diff --git a/cmd.go b/cmd.go
index 413e1a2..8800c3d 100644
--- a/cmd.go
+++ b/cmd.go
@@ -107,6 +107,12 @@ func init() {
 		log.Fatal(err)
 	}
 
+	// db.sslmode
+	apiCmd.Flags().String(FlagDBSSLMode, DefaultDBSSLMode, DescriptionDBSSLMode)
+	if err := viper.BindPFlag(ViperDBSSLMode, apiCmd.Flags().Lookup(FlagDBSSLMode)); err != nil {
+		log.Fatal(err)
+	}
+
 	// db.host
 	apiCmd.Flags().String(FlagDBHost, DefaultDBHost, DescriptionDBHost)
 	if err := viper.BindPFlag(ViperDBHost, apiCmd.Flags().Lookup(FlagDBHost)); err != nil {
@@ -208,13 +214,13 @@ var webCmd = &cobra.Command{
 	Short: "Démarrer le client web",
 	Args:  cobra.ExactArgs(0),
 	Run: func(cmd *cobra.Command, args []string) {
-		webApiHost = viper.GetString(viperWebAPIHost)
-		webApiKey = viper.GetString(viperWebAPIKey)
-		webApiPort = viper.GetInt(viperWebAPIPort)
-		webApiProtocol = viper.GetString(viperWebAPIProtocol)
-		webPassword = viper.GetString(viperWebPassword)
-		webPort = viper.GetInt(viperWebPort)
-		webUser = viper.GetString(viperWebUser)
+		webApiHost = viper.GetString(ViperWebAPIHost)
+		webApiKey = viper.GetString(ViperWebAPIKey)
+		webApiPort = viper.GetInt(ViperWebAPIPort)
+		webApiProtocol = viper.GetString(ViperWebAPIProtocol)
+		webPassword = viper.GetString(ViperWebPassword)
+		webPort = viper.GetInt(ViperWebPort)
+		webUser = viper.GetString(ViperWebUser)
 
 		// Ping API server
 		/*
@@ -271,44 +277,44 @@ func init() {
 	//templatesFS = web.GetTemplates()
 
 	// web.api.host
-	webCmd.Flags().String(flagWebAPIHost, defaultWebAPIHost, descriptionWebAPIHost)
-	if err := viper.BindPFlag(viperWebAPIHost, webCmd.Flags().Lookup(flagWebAPIHost)); err != nil {
+	webCmd.Flags().String(FlagWebAPIHost, DefaultWebAPIHost, DescriptionWebAPIHost)
+	if err := viper.BindPFlag(ViperWebAPIHost, webCmd.Flags().Lookup(FlagWebAPIHost)); err != nil {
 		log.Fatal(err)
 	}
 
 	// web.api.key
-	webCmd.Flags().String(flagWebAPIKey, defaultWebAPIKey, descriptionWebAPIKey)
-	if err := viper.BindPFlag(viperWebAPIKey, webCmd.Flags().Lookup(flagWebAPIKey)); err != nil {
+	webCmd.Flags().String(FlagWebAPIKey, DefaultWebAPIKey, DescriptionWebAPIKey)
+	if err := viper.BindPFlag(ViperWebAPIKey, webCmd.Flags().Lookup(FlagWebAPIKey)); err != nil {
 		log.Fatal(err)
 	}
 
 	// web.api.protocol
-	webCmd.Flags().String(flagWebAPIProtocol, defaultWebAPIProtocol, descriptionWebAPIProtocol)
-	if err := viper.BindPFlag(viperWebAPIProtocol, webCmd.Flags().Lookup(flagWebAPIProtocol)); err != nil {
+	webCmd.Flags().String(FlagWebAPIProtocol, DefaultWebAPIProtocol, DescriptionWebAPIProtocol)
+	if err := viper.BindPFlag(ViperWebAPIProtocol, webCmd.Flags().Lookup(FlagWebAPIProtocol)); err != nil {
 		log.Fatal(err)
 	}
 
 	// web.api.port
-	webCmd.Flags().Int(flagWebAPIPort, defaultWebAPIPort, descriptionWebAPIPort)
-	if err := viper.BindPFlag(viperWebAPIPort, webCmd.Flags().Lookup(flagWebAPIPort)); err != nil {
+	webCmd.Flags().Int(FlagWebAPIPort, DefaultWebAPIPort, DescriptionWebAPIPort)
+	if err := viper.BindPFlag(ViperWebAPIPort, webCmd.Flags().Lookup(FlagWebAPIPort)); err != nil {
 		log.Fatal(err)
 	}
 
 	// web.password
-	webCmd.Flags().String(flagWebPassword, defaultWebPassword, descriptionWebPassword)
-	if err := viper.BindPFlag(viperWebPassword, webCmd.Flags().Lookup(flagWebPassword)); err != nil {
+	webCmd.Flags().String(FlagWebPassword, DefaultWebPassword, DescriptionWebPassword)
+	if err := viper.BindPFlag(ViperWebPassword, webCmd.Flags().Lookup(FlagWebPassword)); err != nil {
 		log.Fatal(err)
 	}
 
 	// web.port
-	webCmd.Flags().Int(flagWebPort, defaultWebPort, descriptionWebPort)
-	if err := viper.BindPFlag(viperWebPort, webCmd.Flags().Lookup(flagWebPort)); err != nil {
+	webCmd.Flags().Int(FlagWebPort, DefaultWebPort, DescriptionWebPort)
+	if err := viper.BindPFlag(ViperWebPort, webCmd.Flags().Lookup(FlagWebPort)); err != nil {
 		log.Fatal(err)
 	}
 
 	// web.user
-	webCmd.Flags().String(flagWebUser, defaultWebUser, descriptionWebUser)
-	if err := viper.BindPFlag(viperWebUser, webCmd.Flags().Lookup(flagWebUser)); err != nil {
+	webCmd.Flags().String(FlagWebUser, DefaultWebUser, DescriptionWebUser)
+	if err := viper.BindPFlag(ViperWebUser, webCmd.Flags().Lookup(FlagWebUser)); err != nil {
 		log.Fatal(err)
 	}
 }
diff --git a/config.go b/config.go
index c0108b4..73d6007 100644
--- a/config.go
+++ b/config.go
@@ -1,5 +1,7 @@
 package main
 
+//TODO move flag declarations here
+
 const (
 	ViperAPIPort       string = "api.port"
 	FlagAPIPort        string = "api-port"
@@ -16,6 +18,11 @@ const (
 	DefaultDBDatabase     string = "bottin"
 	DescriptionDBDatabase string = "Postgres database"
 
+	ViperDBSSLMode       string = "db.sslmode"
+	FlagDBSSLMode        string = "db-sslmode"
+	DefaultDBSSLMode     string = "prefer"
+	DescriptionDBSSLMode string = "Postgres sslmode"
+
 	ViperDBHost       string = "db.host"
 	FlagDBHost        string = "db-host"
 	DefaultDBHost     string = "db"
@@ -36,40 +43,40 @@ const (
 	DefaultDBUser     string = "bottin"
 	DescriptionDBUser string = "Postgres user"
 
-	viperWebUser       string = "web.user"
-	flagWebUser        string = "web-user"
-	defaultWebUser     string = "bottin"
-	descriptionWebUser string = "Web client basic auth user"
+	ViperWebUser       string = "web.user"
+	FlagWebUser        string = "web-user"
+	DefaultWebUser     string = "bottin"
+	DescriptionWebUser string = "Web client basic auth user"
 
-	viperWebPassword       string = "web.password"
-	flagWebPassword        string = "web-password"
-	defaultWebPassword     string = "bottin"
-	descriptionWebPassword string = "Web client basic auth password"
+	ViperWebPassword       string = "web.password"
+	FlagWebPassword        string = "web-password"
+	DefaultWebPassword     string = "bottin"
+	DescriptionWebPassword string = "Web client basic auth password"
 
-	viperWebPort       string = "web.port"
-	flagWebPort        string = "web-port"
-	defaultWebPort     int    = 2312
-	descriptionWebPort string = "Web client port"
+	ViperWebPort       string = "web.port"
+	FlagWebPort        string = "web-port"
+	DefaultWebPort     int    = 2312
+	DescriptionWebPort string = "Web client port"
 
