Support setting ssl client certificate information via environment variables

[soupi]

What

We'd like to support setting ssl certificate information via environment variables.

How

1. We create a new function, get_connect_options, which will read both the uri and the ssl information, and use it and connect_with everywhere instead of connect with just the uri. We make sure all operations using configuration version 5 including the connector and the cli use get_connect_options (except tests).
2. We read the client_cert, client_key and root_cert from the environment and put them directly into the sqlx connection options.

How we tested this

We used this article as a guide on how to set up postgres+certs with docker.

After running all of the commands, we had to do the following as well:

$ certstrap request-cert --common-name postgresdb  --domain localhost
$ cp certs/out/myCA.crt out/
$ cp certs/out/myCA.key out/
$ certstrap sign postgresdb --CA myCA

Then, we added the following environment variables:

$ export CLIENT_CERT="$(cat /tmp/ssl/out/postgresdb.crt)"
$ export CLIENT_KEY="$(cat /tmp/ssl/out/postgresdb.key)"
$ export ROOT_CERT="$(cat /tmp/ssl/certs/out/myCA.crt)"

Initialized and updated the connector:

$ mdkir /tmp/ssltest
$ CONNECTION_URI="postgresql://postgres:postgres@localhost:64009/postgres?sslmode=verify-ca" target/debug/ndc-postgres-cli --context /tmp/ssltest initialize
$ CONNECTION_URI="postgresql://postgres:postgres@localhost:64009/postgres?sslmode=verify-ca" target/debug/ndc-postgres-cli --context /tmp/ssltest update

Added a native query:

$ echo "select 'gil' as "name", 35 as 'age'" > /tmp/ssltest/a.sql

$ CONNECTION_URI="postgresql://postgres:postgres@localhost:64009/postgres?sslmode=verify-ca" target/debug/ndc-postgres-cli --context /tmp/ssltest native-operation create --kind query --operation-path a.sql

Started the connector:

CONNECTION_URI="postgresql://postgres:postgres@localhost:64009/postgres?sslmode=verify-ca" target/debug/ndc-postgres serve --configuration /tmp/ssltest

And ran a query:

curl -X POST \
    -H 'Host: example.hasura.app' \
    -H 'Content-Type: application/json' \
    -H 'x-hasura-role: admin' \
    http://localhost:8080/query \
    -d '{ "collection": "a", "query": { "fields": { "name": { "type": "column", "column": "name" } } }, "arguments": {}, "collection_relationships": {} }' | jq

[SamirTalwar]

Looks great!

I would love to see an automated test at some point.

[SamirTalwar]

Can we log a warning if some, but not all, are None?

[soupi]

Will create a ticket.

[soupi]

https://linear.app/hasura/issue/APIPG-774/when-some-but-not-all-ssl-client-cert-variables-are-set-emit-a-warning

[danieljharvey]

Nice!