Skip to content

Commit f7e72d5

Browse files
tariqksolimantariqksoliman
authored
#688 Support SSL DB Connections (#692)
* #688 Add DB_SSL ENVs * #688 Fix Typo * #688 SSL for connect-pg-simple
1 parent 301d233 commit f7e72d5

File tree

5 files changed

+117
-0
lines changed

5 files changed

+117
-0
lines changed

‎API/connection.js‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
const Sequelize = require("sequelize");
22
const logger = require("./logger");
3+
const fs = require("fs");
34
require("dotenv").config();
45

56
// create a sequelize instance with our local postgres database information.
@@ -11,6 +12,26 @@ const sequelize = new Sequelize(
1112
host: process.env.DB_HOST,
1213
port: process.env.DB_PORT || "5432",
1314
dialect: "postgres",
15+
dialectOptions: {
16+
ssl:
17+
process.env.DB_SSL === "true"
18+
? {
19+
require: true,
20+
rejectUnauthorized: true,
21+
ca:
22+
process.env.DB_SSL_CERT_BASE64 != null &&
23+
process.env.DB_SSL_CERT_BASE64 !== ""
24+
? Buffer.from(
25+
process.env.DB_SSL_CERT_BASE64,
26+
"base64"
27+
).toString("utf-8")
28+
: process.env.DB_SSL_CERT != null &&
29+
process.env.DB_SSL_CERT !== ""
30+
? fs.readFileSync(process.env.DB_SSL_CERT)
31+
: false,
32+
}
33+
: false,
34+
},
1435
logging: process.env.VERBOSE_LOGGING == "true" || false,
1536
pool: {
1637
max:
@@ -37,6 +58,26 @@ const sequelizeSTAC =
3758
host: process.env.DB_HOST,
3859
port: process.env.DB_PORT || "5432",
3960
dialect: "postgres",
61+
dialectOptions: {
62+
ssl:
63+
process.env.DB_SSL === "true"
64+
? {
65+
require: true,
66+
rejectUnauthorized: true,
67+
ca:
68+
process.env.DB_SSL_CERT_BASE64 != null &&
69+
process.env.DB_SSL_CERT_BASE64 !== ""
70+
? Buffer.from(
71+
process.env.DB_SSL_CERT_BASE64,
72+
"base64"
73+
).toString("utf-8")
74+
: process.env.DB_SSL_CERT != null &&
75+
process.env.DB_SSL_CERT !== ""
76+
? fs.readFileSync(process.env.DB_SSL_CERT)
77+
: false,
78+
}
79+
: false,
80+
},
4081
logging: process.env.VERBOSE_LOGGING == "true" || false,
4182
pool: {
4283
max:

‎docs/pages/Setup/ENVs/ENVs.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,18 @@ How many milliseconds until a DB connection times out | integer | default `30000
8989

9090
How many milliseconds for an incoming connection to wait for a DB connection before getting kicked away | integer | default `10000` (10 sec)
9191

92+
#### `DB_SSL=`
93+
94+
If the Postgres DB instance is enforcing SSL, set to true to have MMGIS connect to it via SSL | boolean | default `false`
95+
96+
#### `DB_SSL_CERT=`
97+
98+
If `DB_SSL=true` and if needed, the path to a certificate for ssl | string | default `null`
99+
100+
#### `DB_SSL_CERT_BASE64=`
101+
102+
Alternatively, if `DB_SSL=true` and if needed, a base64 encoded certificate for ssl. `DB_SSL_CERT_BASE64` will take priority over `DB_SSL_CERT` | string | default `null`
103+
92104
#### `CSSO_GROUPS=`
93105

94106
A list of CSSO LDAP groups that have access | string[] | default `[]`

‎sample.env‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,12 @@ DB_POOL_MAX=
9696
DB_POOL_TIMEOUT=
9797
# How many milliseconds for an incoming connection to wait for a DB connection before getting kicked away. Default is 10000 (10 sec)
9898
DB_POOL_IDLE=
99+
# If the Postgres DB instance is enforcing SSL, set to true to have MMGIS connect to it via SSL | boolean | default false
100+
DB_SSL=false
101+
# If DB_SSL=true and if needed, the path to a certificate for ssl | string
102+
DB_SSL_CERT=
103+
# Alternatively, if DB_SSL=true and if needed, a base64 encoded certificate for ssl. DB_SSL_CERT_BASE64 will take priority over DB_SSL_CERT | string
104+
DB_SSL_CERT_BASE64=
99105

100106
#CONFIG
101107
# Disable the configure page

‎scripts/init-db.js‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
const fs = require("fs");
12
const Sequelize = require("sequelize");
23
const logger = require("../API/logger");
34
const utils = require("../API/utils");
@@ -26,6 +27,26 @@ async function initializeDatabase() {
2627
host: process.env.DB_HOST,
2728
port: process.env.DB_PORT || "5432",
2829
dialect: "postgres",
30+
dialectOptions: {
31+
ssl:
32+
process.env.DB_SSL === "true"
33+
? {
34+
require: true,
35+
rejectUnauthorized: true,
36+
ca:
37+
process.env.DB_SSL_CERT_BASE64 != null &&
38+
process.env.DB_SSL_CERT_BASE64 !== ""
39+
? Buffer.from(
40+
process.env.DB_SSL_CERT_BASE64,
41+
"base64"
42+
).toString("utf-8")
43+
: process.env.DB_SSL_CERT != null &&
44+
process.env.DB_SSL_CERT !== ""
45+
? fs.readFileSync(process.env.DB_SSL_CERT)
46+
: false,
47+
}
48+
: false,
49+
},
2950
logging: process.env.VERBOSE_LOGGING == "true" || false,
3051
pool: {
3152
max: 10,
@@ -123,6 +144,26 @@ async function initializeDatabase() {
123144
host: process.env.DB_HOST,
124145
port: process.env.DB_PORT || "5432",
125146
dialect: "postgres",
147+
dialectOptions: {
148+
ssl:
149+
process.env.DB_SSL === "true"
150+
? {
151+
require: true,
152+
rejectUnauthorized: true,
153+
ca:
154+
process.env.DB_SSL_CERT_BASE64 != null &&
155+
process.env.DB_SSL_CERT_BASE64 !== ""
156+
? Buffer.from(
157+
process.env.DB_SSL_CERT_BASE64,
158+
"base64"
159+
).toString("utf-8")
160+
: process.env.DB_SSL_CERT != null &&
161+
process.env.DB_SSL_CERT !== ""
162+
? fs.readFileSync(process.env.DB_SSL_CERT)
163+
: false,
164+
}
165+
: false,
166+
},
126167
logging: process.env.VERBOSE_LOGGING == "true" || false,
127168
pool: {
128169
max: 10,

‎scripts/server.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,23 @@ const pool = new Pool({
107107
database: process.env.DB_NAME,
108108
password: process.env.DB_PASS,
109109
port: process.env.DB_PORT || "5432",
110+
ssl:
111+
process.env.DB_SSL === "true"
112+
? {
113+
require: true,
114+
rejectUnauthorized: true,
115+
ca:
116+
process.env.DB_SSL_CERT_BASE64 != null &&
117+
process.env.DB_SSL_CERT_BASE64 !== ""
118+
? Buffer.from(process.env.DB_SSL_CERT_BASE64, "base64").toString(
119+
"utf-8"
120+
)
121+
: process.env.DB_SSL_CERT != null &&
122+
process.env.DB_SSL_CERT !== ""
123+
? fs.readFileSync(process.env.DB_SSL_CERT)
124+
: false,
125+
}
126+
: false,
110127
});
111128
app.use(
112129
session({

0 commit comments

Comments
 (0)
⚡