Headscale can not connect to postgresql with SNI in used.

[OrvilleQ]

Bug description

Can't get postgresql works with TLS and SNI.

To Reproduce

Try connect to a postgresql database with SNI in used.

Context info

Refs to this document of neon, a hosted postgresql service.

If your application or service uses golang PostgreSQL clients like pgx and lib/pg you can set sslmode=verify-full, which will cause SNI info to be sent. Most likely, this was not intentional but happened inadvertently due to the golang's TLS library API design.

But in headscale, db_ssl is defined as a bool DBssl.

headscale/config.go

Line 543 in ca8bca9

DBssl: viper.GetBool("db_ssl"),

Therefore ssl_mode can only be disabled or require (psql's default), and user won't be able to connect to any hosted postgresql server depend on SNI in TLS.

I suggest we change DBssl to string to fix this issue.