From a51ddc6296ae1c5a86a6975765789c2448a6909c Mon Sep 17 00:00:00 2001
From: Daniel Allaire <allaire.dan@chezlepro.ca>
Date: Sat, 4 Jul 2026 18:53:31 -0400
Subject: [PATCH] =?UTF-8?q?Z=C3=A9ro-confiance=20:=20Forgejo=E2=86=92PG=20?=
 =?UTF-8?q?en=20verify-full?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SSL_MODE=verify-full dans app.ini [database] + PGSSLROOTCERT (root_ca step-ca)
dans l'unité systemd (lib/pq lit l'env). root_ca déjà 0644 (fix client_pki).

Prouvé sur forge-01 : accueil 200, SSL_MODE=verify-full, PGSSLROOTCERT ok,
aucune erreur TLS/DB. Déploiement propre du 1er coup (patron éprouvé).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 roles/serveur_forgejo/defaults/main.yml            | 5 +++++
 roles/serveur_forgejo/templates/app.ini.j2         | 1 +
 roles/serveur_forgejo/templates/forgejo.service.j2 | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/roles/serveur_forgejo/defaults/main.yml b/roles/serveur_forgejo/defaults/main.yml
index 3c2e445..1f5b521 100644
--- a/roles/serveur_forgejo/defaults/main.yml
+++ b/roles/serveur_forgejo/defaults/main.yml
@@ -48,3 +48,8 @@ serveur_forgejo_oidc_client_id: "forgejo"
 serveur_forgejo_oidc_client_secret: "{{ vault_forgejo_oidc | default('') }}"  # voûte (vault_forgejo_oidc)
 serveur_forgejo_oidc_realm: "chezlepro"
 serveur_forgejo_oidc_discovery: "https://keycloak.{{ domaine_interne }}/realms/{{ serveur_forgejo_oidc_realm }}/.well-known/openid-configuration"
+
+# TLS vers PostgreSQL (zero-confiance). 'disable' = compat ; 'verify-full' = chiffre + verifie
+# le cert serveur contre le root_ca step-ca (via PGSSLROOTCERT dans l'unite systemd).
+serveur_forgejo_db_sslmode: "disable"
+serveur_forgejo_db_sslrootcert: "/etc/step/certs/root_ca.crt"
diff --git a/roles/serveur_forgejo/templates/app.ini.j2 b/roles/serveur_forgejo/templates/app.ini.j2
index 4af84dd..38574dc 100644
--- a/roles/serveur_forgejo/templates/app.ini.j2
+++ b/roles/serveur_forgejo/templates/app.ini.j2
@@ -17,6 +17,7 @@ HOST = {{ serveur_forgejo_db_host }}:{{ serveur_forgejo_db_port | default(5432)
 NAME = {{ serveur_forgejo_entree.base }}
 USER = {{ serveur_forgejo_entree.proprietaire }}
 PASSWD = {{ serveur_forgejo_db_password }}
+SSL_MODE = {{ serveur_forgejo_db_sslmode | default('disable') }}
 
 [security]
 INSTALL_LOCK = true
diff --git a/roles/serveur_forgejo/templates/forgejo.service.j2 b/roles/serveur_forgejo/templates/forgejo.service.j2
index 790b84e..6ba45f6 100644
--- a/roles/serveur_forgejo/templates/forgejo.service.j2
+++ b/roles/serveur_forgejo/templates/forgejo.service.j2
@@ -15,6 +15,9 @@ RestartSec=5
 Environment=USER={{ serveur_forgejo_utilisateur }}
 Environment=HOME=/home/{{ serveur_forgejo_utilisateur }}
 Environment=GITEA_WORK_DIR={{ serveur_forgejo_data }}
+{% if serveur_forgejo_db_sslmode | default('disable') in ['verify-ca', 'verify-full'] %}
+Environment=PGSSLROOTCERT={{ serveur_forgejo_db_sslrootcert }}
+{% endif %}
 
 [Install]
 WantedBy=multi-user.target