@simplehomelab/deployrr 6.0.0-rc3

package/apps/official/supabase/files/pre-install.sh

@@ -0,0 +1,201 @@
+#!/bin/bash
+# Supabase Pre-Install Hook
+# Generates secrets, JWT tokens, and injects them into compose files.
+# Also copies vendored volume configs to appdata.
+#
+# Context: This script is SOURCED (not executed) by f_execute_app_hook.
+# Available inherited variables:
+#   $DOCKER_FOLDER  - Docker root folder
+#   $HOSTNAME       - System hostname
+#   $app_folder     - Path to this app's scaffold directory
+# Available functions: f_print_substep, f_print_success, f_print_error, log_info, log_error
+
+# ============================================================================
+# VARIABLES
+# ============================================================================
+COMPOSE_DIR="$DOCKER_FOLDER/compose/$HOSTNAME"
+SECRETS_DIR="$DOCKER_FOLDER/secrets"
+APPDATA_DIR="$DOCKER_FOLDER/appdata/supabase"
+
+# List of all compose files to sed-inject (main + 12 dependencies)
+COMPOSE_FILES=(
+    "supabase.yml"
+    "supabase-kong.yml"
+    "supabase-auth.yml"
+    "supabase-rest.yml"
+    "realtime-dev.supabase-realtime.yml"
+    "supabase-storage.yml"
+    "supabase-imgproxy.yml"
+    "supabase-meta.yml"
+    "supabase-edge-functions.yml"
+    "supabase-analytics.yml"
+    "supabase-db.yml"
+    "supabase-vector.yml"
+    "supabase-pooler.yml"
+)
+
+# ============================================================================
+# HELPER FUNCTIONS
+# ============================================================================
+
+# base64url encode (no padding, URL-safe)
+base64url_encode() {
+    openssl base64 -e -A | tr '+/' '-_' | tr -d '='
+}
+
+# Generate a JWT token signed with HMAC-SHA256
+# Usage: generate_jwt <payload_json> <secret>
+generate_jwt() {
+    local payload_json="$1"
+    local secret="$2"
+
+    # Header: {"alg":"HS256","typ":"JWT"}
+    local header
+    header=$(printf '{"alg":"HS256","typ":"JWT"}' | base64url_encode)
+
+    # Payload
+    local payload
+    payload=$(printf '%s' "$payload_json" | base64url_encode)
+
+    # Signature
+    local signature
+    signature=$(printf '%s.%s' "$header" "$payload" | openssl dgst -sha256 -hmac "$secret" -binary | base64url_encode)
+
+    printf '%s.%s.%s' "$header" "$payload" "$signature"
+}
+
+# ============================================================================
+# READ SECRETS
+# ============================================================================
+f_print_substep "Reading Supabase secrets..."
+
+POSTGRES_PASSWORD=$(sudo cat "${SECRETS_DIR}/supabase_postgres_password" 2>/dev/null || echo "")
+JWT_SECRET=$(sudo cat "${SECRETS_DIR}/supabase_jwt_secret" 2>/dev/null || echo "")
+DASHBOARD_PASSWORD=$(sudo cat "${SECRETS_DIR}/supabase_dashboard_password" 2>/dev/null || echo "")
+SECRET_KEY_BASE=$(sudo cat "${SECRETS_DIR}/supabase_secret_key_base" 2>/dev/null || echo "")
+VAULT_ENC_KEY=$(sudo cat "${SECRETS_DIR}/supabase_vault_enc_key" 2>/dev/null || echo "")
+PG_META_CRYPTO_KEY=$(sudo cat "${SECRETS_DIR}/supabase_pg_meta_crypto_key" 2>/dev/null || echo "")
