the right way to update the image and enable SSL (including cert/key file and pg_hba.conf)

[andreaaizza]

Hi,

any doc describing what in subject?

It should basically boil down to:

1. update postgresql.conf: ssl=on... set cert and key file names
2. upload cert and key files in the image
3. update pg_hba.conf with hostssl ...

But, where in the image filesystem should I put postgresql.conf and pg_hba.conf? What ever iss in /var/lib/postgresql/data/ is ovewritten. I can set arguments to docker run... but I need to run this on kubernetes and would like to have that in a custom image. Also, some customisation can be done via POSTGRES_HOST_AUTH_METHOD, but I cannot use that for SSL.

Therefore the question in subject. Can anybody help?

Cheers,
Andrea

[ImreSamu]

Hi Andrea
In my opinion, you can use this example for SSL support: #989 (comment)

[andreaaizza]

Hi @ImreSamu,

thanks. I think that covers parms of postgresql.conf via command line, and cert/key file. Good! I'm wondering, how is that solution implementing the customization of pg_hba.conf? It should at least include "hostssl...", and in some cases some more finetuning.

Regards,
Andrea

[tasooshi]

I've spent a considerable amount of time hacking around this issue, so if that helps anyone (and possibly could be provided in the docs), the solution is below.

The trick is to use a command line argument pointing to the alternative pg_hba.conf file, for example:

  database:
    image: postgres:latest
    volumes:
      - ./ssl:/etc/ssl/postgresql/
      - ./pg_hba.conf:/etc/postgresql/pg_hba.conf
    command: -c ssl=on -c ssl_cert_file=/etc/ssl/postgresql/server.crt -c ssl_key_file=/etc/ssl/postgresql/server.key -c hba_file=/etc/postgresql/pg_hba.conf

The following entries enforce using SSL on clients:

hostnossl  all  all  all     reject
hostssl    all  all  all     scram-sha-256