@starci/hfs 4.9.11 → 4.10.0

package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml

@@ -7,15 +7,15 @@ schema: starci/application-stacks@1
 sources:
   - repository: {{project}}
 backing:
-  supabase:
-    provider: supabase
-    managed: true
+  db:
+    provider: postgres
+    component: db
 components:
   api:
     role: service
     image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
     compose: infra/swarm/stack.yaml
-    purpose: The application's GraphQL API; managed Supabase supplies its database and Auth integration.
+    purpose: The application's GraphQL API, its own Google and password sign-in and its storage integration.
     required: true
   web:
     role: service
@@ -23,6 +23,14 @@ components:
     compose: infra/swarm/stack.yaml
     purpose: The standalone Next.js application with public configuration supplied at build time.
     required: true
+  db:
+    role: service
+    stateful: true
+    volumes: [db-data]
+    image: "supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2"
+    compose: infra/swarm/stack.yaml
+    purpose: The app's own PostgreSQL (pg_cron, pg_net, pgmq, vector), migrated by starci app db migrate.
+    required: true
   ingress:
     role: ingress
     stateful: true
@@ -39,6 +47,7 @@ environments:
     components:
       api: {replicas: 1, port: 3001}
       web: {replicas: 1, port: 3000}
+      db: {replicas: 1, port: 5432}
       ingress: {replicas: 1, port: 80}
     runbook: README.md
     ingress:
@@ -62,8 +71,8 @@ environments:
         retention: Seven daily snapshots
         owner: Development operator
         restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
-      - component: supabase
-        target: Owner-provisioned encrypted off-host storage for development database exports
+      - component: db
+        target: Owner-provisioned encrypted off-host storage for starci app db dump archives
         retention: Seven daily exports
         owner: Development operator
         restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
@@ -75,10 +84,34 @@ environments:
         where: secrets/primary-db-url
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
-      - name: supabase-service-role-key
-        runtimeName: "{{project}}-dev-supabase-service-role-key-v1"
+      - name: db-password
+        runtimeName: "{{project}}-dev-db-password-v1"
+        version: 1
+        where: secrets/db-password
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: google-client-secret
+        runtimeName: "{{project}}-dev-google-client-secret-v1"
+        version: 1
+        where: secrets/google-client-secret
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: auth-jwt-private-key
+        runtimeName: "{{project}}-dev-auth-jwt-private-key-v1"
+        version: 1
+        where: secrets/auth-jwt-private-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-access-key-id
+        runtimeName: "{{project}}-dev-storage-access-key-id-v1"
+        version: 1
+        where: secrets/storage-access-key-id
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-secret-access-key
+        runtimeName: "{{project}}-dev-storage-secret-access-key-v1"
         version: 1
-        where: secrets/supabase-service-role-key
+        where: secrets/storage-secret-access-key
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
   production:
@@ -88,6 +121,7 @@ environments:
     components:
       api: {replicas: 1, port: 3001}
       web: {replicas: 1, port: 3000}
+      db: {replicas: 1, port: 5432}
       ingress: {replicas: 1, port: 443, httpPort: 80}
     runbook: README.md
     ingress:
@@ -114,9 +148,9 @@ environments:
         retention: Thirty daily snapshots
         owner: Production operator
         restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
-      - component: supabase
-        target: Provider PITR plus owner-provisioned encrypted off-host database exports
-        retention: Seven days PITR and thirty daily exports
+      - component: db
+        target: Owner-provisioned encrypted off-host storage for starci app db dump archives
+        retention: Thirty daily encrypted exports
         owner: Production operator
         restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
     # Scaffolding seals generated placeholders to this app's own recipient; set real values before use.
@@ -127,10 +161,34 @@ environments:
         where: secrets/primary-db-url
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
-      - name: supabase-service-role-key
-        runtimeName: "{{project}}-production-supabase-service-role-key-v1"
+      - name: db-password
+        runtimeName: "{{project}}-production-db-password-v1"
+        version: 1
+        where: secrets/db-password
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: google-client-secret
+        runtimeName: "{{project}}-production-google-client-secret-v1"
         version: 1
-        where: secrets/supabase-service-role-key
+        where: secrets/google-client-secret
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: auth-jwt-private-key
+        runtimeName: "{{project}}-production-auth-jwt-private-key-v1"
+        version: 1
+        where: secrets/auth-jwt-private-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-access-key-id
+        runtimeName: "{{project}}-production-storage-access-key-id-v1"
+        version: 1
+        where: secrets/storage-access-key-id
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-secret-access-key
+        runtimeName: "{{project}}-production-storage-secret-access-key-v1"
+        version: 1
+        where: secrets/storage-secret-access-key
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
     # What `starci app stack` deploys (verbs: prepare, doctor, deploy, verify, rollback); names and shapes only, never a value.
@@ -151,9 +209,9 @@ environments:
           buildArgs:
             values:
               NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
-              NEXT_PUBLIC_SUPABASE_URL: "https://supabase.{{project}}.example.invalid"
-              NEXT_PUBLIC_SUPABASE_ANON_KEY: "REPLACE_WITH_PUBLIC_SUPABASE_ANON_KEY"
+              NEXT_PUBLIC_API_URL: "https://api.{{project}}.example.invalid"
       volumes:
+        - {{project}}-production-db-data
         - {{project}}-production-ingress-data
         - {{project}}-production-ingress-config-data
       secrets:
@@ -162,7 +220,14 @@ environments:
             filePointers: true
             from:
               - member: primary-db-url
-              - member: supabase-service-role-key
+              - member: google-client-secret
+              - member: auth-jwt-private-key
+              - member: storage-access-key-id
+              - member: storage-secret-access-key
+          - service: db
+            filePointers: true
+            from:
+              - member: db-password
       # Release tasks: an idempotent write the release owes the data (a catalogue sync, a seed upsert) is declared under tasks and listed in postDeploy.
       # A deploy runs postDeploy after the stack converged and before verify, which stays read-only. Uncomment and name the real command:
       # tasks:
@@ -184,7 +249,7 @@ environments:
             retry: true
 k8s:
   status: deferred
-  reason: Lite production uses Docker Swarm with managed Supabase backing; Kubernetes belongs to a future full-edition deployment.
+  reason: Lite production uses Docker Swarm with its own PostgreSQL service; Kubernetes belongs to a future full-edition deployment.
 ci:
   secrets:
     - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app}

