Skip to content

fix: 7317 support pg ssl #7366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chocobozzz merged 6 commits into from
Feb 13, 2026
+40 −3
Merged

fix: 7317 support pg ssl #7366

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9732865
fix: 7317 support pg ssl
U1F974 Jan 5, 2026
2b2dfe4
fix: return database.ssl value for tests
U1F974 Jan 5, 2026
4eb1552
feat: new database ssl_settings options
U1F974 Jan 28, 2026
650633a
chore: update production.yaml database ssl_settings
U1F974 Jan 28, 2026
545f0b7
chore: remove useless comment
U1F974 Jan 28, 2026
1e23a06
fix: revert ssl config
U1F974 Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion config/default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,12 @@ trust_proxy:
database:
hostname: '127.0.0.1'
port: 5432
ssl: false
ssl_settings:
enabled: false
Copy link
Owner

@Chocobozzz Chocobozzz Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove ssl_settings.enabled and keep ssl: boolean option to prevent configuration breaking change

Copy link
Contributor Author

@U1F974 U1F974 Jan 30, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should it look like this ?

...
  port: 5432
  ssl: false
  ssl_settings:
    reject_unauthorized: false
    ca: '/absolute/path/to/server-certificates/root.crt'
    cert: '/absolute/path/to/client-certificates/postgresql.crt'
    key: '/absolute/path/to/client-key/postgresql.key'
...

Copy link
Owner

@Chocobozzz Chocobozzz Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes 🙏

Copy link
Contributor Author

@U1F974 U1F974 Jan 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

reject_unauthorized: false
ca: '/absolute/path/to/server-certificates/root.crt'
cert: '/absolute/path/to/client-certificates/postgresql.crt'
key: '/absolute/path/to/client-key/postgresql.key'
suffix: '_dev'
username: 'peertube'
password: 'peertube'
Expand Down
7 changes: 6 additions & 1 deletion config/production.yaml.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,12 @@ trust_proxy:
database:
hostname: '127.0.0.1'
port: 5432
ssl: false
ssl_settings:
enabled: false
reject_unauthorized: false
ca: '/absolute/path/to/server-certificates/root.crt'
cert: '/absolute/path/to/client-certificates/postgresql.crt'
key: '/absolute/path/to/client-key/postgresql.key'
suffix: '_prod'
username: 'peertube'
password: 'peertube'
Expand Down
20 changes: 19 additions & 1 deletion server/core/initializers/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,25 @@ const CONFIG = {
DBNAME: config.has('database.name') ? config.get<string>('database.name') : 'peertube' + config.get<string>('database.suffix'),
HOSTNAME: config.get<string>('database.hostname'),
PORT: config.get<number>('database.port'),
SSL: config.get<boolean>('database.ssl'),
SSL_SETTINGS: {
get ENABLED () {
return config.has('database.ssl_settings.enabled') ? config.get<boolean>('database.ssl_settings.enabled') : false
},
get REJECT_UNAUTHORIZED () {
return config.has('database.ssl_settings.reject_unauthorized')
? config.get<boolean>('database.ssl_settings.reject_unauthorized')
: false
},
get CA() {
return config.has('database.ssl_settings.ca') ? config.get<string>('database.ssl_settings.ca') : null
},
get CERT() {
return config.has('database.ssl_settings.cert') ? config.get<string>('database.ssl_settings.cert') : null
},
get KEY() {
return config.has('database.ssl_settings.key') ? config.get<string>('database.ssl_settings.key') : null
}
},
USERNAME: config.get<string>('database.username'),
PASSWORD: config.get<string>('database.password'),
POOL: {
Expand Down
18 changes: 13 additions & 5 deletions server/core/initializers/database.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ import { LocalVideoViewerWatchSectionModel } from '@server/models/view/local-vid
import { LocalVideoViewerModel } from '@server/models/view/local-video-viewer.js'
import { WatchedWordsListModel } from '@server/models/watched-words/watched-words-list.js'
import pg from 'pg'
import { readFileSync } from 'fs'
import { QueryTypes, Transaction } from 'sequelize'
import { Sequelize as SequelizeTypescript } from 'sequelize-typescript'
import { logger } from '../helpers/logger.js'
Expand Down Expand Up @@ -85,11 +86,18 @@ const poolMax = CONFIG.DATABASE.POOL.MAX

let dialectOptions: any = {}

if (CONFIG.DATABASE.SSL) {
dialectOptions = {
ssl: {
rejectUnauthorized: false
}
if (CONFIG.DATABASE.SSL_SETTINGS.ENABLED) {
// For reference: https://node-postgres.com/features/ssl
dialectOptions = { ssl: { rejectUnauthorized: CONFIG.DATABASE.SSL_SETTINGS.REJECT_UNAUTHORIZED } }

if (CONFIG.DATABASE.SSL_SETTINGS.CA) {
dialectOptions.ssl.ca = readFileSync(CONFIG.DATABASE.SSL_SETTINGS.CA, { encoding: 'utf8' })
}
if (CONFIG.DATABASE.SSL_SETTINGS.CERT) {
dialectOptions.ssl.cert = readFileSync(CONFIG.DATABASE.SSL_SETTINGS.CERT, { encoding: 'utf8' })
}
if (CONFIG.DATABASE.SSL_SETTINGS.KEY) {
dialectOptions.ssl.key = readFileSync(CONFIG.DATABASE.SSL_SETTINGS.KEY, { encoding: 'utf8' })
}
}

Expand Down