Add optional stratum TLS via stunnel sidecar

New 'tls' union config (disabled by default) spins up an
stunnel4 process inside the container that terminates TLS on
a configurable port (3334 by default) and forwards decrypted
stratum traffic to 127.0.0.1:${STRATUM_PORT}.

Cert is self-signed, generated once on first start with a
10-year validity and persisted at /root/.kamado/tls/ so the
fingerprint stays stable across restarts. SHA-256 fingerprint
is printed to container logs on each startup so users can
pin it on their miners. Miners must connect with
verification disabled (no CA trust chain for a private pool).

Runtime image grows by ~3MB for stunnel4 + openssl. The
supervisor loop now waits on three PIDs and tears all of them
down together if any one exits.

docker_entrypoint.sh

@@ -43,6 +43,8 @@ export MAXDIFF=$(q '.maxdiff // 0')
 export DROPIDLE=$(q '.dropidle // 0')
 LOG_LEVEL=$(q '.log-level // "info"')
 ZMQ_ENABLED=$(q '.zmq-enabled // true')
+TLS_ENABLED=$(q '.tls.enabled // "disabled"')
+TLS_PORT=$(q '.tls.port // 3334')
 
 export LOGDIR=/var/log/ckpool
 export SOCKET_DIR=/run/ckpool
@@ -99,17 +101,56 @@ echo "kamado-entrypoint: starting kamado-api"
 /usr/local/bin/kamado-api &
 API_PID=$!
 
+# Optional TLS stratum via stunnel sidecar.
+STUNNEL_PID=""
+if [[ "${TLS_ENABLED}" == "enabled" ]]; then
+    TLS_DIR=/root/.kamado/tls
+    CERT="${TLS_DIR}/stratum.pem"
+    mkdir -p "${TLS_DIR}"
+    if [[ ! -f "${CERT}" ]]; then
+        echo "kamado-entrypoint: generating self-signed stratum TLS cert"
+        openssl req -x509 -newkey rsa:2048 -sha256 -nodes \
+            -keyout "${TLS_DIR}/stratum.key" \
+            -out   "${TLS_DIR}/stratum.crt" \
+            -days 3650 \
+            -subj "/CN=kamado-pool-stratum" >/dev/null 2>&1
+        cat "${TLS_DIR}/stratum.key" "${TLS_DIR}/stratum.crt" > "${CERT}"
+        chmod 600 "${TLS_DIR}/stratum.key" "${CERT}"
+    fi
+    FINGERPRINT=$(openssl x509 -in "${TLS_DIR}/stratum.crt" -noout -fingerprint -sha256 | cut -d= -f2)
+    echo "kamado-entrypoint: stratum TLS SHA256 fingerprint: ${FINGERPRINT}"
+
+    STUNNEL_CONF=/etc/stunnel/stratum.conf
+    mkdir -p /etc/stunnel
+    cat > "${STUNNEL_CONF}" <<EOF
+foreground = yes
+pid =
+output = /dev/stdout
+debug = 4
+
+[stratum]
+accept = 0.0.0.0:${TLS_PORT}
+connect = 127.0.0.1:${STRATUM_PORT}
+cert = ${CERT}
+EOF
+
+    echo "kamado-entrypoint: starting stunnel on :${TLS_PORT} -> :${STRATUM_PORT}"
+    /usr/bin/stunnel4 "${STUNNEL_CONF}" &
+    STUNNEL_PID=$!
+fi
+
 term() {
     echo "kamado-entrypoint: SIGTERM — shutting down"
-    kill -TERM "${API_PID}" "${CKPOOL_PID}" 2>/dev/null || true
-    wait "${API_PID}" "${CKPOOL_PID}" 2>/dev/null || true
+    kill -TERM "${API_PID}" "${CKPOOL_PID}" ${STUNNEL_PID:-} 2>/dev/null || true
+    wait "${API_PID}" "${CKPOOL_PID}" ${STUNNEL_PID:-} 2>/dev/null || true
     exit 0
 }
 trap term TERM INT
 
-wait -n "${CKPOOL_PID}" "${API_PID}"
+# shellcheck disable=SC2086
+wait -n ${CKPOOL_PID} ${API_PID} ${STUNNEL_PID:-}
 EXIT_CODE=$?
-echo "kamado-entrypoint: one of ckpool/kamado-api exited (${EXIT_CODE}), stopping the other"
-kill -TERM "${API_PID}" "${CKPOOL_PID}" 2>/dev/null || true
+echo "kamado-entrypoint: a supervised process exited (${EXIT_CODE}), stopping the rest"
+kill -TERM "${API_PID}" "${CKPOOL_PID}" ${STUNNEL_PID:-} 2>/dev/null || true
 wait || true
 exit "${EXIT_CODE}"