fix: accept SSL configuration for Realtime's main db (#1473)

edgurgel · web-flow · commit 88d028465771 · 2025-07-24T09:08:48.000+12:00
* DB_SSL can be true or false
* DB_SSL_CA_CERT if defined it enables server certificate verification
diff --git a/README.md b/README.md
@@ -131,6 +131,8 @@ If you're using the default tenant, the URL is `ws://realtime-dev.localhost:4000
 | DB_ENC_KEY                                      | string  | Key used to encrypt sensitive fields in \_realtime.tenants and \_realtime.extensions tables. Recommended: 16 characters.                                                                                                                                                                                                        |
 | DB_AFTER_CONNECT_QUERY                          | string  | Query that is run after server connects to database.                                                                                                                                                                                                                                                                            |
 | DB_IP_VERSION                                   | string  | Sets the IP Version to be used. Allowed values are "ipv6" and "ipv4". If none are set we will try to infer the correct version                                                                                                                                                                                                  |
+| DB_SSL                                          | boolean | Whether or not the connection will be set-up using SSL                                                                                                                                                                                                                                                                          |
+| DB_SSL_CA_CERT                                  | string  | Filepath to a CA trust store (e.g.: /etc/cacert.pem). If defined it enables server certificate verification                                                                                                                                                                                                                     |
 | API_JWT_SECRET                                  | string  | Secret that is used to sign tokens used to manage tenants and their extensions via HTTP requests.                                                                                                                                                                                                                               |
 | SECRET_KEY_BASE                                 | string  | Secret used by the server to sign cookies. Recommended: 64 characters.                                                                                                                                                                                                                                                          |
 | ERL_AFLAGS                                      | string  | Set to either "-proto_dist inet_tcp" or "-proto_dist inet6_tcp" depending on whether or not your network uses IPv4 or IPv6, respectively.                                                                                                                                                                                       |
diff --git a/config/runtime.exs b/config/runtime.exs
@@ -12,6 +12,17 @@ port = System.get_env("DB_PORT", "5432")
 db_version = System.get_env("DB_IP_VERSION")
 slot_name_suffix = System.get_env("SLOT_NAME_SUFFIX")
 
+ssl_opts =
+  if System.get_env("DB_SSL", "false") == "true" do
+    if cert = System.get_env("DB_SSL_CA_CERT") do
+      [cacertfile: cert]
+    else
+      [verify: :verify_none]
+    end
+  else
+    false
+  end
+
 tenant_cache_expiration =
   System.get_env("TENANT_CACHE_EXPIRATION_IN_MS", "30000") |> String.to_integer()
 
@@ -204,7 +215,8 @@ if config_env() != :test do
       application_name: "supabase_mt_realtime"
     ],
     after_connect: after_connect_query_args,
-    socket_options: socket_options
+    socket_options: socket_options,
+    ssl: ssl_opts
 
   replica_repos = %{
     Realtime.Repo.Replica.FRA => System.get_env("DB_HOST_REPLICA_FRA", default_db_host),
@@ -232,7 +244,9 @@ if config_env() != :test do
       queue_interval: queue_interval,
       parameters: [
         application_name: "supabase_mt_realtime_ro"
-      ]
+      ],
+      socket_options: socket_options,
+      ssl: ssl_opts
   end
 end
 
@@ -279,6 +293,7 @@ cluster_topologies =
                 application_name: "cluster_node_#{node()}"
               ],
               socket_options: socket_options,
+              ssl: ssl_opts,
               heartbeat_interval: 5_000,
               node_timeout: 15_000,
               channel_name: System.get_env("POSTGRES_CLUSTER_CHANNEL_NAME", "realtime_cluster_#{version}")
diff --git a/lib/realtime/cluster_strategy/postgres.ex b/lib/realtime/cluster_strategy/postgres.ex
@@ -30,6 +30,7 @@ defmodule Realtime.Cluster.Strategy.Postgres do
       port: Keyword.fetch!(state.config, :port),
       parameters: Keyword.fetch!(state.config, :parameters),
       socket_options: Keyword.fetch!(state.config, :socket_options),
+      ssl: Keyword.fetch!(state.config, :ssl),
       channel_name: Keyword.fetch!(state.config, :channel_name)
     ]
 
diff --git a/mix.exs b/mix.exs
@@ -4,7 +4,7 @@ defmodule Realtime.MixProject do
   def project do
     [
       app: :realtime,
-      version: "2.41.6",
+      version: "2.41.7",
       elixir: "~> 1.17.3",
       elixirc_paths: elixirc_paths(Mix.env()),
       start_permanent: Mix.env() == :prod,
diff --git a/test/realtime/cluster_strategy/postgres_test.exs b/test/realtime/cluster_strategy/postgres_test.exs
@@ -50,6 +50,7 @@ defmodule Realtime.Cluster.Strategy.PostgresTest do
         application_name: "#{node()}"
       ],
       socket_options: [:inet],
+      ssl: false,
       heartbeat_interval: 5_000,
       node_timeout: 15_000,
       channel_name: "test_channel_name"

Original file line number	Diff line number	Diff line change
`@@ -30,6 +30,7 @@ defmodule Realtime.Cluster.Strategy.Postgres do`
`30`	`30`	`port: Keyword.fetch!(state.config, :port),`
`31`	`31`	`parameters: Keyword.fetch!(state.config, :parameters),`
`32`	`32`	`socket_options: Keyword.fetch!(state.config, :socket_options),`
	`33`	`+ ssl: Keyword.fetch!(state.config, :ssl),`
`33`	`34`	`channel_name: Keyword.fetch!(state.config, :channel_name)`
`34`	`35`	`]`
`35`	`36`
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@ defmodule Realtime.MixProject do`
`4`	`4`	`def project do`
`5`	`5`	`[`
`6`	`6`	`app: :realtime,`
`7`		`- version: "2.41.6",`
	`7`	`+ version: "2.41.7",`
`8`	`8`	`elixir: "~> 1.17.3",`
`9`	`9`	`elixirc_paths: elixirc_paths(Mix.env()),`
`10`	`10`	`start_permanent: Mix.env() == :prod,`