Direct TLS support

README.md

@@ -987,7 +987,7 @@ const sql = postgres('postgres://username:password@host:port/database', {
   database             : '',            // Name of database to connect to
   username             : '',            // Username of database user
   password             : '',            // Password of database user
-  ssl                  : false,         // true, prefer, require, tls.connect options
+  ssl                  : false,         // true, prefer, require, direct, tls.connect options
   max                  : 10,            // Max number of connections
   max_lifetime         : null,          // Max lifetime in seconds (more info below)
   idle_timeout         : 0,             // Idle connection timeout in seconds

src/connection.js

@@ -336,7 +336,11 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     if (options.socket)
       return ssl ? secure() : connected()
 
-    socket.on('connect', ssl ? secure : connected)
+    if (ssl === 'direct') {
+      socket.on('connect', directTLS)
+    } else {
+      socket.on('connect', ssl ? secure : connected)
+    }
 
     if (options.path)
       return socket.connect(options.path)
@@ -349,6 +353,20 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     hostIndex = (hostIndex + 1) % port.length
   }
 
+    function directTLS() {
+        socket.removeAllListeners()
+        socket = tls.connect({
+            socket,
+            servername: net.isIP(socket.host) ? undefined : socket.host,
+            ALPNProtocols: ['postgresql'],
+            rejectUnauthorized: false
+        })
+        socket.on('secureConnect', connected)
+        socket.on('error', error)
+        socket.on('close', closed)
+        socket.on('drain', drain)
+    }
+
   function reconnect() {
     setTimeout(connect, closedDate ? closedDate + delay - performance.now() : 0)
   }

types/index.d.ts

@@ -44,7 +44,7 @@ interface BaseOptions<T extends Record<string, postgres.PostgresType>> {
    * How to deal with ssl (can be a tls.connect option object)
    * @default false
   */
-  ssl: 'require' | 'allow' | 'prefer' | 'verify-full' | boolean | object;
+  ssl: 'require' | 'allow' | 'prefer' | 'verify-full' | 'direct' | boolean | object;
   /**
    * Max number of connections
    * @default 10