diff --git a/charts/supabase/docker/Database.Dockerfile b/charts/supabase/docker/Database.Dockerfile index fa94cf546521045f6bb2b3b1748d9ab0b8c4c594..d7143e696eed3a97bb516e310420d09e4a5e6306 100644 --- a/charts/supabase/docker/Database.Dockerfile +++ b/charts/supabase/docker/Database.Dockerfile @@ -1,11 +1,52 @@ -FROM bitnami/postgresql:12.9.0-debian-10-r40 +FROM bitnami/postgresql:17-debian-12 USER root -RUN install_packages make git gcc libc6-dev +RUN install_packages make git gcc libc6-dev libssl-dev curl libcurl4-openssl-dev libsodium-dev cmake +# pgjwt RUN git clone https://github.com/michelp/pgjwt.git RUN cd pgjwt && make install + +# wal2json RUN git clone https://github.com/eulerto/wal2json.git RUN cd wal2json && make && make install +# pgvector +RUN git clone --branch v0.8.0 https://github.com/pgvector/pgvector.git +RUN cd pgvector && make && make install + +# pg_stat_monitor +RUN git clone https://github.com/percona/pg_stat_monitor.git +RUN cd pg_stat_monitor && make USE_PGXS=1 && make USE_PGXS=1 install + +# pgaudit +RUN git clone https://github.com/pgaudit/pgaudit.git +RUN cd pgaudit && git checkout REL_17_STABLE && make install USE_PGXS=1 PG_CONFIG=/opt/bitnami/postgresql/bin/pg_config + +# plpgsql_check +RUN git clone https://github.com/okbob/plpgsql_check.git +RUN cd plpgsql_check && make clean && make install + +# pg_cron +RUN git clone https://github.com/citusdata/pg_cron.git +RUN cd pg_cron && make && make install + + +# pg_net +RUN git clone https://github.com/supabase/pg_net.git +RUN cd pg_net && make && make install + +RUN git clone https://github.com/michelp/pgsodium.git +RUN cd pgsodium && make install +COPY --chown=1001:1001 ./pgsodium_getkey /opt/bitnami/postgresql/share/extension +RUN chmod -R +x /opt/bitnami/postgresql/share/extension/pgsodium_getkey + +RUN git clone https://github.com/timescale/timescaledb +RUN cd timescaledb && git checkout 2.17.2 && ./bootstrap && cd build && make && make install + + +ENV POSTGRESQL_SHARED_PRELOAD_LIBRARIES="pg_stat_statements, pg_stat_monitor, pgaudit, plpgsql, plpgsql_check, pg_cron, pg_net, pgsodium, auto_explain" + + + USER 1001 \ No newline at end of file diff --git a/charts/supabase/docker/SupabaseDb.Dockerfile b/charts/supabase/docker/SupabaseDb.Dockerfile new file mode 100644 index 0000000000000000000000000000000000000000..3533be9b3c37d824cef76502aa76ef855d7fe5ae --- /dev/null +++ b/charts/supabase/docker/SupabaseDb.Dockerfile @@ -0,0 +1,28 @@ +FROM supabase/postgres:15.8.1.040 + + +ARG USERNAME=nonroot-pg +ARG USER_UID=1001 +ARG USER_GID=$USER_UID + +RUN groupadd --gid $USER_GID $USERNAME \ + && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME + +RUN chown -R ${USERNAME}:${USERNAME} /usr/lib/postgresql \ + && chown -R ${USERNAME}:${USERNAME} /var/lib/postgresql \ + && chown -R ${USERNAME}:${USERNAME} /usr/share/postgresql + +RUN chown -R ${USERNAME}:${USERNAME} /usr/bin + +RUN chown -R ${USERNAME}:${USERNAME} /usr/lib/postgresql/share/postgresql/ +RUN chown -R ${USERNAME}:${USERNAME} /usr/share/postgresql/ +RUN chown -R ${USERNAME}:${USERNAME} /usr/lib/postgresql/share/postgresql/contrib/ +RUN chown -R ${USERNAME}:${USERNAME} /usr/lib/postgresql + +RUN chown -R ${USERNAME}:${USERNAME} /etc/postgresql-custom +RUN chown -R ${USERNAME}:${USERNAME} /var/run/postgresql +COPY --chown=${USERNAME}:${USERNAME} ./pg_hba.conf /etc/postgresql/pg_hba.conf + +RUN chmod -R 777 /var/lib/postgresql + +USER 1001 \ No newline at end of file diff --git a/charts/supabase/docker/pg_hba.conf b/charts/supabase/docker/pg_hba.conf new file mode 100644 index 0000000000000000000000000000000000000000..8deff36e28b9bcc65bd4ab8018294cd4833d3351 --- /dev/null +++ b/charts/supabase/docker/pg_hba.conf @@ -0,0 +1,96 @@ +# PostgreSQL Client Authentication Configuration File +# =================================================== +# +# Refer to the "Client Authentication" section in the PostgreSQL +# documentation for a complete description of this file. A short +# synopsis follows. +# +# This file controls: which hosts are allowed to