postgres-ha
postgres-ha copied to clipboard
Support exposing to the Internet by adding SSL support
Even if it's easy to expose a Postgres cluster to the Internet, it needs to be secured.
Right now we don't care much because it's meant to be used internally only. However, it's prety useful to be able to use it from external systems that aren't connected to the app's private network. Adding and configuring wireguard is an option, but not in all cases and always requires a lot of fiddling.
Relevant information:
- https://www.postgresql.org/docs/current/libpq-ssl.html
- https://github.com/sorintlab/stolon/blob/master/doc/ssl.md
Beyond exposing publicly, SSL support is also important for zero trust.