|
| 1 | +# pgsql_servers_ssl_params |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +The `pgsql_servers_ssl_params` table allows per-server SSL configuration for PostgreSQL backend connections. This enables different SSL certificates, keys, and TLS version restrictions for each backend server, overriding the global `pgsql-ssl_p2s_*` variables. |
| 6 | + |
| 7 | +This is the PostgreSQL equivalent of MySQL's `mysql_servers_ssl_params` table. |
| 8 | + |
| 9 | +## Table Schema |
| 10 | + |
| 11 | +```sql |
| 12 | +CREATE TABLE pgsql_servers_ssl_params ( |
| 13 | + hostname VARCHAR NOT NULL, |
| 14 | + port INT CHECK (port >= 0 AND port <= 65535) NOT NULL DEFAULT 5432, |
| 15 | + username VARCHAR NOT NULL DEFAULT '', |
| 16 | + ssl_ca VARCHAR NOT NULL DEFAULT '', |
| 17 | + ssl_cert VARCHAR NOT NULL DEFAULT '', |
| 18 | + ssl_key VARCHAR NOT NULL DEFAULT '', |
| 19 | + ssl_crl VARCHAR NOT NULL DEFAULT '', |
| 20 | + ssl_crlpath VARCHAR NOT NULL DEFAULT '', |
| 21 | + ssl_protocol_version_range VARCHAR NOT NULL DEFAULT '', |
| 22 | + comment VARCHAR NOT NULL DEFAULT '', |
| 23 | + PRIMARY KEY (hostname, port, username) |
| 24 | +) |
| 25 | +``` |
| 26 | + |
| 27 | +## Column Reference |
| 28 | + |
| 29 | +| Column | Description | |
| 30 | +|--------|-------------| |
| 31 | +| `hostname` | Backend server hostname. Must match the `hostname` in `pgsql_servers`. | |
| 32 | +| `port` | Backend server port. Default: `5432`. Must match the `port` in `pgsql_servers`. | |
| 33 | +| `username` | ProxySQL username. Empty string `''` acts as a wildcard fallback (see Lookup Hierarchy). | |
| 34 | +| `ssl_ca` | Path to the CA certificate file (PEM). May contain multiple concatenated CA certs. Maps to libpq `sslrootcert`. | |
| 35 | +| `ssl_cert` | Path to the client certificate file. Maps to libpq `sslcert`. | |
| 36 | +| `ssl_key` | Path to the client private key file. Maps to libpq `sslkey`. | |
| 37 | +| `ssl_crl` | Path to the certificate revocation list file. Maps to libpq `sslcrl`. | |
| 38 | +| `ssl_crlpath` | Path to directory containing CRL files. Maps to libpq `sslcrldir` (PostgreSQL 14+). | |
| 39 | +| `ssl_protocol_version_range` | TLS protocol version constraint. See format below. | |
| 40 | +| `comment` | Free-form comment. | |
| 41 | + |
| 42 | +## ssl_protocol_version_range |
| 43 | + |
| 44 | +Controls which TLS protocol versions are allowed for backend connections. This maps to libpq's `ssl_min_protocol_version` and `ssl_max_protocol_version` parameters. |
| 45 | + |
| 46 | +### Format |
| 47 | + |
| 48 | +**Range:** `<min_version>-<max_version>` |
| 49 | + |
| 50 | +Allows connections using any TLS version from `min_version` to `max_version` inclusive. |
| 51 | + |
| 52 | +**Min-only:** `<min_version>-` |
| 53 | + |
| 54 | +Sets a minimum TLS version with no upper bound (libpq default max applies). |
| 55 | + |
| 56 | +**Max-only:** `-<max_version>` |
| 57 | + |
| 58 | +Sets a maximum TLS version. The minimum defaults to libpq's built-in default (`TLSv1.2`). |
| 59 | + |
| 60 | +**Single version (pin):** `<version>` |
| 61 | + |
| 62 | +Pins to exactly that TLS version. Both min and max are set to the same value. |
| 63 | + |
| 64 | +**Empty string:** `''` |
| 65 | + |
| 66 | +Uses libpq defaults (no restriction). |
| 67 | + |
| 68 | +A bare `-` is treated as malformed and ignored (a warning is logged). |
| 69 | + |
| 70 | +### Valid Version Tokens |
| 71 | + |
| 72 | +`TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3` |
| 73 | + |
| 74 | +> **Note:** `TLSv1` and `TLSv1.1` are disabled in most modern PostgreSQL deployments. Attempting to use them will result in connection failures. |
| 75 | +
|
| 76 | +### Examples |
| 77 | + |
| 78 | +| Value | Meaning | |
| 79 | +|-------|---------| |
| 80 | +| `TLSv1.2-TLSv1.3` | Allow TLS 1.2 and TLS 1.3 | |
| 81 | +| `TLSv1.3` | Pin to TLS 1.3 only | |
| 82 | +| `TLSv1.2-TLSv1.2` | Pin to TLS 1.2 only (equivalent to `TLSv1.2`) | |
| 83 | +| `TLSv1.2-` | Require at least TLS 1.2 (max defaults to highest OpenSSL supports) | |
| 84 | +| `-TLSv1.3` | Allow up to TLS 1.3 (min defaults to libpq's built-in `TLSv1.2`) | |
| 85 | +| `''` (empty) | Use libpq defaults | |
| 86 | + |
| 87 | +## Lookup Hierarchy |
| 88 | + |
| 89 | +When ProxySQL opens a new connection to a PostgreSQL backend, it looks up SSL parameters in this order: |
| 90 | + |
| 91 | +1. **Exact match:** `(hostname, port, username)` — if an entry exists for the specific server and the ProxySQL user making the connection, use it. |
| 92 | +2. **Wildcard fallback:** `(hostname, port, '')` — if no exact match, check for an entry with empty username. |
| 93 | +3. **Global fallback:** If no match found, use the global `pgsql-ssl_p2s_*` variables. |
| 94 | + |
| 95 | +This allows you to set a default SSL configuration for a server (empty username) while overriding it for specific users. |
| 96 | + |
| 97 | +> **Important — matching is all-or-nothing.** Once a row in `pgsql_servers_ssl_params` matches (either at step 1 or step 2), ProxySQL uses **only** the SSL fields from that row. Empty columns in the matched row are passed through as empty (libpq defaults), they are **not** silently filled in from `pgsql-ssl_p2s_*`. The global variables are consulted **only** when no row matches at all (step 3). If you want a per-server row to inherit some defaults from the globals, you must copy those values into the row explicitly. |
| 98 | +
|
| 99 | +## Usage |
| 100 | + |
| 101 | +### Basic: Same SSL cert for all users connecting to a server |
| 102 | + |
| 103 | +```sql |
| 104 | +INSERT INTO pgsql_servers_ssl_params |
| 105 | + (hostname, port, ssl_ca, ssl_cert, ssl_key) |
| 106 | +VALUES |
| 107 | + ('db1.example.com', 5432, '/certs/ca.crt', '/certs/client.crt', '/certs/client.key'); |
| 108 | + |
| 109 | +LOAD PGSQL SERVERS TO RUNTIME; |
| 110 | +SAVE PGSQL SERVERS TO DISK; |
| 111 | +``` |
| 112 | + |
| 113 | +### Per-user: Different certs for different applications |
| 114 | + |
| 115 | +```sql |
| 116 | +-- Default for all users connecting to db1 |
| 117 | +INSERT INTO pgsql_servers_ssl_params |
| 118 | + (hostname, port, username, ssl_ca, ssl_cert, ssl_key) |
| 119 | +VALUES |
| 120 | + ('db1.example.com', 5432, '', '/certs/ca.crt', '/certs/default.crt', '/certs/default.key'); |
| 121 | + |
| 122 | +-- Override for 'billing_app' user |
| 123 | +INSERT INTO pgsql_servers_ssl_params |
| 124 | + (hostname, port, username, ssl_ca, ssl_cert, ssl_key) |
| 125 | +VALUES |
| 126 | + ('db1.example.com', 5432, 'billing_app', '/certs/ca.crt', '/certs/billing.crt', '/certs/billing.key'); |
| 127 | + |
| 128 | +LOAD PGSQL SERVERS TO RUNTIME; |
| 129 | +SAVE PGSQL SERVERS TO DISK; |
| 130 | +``` |
| 131 | + |
| 132 | +### TLS version restriction |
| 133 | + |
| 134 | +```sql |
| 135 | +-- Require TLS 1.3 for a specific server |
