From de771a5f1f8ae82d31ebcc69bf094ef0926377c3 Mon Sep 17 00:00:00 2001
From: seonNoh <dark.pearl.nst@gmail.com>
Date: Thu, 24 Sep 2026 00:02:00 +0900
Subject: [PATCH] fix: prefer TLS for the legacy-api DB connection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

보안 리뷰 지적(sslmode=disable). 사설 서브넷 안의 통신이지만 서버가 TLS를
제공하면 사용하도록 sslmode=prefer로 바꾼다(pgx 지원). 서버 인증서를 갖추는
WP-09에서 require로 올린다.
---
 vm/legacy-api/apply.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vm/legacy-api/apply.sh b/vm/legacy-api/apply.sh
index aadb69c..11e7ecf 100755
--- a/vm/legacy-api/apply.sh
+++ b/vm/legacy-api/apply.sh
@@ -15,7 +15,7 @@ unset TOKEN
 ENV_FILE=/opt/selfheal/legacy-api.env
 umask 077
 {
-  printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=disable\n' "${DB_PASSWORD}"
+  printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=prefer\n' "${DB_PASSWORD}"
 } > "$ENV_FILE"
 unset DB_PASSWORD
 docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --pull always --remove-orphans