Custom auth email templates silently lost after 'kong reload' (functions serve / db reset) — GoTrue falls back to built-in defaults

[stefano-bobo]

Describe the bug

Custom auth email templates ([auth.email.template.*] with content_path) are silently replaced by GoTrue's built-in defaults after any kong reload — for example the one functions serve issues, or the container-restart step of supabase db reset.

Mechanism:

1. The CLI starts Kong with kong docker-start --nginx-conf /home/kong/custom_nginx.template. That custom template adds an extra nginx server on :8088 that serves the rendered email templates to GoTrue (GOTRUE_MAILER_TEMPLATES_* = http://<kong>:8088/email/*.html).
2. Later, the CLI runs a bare kong reload inside the container — e.g. apps/cli-go/internal/functions/serve/serve.go step 4 ("Reload Kong to refresh DNS cache for the new Edge Runtime container IP").
3. kong reload re-renders nginx.conf from Kong's default template (the --nginx-conf flag from the original docker-start is not carried over), so the regenerated config loses the :8088 server entirely. After the reload, /usr/local/kong/nginx.conf is a ~311-byte default config with no email_templates server and nothing listens on 8088.
4. On the next auth email, GoTrue fails to fetch the template — templatemailer: template type "magic_link": Get "http://supabase_kong_<project>:8088/email/magic_link.html": dial tcp ...:8088: connect: connection refused (event: templatemailer_template_body_http_error) — and silently falls back to its built-in default template and subject ("Your sign-in link", link-only, no {{ .Token }} code).

This is distinct from #4668 (startup ordering): here the endpoint was healthy and is permanently lost mid-session; only recreating the Kong container (re-running the entrypoint with --nginx-conf) restores it.

To Reproduce

1. Configure a custom template, e.g. in config.toml:

   [auth.email.template.magic_link]
   subject = "Your verification code"
   content_path = "./email-templates/account-access.html"   # contains {{ .Token }}

2. supabase start — send a magic link; the custom template is used (correct).
3. docker exec supabase_kong_<project-id> kong reload (or just run supabase functions serve, which does this internally).
4. docker exec supabase_kong_<project-id> netstat -tln | grep 8088 → no listener.
5. Send another magic link → email arrives as the GoTrue built-in default (no OTP code, default subject); auth container logs templatemailer_template_body_http_error … connection refused.

Expected behavior

Custom email templates keep working across kong reload / functions serve / db reset. Possible fixes:

• pass the custom template to the reload: kong reload --nginx-conf /home/kong/custom_nginx.template, or
• set nginx_conf via kong.conf/env at container start so every re-render includes it, or
• serve the email templates from something not affected by Kong reloads.

Version

• CLI 2.109.1 (also inspected current main: the bare kong reload is in apps/cli-go/internal/functions/serve/serve.go)
• gotrue v2.193.0, kong 2.8.1 images
• macOS / Docker Desktop (darwin 25.5.0)

Additional context

Auth log line at send time:

{"error":"templatemailer: template type \"magic_link\": Get \"http://supabase_kong_bobo-local:8088/email/magic_link.html\": dial tcp 172.18.0.5:8088: connect: connection refused","event":"templatemailer_template_body_http_error","level":"error","mail_type":"magic_link", ...}

Workaround we ship in our repo: a post-task guard that probes :8088 from the auth container and docker restarts Kong when it's gone.

[7ttp]

thanks! @stefano-bobo 💚
fix is out in: https://github.com/supabase/cli/releases/tag/v2.110.0-beta.35

• ref fix(cli): preserve auth templates #5906