Add native TLS transport, TLS clients and lego cert sidecarv0.1.1

- bokfd: optional TLS listener (OpenSSL), certificate reload on change
- clients: tls:host:port targets with chain and host verification
- compose: port 8788 and an INWX/lego renewal sidecar
- Makefile: header dependency tracking (-MMD -MP)

1 files changed, 29 insertions, 0 deletions

diff --git a/compose.yaml b/compose.yaml
index d1739fd..5f824c0 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -6,6 +6,8 @@ services:
     build:
       context: .
     restart: unless-stopped
+    ports:
+      - "8788:8788"
     volumes:
       - ./var/db:/var/lib/bokfd
       - ./var/run:/run/bokfd
@@ -15,3 +17,30 @@ services:
       BOKFD_BACKUP_DIR: /var/lib/bokfd/backup
       BOKFD_EXPORT_DIR: /var/lib/bokfd/export
       BOKFD_LOG_LEVEL: info
+      BOKFD_TLS: 0.0.0.0:8788
+      BOKFD_TLS_CERT: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.crt
+      BOKFD_TLS_KEY: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.key
+
+  certs:
+    image: goacme/lego:latest
+    restart: unless-stopped
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        while :; do
+          if [ -n "$INWX_USERNAME" ] && [ -n "$INWX_PASSWORD" ]; then
+            /lego --path=/certs --email="$LEGO_EMAIL" --dns=inwx \
+              --domains="$LEGO_DOMAIN" --accept-tos run --days 30 || true
+            chown -R 10001:10001 /certs || true
+          else
+            echo "certs: set INWX_USERNAME and INWX_PASSWORD in .env"
+          fi
+          sleep 12h
+        done
+    environment:
+      LEGO_EMAIL: ${LEGO_EMAIL:-anders@makandra.eu}
+      LEGO_DOMAIN: ${LEGO_DOMAIN:-bokf.makandra.eu}
+      INWX_USERNAME: ${INWX_USERNAME:-}
+      INWX_PASSWORD: ${INWX_PASSWORD:-}
+    volumes:
+      - ./var/db/certs:/certs