feat: Tested (with curl) server implementation of the secrets store.

pkg/secretsserver/tls.go

@@ -0,0 +1,29 @@
+package secretsserver
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"os"
+)
+
+// mTLSConfigFromCA returns a tls config that enforces client auth with certs
+// issued by the provided ca.
+func mTLSConfigFromCA(ca string) (*tls.Config, error) {
+	caPEMBytes, err := os.ReadFile(ca)
+	if err != nil {
+		return nil, err
+	}
+	caCertPool := x509.NewCertPool()
+	if added := caCertPool.AppendCertsFromPEM(caPEMBytes); !added {
+		return nil, errors.New("ca file did not contain a valid cert")
+	}
+	return &tls.Config{
+		// Force server to deman and verify cert from clients.
+		ClientAuth: tls.RequireAndVerifyClientCert,
+		// CAs that will be used to verify client certs.
+		ClientCAs: caCertPool,
+		// Safer to default to tls 1.3
+		MinVersion: tls.VersionTLS13,
+	}, nil
+}