From f470b301307604f8e066073ae747808bd09e5bb9 Mon Sep 17 00:00:00 2001
From: Michael Burgess <msburgess3200@hotmail.com>
Date: Fri, 7 Aug 2026 07:21:43 -0400
Subject: [PATCH] Replace MySQL use-ssl boolean with explicit
 connection-parameters (sslMode)

---
 README.md                                           | 13 ++++++++++++-
 .../us/tss3/blockparty/config/ConfigManager.java    |  6 +++---
 .../tss3/blockparty/persistence/StatsDatabase.java  | 11 ++++++++---
 src/main/resources/config.yml                       |  7 ++++++-
 4 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 953b7ab..9884b00 100644
--- a/README.md
+++ b/README.md
@@ -166,10 +166,21 @@ storage:
     database: blockparty
     username: blockparty
     password: password
-    use-ssl: false
     table-prefix: "bp_"
+    connection-parameters: "sslMode=PREFERRED&verifyServerCertificate=false"
 ```
 
+`connection-parameters` is appended verbatim to the JDBC URL, so TLS behavior is
+controlled with real MySQL Connector/J flags rather than a single `use-ssl` toggle.
+Common values:
+
+- `sslMode=DISABLED` — no TLS.
+- `sslMode=PREFERRED&verifyServerCertificate=false` (default) — TLS if the server offers
+  it, without validating the certificate; good for a private/internal database host.
+- `sslMode=REQUIRED&verifyServerCertificate=false` — TLS mandatory, certificate not validated.
+- `sslMode=VERIFY_IDENTITY` — TLS mandatory and the server certificate is validated
+  against a trust store (production-grade; requires a properly signed/trusted cert).
+
 The MySQL JDBC driver (`mysql-connector-j`) is bundled in the plugin jar, so no extra
 download is required. The stats table is created automatically on startup if it doesn't
 exist. All queries run asynchronously off the main thread regardless of storage type.
diff --git a/src/main/java/us/tss3/blockparty/config/ConfigManager.java b/src/main/java/us/tss3/blockparty/config/ConfigManager.java
index d7c7d1e..f2fd72f 100644
--- a/src/main/java/us/tss3/blockparty/config/ConfigManager.java
+++ b/src/main/java/us/tss3/blockparty/config/ConfigManager.java
@@ -90,14 +90,14 @@ public class ConfigManager {
                 config.getString("storage.mysql.database", "blockparty"),
                 config.getString("storage.mysql.username", "blockparty"),
                 config.getString("storage.mysql.password", ""),
-                config.getBoolean("storage.mysql.use-ssl", false),
-                config.getString("storage.mysql.table-prefix", "bp_")
+                config.getString("storage.mysql.table-prefix", "bp_"),
+                config.getString("storage.mysql.connection-parameters", "sslMode=PREFERRED&verifyServerCertificate=false")
         );
     }
 
     /** Immutable snapshot of the storage.* config section. */
     public record StorageSettings(String type, String host, int port, String database,
-                                   String username, String password, boolean useSsl, String tablePrefix) {
+                                   String username, String password, String tablePrefix, String connectionParameters) {
 
         public boolean isMysql() {
             return "mysql".equalsIgnoreCase(type);
diff --git a/src/main/java/us/tss3/blockparty/persistence/StatsDatabase.java b/src/main/java/us/tss3/blockparty/persistence/StatsDatabase.java
index 489656f..fcc7505 100644
--- a/src/main/java/us/tss3/blockparty/persistence/StatsDatabase.java
+++ b/src/main/java/us/tss3/blockparty/persistence/StatsDatabase.java
@@ -53,9 +53,14 @@ public class StatsDatabase {
 
     private void connectMysql() throws Exception {
         Class.forName("com.mysql.cj.jdbc.Driver");
-        String url = "jdbc:mysql://" + settings.host() + ":" + settings.port() + "/" + settings.database()
-                + "?useSSL=" + settings.useSsl() + "&autoReconnect=true&characterEncoding=utf8";
-        connection = DriverManager.getConnection(url, settings.username(), settings.password());
+        String extra = settings.connectionParameters() == null ? "" : settings.connectionParameters().trim();
+        StringBuilder url = new StringBuilder("jdbc:mysql://")
+                .append(settings.host()).append(':').append(settings.port()).append('/').append(settings.database())
+                .append("?autoReconnect=true&characterEncoding=utf8");
+        if (!extra.isEmpty()) {
+            url.append('&').append(extra);
+        }
+        connection = DriverManager.getConnection(url.toString(), settings.username(), settings.password());
     }
 
     private String createTableStatement() {
diff --git a/src/main/resources/config.yml b/src/main/resources/config.yml
index b95bc83..da51b36 100644
--- a/src/main/resources/config.yml
+++ b/src/main/resources/config.yml
@@ -54,8 +54,13 @@ storage:
     database: blockparty
     username: blockparty
     password: password
-    use-ssl: false
     table-prefix: "bp_"
+    # Raw JDBC connection parameters appended to the connection URL (without a leading '?' or '&').
+    # Tune SSL/TLS behavior here instead of a single use-ssl toggle, e.g.:
+    #   "sslMode=REQUIRED&verifyServerCertificate=false"
+    #   "sslMode=VERIFY_IDENTITY" (validates the server cert against a trust store)
+    #   "sslMode=DISABLED" (no TLS at all)
+    connection-parameters: "sslMode=PREFERRED&verifyServerCertificate=false"
 
 rewards:
   winner: