---
.../DestinationForm/index.tsx | 10 +-
.../DestinationPanel/DestinationPanel.tsx | 2 +-
.../DestinationTypeSelection.tsx | 15 +-
.../Replication/useIsETLPrivateAlpha.ts | 35 ++-
.../layouts/DatabaseLayout/DatabaseLayout.tsx | 49 +---
.../DatabaseLayout/DatabaseMenu.utils.tsx | 222 +++++++-----------
.../NavigationBar/NavigationBar.utils.tsx | 7 -
7 files changed, 127 insertions(+), 213 deletions(-)
diff --git a/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationForm/index.tsx b/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationForm/index.tsx
index f9291d4db11..3e0c87901ec 100644
--- a/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationForm/index.tsx
+++ b/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationForm/index.tsx
@@ -1,6 +1,6 @@
import { zodResolver } from '@hookform/resolvers/zod'
import { PermissionAction } from '@supabase/shared-types/out/constants'
-import { useFlag, useParams } from 'common'
+import { useParams } from 'common'
import { CreateAnalyticsBucketSheet } from 'components/interfaces/Storage/AnalyticsBuckets/CreateAnalyticsBucketSheet'
import { getKeys, useAPIKeysQuery } from 'data/api-keys/api-keys-query'
import { useProjectSettingsV2Query } from 'data/config/project-settings-v2-query'
@@ -35,6 +35,10 @@ import {
import { Button, DialogSectionSeparator, Form_Shadcn_, SheetFooter, SheetSection } from 'ui'
import * as z from 'zod'
+import {
+ useIsETLBigQueryPrivateAlpha,
+ useIsETLIcebergPrivateAlpha,
+} from '../../useIsETLPrivateAlpha'
import { DestinationType } from '../DestinationPanel.types'
import { AdvancedSettings } from './AdvancedSettings'
import { CREATE_NEW_NAMESPACE } from './DestinationForm.constants'
@@ -75,8 +79,8 @@ export const DestinationForm = ({
const { ref: projectRef } = useParams()
const { setRequestStatus } = usePipelineRequestStatus()
- const etlEnableBigQuery = useFlag('etlEnableBigQuery')
- const etlEnableIceberg = useFlag('etlEnableIceberg')
+ const etlEnableBigQuery = useIsETLBigQueryPrivateAlpha()
+ const etlEnableIceberg = useIsETLIcebergPrivateAlpha()
const { can: canReadAPIKeys } = useAsyncCheckPermissions(PermissionAction.SECRETS_READ, '*')
const [isFormInteracting, setIsFormInteracting] = useState(false)
diff --git a/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationPanel.tsx b/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationPanel.tsx
index 8c2d69d6437..68e51584c9b 100644
--- a/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationPanel.tsx
+++ b/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationPanel.tsx
@@ -7,6 +7,7 @@ import { useEffect } from 'react'
import { toast } from 'sonner'
import {
Button,
+ cn,
DialogSectionSeparator,
Sheet,
SheetContent,
@@ -14,7 +15,6 @@ import {
SheetHeader,
SheetSection,
SheetTitle,
- cn,
} from 'ui'
import { EnableReplicationCallout } from '../EnableReplicationCallout'
diff --git a/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationTypeSelection.tsx b/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationTypeSelection.tsx
index af2328c95e0..58d5350bc95 100644
--- a/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationTypeSelection.tsx
+++ b/apps/studio/components/interfaces/Database/Replication/DestinationPanel/DestinationTypeSelection.tsx
@@ -1,18 +1,17 @@
import { useFlag } from 'common'
import { AnalyticsBucket, BigQuery, Database } from 'icons'
import { parseAsInteger, parseAsStringEnum, useQueryState } from 'nuqs'
-import { Badge, RadioGroupStacked, RadioGroupStackedItem, cn } from 'ui'
+import { Badge, cn, RadioGroupStacked, RadioGroupStackedItem } from 'ui'
import { useDestinationInformation } from '../useDestinationInformation'
-import { useIsETLPrivateAlpha } from '../useIsETLPrivateAlpha'
+import { useIsETLBigQueryPrivateAlpha, useIsETLIcebergPrivateAlpha } from '../useIsETLPrivateAlpha'
import { DestinationType } from './DestinationPanel.types'
import { InlineLink } from '@/components/ui/InlineLink'
export const DestinationTypeSelection = () => {
- const enablePgReplicate = useIsETLPrivateAlpha()
const unifiedReplication = useFlag('unifiedReplication')
- const etlEnableBigQuery = useFlag('etlEnableBigQuery')
- const etlEnableIceberg = useFlag('etlEnableIceberg')
+ const etlEnableBigQuery = useIsETLBigQueryPrivateAlpha()
+ const etlEnableIceberg = useIsETLIcebergPrivateAlpha()
const numberOfTypes = [unifiedReplication, etlEnableBigQuery, etlEnableIceberg].filter(
Boolean
@@ -52,8 +51,8 @@ export const DestinationTypeSelection = () => {
value={destinationType}
onValueChange={(value) => setDestinationType(value as DestinationType)}
className={cn(
- 'grid [&>button>div]:py-4',
- numberOfTypes === 3 ? 'grid-cols-3' : numberOfTypes === 2 ? 'grid-cols-2' : 'grid-cols-1',
+ 'grid [&>button>div]:py-4 grid-cols-3',
+ numberOfTypes === 3 && !editMode ? 'grid-cols-3' : 'grid-cols-2',
'[&>button:first-of-type]:rounded-none [&>button:last-of-type]:rounded-none',
'[&>button:first-of-type]:!rounded-l-lg [&>button:last-of-type]:!rounded-r-lg'
)}
@@ -121,7 +120,7 @@ export const DestinationTypeSelection = () => {
)}
- {destinationType !== 'Read Replica' && enablePgReplicate && (
+ {destinationType !== 'Read Replica' && (
Replication is in alpha. Expect rapid changes and possible breaking updates.{' '}
diff --git a/apps/studio/components/interfaces/Database/Replication/useIsETLPrivateAlpha.ts b/apps/studio/components/interfaces/Database/Replication/useIsETLPrivateAlpha.ts
index 04486c97f74..351d8095e56 100644
--- a/apps/studio/components/interfaces/Database/Replication/useIsETLPrivateAlpha.ts
+++ b/apps/studio/components/interfaces/Database/Replication/useIsETLPrivateAlpha.ts
@@ -2,18 +2,37 @@ import { useFlag } from 'common'
import { useSelectedOrganizationQuery } from 'hooks/misc/useSelectedOrganization'
/**
- * Organization level opt in for ETL private alpha
+ * Organization level opt in for ETL private alpha, there's 2 flags we're using which controls
+ * the individual destination types. Access to the ETL UI (`useIsETLPrivateAlpha`) will just
+ * check if the org has access to at least one of the destination types
*/
-export const useIsETLPrivateAlpha = () => {
+const useIsCurrentOrgInFlagList = (flag: string) => {
+ const flagValue = useFlag(flag)
const { data: organization } = useSelectedOrganizationQuery()
- const etlPrivateAlpha = useFlag('etlPrivateAlpha')
- const privateAlphaOrgSlugs =
- typeof etlPrivateAlpha === 'string'
- ? (etlPrivateAlpha as string).split(',').map((x) => x.trim())
+ const allowedOrgSlugs =
+ typeof flagValue === 'string'
+ ? (flagValue as string).split(',').map((x: string) => x.trim())
: []
- const etlShowForAllProjects = useFlag('etlPrivateAlphaOverride')
+ // [Joshen] Override for to enable for all organizations by setting the flag value as `all`
+ if (allowedOrgSlugs.includes('all')) return true
- return etlShowForAllProjects || privateAlphaOrgSlugs.includes(organization?.slug ?? '')
+ // [Joshen] Otherwise fallback to checking against org slug
+ return allowedOrgSlugs.includes(organization?.slug ?? '')
+}
+
+export const useIsETLBigQueryPrivateAlpha = () => {
+ return useIsCurrentOrgInFlagList('etlEnableBigQueryPrivateAlpha')
+}
+
+export const useIsETLIcebergPrivateAlpha = () => {
+ return useIsCurrentOrgInFlagList('etlEnableIcebergPrivateAlpha')
+}
+
+export const useIsETLPrivateAlpha = () => {
+ const hasAccessToETLBigQuery = useIsCurrentOrgInFlagList('etlEnableBigQueryPrivateAlpha')
+ const hasAccessToETLIceberg = useIsCurrentOrgInFlagList('etlEnableIcebergPrivateAlpha')
+
+ return hasAccessToETLBigQuery || hasAccessToETLIceberg
}
diff --git a/apps/studio/components/layouts/DatabaseLayout/DatabaseLayout.tsx b/apps/studio/components/layouts/DatabaseLayout/DatabaseLayout.tsx
index a7967289937..ae652ef847a 100644
--- a/apps/studio/components/layouts/DatabaseLayout/DatabaseLayout.tsx
+++ b/apps/studio/components/layouts/DatabaseLayout/DatabaseLayout.tsx
@@ -1,60 +1,21 @@
+import { ProductMenu } from 'components/ui/ProductMenu'
+import { withAuth } from 'hooks/misc/withAuth'
import { useRouter } from 'next/router'
import { PropsWithChildren } from 'react'
-import { useIsColumnLevelPrivilegesEnabled } from 'components/interfaces/App/FeaturePreview/FeaturePreviewContext'
-import { useIsETLPrivateAlpha } from 'components/interfaces/Database/Replication/useIsETLPrivateAlpha'
-import { ProductMenu } from 'components/ui/ProductMenu'
-import { useDatabaseExtensionsQuery } from 'data/database-extensions/database-extensions-query'
-import { useProjectAddonsQuery } from 'data/subscriptions/project-addons-query'
-import { useIsFeatureEnabled } from 'hooks/misc/useIsFeatureEnabled'
-import { useSelectedProjectQuery } from 'hooks/misc/useSelectedProject'
-import { withAuth } from 'hooks/misc/withAuth'
import { ProjectLayout } from '../ProjectLayout'
-import { generateDatabaseMenu } from './DatabaseMenu.utils'
+import { useGenerateDatabaseMenu } from './DatabaseMenu.utils'
export interface DatabaseLayoutProps {
title?: string
}
const DatabaseProductMenu = () => {
- const { data: project } = useSelectedProjectQuery()
-
const router = useRouter()
const page = router.pathname.split('/')[4]
+ const menu = useGenerateDatabaseMenu()
- const { data } = useDatabaseExtensionsQuery({
- projectRef: project?.ref,
- connectionString: project?.connectionString,
- })
- const { data: addons } = useProjectAddonsQuery({ projectRef: project?.ref })
-
- const pgNetExtensionExists = (data ?? []).find((ext) => ext.name === 'pg_net') !== undefined
- const pitrEnabled = addons?.selected_addons.find((addon) => addon.type === 'pitr') !== undefined
- const columnLevelPrivileges = useIsColumnLevelPrivilegesEnabled()
- const enablePgReplicate = useIsETLPrivateAlpha()
-
- const {
- databaseReplication: showPgReplicate,
- databaseRoles: showRoles,
- integrationsWrappers: showWrappers,
- } = useIsFeatureEnabled(['database:replication', 'database:roles', 'integrations:wrappers'])
-
- return (
- <>
- ) => {
diff --git a/apps/studio/components/layouts/DatabaseLayout/DatabaseMenu.utils.tsx b/apps/studio/components/layouts/DatabaseLayout/DatabaseMenu.utils.tsx
index 6939c2d6a05..e8a6a4bb1c0 100644
--- a/apps/studio/components/layouts/DatabaseLayout/DatabaseMenu.utils.tsx
+++ b/apps/studio/components/layouts/DatabaseLayout/DatabaseMenu.utils.tsx
@@ -1,163 +1,104 @@
+import { useParams } from 'common'
+import type {
+ ProductMenuGroup,
+ ProductMenuGroupItem,
+} from 'components/ui/ProductMenu/ProductMenu.types'
+import { IS_PLATFORM } from 'lib/constants'
import { ArrowUpRight } from 'lucide-react'
-import type { ProductMenuGroup } from 'components/ui/ProductMenu/ProductMenu.types'
-import type { Project } from 'data/projects/project-detail-query'
-import { IS_PLATFORM } from 'lib/constants'
+import { useIsColumnLevelPrivilegesEnabled } from '@/components/interfaces/App/FeaturePreview/FeaturePreviewContext'
+import { useIsETLPrivateAlpha } from '@/components/interfaces/Database/Replication/useIsETLPrivateAlpha'
+import { useDatabaseExtensionsQuery } from '@/data/database-extensions/database-extensions-query'
+import { useProjectAddonsQuery } from '@/data/subscriptions/project-addons-query'
+import { useIsFeatureEnabled } from '@/hooks/misc/useIsFeatureEnabled'
+import { useSelectedProjectQuery } from '@/hooks/misc/useSelectedProject'
+
+const ExternalLinkIcon =
Date: Tue, 3 Mar 2026 01:41:18 -0800
Subject: [PATCH 10/19] Fix some typos; update passages to conform to style
guide (#43254)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
**YES**
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
N/A
## What is the new behavior?
N/A
## Additional context
N/A
---------
Co-authored-by: Chris Chinchilla
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
.../content/guides/realtime/broadcast.mdx | 54 +++++++++----------
1 file changed, 27 insertions(+), 27 deletions(-)
diff --git a/apps/docs/content/guides/realtime/broadcast.mdx b/apps/docs/content/guides/realtime/broadcast.mdx
index 7fd48580d3e..9d740fcbd06 100644
--- a/apps/docs/content/guides/realtime/broadcast.mdx
+++ b/apps/docs/content/guides/realtime/broadcast.mdx
@@ -10,22 +10,22 @@ You can use Realtime Broadcast to send low-latency messages between users. Messa
The way Broadcast works changes based on the channel you are using:
-- From REST API will receive an HTTP request which then will be sent via WebSocket to connected clients
-- From Client libraries we have an established WebSocket connection and we use that to send a message to the server which then will be sent via WebSocket to connected clients
-- From Database we add a new entry to `realtime.messages` where we have logical replication set to listen for changes which then will be sent via WebSocket to connected clients
+- **REST API**: Receives an HTTP request and then sends a message via WebSocket to connected clients
+- **Client libraries**: Sends a message via WebSocket to the server, and then the server sends a message via WebSocket to connected clients
+- **Database**: Adds a new entry to `realtime.messages` where a logical replication is set to listen for changes, and then sends a message via WebSocket to connected clients
-The public flag (the last argument in `realtime.send(payload, event, topic, is_private))` only affects who can subscribe to the topic not who can read messages from the database.
+The public flag (the last argument in `realtime.send(payload, event, topic, is_private)`) only affects who can subscribe to the topic not who can read messages from the database.
-- Public (false) → Anyone can subscribe to that topic without authentication
-- Private (true) → Only authenticated clients can subscribe to that topic
+- Public (`false`) → Anyone can subscribe to that topic without authentication
+- Private (`true`) → Only authenticated clients can subscribe to that topic
-However, regardless of whether it's public or private, the Realtime service connects to your database as the authenticated Supabase Admin role.
+Regardless if it's public or private, the Realtime service connects to your database as the authenticated Supabase Admin role.
-For Authorization we insert a message and try to read it, and rollback the transaction to verify that the RLS policies set by the user are being respected by the user joining the channel, but this message isn't sent to the user. You can read more about it in the [Authorization docs](/docs/guides/realtime/authorization).
+For Authorization, we insert a message and try to read it, and rollback the transaction to verify that the Row Level Security (RLS) policies set by the user are being respected by the user joining the channel, but this message isn't sent to the user. You can read more about it in [Authorization](/docs/guides/realtime/authorization).
## Subscribe to messages
@@ -132,9 +132,9 @@ In most cases, you can get the correct key from [the Project's **Connect** dialo
-### Receiving Broadcast messages
+### Receive Broadcast messages
-You can provide a callback for the `broadcast` channel to receive messages. This example will receive any `broadcast` messages that are sent to `test-channel`:
+You can receive Broadcast messages by providing a callback to the channel.
-The realtime.send function in the database includes a flag that determines whether the broadcast is private or public, and client channels also have the same configuration. For broadcasts to work correctly, these settings must match a public broadcast will only reach public channels, and a private broadcast will only reach private ones.
+The `realtime.send()` function in the database includes a flag that determines whether the broadcast is private or public, and client channels also have the same configuration. For broadcasts to work correctly, these settings must match. A public broadcast only reaches public channels and a private broadcast only reaches private channels.
-By default, all database broadcasts are private, meaning clients must authenticate to receive them. If the database sends a public message but the client subscribes to a private channel, the message won't be delivered since private channels only accept signed, authenticated messages.
+By default, all database broadcasts are private, meaning clients must authenticate to receive them. If the database sends a public message but the client subscribes to a private channel, the message is not delivered because private channels only accept signed, authenticated messages.
-It's a common use case to broadcast messages when a record is created, updated, or deleted. We provide a helper function specific to this use case, `realtime.broadcast_changes()`. For more details, check out the [Subscribing to Database Changes](/docs/guides/realtime/subscribing-to-database-changes) guide.
+You can use the `realtime.broadcast_changes()` helper function to broadcast messages when a record is created, updated, or deleted. For more details, read [Subscribing to Database Changes](/docs/guides/realtime/subscribing-to-database-changes).
### Broadcast using the REST API
@@ -685,7 +685,7 @@ You can pass configuration options while initializing the Supabase Client.
>
- You can confirm that the Realtime servers have received your message by setting Broadcast's `ack` config to `true`.
+ You can confirm that the Realtime servers have received your message by setting Broadcast's `ack` setting to `true`.
{/* prettier-ignore */}
```js
@@ -881,20 +881,20 @@ You can also send a Broadcast message by making an HTTP request to Realtime serv
### How it works
-Broadcast Changes allows you to trigger messages from your database. To achieve it Realtime is directly reading your WAL (Write Append Log) file using a publication against the `realtime.messages` table so whenever a new insert happens a message is sent to connected users.
+Broadcast Changes allows you to trigger messages from your database. To achieve it, Realtime directly reads your Write-Ahead Log (WAL) file using a publication against the `realtime.messages` table. Whenever a new insert occurs, a message is sent to connected users.
-It uses partitioned tables per day which allows the deletion your previous messages in a performant way by dropping the physical tables of this partitioned table. Tables older than 3 days old are deleted.
+It uses partitioned tables per day, which allows performant deletion of your previous messages by dropping the physical tables of this partitioned table. Tables older than 3 days are deleted.
-Broadcasting from the database works like a client-side broadcast, using WebSockets to send JSON packages. [Realtime Authorization](/docs/guides/realtime/authorization) is required and enabled by default to protect your data.
+Broadcasting from the database works like a client-side broadcast, using WebSockets to send JSON payloads. [Realtime Authorization](/docs/guides/realtime/authorization) is required and enabled by default to protect your data.
-The database broadcast feature provides two functions to help you send messages:
+Broadcast Changes provides two functions to help you send messages:
-- `realtime.send` will insert a message into realtime.messages without a specific format.
-- `realtime.broadcast_changes` will insert a message with the required fields to emit database changes to clients. This helps you set up triggers on your tables to emit changes.
+- `realtime.send()` inserts a message into `realtime.messages` without a specific format.
+- `realtime.broadcast_changes()` inserts a message with the required fields to emit database changes to clients. This helps you set up triggers on your tables to emit changes.
### Broadcasting a message from your database
-The `realtime.send` function provides the most flexibility by allowing you to broadcast messages from your database without a specific format. This allows you to use database broadcast for messages that aren't necessarily tied to the shape of a Postgres row change.
+The `realtime.send()` function provides the most flexibility by allowing you to broadcast messages from your database without a specific format. This allows you to use database broadcast for messages that aren't necessarily tied to the shape of a Postgres row change.
