJECT="Default Project"Also applies to: 97-98
docker/dev/supabase/logs/vector.yml (1)
152-152: Fix regex pattern: PANIC should not be optional.The regex pattern on line 152 includes
PANIC?which makes the 'C' optional, matching both "PANIC" and "PANI". This appears to be a typo. PANIC should match exactly.Apply this diff:
- parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true) + parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC):.*', numeric_groups: true)docs/PRPs/containers/supabase.md (2)
4-6: Use markdown link syntax or angle brackets for URLs.Bare URLs in markdown should be wrapped in angle brackets or converted to markdown links for proper rendering and compliance with linting standards. This was flagged in the previous review.
Apply this diff:
-Homepage: https://supabase.com -GitHub page: https://github.com/supabase/supabase -Install instructions URL: https://supabase.com/docs/guides/self-hosting/docker +Homepage: <https://supabase.com> +GitHub page: <https://github.com/supabase/supabase> +Install instructions URL: <https://supabase.com/docs/guides/self-hosting/docker>
11-11: Use hyphenated form for compound adjective.When "open source" is used as a compound adjective before a noun, it should be hyphenated: "open-source tools." This was flagged in the previous review.
Apply this diff:
-Long description: Supabase is a Postgres development platform built on enterprise-grade open source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search. +Long description: Supabase is a Postgres development platform built on enterprise-grade open-source tools. It provides hosted Postgres database, authentication & authorization, auto-generated APIs (REST, GraphQL, and real-time subscriptions), serverless functions, file storage, and AI & vector toolkit for embeddings and semantic search.docker/dev/supabase/db/_supabase.sql (1)
1-3: Add validation for POSTGRES_USER environment variable across SQL initialization scripts.The
_supabase.sql,realtime.sql,pooler.sql, andlogs.sqlfiles all read thePOSTGRES_USERenvironment variable without validation. If unset, psql will attempt to execute with an empty owner name, causing initialization to fail.Apply this validation consistently across all four files:
\set pguser `echo "$POSTGRES_USER"` + +\if :{?pguser} +\else + \echo 'ERROR: POSTGRES_USER environment variable is not set' + \q +\endif CREATE DATABASE _supabase WITH OWNER :pguser;docker/dev/supabase/db/webhooks.sql (1)
61-65: Unresolved: Add error handling for integer cast to prevent runtime exceptions.The integer cast on line 64 remains vulnerable to the issue flagged in the previous review. If
TG_ARGV[4]contains non-numeric text, the cast will raise a runtime error. The null checks on lines 61–62 only validate for NULL and the string literal'null', not numeric validity.Apply this diff to safely handle invalid numeric input:
IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN timeout_ms = 1000; ELSE - timeout_ms = TG_ARGV[4]::integer; + BEGIN + timeout_ms = TG_ARGV[4]::integer; + EXCEPTION WHEN invalid_text_representation THEN + timeout_ms = 1000; -- fallback to default + END; END IF;
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
.pre-commit-config.yaml(2 hunks)config-example/docker/myhost/.env(1 hunks)config-example/docker/myhost/.env.supabase(1 hunks)config-example/docker/myhost/services.yaml(1 hunks)docker/dev/supabase.yaml(1 hunks)docker/dev/supabase/api/kong.yml(1 hunks)docker/dev/supabase/db/_supabase.sql(1 hunks)docker/dev/supabase/db/jwt.sql(1 hunks)docker/dev/supabase/db/logs.sql(1 hunks)docker/dev/supabase/db/pooler.sql(1 hunks)docker/dev/supabase/db/realtime.sql(1 hunks)docker/dev/supabase/db/roles.sql(1 hunks)docker/dev/supabase/db/webhooks.sql(1 hunks)docker/dev/supabase/functions/hello/index.ts(1 hunks)docker/dev/supabase/functions/main/index.ts(1 hunks)docker/dev/supabase/logs/vector.yml(1 hunks)docker/dev/supabase/pooler/pooler.exs(1 hunks)docs/PRPs/containers/supabase.md(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (9)
