WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

TLS

Browse Source
This commit is contained in:
eric
2026-10-20 17:09:22 -04:00
parent 447314440b
commit 621611ecd9
4 changed files with 73 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/market/postgres-config.ts
+13 -2
View File
@@ -19,6 +19,15 @@ export async function postgresConfig(env: NodeJS.ProcessEnv = process.env): Prom
if (!['postgres:', 'postgresql:'].includes(url.protocol) || !url.hostname || url.search || url.hash ||
!/^\/[a-zA-Z0-9_-]+$/.test(url.pathname)) throw new Error('Invalid PostgreSQL URL');
const insecure = env.WIKIDECK_CUSTODY_PG_LOCAL_TEST === '1';
const transport = env.WIKIDECK_CUSTODY_PG_TRANSPORT ?? 'tls';
if (transport !== 'tls' && transport !== 'infrastructure') throw new Error('Invalid PostgreSQL transport');
const infrastructure = transport === 'infrastructure';
const acknowledgement = env.WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK;
if (infrastructure) {
if (acknowledgement !== 'encrypted-authenticated-path-enforced' || insecure || env.WIKIDECK_CUSTODY_PG_CA_FILE) {
throw new Error('Infrastructure transport requires explicit acknowledgement without conflicting TLS/test settings');
}
} else if (acknowledgement !== undefined) throw new Error('Infrastructure acknowledgement without infrastructure transport');
if (env.WIKIDECK_CUSTODY_PG_LOCAL_TEST !== undefined && !insecure) throw new Error('Invalid local-test switch');
if (insecure && !['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)) throw new Error('Non-TLS test connections must be loopback');
if (!insecure && (!url.username || !url.password)) throw new Error('PostgreSQL credentials required');
@@ -26,9 +35,11 @@ export async function postgresConfig(env: NodeJS.ProcessEnv = process.env): Prom
const ca = env.WIKIDECK_CUSTODY_PG_CA_FILE ? await secretFile(env.WIKIDECK_CUSTODY_PG_CA_FILE) : undefined;
return { host: url.hostname.replace(/^\[|\]$/g, ''), port: url.port ? Number(url.port) : 5432,
database: url.pathname.slice(1), user: decodeURIComponent(url.username), password: decodeURIComponent(url.password),
ssl: insecure ? false : { rejectUnauthorized: true, ...(ca ? { ca } : {}) },
// Infrastructure mode is explicit plaintext on the driver's hop. It does NOT configure or
// verify a service mesh, peer identity, network policy, or encryption outside this process.
ssl: insecure || infrastructure ? false : { rejectUnauthorized: true, ...(ca ? { ca } : {}) },
max: 4, connectionTimeoutMillis: 5000, idleTimeoutMillis: 10000,
statement_timeout: 10000, lock_timeout: 3000, idle_in_transaction_session_timeout: 10000,
application_name: 'wikideck-custody', options: '-c search_path=wk_custody,pg_catalog' };
} catch { throw new Error('Invalid or inaccessible custody PostgreSQL configuration; check secret files and verified TLS settings'); }
} catch { throw new Error('Invalid or inaccessible custody PostgreSQL configuration; check secret files and explicit transport policy'); }
}