Add TLS encryption

.gitignore

@@ -137,4 +137,7 @@ go
 .terraform*
 
 # raft
-raft_data/
+raft_data/
+# local certificates
+build/test-certs/raft-certs/*.crt
+build/test-certs/raft-certs/*.key

build/test-certs/raft-certs/gen-cert.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# Default values
+NODE_COUNT=3
+
+# Help function
+show_help() {
+  echo "Usage: ./gen-cert.sh [options]"
+  echo ""
+  echo "Options:"
+  echo "  -n, --nodes <num>   Number of nodes to generate (default: 3)"
+  echo "  -c, --clean         Delete all .key, .crt, .csr, and .srl files"
+  echo "  -h, --help          Show this help message"
+  exit 0
+}
+
+# Cleanup function
+clean_certs() {
+    echo "Cleaning up all certificates and keys..."
+    rm -f ./*.key ./*.crt ./*.csr ./*.srl
+    echo "Done."
+    exit 0
+}
+
+# Parse arguments
+while [[ "$#" -gt 0 ]]; do
+  case $1 in
+    -n|--nodes) NODE_COUNT="$2"; shift ;;
+    -c|--clean) clean_certs ;;
+    -h|--help) show_help ;;
+    *) echo "Unknown parameter: $1"; show_help ;;
+  esac
+  shift
+done
+
+echo "Creating CA and certificates for $NODE_COUNT nodes..."
+
+# 1. Generate the Root CA
+openssl req -x509 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 3650 -sha256 -nodes -subj "/CN=root"
+
+# 2. Loop to create node certificates
+for ((i=1; i<=NODE_COUNT; i++))
+do
+    echo "Generating node$i..."
+
+    # Create Request
+    openssl req -out "node$i.csr" -newkey rsa:2048 -keyout "node$i.key" -nodes \
+      -subj "/CN=node$i" \
+      -addext "subjectAltName=DNS:node$i,DNS:localhost,IP:127.0.0.1"
+
+    # Sign Certificate
+    openssl x509 -req -in "node$i.csr" -CA ca.crt -CAkey ca.key \
+      -out "node$i.crt" -days 365 -sha256 \
+      -set_serial "$i" \
+      -extfile <(echo "subjectAltName=DNS:node$i,DNS:localhost,IP:127.0.0.1")
+done
+
+# 3. Final Cleanup of temporary request files
+rm -f ./*.csr
+echo "Success! Generated $NODE_COUNT node certificates."

build/test-certs/raft-certs/start_cluster.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+ROOT_DIR="$(git rev-parse --show-toplevel)"
+
+# Ensure the logs directory exists
+mkdir -p logs
+
+PEERS="1=https://127.0.0.1:9021,2=https://127.0.0.1:9022,3=https://127.0.0.1:9023"
+
+echo "=== Starting 3-node raft cluster ==="
+
+for NODE_ID in 1 2 3; do
+    ADDR=":808$NODE_ID"
+    OUT="logs/node$NODE_ID.log"
+
+    echo "Starting node $NODE_ID on port $ADDR..."
+    go run "$ROOT_DIR"/cmds/core-service \
+        --store_type=raft \
+        --raft_node_id=$NODE_ID \
+        --addr=$ADDR \
+        --raft_peers=$PEERS \
+        --raft_tls_ca=$ROOT_DIR/build/test-certs/raft-certs/ca.crt \
+        --raft_tls_crt=$ROOT_DIR/build/test-certs/raft-certs/node${NODE_ID}.crt  \
+        --raft_tls_key=$ROOT_DIR/build/test-certs/raft-certs/node${NODE_ID}.key \
+        --accepted_jwt_audiences=dss \
+        --public_key_files="$ROOT_DIR"/build/test-certs/auth2.pem > "$OUT" 2>&1 &
+done