feat: add supabase deployer

roles/supabase/defaults/main.yml

@@ -0,0 +1,65 @@
+---
+# --- Debugging ---
+# Set to false to disable no_log and expose secret values in task output.
+# Never set false in production or shared environments.
+supabase_no_log: true
+
+# --- Vault ---
+# KV2 path where Supabase secrets are stored and retrieved.
+# Run with: op run --env-file=~/.ansible.zshenv -- ansible-navigator ...
+# so that VAULT_ADDR / VAULT_TOKEN are injected from 1Password.
+supabase_vault_mount: kv
+supabase_vault_path: supabase
+
+# --- Helm release ---
+supabase_release_name: supabase
+supabase_namespace: supabase
+supabase_chart_repo_url: https://supabase-community.github.io/supabase-kubernetes
+supabase_chart_version: ""   # blank = latest
+
+# --- External access ---
+# Studio and API gateway are both served through Kong on this hostname.
+# No generic default — must be set in host_vars or group_vars.
+supabase_studio_host: ""
+supabase_tls_cluster_issuer: ""
+
+# --- Storage ---
+# Empty string uses the cluster's default StorageClass.
+supabase_storage_class: ""
+supabase_db_storage_size: 10Gi
+supabase_functions_storage_size: 1Gi
+supabase_imgproxy_storage_size: 1Gi
+supabase_minio_storage_size: 20Gi
+
+# --- Database ---
+supabase_db_name: postgres
+
+# --- Studio branding ---
+supabase_org_name: ""
+supabase_project_name: ""
+
+# --- SMTP (set supabase_smtp_enabled: true to configure email auth) ---
+supabase_smtp_enabled: false
+supabase_smtp_host: ""
+supabase_smtp_port: 587
+supabase_smtp_admin_email: ""
+supabase_smtp_sender_name: Supabase
+
+# --- Internal component name overrides ---
+# These become predictable Kubernetes resource names (service, SA, etc.)
+# Must match deployment.*.fullnameOverride values passed to the chart
+supabase_db_fullname: supabase-db
+supabase_kong_fullname: supabase-kong
+supabase_functions_fullname: supabase-functions
+supabase_vector_fullname: supabase-vector
+
+# --- Docker Hub pull secret (optional) ---
+# Set to avoid anonymous rate limiting on docker.io images (kong, timberio/vector, etc.)
+# vault_supabase_dockerhub_token must be set in host_vars when enabled.
+supabase_dockerhub_enabled: false
+supabase_dockerhub_username: ""
+
+# --- Wait ---
+# helm wait is disabled — image pulls from docker.io can take longer than any
+# reasonable helm timeout. Pod readiness is checked separately below.
+supabase_wait_timeout: 600