{$PROXY_DOMAIN} {
    @supabase_api path /auth/v1/* /rest/v1/* /graphql/v1 /realtime/v1/* /storage/v1/* /functions/v1/* /mcp /sso/*

    handle @supabase_api {
        reverse_proxy kong:8000
    }

    handle {
        basic_auth {
            # PROXY_AUTH_PASSWORD is overwritten with the bcrypt on startup
            {$PROXY_AUTH_USERNAME} {$PROXY_AUTH_PASSWORD}
        }

        reverse_proxy studio:3000
    }

    header -server
}