What is Supabase

Supabase is an open-source Firebase alternative built on PostgreSQL. It turns a Postgres database into a full application backend: instant RESTful and GraphQL APIs over your tables (PostgREST), a complete authentication and user-management server with email and JWT support (GoTrue), realtime subscriptions over WebSockets, S3-compatible object storage with on-the-fly image transformation, serverless edge functions, and the Supabase Studio dashboard for managing it all from the browser. The self-hosted edition runs as a docker-compose deployment of eleven services - Studio, the Kong API gateway, Auth, REST, Realtime, Storage, imgproxy, postgres-meta, Edge Functions, the Postgres database, and the Supavisor connection pooler. Build a backend for web and mobile apps without writing server code: define tables, get APIs and a typed client instantly, manage users, and subscribe to changes. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Every secret regenerated per instance at first boot - the Postgres password, the JWT signing secret, the dashboard password, the Realtime/Supavisor key base, the Vault and postgres-meta encryption keys, and the Storage S3 keys. The publicly known upstream demo values are never used.
Both API keys (anon and service_role) are freshly minted JWTs re-signed from the per-instance JWT secret - the default anon/service-role keys that ship with bare Supabase are public and grant full database access
Host Nginx fronts the Kong API gateway on TCP 443 with a self-signed certificate; HTTP redirects to HTTPS; the Studio dashboard is protected by HTTP basic auth
All eleven container images (Studio, Kong, Auth, REST, Realtime, Storage, imgproxy, postgres-meta, Edge Functions, PostgreSQL, Supavisor) pinned by SHA-256 digest with explicit linux/amd64 platform - reproducible builds, no surprise upgrades on rebuild
Kong, Postgres (5432) and the Supavisor pooler (6543) bind to 127.0.0.1 only - Nginx on 443 is the sole public-facing endpoint by default
UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

ARCHITECTURE NOTES

A single host Nginx vhost on TCP 443 terminates TLS and proxies to the Kong gateway, which routes internally to Studio (/), Auth (/auth/v1), REST and GraphQL (/rest/v1, /graphql/v1), Realtime (/realtime/v1, WebSocket), Storage (/storage/v1), and Edge Functions (/functions/v1). Postgres data and uploaded objects persist at /opt/supabase/volumes/db/data and /opt/supabase/volumes/storage - operators can attach an EBS volume there. Direct database access on ports 5432 (session) and 6543 (transaction pooler) is bound to localhost by default; open it explicitly when you need external connections. Replace the self-signed certificate with a CA-signed certificate for production using Certbot, then set SUPABASE_PUBLIC_URL and SITE_URL in /opt/supabase/.env to your HTTPS hostname (and API_EXTERNAL_URL to the same hostname plus /auth/v1) so auth callbacks, storage URLs and the Studio dashboard use the new origin.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/supabase-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-2g7amfc6ymare/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer supabase --plan payg-gen2
az vm create -g my-rg -n supabase --size Standard_D2s_v3 \
  --image lynxroute:supabase:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Supabase 2026.10.12

AWS · 2026-10-25

Supabase self-hosted stack updated to the 2026.10.12 snapshot: Studio, Auth, PostgREST, Realtime, Storage, postgres-meta, Edge Runtime, Supavisor, imgproxy and the Kong gateway move to the versions upstream ships with it
Security: Storage fixes unauthorized object uploads and overwrites through signed resumable upload URLs (GHSA-8rrf-w776-x75g)
Security: Realtime fixes forged broadcast messages on public channels (GHSA-9vjf-j9f7-j42c)
Security: the gateway now blocks the Realtime tenant-management API, and the REST OpenAPI root (/rest/v1/) requires the service_role key; table access with the anon key is unchanged
The Realtime encryption key is now generated per instance at first boot
API_EXTERNAL_URL now ends in /auth/v1, matching upstream; when you move to your own domain, set it to https://your-domain/auth/v1
Bundled PostgreSQL stays on 15.8 for data-directory compatibility
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	2026.10.12	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-10-25	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	2026.09.07	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-09-13	Listing ↗

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	Supabase
Machine-readable	product.json · catalog.json