[JackWilb]

Why

Released self-hosted deployments use vulnerable Supabase Auth and an aging PG15/S3 stack. Carry the verified upstream deployment and migration merged into dev in #1508 (09b4294f) to main for a bug-fix release, including Supabase's eMudhra TLS fix.

Architecture

The Supabase support files match #1508 at 5dc9fc5b53e9716efb8735ba5744e707bf5b9d81. Deployments use the pinned official self-hosted/v0.8.3 bundle outside the application checkout: Postgres 17, Envoy and Storage 1.81 with local file storage. A mandatory Compose override pins upstream Auth v2.198.0-rc.25 by digest, with Go 1.27.3. The bundle's default stable Auth predates the TLS fix. No custom Auth build remains.

The migration exports all live objects through the original API, checks their checksums/layout before the database upgrade, preserves database object records, and installs versioned files with their HTTP metadata. A guarded copy of the pinned upstream upgrade script preserves the correct encryption volume and saved Auth/GitHub overrides, and stops on required migration failures. Existing secrets, sessions, application data, bucket settings and access policies are retained.

The remaining changes add migration tests to CI and link the canonical instructions. The live browser test uses main's existing unauthorized-access UI before authenticating its retained Designer fixture. Application source and dependencies are unchanged.

User-facing impact

Existing bundled MinIO/pgsty operators must follow MIGRATION.md during a maintenance window. New installations use README.md. A checkout update alone does not change running Supabase containers. Hosted Supabase users do not need this migration.

Validation

• Main's own locked dependencies: Python migration/helper suites 18 passed; focused Supabase unit suites 66 passed; lint, typecheck and production build passed.
• Identical backend support files passed Migrate self-hosted Supabase and fix Auth TLS trust #1508's real Linux/ARM64 Docker rehearsals: 1,219 objects including a 32 MiB recording, all original application records, bucket settings, object bytes/HTTP metadata, access policies and synthetic Vault plaintext; existing Designer/anonymous access and refresh tokens; all 11 upgraded services healthy.
• Full container recreation retained the fixed Auth and data. Coordinated PG15+pgsty rollback, Auth certificate mitigation and applicable Chromium checks passed. Empty original-MinIO migration and rollback also passed. Real interrupted export/copy, disk exhaustion, permission failure, incompatible S3 paths, missing rollback archive and required-SQL failure checks stopped as intended; install retries passed.
• Main's Chromium tests: all five checks passed before and after original-MinIO migration, including the legacy object with no version ID; four applicable checks passed after full recreation and again after the VM reboot. Covered new participant persistence/fresh-context resume, retained answers, unfinished participant continuation, retained Designer authorization/exact JSON+CSV exports and binary operations.
• Native pinned Auth trust store rejected all 12 compromised-chain fixtures and accepted the valid GitHub chain. Mock GitHub code exchange/session issuance passed through Envoy in the shared rehearsal. Real external GitHub OAuth and SMTP are unavailable locally and remain deployment smoke tests.
• Migrate self-hosted Supabase and fix Auth TLS trust #1508's independent final review found no remaining issues and all required exact-head GitHub checks passed. This PR's own CI starts after push and is tracked separately.

Synthetic fixtures used Docker Desktop's Linux VM, Linux-volume paths and native Auth/Postgres images. Full container recreation and an actual Linux VM reboot passed, with all 11 services recovering healthy, 29 current objects and database metadata preserved, matching application/policy/Vault snapshots and working existing sessions. Hardware recording was not exercised. Original MinIO used its cached official server image and a checksum-verified official released client binary packaged locally because the client registry image was unavailable.

Risk and rollout

It is a maintenance-window migration, not an in-place image-tag swap. Preserve coordinated off-deployment database/object/encryption/configuration backups and exact old object-store images; rehearse restoration first. Do not regenerate keys or run fresh setup SQL on an existing deployment.

Storage's schema changes are one-way, so rollback requires coordinated backups and loses later writes. Restoring the old Auth requires the documented temporary certificate mitigation before reopening traffic. File storage requires Linux extended attributes; custom extensions/databases/S3 layouts need separate rehearsal. Verify real GitHub callback and SMTP settings before reopening the deployment. Auth is an explicit release-candidate override until a patched stable replacement is reviewed.

[github-actions]

🪓 PR closed, deleted preview.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T01:11:27.704951Z	4bd5553	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.