feat(dashboard-api): supabase auth users sync background runner

.env.gcp.template

@@ -77,6 +77,10 @@ CLICKHOUSE_CLUSTER_SIZE=1
 
 # Dashboard API instance count (default: 0)
 DASHBOARD_API_COUNT=
+# Dashboard API Supabase DB connection string (default: POSTGRES_CONNECTION_STRING)
+SUPABASE_DB_CONNECTION_STRING=
+# Enable dashboard-api auth user sync background worker (default: false)
+ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER=
 
 # Filestore cache for builds shared across cluster (default:false)
 FILESTORE_CACHE_ENABLED=

iac/modules/job-dashboard-api/jobs/dashboard-api.hcl

@@ -71,20 +71,12 @@ job "dashboard-api" {
       }
 
       env {
-        GIN_MODE                               = "release"
-        ENVIRONMENT                            = "${environment}"
-        NODE_ID                                = "$${node.unique.id}"
-        PORT                                   = "$${NOMAD_PORT_api}"
-        POSTGRES_CONNECTION_STRING             = "${postgres_connection_string}"
-        AUTH_DB_CONNECTION_STRING              = "${auth_db_connection_string}"
-        AUTH_DB_READ_REPLICA_CONNECTION_STRING = "${auth_db_read_replica_connection_string}"
-        CLICKHOUSE_CONNECTION_STRING           = "${clickhouse_connection_string}"
-        SUPABASE_JWT_SECRETS                   = "${supabase_jwt_secrets}"
-        REDIS_URL                              = "${redis_url}"
-        REDIS_CLUSTER_URL                      = "${redis_cluster_url}"
-        REDIS_TLS_CA_BASE64                    = "${redis_tls_ca_base64}"
-        OTEL_COLLECTOR_GRPC_ENDPOINT           = "${otel_collector_grpc_endpoint}"
-        LOGS_COLLECTOR_ADDRESS                 = "${logs_collector_address}"
+        NODE_ID = "$${node.unique.id}"
+        PORT    = "$${NOMAD_PORT_api}"
+
+        %{ for key, value in env ~}
+        ${key} = "${value}"
+        %{ endfor ~}
       }
 
       config {

iac/modules/job-dashboard-api/main.tf

@@ -1,27 +1,35 @@
+locals {
+  base_env = {
+    GIN_MODE                                = "release"
+    ENVIRONMENT                             = var.environment
+    POSTGRES_CONNECTION_STRING              = var.postgres_connection_string
+    AUTH_DB_CONNECTION_STRING               = var.auth_db_connection_string
+    AUTH_DB_READ_REPLICA_CONNECTION_STRING  = var.auth_db_read_replica_connection_string
+    SUPABASE_DB_CONNECTION_STRING           = var.supabase_db_connection_string
+    CLICKHOUSE_CONNECTION_STRING            = var.clickhouse_connection_string
+    SUPABASE_JWT_SECRETS                    = var.supabase_jwt_secrets
+    REDIS_URL                               = var.redis_url
+    REDIS_CLUSTER_URL                       = var.redis_cluster_url
+    REDIS_TLS_CA_BASE64                     = var.redis_tls_ca_base64
+    ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER = tostring(var.enable_auth_user_sync_background_worker)
+    OTEL_COLLECTOR_GRPC_ENDPOINT            = "localhost:${var.otel_collector_grpc_port}"
+    LOGS_COLLECTOR_ADDRESS                  = "http://localhost:${var.logs_proxy_port.port}"
+  }
+}
+
 resource "nomad_job" "dashboard_api" {
   jobspec = templatefile("${path.module}/jobs/dashboard-api.hcl", {
     update_stanza = var.update_stanza
     node_pool     = var.node_pool
     image_name    = var.image
-    environment   = var.environment
 
     count = var.count_instances
 
     memory_mb = 512
     cpu_count = 1
 
-    postgres_connection_string             = var.postgres_connection_string
-    auth_db_connection_string              = var.auth_db_connection_string
-    auth_db_read_replica_connection_string = var.auth_db_read_replica_connection_string
-    clickhouse_connection_string           = var.clickhouse_connection_string
-    supabase_jwt_secrets                   = var.supabase_jwt_secrets
-    redis_url                              = var.redis_url
-    redis_cluster_url                      = var.redis_cluster_url
-    redis_tls_ca_base64                    = var.redis_tls_ca_base64
+    env = local.base_env
 
     subdomain = "dashboard-api"
-
-    otel_collector_grpc_endpoint = "localhost:${var.otel_collector_grpc_port}"
-    logs_collector_address       = "http://localhost:${var.logs_proxy_port.port}"
   })
 }

iac/modules/job-dashboard-api/variables.tf

@@ -34,6 +34,12 @@ variable "auth_db_read_replica_connection_string" {
   default   = ""
 }
 
+variable "supabase_db_connection_string" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
 variable "clickhouse_connection_string" {
   type      = string
   sensitive = true
@@ -44,6 +50,11 @@ variable "supabase_jwt_secrets" {
   sensitive = true
 }
 
+variable "enable_auth_user_sync_background_worker" {
+  type    = bool
+  default = false
+}
+
 variable "otel_collector_grpc_port" {
   type    = number
   default = 4317

iac/provider-gcp/Makefile

@@ -76,6 +76,8 @@ tf_vars := \
 	$(call tfvar, LOKI_BOOT_DISK_TYPE) \
 	$(call tfvar, LOKI_USE_V13_SCHEMA_FROM) \
 	$(call tfvar, DASHBOARD_API_COUNT) \
+	$(call tfvar, SUPABASE_DB_CONNECTION_STRING) \
+	$(call tfvar, ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER) \
 	$(call tfvar, DEFAULT_PERSISTENT_VOLUME_TYPE) \
 	$(call tfvar, PERSISTENT_VOLUME_TYPES) \
 	$(call tfvar, DB_MAX_OPEN_CONNECTIONS) \

iac/provider-gcp/main.tf

@@ -275,7 +275,9 @@ module "nomad" {
   otel_collector_resources_cpu_count = var.otel_collector_resources_cpu_count
 
   # Dashboard API
-  dashboard_api_count = var.dashboard_api_count
+  dashboard_api_count                     = var.dashboard_api_count
+  supabase_db_connection_string           = var.supabase_db_connection_string
+  enable_auth_user_sync_background_worker = var.enable_auth_user_sync_background_worker
 
   # Docker reverse proxy
   docker_reverse_proxy_port                = var.docker_reverse_proxy_port

iac/provider-gcp/nomad/main.tf

@@ -130,14 +130,16 @@ module "dashboard_api" {
 
   image = data.google_artifact_registry_docker_image.dashboard_api_image[0].self_link
 
-  postgres_connection_string             = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
-  auth_db_connection_string              = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
-  auth_db_read_replica_connection_string = trimspace(data.google_secret_manager_secret_version.postgres_read_replica_connection_string.secret_data)
-  clickhouse_connection_string           = local.clickhouse_connection_string
-  supabase_jwt_secrets                   = trimspace(data.google_secret_manager_secret_version.supabase_jwt_secrets.secret_data)
-  redis_url                              = local.redis_url
-  redis_cluster_url                      = local.redis_cluster_url
-  redis_tls_ca_base64                    = trimspace(data.google_secret_manager_secret_version.redis_tls_ca_base64.secret_data)
+  postgres_connection_string              = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
+  auth_db_connection_string               = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
+  auth_db_read_replica_connection_string  = trimspace(data.google_secret_manager_secret_version.postgres_read_replica_connection_string.secret_data)
+  supabase_db_connection_string           = var.supabase_db_connection_string
+  clickhouse_connection_string            = local.clickhouse_connection_string
+  supabase_jwt_secrets                    = trimspace(data.google_secret_manager_secret_version.supabase_jwt_secrets.secret_data)
+  redis_url                               = local.redis_url
+  redis_cluster_url                       = local.redis_cluster_url
+  redis_tls_ca_base64                     = trimspace(data.google_secret_manager_secret_version.redis_tls_ca_base64.secret_data)
+  enable_auth_user_sync_background_worker = var.enable_auth_user_sync_background_worker
 