| 136 | +INSERT INTO pgsql_servers_ssl_params |
| 137 | + (hostname, port, ssl_ca, ssl_cert, ssl_key, ssl_protocol_version_range) |
| 138 | +VALUES |
| 139 | + ('secure-db.example.com', 5432, '/certs/ca.crt', '/certs/client.crt', '/certs/client.key', 'TLSv1.3'); |
| 140 | + |
| 141 | +-- Allow TLS 1.2 or 1.3 for another server |
| 142 | +INSERT INTO pgsql_servers_ssl_params |
| 143 | + (hostname, port, ssl_ca, ssl_cert, ssl_key, ssl_protocol_version_range) |
| 144 | +VALUES |
| 145 | + ('db2.example.com', 5432, '/certs/ca.crt', '/certs/client.crt', '/certs/client.key', 'TLSv1.2-TLSv1.3'); |
| 146 | + |
| 147 | +LOAD PGSQL SERVERS TO RUNTIME; |
| 148 | +SAVE PGSQL SERVERS TO DISK; |
| 149 | +``` |
| 150 | + |
| 151 | +### Multiple servers with different SSL configs |
| 152 | + |
| 153 | +```sql |
| 154 | +-- Server A: uses company CA and TLS 1.3 |
| 155 | +INSERT INTO pgsql_servers_ssl_params |
| 156 | + (hostname, port, ssl_ca, ssl_cert, ssl_key, ssl_protocol_version_range, comment) |
| 157 | +VALUES |
| 158 | + ('db-a.internal', 5432, '/certs/company-ca.crt', '/certs/a-client.crt', '/certs/a-client.key', 'TLSv1.3', 'Internal DB'); |
| 159 | + |
| 160 | +-- Server B: uses AWS RDS CA bundle |
| 161 | +INSERT INTO pgsql_servers_ssl_params |
| 162 | + (hostname, port, ssl_ca, comment) |
| 163 | +VALUES |
| 164 | + ('mydb.us-east-1.rds.amazonaws.com', 5432, '/certs/rds-combined-ca-bundle.pem', 'AWS RDS'); |
| 165 | + |
| 166 | +LOAD PGSQL SERVERS TO RUNTIME; |
| 167 | +SAVE PGSQL SERVERS TO DISK; |
| 168 | +``` |
| 169 | + |
| 170 | +## Viewing Configuration |
| 171 | + |
| 172 | +```sql |
| 173 | +-- View configured SSL params |
| 174 | +SELECT * FROM pgsql_servers_ssl_params; |
| 175 | + |
| 176 | +-- View active runtime SSL params |
| 177 | +SELECT * FROM runtime_pgsql_servers_ssl_params; |
| 178 | +``` |
| 179 | + |
| 180 | +## Admin Commands |
| 181 | + |
| 182 | +| Command | Effect | |
| 183 | +|---------|--------| |
| 184 | +| `LOAD PGSQL SERVERS TO RUNTIME` | Promotes `pgsql_servers_ssl_params` to runtime (activates the config) | |
| 185 | +| `SAVE PGSQL SERVERS TO DISK` | Persists `pgsql_servers_ssl_params` to the on-disk database | |
| 186 | +| `LOAD PGSQL SERVERS FROM DISK` | Restores `pgsql_servers_ssl_params` from the on-disk database | |
| 187 | + |
| 188 | +## Prerequisites |
| 189 | + |
| 190 | +Per-server SSL parameters only take effect when `use_ssl=1` is set for the corresponding server in `pgsql_servers`: |
| 191 | + |
| 192 | +```sql |
| 193 | +UPDATE pgsql_servers SET use_ssl=1 WHERE hostname='db1.example.com'; |
| 194 | +LOAD PGSQL SERVERS TO RUNTIME; |
| 195 | +``` |
| 196 | + |
| 197 | +If `use_ssl=0`, the backend connection does not use SSL regardless of `pgsql_servers_ssl_params` entries. |
| 198 | + |
| 199 | +## Notes |
| 200 | + |
| 201 | +- Empty fields in `pgsql_servers_ssl_params` are omitted from the libpq connection string (libpq defaults apply for those fields). |
| 202 | +- Per-server SSL params only affect **new** backend connections. Existing pooled connections continue using their original SSL settings. Use the `/* create_new_connection=1 */` query annotation to force ProxySQL to create a new backend connection. |
| 203 | +- Per-server SSL params apply on the data path (`PgSQL_Connection`), the monitor path (`PgSQL_Monitor`), and the cancel/terminate path (`PgSQL_Backend_Kill_Args`). |
0 commit comments