Feature Request: support client certificate authentication for PostgreSQL

[gclawes]

What is the problem you are trying to solve with this feature?

Support for client certificate authentication would allow homebox to connect to a PostgreSQL database with client certificates instead of (or in supplementation to) username/password. This would be especially useful in Kubernetes environments, where features like cert-manager can provision short-lived certificates that can be trusted by a database server, removing the need to manage secret database credentials.

More info:
https://www.postgresql.org/docs/current/auth-cert.html
https://goteleport.com/learn/postgresql-ssl-authentication-guide/

What is the solution you are proposing?

Add support for configuring client certificates/key (and optionally CA) as environment variables which configure the corresponding options in the PostgreSQL connection string:

• HBOX_DATABASE_SSL_CERT -> sslcert
• HBOX_DATABASE_SSL_KEY -> sslkey

Optionally, for client verification of host certificate.

• HBOX_DATABASE_SSL_ROOT_CERT -> sslrootcert

libpq SSL connection string parameters documented here: https://www.postgresql.org/docs/current/libpq-ssl.html

What alternatives have you considered?

An alternative to using client certificate authentication is to run homebox with HBOX_DATABASE_SSL_MODE=disable to disable SSL usage and negotiation, and run stunnel as a sidecar with protocol = postgresql, with the appropriate client cert settings.

This effectively hands off SSL to stunnel as a sidecar, but at the cost of complexity and possibly performance.

Additional context

No response

Contributions

• I have searched through existing ideas in the discussions to check if this is a duplicate

[tankerkiller125]

#894 to track