Deploy it: the poor man’s stack

A small cloud server with 4GB RAM - the Supabase stack is the hungry tenant, and 2GB plus swap works until the day it does not. Any of the budget providers do; pick one with a data centre near your players.

Two DNS A records at your registrar: one for the app (app.example.com or the bare domain) and one for the API (api.example.com), both pointing at the box.

SSH keys only (password login off), a firewall allowing exactly 22, 80 and 443, and automatic security updates. Docker and Docker Compose from the official install script.

Clone their docker directory, then change every secret before first start: the Postgres password, the JWT secret, and the anon and service keys generated from it. The defaults are publicly known - a stack started with them is open to anybody who read the same README.

Keep Studio and anything administrative off the public ports - reachable through an SSH tunnel or behind auth in the reverse proxy, never bare. Then apply the migrations from the kxb repository against your database.

The repository ships a Dockerfile; the poor man’s registry is no registry - build the image on the server. One thing must be right at build time, not at run time: the NEXT_PUBLIC_* variables (your Supabase URL and anon key) are baked into the client bundle during the build. Setting them afterwards changes nothing and fails silently.

Run the container with restart unless-stopped, listening only on localhost - the proxy is the one with the public face.

Caddy exists because of setups like this: a few lines mapping your two hostnames to the two local ports, and it fetches and renews the TLS certificates by itself. There is genuinely nothing else to do - no certbot, no cron, no openssl.

Signup confirmations need SMTP. A free transactional-mail tier is plenty at this scale - configure its credentials in the Supabase auth service and send a test signup before telling anybody the site exists.

Know the default send limits: self-hosted GoTrue ships conservative rate caps (on the order of tens of mails per hour, with a cooldown per address). Fine for a quiet launch; raise them deliberately when a real crowd arrives, not in a panic while it does.

A nightly pg_dump, compressed, copied off the box - a €1 storage box or any object storage does. Test the restore once, on a day you do not need it. Day-two operations are then one loop: pull, rebuild, restart, and the deploy is whatever minute you ran it in.

Before the domain goes anywhere public: the imprint placeholders from the starter guide, and the legal shell chapter. A deployed site is a published site.