feat: Official Supabase self-hosting integration (13-service stack) by POWERFULMOVES · Pull Request #583 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2026-02-06T10:00:39Z

Summary

Integrated the official Supabase self-hosting stack into PMOVES.AI, replacing the minimal 4-service implementation with a full production-ready 13-service stack.

Changes

1. Core Integration (Commit: `3d1b776c`)

docker-compose.supabase.yml: Complete rewrite with 13 official services
- Studio (port 54323): Management dashboard with port mapping
- Kong Gateway (port 8000): API gateway with declarative config
- GoTrue Auth, PostgREST, Realtime, Storage, ImgProxy, Meta
- Edge Functions, Analytics, PostgreSQL, Vector, Supavisor
scripts/with-env.sh: Added env.tier-supabase to 6-tier architecture

2. Makefile Improvements (Commit: `eebbf899`)

Fixed version check source (PyPI → npm for Supabase CLI)
Rewrote up-supabase with proper error handling
Added network management (ensure-network, clean-networks)
Added setup-supabase-volumes target
Removed silent failures (|| true) from critical paths

3. Secret Generation Script (Commit: `23ee3c83`)

Generates all 9 cryptographic secrets automatically
Creates JWT tokens for anon/service_role keys
OpenSSL validation with helpful install instructions
Fixed POSTGRES_PASSWORD generation (no truncation)

4. Documentation (Commit: `639e436d`)

Complete integration summary with service table
Port mappings, access URLs, environment setup
PR review fixes documented (17 fixes applied)

Resolves

✅ Issue Feat/hirag hybrid #1: Supabase Configuration (bring-up-findings.md)
✅ Issue Feat/langextract supabase realtime #5: up-supabase Makefile Target (bring-up-findings.md)
✅ Issue Discord embeds: event-specific formatting + backoff; pmoves-yt emits … #6: Network Conflicts (bring-up-findings.md)

Test Plan

Generate secrets: bash pmoves/scripts/generate-supabase-secrets.sh > pmoves/env.tier-supabase
Start services: make up-supabase
Verify health: make supa-health
Access Studio: http://localhost:54323
Access Kong: http://localhost:8000
Test API: curl http://localhost:8000/rest/v1/

Additional PR Review Fixes

Following comprehensive PR review with specialized agents:

✅ Studio port mapping added
✅ REST service healthcheck added
✅ env.tier-supabase auto-loading
✅ Migration/seed error handling (removed || true)
✅ Port inconsistency fixed (65433 → 54323)
✅ Version check source fixed (PyPI → npm)
✅ Wait targets error handling improved
✅ verify-all now aggregates failures
✅ DB readiness wait with better error context
✅ Kong entrypoint documentation added
✅ Auth healthcheck documentation fixed
✅ Volume copy error handling
✅ Duplicate SUPA_PROVIDER removed
✅ Network exclusion explanation added
✅ Service dependency warning added

