coder/docs/tutorials/postgres-ssl.md at main

mirror of https://github.com/coder/coder.git synced 2026-10-16 14:48:56 +08:00

Files

T

Nick Vigilante c58ac71ca3 docs(docs/tutorials): reformat to one sentence per line (#30703 )

Reformats the tutorials under `docs/tutorials` to one sentence per line,
as the [docs style
guide](https://github.com/coder/coder/blob/main/docs/.style/style-guide/formatting.md#one-sentence-per-line)
requires. Hard-wrapped paragraphs are unwrapped and lines holding
several sentences are split, so a later edit to one sentence shows up as
a one-line diff.

Apart from the exception below, only whitespace inside paragraphs and
list items changes, and the rendered pages are the same. Comparing the
changed files against `main` word for word, ignoring whitespace and
blockquote `>` markers, finds differences only on the reworded lines.
`git diff --word-diff` is easier to read than the line diff.

9 lines that already contained an em or en dash were reworded by hand,
because `lint/emdash` treats every reflowed line as newly added. Each
uses a parenthetical, a separate sentence, or a colon after a lead-in.
Dashes on lines the reflow did not touch are left alone. The two reverse
proxy tutorials also write `*.coder.example.com` in backticks instead of
escaping the asterisk, which the formatter would otherwise drop.

Applied with an in-progress formatter, limited to pages listed in
`docs/manifest.json` and excluding generated reference docs. This is one
of a batch of PRs that split the docs by area (19 files changed, 656
insertions(+), 1265 deletions(-)).

---
🤖 Built with AI assistance.

2026-10-15 11:24:40 -04:00

2.1 KiB

Raw Permalink Blame History

title

title
Configure Coder to connect to PostgreSQL using SSL

Eric Paulsen

February 24, 2024

Your organization may require connecting to the database instance over SSL. To supply Coder with the appropriate certificates, and have it connect over SSL, follow the steps below:

Client verification (server verifies the client)

Create the certificate as a secret in your Kubernetes cluster, if not already present:

kubectl create secret tls postgres-certs -n coder --key="postgres.key" --cert="postgres.crt"

Define the secret volume and volumeMounts in the Helm chart:

coder:
  volumes:
    - name: "pg-certs-mount"
      secret:
        secretName: "postgres-certs"
  volumeMounts:
    - name: "pg-certs-mount"
      mountPath: "$HOME/.postgresql"
      readOnly: true

Lastly, your PG connection URL will look like:

postgres://<user>:<password>@databasehost:<port>/<db-name>?sslmode=require&sslcert="$HOME/.postgresql/postgres.crt&sslkey=$HOME/.postgresql/postgres.key"

Server verification (client verifies the server)

Download the CA certificate chain for your database instance, and create it as a secret in your Kubernetes cluster, if not already present:

kubectl create secret tls postgres-certs -n coder --key="postgres-root.key" --cert="postgres-root.crt"

Define the secret volume and volumeMounts in the Helm chart:

coder:
  volumes:
    - name: "pg-certs-mount"
      secret:
        secretName: "postgres-certs"
  volumeMounts:
    - name: "pg-certs-mount"
      mountPath: "$HOME/.postgresql/postgres-root.crt"
      readOnly: true

Lastly, your PG connection URL will look like:

postgres://<user>:<password>@databasehost:<port>/<db-name>?sslmode=verify-full&sslrootcert="/home/coder/.postgresql/postgres-root.crt"

More information on connecting to PostgreSQL databases using certificates can be found in the PostgreSQL documentation.

2.1 KiB Raw Permalink Blame History

Client verification (server verifies the client)

Server verification (client verifies the server)

2.1 KiB

Raw Permalink Blame History