SSL to selfhoste supabase postgress?

Artist201 · 2025-12-03T13:08:04.667Z

at first am working on coolify with caddy proxy i have https setup for all domains i have been trying to setup TLS for a few days where i wanted it to be terminated at the proxy level and then continues to the postgres db. but this doesn't seem to work ? here is what i tried to do in caddy file ``` layer4 { :5432 @postgres { tls sni supabasedb.domain.com } route @postgres { tls { connection_policy { alpn postgresql } } proxy { upstream {{upstreams 5432}} } } } ```

A

Artist201OP•12/3/25, 1:08 PM

however this connects fine without ssl.

but if i set the

sslmode

sslmode

sslmode

sslmode to be

required

required

required

required it fails with the error that

server does not support SSL, but SSL was required

server does not support SSL, but SSL was required

server does not support SSL, but SSL was required

server does not support SSL, but SSL was required

so am assuming i should leave tls for postgress to handle but the volume is dynamically being configure isn't it ?
so how am supposed to update the settings to add something like

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

A

Artist201OP•12/3/25, 1:08 PM

compose:

supabase-db:
    image: 'supabase/postgres:15.8.1.085'
    healthcheck:
      test: 'pg_isready -U postgres -h 127.0.0.1'
      interval: 5s
      timeout: 5s
      retries: 10
    depends_on:
      supabase-vector:
        condition: service_healthy
    command:
      - postgres
      - '-c'
      - config_file=/etc/postgresql/postgresql.conf
      - '-c'
      - log_min_messages=fatal
    environment:
      - POSTGRES_HOST=/var/run/postgresql
      - 'PGPORT=${POSTGRES_PORT:-5432}'
      - 'POSTGRES_PORT=${POSTGRES_PORT:-5432}'
      - 'PGPASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'PGDATABASE=${POSTGRES_DB:-postgres}'
      - 'POSTGRES_DB=${POSTGRES_DB:-postgres}'
      - 'JWT_SECRET=${SERVICE_PASSWORD_JWT}'
      - 'JWT_EXP=${JWT_EXPIRY:-3600}'
    volumes:
      - 'supabase-db-data:/var/lib/postgresql/data'
      -
        type: bind
        source: ./volumes/db/realtime.sql
        target: /docker-entrypoint-initdb.d/migrations/99-realtime.sql
      -
        type: bind
        source: ./volumes/db/_supabase.sql
        target: /docker-entrypoint-initdb.d/migrations/97-_supabase.sql
      -
        type: bind
        source: ./volumes/db/pooler.sql
        target: /docker-entrypoint-initdb.d/migrations/99-pooler.sql
      -
        type: bind
        source: ./volumes/db/webhooks.sql
        target: /docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql
      -
        type: bind
        source: ./volumes/db/roles.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-roles.sql
      -
        type: bind
        source: ./volumes/db/jwt.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-jwt.sql
      -
        type: bind
        source: ./volumes/db/logs.sql
        target: /docker-entrypoint-initdb.d/migrations/99-logs.sql
      - 'supabase-db-config:/etc/postgresql-custom'

