Ben Isenstein

"PG On Rails" | Self-hosted Supabase. Amazing developer experience.

Complete Supabase + NextJS

PostgREST

Time before refreshing sessions. Defaults to an hour.

Schemas within Postgres that PostgREST is permitted to expose via RESTful API.

Whether to use legacy Grand Unified Scheme (GUC) variables. Keep set to "false".

Defines the network interface that the server binds to when it starts.

All PG On Rails services declare PORT to standardize building urls within the Railway private network.

Edge Functions

The port that Edge Functions will listen at.

Private url for directly querying Postgres.

Whether to verify if a JWT is legit on every request.

Supabase Storage

Timeout seconds for Postgres connections.

We don't know much about this. Keep it set to "false"

DB role for logged-in users, used in JWTs

DB superuser role (also "supabase_admin")

S3 id for storage's managing access to consumers

S3 secret for storage's managing access to consumers

The port to access Storage admin functions.

Storage backend. Can also be "file" but must be "s3" on Railway.

name of top-level bucket. objects are stored in a structure of <top-level-bucket>/<tenant>/<supabase-bucket>/<object>

Use the path style to reference storage objects.

Max socket connections with S3-compatible storage.

S3 region doesn't matter for our self-hosted S3-compatible storage.

Resumable uploads url expiry milliseconds.

The time window in seconds a consumer has to download a storage object via signed url.

Postgres

Postgres password for the authenticator role.

Postgres password for the auth_admin role.

Database name within the Postgres server.

Postgres password for the pgbouncer role.

Private network connection string to access the DB.

Public connection string to access the DB.

Postgres password for the storage_admin role.

Postgres password for the postgres and supabase_admin roles.

Postgres password for the functions_admin role (this name might be confusing, the functions_admin role is for webhooks, not edge functions).

The Postgres JWT extension config uses "JWT_EXP".

Time before sessions are refreshed. Default one hour.

Please visit the Supabase self-hosting tool in a new tab to generate a JWT secret and keys: https://supabase.com/docs/guides/self-hosting/docker#generate-api-keys

Local socket address to run at when performing internal migrations on start.

PgBouncer

The query that PgBouncer uses to authenticate connecting clients within Postgres. The pgbouncer.get_auth() function is created within the Postgres DB automatically.

The Postgres password encryption type that PgBouncer should use to authenticate connecting clients. This must be "scram-sha-256" because that's how Supabase Postgres encrypts passwords.

The Postgres role that PgBouncer connects to Postgres as before executing client transactions.

The number of server connections that PgBouncer maintains per database in its pool.

The maximum number of client connections that PgBouncer will accept simultaneously.

Public connection string to access the connection pooler.

Postgres connection pool mode. Options are "session", "transaction" and "statement"

Kong

Analytics host for routing. There is currently no analytics server in the template.

Analytics port for routing. There is currently no analytics server in the template.

Setting to "off" enables DB-less mode, loading config from kong.yml instead of a database. Ideal for containerized, version-controlled deployments.

Defines the priority sequence Kong uses when resolving hostnames through DNS.

Number and size of in-memory buffers to handle responses from upstream services. If the upstream response (headers + initial body) fits within this buffer size, it’s handled entirely in memory — faster and more efficient.

Sets the number of Nginx worker processes Kong spawns to handle incoming network connections and process requests. Setting to "auto" will match the number of CPU cores, for max cuncurrency and higher memory overhead.

Plugins that Kong will load and make available at runtime.

Specifies the network addresses and ports on which Kong’s proxy interface listens for incoming traffic.

imgproxy

Enable WebP support detection. When the file extension is omitted in the imgproxy URL and browser supports WebP, imgproxy will use it as the resulting format.

Defines the network interface and port that the server bind to when it starts.

Disable SSL verification, so imgproxy can be used in an environment with self-signed SSL certificates.

Enable or disable the use of ETag HTTP headers when serving images through the proxy.

Use S3-compatible storage to read images before transforming them.

Site

Private network connection string to run DB migrations on startup.

Ensure that Storage has started and run its DB migrations before Site does.

Project anon key which can safely be in a user's browser.

Whether to require a one-time passcode during password change. Read from the Auth service ENV config.

Project service role key FOR USE ON THE SERVER ONLY.

Supabase Realtime

Key used to encrypt sensitive fields in _realtime.tenants and _realtime.extensions tables.

A list of DNS server nodes or resolvers to use for name resolution in distributed or clustered environments.

Set to either "-proto_dist inet_tcp" or "-proto_dist inet6_tcp" depending on whether or not your network uses IPv4 or IPv6, respectively.

Maximum number of concurrent open network connections or open files.

Secret used by the server to sign cookies.

Create a tenant for self-hosting on startup.

Realtime tenant name for self-hosting. MUST MATCH THE SUBDOMAIN OF THIS SERVICE AS IT APPEARS IN THE RAILWAY PRIVATE NETWORK. This service was named "Supabase Realtime" in the project so that it will automatically deploy with the url of "supabase-realtime.railway.internal" in the private network.

Postgres Meta

Encryption key for securing connection strings between Studio and Postgres Meta.

The Postgres role that PG Meta will make queries as.

Supabase Auth

Local path within the Auth docker container to fetch email templates.

Admin role to include in service_role JWTs.

The default role that is given to users in their access token after authentication. Used by Postgres for row-level-security (RLS).

Time before refreshing sessions. Default one hour.

Set to "true" to disable emails, which can be useful in development. Set to "false" to require email confirmations. NOTE - SMTP traffic on Railway is only allowed for the Pro Plan and above.

Auth should expect requests from these hosts.

The default subject for the OTP email is cringe and needs to be overridden.

Email changed notification email template.

Identity linked notification email template.

Identity unlinked notification email template.

MFA factor enrolled notification email template.

MFA factor unenrolled notification email template.

Password changed notification email template.

Phone changed notification email template.

Where to redirect users from emails. Relative path within Kong.

When set to "true", when a user hasn't manually signed in for 24 hours, in order to change their password, they must provide a OTP from their email or phone.

Email address to receive troubleshooting emails.

SMTP password for authentication with the server.

SMTP user for authentication with the server.

MinIO

Port for the MinIO admin console. Public networking over HTTP must be turned on for the service, and pointed at port 9001.

S3 secret for other services to reference.

Supabase Studio

Organization name which appears in the browser tab for Supabase Studio

Project name which appears in the browser tab for Supabase Studio.

API key to use the AI assistant in Supabase Studio and be billed from your OpenAI account.