43 lines
1.3 KiB
Swift
43 lines
1.3 KiB
Swift
|
import NIOSSL
|
||
|
|
|
||
|
|
/// The TLS posture used when connecting to the database.
|
||
|
|
///
|
||
|
|
/// The executable derives a posture from its `database.tls` configuration and passes it along as
|
||
|
|
/// part of ``Configuration``; the MySQL driver receives the resulting `TLSConfiguration` through
|
||
|
|
/// ``tlsConfiguration``.
|
||
|
|
public enum TLS: Sendable {
|
||
|
|
|
||
|
|
/// Connect without TLS, in plaintext.
|
||
|
|
case off
|
||
|
|
|
||
|
|
/// Connect over TLS when the server offers it, falling back to plaintext otherwise.
|
||
|
|
case prefer
|
||
|
|
|
||
|
|
/// Connect only over TLS, refusing the connection when the server offers none.
|
||
|
|
case require
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
// MARK: - Properties
|
||
|
|
|
||
|
|
extension TLS {
|
||
|
|
|
||
|
|
/// The NIO TLS configuration passed to the MySQL driver for this posture.
|
||
|
|
///
|
||
|
|
/// Returns `nil` for ``off`` (connect in plaintext) and the default client configuration for
|
||
|
|
/// ``prefer`` and ``require``.
|
||
|
|
///
|
||
|
|
/// - Note: `prefer` and `require` currently map to the same client configuration — both enable TLS.
|
||
|
|
/// The distinction (fall back to plaintext vs. fail when the server offers no TLS) is not yet
|
||
|
|
/// enforced here; tighten this mapping if that guarantee becomes required.
|
||
|
|
var tlsConfiguration: TLSConfiguration? {
|
||
|
|
switch self {
|
||
|
|
case .off:
|
||
|
|
return nil
|
||
|
|
case .prefer, .require:
|
||
|
|
return .makeClientConfiguration()
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
}
|