Add more tls config values to pgbouncer.ini (#633)

vitabaks · Apr 19, 2024 · 3bbd3e1 · 3bbd3e1
1 parent 8e7151c
commit 3bbd3e1
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/roles/pgbouncer/templates/pgbouncer.ini.j2 b/roles/pgbouncer/templates/pgbouncer.ini.j2
@@ -39,6 +39,9 @@ so_reuseport = 1
 client_tls_sslmode = {{ pgbouncer_client_tls_sslmode }}
 client_tls_key_file = {{ pgbouncer_client_tls_key_file }}
 client_tls_cert_file = {{ pgbouncer_client_tls_cert_file }}
+client_tls_ca_file = {{ pgbouncer_client_tls_ca_file }}
+client_tls_protocols = {{ pgbouncer_client_tls_protocols }}
+client_tls_ciphers = {{ pgbouncer_client_tls_ciphers }}
 {% endif %}
 log_connections = 0
 log_disconnections = 0

diff --git a/vars/main.yml b/vars/main.yml
@@ -325,6 +325,9 @@ pgbouncer_auth_dbname: "postgres"
 pgbouncer_client_tls_sslmode: "disable"
 pgbouncer_client_tls_key_file: ""
 pgbouncer_client_tls_cert_file: ""
+pgbouncer_client_tls_ca_file: ""
+pgbouncer_client_tls_protocols: "secure" # allowed values: tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3, all, secure (tlsv1.2,tlsv1.3)
+pgbouncer_client_tls_ciphers: "default" # allowed values: default, secure, fast, normal, all (not recommended)
 
 pgbouncer_pools:
   - { name: "postgres", dbname: "postgres", pool_parameters: "" }