TLS certificates: Jarl obtains and renews them over ACME

Jarl is now an ACME client (lego's core, no DNS providers). It answers
DNS-01 challenges in a zone it serves, or through Porkbun's DNS API while
Porkbun serves the domain; "auto" decides from the domain's public name
servers at every renewal, and a CNAME on _acme-challenge is followed.
Certificates are used for jarld's HTTPS (served without a restart; each
port speaks HTTPS and plain HTTP, plain HTTP from loopback and trusted
proxies still served) and/or written for named's DNS over TLS/HTTPS, with
rndc reconfig on renewal. Renewal follows the CA's ARI window or two
thirds of the lifetime, with back-off. Certificates you renew yourself
can be used too. Certificates page and dashboard card, jarl cert,
/api/v1/certificates, Prometheus gauges, docs/certificates.md, and an
e2e section against Pebble.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/sniff.go

@@ -0,0 +1,147 @@
+package server
+
+import (
+	"bufio"
+	"crypto/tls"
+	"errors"
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+	"sync"
+	"time"
+)
+
+// sniffListener serves TLS and plain HTTP on the same port: it looks at a
+// connection's first byte and hands the server a *tls.Conn when it is a
+// TLS handshake (0x16), the plain connection otherwise. That way jarld
+// can start serving HTTPS when a certificate turns up (one Jarl obtains,
+// docs/certificates.md) without a restart, and a plain-HTTP bookmark gets
+// a redirect instead of an error.
+type sniffListener struct {
+	net.Listener
+	cfg  *tls.Config
+	ch   chan net.Conn
+	errc chan error
+	done chan struct{}
+	once sync.Once
+}
+
+func newSniffListener(ln net.Listener, cfg *tls.Config) *sniffListener {
+	l := &sniffListener{Listener: ln, cfg: cfg, ch: make(chan net.Conn), errc: make(chan error, 1), done: make(chan struct{})}
+	go l.loop()
+	return l
+}
+
+func (l *sniffListener) loop() {
+	for {
+		c, err := l.Listener.Accept()
+		if err != nil {
+			var ne net.Error
+			if errors.As(err, &ne) && ne.Timeout() {
+				time.Sleep(50 * time.Millisecond)
+				continue
+			}
+			select {
+			case l.errc <- err:
+			default:
+			}
+			return
+		}
+		go l.classify(c)
+	}
+}
+
+func (l *sniffListener) classify(c net.Conn) {
+	c.SetReadDeadline(time.Now().Add(10 * time.Second))
+	br := bufio.NewReader(c)
+	b, err := br.Peek(1)
+	c.SetReadDeadline(time.Time{})
+	if err != nil {
+		c.Close()
+		return
+	}
+	var out net.Conn = &peekedConn{Conn: c, r: br}
+	if b[0] == 0x16 {
+		out = tls.Server(out, l.cfg)
+	}
+	select {
+	case l.ch <- out:
+	case <-l.done:
+		c.Close()
+	}
+}
+
+func (l *sniffListener) Accept() (net.Conn, error) {
+	select {
+	case c := <-l.ch:
+		return c, nil
+	case err := <-l.errc:
+		return nil, err
+	case <-l.done:
+		return nil, net.ErrClosed
+	}
+}
+
+func (l *sniffListener) Close() error {
+	l.once.Do(func() { close(l.done) })
+	return l.Listener.Close()
+}
+
+// peekedConn reads through the buffer that holds the peeked byte.
+type peekedConn struct {
+	net.Conn
+	r *bufio.Reader
+}
+
+func (c *peekedConn) Read(p []byte) (int, error) { return c.r.Read(p) }
+
+var errNoCertificate = errors.New("no certificate for HTTPS yet")
+
+// webCertificate is the certificate jarld serves: one Jarl manages with
+// the web use, else tls.cert_file.
+func (s *Server) webCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	if s.cfg.Certs != nil {
+		if c := s.cfg.Certs.WebCertificate(); c != nil {
+			return c, nil
+		}
+	}
+	if s.certs != nil {
+		return s.certs.get(hello)
+	}
+	return nil, errNoCertificate
+}
+
+// httpsAvailable reports whether jarld has a certificate to serve.
+func (s *Server) httpsAvailable() bool {
+	return s.certs != nil || s.cfg.Certs != nil && s.cfg.Certs.WebCertificate() != nil
+}
+
+// requireHTTPS sends plain-HTTP requests to HTTPS once jarld has a
+// certificate: browsers (GET and HEAD) get a redirect, anything else an
+// error, so tokens and passwords aren't sent in the clear again. Requests
+// from loopback (tools on this server) and from trusted proxies (which
+// terminate TLS themselves) are served as they are.
+func (s *Server) requireHTTPS(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.TLS != nil || !s.httpsAvailable() {
+			next.ServeHTTP(w, r)
+			return
+		}
+		host, _, _ := net.SplitHostPort(r.RemoteAddr)
+		if a, err := netip.ParseAddr(host); err == nil && (a.Unmap().IsLoopback() || s.trusted(a.Unmap())) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		target := "https://" + r.Host + r.URL.RequestURI()
+		if r.Method == http.MethodGet || r.Method == http.MethodHead {
+			http.Redirect(w, r, target, http.StatusPermanentRedirect)
+			return
+		}
+		msg := "jarld serves HTTPS on this port; use " + strings.TrimSuffix(target, r.URL.RequestURI())
+		if r.Header.Get("Authorization") != "" {
+			msg += ". This request's token crossed the network unencrypted; if that network isn't trusted, rotate the token"
+		}
+		writeError(w, http.StatusBadRequest, "https_required", msg)
+	})
+}