Is there a way to provide sslmode that is not in the connection string?

[danielo515]

I am trying to migrate my codebase, which is using postgres.js, to use this package instead. However, I am having difficulties setting the SSL mode. I don't see any reference to that in the pool class.
I see a reference to that being parsed from the connection string, but I was wondering if there is a way to provide it directly without relying on the connection string containing it.

Thanks in advance

[hjr3]

import parseConnectionString from 'pg-connection-string';

const config = parseConnectionString(env.DATABASE_URL);

config.ssl = true; // or any other SSL options you want to set

const pool = new pg.Pool(config);

Reference: https://node-postgres.com/apis/client#new-client

Relates to: #3355 (comment)

[danielo515]

Thanks for the response, but I don't want to use pg-connection-string, thanks, I just want to be able to provide the right options to the pg.Pool without an additional package and preferably in a type safe way. The reference you linked is useful, but it types the ssl as any, so that is of no help. I'm using @types/pg and that doesn't seem to accept.
It mentions passed directly to node.TLSSocket, supports all tls.connect options but that is a bit poor, because it doesn't link to any specific spec, and I will have to find it out and assume that I'm looking at the right documentation from node.

I'm going to assume this is the docs the site mentions: https://nodejs.org/docs/latest-v22.x/api/tls.html#tlsconnectoptions-callback

[hjr3]

import { Pool } from 'pg'
 
const pool = new Pool({
  host: 'localhost',
  user: 'dbuser',
  ssl: true
})

if you want other options, you can look at

node-postgres/packages/pg-connection-string/index.js

Lines 103 to 133 in 8d493f3

	switch (config.sslmode) {
	case 'disable': {
	config.ssl = false
	break
	}
	case 'prefer': {
	config.ssl.rejectUnauthorized = false
	break
	}
	case 'require': {
	if (config.sslrootcert) {
	// If a root CA is specified, behavior of `sslmode=require` will be the same as that of `verify-ca`
	config.ssl.checkServerIdentity = function () {}
	} else {
	config.ssl.rejectUnauthorized = false
	}
	break
	}
	case 'verify-ca': {
	if (!config.ssl.ca) {
	throw new Error(
	'SECURITY WARNING: Using sslmode=verify-ca requires specifying a CA with sslrootcert. If a public CA is used, verify-ca allows connections to a server that somebody else may have registered with the CA, making you vulnerable to Man-in-the-Middle attacks. Either specify a custom CA certificate with sslrootcert parameter or use sslmode=verify-full for proper security.'
	)
	}
	config.ssl.checkServerIdentity = function () {}
	break
	}
	case 'verify-full': {
	break
	}
	}

Example:

const pool = new Pool({
  host: 'localhost',
  user: 'reware',
  ssl: {
    rejectUnauthorized: false,
  }
});

[hjr3]

Also, pg includes pg-connection-string already. If you ever want to try using a connection string, you are not increasing the contents of your node_modules directory.

$ npm ls pg-connection-string
issue-3563@1.0.0
└─┬ pg@8.16.3
  └── pg-connection-string@2.9.1

$ npm i pg-connection-string
$ npm ls pg-connection-string
issue-3563@1.0.0
├── pg-connection-string@2.9.1
└─┬ pg@8.16.3
  └── pg-connection-string@2.9.1 deduped

[dayastant]

import pkg from "pg";
const { Pool } = pkg;

const pool = new Pool({
host: "your-host",
port: 5432,
user: "user",
password: "password",
database: "dbname",
ssl: {
rejectUnauthorized: false, // for self-signed
},
});

[hjr3]

Please re-open if your question has not been answered.