fix(powersync): disable TLS for in-cluster CNPG

.github/workflows/pr.yaml

@@ -55,22 +55,3 @@ jobs:
         with:
           version: v2.5.0
           args: --timeout=5m
-
-  docker:
-    runs-on: ubuntu-latest
-    needs: [build, lint]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: false
-          platforms: linux/amd64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max

hack/test-delivery.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "${repo_root}"
 
-for workflow in .github/workflows/ci.yaml .github/workflows/pr.yaml .github/workflows/release.yaml; do
+for workflow in .github/workflows/ci.yaml .github/workflows/release.yaml; do
   grep -Fq 'platforms: linux/amd64' "${workflow}"
 done
 if grep -R -q 'linux/arm64' .github/workflows Makefile; then

internal/resources/configmaps/powersync.go

@@ -49,10 +49,12 @@ func BuildPowersyncConfigMap(project *supabasev1alpha1.SupabaseProject) *corev1.
 	configYAML := fmt.Sprintf(`storage:
   type: postgresql
   uri: !env PS_POWERSYNC_STORAGE_URI
+  sslmode: disable
 replication:
   connections:
     - type: postgresql
       uri: !env PS_POWERSYNC_REPLICATION_URI
+      sslmode: disable
       tag: default
 dev:
   demo_auth: false

internal/resources/configmaps/powersync_test.go

@@ -17,14 +17,16 @@ const (
 
 type powersyncConfig struct {
 	Storage struct {
-		Type string `json:"type"`
-		URI  string `json:"uri"`
+		Type    string `json:"type"`
+		URI     string `json:"uri"`
+		SSLMode string `json:"sslmode"`
 	} `json:"storage"`
 	Replication struct {
 		Connections []struct {
-			Type string `json:"type"`
-			URI  string `json:"uri"`
-			Tag  string `json:"tag"`
+			Type    string `json:"type"`
+			URI     string `json:"uri"`
+			SSLMode string `json:"sslmode"`
+			Tag     string `json:"tag"`
 		} `json:"connections"`
 	} `json:"replication"`
 	ClientAuth struct {
@@ -131,6 +133,9 @@ func TestBuildPowersyncConfigMap(t *testing.T) {
 	if config.Storage.URI != "PS_POWERSYNC_STORAGE_URI" {
 		t.Errorf("storage URI = %q, want environment template", config.Storage.URI)
 	}
+	if config.Storage.SSLMode != "disable" {
+		t.Errorf("storage sslmode = %q, want disable", config.Storage.SSLMode)
+	}
 	if !strings.Contains(configYAML, "uri: !env PS_POWERSYNC_STORAGE_URI") {
 		t.Error("storage URI must use PowerSync's !env tag")
 	}
@@ -149,6 +154,9 @@ func TestBuildPowersyncConfigMap(t *testing.T) {
 	if conn.URI != "PS_POWERSYNC_REPLICATION_URI" {
 		t.Errorf("replication URI = %q, want environment template", conn.URI)
 	}
+	if conn.SSLMode != "disable" {
+		t.Errorf("replication sslmode = %q, want disable", conn.SSLMode)
+	}
 	if !strings.Contains(configYAML, "uri: !env PS_POWERSYNC_REPLICATION_URI") {
 		t.Error("replication URI must use PowerSync's !env tag")
 	}

internal/resources/deployments/powersync.go

@@ -373,11 +373,11 @@ func buildPowersyncEnv(project *supabasev1alpha1.SupabaseProject, secretNames *s
 		// PowerSync resolves !env PS_* tags in config.yaml.
 		{
 			Name:  "PS_POWERSYNC_STORAGE_URI",
-			Value: fmt.Sprintf("postgresql://powersync_storage:$(PS_STORAGE_PASSWORD)@%s:5432/supabase?sslmode=disable", dbHost),
+			Value: fmt.Sprintf("postgresql://powersync_storage:$(PS_STORAGE_PASSWORD)@%s:5432/supabase", dbHost),
 		},
 		{
 			Name:  "PS_POWERSYNC_REPLICATION_URI",
-			Value: fmt.Sprintf("postgresql://powersync_replication:$(PS_REPLICATION_PASSWORD)@%s:5432/supabase?sslmode=disable", dbHost),
+			Value: fmt.Sprintf("postgresql://powersync_replication:$(PS_REPLICATION_PASSWORD)@%s:5432/supabase", dbHost),
 		},
 	}
 }

internal/resources/deployments/powersync_test.go

@@ -2,6 +2,7 @@ package deployments
 
 import (
 	"slices"
+	"strings"
 	"testing"
 
 	supabasev1alpha1 "github.com/GuionAI/cloudnative-supabase/api/v1alpha1"
@@ -284,9 +285,9 @@ func TestBuildPowersyncEnvVars(t *testing.T) {
 	dep := BuildPowersyncAPIDeployment(project, secretNames)
 	env := dep.Spec.Template.Spec.Containers[0].Env
 
-	envMap := make(map[string]struct{})
+	envMap := make(map[string]string)
 	for _, e := range env {
-		envMap[e.Name] = struct{}{}
+		envMap[e.Name] = e.Value
 	}
 
 	required := []string{"POWERSYNC_CONFIG_PATH", "NODE_OPTIONS", "LOG_FORMAT", "METRICS_PORT", "MICRO_PROBE_TYPE", "PS_STORAGE_PASSWORD", "PS_REPLICATION_PASSWORD", "PS_POWERSYNC_STORAGE_URI", "PS_POWERSYNC_REPLICATION_URI"}
@@ -300,4 +301,9 @@ func TestBuildPowersyncEnvVars(t *testing.T) {
 			t.Errorf("POWERSYNC_CONFIG_PATH = %q, want config.yaml", env.Value)
 		}
 	}
+	for _, name := range []string{"PS_POWERSYNC_STORAGE_URI", "PS_POWERSYNC_REPLICATION_URI"} {
+		if strings.Contains(envMap[name], "sslmode=") {
+			t.Errorf("%s must leave TLS policy to config.yaml, got %q", name, envMap[name])
+		}
+	}
 }