unkin/tomswallapi
4
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

Default TOMSWALLAPI_DB_SSLMODE to require; document local-dev override #20

New Issue
Open
opened 2026-07-26 17:11:04 +10:00 by benvin · 0 comments
benvin commented 2026-07-26 17:11:04 +10:00
Owner
Copy Link
Copy Source

Problem. The default is disable. The database carries the complete
firewall policy for the estate and the credentials that guard it; plaintext
Postgres as the out-of-the-box posture is the wrong default even though
docker-compose localhost is the common dev case.

Proposal. Default require (or verify-full where CA material is
available); set disable explicitly in docker-compose.yml for local dev.
Defaults should be safe in production and overridden for dev, not the reverse.

**Problem.** The default is `disable`. The database carries the complete firewall policy for the estate and the credentials that guard it; plaintext Postgres as the out-of-the-box posture is the wrong default even though docker-compose localhost is the common dev case. **Proposal.** Default `require` (or `verify-full` where CA material is available); set `disable` explicitly in `docker-compose.yml` for local dev. Defaults should be safe in production and overridden for dev, not the reverse.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/tomswallapi#20
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?