Migrate Supabase Storage bucket: Private document library

Move object storage from Supabase Storage bucket to Ample, one component at a time. Destination verified on Ample: a role-to-document access model with negative tests (401 without identity, 403 for the wrong role) and a private-bucket round-trip for the allowed role (private=ok). Source procedure: Inventory objects through the Supabase Storage API or dashboard. Not migrated automatically: Supabase Storage RLS policies, signed URLs and image transformations are not migrated; enforce authorization in the app and stream private objects through it. Cutover: Switch the app's S3_* environment to the Ample bucket with a redeploy, verify reads and writes, keep Supabase Storage read-only until confirmed. Rollback: keep the source untouched until you confirm; nothing at the source is changed or deleted by this guide.

Representative Queries

• Migrate Supabase Storage bucket: Private document library
• Where can I host Private document library?
• I need a component-scoped export/import or reconfiguration procedure for Private document library, with compatibility checks, verification and rollback.

Resource Requirements

• S3-compatible object storage

Infrastructure Requirements

• S3-compatible object storage : Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.

Workload

• Private document library

Migration Source

• Supabase Storage bucket

Execution Status

• Unbound

Prerequisites

• Authorized access to the Supabase Storage bucket source and its export tooling
• An inventory of every component in scope and out of scope
• A validated backup or copy before any cutover
• An Ample account token with servers:write, buckets:write

Workflow Steps

1. Inventory the source: List what Supabase Storage bucket provides beyond the component you are moving. Out of scope here: Supabase Storage RLS policies, signed URLs and image transformations are not migrated; enforce authorization in the app and stream private objects through it.
2. Source step 1: Inventory objects through the Supabase Storage API or dashboard
3. Source step 2: Copy objects with rclone sync from the Supabase S3-compatible endpoint (or a scripted download) to the Ample bucket endpoint using the issued credentials
4. Source step 3: Verify a sample of objects by size and checksum after the copy
5. Create the destination bucket and copy: Create the bucket, copy with rclone or the S3 CLI in path-style mode using the issued credentials, then pass the credentials to the app as encrypted S3_* variables.
6. Validate before cutover: Run the app's own checks and, for data, compare counts and checksums; the example checks are the pattern self-tests (/p/private-document-library).
7. Cut over: Switch the app's S3_* environment to the Ample bucket with a redeploy, verify reads and writes, keep Supabase Storage read-only until confirmed.
8. Rollback: Point DNS or configuration back to the source. The source was never modified; deletion is a separate, user-executed step after validation.

Limitations

• Documentation only: nothing is executed automatically and no execution binding is offered.
• The source-side procedure is documented from Supabase Storage bucket's standard tooling and was not executed in this catalog's evidence; the destination side was verified with the pattern fixture.
• No full source-product parity is claimed: Supabase Storage RLS policies, signed URLs and image transformations are not migrated; enforce authorization in the app and stream private objects through it.
• PutObject and GetObject with path-style addressing are verified; bulk copy tooling and other S3 operations are not.

Cost Estimate

• Currency: USD
• Monthly Amount: $5.0
• Components: app server (size: s-1vcpu-1gb, quantity: 1.0, monthlyAmount: $5.0)

Last Verified

• 2026-09-21T02:34:39Z

Evidence Summary

• Kind: canary_run
• Summary: Destination side verified: the Express pattern fixture deployed on Ample and its checks passed (a role-to-document access model with negative tests and a private-bucket round-trip for the allowed role). The source-side export from Supabase Storage bucket is documented from the vendor's standard tooling and was not executed by this catalog's evidence.

Next Actions

1. Browse the catalog index: GET /v1/catalog
2. Search published recipes by intent, stack and constraints: POST /v1/catalog/search
3. Prepare a side-effect-free deployment plan for an authorized project: POST /v1/catalog/plan
4. Read the existing agent authentication setup: GET /mcp/setup