feat: use Go's default values for TLS server (#13641)

- It's pointless to set defaults when those are _continously_ being updated by Go to incorporate newer values (e.g. PQ in the last few releases).
- It's pointless to figure out a order preference, these are ignored by Go for their own internal preference.
- Do less and trust [Go's cryptography principles](https://golang.org/design/cryptography-principles) to keep this safe and modern.

Documentation PR: forgejo/docs!2089

## Test
1. Obtain a certificate via ACME (self-signed is possible, can be generated via https://stackoverflow.com/a/41366949, requires setting some valid hostname).
2. Set `[server].KEY_FILE` and `[server].CERT_FILE` to the certificate.
3. Set `[server].PROTOCOL = https`.
4. Run forgejo.
5. Verify you can connect to Forgejo over HTTPS.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13641
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>

Author: Gusted

cmd/web_https.go

@@ -12,12 +12,9 @@ import (
 	"forgejo.org/modules/graceful"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
-
-	"github.com/klauspost/cpuid/v2"
 )
 
 var tlsVersionStringMap = map[string]uint16{
-	"":        tls.VersionTLS12, // Default to tls.VersionTLS12
 	"tlsv1.0": tls.VersionTLS10,
 	"tlsv1.1": tls.VersionTLS11,
 	"tlsv1.2": tls.VersionTLS12,
@@ -34,10 +31,13 @@ func toTLSVersion(version string) uint16 {
 }
 
 var curveStringMap = map[string]tls.CurveID{
-	"x25519": tls.X25519,
-	"p256":   tls.CurveP256,
-	"p384":   tls.CurveP384,
-	"p521":   tls.CurveP521,
+	"x25519":             tls.X25519,
+	"p256":               tls.CurveP256,
+	"p384":               tls.CurveP384,
+	"p521":               tls.CurveP521,
+	"x25519mlkem768":     tls.X25519MLKEM768,
+	"secp256r1mlkem768":  tls.SecP256r1MLKEM768,
+	"secp384r1mlkem1024": tls.SecP384r1MLKEM1024,
 }
 
 func toCurvePreferences(preferences []string) []tls.CurveID {
@@ -99,35 +99,6 @@ func toTLSCiphers(cipherStrings []string) []uint16 {
 	return ciphers
 }
 
-// defaultCiphers uses hardware support to check if AES is specifically
-// supported by the CPU.
-//
-// If AES is supported AES ciphers will be preferred over ChaCha based ciphers
-// (This code is directly inspired by the certmagic code.)
-func defaultCiphers() []uint16 {
-	if cpuid.CPU.Supports(cpuid.AESNI) {
-		return defaultCiphersAESfirst
-	}
-	return defaultCiphersChaChaFirst
-}
-
-var (
-	defaultCiphersAES = []uint16{
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	}
-
-	defaultCiphersChaCha = []uint16{
-		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-	}
-
-	defaultCiphersAESfirst    = append(defaultCiphersAES, defaultCiphersChaCha...)
-	defaultCiphersChaChaFirst = append(defaultCiphersChaCha, defaultCiphersAES...)
-)
-
 // runHTTPS listens on the provided network address and then calls
 // Serve to handle requests on incoming TLS connections.
 //
@@ -148,17 +119,10 @@ func runHTTPS(network, listenAddr, name, certFile, keyFile string, m http.Handle
 		tlsConfig.MaxVersion = version
 	}
 
-	// Set curve preferences
-	tlsConfig.CurvePreferences = []tls.CurveID{
-		tls.X25519,
-		tls.CurveP256,
-	}
 	if curves := toCurvePreferences(setting.SSLCurvePreferences); len(curves) > 0 {
 		tlsConfig.CurvePreferences = curves
 	}
 
-	// Set cipher suites
-	tlsConfig.CipherSuites = defaultCiphers()
 	if ciphers := toTLSCiphers(setting.SSLCipherSuites); len(ciphers) > 0 {
 		tlsConfig.CipherSuites = ciphers
 	}

go.mod

@@ -71,7 +71,6 @@ require (
 	github.com/json-iterator/go v1.1.12
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/klauspost/compress v1.19.1
-	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.24
 	github.com/mattn/go-sqlite3 v1.14.48
@@ -196,6 +195,7 @@ require (
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/libdns/libdns v1.1.1 // indirect