darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-02-01 15:46:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

db: specify sslmode in Cloud Foundry env

Browse Source 
Refer to
https://www.postgresql.org/docs/11/libpq-connect.html#LIBPQ-CONNECT-SSLMODE

GOV.UK PaaS gives us the database URI, and we use the default mode of
postgres auth which prefers a TLS connection instead of a plain TCP
connection

We are now specifying the SSL mode in the URI when establishing our
connection to the database, so that:

* We will not connect to the database via a plaintext connection
* We will verify the database connection against a list of trusted CAs

The RDS CA from which the database's certificate is issued is added into
the Cloud Foundry app container via
925681f19b/manifests/cf-manifest/operations.d/350-diego-cell.yml (L17-L22)

Signed-off-by: Toby Lorne <toby.lornewelch-richards@digital.cabinet-office.gov.uk>
Co-authored-by: David <david.mcdonald@digital.cabinet-office.gov.uk>
This commit is contained in:
Toby Lorne
2020-11-09 10:40:58 +00:00
parent 29b6ed427d
commit cfcc3128c2
2 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/cloudfoundry_config.py
View File

@@ -14,7 +14,12 @@ def extract_cloudfoundry_config():
def set_config_env_vars(vcap_services):
# Postgres config
os.environ['SQLALCHEMY_DATABASE_URI'] = vcap_services['postgres'][0]['credentials']['uri']
db_uri = vcap_services['postgres'][0]['credentials']['uri']
sep = "&" if "?" in db_uri else "?"
db_uri += sep + "sslmode=verify-full"
os.environ['SQLALCHEMY_DATABASE_URI'] = db_uri
vcap_application = json.loads(os.environ['VCAP_APPLICATION'])
os.environ['NOTIFY_ENVIRONMENT'] = vcap_application['space_name']