feat: add PawSQL docs examples and image CI

internal/pgwire/sslrequest.go

@@ -0,0 +1,40 @@
+// Package pgwire contains the minimal PostgreSQL wire framing PawSQL needs before proxying.
+package pgwire
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+)
+
+const (
+	sslRequestLength uint32 = 8
+	sslRequestCode   uint32 = 80877103
+)
+
+var ErrNotSSLRequest = errors.New("expected PostgreSQL SSLRequest")
+
+// ReadSSLRequest validates the eight-byte PostgreSQL SSL negotiation request.
+func ReadSSLRequest(reader io.Reader) error {
+	var request [8]byte
+	if _, err := io.ReadFull(reader, request[:]); err != nil {
+		return fmt.Errorf("read PostgreSQL SSLRequest: %w", err)
+	}
+	if length := binary.BigEndian.Uint32(request[0:4]); length != sslRequestLength {
+		return fmt.Errorf("%w: invalid length %d", ErrNotSSLRequest, length)
+	}
+	if code := binary.BigEndian.Uint32(request[4:8]); code != sslRequestCode {
+		return fmt.Errorf("%w: invalid request code %d", ErrNotSSLRequest, code)
+	}
+	return nil
+}
+
+// SSLRequest returns the exact client preamble used to request TLS from PostgreSQL.
+// It exists to make protocol-level tests and clients unambiguous.
+func SSLRequest() [8]byte {
+	var request [8]byte
+	binary.BigEndian.PutUint32(request[0:4], sslRequestLength)
+	binary.BigEndian.PutUint32(request[4:8], sslRequestCode)
+	return request
+}