Storage cannot be used properly through the Docker self host's Supabase

[binganao]

Bug report

• [*] I confirm this is a bug with Supabase, not with my own application.
• [*] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

When I use Docker self-host to access Storage through the dashboard, an error of 500 will be reported. When creating a new bucket, errors will also be generated.

logs

{"level":"error","time":"2023-08-15T14:31:40.129Z","pid":1,"hostname":"2857a247ea18","reqId":"req-5i","tenantId":"stub","project":"stub","error":{"name":"JsonWebTokenError","message":"invalid signature"},"msg":"unable to get owner"}

This seems to be a validation error in JWT, but according to the official documentation configuration and my entry into the storage container to check env, there are no issues

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. docker-compose

# Get the code
git clone --depth 1 https://github.com/supabase/supabase

# Go to the docker folder
cd supabase/docker

# Copy the fake env vars
cp .env.example .env

# Pull the latest images
docker compose pull

2. Configure. env

############
# Secrets
# YOU MUST CHANGE THESE BEFORE GOING INTO PRODUCTION
############

POSTGRES_PASSWORD=24c633f54aef192444a87ff15fc103fe
JWT_SECRET=13c818b24d123a206551d2a858c6f10af2194b8646e284c1a570311fdf4c4a47
ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJyb2xlIjogImFub24iLAogICJpc3MiOiAic3VwYWJhc2UiLAogICJpYXQiOiAxNjkyMDI4ODAwLAogICJleHAiOiAxODQ5ODgxNjAwCn0.3r67Ngur_c0t2VmfP6MPk4kZa-VYj2uvLLigt8dmqHA
SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJyb2xlIjogInNlcnZpY2Vfcm9sZSIsCiAgImlzcyI6ICJzdXBhYmFzZSIsCiAgImlhdCI6IDE2OTIwMjg4MDAsCiAgImV4cCI6IDE4NDk4ODE2MDAKfQ.QA4BsMC6R1WxsIJErF2YHx5f1yqqLwGiXtahph3BUAQ

############
# Database - You can change these to any PostgreSQL database that has logical replication enabled.
############

POSTGRES_HOST=db
POSTGRES_DB=postgres
POSTGRES_PORT=5432
# default user is postgres

############
# API Proxy - Configuration for the Kong Reverse proxy.
############

KONG_HTTP_PORT=8000
KONG_HTTPS_PORT=8443


############
# API - Configuration for PostgREST.
############

PGRST_DB_SCHEMAS=public,storage,graphql_public


############
# Auth - Configuration for the GoTrue authentication server.
############

## General
SITE_URL=http://MY_IPADDR:3000
ADDITIONAL_REDIRECT_URLS=
JWT_EXPIRY=3600
DISABLE_SIGNUP=false
API_EXTERNAL_URL=http://MY_IPADDR:8000

## Mailer Config
MAILER_URLPATHS_CONFIRMATION="/auth/v1/verify"
MAILER_URLPATHS_INVITE="/auth/v1/verify"
MAILER_URLPATHS_RECOVERY="/auth/v1/verify"
MAILER_URLPATHS_EMAIL_CHANGE="/auth/v1/verify"

## Email auth
ENABLE_EMAIL_SIGNUP=true
ENABLE_EMAIL_AUTOCONFIRM=false
SMTP_ADMIN_EMAIL=example@email.com
SMTP_HOST=smtp.example.com
SMTP_PORT=465
SMTP_USER=example@email.com
SMTP_PASS=passwd
SMTP_SENDER_NAME=name

## Phone auth
ENABLE_PHONE_SIGNUP=true
ENABLE_PHONE_AUTOCONFIRM=true


############
# Studio - Configuration for the Dashboard
############

STUDIO_DEFAULT_ORGANIZATION=Default Organization
STUDIO_DEFAULT_PROJECT=Default Project

STUDIO_PORT=3000
# replace if you intend to use Studio outside of localhost
SUPABASE_PUBLIC_URL=http://MY_IPADDR:8000

# Enable webp support
IMGPROXY_ENABLE_WEBP_DETECTION=true

############
# Functions - Configuration for Functions
############
# NOTE: VERIFY_JWT applies to all functions. Per-function VERIFY_JWT is not supported yet.
FUNCTIONS_VERIFY_JWT=true

############
# Logs - Configuration for Logflare
# Please refer to https://supabase.com/docs/reference/self-hosting-analytics/introduction
############

LOGFLARE_LOGGER_BACKEND_API_KEY=446833a77fe1c9a192a3099cbd45760605dd310ff7df0f1c7be8b25e97a8c0bb

# Change vector.toml sinks to reflect this change
LOGFLARE_HTTP_PORT=4001
LOGFLARE_API_KEY=72e6b71901fd2500519625d54fbf15b92e410b1e9f005b6323828e23b7c07558

# Change vector.toml sources.docker_syslog to reflect this change
VECTOR_PORT=9000
VECTOR_API_PORT=9001

# Google Cloud Project details
GOOGLE_PROJECT_ID=GOOGLE_PROJECT_ID
GOOGLE_PROJECT_NUMBER=GOOGLE_PROJECT_NUMBER

3. docker-compose.yml

# Usage
#   Start:          docker compose up
#   With helpers:   docker compose -f docker-compose.yml -f ./dev/docker-compose.dev.yml up
#   Stop:           docker compose down
#   Destroy:        docker compose -f docker-compose.yml -f ./dev/docker-compose.dev.yml down -v --remove-orphans

version: "3.8"

services:

  studio:
    container_name: supabase-studio
    image: supabase/studio:20230803-15c6762
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "require('http').get('http://localhost:3000/api/profile', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"
        ]
      timeout: 5s
      interval: 5s
      retries: 3
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: studio
    depends_on:
      analytics:
        condition: service_healthy
    environment:
      STUDIO_PG_META_URL: http://meta:8080
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

      DEFAULT_ORGANIZATION_NAME: ${STUDIO_DEFAULT_ORGANIZATION}
      DEFAULT_PROJECT_NAME: ${STUDIO_DEFAULT_PROJECT}

      SUPABASE_URL: http://kong:8000
      SUPABASE_PUBLIC_URL: ${SUPABASE_PUBLIC_URL}
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}

      LOGFLARE_API_KEY: ${LOGFLARE_API_KEY}
      LOGFLARE_URL: http://analytics:4000
      NEXT_PUBLIC_ENABLE_LOGS: true
      # Comment to use Big Query backend for analytics
      NEXT_ANALYTICS_BACKEND_PROVIDER: postgres
      # Uncomment to use Big Query backend for analytics
      # NEXT_ANALYTICS_BACKEND_PROVIDER: bigquery

  kong:
    container_name: supabase-kong
    image: kong:2.8.1
    restart: unless-stopped
    # https://unix.stackexchange.com/a/294837
    entrypoint: bash -c 'eval "echo \"$$(cat ~/temp.yml)\"" > ~/kong.yml && /docker-entrypoint.sh kong docker-start'
    ports:
      - ${KONG_HTTP_PORT}:8000/tcp
      - ${KONG_HTTPS_PORT}:8443/tcp
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: kong
    depends_on:
      analytics:
        condition: service_healthy
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
      # https://github.com/supabase/cli/issues/14
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth
      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
    volumes:
      # https://github.com/supabase/supabase/issues/12661
      - ./volumes/api/kong.yml:/home/kong/temp.yml:ro

  auth:
    container_name: supabase-auth
    image: supabase/gotrue:v2.82.4
    depends_on:
      db:
        # Disable this if you are using an external Postgres database
        condition: service_healthy
      analytics:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:9999/health"
        ]
      timeout: 5s
      interval: 5s
      retries: 3
    restart: unless-stopped
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: auth
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_API_PORT: 9999
      API_EXTERNAL_URL: ${API_EXTERNAL_URL}

      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}

      GOTRUE_SITE_URL: ${SITE_URL}
      GOTRUE_URI_ALLOW_LIST: ${ADDITIONAL_REDIRECT_URLS}
      GOTRUE_DISABLE_SIGNUP: ${DISABLE_SIGNUP}

      GOTRUE_JWT_ADMIN_ROLES: service_role
      GOTRUE_JWT_AUD: authenticated
      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
      GOTRUE_JWT_EXP: ${JWT_EXPIRY}
      GOTRUE_JWT_SECRET: ${JWT_SECRET}

      GOTRUE_EXTERNAL_EMAIL_ENABLED: ${ENABLE_EMAIL_SIGNUP}
      GOTRUE_MAILER_AUTOCONFIRM: ${ENABLE_EMAIL_AUTOCONFIRM}
      # GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED: true
      # GOTRUE_SMTP_MAX_FREQUENCY: 1s
      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_ADMIN_EMAIL}
      GOTRUE_SMTP_HOST: ${SMTP_HOST}
      GOTRUE_SMTP_PORT: ${SMTP_PORT}
      GOTRUE_SMTP_USER: ${SMTP_USER}
      GOTRUE_SMTP_PASS: ${SMTP_PASS}
      GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_NAME}
      GOTRUE_MAILER_URLPATHS_INVITE: ${MAILER_URLPATHS_INVITE}
      GOTRUE_MAILER_URLPATHS_CONFIRMATION: ${MAILER_URLPATHS_CONFIRMATION}
      GOTRUE_MAILER_URLPATHS_RECOVERY: ${MAILER_URLPATHS_RECOVERY}
      GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: ${MAILER_URLPATHS_EMAIL_CHANGE}

      GOTRUE_EXTERNAL_PHONE_ENABLED: ${ENABLE_PHONE_SIGNUP}
      GOTRUE_SMS_AUTOCONFIRM: ${ENABLE_PHONE_AUTOCONFIRM}
      MFA_ENABLED: ${MFA_ENABLED}

  rest:
    container_name: supabase-rest
    image: postgrest/postgrest:v11.1.0
    depends_on:
      db:
        # Disable this if you are using an external Postgres database
        condition: service_healthy
      analytics:
        condition: service_healthy
    restart: unless-stopped
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: rest
    environment:
      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      PGRST_DB_SCHEMAS: ${PGRST_DB_SCHEMAS}
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: "false"

  realtime:
    container_name: realtime-dev.supabase-realtime
    image: supabase/realtime:v2.10.1
    depends_on:
      db:
        # Disable this if you are using an external Postgres database
        condition: service_healthy
      analytics:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "bash",
          "-c",
          "printf \\0 > /dev/tcp/localhost/4000"
        ]
      timeout: 5s
      interval: 5s
      retries: 3
    restart: unless-stopped
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: realtime
    environment:
      PORT: 4000
      DB_HOST: ${POSTGRES_HOST}
      DB_PORT: ${POSTGRES_PORT}
      DB_USER: supabase_admin
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_NAME: ${POSTGRES_DB}
      DB_AFTER_CONNECT_QUERY: 'SET search_path TO _realtime'
      DB_ENC_KEY: supabaserealtime
      API_JWT_SECRET: ${JWT_SECRET}
      FLY_ALLOC_ID: fly123
      FLY_APP_NAME: realtime
      SECRET_KEY_BASE: UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq
      ERL_AFLAGS: -proto_dist inet_tcp
      ENABLE_TAILSCALE: "false"
      DNS_NODES: "''"
    command: >
      sh -c "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"

