feat(proxy): proxy, SOCKS5, mTLS, and TLS hardening support (closes #80)

[Aidan Holland (thehappydinoa)]

Summary

Implements issue #80 — proxy support within CLI config — extended to cover the full range of corporate/locked-down environment requirements.

All settings live under two new sections in config.yaml:

proxy:
  url: socks5://proxy.corp.internal:1080   # http, https, socks5, socks5h
  disable-http2: false                     # force HTTP/1.1 for broken proxies

tls:
  ca-bundle: /etc/ssl/corp-ca.pem          # appended to system CA pool; supports ~ and $ENV_VAR
  insecure-skip-verify: false              # disable TLS verification (prints a stderr warning when active)
  client-cert: /etc/ssl/client.pem         # mTLS client certificate; supports ~ and $ENV_VAR
  client-key:  /etc/ssl/client-key.pem     # mTLS private key; supports ~ and $ENV_VAR

HTTP_PROXY, HTTPS_PROXY, and NO_PROXY env vars continue to work unchanged and take effect when proxy.url is not set.

Changes

• internal/config/proxy.go (new) — ProxyConfig struct + defaultProxyConfig, following the per-type file pattern
• internal/config/tls.go (new) — TLSConfig struct + defaultTLSConfig, following the per-type file pattern
• internal/config/config.go — Proxy and TLS fields added to Config; both referenced in defaultConfig
• internal/pkg/clients/http/http.go — New() takes an Options struct; proxy routing by scheme (HTTP vs SOCKS5); buildTLSConfig handles CA bundle, client cert, skip-verify; expandPath expands ~ and $ENV_VAR in file paths; stderr warning when insecure-skip-verify is active; warns if system CA pool fails to load
• internal/pkg/clients/censys/censys.go — call site updated to pass all new options from config
• internal/pkg/clients/http/http_test.go — updated for new API; full integration test coverage for all three manual test scenarios

Test plan

• go test ./... passes (all green)
• tls.insecure-skip-verify: true prints stderr warning (fmt.Fprintln in New())
• Missing/invalid CA bundle, mismatched client cert/key return clear errors (TestNew_MissingCABundle, TestNew_MismatchedClientCert)
• Invalid proxy URL and unsupported scheme return clear errors (TestNew_InvalidProxyURL, TestNew_UnsupportedProxyScheme)
• proxy.url routes all requests through the configured proxy (TestNew_ProxyURL_RoutesViaProxy — spins up a local proxy server and asserts it receives the request)
• tls.ca-bundle accepts connections to servers signed by a custom CA (TestNew_CABundle_AcceptsCustomCA — generates an in-memory CA, signs a server cert, asserts the configured client succeeds and a bare client correctly fails)
• HTTP_PROXY env var is honoured when proxy.url is unset (TestNew_EnvProxy_UsedWhenNoProxyURL — spins up a local proxy, sets env var, asserts the proxy receives the request)

🤖 Generated with Claude Code