Use a self-signed TLS certificate for PostgreSQL

site-cookbooks/kosmos-postgresql/README.md

@@ -6,7 +6,6 @@
 
 Usage:
 
-When the `tls` attribute is set to true, a TLS certificate for the FQDN
 (`node['fqdn']`, for example `andromeda.kosmos.org`) is generated using Let's
 Encrypt and copied to the PostgreSQL data directory and added to the
 `postgresql.conf` file
@@ -16,7 +15,6 @@ Encrypt and copied to the PostgreSQL data directory and added to the
 ```ruby
 postgresql_custom_server "12" do
   role "primary"
-  tls true
 end
 ```
 
@@ -25,7 +23,6 @@ end
 ```ruby
 postgresql_custom_server "12" do
   role "replica"
-  tls true
 end
 ```
 
@@ -47,3 +44,47 @@ about PostgreSQL client authentication, see the
 
 The primary opens up the PostgreSQL port (5432 TCP) to replicas, and replicas
 to the primary.
+
+## TLS self-signed certificate
+
+A wildcard (`*.kosmos.org` certificate) was generated with the following
+commands:
+
+```
+openssl req -new -nodes -text -out root.csr -keyout root.key \
+  -subj "/CN=root.kosmos.org"
+chmod og-rwx root.key
+openssl x509 -req -in root.csr -text -days 3650 \
+  -extfile /etc/ssl/openssl.cnf -extensions v3_ca \
+  -signkey root.key -out root.crt
+openssl req -new -nodes -text -out server.csr \
+  -keyout server.key -subj "/CN=*.kosmos.org"
+chmod og-rwx server.key
+openssl x509 -req -in server.csr -text -days 1825 \
+  -CA root.crt -CAkey root.key -CAcreateserial \
+  -out server.crt
+```
+
+It is valid until May 12 2025.
+
+The content of `server.crt`, `server.key` and `root.crt` an stored in the
+`postgresql` encrypted data bag. The root key is stored in LastPass
+("Self-signed TLS root certificate"). `server.crt` & `server.key` are used by
+the PostgreSQL server.
+
+The root certificate needs to be deployed to clients so they verify the cert
+can be trusted.
+
+For example:
+
+```ruby
+postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
+root_cert_path = "/etc/ssl/certs/root.kosmos.org.crt"
+file root_cert_path do
+  content postgresql_data_bag_item['ssl_root_cert']
+  mode "0644"
+end
+```
+
+`/etc/ssl/certs/root.kosmos.org.crt` can be used as the CA root cert path in
+the client's configuration