Peeks at the first byte of socket to pick plain TCP vs TLS, then serves the connection.

Runs the server-side TLS handshake on a plain socket, using the identity resolved at boot (:tls_options). Also used by FakeRiak.Connection for in-band upgrades like Riak's RpbStartTls.

Resolves the TLS server identity once at boot: a user-supplied cert/key file pair (:tls_cert_files config, set by the CLI), or an ephemeral self-signed certificate generated on the fly.

@spec validate_cert_files(Path.t(), Path.t()) ::
  :ok | {:warning, String.t()} | {:error, String.t()}

Validates a user-supplied --tls-cert/--tls-key pair at startup, before the app ever binds a socket.

A bad pair otherwise only fails at the first real handshake, and by then a client sees nothing more specific than a closed connection (this is exactly the "handshake failed: :close" a Riak PBC client reports for e.g. a mismatched key/cert or a garbled PEM file). This runs the exact handshake handshake/1 would over a loopback socket — which catches a mismatched key/cert pair, a password-protected key, a wrong-format file, and so on — plus a separate expiry check, since the loopback client connects with verify_none and so never validates the server's own certificate the way a real client might.

An expired certificate is still perfectly usable in a handshake (only a verifying client will reject it), so it yields {:warning, message} rather than an error: the caller can surface it and start anyway.