Use TlsMode::Prefer instead of TlsMode:None in notification_listener

[joe-bowman]

In notification_listener, we create a postgresql connection with the param TlsMode::None. There is no reason to not use TlsMode::Prefer here and not force operators to run postgresql with Host over SslHost in pg_hba.conf.

graph-node/store/postgres/src/notification_listener.rs

Line 121 in 39287ae

let conn = Connection::connect(postgres_url, TlsMode::None)

Elsewhere, Diesel is used and this respects the postgres_url passed on the command line.

[joe-bowman]

Sadly, this is not as easy as it seems.

The postgres v0.15.2 library support for TLS requires an old version of openssl - and upgrading runs into various issues (notably mutable borrowing of the Postgresql Client object for both Client.notifications() and a new JsonNotification object).

It'd be great to get this looked into, because disabling TLS for this feels the wrong thing to do..

[leoyvens]

@joe-bowman are you still interested in this? We've since updated the postgres crate, if you want to try this again.

[qiaozhengyuan]

Would hope this change gets deployed as when I tried to run the docker image with my own postgresql service, it failed because my postgresql enforces tls.

[wup-one]

Any update here? Does the graph-node support postgres over SSL?

[JasoonS]

Does the graph-node support postgres over SSL?

AFAIK not unfortunately. It is a big pity since most self maintained graphs would use a postgres instance that requires SSL.

[mb-shorai]

The postgres v0.15.2 library support for TLS requires an old version of openssl - and upgrading runs into various issues (notably mutable borrowing of the Postgresql Client object for both Client.notifications() and a new JsonNotification object).

@joe-bowman how can one reproduce the issue? As I'm experimenting with enabling TLS and I would like to check if the issue with mutable borrowing still exists.

[mb-shorai]

I guess it can be closed now that #3503 is merged, although there is some room for improvements (e.g. don't turn the certificate validation off, but make it configurable).