   otel_collector_grpc_port = var.otel_collector_grpc_port
   logs_proxy_port          = var.logs_proxy_port

iac/provider-gcp/nomad/variables.tf

@@ -454,6 +454,17 @@ variable "dashboard_api_count" {
   default = 0
 }
 
+variable "supabase_db_connection_string" {
+  type      = string
+  default   = ""
+  sensitive = true
+}
+
+variable "enable_auth_user_sync_background_worker" {
+  type    = bool
+  default = false
+}
+
 variable "volume_token_issuer" {
   type = string
 }

iac/provider-gcp/variables.tf

@@ -230,6 +230,17 @@ variable "dashboard_api_count" {
   default = 0
 }
 
+variable "supabase_db_connection_string" {
+  type      = string
+  default   = ""
+  sensitive = true
+}
+
+variable "enable_auth_user_sync_background_worker" {
+  type    = bool
+  default = false
+}
+
 variable "docker_reverse_proxy_port" {
   type = object({
     name        = string

packages/api/go.mod

@@ -35,7 +35,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/grafana/loki/v3 v3.6.4
 	github.com/hashicorp/nomad/api v0.0.0-20251216171439-1dee0671280e
-	github.com/jackc/pgx/v5 v5.7.5
+	github.com/jackc/pgx/v5 v5.9.1
 	github.com/launchdarkly/go-sdk-common/v3 v3.3.0
 	github.com/launchdarkly/go-server-sdk/v7 v7.13.0
 	github.com/oapi-codegen/gin-middleware v1.0.2
@@ -386,7 +386,7 @@ require (
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
 	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.35.0 // indirect

packages/auth/go.mod

@@ -64,7 +64,7 @@ require (
 	github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jellydator/ttlcache/v3 v3.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect

packages/clickhouse/go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.5 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
@@ -93,7 +93,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect

packages/client-proxy/go.mod

@@ -65,7 +65,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect

packages/dashboard-api/Makefile

@@ -19,16 +19,15 @@ generate:
 
 .PHONY: build
 build:
-	# Allow for passing commit sha directly for docker builds
 	$(eval COMMIT_SHA ?= $(shell git rev-parse --short HEAD))
 	$(eval EXPECTED_MIGRATION_TIMESTAMP ?= $(expectedMigration))
 	CGO_ENABLED=0 go build -o bin/dashboard-api -ldflags "-X=main.commitSHA=$(COMMIT_SHA) -X=main.expectedMigrationTimestamp=$(EXPECTED_MIGRATION_TIMESTAMP)" .
 
 .PHONY: build-and-upload
 build-and-upload:
-		$(eval COMMIT_SHA := $(shell git rev-parse --short HEAD))
-		$(eval EXPECTED_MIGRATION_TIMESTAMP := $(expectedMigration))
-		@ docker build --platform linux/amd64 --tag $(IMAGE_REGISTRY) --push --build-arg COMMIT_SHA="$(COMMIT_SHA)" --build-arg EXPECTED_MIGRATION_TIMESTAMP="$(EXPECTED_MIGRATION_TIMESTAMP)"  -f ./Dockerfile ..
+	$(eval COMMIT_SHA := $(shell git rev-parse --short HEAD))
+	$(eval EXPECTED_MIGRATION_TIMESTAMP := $(expectedMigration))
+	@docker build --platform linux/amd64 --tag $(IMAGE_REGISTRY) --push --build-arg COMMIT_SHA="$(COMMIT_SHA)" --build-arg EXPECTED_MIGRATION_TIMESTAMP="$(EXPECTED_MIGRATION_TIMESTAMP)" -f ./Dockerfile ..
 
 .PHONY: run
 run: