selfhost-auth-admin

A self-hosted Auth settings panel for self-hosted Supabase — a free replacement for the platform-only ("paywalled") Authentication configuration tabs of the hosted Supabase dashboard.

Why

On a self-hosted Supabase stack, the Studio dashboard's advanced Authentication config (rate limits, password policy, MFA, sessions, providers, URL config, …) is gated behind NEXT_PUBLIC_IS_PLATFORM, because those screens read/write through Supabase's hosted control-plane API — a SaaS service that isn't part of the open stack. Forcing platform mode on self-host just 404s the whole dashboard.

But every one of those settings is just a GoTrue env var in your project's .env (mapped to GOTRUE_* by docker-compose). This app gives you a real UI over them: read current config → edit → Save writes .env and runs docker compose up -d auth.

No control plane required. No third-party dependencies (Python 3 stdlib only).

What it manages

URL configuration · Signup · Sessions & JWT · Password policy · MFA (TOTP/Phone/WebAuthn) · Rate limits · Security (refresh-token rotation, manual linking, OAuth2 server) · Social providers (Google, Twitch, GitHub — extend SCHEMA for more).

Run

PROJECT_DIR=/path/to/supabase-docker-project python3 app.py
# listens on 127.0.0.1:8799

Put it behind a reverse proxy + auth (this deployment uses Caddy under an existing Cloudflare Access domain at /__auth-admin/). Env:

var	default	meaning
PROJECT_DIR	/home/td/supa/supabase-project	dir containing the supabase .env + compose
HOST	127.0.0.1	bind host
PORT	8799	bind port

Security

This app edits .env and restarts a container, so it must be deployed behind authentication (it has none of its own). Bind to localhost and front it with an authenticating proxy. Secrets are shown in the UI (provider client secrets) — keep access locked down.

How it works

1. read_env() parses the project .env.
2. The browser renders a grouped form (the SCHEMA).
3. Save posts JSON → values are type-validated → update_env() rewrites only the touched keys (comments/order preserved) → docker compose up -d auth applies them.

License

MIT — see LICENSE.