mTLS based Passwordless Authentication to Postgres DB

[dokhremenko]

Feature Description

Postgres DB supports passwordless authentication based on mutual TLS client-server certificates.
Can such a mechanism be implemented for Gitea? Probably it's not supported by PG driver https://pkg.go.dev/github.com/lib/pq used in Gitea but maybe such an approach can be evaluated?

Screenshots

No response

[lunny]

It depends on the upstream library. Please send an issue also to the upstream repository.

[lafriks]

Both lib/pq and pgx does support this

[dokhremenko]

Hi @lunny
I double checked and, as @lafriks mentioned, mTLS based auth is supported by underlying libs.
But after fast code checking I didn't find relevant parameters for db needed to pass certificates, something similar to SSL_MODE, but for sslcert, sslkey, sslcacert

So it can be assumed that issue is in Gitea itself.

May ask you if it going to be supported by Gitea(or maybe I missed something and it is already supported)?

[dokhremenko]

It was working for me to just to pass env vars PGSSLROOTCERT, PGSSLCERT, PGSSLKEY with the path to certs, and remove PASSWD env from gitea config