package tls

import (
	"crypto/tls"
	"crypto/x509"
	"net"
	"time"

	"git.giftfish.de/ston1th/haproxy-lb/pkg/config"
	"github.com/hashicorp/raft"
)

var (
	ciphers = []uint16{
		tls.TLS_CHACHA20_POLY1305_SHA256,
	}
	curves = []tls.CurveID{
		tls.X25519,
	}
)

type stream struct {
	net.Listener
	insecure bool
	ca       *x509.CertPool
}

func NewStream(cfg *config.Raft) (s *stream, err error) {
	cert, err := tls.LoadX509KeyPair(cfg.TLS.Cert, cfg.TLS.Key)
	if err != nil {
		return
	}
	ca, err := config.LoadCertPool(cfg.TLS.CA)
	if err != nil {
		return
	}
	l, err := tls.Listen("tcp", cfg.Listen, &tls.Config{
		MinVersion:               tls.VersionTLS13,
		CipherSuites:             ciphers,
		CurvePreferences:         curves,
		PreferServerCipherSuites: true,
		Certificates:             []tls.Certificate{cert},
	})
	if err != nil {
		return
	}
	s = &stream{l, cfg.TLS.Insecure, ca}
	return
}

func (s *stream) Dial(address raft.ServerAddress, timeout time.Duration) (net.Conn, error) {
	return tls.DialWithDialer(
		&net.Dialer{Timeout: timeout},
		"tcp", string(address),
		&tls.Config{
			MinVersion:         tls.VersionTLS13,
			CipherSuites:       ciphers,
			CurvePreferences:   curves,
			InsecureSkipVerify: s.insecure,
			RootCAs:            s.ca,
		},
	)
}