Support PostgreSQL connection with SSL #1243

.github/workflows/build-binary-for-release.yml

@@ -53,7 +53,7 @@ jobs:
         args: release --clean --skip=validate
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       with:
         name: answer
         path: ./dist/*

.goreleaser.yaml

@@ -65,8 +65,6 @@ archives:
         dst: NOTICE
       - src: "docs/release/licenses/*"
         dst: licenses/
-      - src: "DISCLAIMER"
-        dst: DISCLAIMER
     wrap_in_directory: true
 checksum:
   name_template: 'checksums.txt'

configs/config.yaml

@@ -24,6 +24,12 @@ data:
     connection: "/data/sqlite3/answer.db"
   cache:
     file_path: "/data/cache/cache.db"
+  ssl:
+    enabled: "no"
+    mode: "require"
+    ssl_cert_file: "/data/cache/ssl/certs/server-ca.pem"           
+    ssl_key_file: "/data/cache/ssl/certs/client-cert.pem"
+    ssl_client_cert_file: "/data/cache/ssl/certs/client-key.pem"             
 i18n:
   bundle_dir: "/data/i18n"
 swaggerui:

internal/install/install_req.go

@@ -21,7 +21,9 @@ package install
 
 import (
 	"fmt"
+	"log"
 	"net/url"
+	"os"
 	"strings"
 
 	"github.com/apache/answer/internal/base/reason"
@@ -40,12 +42,17 @@ type CheckConfigFileResp struct {
 
 // CheckDatabaseReq check database
 type CheckDatabaseReq struct {
-	DbType     string `validate:"required,oneof=postgres sqlite3 mysql" json:"db_type"`
-	DbUsername string `json:"db_username"`
-	DbPassword string `json:"db_password"`
-	DbHost     string `json:"db_host"`
-	DbName     string `json:"db_name"`
-	DbFile     string `json:"db_file"`
+	DbType       string `validate:"required,oneof=postgres sqlite3 mysql" json:"db_type"`
+	DbUsername   string `json:"db_username"`
+	DbPassword   string `json:"db_password"`
+	DbHost       string `json:"db_host"`
+	DbName       string `json:"db_name"`
+	DbFile       string `json:"db_file"`
+	Ssl          bool   `json:"ssl_enabled"`
+	SslMode      string `json:"ssl_mode"`
+	SslCrt       string `json:"server-ca.pem"`
+	SslKey       string `json:"client-cert.pem"`
+	SslCrtClient string `json:"client-key.pem"`
 }
 
 // GetConnection get connection string
@@ -59,8 +66,26 @@ func (r *CheckDatabaseReq) GetConnection() string {
 	}
 	if r.DbType == string(schemas.POSTGRES) {
 		host, port := parsePgSQLHostPort(r.DbHost)
-		return fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=disable",
-			host, port, r.DbUsername, r.DbPassword, r.DbName)
+		if !r.Ssl {
+			return fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=disable",
+				host, port, r.DbUsername, r.DbPassword, r.DbName)
+			//supporting two sslmodes (to be extended to all modes)
+		} else if r.SslMode == "require" {
+			return fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=%s",
+				host, port, r.DbUsername, r.DbPassword, r.DbName, r.SslMode)
+		} else if r.SslMode == "verify-ca" {
+			_, err_server_ca := os.Stat(r.SslCrt)
+			_, err_client_cert := os.Stat(r.SslKey)
+			_, err_client_key := os.Stat(r.SslCrtClient)
+			if err_server_ca != nil || err_client_cert != nil || err_client_key != nil {
+				if os.IsNotExist(err_server_ca) || os.IsNotExist(err_client_cert) || os.IsNotExist(err_client_key) {
+					log.Fatal("Certificate not Found !!")
+				}
+			}
+			return fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=%s sslrootcert=%s  sslcert=%s sslkey=%s",
+				host, port, r.DbUsername, r.DbPassword, r.DbName, r.SslMode, r.SslCrt, r.SslKey, r.SslCrtClient)
+		}
+
 	}
 	return ""
 }

ui/src/pages/Install/components/SecondStep/index.tsx

@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { FC, FormEvent } from 'react';
+import { FC, FormEvent, useState  } from 'react';
 import { Form, Button } from 'react-bootstrap';
 import { useTranslation } from 'react-i18next';
 
@@ -51,7 +51,7 @@ const Index: FC<Props> = ({ visible, data, changeCallback, nextCallback }) => {
 
   const checkValidated = (): boolean => {
     let bol = true;
-    const { db_type, db_username, db_password, db_host, db_name, db_file } =
+    const { db_type, db_username, db_password, db_host, db_name, db_file,ssl_enabled,ssl_mode } =
       data;
 
     if (db_type.value !== 'sqlite3') {
@@ -81,7 +81,23 @@ const Index: FC<Props> = ({ visible, data, changeCallback, nextCallback }) => {
           errorMsg: t('db_host.msg'),
         };
       }
-
+      if (!ssl_enabled.value) {
+        bol = false;
+        data.ssl_enabled = {
+          value: '',
+          isInvalid: true,
+          errorMsg: t('ssl_enabled.msg'),
+        };
+      }
+      if (!ssl_mode.value) {
+        bol = false;
+        data.ssl_mode = {
+          value: '',
+          isInvalid: true,
+          errorMsg: t('ssl_mode.msg'),
+        };
+      }
+
       if (!db_name.value) {
         bol = false;
         data.db_name = {
@@ -113,6 +129,14 @@ const Index: FC<Props> = ({ visible, data, changeCallback, nextCallback }) => {
     nextCallback();
   };
 
+  //checkbox for sslmode enabled or not
+  const [checked, setChecked] = useState(false);
+
+  const handleChange = () => {
+    // Change state to the opposite when checkbox changes
+    setChecked(!checked);
+  };
+
   if (!visible) return null;
   return (
     <Form noValidate onSubmit={handleSubmit}>
@@ -183,6 +207,52 @@ const Index: FC<Props> = ({ visible, data, changeCallback, nextCallback }) => {
             <Form.Control.Feedback type="invalid">
               {data.db_password.errorMsg}
             </Form.Control.Feedback>
+            {data.db_type.value=== 'postgres' && (
+              <div className='conditional-checkbox'>
+                <label htmlFor='sslEnabled' className='switch switch-default'>
+                  SSL Mode On
+                </label>
+                <input
+                  id='sslEnabled'
+                  type='checkbox'
+                  checked={checked}
+                  onChange={(e) => {
+                    changeCallback({
+                      ssl_enabled: {
+                        value: e.target.value,
+                        isInvalid: false,
+                        errorMsg: '',
+                      },
+                    });
+                  }}
+                />
+                {checked &&  (
+                  <Form.Group controlId="sslmodeOptionsDropdown" className="mb-3">
+                          <Form.Label>{"SSL mode"}</Form.Label>
+                          <Form.Select
+                            value={data.value}
+                            isInvalid={data.isInvalid}
+                            onChange={(e) => {
+                              changeCallback({
+                                ssl_mode: {
+                                  value: e.target.value,
+                                  isInvalid: false,
+                                  errorMsg: '',
+                                },
+                              });
+                            }}>
+                            {["require","verify-ca"].map((item) => {
+                              return (
+                                <option value={item} key={item}>
+                                  {item}
+                                </option>
+                              );
+                            })}
+                          </Form.Select>
+                        </Form.Group>
+                  )}
+                </div>
+                )}
           </Form.Group>
 
           <Form.Group controlId="db_host" className="mb-3">
@@ -228,6 +298,7 @@ const Index: FC<Props> = ({ visible, data, changeCallback, nextCallback }) => {
               {data.db_name.errorMsg}
             </Form.Control.Feedback>
           </Form.Group>
+
         </>
       ) : (
         <Form.Group controlId="file" className="mb-3">

ui/src/pages/Install/index.tsx

@@ -130,6 +130,16 @@ const Index: FC = () => {
       isInvalid: false,
       errorMsg: '',
     },
+    ssl_enabled: {
+      value: '',
+      isInvalid: false,
+      errorMsg: '',
+    },
+    ssl_mode: {
+      value: '',
+      isInvalid: false,
+      errorMsg: '',
+    },
   });
 
   const updateFormData = (params: FormDataType) => {