supabase-db:
    image: 'supabase/postgres:15.8.1.085'
    healthcheck:
      test: 'pg_isready -U postgres -h 127.0.0.1'
      interval: 5s
      timeout: 5s
      retries: 10
    depends_on:
      supabase-vector:
        condition: service_healthy
    command:
      - postgres
      - '-c'
      - config_file=/etc/postgresql/postgresql.conf
      - '-c'
      - log_min_messages=fatal
    environment:
      - POSTGRES_HOST=/var/run/postgresql
      - 'PGPORT=${POSTGRES_PORT:-5432}'
      - 'POSTGRES_PORT=${POSTGRES_PORT:-5432}'
      - 'PGPASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'PGDATABASE=${POSTGRES_DB:-postgres}'
      - 'POSTGRES_DB=${POSTGRES_DB:-postgres}'
      - 'JWT_SECRET=${SERVICE_PASSWORD_JWT}'
      - 'JWT_EXP=${JWT_EXPIRY:-3600}'
    volumes:
      - 'supabase-db-data:/var/lib/postgresql/data'
      -
        type: bind
        source: ./volumes/db/realtime.sql
        target: /docker-entrypoint-initdb.d/migrations/99-realtime.sql
      -
        type: bind
        source: ./volumes/db/_supabase.sql
        target: /docker-entrypoint-initdb.d/migrations/97-_supabase.sql
      -
        type: bind
        source: ./volumes/db/pooler.sql
        target: /docker-entrypoint-initdb.d/migrations/99-pooler.sql
      -
        type: bind
        source: ./volumes/db/webhooks.sql
        target: /docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql
      -
        type: bind
        source: ./volumes/db/roles.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-roles.sql
      -
        type: bind
        source: ./volumes/db/jwt.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-jwt.sql
      -
        type: bind
        source: ./volumes/db/logs.sql
        target: /docker-entrypoint-initdb.d/migrations/99-logs.sql
      - 'supabase-db-config:/etc/postgresql-custom'

supabase-db:
    image: 'supabase/postgres:15.8.1.085'
    healthcheck:
      test: 'pg_isready -U postgres -h 127.0.0.1'
      interval: 5s
      timeout: 5s
      retries: 10
    depends_on:
      supabase-vector:
        condition: service_healthy
    command:
      - postgres
      - '-c'
      - config_file=/etc/postgresql/postgresql.conf
      - '-c'
      - log_min_messages=fatal
    environment:
      - POSTGRES_HOST=/var/run/postgresql
      - 'PGPORT=${POSTGRES_PORT:-5432}'
      - 'POSTGRES_PORT=${POSTGRES_PORT:-5432}'
      - 'PGPASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'PGDATABASE=${POSTGRES_DB:-postgres}'
      - 'POSTGRES_DB=${POSTGRES_DB:-postgres}'
      - 'JWT_SECRET=${SERVICE_PASSWORD_JWT}'
      - 'JWT_EXP=${JWT_EXPIRY:-3600}'
    volumes:
      - 'supabase-db-data:/var/lib/postgresql/data'
      -
        type: bind
        source: ./volumes/db/realtime.sql
        target: /docker-entrypoint-initdb.d/migrations/99-realtime.sql
      -
        type: bind
        source: ./volumes/db/_supabase.sql
        target: /docker-entrypoint-initdb.d/migrations/97-_supabase.sql
      -
        type: bind
        source: ./volumes/db/pooler.sql
        target: /docker-entrypoint-initdb.d/migrations/99-pooler.sql
      -
        type: bind
        source: ./volumes/db/webhooks.sql
        target: /docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql
      -
        type: bind
        source: ./volumes/db/roles.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-roles.sql
      -
        type: bind
        source: ./volumes/db/jwt.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-jwt.sql
      -
        type: bind
        source: ./volumes/db/logs.sql
        target: /docker-entrypoint-initdb.d/migrations/99-logs.sql
      - 'supabase-db-config:/etc/postgresql-custom'

