The cloud bill quietly passed $200 a month. The product grows, the database swells, the line on the statement grows with it. The thought arrived: host this myself.
On a napkin:
- Cloud: about $200/mo for the database, storage, bandwidth, backups
- VPS (8 GB RAM, 4 vCPU, 200 GB SSD): about $40/mo plus about $2 for cold backup storage
- Difference: about $158/mo, roughly $1896/year
For teams in sanctioned geographies, availability is a real risk. When production falls to geopolitics rather than bugs, the keys are better in your pocket.
Self-hosting here is not a romance of metal. It is unit economics: you pay with time for a predictable bill.
What you actually stand up
Supabase is not one container. PostgreSQL, PostgREST, GoTrue, Realtime, Storage, Kong, Studio. All in Docker, all on one network.
Only the gateway and Studio face the world. Postgres never does. That is the security.
Why not Nhost
If you live in GraphQL and Hasura, Nhost is closer. I took Supabase for REST, the docs, and the Next.js fit. You can switch later. It is almost a frontend rewrite.
How I moved
No memoirs. A working list.
- Prepared the VPS and a disk for backups. Access, monitoring, alerts.
- Deployed the official Docker stack. Checked that only the gateway and Studio were public.
- Created the database, enabled extensions the product needed: pgvector, pg_net.
- Moved schema and data. Dry-run first, then a night run.
- RLS, keys, secrets. Checked twice.
- Storage and CDN. Headers and permissions.
- Frontend SDK keys, regression, logging.
- DNS and a rollback prepared in advance.
Backups are not a place for heroism. Daily database snapshots, weekly into cold storage. Practice restores. Do not "trust".
It paid for itself in one or two weekends of work. In place of a vendor SLA you get your own zone: power, uptime, spare capacity. A UPS, a backup off this machine, a restore drill.
When load grows, some of it can go back to the cloud. Hybrid is fine.
What I tripped on
VPS bandwidth caps. Overage is billed separately. Learn the price first.
One extra allow in Storage or RLS costs more than it looks.
Postgres connection limits. "By eye" is not enough on the first peak.
When everything is yours, you suddenly need real dashboards. "We will look later" does not work.
The production keys are in my pocket now, not with a kind uncle. Calmer. More responsible too.
See also