Add SSL support to Databases

[sharukhkhanajm]

Description

I have created a Postgres db in Coolify now I am trying to deploy my application in production mode so I am getting this error in production mode.

I am using go lang with sslmode=require

panic: failed to connect to `host=24.199.98.149 user=postgres database=postgres`: tls error (server refused TLS connection)

Minimal Reproduction (if possible, example repository)

N/A

Exception or Error

No response

Version

v4.0.0-beta.239

[aritraroy]

I am also seeing the same issue with a MongoDB database deployed using Coolify. Any help on this will be really appreciated.

[aiherrera]

I'm on v4.0.0-beta.306 still don't have SSL activated

[vikyw89]

following

[jonathanbell]

Looks like TLS is not turned on by default. Anyone has instructions on how to do this?

[ro-bit-admin]

Any update on this?

[rouuuge]

You can use that

[wottpal]

Do i need to create server.crt & server.key myself? Would be great to have SSL-mode as a flag in Coolify/Postgres itself, @andrasbacsai :)

[FrSenpai]

following this, need a feature to auto generate ssl certificates :(

[aritraroy]

Given that some many people are looking for this feature, it would be great if you can prioritize this @andrasbacsai

[maietta]

This is an open source project. To prioritize features, one should consider putting a financial reward on that feature request.

The higher the dollar amount, the better chances of this feature getting added sooner.

[rouuuge]

Do i need to create server.crt & server.key myself? Would be great to have SSL-mode as a flag in Coolify/Postgres itself, @andrasbacsai :)

guys i guess it's already working. at least for me. only create the server.crt and key by yourself and mount the directory like:

[nebiyuelias1]

Yes, I created one myself and I added the directory to be mounted. But I was getting the above error.

[rouuuge]

it might be a permission issue, i created a script for generating the keys:

#!/bin/bash

# Set the directory for the new certificates
CERT_DIR="/data/coolify/postgresql/certs"

# Ensure the directory exists
mkdir -p $CERT_DIR
cd $CERT_DIR

# Generate a new private key
openssl genrsa -out server.key 2048

# Create a configuration file
cat > server.cnf <<EOF
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
CN = <your_domain>
[v3_req]
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = <your_domain>
EOF

# Generate CSR and self-signed certificate
openssl req -new -key server.key -out server.csr -config server.cnf
openssl x509 -req -in server.csr -signkey server.key -out server.crt -days 365 -
extfile server.cnf -extensions v3_req

# Set appropriate permissions
chmod 600 server.key
chmod 644 server.crt

# Set ownership to 70:70 (postgres user and group)
chown 70:70 server.key server.crt

# Clean up
rm server.cnf server.csr

echo "New SSL certificate and key have been generated in $CERT_DIR"
echo "server.crt and server.key are ready to use"
echo "Ownership set to 70:70 and permissions set to 600 for key, 644 for cert"

just replace the <your_domain> with your url

[nebiyuelias1]

@rouuuge thanks! It worked for me but I had to change the user id and group id. Not 70 in my case.

[GraemeFulton]

thank you this worked for me – I was trying to get ssl for postgres in Supabase. Here's how i did that for anyone searching:

After running the script above (with the right user id and group id), it created the certificates on my server, but I realised the certificates have to be copied into the docker container for Supabase to use them.
To get that working, I had to add these lines into the Docker Compose:

In the services->supabase-db->command bit, add these 3:

      - '-c'
      - ssl=on
      - '-c'
      - ssl_cert_file=/etc/postgresql/certs/server.crt
      - '-c'
      - ssl_key_file=/etc/postgresql/certs/server.key
      - '-c'

and in services->supabse-db->volumes:
- '/data/coolify/postgresql/certs:/etc/postgresql/certs:ro'

All together:

services:
  supabase-db:
    image: 'supabase/postgres:15.1.1.78'
    # ... other existing configurations ...
    command:
      - postgres
      - '-c'
      - config_file=/etc/postgresql/postgresql.conf
      - '-c'
      - ssl=on
      - '-c'
      - ssl_cert_file=/etc/postgresql/certs/server.crt
      - '-c'
      - ssl_key_file=/etc/postgresql/certs/server.key
    volumes:
      - 'supabase-db-data:/var/lib/postgresql/data'
      - '/path/on/host/postgresql/certs:/etc/postgresql/certs:ro'
      # ... other existing volume mounts ...

Docker compose is found in this bit:

[krisbitney]

This works until I try to connect to the database.

Connection failed: Error: self-signed certificate
at /Users/kris/WebstormProjects/zenchain-protocol/faucet/node_modules/pg-pool/index.js:45:11
at processTicksAndRejections (node:internal/process/task_queues:95:5)
at async checkConnectionHealth (/Users/kris/WebstormProjects/zenchain-protocol/faucet/scripts/check_pg_health.ts:15:14) {
code: 'DEPTH_ZERO_SELF_SIGNED_CERT'
}

[wottpal]

Nice workaround, thanks! Though, as noted above, Coolify needs a "single-click solution" for this (and might even consider enabling it by default).

[peaklabs-dev]

• Checkbox to require SSL mode sslmode=require
• Also we should add a dropdown where the user can even select the ssl mode like "PREFERRED", "DISABLED", "ALLOW", "VERIFY-CA", "VERIFY-FULL"...
• And the SSL certificate will be generated automatically in the background
• We also need a domain setting for a public URL, to use a custom domain in the URL instead of the IP adress

[mrpajzl]

Is there some plan when this could see the light? If there's something I could help with let me know. But RN I'm impatiantly waiting 😆

[gurgunday]

I agree, this would be an awesome feature

Otherwise the databases are just not usable from the public internet as they are insecure by default

[ghost]

@peaklabs-dev is there any eta for this? its quite a blocker for me

[gurgunday]

@ComposeVisualEditorDev

#3976 (reply in thread)

[ghost]

ohh didnt see that comment, thanks!

[aritraroy]

This checklist is a good start. Wanted to know if SSL mode is being considered only for Postgres or also for MongoDB? I have been facing the same limitation with mongodb as well.

[peaklabs-dev]

It is planned for all DBs

[tb-b]

@peaklabs-dev do you have approx. ETA?

[peaklabs-dev]

No ETA but probably after v4 stable.

[rouuuge]

Just a hint for those who use a postgres service: currently you loose your volume if you map the cert directory:

See my comment here

[zachlatta]

I am happy to add a $500 bounty to this if shipped in a version deployed on app.coolify.io before the end of January. This is a crucial feature for us.

Criteria would be that SSL is enabled by default on all “default” DBs that support it in Coolify (meaning those listed when you create a new project and look at resources to add). Postgres is the most important to us.

[peaklabs-dev]

@zachlatta Thank you. Answered on discord, I know you said email but it is only 1 message and thats it.

[zachlatta]

@peaklabs-dev: Can you give an update?

[zaaakher]

@zachlatta He's cooking #5027, he just pushed a commit 10 minutes ago 🎉

@peaklabs-dev I'm cheering for you from the sidelines 🥳

[peaklabs-dev]

@zachlatta I made a lot of progress, you can see the PR here #5027. And the main DBs are done, just need some more testing and probably some small fixes to make sure everything works properly. The only databases left are the Redis based ones (are in local testing and will be ready tomorrow) and ClickHouse, which I am not sure I want to take on now as it is a bit more complex.

[juicygoose]

@peaklabs-dev amazing work !! thanks a ton

[sandros94]

Could SSL be also added to KV stores like redis, keydb and dragonfly?

[peaklabs-dev]

SSL support is now completed and will be added via this PR #5027 in one of the next updates.

@zachlatta SSL support is now done. It was quite a lot of work and took a lot of time debugging, making sure that it is secure and much more.

[TheMikeyRoss]

legend

[zachlatta]

Fantastic, you are amazing! Thank you! Please email me with your bounty link again and I will pay the remaining 50% of the bounty. From: 🏔️ Peak ***@***.***> Date: Monday, February 10, 2025 at 3:41 PM To: coollabsio/coolify ***@***.***> Cc: Zach Latta ***@***.***>, Mention ***@***.***> Subject: Re: [coollabsio/coolify] Add SSL support to Databases (Discussion #3976) SSL support is now completed and will be added via this PR #5027<#5027> in one of the next updates. @zachlatta<https://github.com/zachlatta> SSL support is now done. It was quite a lot of work and took a lot of time debugging, making sure that it is secure and much more. — Reply to this email directly, view it on GitHub<#3976 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAHSH6GV2T6JNEFJ3RJRKGD2PEFIJAVCNFSM6AAAAABQN2PP2OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMJSHAYDKNA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[peaklabs-dev]

@zachlatta The bounty link is as follows: https://opencollective.com/peaklabs-dev

[zachlatta]

Just paid the 2nd half of the bounty. Thank you so much for building this! From: 🏔️ Peak ***@***.***> Date: Monday, February 10, 2025 at 3:46 PM To: coollabsio/coolify ***@***.***> Cc: Zach Latta ***@***.***>, Mention ***@***.***> Subject: Re: [coollabsio/coolify] Add SSL support to Databases (Discussion #3976) @zachlatta<https://github.com/zachlatta> The bounty link is as follows: https://opencollective.com/peaklabs-dev — Reply to this email directly, view it on GitHub<#3976 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAHSH6AMBQFOOTPUI4ELHBL2PEF33AVCNFSM6AAAAABQN2PP2OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMJSHAZDCNA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[juicygoose]

Thank you so much for sponsoring this !!

[zachlatta]

Any updates on getting the PR merged?

[zachlatta]

Hey, just checking in again. Any updates? The bounty was originally for it to be deployed in February and it’s now March.

[Megajin]

I second this.

[zachlatta]

Hi, I'm following up again. @peaklabs-dev: Can you give an update?

[peaklabs-dev]

I think Andras was looking into merging it last week. I will ask again.

[zachlatta]

Thank you so much! So appreciate you building this. From: 🏔️ Peak ***@***.***> Date: Wednesday, March 12, 2025 at 2:13 PM To: coollabsio/coolify ***@***.***> Cc: Zach Latta ***@***.***>, Mention ***@***.***> Subject: Re: [coollabsio/coolify] Add SSL support to Databases (Discussion #3976) I think Andras was looking into merging it last week. I will ask again. — Reply to this email directly, view it on GitHub<#3976 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAHSH6FA5RDGKXXM6IIHYD32UB2MBAVCNFSM6AAAAABQN2PP2OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENBXHA3DMMY>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[Tmmcmasters]

I am happy to see this being released. I am running into an error still on version 4.0.0-beta.400.

FATAL: could not load private key file "/var/lib/postgresql/certs/server.key": Permission denied
2025-03-27 19:55:19.728 UTC [1] LOG: database system is shut down
2025-03-27 19:55:32.860 UTC [1] FATAL: could not load private key file "/var/lib/postgresql/certs/server.key": Permission denied
2025-03-27 19:55:32.860 UTC [1] LOG: database system is shut down

Steps are:
Make publicly available on the normal port of 5432.
Once it is started, I stop it, and click enable SSL:

I get an empty Proxy Logs which showed the first weird thing. I have to hard refresh CTRL + SHIFT + R to get this page to work because it freezes my client.
After hard refresh, I start the postgres server:
FATAL: could not load private key file "/var/lib/postgresql/certs/server.key": Permission denied
2025-03-27 19:55:19.728 UTC [1] LOG: database system is shut down
2025-03-27 19:55:32.860 UTC [1] FATAL: could not load private key file "/var/lib/postgresql/certs/server.key": Permission denied
2025-03-27 19:55:32.860 UTC [1] LOG: database system is shut down

This is in spite that the persistent storage states that the destination path is

[TheMikeyRoss]

@Tmmcmasters Can you please create an issue for it? so that it can be discussed and hopefully resolved there

[Tmmcmasters]

Created this issue
#5450

[PolpOnline]

@Tmmcmasters you accidentally linked the wrong issue. The text is right, but the underlying link is wrong.

[Tmmcmasters]

Ooop @PolpOnline @TheMikeyRoss I update the link above

[cbratschi]

Using mongosh with the internal or public URL from the MongoDB terminal gives me a connection timeout. If I connect without TSL MongoDB correctly reports that TSL is required.

Are there plans to support Let's Encrypt certificates with domain names?

[yashodhank]

Are others experiencing difficulties with s3 automated backups failing due to mongodb's enabled ssl mode?