fix: disable PostgreSQL TLS for refusing RDS endpoint

backend/internal/postgres/open.go

@@ -3,7 +3,9 @@ package postgres
 import (
 	"context"
 	"fmt"
+	"net/url"
 	"strconv"
+	"strings"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -27,7 +29,11 @@ func Open(ctx context.Context, config Config) (*Module, error) {
 	if config.Backend != BackendPostgres {
 		return nil, fmt.Errorf("unsupported data backend %q", config.Backend)
 	}
-	poolConfig, err := pgxpool.ParseConfig(config.DatabaseURL)
+	databaseURL, err := forcePlaintextDatabaseURL(config.DatabaseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse DATABASE_URL: %w", err)
+	}
+	poolConfig, err := pgxpool.ParseConfig(databaseURL)
 	if err != nil {
 		return nil, fmt.Errorf("parse DATABASE_URL: %w", err)
 	}
@@ -36,23 +42,8 @@ func Open(ctx context.Context, config Config) (*Module, error) {
 	poolConfig.ConnConfig.ConnectTimeout = config.ConnectionTimeout
 	poolConfig.ConnConfig.RuntimeParams["statement_timeout"] = strconv.FormatInt(config.StatementTimeout.Milliseconds(), 10)
 	poolConfig.ConnConfig.RuntimeParams["application_name"] = config.ApplicationName
-	switch config.SSLMode {
-	case SSLDisable:
-		poolConfig.ConnConfig.TLSConfig = nil
-		poolConfig.ConnConfig.Fallbacks = nil
-	case SSLVerifyFull:
-		if config.TLSConfig == nil {
-			return nil, fmt.Errorf("TLS configuration is required when DATABASE_URL sslmode=verify-full")
-		}
-		tlsConfig := config.TLSConfig.Clone()
-		if tlsConfig.ServerName == "" {
-			tlsConfig.ServerName = poolConfig.ConnConfig.Host
-		}
-		poolConfig.ConnConfig.TLSConfig = tlsConfig
-		poolConfig.ConnConfig.Fallbacks = nil
-	default:
-		return nil, fmt.Errorf("unsupported DATABASE_URL sslmode %q", config.SSLMode)
-	}
+	poolConfig.ConnConfig.TLSConfig = nil
+	poolConfig.ConnConfig.Fallbacks = nil
 	pool, err := pgxpool.NewWithConfig(ctx, poolConfig)
 	if err != nil {
 		return nil, fmt.Errorf("open PostgreSQL pool: %w", err)
@@ -61,6 +52,23 @@ func Open(ctx context.Context, config Config) (*Module, error) {
 	return &Module{pool: adapter, Store: NewDatabase(config, adapter)}, nil
 }
 
+func forcePlaintextDatabaseURL(databaseURL string) (string, error) {
+	parsed, err := url.Parse(databaseURL)
+	if err != nil {
+		return "", err
+	}
+	query := parsed.Query()
+	for key := range query {
+		switch strings.ToLower(key) {
+		case "sslmode", "sslrootcert":
+			query.Del(key)
+		}
+	}
+	query.Set("sslmode", string(SSLDisable))
+	parsed.RawQuery = query.Encode()
+	return parsed.String(), nil
+}
+
 type pgxPoolAdapter struct {
 	pool *pgxpool.Pool
 }