{"record":{"id":"be48325390daf511","repo":"JuliusBrussee/caveman","slug":"postgres-production-database-url-requires-sslmode","errorCode":null,"errorMessage":"postgres: production DATABASE_URL requires sslmode=verify-full","messagePattern":"postgres: production DATABASE_URL requires sslmode=verify-full","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/postgresconfig/postgresconfig.go","lineNumber":37,"sourceCode":")\n\nconst (\n\tcaEnvironment     = \"CAVE_POSTGRES_CA_CERT\"\n\tcaFileEnvironment = \"CAVE_POSTGRES_CA_CERT_FILE\"\n)\n\n// ParsePoolConfig validates the connection string and applies the managed\n// database CA to every TLS path. Production rejects sslmode=require because it\n// encrypts without authenticating the server; verify-full is mandatory.\nfunc ParsePoolConfig(databaseURL string) (*pgxpool.Config, error) {\n\tproduction := runtimeenv.IsProduction()\n\tif production {\n\t\tparsed, err := url.Parse(databaseURL)\n\t\tif err != nil || (parsed.Scheme != \"postgres\" && parsed.Scheme != \"postgresql\") || parsed.Hostname() == \"\" {\n\t\t\treturn nil, errors.New(\"postgres: production DATABASE_URL must be a Postgres URL\")\n\t\t}\n\t\tif parsed.Query().Get(\"sslmode\") != \"verify-full\" {\n\t\t\treturn nil, errors.New(\"postgres: production DATABASE_URL requires sslmode=verify-full\")\n\t\t}\n\t}\n\n\tconfig, err := pgxpool.ParseConfig(databaseURL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"postgres: parse DATABASE_URL: %w\", err)\n\t}\n\tcaPEM, err := caPEMFromEnvironment()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif production && caPEM == \"\" {\n\t\treturn nil, fmt.Errorf(\"postgres: %s or %s is required in production\", caEnvironment, caFileEnvironment)\n\t}\n\tif caPEM == \"\" {\n\t\treturn config, nil\n\t}\n\troots := x509.NewCertPool()","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/postgresconfig/postgresconfig.go#L19-L55","documentation":"Error \"postgres: production DATABASE_URL requires sslmode=verify-full\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/postgresconfig/postgresconfig.go:37 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use sslmode=verify-full on the production DATABASE_URL."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}