connect, how clients +# are authenticated, which PostgreSQL user names they can use, which +# databases they can access. Records take one of these forms: +# +# local DATABASE USER METHOD [OPTIONS] +# host DATABASE USER ADDRESS METHOD [OPTIONS] +# hostssl DATABASE USER ADDRESS METHOD [OPTIONS] +# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS] +# hostgssenc DATABASE USER ADDRESS METHOD [OPTIONS] +# hostnogssenc DATABASE USER ADDRESS METHOD [OPTIONS] +# +# (The uppercase items must be replaced by actual values.) +# +# The first field is the connection type: "local" is a Unix-domain +# socket, "host" is either a plain or SSL-encrypted TCP/IP socket, +# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a +# non-SSL TCP/IP socket. Similarly, "hostgssenc" uses a +# GSSAPI-encrypted TCP/IP socket, while "hostnogssenc" uses a +# non-GSSAPI socket. +# +# DATABASE can be "all", "sameuser", "samerole", "replication", a +# database name, or a comma-separated list thereof. The "all" +# keyword does not match "replication". Access to replication +# must be enabled in a separate record (see example below). +# +# USER can be "all", a user name, a group name prefixed with "+", or a +# comma-separated list thereof. In both the DATABASE and USER fields +# you can also write a file name prefixed with "@" to include names +# from a separate file. +# +# ADDRESS specifies the set of hosts the record matches. It can be a +# host name, or it is made up of an IP address and a CIDR mask that is +# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that +# specifies the number of significant bits in the mask. A host name +# that starts with a dot (.) matches a suffix of the actual host name. +# Alternatively, you can write an IP address and netmask in separate +# columns to specify the set of hosts. Instead of a CIDR-address, you +# can write "samehost" to match any of the server's own IP addresses, +# or "samenet" to match any address in any subnet that the server is +# directly connected to. +# +# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", +# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". +# Note that "password" sends passwords in clear text; "md5" or +# "scram-sha-256" are preferred since they send encrypted passwords. +# +# OPTIONS are a set of options for the authentication in the format +# NAME=VALUE. The available options depend on the different +# authentication methods -- refer to the "Client Authentication" +# section in the documentation for a list of which options are +# available for which authentication methods. +# +# Database and user names containing spaces, commas, quotes and other +# special characters must be quoted. Quoting one of the keywords +# "all", "sameuser", "samerole" or "replication" makes the name lose +# its special character, and just match a database or username with +# that name. +# +# This file is read on server startup and when the server receives a +# SIGHUP signal. If you edit the file on a running system, you have to +# SIGHUP the server for the changes to take effect, run "pg_ctl reload", +# or execute "SELECT pg_reload_conf()". +# +# Put your actual configuration here +# ---------------------------------- +# +# If you want to allow non-local connections, you need to add more +# "host" records. In that case you will also need to make PostgreSQL +# listen on a non-local interface via the listen_addresses +# configuration parameter, or via the -i or -h command line switches. + +# TYPE DATABASE USER ADDRESS METHOD + +# trust local connections +local all nonroot-pg trust +local all postgres trust +local all supabase_admin scram-sha-256 +local all all peer map=supabase_map +host all all 127.0.0.1/32 trust +host all all ::1/128 trust + +# IPv4 external connections +host all all 10.0.0.0/8 scram-sha-256 +host all all 172.16.0.0/12 scram-sha-256 +host all all 192.168.0.0/16 scram-sha-256 +host all all 0.0.0.0/0 scram-sha-256 + +# IPv6 external connections +host all all ::0/0 scram-sha-256 \ No newline at end of file diff --git a/charts/supabase/docker/pgsodium_getkey b/charts/supabase/docker/pgsodium_getkey new file mode 100644 index 0000000000000000000000000000000000000000..219c49373d59a7d9795534b3e771b671c34c6bb6 --- /dev/null +++ b/charts/supabase/docker/pgsodium_getkey @@ -0,0 +1,15 @@ +#!/bin/bash + +# Script adapted from upstream supabase-postgres +# https://github.com/supabase/postgres/blob/develop/ansible/files/admin_api_scripts/pg_upgrade_pgsodium_getkey.sh + +set -euo pipefail + +KEY_FILE=/opt/bitnami/postgresql/conf/pgsodium_root.key + +# if key file doesn't exist (project previously didn't use pgsodium), generate a new key +if [[ ! -f "${KEY_FILE}" ]]; then + head -c 32 /dev/urandom | od -A n -t x1 | tr -d ' \n' >$KEY_FILE +fi + +cat $KEY_FILE diff --git a/charts/supabase/templates/db/deployment.yaml b/charts/supabase/templates/db/deployment.yaml index 314842ede81a5db873cd8dcab536cfa145b818cb..f6d5089517e6f6059559426c9e00d035874bf5e8 100644 --- a/charts/supabase/templates/db/deployment.yaml +++ b/charts/supabase/templates/db/deployment.yaml @@ -32,15 +32,25 @@ spec: - name: init-db image: "{{ .Values.db.image.repository }}:{{ .Values.db.image.tag | default .Chart.AppVersion }}" imagePullPolicy: IfNotPresent + securityContext: + {{- toYaml .Values.db.securityContext | nindent 12 }} command: ["/bin/sh", "-c"] args: - | + + echo "Creating new PGDATA directory in PVC (for subpath)..." + mkdir -p /var/lib/postgresql/data/postgres-data echo "Copying init scripts into existing image script directory..." cp -r /docker-entrypoint-initdb.d/* /initdb.d/ + # init-scripts cp /custom-init-scripts/98-webhooks.sql /initdb.d/init-scripts/ cp /custom-init-scripts/99-roles.sql /initdb.d/init-scripts/ - cp /custom-init-scripts/99-logs.sql /initdb.d/migrations/ + cp /custom-init-scripts/99-jwt.sql /initdb.d/init-scripts/ + # migrations cp /custom-init-scripts/99-realtime.sql /initdb.d/migrations/ + cp /custom-init-scripts/97-_supabase.sql /initdb.d/migrations/ + cp /custom-init-scripts/99-logs.sql /initdb.d/migrations/ + cp /custom-init-scripts/99-pooler.sql /initdb.d/migrations/ echo "Copying user-defined migration scripts..." cp /custom-migrations/* /initdb.d/migrations/ || echo "Skip migrations" @@ -52,6 +62,10 @@ spec: name: custom-migrations - mountPath: /initdb.d name: initdb-scripts-data + {{- if .Values.db.persistence.enabled }} + - mountPath: /var/lib/postgresql/data + name: postgres-volume + {{- end }} containers: - name: {{ include "supabase.db.name" $ }} securityContext: @@ -170,4 +184,4 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/charts/supabase/templates/db/initdb.config.yaml b/charts/supabase/templates/db/initdb.config.yaml index 25f61ad23fac72cd7b215433d5876a6f24efabd4..aec2e9c684dee94d6f4177cab57c3beefa04cd7a 100644 --- a/charts/supabase/templates/db/initdb.config.yaml +++ b/charts/supabase/templates/db/initdb.config.yaml @@ -15,13 +15,21 @@ data: 99-logs.sql: | \set pguser `echo "$POSTGRES_USER"` + \c _supabase create schema if not exists _analytics; alter schema _analytics owner to :pguser; + \c postgres 99-realtime.sql: | \set pguser `echo "$POSTGRES_USER"` create schema if not exists _realtime; alter schema _realtime owner to :pguser; + 99-pooler.sql: | + \set pguser `echo "$POSTGRES_USER"` + \c _supabase + create schema if not exists _supavisor; + alter schema _supavisor owner to :pguser; + \c postgres 99-roles.sql: | -- NOTE: change to your own passwords for production environments \set pgpass `echo "$POSTGRES_PASSWORD"` @@ -31,6 +39,7 @@ data: ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass'; ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass'; ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass'; + 98-webhooks.sql: | BEGIN; -- Create pg_net extension @@ -240,4 +249,11 @@ data: REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC; GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role; COMMIT; -{{- end }} \ No newline at end of file + + 97-_supabase.sql: | + \set pguser `echo "$POSTGRES_USER"` + CREATE DATABASE _supabase WITH OWNER :pguser; + + + +{{- end }}