// Serverul de proba al retetei Go din remediere.mjs (profilul `go`, pentru hndl-exposed + tls12-accepted + hsts-missing):
//   &tls.Config{MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}}
//   w.Header().Set("Strict-Transport-Security", "max-age=31536000")
// Certificat autosemnat generat la pornire (ECDSA P-256), asculta pe 127.0.0.1:<port>, raspunde "ok" la orice cale.
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"log"
	"math/big"
	"net/http"
	"os"
	"runtime"
	"time"
)

func main() {
	port := "8445"
	if len(os.Args) > 1 {
		port = os.Args[1]
	}
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		log.Fatal(err)
	}
	tmpl := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "proba.local"}, NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(48 * time.Hour), DNSNames: []string{"proba.local", "localhost"}}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		log.Fatal(err)
	}
	cert := tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
	// EXACT fragmentul retetei (remediere.mjs, profilul go, setarile groups + tlsMin 1.3 + hsts):
	cfg := &tls.Config{MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}, Certificates: []tls.Certificate{cert}}
	mux := http.NewServeMux()
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Strict-Transport-Security", "max-age=31536000")
		fmt.Fprintln(w, "ok")
	})
	srv := &http.Server{Addr: "127.0.0.1:" + port, Handler: mux, TLSConfig: cfg}
	fmt.Printf("listening 127.0.0.1:%s go=%s\n", port, runtime.Version())
	log.Fatal(srv.ListenAndServeTLS("", ""))
}