How do I connect through TLS to tokio-postgres database?

[haasal]

I can only connect to my database through a secure context (i.e. TLS). However for this to work I had to replace the NoTls enum in connect_raw through some actual TLS connector implementation. Unfortunately there are only two solutions available: One with native-tls and one with openssl. Both don't compile to wasm. The only option would be using rustls but there isn't a crate that connects rustls to the tokio-postgres crate. What is they way you would use TLS?

[kflansburg]

If you create a socket with SecureTransport::On, Cloudflare will handle TLS for you. Some databases require StartTls (I believe Postgres is one of them). I don't know if Postgres expects any data to be sent in plaintext or if you can upgrade right away. You may be able to do something like:

let plaintext = Socket::builder()
    .secure_transport(SecureTransport::StartTls)
    .connect("host", 5432);
let socket = plaintext.start_tls();

// Pass to tokio-postgres, with `tokio_postgres::tls::NoTls`
// as far as it is concerned, it is just a plaintext socket.

[haasal]

Ok thanks. Now this doesn't crash on the socket connection but on connect_raw() with tokio-postgres: Error { kind: Io, cause: Some(Custom { kind: UnexpectedEof, error: "early eof" }) }.
This is giving me real headaches.

    let mut config = tokio_postgres::config::Config::new();
    config.user("<redacted>");
    config.password("<redacted>");
    config.dbname("<redacted>");
    config.ssl_mode(SslMode::Require);

    let socket = Socket::builder()
        .secure_transport(SecureTransport::StartTls)
        .connect("<redacted>.eu-central-1.aws.neon.tech", 5432)?;
    let socket = socket.start_tls();

    let (_client, connection) = config
        .connect_raw(socket, NoTls)
        .await
        .map_err(|e| worker::Error::RustError(format!("tokio-postgres: {:?}", e)))?;

    wasm_bindgen_futures::spawn_local(async move {
        if let Err(error) = connection.await {
            console_log!("connection error: {:?}", error);
        }
    });

I can connect through psql with identical credentials.

[kflansburg]

It sounds like Postgres may be closing the connection due to missing some data before start tls is initiated. Unfortunately I’m not super familiar with the start tls protocol or how Postgres uses it.

[kflansburg]

Could you try with SecureTransport::On? And no call to start_tls()

[haasal]

That's what I tried first. In that case I got the error that my connection was unexpectedly closed :/

[haasal]

So depending on the environment and TLS type I get different errors:

	SecureTransport::On	SecureTransport::StartTls
wrangler dev -r	tokio-postgres: Error { kind: Io, cause: Some(Custom { kind: Other, error: "Error: Stream was cancelled." }) }	tokio-postgres: Error { kind: Io, cause: Some(Custom { kind: UnexpectedEof, error: "early eof" }) }
wrangler dev	tokio-postgres: Error { kind: Io, cause: Some(Custom { kind: Other, error: "Error: Network connection lost." }) }	tokio-postgres: Error { kind: Io, cause: Some(Custom { kind: Other, error: "Error: Network connection lost." }) }