Add native TLS transport, TLS clients and lego cert sidecarv0.1.1

- bokfd: optional TLS listener (OpenSSL), certificate reload on change
- clients: tls:host:port targets with chain and host verification
- compose: port 8788 and an INWX/lego renewal sidecar
- Makefile: header dependency tracking (-MMD -MP)

1 files changed, 4 insertions, 2 deletions

diff --git a/Dockerfile b/Dockerfile
index ba76b97..0c22b19 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,6 +3,7 @@
 FROM debian:bookworm-slim AS build
 RUN apt-get update \
  && apt-get install -y --no-install-recommends build-essential libncurses-dev \
+      libssl-dev \
  && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY . .
@@ -10,12 +11,13 @@ RUN make -j"$(nproc)" && make test
 
 FROM debian:bookworm-slim AS runtime
 RUN apt-get update \
- && apt-get install -y --no-install-recommends libncursesw6 ca-certificates \
+ && apt-get install -y --no-install-recommends libncursesw6 libssl3 \
+      ca-certificates util-linux \
  && rm -rf /var/lib/apt/lists/* \
  && useradd --system --uid 10001 --home-dir /var/lib/bokfd \
       --shell /usr/sbin/nologin bokfd \
  && install -d -o bokfd -g bokfd /var/lib/bokfd /var/lib/bokfd/backup \
-      /var/lib/bokfd/export /run/bokfd
+      /var/lib/bokfd/export /var/lib/bokfd/certs /run/bokfd
 COPY --from=build /src/build/bokfd /src/build/bokfctl /src/build/bokftui \
      /usr/local/bin/
 COPY --from=build /src/data/bas_k2.csv /src/data/bas_k3.csv \