Replace MySQL use-ssl boolean with explicit connection-parameters (sslMode)

2026-08-07 07:21:43 -04:00
parent 1c16f9a83b
commit f470b30130
4 changed files with 29 additions and 8 deletions
@@ -166,10 +166,21 @@ storage:
    database: blockparty
    username: blockparty
    password: password
-    use-ssl: false
    table-prefix: "bp_"
+    connection-parameters: "sslMode=PREFERRED&verifyServerCertificate=false"
 ```

+`connection-parameters` is appended verbatim to the JDBC URL, so TLS behavior is
+controlled with real MySQL Connector/J flags rather than a single `use-ssl` toggle.
+Common values:
+
+- `sslMode=DISABLED` — no TLS.
+- `sslMode=PREFERRED&verifyServerCertificate=false` (default) — TLS if the server offers
+  it, without validating the certificate; good for a private/internal database host.
+- `sslMode=REQUIRED&verifyServerCertificate=false` — TLS mandatory, certificate not validated.
+- `sslMode=VERIFY_IDENTITY` — TLS mandatory and the server certificate is validated
+  against a trust store (production-grade; requires a properly signed/trusted cert).
+
 The MySQL JDBC driver (`mysql-connector-j`) is bundled in the plugin jar, so no extra
 download is required. The stats table is created automatically on startup if it doesn't
 exist. All queries run asynchronously off the main thread regardless of storage type.