postgres

#Postgres.mbt

#Packages

• moonbit-community/postgres/client: low-level PostgreSQL client
• moonbit-community/postgres/pgpool: single-event-loop connection pool built on top of client

• client doc
• pgpool doc

#TLS

• disable: plaintext only
• verify-ca: TLS with certificate-chain validation but without hostname/IP validation
• verify-full: TLS with certificate-chain validation and hostname/IP validation

• sslmode
• sslrootcert

• prefer -> verify-full for authenticated TLS, or disable for intentional plaintext
• require -> verify-full in most deployments, or verify-ca when hostname validation is intentionally out of scope
• verify-full now requires an explicit host or hostaddr

///|
fn _upgrade_examples() -> @pgpool.Config {
  @pgpool.Config::new(
    "db.example",
    hostaddr="10.0.0.15",
    user="moon",
    dbname="app",
    password="secret",
    ssl_mode=@client.SslMode::VerifyFull,
    ssl_root_cert="/etc/postgres/root.crt",
    application_name="my-service",
    pool=@pgpool.PoolConfig::new(4),
  )
}

• Aembit, "The Strange World of Postgres TLS": https://aembit.io/blog/the-strange-world-of-postgres-tls
• PostgreSQL sslmode: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLMODE
• PostgreSQL certificate verification semantics: https://www.postgresql.org/docs/current/libpq-ssl.html#LIBQ-SSL-CERTIFICATES
• PostgreSQL TLS protection matrix: https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-PROTECTION
• PostgreSQL sslrootcert: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLROOTCERT
• PostgreSQL unsupported parameters called out in this project: sslcert, sslkey, sslpassword, sslcrl, sslcrldir, sslsni, ssl_min_protocol_version, ssl_max_protocol_version, sslnegotiation, sslcertmode, sslkeylogfile, sslcompression

#Testing

• Run PostgreSQL integration tests: node scripts/pg_integration_test.mjs
• Run PostgreSQL integration coverage tests: node scripts/pg_integration_test.mjs --enable-coverage