Add TLS/mTLS settings for postgreSQL and Redis

src/pretix/settings.py

@@ -3,7 +3,7 @@
 import os
 import sys
 from urllib.parse import urlparse
-
+from .settings_helpers import *
 import django.conf.locale
 from django.utils.crypto import get_random_string
 from kombu import Queue
@@ -83,6 +83,11 @@
     db_options['charset'] = 'utf8mb4'
 JSON_FIELD_AVAILABLE = db_backend in ('mysql', 'postgresql')
 
+db_tls_config = build_db_tls_config(config, db_backend)
+if(db_tls_config is not None):
+    db_options.update(db_tls_config)
+
+
 DATABASES = {
     'default': {
         'ENGINE': 'django.db.backends.' + db_backend,
@@ -209,22 +214,28 @@
 
 HAS_REDIS = config.has_option('redis', 'location')
 if HAS_REDIS:
-    CACHES['redis'] = {
-        "BACKEND": "django_redis.cache.RedisCache",
-        "LOCATION": config.get('redis', 'location'),
-        "OPTIONS": {
+    OPTIONS = {
             "CLIENT_CLASS": "django_redis.client.DefaultClient",
             "REDIS_CLIENT_KWARGS": {"health_check_interval": 30}
         }
+    redis_tls_config = build_redis_tls_config(config)
+    if(redis_tls_config is not None):
+        OPTIONS["CONNECTION_POOL_KWARGS"] = redis_tls_config
+        OPTIONS["REDIS_CLIENT_KWARGS"].update(redis_tls_config)
+
+    if config.has_option('redis', 'password'):
+        OPTIONS["PASSWORD"] = config.get('redis', 'password')
+
+    CACHES['redis'] = {
+        "BACKEND": "django_redis.cache.RedisCache",
+        "LOCATION": config.get('redis', 'location'),
+        "OPTIONS": OPTIONS
     }
     CACHES['redis_sessions'] = {
         "BACKEND": "django_redis.cache.RedisCache",
         "LOCATION": config.get('redis', 'location'),
         "TIMEOUT": 3600 * 24 * 30,
-        "OPTIONS": {
-            "CLIENT_CLASS": "django_redis.client.DefaultClient",
-            "REDIS_CLIENT_KWARGS": {"health_check_interval": 30}
-        }
+        "OPTIONS": OPTIONS
     }
     if not HAS_MEMCACHED:
         CACHES['default'] = CACHES['redis']

src/pretix/settings_helpers.py

@@ -0,0 +1,38 @@
+def build_db_tls_config(config, db_backend):
+    db_ssl_mode = config.get("database", "sslmode", fallback="disable")
+    # add postgresql TLS options
+    if db_ssl_mode != "disable" and db_backend == "postgresql":
+        db_tls_config = {
+            "sslmode": db_ssl_mode,
+            "sslrootcert": config.get("database", "sslrootcert"),
+        }
+        # add postgresql mTLS options
+        if config.has_option("database", "sslcert"):
+            db_tls_config.update(
+                {
+                    "sslcert": config.get("database", "sslcert"),
+                    "sslkey": config.get("database", "sslkey"),
+                }
+            )
+        return db_tls_config
+    return None
+
+
+def build_redis_tls_config(config):
+    redis_ssl_cert_reqs = config.get("redis", "ssl_cert_reqs", fallback="none")
+    # add redis tls options
+    if redis_ssl_cert_reqs != "none":
+        redis_tls_config = {
+            "ssl_cert_reqs": redis_ssl_cert_reqs,
+            "ssl_ca_certs": config.get("redis", "ssl_ca_certs"),
+        }
+        # add redis mTLS options
+        if config.has_option("redis", "ssl_certfile"):
+            redis_tls_config.update(
+                {
+                    "ssl_keyfile": config.get("redis", "ssl_keyfile"),
+                    "ssl_certfile": config.get("redis", "ssl_certfile"),
+                }
+            )
+        return redis_tls_config
+    return None