Merge pull request #745 from 617a7a/main

feat: add support for TLS with Postgres

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## 0.17.0 (2022-XX-XX)
 
+- Add ability to connect to PostgreSQL over TLS/SSL [#745](https://github.com/juanfont/headscale/pull/745)
+
 ## 0.16.3 (2022-08-17)
 
 ### Changes
@@ -131,7 +133,7 @@ This is a part of aligning `headscale`'s behaviour with Tailscale's upstream beh
 - OpenID Connect users will be mapped per namespaces
   - Each user will get its own namespace, created if it does not exist
   - `oidc.domain_map` option has been removed
-  - `strip_email_domain` option has been added (see [config-example.yaml](./config_example.yaml))
+  - `strip_email_domain` option has been added (see [config-example.yaml](./config-example.yaml))
 
 ### Changes
 

app.go

@@ -129,12 +129,16 @@ func NewHeadscale(cfg *Config) (*Headscale, error) {
 	switch cfg.DBtype {
 	case Postgres:
 		dbString = fmt.Sprintf(
-			"host=%s dbname=%s user=%s sslmode=disable",
+			"host=%s dbname=%s user=%s",
 			cfg.DBhost,
 			cfg.DBname,
 			cfg.DBuser,
 		)
 
+		if !cfg.DBssl {
+			dbString += " sslmode=disable"
+		}
+
 		if cfg.DBport != 0 {
 			dbString += fmt.Sprintf(" port=%d", cfg.DBport)
 		}

config-example.yaml

@@ -121,6 +121,7 @@ db_path: /var/lib/headscale/db.sqlite
 # db_name: headscale
 # db_user: foo
 # db_pass: bar
+# db_ssl: false
 
 ### TLS configuration
 #

config.go

@@ -47,6 +47,7 @@ type Config struct {
 	DBname string
 	DBuser string
 	DBpass string
+	DBssl  bool
 
 	TLS TLSConfig
 
@@ -506,6 +507,7 @@ func GetHeadscaleConfig() (*Config, error) {
 		DBname: viper.GetString("db_name"),
 		DBuser: viper.GetString("db_user"),
 		DBpass: viper.GetString("db_pass"),
+		DBssl:  viper.GetBool("db_ssl"),
 
 		TLS: GetTLSConfig(),