feat: Fully featured Go client for the secrets service.

pkg/secretsclient/http.go

@@ -0,0 +1,38 @@
+package secretsclient
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+)
+
+func newMTLSClient(ca, cert, key string) (*http.Client, error) {
+	caPEMBytes, err := os.ReadFile(ca)
+	if err != nil {
+		return nil, err
+	}
+	caPool := x509.NewCertPool()
+	if !caPool.AppendCertsFromPEM(caPEMBytes) {
+		return nil, errors.New("could create a ca pool from file")
+	}
+
+	cliCert, err := tls.LoadX509KeyPair(cert, key)
+	if err != nil {
+		return nil, fmt.Errorf("could not load client cert/key: %w", err)
+	}
+
+	return &http.Client{
+		// TODO: Tune other params.
+		Timeout: 10 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      caPool,
+				Certificates: []tls.Certificate{cliCert},
+			},
+		},
+	}, nil
+}