add new opaque api keys and new auth to self-hosted

docker/.env.example

@@ -15,11 +15,31 @@
 # Postgres
 POSTGRES_PASSWORD=your-super-secret-and-long-postgres-password
 
-# Symmetric encryption key and JWT API keys
+# Legacy symmetric HS256 key
 JWT_SECRET=your-super-secret-jwt-token-with-at-least-32-characters-long
+# Legacy API keys (HS256-signed JWTs)
 ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE
 SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
 
+# Asymmetric key pair (ES256) and opaque API keys
+#
+# Documentation:
+# https://supabase.com/docs/guides/self-hosting/self-hosted-auth-keys
+#
+# To generate:
+# sh ./utils/add-new-auth-keys.sh
+#
+# Opaque API key for client-side use (anon role).
+SUPABASE_PUBLISHABLE_KEY=
+# Opaque API key for server-side use (service_role). Never expose in client code.
+SUPABASE_SECRET_KEY=
+# JSON array of signing JWKs (EC private + legacy symmetric).
+# Used by Auth.
+JWT_KEYS=
+# JWKS for token verification (EC public + legacy symmetric).
+# Used by PostgREST, Realtime, Storage to verify tokens.
+JWT_JWKS=
+
 # Access to Dashboard
 DASHBOARD_USERNAME=supabase
 DASHBOARD_PASSWORD=this_password_is_insecure_and_should_be_updated
@@ -260,12 +280,19 @@ GOOGLE_PROJECT_NUMBER=GOOGLE_PROJECT_NUMBER
 
 
 ############
-# API Proxy - Configuration for the Kong API gateway
+# API gateway
 ############
 
+# Kong configuration variables
 KONG_HTTP_PORT=8000
 KONG_HTTPS_PORT=8443
 
+# Used internally by the API gateway - DO NOT use in any client or server code.
+# Pre-signed ES256 JWT "API key" for anon role.
+ANON_KEY_ASYMMETRIC=
+# Pre-signed ES256 JWT "API key" for service_role.
+SERVICE_ROLE_KEY_ASYMMETRIC=
+
 
 ############
 # imgproxy