feat: allow for postgres ssl connections

.env.example

@@ -23,6 +23,7 @@ CLICKHOUSE_PASSWORD=frog
 POSTGRES_DB=analytics
 POSTGRES_USER=frog
 POSTGRES_PASSWORD=frog
+POSTGRES_SSL=false
 
 # External Service Tokens (optional)
 MAPBOX_TOKEN=

docker-compose.cloud.yml

@@ -95,6 +95,7 @@ services:
       - POSTGRES_DB=${POSTGRES_DB:-analytics}
       - POSTGRES_USER=${POSTGRES_USER:-frog}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-frog}
+      - POSTGRES_SSL=${POSTGRES_SSL:-false}
       - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
       - BASE_URL=${BASE_URL}
       - DISABLE_SIGNUP=${DISABLE_SIGNUP}

docs/content/docs/self-hosting-guides/self-hosting-advanced.mdx

@@ -78,6 +78,7 @@ CLICKHOUSE_PASSWORD=frog
 POSTGRES_USER=frog
 POSTGRES_PASSWORD=frog
 POSTGRES_DB=analytics
+POSTGRES_SSL=false
 CLICKHOUSE_DB=analytics
 
 # Custom image tags

server/drizzle.config.ts

@@ -13,7 +13,20 @@ export default defineConfig({
     database: process.env.POSTGRES_DB || "analytics",
     user: process.env.POSTGRES_USER || "frog",
     password: process.env.POSTGRES_PASSWORD || "frog",
-    ssl: false,
+    ssl:
+      process.env.POSTGRES_SSL === "true"
+        ? {
+            rejectUnauthorized:
+              process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "false"
+                ? false
+                : true,
+            ca: process.env.POSTGRES_SSL_CA
+              ? process.env.POSTGRES_SSL_CA.replace(/\\n/g, "\n")
+              : undefined,
+          }
+        : false,
+    onnotice: () => {},
+    max: 20,
   },
   verbose: true,
   schemaFilter: ["public"],

server/src/db/postgres/postgres.ts

@@ -12,6 +12,18 @@ const client = postgres({
   database: process.env.POSTGRES_DB,
   username: process.env.POSTGRES_USER,
   password: process.env.POSTGRES_PASSWORD,
+  ssl:
+    process.env.POSTGRES_SSL === "true"
+      ? {
+          rejectUnauthorized:
+            process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "false"
+              ? false
+              : true,
+          ca: process.env.POSTGRES_SSL_CA
+            ? process.env.POSTGRES_SSL_CA.replace(/\\n/g, "\n")
+            : undefined,
+        }
+      : false,
   onnotice: () => {},
   max: 20,
 });

server/src/lib/auth.ts

@@ -101,6 +101,18 @@ export const auth = betterAuth({
     database: process.env.POSTGRES_DB,
     user: process.env.POSTGRES_USER,
     password: process.env.POSTGRES_PASSWORD,
+    ssl:
+      process.env.POSTGRES_SSL === "true"
+        ? {
+            rejectUnauthorized:
+              process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "false"
+                ? false
+                : true,
+            ca: process.env.POSTGRES_SSL_CA
+              ? process.env.POSTGRES_SSL_CA.replace(/\\n/g, "\n")
+              : undefined,
+          }
+        : undefined,
   }),
   emailAndPassword: {
     enabled: true,