Comments backend setup (Supabase)

The blog’s invite-only comments run on Supabase (free tier). The static site talks to it directly with the public anon key — all security is enforced by database Row-Level Security, so nothing secret lives in the repo.

One-time setup

1. Create a project at https://supabase.com (free tier is fine).

2. Run the schema. Dashboard → SQL Editor → paste the contents of supabase/schema.sql → Run. This creates the approved_emails, applications, and comments tables plus all the security rules.

3. Enable email auth. Authentication → Providers → Email — make sure it’s enabled (magic link / OTP). No passwords are used.

4. Set redirect URLs. Authentication → URL Configuration:
   • Site URL: https://sc103121.github.io
   • Redirect URLs: add both
     • http://localhost:4000/**
     • https://sc103121.github.io/**
5. Copy your keys into _config.yml:
   • url — Settings → Data API (or the Connect button): https://YOUR-PROJECT.supabase.co
   • anon_key — Settings → API Keys → the Publishable key (sb_publishable_…). This is the new name for the old “anon public” key and is browser-safe with RLS on. The Legacy tab’s anon key also works if you prefer it.

     supabase:
     url: "https://YOUR-PROJECT.supabase.co"
     anon_key: "sb_publishable_..."
     

     Both are safe to commit — they’re designed to be public. Never put the Secret key (sb_secret_…) / service_role key in the repo.

Day-to-day

• Review applications: Table Editor → applications (name, chosen display name, email, reason).
• Approve someone: Table Editor → approved_emails → insert a row with their email and the display_name from their application (that’s the name shown on their comments; the commenter can’t change it). They can now sign in (magic link) and comment. Anyone not on this list is blocked by the database even if they sign in.
• Make yourself a moderator: on your own approved_emails row, set is_owner = true. That lets you delete any comment from the site (not just your own). Also set your own display_name.
• Delete a comment: on the site, comments now soft-delete (the row stays so replies remain; it shows “This comment has been deleted”). To hard-remove a row entirely, use Table Editor → comments.

Notes

• Supabase’s built-in email sender is rate-limited and meant for testing. For real traffic, set up custom SMTP (Authentication → Emails → SMTP Settings).
• Comments only render in a production Jekyll build. Locally: JEKYLL_ENV=production bundle exec jekyll serve.