Add Bolt TLS termination as optional feature

container/boltage-start.sh

@@ -0,0 +1,58 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: 2026 Bart Broere
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Starts boltage. With BOLTAGE_TLS_SELF_SIGNED=true, it first generates a self-signed
+# TLS certificate, or reuses the one from an earlier start, and points boltage at it.
+set -eu
+
+if [ "${BOLTAGE_TLS_SELF_SIGNED:-false}" = "true" ]; then
+    if [ -n "${BOLTAGE_TLS_CERT:-}${BOLTAGE_TLS_KEY:-}" ]; then
+        echo "boltage: BOLTAGE_TLS_CERT or BOLTAGE_TLS_KEY is set, not using a self-signed certificate" >&2
+    else
+        dir="${BOLTAGE_TLS_DIR:-/var/lib/boltage/tls}"
+        cert="$dir/self-signed.crt"
+        key="$dir/self-signed.key"
+
+        # Host names and addresses the certificate is valid for.
+        names="localhost,127.0.0.1,::1"
+        [ -n "${BOLTAGE_ADVERTISED_HOST:-}" ] && names="$names,$BOLTAGE_ADVERTISED_HOST"
+        [ -n "${BOLTAGE_TLS_HOSTNAMES:-}" ] && names="$names,$BOLTAGE_TLS_HOSTNAMES"
+        is_ip() {
+            case "$1" in
+                *[!0-9.]*) ;;  # not IPv4
+                *) return 0 ;;
+            esac
+            case "$1" in
+                *:*) case "$1" in *[!0-9a-fA-F:.]*) return 1 ;; *) return 0 ;; esac ;;  # IPv6
+            esac
+            return 1
+        }
+        san=""
+        for name in $(echo "$names" | tr ', ' '\n\n' | awk 'NF && !seen[$0]++'); do
+            if is_ip "$name"; then
+                san="${san:+$san,}IP:$name"
+            else
+                san="${san:+$san,}DNS:$name"
+            fi
+        done
+
+        # Generate a new certificate on first start, when the names changed, or when the
+        # stored one expires within 30 days.
+        if [ ! -s "$key" ] || [ "$(cat "$dir/self-signed.names" 2>/dev/null)" != "$san" ] \
+                || ! openssl x509 -in "$cert" -noout -checkend 2592000 >/dev/null 2>&1; then
+            (umask 077 && mkdir -p "$dir")
+            (umask 077 && openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
+                -days 825 -subj "/CN=boltage" -addext "subjectAltName=$san" \
+                -addext "extendedKeyUsage=serverAuth" \
+                -keyout "$key.new" -out "$cert.new" 2>/dev/null)
+            mv "$key.new" "$key"
+            mv "$cert.new" "$cert"
+            echo "$san" > "$dir/self-signed.names"
+            echo "boltage: generated a self-signed TLS certificate for $san in $dir"
+        fi
+        echo "boltage: self-signed TLS certificate, $(openssl x509 -in "$cert" -noout -fingerprint -sha256)"
+        export BOLTAGE_TLS_CERT="$cert" BOLTAGE_TLS_KEY="$key"
+    fi
+fi
+
+exec /opt/boltage/venv/bin/boltage "$@"