feat(postgres): add --ssl-cert and --ssl-key CLI flags by reddynitish · Pull Request #3150 · maplibre/martin · GitHub
Skip to content

feat(postgres): add --ssl-cert and --ssl-key CLI flags - #3150

Merged
CommanderStorm merged 2 commits into
maplibre:mainfrom
reddynitish:fix-1052-add-ssl-cli-flags
Aug 24, 2026
Merged

feat(postgres): add --ssl-cert and --ssl-key CLI flags#3150
CommanderStorm merged 2 commits into
maplibre:mainfrom
reddynitish:fix-1052-add-ssl-cli-flags

Conversation

@reddynitish

@reddynitish reddynitish commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds --ssl-cert and --ssl-key CLI flags for the Postgres source, mirroring the existing --ca-root-file flag. This split out of #3141 following review from @CommanderStorm, who asked for the SSL flags, the legacy env var warnings, and the breaking removal of implicit env var reads to be separated into independent PRs.

This PR is the narrow, non-breaking part: two new flags only.

  • --ssl-cert <FILE> / --ssl-key <FILE> set the client SSL certificate/key for Postgres connections.
  • CLI flags override the config file, the same way --ca-root-file already overrides ssl_root_cert.
  • Existing PGSSLCERT/PGSSLKEY env var fallback behavior is unchanged.

Testing

  • cargo fmt --check
  • cargo check --workspace
  • cargo test -p martin --lib config::args::postgres (7 passed)
  • cargo clippy -p martin --all-targets -- -D warnings — passes for the changed crate; a pre-existing result_large_err clippy failure in martin-core::tiles::postgres::errors (unrelated file, present on main) blocks a full clean workspace clippy run.

@reddynitish @claude
feat(config): add --ssl-cert and --ssl-key CLI flags
ee7df75 
PGSSLCERT and PGSSLKEY had no CLI equivalent, unlike PGSSLROOTCERT
(--ca-root-file). Add --ssl-cert/--ssl-key following the same precedence
as the existing SSL flags: CLI wins over the environment variable, and
overrides a config file's ssl_cert/ssl_key the way --ca-root-file already
overrides ssl_root_cert.

No change to existing env-var or config-file behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Aug 24, 2026
Merged
Closed
@github-actions

github-actions Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

CommanderStorm
CommanderStorm reviewed Aug 24, 2026
View reviewed changes
Comment thread martin/src/config/args/postgres.rs Outdated
CommanderStorm
CommanderStorm reviewed Aug 24, 2026
View reviewed changes
Comment thread martin/src/config/args/postgres.rs Outdated
@CommanderStorm
Apply suggestions from code review
9087374 
Co-authored-by: Frank Elsinga <frank@elsinga.de>
@CommanderStorm
CommanderStorm enabled auto-merge (squash) August 24, 2026 08:02
CommanderStorm
CommanderStorm approved these changes Aug 24, 2026
View reviewed changes

@CommanderStorm CommanderStorm left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks

@CommanderStorm
CommanderStorm merged commit 7caa85a into maplibre:main Aug 24, 2026
50 checks passed
@CommanderStorm CommanderStorm mentioned this pull request Aug 23, 2026
Merged
CommanderStorm added a commit that referenced this pull request Aug 24, 2026
@reddynitish @claude
@CommanderStorm @pre-commit-ci
feat(config): warn about legacy Postgres env var usage (#3151)
b77491b 
## Summary

Warns once at startup when Martin falls back to one of the five implicit
Postgres env vars (`DATABASE_URL`, `DEFAULT_SRID`, `PGSSLCERT`,
`PGSSLKEY`, `PGSSLROOTCERT`), naming the config-file key (and CLI flag,
where one exists) that replaces it. Split out of #3141 following review
from @CommanderStorm, alongside #3150 (the `--ssl-cert`/`--ssl-key`
flags).

This is a deprecation/migration-warning PR only — **all five variables
still function exactly as before**. The actual breaking removal is
deferred to Martin v2 and is not part of this PR.

