Skip to main content
Self-hosting the platform is not available yet. To run builds on your own machines today, use self-hosted runners. The platform stays at app.outerlayer.ai, and each build runs on a machine you control.

​
Install against your own Supabase

A self-hosted OuterLayer connects to a Supabase you already have: Supabase Cloud, Supabase’s own self-hosted stack, or the Supabase CLI. A container applies OuterLayer’s database migrations to it. The steps live in docker/README.md, which covers the compose stack and the environment file.

​
Auth settings your Supabase needs

The Supabase CLI reads these settings from config.toml, so a CLI install needs no manual step. A Supabase you bring does. Turn each one on in your project before you sign in.
  • Custom access token hook. Turn it on and point it at the Postgres function public.custom_access_token_hook, which the migrations create. On Supabase Cloud, set it under Authentication > Hooks. On Supabase’s self-hosted stack, set GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_ENABLED=true and GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI=pg-functions://postgres/public/custom_access_token_hook on the auth service. Without the hook, the dashboard shows an error that names it.
  • OAuth server. Turn it on with the authorization path /oauth/consent. It backs the MCP connector sign-in, and it is in beta on Supabase Cloud. On Supabase Cloud, set it under Authentication > OAuth Server. On the self-hosted stack, set GOTRUE_OAUTH_SERVER_ENABLED=true and GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH=/oauth/consent.
  • Dynamic client registration. Leave it off. While it is on, any caller that can reach your Auth URL can register an OAuth client. It is part of the same OAuth server settings, and GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION=false turns it off on the self-hosted stack.
  • site_url. Set it to the URL people open the dashboard at. On Supabase Cloud, set the Site URL under Authentication > URL Configuration. On the self-hosted stack, set GOTRUE_SITE_URL.
  • Redirect URLs. Add <dashboard URL>/auth/callback for each address the dashboard is served from. On Supabase Cloud, add them under Authentication > URL Configuration. On the self-hosted stack, set GOTRUE_URI_ALLOW_LIST.

​
Evidence comments arrive later

A self-hosted platform has no message queue. Because of that, a build’s uploaded artifacts reach the pull request’s evidence comment late. They arrive only on the pull request’s next GitHub event or the next run of /api/cron/pr-comment-sweep. The hosted platform runs that sweep hourly, but the compose stack does not schedule it. Builds are not held up, because outerlayer sync prints each artifact’s link as it uploads it.