+LOGFLARE_PUBLIC_TOKEN=$(sudo cat "${SECRETS_DIR}/supabase_logflare_public_token" 2>/dev/null || echo "")
+LOGFLARE_PRIVATE_TOKEN=$(sudo cat "${SECRETS_DIR}/supabase_logflare_private_token" 2>/dev/null || echo "")
+S3_ACCESS_KEY_ID=$(sudo cat "${SECRETS_DIR}/supabase_s3_access_key_id" 2>/dev/null || echo "")
+S3_ACCESS_KEY_SECRET=$(sudo cat "${SECRETS_DIR}/supabase_s3_access_key_secret" 2>/dev/null || echo "")
+POOLER_TENANT_ID=$(sudo cat "${SECRETS_DIR}/supabase_pooler_tenant_id" 2>/dev/null || echo "")
+
+if [[ -z "$POSTGRES_PASSWORD" || -z "$JWT_SECRET" || -z "$DASHBOARD_PASSWORD" ]]; then
+    f_print_error "Critical Supabase secrets are missing from $SECRETS_DIR/"
+    log_error "supabase" "Missing secrets - aborting pre-install"
+    return 1
+fi
+
+# ============================================================================
+# GENERATE JWT TOKENS
+# ============================================================================
+f_print_substep "Generating JWT tokens..."
+
+# Generate ANON key: read-only public key
+# Payload: {"role":"anon","iss":"supabase","iat":<now>,"exp":<now+5years>}
+CURRENT_TS=$(date +%s)
+EXPIRY_TS=$((CURRENT_TS + 157680000)) # 5 years
+
+ANON_PAYLOAD=$(printf '{"role":"anon","iss":"supabase","iat":%d,"exp":%d}' "$CURRENT_TS" "$EXPIRY_TS")
+ANON_KEY=$(generate_jwt "$ANON_PAYLOAD" "$JWT_SECRET")
+
+# Generate SERVICE_ROLE key: full admin access
+SERVICE_ROLE_PAYLOAD=$(printf '{"role":"service_role","iss":"supabase","iat":%d,"exp":%d}' "$CURRENT_TS" "$EXPIRY_TS")
+SERVICE_ROLE_KEY=$(generate_jwt "$SERVICE_ROLE_PAYLOAD" "$JWT_SECRET")
+
+# Persist generated JWT tokens to secrets files (use sudo tee — secrets dir is root-owned)
+printf '%s' "$ANON_KEY" | sudo tee "${SECRETS_DIR}/supabase_anon_key" > /dev/null
+printf '%s' "$SERVICE_ROLE_KEY" | sudo tee "${SECRETS_DIR}/supabase_service_role_key" > /dev/null
+
+log_info "supabase" "Generated JWT tokens (anon + service_role)"
+
+# ============================================================================
+# COPY VOLUME CONFIGS TO APPDATA
+# ============================================================================
+f_print_substep "Copying volume configurations..."
+
+# Create appdata directories
+sudo mkdir -p "${APPDATA_DIR}/volumes/api"
+sudo mkdir -p "${APPDATA_DIR}/volumes/db"
+sudo mkdir -p "${APPDATA_DIR}/volumes/logs"
+sudo mkdir -p "${APPDATA_DIR}/volumes/pooler"
+sudo mkdir -p "${APPDATA_DIR}/volumes/functions/main"
+sudo mkdir -p "${APPDATA_DIR}/volumes/functions/hello"
+sudo mkdir -p "${APPDATA_DIR}/storage"
+sudo mkdir -p "${APPDATA_DIR}/deno-cache"
+sudo mkdir -p "$DOCKER_FOLDER/appdata/supabase-db/data"
+
+# Copy vendored config files from scaffold to appdata
+# Only copy if not already present (preserves user modifications)
+# $app_folder is inherited from the framework (set by f_load_app_manifest)
+[[ ! -f "${APPDATA_DIR}/volumes/api/kong.yml" ]] && \
+    sudo cp "${app_folder}/files/volumes/api/kong.yml" "${APPDATA_DIR}/volumes/api/kong.yml"
+
