Not planned for near-term implementation — tracking issue.
The engine currently connects to Postgres without TLS support. Most managed Postgres providers (RDS, Cloud SQL, Supabase, Neon) require or strongly default to TLS, so this gates deployments against them.
Scope when picked up: rustls-based TLS in tokio-postgres with psql-compatible sslmode semantics — disable / prefer (attempt TLS, fall back to plain) / require (TLS, no cert verification) / verify-full (CA file + hostname), including SNI (Neon needs it even with verify-none). Upstream reference: sync-service connection/manager/connection_resolver.ex (also covers the IPv6→IPv4 fallback pattern worth copying at the same time).
🤖 Generated with Claude Code
Not planned for near-term implementation — tracking issue.
The engine currently connects to Postgres without TLS support. Most managed Postgres providers (RDS, Cloud SQL, Supabase, Neon) require or strongly default to TLS, so this gates deployments against them.
Scope when picked up: rustls-based TLS in tokio-postgres with psql-compatible
sslmodesemantics —disable/prefer(attempt TLS, fall back to plain) /require(TLS, no cert verification) /verify-full(CA file + hostname), including SNI (Neon needs it even with verify-none). Upstream reference: sync-serviceconnection/manager/connection_resolver.ex(also covers the IPv6→IPv4 fallback pattern worth copying at the same time).🤖 Generated with Claude Code