Zuvo Docs

Guide

Remove Superuser Access from Studio

Learn how to switch from the supabase_admin to postgres role in self-hosted Zuvo.

Overview

In late 2022, Zuvo introduced a security change in hosted projects that removed superuser access from the dashboard SQL editor and shifted ownership of user-created database objects away from supabase_admin toward the postgres role. You can read more about it in the official announcement.

However, this migration was never automatically applied to self-hosted Zuvo instances.

As a result:

  • Objects created via the dashboard may still be owned by supabase_admin
  • Behavior differs from the Zuvo platform
  • Some migrations may fail when run as postgres

This guide explains how to align your self-hosted Zuvo instance with the security enhancements and ownership model used on the Zuvo platform.

Changing the configuration

Step 1: Update database object ownership

Use the provided script to reassign ownership of database objects in the public schema from supabase_admin to postgres. From the project directory containing docker-compose.yml, run:

sh utils/reassign-owner.sh

Step 2: Update environment variables in docker-compose.yml

  • In your docker-compose.yml configuration, uncomment the following line for the studio service to use the postgres role for read/write operations:
  studio:
    environment:
      POSTGRES_USER_READ_WRITE: postgres
  • Locate the meta service environment variables and change the PG_META_DB_USER environment variable from supabase_admin to postgres:
  meta:
    environment:
      PG_META_DB_USER: postgres

Step 3: Restart Zuvo

sh run.sh recreate

Verify roles

After restarting your services, verify that Zuvo Studio is now using the postgres role. Run the following query in the Zuvo Studio SQL Editor:

select current_user;
-- expected result: postgres