Dokploy / Dokploy/dokploy

[Dokploy DB] Add SSL Support

Open
#3,620 0 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
37.4k
Forks
3k
Avg merge
1d 3h
Merged PRs (30d)
73

Description

What problem will this feature address?

Currently you are able to set the environment variables of dokploy to connect to pretty much to any running PostgreSQL DB (But the docs lack this knowledge) it relies in internal communication with no SSL that in most cases is secure with proper boundaries.

The problem arise when you want to use a secure external DB even inside a Cloud provider the connection will require SSL, in my case I have my own DB with TLS end-to-end, currently the envars are not meant to handle an SSL connection so you need to hack it trough using POSTGRES_DB to inject <db_name>?ssl_mode=require thats a good workaround (if documented) but is not handling the whole security spectrum that postgres provides.

References:

https://github.com/Dokploy/dokploy/blob/aa2e0e81c6c611bf4e567e0dd3d30892bb992354/packages/server/src/db/constants.ts#L27

Describe the solution you'd like

Properly handle the envars:

PGSSLMODE=verify-full
PGSSLROOTCERT=/run/secrets/postgres_ca

Describe alternatives you've considered

document the workaround of the query string injection that is already available and the configurable envars

Additional context

No response

Will you send a PR to implement it?

No

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with packages/server/src/db/constants.ts at the referenced connection settings and trace how PostgreSQL environment variables are consumed. Confirm how PGSSLMODE and PGSSLROOTCERT should be handled, then verify that secure external PostgreSQL connections work and that the existing query-string workaround remains documented if it is retained.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql, typescript
Domain
databases
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.