diff --git a/roles/serveur_forgejo/defaults/main.yml b/roles/serveur_forgejo/defaults/main.yml
index 3c2e445..1f5b521 100644
--- a/roles/serveur_forgejo/defaults/main.yml
+++ b/roles/serveur_forgejo/defaults/main.yml
@@ -48,3 +48,8 @@ serveur_forgejo_oidc_client_id: "forgejo"
 serveur_forgejo_oidc_client_secret: "{{ vault_forgejo_oidc | default('') }}"  # voûte (vault_forgejo_oidc)
 serveur_forgejo_oidc_realm: "chezlepro"
 serveur_forgejo_oidc_discovery: "https://keycloak.{{ domaine_interne }}/realms/{{ serveur_forgejo_oidc_realm }}/.well-known/openid-configuration"
+
+# TLS vers PostgreSQL (zero-confiance). 'disable' = compat ; 'verify-full' = chiffre + verifie
+# le cert serveur contre le root_ca step-ca (via PGSSLROOTCERT dans l'unite systemd).
+serveur_forgejo_db_sslmode: "disable"
+serveur_forgejo_db_sslrootcert: "/etc/step/certs/root_ca.crt"
diff --git a/roles/serveur_forgejo/templates/app.ini.j2 b/roles/serveur_forgejo/templates/app.ini.j2
index 4af84dd..38574dc 100644
--- a/roles/serveur_forgejo/templates/app.ini.j2
+++ b/roles/serveur_forgejo/templates/app.ini.j2
@@ -17,6 +17,7 @@ HOST = {{ serveur_forgejo_db_host }}:{{ serveur_forgejo_db_port | default(5432)
 NAME = {{ serveur_forgejo_entree.base }}
 USER = {{ serveur_forgejo_entree.proprietaire }}
 PASSWD = {{ serveur_forgejo_db_password }}
+SSL_MODE = {{ serveur_forgejo_db_sslmode | default('disable') }}
 
 [security]
 INSTALL_LOCK = true
diff --git a/roles/serveur_forgejo/templates/forgejo.service.j2 b/roles/serveur_forgejo/templates/forgejo.service.j2
index 790b84e..6ba45f6 100644
--- a/roles/serveur_forgejo/templates/forgejo.service.j2
+++ b/roles/serveur_forgejo/templates/forgejo.service.j2
@@ -15,6 +15,9 @@ RestartSec=5
 Environment=USER={{ serveur_forgejo_utilisateur }}
 Environment=HOME=/home/{{ serveur_forgejo_utilisateur }}
 Environment=GITEA_WORK_DIR={{ serveur_forgejo_data }}
+{% if serveur_forgejo_db_sslmode | default('disable') in ['verify-ca', 'verify-full'] %}
+Environment=PGSSLROOTCERT={{ serveur_forgejo_db_sslrootcert }}
+{% endif %}
 
 [Install]
 WantedBy=multi-user.target