From 9ec6c4f94417611000f6e82a2bd7b7e5c868ff65 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 12:01:55 -0600
Subject: [PATCH 1/9] chore(ui): adjust padding and logo size in Navigation and
 Search components

---
 app/src/components/Navigation.tsx | 6 +++---
 app/src/components/Search.tsx     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/src/components/Navigation.tsx b/app/src/components/Navigation.tsx
index c1f041c..7222374 100644
--- a/app/src/components/Navigation.tsx
+++ b/app/src/components/Navigation.tsx
@@ -23,10 +23,10 @@ const Navigation = () => {
   }, [setGithubStars]);
 
   return (
-    <div className="flex sticky top-0 bg-background/80 backdrop-blur-xs z-10 justify-between items-center p-4 border-b">
+    <div className="flex sticky top-0 bg-background/80 backdrop-blur-xs z-10 justify-between items-center p-2 py-4 lg:p-4 border-b">
       <div className="flex flex-row gap-2 justify-center items-center">
-        <DokployLogo className="w-10 h-10 text-black dark:text-white" />
-        <h1 className="text-2xl font-bold">Dokploy Templates</h1>
+        <DokployLogo className="size-7 lg:size-10 text-black dark:text-white" />
+        <h1 className="text-2xl font-bold hidden lg:block">Dokploy Templates</h1>
       </div>
       <div className="flex flex-row gap-2 justify-center items-center">
         <Button
diff --git a/app/src/components/Search.tsx b/app/src/components/Search.tsx
index 6aa19eb..f95a7ea 100644
--- a/app/src/components/Search.tsx
+++ b/app/src/components/Search.tsx
@@ -44,7 +44,7 @@ const Search = () => {
   }, [uniqueTags, tagSearch]);
 
   return (
-    <div className=" mx-auto p-12  border-b w-full">
+    <div className=" mx-auto p-4 lg:p-12  border-b w-full">
       {/* <h1 className="text-2xl md:text-3xl xl:text-4xl font-bold text-center mb-8">
         Available Templates ({templates?.length || 0})
       </h1> */}
@@ -71,7 +71,7 @@ const Search = () => {
               <XIcon className="absolute end-3 translate-y-3.5 top-1/2 h-5 w-5 text-gray-400" />
             </div>
           ) : (
-            <SearchIcon className="absolute end-3 translate-y-3.5 top-1/2 h-5 w-5 text-gray-400" />
+            <SearchIcon className="absolute end-3 translate-y-2 top-1/2 lg:size-5 size-4 text-gray-400" />
           )}
         </div>
 

From 72a574a85d46af2323f52d6955ef78dbc518d439 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 12:08:51 -0600
Subject: [PATCH 2/9] feat: enhance Supabase template with new routes and
 database configurations

- Added new routes for Realtime, Storage, Edge Functions, Analytics, and Database access.
- Implemented ACL and key-auth plugins for enhanced security.
- Updated database initialization scripts for JWT and role management.
- Improved logging configuration for better observability.
---
 blueprints/supabase/template.yml | 713 ++++++++++++++++++++++++++++++-
 1 file changed, 712 insertions(+), 1 deletion(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index 22bb739..d9595a7 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -180,4 +180,715 @@ config:
               - name: key-auth
                 config:
                   hide_credentials: true
-              - name: request-transformer 
\ No newline at end of file
+              - name: request-transformer
+                config:
+                  add:
+                    headers:
+                      - Content-Profile:graphql_public
+              - name: acl
+                config:
+                  hide_groups_header: true
+                  allow:
+                    - admin
+                    - anon
+
+          ## Secure Realtime routes
+          - name: realtime-v1-ws
+            _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+            url: http://realtime-dev.supabase-realtime:4000/socket
+            protocol: ws
+            routes:
+              - name: realtime-v1-ws
+                strip_path: true
+                paths:
+                  - /realtime/v1/
+            plugins:
+              - name: cors
+              - name: key-auth
+                config:
+                  hide_credentials: false
+              - name: acl
+                config:
+                  hide_groups_header: true
+                  allow:
+                    - admin
+                    - anon
+          - name: realtime-v1-rest
+            _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+            url: http://realtime-dev.supabase-realtime:4000/api
+            protocol: http
+            routes:
+              - name: realtime-v1-rest
+                strip_path: true
+                paths:
+                  - /realtime/v1/api
+            plugins:
+              - name: cors
+              - name: key-auth
+                config:
+                  hide_credentials: false
+              - name: acl
+                config:
+                  hide_groups_header: true
+                  allow:
+                    - admin
+                    - anon
+          ## Storage routes: the storage server manages its own auth
+          - name: storage-v1
+            _comment: 'Storage: /storage/v1/* -> http://storage:5000/*'
+            url: http://storage:5000/
+            routes:
+              - name: storage-v1-all
+                strip_path: true
+                paths:
+                  - /storage/v1/
+            plugins:
+              - name: cors
+
+          ## Edge Functions routes
+          - name: functions-v1
+            _comment: 'Edge Functions: /functions/v1/* -> http://functions:9000/*'
+            url: http://functions:9000/
+            routes:
+              - name: functions-v1-all
+                strip_path: true
+                paths:
+                  - /functions/v1/
+            plugins:
+              - name: cors
+
+          ## Analytics routes
+          - name: analytics-v1
+            _comment: 'Analytics: /analytics/v1/* -> http://logflare:4000/*'
+            url: http://analytics:4000/
+            routes:
+              - name: analytics-v1-all
+                strip_path: true
+                paths:
+                  - /analytics/v1/
+
+          ## Secure Database routes
+          - name: meta
+            _comment: 'pg-meta: /pg/* -> http://pg-meta:8080/*'
+            url: http://meta:8080/
+            routes:
+              - name: meta-all
+                strip_path: true
+                paths:
+                  - /pg/
+            plugins:
+              - name: key-auth
+                config:
+                  hide_credentials: false
+              - name: acl
+                config:
+                  hide_groups_header: true
+                  allow:
+                    - admin
+
+          ## Protected Dashboard - catch all remaining routes
+          - name: dashboard
+            _comment: 'Studio: /* -> http://studio:3000/*'
+            url: http://studio:3000/
+            routes:
+              - name: dashboard-all
+                strip_path: true
+                paths:
+                  - /
+            plugins:
+              - name: cors
+              - name: basic-auth
+                config:
+                  hide_credentials: true 
+    - filePath: /volumes/db/init/data.sql
+      content: |
+        
+    - filePath: /volumes/db/jwt.sql
+      content: |
+        \\set jwt_secret \`echo "$JWT_SECRET"\`
+        \\set jwt_exp \`echo "$JWT_EXP"\`
+
+        ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
+        ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
+    - filePath: /volumes/db/logs.sql
+      content: |
+        \\set pguser \`echo "$POSTGRES_USER"\`
+
+        create schema if not exists _analytics;
+        alter schema _analytics owner to :pguser;
+    - filePath: /volumes/db/realtime.sql
+      content: |
+        \\set pguser \`echo "$POSTGRES_USER"\`
+
+        create schema if not exists _realtime;
+        alter schema _realtime owner to :pguser;
+    - filePath: /volumes/db/roles.sql
+      content: |
+      -- NOTE: change to your own passwords for production environments
+      \\set pgpass \`echo "$POSTGRES_PASSWORD"\`
+
+      ALTER USER authenticator WITH PASSWORD :'pgpass';
+      ALTER USER pgbouncer WITH PASSWORD :'pgpass';
+      ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
+      ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
+      ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
+    - filePath: /volumes/db/webhooks.sql
+      content: |
+        BEGIN;
+          -- Create pg_net extension
+          CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+          -- Create supabase_functions schema
+          CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+          GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+          ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+          -- supabase_functions.migrations definition
+          CREATE TABLE supabase_functions.migrations (
+            version text PRIMARY KEY,
+            inserted_at timestamptz NOT NULL DEFAULT NOW()
+          );
+          -- Initial supabase_functions migration
+          INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+          -- supabase_functions.hooks definition
+          CREATE TABLE supabase_functions.hooks (
+            id bigserial PRIMARY KEY,
+            hook_table_id integer NOT NULL,
+            hook_name text NOT NULL,
+            created_at timestamptz NOT NULL DEFAULT NOW(),
+            request_id bigint
+          );
+          CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+          CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+          COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+          CREATE FUNCTION supabase_functions.http_request()
+            RETURNS trigger
+            LANGUAGE plpgsql
+            AS $function$
+            DECLARE
+              request_id bigint;
+              payload jsonb;
+              url text := TG_ARGV[0]::text;
+              method text := TG_ARGV[1]::text;
+              headers jsonb DEFAULT '{}'::jsonb;
+              params jsonb DEFAULT '{}'::jsonb;
+              timeout_ms integer DEFAULT 1000;
+            BEGIN
+              IF url IS NULL OR url = 'null' THEN
+                RAISE EXCEPTION 'url argument is missing';
+              END IF;
+
+              IF method IS NULL OR method = 'null' THEN
+                RAISE EXCEPTION 'method argument is missing';
+              END IF;
+
+              IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+                headers = '{"Content-Type": "application/json"}'::jsonb;
+              ELSE
+                headers = TG_ARGV[2]::jsonb;
+              END IF;
+
+              IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+                params = '{}'::jsonb;
+              ELSE
+                params = TG_ARGV[3]::jsonb;
+              END IF;
+
+              IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+                timeout_ms = 1000;
+              ELSE
+                timeout_ms = TG_ARGV[4]::integer;
+              END IF;
+
+              CASE
+                WHEN method = 'GET' THEN
+                  SELECT http_get INTO request_id FROM net.http_get(
+                    url,
+                    params,
+                    headers,
+                    timeout_ms
+                  );
+                WHEN method = 'POST' THEN
+                  payload = jsonb_build_object(
+                    'old_record', OLD,
+                    'record', NEW,
+                    'type', TG_OP,
+                    'table', TG_TABLE_NAME,
+                    'schema', TG_TABLE_SCHEMA
+                  );
+
+                  SELECT http_post INTO request_id FROM net.http_post(
+                    url,
+                    payload,
+                    params,
+                    headers,
+                    timeout_ms
+                  );
+                ELSE
+                  RAISE EXCEPTION 'method argument % is invalid', method;
+              END CASE;
+
+              INSERT INTO supabase_functions.hooks
+                (hook_table_id, hook_name, request_id)
+              VALUES
+                (TG_RELID, TG_NAME, request_id);
+
+              RETURN NEW;
+            END
+          $function$;
+          -- Supabase super admin
+          DO
+          $$
+          BEGIN
+            IF NOT EXISTS (
+              SELECT 1
+              FROM pg_roles
+              WHERE rolname = 'supabase_functions_admin'
+            )
+            THEN
+              CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+            END IF;
+          END
+          $$;
+          GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+          GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+          GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+          ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+          ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+          ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+          ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+          GRANT supabase_functions_admin TO postgres;
+          -- Remove unused supabase_pg_net_admin role
+          DO
+          $$
+          BEGIN
+            IF EXISTS (
+              SELECT 1
+              FROM pg_roles
+              WHERE rolname = 'supabase_pg_net_admin'
+            )
+            THEN
+              REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+              DROP OWNED BY supabase_pg_net_admin;
+              DROP ROLE supabase_pg_net_admin;
+            END IF;
+          END
+          $$;
+          -- pg_net grants when extension is already enabled
+          DO
+          $$
+          BEGIN
+            IF EXISTS (
+              SELECT 1
+              FROM pg_extension
+              WHERE extname = 'pg_net'
+            )
+            THEN
+              GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+              ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+              ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+              ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+              ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+              REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+              REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+              GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+              GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+            END IF;
+          END
+          $$;
+          -- Event trigger for pg_net
+          CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+          RETURNS event_trigger
+          LANGUAGE plpgsql
+          AS $$
+          BEGIN
+            IF EXISTS (
+              SELECT 1
+              FROM pg_event_trigger_ddl_commands() AS ev
+              JOIN pg_extension AS ext
+              ON ev.objid = ext.oid
+              WHERE ext.extname = 'pg_net'
+            )
+            THEN
+              GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+              ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+              ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+              ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+              ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+              REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+              REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+              GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+              GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+            END IF;
+          END;
+          $$;
+          COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+          DO
+          $$
+          BEGIN
+            IF NOT EXISTS (
+              SELECT 1
+              FROM pg_event_trigger
+              WHERE evtname = 'issue_pg_net_access'
+            ) THEN
+              CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+              EXECUTE PROCEDURE extensions.grant_pg_net_access();
+            END IF;
+          END
+          $$;
+          INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+          ALTER function supabase_functions.http_request() SECURITY DEFINER;
+          ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+          REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+          GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+        COMMIT;
+    - filePath: /volumes/functions/hello/index.ts
+      content: |
+      // Follow this setup guide to integrate the Deno language server with your editor:
+      // https://deno.land/manual/getting_started/setup_your_environment
+      // This enables autocomplete, go to definition, etc.
+
+      import { serve } from "https://deno.land/std@0.177.1/http/server.ts"
+
+      serve(async () => {
+        return new Response(
+          \`"Hello from Edge Functions!"\`,
+          { headers: { "Content-Type": "application/json" } },
+        )
+      })
+
+      // To invoke:
+      // curl 'http://localhost:<KONG_HTTP_PORT>/functions/v1/hello' \\
+      //   --header 'Authorization: Bearer <anon/service_role API key>'
+    - filePath: /volumes/functions/main/index.ts
+      content: |
+        import { serve } from 'https://deno.land/std@0.131.0/http/server.ts'
+        import * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'
+
+        console.log('main function started')
+
+        const JWT_SECRET = Deno.env.get('JWT_SECRET')
+        const VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'
+
+        function getAuthToken(req: Request) {
+          const authHeader = req.headers.get('authorization')
+          if (!authHeader) {
+            throw new Error('Missing authorization header')
+          }
+          const [bearer, token] = authHeader.split(' ')
+          if (bearer !== 'Bearer') {
+            throw new Error(\`Auth header is not 'Bearer {token}'\`)
+          }
+          return token
+        }
+
+        async function verifyJWT(jwt: string): Promise<boolean> {
+          const encoder = new TextEncoder()
+          const secretKey = encoder.encode(JWT_SECRET)
+          try {
+            await jose.jwtVerify(jwt, secretKey)
+          } catch (err) {
+            console.error(err)
+            return false
+          }
+          return true
+        }
+
+        serve(async (req: Request) => {
+          if (req.method !== 'OPTIONS' && VERIFY_JWT) {
+            try {
+              const token = getAuthToken(req)
+              const isValidJWT = await verifyJWT(token)
+
+              if (!isValidJWT) {
+                return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {
+                  status: 401,
+                  headers: { 'Content-Type': 'application/json' },
+                })
+              }
+            } catch (e) {
+              console.error(e)
+              return new Response(JSON.stringify({ msg: e.toString() }), {
+                status: 401,
+                headers: { 'Content-Type': 'application/json' },
+              })
+            }
+          }
+
+          const url = new URL(req.url)
+          const { pathname } = url
+          const path_parts = pathname.split('/')
+          const service_name = path_parts[1]
+
+          if (!service_name || service_name === '') {
+            const error = { msg: 'missing function name in request' }
+            return new Response(JSON.stringify(error), {
+              status: 400,
+              headers: { 'Content-Type': 'application/json' },
+            })
+          }
+
+          const servicePath = \`/home/deno/functions/\${service_name}\`
+          console.error(\`serving the request with \${servicePath}\`)
+
+          const memoryLimitMb = 150
+          const workerTimeoutMs = 1 * 60 * 1000
+          const noModuleCache = false
+          const importMapPath = null
+          const envVarsObj = Deno.env.toObject()
+          const envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])
+
+          try {
+            const worker = await EdgeRuntime.userWorkers.create({
+              servicePath,
+              memoryLimitMb,
+              workerTimeoutMs,
+              noModuleCache,
+              importMapPath,
+              envVars,
+            })
+            return await worker.fetch(req)
+          } catch (e) {
+            const error = { msg: e.toString() }
+            return new Response(JSON.stringify(error), {
+              status: 500,
+              headers: { 'Content-Type': 'application/json' },
+            })
+          }
+        })
+    - filePath: /volumes/logs/vector.yml
+      content: |
+       api:
+          enabled: true
+          address: 0.0.0.0:9001
+
+        sources:
+          docker_host:
+            type: docker_logs
+            exclude_containers:
+              - supabase-vector
+
+        transforms:
+          project_logs:
+            type: remap
+            inputs:
+              - docker_host
+            source: |-
+              .project = "default"
+              .event_message = del(.message)
+              .appname = del(.container_name)
+              del(.container_created_at)
+              del(.container_id)
+              del(.source_type)
+              del(.stream)
+              del(.label)
+              del(.image)
+              del(.host)
+              del(.stream)
+          router:
+            type: route
+            inputs:
+              - project_logs
+            route:
+              kong: '.appname == "supabase-kong"'
+              auth: '.appname == "supabase-auth"'
+              rest: '.appname == "supabase-rest"'
+              realtime: '.appname == "supabase-realtime"'
+              storage: '.appname == "supabase-storage"'
+              functions: '.appname == "supabase-functions"'
+              db: '.appname == "supabase-db"'
+          # Ignores non nginx errors since they are related with kong booting up
+          kong_logs:
+            type: remap
+            inputs:
+              - router.kong
+            source: |-
+              req, err = parse_nginx_log(.event_message, "combined")
+              if err == null {
+                  .timestamp = req.timestamp
+                  .metadata.request.headers.referer = req.referer
+                  .metadata.request.headers.user_agent = req.agent
+                  .metadata.request.headers.cf_connecting_ip = req.client
+                  .metadata.request.method = req.method
+                  .metadata.request.path = req.path
+                  .metadata.request.protocol = req.protocol
+                  .metadata.response.status_code = req.status
+              }
+              if err != null {
+                abort
+              }
+          # Ignores non nginx errors since they are related with kong booting up
+          kong_err:
+            type: remap
+            inputs:
+              - router.kong
+            source: |-
+              .metadata.request.method = "GET"
+              .metadata.response.status_code = 200
+              parsed, err = parse_nginx_log(.event_message, "error")
+              if err == null {
+                  .timestamp = parsed.timestamp
+                  .severity = parsed.severity
+                  .metadata.request.host = parsed.host
+                  .metadata.request.headers.cf_connecting_ip = parsed.client
+                  url, err = split(parsed.request, " ")
+                  if err == null {
+                      .metadata.request.method = url[0]
+                      .metadata.request.path = url[1]
+                      .metadata.request.protocol = url[2]
+                  }
+              }
+              if err != null {
+                abort
+              }
+          # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.
+          auth_logs:
+            type: remap
+            inputs:
+              - router.auth
+            source: |-
+              parsed, err = parse_json(.event_message)
+              if err == null {
+                  .metadata.timestamp = parsed.time
+                  .metadata = merge!(.metadata, parsed)
+              }
+          # PostgREST logs are structured so we separate timestamp from message using regex
+          rest_logs:
+            type: remap
+            inputs:
+              - router.rest
+            source: |-
+              parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')
+              if err == null {
+                  .event_message = parsed.msg
+                  .timestamp = to_timestamp!(parsed.time)
+                  .metadata.host = .project
+              }
+          # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)
+          realtime_logs:
+            type: remap
+            inputs:
+              - router.realtime
+            source: |-
+              .metadata.project = del(.project)
+              .metadata.external_id = .metadata.project
+              parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')
+              if err == null {
+                  .event_message = parsed.msg
+                  .metadata.level = parsed.level
+              }
+          # Storage logs may contain json objects so we parse them for completeness
+          storage_logs:
+            type: remap
+            inputs:
+              - router.storage
+            source: |-
+              .metadata.project = del(.project)
+              .metadata.tenantId = .metadata.project
+              parsed, err = parse_json(.event_message)
+              if err == null {
+                  .event_message = parsed.msg
+                  .metadata.level = parsed.level
+                  .metadata.timestamp = parsed.time
+                  .metadata.context[0].host = parsed.hostname
+                  .metadata.context[0].pid = parsed.pid
+              }
+          # Postgres logs some messages to stderr which we map to warning severity level
+          db_logs:
+            type: remap
+            inputs:
+              - router.db
+            source: |-
+              .metadata.host = "db-default"
+              .metadata.parsed.timestamp = .timestamp
+
+              parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)
+
+              if err != null || parsed == null {
+                .metadata.parsed.error_severity = "info"
+              }
+              if parsed != null {
+              .metadata.parsed.error_severity = parsed.level
+              }
+              if .metadata.parsed.error_severity == "info" {
+                  .metadata.parsed.error_severity = "log"
+              }
+              .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
+
+        sinks:
+          logflare_auth:
+            type: 'http'
+            inputs:
+              - auth_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_realtime:
+            type: 'http'
+            inputs:
+              - realtime_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_rest:
+            type: 'http'
+            inputs:
+              - rest_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_db:
+            type: 'http'
+            inputs:
+              - db_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            # We must route the sink through kong because ingesting logs before logflare is fully initialised will
+            # lead to broken queries from studio. This works by the assumption that containers are started in the
+            # following order: vector > db > logflare > kong
+            uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_functions:
+            type: 'http'
+            inputs:
+              - router.functions
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_storage:
+            type: 'http'
+            inputs:
+              - storage_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_kong:
+            type: 'http'
+            inputs:
+              - kong_logs
+              - kong_err
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+        
+         

From 4d5eddd1d4a5e73d777e27bd555af289faf1cf81 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 12:12:54 -0600
Subject: [PATCH 3/9] fix: update password handling in Supabase template SQL
 scripts

- Changed password setting syntax to use single quotes for consistency.
- Ensured the password echo command is correctly formatted for production environments.
---
 blueprints/supabase/template.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index d9595a7..a36e028 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -324,14 +324,14 @@ config:
         alter schema _realtime owner to :pguser;
     - filePath: /volumes/db/roles.sql
       content: |
-      -- NOTE: change to your own passwords for production environments
-      \\set pgpass \`echo "$POSTGRES_PASSWORD"\`
+        -- NOTE: change to your own passwords for production environments
+        \set pgpass '$(echo "$POSTGRES_PASSWORD")'
 
-      ALTER USER authenticator WITH PASSWORD :'pgpass';
-      ALTER USER pgbouncer WITH PASSWORD :'pgpass';
-      ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
-      ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
-      ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
+        ALTER USER authenticator WITH PASSWORD :'pgpass';
+        ALTER USER pgbouncer WITH PASSWORD :'pgpass';
+        ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
+        ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
+        ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
     - filePath: /volumes/db/webhooks.sql
       content: |
         BEGIN;

From 1b20dd74d13c9519db21e27d2d6904f2b8c3d11d Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 12:15:21 -0600
Subject: [PATCH 4/9] refactor: clean up Deno function and logging URIs in
 Supabase template

- Reformatted Deno function response and improved readability.
- Updated logging URIs to use consistent string interpolation syntax.
- Ensured error messages and log paths are correctly formatted for clarity.
---
 blueprints/supabase/template.yml | 48 ++++++++++++++++----------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index a36e028..4e9292b 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -544,22 +544,22 @@ config:
         COMMIT;
     - filePath: /volumes/functions/hello/index.ts
       content: |
-      // Follow this setup guide to integrate the Deno language server with your editor:
-      // https://deno.land/manual/getting_started/setup_your_environment
-      // This enables autocomplete, go to definition, etc.
+        // Follow this setup guide to integrate the Deno language server with your editor:
+        // https://deno.land/manual/getting_started/setup_your_environment
+        // This enables autocomplete, go to definition, etc.
 
-      import { serve } from "https://deno.land/std@0.177.1/http/server.ts"
+        import { serve } from "https://deno.land/std@0.177.1/http/server.ts"
 
-      serve(async () => {
-        return new Response(
-          \`"Hello from Edge Functions!"\`,
-          { headers: { "Content-Type": "application/json" } },
-        )
-      })
+        serve(async () => {
+          return new Response(
+            `"Hello from Edge Functions!"`,
+            { headers: { "Content-Type": "application/json" } }
+          )
+        })
 
-      // To invoke:
-      // curl 'http://localhost:<KONG_HTTP_PORT>/functions/v1/hello' \\
-      //   --header 'Authorization: Bearer <anon/service_role API key>'
+        // To invoke:
+        // curl 'http://localhost:<KONG_HTTP_PORT>/functions/v1/hello' \
+        //   --header 'Authorization: Bearer <anon/service_role API key>'
     - filePath: /volumes/functions/main/index.ts
       content: |
         import { serve } from 'https://deno.land/std@0.131.0/http/server.ts'
@@ -577,7 +577,7 @@ config:
           }
           const [bearer, token] = authHeader.split(' ')
           if (bearer !== 'Bearer') {
-            throw new Error(\`Auth header is not 'Bearer {token}'\`)
+            throw new Error(`Auth header is not 'Bearer {token}'`)
           }
           return token
         }
@@ -628,8 +628,8 @@ config:
             })
           }
 
-          const servicePath = \`/home/deno/functions/\${service_name}\`
-          console.error(\`serving the request with \${servicePath}\`)
+          const servicePath = `/home/deno/functions/${service_name}`
+          console.error(`serving the request with ${servicePath}`)
 
           const memoryLimitMb = 150
           const workerTimeoutMs = 1 * 60 * 1000
@@ -772,7 +772,7 @@ config:
             source: |-
               .metadata.project = del(.project)
               .metadata.external_id = .metadata.project
-              parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')
+              parsed, err = parse_regex(.event_message, r'^(?P<time>\d+:\d+:\d+\.\d+) \[(?P<level>\w+)\\] (?P<msg>.*)$')
               if err == null {
                   .event_message = parsed.msg
                   .metadata.level = parsed.level
@@ -825,7 +825,7 @@ config:
             method: 'post'
             request:
               retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
           logflare_realtime:
             type: 'http'
             inputs:
@@ -835,7 +835,7 @@ config:
             method: 'post'
             request:
               retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
           logflare_rest:
             type: 'http'
             inputs:
@@ -845,7 +845,7 @@ config:
             method: 'post'
             request:
               retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
           logflare_db:
             type: 'http'
             inputs:
@@ -858,7 +858,7 @@ config:
             # We must route the sink through kong because ingesting logs before logflare is fully initialised will
             # lead to broken queries from studio. This works by the assumption that containers are started in the
             # following order: vector > db > logflare > kong
-            uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
           logflare_functions:
             type: 'http'
             inputs:
@@ -868,7 +868,7 @@ config:
             method: 'post'
             request:
               retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
           logflare_storage:
             type: 'http'
             inputs:
@@ -878,7 +878,7 @@ config:
             method: 'post'
             request:
               retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
           logflare_kong:
             type: 'http'
             inputs:
@@ -889,6 +889,6 @@ config:
             method: 'post'
             request:
               retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=\${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
         
          

From c358d824fd6ae5579224827a2344264703c362b5 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 12:24:53 -0600
Subject: [PATCH 5/9] refactor: standardize indentation and formatting in
 Supabase template logging configuration

- Adjusted indentation for better readability.
- Reformatted logging sink configurations for consistency and clarity.
---
 blueprints/supabase/template.yml | 152 +++++++++++++++----------------
 1 file changed, 76 insertions(+), 76 deletions(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index 4e9292b..e42bbd8 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -658,7 +658,7 @@ config:
         })
     - filePath: /volumes/logs/vector.yml
       content: |
-       api:
+        api:
           enabled: true
           address: 0.0.0.0:9001
 
@@ -815,80 +815,80 @@ config:
               }
               .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
 
-        sinks:
-          logflare_auth:
-            type: 'http'
-            inputs:
-              - auth_logs
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-          logflare_realtime:
-            type: 'http'
-            inputs:
-              - realtime_logs
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-          logflare_rest:
-            type: 'http'
-            inputs:
-              - rest_logs
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-          logflare_db:
-            type: 'http'
-            inputs:
-              - db_logs
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            # We must route the sink through kong because ingesting logs before logflare is fully initialised will
-            # lead to broken queries from studio. This works by the assumption that containers are started in the
-            # following order: vector > db > logflare > kong
-            uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-          logflare_functions:
-            type: 'http'
-            inputs:
-              - router.functions
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-          logflare_storage:
-            type: 'http'
-            inputs:
-              - storage_logs
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-          logflare_kong:
-            type: 'http'
-            inputs:
-              - kong_logs
-              - kong_err
-            encoding:
-              codec: 'json'
-            method: 'post'
-            request:
-              retry_max_duration_secs: 10
-            uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          sinks:
+            logflare_auth:
+              type: 'http'
+              inputs:
+                - auth_logs
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            logflare_realtime:
+              type: 'http'
+              inputs:
+                - realtime_logs
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            logflare_rest:
+              type: 'http'
+              inputs:
+                - rest_logs
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            logflare_db:
+              type: 'http'
+              inputs:
+                - db_logs
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              # We must route the sink through kong because ingesting logs before logflare is fully initialised will
+              # lead to broken queries from studio. This works by the assumption that containers are started in the
+              # following order: vector > db > logflare > kong
+              uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            logflare_functions:
+              type: 'http'
+              inputs:
+                - router.functions
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            logflare_storage:
+              type: 'http'
+              inputs:
+                - storage_logs
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            logflare_kong:
+              type: 'http'
+              inputs:
+                - kong_logs
+                - kong_err
+              encoding:
+                codec: 'json'
+              method: 'post'
+              request:
+                retry_max_duration_secs: 10
+              uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
         
          

From 20e3889d4cde6c426b7981ea459e93b9bb1d5158 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 12:47:06 -0600
Subject: [PATCH 6/9] refactor: improve formatting and consistency in Supabase
 template logging configuration

- Added a blank line for better separation in the configuration.
- Corrected regex pattern formatting for clarity.
- Ensured consistent indentation for logging sink configurations.
---
 blueprints/supabase/template.yml | 154 ++++++++++++++++---------------
 1 file changed, 78 insertions(+), 76 deletions(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index e42bbd8..c1c932c 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -658,6 +658,7 @@ config:
         })
     - filePath: /volumes/logs/vector.yml
       content: |
+        
         api:
           enabled: true
           address: 0.0.0.0:9001
@@ -772,7 +773,7 @@ config:
             source: |-
               .metadata.project = del(.project)
               .metadata.external_id = .metadata.project
-              parsed, err = parse_regex(.event_message, r'^(?P<time>\d+:\d+:\d+\.\d+) \[(?P<level>\w+)\\] (?P<msg>.*)$')
+              parsed, err = parse_regex(.event_message, r'^(?P<time>\d+:\d+:\d+\.\d+) \[(?P<level>\w+)\] (?P<msg>.*)$')
               if err == null {
                   .event_message = parsed.msg
                   .metadata.level = parsed.level
@@ -815,80 +816,81 @@ config:
               }
               .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
 
