---

mkdir -p testdata/certs && cd testdata/certs

# CA
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout ca.key -out ca.crt -days 3650 -subj "/CN=etcd-test-ca" \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

# --- сертификат сервера etcd ---
cat > server.ext <<EOF
basicConstraints=CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=DNS:localhost,DNS:etcd,IP:127.0.0.1
EOF
openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout server.key -out server.csr -subj "/CN=etcd"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out server.crt -days 825 -extfile server.ext

# --- клиентский сертификат (для mTLS) ---
cat > client.ext <<EOF
basicConstraints=CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=clientAuth
EOF
openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout client.key -out client.csr -subj "/CN=test-client"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out client.crt -days 825 -extfile client.ext

===============================================================


etcd:
  image: quay.io/coreos/etcd:v3.5.17
  volumes: ["./testdata/certs:/certs:ro"]
  ports: ["2379:2379"]
  command: >
    etcd --name test --data-dir /etcd-data
    --listen-client-urls https://0.0.0.0:2379
    --advertise-client-urls https://localhost:2379
    --cert-file /certs/server.crt --key-file /certs/server.key
    --trusted-ca-file /certs/ca.crt --client-cert-auth
    
==============================================================   
    
caPEM, _ := os.ReadFile("testdata/certs/ca.crt")
pool := x509.NewCertPool()
pool.AppendCertsFromPEM(caPEM)
clientCert, err := tls.LoadX509KeyPair("testdata/certs/client.crt", "testdata/certs/client.key")
if err != nil { t.Fatal(err) }

tlsCfg := &tls.Config{
    RootCAs:      pool,
    Certificates: []tls.Certificate{clientCert},
    MinVersion:   tls.VersionTLS12,
}