Repository navigation
List the database TLS settings in the Server configuration reference #364
Description
Problem
The website's Server configuration reference lists the database variables but none of the TLS settings. Since server#540, the Server reads DB_SSLMODE, DB_SSLROOTCERT and, for MySQL, MYSQL_ATTR_SSL_CA (config/database.php). The Server's own reference says to set them on every role, including the bootstrap/migration job.
The website doesn't mention any of this. Operators deploying from the website guides, for example on ECS or with Compose, can't find how to require a verified database connection. They also aren't told that PostgreSQL defaults to prefer, or that the migration job needs the same settings as the runtime roles.
Acceptance criteria
- The Database row in the config reference lists
DB_SSLMODE,DB_SSLROOTCERT, their aliases andMYSQL_ATTR_SSL_CA, and links to a database TLS section. - That section gives the supported modes for each engine and the PostgreSQL
preferdefault. It says to set the same values on the API server, queue worker, bootstrap/migration job and scheduler, and that conflicting settings refuse startup. - The deployment guide's encryption row links to that section.
Activity
rmcdaniel commentedon Oct 23, 2026
Accepted as documentation of the existing Server TLS controls. Implementation is now in #365 while the independent P1 Core publication gates run. Both guides and all seven translations are updated with reviewed source hashes; the TLS implementation and Helm Secret/mount contract are checked against Server b4192a347. All 105 guide translation/hash checks and the existing code-block parity checks pass locally. Normal hosted checks and actual deployed localized pages remain required before this issue closes.
rmcdaniel commentedon Oct 23, 2026
Delivered in #365, merged as
82b702f66d52cd050d72c8ec12f092bfa75e3ece/exact qualified tree
ab5e2d136fd796d822c0e3aa9e11a017341f71c9.All nine candidate and all applicable main checks pass; Sonar has zero
OPEN/CONFIRMED issues. Pages deployment
39904630046
passes.
The configuration reference
now includes canonical variables and aliases, engine modes, opportunistic
defaults, conflict refusals, CA mounts and per-role configuration. Helm uses
the actual pre-created Secret/CA-key settings. The
deployment guide
links to the TLS section.
Both guides are updated in all eight offered languages. All 105 guide
translation/hash controls and existing code-block parity checks pass.
Sixteen actual published pages return HTTP 200 after following the canonical
route; readback verifies each localized TLS heading, variables/modes, Helm
Secret and locale-correct deployment link. An initial reader stopped at a
301 redirect and is not counted as a successful readback.
The merged remote head is verified absent. This documents existing Server
behavior; it changes no product runtime, dependency or version.