- docker/dev/supabase/db/logs.sql
- docker/dev/supabase/db/jwt.sql
- config-example/docker/myhost/.env
- docker/dev/supabase/pooler/pooler.exs
- docker/dev/supabase/api/kong.yml
- docker/dev/supabase/functions/main/index.ts
- docker/dev/supabase/functions/hello/index.ts
- docker/dev/supabase/db/roles.sql
- docker/dev/supabase/db/pooler.sql
🧰 Additional context used
📓 Path-based instructions (4)
.pre-commit-config.yaml
📄 CodeRabbit inference engine (AGENTS.md)
Contributors must follow the pre-commit rules defined in .pre-commit-config.yaml
Files:
.pre-commit-config.yaml
**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
All YAML files must be linted and validated
Files:
config-example/docker/myhost/services.yamldocker/dev/supabase.yamldocker/dev/supabase/logs/vector.yml
{terraform/**/*.tf,docker/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (AGENTS.md)
Run KICS security scanning on IaC files (Terraform and Docker Compose)
Files:
docker/dev/supabase.yamldocker/dev/supabase/logs/vector.yml
docker/**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Define each Docker service in a YAML file within the appropriate category under docker/
Files:
docker/dev/supabase.yamldocker/dev/supabase/logs/vector.yml
🧠 Learnings (4)
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to ansible/**/*.{yml,yaml} : Ansible playbooks and roles must pass Ansible linting
Applied to files:
.pre-commit-config.yaml
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to .pre-commit-config.yaml : Contributors must follow the pre-commit rules defined in .pre-commit-config.yaml
Applied to files:
.pre-commit-config.yaml
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to scripts/**/*.py : Python code (e.g., labctl.py) must pass Ruff linting
Applied to files:
.pre-commit-config.yaml
📚 Learning: 2025-10-13T20:02:07.433Z
Learnt from: CR
Repo: bubacoder/infra PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-10-13T20:02:07.433Z
Learning: Applies to docker/**/*.{yml,yaml} : Define each Docker service in a YAML file within the appropriate category under docker/
Applied to files:
docker/dev/supabase.yaml
🧬 Code graph analysis (1)
docker/dev/supabase.yaml (1)
docs/web/update-docs.py (1)
process_docker_compose_file(296-338)
🪛 dotenv-linter (4.0.0)
config-example/docker/myhost/.env.supabase
[warning] 8-8: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 9-9: [UnorderedKey] The SUPABASE_JWT_SECRET key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 10-10: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 10-10: [UnorderedKey] The SUPABASE_ANON_KEY key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 11-11: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 12-12: [UnorderedKey] The SUPABASE_DASHBOARD_USERNAME key should go before the SUPABASE_JWT_SECRET key
(UnorderedKey)
[warning] 13-13: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 13-13: [UnorderedKey] The SUPABASE_DASHBOARD_PASSWORD key should go before the SUPABASE_DASHBOARD_USERNAME key
(UnorderedKey)
[warning] 14-14: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 14-14: [UnorderedKey] The SUPABASE_SECRET_KEY_BASE key should go before the SUPABASE_SERVICE_ROLE_KEY key
(UnorderedKey)
[warning] 15-15: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 16-16: [UnorderedKey] The SUPABASE_PG_META_CRYPTO_KEY key should go before the SUPABASE_POSTGRES_PASSWORD key
(UnorderedKey)
[warning] 18-18: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 24-24: [UnorderedKey] The SUPABASE_POSTGRES_DB key should go before the SUPABASE_POSTGRES_HOST key
(UnorderedKey)
[warning] 28-28: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 35-35: [UnorderedKey] The SUPABASE_POOLER_DEFAULT_POOL_SIZE key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 37-37: [UnorderedKey] The SUPABASE_POOLER_MAX_CLIENT_CONN key should go before the SUPABASE_POOLER_PROXY_PORT_TRANSACTION key
(UnorderedKey)
[warning] 42-42: [UnorderedKey] The SUPABASE_POOLER_DB_POOL_SIZE key should go before the SUPABASE_POOLER_DEFAULT_POOL_SIZE key
(UnorderedKey)
