From fc03ed7b0e679e8fbee892b355495d25ddd137ca Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Fri, 20 Mar 2026 12:48:05 -0500
Subject: [PATCH] Disable SSL for database connections on private network (#97)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every timeout stack trace pointed at ssl_gen_statem.call/2 — the OTP 27
SSL gen_statem hanging during recv. PG is on private network (10.0.15.20)
and SSL verify was already disabled (verify_none), providing no security
benefit while adding CPU overhead and the gen_statem layer that caused
all connection timeouts.

Removed DATABASE_SSL and DATABASE_SSL_VERIFY env vars from both the
init container and main container. Also disabled SSL on the PG server
(ssl=off in postgresql.conf, hostssl→host in pg_hba.conf).

Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/97
---
 k8s/deployment.yaml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index e0970ec4..d5a3eb52 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -47,10 +47,6 @@ spec:
           env:
             - name: MIX_ENV
               value: "prod"
-            - name: DATABASE_SSL
-              value: "true"
-            - name: DATABASE_SSL_VERIFY
-              value: "false"
             - name: RELEASE_COOKIE
               valueFrom:
                 secretKeyRef:
@@ -173,10 +169,6 @@ spec:
                 secretKeyRef:
                   name: towerops-secrets
                   key: CLOAK_KEY
-            - name: DATABASE_SSL
-              value: "true"
-            - name: DATABASE_SSL_VERIFY
-              value: "false"
             - name: STRIPE_SECRET_KEY
               valueFrom:
                 secretKeyRef: