feat: add doc for db ssl config#102
Conversation
There was a problem hiding this comment.
Pull request overview
Adds documentation for configuring database SSL/TLS in both Kubernetes (Helm values.yaml) and Docker Compose (.env.custom) deployment guides across multiple locales.
Changes:
- Document
sslModeunderuniverser.config.databasein Kubernetes deployment guides (EN / zh-CN / zh-TW / ja-JP). - Add a Docker Compose “Database SSL” section with
DATABASE_SSL_MODEand Temporal SQL TLS env vars (EN / zh-CN / zh-TW / ja-JP). - Add a MySQL-specific note explaining how
sslModeis mapped into the MySQL DSN.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| content/guides/pro/deploy/kubernetes.mdx | Adds sslMode examples and MySQL mapping note for Helm-based deployments |
| content/guides/pro/deploy/kubernetes.zh-CN.mdx | Same as above (Simplified Chinese) |
| content/guides/pro/deploy/kubernetes.zh-TW.mdx | Same as above (Traditional Chinese) |
| content/guides/pro/deploy/kubernetes.ja-JP.mdx | Same as above (Japanese) |
| content/guides/pro/deploy/docker-compose.mdx | Adds Database SSL env var section for Compose deployments |
| content/guides/pro/deploy/docker-compose.zh-CN.mdx | Same as above (Simplified Chinese) |
| content/guides/pro/deploy/docker-compose.zh-TW.mdx | Same as above (Traditional Chinese) |
| content/guides/pro/deploy/docker-compose.ja-JP.mdx | Same as above (Japanese) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| sslMode: disable # 使用可能な値：disable、require、verify-ca、verify-full。SSL を有効化するには require / verify-ca / verify-full を設定 | ||
|
|
||
| temporal: # temporal はデータベースを使用します | ||
| server: |
There was a problem hiding this comment.
universer.config.database.sslMode が追加されていますが、同じ例で Temporal の SQL persistence も外部 DB に接続している一方で、Temporal 側の SSL/TLS 設定が記載されていません。DB 側で SSL 必須の場合、Univer は接続できても Temporal が接続失敗する可能性があります。ここに Temporal の SQL 接続で SSL/TLS を有効化する方法（もしくは sslMode は Temporal には適用されず別途設定が必要である旨）を追記することを検討してください。
| TEMPORAL_SQL_TLS_ENABLED=true | ||
| TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true | ||
| ``` | ||
|
|
||
| > For production, set `TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=false` and configure CA/certificates properly. |
There was a problem hiding this comment.
The example enables TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true, which disables hostname verification and is insecure by default. Consider making the snippet default to false and explicitly calling out that true should only be used for local/dev troubleshooting (or when you fully understand the risk), so readers don’t copy an unsafe config into production.
| TEMPORAL_SQL_TLS_ENABLED=true | ||
| TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true | ||
| ``` | ||
|
|
||
| > 生产环境建议将 `TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION` 设置为 `false`，并正确配置 CA / 证书。 |
There was a problem hiding this comment.
示例里将 TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true 作为默认值会关闭主机名校验，安全性较差，容易被直接复制到生产环境。建议示例默认设置为 false，并明确说明仅在本地/排障时才临时设置为 true。
| TEMPORAL_SQL_TLS_ENABLED=true | ||
| TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true | ||
| ``` | ||
|
|
||
| > 生產環境建議將 `TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION` 設為 `false`，並正確配置 CA／憑證。 |
There was a problem hiding this comment.
範例把 TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true 當預設值會關閉主機名稱驗證，風險較高，容易被直接套用到生產環境。建議將範例預設改為 false，並註明僅在本地/除錯排障時才暫時設為 true。
| TEMPORAL_SQL_TLS_ENABLED=true | ||
| TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true | ||
| ``` | ||
|
|
||
| > 本番環境では `TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION` を `false` に設定し、CA/証明書を正しく設定してください。 |
There was a problem hiding this comment.
サンプルで TEMPORAL_SQL_TLS_DISABLE_HOST_VERIFICATION=true をデフォルトにするとホスト名検証が無効になり、セキュリティ上危険です（そのまま本番にコピーされやすいです）。例は false をデフォルトにし、true はローカル/トラブルシュート時の一時設定に限定する旨を明記することを検討してください。
| sslMode: disable # Supported values: disable, require, verify-ca, verify-full; set to require / verify-ca / verify-full to enable SSL | ||
|
|
||
| temporal: # temporal uses the database | ||
| server: |
There was a problem hiding this comment.
This adds universer.config.database.sslMode, but the same examples also configure Temporal’s SQL persistence against the same RDS without any SSL/TLS options. If users point Temporal at an SSL-required database, Temporal may fail to connect even though sslMode is set for Univer. Consider adding a short note here on how to enable SSL/TLS for Temporal’s SQL connection (or explicitly stating it’s configured separately and not affected by sslMode).
| sslMode: disable # 可选值：disable、require、verify-ca、verify-full；开启 SSL 请设置为 require / verify-ca / verify-full | ||
|
|
||
| temporal: # temporal 用到了数据库 | ||
| server: |
There was a problem hiding this comment.
这里新增了 universer.config.database.sslMode，但同一段示例里 Temporal 也连接到同一个外部数据库（persistence 配置）却没有任何 SSL/TLS 配置项。若用户的 RDS 强制 SSL，Temporal 可能会连不上，即使 Univer 侧已设置 sslMode。建议在此补充 Temporal SQL 连接如何开启 SSL/TLS（或明确说明 Temporal 需单独配置，且不受 sslMode 影响）。
| sslMode: disable # 可選值：disable、require、verify-ca、verify-full；啟用 SSL 請設為 require / verify-ca / verify-full | ||
|
|
||
| temporal: # temporal 用到了資料庫 | ||
| server: |
There was a problem hiding this comment.
此處新增 universer.config.database.sslMode，但同一段示例裡 Temporal 也連到外部資料庫（persistence 設定）卻沒有任何 SSL/TLS 相關設定。若使用強制 SSL 的 RDS，Temporal 可能仍會連線失敗，即使 Univer 已設定 sslMode。建議補充 Temporal SQL 連線如何啟用 SSL/TLS（或明確說明 Temporal 需另外設定，且不受 sslMode 影響）。
等下次发版一起