From ed1c15929d2eb2dbc6432986c26661bf1549964a Mon Sep 17 00:00:00 2001
From: Anders Betts <anders.betts@gmail.com>
Date: Thu, 17 Sep 2026 21:26:20 +0200
Subject: Add native TLS transport, TLS clients and lego cert sidecar

- bokfd: optional TLS listener (OpenSSL), certificate reload on change
- clients: tls:host:port targets with chain and host verification
- compose: port 8788 and an INWX/lego renewal sidecar
- Makefile: header dependency tracking (-MMD -MP)
---
 src/config.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'src/config.c')

diff --git a/src/config.c b/src/config.c
index 3bce6e9..d1f392a 100644
--- a/src/config.c
+++ b/src/config.c
@@ -24,6 +24,10 @@ void config_defaults(void)
     g_cfg.export_dir = xstrdup("/var/lib/bokfd/export");
     g_cfg.tcp_addr = NULL;
     g_cfg.tcp_enabled = 0;
+    g_cfg.tls_addr = NULL;
+    g_cfg.tls_enabled = 0;
+    g_cfg.tls_cert = xstrdup("/var/lib/bokfd/certs/fullchain.pem");
+    g_cfg.tls_key = xstrdup("/var/lib/bokfd/certs/privkey.pem");
     g_cfg.log_level = LOG_INFO;
     g_cfg.allow_org_create = 1;
     g_cfg.audit_reads = 0;
@@ -52,6 +56,17 @@ static int apply_kv(const char *key, const char *val, char **err)
             set_str(&g_cfg.tcp_addr, val);
             g_cfg.tcp_enabled = 1;
         }
+    } else if (strcmp(key, "tls") == 0) {
+        if (strcmp(val, "off") == 0 || strcmp(val, "") == 0) {
+            g_cfg.tls_enabled = 0;
+        } else {
+            set_str(&g_cfg.tls_addr, val);
+            g_cfg.tls_enabled = 1;
+        }
+    } else if (strcmp(key, "tls_cert") == 0) {
+        set_str(&g_cfg.tls_cert, val);
+    } else if (strcmp(key, "tls_key") == 0) {
+        set_str(&g_cfg.tls_key, val);
     } else if (strcmp(key, "log_level") == 0) {
         g_cfg.log_level = log_level_from_name(val);
     } else if (strcmp(key, "allow_org_create") == 0) {
@@ -137,6 +152,12 @@ void config_apply_env(void)
         set_str(&g_cfg.export_dir, v);
     if ((v = getenv("BOKFD_TCP")))
         apply_kv("tcp", v, NULL);
+    if ((v = getenv("BOKFD_TLS")))
+        apply_kv("tls", v, NULL);
+    if ((v = getenv("BOKFD_TLS_CERT")))
+        set_str(&g_cfg.tls_cert, v);
+    if ((v = getenv("BOKFD_TLS_KEY")))
+        set_str(&g_cfg.tls_key, v);
     if ((v = getenv("BOKFD_LOG_LEVEL")))
         g_cfg.log_level = log_level_from_name(v);
     if ((v = getenv("BOKFD_ALLOW_ORG_CREATE")))
@@ -164,6 +185,9 @@ void config_free(void)
     free(g_cfg.backup_dir);
     free(g_cfg.export_dir);
     free(g_cfg.tcp_addr);
+    free(g_cfg.tls_addr);
+    free(g_cfg.tls_cert);
+    free(g_cfg.tls_key);
     free(g_cfg.synchronous);
     free(g_cfg.chart_k2_file);
     free(g_cfg.chart_k3_file);
-- 
cgit v1.3