Skip to content

dev2 supabase-stack: turn off phone signup autoconfirm #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralyodio merged 1 commit into from
Oct 6, 2026
Merged

dev2 supabase-stack: turn off phone signup autoconfirm #138

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dev2/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ dev2-site migrate <site> --yes the whole move, resumable; each step below is a
| `railway-stop` | `deploymentRemove` + `serviceDisconnect` (or the next push silently redeploys on Railway) |
| `merge` | merges the scaffold PR; CI deploys the default branch to dev2 |
| `retire` | `--yes`: `serviceDelete` for the app, companions and data services. Only after `verify --public` |
| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www/<site>/supabase` (compose project `<slug>-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.<site>` added to the site's cert/vhost/dns via `sites.d`. The `auth` service also reads `volumes/auth/auth.env` (created empty, 0600), which holds the site's `GOTRUE_*` settings that the base compose file only ships commented out. For example, phone sign-in needs `GOTRUE_SMS_PROVIDER=twilio` and the `GOTRUE_SMS_TWILIO_*` credentials there |
| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www/<site>/supabase` (compose project `<slug>-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.<site>` added to the site's cert/vhost/dns via `sites.d`. The `auth` service also reads `volumes/auth/auth.env` (created empty, 0600), which holds the site's `GOTRUE_*` settings that the base compose file only ships commented out. For example, phone sign-in needs `GOTRUE_SMS_PROVIDER=twilio` and the `GOTRUE_SMS_TWILIO_*` credentials there. Phone signup is off unless auth.env sets `GOTRUE_SMS_PROVIDER` or `GOTRUE_HOOK_SEND_SMS_ENABLED`, and phone (like email) autoconfirm is always off: upstream ships both on, which hands a session to any made-up number |
| `supabase-pull` | dumps the cloud project through its session pooler (password from the app's `SUPABASE_DB_PASSWORD`, or `--reset-password` through the management API) into `/root/dumps/<slug>-supabase-<ts>` |
| `supabase-load` | loads it (extensions, schema, data, grants, buckets, absolute storage-URL rewrite over every text/json column, realtime, cron) |
| `supabase-storage` | copies every Storage object through the two Storage APIs (node in a container on dev2; resumable) |
Expand Down
11 changes: 11 additions & 0 deletions dev2/templates/supabase-stack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,17 @@ set_env POOLER_PROXY_PORT_TRANSACTION "$POOLER_PORT"
set_env DISABLE_SIGNUP false
set_env ENABLE_EMAIL_SIGNUP true
set_env ENABLE_EMAIL_AUTOCONFIRM false
# Upstream .env.example ships phone signup ON with SMS autoconfirm ON. With no
# SMS provider, POST /auth/v1/signup {phone,password} then returns a live session
# for any made-up number, skipping email confirmation entirely; with a provider,
# autoconfirm still skips the OTP. So: autoconfirm always off, and phone signup
# only on for a site whose auth.env configures a way to send the SMS.
set_env ENABLE_PHONE_AUTOCONFIRM false
if grep -qE '^GOTRUE_(SMS_PROVIDER|HOOK_SEND_SMS_ENABLED)=' "$DIR/volumes/auth/auth.env" 2>/dev/null; then
set_env ENABLE_PHONE_SIGNUP true
else
set_env ENABLE_PHONE_SIGNUP false
fi
if [ -n "${SMTP_PASS:-}" ]; then
set_env SMTP_HOST smtp.resend.com; set_env SMTP_PORT 465; set_env SMTP_USER resend; set_env SMTP_PASS "$SMTP_PASS"
set_env SMTP_SENDER_NAME "${SMTP_SENDER:-$SITE}"; set_env SMTP_ADMIN_EMAIL "${SMTP_ADMIN:-noreply@$SITE}"
Expand Down
Loading