[warning] 44-44: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 49-49: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 50-50: [UnorderedKey] The SUPABASE_KONG_HTTPS_PORT key should go before the SUPABASE_KONG_HTTP_PORT key
(UnorderedKey)
[warning] 50-50: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 52-52: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 59-59: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 66-66: [UnorderedKey] The SUPABASE_ADDITIONAL_REDIRECT_URLS key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 67-67: [UnorderedKey] The SUPABASE_JWT_EXPIRY key should go before the SUPABASE_SITE_URL key
(UnorderedKey)
[warning] 68-68: [UnorderedKey] The SUPABASE_DISABLE_SIGNUP key should go before the SUPABASE_JWT_EXPIRY key
(UnorderedKey)
[warning] 69-69: [UnorderedKey] The SUPABASE_API_EXTERNAL_URL key should go before the SUPABASE_DISABLE_SIGNUP key
(UnorderedKey)
[warning] 72-72: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 73-73: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 74-74: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 75-75: [UnorderedKey] The SUPABASE_MAILER_URLPATHS_EMAIL_CHANGE key should go before the SUPABASE_MAILER_URLPATHS_INVITE key
(UnorderedKey)
[warning] 79-79: [UnorderedKey] The SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key should go before the SUPABASE_ENABLE_EMAIL_SIGNUP key
(UnorderedKey)
[warning] 84-84: [UnorderedKey] The SUPABASE_SMTP_PASS key should go before the SUPABASE_SMTP_PORT key
(UnorderedKey)
[warning] 85-85: [UnorderedKey] The SUPABASE_SMTP_SENDER_NAME key should go before the SUPABASE_SMTP_USER key
(UnorderedKey)
[warning] 86-86: [UnorderedKey] The SUPABASE_ENABLE_ANONYMOUS_USERS key should go before the SUPABASE_ENABLE_EMAIL_AUTOCONFIRM key
(UnorderedKey)
[warning] 90-90: [UnorderedKey] The SUPABASE_ENABLE_PHONE_AUTOCONFIRM key should go before the SUPABASE_ENABLE_PHONE_SIGNUP key
(UnorderedKey)
[warning] 92-92: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 97-97: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 98-98: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
[warning] 107-107: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 109-109: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 116-116: [ExtraBlankLine] Extra blank line detected
(ExtraBlankLine)
[warning] 124-124: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 125-125: [UnorderedKey] The SUPABASE_LOGFLARE_PRIVATE_ACCESS_TOKEN key should go before the SUPABASE_LOGFLARE_PUBLIC_ACCESS_TOKEN key
(UnorderedKey)
🪛 LanguageTool
docs/PRPs/containers/supabase.md
[grammar] ~11-~11: Use a hyphen to join words.
Context: ... platform built on enterprise-grade open source tools. It provides hosted Postgre...
(QB_NEW_EN_HYPHEN)
[style] ~88-~88: Consider an alternative to strengthen your wording.
Context: ... with SSL/TLS termination ### Possible Further Improvements 1. Reverse Proxy Integration: Plac...
(IMPROVEMENTS_REFINEMENTS)
🪛 markdownlint-cli2 (0.18.1)
docs/PRPs/containers/supabase.md
4-4: Bare URL used
(MD034, no-bare-urls)
5-5: Bare URL used
(MD034, no-bare-urls)
6-6: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check
🔇 Additional comments (12)
.pre-commit-config.yaml (1)
91-91: LGTM! Pre-commit version adjustment is documented.The downgrade from ansible-lint v25.11.0 to v25.9.0 is justified by a documented Python compatibility issue. This aligns with maintaining pre-commit hook stability.
docker/dev/supabase/logs/vector.yml (1)
1-3: API endpoint properly configured.The Vector API is correctly enabled on 0.0.0.0:9001 for health checks and metrics collection. Health check path properly referenced in docker/dev/supabase.yaml.
docker/dev/supabase.yaml (4)
77-106: LGTM! Kong service properly configured with template substitution.Kong gateway is correctly configured with declarative config file mounted (kong.yml) and environment variable substitution for authentication credentials. The entrypoint bash template substitution is appropriate for dynamic configuration.
