Topics

Supabase•2mo ago

Self-Hosted Supabase Studio with Username and Password. How?

Hello, I want when i try to open self-hosted Supabase Studio to ask me for Username and Password. I have followed this tutorial and made everythning as described but again when i open it, it does not ask me for credentials. Tutorial(from 24:35 - 25:05): https://www.youtube.com/watch?v=wyUr_U6Cma4 Its only 30 secconds. And i have check it several times. Also tried in different browsers, privete window etc. I want to be protected this way, not with authelia. Thank you in advance

YouTube

Complete Guide ⚡️ Supabase Self-Hosted ➕ Custom S3 ➕ Authelia

Supabase self hosted including S3 Storage, Customs Domains and Authelia. 🚨 Important Notes: I got informed on my blog that User Creation via Dashboard wasn't possible and that for some very specific things such as e.g. certain POST requests the Dashboard wasn't 100% working. There were only small things missing (updated in the Blog Articl...

48 Replies

inder•2mo ago

I remember in this video David mentions to comment out username password config in volumes/api/kong.yml. try uncommenting those, restart stack and i believe dashboard should ask you for username password Last I remember it was at the end of the file.

Zoran VelinovOP•2mo ago

I will chek it now Thank you

inder•2mo ago

Just checked, at the end of the file uncomment basic-auth plugin config But make sure you use https after this otherwise your username pass can be seen by anyone in the middle

Zoran VelinovOP•2mo ago

I have also question about fact that some thing all still accesible by serverip:port no matter that i have https domain access but i will open another post for this about basic-auth plugin config To uncoment all:

  ## Protected Dashboard - catch all remaining routes
#  - name: dashboard
#    _comment: 'Studio: /* -> http://studio:3000/*'
#    url: http://studio:3000/
#    routes:
#      - name: dashboard-all
#        strip_path: true
#        paths:
#          - /
#    plugins:
#      - name: cors
#      - name: basic-auth
#        config:
#          hide_credentials: true

  ## Protected Dashboard - catch all remaining routes
#  - name: dashboard
#    _comment: 'Studio: /* -> http://studio:3000/*'
#    url: http://studio:3000/
#    routes:
#      - name: dashboard-all
#        strip_path: true
#        paths:
#          - /
#    plugins:
#      - name: cors
#      - name: basic-auth
#        config:
#          hide_credentials: true

inder•2mo ago

Please wrap code with markdown codeblocks, its hard to read otherwise

Zoran VelinovOP•2mo ago

i am triong just to fin it

inder•2mo ago

Triple backticks, or search markdown codeblocks

Zoran VelinovOP•2mo ago

Done

inder•2mo ago

Are you going with same setup as described in video? Nginx proxy manager in front?

Zoran VelinovOP•2mo ago

Yes

inder•2mo ago

I will have to test this locally first for usage with basic-auth. You can also try setting up an instance with my project https://github.com/singh-inder/supabase-automated-self-host. It defaults to basic-auth but authelia can be specified with a flag.

Zoran VelinovOP•2mo ago

If you can make this test i will really appriciate. Also i will make some test and check your project

inder•2mo ago

Sure, I will test and get back to you soon.

Zoran VelinovOP•2mo ago

Can you just tell me about this:

#    _comment: 'Studio: /* -> http://studio:3000/*' - Here to put my supastudio domain?
#    url: http://studio:3000/ - Here my basic domain?

#    _comment: 'Studio: /* -> http://studio:3000/*' - Here to put my supastudio domain?
#    url: http://studio:3000/ - Here my basic domain?

Thanks

inder•2mo ago

I just need to confirm how he setup routes in nginx proxy manager.

Zoran VelinovOP•2mo ago

ok

inder•2mo ago

@Zoran Velinov How have you configured proxy manager service in docker-compose?

Zoran VelinovOP•2mo ago

just sec

  nginx:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      # These ports are in format <host-port>:<container-port>
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '127.0.0.1:81:81' # Admin Web Port
    volumes:
      - ./nginx-data:/data
      - ./nginx-letsencrypt:/etc/letsencrypt
      - ./nginx-snippets:/snippets:ro
    environment:
      TZ: 'Europe/Berlin'

  nginx:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      # These ports are in format <host-port>:<container-port>
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '127.0.0.1:81:81' # Admin Web Port
    volumes:
      - ./nginx-data:/data
      - ./nginx-letsencrypt:/etc/letsencrypt
      - ./nginx-snippets:/snippets:ro
    environment:
      TZ: 'Europe/Berlin'

inder•2mo ago

I'll guide you acc. to David's setup 1. There is a item in navbar Access Lists. Click on it and create a rule. name it anything you want. Click on satisy any. Then in authorizations, enter your username and password. after this click on save

No description

No description

Zoran VelinovOP•2mo ago

I have done this but no helped

inder•2mo ago

Now run this command and check if user password file was created successully ls -l nginx-data/access There should be a file in this folder. I've just tested basic-auth.

Zoran VelinovOP•2mo ago

ok. let me check just to know i havent touch this. its still commented

inder•2mo ago

Thats ok, acc. to david's setup

Zoran VelinovOP•2mo ago

Zoran VelinovOP•2mo ago

it have only 1

inder•2mo ago

cat it it should be like this <username>:<hashed_password>

Zoran VelinovOP•2mo ago

when i open it it have only one line: admin:and here encripted paasword i mean when i open nano 1

inder•2mo ago

great.

inder•2mo ago

No description

inder•2mo ago

No description

inder•2mo ago

location /storage {
    proxy_pass http://kong:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
 }

location /auth {
    proxy_pass http://kong:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
}


location / {
    auth_basic "Admin";
    auth_basic_user_file /data/access/1;
    proxy_pass http://studio:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
}

location /storage {
    proxy_pass http://kong:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
 }

location /auth {
    proxy_pass http://kong:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
}


location / {
    auth_basic "Admin";
    auth_basic_user_file /data/access/1;
    proxy_pass http://studio:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
}

make sure to save after adding this config Btw, this has to be done in your studio domain config Done?

Zoran VelinovOP•2mo ago

Yes! Just make more test to be sure. Its work like it should. Thank you very much. I own you a drink 🫡

inder•2mo ago

No worries. Make sure to do thorough testing. And the auth location block, I'm not sure if its required but it was present in his config

Zoran VelinovOP•2mo ago

My auth.domain.com now got to authelia login form because i have folowed his tutorial. Probably i will need to remove this proxy

inder•2mo ago

is auth.domain.com supposed to be api route or studio url?

Zoran VelinovOP•2mo ago

auth.domain.com go to Authelia Login Page. After succesfully logint it redirect to supabaseStudio.domain.com

inder•2mo ago

oh ok, so if you don't want it you can remove the config but you should use it for production instance

Zoran VelinovOP•2mo ago

Which want to use for productin? auth.domain.com?

inder•2mo ago

yes you should use authelia when deploying a production instance. 2FA is definitely more secure than basic username pass auth

Zoran VelinovOP•2mo ago

Ok. I have succesfuly implemeted authelia autherization acording his tutorial. I will just need to remove this that you sent me for Advanced tab and put this for authelia i believe because before authelia has worked like this

inder•2mo ago

For authelia you can rely entirely on his tutorial. Basic auth had an issue and that's fixed with the config above

Zoran VelinovOP•2mo ago

Yes. I understand Thank you I am confused little about someting about basic auth. In .env file have lines like: DASHBOARD_USERNAME=username DASHBOARD_PASSWORD=password They are here but they dont work without you code in Advanced for the proxy in Nginx Proxy Manager. Than why they exist in .env file?

inder•2mo ago

This is used by kong. supabase by default also comes with basic-auth but as the supabase studio config is commented out it isn't reachable and nginx is handling it

