RTFM · Healthchecks
lb.saphira.postgresql: will it negotiate TLS?
PostgreSQL answers one specific question before any login: "do you speak TLS?"; S or N, one byte. This check asks exactly that, optionally demanding the S, and never authenticates.
What it proves
A real PostgreSQL server that completes the SSLRequest negotiation: the check sends the 8-byte SSLRequest code and the server must answer a single byte: S (TLS supported) or N (not supported). With LB_SAPHIRA_PG_REQUIRE_SSL=1 only S is healthy, which makes the check prove your TLS policy on the backend, not just the process.
How it works
The probe engine sends the fixed SSLRequest packet (length 8, code 80877103) and reads one byte. That is the whole protocol surface: no startup message, no authentication exchange, no query.
Configuration
| Variable | Default | Meaning |
|---|---|---|
| LB_SAPHIRA_PG_REQUIRE_SSL | 0 | 1 = the N answer (TLS unsupported) is a failure |
| LB_SAPHIRA_TIMEOUT | 3 | Negotiation deadline |
| (target port) | $4, else 5432 | Any port postmaster listens on |
Wiring it up
# ldirectord.cf
virtual = 203.0.113.10:5432
protocol = tcp
scheduler = lc
real = 192.168.20.105:5432 gate 1
real = 192.168.20.106:5432 gate 1
checktype = external
checkcommand = "/var/lib/lb/saphira/lb.saphira.postgresql"# /etc/saphira/lb-healthchecks.d/postgresql.conf
LB_SAPHIRA_PG_REQUIRE_SSL=1Run it by hand
LB_SAPHIRA_PG_REQUIRE_SSL=1 \
/var/lib/lb/saphira/lb.saphira.postgresql db-pool 5432 192.168.20.105 5432
echo $?
# 0 = S or N answered (S required with the knob set)
# 1 = no single-byte answer, or TLS unsupported while requiredFailure modes
- Nothing answered: the port proxies but the postmaster is unreachable
- N while REQUIRE_SSL=1: TLS was disabled or the ssl config changed: exactly the regression this check exists to catch
Did we miss something?
If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.
Send feedback or request a new section →
Prefer not to do it yourself?
Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.