start without tls first and then load certificates again

[boddumanohar]

related PR on the Vela controller Side: simplyblock/vela-controller#623

When PGBouncer starts, we first start with Non-TLS and then start with TLS once the certificates are available.

Waiting for certificates...
01/Mar/2026:02:55:56 +0000: Starting PostgREST 14.3...
01/Mar/2026:02:55:56 +0000: API server listening on 0.0.0.0:3000
01/Mar/2026:02:55:56 +0000: Listening for database notifications on the "pgrst" channel
01/Mar/2026:02:55:56 +0000: Successfully connected to PostgreSQL 18.1 on x86_64-linux, compiled by gcc-14.3.0, 64-bit
01/Mar/2026:02:55:56 +0000: Connection Pool initialized with a maximum size of 10 connections
01/Mar/2026:02:55:56 +0000: Config reloaded
01/Mar/2026:02:55:56 +0000: Schema cache queried in 927.6 milliseconds
01/Mar/2026:02:55:56 +0000: Schema cache loaded 3 Relations, 2 Relationships, 4 Functions, 0 Domain Representations, 4 Media Type Handlers, 1196 Timezones
01/Mar/2026:02:55:56 +0000: Schema cache loaded in 7.7 milliseconds
Certificates found. Enabling TLS and reloading PgBouncer...

the logs from PGBouncer

# tail -f /tmp/pgbouncer.log
2026-03-02 13:47:26.634 UTC [312] LOG kernel file descriptor limit: 1024 (hard: 4096); max_client_conn: 100, max expected fd use: 132
2026-03-02 13:47:26.636 UTC [312] LOG listening on 0.0.0.0:6432
2026-03-02 13:47:26.636 UTC [312] LOG process up: PgBouncer 1.25.1, libevent 2.1.12-stable (epoll), adns: c-ares 1.34.5, tls: OpenSSL 3.6.0 1 Oct 2025
2026-03-02 13:48:56.591 UTC [312] LOG got SIGHUP, re-reading config


2026-03-02 13:52:22.846 UTC [312] LOG got SIGHUP, re-reading config

also the second reload during certificate renewal

[boddumanohar]

this is not required as we can provision a temporary certificate using the annotation cert-manager.io/issue-temporary-certificate: "true"