feat: Add POSTGRES_SSL_MODE support for Postgres connection

[thesujai]

Summary

feat: Add POSTGRES_SSL_MODE support for Postgres connection

Changes

feat: Add POSTGRES_SSL_MODE support for Postgres connection

How was this tested?

NA

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Changes how external/managed Postgres connections are established when SSL is enabled; misconfigured sslmode can prevent startup or DB connectivity, though the default remains unchanged.

Overview
Adds optional POSTGRES_SSL_MODE so distributed deployments can set Postgres TLS via the standard sslmode query parameter when the app builds the URL from POSTGRES_* (unset leaves behavior unchanged—no sslmode on the connection string). DATABASE_URL is still used as-is when set; this knob applies to the composed postgres://… path.

The server validates allowed modes (disable, prefer, require, verify-ca, verify-full, no-verify) at boot and fails fast on invalid values. Helm gains externalPostgres.sslMode, which sets POSTGRES_SSL_MODE for external Postgres only; docs are updated in .env.example, values.yaml, and a patch changeset.

^{Reviewed by Cursor Bugbot for commit 58aaff3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 58aaff3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8acb9cf. Configure here.}