supabase-db:
    image: 'supabase/postgres:15.8.1.085'
    healthcheck:
      test: 'pg_isready -U postgres -h 127.0.0.1'
      interval: 5s
      timeout: 5s
      retries: 10
    depends_on:
      supabase-vector:
        condition: service_healthy
    command:
      - postgres
      - '-c'
      - config_file=/etc/postgresql/postgresql.conf
      - '-c'
      - log_min_messages=fatal
    environment:
      - POSTGRES_HOST=/var/run/postgresql
      - 'PGPORT=${POSTGRES_PORT:-5432}'
      - 'POSTGRES_PORT=${POSTGRES_PORT:-5432}'
      - 'PGPASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
      - 'PGDATABASE=${POSTGRES_DB:-postgres}'
      - 'POSTGRES_DB=${POSTGRES_DB:-postgres}'
      - 'JWT_SECRET=${SERVICE_PASSWORD_JWT}'
      - 'JWT_EXP=${JWT_EXPIRY:-3600}'
    volumes:
      - 'supabase-db-data:/var/lib/postgresql/data'
      -
        type: bind
        source: ./volumes/db/realtime.sql
        target: /docker-entrypoint-initdb.d/migrations/99-realtime.sql
      -
        type: bind
        source: ./volumes/db/_supabase.sql
        target: /docker-entrypoint-initdb.d/migrations/97-_supabase.sql
      -
        type: bind
        source: ./volumes/db/pooler.sql
        target: /docker-entrypoint-initdb.d/migrations/99-pooler.sql
      -
        type: bind
        source: ./volumes/db/webhooks.sql
        target: /docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql
      -
        type: bind
        source: ./volumes/db/roles.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-roles.sql
      -
        type: bind
        source: ./volumes/db/jwt.sql
        target: /docker-entrypoint-initdb.d/init-scripts/99-jwt.sql
      -
        type: bind
        source: ./volumes/db/logs.sql
        target: /docker-entrypoint-initdb.d/migrations/99-logs.sql
      - 'supabase-db-config:/etc/postgresql-custom'

A

Artist201OP•12/3/25, 8:46 PM

so far what i did was

enable ssl through the command routs while mounting the certs inside the container.
this will enable tls but will not enforce it.

we need to modify
pg_hba.conf
so i just mounted it and copied the original while editing adding

hostssl

hostssl

hostssl

hostssl

hostssl  all   all   0.0.0.0/0   md5
hostssl  all   all   ::/0        md5

hostssl  all   all   0.0.0.0/0   md5
hostssl  all   all   ::/0        md5

hostssl  all   all   0.0.0.0/0   md5
hostssl  all   all   ::/0        md5

hostssl  all   all   0.0.0.0/0   md5
hostssl  all   all   ::/0        md5

note that i didn't add the volume for pg_hba until after the first run so the database initilize successfully

however none ssl traffic is still accepted idk why

A

aantti•12/4/25, 8:41 AM

Nice digging

It also looks like the

supabase-db

supabase-db

supabase-db

supabase-db service above doesn't expose Postgres port directly? Default sefl-hosted Docker Compose comes with supavisor on port 5432, and Postgres not externally accessible.

Aaantti Nice digging 🙂 It also looks like the `supabase-db` service above doesn't expos...

A

Artist201OP•12/4/25, 4:14 PM

am i supposed to connect through that ?

A

Artist201OP•12/4/25, 4:15 PM

the template i have didn't have that i just noticed after checking the official one

AArtist201 am i supposed to connect through that ?

A

Artist201OP•12/4/25, 4:16 PM

also does it provide any kind of encryption/protection ?

A

aantti•12/5/25, 10:10 AM

the template i have didn't have that i just noticed after checking the official one

Curious, what's your configuration? Where are you deploying self-hosted Supabase and how? The official Docker Compose guide and configuration cover a configuration with Supavisor. It offers session and transaction mode for connection pooling. The SSL part is somewhat tricky, though.

Aaantti > the template i have didn't have that i just noticed after checking the officia...

A

Artist201OP•12/5/25, 10:18 AM

on my own server using coolify.
howver i modified a lot of things

A

Artist201OP•12/5/25, 10:19 AM

so yeah.. i should have used the supvisor. will try to fix it as soon as i can

A

Artist201OP•12/5/25, 10:20 AM

but is there anyplace to start how to setup ssl ? even if self signed

A

aantti•12/5/25, 11:29 AM

Well, this is embarassing, but I'm trying to figure it out myself re Supavisor + ssl on self-hosted

