add a config option to require TLS on postgres

pg/protocol.go

@@ -100,6 +100,8 @@ func (s *Server) handle(ctx context.Context, conn net.Conn) (err error) {
 		}
 	}
 
+	var hasTLS bool
+
 startup:
 	// Read startup packet.
 	var buf [4]byte
@@ -151,6 +153,7 @@ startup:
 					return errors.Wrap(err, "transferring startup deadline to TLS connection")
 				}
 			}
+			hasTLS = true
 			goto startup
 		}
 
@@ -163,6 +166,11 @@ startup:
 		goto startup
 	}
 
+	if s.RequireTLS && !hasTLS {
+		// Reject the unsecured connection.
+		return errors.Errorf("client at %s attempted to initiate an unsecured postgres conenction", conn.RemoteAddr())
+	}
+
 	// Handle regular postgres.
 	return s.handleStandard(ctx, proto, conn, data)
 }

pg/server.go

@@ -35,6 +35,10 @@ type Server struct {
 	// TLSConfig is the TLS configuration to use to serve postgres TLS connections.
 	TLSConfig *tls.Config
 
+	// RequireTLS rejects unencrypted postgres connections.
+	// This allows for mTLS to be used as auth.
+	RequireTLS bool
+
 	// StartupTimeout is the timeout to use for connection startup.
 	// If a connection fails to set up a protocol before this completes, it will be terminated.
 	StartupTimeout time.Duration

server/config.go

@@ -174,6 +174,8 @@ type Config struct {
 		// TLS configuration for postgres connections.
 		TLS TLSConfig `toml:"tls"`
 
+		RequireTLS bool `toml:"require-tls"`
+
 		StartupTimeout toml.Duration `toml:"startup-timeout"`
 		ReadTimeout    toml.Duration `toml:"read-timeout"`
 		WriteTimeout   toml.Duration `toml:"write-timout"`

server/server.go

@@ -191,6 +191,7 @@ func (m *Command) Start() (err error) {
 		m.pgserver.s.WriteTimeout = time.Duration(m.Config.Postgres.WriteTimeout)
 		m.pgserver.s.MaxStartupSize = m.Config.Postgres.MaxStartupSize
 		m.pgserver.s.ConnectionLimit = m.Config.Postgres.ConnectionLimit
+		m.pgserver.s.RequireTLS = m.Config.Postgres.RequireTLS
 		err := m.pgserver.Start(m.Config.Postgres.Addr)
 		if err != nil {
 			return errors.Wrap(err, "starting postgres")