Use Cases and Workflow

This scenario is intended for applications accessible to public users. Bind an EIP to the application to make it accessible over the public network. The access URL is http(s)://{EIP}:8443. Email authentication and third-party GitHub login are supported, allowing end users to sign up and sign in. This scenario is suitable for official public-facing applications that require an account system, such as consumer-facing (ToC) products.

Figure 1 Workflow for access using an EIP

Workflow:

1. Preparations

   Buy an EIP, create a security group and an OBS bucket, create an access key ID (AK) and secret access key (SK), and buy an SSL certificate (optional).

2. Creating an RDS Supabase application
   • The creation process takes about 20–30 minutes.
   • After creation, configure access rules to allow traffic to reach the Supabase application port.
3. Access control
   • Bind an EIP: Enable access over the public network.
   • Enable SSL (optional): Enable SSL as needed to access the application securely over HTTPS.
   • Modify the security group (optional): Switch to a different security group as needed for your workload and configure relevant access rules to ensure normal access.
4. Workload configuration
   • Storage configuration (optional): Enable it as needed to store files such as audio, video, and images, with secure, high-performance uploads and downloads.
   • Auth configuration for email authentication (optional): Enable it as needed to integrate with an external email server and support email-based authentication.
   • Auth configuration for GitHub authentication (optional): Enable it as needed to integrate with GitHub OAuth for single sign-on (SSO).
5. Application login

   Web login over the public network is supported through the Dashboard console. The access URL is http(s)://{EIP}:8443.

6. Application integration

   Obtain the API key for your scenario. Use it with the access URL to call backend services through the SDK.

Notes

• An EIP can be bound to only one application. After enabling email or GitHub authentication, do not unbind the EIP or delete security group rules.
• Allow inbound TCP traffic on port 8443 in the security group. Allow outbound traffic required for email, GitHub, and the frontend application.

This scenario is intended for public-facing applications. A DNAT gateway forwards public network traffic to the application on the private network. The access URL is http(s)://{DNAT_public_IP}:{Public_port}. GitHub authentication is not supported. Email authentication supports only simple account login (email account sign-up and email delivery are not supported). Multiple applications can share one EIP and be distinguished by their public ports. This scenario is suitable for public APIs that do not require strong authentication or for exposing internal services to the public network.

Figure 2 Workflow for access using public DNAT

Workflow:

1. Preparations

   Buy a NAT gateway and an EIP, create a security group and an OBS bucket, create an AK/SK pair, and buy an SSL certificate (optional).

2. Creating an RDS Supabase application
   • The creation process takes about 20–30 minutes.
   • After creation, configure access rules to allow traffic to reach the Supabase application port.
3. Access control
   • Bind a DNAT gateway address: Enable access over the public network.
   • Enable SSL (optional): Enable SSL as needed to access the application securely over HTTPS.
   • Modify the security group (optional): Switch to a different security group as needed for your workload and configure relevant access rules to ensure normal access.
4. Workload configuration
   • Storage configuration (optional): Enable it as needed to store files such as audio, video, and images, with secure, high-performance uploads and downloads.
   • Auth configuration for email login (optional): Enable it as needed. Only basic account sign-in and sign-up without confirmation are supported. (With automatic confirmation enabled, accounts are created successfully immediately after sign-up, without sending confirmation emails or requiring user confirmation.) Sign-up with email confirmation is not supported (this method sends a confirmation email to the registered email address and requires the user to click the confirmation link to complete registration). Email sending is also not supported.
5. Application login

   Web login over the public network is supported through the Dashboard console. The access URL is http(s)://{DNAT_public_IP}:{Public_port}.

6. Application integration

   Obtain the API key for your scenario. Use it with the access URL to call backend services through the SDK.

Notes

• The gateway and the application must be in the same subnet. The EIP must not be in use by another gateway or application. The NAT gateway and EIP are billed separately.
• Configure the security group to allow inbound traffic on the public port associated with the DNAT gateway address.
• GitHub authentication is not supported in this scenario. Email functionality is limited to basic account sign-in and sign-up with automatic confirmation. Email confirmation during sign-up, email template configuration, and email delivery are not supported. Full email authentication is unavailable.
• Simple account login: Create users in the Authentication module of the Supabase Dashboard console and select automatic confirmation. These users can then use their accounts to sign in to Supabase services.
• DNAT distinguishes multiple applications by public port. Plan the port assignments in advance.

This scenario is intended for private network environments that are not accessible from the public network. The application and clients must be in the same VPC and subnet, and data does not traverse the public network. The access URL is http://{Private_IP}:8443. GitHub authentication is not supported. Email authentication is supported only through an email service accessible over the private network, such as an internal SMTP server, and must be enabled as needed. This scenario is suitable for internal development and testing and for integration with business systems within the same VPC.

Figure 3 Workflow for private network access

Workflow:

1. Preparations

   Create a security group and an OBS bucket, create an AK/SK pair, and buy an SSL certificate (optional). An EIP or NAT gateway is not required for this scenario.

2. Creating an RDS Supabase application
   • The creation process takes about 20–30 minutes.
   • After creation, configure access rules to allow traffic to reach the Supabase application port.
3. Access control
   • Enable SSL (optional): Enable SSL as needed to access the application securely over HTTPS.
   • Modify the security group (optional): Switch to a different security group as needed for your workload and configure relevant access rules to ensure normal access.
4. Workload configuration

   Storage configuration (optional): Enable it as needed to store files such as audio, video, and images, with secure, high-performance uploads and downloads.

   Auth configuration for email authentication (optional): Enable it as needed to integrate with an email service accessible over the private network, such as a self-managed SMTP server.

5. Application login

   Web login is supported only within the private VPC network through the Dashboard console. The access URL is http://{Private_IP}:8443.

6. Application integration

   Obtain the API key for your scenario. Use it with the access URL to call backend services through the SDK.

Notes

• Clients must have private network connectivity to the application within the same VPC and subnet. The application and instance must also be in the same VPC and subnet. Only IPv4 is supported, and this configuration cannot be changed after creation.
• GitHub authentication is not supported. Email authentication is supported only over the private network. Enable it as needed and ensure that the SMTP server is reachable over the private network and outbound traffic is allowed.