Does not support TLS

[heroku]

Does not support TLS

[bigkevmcd]

Hey @uhoh-itsmaciek is this enough? https://github.com/heroku/heroku-buildpack-ci-postgresql/blob/master/support/postgresql-build#L31

[msakrejda]

@bigkevmcd hmm I thought so, but looking at the history of that file, this has been configured like that since the beginning, and I've definitely had issues connecting, so maybe there's more to it. Let me investigate; I'll follow up.

[msakrejda]

Yeah, i don't know what's up: we're definitely building with openssl: pg_config confirms it:

~ $ /app/vendor/postgresql/bin/pg_config
BINDIR = /app/vendor/postgresql/bin
DOCDIR = /app/vendor/postgresql/share/doc
HTMLDIR = /app/vendor/postgresql/share/doc
INCLUDEDIR = /app/vendor/postgresql/include
PKGINCLUDEDIR = /app/vendor/postgresql/include
INCLUDEDIR-SERVER = /app/vendor/postgresql/include/server
LIBDIR = /app/vendor/postgresql/lib
PKGLIBDIR = /app/vendor/postgresql/lib
LOCALEDIR = /app/vendor/postgresql/share/locale
MANDIR = /app/vendor/postgresql/share/man
SHAREDIR = /app/vendor/postgresql/share
SYSCONFDIR = /app/vendor/postgresql/etc
PGXS = /app/vendor/postgresql/lib/pgxs/src/makefiles/pgxs.mk
CONFIGURE = '--prefix=/app/vendor/postgresql' '--enable-integer-datetimes' '--enable-thread-safety' '--enable-debug' '--disable-rpath' '--with-gnu-ld' '--with-pgport=5432' '--with-system-tzdata=/usr/share/zoneinfo' '--without-tcl' '--without-perl' '--without-python' '--with-krb5' '--with-gssapi' '--with-openssl' '--with-libxml' '--with-libxslt' '--with-uuid=e2fs'
CC = gcc
CPPFLAGS = -DFRONTEND -D_GNU_SOURCE -I/usr/include/libxml2
CFLAGS = -Wall -Wmissing-prototypes -Wpointer-arith -Wdeclaration-after-statement -Wendif-labels -Wmissing-format-attribute -Wformat-security -fno-strict-aliasing -fwrapv -fexcess-precision=standard -g -O2
CFLAGS_SL = -fPIC
LDFLAGS = -L../../src/common -Wl,--as-needed
LDFLAGS_EX = 
LDFLAGS_SL = 
LIBS = -lpgcommon -lpgport -lpthread -lxslt -lxml2 -lssl -lcrypto -lgssapi_krb5 -lz -lreadline -lrt -lcrypt -ldl -lm  
VERSION = PostgreSQL 10.1
~ $ PGSSLMODE=require psql $DATABASE_URL 
psql: server does not support SSL, but SSL was required
~ $ psql $DATABASE_URL                  
psql (10.1)
Type "help" for help.

postgres_buildpack_db=# 

But requiring TLS still doesn't work. I can't really dig deeper right now; I'll keep this in mind if I run across some new info.

[msakrejda]

I think we need to generate a snakeoil cert:

~ $ /app/vendor/postgresql/bin/postgres -c ssl=on            
2017-12-12 22:00:16.436 UTC [833] FATAL:  could not load server certificate file "server.crt": No such file or directory
2017-12-12 22:00:16.436 UTC [833] LOG:  database system is shut down

I can take this on and submit a pull request.