Add TLS options to sample config file.

diff --git a/etc/pgbouncer.ini b/etc/pgbouncer.ini
index f1940e75c542d4717e4476b4f7bc9cf96ff893be..b13dcb942087a0d1eb388c0086b74289b980ad82 100644 (file)
--- a/etc/pgbouncer.ini
+++ b/etc/pgbouncer.ini
@@ -45,6 +45,54 @@ listen_port = 6432
 ;unix_socket_mode = 0777
 ;unix_socket_group =
 
+;;;
+;;; TLS settings for accepring clients
+;;;
+
+;; disable, allow, require, verify-ca, verify-full
+;client_tls_sslmode = disable
+
+;; Path to file that contains trusted CA certs
+;client_tls_ca_file = <system default>
+
+;; Private key and cert to present to clients.
+;; Required for accepting TLS connections from clients.
+;client_tls_key_file =
+;client_tls_cert_file =
+
+;; fast, normal, secure, legacy, <ciphersuite string>
+;client_tls_ciphers = fast
+
+;; all, secure, tlsv1.0, tlsv1.1, tlsv1.2
+;client_tls_protocols = all
+
+;; none, auto, legacy
+;client_tls_dheparams = auto
+
+;; none, auto, <curve name>
+;client_tls_ecdhcurve = auto
+
+;;;
+;;; TLS settings for connecting to backend databases
+;;;
+
+;; disable, allow, require, verify-ca, verify-full
+;server_tls_sslmode = disable
+
+;; Path to that contains trusted CA certs
+;server_tls_ca_file = <system default>
+
+;; Private key and cert to present to backend.
+;; Needed only if backend server require client cert.
+;server_tls_key_file =
+;server_tls_cert_file =
+
+;; all, secure, tlsv1.0, tlsv1.1, tlsv1.2
+;server_tls_protocols = all
+
+;; fast, normal, secure, legacy, <ciphersuite string>
+;server_tls_ciphers = fast
+
 ;;;
 ;;; Authentication settings
 ;;;
@@ -54,6 +102,9 @@ auth_type = trust
 ;auth_file = /8.0/main/global/pg_auth
 auth_file = /etc/pgbouncer/userlist.txt
 
+;; Path to HBA-style auth config
+;auth_hba_file =
+
 ;; Query to use to fetch password from database.  Result
 ;; must have 2 columns - username and password hash.
 ;auth_query = SELECT usename, passwd FROM pg_shadow WHERE usename=$1