Skip to content

SQL.Postgres requests TLS on the alchemy dev Hyperdrive passthrough; workerd rejects it #1953

Description

@peterje

In alchemy dev, an Effect Worker using SQL.Postgres({ url: hyperdrive.connectionString }) logs this on its first query:

workerd/api/sockets.c++:681: error: NOSENTRY startTls called with unsupported expectedServerHostname option

The local Hyperdrive binding hands the Worker a localhost URL with sslmode=prefer. SQL/PostgresTls.ts turns prefer into ssl: true, @effect/sql-pg upgrades the socket with a server name, and workerd's startTls does not support that option. The connection then falls back to plaintext on the in-process hop to the passthrough, so queries work, but every new connection logs an error and spends time on the failed upgrade. Together with the passthrough's own connection to the origin, the first query on a cold PlanetScale PS_DEV branch can exceed @effect/sql-pg's 5-second default connectTimeout.

Reproduce: Cloudflare.Hyperdrive.Connection with dev: role.pooledOrigin (PlanetScale), an Effect Worker querying through SQL.Postgres, and alchemy dev.

Suggested fix: when the URL points at the local dev passthrough (localhost), resolve ssl: false rather than true; the passthrough performs TLS to the real origin itself. Observed with alchemy 2.0.0-beta.80 and @effect/sql-pg 4.0.0; SQL/PostgresTls.ts is unchanged on main (ea384f0).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions