# Postgres TLS

Bindplane supports TLS and mutual TLS when connecting to Postgres.

### Prerequisites

This guide assumes you already have Bindplane and Postgres deployed and configured. Before\
following this guide, make sure you have performed the steps in the previous [Postgres Store](/how-to-guides/infrastructure-and-operations/postgres/postgres-store.md) guide.

Lastly, the guide assumes you have already configured Postgres to use TLS or mutual TLS.

### SSL Mode

Before configuring TLS, familiarize yourself with the following Postgres SSL mode options. Bindplane\
supports four SSL mode options.

<table><thead><tr><th width="94.77734375">Mode</th><th>Description</th></tr></thead><tbody><tr><td>disable</td><td>TLS is not used.</td></tr><tr><td>require</td><td>TLS is used, but does not verify the server certificate.</td></tr><tr><td>verify-ca</td><td>TLS is used and verifies the server certificate.</td></tr><tr><td>verify-full</td><td>Same as <code>verify-ca</code>, but with mutual TLS and a client TLS key pair is configured.</td></tr></tbody></table>

You can review the official descriptions [here](https://www.postgresql.org/docs/current/libpq-ssl.html). Keep in mind that Bindplane supports a subset of the options found in the official Postgres documentation.

### Linux

When operating Bindplane on Linux, you can enable TLS by editing the configuration file at `/etc/bindplane/config.yaml`.

Find the `store` section and modify the `store.postgres` sub section.

```yaml
store:
  type: postgres
  maxEvents: 100
  postgres:
    host: bindplane-postgres
    port: "5432"
    connectTimeout: 30s
    database: bindplane
    username: bindplane
    password: your_password
    maxConnections: 100
    sslmode: disable
```

Modify `store.postgres.sslmode` to `require` or `verify-ca`. If using `verify-ca`, configure a certificate authority by setting `store.postgres.sslRootCert` to the path of a CA certificate file that can be used to verify the Postgres server's authenticity.

The resulting configuration file should look similar to this:

```yaml
store:
  type: postgres
  maxEvents: 100
  postgres:
    host: bindplane-postgres
    port: "5432"
    connectTimeout: 30s
    database: bindplane
    username: bindplane
    password: your_password
    maxConnections: 100
+   sslmode: verify-ca
+   sslRootCert: /etc/bindplane/tls/postgres-ca.crt
```

{% hint style="info" %}
**NOTE**

`sslRootCert` is not required when using `verify-ca` if the operating system's trust store\
includes your CA certificate.
{% endhint %}

Mutual TLS can be configured by setting `sslmode` to `verify-full` and including the `sslCert` and `sslKey` options.

```yaml
store:
  type: postgres
  maxEvents: 100
  postgres:
    host: bindplane-postgres
    port: "5432"
    connectTimeout: 30s
    database: bindplane
    username: bindplane
    password: your_password
    maxConnections: 100
+   sslmode: verify-full
+   sslRootCert: /etc/bindplane/tls/postgres-ca.crt
+   sslCert: /etc/bindplane/tls/client.crt
+   sslKey: /etc/bindplane/tls/client.key
```

When copying certificates to the Bindplane server, set the filesystem ownership and permissions.

```bash
sudo chown -R bindplane:bindplane /etc/bindplane/tls
sudo chmod 0400 /etc/bindplane/tls/*
```

After you have re-configured Bindplane and deployed the TLS files, restart the service.

```bash
sudo systemctl restart bindplane
```

Watch the Bindplane log file for issues.

```bash
sudo tail -F /var/log/bindplane/bindplane.log
```

If the service appears stopped, and the log file is not useful, check the journal output of the service.

```bash
sudo journalctl -f --unit bindplane
```

If no errors are encountered, Bindplane is correctly configured to use TLS when connecting to Postgres.

### Kubernetes

The [Bindplane Helm Chart](https://github.com/observIQ/bindplane-op-helm/tree/main) supports configuring Bindplane to use TLS by leveraging Kubernetes secrets.

Assuming you have the following files:

* `ca.crt`: The CA certificate
* `client.crt`: The mutual TLS client certificate (optional)
* `client.key`: The mutual TLS client private key (optional)

Create a Kubernetes secret. Omit the client keypair if you do not intend to use mutual TLS.

```bash
kubectl create secret generic postgres-tls \
  --from-file ca.crt \
  --from-file client.crt \
  --from-file client.key
```

Update your values configuration to include the `sslmode` and `sslsecret` options. Use sslmode `verify-ca` and omit the client keypair if you are not using mutual tls.

```yaml
backend:
  type: postgres
  postgres:
    host: postgres.postgres.svc.cluster.local
    database: bindplane
    username: postgres
    password: password
    maxConnections: 20
+   sslmode: verify-full # Use verify-ca if not using mutual TLS
+   sslsecret:
+     name: postgres-tls
+     sslrootcertSubPath: ca.crt
+     sslcertSubPath: client.crt # Optional, for mutual TLS
+     sslkeySubPath: client.key # Optional, for mutual TLS
```

Upgrade your Helm deployment to apply the changes. The Bindplane pods should restart without startup errors. If the new Bindplane pod(s) enter a crashloop, check their logs to investigate the error. If the pods come up successfully, TLS is configured and working.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.bindplane.com/how-to-guides/infrastructure-and-operations/postgres/postgres-tls.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.