best way to set tls certificates directly in memory?

[gabor]

when using the tls certificate options in the connection string, it's assumed the certificates are on disk. in my case i have them in memory (i basically have a *tls.Config already).
what is the best way to use such certificates?

i found a way that works:

connstr := "connection string without tls things"
conf := pgx.ParseConfig(connstr)
conf.TLSConfig = tlsConf
db := pgxstdlib.OpenDB(conf)

but i also saw this warning:

pgx/pgconn/config.go

Lines 204 to 209 in 5c63f64

	// The sslmode "prefer" (the default), sslmode "allow", and multiple hosts are implemented via the Fallbacks field of
	// the Config struct. If TLSConfig is manually changed it will not affect the fallbacks. For example, in the case of
	// sslmode "prefer" this means it will first try the main Config settings which use TLS, then it will try the fallback
	// which does not use TLS. This can lead to an unexpected unencrypted connection if the main TLS config is manually
	// changed later but the unencrypted fallback is present. Ensure there are no stale fallbacks when manually setting
	// TLSConfig.

"Ensure there are no stale fallbacks when manually setting TLSConfig."

is there maybe a more robust way to do this?

if not, how should i "ensure there are no stale fallbacks"? before replacing conf.TLSConfig, should i check if it's nil or not, and return an error if it's not nil?

[jackc]

ensure there are no stale fallbacks

Make sure that Config.Fallbacks is empty.