Certificate validation (#36)

* Add cert option to connecting DB * Format import orders * Revert line wrap in README
LiskHQ · May 8, 2024 · b87e82b · b87e82b
1 parent 48a43a8
commit b87e82b
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 14 deletions.
diff --git a/packages/claim-backend/.env.example b/packages/claim-backend/.env.example
@@ -6,6 +6,7 @@ DB_DATABASE=claim-backend
 DB_USERNAME=claim-backend
 DB_PASSWORD_PATH=./db_password.txt
 DB_SSLMODE=true
+DB_SSL_CERT_PATH=
 DB_LOGGING=true
 CORS_ORIGIN=*
 MERKLE_TREE_PATH=../../data/claim/merkle-tree-result-detailed.json

diff --git a/packages/claim-backend/README.md b/packages/claim-backend/README.md
@@ -11,19 +11,20 @@ Apart from Node version 18, Claim Backend also requires:
 
 ## .env Params
 
-| param            | Description                                                                                                                                          | Required |
-| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
-| BACKEND_HOST     | IP used by backend (Default: 127.0.0.1)                                                                                                              | false    |
-| BACKEND_PORT     | Port used by backend (Default: 3000)                                                                                                                 | false    |
-| DB_PORT          | Port used by PostgreSQL DB (Default: 5432)                                                                                                           | false    |
-| DB_HOST          | Host used by PostgreSQL DB (Default: 127.0.0.1)                                                                                                      | false    |
-| DB_DATABASE      | Name of Database of PostgreSQL DB (Default: claim-backend)                                                                                           | false    |
-| DB_USERNAME      | Username of PostgreSQL DB (Default: claim-backend)                                                                                                   | false    |
-| DB_PASSWORD_PATH | Absolute file path or file path relative to `docker-compose.yaml` that stores the password of database of PostgreSQL DB (Default: ./db_password.txt) | false    |
-| DB_SSLMODE       | A flag to turn on SSL Connection on DB (Default: false)                                                                                              | false    |
-| DB_LOGGING       | A flag to turn on verbose logging of DB (Default: true)                                                                                              | false    |
-| CORS_ORIGIN      | Accepted Origin, can be string or Regex (Default: \*)                                                                                                | false    |
-| MERKLE_TREE_PATH | Path merkle-tree-details.json, generated by Tree Builder                                                                                             | true     |
+| param            | Description                                                                                                                                          | Required                  |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
+| BACKEND_HOST     | IP used by backend (Default: 127.0.0.1)                                                                                                              | false                     |
+| BACKEND_PORT     | Port used by backend (Default: 3000)                                                                                                                 | false                     |
+| DB_PORT          | Port used by PostgreSQL DB (Default: 5432)                                                                                                           | false                     |
+| DB_HOST          | Host used by PostgreSQL DB (Default: 127.0.0.1)                                                                                                      | false                     |
+| DB_DATABASE      | Name of Database of PostgreSQL DB (Default: claim-backend)                                                                                           | false                     |
+| DB_USERNAME      | Username of PostgreSQL DB (Default: claim-backend)                                                                                                   | false                     |
+| DB_PASSWORD_PATH | Absolute file path or file path relative to `docker-compose.yaml` that stores the password of database of PostgreSQL DB (Default: ./db_password.txt) | false                     |
+| DB_SSLMODE       | A flag to turn on SSL Connection on DB (Default: false)                                                                                              | false                     |
+| DB_SSL_CERT_PATH | Path to SSL Certificate (.crt or .pem) (Default: `null`)                                                                                             | When `DB_SSLMODE` is True |
+| DB_LOGGING       | A flag to turn on verbose logging of DB (Default: true)                                                                                              | false                     |
+| CORS_ORIGIN      | Accepted Origin, can be string or Regex (Default: \*)                                                                                                | false                     |
+| MERKLE_TREE_PATH | Path merkle-tree-details.json, generated by Tree Builder                                                                                             | true                      |
 
 ## Run
 

diff --git a/packages/claim-backend/src/db.ts b/packages/claim-backend/src/db.ts
@@ -23,7 +23,10 @@ export class DB {
 					? {
 							ssl: {
 								require: true,
-								rejectUnauthorized: false,
+								rejectUnauthorized: true,
+								ca: process.env.DB_SSL_CERT_PATH
+									? [fs.readFileSync(process.env.DB_SSL_CERT_PATH)]
+									: [],
 							},
 						}
 					: {},