Skip to content

#688 Support SSL DB Connections #692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tariqksoliman merged 3 commits into from
May 19, 2025
Merged

#688 Support SSL DB Connections #692

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
32b8c33
#688 Add DB_SSL ENVs
tariqksoliman May 14, 2025
5488c87
#688 Fix Typo
tariqksoliman May 16, 2025
5fd7d3b
#688 SSL for connect-pg-simple
tariqksoliman May 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions API/connection.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
const Sequelize = require("sequelize");
const logger = require("./logger");
const fs = require("fs");
require("dotenv").config();

// create a sequelize instance with our local postgres database information.
Expand All @@ -11,6 +12,26 @@ const sequelize = new Sequelize(
host: process.env.DB_HOST,
port: process.env.DB_PORT || "5432",
dialect: "postgres",
dialectOptions: {
ssl:
process.env.DB_SSL === "true"
? {
require: true,
rejectUnauthorized: true,
ca:
process.env.DB_SSL_CERT_BASE64 != null &&
process.env.DB_SSL_CERT_BASE64 !== ""
? Buffer.from(
process.env.DB_SSL_CERT_BASE64,
"base64"
).toString("utf-8")
: process.env.DB_SSL_CERT != null &&
process.env.DB_SSL_CERT !== ""
? fs.readFileSync(process.env.DB_SSL_CERT)
: false,
}
: false,
},
logging: process.env.VERBOSE_LOGGING == "true" || false,
pool: {
max:
Expand All @@ -37,6 +58,26 @@ const sequelizeSTAC =
host: process.env.DB_HOST,
port: process.env.DB_PORT || "5432",
dialect: "postgres",
dialectOptions: {
ssl:
process.env.DB_SSL === "true"
? {
require: true,
rejectUnauthorized: true,
ca:
process.env.DB_SSL_CERT_BASE64 != null &&
process.env.DB_SSL_CERT_BASE64 !== ""
? Buffer.from(
process.env.DB_SSL_CERT_BASE64,
"base64"
).toString("utf-8")
: process.env.DB_SSL_CERT != null &&
process.env.DB_SSL_CERT !== ""
? fs.readFileSync(process.env.DB_SSL_CERT)
: false,
}
: false,
},
logging: process.env.VERBOSE_LOGGING == "true" || false,
pool: {
max:
Expand Down
12 changes: 12 additions & 0 deletions docs/pages/Setup/ENVs/ENVs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,18 @@ How many milliseconds until a DB connection times out | integer | default `30000

How many milliseconds for an incoming connection to wait for a DB connection before getting kicked away | integer | default `10000` (10 sec)

#### `DB_SSL=`

If the Postgres DB instance is enforcing SSL, set to true to have MMGIS connect to it via SSL | boolean | default `false`

#### `DB_SSL_CERT=`

If `DB_SSL=true` and if needed, the path to a certificate for ssl | string | default `null`

#### `DB_SSL_CERT_BASE64=`

Alternatively, if `DB_SSL=true` and if needed, a base64 encoded certificate for ssl. `DB_SSL_CERT_BASE64` will take priority over `DB_SSL_CERT` | string | default `null`

#### `CSSO_GROUPS=`

A list of CSSO LDAP groups that have access | string[] | default `[]`
Expand Down
6 changes: 6 additions & 0 deletions sample.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,12 @@ DB_POOL_MAX=
DB_POOL_TIMEOUT=
# How many milliseconds for an incoming connection to wait for a DB connection before getting kicked away. Default is 10000 (10 sec)
DB_POOL_IDLE=
# If the Postgres DB instance is enforcing SSL, set to true to have MMGIS connect to it via SSL | boolean | default false
DB_SSL=false
# If DB_SSL=true and if needed, the path to a certificate for ssl | string
DB_SSL_CERT=
# Alternatively, if DB_SSL=true and if needed, a base64 encoded certificate for ssl. DB_SSL_CERT_BASE64 will take priority over DB_SSL_CERT | string
DB_SSL_CERT_BASE64=

#CONFIG
# Disable the configure page
Expand Down
41 changes: 41 additions & 0 deletions scripts/init-db.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
const fs = require("fs");
const Sequelize = require("sequelize");
const logger = require("../API/logger");
const utils = require("../API/utils");
Expand Down Expand Up @@ -26,6 +27,26 @@ async function initializeDatabase() {
host: process.env.DB_HOST,
port: process.env.DB_PORT || "5432",
dialect: "postgres",
dialectOptions: {
ssl:
process.env.DB_SSL === "true"
? {
require: true,
rejectUnauthorized: true,
ca:
process.env.DB_SSL_CERT_BASE64 != null &&
process.env.DB_SSL_CERT_BASE64 !== ""
? Buffer.from(
process.env.DB_SSL_CERT_BASE64,
"base64"
).toString("utf-8")
: process.env.DB_SSL_CERT != null &&
process.env.DB_SSL_CERT !== ""
? fs.readFileSync(process.env.DB_SSL_CERT)
: false,
}
: false,
},
logging: process.env.VERBOSE_LOGGING == "true" || false,
pool: {
max: 10,
Expand Down Expand Up @@ -123,6 +144,26 @@ async function initializeDatabase() {
host: process.env.DB_HOST,
port: process.env.DB_PORT || "5432",
dialect: "postgres",
dialectOptions: {
ssl:
process.env.DB_SSL === "true"
? {
require: true,
rejectUnauthorized: true,
ca:
process.env.DB_SSL_CERT_BASE64 != null &&
process.env.DB_SSL_CERT_BASE64 !== ""
? Buffer.from(
process.env.DB_SSL_CERT_BASE64,
"base64"
).toString("utf-8")
: process.env.DB_SSL_CERT != null &&
process.env.DB_SSL_CERT !== ""
? fs.readFileSync(process.env.DB_SSL_CERT)
: false,
}
: false,
},
logging: process.env.VERBOSE_LOGGING == "true" || false,
pool: {
max: 10,
Expand Down
17 changes: 17 additions & 0 deletions scripts/server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,23 @@ const pool = new Pool({
database: process.env.DB_NAME,
password: process.env.DB_PASS,
port: process.env.DB_PORT || "5432",
ssl:
process.env.DB_SSL === "true"
? {
require: true,
rejectUnauthorized: true,
ca:
process.env.DB_SSL_CERT_BASE64 != null &&
process.env.DB_SSL_CERT_BASE64 !== ""
? Buffer.from(process.env.DB_SSL_CERT_BASE64, "base64").toString(
"utf-8"
)
: process.env.DB_SSL_CERT != null &&
process.env.DB_SSL_CERT !== ""
? fs.readFileSync(process.env.DB_SSL_CERT)
: false,
}
: false,
});
app.use(
session({
Expand Down
⚡