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -1,14 +1,14 @@
 # Development stack
 
-Every development dependency runs in Docker Linux containers. Local Supabase starts through its CLI and supplies PostgreSQL, pgvector, Auth and Storage. Every other declared dependency, such as Redis, starts through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model; Compose is an implementation detail. The app services may run in the local Docker Swarm model or through a declared native development profile while dependencies stay in Docker.
-The application image references contain illustrative all-zero digests. Replace them with verified published release digests in the manifest, model and `.starcistacks/dev/infra/swarm/releases/images.lock.yaml` before starting the container model. Replace its starter `SUPABASE_URL` with the local Supabase endpoint reachable from the Swarm node, and seal that local database connection and integration credential; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
+Every development dependency runs in Docker Linux containers. The `db` service (image supabase/postgres: PostgreSQL with pg_cron, pg_net, pgmq and pgvector) starts with `npm run db:start` and takes the migrations with `npm run db:push`; storage is the S3-compatible MinIO the environment names. Every other declared dependency, such as Redis, starts through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model; Compose is an implementation detail. The app services may run in the local Docker Swarm model or through a declared native development profile while dependencies stay in Docker.
+The application image references contain illustrative all-zero digests. Replace them with verified published release digests in the manifest, model and `.starcistacks/dev/infra/swarm/releases/images.lock.yaml` before starting the container model. Seal the local database connection and the integration credentials; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
 
-The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set dev` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+The runtime template tracks no encrypted members. Scaffolding generates the six declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set dev` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
 
 | Command | Operation |
 | --- | --- |
-| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
-| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
+| prepare | Run `npm run db:start` at the app root; then `npm run db:push` to apply the migrations; export `DATABASE_URL` for the database verbs. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local database availability. |
 | up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
 | status | Run `docker stack services {{project}}-dev`. |
 | logs | Run `docker service logs {{project}}-dev_api`; never print mounted credentials. |

package/templates/app/skeleton-lite/.starcistacks/dev/environment.json

@@ -1,6 +1,6 @@
 {
   "environment": "dev",
-  "provider": "supabase",
+  "provider": "postgres",
   "project": "{{project}}",
   "runtime": "docker-swarm"
 }

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md

@@ -2,6 +2,6 @@
 
 Status: pending owner execution. No backup or restore has been run by scaffolding.
 
