mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-15 23:31:29 +00:00
b5bf09d22d
* fix(db): carry DATABASE_SSLMODE/DATABASE_SSLROOTCERT into the assembled writer and reader URLs The componentized gateway supervisor starts the in-container PgBouncer from the DATABASE_URL assembled out of the discrete DATABASE_* vars before config.yaml is read, so an IAM URL had no way to request verified TLS: PgBouncer dialed the server with server_tls_sslmode = prefer (no SNI, no verification) and public RDS endpoints rejected the handshake. Two new env vars, exposed by the chart as database.writer.sslMode / sslRootCert, are appended as libpq sslmode/sslrootcert to every writer and reader URL the settings assemble (never to a pinned URL), then translated for Prisma as before. Token refresh now also carries Prisma's sslmode/sslcert/sslaccept over into the re-minted URL Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(db): keep TLS params on the CLI password URL and the initial IAM reader mint Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(db): treat DATABASE_SSLROOTCERT on its own as verify-full and cover collector and migrations TLS env Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(db): type the reader mint TLS test double and drop its mutable capture Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| helpers | ||
| prisma_and_spend | ||
| proxy_logging | ||
| __init__.py | ||