zgbrenner collapses Gary down to two vendors

A self-hosting cleanup that swaps three outside services for two, making Gary far easier for a small team to stand up.

infrastructuresecurity

zgbrenner finished moving Gary's login and identity handling onto Clerk, a hosted authentication service, and folded all file storage into Supabase - the same platform already running the app's database. That retires the separate Cloudflare R2 object-storage account the fork used to depend on.

The trade is deliberate. You give up some flexibility: Supabase's storage isn't a perfect drop-in for a dedicated file service, and you're now tying your database and your files to one vendor. In return, a deployment needs two external services instead of three - login on one side, database and files on the other - which is meaningfully less to wire up and pay for. zgbrenner notes Supabase's storage access has to be switched on by hand before the backend will start.

So what Worth a look for anyone running a small or solo deployment who wants fewer moving parts and is already committed to Supabase.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from zgbrenner/gary, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date

a7ea67d0 feat: verify Clerk tokens in backend, use Supabase for storage Claude 2026-05-20 ↗ GitHub

SHA	Subject	Author	Date
`a7ea67d0`	feat: verify Clerk tokens in backend, use Supabase for storage	Claude	2026-05-20	↗ GitHub
commit body Complete the Clerk migration on the backend side and consolidate the data layer onto Supabase so Gary can run without Cloudflare. - Backend auth: requireAuth verifies Clerk session JWTs via @clerk/backend instead of Supabase tokens; Clerk user id flows to res.locals.userId - Resolve user emails through the Clerk API (cached); the sharing/"people" endpoints now look users up via Clerk, not Supabase Auth - Schema: user_profiles and user_api_keys store the Clerk user id as text and no longer depend on auth.users; drop the Supabase Auth signup trigger - Account deletion removes the Clerk user plus the profile/api-key rows - Storage: switch the S3 client config from R2-specific env vars to generic S3_* vars (with a configurable region) so Supabase Storage works - Remove the dead frontend storage helper and the unused Supabase JWT helper - Docs: add docs/SUPABASE_SETUP.md and update env examples / deployment docs https://claude.ai/code/session_018GMAE164ehpBTxzBdsof9r

commit body

Complete the Clerk migration on the backend side and consolidate the data
layer onto Supabase so Gary can run without Cloudflare.

- Backend auth: requireAuth verifies Clerk session JWTs via @clerk/backend
  instead of Supabase tokens; Clerk user id flows to res.locals.userId
- Resolve user emails through the Clerk API (cached); the sharing/"people"
  endpoints now look users up via Clerk, not Supabase Auth
- Schema: user_profiles and user_api_keys store the Clerk user id as text
  and no longer depend on auth.users; drop the Supabase Auth signup trigger
- Account deletion removes the Clerk user plus the profile/api-key rows
- Storage: switch the S3 client config from R2-specific env vars to generic
  S3_* vars (with a configurable region) so Supabase Storage works
- Remove the dead frontend storage helper and the unused Supabase JWT helper
- Docs: add docs/SUPABASE_SETUP.md and update env examples / deployment docs

https://claude.ai/code/session_018GMAE164ehpBTxzBdsof9r

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-567.md from inside the repo you want the changes in.

⬇ Download capture-thread-567.md