🌟 Supabase Production Self-Host: Ultimate Guide for Custom API Domain & HTTPS Setup

D: ### 🚀 Introduction
Self-hosting Supabase in production requires careful configuration, especially for custom API domains and HTTPS. This guide will walk you through the entire process step-by-step, ensuring a secure and scalable setup.

🔧 Prerequisites

Before diving in, make sure you have:
✔ Supabase Self-Hosted Instance (Docker/Kubernetes)
✔ Domain Name (e.g., api.yourdomain.com)
✔ SSL Certificate (Let’s Encrypt or custom)
✔ Reverse Proxy (Nginx, Traefik, or Caddy)

🛠 Step 1: Configure Custom API Domain

1.1 Update Supabase Config

Edit your docker-compose.yml or Helm values to point to your custom domain:

services:
  kong:
    environment:
      - KONG_HOST=api.yourdomain.com
  studio:
    environment:
      - STUDIO_PUBLIC_URL=https://studio.yourdomain.com

1.2 Update DNS Records

Add an A record or CNAME pointing to your server’s IP:

• api.yourdomain.com → YOUR_SERVER_IP

🔒 Step 2: Enable HTTPS with SSL

2.1 Using Let’s Encrypt (Certbot)

Run Certbot to generate a free SSL certificate:

sudo certbot certonly --nginx -d api.yourdomain.com

2.2 Configure Nginx as Reverse Proxy

Edit /etc/nginx/sites-available/supabase:

server {
    listen 443 ssl;
    server_name api.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/api.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://localhost:8000; # Supabase Kong port
        proxy_set_header Host $host;
    }
}

Restart Nginx:

sudo systemctl restart nginx

2.3 (Alternative) Traefik or Caddy Setup

• Traefik: Use Docker labels for automatic HTTPS.
• Caddy: Automatic HTTPS with just:

  api.yourdomain.com {
    reverse_proxy localhost:8000
  }

🔥 Step 3: Verify & Test

3.1 Check HTTPS Connection

curl -I https://api.yourdomain.com

✅ Should return HTTP/2 200

3.2 Test Supabase API

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  'https://api.yourdomain.com',
  'YOUR_SUPABASE_KEY'
)

🚀 Step 4: Production Hardening

4.1 Enable HSTS

Add to Nginx config:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

4.2 Rate Limiting

Protect your API with Kong plugins or Nginx rules.

🏁 Conclusion

You’ve successfully set up a custom domain + HTTPS for Supabase in production! 🎉

🔗 Further Reading:

• Supabase Self-Hosting Docs
• Certbot Official Guide

Got stuck? Ask in the comments! 👇💬