Add support for Redis over TLS and postgres over TLS

api/config/packages/common_ground.yaml

@@ -9,6 +9,10 @@ parameters:
   env(APP_COMMONGROUND_KEY): "d4bb1810-8358-4372-98db-6c7bd2fb370c"
   env(APP_COMMONGROUND_SECRET): ""
   env(CACHE_URL): ''
+
+  env(DATABASE_ROOT_CERT): /var/certs/postgresql.crt
+  env(REDIS_PROTOCOL): redis
+
 
   common_ground.app.id: "%env(APP_COMMONGROUND_ID)%"
   app_commonground_id: "%env(APP_COMMONGROUND_ID)%"

api/config/packages/doctrine.yaml

@@ -3,6 +3,7 @@ doctrine:
         # IMPORTANT: You MUST configure your server version,
         # either here or in the DATABASE_URL env var (see .env file)
         #server_version: '13'
+        sslrootcert: '%env(DATABASE_ROOT_CERT)%'
         url: '%env(resolve:DATABASE_URL)%'
         types:
             uuid:  Ramsey\Uuid\Doctrine\UuidType

api/config/packages/framework.yaml

@@ -21,7 +21,7 @@ framework:
         prefix_seed: commonground_gateway_cache
         app: cache.adapter.redis
         system: cache.adapter.redis
-        default_redis_provider: "redis://%env(REDIS_HOST)%:%env(int:REDIS_PORT)%"
+        default_redis_provider: "%env(REDIS_PROTOCOL)%://%env(REDIS_HOST)%:%env(int:REDIS_PORT)%"
 
 
     trusted_hosts: "%env(TRUSTED_HOSTS)%"

api/helm/commonground-gateway/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.5.5
+version: 1.5.6
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

api/helm/commonground-gateway/templates/consumer.yaml

@@ -53,6 +53,13 @@ spec:
         - name: vendor
           persistentVolumeClaim:
               claimName: {{ include "commonground-gateway.fullname" . }}-vendor
+        {{-  if .Values.security.postgresCert }}
+        -   name: postgres-certificate
+            projected:
+                sources:
+                    -   secret:
+                            name: {{ include "commonground-gateway.fullname" . }}-postgresCert
+          {{- end }}
       initContainers:
           - name: {{ include "commonground-gateway.fullname" . }}-init
             securityContext:
@@ -86,7 +93,13 @@ spec:
             - mountPath: /var/run/idp
               name: idp-certificate
               readOnly: true
-            {{- end }}            
+            {{- end }}
+            {{- if .Values.security.postgresCert }}
+            - mountPath: /srv/api/var/certs/postgres.crt
+              subPath: certificate.crt
+              name: postgres-certificate
+              readOnly: true
+            {{- end }}     
             - mountPath: /srv/api/vendor
               subPath: vendor
               name: vendor
@@ -161,6 +174,8 @@ spec:
                 secretKeyRef:
                   key: database-url
                   name: {{ include "commonground-gateway.fullname" . }}
+            - name: DATABASE_ROOT_CERT
+              value: /srv/api/var/certs/postgres.crt
             - name: CACHE_URL
               valueFrom:
                   secretKeyRef:
@@ -247,6 +262,8 @@ spec:
                 configMapKeyRef:
                   key: redis-port
                   name: {{ include "commonground-gateway.fullname" . }}
+            - name: REDIS_PROTOCOL
+              value: {{ .Values.security.redisProtocol }}
             {{- end }}
             - name: SAML_ENABLED
               valueFrom:

api/helm/commonground-gateway/templates/cron-runner.yaml

@@ -60,7 +60,14 @@ spec:
                   - name: vendor
                     persistentVolumeClaim:
                         claimName: {{ include "commonground-gateway.fullname" . }}-vendor
-
+
+                {{-  if .Values.security.postgresCert }}
+                  -   name: postgres-certificate
+                      projected:
+                          sources:
+                              -   secret:
+                                      name: {{ include "commonground-gateway.fullname" . }}-postgresCert
+                  {{- end }}
               initContainers:
                   - name: {{ include "commonground-gateway.fullname" . }}-init
                     securityContext:
@@ -120,6 +127,12 @@ spec:
                           subPath: bundles.php
                           name: vendor
                           readOnly: false
+                        {{- if .Values.security.postgresCert }}
+                        - mountPath: /srv/api/var/certs/postgres.crt
+                          subPath: certificate.crt
+                          name: postgres-certificate
+                          readOnly: true
+                        {{- end }}
                     args:
                         - bin/console
                         - cronjob:command
@@ -169,6 +182,8 @@ spec:
                               secretKeyRef:
                                   key: database-url
                                   name: {{ include "commonground-gateway.fullname" . }}
+                        - name: DATABASE_ROOT_CERT
+                          value: /srv/api/var/certs/postgres.crt
                         - name: CACHE_URL
                           valueFrom:
                               secretKeyRef:
@@ -257,6 +272,8 @@ spec:
                               configMapKeyRef:
                                   key: redis-port
                                   name: {{ include "commonground-gateway.fullname" . }}
+                        - name: REDIS_PROTOCOL
+                          value: {{ .Values.security.redisProtocol }}
                         {{- end }}
                         - name: SAML_ENABLED
                           valueFrom:

api/helm/commonground-gateway/templates/deployment.yaml

@@ -86,6 +86,13 @@ spec:
             - secret:
                 name: {{ include "commonground-gateway.fullname" . }}-tls
         {{- end }}
+        {{-  if .Values.security.postgresCert }}
+        -   name: postgres-certificate
+            projected:
+                sources:
+                    -   secret:
+                            name: {{ include "commonground-gateway.fullname" . }}-postgresCert
+          {{- end }}
       initContainers:
           - name: {{ include "commonground-gateway.fullname" . }}-init          
             securityContext:
@@ -140,6 +147,12 @@ spec:
               name: doctrine
               readOnly: true
             {{- end }}
+            {{- if .Values.security.postgresCert }}
+            - mountPath: /srv/api/var/certs/postgres.crt
+              subPath: certificate.crt
+              name: postgres-certificate
+              readOnly: true
+            {{- end }}
             - mountPath: /srv/api/vendor
               subPath: vendor
               name: vendor
@@ -211,6 +224,8 @@ spec:
                 secretKeyRef:
                   key: database-url
                   name: {{ include "commonground-gateway.fullname" . }}
+            - name: DATABASE_ROOT_CERT
+              value: /srv/api/var/certs/postgres.crt
             - name: CACHE_URL
               valueFrom:
                 secretKeyRef:
@@ -310,6 +325,8 @@ spec:
                 configMapKeyRef:
                   key: redis-port
                   name: {{ include "commonground-gateway.fullname" . }}
+            - name: REDIS_PROTOCOL
+              value: {{ .Values.security.redisProtocol }}
             {{- end }}
             - name: SAML_ENABLED
               valueFrom:

api/helm/commonground-gateway/templates/secrets.yaml

@@ -42,3 +42,17 @@ data:
   {{ else }}
   mongodb-url: {{ .Values.mongodb.url | b64enc | quote }}
   {{ end }}
+
+{{- if .Values.security.postgresCert }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: {{ include "commonground-gateway.fullname" . }}-postgresCert
+    labels:
+    {{- include "commonground-gateway.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+    certificate.crt: |
+        {{ .Values.security.postgresCert | nindent 8 }}
+{{- end }}

api/helm/commonground-gateway/values.yaml

@@ -82,6 +82,8 @@ security:
       CvVVrqBVqLHjva4erqYol6K/jbSfUtRCy8IlFU7LYu1KLehZKYvj3vekj3Cn08Aq
       ljr/Q8Pw+OfUZTzKg4PVDQVfFqKtyosv
       -----END CERTIFICATE-----
+  postgresCert: null
+  redisProtocol: redis
   authEnabled: true
   sessionDuration: 900
   certificate:
@@ -215,6 +217,9 @@ mongodb:
             memory: 6Gi
 
 gateway-ui:
+    pwa:
+        image:
+            tag: latest
     enabled: true
     resources:
         requests: