starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Headscale can not connect to postgresql with SNI in used. #366

New Issue
Closed
opened 2025-12-29 01:27:44 +01:00 by adam · 0 comments
adam commented 2025-12-29 01:27:44 +01:00
Owner
Copy Link

Originally created by @OrvilleQ on GitHub (Nov 3, 2022).

Bug description

Can't get postgresql works with TLS and SNI.

To Reproduce

Try connect to a postgresql database with SNI in used.

Context info

Refs to this document of neon, a hosted postgresql service.

If your application or service uses golang PostgreSQL clients like pgx and lib/pg you can set sslmode=verify-full, which will cause SNI info to be sent. Most likely, this was not intentional but happened inadvertently due to the golang's TLS library API design.

But in headscale, db_ssl is defined as a bool DBssl.

ca8bca98ed/config.go (L543)

Therefore ssl_mode can only be disabled or require (psql's default), and user won't be able to connect to any hosted postgresql server depend on SNI in TLS.

I suggest we change DBssl to string to fix this issue.

Originally created by @OrvilleQ on GitHub (Nov 3, 2022). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the bug report in this language. --> **Bug description** <!-- A clear and concise description of what the bug is. Describe the expected bahavior and how it is currently different. If you are unsure if it is a bug, consider discussing it on our Discord server first. --> Can't get postgresql works with TLS and SNI. **To Reproduce** Try connect to a postgresql database with SNI in used. <!-- Steps to reproduce the behavior. --> **Context info** Refs to [this]() document of neon, a hosted postgresql service. ``` If your application or service uses golang PostgreSQL clients like pgx and lib/pg you can set sslmode=verify-full, which will cause SNI info to be sent. Most likely, this was not intentional but happened inadvertently due to the golang's TLS library API design. ``` But in headscale, `db_ssl` is defined as a bool `DBssl`. https://github.com/juanfont/headscale/blob/ca8bca98edca4dced2331071ef67fa0e0b0d0942/config.go#L543 Therefore `ssl_mode` can only be `disabled` or `require` (psql's default), and user won't be able to connect to any hosted postgresql server depend on SNI in TLS. I suggest we change `DBssl` to string to fix this issue. <!-- Please add relevant information about your system. For example: - Version of headscale used - Version of tailscale client - OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version - Kernel version - The relevant config parameters you used - Log output -->
adam added the bug label 2025-12-29 01:27:44 +01:00
adam closed this issue 2025-12-29 01:27:44 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#366
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?