394-451: Verify database initialization scripts include environment validation.The database service mounts multiple initialization scripts (lines 399-413), including realtime.sql, _supabase.sql, and others that read POSTGRES_USER environment variable. Ensure these scripts include validation for unset environment variables to prevent initialization failures.
The health check and environment setup look correct, but the mounted init scripts need validation as flagged in separate reviews of those files.
480-482: LGTM! KICS ignore comment is properly documented.The
kics-scan ignore-linecomment on line 480 for thelabel=disablesecurity option is an acceptable exception for Docker socket mounting (used for Vector log collection). Ensure this is tracked in your security review process.
1-16: Docker structure is compliant; manual KICS security scanning verification required.The Docker service organization is correct—
docker/dev/supabase.yamlproperly defines services in a YAML file within the appropriate category. However, the coding guideline requires KICS security scanning on IaC files (docker/**/*.{yml,yaml}), which cannot be verified in this sandbox environment (KICS tool unavailable). Manual verification of security compliance via KICS is needed before merge.docs/PRPs/containers/supabase.md (1)
13-15: LGTM! Documentation provides clear security and deployment guidance.The security considerations section (lines 76-86) appropriately emphasizes credential changes before production deployment, and the further improvements section identifies key operational areas. Documentation aligns well with the infrastructure additions in this PR.
Also applies to: 38-44
config-example/docker/myhost/services.yaml (1)
113-116: LGTM! Service configuration updates are clean and validated.YAML syntax validation confirms the file is well-formed. The addition of the supabase service to the dev group and state change for jupyter-notebook are properly formatted and align with the Supabase stack introduction.
docker/dev/supabase/db/webhooks.sql (4)
49-59: Similar error-handling concern: JSON casting lacks validation.Lines 52 and 58 cast
TG_ARGV[2]andTG_ARGV[3]tojsonbwithout error handling. Invalid JSON will raise a runtime exception. For consistency and robustness, apply the same exception-handling pattern:IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN headers = '{"Content-Type": "application/json"}'::jsonb; ELSE - headers = TG_ARGV[2]::jsonb; + BEGIN + headers = TG_ARGV[2]::jsonb; + EXCEPTION WHEN invalid_text_representation THEN + headers = '{"Content-Type": "application/json"}'::jsonb; + END; END IF; IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN params = '{}'::jsonb; ELSE - params = TG_ARGV[3]::jsonb; + BEGIN + params = TG_ARGV[3]::jsonb; + EXCEPTION WHEN invalid_text_representation THEN + params = '{}'::jsonb; + END; END IF;
28-102: Approve http_request() trigger function design and implementation.The overall structure, security posture (SECURITY DEFINER), and search_path isolation are sound. The GET/POST branching logic, payload construction, and hooks audit trail are well-executed. Once the cast error handling above is applied, this function will be production-ready.
104-124: Approve role creation and privilege grants.The conditional creation of
supabase_functions_admin, careful grant structure, and search_path defaults are appropriate and well-structured for a Supabase environment.
141-207: Approve event trigger and pg_net access infrastructure.The conditional pg_net grant logic, event trigger for automatic access grants on extension creation, and final SECURITY DEFINER/search_path configuration on the http_request function are well-designed and follow security best practices.
bf3c073 to
4f1500c
Compare
Summary by CodeRabbit
New Features
Documentation
Chores
✏️ Tip: You can customize this high-level summary in your review settings.