package main

import (
	"crypto/tls"
	"crypto/x509"
	"net/http"
	"time"
)

// httpClient builds the broker HTTP client. With a non-nil pool it pins the
// fleet CA for an https broker (prod); plain http (lab) ignores it. Short
// timeouts on the individual calls — the long human-approval wait is the poll
// LOOP in enrol(), not a single request.
func httpClient(pool *x509.CertPool) *http.Client {
	tr := &http.Transport{}
	if pool != nil {
		tr.TLSClientConfig = &tls.Config{RootCAs: pool, MinVersion: tls.VersionTLS12}
	}
	return &http.Client{Timeout: 30 * time.Second, Transport: tr}
}