SSL Self-Hosting

[mrvillage]

Hello! I'm setting up a self-hosted supabase instance and don't know where to grab the SSL certificate from. Would someone be able to direct me in the right direction? Thanks!

[inian]

Hi @mrvillage, for the self hosted setup you will need to generate a SSL cert for your domain from a CA like LetsEncrypt, Digicert and you can add the cert to Kong. If you are just need this for local development, you can create a self signed certificate. There is more information on how to do this here.

The process is slightly different for setting up SSL for postgres, let me know if you are looking for that

[mrvillage]

Thanks!

[rudolphmax]

@inian How would I assign my self-signed cert to the local supabase servers?

[LazerJesus]

is it really true that in dbless mode kong only accepts ssl certificates if they are HARDCODED into the kong.yaml?
its the only way i was able to get it to work but that seems absurdly bad.

[Stokestack]

Is there any more information available on this? I looked at the recommended Kong documentation, but I can't figure out how to follow those instructions for local Supabase development. I'm baffled by:

5. Upload the certificate and key to Kong. We are creating the SNI entity with the same Admin API request

curl -k -X POST
https://kong.lan:8444/certificates
-H 'Content-Type: multipart/form-data'
-F cert=@./kong.lan.pem
-F key=@./kong.lan.key
-F snis[]=kong.lan

I have no idea how to translate that to putting the certificates somewhere on my local machine.

[swingislee]

Have you solved this problem? I'm having the same confusion now

[Stokestack]

Nope. I gave up on Supabase entirely. Too much undocumented, too many roadblocks that nobody is able or willing to answer questions about. Stuff like this wasted weeks of my time. I wrote my own user-authentication and validation logic, and then got back to work on functionality. Much happier now.

[wittyphantom333]

I agree. While this would be an awesome product to use, the fact that the "open source" version is so broken and missing features of live that its just another one of the companies out there right now that try to use the opensource community to make their product known and succeed, but in such a broken manner that you are better off using their paid for offering. This is becoming the norm in the industry, OpenAI anyone?, and its really sad. So many companies turning their backs on devs that promote their products its turning into a joke.

[ShunL12324]

The easiest way I think is to use Nginx as a reverse proxy:

# In Nginx's config file
server {
    listen 9443 ssl http2;
    server_name xxxxx.com;

    # SSL Configuration
    ........
    location / {
        # Use http since Kong is not configured with SSL
        proxy_pass http://127.0.0.1:8000; 
    ........
}

If you use the same port as Kong (8000 & 8443), you may need to set the Kong container to only listen on 127.0.0.1:

kong:
    .........
    ports:
      - 127.0.0.1:${KONG_HTTP_PORT}:8000/tcp
      - 127.0.0.1:${KONG_HTTPS_PORT}:8443/tcp