feat: add TLS certificate management functionality

- Implemented TLS certificate model and service for managing certificates.
- Added API endpoints for creating, importing, listing, and deleting TLS certificates.
- Enhanced proxy route configuration to support HTTPS with certificate selection.
- Updated frontend to include TLS certificate management UI with manual and file import options.
- Added validation for HTTPS routes to ensure certificates are selected.
- Implemented tests for TLS certificate creation and proxy route validation.

atsf_agent/internal/config/config.go

@@ -10,7 +10,9 @@ import (
 
 const (
 	defaultDockerRouteConfigRelativePath = "etc/nginx/conf.d/atsflare_routes.conf"
+	defaultCertDirRelativePath           = "etc/nginx/certs"
 	defaultDockerStateRelativePath       = "var/lib/atsflare/agent-state.json"
+	defaultDockerNginxCertDir            = "/etc/nginx/atsflare-certs"
 )
 
 type Config struct {
@@ -26,6 +28,8 @@ type Config struct {
 	DockerBinary       string        `json:"docker_binary"`
 	DataDir            string        `json:"data_dir"`
 	RouteConfigPath    string        `json:"route_config_path"`
+	CertDir            string        `json:"cert_dir"`
+	NginxCertDir       string        `json:"nginx_cert_dir"`
 	StatePath          string        `json:"state_path"`
 	HeartbeatInterval  time.Duration `json:"heartbeat_interval"`
 	SyncInterval       time.Duration `json:"sync_interval"`
@@ -76,6 +80,16 @@ func applyDefaults(cfg *Config, baseDir string) {
 			cfg.StatePath = filepath.Join(cfg.DataDir, defaultDockerStateRelativePath)
 		}
 	}
+	if cfg.CertDir == "" {
+		cfg.CertDir = filepath.Join(cfg.DataDir, defaultCertDirRelativePath)
+	}
+	if cfg.NginxCertDir == "" {
+		if cfg.NginxPath != "" {
+			cfg.NginxCertDir = cfg.CertDir
+		} else {
+			cfg.NginxCertDir = defaultDockerNginxCertDir
+		}
+	}
 	if cfg.HeartbeatInterval <= 0 {
 		cfg.HeartbeatInterval = 30 * time.Second
 	}

atsf_agent/internal/config/config_test.go

@@ -36,6 +36,12 @@ func TestLoadDockerModeUsesManagedPaths(t *testing.T) {
 	if cfg.RouteConfigPath != filepath.Join(dir, "data", defaultDockerRouteConfigRelativePath) {
 		t.Fatalf("unexpected route config path: %s", cfg.RouteConfigPath)
 	}
+	if cfg.CertDir != filepath.Join(dir, "data", defaultCertDirRelativePath) {
+		t.Fatalf("unexpected cert dir: %s", cfg.CertDir)
+	}
+	if cfg.NginxCertDir != defaultDockerNginxCertDir {
+		t.Fatalf("unexpected nginx cert dir: %s", cfg.NginxCertDir)
+	}
 	if cfg.StatePath != filepath.Join(dir, "data", defaultDockerStateRelativePath) {
 		t.Fatalf("unexpected state path: %s", cfg.StatePath)
 	}
@@ -72,6 +78,9 @@ func TestLoadPathModeKeepsExplicitPaths(t *testing.T) {
 	if cfg.StatePath != "/tmp/agent-state.json" {
 		t.Fatalf("unexpected state path: %s", cfg.StatePath)
 	}
+	if cfg.NginxCertDir != cfg.CertDir {
+		t.Fatalf("expected path mode nginx cert dir to equal cert dir, got %s / %s", cfg.NginxCertDir, cfg.CertDir)
+	}
 }
 
 func TestLoadUsesCustomDataDirForGeneratedFiles(t *testing.T) {
@@ -104,4 +113,7 @@ func TestLoadUsesCustomDataDirForGeneratedFiles(t *testing.T) {
 	if cfg.StatePath != "/srv/atsflare/"+defaultDockerStateRelativePath {
 		t.Fatalf("unexpected state path: %s", cfg.StatePath)
 	}
+	if cfg.CertDir != "/srv/atsflare/"+defaultCertDirRelativePath {
+		t.Fatalf("unexpected cert dir: %s", cfg.CertDir)
+	}
 }