dev2: lean Supabase stacks (drop studio, meta, imgproxy, supavisor)

[ralyodio]

dev2 (production, 91 GB) has swap ~100% used. Each of the 21 per-site Supabase stacks runs four services that no app uses: studio, postgres-meta, supavisor and imgproxy, about 300 MiB per stack and ~6.7 GB in total.

Evidence they are unused (2026-10-01, read-only on dev2):

• /pg/ (meta): 0 requests in any gateway log. Studio: the only hits were one scanner fetching /css/support_parent.css (401).
• /storage/v1/render/ (imgproxy): 0 hits. No transform / render/image calls in any of the 21 app repos.
• supavisor: pooler ports are bound to 127.0.0.1 only. No established connections to 66xx, and no inbound sockets in any supavisor container. No app.env/deploy.env/compose file on the box mentions a pooler. bittorrented's droplet tunnels to the db port (5590).

What changes

• templates/supabase-stack.sh: optional services are dropped by default via DROP_SERVICES. A dropped service becomes !reset null in the overlay. The depends_on entries that pointed at the removed services (api-gw on studio, storage on imgproxy) are rewritten as one-line # lean: entries. Compose leaves depends_on out of its config hash, so no remaining container is recreated.
• MODE=services edits each stack's live overlay instead of re-rendering it. The stacks predate later template additions (FILE_SIZE_LIMIT, functions env_file), so a re-render would recreate storage and functions. Before anything is applied, every remaining service's new hash must equal its running container's label. db is never recreated, and drift in any other service is refused unless --allow-recreate is given. .env and the overlay are backed up as <name>.bak-NNN.<ext>, then up -d --remove-orphans --pull never runs.
• dev2-site supabase-services <site> [--dry-run]. A site opts back in with sites.d "keep_services": ["imgproxy", ...].

Gateway ports, keys, JWT secret, container names and networks are unchanged. So no app.env, nginx vhost, app image or deploy-dev2.yml workflow is affected.

Tested

• bash -n and py_compile.
• Transform round trip on a live overlay: lean, then keep all, gives a byte-identical original. A second lean pass is a no-op.
• --dry-run on all 21 stacks: keep=7 (db included), remove=imgproxy,meta,studio,supavisor, nothing recreated.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

25 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 12 | LOW: 9

Severity	Rule	Location
HIGH	sh-remote-script-execution	root-ubuntu.sh:3236
HIGH	sh-remote-script-execution	root-ubuntu.sh:3237
HIGH	sh-remote-script-execution	root-ubuntu.sh:5071
HIGH	sh-remote-script-execution	root-ubuntu.sh:5075
MEDIUM	sql-template-interpolation	dev2/dev2-site:815
MEDIUM	sql-template-interpolation	dev2/dev2-site:892
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5248
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1042
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:36
LOW	secret-generic-credential	src/user-export.ts:632
LOW	secret-generic-credential	src/user-export.ts:638
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.