Add SSL configuration helper for database connections (RepoSSL)

[emancu]

Background

In app-shedul-umbrella, we discovered that Erlang's default SSL hostname verification does not support wildcard certificates. This caused production failures when connecting to pgbouncer which uses wildcard certs (*.pgbouncer.svc.cluster.local).

The fix requires setting customize_hostname_check with the HTTPS match function:

[
  verify: :verify_peer,
  cacertfile: "/path/to/ca_certs.pem",
  server_name_indication: hostname |> String.to_charlist(),
  customize_hostname_check: [
    match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
  ]
]

Currently, each app in the umbrella has its own RepoSSL module that duplicates this logic. This should be centralized in Surgex alongside RepoHelpers.set_opts/2.

Proposal

Add a new function to Surgex (either in RepoHelpers or a new RepoSSL module):

def get_ssl_opts(database_url, env, opts \\ []) do
  case env do
    :prod ->
      if System.get_env("DISABLE_SSL_VERIFICATION") in ["1", "true"] do
        [verify: :verify_none]
      else
        cacertfile = Keyword.get(opts, :cacertfile) || 
                     System.get_env("DATABASE_CA_CERT_PATH") ||
                     "/etc/ssl/certs/database_ca_certs.pem"
        
        [
          cacertfile: cacertfile,
          verify: :verify_peer,
          server_name_indication: database_url |> URI.parse() |> Map.fetch!(:host) |> String.to_charlist(),
          customize_hostname_check: [
            match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
          ]
        ]
      end

    _ ->
      false
  end
end

Benefits

1. Single source of truth - All Fresha repos use the same SSL configuration
2. Prevents bugs - Missing customize_hostname_check causes silent failures with wildcard certs
3. Consistent behavior - All apps handle SSL the same way
4. Easier updates - Fix SSL issues in one place

Testing

Include tests that verify:

• Erlang's default fails on wildcard certs (proving the problem exists)
• With customize_hostname_check, wildcard certs work

See app-shedul-umbrella PR #849 for reference implementation and tests.

References

• PR with fix: https://github.com/surgeventures/app-shedul-umbrella/pull/849
• Postgrex changelog on SSL changes: https://github.com/elixir-ecto/postgrex/blob/master/CHANGELOG.md