Fix self-signed cert error (#64)

* add certificate to droplet, update readme

* update test container job to add crt

.env.template

@@ -7,3 +7,4 @@ POSTGRES_DB_NAME=postgres
 POSTGRES_USERNAME=postgres
 POSTGRES_PASSWORD=postgrespw
 POSTGRES_SSLMODE=require
+CA_CERT=/usr/local/share/ca-certificates/ca-certificate.crt

.github/workflows/test-containers.yml

@@ -13,6 +13,10 @@ jobs:
       run: |
         cp .env.template .env
         sed -i 's/POSTGRES_SSLMODE=require/POSTGRES_SSLMODE=allow/' .env
+    - name: Create dummy certificate
+      run: |
+        mkdir api/certificates
+        touch api/certificates/dummy-cert.crt
     - name: Create PostgreSQL container
       run: docker run -d --name postgres -p 5432:5432 -e POSTGRES_PASSWORD=postgrespw postgres
     - name: Start containers

.gitignore

@@ -3,3 +3,5 @@ oapen-engine/lib/
 .python-version
 private/
 .env
+
+api/certificates/

README.md

@@ -140,7 +140,9 @@ The OAPEN Suggestion Service uses natural-language processing to suggest books b
 
 ### SSL Certificate
 
-> TODO: add documentation
+   > Add information on how to retrieve certificate from DigitalOcean managed DB.
+
+Create a directory in `api` called `certificates`. Once you have acquired a certificate for your managed database, copy it into `/api/certificates`. **Make sure that this file is named `ca-certificate.crt`, or ensure that the name of your certificate matches the `CA_CERT` variable in your `.env`.** 
 
 ## Running
 

api/Dockerfile

@@ -10,8 +10,13 @@ RUN npm install
 # RUN npm ci --only=production
 
 # Bundle app source
+
 COPY . .
 
+COPY ./certificates/* /usr/local/share/ca-certificates/
+
+RUN chmod 644 /usr/local/share/ca-certificates/*.crt && update-ca-certificates
+
 EXPOSE 3001
 
-CMD [ "npm", "start" ]
+CMD [ "npm", "start" ]

api/db/connection.js

@@ -1,5 +1,6 @@
 const options = {};
 const pgp = require("pg-promise")(options);
+const fs = require("fs");
 
 class DatabaseConnectionError extends Error {
   constructor(message) {
@@ -16,7 +17,10 @@ try {
     database: process.env.POSTGRES_DB_NAME,
     user: process.env.POSTGRES_USERNAME,
     password: process.env.POSTGRES_PASSWORD,
-    ssl: process.env.POSTGRES_SSLMODE === "require"
+    ssl: {
+	    rejectUnauthorized: process.env.POSTGRES_SSLMODE === "require",
+	    ca: fs.readFileSync(process.env.CA_CERT).toString(),
+    }
   };
   db = pgp(cn);
 } catch {
@@ -25,4 +29,4 @@ try {
   );
 }
 
-module.exports = db;
+module.exports = db;