Server sized for your workload in your account (Hetzner, DigitalOcean, AWS, Hostinger VPS or similar), OS hardened, firewall, SSH keys only.
Supabase via the official Docker Compose setup, pinned to a release.
Every secret and key generated fresh; nothing left at example defaults.
HTTPS through a reverse proxy, your domain via Cloudflare DNS.
Studio and Postgres not exposed to the public internet; dashboard protected.
Auth configured: site URL, redirect URLs, custom SMTP, email templates.
Storage on local disk or S3-compatible object storage (S3, R2).
Connection pooling configured for your app.
Automated offsite database backups, and a restore test we run with you.
Uptime and resource monitoring with alerts to your inbox.
Update procedure documented and tested once.
Runbook: start/stop, logs, rotate keys, restore, update.