+for sqlFile in realtime.sql webhooks.sql roles.sql jwt.sql _supabase.sql logs.sql pooler.sql; do
+    [[ ! -f "${APPDATA_DIR}/volumes/db/${sqlFile}" ]] && \
+        sudo cp "${app_folder}/files/volumes/db/${sqlFile}" "${APPDATA_DIR}/volumes/db/${sqlFile}"
+done
+
+[[ ! -f "${APPDATA_DIR}/volumes/logs/vector.yml" ]] && \
+    sudo cp "${app_folder}/files/volumes/logs/vector.yml" "${APPDATA_DIR}/volumes/logs/vector.yml"
+
+[[ ! -f "${APPDATA_DIR}/volumes/pooler/pooler.exs" ]] && \
+    sudo cp "${app_folder}/files/volumes/pooler/pooler.exs" "${APPDATA_DIR}/volumes/pooler/pooler.exs"
+
+[[ ! -f "${APPDATA_DIR}/volumes/functions/main/index.ts" ]] && \
+    sudo cp "${app_folder}/files/volumes/functions/main/index.ts" "${APPDATA_DIR}/volumes/functions/main/index.ts"
+
+[[ ! -f "${APPDATA_DIR}/volumes/functions/hello/index.ts" ]] && \
+    sudo cp "${app_folder}/files/volumes/functions/hello/index.ts" "${APPDATA_DIR}/volumes/functions/hello/index.ts"
+
+log_info "supabase" "Volume configs copied to appdata"
+
+# ============================================================================
+# INJECT SECRETS INTO COMPOSE FILES
+# ============================================================================
+f_print_substep "Injecting secrets into compose files..."
+
+DASHBOARD_USERNAME="supabase"
+
+for composeFile in "${COMPOSE_FILES[@]}"; do
+    local filePath="${COMPOSE_DIR}/${composeFile}"
+    [[ ! -f "$filePath" ]] && continue
+
+    # Postgres password
+    sudo sed -i "s|POSTGRES-PASSWORD-PLACEHOLDER|${POSTGRES_PASSWORD}|g" "$filePath"
+
+    # JWT secret
+    sudo sed -i "s|JWT-SECRET-PLACEHOLDER|${JWT_SECRET}|g" "$filePath"
+
+    # JWT tokens (ANON + SERVICE_ROLE)
+    sudo sed -i "s|ANON-KEY-PLACEHOLDER|${ANON_KEY}|g" "$filePath"
+    sudo sed -i "s|SERVICE-ROLE-KEY-PLACEHOLDER|${SERVICE_ROLE_KEY}|g" "$filePath"
+
+    # Dashboard credentials
+    sudo sed -i "s|DASHBOARD-USERNAME-PLACEHOLDER|${DASHBOARD_USERNAME}|g" "$filePath"
+    sudo sed -i "s|DASHBOARD-PASSWORD-PLACEHOLDER|${DASHBOARD_PASSWORD}|g" "$filePath"
+
+    # Secret key base (Realtime + Supavisor)
+    sudo sed -i "s|SECRET-KEY-BASE-PLACEHOLDER|${SECRET_KEY_BASE}|g" "$filePath"
+
+    # Vault encryption key (Supavisor)
+    sudo sed -i "s|VAULT-ENC-KEY-PLACEHOLDER|${VAULT_ENC_KEY}|g" "$filePath"
+
+    # PG Meta crypto key
+    sudo sed -i "s|PG-META-CRYPTO-KEY-PLACEHOLDER|${PG_META_CRYPTO_KEY}|g" "$filePath"
+
+    # Logflare tokens
+    sudo sed -i "s|LOGFLARE-PUBLIC-TOKEN-PLACEHOLDER|${LOGFLARE_PUBLIC_TOKEN}|g" "$filePath"
+    sudo sed -i "s|LOGFLARE-PRIVATE-TOKEN-PLACEHOLDER|${LOGFLARE_PRIVATE_TOKEN}|g" "$filePath"
+
+    # Storage S3 credentials
+    sudo sed -i "s|S3-ACCESS-KEY-ID-PLACEHOLDER|${S3_ACCESS_KEY_ID}|g" "$filePath"
+    sudo sed -i "s|S3-ACCESS-KEY-SECRET-PLACEHOLDER|${S3_ACCESS_KEY_SECRET}|g" "$filePath"
+
+    # Pooler tenant ID
+    sudo sed -i "s|POOLER-TENANT-ID-PLACEHOLDER|${POOLER_TENANT_ID}|g" "$filePath"
+done
+
+f_print_success "Supabase secrets configured"
+log_info "supabase" "All secrets injected into compose files"

