[duplicate-code] Duplicate Code Pattern: TLS Config Struct Initialization (3 locations) #7819

🔍 Duplicate Code Pattern: TLS Config Struct Initialization

Part of duplicate code analysis: #7818

Summary

The &tls.Config{Certificates: ..., MinVersion: tls.VersionTLS12} initialization struct appears in 3 separate locations across the server and proxy packages. Two of the occurrences are structurally identical (server cert + min version); the third is a minimal HTTP client variant. If the minimum TLS version policy ever needs to change (e.g., to enforce TLS 1.3), all three locations must be updated independently — a maintenance and consistency risk.

This pattern was explicitly noted in commit 21110aa as a "lower-priority organizational observation" that was intentionally left out of that refactoring pass.

Duplication Details

Pattern: &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12}

• Severity: Low-Medium
• Occurrences: 3 instances across 3 files
• Locations:
  • internal/server/gateway_tls.go (lines 36–39) — gateway server TLS
  • internal/proxy/tls.go (lines 163–166) — proxy server self-signed TLS
  • internal/proxy/proxy.go (line 126) — HTTP client TLS (subset: MinVersion only)

Location 1 (internal/server/gateway_tls.go:36–39):

cfg := &tls.Config{
    Certificates: []tls.Certificate{serverCert},
    MinVersion:   tls.VersionTLS12,
}

Location 2 (internal/proxy/tls.go:163–166):

tlsCfg := &tls.Config{
    Certificates: []tls.Certificate{serverCertPair},
    MinVersion:   tls.VersionTLS12,
}

Location 3 (internal/proxy/proxy.go:126):

TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12},

Impact Analysis

• Maintainability: Updating the minimum TLS version policy requires changes in 3 separate files in 2 different packages (server and proxy). Easy to miss one location.
• Bug Risk: Low but non-zero — a future developer could update the server TLS version but forget proxy/tls.go or proxy/proxy.go, leading to inconsistent TLS policy across the gateway.
• Code Bloat: Minor — ~4 lines repeated 3 times.

Refactoring Recommendations

Option A: Shared helper in internal/httputil

Add to internal/httputil/ (or a new internal/tlsutil/ package):

// NewServerTLSConfig creates a *tls.Config with the standard gateway minimum
// TLS version and the provided certificate.
func NewServerTLSConfig(cert tls.Certificate) *tls.Config {
    return &tls.Config{
        Certificates: []tls.Certificate{cert},
        MinVersion:   tls.VersionTLS12,
    }
}

// NewClientTLSConfig creates a *tls.Config suitable for HTTP client use with
// the standard gateway minimum TLS version.
func NewClientTLSConfig() *tls.Config {
    return &tls.Config{MinVersion: tls.VersionTLS12}
}

• Estimated effort: 30 minutes
• Benefits: Single place to update minimum TLS version; self-documenting intent

Option B: Exported constant only

Add a shared constant:

// MinTLSVersion is the minimum TLS version enforced across all gateway listeners
// and clients.
const MinTLSVersion = tls.VersionTLS12

• Estimated effort: 15 minutes
• Benefits: Slightly less abstraction but still centralizes the policy value

Implementation Checklist

• Create helper function(s) in internal/httputil/ (or equivalent)
• Update internal/server/gateway_tls.go to use shared helper
• Update internal/proxy/tls.go to use shared helper
• Update internal/proxy/proxy.go to use shared client helper
• Verify no behavioral change (TLS 1.2 minimum unchanged)
• Run make test-all to confirm no regressions

Parent Issue

See parent analysis report: #7818
Related to #7818

Generated by Duplicate Code Detector · 1.2K AIC · ⊞ 35.7K · ◷

• expires on Jun 27, 2026, 3:47 AM UTC