fix: disable SSL in postgresql.conf for CNPG snapshot compatibility

[Negashev]

Problem

CNPG snapshots have ssl = on in postgresql.conf. asyncpg tries SSL handshake through WebSocket tunnel → binary SSL data doesn't pass through tcp-over-websocket → Connection reset by peer.

The existing fix only overwrites pg_hba.conf (host all all all trust) but does NOT disable SSL in postgresql.conf. PostgreSQL still requires SSL, asyncpg tries SSL, fails through tunnel.

Solution

Add sed -i 's/^ssl.*=.*on/ssl = off/' /var/lib/postgresql/data/postgresql.conf alongside existing pg_hba.conf overwrite. Both run before docker-entrypoint.sh postgres starts.

Related

• PR fix: retry-loop re-provisioning on upstream DB loss #3: retry-loop re-provisioning
• PR fix: watchdog DNS tolerance + pg_isready in wait-service #4: watchdog tolerance + pg_isready
• PR fix: remove ttlStrategy — rely on uptime container for lifecycle #5: remove ttlStrategy
• Root cause: asyncpg SSL handshake fails through WebSocket tunnel