CMO: TLS in transit + mTLS (#27)

Dockerfile

@@ -10,22 +10,25 @@ RUN apt-get update \
         build-essential \
         ca-certificates \
         pkg-config \
+        libssl-dev \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /src
 COPY . .
 
 # distclean drops any host object files that slipped into the build context.
 RUN make distclean || true \
-    && make -j"$(nproc)" \
-    && make install PREFIX=/opt/cmo
+    && make -j"$(nproc)" BUILD_TLS=yes \
+    && make install BUILD_TLS=yes PREFIX=/opt/cmo
 
 FROM debian:bookworm-slim AS runtime
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         gosu \
+        libssl3 \
+        openssl \
     && rm -rf /var/lib/apt/lists/* \
     && groupadd --system --gid 999 valkey \
     && useradd --system --uid 999 --gid valkey --home-dir /data --shell /usr/sbin/nologin valkey \

deploy/docker-entrypoint.sh

@@ -524,6 +524,24 @@ sed \
             esac
         fi
     fi
+    # TLS in transit (plan item 27). Set CMO_TLS_CERT/KEY/CA to enable.
+    # CMO_TLS_ONLY=yes closes the plain port; CMO_TLS_MTLS=yes requires client certs.
+    if [ -n "${CMO_TLS_CERT:-}" ]; then
+        for f in "$CMO_TLS_CERT" "${CMO_TLS_KEY:?CMO_TLS_KEY is required with CMO_TLS_CERT}" "${CMO_TLS_CA:?CMO_TLS_CA is required with CMO_TLS_CERT}"; do
+            [ -r "$f" ] || { echo "TLS file not readable: $f" >&2; exit 1; }
+        done
+        printf '%s\n' "tls-port ${CMO_TLS_PORT:-6380}"
+        printf '%s\n' "tls-cert-file ${CMO_TLS_CERT}"
+        printf '%s\n' "tls-key-file ${CMO_TLS_KEY}"
+        printf '%s\n' "tls-ca-cert-file ${CMO_TLS_CA}"
+        printf '%s\n' "tls-auth-clients $([ "${CMO_TLS_MTLS:-no}" = yes ] && echo yes || echo no)"
+        printf '%s\n' "tls-protocols \"TLSv1.2 TLSv1.3\""
+        printf '%s\n' "tls-replication yes"
+        printf '%s\n' "tls-cluster yes"
+        if [ "${CMO_TLS_ONLY:-no}" = yes ]; then
+            printf '%s\n' "port 0"
+        fi
+    fi
     if [ "$CMO_CLUSTER_ENABLED" = "yes" ]; then
         printf '%s\n' "cluster-enabled yes"
         printf '%s\n' "cluster-config-file ${CMO_DATA_DIR}/nodes.conf"

deploy/tls-gen.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Make a private CA plus server and client certs for home-lab TLS (plan item 27).
+# Usage: deploy/tls-gen.sh <out-dir> [server-dns-name ...]
+# Keys are written 0600. Use a real CA for anything reachable from the internet.
+set -eu
+out="${1:?usage: tls-gen.sh <out-dir> [dns ...]}"; shift
+[ $# -gt 0 ] || set -- localhost
+mkdir -p "$out"; umask 077
+san=""; for n in "$@"; do san="${san}${san:+,}DNS:${n}"; done
+san="${san},IP:127.0.0.1"
+[ -f "$out/ca.key" ] || {
+  openssl genrsa -out "$out/ca.key" 4096 2>/dev/null
+  openssl req -x509 -new -key "$out/ca.key" -sha256 -days 3650 -subj "/CN=Cache-Me-Outside CA" -out "$out/ca.crt"
+}
+mk() {
+  openssl genrsa -out "$out/$1.key" 2048 2>/dev/null
+  openssl req -new -key "$out/$1.key" -subj "/CN=$2" -out "$out/$1.csr"
+  printf 'subjectAltName=%s\nextendedKeyUsage=%s\n' "$3" "$4" > "$out/$1.ext"
+  openssl x509 -req -in "$out/$1.csr" -CA "$out/ca.crt" -CAkey "$out/ca.key" -CAcreateserial \
+    -days 825 -sha256 -extfile "$out/$1.ext" -out "$out/$1.crt" 2>/dev/null
+  rm -f "$out/$1.csr" "$out/$1.ext"
+}
+mk server "$1" "$san" serverAuth,clientAuth
+mk client cmo-client "DNS:cmo-client" clientAuth
+chmod 644 "$out"/*.crt
+echo "Wrote $out/{ca,server,client}.{crt,key}"