ecto ssl tweaks

config/runtime.exs

@@ -63,6 +63,26 @@ if config_env() == :prod do
       redis_config
     end
 
+  # Configure SSL options based on environment variables
+  ssl_config =
+    case System.get_env("DATABASE_SSL") do
+      "true" ->
+        case System.get_env("DATABASE_SSL_VERIFY") do
+          "false" ->
+            [
+              verify: :verify_none,
+              server_name_indication: :disable,
+              verify_fun: {fn _, _, _ -> {:valid, :ok} end, :ok}
+            ]
+
+          _ ->
+            [verify: :verify_peer]
+        end
+
+      _ ->
+        false
+    end
+
   config :libcluster,
     topologies: [
       k8s: [
@@ -168,7 +188,7 @@ if config_env() == :prod do
     secret: System.get_env("AWS_SECRET_ACCESS_KEY")
 
   config :towerops, Towerops.Repo,
-    ssl: true,
+    ssl: ssl_config,
     url: database_url,
     pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
     # For machines with several cores, consider starting multiple pools of `pool_size`

k8s/deployment.yaml

@@ -99,6 +99,10 @@ spec:
                 secretKeyRef:
                   name: towerops-secrets
                   key: SECRET_KEY_BASE
+            - name: DATABASE_SSL
+              value: "true"
+            - name: DATABASE_SSL_VERIFY
+              value: "false"
           envFrom:
             # Redis connection configured via towerops-redis secret
             - secretRef: