v2.0.47: HTTPS Everywhere — TLS-only control plane, agents/CLI/MCP

Breaking change release. Plaintext HTTP listener removed. The certctl
control plane now terminates TLS 1.3 on :8443 via
http.Server.ListenAndServeTLS. No CERTCTL_TLS_ENABLED=false escape
hatch. No dual-listener mode. One-step cutover per docs/upgrade-to-tls.md.

Server
- cmd/server/tls.go: certHolder with SIGHUP hot-reload + atomic cert
  swap, buildServerTLSConfig (TLS 1.3 min, GetCertificate callback),
  preflightServerTLS validation
- cmd/server/main.go: ListenAndServeTLS in place of ListenAndServe,
  watchSIGHUP wiring, cert/key path config threading
- tls_test.go: 418-line regression coverage of reload, preflight,
  callback behavior, SAN validation

Config
- CERTCTL_TLS_CERT_PATH / CERTCTL_TLS_KEY_PATH (required)
- Plaintext rejection: agents/CLI/MCP pre-flight-fail on http://
  URLs with a pointer to docs/upgrade-to-tls.md

Agents, CLI, MCP
- All three pre-flight-reject http:// URLs with fail-loud diagnostic
- CERTCTL_SERVER_CA_BUNDLE_PATH for private-CA trust
- CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY for dev-only bypass
  (loud warning on startup)
- install-agent.sh emits both vars as commented template lines

docker-compose
- certctl-tls-init sidecar generates SAN-valid self-signed cert into
  deploy/test/certs/ on first boot
- All demo-stack curls pin against ca.crt with --cacert

Helm chart
- Three TLS provisioning modes, exactly one required:
  - server.tls.existingSecret (operator-supplied)
  - server.tls.certManager.enabled (cert-manager integration)
  - server.tls.selfSigned.enabled (eval only — not for production)
- server-certificate.yaml template for cert-manager mode
- helm install without a TLS source fails at template render with
  a pointer to docs/tls.md

CI
- .github/workflows/ci.yml Helm Chart Validation step renders the
  chart in both existingSecret and cert-manager modes, plus an
  inverse guard-regression test that asserts helm template MUST
  refuse to render when no TLS source is configured. Previously
  the single `helm template` invocation hit the certctl.tls.required
  fail-loud guard and exit-1'd CI. Four invocations now: lint
  (existingSecret), template (existingSecret), template
  (cert-manager), template (no args — must fail).

Integration tests
- deploy/test/integration_test.go stands up the Compose stack over
  HTTPS, extracts the CA bundle, and exercises every certctl API
  over https://localhost:8443
- All 34 integration subtests green (per Phase 8 local CI-parity)

Documentation
- New: docs/tls.md (provisioning patterns, rotation, SIGHUP reload)
- New: docs/upgrade-to-tls.md (one-step cutover, no-downgrade
  warnings, fleet-roll sequencing)
- CHANGELOG.md: v2.2.0 "HTTPS Everywhere — The Irony" entry
  (file heading unchanged; release tag is v2.0.47)
- All curls in docs/, examples/, deploy/helm/ guides use
  https://localhost:8443 --cacert

Verification
- grep -rn "ListenAndServe[^T]" cmd/ internal/ → 0 hits
- grep -rn "\"http://" cmd/ internal/ → 2 benign hits (Caddy admin
  API default, SSRF doc comment) — zero certctl endpoints
- Tasks #197–#206 (Phases 0–8) all closed in the tracker

Files: 65 changed, 3489 insertions, 372 deletions (pre-CI-fix).

deploy/test/run-test.sh

@@ -1,5 +1,30 @@
 #!/usr/bin/env bash
 # =============================================================================
+# DEPRECATED — prefer `go test -tags integration ./deploy/test/...`
+# =============================================================================
+#
+# This bash harness predates the Go integration test suite in
+# deploy/test/integration_test.go (build tag `integration`, 34 subtests across
+# 13 phases — health, agent heartbeat, Local CA issuance, ACME, step-ca, EST,
+# S/MIME, discovery, network scan, revocation + CRL, deployment verification).
+# The Go suite uses crypto/x509, crypto/tls, and database/sql to parse certs,
+# probe TLS, and talk to PostgreSQL directly — no openssl text-scraping or
+# brittle curl pipelines. It is the authoritative integration test surface as
+# of milestone M-007 (HTTPS Everywhere, Phase 6), where the test compose
+# stack wires the server on https://localhost:8443 behind a pinned CA bundle
+# at ./certs/ca.crt.
+#
+# Run the Go suite:
+#   (cd deploy && docker compose -f docker-compose.test.yml up -d --build)
+#   go test -tags integration -v -count=1 ./deploy/test/...
+#
+# Keep this bash script around because:
+#   * It is cited in docs/test-env.md and muscle-memory for contributors.
+#   * It exercises the CLI / curl path end-to-end (a different failure mode
+#     than the Go HTTP client path).
+# But any NEW integration coverage goes in integration_test.go — not here.
+#
+# =============================================================================
 # certctl End-to-End Test Script
 # =============================================================================
 #
@@ -32,10 +57,11 @@ set -euo pipefail
 # Config
 # ---------------------------------------------------------------------------
 COMPOSE_FILE="docker-compose.test.yml"
-API_URL="http://localhost:8443"
+API_URL="https://localhost:8443"
 API_KEY="test-key-2026"
 NGINX_TLS="localhost:8444"
 AUTH_HEADER="Authorization: Bearer ${API_KEY}"
+CACERT="./certs/ca.crt"
 
 # Flags
 BUILD=true
@@ -91,7 +117,7 @@ header() {
 # API helper: GET endpoint, return JSON body. Exits 1 on HTTP error.
 api_get() {
   local path="$1"
-  curl -sf -H "${AUTH_HEADER}" "${API_URL}${path}" 2>/dev/null
+  curl -sf --cacert "${CACERT}" -H "${AUTH_HEADER}" "${API_URL}${path}" 2>/dev/null
 }
 
 # API helper: POST with optional JSON body
@@ -99,10 +125,10 @@ api_post() {
   local path="$1"
   local body="${2:-}"
   if [ -n "$body" ]; then
-    curl -sf -X POST -H "${AUTH_HEADER}" -H "Content-Type: application/json" \
+    curl -sf --cacert "${CACERT}" -X POST -H "${AUTH_HEADER}" -H "Content-Type: application/json" \
       -d "$body" "${API_URL}${path}" 2>/dev/null
   else
-    curl -sf -X POST -H "${AUTH_HEADER}" "${API_URL}${path}" 2>/dev/null
+    curl -sf --cacert "${CACERT}" -X POST -H "${AUTH_HEADER}" "${API_URL}${path}" 2>/dev/null
   fi
 }