fix: support enforcing SSL connection

src/config.ts

@@ -1,6 +1,7 @@
 import dotenv from 'dotenv'
 
 type StorageBackendType = 'file' | 's3'
+
 type StorageConfigType = {
   keepAliveTimeout: number
   headersTimeout: number
@@ -20,6 +21,7 @@ type StorageConfigType = {
   jwtAlgorithm: string
   multitenantDatabaseUrl?: string
   databaseURL: string
+  databaseSSLRootCert?: string
   databasePoolURL?: string
   databaseMaxConnections: number
   databaseFreePoolAfterInactivity: number
@@ -108,6 +110,7 @@ export function getConfig(): StorageConfigType {
     jwtSecret: getOptionalIfMultitenantConfigFromEnv('PGRST_JWT_SECRET') || '',
     jwtAlgorithm: getOptionalConfigFromEnv('PGRST_JWT_ALGORITHM') || 'HS256',
     multitenantDatabaseUrl: getOptionalConfigFromEnv('MULTITENANT_DATABASE_URL'),
+    databaseSSLRootCert: getOptionalConfigFromEnv('DATABASE_SSL_ROOT_CERT'),
     databaseURL: getOptionalIfMultitenantConfigFromEnv('DATABASE_URL') || '',
     databasePoolURL: getOptionalConfigFromEnv('DATABASE_POOL_URL') || '',
     databaseMaxConnections: parseInt(

src/database/connection.ts

@@ -9,8 +9,12 @@ import { StorageBackendError } from '../storage'
 // https://github.com/knex/knex/issues/387#issuecomment-51554522
 pg.types.setTypeParser(20, 'text', parseInt)
 
-const { databaseMaxConnections, databaseFreePoolAfterInactivity, databaseConnectionTimeout } =
-  getConfig()
+const {
+  databaseSSLRootCert,
+  databaseMaxConnections,
+  databaseFreePoolAfterInactivity,
+  databaseConnectionTimeout,
+} = getConfig()
 
 interface TenantConnectionOptions {
   user: User
@@ -73,7 +77,10 @@ export class TenantConnection {
         idleTimeoutMillis: isExternalPool ? 100 : databaseFreePoolAfterInactivity,
         reapIntervalMillis: isExternalPool ? 110 : undefined,
       },
-      connection: connectionString,
+      connection: {
+        connectionString: connectionString,
+        ...this.sslSettings(),
+      },
       acquireConnectionTimeout: databaseConnectionTimeout,
     })
 
@@ -110,6 +117,13 @@ export class TenantConnection {
     return new this(knexPool, options)
   }
 
+  protected static sslSettings() {
+    if (databaseSSLRootCert) {
+      return { ssl: { ca: databaseSSLRootCert } }
+    }
+    return {}
+  }
+
   async dispose() {
     if (this.options.isExternalPool) {
       return this.pool.destroy()
@@ -137,8 +151,8 @@ export class TenantConnection {
       },
       {
         minTimeout: 50,
-        maxTimeout: 500,
-        maxRetryTime: 2000,
+        maxTimeout: 200,
+        maxRetryTime: 3000,
         retries: 10,
       }
     )

src/database/migrate.ts

@@ -1,15 +1,20 @@
-import { Client } from 'pg'
+import { Client, ClientConfig } from 'pg'
 import { migrate } from 'postgres-migrations'
 import { getConfig } from '../config'
 
-const { multitenantDatabaseUrl } = getConfig()
+const { multitenantDatabaseUrl, databaseSSLRootCert } = getConfig()
 
 /**
  * Runs tenant migrations
  */
 export async function runMigrations(): Promise<void> {
   console.log('running migrations')
-  await connectAndMigrate(process.env.DATABASE_URL, './migrations/tenant')
+  let ssl: ClientConfig['ssl'] | undefined = undefined
+
+  if (databaseSSLRootCert) {
+    ssl = { ca: databaseSSLRootCert }
+  }
+  await connectAndMigrate(process.env.DATABASE_URL, './migrations/tenant', ssl)
   console.log('finished migrations')
 }
 
@@ -27,15 +32,26 @@ export async function runMultitenantMigrations(): Promise<void> {
  * @param databaseUrl
  */
 export async function runMigrationsOnTenant(databaseUrl: string): Promise<void> {
-  await connectAndMigrate(databaseUrl, './migrations/tenant')
+  let ssl: ClientConfig['ssl'] | undefined = undefined
+
+  if (databaseSSLRootCert) {
+    ssl = { ca: databaseSSLRootCert }
+  }
+  await connectAndMigrate(databaseUrl, './migrations/tenant', ssl)
 }
 
-async function connectAndMigrate(databaseUrl: string | undefined, migrationsDirectory: string) {
-  const dbConfig = {
+async function connectAndMigrate(
+  databaseUrl: string | undefined,
+  migrationsDirectory: string,
+  ssl?: ClientConfig['ssl']
+) {
+  const dbConfig: ClientConfig = {
     connectionString: databaseUrl,
     connectionTimeoutMillis: 10_000,
     options: '-c search_path=storage,public',
+    ssl,
   }
+
   const client = new Client(dbConfig)
   try {
     await client.connect()

src/queue/queue.ts

@@ -26,6 +26,7 @@ export abstract class Queue {
     if (isMultitenant) {
       url = pgQueueConnectionURL ?? multitenantDatabaseUrl
     }
+
     Queue.pgBoss = new PgBoss({
       connectionString: url,
       max: 4,