Leon SerfatyandClaude Opus 5 319d94b03c Check private-network host before the CA cert when choosing TLS ...

A leftover DATABASE_CA_CERT_PATH (the DigitalOcean CA, still set in the
production env and still committed at certs/ca-certificate.crt) made the `ca`
branch win before the private-host check, so the app forced verified TLS onto
the internal Postgres container and failed with "The server does not support
SSL connections".

Move the private-host branch ahead of the CA branch: a Docker service name,
localhost, or an RFC1918 address connects in plaintext regardless of a stale CA
path. Public hosts are unaffected and still require a CA in production. Set
DATABASE_SSL=require (or =verify) to opt a private host back into TLS.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-26 11:31:25 -04:00

..

migrations

Superadmin impersonation, hardened auth/upload paths, dependency updates

2026-08-26 10:25:39 -04:00

src

Check private-network host before the CA cert when choosing TLS

2026-08-26 11:31:25 -04:00

drizzle.config.ts

Initial commit — eLegal Software monorepo

2026-04-26 02:42:42 -04:00

package.json

Security hardening: deps, tenancy quotas, auth, deploy, webhooks

2026-07-17 13:34:33 -04:00

tsconfig.json

Initial commit — eLegal Software monorepo

2026-04-26 02:42:42 -04:00