5 Tips to Protect Your AI API Keys in 2025
April 7, 2025
Learn how to secure your OpenAI, Anthropic, and other AI API keys from unauthorized access to prevent billing surprises and data breaches.
#security#openai+3
How to Self-Host Supabase: A Practical Guide
Fernando Chaves
April 7th, 2025
Supabase has become a popular open-source alternative to Firebase, offering a powerful backend-as-a-service solution with real-time database capabilities, authentication, storage, and more. While Supabase provides a convenient cloud-hosted option, self-hosting gives you full control over your data, enhanced privacy, and potentially significant cost savings. This guide walks you through the process of self-hosting Supabase on your own infrastructure.
Why Self-Host Supabase?
Before diving into the setup process, let's explore the key benefits of self-hosting Supabase:
- Complete data sovereignty and control over your infrastructure
- Enhanced privacy and security for sensitive applications
- Cost savings, especially for high-volume applications
- Ability to customize the stack to your specific requirements
- Freedom from vendor lock-in and service limitations
- Local development and testing without internet connectivity
Prerequisites for Self-Hosting Supabase
Before starting the self-hosting process, ensure you have the following requirements in place:
- A Linux server (virtual or physical) with at least 4GB RAM and 2 CPU cores
- Docker and Docker Compose installed
- Git for cloning the Supabase repositories
- Basic knowledge of command-line operations and networking
- A domain name (optional but recommended for production environments)
Method 1: Self-Hosting with Docker Compose
The simplest way to self-host Supabase is using Docker Compose, which allows you to run all the necessary components with minimal configuration. Here's how to get started:
Clone the official Supabase repository
git clone --depth 1 https://github.com/supabase/supabase.git
cd supabase/docker
Copy the example environment configuration
cp .env.example .env
Edit the environment variables with your custom settings
nano .env
In the .env file, you'll need to configure several important variables:
- POSTGRES_PASSWORD: A strong password for your PostgreSQL database
- JWT_SECRET: A secure random string for JWT token generation (use 'openssl rand -base64 32' to generate)
- ANON_KEY and SERVICE_ROLE_KEY: API keys for your Supabase instance
- DOMAIN_NAME: The domain where your Supabase instance will be accessible
Once you've configured the environment variables, you can start Supabase with Docker Compose:
Start all Supabase services in detached mode
docker compose up -d
After a few minutes, your self-hosted Supabase instance should be up and running. You can access the Studio UI at http://your-server-ip:8000 and use port 5432 for PostgreSQL database connections.
Method 2: Production Deployment with Docker and a Reverse Proxy
For production environments, you'll want to add a proper reverse proxy for SSL termination and improved security. Here's how to set it up with Docker and Traefik:
Make sure you're in the supabase-docker directory
cd supabase/docker
Edit the docker-compose.yml file to include Traefik
nano docker-compose.yml
Add Traefik configuration to your docker-compose.yml file to handle SSL and routing:
version: '3'
services:
traefik:
image: traefik:v2.9
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./traefik/acme.json:/acme.json:rw
- ./traefik/traefik.yml:/traefik.yml:ro
networks:
- proxy
studio:
labels:
- "traefik.enable=true"
- "traefik.http.routers.studio.rule=Host(`studio.yourdomain.com`)"
- "traefik.http.routers.studio.entrypoints=websecure"
- "traefik.http.routers.studio.tls.certresolver=letsencrypt"
kong:
labels:
- "traefik.enable=true"
- "traefik.http.routers.api.rule=Host(`api.yourdomain.com`)"
- "traefik.http.routers.api.entrypoints=websecure"
- "traefik.http.routers.api.tls.certresolver=letsencrypt"
networks:
proxy:
external: true
Create a proper Traefik configuration file for SSL and routing:
Create a directory for Traefik config
mkdir -p traefik
touch traefik/acme.json && chmod 600 traefik/acme.json
Create the Traefik config file
nano traefik/traefik.yml
This method is more complex but provides better security for production workloads. For detailed configuration options, refer to the official Supabase Docker documentation at https://supabase.com/docs/guides/self-hosting/docker.
Method 3: Low-Cost VPS Deployment ($3-5/month)
If you're on a tight budget, you can self-host Supabase on a low-cost VPS for as little as $3-$5 per month using a minimal configuration. Here's how to set it up on providers like DigitalOcean, Linode, or Vultr:
Start with a basic Ubuntu 22.04 VPS (1-2GB RAM)
Install Docker and Docker Compose
apt update && apt upgrade -y
apt install docker.io docker-compose git -y
Clone the official Supabase repository (development branch has Docker files)
git clone --depth 1 https://github.com/supabase/supabase.git
cd supabase/docker
Configure a lightweight setup by editing docker-compose.yml
You can comment out services you don't need like studio, realtime, etc.
cp .env.example .env
nano .env
nano docker-compose.yml
Start only the essential services
docker-compose up -d postgres kong auth rest storage
The minimal setup includes PostgreSQL, PostgREST, GoTrue (auth), and a lightweight API, omitting the Studio UI and other resource-intensive components. This configuration can run on a VPS with only 1-2GB of RAM.
Configuring and Securing Your Self-Hosted Supabase Instance
After deploying Supabase, it's essential to secure your instance properly:
- Set up a firewall to only expose necessary ports (80, 443, and optionally 5432 for PostgreSQL)
- Enable PostgreSQL connection encryption and strong authentication
- Implement regular database backups to an external storage location
- Set up monitoring with Prometheus and Grafana (included in the Docker setup)
- Keep your Supabase components updated regularly
Here's how to set up a basic firewall on Ubuntu using UFW:
Install UFW if not already installed
apt install ufw -y
Set default policies
ufw default deny incoming
ufw default allow outgoing
Allow SSH (always do this first to avoid locking yourself out)
ufw allow ssh
Allow HTTP and HTTPS
ufw allow 80/tcp
ufw allow 443/tcp
Only allow PostgreSQL access if needed externally
ufw allow 5432/tcp
Enable the firewall
ufw enable
Managing and Updating Your Self-Hosted Supabase
Keeping your self-hosted Supabase instance updated is crucial for security and performance. Here's how to update your Docker-based deployment:
Navigate to your Supabase directory
cd supabase/docker
Pull the latest changes from the repository
git pull
Pull the latest Docker images
docker compose pull
Restart the services with the updated images
docker compose down
docker compose up -d
It's recommended to perform updates during off-peak hours and always back up your database before updating:
Backup PostgreSQL data before updating
docker compose exec db pg_dumpall -U postgres > supabase_backup_$(date +%Y%m%d).sql
Connecting to Your Self-Hosted Supabase from Applications
Once your self-hosted Supabase instance is up and running, you can connect to it from your applications using the official Supabase client libraries. Here's how to connect from a JavaScript application:
// Import the client library
import { createClient } from '@supabase/supabase-js'
// Set up the client with your self-hosted details
const supabaseUrl = 'https://api.yourdomain.com' // Or your server IP with port
const supabaseKey = 'your-anon-key' // From your .env file
const supabase = createClient(supabaseUrl, supabaseKey)
// Example query to test the connection
async function fetchUsers() {
const { data, error } = await supabase
.from('users')
.select('id, name, email')
.limit(10)
if (error) {
console.error('Error fetching users:', error)
return null
}
return data
}
The connection process is the same as with the cloud-hosted Supabase, just using your self-hosted URL and keys. Make sure your client is using the correct URL and port for your self-hosted instance.
Troubleshooting Common Self-Hosting Issues
When self-hosting Supabase, you might encounter some common issues. Here's how to resolve them:
- Connection refused errors: Check that your ports are correctly exposed and not blocked by firewalls
- Authentication failures: Verify your JWT settings and API keys in the .env file
- Database connectivity issues: Check PostgreSQL logs and ensure correct credentials
- Missing services: Make sure all containers are running with 'docker compose ps'
- Out of memory errors: Increase your server's RAM or optimize the PostgreSQL configuration
For detailed troubleshooting, check the logs of the specific service:
View logs for all services
docker compose logs
View logs for a specific service
docker compose logs postgres
docker compose logs kong
docker compose logs auth
Follow logs in real-time
docker compose logs -f
Real-World Cost Comparison: Self-Hosted vs. Cloud Supabase
One of the main reasons to self-host Supabase is potential cost savings. Here's a realistic comparison of monthly costs based on actual usage:
- Supabase Cloud Pro Plan: $25/month (base) + additional costs for storage, bandwidth, and compute
- Self-Hosted on Budget VPS (DigitalOcean/Linode/Vultr): $5-10/month (2GB RAM, suitable for development)
- Self-Hosted on Standard VPS: $20-40/month (4-8GB RAM, good for small production apps)
- Self-Hosted on High-Performance VPS: $80-150/month (16GB+ RAM, suitable for larger applications)
For applications with moderate to high usage or large databases, self-hosting can offer significant cost savings. A real-world application with 100GB of database storage and moderate traffic might cost $200+ monthly on Supabase Cloud, while self-hosting the same workload could cost $40-60/month.
Conclusion
Self-hosting Supabase gives you complete control over your data and infrastructure while potentially reducing costs for growing applications. While it requires more technical expertise and maintenance compared to the cloud-hosted option, the benefits of data sovereignty, customization, and cost efficiency make it an attractive option for many projects.
By following this guide, you should be able to set up and manage your own self-hosted Supabase instance, tailored to your specific requirements and budget. Whether you choose the simple Docker Compose method, a production-grade deployment, or a budget-friendly VPS setup, self-hosting opens up new possibilities for your Supabase-powered applications.
Ready to Boost Your App Development with React Native?
Building applications with React Native and self-hosted Supabase can be a powerful combination. If you're looking to accelerate your development process, check out LaunchYourApp - our comprehensive React Native boilerplate with ready-to-use components, navigation, authentication, and more.
Explore LaunchYourApp Features