[PR #319] [MERGED] Add MySQL TLS/SSL support #318

New issue

Closed

opened 2026-03-03 11:57:14 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 11:57:14 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Finb/bark-server/pull/319
Author: @xinlon-z
Created: 11/16/2025
Status: ✅ Merged
Merged: 11/17/2025
Merged by: @Finb

Base: master ← Head: master

📝 Commits (1)

4b237f8 Add MySQL TLS/SSL support

📊 Changes

2 files changed (+98 additions, -1 deletions)

View changed files

📝 database/mysql.go (+52 -0)
📝 main.go (+46 -1)

📄 Description

Hi maintainer,
This PR adds optional TLS/SSL support for MySQL connections in Bark Server. It allows the server to connect to MySQL securely using a CA certificate, and optionally a client certificate + key. MySQL TLS/SSL is disabled by default, so existing setups continue to work without any changes.
And I have added the following CLI flags to support this feature:

Flag	Type	Default	Description
`--mysql-tls`	bool	false	Enables TLS when connecting to the MySQL server.
`--mysql-skip-verify`	bool	false	Skips verification of the server’s certificate chain (use with caution).
`--mysql-cert`	path	""	Path to the client certificate (`client-cert.pem`).
`--mysql-key`	path	""	Path to the client private key (`client-key.pem`).
`--mysql-ca`	path	""	Path to the CA certificate used to verify the MySQL server.

Example usage:

./bark-server \
--dsn "user:pass@tcp(host:port)/dbname" \
--mysql-tls \
--mysql-ca /path/to/ca.pem \
--mysql-client-cert /path/to/client-cert.pem \
--mysql-client-key /path/to/client-key.pem \
--mysql-tls-skip-verify

I have fully validated it with MySQL 8.4.7 locally:
xinlon@ubuntu-pc:~/work/bark-server$ ./bark-server --dsn "bark:test_passwd@tcp(192.168.11.22:3306)/Bark_Server" --mysql-ca /home/xinlon/ca.pem --mysql-client-cert /home/xinlon/client-cert.pem --mysql-client-key /home/xinlon/client-key.pem --mysql-tls --mysql-tls-skip-verify
2025-11-16 12:12:06 INFO create apns client: 0
2025-11-16 12:12:06 INFO init apns client success...
2025-11-16 12:12:06 INFO Bark Server Has No Basic Auth.
2025-11-16 12:12:06 INFO load route [register_compat] success...
2025-11-16 12:12:06 INFO load route [misc] success...
2025-11-16 12:12:06 INFO load route [push] success...
2025-11-16 12:12:06 INFO load route [register] success...
2025-11-16 12:12:06 INFO load route [push_compat] success...
2025-11-16 12:12:06 INFO MySQL TLS CA: /home/xinlon/ca.pem
2025-11-16 12:12:06 INFO MySQL TLS client cert: /home/xinlon/client-cert.pem
2025-11-16 12:12:06 INFO MySQL TLS client key: /home/xinlon/client-key.pem
2025-11-16 12:12:06 INFO Server certificate verification skipped: true
2025-11-16 12:12:06 INFO Bark Server Listen at: 0.0.0.0:8080 , Database: *database.MySQL

┌───────────────────────────────────────────────────┐
│ Fiber v2.52.9 │
│ http://[::]:8080 │
│ │
│ Handlers ............ 28 Processes ........... 1 │
│ Prefork ....... Disabled PID ............. 24704 │
└───────────────────────────────────────────────────┘

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Finb/bark-server/pull/319 **Author:** [@xinlon-z](https://github.com/xinlon-z) **Created:** 11/16/2025 **Status:** ✅ Merged **Merged:** 11/17/2025 **Merged by:** [@Finb](https://github.com/Finb) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`4b237f8`](https://github.com/Finb/bark-server/commit/4b237f8c78051837f4e882557d4959a4988fe906) Add MySQL TLS/SSL support ### 📊 Changes **2 files changed** (+98 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `database/mysql.go` (+52 -0) 📝 `main.go` (+46 -1) </details> ### 📄 Description Hi maintainer, This PR adds optional TLS/SSL support for MySQL connections in Bark Server. It allows the server to connect to MySQL securely using a CA certificate, and optionally a client certificate + key. MySQL TLS/SSL is disabled by default, so existing setups continue to work without any changes. And I have added the following CLI flags to support this feature: Flag | Type | Default | Description | |-------------------------|-------|---------|-------------| | `--mysql-tls` | bool | false | Enables TLS when connecting to the MySQL server. | | `--mysql-skip-verify` | bool | false | Skips verification of the server’s certificate chain (use with caution). | | `--mysql-cert` | path | "" | Path to the client certificate (`client-cert.pem`). | | `--mysql-key` | path | "" | Path to the client private key (`client-key.pem`). | | `--mysql-ca` | path | "" | Path to the CA certificate used to verify the MySQL server. | Example usage: ./bark-server \ --dsn "user:pass@tcp(host:port)/dbname" \ --mysql-tls \ --mysql-ca /path/to/ca.pem \ --mysql-client-cert /path/to/client-cert.pem \ --mysql-client-key /path/to/client-key.pem \ --mysql-tls-skip-verify I have fully validated it with MySQL 8.4.7 locally: xinlon@ubuntu-pc:~/work/bark-server$ ./bark-server --dsn "bark:test_passwd@tcp(192.168.11.22:3306)/Bark_Server" --mysql-ca /home/xinlon/ca.pem --mysql-client-cert /home/xinlon/client-cert.pem --mysql-client-key /home/xinlon/client-key.pem --mysql-tls --mysql-tls-skip-verify 2025-11-16 12:12:06 INFO create apns client: 0 2025-11-16 12:12:06 INFO init apns client success... 2025-11-16 12:12:06 INFO Bark Server Has No Basic Auth. 2025-11-16 12:12:06 INFO load route [register_compat] success... 2025-11-16 12:12:06 INFO load route [misc] success... 2025-11-16 12:12:06 INFO load route [push] success... 2025-11-16 12:12:06 INFO load route [register] success... 2025-11-16 12:12:06 INFO load route [push_compat] success... 2025-11-16 12:12:06 INFO MySQL TLS CA: /home/xinlon/ca.pem 2025-11-16 12:12:06 INFO MySQL TLS client cert: /home/xinlon/client-cert.pem 2025-11-16 12:12:06 INFO MySQL TLS client key: /home/xinlon/client-key.pem 2025-11-16 12:12:06 INFO Server certificate verification skipped: true 2025-11-16 12:12:06 INFO Bark Server Listen at: 0.0.0.0:8080 , Database: *database.MySQL ┌───────────────────────────────────────────────────┐ │ Fiber v2.52.9 │ │ http://[::]:8080 │ │ │ │ Handlers ............ 28 Processes ........... 1 │ │ Prefork ....... Disabled PID ............. 24704 │ └───────────────────────────────────────────────────┘ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>