Backend Platforms

supabase

Supabase backend platform — Postgres core with GoTrue auth, PostgREST, Realtime, Storage API (S3/RustFS) and ImgProxy. This is Supabase, NOT Apache Superset.

@r8s/supabase

supabasepostgresauthrealtimestorage

Components (1)

Supabase

Supabase — open-source Firebase alternative: auth, REST, realtime and storage on Postgres. This is the Supabase backend platform, NOT Apache Superset (which ships in the separate r8s/superset package).

import { Platform } from '@r8s/recipes'
import { Supabase } from '@r8s/supabase'

export default (
  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
    <Supabase
      name="backend"
      host="backend.example.com"
      objectStorage={{
        endpoint: 'https://s3.internal.example.com',
        bucket: 'backend-uploads',
        credentialsSecret: 'backend-object-store-credentials',
      }}
    />
  </Platform>
)

namestringOptional—

Resource name — base for every derived resource (defaults to 'supabase')

namespacestringOptional—

Kubernetes namespace (defaults to 'default')

hoststringRequired—

Public hostname for the REST API root — PostgREST (required)

replicasnumberOptional—

Replicas per service (defaults to 1; PostgREST/GoTrue scale horizontally)

storagestringOptional—

Postgres cluster storage size for the Database core (defaults to '10Gi')

storageApibooleanOptional—

Render the Storage API service (defaults to true). Set false to run a minimal auth + REST-only Supabase. The S3 objectStorage prop is always required so a bucket is declared for the platform.

objectStorage{ endpoint: string, bucket: string, credentialsSecret: string }Required—

S3-compatible object storage for the Storage API (RustFS in the platform). Reference a bucket whose credentials live in a Secret provisioned by the secrets backend (keys: accessKey, secretKey) — never plaintext.

regionstringOptional—

S3 region reported to the Storage API (GLOBAL_S3_REGION, defaults to 'us-east-1'). For S3-compatible stores like RustFS any consistent region works — keep it aligned with the provider's default.

jwtSecretsNamestringOptional—

Name of an existing Secret holding the Supabase JWT bundle with keys jwtSecret, anonKey, serviceRoleKey and referrerURLs. Required unless a secrets backend (openbao/vault) is configured on the surrounding Platform — the backend then provisions the bundle at path <path>/<name>/jwt. Plaintext JWT secrets are not supported.

uriAllowListstring | string[]Optional—

Additional redirect URLs GoTrue may send users to after signup, magic-link or OAuth flows (GOTRUE_URI_ALLOW_LIST). The site URL is always allowed; pass a list (joined with ',') or a pre-joined string.

resources{ requests?: { cpu?: string, memory?: string }, limits?: { cpu?: string, memory?: string } }Optional—

Requested resources — applied to every service in the suite

tls{ secretName: string, clusterIssuer: string }Optional—

TLS configuration (defaults to letsencrypt-prod cluster issuer)

←All packages