version: 2026.07.02
requires:
  - name: smtp
defaultConfig:
  namespace: supabase
  domain: supabase.{{ .cloud.domain }}
  externalDnsDomain: "{{ .cloud.domain }}"
  tlsSecretName: wildcard-wild-cloud-tls
  dbStorage: 10Gi
  fileStorage: 5Gi
  db:
    host: db
    name: postgres
    user: supabase_admin
  jwtExpiry: "3600"
  siteUrl: "https://supabase.{{ .cloud.domain }}"
  defaultOrg: "Default Organization"
  defaultProject: "Default Project"
  dashboardUsername: supabase
  smtp:
    host: "{{ .apps.smtp.host }}"
    port: "{{ .apps.smtp.port }}"
    user: "{{ .apps.smtp.user }}"
    from: "{{ .apps.smtp.from }}"
defaultSecrets:
  - key: dbPassword
  - key: dashboardPassword
  - key: jwtSecret
    default: "your-super-secret-jwt-token-with-at-least-32-characters-long"
  - key: anonKey
    default: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE"
  - key: serviceRoleKey
    default: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q"
  - key: secretKeyBase
    default: "UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq"
  - key: realtimeEncKey
    default: "supabaserealtime"
  - key: vaultEncKey
    default: '{{ crypto.SHA256 .secrets.jwtSecret }}'
  - key: pgMetaCryptoKey
    default: '{{ crypto.SHA256 .secrets.dbPassword }}'
  - key: dbUrlAuth
    default: "postgres://supabase_auth_admin:{{ .secrets.dbPassword }}@{{ .app.db.host }}:5432/{{ .app.db.name }}?sslmode=disable"
  - key: dbUrlStorage
    default: "postgres://supabase_storage_admin:{{ .secrets.dbPassword }}@{{ .app.db.host }}:5432/{{ .app.db.name }}?sslmode=disable"
  - key: dbUrlRest
    default: "postgres://authenticator:{{ .secrets.dbPassword }}@{{ .app.db.host }}:5432/{{ .app.db.name }}?sslmode=disable"
requiredSecrets:
  - smtp.password
scripts:
  - name: generate-keys
    path: scripts/generate-keys.sh
    description: "Generate new JWT secret and API keys. Run this before going to production to replace the default example keys."
    params:
      - name: JWT_SECRET
        description: "Optional: provide your own JWT secret (min 32 chars). Leave blank to auto-generate."