Add native TLS transport, TLS clients and lego cert sidecarv0.1.1

- bokfd: optional TLS listener (OpenSSL), certificate reload on change
- clients: tls:host:port targets with chain and host verification
- compose: port 8788 and an INWX/lego renewal sidecar
- Makefile: header dependency tracking (-MMD -MP)

1 files changed, 19 insertions, 7 deletions

diff --git a/clients/client.h b/clients/client.h
index 7e18a23..9372e72 100644
--- a/clients/client.h
+++ b/clients/client.h
@@ -4,11 +4,23 @@
 #include <stdint.h>
 
 /* Thin protocol client shared by bokfctl and bokftui. Connects to a unix
-   socket path or "tcp:host:port". */
+   socket path, "tcp:host:port" (plaintext) or "tls:host:port". The TLS
+   client verifies the certificate chain and host name; BOKFD_TLS_CA adds a
+   PEM file to the trust store (for private CAs and tests). */
 
-int client_connect(const char *target);
-int client_send_line(int fd, const char *line);
-char *client_read_line(int fd);
+struct client_conn {
+    int fd;
+    void *ssl;
+    void *ctx;
+};
+
+int client_connect(const char *target, struct client_conn *out);
+void client_close(struct client_conn *c);
+int client_send_line(struct client_conn *c, const char *line);
+char *client_read_line(struct client_conn *c);
+
+/* Human-readable reason for the last failed call. */
+const char *client_last_error(void);
 
 char *client_make_request(const char *cmd, const char *session, int64_t org,
                           const char *args_json, const char *id);
@@ -16,12 +28,12 @@ char *client_make_login_args(const char *user, const char *password);
 
 /* Sends one command and returns the raw response line (malloc'd), or NULL
    on a transport error. */
-char *client_rpc(int fd, const char *cmd, const char *session, int64_t org,
-                 const char *args_json);
+char *client_rpc(struct client_conn *c, const char *cmd, const char *session,
+                 int64_t org, const char *args_json);
 
 /* Password login. Returns 0 and sets *session_out on success; on failure
    returns -1 and sets *err_out to the response line or an error message. */
-int client_login(int fd, const char *user, const char *password,
+int client_login(struct client_conn *c, const char *user, const char *password,
                  char **session_out, char **err_out);
 
 /* Convenience: true when the response line has "ok":true. */