Skip to content
Snippets Groups Projects
Verified Commit bf57902c authored by Sheogorath's avatar Sheogorath :european_castle:
Browse files

fix(mastodon): broken streaming postgres certificate

This patch fixes the mastodon-streaming Pod, which refused to talk to the
postgresql cluster, due to the use of TLS with a self-signed certificate.
Since the pg library in NodeJS does not accept any self-signed certificate
without explicitly disabling certificate checking in the source code, this patch
fixes the whole problem by boostrapping a namespace CA, creating a certificate
for the postgresql cluster, adjusting the required permissions for that,
deploying the ca certificate to the mastodon-streaming Pod and configuring the
streaming Pod to consider this namespace CA an additional CA certificate for its
existence.

Let me put it this way: It's not a nice, but a functional and actually
sustainable solution to the problem.

All this is stichted together as postRenderers since the upstream helm chart is
a bit limited in that perspective. Hopefully I can submit all these adjustments
upstream in the long term. It works for now.

References:
https://github.com/mastodon/mastodon/blob/3114c826a7a6b2b10bff722c59cca57abe7f819f/streaming/index.js#L143-L146
https://www.postgresql.org/docs/10/libpq-ssl.html
https://node-postgres.com/features/ssl
parent 22fa75c4
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment