require TLS when configured

ctl/server.go

@@ -92,7 +92,6 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) {
 	// Postgres endpoint
 	flags.StringVar(&srv.Config.Postgres.Addr, "postgres.addr", srv.Config.Postgres.Addr, "address to which to bind a postgres endpoint (leave blank to disable)")
 	SetTLSConfig(flags, "postgres.", &srv.Config.Postgres.TLS.CertificatePath, &srv.Config.Postgres.TLS.CertificateKeyPath, &srv.Config.Postgres.TLS.CACertPath, &srv.Config.Postgres.TLS.SkipVerify, &srv.Config.Postgres.TLS.EnableClientVerification)
-	flags.BoolVar(&srv.Config.Postgres.RequireTLS, "postgres.tls.require", srv.Config.Postgres.RequireTLS, "Require TLS on all incoming postgres connections.")
 	flags.DurationVar((*time.Duration)(&srv.Config.Postgres.StartupTimeout), "postgres.startup-timeout", time.Duration(srv.Config.Postgres.StartupTimeout), "Timeout for postgres connection startup. (set 0 to disable)")
 	flags.DurationVar((*time.Duration)(&srv.Config.Postgres.ReadTimeout), "postgres.read-timeout", time.Duration(srv.Config.Postgres.ReadTimeout), "Timeout for reads on a postgres connection. (set 0 to disable; does not include connection idling)")
 	flags.DurationVar((*time.Duration)(&srv.Config.Postgres.WriteTimeout), "postgres.write-timeout", time.Duration(srv.Config.Postgres.WriteTimeout), "Timeout for writes on a postgres connection. (set 0 to disable)")

pg/protocol.go

@@ -172,7 +172,7 @@ startup:
 		goto startup
 	}
 
-	if s.RequireTLS && !hasTLS {
+	if s.TLSConfig != nil && !hasTLS {
 		// Reject the unsecured connection.
 		return errors.Errorf("client at %s attempted to initiate an unsecured postgres conenction", conn.RemoteAddr())
 	}

pg/server.go

@@ -35,10 +35,6 @@ type Server struct {
 	// TLSConfig is the TLS configuration to use to serve postgres TLS connections.
 	TLSConfig *tls.Config
 
-	// RequireTLS rejects unencrypted postgres connections.
-	// This allows for mTLS to be used as auth.
-	RequireTLS bool
-
 	// StartupTimeout is the timeout to use for connection startup.
 	// If a connection fails to set up a protocol before this completes, it will be terminated.
 	StartupTimeout time.Duration

server/config.go

@@ -174,8 +174,6 @@ type Config struct {
 		// TLS configuration for postgres connections.
 		TLS TLSConfig `toml:"tls"`
 
-		RequireTLS bool `toml:"require-tls"`
-
 		StartupTimeout toml.Duration `toml:"startup-timeout"`
 		ReadTimeout    toml.Duration `toml:"read-timeout"`
 		WriteTimeout   toml.Duration `toml:"write-timout"`

server/server.go

@@ -191,7 +191,6 @@ func (m *Command) Start() (err error) {
 		m.pgserver.s.WriteTimeout = time.Duration(m.Config.Postgres.WriteTimeout)
 		m.pgserver.s.MaxStartupSize = m.Config.Postgres.MaxStartupSize
 		m.pgserver.s.ConnectionLimit = m.Config.Postgres.ConnectionLimit
-		m.pgserver.s.RequireTLS = m.Config.Postgres.RequireTLS
 		err := m.pgserver.Start(m.Config.Postgres.Addr)
 		if err != nil {
 			return errors.Wrap(err, "starting postgres")