fix: add DB_SSL=true permanently to SSM, ec2 startup, and deploy job

infra/terraform/ec2.tf

@@ -87,6 +87,12 @@ resource "aws_instance" "app" {
       --output text \
       --region ${var.aws_region})
 
+    DB_SSL=$(aws ssm get-parameter \
+      --name "/${var.project_name}/db_ssl" \
+      --query "Parameter.Value" \
+      --output text \
+      --region ${var.aws_region})
+
     # Authenticate to ECR
     aws ecr get-login-password --region ${var.aws_region} | \
       docker login --username AWS --password-stdin \
@@ -106,6 +112,7 @@ resource "aws_instance" "app" {
       -e DB_NAME=$DB_NAME \
       -e DB_USER=$DB_USER \
       -e DB_PASSWORD=$DB_PASSWORD \
+      -e DB_SSL=$DB_SSL \
       -e JWT_SECRET=$JWT_SECRET \
       ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/task-backend:latest
 

infra/terraform/ssm.tf

@@ -3,13 +3,11 @@
 # Stores all runtime secrets for the EC2 instance.
 # EC2 fetches these at startup - no secrets in user data.
 # --------------------------------------------------
-
 resource "aws_ssm_parameter" "db_host" {
   name        = "/${var.project_name}/db_host"
   description = "RDS instance hostname"
   type        = "SecureString"
   value       = var.db_host
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -21,7 +19,6 @@ resource "aws_ssm_parameter" "db_name" {
   description = "PostgreSQL database name"
   type        = "SecureString"
   value       = var.db_name
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -33,7 +30,6 @@ resource "aws_ssm_parameter" "db_username" {
   description = "PostgreSQL master username"
   type        = "SecureString"
   value       = var.db_username
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -45,7 +41,6 @@ resource "aws_ssm_parameter" "db_password" {
   description = "PostgreSQL master password"
   type        = "SecureString"
   value       = var.db_password
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -57,7 +52,17 @@ resource "aws_ssm_parameter" "jwt_secret" {
   description = "JWT signing secret for authentication"
   type        = "SecureString"
   value       = var.jwt_secret
-
+  tags = {
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+resource "aws_ssm_parameter" "db_ssl" {
+  name        = "/${var.project_name}/db_ssl"
+  description = "Enable SSL for RDS connection"
+  type        = "String"
+  value       = "true"
   tags = {
     Project     = var.project_name
     Environment = var.environment