Replace MySQL use-ssl boolean with explicit connection-parameters (sslMode)

README.md

@@ -166,10 +166,21 @@ storage:
     database: blockparty
     username: blockparty
     password: password
-    use-ssl: false
     table-prefix: "bp_"
+    connection-parameters: "sslMode=PREFERRED&verifyServerCertificate=false"
 ```
 
+`connection-parameters` is appended verbatim to the JDBC URL, so TLS behavior is
+controlled with real MySQL Connector/J flags rather than a single `use-ssl` toggle.
+Common values:
+
+- `sslMode=DISABLED` — no TLS.
+- `sslMode=PREFERRED&verifyServerCertificate=false` (default) — TLS if the server offers
+  it, without validating the certificate; good for a private/internal database host.
+- `sslMode=REQUIRED&verifyServerCertificate=false` — TLS mandatory, certificate not validated.
+- `sslMode=VERIFY_IDENTITY` — TLS mandatory and the server certificate is validated
+  against a trust store (production-grade; requires a properly signed/trusted cert).
+
 The MySQL JDBC driver (`mysql-connector-j`) is bundled in the plugin jar, so no extra
 download is required. The stats table is created automatically on startup if it doesn't
 exist. All queries run asynchronously off the main thread regardless of storage type.

src/main/java/us/tss3/blockparty/config/ConfigManager.java

@@ -90,14 +90,14 @@ public class ConfigManager {
                 config.getString("storage.mysql.database", "blockparty"),
                 config.getString("storage.mysql.username", "blockparty"),
                 config.getString("storage.mysql.password", ""),
-                config.getBoolean("storage.mysql.use-ssl", false),
+                config.getString("storage.mysql.table-prefix", "bp_"),
-                config.getString("storage.mysql.table-prefix", "bp_")
+                config.getString("storage.mysql.connection-parameters", "sslMode=PREFERRED&verifyServerCertificate=false")
         );
     }
 
     /** Immutable snapshot of the storage.* config section. */
     public record StorageSettings(String type, String host, int port, String database,
-                                   String username, String password, boolean useSsl, String tablePrefix) {
+                                   String username, String password, String tablePrefix, String connectionParameters) {
 
         public boolean isMysql() {
             return "mysql".equalsIgnoreCase(type);

src/main/java/us/tss3/blockparty/persistence/StatsDatabase.java

@@ -53,9 +53,14 @@ public class StatsDatabase {
 
     private void connectMysql() throws Exception {
         Class.forName("com.mysql.cj.jdbc.Driver");
-        String url = "jdbc:mysql://" + settings.host() + ":" + settings.port() + "/" + settings.database()
+        String extra = settings.connectionParameters() == null ? "" : settings.connectionParameters().trim();
-                + "?useSSL=" + settings.useSsl() + "&autoReconnect=true&characterEncoding=utf8";
+        StringBuilder url = new StringBuilder("jdbc:mysql://")
-        connection = DriverManager.getConnection(url, settings.username(), settings.password());
+                .append(settings.host()).append(':').append(settings.port()).append('/').append(settings.database())
+                .append("?autoReconnect=true&characterEncoding=utf8");
+        if (!extra.isEmpty()) {
+            url.append('&').append(extra);
+        }
+        connection = DriverManager.getConnection(url.toString(), settings.username(), settings.password());
     }
 
     private String createTableStatement() {

src/main/resources/config.yml

@@ -54,8 +54,13 @@ storage:
     database: blockparty
     username: blockparty
     password: password
-    use-ssl: false
     table-prefix: "bp_"
+    # Raw JDBC connection parameters appended to the connection URL (without a leading '?' or '&').
+    # Tune SSL/TLS behavior here instead of a single use-ssl toggle, e.g.:
+    #   "sslMode=REQUIRED&verifyServerCertificate=false"
+    #   "sslMode=VERIFY_IDENTITY" (validates the server cert against a trust store)
+    #   "sslMode=DISABLED" (no TLS at all)
+    connection-parameters: "sslMode=PREFERRED&verifyServerCertificate=false"
 
 rewards:
   winner: