fix: add TLS support for PostgreSQL connections (#363) (#427)

All PostgreSQL connection sites hardcoded NoTls, preventing connections
to managed providers that require TLS (AWS RDS, Neon, Supabase, etc.).

- Add tokio-postgres-rustls with rustls + system root certificates
- Add SslMode enum (disable/prefer/require) via DATABASE_SSLMODE env var
- Replace NoTls at all 4 production call sites with TLS-aware pool creation
- Add SslMode::from_env() helper for lightweight CLI tools
- Log native cert loading errors and warn on empty root store

Default mode is Prefer (attempts TLS, matching most managed providers).

Co-authored-by: Claude Opus 4.6 <[email protected]>

src/db/mod.rs

@@ -12,6 +12,9 @@
 #[cfg(feature = "postgres")]
 pub mod postgres;
 
+#[cfg(feature = "postgres")]
+pub mod tls;
+
 #[cfg(feature = "libsql")]
 pub mod libsql;
 

src/db/tls.rs

@@ -0,0 +1,86 @@
+//! TLS connector factory for PostgreSQL connections.
+//!
+//! Builds a [`deadpool_postgres::Pool`] with the appropriate TLS connector
+//! based on the configured [`SslMode`].  Uses `rustls` with system root
+//! certificates — the same TLS stack that `reqwest` already uses for HTTP.
+
+use deadpool_postgres::{Pool, Runtime};
+use tokio_postgres::NoTls;
+use tokio_postgres_rustls::MakeRustlsConnect;
+
+use crate::config::SslMode;
+
+/// Build a rustls-based TLS connector using the platform's root certificate store.
+fn make_rustls_connector() -> MakeRustlsConnect {
+    let mut root_store = rustls::RootCertStore::empty();
+    let native = rustls_native_certs::load_native_certs();
+    for e in &native.errors {
+        tracing::warn!("error loading system root certs: {e}");
+    }
+    for cert in native.certs {
+        if let Err(e) = root_store.add(cert) {
+            tracing::warn!("skipping invalid system root cert: {e}");
+        }
+    }
+    if root_store.is_empty() {
+        tracing::error!("no system root certificates found -- TLS connections will fail");
+    }
+    let config = rustls::ClientConfig::builder()
+        .with_root_certificates(root_store)
+        .with_no_client_auth();
+    MakeRustlsConnect::new(config)
+}
+
+/// Create a [`deadpool_postgres::Pool`] with the appropriate TLS connector.
+///
+/// - `Disable` → plain TCP (no TLS)
+/// - `Prefer` / `Require` → rustls with system root certificates
+///
+/// **Note:** `Prefer` and `Require` currently behave identically — both
+/// provide a TLS connector and will fail if the server rejects the TLS
+/// handshake.  True `prefer` semantics (retry without TLS on failure)
+/// would require reconnection logic that tokio-postgres does not provide
+/// out of the box.  The three-variant enum is kept for forward-compatibility
+/// and familiarity with libpq's `sslmode` parameter.
+pub fn create_pool(
+    config: &deadpool_postgres::Config,
+    ssl_mode: SslMode,
+) -> Result<Pool, deadpool_postgres::CreatePoolError> {
+    match ssl_mode {
+        SslMode::Disable => config.create_pool(Some(Runtime::Tokio1), NoTls),
+        SslMode::Prefer | SslMode::Require => {
+            let tls = make_rustls_connector();
+            config.create_pool(Some(Runtime::Tokio1), tls)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn create_pool_disable_mode() {
+        let mut config = deadpool_postgres::Config::new();
+        config.url = Some("postgres://localhost/test".to_string());
+        // Should succeed — pool is created lazily, no actual connection needed.
+        let pool = create_pool(&config, SslMode::Disable);
+        assert!(pool.is_ok());
+    }
+
+    #[test]
+    fn create_pool_prefer_mode() {
+        let mut config = deadpool_postgres::Config::new();
+        config.url = Some("postgres://localhost/test".to_string());
+        let pool = create_pool(&config, SslMode::Prefer);
+        assert!(pool.is_ok());
+    }
+
+    #[test]
+    fn create_pool_require_mode() {
+        let mut config = deadpool_postgres::Config::new();
+        config.url = Some("postgres://localhost/test".to_string());
+        let pool = create_pool(&config, SslMode::Require);
+        assert!(pool.is_ok());
+    }
+}