Gerhard Scheikl
fa457de8ec
Server-side Supabase calls (middleware getUser/refresh, server components, admin client) all egress through the Docker gateway as a single NATed IP and traverse Caddy's per-IP /auth/* rate limiter (8 events/s). A handful of active users saturate that shared bucket, 429ing getUser()/token refresh; the middleware then treats the session as invalid and bounces to /login, while a manual refresh lands under budget and works again. Add SUPABASE_INTERNAL_URL (e.g. http://kong-prod:8000) used only by the server-side clients (middleware, lib/supabase/server.ts, admin getSupabaseAdmin /getSupabaseAnon), falling back to the public URL when unset. Browser clients keep the public URL so real per-user-IP edge rate limiting still applies. Also bake the arg in the Dockerfile/build and make the web-prod network alias durable via WEB_ALIAS (dev sets web-dev) so the dev container can't reclaim the web-prod alias on redeploy.
29 lines
880 B
TypeScript
29 lines
880 B
TypeScript
import { createServerClient } from '@supabase/ssr';
|
|
import { cookies } from 'next/headers';
|
|
|
|
export function createSupabaseServerClient() {
|
|
const cookieStore = cookies();
|
|
return createServerClient(
|
|
// Prefer the internal Docker URL so server-side calls skip the Caddy edge
|
|
// (and its rate limiter); fall back to the public URL when unset.
|
|
process.env.SUPABASE_INTERNAL_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL!,
|
|
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
|
|
{
|
|
cookies: {
|
|
getAll() {
|
|
return cookieStore.getAll();
|
|
},
|
|
setAll(toSet) {
|
|
try {
|
|
toSet.forEach(({ name, value, options }) => {
|
|
cookieStore.set(name, value, options);
|
|
});
|
|
} catch {
|
|
// Called from a Server Component — middleware will refresh.
|
|
}
|
|
},
|
|
},
|
|
},
|
|
);
|
|
}
|