42 lines
1.6 KiB
Swift
42 lines
1.6 KiB
Swift
import NIOSSL
|
|
import PostgresNIO
|
|
|
|
/// The TLS posture used when connecting to the database.
|
|
///
|
|
/// The executable derives a posture from its `database.tls` configuration and passes it along as part of ``Configuration``; the PostgreSQL driver
|
|
/// receives the resulting connection TLS mode through ``postgresTLS()``.
|
|
public enum TLS: Sendable {
|
|
|
|
/// Connect without TLS, in plaintext.
|
|
case off
|
|
|
|
/// Connect over TLS when the server offers it, falling back to plaintext otherwise.
|
|
case prefer
|
|
|
|
/// Connect only over TLS, refusing the connection when the server offers none.
|
|
case require
|
|
|
|
}
|
|
|
|
// MARK: - Methods
|
|
|
|
extension TLS {
|
|
|
|
/// The connection TLS mode passed to the PostgreSQL driver for this posture.
|
|
///
|
|
/// Returns `.disable` for ``off`` (connect in plaintext) and the default client configuration for ``prefer`` and ``require``. The driver enforces
|
|
/// both semantics natively: `prefer` upgrades to TLS only when the server advertises support and continues in plaintext otherwise, while `require`
|
|
/// refuses the connection when the server offers no TLS.
|
|
///
|
|
/// - Throws: an error when the TLS context cannot be built from the default client configuration.
|
|
/// - Returns: the connection TLS mode for this posture.
|
|
func postgresTLS() throws -> PostgresConnection.Configuration.TLS {
|
|
switch self {
|
|
case .off: .disable
|
|
case .prefer: .prefer(try NIOSSLContext(configuration: .makeClientConfiguration()))
|
|
case .require: .require(try NIOSSLContext(configuration: .makeClientConfiguration()))
|
|
}
|
|
}
|
|
|
|
}
|