feat(core): add support for encrypted db connection in maintenance:install

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Author: susnux

core/Command/Maintenance/Install.php

@@ -27,6 +27,19 @@
 use function get_class;
 
 class Install extends Command {
+	/**
+	 * SSL/TLS command line options and the installer options they provide. The database
+	 * setup translates those, see \OC\Setup\AbstractDatabase::ENCRYPTION_OPTIONS.
+	 * `--database-ssl-no-verify` is handled separately as it takes no value.
+	 */
+	private const array SSL_OPTIONS = [
+		'database-ssl-mode' => 'dbsslmode',
+		'database-ssl-ca' => 'dbsslca',
+		'database-ssl-cert' => 'dbsslcert',
+		'database-ssl-key' => 'dbsslkey',
+		'database-ssl-crl' => 'dbsslcrl',
+	];
+
 	public function __construct(
 		private SystemConfig $config,
 		private IniGetWrapper $iniGetWrapper,
@@ -46,6 +59,12 @@ protected function configure(): void {
 			->addOption('database-user', null, InputOption::VALUE_REQUIRED, 'Login to connect to the database')
 			->addOption('database-pass', null, InputOption::VALUE_OPTIONAL, 'Password of the database user', null)
 			->addOption('database-table-space', null, InputOption::VALUE_OPTIONAL, 'Table space of the database (oci only)', null)
+			->addOption('database-ssl-mode', null, InputOption::VALUE_REQUIRED, 'Encryption mode for the database connection, e.g. "require" or "verify-full" (pgsql only)')
+			->addOption('database-ssl-ca', null, InputOption::VALUE_REQUIRED, 'Path to the CA certificate the database server is verified against (mysql and pgsql only)')
+			->addOption('database-ssl-cert', null, InputOption::VALUE_REQUIRED, 'Path to the client certificate used to authenticate against the database (mysql and pgsql only)')
+			->addOption('database-ssl-key', null, InputOption::VALUE_REQUIRED, 'Path to the private key of the client certificate (mysql and pgsql only)')
+			->addOption('database-ssl-crl', null, InputOption::VALUE_REQUIRED, 'Path to the certificate revocation list (pgsql only)')
+			->addOption('database-ssl-no-verify', null, InputOption::VALUE_NONE, 'Do not verify that the database server certificate matches the hostname used to connect (mysql only)')
 			->addOption('disable-admin-user', null, InputOption::VALUE_NONE, 'Disable the creation of an admin user')
 			->addOption('admin-user', null, InputOption::VALUE_REQUIRED, 'Login of the admin account', 'admin')
 			->addOption('admin-pass', null, InputOption::VALUE_REQUIRED, 'Password of the admin account')
@@ -184,6 +203,19 @@ protected function validateInput(InputInterface $input, OutputInterface $output,
 		if ($db === 'oci') {
 			$options['dbtablespace'] = $input->getParameterOption('--database-table-space', '');
 		}
+		// The database setup translates these into the system config values that configure
+		// an encrypted connection, and rejects the ones it does not support,
+		// see \OC\Setup\AbstractDatabase::getEncryptionConfig()
+		foreach (self::SSL_OPTIONS as $option => $installerOption) {
+			$value = $input->getOption($option);
+			if ($value !== null) {
+				$options[$installerOption] = (string)$value;
+			}
+		}
+		if ($input->getOption('database-ssl-no-verify')) {
+			$options['dbsslnoverify'] = true;
+		}
+
 		return $options;
 	}
 

lib/private/Setup/MySQL.php

@@ -111,7 +111,7 @@ protected function getEncryptionConfig(array $config): array {
 	private function getSslAttributes(): array {
 		// TODO: simplify once we only support PHP 8.5+.
 		if (PHP_VERSION_ID >= 80500 && class_exists(\Pdo\Mysql::class)) {
-			/** @psalm-suppress UndefinedClass */
+			/** @psalm-suppress UndefinedConstant Psalm resolves the non-mysqlnd variant of the symfony polyfill class, which lacks this constant */
 			return [
 				'ca' => \Pdo\Mysql::ATTR_SSL_CA,
 				'cert' => \Pdo\Mysql::ATTR_SSL_CERT,

