Supabase - Hardened Self-Hosted Backend (Postgres, Auth, REST, Realtime)

This is a repackaged open source software product wherein additional charges apply for hardening, security configuration, and setup support.

WHAT IS SUPABASE

Supabase is an open-source Firebase alternative built on PostgreSQL. It turns a Postgres database into a full application backend: instant RESTful and GraphQL APIs over your tables (PostgREST), a complete authentication and user-management server with email and JWT support (GoTrue), realtime subscriptions over WebSockets, S3-compatible object storage with on-the-fly image transformation, serverless edge functions, and the Supabase Studio dashboard for managing it all from the browser. The self-hosted edition runs as a docker-compose deployment of eleven services - Studio, the Kong API gateway, Auth, REST, Realtime, Storage, imgproxy, postgres-meta, Edge Functions, the Postgres database, and the Supavisor connection pooler. Build a backend for web and mobile apps without writing server code: define tables, get APIs and a typed client instantly, manage users, and subscribe to changes. Apache-2.0 license, no vendor lock-in.

WHAT THIS AMI ADDS

Security hardening:

• Every secret regenerated per instance at first boot - the Postgres password, the JWT signing secret, the dashboard password, the Realtime/Supavisor key base, the Vault and postgres-meta encryption keys, and the Storage S3 keys. The publicly known upstream demo values are never used.
• Both API keys (anon and service_role) are freshly minted JWTs re-signed from the per-instance JWT secret - the default anon/service-role keys that ship with bare Supabase are public and grant full database access
• Host Nginx fronts the Kong API gateway on TCP 443 with a self-signed certificate; HTTP redirects to HTTPS; the Studio dashboard is protected by HTTP basic auth
• All eleven container images (Studio, Kong, Auth, REST, Realtime, Storage, imgproxy, postgres-meta, Edge Functions, PostgreSQL, Supavisor) pinned by SHA-256 digest with explicit linux/amd64 platform - reproducible builds, no surprise upgrades on rebuild
• Kong, Postgres (5432) and the Supavisor pooler (6543) bind to 127.0.0.1 only - Nginx on 443 is the sole public-facing endpoint by default
• UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
• fail2ban, AppArmor
• CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
• auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html
• CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

ARCHITECTURE NOTES

A single host Nginx vhost on TCP 443 terminates TLS and proxies to the Kong gateway, which routes internally to Studio (/), Auth (/auth/v1), REST and GraphQL (/rest/v1, /graphql/v1), Realtime (/realtime/v1, WebSocket), Storage (/storage/v1), and Edge Functions (/functions/v1). Postgres data and uploaded objects persist at /opt/supabase/volumes/db/data and /opt/supabase/volumes/storage - operators can attach an EBS volume there. Direct database access on ports 5432 (session) and 6543 (transaction pooler) is bound to localhost by default; open it explicitly when you need external connections. Replace the self-signed certificate with a CA-signed certificate for production using Certbot, then set SUPABASE_PUBLIC_URL, API_EXTERNAL_URL and SITE_URL in /opt/supabase/.env to your HTTPS hostname so auth callbacks, storage URLs and the Studio dashboard use the new origin.