web: add post-quantum hybrid KEM groups to curve_preferences

docs/web-configuration.md

@@ -92,6 +92,18 @@ tls_server_config:
   # Elliptic curves that will be used in an ECDHE handshake, in preference
   # order. Available curves are documented in the go documentation:
   # https://golang.org/pkg/crypto/tls/#CurveID
+  #
+  # In TLS 1.3, this registry was extended to "Named Groups" (RFC 8446,
+  # Section 4.2.7) and now also covers hybrid post-quantum KEMs.
+  #
+  # Available values:
+  #   * CurveP256
+  #   * CurveP384
+  #   * CurveP521
+  #   * X25519
+  #   * X25519MLKEM768 (requires Go 1.24+)
+  #   * SecP256r1MLKEM768 (requires Go 1.26+)
+  #   * SecP384r1MLKEM1024 (requires Go 1.26+)
   [ curve_preferences:
     [ - <string> ] ]
 

web/tls_config.go

@@ -531,10 +531,11 @@ func (c Cipher) MarshalYAML() (any, error) {
 type Curve tls.CurveID
 
 var curves = map[string]Curve{
-	"CurveP256": (Curve)(tls.CurveP256),
-	"CurveP384": (Curve)(tls.CurveP384),
-	"CurveP521": (Curve)(tls.CurveP521),
-	"X25519":    (Curve)(tls.X25519),
+	"CurveP256":      (Curve)(tls.CurveP256),
+	"CurveP384":      (Curve)(tls.CurveP384),
+	"CurveP521":      (Curve)(tls.CurveP521),
+	"X25519":         (Curve)(tls.X25519),
+	"X25519MLKEM768": (Curve)(tls.X25519MLKEM768), // Go 1.24+
 }
 
 func (c *Curve) UnmarshalYAML(unmarshal func(any) error) error {

web/tls_config_go126.go

@@ -0,0 +1,24 @@
+// Copyright The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build go1.26
+
+package web
+
+import "crypto/tls"
+
+func init() {
+	// Hybrid post-quantum KEM groups added in Go 1.26.
+	curves["SecP256r1MLKEM768"] = (Curve)(tls.SecP256r1MLKEM768)
+	curves["SecP384r1MLKEM1024"] = (Curve)(tls.SecP384r1MLKEM1024)
+}