-The development operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
+The development operator owns recovery of the db service's volume `{{project}}-dev-db-data` and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
 
 Before relying on the backup policy, restore a database export and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored ingress configuration and state. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml

@@ -8,13 +8,29 @@ services:
       HTTP_SECURITY_ALLOWED_ORIGINS: http://dev.{{project}}.example.invalid
       PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
       PRIMARY_DB_SCHEMA: public
-      SUPABASE_URL: https://{{project}}.supabase.co
-      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+      GOOGLE_CLIENT_ID: REPLACE_WITH_GOOGLE_OAUTH_CLIENT_ID
+      GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google-client-secret
+      GOOGLE_CALLBACK_URL: http://dev.{{project}}.example.invalid/auth/google/callback
+      AUTH_JWT_ISSUER: http://dev.{{project}}.example.invalid
+      AUTH_JWT_AUDIENCE: {{project}}
+      AUTH_JWT_KEY_ID: dev-1
+      AUTH_JWT_PRIVATE_KEY_FILE: /run/secrets/auth-jwt-private-key
+      STORAGE_ENDPOINT: https://storage.{{project}}.example.invalid
+      STORAGE_REGION: us-east-1
+      STORAGE_BUCKET: {{project}}-dev
+      STORAGE_ACCESS_KEY_ID_FILE: /run/secrets/storage-access-key-id
+      STORAGE_SECRET_ACCESS_KEY_FILE: /run/secrets/storage-secret-access-key
     secrets:
       - source: primary-db-url
         target: primary-db-url
-      - source: supabase-service-role-key
-        target: supabase-service-role-key
+      - source: google-client-secret
+        target: google-client-secret
+      - source: auth-jwt-private-key
+        target: auth-jwt-private-key
+      - source: storage-access-key-id
+        target: storage-access-key-id
+      - source: storage-secret-access-key
+        target: storage-secret-access-key
     networks: [app]
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
@@ -66,6 +82,38 @@ services:
       restart_policy:
         condition: on-failure
         delay: 5s
+  db:
+    image: "supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2"
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD_FILE: /run/secrets/db-password
+    secrets:
+      - source: db-password
+        target: db-password
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 5
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
   ingress:
     image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
     configs:
@@ -104,13 +152,28 @@ secrets:
   primary-db-url:
     external: true
     name: "{{project}}-dev-primary-db-url-v1"
-  supabase-service-role-key:
+  db-password:
+    external: true
+    name: "{{project}}-dev-db-password-v1"
+  google-client-secret:
+    external: true
+    name: "{{project}}-dev-google-client-secret-v1"
+  auth-jwt-private-key:
     external: true
-    name: "{{project}}-dev-supabase-service-role-key-v1"
+    name: "{{project}}-dev-auth-jwt-private-key-v1"
+  storage-access-key-id:
+    external: true
+    name: "{{project}}-dev-storage-access-key-id-v1"
+  storage-secret-access-key:
+    external: true
+    name: "{{project}}-dev-storage-secret-access-key-v1"
 configs:
   ingress-config:
     file: ./Caddyfile
 volumes:
+  db-data:
+    external: true
+    name: "{{project}}-dev-db-data"
   ingress-data:
     external: true
     name: "{{project}}-dev-ingress-data"

package/templates/app/skeleton-lite/.starcistacks/dev/runtime/env/KEYS.md

@@ -1,18 +1,29 @@
 # Environment key roster
 
-This roster declares names only. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set dev` before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Store product credential values in sealed custody and materialize private KEY files outside the repository.
+This roster declares names only. Scaffolding generates the six declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set dev` before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Store product credential values in sealed custody and materialize private KEY files outside the repository.
 
 | Key | Consumer |
 | --- | --- |
 | `PORT` | API listener |
 | `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
-| `PRIMARY_DB_URL` | API primary database connection; `.starcistacks/dev/secrets/primary-db-url.enc` maps to external `{{project}}-dev-primary-db-url-v1` and mounted `/run/secrets/primary-db-url` |
+| `PRIMARY_DB_URL` | API least-privilege database connection; `.starcistacks/dev/secrets/primary-db-url.enc` maps to external `{{project}}-dev-primary-db-url-v1` and mounted `/run/secrets/primary-db-url` |
 | `PRIMARY_DB_SCHEMA` | API primary database schema |
-| `SUPABASE_URL` | API Auth and Storage integration |
-| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; `.starcistacks/dev/secrets/supabase-service-role-key.enc` maps to external `{{project}}-dev-supabase-service-role-key-v1` and mounted `/run/secrets/supabase-service-role-key` |
+| `POSTGRES_PASSWORD` | The db service's superuser password; `.starcistacks/dev/secrets/db-password.enc` maps to external `{{project}}-dev-db-password-v1` and mounted `/run/secrets/db-password` |
+| `GOOGLE_CLIENT_ID` | API Google OAuth client |
+| `GOOGLE_CLIENT_SECRET` | API Google OAuth client; `.starcistacks/dev/secrets/google-client-secret.enc` maps to external `{{project}}-dev-google-client-secret-v1` and mounted `/run/secrets/google-client-secret` |
+| `GOOGLE_CALLBACK_URL` | API Google OAuth callback door |
+| `AUTH_JWT_ISSUER` | API access-token issuer |
+| `AUTH_JWT_AUDIENCE` | API access-token audience |
+| `AUTH_JWT_KEY_ID` | API signing key id, published in the JWKS |
+| `AUTH_JWT_PRIVATE_KEY` | API ES256 signing key; `.starcistacks/dev/secrets/auth-jwt-private-key.enc` maps to external `{{project}}-dev-auth-jwt-private-key-v1` and mounted `/run/secrets/auth-jwt-private-key` |
+| `STORAGE_ENDPOINT` | API S3-compatible storage endpoint |
+| `STORAGE_REGION` | API storage signing region |
+| `STORAGE_BUCKET` | API storage bucket |
+| `STORAGE_ACCESS_KEY_ID` | API storage credential; `.starcistacks/dev/secrets/storage-access-key-id.enc` maps to external `{{project}}-dev-storage-access-key-id-v1` and mounted `/run/secrets/storage-access-key-id` |
+| `STORAGE_SECRET_ACCESS_KEY` | API storage credential; `.starcistacks/dev/secrets/storage-secret-access-key.enc` maps to external `{{project}}-dev-storage-secret-access-key-v1` and mounted `/run/secrets/storage-secret-access-key` |
+| `DATABASE_URL` | `starci app db` verbs (migrate, dump, plan) and `contract:emit`, from the operator's environment |
 | `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_API_URL` | Front-end auth doors of the API |
 | `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
-| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
-| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
 
-Public front-end configuration is supplied at build time and stays outside sealed custody. Production database deployment consumes `SUPABASE_ACCESS_TOKEN`, `SUPABASE_DB_PASSWORD` and `SUPABASE_PROJECT_ID` from its environment's sealed custody; the GitHub secret store carries only the age identity.
+Public front-end configuration is supplied at build time and stays outside sealed custody. The database verbs read `DATABASE_URL` from the operator's environment; the GitHub secret store carries only the age identity.

