platform-admin/Cibello-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(db): RDS-CA i poolen (app+migrator delar TLS)

Browse Source
This commit is contained in:
Sven (AAMOS AI)
2026-08-12 05:34:43 +07:00
parent 983f3fb2aa
commit 81927b6cdc
5 changed files with 86 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/deployment/first-deploy.sh
+16 -4
View File
@@ -118,10 +118,19 @@ say "GRIND 1 OK: .env på plats ($([ "$MODE" = production ] && echo 'produktions
db_reachable() {
(cd "$ROOT" && node -e "
const { Client } = require('pg');
const extraCa = process.env.NODE_EXTRA_CA_CERTS ? require('fs').readFileSync(process.env.NODE_EXTRA_CA_CERTS) : undefined;
const ssl = extraCa ? { ca: extraCa } : undefined;
const c = new Client({ connectionString: process.env.DB_URL, connectionTimeoutMillis: 3000, ...(ssl ? { ssl } : {}) });
c.connect().then(() => c.end()).then(() => process.exit(0)).catch(() => process.exit(1));
const fs = require('fs');
const caPath = process.env.DATABASE_CA_CERT || process.env.NODE_EXTRA_CA_CERTS;
const rawUrl = process.env.DB_URL || '';
const hasSslmode = /sslmode=(require|verify)/.test(rawUrl);
const url = rawUrl.replace(/[?&]sslmode=[^&]+/, '').replace(/\?$/, '');
let ssl;
if (caPath && fs.existsSync(caPath)) {
ssl = { ca: fs.readFileSync(caPath), rejectUnauthorized: true };
} else if (hasSslmode) {
ssl = { rejectUnauthorized: false };
}
const c = new Client({ connectionString: url, connectionTimeoutMillis: 3000, ...(ssl ? { ssl } : {}) });
c.connect().then(() => c.end()).then(() => process.exit(0)).catch((e) => { console.error(e.message); process.exit(1); });
") 2>/dev/null
}
# Rå TCP-PING: alla svar (även -NOAUTH) bevisar att Redis är nåbar.
@@ -147,6 +156,9 @@ start_docker_services() {
}
export DB_URL="$(get_env DATABASE_URL)"
export R_URL="$(get_env REDIS_URL)"
export DATABASE_CA_CERT="$(get_env DATABASE_CA_CERT)"
EXTRA_CA=$(get_env NODE_EXTRA_CA_CERTS)
[ -n "$EXTRA_CA" ] && export NODE_EXTRA_CA_CERTS="$EXTRA_CA"
if DB_URL="$DB_URL" db_reachable; then
say "Databasen svarar redan – ingen uppstart behövs."
elif [ "$MODE" = "staging" ]; then