Centralize TLS config construction behind shared httputil helpers

[Copilot]

TLS config initialization (Certificates + MinVersion) was duplicated across server and proxy paths, with a separate inline client variant, creating policy drift risk if minimum TLS requirements change. This PR consolidates those constructions into shared helpers while preserving current TLS 1.2 behavior.

• Shared TLS policy surface

  • Added /internal/httputil/tls_config.go with:
    • MinTLSVersion (single source of truth for minimum TLS version)
    • NewServerTLSConfig(cert tls.Certificate) *tls.Config
    • NewClientTLSConfig() *tls.Config

• Call-site deduplication

  • Replaced inline server TLS config construction in:
    • /internal/server/gateway_tls.go
    • /internal/proxy/tls.go
  • Replaced inline proxy HTTP client TLS config in:
    • /internal/proxy/proxy.go

• Focused helper coverage

  • Added /internal/httputil/tls_config_test.go to assert helper outputs (min version and certificate wiring).

// internal/httputil/tls_config.go
const MinTLSVersion = tls.VersionTLS12

func NewServerTLSConfig(cert tls.Certificate) *tls.Config {
	return &tls.Config{
		Certificates: []tls.Certificate{cert},
		MinVersion:   MinTLSVersion,
	}
}

func NewClientTLSConfig() *tls.Config {
	return &tls.Config{MinVersion: MinTLSVersion}
}

[Copilot]

Pull request overview

This PR centralizes TLS tls.Config construction behind shared internal/httputil helpers to eliminate duplicated “min TLS version + certificate wiring” logic across the gateway server and proxy, reducing the risk of policy drift while preserving the existing TLS 1.2 minimum behavior.

Changes:

• Added internal/httputil/tls_config.go with a single TLS policy surface (MinTLSVersion) plus NewServerTLSConfig / NewClientTLSConfig helpers.
• Updated gateway server TLS setup (internal/server/gateway_tls.go) and proxy self-signed TLS generation (internal/proxy/tls.go) to use httputil.NewServerTLSConfig.
• Updated proxy outbound HTTP client TLS config (internal/proxy/proxy.go) to use httputil.NewClientTLSConfig and added focused helper tests in internal/httputil/tls_config_test.go.

Show a summary per file

File	Description
internal/server/gateway_tls.go	Replaces inline server tls.Config construction with httputil.NewServerTLSConfig while keeping existing mTLS augmentation logic intact.
internal/proxy/tls.go	Uses shared server TLS config helper for the generated self-signed localhost cert chain.
internal/proxy/proxy.go	Uses shared client TLS config helper for the proxy’s outbound http.Transport TLS policy.
internal/httputil/tls_config.go	Introduces centralized minimum TLS version constant and server/client TLS config constructors.
internal/httputil/tls_config_test.go	Adds unit tests validating the helper-produced tls.Config fields (min version and certificate wiring).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/5 changed files
• Comments generated: 0