From 05b85af68ef504e0ff3e3a034cac669297b83e3d Mon Sep 17 00:00:00 2001 From: Sheng Kun Chang Date: Fri, 3 Jul 2026 22:57:06 +0800 Subject: [PATCH] fix(db): make Resources.DB sslmode configurable (MS_MODULE_DB_SSLMODE) The vended-credential pool hardcoded sslmode=require (correct for prod's RDS Proxy), so a local dev-sim Postgres with no TLS refused every deployed-module DB connection. Default stays require; the dev runner sets MS_MODULE_DB_SSLMODE=disable. Unset always resolves to the secure default. Co-Authored-By: Claude Fable 5 --- db/pool_cache.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/db/pool_cache.go b/db/pool_cache.go index d4813d5..80ab014 100644 --- a/db/pool_cache.go +++ b/db/pool_cache.go @@ -3,6 +3,7 @@ package db import ( "context" "fmt" + "os" "time" "github.com/jackc/pgx/v5" @@ -72,9 +73,16 @@ func configurePoolDefaults(cfg *pgxpool.Config) { func createPool(ctx context.Context, cred Credential) (*pgxpool.Pool, error) { // DSN intentionally excludes the password — any wrapped ParseConfig error // would otherwise echo the full connection string into CloudWatch. + // sslmode defaults to require (prod: the RDS Proxy endpoint mandates TLS); + // a local dev-sim Postgres has no TLS, so the dev runner sets + // MS_MODULE_DB_SSLMODE=disable. Unset always resolves to the secure default. + sslmode := os.Getenv("MS_MODULE_DB_SSLMODE") + if sslmode == "" { + sslmode = "require" + } connStr := fmt.Sprintf( - "host=%s port=%d dbname=%s user=%s sslmode=require", - cred.Host, cred.Port, cred.Database, cred.Username, + "host=%s port=%d dbname=%s user=%s sslmode=%s", + cred.Host, cred.Port, cred.Database, cred.Username, sslmode, ) cfg, err := pgxpool.ParseConfig(connStr) if err != nil {