Easiest would be to use Postgres directly for now, or try to create an alternative pgbouncer service with ssl (e.g., Perplexity offers some reasonable asnwers). I do not have a ready-to-go pgbouncer config + docker compose ready yet, sadly - but been meaning to add this as an option. Last but not least, regarding why non-ssl traffic is still accepted - are the

hostssl

hostssl

hostssl

hostssl the only entries? Also useful - https://www.percona.com/blog/enabling-and-enforcing-ssl-tls-for-postgresql-connections/ and https://richyen.com/postgres/2020/05/15/how-to-spot-an-impostor.html and https://www.prisma.io/dataguide/postgresql/authentication-and-authorization/configuring-user-authentication (maybe try adding

hostnossl

hostnossl

hostnossl

hostnossl explicitly at the top of the pg_hba

)

I

inder•12/5/25, 12:21 PM

I found this PR which adds support for SSL connections downstream. https://github.com/supabase/supavisor/pull/129

Aaantti Well, this is embarassing, but I'm trying to figure it out myself re Supavisor +...

A

Artist201OP•12/6/25, 10:04 AM

i had this

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# Reject all non-SSL TCP connections
host     all   all   0.0.0.0/0   reject
host     all   all   ::/0        reject

# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
hostssl    all             all             127.0.0.1/32            trust
# IPv6 local connections:
hostssl    all             all             ::1/128                 trust
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     trust
hostssl    replication     all             127.0.0.1/32            trust
hostssl    replication     all             ::1/128                 trust

hostssl  all   all   0.0.0.0/0   scram-sha-256
hostssl  all   all   ::/0        scram-sha-256

hostssl    all all all scram-sha-256

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# Reject all non-SSL TCP connections
host     all   all   0.0.0.0/0   reject
host     all   all   ::/0        reject

# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
hostssl    all             all             127.0.0.1/32            trust
# IPv6 local connections:
hostssl    all             all             ::1/128                 trust
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     trust
hostssl    replication     all             127.0.0.1/32            trust
hostssl    replication     all             ::1/128                 trust

hostssl  all   all   0.0.0.0/0   scram-sha-256
hostssl  all   all   ::/0        scram-sha-256

hostssl    all all all scram-sha-256

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# Reject all non-SSL TCP connections
host     all   all   0.0.0.0/0   reject
host     all   all   ::/0        reject

# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
hostssl    all             all             127.0.0.1/32            trust
# IPv6 local connections:
hostssl    all             all             ::1/128                 trust
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     trust
hostssl    replication     all             127.0.0.1/32            trust
hostssl    replication     all             ::1/128                 trust

hostssl  all   all   0.0.0.0/0   scram-sha-256
hostssl  all   all   ::/0        scram-sha-256

hostssl    all all all scram-sha-256

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# Reject all non-SSL TCP connections
host     all   all   0.0.0.0/0   reject
host     all   all   ::/0        reject

# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
hostssl    all             all             127.0.0.1/32            trust
# IPv6 local connections:
hostssl    all             all             ::1/128                 trust
# Allow replication connections from localhost, by a user with the
# replication privilege.
local   replication     all                                     trust
hostssl    replication     all             127.0.0.1/32            trust
hostssl    replication     all             ::1/128                 trust

hostssl  all   all   0.0.0.0/0   scram-sha-256
hostssl  all   all   ::/0        scram-sha-256

hostssl    all all all scram-sha-256

Iinder I found this PR which adds support for SSL connections downstream. https://githu...

A

Artist201OP•12/6/25, 10:09 AM

so i just tested this and yes it works
however it doesn't enforce it

A

Artist201OP•12/6/25, 10:13 AM

a random question
have anyone figured out how to route tcp traffic through caddy behind a cloudflare tunnel.
cause it seems it is only possible to connect to the db from the internet by exposing the IP in dns settings with an A record...

AArtist201 so i just tested this and yes it works however it doesn't enforce it

I

inder•12/6/25, 1:13 PM

I found info about it in supavisor docs.

I

inder•12/6/25, 1:14 PM