```sql
SELECT realtime.send (
@@ -909,7 +909,7 @@ SELECT realtime.send (
#### Setup realtime authorization
-Realtime Authorization is required and enabled by default. To allow your users to listen to messages from topics, create an RLS (Row Level Security) policy:
+Realtime Authorization is required and enabled by default. To allow your users to listen to messages from topics, create an RLS policy:
```sql
CREATE POLICY "authenticated can receive broadcasts"
@@ -920,13 +920,13 @@ USING ( true );
```
-See the [Realtime Authorization](/docs/guides/realtime/authorization) docs to learn how to set up more specific policies.
+Read [Realtime Authorization](/docs/guides/realtime/authorization) to learn how to set up more specific policies.
#### Set up trigger function
-First, set up a trigger function that uses `realtime.broadcast_changes` to insert an event whenever it is triggered. The event is set up to include data on the schema, table, operation, and field changes that triggered it.
+First, set up a trigger function that uses the `realtime.broadcast_changes()` function to insert an event whenever it is triggered. The event is set up to include data on the schema, table, operation, and field changes that triggered it.
-For this example use case, we want to have a topic with the name `topic:` to which we're going to broadcast events.
+For this example, you're going broadcast events to a topic named `topic:`.
```sql
CREATE OR REPLACE FUNCTION public.your_table_changes()
@@ -948,7 +948,7 @@ END;
$$ LANGUAGE plpgsql;
```
-Of note are the Postgres native trigger special variables used:
+The Postgres native trigger special variables used are:
- `TG_OP` - the operation that triggered the function
- `TG_TABLE_NAME` - the table that caused the trigger
@@ -1000,7 +1000,7 @@ Broadcast Replay enables **private** channels to access messages that were sent
You can configure replay with the following options:
-- **`since`** (Required): The epoch timestamp in milliseconds (e.g., `1697472000000`), specifying the earliest point from which messages should be retrieved.
+- **`since`** (Required): The epoch timestamp in milliseconds (for example, `1697472000000`), specifying the earliest point from which messages should be retrieved.
- **`limit`** (Optional): The number of messages to return. This must be a positive integer, with a maximum value of 25.
Date: Tue, 3 Mar 2026 11:47:50 +0200
Subject: [PATCH 11/19] Blog: Add Timescale to pg_partman migration guide
(#40037)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Blog post on using pg_partman instead of TimescaleDB to prepare for the
upcoming deprecation
## What is the current behavior?
## What is the new behavior?
Blog post to include migration information for those using Timescale
## Additional context
Not to be merged until pg_partman is released in 15 and 17 images
## Summary by CodeRabbit
* **Documentation**
* Added a comprehensive pg_partman guide covering setup, time- and
integer-based partitioning, maintenance, automation, and resources.
* Added a migration guide for moving from TimescaleDB hypertables to
native PostgreSQL partitioning using pg_partman.
* Updated TimescaleDB docs with migration notes and support guidance.
* **New Features**
* Listed pg_partman in the public extensions reference and added
navigation entries linking to the pg_partman guide and migration guide.
✏️ Tip: You can customize this high-level summary in your review
settings.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
.../NavigationMenu.constants.ts | 8 ++
.../guides/database/extensions/pg_partman.mdx | 95 +++++++++++++++
.../database/extensions/timescaledb.mdx | 4 +
.../database/migrating-to-pg-partman.mdx | 113 ++++++++++++++++++
packages/shared-data/extensions.json | 9 ++
5 files changed, 229 insertions(+)
create mode 100644 apps/docs/content/guides/database/extensions/pg_partman.mdx
create mode 100644 apps/docs/content/guides/database/migrating-to-pg-partman.mdx
diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
index 6fca567215c..4cea890356d 100644
--- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
+++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
@@ -1049,6 +1049,10 @@ export const database: NavMenuConstant = {
name: 'Partitioning your tables',
url: '/guides/database/partitions' as `/${string}`,
},
+ {
+ name: 'Migrating to pg_partman',
+ url: '/guides/database/migrating-to-pg-partman' as `/${string}`,
+ },
{
name: 'Managing connections',
url: '/guides/database/connection-management' as `/${string}`,
@@ -1249,6 +1253,10 @@ export const database: NavMenuConstant = {
name: 'pg_net: Async Networking',
url: '/guides/database/extensions/pg_net' as `/${string}`,
},
+ {
+ name: 'pg_partman: Partition management',
+ url: '/guides/database/extensions/pg_partman' as `/${string}`,
+ },
{
name: 'pg_plan_filter: Restrict Total Cost',
url: '/guides/database/extensions/pg_plan_filter' as `/${string}`,
diff --git a/apps/docs/content/guides/database/extensions/pg_partman.mdx b/apps/docs/content/guides/database/extensions/pg_partman.mdx
new file mode 100644
index 00000000000..de2db96c9c0
--- /dev/null
+++ b/apps/docs/content/guides/database/extensions/pg_partman.mdx
@@ -0,0 +1,95 @@
+---
+id: 'pg_partman'
+title: 'pg_partman: partition management'
+description: 'Automated partition management'
+---
+
+[`pg_partman`](https://github.com/pgpartman/pg_partman) is a Postgres extension that automates the creation and maintenance of partitions for tables using Postgres native partitioning.
+
+## Enable the extension
+
+To enable `pg_partman`, create a dedicated schema for it and enable the extension there.
+
+{/* prettier-ignore */}
+```sql
+create schema if not exists partman;
+create extension if not exists pg_partman with schema partman;
+```
+
+## Create a partitioned table
+
+`pg_partman` requires your parent table to already be declared as a partitioned table.
+
+{/* prettier-ignore */}
+```sql
+create table public.messages (
+ id bigint generated by default as identity,
+ sent_at timestamptz not null,
+ sender_id uuid,
+ recipient_id uuid,
+ body text,
+ primary key (sent_at, id)
+)
+partition by range (sent_at);
+```
+
+## Set up partitioning
+
+You configure the parent table using `partman.create_parent()`. The function takes an `ACCESS EXCLUSIVE` lock briefly while it creates the initial partitions.
+
+### Time-based partitions
+
+{/* prettier-ignore */}
+```sql
+select partman.create_parent(
+ p_parent_table := 'public.messages',
+ p_control := 'sent_at',
+ p_type := 'range',
+ p_interval := '7 days',
+ p_premake := 7,
+ p_start_partition := '2025-01-01 00:00:00'
+);
+```
+
+### Integer-based partitions
+
+{/* prettier-ignore */}
+```sql
+create table public.events (
+ id bigint generated by default as identity,
+ inserted_at timestamptz not null default now(),
+ payload jsonb,
+ primary key (id)
+)
+partition by range (id);
+
+select partman.create_parent(
+ p_parent_table := 'public.events',
+ p_control := 'id',
+ p_type := 'range',
+ p_interval := '100000'
+);
+```
+
+## Running maintenance
+
+It’s important to call `pg_partman` maintenance regularly so future partitions are pre-created and retention policies are applied.
+
+{/* prettier-ignore */}
+```sql
+call partman.run_maintenance_proc();
+```
+
+To automate this, schedule it using `pg_cron`.
