1436899 - Use SSL to connect to Postgres database

Status: RESOLVED WORKSFORME

(Webtools :: Pulse, enhancement)

Description

[Mark Côté [:mcote]]

Heroku will soon require the use of SSL when connecting to Postgres databases (which is a good idea in any case).

Comment 1

[Mark Côté [:mcote]]

According to https://devcenter.heroku.com/articles/heroku-postgres-ssl-brownouts there's likely nothing we need to do, as "sslmode" in libpq defaults to "prefer", and we're not overriding it.  Also pulseguardian-dev appears to be using modern infrastructure, and it is working fine (or at least was, until bug 1436901 surfaced, which I'm looking into).

We could force "sslmode" to "require" when running in heroku, although that is seemingly unnecessary.

Comment 2

[Mark Côté [:mcote]]

Running "heroku pg:credentials:url DATABASE -a pulseguardian" has also indicated that we're running with sslmode as "require" (which I guess is what happens when you have it configured to "prefer" and the db supports SSL).

Comment 3

[Ed Morley [:emorley]]

(In reply to Mark Côté [:mcote] from comment #1)
> We could force "sslmode" to "require" when running in heroku, although that
> is seemingly unnecessary.

`prefer` is close to `disable` in terms of security offered, see:
https://www.postgresql.org/docs/10/static/libpq-ssl.html#LIBPQ-SSL-PROTECTION

Comment 4

[Ed Morley [:emorley]]

The brownout occurred here:
https://papertrailapp.com/systems/pulseguardian/events?focus=900501047435526185