Merge pull request #3029 from alphagov/sslmode

Specify sslmode in Cloud Foundry environment variables

app/cloudfoundry_config.py

@@ -14,7 +14,12 @@ def extract_cloudfoundry_config():
 
 def set_config_env_vars(vcap_services):
     # Postgres config
-    os.environ['SQLALCHEMY_DATABASE_URI'] = vcap_services['postgres'][0]['credentials']['uri']
+    db_uri = vcap_services['postgres'][0]['credentials']['uri']
+
+    sep = "&" if "?" in db_uri else "?"
+    db_uri += sep + "sslmode=verify-full"
+
+    os.environ['SQLALCHEMY_DATABASE_URI'] = db_uri
 
     vcap_application = json.loads(os.environ['VCAP_APPLICATION'])
     os.environ['NOTIFY_ENVIRONMENT'] = vcap_application['space_name']

tests/app/test_cloudfoundry_config.py

@@ -31,10 +31,35 @@ def cloudfoundry_environ(os_environ, cloudfoundry_config):
     os.environ['VCAP_APPLICATION'] = '{"space_name": "🚀🌌"}'
 
 
+@pytest.fixture
+def postgres_config_with_setting():
+    return [
+        {
+            'credentials': {
+                'uri': 'postgres uri?setting=true'
+            }
+        }
+    ]
+
+
+@pytest.fixture
+def cloudfoundry_config_with_setting(postgres_config_with_setting):
+    return {
+        'postgres': postgres_config_with_setting,
+        'user-provided': []
+    }
+
+
+@pytest.fixture
+def cloudfoundry_environ_with_setting(os_environ, cloudfoundry_config_with_setting):
+    os.environ['VCAP_SERVICES'] = json.dumps(cloudfoundry_config_with_setting)
+    os.environ['VCAP_APPLICATION'] = '{"space_name": "🚀🌌"}'
+
+
 def test_extract_cloudfoundry_config_populates_other_vars(cloudfoundry_environ):
     extract_cloudfoundry_config()
 
-    assert os.environ['SQLALCHEMY_DATABASE_URI'] == 'postgres uri'
+    assert os.environ['SQLALCHEMY_DATABASE_URI'] == 'postgres uri?sslmode=verify-full'
     assert os.environ['NOTIFY_ENVIRONMENT'] == '🚀🌌'
     assert os.environ['NOTIFY_LOG_PATH'] == '/home/vcap/logs/app.log'
 
@@ -49,3 +74,9 @@ def test_set_config_env_vars_ignores_unknown_configs(cloudfoundry_config, cloudf
 
     assert 'foo' not in os.environ
     assert 'bar' not in os.environ
+
+
+def test_extract_cloudfoundry_config_populates_postgres_with_setting(cloudfoundry_environ_with_setting):
+    extract_cloudfoundry_config()
+
+    assert os.environ['SQLALCHEMY_DATABASE_URI'] == 'postgres uri?setting=true&sslmode=verify-full'