gitops/optimclaw
1
0
Fork 0
mirror of https://github.com/outbackdingo/optimclaw.git synced 2026-08-26 15:40:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add TLS support for PostgreSQL connections (#363) (#427)

Browse Source 
All PostgreSQL connection sites hardcoded NoTls, preventing connections
to managed providers that require TLS (AWS RDS, Neon, Supabase, etc.).

- Add tokio-postgres-rustls with rustls + system root certificates
- Add SslMode enum (disable/prefer/require) via DATABASE_SSLMODE env var
- Replace NoTls at all 4 production call sites with TLS-aware pool creation
- Add SslMode::from_env() helper for lightweight CLI tools
- Log native cert loading errors and warn on empty root store

Default mode is Prefer (attempts TLS, matching most managed providers).

Co-authored-by: Claude Opus 4.6 <[email protected]>
This commit is contained in:
Zaki Manian
2026-03-01 08:49:09 +00:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 1f2e8c3b72
commit 3362081192
10 changed files with 285 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cli/doctor.rs
+1 -5
View File
@@ -171,11 +171,7 @@ async fn try_pg_connect() -> Result<(), String> {
url: Some(url),
..Default::default()
};
let pool = config
.create_pool(
Some(deadpool_postgres::Runtime::Tokio1),
tokio_postgres::NoTls,
)
let pool = crate::db::tls::create_pool(&config, crate::config::SslMode::from_env())
.map_err(|e| format!("pool error: {e}"))?;
let client = tokio::time::timeout(std::time::Duration::from_secs(5), pool.get())
src/cli/status.rs
+1 -5
View File
@@ -169,11 +169,7 @@ async fn check_database() -> anyhow::Result<()> {
url: Some(url),
..Default::default()
};
let pool = config
.create_pool(
Some(deadpool_postgres::Runtime::Tokio1),
tokio_postgres::NoTls,
)
let pool = crate::db::tls::create_pool(&config, crate::config::SslMode::from_env())
.map_err(|e| anyhow::anyhow!("pool error: {}", e))?;
let client = tokio::time::timeout(std::time::Duration::from_secs(5), pool.get())