Self-Host Supabase: Your Own Open-Source Firebase Alternative in 20 Minutes
Want Firebase's real-time database, authentication, and storage without vendor lock-in or surprise bills? Supabase gives you all that—and it's fully open-source. In this guide, you'll self-host Supabase on your own VPS with Docker, giving you complete control over your data and infrastructure.
Why Self-Host Supabase?
- Data ownership: Your data stays on your servers, not Google's
- No vendor lock-in: PostgreSQL under the hood—migrate anywhere
- Predictable costs: Flat VPS pricing vs. per-operation billing
- Full control: Customize auth, storage, and edge functions
- Privacy compliance: GDPR, HIPAA-ready on your infrastructure
Prerequisites
- VPS with 4+ CPU cores, 8GB+ RAM, 20GB+ SSD (Hetzner CX31 or similar)
- Docker and Docker Compose installed
- Domain pointed to your server (e.g., supabase.yourdomain.com)
- Basic familiarity with PostgreSQL
Step 1: Clone Supabase Docker Setup
git clone --depth 1 https://github.com/supabase/supabase
cd supabase/docker
cp .env.example .env
Step 2: Configure Environment
Edit .env with your settings:
# Database
POSTGRES_PASSWORD=your_secure_db_password
# API Keys (generate random strings)
ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
# Site URL
SITE_URL=https://supabase.yourdomain.com
ADDITIONAL_REDIRECT_URLS=https://yourapp.com
# JWT Secret
JWT_SECRET=your_random_jwt_secret_min_32_chars
Generate keys:
# Generate JWT secret
openssl rand -base64 32
# Generate anon/service keys (use jwt.io with your secret)
# Payload: {"role":"anon"} or {"role":"service_role"}
Step 3: Update Docker Compose
Edit docker-compose.yml to expose Kong (API gateway) properly:
services:
kong:
image: kong:2.8.1
environment:
KONG_DATABASE: "off"
KONG_DECLARATIVE_CONFIG: /var/lib/kong/kong.yml
KONG_DNS_ORDER: LAST,A,CNAME
ports:
- "8000:8000"
volumes:
- ./volumes/api/kong.yml:/var/lib/kong/kong.yml:ro
Step 4: Start Supabase
docker compose up -d
Wait 2-3 minutes for all services to initialize. Check status:
docker compose ps
Step 5: Set Up Reverse Proxy (Traefik/Nginx)
For production, put Supabase behind a reverse proxy with SSL:
# Traefik labels example
labels:
- "traefik.enable=true"
- "traefik.http.routers.supabase.rule=Host(`supabase.yourdomain.com`)"
- "traefik.http.routers.supabase.entrypoints=websecure"
- "traefik.http.routers.supabase.tls.certresolver=letsencrypt"
- "traefik.http.services.supabase.loadbalancer.server.port=8000"
Step 6: Access Supabase Studio
- Studio:
https://supabase.yourdomain.com - Default credentials: Check
.envforDASHBOARD_USERNAMEandDASHBOARD_PASSWORD
Verification Steps
- Check health:
curl https://supabase.yourdomain.com/health - Test API: Create a table in Studio, then query:
curl -H "apikey: YOUR_ANON_KEY" https://supabase.yourdomain.com/rest/v1/your_table - Test auth: Sign up a user via Studio or API
- Check database: Connect with
psql postgresql://postgres:password@localhost:5432/postgres
What's Included?
- PostgreSQL 15: Full database with extensions
- PostgREST: Auto-generated REST API
- GoTrue: Authentication service
- Realtime: WebSocket subscriptions
- Storage: S3-compatible file storage
- Edge Functions: Deno-based serverless functions
- Studio: Web-based admin dashboard
Production Tips
- Backups: Set up nightly
pg_dumpto S3/MinIO - Monitoring: Add Prometheus + Grafana (see our monitoring guide)
- Updates: Pin versions in
docker-compose.yml, test before deploying - Security: Enable fail2ban, restrict Studio to VPN if possible
Next Steps
- Connect your app with Supabase client libraries (JS, Python, Flutter)
- Set up Row Level Security (RLS) policies
- Configure storage buckets with policies
- Deploy edge functions for serverless logic
Related Guides
- Self-Host PostgreSQL: High-Availability Database Cluster
- Self-Host MinIO: S3-Compatible Object Storage
- Self-Host Grafana + Prometheus: Monitor Your Supabase Stack
Questions? Drop a comment or reach out on our Discord.