Add TLS/mTLS settings for postgreSQL and Redis

src/pretix/settings.py

@@ -3,7 +3,7 @@
 import os
 import sys
 from urllib.parse import urlparse
-
+from .tls_settings import *
 import django.conf.locale
 from django.utils.crypto import get_random_string
 from kombu import Queue
@@ -83,6 +83,11 @@
     db_options['charset'] = 'utf8mb4'
 JSON_FIELD_AVAILABLE = db_backend in ('mysql', 'postgresql')
 
+db_tls_config = build_db_tls_config(config, db_backend)
+if(db_tls_config is not None):
+    db_options.update(db_tls_config)
+
+
 DATABASES = {
     'default': {
         'ENGINE': 'django.db.backends.' + db_backend,
@@ -209,22 +214,28 @@
 
 HAS_REDIS = config.has_option('redis', 'location')
 if HAS_REDIS:
-    CACHES['redis'] = {
-        "BACKEND": "django_redis.cache.RedisCache",
-        "LOCATION": config.get('redis', 'location'),
-        "OPTIONS": {
+    OPTIONS = {
             "CLIENT_CLASS": "django_redis.client.DefaultClient",
             "REDIS_CLIENT_KWARGS": {"health_check_interval": 30}
         }
+    redis_tls_config = build_redis_tls_config(config)
+    if(redis_tls_config is not None):
+        OPTIONS["CONNECTION_POOL_KWARGS"] = redis_tls_config
+        OPTIONS["REDIS_CLIENT_KWARGS"].update(redis_tls_config)
+
+    if config.has_option('redis', 'password'):
+        OPTIONS["PASSWORD"] = config.get('redis', 'password')
+
+    CACHES['redis'] = {
+        "BACKEND": "django_redis.cache.RedisCache",
+        "LOCATION": config.get('redis', 'location'),
+        "OPTIONS": OPTIONS
     }
     CACHES['redis_sessions'] = {
         "BACKEND": "django_redis.cache.RedisCache",
         "LOCATION": config.get('redis', 'location'),
         "TIMEOUT": 3600 * 24 * 30,
-        "OPTIONS": {
-            "CLIENT_CLASS": "django_redis.client.DefaultClient",
-            "REDIS_CLIENT_KWARGS": {"health_check_interval": 30}
-        }
+        "OPTIONS": OPTIONS
     }
     if not HAS_MEMCACHED:
         CACHES['default'] = CACHES['redis']

src/pretix/tls_settings.py

@@ -0,0 +1,34 @@
+
+def build_db_tls_config(config, db_backend):
+    db_ssl_mode = config.get('database', 'sslmode', fallback='disable')
+    #add postgresql TLS options
+    if db_ssl_mode != 'disable' and db_backend == 'postgresql':
+        db_tls_config = {
+            'sslmode': db_ssl_mode,
+            'sslrootcert': config.get('database', 'sslrootcert'),
+        }
+        #add postgresql mTLS options
+        if config.has_option('database', 'sslcert'):
+            db_tls_config.update({
+                'sslcert': config.get('database', 'sslcert'),
+                'sslkey': config.get('database', 'sslkey'),
+            })
+        return db_tls_config
+    return None
+
+def build_redis_tls_config(config):
+    redis_ssl_cert_reqs = config.get('redis', 'ssl_cert_reqs', fallback='none')
+    #add redis tls options
+    if redis_ssl_cert_reqs != 'none':
+        redis_tls_config = {
+            'ssl_cert_reqs': redis_ssl_cert_reqs,
+            'ssl_ca_certs': config.get('redis', 'ssl_ca_certs'),
+        }
+        #add redis mTLS options
+        if config.has_option('redis', 'ssl_certfile'):
+            redis_tls_config.update({
+                'ssl_keyfile': config.get('redis', 'ssl_keyfile'),
+                'ssl_certfile': config.get('redis', 'ssl_certfile'),
+            })
+        return redis_tls_config
+    return None