How to connect etherpad with mysql via SSL/TLS

[slaudel]

Hi,

unfortunately I didn't find any solution to my problem.
How can I connect etherpad to a remote mysql database secured by SSL/TLS?
I found #5350 but I'm not getting into it. What do I need to configure in settings.json to have etherpad connect securely to mysql? The referenced link to ueberdb2/mysql2 doesn't tell me either. Is it so rare to connect securely to mysql? Maybe this should be documented?

Regards

[SamTV12345]

Hi,

sorry for the inconvenience. We use the official MongoDB driver. You can find the documentation here: https://www.mongodb.com/docs/drivers/node/current/fundamentals/connection/connection-options/ you probably want tls:true, tlsCAFile and tlsCertificateKeyFile all these option in the settings.json under the key dbSettings. Then it should work.

[slaudel]

Hi,

thanks for your reply, but unfortunately this (tls: true) doesn't work.
The database part of my settings.json looks like the following:

  "dbType": "${DB_TYPE:dirty}",
  "dbSettings": {
    "host":       "${DB_HOST:undefined}",
    "port":       "${DB_PORT:undefined}",
    "database":   "${DB_NAME:undefined}",
    "user":       "${DB_USER:undefined}",
    "password":   "${DB_PASS:undefined}",
    "charset":    "${DB_CHARSET:undefined}",
    "ssl": {
      "ca": "${DB_SSL_CA:undefined}",
      "verifyIdentity": false
    }
  },

with DB_TYPE=mysql and all other variables being populated.
DB_SSL_CA points to the CA cert file.
The ssl section was added by myself after studying https://github.com/sidorares/node-mysql2/blob/master/typings/mysql/lib/Connection.d.ts.

I'm getting the following error:

[2024-07-30T11:55:04.680] [ERROR] server - TypeError: import_ueberdb2.default.Database is not a constructor
    at Object.exports.init (/opt/etherpad-lite/src/node/db/DB.ts:40:16)
    at Object.exports.start (/opt/etherpad-lite/src/node/server.ts:169:14)
    at err (/opt/etherpad-lite/src/node/server.ts:306:38)
    at Object.<anonymous> (/opt/etherpad-lite/src/node/server.ts:309:61)
    at Module._compile (node:internal/modules/cjs/loader:1504:14)
    at Object.transformer (/opt/etherpad-lite/node_modules/.pnpm/[email protected]/node_modules/tsx/dist/register-CCR7NebB.cjs:3:1101)
    at Module.load (node:internal/modules/cjs/loader:1282:32)
    at Module._load (node:internal/modules/cjs/loader:1098:12)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:215:24)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:158:5)
    at node:internal/main/run_main_module:30:49

[SamTV12345]

Oh seems like it works. You need to pull the latest changes. There was an error on develop which is fixed by now.

[slaudel]

I now pulled from the development branch and am getting a bit farther.
Now etherpad complains about the self signed mysql certificate.

[2024-07-30T14:17:52.466] [ERROR] ueberDB - Fatal MySQL error: Error: self-signed certificate
2024-07-30T12:17:52.466796149Z     at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
2024-07-30T12:17:52.466804678Z     at TLSSocket.emit (node:events:520:28)
2024-07-30T12:17:52.466824434Z     at TLSSocket._finishInit (node:_tls_wrap:1078:8)
    at ssl.onhandshakedone (node:_tls_wrap:864:12)
[2024-07-30T14:17:52.466] [ERROR] server - Error occurred while starting Etherpad
[2024-07-30T14:17:52.468] [ERROR] server - Metrics at time of fatal error:
2024-07-30T12:17:52.468427193Z {
  "httpStartTime": 0,
  "memoryUsage": 164405248,
  "memoryUsageHeap": 65907584
}
[2024-07-30T14:17:52.468] [ERROR] server - Error: self-signed certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
    at TLSSocket.emit (node:events:520:28)
    at TLSSocket._finishInit (node:_tls_wrap:1078:8)
    at ssl.onhandshakedone (node:_tls_wrap:864:12)

How can I tell etherpad to accept the certificate or to ignore the error?

[slaudel]

Okay, I'll answer it myself, I found the solution on sidorares/node-mysql2#2130.

My settings.json now looks like

  "dbType": "${DB_TYPE:dirty}",
  "dbSettings": {
    "host":       "${DB_HOST:undefined}",
    "port":       "${DB_PORT:undefined}",
    "database":   "${DB_NAME:undefined}",
    "user":       "${DB_USER:undefined}",
    "password":   "${DB_PASS:undefined}",
    "charset":    "${DB_CHARSET:undefined}",
    "ssl": {
      "ca": "${DB_SSL_CA:undefined}",
      "verifyIdentity": false,
      "rejectUnauthorized": false
    }
  },