Support requiring TLS for API access

Signed-off-by: Jonathon Anderson <janderson@ciq.com>

internal/pkg/warewulfd/helpers.go

@@ -58,7 +58,7 @@ func buildTemplateVars(conf *warewulfconf.WarewulfYaml, rinfo parsedRequest, rem
 		Ipaddr:        conf.Ipaddr,
 		Ipaddr6:       ipaddr6,
 		Port:          strconv.Itoa(conf.Warewulf.Port),
-		TLS:           conf.Warewulf.EnableTLS(),
+		TLS:           conf.Warewulf.TLSEnabled(),
 		Authority:     authority,
 		Hostname:      remoteNode.Id(),
 		Hwaddr:        rinfo.hwaddr,

internal/pkg/warewulfd/overlay.go

@@ -95,7 +95,7 @@ func HandleSystemOverlay(w http.ResponseWriter, req *http.Request) {
 // If TLS is enabled, returns 403 Forbidden for plain-HTTP requests.
 // If an explicit ?overlay= list is present, delegates to HandleOverlayList.
 func HandleRuntimeOverlay(w http.ResponseWriter, req *http.Request) {
-	if config.Get().Warewulf.EnableTLS() && req.TLS == nil {
+	if config.Get().Warewulf.TLSEnabled() && req.TLS == nil {
 		wwlog.Denied("runtime overlay requested over insecure connection")
 		w.WriteHeader(http.StatusForbidden)
 		return

internal/pkg/warewulfd/server/server.go

@@ -37,6 +37,17 @@ func (h *slashFix) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	h.mux.ServeHTTP(w, r)
 }
 
+func requireTLS(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.TLS == nil {
+			wwlog.Denied("API request over insecure connection")
+			w.WriteHeader(http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func configureRootHandler(apiHandler http.Handler) *slashFix {
 	var wwHandler http.ServeMux
 	wwHandler.HandleFunc("/provision/", warewulfd.HandleProvision)
@@ -89,13 +100,16 @@ func RunServer() error {
 	var apiHandler http.Handler
 	if conf.API != nil && conf.API.Enabled() {
 		apiHandler = api.Handler(auth, conf.API.AllowedIPNets())
+		if conf.API.TLSEnabled() {
+			apiHandler = requireTLS(apiHandler)
+		}
 	}
 
 	httpHandler := configureRootHandler(apiHandler)
 
 	errChan := make(chan error, 2)
 
-	if conf.Warewulf.EnableTLS() {
+	if conf.Warewulf.TLSEnabled() {
 		key := path.Join(conf.Paths.Sysconfdir, "warewulf", "tls", "warewulf.key")
 		crt := path.Join(conf.Paths.Sysconfdir, "warewulf", "tls", "warewulf.crt")