Allow passing ssl_cert_data, ssl_key_dadta and ssl_root_cert_data

[brmzkw]

Each ssl_* file parameter now has a *_data counterpart that accepts the raw PEM content directly. When set, the content is written to a temporary file which is passed to the PostgreSQL tools via the existing env vars (PGSSLCERT, PGSSLKEY, PGSSLROOTCERT). Temp files are removed when the connector is closed.

To test, start a postgresql container:

#!/bin/sh
set -eu

CERTDIR="$(pwd)/certs"
INITDIR="$(pwd)/docker-entrypoint-initdb.d"

rm -rf "$CERTDIR" "$INITDIR"
mkdir -p "$CERTDIR" "$INITDIR"

# CA
openssl req -new -x509 -days 365 -nodes \
  -subj "/CN=test-ca" \
  -keyout "$CERTDIR/ca.key" \
  -out "$CERTDIR/ca.crt"

# Server cert. CN must match hostname used by clients.
openssl req -newkey rsa:2048 -nodes \
  -subj "/CN=localhost" \
  -keyout "$CERTDIR/server.key" \
  -out "$CERTDIR/server.csr"

openssl x509 -req -days 365 \
  -in "$CERTDIR/server.csr" \
  -CA "$CERTDIR/ca.crt" \
  -CAkey "$CERTDIR/ca.key" \
  -CAcreateserial \
  -out "$CERTDIR/server.crt"

# Client cert. CN must match PostgreSQL user.
openssl req -newkey rsa:2048 -nodes \
  -subj "/CN=postgres" \
  -keyout "$CERTDIR/client.key" \
  -out "$CERTDIR/client.csr"

openssl x509 -req -days 365 \
  -in "$CERTDIR/client.csr" \
  -CA "$CERTDIR/ca.crt" \
  -CAkey "$CERTDIR/ca.key" \
  -CAcreateserial \
  -out "$CERTDIR/client.crt"

chmod 600 "$CERTDIR"/*.key

cat > "$INITDIR/001-enable-mtls.sh" <<'EOF'
#!/bin/sh
set -eu

cat >> "$PGDATA/postgresql.conf" <<CONF
ssl = on
ssl_ca_file = '/certs/ca.crt'
ssl_cert_file = '/certs/server.crt'
ssl_key_file = '/certs/server.key'
CONF

cat > "$PGDATA/pg_hba.conf" <<CONF
# Require TLS + valid client certificate.
hostssl all all all cert clientcert=verify-full

# Reject non-TLS connections.
hostnossl all all all reject
CONF
EOF

chmod +x "$INITDIR/001-enable-mtls.sh"

docker run --rm -ti \
  --name test \
  -p 9999:5432 \
  -e POSTGRES_PASSWORD=postgres \
  -v "$CERTDIR:/certs:ro" \
  -v "$INITDIR:/docker-entrypoint-initdb.d:ro" \
  postgres:17

Do a backup with the _data*:

plakar -stdio at ./toto backup -o ssl_root_cert_data="$(cat ./certs/ca.crt)" -o ssl_cert_data="$(cat certs/client.crt)" -o ssl_key_data="$(cat certs/client.key)" postgres://postgres:postgres@localhost:9999

Or with the files:

plakar -stdio at ./toto backup -o ssl_root_cert=certs/ca.crt -o ssl_cert=certs/client.crt -o ssl_key=certs/client.key postgres://postgres:postgres@localhost:9999