version: 2026.07.02-1
requires:
- name: smtp
defaultConfig:
  namespace: supabase
  domain: supabase.{{ .cloud.domain }}
  dbStorage: 10Gi
  fileStorage: 5Gi
  db:
    host: db
    name: postgres
    user: supabase_admin
  jwtExpiry: '3600'
  siteUrl: https://supabase.{{ .cloud.domain }}
  defaultOrg: Default Organization
  defaultProject: Default Project
  dashboardUsername: supabase
  smtp:
    host: '{{ .apps.smtp.host }}'
    port: '{{ .apps.smtp.port }}'
    user: '{{ .apps.smtp.user }}'
    from: '{{ .apps.smtp.from }}'
defaultSecrets:
- key: dbPassword
- key: dashboardPassword
- key: jwtSecret
  default: your-super-secret-jwt-token-with-at-least-32-characters-long
- key: anonKey
  default: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE
- key: serviceRoleKey
  default: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
- key: secretKeyBase
  default: UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq
- key: realtimeEncKey
  default: supabaserealtime
- key: vaultEncKey
  default: '{{ crypto.SHA256 .secrets.jwtSecret }}'
- key: pgMetaCryptoKey
  default: '{{ crypto.SHA256 .secrets.dbPassword }}'
- key: dbUrlAuth
  default: postgres://supabase_auth_admin:{{ .secrets.dbPassword }}@{{ .app.db.host
    }}:5432/{{ .app.db.name }}?sslmode=disable
- key: dbUrlStorage
  default: postgres://supabase_storage_admin:{{ .secrets.dbPassword }}@{{ .app.db.host
    }}:5432/{{ .app.db.name }}?sslmode=disable
- key: dbUrlRest
  default: postgres://authenticator:{{ .secrets.dbPassword }}@{{ .app.db.host }}:5432/{{
    .app.db.name }}?sslmode=disable
requiredSecrets:
- smtp.password
scripts:
- name: generate-keys
  path: scripts/generate-keys.sh
  description: Generate new JWT secret and API keys. Run this before going to production
    to replace the default example keys.
  params:
  - name: JWT_SECRET
    description: 'Optional: provide your own JWT secret (min 32 chars). Leave blank
      to auto-generate.'