Add Bolt TLS termination as optional feature

Containerfile

@@ -53,7 +53,7 @@ RUN python3 -m build --sdist --outdir /dist /src \
 FROM ${SLIM_BASE_IMAGE} AS slim
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends python3 python3-psycopg python3-venv \
+    && apt-get install -y --no-install-recommends openssl python3 python3-psycopg python3-venv \
     && rm -rf /var/lib/apt/lists/*
 
 # boltage itself, using Debian's psycopg and the other dependencies from PyPI. License
@@ -70,8 +70,15 @@ COPY LICENSE THIRD_PARTY_NOTICES.md /usr/share/doc/boltage/
 COPY --from=browser /src/LICENSE /src/NOTICE.txt /src/LICENSES.txt /neo4j-browser-source.tar.gz \
     /usr/share/doc/boltage/neo4j-browser/
 COPY --from=browser /src/dist /opt/boltage/browser
+COPY container/boltage-start.sh /usr/local/bin/boltage-start.sh
 
-RUN useradd --system --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin boltage
+# uid and gid 999, the same as the postgres user that runs boltage in the full image,
+# so mounted certificates need the same permissions in both. /var/lib/boltage holds
+# the self-signed certificate, when there is one.
+RUN groupadd --system --gid 999 boltage \
+    && useradd --system --uid 999 --gid boltage --no-create-home --home-dir /nonexistent \
+        --shell /usr/sbin/nologin boltage \
+    && install -d -o boltage -g boltage -m 0700 /var/lib/boltage
 USER boltage
 
 ENV BOLTAGE_BROWSER_DIR=/opt/boltage/browser \
@@ -81,7 +88,7 @@ ENV BOLTAGE_BROWSER_DIR=/opt/boltage/browser \
 # 7474: neo4j-browser (HTTP), 7687: Bolt
 EXPOSE 7474 7687
 
-CMD ["/opt/boltage/venv/bin/boltage"]
+CMD ["/usr/local/bin/boltage-start.sh"]
 
 
 FROM ${AGE_IMAGE} AS full
@@ -124,7 +131,8 @@ ADD https://raw.githubusercontent.com/apache/age/${AGE_SOURCE_REF}/LICENSE \
 COPY --from=browser /src/dist /opt/boltage/browser
 COPY container/initdb/ /docker-entrypoint-initdb.d/
 COPY container/pgadmin/config_distro.py /opt/boltage/pgadmin/config_distro.py
-COPY container/boltage-entrypoint.sh /usr/local/bin/boltage-entrypoint.sh
+COPY container/boltage-entrypoint.sh container/boltage-start.sh /usr/local/bin/
+RUN install -d -o postgres -g postgres -m 0700 /var/lib/boltage
 
 ENV BOLTAGE_DEFAULT_GRAPH=neo4j \
     BOLTAGE_BROWSER_DIR=/opt/boltage/browser \