feat(pg): support SSL certs

.env.example

@@ -52,6 +52,8 @@ POSTGRES_DB=parabol-saas
 POSTGRES_HOST=localhost
 POSTGRES_PORT=5432
 POSTGRES_POOL_SIZE=5
+POSTGRES_SSL_REJECT_UNAUTHORIZED=false
+POSTGRES_SSL_DIR='/var/lib/postgresql'
 PROTO='http'
 REDIS_URL='redis://localhost:6379'
 RETHINKDB_URL='rethinkdb://localhost:28015/actionDevelopment'

packages/server/postgres/README.md

@@ -25,6 +25,11 @@ In other words, migration 3 should have a guarantee that migration 2 has already
 
 - [Queries](./queries/README.md)
 
+### SSL
+
+1. Pick a directory on the local filesystem to store the keys. Store the absolute path in the env var `POSTGRES_SSL_DIR`
+2. Add `root.crt` (CA), `postgresql.key`, and `postgresql.crt` to that directory.
+
 ### Gotchas
 
 #### pgm vs. node-pg inside a migration
@@ -40,5 +45,5 @@ Moving forward, we will only use `pg.Client`
 
 Parameters are capped at 16-bit, so if you're doing a bulk insert, you'll need to break it up.
 In other words, if `# rows * columns per row > 65,535` you need to do it in batches.
-`pg-protocol` shows this here: https://github.com/brianc/node-postgres/blob/master/packages/pg-protocol/src/serializer.ts#L155
-Issue here: https://github.com/brianc/node-postgres/issues/581
+`pg-protocol` shows this here: <https://github.com/brianc/node-postgres/blob/master/packages/pg-protocol/src/serializer.ts#L155>
+Issue here: <https://github.com/brianc/node-postgres/issues/581>

packages/server/postgres/getPgConfig.ts

@@ -1,12 +1,19 @@
 import PROD from '../PROD'
+// @ts-ignore
+import getPgSSL from './getPgSSL'
 
-const getPgConfig = () => ({
-  user: process.env.POSTGRES_USER,
-  password: process.env.POSTGRES_PASSWORD,
-  database: process.env.POSTGRES_DB,
-  host: process.env.POSTGRES_HOST,
-  port: Number(process.env.POSTGRES_PORT),
-  max: Number(process.env.POSTGRES_POOL_SIZE) || PROD ? 20 : 5
-})
+const getPgConfig = () => {
+  const config = {
+    user: process.env.POSTGRES_USER,
+    password: process.env.POSTGRES_PASSWORD,
+    database: process.env.POSTGRES_DB,
+    host: process.env.POSTGRES_HOST,
+    port: Number(process.env.POSTGRES_PORT),
+    max: Number(process.env.POSTGRES_POOL_SIZE) || PROD ? 20 : 5
+  }
+  const ssl = getPgSSL()
+  if (!ssl) return config
+  return {...config, ssl}
+}
 
 export default getPgConfig

packages/server/postgres/getPgSSL.js

@@ -0,0 +1,22 @@
+const {readFileSync} = require('fs')
+const path = require('path')
+
+const getSSL = () => {
+  try {
+    // optional env var, likely outside the app dir
+    const POSTGRES_SSL_DIR = process.env.POSTGRES_SSL_DIR
+    const ca = readFileSync(path.join(POSTGRES_SSL_DIR, 'root.crt'))
+    const key = readFileSync(path.join(POSTGRES_SSL_DIR, 'postgresql.key'))
+    const cert = readFileSync(path.join(POSTGRES_SSL_DIR, 'postgresql.crt'))
+    return {
+      ca,
+      key,
+      cert,
+      rejectUnauthorized: process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === 'false' ? false : true
+    }
+  } catch (e) {
+    return undefined
+  }
+}
+
+module.exports = getSSL

packages/server/postgres/pgmConfig.js

@@ -1,14 +1,16 @@
+const getPgSSL = require('./getPgSSL')
 
 const pgmConfig = {
   user: process.env.POSTGRES_USER,
   password: process.env.POSTGRES_PASSWORD,
   host: process.env.POSTGRES_HOST,
   port: process.env.POSTGRES_PORT,
   database: process.env.POSTGRES_DB,
+  ssl: getPgSSL() ?? undefined,
   tsconfig: 'packages/server/tsconfig.json',
   'migrations-dir': 'packages/server/postgres/migrations',
   'migrations-table': 'PgMigrations',
-  'template-file-name':'packages/server/postgres/migrationTemplate.ts'
+  'template-file-name': 'packages/server/postgres/migrationTemplate.ts'
 }
 
 module.exports = pgmConfig

packages/server/postgres/pgtypedConfig.js

@@ -1,4 +1,5 @@
 require('../../../scripts/webpack/utils/dotenv')
+const ssl = require('./getPgSSL')()
 
 const emitTemplateTarget = 'packages/server/postgres/queries/generated/{{name}}.ts'
 
@@ -23,8 +24,7 @@ const pgtypedConfig = {
     password: process.env.POSTGRES_PASSWORD,
     host: process.env.POSTGRES_HOST,
     port: Number(process.env.POSTGRES_PORT),
-    ssl: process.env.PGSSLMODE === 'require' ? true : false
+    ssl: ssl ?? undefined
   }
 }
-
 module.exports = pgtypedConfig