  storage:
    container_name: supabase-storage
    image: supabase/storage-api:v0.40.4
    depends_on:
      db:
        # Disable this if you are using an external Postgres database
        condition: service_healthy
      rest:
        condition: service_started
      imgproxy:
        condition: service_started
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:5000/status"
        ]
      timeout: 5s
      interval: 5s
      retries: 3
    restart: unless-stopped
    environment:
      ANON_KEY: ${ANON_KEY}
      SERVICE_KEY: ${SERVICE_ROLE_KEY}
      POSTGREST_URL: http://rest:3000
      PGRST_JWT_SECRET: ${JWT_SECRET}
      DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      FILE_SIZE_LIMIT: 52428800
      STORAGE_BACKEND: file
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      # TODO: https://github.com/supabase/storage-api/issues/55
      REGION: stub
      GLOBAL_S3_BUCKET: stub
      ENABLE_IMAGE_TRANSFORMATION: "true"
      IMGPROXY_URL: http://imgproxy:5001
    volumes:
      - ./volumes/storage:/var/lib/storage:z

  imgproxy:
    container_name: supabase-imgproxy
    image: darthsim/imgproxy:v3.8.0
    healthcheck:
      test: [ "CMD", "imgproxy", "health" ]
      timeout: 5s
      interval: 5s
      retries: 3
    environment:
      IMGPROXY_BIND: ":5001"
      IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
      IMGPROXY_USE_ETAG: "true"
      IMGPROXY_ENABLE_WEBP_DETECTION: ${IMGPROXY_ENABLE_WEBP_DETECTION}
    volumes:
      - ./volumes/storage:/var/lib/storage:z

  meta:
    container_name: supabase-meta
    image: supabase/postgres-meta:v0.66.3
    depends_on:
      db:
        # Disable this if you are using an external Postgres database
        condition: service_healthy
      analytics:
        condition: service_healthy
    restart: unless-stopped
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: meta
    environment:
      PG_META_PORT: 8080
      PG_META_DB_HOST: ${POSTGRES_HOST}
      PG_META_DB_PORT: ${POSTGRES_PORT}
      PG_META_DB_NAME: ${POSTGRES_DB}
      PG_META_DB_USER: supabase_admin
      PG_META_DB_PASSWORD: ${POSTGRES_PASSWORD}

  functions:
    container_name: supabase-edge-functions
    image: supabase/edge-runtime:v1.8.1
    restart: unless-stopped
    depends_on:
      analytics:
        condition: service_healthy
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: functions
    environment:
      JWT_SECRET: ${JWT_SECRET}
      SUPABASE_URL: http://kong:8000
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
      SUPABASE_DB_URL: postgresql://postgres:${POSTGRES_PASSWORD}@{POSTGRES_DB}:${POSTGRES_PORT}/${POSTGRES_DB}
      # TODO: Allow configuring VERIFY_JWT per function. This PR might help: https://github.com/supabase/cli/pull/786
      VERIFY_JWT: "${FUNCTIONS_VERIFY_JWT}"
    volumes:
      - ./volumes/functions:/home/deno/functions:Z
    command:
      - start
      - --main-service
      - /home/deno/functions/main

  analytics:
    container_name: supabase-analytics
    image: supabase/logflare:1.4.0
    healthcheck:
      test: [ "CMD", "curl", "http://localhost:4000/health" ]
      timeout: 5s
      interval: 5s
      retries: 10
    restart: unless-stopped
    depends_on:
      db:
        # Disable this if you are using an external Postgres database
        condition: service_healthy
    # Uncomment to use Big Query backend for analytics
    # volumes:
    #   - type: bind
    #     source: ${PWD}/gcloud.json
    #     target: /opt/app/rel/logflare/bin/gcloud.json
    #     read_only: true
    environment:
      LOGFLARE_NODE_HOST:  127.0.0.1
      DB_USERNAME: supabase_admin
      DB_DATABASE: ${POSTGRES_DB}
      DB_HOSTNAME: ${POSTGRES_HOST}
      DB_PORT: ${POSTGRES_PORT}
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_SCHEMA: _analytics
      LOGFLARE_API_KEY: ${LOGFLARE_API_KEY}
      LOGFLARE_SINGLE_TENANT: true
      LOGFLARE_SUPABASE_MODE: true
      LOGFLARE_MIN_CLUSTER_SIZE: 1
      RELEASE_COOKIE: cookie

