(WIP) feat: deploy gotrue using system manager

yvan-sraka · yvan-sraka · commit 6dbea427773c · 2025-09-22T15:25:44.000+02:00
diff --git a/ansible/files/gotrue-optimizations.service.j2 b/ansible/files/gotrue-optimizations.service.j2
diff --git a/ansible/files/gotrue.service.j2 b/ansible/files/gotrue.service.j2
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
@@ -13,7 +13,7 @@
           dest: "00-schema.sql",
         }
       - { source: "stat_extension.sql", dest: "01-extension.sql" }
-    
+
   environment:
     PATH: /usr/lib/postgresql/bin:{{ ansible_env.PATH }}
 
@@ -40,13 +40,6 @@
       import_tasks: tasks/setup-wal-g.yml
       when: debpkg_mode or nixpkg_mode or stage2_nix
 
-    - name: Install Gotrue
-      import_tasks: tasks/setup-gotrue.yml
-      tags:
-        - install-gotrue
-        - install-supabase-internal
-      when: debpkg_mode or nixpkg_mode
-  
     - name: Install PostgREST
       import_tasks: tasks/setup-postgrest.yml
       tags:
@@ -96,7 +89,7 @@
         src: files/apt_periodic
         dest: /etc/apt/apt.conf.d/10periodic
       when: debpkg_mode or nixpkg_mode
-      
+
     - name: Transfer init SQL files
       copy:
         src: files/{{ item.source }}
@@ -131,13 +124,13 @@
       tags:
         - install-supabase-internal
       when: debpkg_mode or stage2_nix
-      
+
     - name: Finalize AMI
       import_tasks: tasks/finalize-ami.yml
       tags:
         - install-supabase-internal
       when: debpkg_mode or nixpkg_mode
-      
+
     - name: Enhance fail2ban
       import_tasks: tasks/setup-fail2ban.yml
       when: debpkg_mode or nixpkg_mode
@@ -218,7 +211,7 @@
         systemctl stop postgresql.service
       when: stage2_nix
 
-    - name: Remove osquery    
+    - name: Remove osquery
       become: yes
       shell: |
         sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile remove osquery"
diff --git a/ansible/tasks/setup-gotrue.yml b/ansible/tasks/setup-gotrue.yml
diff --git a/ansible/vars.yml b/ansible/vars.yml
@@ -24,9 +24,6 @@ postgrest_release: "13.0.5"
 postgrest_arm_release_checksum: sha256:7b4eafdaf76bc43b57f603109d460a838f89f949adccd02f452ca339f9a0a0d4
 postgrest_x86_release_checksum: sha256:05be2bd48abee6c1691fc7c5d005023466c6989e41a4fc7d1302b8212adb88b5
 
-gotrue_release: 2.179.0
-gotrue_release_checksum: sha1:e985fce00b2720b747e6a04420910015c4967121
-
 aws_cli_release: "2.23.11"
 
 salt_minion_version: 3007
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -33,7 +33,15 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     system-manager = {
-      url = "github:numtide/system-manager";
+      # FIXME: remove custom branch when this PR is merged:
+      # https://github.com/numtide/system-manager/pull/266
+      url = "github:numtide/system-manager/users";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    gotrue = {
+      # FIXME: remove custom fork when this PR is merged:
+      # https://github.com/supabase/auth/pull/2166
+      url = "github:yvan-sraka/auth";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
diff --git a/nix/systemConfigs.nix b/nix/systemConfigs.nix
@@ -1,9 +1,12 @@
 { self, inputs, ... }:
 let
   mkModules = system: [
+    inputs.gotrue.nixosModules.auth
+    self.systemModules.gotrue
     ({
       services.nginx.enable = true;
       nixpkgs.hostPlatform = system;
+      supabase.services.gotrue.enable = true;
     })
   ];
 
diff --git a/nix/systemModules/default.nix b/nix/systemModules/default.nix
@@ -4,6 +4,8 @@
 {
   imports = [ ./tests ];
   flake = {
-    systemModules = { };
+    systemModules = {
+      gotrue = ./gotrue.nix;
+    };
   };
 }
diff --git a/nix/systemModules/dummy-firewall.nix b/nix/systemModules/dummy-firewall.nix
@@ -0,0 +1,6 @@
+{ lib, ... }:
+{
+  options.networking.firewall = lib.mkOption {
+    type = lib.types.attrs;
+  };
+}
diff --git a/nix/systemModules/gotrue.nix b/nix/systemModules/gotrue.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  config,
+  self,
+  system,
+  ...
+}:
+let
+  cfg = config.supabase.services.gotrue;
+in
+{
+  imports = [
+    # TODO: actually open the ports it needs with ufw
+    ./dummy-firewall.nix
+  ];
+
+  options = {
+    supabase.services.gotrue = {
+      enable = lib.mkEnableOption "Supabase (gotrue) authentication service";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.userborn.enable = true;
+    services.auth = {
+      enable = true;
+      package = self.inputs.gotrue.packages.${system}.default;
+    };
+
+    systemd.services.gotrue = {
+      wantedBy = lib.mkForce [
+        "system-manager.target"
+      ];
+    };
+    # TODO: supabase-admin-api haven't been turned into a system-manager module yet:
+    #
+    # systemd.services.gotrue-optimizations = {
+    #   description = "gotrue (auth) optimizations";
+    #   wantedBy = [ "gotrue.service" ];
+    #   serviceConfig = {
+    #     Type = "oneshot";
+    #     # we don't want failures from this command to cause PG startup to fail
+    #     ExecStart = "/bin/bash -c '/opt/supabase-admin-api optimize auth --destination-config-file-path /etc/gotrue/gotrue.generated.env ; exit 0'";
+    #     ExecStartPost = "/bin/bash -c 'cp -a /etc/gotrue/gotrue.generated.env /etc/auth.d/20_generated.env ; exit 0'";
+    #     User = "postgrest";
+    #   };
+    # };
+
+    # TODO: that's what the activation script was doing:
+    # cp $out/etc/auth.env /etc/auth.d/20_generated.env
+    # chown gotrue:gotrue /etc/auth.d/20_generated.env
+    # chmod 600 /etc/auth.d/20_generated.env
+  };
+}
diff --git a/nix/systemModules/tests/test_gotrue.py b/nix/systemModules/tests/test_gotrue.py
@@ -0,0 +1,11 @@
+# from time import sleep
+
+
+def test_gotrue_service(host):
+    # sleep(5000)  # Handy for interactive debugging (with docker exec -it $CONTAINER_ID /bin/bash)
+    assert host.service("gotrue.service").is_valid
+    assert host.service("gotrue.service").is_running, (
+        "Auth service should be running but failed: {}".format(
+            host.run("systemctl status gotrue.service").stdout
+        )
+    )

Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,8 @@`
`4`	`4`	`{`
`5`	`5`	`imports = [ ./tests ];`
`6`	`6`	`flake = {`
`7`		`- systemModules = { };`
	`7`	`+ systemModules = {`
	`8`	`+ gotrue = ./gotrue.nix;`
	`9`	`+ };`
`8`	`10`	`};`
`9`	`11`	`}`