PG* DB env preparation

docker-compose.yml

@@ -37,6 +37,8 @@ services:
   service:
     build:
       context: .
+      args:
+        DB_SSL: ${DB_SSL}  # So that we can error out at build time if this is defined with a value of "true" (no longer supported from 2026.1).
       dockerfile: service.dockerfile
     depends_on:
       - secrets
@@ -47,12 +49,24 @@ services:
     volumes:
       - secrets:/etc/secrets
       - /data/transfer:/data/transfer
-    env_file: .env
+    env_file:
+      - ".env"
     environment:
       - DOMAIN=${DOMAIN}
       - SYSADMIN_EMAIL=${SYSADMIN_EMAIL}
       - HTTPS_PORT=${HTTPS_PORT:-443}
       - NODE_OPTIONS=${SERVICE_NODE_OPTIONS:-}
+      # Prepare libpq connection env vars, while handling legacy DB_* vars.
+      # Resolution order:
+      # 1. PGVAR specified in .env. This includes declarations with empty values, for instance, to use an empty password (PGPASSWORD=).
+      # 2. Corresponding legacy DB_VAR in .env. These are legacy overrides for custom database connections.
+      # 3. ODK default value.
+      - PGHOST=${PGHOST-${DB_HOST:-postgres14}}
+      - PGDATABASE=${PGDATABASE-${DB_NAME:-odk}}
+      - PGUSER=${PGUSER-${DB_USER:-odk}}
+      - PGPASSWORD=${PGPASSWORD-${DB_PASSWORD:-odk}}
+      - PGAPPNAME=${PGAPPNAME-odkcentral}
+      # End of libpq connection env var preparation.
       - DB_POOL_SIZE=${DB_POOL_SIZE:-10}
       - EMAIL_FROM=${EMAIL_FROM:-no-reply@$DOMAIN}
       - EMAIL_HOST=${EMAIL_HOST:-mail}

files/service/scripts/start-odk.sh

@@ -17,24 +17,6 @@ SENTRY_TAGS="{ \"version.central\": \"$(cat sentry-versions/central)\", \"versio
 # shellcheck disable=SC2090
 export SENTRY_TAGS
 
-# handle legacy DB_SSL configuration, as we couldn't conditionally template that in docker-compose.yml
-if [[ -v DB_SSL && "${DB_SSL}" = "true" ]]; then
-  if [[ -v PGSSLMODE && -v PGREQUIRESSL ]]; then
-    export PGSSLMODE="require"
-  else
-    echo "Fatal: legacy 'DB_SSL=true' specified, but PGSSLMODE or PGREQUIRESSL has already been set. To resolve ambiguity, remove 'DB_SSL=true' from your .env file." > /dev/stderr
-    exit 100
-  fi
-fi
-
-# handle other legacy DB_* configuration, and fill in our defaults if nothing is specified
-# When these PG* variables are _defined_ (even if _empty_), they will be left as-is.
-[[ -v PGHOST ]] || export PGHOST=${DB_HOST:-postgres14}
-[[ -v PGUSER ]] || export PGUSER=${DB_USER:-odk}
-[[ -v PGPASSWORD ]] || export PGPASSWORD=${DB_PASSWORD:-odk}
-[[ -v PGDATABASE ]] || export PGDATABASE=${DB_NAME:-odk}
-[[ -v PGAPPNAME ]] || export PGAPPNAME=odkcentral
-
 echo "waiting for PostgreSQL to become connectable to..."
 while ! (psql --no-password --quiet --command "" > /dev/null 2>&1 || (echo "sleeping 1 second waiting for a database connection"; false)); do sleep 1; done
 

service.dockerfile

@@ -16,6 +16,8 @@ RUN echo "deb http://apt.postgresql.org/pub/repos/apt/ $(grep -oP 'VERSION_CODEN
       | gpg --dearmor > /etc/apt/trusted.gpg.d/apt.postgresql.org.gpg
 
 
+ARG DB_SSL
+RUN [[ -v DB_SSL ]] && (echo '\n\n\n\n\nYou have the "DB_SSL" variable defined (in your .env file, probably).\nThis variable is no longer supported from Central 2026.1 onwards.\nThere is a new way of configuring SSL for your database, please see:\n\nhttps://docs.getodk.org/central-install-digital-ocean/#using-a-custom-database-server\n\nPlease refer to the Central 2026.1.0 release notes for more information on this change.\n\n\n\n\n'; exit 13) || true
 
 FROM node:${node_version}-slim AS intermediate
 RUN apt-get update \