ResiLien
/
terraform
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

provider/postgresql: default ssl_mode is "prefer" 

According to the libpq documentation, "prefer" is the default in the
underlying library and so setting a different default in the Terraform
layer would be a breaking change for existing users of this provider
whose servers do not have TLS correctly configured.

The docs now link to the libpq manual's discussion of the security
implications of each of the ssl_mode options, so the user can understand
the limitations of the "prefer" default and can make an informed decision
about which setting is appropriate for their situation.
This commit is contained in:
Martin Atkins 2016-04-17 08:32:02 -07:00
parent 4954f1351f
commit 220d73f32c
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
builtin/providers/postgresql/provider.go
View File

@ -38,7 +38,7 @@ func Provider() terraform.ResourceProvider {
"ssl_mode": &schema.Schema{ "ssl_mode": &schema.Schema{
Type: schema.TypeString, Type: schema.TypeString,
Optional: true, Optional: true,
Default: "require", Default: "prefer",
Description: "Connection mode for postgresql server", Description: "Connection mode for postgresql server",
}, },
}, },

6
website/source/docs/providers/postgresql/index.html.markdown
View File

@ -59,7 +59,9 @@ resource "postgresql_database" "my_db2" {
The following arguments are supported: The following arguments are supported:
* `host` - (Required) The address for the postgresql server connection. * `host` - (Required) The address for the postgresql server connection.
* `port` - (Optional) The port for the postgresql server connection. (Default 5432) * `port` - (Optional) The port for the postgresql server connection. The default is `5432`.
* `username` - (Required) Username for the server connection. * `username` - (Required) Username for the server connection.
* `password` - (Optional) Password for the server connection. * `password` - (Optional) Password for the server connection.
* `ssl_mode` - (Optional) Set connection mode for postgresql server (Default "require", more options [lib/pq documentations](https://godoc.org/github.com/lib/pq)). * `ssl_mode` - (Optional) Set the priority for an SSL connection to the server.
The default is `prefer`; the full set of options and their implications
can be seen [in the libpq SSL guide](http://www.postgresql.org/docs/9.4/static/libpq-ssl.html#LIBPQ-SSL-PROTECTION).