Konga: Cannot connect to Postgres with SSL

Created on 23 Nov 2017 · 17Comments · Source: pantsel/konga

Hi,

For some reason Konga won't connect to RDS Postgres in SSL.

Here's the compose:
``` konga:
image: pantsel/konga:latest
environment:
DB_ADAPTER: postgres
DB_DATABASE: xxxx
DB_HOST: xxxxx
DB_PASSWORD: xxxxx
NODE_ENV: development
DB_SSL: 'true'
stdin_open: true
tty: true
command:
- printenv
- '&&'
- /bin/bash
- ./start.sh

And the error log:
```23/11/2017 15:02:53Using postgres DB Adapter.
23/11/2017 15:02:53Failed to connect to DB named `xxxx` { error: no pg_hba.conf entry for host "x.x.x.x", user "xxx", database "xxx", SSL off
23/11/2017 15:02:53    at Connection.parseE (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:539:11)
23/11/2017 15:02:53    at Connection.parseMessage (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:366:17)
23/11/2017 15:02:53    at Socket.<anonymous> (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:105:22)
23/11/2017 15:02:53    at emitOne (events.js:96:13)
23/11/2017 15:02:53    at Socket.emit (events.js:188:7)
23/11/2017 15:02:53    at readableAddChunk (_stream_readable.js:176:18)
23/11/2017 15:02:53    at TCP.onread (net.js:547:20)
23/11/2017 15:02:53  name: 'error',
23/11/2017 15:02:53  length: 152,
23/11/2017 15:02:53  severity: 'FATAL',
23/11/2017 15:02:53  code: '28000',
23/11/2017 15:02:53  detail: undefined,
23/11/2017 15:02:53  hint: undefined,
23/11/2017 15:02:53  position: undefined,
23/11/2017 15:02:53  internalPosition: undefined,
23/11/2017 15:02:53  internalQuery: undefined,
23/11/2017 15:02:53  where: undefined,
23/11/2017 15:02:53  schema: undefined,
23/11/2017 15:02:53  table: undefined,
23/11/2017 15:02:53  column: undefined,
23/11/2017 15:02:53  dataType: undefined,
23/11/2017 15:02:53  constraint: undefined,
23/11/2017 15:02:53  file: 'auth.c',
23/11/2017 15:02:53  line: '467',
23/11/2017 15:02:53  routine: 'ClientAuthentication' }

As you can see in the log it has SSL off, despite it being enabled in the environment variables.

It looks like this line is being ignored: https://github.com/pantsel/konga/blob/master/config/connections.js#L82

Source

bluemalkin

All 17 comments

@bluemalkin , check out the latest commit.

Waiting for feedback.

Cheers.

pantsel on 23 Nov 2017

Thanks @pantsel I still get the same error using the latest tag.

24/11/2017 16:10:12Using postgres DB Adapter. 24/11/2017 16:10:12Failed to connect to DB named `xxx` { error: no pg_hba.conf entry for host "x.x.x.x", user "xxx", database "xxx", SSL off 24/11/2017 16:10:12 at Connection.parseE (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:539:11) 24/11/2017 16:10:12 at Connection.parseMessage (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:366:17) 24/11/2017 16:10:12 at Socket.<anonymous> (/app/node_modules/sails-postgresql/node_modules/pg/lib/connection.js:105:22) 24/11/2017 16:10:12 at emitOne (events.js:96:13) 24/11/2017 16:10:12 at Socket.emit (events.js:188:7) 24/11/2017 16:10:12 at readableAddChunk (_stream_readable.js:176:18) 24/11/2017 16:10:12 at TCP.onread (net.js:547:20)

bluemalkin on 24 Nov 2017

Are you defining the DB_SSL env var when starting the app?

pantsel on 24 Nov 2017

Yes as per first post.

bluemalkin on 24 Nov 2017

Can you hard code it to true in the connections.js file and see if it works then?

ssl: true

If it doesn't, there's something wrong with the adapter itself.

pantsel on 24 Nov 2017

@pantsel I tried that too - hardcoded all values in connections.js, mounted the file and same error.

bluemalkin on 27 Nov 2017

@pantsel what do you reckon ? Should we raise an issue at the upstream https://github.com/balderdashy/sails ?

bluemalkin on 29 Nov 2017

@bluemalkin , I think that's the place to do so.

pantsel on 30 Nov 2017

chris-scentregroup on 16 Jan 2018

The fix is actually adequate from https://github.com/pantsel/konga/commit/53446d5d1dbe5deec983817ffcdf31000670a4c1. However, there has been no release yet. @pantsel can you do another release and so the docker image gets the update?

chris-scentregroup on 28 Feb 2018

👍1

Just published the 0.9.1 release

pantsel on 28 Feb 2018

❤1

@pantsel thank you mate. Docker image in hub updated soon (sorry not familiar with your CI/CD release process there..).

flaccid on 28 Feb 2018

@flaccid ,
the image is building as we speak.

pantsel on 28 Feb 2018

👍1

Please help me fix this....
Unable to connect to SSL enabled postgres database

env:
        - name: KONGA_LOG_LEVEL
          value: "debug"
        - name: NODE_ENV
          value: "production"
        - name: DB_HOST
          value: "xxx.postgres.database.azure.com"
        - name: DB_PORT
          value: "5432"
        - name: DB_USER
          value: "xxx@postgres"
        - name: DB_PASSWORD
          value: "yyy"
        - name: DB_DATABASE
          value: "konga_database"
        - name: DB_POOLSIZE
          value: "10"
        - name: DB_SSL
          value: "true"
        - name: DB_ADAPTER
          value: "postgres"
        - name: NODE_TLS_REJECT_UNAUTHORIZED
          value: '0'

And logs of konga pod after k8s deployment

Hook:api_health_checks:process() called
Hook:health_checks:process() called
Hook:start-scheduled-snapshots:process() called
Hook:upstream_health_checks:process() called
Hook:user_events_hook:process() called
User had models, so no seed needed
Start scheduled health checks for node 1
Kongnode had models, so no seed needed
Emailtransport seeds updated
Performing health check for node 1
Health check for node 1 succeeded { database: { reachable: true },
  memory:
   { workers_lua_vms:
      [ [Object],
        [Object],
        [Object],
        [Object],
        [Object],
        [Object],
        [Object],
        [Object] ],
     lua_shared_dicts:
      { kong_locks: [Object],
        kong: [Object],
        kong_process_events: [Object],
        kong_db_cache: [Object],
        kong_cluster_events: [Object],
        kong_db_cache_miss: [Object],
        prometheus_metrics: [Object],
        kong_healthchecks: [Object],
        kong_rate_limiting_counters: [Object] } },
  server:
   { connections_writing: 1,
     total_requests: 181602,
     connections_handled: 17547,
     connections_accepted: 17547,
     connections_reading: 0,
     connections_active: 2,
     connections_waiting: 1 } }
KongNode:afterUpdate:called()
KongNode:afterUpdate:health_checks true
KongNode:afterUpdate:emit health_checks.start
events.js:183
      throw er; // Unhandled 'error' event
      ^

Error: read ECONNRESET
    at TLSWrap.onread (net.js:622:25)

swapnild2111 on 19 Aug 2019

i am also receiving Failed to connect to DB { error: no pg_hba.conf entry for host "179.216.8.119", user "jessequinn_dev", database "kong", SSL off with DB_SSL: 'true' in docker-compose with the prepare statement.

  konga-prepare:
    image: pantsel/konga:next
    command: "-c prepare -a postgres -u postgresql://XXX/kong?sslmode=require"
    environment:
      DB_SSL: 'true'
    restart: on-failure
    depends_on:
      - kong

jessequinn on 11 Apr 2020

@jessequinn & @swapnild2111 I believe https://github.com/pantsel/konga/issues/645 is related to this issue

mloskot on 6 Dec 2020

@jessequinn

i am also receiving Failed to connect to DB { error: no pg_hba.conf entry for host "179.216.8.119", user "jessequinn_dev", database "kong", SSL off with DB_SSL: 'true' in docker-compose with the prepare statement.
  konga-prepare:
    image: pantsel/konga:next
    command: "-c prepare -a postgres -u postgresql://XXX/kong?sslmode=require"
    environment:
      DB_SSL: 'true'
    restart: on-failure
    depends_on:
      - kong

This is solved by adding "ssl=true" to the end of the connection string. For this example, it has 'sslmode=require' which isn't picked up by the parser. The prepare function also seems to ignore the settings in the .env file to do with DB_SSL.