From daf00a45e83233872bbe367bb5d35a2a43a32c66 Mon Sep 17 00:00:00 2001 From: Manuel Raynaud Date: Tue, 22 Sep 2026 09:40:50 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(yhub)=20document=20how=20to=20enab?= =?UTF-8?q?le=20secure=20postrgesql=20connection?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Document how to enable secure postgresql connection if needed. --- src/helm/impress/values.yaml | 1 + src/yhub-server/README.md | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/src/helm/impress/values.yaml b/src/helm/impress/values.yaml index e432772ab..5740f7fe6 100644 --- a/src/helm/impress/values.yaml +++ b/src/helm/impress/values.yaml @@ -1084,6 +1084,7 @@ yhub: ## @param yhub.envVars Configure yhub container environment variables ## @extra yhub.envVars.REDIS Required, redis/valkey url holding the live document state (e.g. redis://valkey:6379/0) ## @extra yhub.envVars.POSTGRES Required, url of the yhub database, created by the init-db job (e.g. postgres://user:pass@postgres:5432/yhub) + ## Append `?sslmode=require` (or `verify-full`) when the server only accepts TLS, which is the default of the Zalando/Spilo operator ## @extra yhub.envVars.REDIS_PREFIX Namespace of the redis keys, when the instance is shared (default: yhub) ## @extra yhub.envVars.COLLABORATION_BACKEND_BASE_URL Base url of the Docs backend, which yhub asks about users and document access rights ## @extra yhub.envVars.COLLABORATION_SERVER_ORIGIN Comma separated list of the origins allowed to open a websocket diff --git a/src/yhub-server/README.md b/src/yhub-server/README.md index 45074fcb5..68bef5354 100644 --- a/src/yhub-server/README.md +++ b/src/yhub-server/README.md @@ -556,6 +556,15 @@ the DDL is applied (`relation "yhub_ydoc_tombstones_v1" does not exist`, for instance). Nothing in this repository copies the schema, so an upgrade is `package.json` plus this script and nothing else. +The connection is not encrypted unless the url asks for it. A server that only +has `hostssl` rules in its `pg_hba.conf` — the default of the Zalando/Spilo +operator — answers `pg_hba.conf rejects connection for host ..., no +encryption`: append `?sslmode=require` to `POSTGRES` +(`postgres://user:pass@host:5432/yhub?sslmode=require`), or +`?sslmode=verify-full` when the certificate of the server is signed by an +authority Node trusts (`NODE_EXTRA_CA_CERTS`). The server, the worker and +`init-db` all read the same url, so the parameter is set once. + From the repository root, `make migrate-yhub` runs it against the dev stack — the counterpart of `make migrate` for the Django database. `make bootstrap` already includes it, so a fresh checkout needs nothing extra; an upgrade is