Supabase Traefik Community Setup

To begin the setup, clone the repository using a shallow clone to save time and space, then navigate into the project directory.

git clone --depth 1 https://github.com/supabase-community/supabase-traefik
cd supabase-traefik

To set up Traefik as your reverse proxy:

1. Navigate to the traefik directory.
2. Create a .env file from the example template.
3. Edit the .env file to replace the placeholder values with your specific configuration.
4. Start the Traefik container using Docker Compose.

cd traefik
cp .env.example .env
# Edit .env with your values
docker-compose up -d

To integrate Supabase services with the Traefik network:

1. Clone the official Supabase repository and navigate to the supabase/docker directory.
2. Create a .env file from the example template.
3. Crucial Step: Modify the docker-compose.yml file. For every service you want to expose or connect via Traefik, add the following network configuration:

   networks:
     - supabase

   Note: Ensure the network name matches the network name used by your Traefik setup.
4. Start the Supabase services using Docker Compose.

git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker
cp .env.example .env

# In docker-compose.yml, add this to each service:
# networks:
#   - supabase

docker-compose up -d

To expose the Traefik dashboard through the Traefik reverse proxy itself, you must apply specific labels to the traefik service. This is required if you are not using a fileConfig.yml file.

Key labels include:

• traefik.enable: true: Enables Traefik reverse proxy for the dashboard.
• traefik.http.routers.api.rule: Host("traefik.domain.com"): Defines the subdomain/hostname used to access the dashboard.
• traefik.http.routers.api.entryPoints: https: Specifies the entry point (e.g., https) for the dashboard.
• traefik.http.routers.api.service: api@internal: Enables the internal Traefik API service.

labels:
  traefik.enable: true
  traefik.http.routers.api.rule: Host(`traefik.domain.com`)
  traefik.http.routers.api.entryPoints: https
  traefik.http.routers.api.service: api@internal

When setting up Traefik with Cloudflare DNS challenges, you must provide the following environment variables to allow Traefik to authenticate with the Cloudflare API for SSL certificate issuance:

• CF_DNS_API_TOKEN: Your Cloudflare API token with DNS edit permissions.
• CLOUDFLARE_EMAIL: The email address associated with your Cloudflare account.
• DOMAIN: The root domain you are using for your services (e.g., example.com).

CF_DNS_API_TOKEN='xxx'
CLOUDFLARE_EMAIL='cloudflareEmail@gmail.com'
DOMAIN='domain.com'

The dockersocket service uses tecnativa/docker-socket-proxy to provide a secure way for Traefik to communicate with the Docker daemon.

Environment settings:

• CONTAINERS: 1: Enables access to container information.
• POST: 0: Disables POST requests to ensure the proxy is read-only for security.

Note: This service requires privileged: true and access to /var/run/docker.sock.

dockersocket:
    container_name: dockersocket
    image: tecnativa/docker-socket-proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - supabase
    environment:
      CONTAINERS: 1
      POST: 0
    privileged: true
    restart: unless-stopped

The traefik service uses the following environment variables for Cloudflare DNS integration and domain management. These should be provided in your shell or a .env file:

• CF_DNS_API_TOKEN: Your Cloudflare DNS API token.
• CLOUDFLARE_EMAIL: Your Cloudflare account email.
• DOMAIN: The primary domain used for SSL/DNS configuration.

environment:
  CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
  CLOUDFLARE_EMAIL: ${CLOUDFLARE_EMAIL}
  DOMAIN: ${DOMAIN}