feat(relays): accept a self-signed certificate on a generic HTTP board

HTTPS to a relay board could not work. Nearly every board that offers it signs
its own certificate — there is no authority anywhere that could have signed it —
so the request failed verification before it left.

A checkbox, per board, off by default. Not a blanket switch, because the other
HTTPS case is real and opposite: a board reached from outside through a proxy
with a genuine certificate, where verification is the only thing standing
between an antenna switch and the internet. Same setting, two boards, different
answers.

Off by default is only safe if the failure explains itself, so a certificate
error now names the box to tick. Go's own "x509: certificate signed by unknown
authority" is accurate and tells an operator nothing about what to do next.

Shown only once an https:// URL is actually in the board's configuration. A
board on plain HTTP has no certificate to argue about, and an option that cannot
matter yet is one more thing to wonder about.

The flag joins the driver cache key: ticking it has to rebuild the driver, or
the cached one would go on refusing the certificate with the verifying client it
already holds.

The boards that take a bare host — WebSwitch, KMTronic — keep verification. An
https:// typed there is the proxy case by construction, since they default to
plain HTTP on the LAN.

Three tests against a real self-signed TLS server: accepted with the box,
refused with a message naming it without the box, and one board's setting not
leaking into another's.

internal/relaydev/relaydev.go

@@ -17,7 +17,10 @@ package relaydev
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/xml"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -28,8 +31,8 @@ import (
 
 // Device is one relay board.
 type Device interface {
-	Count() int                                       // number of user-controllable relays
-	Status(ctx context.Context) ([]bool, error)       // state of each relay (index 0 = relay 1)
+	Count() int                                        // number of user-controllable relays
+	Status(ctx context.Context) ([]bool, error)        // state of each relay (index 0 = relay 1)
 	Set(ctx context.Context, relay int, on bool) error // relay is 1-based
 	// Close releases any OS handle the driver holds (serial port, FTDI handle).
 	// Network boards hold nothing and no-op. MUST be called when a cached driver is
@@ -40,8 +43,47 @@ type Device interface {
 
 func httpClient() *http.Client { return &http.Client{Timeout: 5 * time.Second} }
 
+// insecureClient talks to a board presenting a certificate nothing can verify.
+//
+// Which is nearly every board that offers HTTPS at all: a relay box on the LAN
+// signs its own certificate, and there is no authority anywhere that could have
+// signed it. Refusing that means refusing HTTPS on the hardware, which is not a
+// security decision, only an outcome.
+//
+// So it is offered, per board, and OFF by default — because the other HTTPS
+// case is real and opposite: a board reached from outside through a proxy with
+// a genuine certificate, where verification is the only thing standing between
+// an antenna switch and the internet. One box, on the board that needs it.
+//
+// Built once. A Transport per request would open a fresh TLS connection every
+// time and never reuse one.
+var insecureClient = &http.Client{
+	Timeout: 5 * time.Second,
+	Transport: &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // the operator ticked the box for this board
+	},
+}
+
+// certError says which box to tick when TLS is what failed.
+//
+// Go's own message — "x509: certificate signed by unknown authority" — is
+// accurate and tells an operator nothing about what to do next. Naming the
+// setting turns a dead end into an instruction.
+func certError(err error) error {
+	var unknown x509.UnknownAuthorityError
+	var host x509.HostnameError
+	var verify *tls.CertificateVerificationError
+	if errors.As(err, &unknown) || errors.As(err, &host) || errors.As(err, &verify) {
+		return fmt.Errorf("%w — the board's HTTPS certificate cannot be verified; "+
+			"tick \"Accept a self-signed certificate\" for this board if it is on your own network", err)
+	}
+	return err
+}
+
 // get issues a GET with optional basic auth and returns the body on 2xx.
-func get(ctx context.Context, url, user, pass string) ([]byte, error) {
+//
+// insecure skips certificate verification, for a board that signs its own.
+func get(ctx context.Context, url, user, pass string, insecure bool) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
@@ -49,9 +91,13 @@ func get(ctx context.Context, url, user, pass string) ([]byte, error) {
 	if user != "" || pass != "" {
 		req.SetBasicAuth(user, pass)
 	}
-	resp, err := httpClient().Do(req)
+	client := httpClient()
+	if insecure {
+		client = insecureClient
+	}
+	resp, err := client.Do(req)
 	if err != nil {
-		return nil, err
+		return nil, certError(err)
 	}
 	defer resp.Body.Close()
 	body, _ := io.ReadAll(resp.Body)
@@ -87,8 +133,8 @@ type webswitch struct {
 // NewWebswitch builds a WebSwitch 1216H client (5 relays).
 func NewWebswitch(host string) Device { return &webswitch{host: host, count: 5} }
 
-func (w *webswitch) Count() int    { return w.count }
-func (w *webswitch) Close() error  { return nil } // stateless HTTP, nothing to release
+func (w *webswitch) Count() int   { return w.count }
+func (w *webswitch) Close() error { return nil } // stateless HTTP, nothing to release
 
 func (w *webswitch) Set(ctx context.Context, relay int, on bool) error {
 	if relay < 1 || relay > w.count {
@@ -98,7 +144,7 @@ func (w *webswitch) Set(ctx context.Context, relay int, on bool) error {
 	if on {
 		action = "on"
 	}
-	_, err := get(ctx, fmt.Sprintf("%s/relaycontrol/%s/%d", relayBase(w.host), action, relay), "", "")
+	_, err := get(ctx, fmt.Sprintf("%s/relaycontrol/%s/%d", relayBase(w.host), action, relay), "", "", false)
 	return err
 }
 
@@ -109,7 +155,7 @@ func (w *webswitch) Status(ctx context.Context) ([]bool, error) {
 		sel.WriteString(strconv.Itoa(i))
 		sel.WriteByte('$')
 	}
-	body, err := get(ctx, fmt.Sprintf("%s/relaystate/get2/%s", relayBase(w.host), sel.String()), "", "")
+	body, err := get(ctx, fmt.Sprintf("%s/relaystate/get2/%s", relayBase(w.host), sel.String()), "", "", false)
 	if err != nil {
 		return nil, err
 	}
@@ -156,7 +202,7 @@ func (k *kmtronic) Set(ctx context.Context, relay int, on bool) error {
 		state = "01"
 	}
 	// FF<rr><ss>: e.g. FF0101 = relay 1 on, FF0800 = relay 8 off.
-	_, err := get(ctx, fmt.Sprintf("%s/FF%02d%s", relayBase(k.host), relay, state), k.user, k.pass)
+	_, err := get(ctx, fmt.Sprintf("%s/FF%02d%s", relayBase(k.host), relay, state), k.user, k.pass, false)
 	return err
 }
 
@@ -170,7 +216,7 @@ type kmStatus struct {
 }
 
 func (k *kmtronic) Status(ctx context.Context) ([]bool, error) {
-	body, err := get(ctx, fmt.Sprintf("%s/status.xml", relayBase(k.host)), k.user, k.pass)
+	body, err := get(ctx, fmt.Sprintf("%s/status.xml", relayBase(k.host)), k.user, k.pass, false)
 	if err != nil {
 		return nil, err
 	}