From df6431c899e04f8d6c76daa41cb11a57921082e5 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Fri, 20 Mar 2026 12:56:30 -0500
Subject: [PATCH] Disable database SSL/TLS encryption

Removed DATABASE_SSL and DATABASE_SSL_VERIFY environment variable
handling and SSL configuration from database connection settings.
---
 config/runtime.exs | 81 +++++++++++++++++-----------------------------
 1 file changed, 30 insertions(+), 51 deletions(-)

diff --git a/config/runtime.exs b/config/runtime.exs
index db7611a..7458de2 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -49,21 +49,6 @@ if config_env() == :prod do
   # Configure clustering based on environment
   cluster_enabled = System.get_env("CLUSTER_ENABLED", "false") == "true"
 
-  # Parse SSL configuration from environment
-  ssl_enabled = System.get_env("DATABASE_SSL", "false") == "true"
-  ssl_verify = System.get_env("DATABASE_SSL_VERIFY", "true") == "true"
-
-  ssl_opts =
-    if ssl_enabled do
-      if ssl_verify do
-        [ssl: true]
-      else
-        [ssl: true, ssl_opts: [verify: :verify_none]]
-      end
-    else
-      []
-    end
-
   # ## Configuring the mailer
   #
   # Configure Resend for email delivery
@@ -71,42 +56,36 @@ if config_env() == :prod do
     adapter: Resend.Swoosh.Adapter,
     api_key: System.get_env("RESEND_API_KEY")
 
-  config :aprsme,
-         Aprsme.Repo,
-         Keyword.merge(
-           [
-             url: database_url,
-             # Increased pool size for better concurrency (was 25)
-             pool_size: String.to_integer(System.get_env("POOL_SIZE") || "45"),
-             # Increased timeout for ARM system under load
-             pool_timeout: String.to_integer(System.get_env("POOL_TIMEOUT") || "10000"),
-             # Match PostgreSQL statement timeout capabilities
-             timeout: String.to_integer(System.get_env("DB_TIMEOUT") || "30000"),
-             socket_options:
-               maybe_ipv6 ++
-                 [
-                   # TCP optimizations for better connection handling
-                   keepalive: true,
-                   nodelay: true,
-                   recbuf: 8192,
-                   sndbuf: 8192
-                 ],
-             types: Aprsme.PostgresTypes,
-             # Reduced queue target for faster response
-             queue_target: 100,
-             # Check queue more frequently
-             queue_interval: 1_000,
-             # Optimize for unnamed prepared statements (better for dynamic queries)
-             prepare: :unnamed,
-             # Connection parameters to leverage PostgreSQL settings
-             # Note: When using PgBouncer, only certain parameters are supported
-             parameters: [
-               # Application name for monitoring
-               application_name: "aprsme"
-             ]
-           ],
-           ssl_opts
-         )
+  config :aprsme, Aprsme.Repo,
+    url: database_url,
+    # Increased pool size for better concurrency (was 25)
+    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "45"),
+    # Increased timeout for ARM system under load
+    pool_timeout: String.to_integer(System.get_env("POOL_TIMEOUT") || "10000"),
+    # Match PostgreSQL statement timeout capabilities
+    timeout: String.to_integer(System.get_env("DB_TIMEOUT") || "30000"),
+    socket_options:
+      maybe_ipv6 ++
+        [
+          # TCP optimizations for better connection handling
+          keepalive: true,
+          nodelay: true,
+          recbuf: 8192,
+          sndbuf: 8192
+        ],
+    types: Aprsme.PostgresTypes,
+    # Reduced queue target for faster response
+    queue_target: 100,
+    # Check queue more frequently
+    queue_interval: 1_000,
+    # Optimize for unnamed prepared statements (better for dynamic queries)
+    prepare: :unnamed,
+    # Connection parameters to leverage PostgreSQL settings
+    # Note: When using PgBouncer, only certain parameters are supported
+    parameters: [
+      # Application name for monitoring
+      application_name: "aprsme"
+    ]
 
   config :aprsme, AprsmeWeb.Endpoint,
     url: [host: host, port: 443, scheme: "https"],