fix(postgres): configurable sslMode

.tpl.env

@@ -2,3 +2,5 @@
 # Used by `just db-bootstrap`.
 OPENWEBUI_PG_PASSWORD_FILE=
 AUTHENTIK_PG_PASSWORD_FILE=
+# Defaults to require. Only for a server without TLS, see docs/postgresql.md.
+# PGSSLMODE=disable

docs/postgresql.md

@@ -1,8 +1,10 @@
 # PostgreSQL
 
-The chart connects to an external PostgreSQL server, which
-must be reachable from the cluster and accept TLS: both OpenWebUI and Authentik connect with
-`sslmode=require`.
+The chart connects to an external PostgreSQL server, which must be reachable from the
+cluster. Both OpenWebUI and Authentik default to `sslmode=require`, so the server should
+accept TLS. Against one that does not, set `openwebui.postgres.sslMode` and
+`authentik.authentik.postgresql.sslmode` to `disable`, which leaves all database traffic
+in cleartext for as long as the deployment runs.
 
 ## Roles and databases
 
@@ -20,14 +22,17 @@ allowed to `CREATE ROLE` and `CREATE DATABASE`; on a managed or central server y
 to ask a DBA to run [bootstrap-db.sql](../tools/scripts/bootstrap-db.sql) instead. Either way
 it is safe to re-run: existing roles and databases are left untouched.
 
-> [!NOTE]
+> [!IMPORTANT]
 >
-> The sql script sends the application passwords in `CREATE ROLE` statements, so connect over TLS.
-> The recipe does this for you. When running manually, use :
+> The sql script sends the application passwords in `CREATE ROLE` statements, so connect
+> over TLS. The recipe defaults to `sslmode=require`. When running manually, use:
 >
 > ```bash
 > psql "postgresql://<admin>@<host>/postgres?sslmode=require" -f tools/scripts/bootstrap-db.sql
 > ```
+>
+> Without TLS, `PGSSLMODE=disable just db-bootstrap <host>` sends those passwords in
+> cleartext; run it from a pod inside the cluster.
 
 ## Values
 

justfile

@@ -88,7 +88,7 @@ db-bootstrap host admin_user="postgres" openwebui_db="vllm-openwebui" authentik_
     AUTHENTIK_PG_DATABASE="{{authentik_db}}" \
     OPENWEBUI_PG_PASSWORD="$(< "$OPENWEBUI_PG_PASSWORD_FILE")" \
     AUTHENTIK_PG_PASSWORD="$(< "$AUTHENTIK_PG_PASSWORD_FILE")" \
-        psql "postgresql://{{admin_user}}@{{host}}/postgres?sslmode=require" \
+        psql "postgresql://{{admin_user}}@{{host}}/postgres?sslmode=${PGSSLMODE:-require}" \
             --file "{{root_dir}}/tools/scripts/bootstrap-db.sql"
 
 # Errors if the repository contains unformatted files.

templates/postgres_secret.yaml

@@ -11,6 +11,8 @@ type: Opaque
   {{- $pg := .Values.openwebui.postgres }}
   {{- /* One value fills both db and role. */}}
   {{- $db := $pg.database | required ".Values.openwebui.postgres.database is required" }}
+  {{- $host := $pg.host | required ".Values.openwebui.postgres.host is required" }}
+  {{- $password := $pg.password | required ".Values.openwebui.postgres.password is required" }}
 stringData:
-  OPENWEBUI_DATABASE_URL: "postgresql://{{ $db }}:{{ $pg.password | required ".Values.openwebui.postgres.password is required" }}@{{ $pg.host | required ".Values.openwebui.postgres.host is required" }}:5432/{{ $db }}?sslmode=require"
+  OPENWEBUI_DATABASE_URL: "postgresql://{{ $db }}:{{ $password }}@{{ $host }}:5432/{{ $db }}?sslmode={{ $pg.sslMode }}"
 {{- end }}

values.yaml

@@ -56,6 +56,8 @@ openwebui:
     host:
     # Database name, and the name of the role that owns it.
     database: vllm-openwebui
+    # "disable" puts every query on the wire in cleartext.
+    sslMode: require
     password:
   admin:
     user: admin