How to Self-Host Supabase on Ubuntu VPS with Docker (Free Firebase Alternative)

Why Self-Host Supabase on Your Own Cloud VPS?

Supabase is the premier open-source alternative to Google Firebase. It provides developers with a full enterprise stack: an ACID-compliant PostgreSQL database, automated instant REST and GraphQL APIs (PostgREST), real-time WebSocket subscriptions, complete user authentication with OAuth providers (GoTrue), AI vector embeddings (pgvector), and a web-based administrative Studio dashboard.

While Supabase Cloud offers a generous managed tier, high-concurrency applications, vector search workloads, and large file storage pools can quickly exceed free allowances. Self-hosting Supabase on an Ubuntu Cloud VPS provides 100% data sovereignty, zero database row limits, unlimited storage volumes, and total freedom to customize PostgreSQL extensions—without recurring SaaS bills.

In this technical deployment playbook, we will configure official Supabase Docker Compose on Ubuntu 24.04/22.04 LTS, generate production cryptographic secrets, configure PostgreSQL with pgvector, and expose the Studio dashboard securely behind an Nginx reverse proxy with SSL encryption.

Step 1: Installing Docker Engine and Git

Ensure your Ubuntu VPS has Docker Engine and Docker Compose V2 installed:

# Update package list and install Docker prerequisite tools
sudo apt update && sudo apt install -y curl git openssl ca-certificates

# Install official Docker CE and compose plugin
curl -fsSL https://get.docker.com | sudo sh
sudo systemctl enable --now docker

Step 2: Cloning the Official Supabase Docker Repository

Clone the official Supabase repository and navigate to the production Docker directory:

# Clone Supabase repository
git clone --depth 1 https://github.com/supabase/supabase /var/www/supabase

# Enter docker orchestration folder
cd /var/www/supabase/docker

# Copy production environment template
cp .env.example .env

Step 3: Generating Cryptographic Security Secrets

Never run Supabase in production with default secrets. You must generate unique cryptographic tokens for JWT signing, database root credentials, and API secret keys:

# Generate random 32-character database and JWT secrets
openssl rand -hex 32
openssl rand -hex 32
openssl rand -base64 32

Edit /var/www/supabase/docker/.env and configure the following essential environment keys:

# Database Credentials
POSTGRES_PASSWORD=YourStrongDatabasePassword2026!
POSTGRES_DB=postgres

# API & Studio Security
JWT_SECRET=YourSuperLongJwtSecretKeyAtLeast32Chars!
ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Web Dashboard Credentials
DASHBOARD_USERNAME=admin
DASHBOARD_PASSWORD=UltraSecureAdminPass2026!

# Public Base URLs
SITE_URL=https://app.example.com
API_EXTERNAL_URL=https://supabase.example.com

Step 4: Launching Supabase Fleet via Docker Compose

Start the Supabase microservices cluster in background daemon mode:

# Pull latest container images and launch cluster
docker compose up -d

# Verify that all 11 Supabase services are healthy
docker compose ps

Step 5: Nginx Reverse Proxy Configuration & SSL Setup

Expose the Supabase Kong API gateway (port 8000) and Studio dashboard (port 3000 or 8000) via Nginx at /etc/nginx/sites-available/supabase.example.com:

server {
    listen 80;
    server_name supabase.example.com;

    client_max_body_size 100M;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Activate the configuration and issue a free Let’s Encrypt SSL certificate:

sudo ln -s /etc/nginx/sites-available/supabase.example.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d supabase.example.com

Supabase Architecture Component Overview

Production Security & Backup Checklist

• Automate PostgreSQL Dumps: Schedule a nightly docker exec -t supabase-db pg_dumpall -U postgres | gzip > /backups/supabase.sql.gz cron job.
• Restrict Direct Database Access: Keep port 5432 bound to 127.0.0.1 and access via SSH tunneling or internal Docker networks only.
• Enable Rate Limiting in Kong: Configure request throttling on authentication endpoints to prevent brute-force attacks.

Enabling and Leveraging pgvector for AI & LLM Embeddings

One of Supabase’s most compelling capabilities is native support for pgvector, allowing you to store high-dimensional vector embeddings generated by OpenAI, Anthropic, or HuggingFace directly alongside your relational application data for semantic search and Retrieval-Augmented Generation (RAG):

-- Enable pgvector extension in Supabase PostgreSQL CLI
CREATE EXTENSION IF NOT EXISTS vector;

-- Create documents table with vector embeddings
CREATE TABLE documentation_embeddings (
    id BIGSERIAL PRIMARY KEY,
    content TEXT,
    embedding VECTOR(1536),
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

-- High-speed Cosine Similarity Index
CREATE INDEX ON documentation_embeddings USING ivfflat (embedding vector_cosine_ops) WITH (lists = 100);

Automating Disaster Recovery & Nightly PostgreSQL Backups

Protect your database by creating a persistent backup cron script at /usr/local/bin/backup-supabase.sh:

#!/bin/bash
set -e
BACKUP_DIR="/var/backups/supabase/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR

# Export compressed dump of entire PostgreSQL database cluster
docker exec -t supabase-db pg_dumpall -U postgres | gzip > $BACKUP_DIR/supabase_all.sql.gz

# Delete backups older than 30 days
find /var/backups/supabase/ -type d -mtime +30 -exec rm -rf {} +
echo "Supabase database backup completed successfully!"

Supabase Microservices Port & Resource Allocation