fix: secure sql (#21)

* use new cert loaded in dockerfile

docker/Dockerfile

@@ -6,7 +6,7 @@ WORKDIR /usr/src/app
 RUN apk update && apk add bash curl
 
 RUN mkdir -p /usr/local/certs/ca-certificates
-RUN curl -ks 'https://s3.amazonaws.com/rds-downloads/rds-ca-2015-root.pem' -o '/usr/local/certs/ca-certificates/rds-ca-2015-root.pem'
+RUN curl -ks 'https://truststore.pki.rds.amazonaws.com/us-west-2/us-west-2-bundle.pem' -o '/usr/local/certs/ca-certificates/us-west-2-bundle.pem'
 
 COPY . .
 
@@ -33,7 +33,7 @@ COPY --from=builder /usr/src/app/packages/backend/tsconfig.json /usr/src/app
 
 COPY --from=builder /usr/src/app/packages/frontend/build /usr/src/app/public
 
-COPY --from=builder /usr/local/certs/ca-certificates/rds-ca-2015-root.pem /usr/local/certs/ca-certificates/rds-ca-2015-root.pem
+COPY --from=builder /usr/local/certs/ca-certificates/us-west-2-bundle.pem /usr/local/certs/ca-certificates/us-west-2-bundle.pem
 
 RUN yarn install --production
 

packages/backend/config/config.ts

@@ -10,6 +10,7 @@ export interface Config {
   JWTSecret: string;
   Port: number;
   PostgresConnectionURL: string;
+  PostgresSSLCertPath?: string;
 }
 
 function getCORSWhitelist(): string[] {
@@ -39,6 +40,8 @@ export function getConfig(): Config {
     Port: parseInt((process.env.BACKEND_PORT as string) ?? '3001', 10),
     PostgresConnectionURL:
       (process.env.POSTGRES_CONNECTION_URL as string) ?? '',
+    PostgresSSLCertPath:
+      '/usr/local/certs/ca-certificates/us-west-2-bundle.pem',
   };
 
   return config;

packages/backend/index.ts

@@ -87,6 +87,15 @@ console.log('using postgres session store');
 const PostgresqlStore = genFunc(session);
 const sessionStore = new PostgresqlStore({
   conString: config.PostgresConnectionURL,
+  conObject: {
+    connectionString: config.PostgresConnectionURL,
+    ssl:
+      config.Environment === 'production'
+        ? {
+            cert: fs.readFileSync(config.PostgresSSLCertPath).toString(),
+          }
+        : false,
+  },
 });
 
 app.use(