package/apps/official/supabase/files/volumes/api/kong.yml

@@ -0,0 +1,221 @@
+_format_version: '2.1'
+_transform: true
+
+###
+consumers:
+  - username: DASHBOARD
+  - username: anon
+    keyauth_credentials:
+      - key: ${SUPABASE_ANON_KEY}
+  - username: service_role
+    keyauth_credentials:
+      - key: ${SUPABASE_SERVICE_KEY}
+
+###
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+###
+basicauth_credentials:
+  - consumer: DASHBOARD
+    username: '${DASHBOARD_USERNAME}'
+    password: '${DASHBOARD_PASSWORD}'
+
+###
+services:
+  ## Open Auth routes
+  - name: auth-v1-open
+    url: http://supabase-auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://supabase-auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://supabase-auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  ## Secure Auth routes
+  - name: auth-v1
+    _comment: 'GoTrue: /auth/v1/* -> http://supabase-auth:9999/*'
+    url: http://supabase-auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure REST routes
+  - name: rest-v1
+    _comment: 'PostgREST: /rest/v1/* -> http://supabase-rest:3000/*'
+    url: http://supabase-rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure GraphQL routes
+  - name: graphql-v1
+    _comment: 'PostgREST: /graphql/v1/* -> http://supabase-rest:3000/rpc/graphql'
+    url: http://supabase-rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - Content-Profile:graphql_public
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure Realtime routes
+  - name: realtime-v1-ws
+    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+    url: http://realtime-dev.supabase-realtime:4000/socket
+    protocol: ws
+    routes:
+      - name: realtime-v1-ws
+        strip_path: true
+        paths:
+          - /realtime/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+  - name: realtime-v1-rest
+    _comment: 'Realtime: /realtime/v1/api/* -> http://realtime:4000/api/*'
+    url: http://realtime-dev.supabase-realtime:4000/api
+    protocol: http
+    routes:
+      - name: realtime-v1-rest
+        strip_path: true
+        paths:
+          - /realtime/v1/api
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Storage routes: the storage server manages its own auth
+  - name: storage-v1
+    _comment: 'Storage: /storage/v1/* -> http://supabase-storage:5000/*'
+    url: http://supabase-storage:5000/
+    routes:
+      - name: storage-v1-all
+        strip_path: true
+        paths:
+          - /storage/v1/
+    plugins:
+      - name: cors
+
+  ## Edge Functions routes
+  - name: functions-v1
+    _comment: 'Edge Functions: /functions/v1/* -> http://supabase-edge-functions:9000/*'
+    url: http://supabase-edge-functions:9000/
+    routes:
+      - name: functions-v1-all
+        strip_path: true
+        paths:
+          - /functions/v1/
+    plugins:
+      - name: cors
+
+  ## Secure Database routes
+  - name: meta
+    _comment: 'pg-meta: /pg/* -> http://supabase-meta:8080/*'
+    url: http://supabase-meta:8080/
+    routes:
+      - name: meta-all
+        strip_path: true
+        paths:
+          - /pg/
+    plugins:
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+
+  ## Protected Dashboard - catch all remaining routes
+  - name: dashboard
+    _comment: 'Studio: /* -> http://supabase:3000/*'
+    url: http://supabase:3000/
+    routes:
+      - name: dashboard-all
+        strip_path: true
+        paths:
+          - /
+    plugins:
+      - name: cors

package/apps/official/supabase/files/volumes/db/_supabase.sql

@@ -0,0 +1,3 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+CREATE DATABASE _supabase WITH OWNER :pguser;

package/apps/official/supabase/files/volumes/db/jwt.sql

@@ -0,0 +1,5 @@
+\set jwt_secret `echo "$JWT_SECRET"`
+\set jwt_exp `echo "$JWT_EXP"`
+
+ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
+ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';

package/apps/official/supabase/files/volumes/db/logs.sql

@@ -0,0 +1,6 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+\c _supabase
+create schema if not exists _analytics;
+alter schema _analytics owner to :pguser;
+\c postgres

package/apps/official/supabase/files/volumes/db/pooler.sql

@@ -0,0 +1,6 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+\c _supabase
+create schema if not exists _supavisor;
+alter schema _supavisor owner to :pguser;
+\c postgres

package/apps/official/supabase/files/volumes/db/realtime.sql

@@ -0,0 +1,4 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+create schema if not exists _realtime;
+alter schema _realtime owner to :pguser;

package/apps/official/supabase/files/volumes/db/roles.sql

@@ -0,0 +1,8 @@
+-- NOTE: change to your own passwords for production environments
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+
+ALTER USER authenticator WITH PASSWORD :'pgpass';
+ALTER USER pgbouncer WITH PASSWORD :'pgpass';
+ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';

package/apps/official/supabase/files/volumes/db/webhooks.sql

@@ -0,0 +1,208 @@
+BEGIN;
+  -- Create pg_net extension
+  CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+  -- Create supabase_functions schema
+  CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+  GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+  -- supabase_functions.migrations definition
+  CREATE TABLE supabase_functions.migrations (
+    version text PRIMARY KEY,
+    inserted_at timestamptz NOT NULL DEFAULT NOW()
+  );
+  -- Initial supabase_functions migration
+  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+  -- supabase_functions.hooks definition
+  CREATE TABLE supabase_functions.hooks (
+    id bigserial PRIMARY KEY,
+    hook_table_id integer NOT NULL,
+    hook_name text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT NOW(),
+    request_id bigint
+  );
+  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+  CREATE FUNCTION supabase_functions.http_request()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    AS $function$
+    DECLARE
+      request_id bigint;
+      payload jsonb;
+      url text := TG_ARGV[0]::text;
+      method text := TG_ARGV[1]::text;
+      headers jsonb DEFAULT '{}'::jsonb;
+      params jsonb DEFAULT '{}'::jsonb;
+      timeout_ms integer DEFAULT 1000;
+    BEGIN
+      IF url IS NULL OR url = 'null' THEN
+        RAISE EXCEPTION 'url argument is missing';
+      END IF;
+
+      IF method IS NULL OR method = 'null' THEN
+        RAISE EXCEPTION 'method argument is missing';
+      END IF;
+
+      IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+        headers = '{"Content-Type": "application/json"}'::jsonb;
+      ELSE
+        headers = TG_ARGV[2]::jsonb;
+      END IF;
+
+      IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+        params = '{}'::jsonb;
+      ELSE
+        params = TG_ARGV[3]::jsonb;
+      END IF;
+
+      IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+        timeout_ms = 1000;
+      ELSE
+        timeout_ms = TG_ARGV[4]::integer;
+      END IF;
+
+      CASE
+        WHEN method = 'GET' THEN
+          SELECT http_get INTO request_id FROM net.http_get(
+            url,
+            params,
+            headers,
+            timeout_ms
+          );
+        WHEN method = 'POST' THEN
+          payload = jsonb_build_object(
+            'old_record', OLD,
+            'record', NEW,
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'schema', TG_TABLE_SCHEMA
+          );
+
+          SELECT http_post INTO request_id FROM net.http_post(
+            url,
+            payload,
+            params,
+            headers,
+            timeout_ms
+          );
+        ELSE
+          RAISE EXCEPTION 'method argument % is invalid', method;
+      END CASE;
+
+      INSERT INTO supabase_functions.hooks
+        (hook_table_id, hook_name, request_id)
+      VALUES
+        (TG_RELID, TG_NAME, request_id);
+
+      RETURN NEW;
+    END
+  $function$;
+  -- Supabase super admin
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_functions_admin'
+    )
+    THEN
+      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+    END IF;
+  END
+  $$;
+  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+  ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+  ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+  ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+  GRANT supabase_functions_admin TO postgres;
+  -- Remove unused supabase_pg_net_admin role
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_pg_net_admin'
+    )
+    THEN
+      REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+      DROP OWNED BY supabase_pg_net_admin;
+      DROP ROLE supabase_pg_net_admin;
+    END IF;
+  END
+  $$;
+  -- pg_net grants when extension is already enabled
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_extension
+      WHERE extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END
+  $$;
+  -- Event trigger for pg_net
+  CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+  RETURNS event_trigger
+  LANGUAGE plpgsql
+  AS $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_event_trigger_ddl_commands() AS ev
+      JOIN pg_extension AS ext
+      ON ev.objid = ext.oid
+      WHERE ext.extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END;
+  $$;
+  COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_event_trigger
+      WHERE evtname = 'issue_pg_net_access'
+    ) THEN
+      CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+      EXECUTE PROCEDURE extensions.grant_pg_net_access();
+    END IF;
+  END
+  $$;
+  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+  ALTER function supabase_functions.http_request() SECURITY DEFINER;
+  ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+  REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+  GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+COMMIT;

package/apps/official/supabase/files/volumes/functions/hello/index.ts

@@ -0,0 +1,6 @@
+Deno.serve(async () => {
+    return new Response(
+        `"Hello from Edge Functions!"`,
+        { headers: { "Content-Type": "application/json" } },
+    )
+})