package/templates/app/skeleton-lite/.starcistacks/production/README.md

@@ -1,11 +1,11 @@
 # Production stack
 
 The tracked model declares Docker Swarm application services and one digest-pinned Caddy ingress.
-Hosted Supabase supplies PostgreSQL, pgvector, Auth and Storage. The app and its other dependencies run on Docker Swarm. A Redis service runs only when `hfs.json` `sides.be.backing` declares it for a capability that needs it: one stateful replica with a digest-pinned image, a named volume with a backup entry and its password as a sealed member granted as a Swarm secret (Redis runs `--appendonly yes` with the volume at `/data`). The scaffold declares none; `starci app add queue|job` declares Redis and renders it here.
+The `db` service (image supabase/postgres) supplies PostgreSQL with pg_cron, pg_net, pgmq and pgvector on a named volume; sign-in is the API's own (Passport) and storage is the S3-compatible MinIO the environment names. The app and its dependencies run on Docker Swarm. A Redis service runs only when `hfs.json` `sides.be.backing` declares it for a capability that needs it: one stateful replica with a digest-pinned image, a named volume with a backup entry and its password as a sealed member granted as a Swarm secret (Redis runs `--appendonly yes` with the volume at `/data`). The scaffold declares none; `starci app add queue|job` declares Redis and renders it here.
 The model is a deployment declaration. It contains no owner credentials, real DNS receipt, completed release or restore proof. Public records under `.starcistacks/production/infra/swarm/` explicitly mark those owner-run operations as pending.
 Its application image references contain illustrative all-zero digests; they identify no published image and must be replaced before deployment.
 
-The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set production` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+The runtime template tracks no encrypted members. Scaffolding generates the six declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set production` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
 
 | Command | Operation |
 | --- | --- |
@@ -26,13 +26,13 @@ Every item is pending. Swarm initialization, provider URIs, DNS changes and key
 | Swarm and placement | Initialize the intended manager; label the intended stateful node `{{project}}=production`. Only that node owns the external ingress volumes. |
 | DNS | Replace the reserved `example.invalid` hosts consistently in the manifest, Caddyfile and public configuration; publish address records for the web and API hosts and retain a provider receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
 | TLS | Caddy issues certificates after real DNS resolves. Provision `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data` on the selected node; retain an issuance and renewal receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
-| Database | Provision Supabase and the app_be connection; provider backups remain enabled. Record the provider URI and recovery owner without copying credentials here. |
+| Database | Provision `{{project}}-production-db-data` on the stateful node; after the first deploy create the app_be login through the baseline migration (`starci app db migrate --url-env DATABASE_URL --execute`). Record the recovery owner without copying credentials here. |
 | Secret custody | Replace generated placeholder values with real values at the manifest's declared `.starcistacks/production/secrets/*.enc` paths; record their keys in `.starcistacks/production/runtime/env/KEYS.md`. The app's age identity stays only in the host's untracked `.claude/secret.env`. |
-| External secrets | Materialize the sealed members in owner custody and create `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. The API reads mounted files; rotation creates new versioned names before updating the model. |
-| Public build configuration | Build the front end with its declared public site and GraphQL URLs, the Supabase public URL and anonymous key. Public browser values stay outside sealed secret custody. |
+| External secrets | Materialize the sealed members in owner custody and create the `{{project}}-production-<member>-v1` external secret of each declared member. The API reads mounted files; rotation creates new versioned names before updating the model. |
+| Public build configuration | Build the front end with its declared public site, API and GraphQL URLs. Public browser values stay outside sealed secret custody. |
 | Immutable release | Replace the illustrative all-zero application digests in the manifest, model and `.starcistacks/production/infra/swarm/releases/images.lock.yaml` with digests produced by the verified release. Store each rendered release under `/srv/{{project}}/releases/<digest>`. Retain the last accepted record in `.starcistacks/production/infra/swarm/releases/previous.yaml`, then move the current pointer and update `.starcistacks/production/infra/swarm/releases/current.yaml` after verification. |
 | Rollback | Retain the previous model and images, redeploy that model if convergence or health fails, and record the resulting convergence receipt. Database changes follow an expand/contract sequence. |
-| Backup | Provision the manifest's seven days of database PITR and thirty daily encrypted off-host database exports and ingress-volume snapshots. Record the actual destination and encryption custody in `.starcistacks/production/infra/swarm/recovery/restore-proof.md`; the production operator owns both components. |
+| Backup | Provision the manifest's thirty daily encrypted off-host database exports (`starci app db dump`) and ingress-volume snapshots. Record the actual destination and encryption custody in `.starcistacks/production/infra/swarm/recovery/restore-proof.md`; the production operator owns both components. |
 | Restore proof | Perform a restore into isolated infrastructure, verify the restored database and ingress state, and attach a dated receipt with artifact digests to `.starcistacks/production/infra/swarm/recovery/restore-proof.md`. Its initial record is pending; no restore has been run by scaffolding. |
 
 No host scheduler is installed. Scheduled application work belongs to the back-end scheduler or an explicitly declared replicated job.

package/templates/app/skeleton-lite/.starcistacks/production/environment.json

@@ -1,6 +1,6 @@
 {
   "environment": "production",
-  "provider": "supabase",
+  "provider": "postgres",
   "project": "{{project}}",
   "runtime": "docker-swarm"
 }

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/recovery/restore-proof.md

@@ -2,6 +2,6 @@
 
 Status: pending owner execution. No backup or restore has been run by scaffolding.
 
-The production operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data`. Provision seven days of provider PITR and thirty daily encrypted off-host database exports. Retain thirty daily encrypted off-host snapshots for both ingress volumes.
+The production operator owns recovery of the db service's volume `{{project}}-production-db-data` and both external ingress volumes, `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data`. Provision thirty daily encrypted off-host database exports through `starci app db dump`. Retain thirty daily encrypted off-host snapshots for both ingress volumes.
 
-Before relying on the backup policy, restore the provider database backup and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored TLS and ingress configuration. Attach the dated result here without credentials.
+Before relying on the backup policy, restore a `starci app db dump` archive and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored TLS and ingress configuration. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/stack.yaml

@@ -8,13 +8,29 @@ services:
       HTTP_SECURITY_ALLOWED_ORIGINS: https://{{project}}.example.invalid
       PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
       PRIMARY_DB_SCHEMA: public
-      SUPABASE_URL: https://{{project}}.supabase.co
-      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+      GOOGLE_CLIENT_ID: REPLACE_WITH_GOOGLE_OAUTH_CLIENT_ID
+      GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google-client-secret
+      GOOGLE_CALLBACK_URL: https://api.{{project}}.example.invalid/auth/google/callback
+      AUTH_JWT_ISSUER: https://api.{{project}}.example.invalid
+      AUTH_JWT_AUDIENCE: {{project}}
+      AUTH_JWT_KEY_ID: production-1
+      AUTH_JWT_PRIVATE_KEY_FILE: /run/secrets/auth-jwt-private-key
+      STORAGE_ENDPOINT: https://storage.{{project}}.example.invalid
+      STORAGE_REGION: us-east-1
+      STORAGE_BUCKET: {{project}}-production
+      STORAGE_ACCESS_KEY_ID_FILE: /run/secrets/storage-access-key-id
+      STORAGE_SECRET_ACCESS_KEY_FILE: /run/secrets/storage-secret-access-key
     secrets:
       - source: primary-db-url
         target: primary-db-url
-      - source: supabase-service-role-key
-        target: supabase-service-role-key
+      - source: google-client-secret
+        target: google-client-secret
+      - source: auth-jwt-private-key
+        target: auth-jwt-private-key
+      - source: storage-access-key-id
+        target: storage-access-key-id
+      - source: storage-secret-access-key
+        target: storage-secret-access-key
     networks: [app]
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
@@ -66,6 +82,38 @@ services:
       restart_policy:
         condition: on-failure
         delay: 5s
+  db:
+    image: "supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2"
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD_FILE: /run/secrets/db-password
+    secrets:
+      - source: db-password
+        target: db-password
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 5
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
   ingress:
     image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
     configs:
@@ -105,13 +153,28 @@ secrets:
   primary-db-url:
     external: true
     name: "{{project}}-production-primary-db-url-v1"
-  supabase-service-role-key:
+  db-password:
+    external: true
+    name: "{{project}}-production-db-password-v1"
+  google-client-secret:
+    external: true
+    name: "{{project}}-production-google-client-secret-v1"
+  auth-jwt-private-key:
     external: true
-    name: "{{project}}-production-supabase-service-role-key-v1"
+    name: "{{project}}-production-auth-jwt-private-key-v1"
+  storage-access-key-id:
+    external: true
+    name: "{{project}}-production-storage-access-key-id-v1"
+  storage-secret-access-key:
+    external: true
+    name: "{{project}}-production-storage-secret-access-key-v1"
 configs:
   ingress-config:
     file: ./Caddyfile
 volumes:
+  db-data:
+    external: true
+    name: "{{project}}-production-db-data"
   ingress-data:
     external: true
     name: "{{project}}-production-ingress-data"

package/templates/app/skeleton-lite/.starcistacks/production/runtime/env/KEYS.md

@@ -1,6 +1,6 @@
 # Production environment key roster
 
-This inventory declares names, consumers and mounted file paths. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set production` after owner provisioning and before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Scaffolding supplies no deployment credential or successful deployment.
+This inventory declares names, consumers and mounted file paths. Scaffolding generates the six declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set production` after owner provisioning and before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Scaffolding supplies no deployment credential or successful deployment.
 
 | Key | Consumer |
 | --- | --- |
@@ -8,14 +8,22 @@ This inventory declares names, consumers and mounted file paths. Scaffolding gen
 | `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
 | `PRIMARY_DB_URL` | API least-privilege database connection; reads `PRIMARY_DB_URL_FILE` at `/run/secrets/primary-db-url` |
 | `PRIMARY_DB_SCHEMA` | API primary database schema |
-| `SUPABASE_URL` | API Auth and Storage integration |
-| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; reads `SUPABASE_SERVICE_ROLE_KEY_FILE` at `/run/secrets/supabase-service-role-key` |
+| `POSTGRES_PASSWORD` | The db service's superuser password; reads `POSTGRES_PASSWORD_FILE` at `/run/secrets/db-password` |
+| `GOOGLE_CLIENT_ID` | API Google OAuth client |
+| `GOOGLE_CLIENT_SECRET` | API Google OAuth client; reads `GOOGLE_CLIENT_SECRET_FILE` at `/run/secrets/google-client-secret` |
+| `GOOGLE_CALLBACK_URL` | API Google OAuth callback door |
+| `AUTH_JWT_ISSUER` | API access-token issuer |
+| `AUTH_JWT_AUDIENCE` | API access-token audience |
+| `AUTH_JWT_KEY_ID` | API signing key id, published in the JWKS |
+| `AUTH_JWT_PRIVATE_KEY` | API ES256 signing key; reads `AUTH_JWT_PRIVATE_KEY_FILE` at `/run/secrets/auth-jwt-private-key` |
+| `STORAGE_ENDPOINT` | API S3-compatible storage endpoint |
+| `STORAGE_REGION` | API storage signing region |
+| `STORAGE_BUCKET` | API storage bucket |
+| `STORAGE_ACCESS_KEY_ID` | API storage credential; reads `STORAGE_ACCESS_KEY_ID_FILE` at `/run/secrets/storage-access-key-id` |
+| `STORAGE_SECRET_ACCESS_KEY` | API storage credential; reads `STORAGE_SECRET_ACCESS_KEY_FILE` at `/run/secrets/storage-secret-access-key` |
+| `DATABASE_URL` | `starci app db` verbs (migrate, dump, plan) and `contract:emit`, from the operator's environment |
 | `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_API_URL` | Front-end auth doors of the API |
 | `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
-| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
-| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
-| `SUPABASE_ACCESS_TOKEN` | Production database deployment |
-| `SUPABASE_DB_PASSWORD` | Production database deployment |
-| `SUPABASE_PROJECT_ID` | Production database deployment |
 
-Public front-end configuration is supplied at build time and stays outside sealed custody. Set real values in `.starcistacks/production/secrets/primary-db-url.enc` and `.starcistacks/production/secrets/supabase-service-role-key.enc` at the declared paths. Versioned external application secrets are `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. Seal deployment-only credentials separately under `.starcistacks/production/secrets/*.enc`; they never enter an API container.
+Public front-end configuration is supplied at build time and stays outside sealed custody. Set real values in the six `.starcistacks/production/secrets/*.enc` members at the declared paths; their versioned external secrets are `{{project}}-production-<member>-v1`. The database deploy workflow reads `DATABASE_URL` from the sealed `database-url` member of its environment; it never enters an API container.