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com

Complete rewrite of Supabase integration using official self-hosted stack: - Studio (port 54323): Management dashboard - Kong Gateway (port 8000): API gateway with declarative config - GoTrue Auth (internal): JWT authentication service - PostgREST (internal): RESTful API layer - Realtime: WebSocket subscription service - Storage: S3-compatible file storage - ImgProxy: Image transformation service - Meta: Database management API - Edge Functions: Deno-based serverless functions - Analytics (Logflare): Log management - PostgreSQL: Official Supabase Postgres image - Vector: Log pipeline for Analytics - Supavisor: Connection pooler (ports 5432, 6543) Key improvements: - Studio port mapping added (54323:3000) - REST service healthcheck with curl availability check - Kong entrypoint with env var expansion for kong.yml - Storage dependencies use service_healthy condition - All services join pmoves-net external network - Volume paths configurable via SUPABASE_VOLUMES - Port 4000 (Analytics) disabled to avoid TensorZero UI conflict env.tier-supabase auto-loading: - Added to 6-tier architecture in scripts/with-env.sh - Environment loads automatically on all scripts using with-env.sh Resolves: Issue #1 (Supabase Configuration) from bring-up-findings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Addressed PR review findings for Supabase integration: - Fixed version check source (PyPI → npm registry for Supabase CLI) - Rewrote up-supabase with proper error handling and health checks - Added down-supabase, restart-supabase targets - Added network management (ensure-network, clean-networks) - Added setup-supabase-volumes for initial volume setup Error handling improvements: - Removed || true from DB readiness wait (now fails with context) - DB timeout shows container status and recent logs on failure - Volume copy errors are reported instead of silently ignored - Kong gateway wait has proper timeout and error message Healthcheck improvements: - supa-health checks Kong gateway (port 8000) - Auth service check now uses Kong gateway instead of direct port - Studio health check respects SUPABASE_STUDIO_PORT variable - Added container status table for visual verification Network management: - ensure-network creates pmoves-net if missing - clean-networks removes stale networks with empty labels - Fixes "incorrect label" errors from previous deployments Port standardization: - Studio port standardized to 54323 (was 65433 in some places) - All references updated for consistency Resolves: Issue #5 (up-supabase Makefile Target) from bring-up-findings Resolves: Issue #6 (Network Conflicts) from bring-up-findings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Added automated secret generation for Supabase production deployment: - Generates all 9 critical security secrets (JWT, DB, encryption keys) - Creates JWT tokens for ANON_KEY and SERVICE_ROLE_KEY - Output can be piped directly to env.tier-supabase Features: - OpenSSL availability check with helpful install instructions - JWT_SECRET: 64-byte base64 random secret - POSTGRES_PASSWORD: 32-char password (special chars removed) - VAULT_ENC_KEY: 64 hex chars (32 bytes) for Supavisor - SECRET_KEY_BASE: 64-byte base64 for Rails/Erlang sessions - All other required secrets with proper entropy Usage: bash scripts/generate-supabase-secrets.sh > env.tier-supabase Security improvements: - POSTGRES_PASSWORD generates extra bytes before truncation - Ensures 32 chars even after removing special chars - VAULT_ENC_KEY comment corrected (32 bytes = 64 hex chars) - Removed broken $OUTPUT_FILE logic (stdout-only output) Resolves: Part of Issue #4 (Missing Secret Environment Variables) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…tion Comprehensive documentation of Supabase integration: - 13-service official stack overview with service table - Complete port mappings and access URLs - Environment setup instructions with secret generation - Migration guide from previous 4-service implementation - Testing checklist for validation - Technical notes on multi-arch support and security PR Review Fixes Applied section documents: - 5 Critical fixes (Studio port, REST healthcheck, env loading, etc.) - 5 High Priority fixes (port consistency, version check, wait targets, etc.) - 5 Medium Priority fixes (Kong entrypoint docs, Auth healthcheck, etc.) - 2 Documentation updates Files created/modified: - pmoves/env.tier-supabase.example (template) - pmoves/scripts/generate-supabase-secrets.sh (generator) - pmoves/docker-compose.supabase.yml (13-service stack) - pmoves/Makefile (Supabase targets, network management) - scripts/with-env.sh (6-tier architecture) - .gitmodules (PMOVES-supabase submodule) Provides complete reference for: - Initial setup and deployment - Service dependencies and startup ordering - Network isolation architecture - Volume requirements - Troubleshooting known issues 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

coderabbitai · 2026-02-06T10:00:49Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch test-hardened

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

chatgpt-codex-connector · 2026-02-06T10:00:50Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Production merge including: - PR #583: Official Supabase integration (13-service stack) - PR #584: Audit v2 findings (healthchecks, dependencies, error handling) - PR #585: Hybrid NetworkPolicy (explicit external API allow-list) - GPU Orchestrator security hardening (no-new-privileges, cap_drop) - CHIT security documentation - Service dependencies with healthchecks - Agent Zero healthcheck 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> # Conflicts: # docs/PMOVES.AI-Edition-Hardened-Full.md # pmoves/Makefile # pmoves/__init__.py # pmoves/docker-compose.external.yml # pmoves/docker-compose.yml # pmoves/env.shared.example # pmoves/env.tier-media

Codex Agent and others added 4 commits February 6, 2026 04:58

POWERFULMOVES merged commit dd4c9f4 into PMOVES.AI-Edition-Hardened Feb 6, 2026
1 of 13 checks passed

POWERFULMOVES deleted the test-hardened branch March 9, 2026 20:57

Navigation Menu

feat: Official Supabase self-hosting integration (13-service stack) - #583

feat: Official Supabase self-hosting integration (13-service stack)#583
POWERFULMOVES merged 4 commits into
PMOVES.AI-Edition-Hardenedfrom
test-hardened

POWERFULMOVES commented Feb 6, 2026

Uh oh!

coderabbitai Bot commented Feb 6, 2026

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

POWERFULMOVES commented Feb 6, 2026

Summary

Changes

1. Core Integration (Commit: 3d1b776c)

2. Makefile Improvements (Commit: eebbf899)

3. Secret Generation Script (Commit: 23ee3c83)

4. Documentation (Commit: 639e436d)

Resolves

Test Plan

Additional PR Review Fixes

Uh oh!

coderabbitai Bot commented Feb 6, 2026

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. Core Integration (Commit: `3d1b776c`)

2. Makefile Improvements (Commit: `eebbf899`)

3. Secret Generation Script (Commit: `23ee3c83`)

4. Documentation (Commit: `639e436d`)