Skip to content

enhance: add ssl opts for db connections #748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 19, 2025
Merged

enhance: add ssl opts for db connections #748

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 42 additions & 1 deletion crowdsec-docs/docs/configuration/crowdsec_configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,9 @@ db_config:
host: "<db_host_ip>" # for mysql/pgsql
port: "<db_host_port>" # for mysql/pgsql
sslmode: "<require/disable>" # for pgsql
ssl_ca_cert: "<path_to_ca_cert_file>" # for mysql/pgsql
ssl_client_cert: "<path_to_client_cert_file>" # for mysql/pgsql
ssl_client_key: "<path_to_client_key_file>" # for mysql/pgsql
use_wal: "true|false" # for sqlite
max_open_conns: "<max_number_of_conns_to_db>"
flush:
Expand Down Expand Up @@ -459,6 +462,9 @@ db_config:
host: "<db_host_ip>" # for mysql/postgresql/pgx # must be omitted if using socket file
port: "<db_host_port>" # for mysql/postgresql/pgx # must be omitted if using socket file
sslmode: "<require/disable>" # for postgresql/pgx
ssl_ca_cert: "<path_to_ca_cert_file>" # for mysql/pgsql
ssl_client_cert: "<path_to_client_cert_file>" # for mysql/pgsql
ssl_client_key: "<path_to_client_key_file>" # for mysql/pgsql
max_open_conns: "<max_number_of_conns_to_db>"
decision_bulk_size: "<decision_bulk_size>"
flush:
Expand Down Expand Up @@ -556,13 +562,48 @@ db_config:
The port to connect to (only if the type of database is `mysql` or `postgresql`). Must be omitted if using socket file.


#### `sslmode`

```yaml
db_config:
type: postgresql

sslmode: require
```
Require or disable ssl connection to database (only if the type of database is `postgresql`). See [PostgreSQL SSL modes](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS) for possible values.
Require or disable ssl connection to database (only if the type of database is `mysql` or `postgresql` or `pgx`).

See [PostgreSQL SSL modes](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS) for possible values.
See [MySQL SSL modes](https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html) for possible values within the `Client-Side` configuration.

#### `ssl_ca_cert`

```yaml
db_config:
type: mysql|postgresql|pgx

ssl_ca_cert: /path/to/ca.crt
```
Path to the CA certificate file (only if the type of database is `mysql` or `postgresql` or `pgx`)

#### `ssl_client_cert`

```yaml
db_config:
type: mysql|postgresql|pgx

ssl_client_cert: /path/to/client.crt
```
Path to the client certificate file when using mTLS (only if the type of database is `mysql` or `postgresql` or `pgx`)

#### `ssl_client_key`

```yaml
db_config:
type: mysql|postgresql|pgx

ssl_client_key: /path/to/client.key
```
Path to the client key file when using mTLS (only if the type of database is `mysql` or `postgresql` or `pgx`)

#### `max_open_conns`

Expand Down