Allow For Configuration of SSL Mode With the Postgres Backend

backend/postgres/options.go

@@ -13,6 +13,10 @@ type options struct {
 
 	// ApplyMigrations automatically applies database migrations on startup.
 	ApplyMigrations bool
+
+	// SSLMode configures the sslmode parameter for the PostgreSQL connection.
+	// Defaults to "disable" if not set.
+	SSLMode string
 }
 
 type option func(*options)
@@ -30,6 +34,15 @@ func WithPostgresOptions(f func(db *sql.DB)) option {
 	}
 }
 
+// WithSSLMode configures the sslmode parameter for the PostgreSQL connection string.
+// Valid values include "disable", "require", "verify-ca", "verify-full", etc.
+// Defaults to "disable" if not set.
+func WithSSLMode(sslmode string) option {
+	return func(o *options) {
+		o.SSLMode = sslmode
+	}
+}
+
 // WithBackendOptions allows to pass generic backend options.
 func WithBackendOptions(opts ...backend.BackendOption) option {
 	return func(o *options) {

backend/postgres/postgres.go

@@ -39,7 +39,11 @@ func NewPostgresBackend(host string, port int, user, password, database string,
 		opt(options)
 	}
 
-	dsn := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=disable", host, port, user, password, database)
+	if options.SSLMode == "" {
+		options.SSLMode = "disable"
+	}
+
+	dsn := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=%s", host, port, user, password, database, options.SSLMode)
 
 	db, err := sql.Open("pgx", dsn)
 	if err != nil {

backend/postgres/postgres_test.go

@@ -211,6 +211,60 @@ func Test_PostgresBackend_WorkerName(t *testing.T) {
 	})
 }
 
+func Test_PostgresBackend_SSLMode(t *testing.T) {
+	t.Run("DefaultSSLMode", func(t *testing.T) {
+		// sql.Open doesn't actually connect, so this works without a real database
+		b := NewPostgresBackend("localhost", 5432, "user", "pass", "db", WithApplyMigrations(false))
+		defer b.Close()
+
+		expected := "host=localhost port=5432 user=user password=pass dbname=db sslmode=disable"
+		if b.dsn != expected {
+			t.Errorf("Expected DSN %q, got %q", expected, b.dsn)
+		}
+	})
+
+	t.Run("CustomSSLMode", func(t *testing.T) {
+		b := NewPostgresBackend("localhost", 5432, "user", "pass", "db", WithApplyMigrations(false), WithSSLMode("require"))
+		defer b.Close()
+
+		expected := "host=localhost port=5432 user=user password=pass dbname=db sslmode=require"
+		if b.dsn != expected {
+			t.Errorf("Expected DSN %q, got %q", expected, b.dsn)
+		}
+	})
+
+	t.Run("VerifyFullSSLMode", func(t *testing.T) {
+		b := NewPostgresBackend("localhost", 5432, "user", "pass", "db", WithApplyMigrations(false), WithSSLMode("verify-full"))
+		defer b.Close()
+
+		expected := "host=localhost port=5432 user=user password=pass dbname=db sslmode=verify-full"
+		if b.dsn != expected {
+			t.Errorf("Expected DSN %q, got %q", expected, b.dsn)
+		}
+	})
+
+	t.Run("EmptySSLModeDefaultsToDisable", func(t *testing.T) {
+		b := NewPostgresBackend("localhost", 5432, "user", "pass", "db", WithApplyMigrations(false), WithSSLMode(""))
+		defer b.Close()
+
+		expected := "host=localhost port=5432 user=user password=pass dbname=db sslmode=disable"
+		if b.dsn != expected {
+			t.Errorf("Expected DSN %q, got %q", expected, b.dsn)
+		}
+	})
+
+	t.Run("WithSSLModeOption", func(t *testing.T) {
+		opts := &options{
+			Options: backend.ApplyOptions(),
+		}
+		WithSSLMode("verify-ca")(opts)
+
+		if opts.SSLMode != "verify-ca" {
+			t.Errorf("Expected SSLMode 'verify-ca', got %q", opts.SSLMode)
+		}
+	})
+}
+
 func Test_PostgresBackendWithDB(t *testing.T) {
 	if testing.Short() {
 		t.Skip()