Turn on the server gateway

Booking links, the client portal and "one-click fix" go through your Rollout server. With the server gateway, the database only accepts those requests if they really come from that server. It takes five minutes and no downtime.

Why this is needed

The database lives at Supabase and, like any cloud database, is reachable over the internet. Without the gateway, someone could call the public functions directly, bypassing Rollout, and make up an IP address while doing so. With the gateway, your server sends a secret key along. Anyone without that key is refused.

What the gateway protects:

Turn it on in five steps

1. Run migration 0017

   If you ran all migrations in step 1, this is already done. Otherwise: ./deploy/migrate.sh or supabase/setup-0017.sql in the SQL Editor. As long as no hash is set, everything works as before.

2. Create the secret

   On your own computer, in the repository folder:

   Terminal

   Copy

   $ node scripts/gateway-secret.mjs

   ROLLOUT_GATEWAY_SECRET=f3Q9xK2vT7pL1mN8rB4wY6zH0cJ5sD2aE9uG4kR1tV8

   -- Supabase SQL Editor (pas NA het deployen van de server met dit geheim):

   update platform_settings set gateway_secret_hash = '6b1f…c9e2';

   The script gives two things: the secret (for Vercel) and an SQL line with the hash (for the database). Each run gives a new secret, so use both from the same run. The values above are examples.

3. Put the secret in Vercel and deploy

   Settings → Environment Variables → ROLLOUT_GATEWAY_SECRET, Production only, Sensitive on.

   Vercel → project → Settings → Environment Variables

   KeyValue

   EnvironmentsProductionPreviewDevelopmentSensitiveSave

   No variables saved yet

   Then Deployments → Redeploy. Check https://<your-domain>/api/ready: it should now say "gateway": "not-enforced" (secret present, gateway not on yet).

4. Put the hash in the database

   Paste the update line from the script into the SQL Editor and click Run. From this moment the gateway is on.

   Supabase → SQL Editor → New query

   Untitled queryRun ⌘↵

   1

   2

   3

   ResultsNothing run yet
5. Check

    

   Then open a booking link in a private window: it should just work. And a direct call should now be refused ("Deze functie is alleen via Rollout bereikbaar" means "this function is only reachable via Rollout"):

   Terminal

   Copy

   $ curl -s https://<project-ref>.supabase.co/rest/v1/rpc/resolve_booking_token -H 'apikey: <anon-key>' -H 'Content-Type: application/json' -d '{"token":"bk_test"}'

   {"code":"P0001","details":null,"hint":null,"message":"Deze functie is alleen via Rollout bereikbaar."}

What does the status mean?

Replacing the secret

On suspicion of a leak, or when someone with access leaves: run the script again, put the new secret in Vercel, deploy, and set the new hash in the database. Between the deploy and the new hash, booking links briefly fail; so do it outside office hours.

Every installation (every MSP) has its own secret. Never reuse it.