Zoran VelinovOP•2mo ago

So just to ignore this in env file or to comment them?

inder•2mo ago

its passed here to kong service https://github.com/supabase/supabase/blob/5108f45292108bafed71f9390339a428c5a1d8e7/docker/docker-compose.yml#L86-L87 I'm not sure if kong will throw any errors if this config is not passed to it. You can try it

Zoran VelinovOP•2mo ago

When i comment DASHBOARD_USERNAME and DASHBOARD_PASSWORD in .env its give warnings and errors:

WARN[0000] The "DASHBOARD_USERNAME" variable is not set. Defaulting to a blank string.
WARN[0000] The "DASHBOARD_PASSWORD" variable is not set. Defaulting to a blank string.
supabase-kong  | 2025/11/05 16:09:10 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6
supabase-kong  | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6
supabase-kong  | 2025/11/05 16:09:11 [error] 1#0: init_by_lua error: /usr/local/share/lua/5.1/kong/init.lua:553: error parsing declarative config file /home/kong/kong.yml:
supabase-kong  | in 'basicauth_credentials':
supabase-kong  |   - in entry 1 of 'basicauth_credentials':
supabase-kong  |     in 'username': required field missing
supabase-kong  |     in 'password': required field missing
supabase-kong  | stack traceback:
supabase-kong  |        [C]: in function 'error'
supabase-kong  |        /usr/local/share/lua/5.1/kong/init.lua:553: in function 'init'
supabase-kong  |        init_by_lua:3: in main chunk
supabase-kong  | nginx: [error] init_by_lua error: /usr/local/share/lua/5.1/kong/init.lua:553: error parsing declarative config file /home/kong/kong.yml:
supabase-kong  | in 'basicauth_credentials':
supabase-kong  |   - in entry 1 of 'basicauth_credentials':
supabase-kong  |     in 'username': required field missing
supabase-kong  |     in 'password': required field missing

WARN[0000] The "DASHBOARD_USERNAME" variable is not set. Defaulting to a blank string.
WARN[0000] The "DASHBOARD_PASSWORD" variable is not set. Defaulting to a blank string.
supabase-kong  | 2025/11/05 16:09:10 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6
supabase-kong  | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6
supabase-kong  | 2025/11/05 16:09:11 [error] 1#0: init_by_lua error: /usr/local/share/lua/5.1/kong/init.lua:553: error parsing declarative config file /home/kong/kong.yml:
supabase-kong  | in 'basicauth_credentials':
supabase-kong  |   - in entry 1 of 'basicauth_credentials':
supabase-kong  |     in 'username': required field missing
supabase-kong  |     in 'password': required field missing
supabase-kong  | stack traceback:
supabase-kong  |        [C]: in function 'error'
supabase-kong  |        /usr/local/share/lua/5.1/kong/init.lua:553: in function 'init'
supabase-kong  |        init_by_lua:3: in main chunk
supabase-kong  | nginx: [error] init_by_lua error: /usr/local/share/lua/5.1/kong/init.lua:553: error parsing declarative config file /home/kong/kong.yml:
supabase-kong  | in 'basicauth_credentials':
supabase-kong  |   - in entry 1 of 'basicauth_credentials':
supabase-kong  |     in 'username': required field missing
supabase-kong  |     in 'password': required field missing

With uncomenting it it still have some warnings but not errors, so i hope its ok:

2025/11/05 16:15:49 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6
supabase-kong  | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6

2025/11/05 16:15:49 [warn] 1#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6
supabase-kong  | nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /usr/local/kong/nginx.conf:6

inder•2mo ago

yeah that config is required that's why you get required field missing. You can keep it as it is. And maybe add a comment in env file that currently these values aren't being used or something like that as a note to yourself

Zoran VelinovOP•2mo ago

Yes, yes. Thanks

Supabase gives you the tools, documentation, and community that makes managing databases, authentication, and backend infrastructure a lot less overwhelming.

44KMembers

View on Discord

Did you find this page helpful?