Remove openclaw. Start supabase work. In flight

roles/supabase/defaults/main.yml

@@ -59,6 +59,13 @@ supabase_vector_fullname: supabase-vector
 supabase_dockerhub_enabled: false
 supabase_dockerhub_username: ""
 
+# --- External DB access ---
+# External hostname (or IP) clients use to reach the postgres NodePort.
+# Must be set in host_vars; no safe generic default.
+supabase_db_external_host: ""
+# NodePort assigned for external postgres access (30000-32767).
+supabase_db_nodeport: 30432
+
 # --- Wait ---
 # helm wait is disabled — image pulls from docker.io can take longer than any
 # reasonable helm timeout. Pod readiness is checked separately below.

roles/supabase/meta/argument_specs.yml

@@ -114,6 +114,19 @@ argument_specs:
           name that receives the privileged SCC.
         type: str
         default: supabase-vector
+      supabase_db_external_host:
+        description: >-
+          External hostname or IP used in the postgres_url written to Vault and
+          by clients connecting via the NodePort Service. Must be set in host_vars.
+        type: str
+        default: ""
+      supabase_db_nodeport:
+        description: >-
+          NodePort assigned for external PostgreSQL access (30000-32767).
+          Used both when creating the NodePort Service and when constructing the
+          postgres_url written to Vault.
+        type: int
+        default: 30432
       supabase_wait_timeout:
         description: Seconds to wait for deployments to become ready.
         type: int

roles/supabase/tasks/main.yml

@@ -452,7 +452,30 @@
           caCertificate: ""
 
 # ------------------------------------------------------------------
-# Step 7: Wait for Kong deployment to be healthy
+# Step 7: NodePort Service for external PostgreSQL access
+# ------------------------------------------------------------------
+- name: Create NodePort Service for external PostgreSQL access
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: "{{ supabase_db_fullname }}-external"
+        namespace: "{{ supabase_namespace }}"
+      spec:
+        type: NodePort
+        selector:
+          app.kubernetes.io/name: "{{ supabase_db_fullname }}"
+          app.kubernetes.io/instance: "{{ supabase_release_name }}"
+        ports:
+          - name: postgres
+            port: 5432
+            targetPort: 5432
+            nodePort: "{{ supabase_db_nodeport | int }}"
+
+# ------------------------------------------------------------------
+# Step 9: Wait for Kong deployment to be healthy
 # ------------------------------------------------------------------
 - name: Wait for Kong deployment to be ready
   kubernetes.core.k8s_info:
@@ -468,7 +491,7 @@
   delay: 10
 
 # ------------------------------------------------------------------
-# Step 8: Summary
+# Step 10: Summary
 # ------------------------------------------------------------------
 - name: Display Supabase deployment summary
   ansible.builtin.debug:

roles/supabase/tasks/vault_secrets.yml

@@ -144,6 +144,15 @@
       openai_api_key: "{{ __supabase_openai_api_key }}"
   no_log: "{{ supabase_no_log }}"
 
+- name: Write postgres_url to oys/dev/supabase in Vault
+  community.hashi_vault.vault_kv2_write:
+    path: oys/dev/supabase
+    engine_mount_point: "{{ supabase_vault_mount }}"
+    data:
+      postgres_url: >-
+        postgresql://postgres:{{ __supabase_db_password }}@{{ supabase_db_external_host }}:{{ supabase_db_nodeport }}/{{ supabase_db_name }}
+  no_log: "{{ supabase_no_log }}"
+
 - name: Report vault secret status
   ansible.builtin.debug:
     msg: >-