Deploy Supabase

Deploy and Host Supabase on Railway

Supabase is the open-source Firebase alternative: a PostgreSQL database wrapped in an auto-generated REST API, an auth server, realtime subscriptions, S3-compatible file storage, Deno edge functions and a table-editor dashboard. You get plain Postgres — schemas, joins, transactions, Row Level Security and the full extension ecosystem, including pgvector for embeddings. Self-host Supabase under Apache-2.0 to keep data in your own infrastructure, with a connection string any ORM or BI tool can point at.

Run Supabase on Railway and the upstream stack comes up pre-wired: db on a persistent volume, kong as the single public API gateway, plus auth, rest, realtime-dev, storage on a managed bucket, imgproxy, meta, studio and functions. Only Kong gets a public domain — every other service is private. Requests enter at /rest/v1, /auth/v1, /storage/v1, /realtime/v1, /functions/v1, /graphql/v1 or /pg/, are authenticated by Kong's key-auth and ACL plugins, and proxied to the right service.

Getting Started with Supabase on Railway

You supply one credential: JWT_SECRET. Your anon and service_role API keys are HS256 JWTs signed with it, so they cannot be random — but you need not make them: each service derives them at startup, and because HMAC is deterministic every container computes identical keys. Read them off Studio's API settings page. To use your own, set ANON_KEY and SERVICE_ROLE_KEY and nothing is derived.

Once the deploy is green, open Kong's public domain. Studio sits behind HTTP basic auth at the gateway, so the browser prompts immediately — sign in with DASHBOARD_USERNAME and DASHBOARD_PASSWORD. In the SQL Editor, create a table, add an RLS policy for the anon role and insert a row, then read it back through PostgREST with your anon key: a 200 proves Kong's key mapping, PostgREST's role switching and RLS are all wired. Two day-one notes — there is no SMTP unless you configure it, so confirmation and recovery email will not deliver, and pg_graphql is inactive until you run create extension pg_graphql.

About Hosting Supabase

Supabase is small services pointed at one Postgres database. PostgREST reflects your schema into a REST API and swaps its Postgres role per request from the JWT, so authorization is enforced by RLS in the database, not application code. GoTrue issues those JWTs, Realtime tails logical replication, Storage applies the same RLS model to files.

• Postgres 17 with pgvector, PostGIS, pg_cron, pg_net, pg_graphql, Vault and 30+ more
• REST and GraphQL APIs that update the moment your schema does
• Row Level Security enforced for every client, including anonymous ones
• Email, phone, OAuth and SSO auth with JWT sessions
• Realtime change streams, broadcast and presence, plus Deno edge functions

Why Deploy Supabase on Railway

Railway removes the server administration a ten-service stack implies.

• Every service provisioned, versioned and networked
• Private networking keeps Postgres, auth, storage and Studio off the internet
• The database volume and storage bucket are handled by the platform
• Scale each service independently
• Usage-based pricing, no project pausing, no per-row read fees

Common Use Cases

• Multi-tenant SaaS backends where tenant isolation is an RLS policy, so a bug in one route cannot leak another tenant's rows
• AI and RAG apps storing embeddings in pgvector beside relational data, so one query mixes similarity and SQL filters
• Mobile and web backends for Flutter, Expo, Swift, Kotlin and Next.js — auth, storage and realtime with no server code

Dependencies for Supabase

• db — supabase/postgres:17.6.1.136. Postgres 17 with Supabase's roles and extensions, on a volume. POSTGRES_USER must be supabase_admin: the image's migration script runs as that role, so any other value fails every migration while the container looks healthy.
• kong — kong/kong:3.9.1. Gateway: API-key auth, ACLs, basic auth on Studio.
• auth — supabase/gotrue:v2.189.0. Issues user JWTs signed with JWT_SECRET.
• rest — postgrest/postgrest:v14.12. REST over public and graphql_public; serves /graphql/v1.
• realtime-dev — supabase/realtime:v2.102.3. Keep this name: Realtime takes its tenant ID from the first label of the request hostname.
• storage — supabase/storage-api:v1.60.4. Objects in the bucket, metadata in Postgres.
• imgproxy — darthsim/imgproxy:v3.30.1. Resizing and WebP from that bucket.
• meta — supabase/postgres-meta:v0.96.6. Schema introspection, admin only.
• studio — supabase/studio. Table editor, SQL editor, auth users.
• functions — supabase/edge-runtime:v1.74.0. Deno runtime for /functions/v1/.

kong, storage, studio and functions build from a small public wrapper over those exact images that derives the API keys at boot; the rest deploy the images directly.

Environment Variables Reference

Deployment Dependencies

• Source: (docker/docker-compose.yml)
• Build repo:
• Docs:
• Clients: supabase-js, supabase-py, Flutter, Swift, Kotlin, C#, CLI

Hardware Requirements for Self-Hosting Supabase

Supabase's self-hosting guide publishes specs for the stack.

Dropping services you do not need lowers that floor; the database needs headroom.

Self-Hosting Supabase with Docker

The upstream project ships a Compose stack. To self-host Supabase locally, run:

git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker
cp .env.example .env
docker compose up -d

Studio is then on http://localhost:8000. Change JWT_SECRET, POSTGRES_PASSWORD and both dashboard values before exposing it. Upstream's compose has you generate the API keys; this template derives them.

Verify a deployment with curl against your gateway domain:

curl -s "https:///auth/v1/health" -H "apikey: $ANON_KEY"
curl -s "https:///storage/v1/status"
curl -s "https:///rest/v1/your_table?select=*" \
  -H "apikey: $ANON_KEY" -H "Authorization: Bearer $ANON_KEY"

A 200 from all three means gateway, auth, storage and PostgREST are healthy. Take $ANON_KEY from Studio's API settings page.

How Much Does It Cost to Self-Host Supabase?

Supabase's core is free and open source under Apache-2.0 — no licence fee, no seat cost, no feature gating when self-hosted. You pay only for infrastructure: usage-based compute for ten small services plus volume and bucket storage. Supabase Cloud's free tier caps you at 500 MB of database, 1 GB of file storage and two projects that pause after a week idle, with Pro at $25/month per organization; self-hosting removes per-MAU and per-egress metering.

FAQ

What is Supabase? An open-source backend platform built on PostgreSQL, bundling a database, auto-generated REST and GraphQL APIs, authentication, realtime subscriptions, file storage and edge functions behind one gateway.

What does this Railway template deploy? Ten services: Postgres, the Kong gateway, GoTrue auth, PostgREST, Realtime, Storage, imgproxy, postgres-meta, Studio and the Deno edge runtime, plus a volume for the database and a bucket for files. Kong alone has a public domain.

Where do my ANON_KEY and SERVICE_ROLE_KEY come from? Derived for you. Both are HS256 JWTs naming a Postgres role (anon or service_role) and signed with JWT_SECRET, so a random generator cannot produce them — each service computes them at boot. Find them on Studio's API settings page, or set your own to override.

Why a managed bucket instead of a volume for storage? Storage and imgproxy both need the same object store, and a volume attaches to exactly one service. An S3-compatible bucket lets both read it and removes the bundled MinIO container.

Can I connect Prisma, Drizzle or psql directly to the database? Yes, over private networking at db.railway.internal:5432. The database is deliberately not public, so run migrations from another service in the project.