      # Comment variables to use Big Query backend for analytics
      POSTGRES_BACKEND_URL: postgresql://supabase_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      POSTGRES_BACKEND_SCHEMA: _analytics
      LOGFLARE_FEATURE_FLAG_OVERRIDE: multibackend=true

      # Uncomment to use Big Query backend for analytics
      # GOOGLE_PROJECT_ID: ${GOOGLE_PROJECT_ID}
      # GOOGLE_PROJECT_NUMBER: ${GOOGLE_PROJECT_NUMBER}
    entrypoint: |
                  sh -c `cat <<'EOF' > run.sh && sh run.sh
                  ./logflare eval Logflare.Release.migrate
                  ./logflare start --sname logflare
                  EOF
                  `

  # Comment out everything below this point if you are using an external Postgres database
  db:
    container_name: supabase-db
    image: supabase/postgres:15.1.0.103
    healthcheck:
      test: pg_isready -U postgres -h localhost
      interval: 5s
      timeout: 5s
      retries: 10
    depends_on:
      vector:
        condition: service_healthy
    logging:
      driver: syslog
      options:
        syslog-address: "tcp://localhost:${VECTOR_PORT}"
        tag: db
    command:
      - postgres
      - -c
      - config_file=/etc/postgresql/postgresql.conf
      - -c
      - log_min_messages=fatal # prevents Realtime polling queries from appearing in logs
    restart: unless-stopped
    ports:
      # Pass down internal port because it's set dynamically by other services
      - 127.0.0.1:${POSTGRES_PORT}:${POSTGRES_PORT}
    environment:
      POSTGRES_HOST: /var/run/postgresql
      PGPORT: ${POSTGRES_PORT}
      POSTGRES_PORT: ${POSTGRES_PORT}
      PGPASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATABASE: ${POSTGRES_DB}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - ./volumes/db/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:Z
      # Must be superuser to create event trigger
      - ./volumes/db/webhooks.sql:/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql:Z
      # Must be superuser to alter reserved role
      - ./volumes/db/roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:Z
      # PGDATA directory is persisted between restarts
      - ./volumes/db/data:/var/lib/postgresql/data:Z
      # Changes required for Analytics support
      - ./volumes/db/logs.sql:/docker-entrypoint-initdb.d/migrations/99-logs.sql:Z

  vector:
    container_name: supabase-vector
    image: timberio/vector:0.28.1-alpine
    healthcheck:
      test:
        [

          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:${VECTOR_API_PORT}/health"
        ]
      timeout: 5s
      interval: 5s
      retries: 3
    ports:
      - ${VECTOR_PORT}:${VECTOR_PORT}
      - ${VECTOR_API_PORT}:${VECTOR_API_PORT}
    volumes:
      - ./volumes/logs/vector.yml:/etc/vector/vector.yml:ro
    command: [ "--config", "etc/vector/vector.yml" ]

4. up

# Start the services (in detached mode)
docker compose up -d

Expected behavior

Normal use of storage function.

Screenshots

System information

• OS: macOS, Windows
• Browser (if applies) Microsoft Edge
• Version of Node.js:18.16.0

[Tani1015]

Generate API Keys#
Create a new JWT_SECRET and store it securely.
We can use your JWT Secret to generate new anon and service API keys using the form below. Update the "JWT Secret" and then run "Generate JWT" once for the SERVICE_KEY and once for the ANON_KEY:

Setting JWT Secret,SERVICE_KWY and ANON_KEY again without reloading the page solved the problem.

