External database ssl mode

[edlouth]

Value to set ssl mode for external postgres database

[LarsHanegraaf]

Setting the following extra environment variable in the values, resolved the problem:

extraEnv:
  - name: PGSSLMODE
    value: require

[simonlbcr]

The ssl section (added since this issue was opened) fixes SSL for the backend deployment but not the worker. With ssl.enabled: true:

• Backend: gets PGSSLMODE and NODE_EXTRA_CA_CERTS env vars ✅
• Worker: gets the cert volume mounted, but neither env var ❌

The worker crashes with Error migrating graphile worker SSL required because Graphile Worker connects to PG without TLS.

Workaround — add the missing vars via schedulerExtraEnv:

ssl:
  enabled: true
  mountPath: "/etc/ssl/certs"
  certFileName: "ca-certificate.crt"
  configMapName: "pg-ca-cert"

schedulerExtraEnv:
  - name: NODE_EXTRA_CA_CERTS
    value: "/etc/ssl/certs/ca-certificate.crt"
  - name: PGSSLMODE
    value: "require"

Expected: ssl.enabled: true should set PGSSLMODE and NODE_EXTRA_CA_CERTS on all deployments (backend, worker, and any nats workers), not just the backend.

Chart version: lightdash-2.7.3, app version 0.2744.1.