Add SSLMODE to database connection settings

[sdktr]

Defaulting to SSLMODE=prefer, optional override using environment variable: DB_SSLMODE

[cimnine]

Thank you for this PR. Would you mind (a) explaining the motivation for this proposed change and (b) resolving the merge conflict so that this feature would be able to merge?

[sdktr]

Thank you for this PR. Would you mind (a) explaining the motivation for this proposed change and (b) resolving the merge conflict so that this feature would be able to merge?

This PR introduces an optional database connection security setting. This allows for accessing (external) postgres backends that happen to prefer or demand a transport layer encryption/authentication other than the default plain text.

To avoid any negative effects for setups that do not include this setting, this PR defaults to 'prefer' which uses SSL if the servers supports it but still runs unaffected when the server has no support.

We've been running with sslmode=require connecting to an Azure Postgres PaaS backend for > 1 month now with good results on performance and security.

sslmode	Eavesdropping protection	MITM protection	Statement
disable	No	No	I don't care about security, and I don't want to pay the overhead of encryption.
allow	Maybe	No	I don't care about security, but I will pay the overhead of encryption if the server insists on it.
prefer	Maybe	No	I don't care about encryption, but I wish to pay the overhead of encryption if the server supports it.
require	Yes	No	I want my data to be encrypted, and I accept the overhead. I trust that the network will make sure I always connect to the server I want.
verify-ca	Yes	Depends on CA-policy	I want my data encrypted, and I accept the overhead. I want to be sure that I connect to a server that I trust.
verify-full	Yes	Yes	I want my data encrypted, and I accept the overhead. I want to be sure that I connect to a server I trust, and that it's the one I specify.

[cimnine]

Thank you for the explanation. I believe you have found the sweet spot between out-of-the-box security and backwards-compatibility with this.

I will merge the PR and it will land in the develop branch. This is our new staging area for future releases of Netbox Docker.