add tls termination

[bubunyo]

add tls support

[Copilot]

Pull request overview

This PR adds optional client-side TLS termination to kroxy’s Kafka listener, configured via YAML and wired through to the proxy server so clients can connect over TLS while the upstream broker connection remains plaintext.

Changes:

• Introduces tls configuration (enabled/cert_file/key_file) with validation and a Build() helper that loads the server keypair.
• Wraps the client-facing listener with TLS when configured, and logs whether TLS is enabled.
• Adds test coverage for TLS handshake + SASL/PLAIN over TLS, plus documentation updates and an example config snippet.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the new tls config block and updates scope notes to reflect client TLS termination support.
proxy/listener.go	Adds TLS wrapping for the client listener and logs TLS enablement.
proxy/listener_tls_test.go	Adds integration-style tests for TLS handshake + SASL/PLAIN and plaintext rejection behavior.
dockerfiles/kroxy.yaml	Adds commented example tls configuration for the demo stack.
config/config.go	Adds TLSConfig, validation, and Build() to produce *tls.Config (or nil when disabled).
config/config_test.go	Adds unit tests for TLSConfig.Build() and config validation scenarios.
cmd/kroxy/main.go	Wires cfg.TLS.Build() into proxy.NewServer via ServerConfig.TLS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.