DevOps Runbook Series: Security for the Self-Hosted Stack

This series provides six hands-on runbooks for operating a self-hosted app stack securely. It is written for DevOps teams running Supabase, Next.js and related technologies in production who want to secure their infrastructure systematically.

Why a systematic approach matters

Self-hosting gives you control over data and infrastructure. That control comes with responsibility: every component has its own security requirements, and dependencies between layers stay invisible when reviewed in isolation.

A systematic, machine-readable security approach across all layers makes the difference. According to the SANS Institute (2024), organizations with a machine-readable security baseline detect configuration drift on average 14 times faster than teams without a baseline.

This series walks you through the stack layer by layer and concludes with a YAML-based baseline that consolidates all rules from the individual runbooks.

Series overview

Part	Article	Focus area	Key deliverable
1	Supabase Self-Hosting Runbook	Platform foundation	Server architecture, Docker Compose, RLS
2	Running Next.js on Supabase Securely	App layer	Auth, Middleware, environment separation
3	Deploying Supabase Edge Functions Securely	Integrations	Webhooks, signatures, CORS
4	Running Trigger.dev Background Jobs Securely	Async processing	Tasks, idempotency, concurrency
5	Claude Code as Security Control in DevOps Workflows	Automated audits	Custom commands, headless mode
6	Security Baseline for the Entire Stack	Full-stack baseline	YAML, automated checks

The articles in detail

Part 1 - Supabase Self-Hosting Runbook. Describes a two-server architecture (production and audit), Docker Compose with version-pinned images, service configuration for seven components, and Row Level Security as a requirement on all public tables.

Part 2 - Running Next.js securely. Covers the app layer on top of Supabase: auth flow with PKCE, middleware for route protection, strict environment separation between server and client, and secure API route patterns.

Part 3 - Deploying Edge Functions securely. Focuses on webhook processing with signature verification, CORS configuration, input validation in the Deno runtime, and secure secret management for third-party integrations.

Part 4 - Trigger.dev Background Jobs. Describes the self-hosted setup of Trigger.dev v3, idempotent task definition, concurrency control, retry strategies, and secrets isolation between tasks.

Part 5 - Claude Code as security control. Shows how to use Claude Code as an automated audit tool in DevOps workflows: custom commands, headless audit runs, and CI pipeline integration.

Part 6 - Security Baseline. Consolidates all rules from articles 1 through 5 into a machine-readable security-baseline.yml. Includes deterministic check scripts and integration with the Claude Code audit.

Who this series is for

• DevOps engineers running self-hosted infrastructure
• CTOs and technical leads evaluating self-hosting vs. managed services
• Security engineers auditing app stacks
• Developers building on Supabase and Next.js

How to use this series

• Read the articles in order from 1 to 6, as they build on each other
• Download the Claude Code checklists at the end of each article
• Implement the recommendations layer by layer in your environment
• Use the security baseline from article 6 as a daily monitoring gate