+
+{/* prettier-ignore */}
+```sql
+create extension if not exists pg_cron;
+
+select
+ cron.schedule('@hourly', $$call partman.run_maintenance_proc()$$);
+```
+
+## Resources
+
+- Official [pg_partman documentation](https://github.com/pgpartman/pg_partman/blob/development/doc/pg_partman.md)
diff --git a/apps/docs/content/guides/database/extensions/timescaledb.mdx b/apps/docs/content/guides/database/extensions/timescaledb.mdx
index 8ca28081578..a3aa0303646 100644
--- a/apps/docs/content/guides/database/extensions/timescaledb.mdx
+++ b/apps/docs/content/guides/database/extensions/timescaledb.mdx
@@ -8,6 +8,10 @@ description: 'Scalable time-series data storage and analysis'
The `timescaledb` extension is deprecated in projects using Postgres 17. It continues to be supported in projects using Postgres 15, but will need to dropped before those projects are upgraded to Postgres 17. See the [Upgrading to Postgres 17 notes](/docs/guides/platform/upgrading#upgrading-to-postgres-17) for more information.
+If you are using hypertables, follow the [migration guide](/docs/guides/database/migrating-to-pg-partman) to convert to native partitioning managed by `pg_partman`.
+
+For additional support, contact our Success team by creating a support ticket in the Supabase Dashboard.
+
[`timescaledb`](https://docs.timescale.com/timescaledb/latest/) is a Postgres extension designed for improved handling of time-series data. It provides a scalable, high-performance solution for storing and querying time-series data on top of a standard Postgres database.
diff --git a/apps/docs/content/guides/database/migrating-to-pg-partman.mdx b/apps/docs/content/guides/database/migrating-to-pg-partman.mdx
new file mode 100644
index 00000000000..55243113dcd
--- /dev/null
+++ b/apps/docs/content/guides/database/migrating-to-pg-partman.mdx
@@ -0,0 +1,113 @@
+---
+id: 'migrating-from-timescaledb-to-pg-partman'
+title: 'Migrate from TimescaleDB to pg_partman'
+description: 'Convert TimescaleDB hypertables to Postgres native partitions managed by pg_partman.'
+---
+
+Starting from Postgres 17, Supabase projects do not have the `timescaledb` extension available. If your project relies on TimescaleDB hypertables, you will need to migrate to standard Postgres tables before upgrading.
+
+This guide shows one approach to migrate a hypertable to a native Postgres partitioned table and optionally configure `pg_partman` to automate ongoing partition maintenance.
+The approach outlined in this guide can also be used for traditional partitioned tables.
+
+## Before you begin
+
+- Test the migration path in a staging environment (for example by creating a copy of your production project or using branching).
+- Review your application for TimescaleDB-specific SQL usage (for example `time_bucket()`, compression policies). Those features are not provided by `pg_partman`.
+
+## Migration overview
+
+1. Create a new partitioned table.
+2. Copy data from the hypertable to the new table.
+3. Swap over and drop the hypertable.
+4. Configure `pg_partman` (optional) and schedule maintenance.
+
+## Example: Migrate `messages` from hypertable to native partitions
+
+This example assumes a `messages` hypertable partitioned by `sent_at`.
+
+### 1. Rename the existing hypertable
+
+This keeps the original data in place while you create a new partitioned table with the original name.
+
+{/* prettier-ignore */}
+```sql
+alter table public.messages rename to ht_messages;
+```
+
+### 2. Create a new partitioned table
+
+When using native partitioning, the partitioning column must be included in any unique index (including the primary key).
+
+{/* prettier-ignore */}
+```sql
+create table public.messages (
+ like public.ht_messages including all,
+ primary key (sent_at, id)
+)
+partition by range (sent_at);
+```
+
+### 3. Copy data into the new table
+
+For large tables, consider copying in batches (for example by time range) during a maintenance window.
+
+{/* prettier-ignore */}
+```sql
+insert into public.messages
+select *
+from public.ht_messages;
+```
+
+### 4. Drop the old hypertable (and TimescaleDB)
+
+Only drop the extension once you’ve migrated all hypertables and no other objects depend on it.
+
+{/* prettier-ignore */}
+```sql
+drop table public.ht_messages;
+
+drop extension if exists timescaledb;
+```
+
+### 5. Configure `pg_partman` (optional)
+
+Enable `pg_partman` and register your table so partitions are created ahead of time.
+
+{/* prettier-ignore */}
+```sql
+create schema if not exists partman;
+create extension if not exists pg_partman with schema partman;
+
+select partman.create_parent(
+ p_parent_table := 'public.messages',
+ p_control := 'sent_at',
+ p_type := 'range',
+ p_interval := '7 days',
+ p_premake := 7,
+ p_start_partition := '2025-01-01 00:00:00'
+);
+```
+
+## Keep partitions up to date
+
+`pg_partman` requires running maintenance to pre-make partitions and apply retention policies.
+
+{/* prettier-ignore */}
+```sql
+call partman.run_maintenance_proc();
+```
+
+To automate this, schedule it with `pg_cron`.
+
+{/* prettier-ignore */}
+```sql
+create extension if not exists pg_cron;
+
+select cron.schedule('@daily', $$call partman.run_maintenance_proc()$$);
+```
+
+## Additional resources
+
+- [Partitioning your tables](/docs/guides/database/partitions).
+- [`pg_partman` documentation](/docs/guides/database/extensions/pg_partman)
+- [`pg_partman` migration guides](https://github.com/pgpartman/pg_partman/blob/development/doc/migrate_to_partman.md)
diff --git a/packages/shared-data/extensions.json b/packages/shared-data/extensions.json
index bbb5378f482..b937f861509 100644
--- a/packages/shared-data/extensions.json
+++ b/packages/shared-data/extensions.json
@@ -278,6 +278,15 @@
"product": "Database Webhooks",
"product_url": "/project/{ref}/integrations/webhooks"
},
+ {
+ "name": "pg_partman",
+ "comment": "Automated partition management",
+ "tags": ["Utility"],
+ "link": "/guides/database/extensions/pg_partman",
+ "github_url": "https://github.com/pgpartman/pg_partman",
+ "product": null,
+ "product_url": null
+ },
{
"name": "pg_prewarm",
"comment": "prewarm relation data",
From efdf6d188b657be6d640d09da7cb4ff405cc8ede Mon Sep 17 00:00:00 2001
From: Joshen Lim
Date: Tue, 3 Mar 2026 18:10:01 +0800
Subject: [PATCH 12/19] Fix auth hooks, enabled state in panel doesnt match
hook state if disabled (#43326)
## Context
If an auth hook is disabled, clicking "Configure hook" will incorrectly
show the enable toggle as true
Date: Tue, 3 Mar 2026 18:14:34 +0800
Subject: [PATCH 13/19] Persist dismissal of table filter bar banner if already
enabled or enabling feature preview (#43323)
## Context
Persists the dismissal of the table filter banner promo if
- Already enabled
- After enabling feature preview
Date: Tue, 3 Mar 2026 11:32:10 +0100
Subject: [PATCH 14/19] docs: add information about storage in oauth app scope
documentation (#43330)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
Recreation of https://github.com/supabase/supabase/pull/39706 as I am
unable to resolve the merge conflict in that PR.