- A variable the config file already references explicitly as `${VAR}`
is not reported — it's doing exactly what it should.
- Variable values are never logged, only the fact that a var is set.
- Warning text names the replacement, it never claims the variable is
already ignored.
- `docs/content/env-vars.md` gets a short deprecation note pointing at
#1052.

## Testing

- `cargo fmt --check`
- `cargo check --workspace`
- `cargo test -p martin --lib config::file::main::parse` (63 passed)
- `cargo test -p martin --lib config::args::root` (9 passed, including a
regression test that `DATABASE_URL` still configures Postgres while also
warning)
- `cargo clippy -p martin --all-targets -- -D warnings` — passes for the
changed crate; a pre-existing `result_large_err` clippy failure in
`martin-core::tiles::postgres::errors` (unrelated file, present on
`main`) blocks a full clean workspace clippy run.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Frank Elsinga <frank@elsinga.de>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
CommanderStorm added a commit that referenced this pull request Aug 31, 2026
@CommanderStorm @pre-commit-ci
chore: release (#3129)
2854c42 
## 🤖 New release

* `martin-tile-utils`: 0.7.6 -> 0.7.7 (✓ API compatible changes)
* `mbtiles`: 0.19.1 -> 0.19.2 (✓ API compatible changes)
* `martin-core`: 0.11.0 -> 0.11.1 (✓ API compatible changes)
* `martin`: 1.14.0 -> 1.15.0

<details><summary><i><b>Changelog</b></i></summary><p>


## `mbtiles`

<blockquote>

##
[0.19.2](mbtiles-v0.19.1...mbtiles-v0.19.2)
- 2026-08-31

### Added

- jxl support ([#3181](#3181))

### Fixed

- *(mbtiles)* avoid full tiles scan when computing min/max zoom
([#3185](#3185))

### Other

- minor test cleanup
([#3179](#3179))
- *(clippy)* warn on wildcard_enum_match_arm
([#3168](#3168))
- *(tests)* use assert_matches! instead of assert!(matches!(..))
([#3166](#3166))
- adopt clippy 1.98
([#3137](#3137))
- *(test)* migrate the save-config e2e tests to rust and retire
tests/test.sh ([#3105](#3105))
- implement hillshade-postprocessing
([#3180](#3180))
</blockquote>

## `martin-core`

<blockquote>

##
[0.11.1](martin-core-v0.11.0...martin-core-v0.11.1)
- 2026-08-31

### Added

- add contour processing
([#3183](#3183))
- jxl support ([#3181](#3181))

### Fixed

- *(catalog)* serialize the catalog in a stable key order
([#3189](#3189))

### Other

- implement hillshade-postprocessing
([#3180](#3180))
- minor test cleanup
([#3179](#3179))
- *(clippy)* warn on wildcard_enum_match_arm
([#3168](#3168))
- *(tests)* use assert_matches! instead of assert!(matches!(..))
([#3166](#3166))
- *(errors)* split MartinError into different error types
([#3162](#3162))
- *(cache)* fix some CI flakes by widening font + sprite cache expiry
margins ([#3146](#3146))
- adopt clippy 1.98
([#3137](#3137))
- fix fmt ([#3135](#3135))
- *(test)* migrate the save-config e2e tests to rust and retire
tests/test.sh ([#3105](#3105))
</blockquote>

## `martin`

<blockquote>

##
[1.15.0](martin-v1.14.0...martin-v1.15.0)
- 2026-08-31

### Added

- *(catalog)* answer conditional requests on /catalog
([#3188](#3188))
- add contour processing
([#3183](#3183))
- jxl support ([#3181](#3181))
- *(cache-control)* per-source Cache-Control overrides
([#3167](#3167))
- *(config)* warn about legacy Postgres env var usage
([#3151](#3151))
- *(postgres)* add --ssl-cert and --ssl-key CLI flags
([#3150](#3150))

### Fixed

- *(catalog)* serialize the catalog in a stable key order
([#3189](#3189))
- *(config)* gate the resolve_process_config imports on _process
([#3191](#3191))
- *(fonts)* redirect glyph URLs with a file extension
([#3187](#3187))
- *(deps)* update npm dependencies
([#3177](#3177))
- *(deps)* update npm dependencies
([#3175](#3175))
- *(pmtiles)* pick up ECS and EKS credential discovery env vars for S3
sources ([#3165](#3165))
- *(reload)* keep per-source convert_to_* overrides for file-backed
sources ([#3160](#3160))
- *(postgres)* keep per-source convert_to_* overrides on the reload path
([#3144](#3144))
- *(mbtiles)* avoid full tiles scan when computing min/max zoom
([#3185](#3185))

### Other

- *(reload)* publish local file kinds through init()
([#3190](#3190))
- implement hillshade-postprocessing
([#3180](#3180))
- minor test cleanup
([#3179](#3179))
- *(reload)* gather the tile reloaders into TileReloaders
([#3178](#3178))
- *(deps)* update cargo dependencies
([#3172](#3172))
- *(postgres)* make the reloader the single writer of PostgreSQL sources
([#3130](#3130))
- *(clippy)* warn on wildcard_enum_match_arm
([#3168](#3168))
- *(tests)* use assert_matches! instead of assert!(matches!(..))
([#3166](#3166))
- *(errors)* split MartinError into different error types
([#3162](#3162))
- *(deps)* autoupdate pre-commit
([#3155](#3155))
- fix typo explicitely -> explicitly (source + generated), recomend ->
recommend ([#3147](#3147))
- *(pmtiles)* open file sources concurrently and share one client per
store ([#3131](#3131))
- *(reload)* build advisory additions and updates concurrently
([#3142](#3142))
- *(discovery)* return warnings from Discovery::discover
([#3143](#3143))
- *(postprocesing)* refactor docs to accept the new postprocessing
section ([#3139](#3139))
- adopt clippy 1.98
([#3137](#3137))
- fix cors logging logging `unrecognisable`
([#3136](#3136))
- fix fmt ([#3135](#3135))
- *(config)* resolve file source ids before opening the sources
([#3133](#3133))
- *(cache)* fix some CI flakes by widening font + sprite cache expiry
margins ([#3146](#3146))
- *(test)* migrate the save-config e2e tests to rust and retire
tests/test.sh ([#3105](#3105))
</blockquote>


</p></details>

---
This PR was generated with
[release-plz](https://github.com/release-plz/release-plz/).

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
@CommanderStorm CommanderStorm mentioned this pull request Aug 31, 2026
Merged
@johncarmack1984 johncarmack1984 mentioned this pull request Sep 22, 2026
Merged
CommanderStorm pushed a commit that referenced this pull request Sep 22, 2026
@johncarmack1984
feat!: stop reading the Postgres env vars (#3371)
7a79a98 
Closes #1052

Last of the v2.0 musts from #3333. Martin no longer reads
`DATABASE_URL`, `DEFAULT_SRID`, `PGSSLCERT`, `PGSSLKEY` or
`PGSSLROOTCERT` from its environment. #3150 added the missing flags,
#3151 added the warning, this is the removal both promised. Sources come
from the command line or the config file, and a config file can still
pull any variable in with `${DATABASE_URL}`.

Three things to know:

- `martin` with only `DATABASE_URL` exported now stops with "No tile
sources found". The other four go quiet instead: a table with SRID 0
gets skipped with its usual warning, and a client certificate that used
to ride in on `PGSSLCERT` is not sent. Worth a line in the migration
guide.
- Docker users put the connection string after the image name, or keep
`-e DATABASE_URL` and write `connection_string: ${DATABASE_URL}` into a
mounted config. The docs examples moved with it, the demo compose and
the install snippet on the demo site too.
- `--ssl-cert`, `--ssl-key` and `--ca-root-file` replace the three
`PGSSL*` files, on the command line and on top of a config.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@CommanderStorm CommanderStorm CommanderStorm approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@reddynitish @CommanderStorm