Fix support PostgreSQL CA bundle in Helm charts with file path option

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

contrib/helm/charts/probo/README.md

@@ -155,6 +155,8 @@ The following parameters **must** be configured:
 | `postgresql.port`      | PostgreSQL port                 | `5432` |
 | `postgresql.database`  | Database name                   | `probod` |
 | `postgresql.username`  | Database user                   | `probod` |
+| `postgresql.caBundle`  | PostgreSQL TLS CA certificate bundle (inline) | `""` |
+| `postgresql.caBundlePath` | PostgreSQL TLS CA certificate bundle (file path) | `""` |
 | `s3.bucket`            | S3 bucket name                  | `probod` |
 | `s3.region`            | AWS region                      | `us-east-1` |
 | `s3.endpoint`          | S3 endpoint (for S3-compatible) | `""` |
@@ -183,6 +185,38 @@ The chart deploys the following:
 
 Database migrations run automatically when Probo starts. No manual intervention is required.
 
+### TLS/SSL Configuration
+
+For secure PostgreSQL connections, you can provide a CA certificate bundle in two ways:
+
+1. **Inline CA Bundle** (`postgresql.caBundle`): Provide the certificate content directly in values.yaml
+   ```yaml
+   postgresql:
+     caBundle: |
+       -----BEGIN CERTIFICATE-----
+       MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl
+       ...
+       -----END CERTIFICATE-----
+   ```
+
+2. **File Path** (`postgresql.caBundlePath`): Mount the CA bundle as a ConfigMap/Secret and reference the path
+   ```yaml
+   postgresql:
+     caBundlePath: /etc/ssl/certs/ca-certificates.crt
+
+   # Then mount your CA bundle using volumes/volumeMounts
+   volumes:
+     - name: ca-bundle
+       configMap:
+         name: postgres-ca-bundle
+   volumeMounts:
+     - name: ca-bundle
+       mountPath: /etc/ssl/certs
+       readOnly: true
+   ```
+
+**Note:** Using `caBundlePath` is recommended for large CA bundles (e.g., system CA bundles) as it avoids environment variable size limitations.
+
 ### Backup
 
 Use your PostgreSQL provider's backup solution (e.g., AWS RDS automated backups, GCP Cloud SQL backups).
@@ -232,6 +266,11 @@ Check the Probo logs for S3 connection errors when uploading files.
 postgresql:
   host: "mydb.abc123.us-east-1.rds.amazonaws.com"
   password: "<rds-password>"
+  # Optional: Add RDS CA bundle for TLS connections
+  # caBundle: |
+  #   -----BEGIN CERTIFICATE-----
+  #   ...RDS CA certificate...
+  #   -----END CERTIFICATE-----
 
 s3:
   region: "us-east-1"

contrib/helm/charts/probo/templates/deployment.yaml

@@ -85,6 +85,16 @@ spec:
               value: {{ include "probo.postgresql.database" . | quote }}
             - name: PG_POOL_SIZE
               value: {{ .Values.postgresql.poolSize | default "100" | quote }}
+            {{- if .Values.postgresql.caBundle }}
+            - name: PG_CA_BUNDLE
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: pg-ca-bundle
+            {{- else if .Values.postgresql.caBundlePath }}
+            - name: PG_CA_BUNDLE_PATH
+              value: {{ .Values.postgresql.caBundlePath | quote }}
+            {{- end }}
             # Authentication
             - name: AUTH_DISABLE_SIGNUP
               value: {{ .Values.probo.auth.disableSignup | quote }}

contrib/helm/charts/probo/templates/secret.yaml

@@ -8,6 +8,9 @@ type: Opaque
 stringData:
   # Database credentials
   db-password: {{ if .Values.postgresql.enabled }}{{ .Values.postgresql.auth.postgresPassword | quote }}{{ else }}{{ required "postgresql.password is required when postgresql.enabled=false" .Values.postgresql.password | quote }}{{ end }}
+  {{- if .Values.postgresql.caBundle }}
+  pg-ca-bundle: {{ .Values.postgresql.caBundle | quote }}
+  {{- end }}
 
   # S3 credentials
   s3-access-key: {{ include "probo.s3.accessKeyId" . | quote }}

contrib/helm/charts/probo/values.yaml

@@ -297,6 +297,13 @@ postgresql:
   password: ""  # REQUIRED when enabled=false: PostgreSQL password
   database: probod
   poolSize: 100
+  # PostgreSQL TLS/SSL configuration
+  # caBundle: |
+  #   -----BEGIN CERTIFICATE-----
+  #   ...certificate content...
+  #   -----END CERTIFICATE-----
+  # Or use caBundlePath to mount from a ConfigMap/Secret
+  # caBundlePath: /etc/ssl/certs/ca-certificates.crt
 
 # S3 storage configuration
 # For production: Use external S3 (AWS S3, GCS, etc.)