feat(database): support configurable SSL mode for PostgreSQL and MySQL

Add ssl_mode configuration option to allow users to customize SSL/TLS
policy for database connections instead of hardcoding sslmode=disable
for PostgreSQL and having no TLS support for MySQL.

Changes:
- database.Config, DatabaseConfig: add SSLMode field
- PostgreSQL DSN: replace hardcoded sslmode=disable with configurable
value
- MySQL DSN: append &tls=<SSLMode> parameter when SSLMode is set
- Full config pipeline: INI/env -> DatabaseConfig -> Config -> DSN ->
subprocess
- New env var BH_DB_SSL_MODE and ini key [database] ssl_mode
- Updated config example and documentation

internal/database/database.go

@@ -28,6 +28,7 @@ type Config struct {
 	DBName   string
 	Path     string // for sqlite
 	DSN      string // for mysql/mariadb unix socket or custom dsn
+	SSLMode  string // postgres: disable/require/verify-ca/verify-full; mysql: true/skip-verify
 }
 
 func Init(cfg *Config) error {
@@ -37,24 +38,19 @@ func Init(cfg *Config) error {
 	loc := systime.CST
 	time.Local = loc
 
+	dsn, err := buildDSN(cfg)
+	if err != nil {
+		return err
+	}
+
 	var dialector gorm.Dialector
 
 	switch cfg.Type {
 	case "sqlite":
-		dialector = sqlite.Open(cfg.Path + "?_busy_timeout=5000")
+		dialector = sqlite.Open(dsn)
 	case "mysql":
-		dsn := cfg.DSN
-		if dsn == "" {
-			dsn = fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=True&loc=Asia%%2FShanghai",
-				cfg.User, cfg.Password, cfg.Host, cfg.Port, cfg.DBName)
-		}
 		dialector = mysql.Open(dsn)
 	case "postgres":
-		dsn := cfg.DSN
-		if dsn == "" {
-			dsn = fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=disable TimeZone=Asia/Shanghai",
-				cfg.Host, cfg.Port, cfg.User, cfg.Password, cfg.DBName)
-		}
 		dialector = postgres.Open(dsn)
 	default:
 		return fmt.Errorf("unsupported database type: %s", cfg.Type)
@@ -102,3 +98,33 @@ func AutoMigrate(models ...interface{}) error {
 func GetDB() *gorm.DB {
 	return DB
 }
+
+func buildDSN(cfg *Config) (string, error) {
+	switch cfg.Type {
+	case "sqlite":
+		return cfg.Path + "?_busy_timeout=5000", nil
+	case "mysql":
+		if cfg.DSN != "" {
+			return cfg.DSN, nil
+		}
+		dsn := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=True&loc=Asia%%2FShanghai",
+			cfg.User, cfg.Password, cfg.Host, cfg.Port, cfg.DBName)
+		if cfg.SSLMode != "" {
+			dsn += "&tls=" + cfg.SSLMode
+		}
+		return dsn, nil
+	case "postgres":
+		if cfg.DSN != "" {
+			return cfg.DSN, nil
+		}
+		sslMode := cfg.SSLMode
+		if sslMode == "" {
+			sslMode = "disable"
+		}
+		dsn := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=%s TimeZone=Asia/Shanghai",
+			cfg.Host, cfg.Port, cfg.User, cfg.Password, cfg.DBName, sslMode)
+		return dsn, nil
+	default:
+		return "", fmt.Errorf("unsupported database type: %s", cfg.Type)
+	}
+}