[binganao]

Hey bro, I realized that the jwt used in the '.env' file provided by the official Github is different from the one generated in the official document. You can use https://jwt.io to looking at their differences, and you will find that their fields are different. So please do not use the automatic generation tools in the official documentation.

[adam-bierschenk]

That worked. Appreciate the help!

[jspm2013]

Hey Together, do you mean you kept the provided keys from the repo, and did not change/update them to whatever new generated keys?

My issue is similar, but the error is not "Invalid signature" but "Fetch failed" ... have you probably also run into this one?

[lxup]

@jspm2013 you have to go to the documentation: https://supabase.com/docs/guides/self-hosting/docker#generate-api-keys
And inside this page they generate after each reload of the page a JWT example that you can use. So just take the JWT generated, and generate the ANON and SERVICE keys

[gLuColte]

@lxup You Legend!

Manual Solution

Bit of elaboration for people looking for the solution:

• The JWT can be randomly generated
• You need to use the JWT to generate your ANON and SERVICE Keys, using the given payload

Attempt: Shell Solution for Auto Generate (NOT WORKING)

Tried to write a Shell Script to do simliar:

#!/bin/bash
# Function to generate a random secret of 40 characters
generate_random_secret() {
    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 40
}

# Function to generate a JWT token from a payload and secret
generate_jwt_token() {
    local payload="$1"
    local jwt_secret="$2"
    echo -n "$payload" | openssl dgst -sha256 -hmac "$jwt_secret" -binary | openssl enc -base64 -A
}

# Generate and save passwords to variables
POSTGRES_PASSWORD=$(generate_random_secret)
JWT_SECRET=$(generate_random_secret)
current_time=$(date +%s)  # Get the current Unix timestamp
one_year_from_now=$((current_time + 31536000))  # Add 365 days (in seconds) to the current time

# Generate the dashboard password
DASHBOARD_PASSWORD=$(generate_random_secret)

SMTP_PASS=$(generate_random_secret)
LOGFLARE_LOGGER_BACKEND_API_KEY=$(generate_random_secret)
LOGFLARE_API_KEY=$(generate_random_secret)

# Update keys with random values in the .env file
ENV_FILE=".env"
TEMP_FILE="temp_env_file"

echo "Updating secrets in the .env file..."

update_env() {
    key=$1
    value=$2
    if grep -q "^$key=" "$ENV_FILE"; then
        # If the key exists, replace it
        awk -v key="$key" -v value="$value" -F '=' '$1 == key {print key "=\"" value "\""; next}1' "$ENV_FILE" > "$TEMP_FILE"
    else
        # If the key does not exist, append it
        echo "$key=\"$value\"" >> "$TEMP_FILE"
    fi
    mv "$TEMP_FILE" "$ENV_FILE"
}

update_env POSTGRES_PASSWORD "$POSTGRES_PASSWORD"

# Generate JWT Tokens
service_payload='{
    "role": "service_role",
    "iss": "supabase",
    "iat": '"$current_time"',
    "exp": '"$one_year_from_now"'
}'
anon_payload='{
    "role": "anon",
    "iss": "supabase",
    "iat": '"$current_time"',
    "exp": '"$one_year_from_now"'
}'

ANON_KEY=$(generate_jwt_token "$anon_payload" "$JWT_SECRET")

# Set the JWT_SECRET in .env file
update_env JWT_SECRET "$JWT_SECRET"

# Set the dashboard password in .env file
update_env DASHBOARD_PASSWORD "$DASHBOARD_PASSWORD"

update_env SMTP_PASS "$SMTP_PASS"
update_env LOGFLARE_LOGGER_BACKEND_API_KEY "$LOGFLARE_LOGGER_BACKEND_API_KEY"
update_env LOGFLARE_API_KEY "$LOGFLARE_API_KEY"

echo "Secrets updated in $ENV_FILE"

But failed, it still shows invalid when the storage tried to use the generated ANON_KEY/SERVICE_ROLE_KEY to communicate.

Any idea what I am doing wrong with the shelll script?

[alimuradov]

I have a similar problem; I've been struggling for two days to install Supabase on my own Ubuntu 22.04 server.

Currently, I managed to set up Supabase deployment using Docker, following the official documentation. However, there are still some issues that I can't resolve.

For example, the storage section in the Dashboard is not working for me. I can't see the list of all Buckets and create a new one.

Also, it's entirely unclear what values to set for the variables, surprisingly, they don't seem to affect anything, and the values with http://localhost and with my subdomain https://studio.mariadent.ru.
Also, it's unclear whether it's necessary to specify ports in these variables.

SITE_URL=https://studio.mariadent.ru
API_EXTERNAL_URL=https://studio.mariadent.ru
# replace if you intend to use Studio outside of localhost
SUPABASE_PUBLIC_URL=https://studio.mariadent.ru

I've been reading discussions on this topic for two days, but everyone writes differently.

And here is my Nginx configuration:

# REST
location ~ ^/rest/v1/(.*)$ {
    proxy_set_header Host $host;
    proxy_pass $forward_scheme://kong:8000;
    proxy_redirect off;
}

# AUTH
location ~ ^/auth/v1/(.*)$ {
    proxy_set_header Host $host;
    proxy_pass $forward_scheme://kong:8000;
    proxy_redirect off;
}

# REALTIME
location ~ ^/realtime/v1/(.*)$ {
    proxy_redirect off;
    proxy_pass $forward_scheme://kong:8000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    #proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
}

# STUDIO
location / {
    proxy_set_header Host $host;
    proxy_pass $forward_scheme://studio:3000;
    proxy_redirect off;
    proxy_set_header Upgrade $http_upgrade;
}

[jameswong3388]

How's it going ?

[alimuradov]

@jameswong3388 everything is bad, I had to abandon supabase((

[immocalcul]

Hello everyone,

I'm taking the time to share my experience because I spent countless hours trying to understand how to set up Supabase for self-hosting using Docker and Nginx. The lack of detailed documentation on Supabase's official site forced me to sift through numerous forums and tutorials, which were often outdated or overly complicated, making the process unnecessarily difficult.

I believe it would benefit the community if the Supabase team would seriously consider adding specific documentation for setup with Nginx and SSL certificates integration. I encountered several errors with the Supabase storage configuration, notably a major issue that prevented file uploads to the bucket from the Studio interface.

The issue was related to the Docker .env configuration. Following the documentation, I had set my domain as: API_EXTERNAL_URL=https://myserveraddress.com:8000. However, since Nginx redirects traffic from port 8000 to Kong, it's incorrect to include the port in the URL. The correct configuration is simply: API_EXTERNAL_URL=https://myserveraddress.com, letting Nginx handle the traffic redirection to Kong.

Here's a simplified example of the Nginx configuration that worked for me:

`
upstream kong {
server localhost:8000;
}

location / {
proxy_pass http://kong; # Redirect all requests to Kong
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
`

There's no need to add other specific routes in the Nginx configuration; Kong takes care of the rest. I noticed that many tutorials suggested adding unnecessary configurations, complicating the process for no reason.

The issue that was preventing uploads turned out to be Supabase Studio trying to connect to port 8000. I hope my feedback will help others navigate the self-hosting setup of Supabase more smoothly.

Thank you for considering these suggestions to improve the documentation and enhance the user experience.

[yuri12344]

Hi guys, I have same problem and I make a video to help you solve some problems, is easy.

https://youtu.be/NMqeUojxBbg

[AlizerUncaged]

this is a lost cause lmao, you're forced to use the cloud version of supabase to make things actually work

[lmntix]

Do check out and see if you still see any issues
https://www.reddit.com/r/Supabase/comments/1g73kl0/self_hosted_supabase_setup_with_authelia_and_caddy/

[jpaveg]

[yuri12344]

Idknw men. I use it for clients in production and everything works fine to me.
No lack in anything