Reintroduce TLS support for device listener

preserve client IP visibility

Previously, TLS termination was moved to nginx for better separation of concerns.
However, this introduced an issue with the new device IP display feature:

- With nginx reverse proxying, all device connections appear to originate from 127.0.0.1
- The actual device IP addresses were masked by the proxy layer
- This prevented accurate IP-based device identification and reporting

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

config.go

@@ -47,6 +47,10 @@ type Config struct {
 	AllowOrigins bool
 
 	PprofAddr string
+
+	SslCert string
+	SslKey  string
+	CaCert  string
 }
 
 func (cfg *Config) Parse(c *cli.Command) error {
@@ -78,6 +82,10 @@ func (cfg *Config) Parse(c *cli.Command) error {
 		"allow-origins": &cfg.AllowOrigins,
 
 		"pprof": &cfg.PprofAddr,
+
+		"sslcert": &cfg.SslCert,
+		"sslkey":  &cfg.SslKey,
+		"cacert":  &cfg.CaCert,
 	}
 
 	for name, opt := range fields {

device.go

@@ -28,11 +28,14 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/binary"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -154,7 +157,34 @@ func (srv *RttyServer) ListenDevices() {
 	}
 	defer ln.Close()
 
-	log.Info().Msgf("Listen devices on: %s", ln.Addr().(*net.TCPAddr))
+	if cfg.SslCert != "" && cfg.SslKey != "" {
+		cert, err := tls.LoadX509KeyPair(cfg.SslCert, cfg.SslKey)
+		if err != nil {
+			log.Fatal().Msg(err.Error())
+		}
+
+		config := &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			MinVersion:   tls.VersionTLS12,
+		}
+
+		if cfg.CaCert != "" {
+			caCert, err := os.ReadFile(cfg.CaCert)
+			if err != nil {
+				log.Fatal().Msg(err.Error())
+			}
+			caCertPool := x509.NewCertPool()
+			caCertPool.AppendCertsFromPEM(caCert)
+			config.ClientCAs = caCertPool
+			config.ClientAuth = tls.RequireAndVerifyClientCert
+		}
+
+		ln = tls.NewListener(ln, config)
+
+		log.Info().Msgf("Listen devices on: %s SSL on", ln.Addr().(*net.TCPAddr))
+	} else {
+		log.Info().Msgf("Listen devices on: %s SSL off", ln.Addr().(*net.TCPAddr))
+	}
 
 	for {
 		conn, err := ln.Accept()

main.go

@@ -118,6 +118,18 @@ func main() {
 				Aliases: []string{"V"},
 				Usage:   "more detailed log output",
 			},
+			&cli.StringFlag{
+				Name:  "sslcert",
+				Usage: "SSL/TLS certificate for device",
+			},
+			&cli.StringFlag{
+				Name:  "sslkey",
+				Usage: "SSL/TLS private key for device",
+			},
+			&cli.StringFlag{
+				Name:  "cacert",
+				Usage: "CA certificate to verify devices (mTLS)",
+			},
 		},
 		Action: cmdAction,
 	}

rttys.conf

@@ -38,3 +38,8 @@
 
 # CORS support (allow all origins for cross-domain requests)
 #allow-origins: false
+
+# SSL/TLS for listen device
+#sslcert:
+#sslkey:
+#cacert: