Aggiungo stack Supabase self-hosted e config di produzione

Stack Docker completo in infra/supabase/docker/ (vendored da supabase/supabase) per svincolare dev e produzione da Lovable Cloud. Include override di produzione che non espone porte pubblicamente e disattiva i servizi non usati da CrAPP (Realtime, Storage, imgproxy, Edge Functions, pooler), un Caddyfile con routing /api/* per un solo dominio, e i template .env per app e stack. Forzo inoltre il preset Nitro a node-server in vite.config.ts, dato che il default sarebbe Cloudflare Workers.
2026-08-28 14:23:20 +02:00
parent eddee2ec44
commit f496eb2f88
67 changed files with 12697 additions and 0 deletions
@@ -0,0 +1,95 @@
+upstream api_gw_upstream {
+    server api-gw:8000;
+    keepalive 2;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+
+    server_name ${PROXY_DOMAIN};
+    server_tokens off;
+
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-Port $server_port;
+
+    ssl_certificate /etc/letsencrypt/live/${PROXY_DOMAIN}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${PROXY_DOMAIN}/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/${PROXY_DOMAIN}/chain.pem;
+
+    ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;
+
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    # Prevent 502 errors from large Supabase auth cookies
+    large_client_header_buffers 4 16k;
+    proxy_buffer_size 128k;
+    proxy_buffers 4 256k;
+    proxy_busy_buffers_size 256k;
+
+    location / {
+        auth_basic "supabase";
+        auth_basic_user_file /etc/nginx/user_conf.d/dashboard-passwd;
+
+        proxy_pass http://studio:3000;
+    }
+
+    location /auth {
+        proxy_pass http://api_gw_upstream;
+    }
+
+    location /rest {
+        proxy_pass http://api_gw_upstream;
+    }
+
+    location /graphql {
+        proxy_pass http://api_gw_upstream;
+    }
+
+    location /realtime/v1/ {
+        proxy_pass http://api_gw_upstream;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Port $server_port;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_read_timeout 3600s;
+    }
+
+    location /storage/v1/ {
+        proxy_pass http://api_gw_upstream;
+
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        chunked_transfer_encoding off;
+
+        client_max_body_size 0;
+    }
+
+    location /functions {
+        proxy_pass http://api_gw_upstream;
+    }
+
+    location /mcp {
+        proxy_pass http://api_gw_upstream;
+    }
+
+    location /sso {
+        proxy_pass http://api_gw_upstream;
+    }
+}