Method BuildTLSConfig

config/config.go:353–375

BuildTLSConfig builds tls.Config from TLS configuration.

(acm *autocert.Manager)

// BuildTLSConfig builds tls.Config from TLS configuration.
func (c *TLS) BuildTLSConfig(acm *autocert.Manager) (*tls.Config, error) {
	tlsCfg := tls.Config{
		PreferServerCipherSuites: true,
		MinVersion:               tls.VersionTLS12,
		CurvePreferences: []tls.CurveID{
			tls.CurveP256,
			tls.X25519,
		},
		InsecureSkipVerify: c.InsecureSkipVerify, // nolint: gosec
	}
	if len(c.KeyFile) > 0 && len(c.CertFile) > 0 {
		cert, err := tls.LoadX509KeyPair(c.CertFile, c.KeyFile)
		if err != nil {
			return nil, fmt.Errorf("cannot load cert for `cert_file`=%q, `key_file`=%q: %w",
				c.CertFile, c.KeyFile, err)
		}
		tlsCfg.Certificates = []tls.Certificate{cert}
	} else if acm != nil {
		tlsCfg.GetCertificate = acm.GetCertificate
	}

	return &tlsCfg, nil
}

// HTTPS describes configuration for server to listen HTTPS connections
// It can be autocert with letsencrypt