---------
Co-authored-by: Emil Wåreus
---
.../build-a-supabase-oauth-integration/oauth-scopes.mdx | 2 ++
1 file changed, 2 insertions(+)
diff --git a/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx b/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx
index ef13b111f2c..2e749fc4da2 100644
--- a/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx
+++ b/apps/docs/content/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes.mdx
@@ -39,3 +39,5 @@ You can update scopes of your OAuth app at any time, but existing OAuth app user
| `Rest` | `Write` | Update a project's PostgREST configuration |
| `Secrets` | `Read` | Retrieve a project's API keys
Date: Tue, 3 Mar 2026 19:10:23 +0800
Subject: [PATCH 15/19] chore: log drains on Pro Plan (#42435)
---
.../platform/manage-your-usage/log-drains.mdx | 2 +-
.../content/guides/telemetry/log-drains.mdx | 2 +-
.../PausedState/ProjectPausedState.tsx | 30 +++++++++----------
packages/shared-data/plans.ts | 2 +-
packages/shared-data/pricing.ts | 2 +-
5 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx b/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx
index dac00f80c61..fef7ebb55fc 100644
--- a/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx
+++ b/apps/docs/content/guides/platform/manage-your-usage/log-drains.mdx
@@ -36,7 +36,7 @@ Usage is shown as "Log Drain Hours" on your invoice.
### Pricing
-Log Drains are available as a project Add-On for all Team and Enterprise users. Each Log Drain costs
- {isFreePlan ? (
-
-
- ) : (
-
-
- )}
-
{
>
Resume project
+
+ {isFreePlan ? (
+
+
+ ) : (
+
+
+ )}
)}
diff --git a/packages/shared-data/plans.ts b/packages/shared-data/plans.ts
index 0b906209837..b32860d63c5 100644
--- a/packages/shared-data/plans.ts
+++ b/packages/shared-data/plans.ts
@@ -62,6 +62,7 @@ export const plans: PricingInformation[] = [
'Email support',
'Daily backups stored for 7 days',
'7-day log retention',
+ ['Add Log Drains', 'additional $60 per drain, per project'],
],
preface: 'Everything in the Free Plan, plus:',
cta: 'Get Started',
@@ -85,7 +86,6 @@ export const plans: PricingInformation[] = [
'Priority email support & SLAs',
'Daily backups stored for 14 days',
'28-day log retention',
- ['Add Log Drains', 'additional $60 per drain, per project'],
],
preface: 'Everything in the Pro Plan, plus:',
cta: 'Get Started',
diff --git a/packages/shared-data/pricing.ts b/packages/shared-data/pricing.ts
index 495798f6e38..f6ff197a0cb 100644
--- a/packages/shared-data/pricing.ts
+++ b/packages/shared-data/pricing.ts
@@ -590,7 +590,7 @@ export const pricing: Pricing = {
title: 'Log Drain',
plans: {
free: false,
- pro: false,
+ pro: ['$60 per drain per month', '+ $0.20 per million events', '+ $0.09 per GB egress'],
team: ['$60 per drain per month', '+ $0.20 per million events', '+ $0.09 per GB egress'],
enterprise: 'Custom',
},
From bb10862e074cdb918e203537348ac6249d383b94 Mon Sep 17 00:00:00 2001
From: Illia Basalaiev <44750366+Ellba@users.noreply.github.com>
Date: Tue, 3 Mar 2026 12:18:01 +0100
Subject: [PATCH 16/19] chore: update jwt expiration link in the user sessions
docs (#43338)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
This can be customized in your project's Auth settings in the Advanced
Settings section.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
This can be customized in your project's settings in the JWT Keys >
Legacy JWT Secret section.
- /docs/guides/auth/sessions
---
apps/docs/content/guides/auth/sessions.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/apps/docs/content/guides/auth/sessions.mdx b/apps/docs/content/guides/auth/sessions.mdx
index 1b79d9f8d66..c7eac35d2bf 100644
--- a/apps/docs/content/guides/auth/sessions.mdx
+++ b/apps/docs/content/guides/auth/sessions.mdx
@@ -69,7 +69,7 @@ Otherwise sessions are progressively deleted from the database 24 hours after th
### What are recommended values for access token (JWT) expiration?
-Most applications should use the default expiration time of 1 hour. This can be customized in your project's [Auth settings](/dashboard/project/_/settings/jwt) in the Advanced Settings section.
+Most applications should use the default expiration time of 1 hour. This can be customized in your [project's settings](/dashboard/project/_/settings/jwt/legacy) in the JWT Keys > Legacy JWT Secret section.
Setting a value over 1 hour is generally discouraged for security reasons, but it may make sense in certain situations.
From 911eb03498e813c9f13555444cd9440974b4fe33 Mon Sep 17 00:00:00 2001
From: Jordi Enric <37541088+jordienr@users.noreply.github.com>
Date: Tue, 3 Mar 2026 12:20:42 +0100
Subject: [PATCH 17/19] fix: banning / unbanning a user does not update user
pane ban status (#43332)
---
apps/studio/data/auth/user-update-mutation.ts | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/apps/studio/data/auth/user-update-mutation.ts b/apps/studio/data/auth/user-update-mutation.ts
index 986a2416a1e..2c50c824855 100644
--- a/apps/studio/data/auth/user-update-mutation.ts
+++ b/apps/studio/data/auth/user-update-mutation.ts
@@ -1,8 +1,8 @@
import { useMutation, useQueryClient } from '@tanstack/react-query'
-import { toast } from 'sonner'
-
import { handleError, patch } from 'data/fetchers'
+import { toast } from 'sonner'
import type { ResponseError, UseCustomMutationOptions } from 'types'
+
import { authKeys } from './keys'
export type UserUpdateVariables = {
@@ -37,8 +37,11 @@ export const useUserUpdateMutation = ({
return useMutation({
mutationFn: (vars) => updateUser(vars),
async onSuccess(data, variables, context) {
- const { projectRef } = variables
- await queryClient.invalidateQueries({ queryKey: authKeys.usersInfinite(projectRef) })
+ const { projectRef, userId } = variables
+ await Promise.all([
+ queryClient.invalidateQueries({ queryKey: authKeys.usersInfinite(projectRef) }),
+ queryClient.invalidateQueries({ queryKey: authKeys.user(projectRef, userId) }),
+ ])
await onSuccess?.(data, variables, context)
},
async onError(data, variables, context) {
From 997999779f312f184279633a97ed218c8df53ac1 Mon Sep 17 00:00:00 2001
From: "Andrey A." <56412611+aantti@users.noreply.github.com>
Date: Tue, 3 Mar 2026 14:04:35 +0100
Subject: [PATCH 18/19] add caddy and nginx configs for self-hosted
---
docker/.env.example | 19 +++
docker/docker-compose.caddy.yml | 34 ++++++
docker/docker-compose.nginx.yml | 33 ++++++
docker/volumes/proxy/caddy/Caddyfile | 36 ++++++
.../proxy/nginx/supabase-nginx.conf.tpl | 109 ++++++++++++++++++
5 files changed, 231 insertions(+)
create mode 100644 docker/docker-compose.caddy.yml
create mode 100644 docker/docker-compose.nginx.yml
create mode 100644 docker/volumes/proxy/caddy/Caddyfile
create mode 100644 docker/volumes/proxy/nginx/supabase-nginx.conf.tpl
diff --git a/docker/.env.example b/docker/.env.example
index 5fcff319982..3e1e2dc35e6 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -217,3 +217,22 @@ KONG_HTTPS_PORT=8443
# Enable webp support
IMGPROXY_ENABLE_WEBP_DETECTION=true
+
+
+############
+# TLS Proxy - Optional Caddy or Nginx reverse proxy with Let's Encrypt
+############
+
+# Documentation:
+# https://supabase.com/docs/guides/self-hosting/self-hosted-proxy-https
+
+# Usage:
+# docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d
+# docker compose -f docker-compose.yml -f docker-compose.nginx.yml up -d
+
+# Domain name for the proxy (must point to your server)
+PROXY_DOMAIN=your-domain.example.com
+
+# Email for Let's Encrypt certificate notifications (nginx only, Caddy uses PROXY_DOMAIN).
+# This should be a valid email, not a placehoder (otherwise Certbot may fail to start).
+CERTBOT_EMAIL=admin@example.com
diff --git a/docker/docker-compose.caddy.yml b/docker/docker-compose.caddy.yml
new file mode 100644
index 00000000000..b31ee8db586
--- /dev/null
+++ b/docker/docker-compose.caddy.yml
@@ -0,0 +1,34 @@
+services:
+
+ kong:
+ ports: !reset []
+
+ caddy:
+ container_name: supabase-caddy
+ image: caddy:2
+ restart: unless-stopped
+ ports:
+ - "80:80"
+ - "443:443"
+ - "443:443/udp"
+ depends_on:
+ kong:
+ condition: service_healthy
+ environment:
+ PROXY_DOMAIN: ${PROXY_DOMAIN}
+ PROXY_AUTH_USERNAME: ${DASHBOARD_USERNAME}
+ PROXY_AUTH_PASSWORD: ${DASHBOARD_PASSWORD}
+ command:
+ - /bin/sh
+ - -c
+ - |
+ PROXY_AUTH_PASSWORD=$$(caddy hash-password --plaintext "$$PROXY_AUTH_PASSWORD") && \
+ caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
+ volumes:
+ - ./volumes/proxy/caddy:/etc/caddy
+ - caddy_data:/data
+ - caddy_config:/config
+
+volumes:
+ caddy_data:
+ caddy_config:
diff --git a/docker/docker-compose.nginx.yml b/docker/docker-compose.nginx.yml
new file mode 100644
index 00000000000..e693a86aee1
--- /dev/null
+++ b/docker/docker-compose.nginx.yml
@@ -0,0 +1,33 @@
+services:
+
+ kong:
+ ports: !reset []
+
+ nginx:
+ container_name: supabase-nginx
+ image: jonasal/nginx-certbot:6.0.1-nginx1.29.5
+ restart: unless-stopped
+ ports:
+ - "80:80"
+ - "443:443"
+ depends_on:
+ kong:
+ condition: service_healthy
+ environment:
+ PROXY_DOMAIN: ${PROXY_DOMAIN}
+ CERTBOT_EMAIL: ${CERTBOT_EMAIL}
+ PROXY_AUTH_USERNAME: ${DASHBOARD_USERNAME}
+ PROXY_AUTH_PASSWORD: ${DASHBOARD_PASSWORD}
+ command:
+ - /bin/bash
+ - -c
+ - |
+ printf '%s:%s\n' "$${PROXY_AUTH_USERNAME}" "$$(openssl passwd -apr1 "$${PROXY_AUTH_PASSWORD}")" > /etc/nginx/user_conf.d/dashboard-passwd && \
+ envsubst '$${PROXY_DOMAIN}' < /etc/nginx/supabase-nginx.conf.tpl > /etc/nginx/user_conf.d/nginx.conf && \
+ /scripts/start_nginx_certbot.sh
+ volumes:
+ - ./volumes/proxy/nginx/supabase-nginx.conf.tpl:/etc/nginx/supabase-nginx.conf.tpl:ro
+ - nginx_letsencrypt:/etc/letsencrypt
+
+volumes:
+ nginx_letsencrypt:
diff --git a/docker/volumes/proxy/caddy/Caddyfile b/docker/volumes/proxy/caddy/Caddyfile
new file mode 100644
index 00000000000..d76c3ed36f3
--- /dev/null
+++ b/docker/volumes/proxy/caddy/Caddyfile
@@ -0,0 +1,36 @@
+{$PROXY_DOMAIN} {
+ @supabase_api path /auth/v1/* /rest/v1/* /graphql/v1/* /realtime/v1/* /functions/v1/* /mcp
+
+ handle @supabase_api {
+ reverse_proxy kong:8000
+ }
+
+ handle_path /storage/v1/* {
+ # CORS headers for Storage (bypasses Kong, which normally handles CORS)
+ @cors_preflight method OPTIONS
+ handle @cors_preflight {
+ header Access-Control-Allow-Origin *
+ header Access-Control-Allow-Methods "GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS"
+ header Access-Control-Allow-Headers *
+ respond 204
+ }
+
+ header Access-Control-Allow-Origin *
+
+ reverse_proxy storage:5000 {
+ # Required for TUS resumable upload Location headers and S3 signature verification.
+ header_up X-Forwarded-Prefix /{http.request.orig_uri.path.0}/{http.request.orig_uri.path.1}
+ }
+ }
+
+ handle {
+ basic_auth {
+ # PROXY_AUTH_PASSWORD is overwritten with the bcrypt on startup
+ {$PROXY_AUTH_USERNAME} {$PROXY_AUTH_PASSWORD}
+ }
+
+ reverse_proxy studio:3000
+ }
+
+ header -server
+}
diff --git a/docker/volumes/proxy/nginx/supabase-nginx.conf.tpl b/docker/volumes/proxy/nginx/supabase-nginx.conf.tpl
new file mode 100644
index 00000000000..f50f23653c0
--- /dev/null
+++ b/docker/volumes/proxy/nginx/supabase-nginx.conf.tpl
@@ -0,0 +1,109 @@
+upstream kong_upstream {
+ server kong:8000;
+ keepalive 2;
+}
+
+server {
+ listen 443 ssl;
+ listen [::]:443 ssl;
+ http2 on;
+
+ server_name ${PROXY_DOMAIN};
+ server_tokens off;
+
+ proxy_http_version 1.1;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $remote_addr;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Port $server_port;
+
+ ssl_certificate /etc/letsencrypt/live/${PROXY_DOMAIN}/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/${PROXY_DOMAIN}/privkey.pem;
+ ssl_trusted_certificate /etc/letsencrypt/live/${PROXY_DOMAIN}/chain.pem;
+
+ ssl_dhparam /etc/letsencrypt/dhparams/dhparam.pem;
+
+ ssl_session_cache shared:SSL:10m;
+ ssl_session_timeout 10m;
+
+ # Prevent 502 errors from large Supabase auth cookies
+ large_client_header_buffers 4 16k;
+ proxy_buffer_size 128k;
+ proxy_buffers 4 256k;
+ proxy_busy_buffers_size 256k;
+
+ location / {
+ auth_basic "supabase";
+ auth_basic_user_file /etc/nginx/user_conf.d/dashboard-passwd;
+
+ proxy_pass http://studio:3000;
+ }
+
+ location /auth {
+ proxy_pass http://kong_upstream;
+ }
+
+ location /rest {
+ proxy_pass http://kong_upstream;
+ }
+
+ location /realtime/v1/ {
+ proxy_pass http://kong_upstream;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $remote_addr;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Port $server_port;
+
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+
+ proxy_read_timeout 3600s;
+ }
+
+ location /storage/v1/ {
+ proxy_pass http://storage:5000/;
+ proxy_buffering off;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $remote_addr;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Port $server_port;
+
+ # Required for TUS resumable upload Location headers and S3 signature verification.
+ proxy_set_header X-Forwarded-Prefix /storage/v1;
+
+ client_max_body_size 0;
+
+ # CORS headers for Storage (bypasses Kong, which normally handles CORS)
+ if ($request_method = OPTIONS) {
+ add_header 'Access-Control-Allow-Origin' '*';
+ add_header 'Access-Control-Allow-Methods' 'GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS';
+ add_header 'Access-Control-Allow-Headers' '*';
+ add_header 'Content-Length' 0;
+ add_header 'Content-Type' 'text/plain charset=UTF-8';
+ return 204;
+ }
+
+ add_header 'Access-Control-Allow-Origin' '*';
+ }
+
+ location /functions {
+ proxy_pass http://kong_upstream;
+ }
+
+ location /graphql {
+ proxy_pass http://kong_upstream;
+ }
+
+ location /mcp {
+ proxy_pass http://kong_upstream;
+ }
+}
From bdab64e8442ed55a7e4b9f7307ce910cc0254ff1 Mon Sep 17 00:00:00 2001
From: "Andrey A." <56412611+aantti@users.noreply.github.com>
Date: Tue, 3 Mar 2026 14:57:45 +0100
Subject: [PATCH 19/19] chore(docs): add new words to rule003 (#43344)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add a couple of technical terms, and a handful of common brand and
products names to simplify docs submissions.
---
supa-mdx-lint/Rule003Spelling.toml | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/supa-mdx-lint/Rule003Spelling.toml b/supa-mdx-lint/Rule003Spelling.toml
index da1a0cc3c44..7d7bdf8dd6e 100644
--- a/supa-mdx-lint/Rule003Spelling.toml
+++ b/supa-mdx-lint/Rule003Spelling.toml
@@ -51,6 +51,7 @@ allow_list = [
"[Dd]ata[Ff]rames?",
"[Dd]atasets?",
"[Dd]atasources?",
+ "[Dd]atetime",
"[Dd]e facto",
"[Dd]enylists?",
"[Dd]evs?",
@@ -103,6 +104,7 @@ allow_list = [
"[Oo]vercommit(s|ted|ting)?",
"[Pp]arallelization",
"[Pp]arams?",
+ "[Pp]assthrough",
"[Pp]laintext",
"[Pp]olyfill(s|ed)?",
"[Pp]oolers?",
@@ -137,6 +139,7 @@ allow_list = [
"[Tt]radeoffs?",
"[Tt]unneled",
"UncaughtException",
+ "[Uu]ncomment(ing|ed)?",
"[Uu]nlink(ing|s|ed)?",
"[Uu]pserts?",
"[Uu]ptime",
@@ -161,8 +164,10 @@ allow_list = [
"BotFather",
"Brevo",
"bytea",
+ "[Cc]addy",
"CAPTCHA",
"Cartes Bancaires",
+ "[Cc]ertbot",
"ChatGPT",
"Citus",
"ClickHouse",
@@ -210,6 +215,7 @@ allow_list = [
"GraphQL",
"Groonga",
"HackerOne",
+ "[Hh][Aa][Pp]roxy",
"HashiCorp",
"Heroku",
"Homebrew",
@@ -218,6 +224,7 @@ allow_list = [
"HypoPG",
"IdP",
"ImageMagick",
+ "imgproxy",
"Inbucket",
"Inferencer",
"Infisical",
@@ -249,6 +256,7 @@ allow_list = [
"Mailtrap",
"Mansueli",
"Metabase",
+ "[Mm]in[Ii][Oo]",
"Mixpeek",
"Multiplatform",
"MySQL",
@@ -256,6 +264,7 @@ allow_list = [
"Nano",
"Netlify",
"Next.js",
+ "[Nn]ginx",
"NoSQL",
"Node.js",
"Nuxt",
@@ -297,6 +306,7 @@ allow_list = [
"PrivateLink",
"PyIceberg",
"Qodo",
+ "rclone",
"README",
"Redis",
"RedwoodJS",
@@ -313,15 +323,17 @@ allow_list = [
"SecureStore",
"SendGrid",
"Session Timebox",
+ "Snapchat",
"Snaplet",
"Solana",
"SolidJS",
"Spotify",
"Sqitch",
+ "Supabase",
"Supavisor",
"SvelteKit",
"SwiftUI",
- "Supabase",
+ "Reddit",
"Remapper",
"TablePlus",
"TextLocal",
@@ -329,6 +341,7 @@ allow_list = [
"TimescaleDB",
"tmux",
"TooManyChannels",
+ "[Tt]raefik",
"Transformers.js",
"tsquery",
"Twilio",
- )}
-
- {selectedRegion?.name
- ? getDisplayNameForSmartRegion(selectedRegion.name)
- : field.value}
-
+ <>
+ 
-
- {getDisplayNameForSmartRegion(value.name)}
+
+ }
+ >
+