Authentication: avoid hardcoded database credentials ?

[joaoroscoe]

Would it possible to use SSL certificate authentication, to avoid having user/password pair in the flow itself ?

[Alkarex]

Hello,
I have not checked in details yet, but the node already supports Dynamic PostgreSQL connection parameters, with all those parameters https://node-postgres.com/apis/client
See in particular the ssl parameter.

If this is not sufficient, we could expose other options of the underlying library, which is https://node-postgres.com
So I suggest you try to identify what this library could do for your use case, and then we can discuss how to expose it.

[joaoroscoe]

I have just changed the thread title to better describe it's subject.

I changed my configuration to use global context variables, instead of hardcoded credentials, and defined these variables content somewhere else, ensuring that any database access will only happen after the contents of these variables are set. That is working fine.

However, I still have a problem to solve: my Node Red instance runs via pm2, to ensure that, in the event of a crash, it will be restarted. While testing that, I found that after a restart following a Node Red chash, the connection to the database fails, although apparently the variables containing the access credentials have the correct content - apparently some kind of race condition. I also verified that this situation is resolved if I manually re-deploy the flow.

Based on my tests, I am assuming that the connection to the database is only made once, at some point right after the flow is initialized, and that changing the content of the variables used in this connection, after that moment, will have no effect. Is that assumption correct? Is there any way to force a new connection attempt?

Update:

I have juste confirmed that the issue described above happens after any kind of Node Red startup - a host reboot, for instance. Therefore, my implementation is working only after a manual flow deploy.

[Alkarex]

To isolate the problem, could you test with the current normal way to pass credentials, whether the connection is still working fine after e.g. the database is stopped and restarted?

[joaoroscoe]

Yes, confirmed: if I put in hardcoded credentials, I can either restart Node Red or crash it, to be automatically restart, and the database connection will work properly, directly from restart.

[Alkarex]

What starting Node-RED with the database down, and starting the database later?

[joaoroscoe]

Same behaviour.

Examining the logs, it seems that even the very first database access attempt uses 127.0.0.1 (default, I suppose). Looks like Node Red tries to get postgresql configuration from global variables right after startup - not at first database connection attempt. If that's the case, that will happen prior to global context variables getting set...