tests/Core/Command/Maintenance/InstallTest.php

@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace Tests\Core\Command\Maintenance;
+
+use bantu\IniGetWrapper\IniGetWrapper;
+use OC\Core\Command\Maintenance\Install;
+use OC\SystemConfig;
+use Symfony\Component\Console\Input\ArrayInput;
+use Symfony\Component\Console\Output\NullOutput;
+use Test\TestCase;
+
+class InstallTest extends TestCase {
+	private Install $command;
+
+	#[\Override]
+	protected function setUp(): void {
+		parent::setUp();
+
+		$this->command = new Install(
+			$this->createMock(SystemConfig::class),
+			$this->createMock(IniGetWrapper::class),
+		);
+	}
+
+	/**
+	 * @param array<string, string|bool> $parameters
+	 * @return array The installer options built from the command line input
+	 */
+	private function validateInput(array $parameters): array {
+		$input = new ArrayInput(array_merge([
+			'--database-name' => 'nextcloud',
+			'--database-user' => 'admin',
+			'--database-pass' => 'admin-password',
+			'--admin-pass' => 'admin-password',
+		], $parameters), $this->command->getDefinition());
+
+		return self::invokePrivate($this->command, 'validateInput', [$input, new NullOutput(), ['sqlite', 'mysql', 'pgsql', 'oci']]);
+	}
+
+	public static function encryptionOptions(): array {
+		return [
+			'--database-ssl-mode' => ['--database-ssl-mode', 'verify-full', 'dbsslmode', 'verify-full'],
+			'--database-ssl-ca' => ['--database-ssl-ca', '/ca.pem', 'dbsslca', '/ca.pem'],
+			'--database-ssl-cert' => ['--database-ssl-cert', '/client.crt', 'dbsslcert', '/client.crt'],
+			'--database-ssl-key' => ['--database-ssl-key', '/client.key', 'dbsslkey', '/client.key'],
+			'--database-ssl-crl' => ['--database-ssl-crl', '/crl.pem', 'dbsslcrl', '/crl.pem'],
+			'--database-ssl-no-verify' => ['--database-ssl-no-verify', true, 'dbsslnoverify', true],
+		];
+	}
+
+	/**
+	 * The command only forwards the options, the database setup translates them into the
+	 * system config values and rejects the ones it does not support.
+	 */
+	#[\PHPUnit\Framework\Attributes\DataProvider('encryptionOptions')]
+	public function testForwardsEncryptionOptions(string $parameter, string|bool $value, string $option, string|bool $expected): void {
+		$options = $this->validateInput([
+			'--database' => 'pgsql',
+			$parameter => $value,
+		]);
+
+		$this->assertSame($expected, $options[$option]);
+	}
+
+	public function testNoEncryptionOptions(): void {
+		$options = $this->validateInput(['--database' => 'mysql']);
+
+		foreach (['dbsslmode', 'dbsslca', 'dbsslcert', 'dbsslkey', 'dbsslcrl', 'dbsslnoverify'] as $option) {
+			$this->assertArrayNotHasKey($option, $options);
+		}
+	}
+
+	/**
+	 * An option that does not apply to the chosen database is not filtered out here, it
+	 * has to be reported by the database setup instead of being silently dropped.
+	 */
+	public function testForwardsEncryptionOptionsRegardlessOfDatabase(): void {
+		$options = $this->validateInput([
+			'--database' => 'sqlite',
+			'--database-ssl-ca' => '/ca.pem',
+		]);
+
+		$this->assertSame('/ca.pem', $options['dbsslca']);
+	}
+}

tests/lib/Setup/MySQLTest.php

@@ -17,16 +17,6 @@
 use Test\TestCase;
 
 class MySQLTest extends TestCase {
-	/**
-	 * Numeric literals instead of the PDO::MYSQL_ATTR_* constants: those are deprecated
-	 * since PHP 8.5 and only defined when the MySQL driver is available.
-	 */
-	private const ATTR_SSL_KEY = 1006;
-	private const ATTR_SSL_CERT = 1007;
-	private const ATTR_SSL_CA = 1008;
-	private const ATTR_SSL_VERIFY_SERVER_CERT = 1013;
-	private const ATTR_INIT_COMMAND = 1002;
-
 	private SystemConfig&MockObject $config;
 	private MySQL $database;
 
@@ -48,6 +38,23 @@ protected function setUp(): void {
 		);
 	}
 
+	/**
+	 * The numeric value of a PDO MySQL attribute, e.g. `SSL_CA`.
+	 *
+	 * The values are not stable across PHP versions, so they must never be hardcoded.
+	 * Since PHP 8.5 the `PDO::MYSQL_ATTR_*` constants are deprecated in favor of
+	 * `Pdo\Mysql::ATTR_*`, and either only exists with the MySQL driver installed.
+	 */
+	private function attribute(string $name): int {
+		if (!extension_loaded('pdo_mysql')) {
+			$this->markTestSkipped('The pdo_mysql extension is required to resolve the PDO attribute values');
+		}
+		if (PHP_VERSION_ID >= 80500 && class_exists(\Pdo\Mysql::class)) {
+			return (int)constant('Pdo\Mysql::ATTR_' . $name);
+		}
+		return (int)constant('PDO::MYSQL_ATTR_' . $name);
+	}
+
 	/**
 	 * MySQL/MariaDB is configured through PDO driver options, keyed by the numeric PDO
 	 * attributes - which is why the web installer and CLI cannot pass them directly.
@@ -60,10 +67,10 @@ public function testInitializeMapsEncryptionOptions(): void {
 				'dbhost' => 'db.example.org',
 				'dbtableprefix' => 'oc_',
 				'dbdriveroptions' => [
-					self::ATTR_SSL_CA => '/ca.pem',
-					self::ATTR_SSL_CERT => '/client.crt',
-					self::ATTR_SSL_KEY => '/client.key',
-					self::ATTR_SSL_VERIFY_SERVER_CERT => false,
+					$this->attribute('SSL_CA') => '/ca.pem',
+					$this->attribute('SSL_CERT') => '/client.crt',
+					$this->attribute('SSL_KEY') => '/client.key',
+					$this->attribute('SSL_VERIFY_SERVER_CERT') => false,
 				],
 			]);
 
@@ -87,13 +94,13 @@ public function testInitializeMergesWithRawDriverOptions(): void {
 				'dbhost' => 'db.example.org',
 				'dbtableprefix' => 'oc_',
 				'dbdriveroptions' => [
-					self::ATTR_INIT_COMMAND => 'SET wait_timeout = 28800',
-					self::ATTR_SSL_CA => '/ca.pem',
+					$this->attribute('INIT_COMMAND') => 'SET wait_timeout = 28800',
+					$this->attribute('SSL_CA') => '/ca.pem',
 				],
 			]);
 
 		$this->database->initialize($this->options([
-			'dbdriveroptions' => [self::ATTR_INIT_COMMAND => 'SET wait_timeout = 28800'],
+			'dbdriveroptions' => [$this->attribute('INIT_COMMAND') => 'SET wait_timeout = 28800'],
 			'dbsslca' => '/ca.pem',
 		]));
 	}