disclosure-bureau/infra/disclosure-stack/kong.yml

# Kong declarative config — Supabase API gateway.
# Routes:
#   /auth/v1/*    → GoTrue
#   /rest/v1/*    → PostgREST
#   /realtime/v1/* → Realtime
#   /storage/v1/* → Storage API
#   /pg/*         → postgres-meta (Studio backend)

_format_version: "2.1"
_transform: true

consumers:
  - username: anon
    keyauth_credentials:
      - key: ${SUPABASE_ANON_KEY}
  - username: service_role
    keyauth_credentials:
      - key: ${SUPABASE_SERVICE_KEY}

acls:
  - consumer: anon
    group: anon
  - consumer: service_role
    group: admin

services:
  # GoTrue (Supabase v2.x) bakes the API_EXTERNAL_URL host into PKCE email
  # confirmation links. Since our API gateway is api.disclosure.top but the
  # /auth/callback handler lives on the Next.js site disclosure.top, emails
  # would 404 at Kong. We catch the bare /auth/callback path on the api host
  # and proxy it to the Next.js web service — the browser stays on the api
  # subdomain but the Next.js handler still runs.
  - name: auth-callback-proxy
    url: http://web:3000
    routes:
      - name: auth-callback-proxy
        paths: [/auth/callback]
        strip_path: false
    plugins:
      - name: cors

  - name: auth-v1-open
    url: http://auth:9999/verify
    routes:
      - name: auth-v1-open
        strip_path: true
        paths: [/auth/v1/verify]
    plugins:
      - name: cors

  - name: auth-v1-open-callback
    url: http://auth:9999/callback
    routes:
      - name: auth-v1-open-callback
        strip_path: true
        paths: [/auth/v1/callback]
    plugins:
      - name: cors

  - name: auth-v1-open-authorize
    url: http://auth:9999/authorize
    routes:
      - name: auth-v1-open-authorize
        strip_path: true
        paths: [/auth/v1/authorize]
    plugins:
      - name: cors

  - name: auth-v1
    _comment: "GoTrue: /auth/v1/* -> http://auth:9999/*"
    url: http://auth:9999/
    routes:
      - name: auth-v1-all
        strip_path: true
        paths: [/auth/v1/]
    plugins:
      - name: cors
      - name: key-auth
        config: { hide_credentials: false }
      - name: acl
        config: { hide_groups_header: true, allow: [admin, anon] }

  - name: rest-v1
    _comment: "PostgREST: /rest/v1/* -> http://rest:3000/*"
    url: http://rest:3000/
    routes:
      - name: rest-v1-all
        strip_path: true
        paths: [/rest/v1/]
    plugins:
      - name: cors
      - name: key-auth
        config: { hide_credentials: true }
      - name: acl
        config: { hide_groups_header: true, allow: [admin, anon] }

  - name: realtime-v1
    _comment: "Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*"
    url: http://realtime:4000/socket/
    routes:
      - name: realtime-v1-all
        strip_path: true
        paths: [/realtime/v1/]
    plugins:
      - name: cors
      - name: key-auth
        config: { hide_credentials: false }
      - name: acl
        config: { hide_groups_header: true, allow: [admin, anon] }

  - name: storage-v1
    _comment: "Storage: /storage/v1/* -> http://storage:5000/*"
    url: http://storage:5000/
    routes:
      - name: storage-v1-all
        strip_path: true
        paths: [/storage/v1/]
    plugins:
      - name: cors

  - name: meta
    _comment: "pg-meta: /pg/* -> http://meta:8080/*"
    url: http://meta:8080/
    routes:
      - name: meta-all
        strip_path: true
        paths: [/pg/]
    plugins:
      - name: key-auth
      - name: acl
        config: { hide_groups_header: true, allow: [admin] }