LinumIQ/linumiq_net-web_app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): route server-side Supabase calls via internal URL to avoid edge rate-limit

Browse Source 
Server-side Supabase calls (middleware getUser/refresh, server components,
admin client) all egress through the Docker gateway as a single NATed IP and
traverse Caddy's per-IP /auth/* rate limiter (8 events/s). A handful of active
users saturate that shared bucket, 429ing getUser()/token refresh; the
middleware then treats the session as invalid and bounces to /login, while a
manual refresh lands under budget and works again.

Add SUPABASE_INTERNAL_URL (e.g. http://kong-prod:8000) used only by the
server-side clients (middleware, lib/supabase/server.ts, admin getSupabaseAdmin
/getSupabaseAnon), falling back to the public URL when unset. Browser clients
keep the public URL so real per-user-IP edge rate limiting still applies.

Also bake the arg in the Dockerfile/build and make the web-prod network alias
durable via WEB_ALIAS (dev sets web-dev) so the dev container can't reclaim the
web-prod alias on redeploy.
This commit is contained in:
Gerhard Scheikl
2026-06-02 12:45:10 +02:00
parent 9f8477f16f
commit fa457de8ec
5 changed files with 29 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/supabase/admin.ts
+7 -2
View File
@@ -33,7 +33,10 @@ const adminDispatcher = new Agent({
export function getSupabaseAdmin(): SupabaseClient {
if (_admin) return _admin;
const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
// Reach Supabase over the internal Docker network when configured, bypassing
// the Caddy edge/rate limiter; fall back to the public URL otherwise.
const url =
process.env.SUPABASE_INTERNAL_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL;
const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
if (!url || !key) {
throw new Error('Supabase admin env not configured');
@@ -57,7 +60,9 @@ export function getSupabaseAdmin(): SupabaseClient {
}
export function getSupabaseAnon(): SupabaseClient {
const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
// Server-side anon client also prefers the internal Docker URL.
const url =
process.env.SUPABASE_INTERNAL_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL;
const key = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
if (!url || !key) {
throw new Error('Supabase anon env not configured');
lib/supabase/server.ts
+3 -1
View File
@@ -4,7 +4,9 @@ import { cookies } from 'next/headers';
export function createSupabaseServerClient() {
const cookieStore = cookies();
return createServerClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
// Prefer the internal Docker URL so server-side calls skip the Caddy edge
// (and its rate limiter); fall back to the public URL when unset.
process.env.SUPABASE_INTERNAL_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
{
cookies: {