Skip to content

Clarify Postgres connection guidance: TLS recommendation is not server enforcement #1002

Description

@sdairs

Human Postgres connection output says TLS required, but the managed Postgres service exercised in the 23 September release QA accepted a plaintext connection. This is a small output/help correction; changing backend enforcement is outside this issue.

Tested installed CLI 0.5.0, main df81e46cfec0bb58ea981d17cc6fd2de24442e7d.

Observed on an owned disposable service:

  • Human cloud postgres get printed Connection: ...; TLS required.
  • A connection with PGSSLMODE=disable succeeded. SELECT ssl FROM pg_stat_ssl WHERE pid=pg_backend_pid() returned false.
  • A separate verify-full connection using the service CA succeeded with TLS1.3.

The claim is emitted by render_postgres_connection_guidance, shared by get, read-replica creation and restore.

Change the guidance to distinguish the recommended connection practice from a server-enforced requirement, for example use verified TLS. Preserve the existing CA/connection workflow and JSON shapes. Do not infer that every managed service accepts plaintext or weaken connection defaults.

This is a focused follow-up to closed #836, whose scope added connection recovery guidance; no existing open issue specifically covered this inaccurate enforcement claim. No release milestone or blocker designation is requested.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationImprovements or additions to documentation

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions