Skip to content

feat: allow for postgres ssl connections #607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JGaudette wants to merge 4 commits into
base: master
Choose a base branch
from
Open

feat: allow for postgres ssl connections #607

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a1990dd
feat: allow for postgres ssl connections
JGaudette Sep 29, 2025
2d308ce
feat: allow for postgres ssl connections in migrations
JGaudette Sep 30, 2025
88346b4
update ssl
JGaudette Nov 24, 2025
d5e15d0
Merge branch 'master' into feature/ssl-env-variable
JGaudette Nov 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,5 +23,6 @@ CLICKHOUSE_PASSWORD=frog
POSTGRES_DB=analytics
POSTGRES_USER=frog
POSTGRES_PASSWORD=frog
POSTGRES_SSL=false

RESEND_API_KEY=rs_XXXXXXX
1 change: 1 addition & 0 deletions docker-compose.cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ services:
- POSTGRES_DB=${POSTGRES_DB:-analytics}
- POSTGRES_USER=${POSTGRES_USER:-frog}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-frog}
- POSTGRES_SSL=${POSTGRES_SSL:-false}
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
- BASE_URL=${BASE_URL}
- DISABLE_SIGNUP=${DISABLE_SIGNUP}
Expand Down
1 change: 1 addition & 0 deletions docs/src/content/self-hosting-advanced.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ CLICKHOUSE_PASSWORD=frog
POSTGRES_USER=frog
POSTGRES_PASSWORD=frog
POSTGRES_DB=analytics
POSTGRES_SSL=false
CLICKHOUSE_DB=analytics

# Custom image tags
Expand Down
2 changes: 1 addition & 1 deletion server/drizzle.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ export default defineConfig({
database: process.env.POSTGRES_DB || "analytics",
user: process.env.POSTGRES_USER || "frog",
password: process.env.POSTGRES_PASSWORD || "frog",
ssl: false,
ssl: process.env.POSTGRES_SSL === "true" ? true : false,
},
verbose: true,
});
1 change: 1 addition & 0 deletions server/src/db/postgres/postgres.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ const client = postgres({
database: process.env.POSTGRES_DB,
username: process.env.POSTGRES_USER,
password: process.env.POSTGRES_PASSWORD,
ssl: process.env.POSTGRES_SSL === "true" ? true : false,

@coderabbitai coderabbitai Bot Sep 30, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Consider SSL certificate validation for production environments.

While enabling SSL with ssl: true encrypts the connection, it doesn't validate the server's certificate by default. For production environments like RDS, you should verify the server certificate to prevent man-in-the-middle attacks.

Consider using an object configuration for SSL to enable certificate validation:

-  ssl: process.env.POSTGRES_SSL === "true" ? true : false,
+  ssl: process.env.POSTGRES_SSL === "true" ? { rejectUnauthorized: true } : false,

Note: RDS instances typically require certificate validation. If you need to provide a custom CA certificate, the postgres library also supports:

ssl: {
  rejectUnauthorized: true,
  ca: fs.readFileSync('/path/to/ca-certificate.crt').toString(),
}
🤖 Prompt for AI Agents 
In server/src/db/postgres/postgres.ts around line 15, the SSL option is
currently set as a boolean which enables encryption but does not enforce server
certificate validation; change the ssl option to an object that sets
rejectUnauthorized: true for production (e.g., when NODE_ENV === "production" or
POSTGRES_SSL === "true") and, if required by your RDS setup, load a CA bundle
from a configured path (read the CA file with fs.readFileSync and pass it as
ca); ensure you conditionally construct this object (or leave ssl: false for
non-SSL envs), and add the needed fs import and error handling for missing CA
file.

onnotice: () => {},
max: 20,
});
Expand Down