-          sinks:
-            logflare_auth:
-              type: 'http'
-              inputs:
-                - auth_logs
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-            logflare_realtime:
-              type: 'http'
-              inputs:
-                - realtime_logs
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-            logflare_rest:
-              type: 'http'
-              inputs:
-                - rest_logs
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-            logflare_db:
-              type: 'http'
-              inputs:
-                - db_logs
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              # We must route the sink through kong because ingesting logs before logflare is fully initialised will
-              # lead to broken queries from studio. This works by the assumption that containers are started in the
-              # following order: vector > db > logflare > kong
-              uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-            logflare_functions:
-              type: 'http'
-              inputs:
-                - router.functions
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-            logflare_storage:
-              type: 'http'
-              inputs:
-                - storage_logs
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
-            logflare_kong:
-              type: 'http'
-              inputs:
-                - kong_logs
-                - kong_err
-              encoding:
-                codec: 'json'
-              method: 'post'
-              request:
-                retry_max_duration_secs: 10
-              uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+        sinks:
+          logflare_auth:
+            type: 'http'
+            inputs:
+              - auth_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_realtime:
+            type: 'http'
+            inputs:
+              - realtime_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_rest:
+            type: 'http'
+            inputs:
+              - rest_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_db:
+            type: 'http'
+            inputs:
+              - db_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            # We must route the sink through kong because ingesting logs before logflare is fully initialised will
+            # lead to broken queries from studio. This works by the assumption that containers are started in the
+            # following order: vector > db > logflare > kong
+            uri: 'http://kong:8000/analytics/v1/api/logs?source_name=postgres.logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_functions:
+            type: 'http'
+            inputs:
+              - router.functions
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_storage:
+            type: 'http'
+            inputs:
+              - storage_logs
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+          logflare_kong:
+            type: 'http'
+            inputs:
+              - kong_logs
+              - kong_err
+            encoding:
+              codec: 'json'
+            method: 'post'
+            request:
+              retry_max_duration_secs: 10
+            uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod&api_key=${LOGFLARE_API_KEY?LOGFLARE_API_KEY is required}'
+            
         
          

From 0b41b1513d3c82aceef5ec31ecdda79c242d0850 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 13:10:41 -0600
Subject: [PATCH 7/9] fix: correct password handling syntax in Supabase
 template SQL scripts

- Updated the password setting syntax to use backticks for command substitution.
- Ensured the echo command for the POSTGRES_PASSWORD variable is correctly formatted for production environments.
---
 blueprints/supabase/template.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index c1c932c..0910d4e 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -325,7 +325,7 @@ config:
     - filePath: /volumes/db/roles.sql
       content: |
         -- NOTE: change to your own passwords for production environments
-        \set pgpass '$(echo "$POSTGRES_PASSWORD")'
+        \\set pgpass \`echo "$POSTGRES_PASSWORD"\`
 
         ALTER USER authenticator WITH PASSWORD :'pgpass';
         ALTER USER pgbouncer WITH PASSWORD :'pgpass';

From e422bf9ecdd6401287eca3a3c73936a50818320f Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 13:13:14 -0600
Subject: [PATCH 8/9] fix: correct password handling syntax in Supabase
 template SQL scripts

- Updated the password setting syntax to use backticks for command substitution.
- Ensured the echo command for the POSTGRES_PASSWORD variable is correctly formatted.
---
 blueprints/supabase/template.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index 0910d4e..61917b8 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -325,7 +325,7 @@ config:
     - filePath: /volumes/db/roles.sql
       content: |
         -- NOTE: change to your own passwords for production environments
-        \\set pgpass \`echo "$POSTGRES_PASSWORD"\`
+        \set pgpass `echo "$POSTGRES_PASSWORD"`
 
         ALTER USER authenticator WITH PASSWORD :'pgpass';
         ALTER USER pgbouncer WITH PASSWORD :'pgpass';

From a3d3c32112db7f482cea20ba3b028f0388cfd920 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sat, 15 Mar 2025 13:16:06 -0600
Subject: [PATCH 9/9] fix: standardize command substitution syntax in Supabase
 template SQL scripts

- Updated command substitution syntax to use backticks consistently across SQL scripts.
- Ensured proper formatting for JWT and PostgreSQL user settings.
---
 blueprints/supabase/template.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/blueprints/supabase/template.yml b/blueprints/supabase/template.yml
index 61917b8..802dec8 100644
--- a/blueprints/supabase/template.yml
+++ b/blueprints/supabase/template.yml
@@ -305,20 +305,20 @@ config:
         
     - filePath: /volumes/db/jwt.sql
       content: |
-        \\set jwt_secret \`echo "$JWT_SECRET"\`
-        \\set jwt_exp \`echo "$JWT_EXP"\`
+        \set jwt_secret `echo "$JWT_SECRET"`
+        \set jwt_exp `echo "$JWT_EXP"`
 
         ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
         ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
     - filePath: /volumes/db/logs.sql
       content: |
-        \\set pguser \`echo "$POSTGRES_USER"\`
+        \set pguser `echo "$POSTGRES_USER"`
 
         create schema if not exists _analytics;
         alter schema _analytics owner to :pguser;
     - filePath: /volumes/db/realtime.sql
       content: |
-        \\set pguser \`echo "$POSTGRES_USER"\`
+        \set pguser `echo "$POSTGRES_USER"`
 
         create schema if not exists _realtime;
         alter schema _realtime owner to :pguser;