MIME-Version: 1.0
References: 
 <CA+7KU8pPEXm-EbY0nk3CwiMkM962AMapwghwSAu0QmThnkZoNQ@mail.gmail.com>
In-Reply-To: 
 <CA+7KU8pPEXm-EbY0nk3CwiMkM962AMapwghwSAu0QmThnkZoNQ@mail.gmail.com>
From: John Barker <johnobarker@gmail.com>
Date: Mon, 7 Apr 2025 14:29:43 -0400
Message-ID: 
 <CA+7KU8qGkLzzAFJHuJfCe=jZuOG2ZHAWQvgv+oW+5m5ZBNAsOA@mail.gmail.com>
Subject: Fwd: Enforcing TLS 1.3 as a a minimum version
To: pgadmin-support@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000039d1590632346c86"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2B7KU8qGkLzzAFJHuJfCe%3DjZuOG2ZHAWQvgv%2BoW%2B5m5ZBNAsOA%40mail.gmail.com>
Precedence: bulk

--00000000000039d1590632346c86
Content-Type: text/plain; charset="UTF-8"

I am running pgAdmin 9.1 in a podman container and am trying to ensure that
TLS 1.3 is the minimum version.    I have created an override file and I
know that it is being read at startup but the enforcement of TLS 1.3 is not
happening.   I am using this configuration as suggested by the
documentation here:  https://docs.gunicorn.org/en/21.2.0/settings.html

Any idea of what to check.  I know the file is being parsed because if I
introduce a bad config, it is noted at startup.

Also, where or how is the instance variable for the config defined?

"The callable needs to accept an instance variable for the Config"

The below is a file mapped into the container called gunicorn_config.py

def ssl_context(conf, default_ssl_context_factory):
    import ssl
    context = default_ssl_context_factory()
    context.minimum_version = ssl.TLSVersion.TLSv1_3
    return context

--00000000000039d1590632346c86
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_quote gmail_quote_container"><div =
dir=3D"ltr" class=3D"gmail_attr">I am running pgAdmin 9.1 in a podman conta=
iner and am trying to ensure that TLS 1.3 is the minimum version.=C2=A0 =C2=
=A0 I have created an override=C2=A0file and I know that it is being read a=
t startup but the enforcement of TLS 1.3 is not happening.=C2=A0 =C2=A0I am=
 using this configuration as suggested by the documentation here:=C2=A0=C2=
=A0<a href=3D"https://docs.gunicorn.org/en/21.2.0/settings.html" target=3D"=
_blank">https://docs.gunicorn.org/en/21.2.0/settings.html</a></div><div dir=
=3D"ltr"><div><br></div><div>Any idea of what to check.=C2=A0 I know the fi=
le is being parsed because if I introduce a bad config, it is noted at star=
tup.</div><div><br></div><div>Also, where or how is the instance variable f=
or the config defined?</div><div><br></div><div><span style=3D"color:rgb(64=
,64,64);font-family:Lato,proxima-nova,&quot;Helvetica Neue&quot;,Arial,sans=
-serif;font-size:16px;background-color:rgb(252,252,252)">&quot;The callable=
 needs to accept an instance variable for the Config&quot;</span><br><div><=
br></div><div>The below is a file mapped into the container called gunicorn=
_config.py</div><div><pre style=3D"box-sizing:border-box;font-family:SFMono=
-Regular,Menlo,Monaco,Consolas,&quot;Liberation Mono&quot;,&quot;Courier Ne=
w&quot;,Courier,monospace;font-size:12px;line-height:1.4;margin-top:0px;mar=
gin-bottom:0px;padding:12px;overflow:auto;color:rgb(64,64,64)"><span style=
=3D"box-sizing:border-box;color:rgb(0,112,32);font-weight:bold">def</span> =
<span style=3D"box-sizing:border-box;color:rgb(6,40,126)">ssl_context</span=
><span style=3D"box-sizing:border-box">(</span><span style=3D"box-sizing:bo=
rder-box">conf</span><span style=3D"box-sizing:border-box">,</span> <span s=
tyle=3D"box-sizing:border-box">default_ssl_context_factory</span><span styl=
e=3D"box-sizing:border-box">):</span>
    <span style=3D"box-sizing:border-box;color:rgb(0,112,32);font-weight:bo=
ld">import</span> <span style=3D"box-sizing:border-box;color:rgb(14,132,181=
);font-weight:bold">ssl</span>
    <span style=3D"box-sizing:border-box">context</span> <span style=3D"box=
-sizing:border-box;color:rgb(102,102,102)">=3D</span> <span style=3D"box-si=
zing:border-box">default_ssl_context_factory</span><span style=3D"box-sizin=
g:border-box">()</span>
    <span style=3D"box-sizing:border-box">context</span><span style=3D"box-=
sizing:border-box;color:rgb(102,102,102)">.</span><span style=3D"box-sizing=
:border-box">minimum_version</span> <span style=3D"box-sizing:border-box;co=
lor:rgb(102,102,102)">=3D</span> <span style=3D"box-sizing:border-box">ssl<=
/span><span style=3D"box-sizing:border-box;color:rgb(102,102,102)">.</span>=
<span style=3D"box-sizing:border-box">TLSVersion</span><span style=3D"box-s=
izing:border-box;color:rgb(102,102,102)">.</span><span style=3D"box-sizing:=
border-box">TLSv1_3</span>
    <span style=3D"box-sizing:border-box;color:rgb(0,112,32);font-weight:bo=
ld">return</span> <span style=3D"box-sizing:border-box">context</span></pre=
></div></div></div>
</div></div>

--00000000000039d1590632346c86--