-	viperWebAPIHost       string = "api.host"
-	flagWebAPIHost        string = "api-host"
-	defaultWebAPIHost     string = "api"
-	descriptionWebAPIHost string = "Target API server host"
+	ViperWebAPIHost       string = "api.host"
+	FlagWebAPIHost        string = "api-host"
+	DefaultWebAPIHost     string = "api"
+	DescriptionWebAPIHost string = "Target API server host"
 
-	viperWebAPIKey       string = "api.key"
-	flagWebAPIKey        string = "api-key"
-	defaultWebAPIKey     string = "bottin"
-	descriptionWebAPIKey string = "Target API server key"
+	ViperWebAPIKey       string = "api.key"
+	FlagWebAPIKey        string = "api-key"
+	DefaultWebAPIKey     string = "bottin"
+	DescriptionWebAPIKey string = "Target API server key"
 
-	viperWebAPIPort       string = "api.port"
-	flagWebAPIPort        string = "api-port"
-	defaultWebAPIPort     int    = 1312
-	descriptionWebAPIPort string = "Target API server port"
+	ViperWebAPIPort       string = "api.port"
+	FlagWebAPIPort        string = "api-port"
+	DefaultWebAPIPort     int    = 1312
+	DescriptionWebAPIPort string = "Target API server port"
 
-	viperWebAPIProtocol       string = "api.protocol"
-	flagWebAPIProtocol        string = "api-protocol"
-	defaultWebAPIProtocol     string = "http"
-	descriptionWebAPIProtocol string = "Target API server protocol (http/https)"
+	ViperWebAPIProtocol       string = "api.protocol"
+	FlagWebAPIProtocol        string = "api-protocol"
+	DefaultWebAPIProtocol     string = "http"
+	DescriptionWebAPIProtocol string = "Target API server protocol (http/https)"
 )
 
 type Config struct {
@@ -97,3 +104,24 @@ type Config struct {
 		} `yaml:"api"`
 	} `yaml:"web"`
 }
+
+// DefaultConfig returns a Config filled with the default values from the
+// `Default*` constants defined in this file.
+func DefaultConfig() (cfg Config) {
+	cfg.API.Port = DefaultAPIPort
+	cfg.API.Key = DefaultAPIKey
+	cfg.DB.Database = DefaultDBDatabase
+	cfg.DB.Host = DefaultDBHost
+	cfg.DB.SSLMode = DefaultDBSSLMode
+	cfg.DB.Password = DefaultDBPassword
+	cfg.DB.Port = DefaultDBPort
+	cfg.DB.User = DefaultDBUser
+	cfg.Web.User = DefaultWebUser
+	cfg.Web.Password = DefaultWebPassword
+	cfg.Web.Port = DefaultWebPort
+	cfg.Web.API.Host = DefaultWebAPIHost
+	cfg.Web.API.Key = DefaultWebAPIKey
+	cfg.Web.API.Port = DefaultWebAPIPort
+	cfg.Web.API.Protocol = DefaultWebAPIProtocol
+	return
+}
diff --git a/db_test.go b/db_test.go
index 0f508a5..4c3881a 100644
--- a/db_test.go
+++ b/db_test.go
@@ -6,12 +6,13 @@ import (
 	"testing"
 
 	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/spf13/viper"
 )
 
-// path to a file containing the db password
-var passfile string
-
 func TestDB(t *testing.T) {
+	cfg := DefaultConfig()
+	cfg.DB.Password = viper.GetString(ViperDBPassword)
+
 	ctx := context.Background()
 
 	//prep
@@ -19,12 +20,12 @@ func TestDB(t *testing.T) {
 		ctx,
 		fmt.Sprintf(
 			"user=%s password=%s database=%s host=%s port=%d sslmode=%s ",
-			"bottin",
-			dbPassword,
-			"bottin",
-			"postgres.agecem.com",
-			5432,
-			"require", //TODO change to "require"
+			cfg.DB.User,
+			cfg.DB.Password,
+			cfg.DB.Database,
+			cfg.DB.Host,
+			cfg.DB.Port,
+			cfg.DB.SSLMode,
 		))
 	if err != nil {
 		t.Error(err)