You are an expert in writing code in many different languages. Your goal is to perform code completion for the following code, keeping in mind the rest of the code and the file meta data.
    Metadata details:
    filename: server.go
    path of file: ./repos/hubble-ui/backend/vendor/github.com/cilium/cilium/pkg/crypto/certloader
    
    the code of the file until where you have to start completion: // SPDX-License-Identifier: Apache-2.0
// Copyright Authors of Cilium

package certloader

import (
	"crypto/tls"
	"errors"

	"github.com/sirupsen/logrus"
)

// ServerConfigBuilder creates tls.Config to be used as TLS server.
type ServerConfigBuilder interface {
	IsMutualTLS() bool
	ServerConfig(base *tls.Config) *tls.Config
}

// WatchedServerConfig is a ServerConfigBuilder backed up by files to be
// watched for changes. The tls.Config created will use the latest CA and
// keypair on each TLS handshake, allowing for smooth TLS configuration
// rotation.
type WatchedServerConfig struct {
	*Watcher
	log logrus.FieldLogger
}

var (
	// ErrMissingCertFile is returned when the certificate file is missing.
	ErrMissingCertFile = errors
    
func (c *WatchedServerConfig) ServerConfig(base *tls.Config) *tls.Config {
	// We return a tls.Config having only the GetConfigForClient member set.
	// When a client initialize a TLS handshake, this function will be called
	// and the tls.Config returned by GetConfigForClient will be used. This
	// mechanism allow us to reload the certificates transparently between two
	// clients connections without having to restart the server.
	// See also the discussion at https://github.com/golang/go/issues/16066.
	return &tls.Config{
		GetConfigForClient: func(_ *tls.ClientHelloInfo) (*tls.Config, error) {
			keypair, caCertPool := c.KeypairAndCACertPool()
			tlsConfig := base.Clone()
			tlsConfig.Certificates = []tls.Certificate{*keypair}
			if c.IsMutualTLS() {
				// We've been configured to serve mTLS, so setup the ClientCAs
				// accordingly.
				tlsConfig.ClientCAs = caCertPool
				// The caller may have its own desire about the handshake
				// ClientAuthType. We honor it unless its tls.NoClientCert (the
				// default zero value) as we are configured to serve mTLS.
				if tlsConfig.ClientAuth == tls.NoClientCert {
					tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
				}
			}
			c.log.WithField("keypair-sn", keypairId(keypair)).
				Debug("Server tls handshake")
			return tlsConfig, nil
		},
		// NOTE: this MinVersion is not used as this tls.Config will be
		// overridden by the one returned by GetConfigForClient. The effective
		// MinVersion must be set by the provided base TLS configuration.
		MinVersion: tls.VersionTLS13,
	}
}