Add Authenticated HTTPS Admin Foundation

src/main.c

@@ -7,6 +7,7 @@
 #include "network_console.h"
 #include "rs232_hw_test.h"
 #include "rs232_port_owner.h"
+#include "secure_random.h"
 #include "serial_config.h"
 #include "serial_console.h"
 #include "serial_service.h"
@@ -16,6 +17,9 @@
 #include "system_console.h"
 #include "usb_cdc_transport.h"
 #include "usb_console.h"
+#include "web_console.h"
+#include "web_security.h"
+#include "web_server.h"
 #include "wifi_config.h"
 #include "wifi_console.h"
 #include "wifi_manager.h"
@@ -28,7 +32,7 @@ static const char *TAG = "firmware";
 
 void app_main(void)
 {
-    ESP_LOGI(TAG, "ESP32-S3 Serial Swiss Army Knife Wi-Fi foundation phase started");
+    ESP_LOGI(TAG, "ESP32-S3 Serial Swiss Army Knife HTTPS foundation phase started");
 
     if (esp_psram_is_initialized()) {
         ESP_LOGI(TAG, "PSRAM initialized: %u bytes", (unsigned int)esp_psram_get_size());
@@ -36,8 +40,12 @@ void app_main(void)
         ESP_LOGW(TAG, "PSRAM is not initialized");
     }
 
-    /* Seed credential generation before any future RF or ADC initialization. */
-    esp_err_t wifi_entropy_error = wifi_config_entropy_init();
+    /* Seed the sole device DRBG before any future RF, Bluetooth, or ADC use. */
+    esp_err_t random_error = secure_random_init();
+    if (random_error != ESP_OK) {
+        ESP_LOGE(TAG, "Secure random initialization failed: %s",
+                 esp_err_to_name(random_error));
+    }
 
     /* Blue means the firmware is initialized and waiting for a console command. */
     ESP_ERROR_CHECK(status_led_init());
@@ -59,9 +67,30 @@ void app_main(void)
     /* Native USB owns GPIO19/20; UART0 logging stays on the USB-to-UART bridge. */
     ESP_ERROR_CHECK(usb_cdc_transport_init());
 
+    /* Provision HTTPS identity before Wi-Fi starts; failures leave UART/USB recovery intact. */
+    web_security_load_result_t web_security_source = WEB_SECURITY_LOAD_STORED;
+    esp_err_t web_security_error = random_error;
+    if (web_security_error == ESP_OK) {
+        web_security_error = web_security_init(&web_security_source);
+    }
+    if (web_security_error != ESP_OK) {
+        ESP_LOGE(TAG,
+                 "HTTPS security material unavailable (%s); use UART0 'web reset --force' to replace it",
+                 esp_err_to_name(web_security_error));
+    } else {
+        ESP_LOGI(TAG, "Using %s HTTPS identity and administrative credential",
+                 web_security_source == WEB_SECURITY_LOAD_STORED ? "stored" : "newly generated");
+    }
+
+    esp_err_t web_runtime_error = web_server_init();
+    if (web_runtime_error != ESP_OK) {
+        ESP_LOGE(TAG, "HTTPS runtime initialization failed: %s",
+                 esp_err_to_name(web_runtime_error));
+    }
+
     wifi_app_config_t wifi_config;
     wifi_config_load_source_t wifi_config_source;
-    esp_err_t wifi_config_error = wifi_entropy_error;
+    esp_err_t wifi_config_error = random_error;
     if (wifi_config_error == ESP_OK) {
         wifi_config_error = wifi_config_load(&wifi_config, &wifi_config_source);
     }
@@ -82,8 +111,9 @@ void app_main(void)
                  "Stored Wi-Fi configuration is incompatible; using RAM defaults without overwriting it");
     }
 
+    esp_err_t wifi_error = wifi_config_error;
     if (wifi_config_error == ESP_OK) {
-        esp_err_t wifi_error = wifi_manager_init(&wifi_config);
+        wifi_error = wifi_manager_init(&wifi_config);
         if (wifi_error == ESP_OK && wifi_config.enabled_at_boot != 0U) {
             wifi_error = wifi_manager_start();
         }
@@ -103,6 +133,17 @@ void app_main(void)
     }
     wifi_config_secure_wipe(&wifi_config, sizeof(wifi_config));
 
+    if (wifi_error == ESP_OK && web_security_error == ESP_OK &&
+        web_runtime_error == ESP_OK) {
+        esp_err_t start_error = web_server_start();
+        if (start_error != ESP_OK) {
+            ESP_LOGE(TAG, "HTTPS startup failed: %s; UART0 recovery remains available",
+                     esp_err_to_name(start_error));
+        } else {
+            ESP_LOGI(TAG, "Authenticated HTTPS listening on TCP port 443");
+        }
+    }
+
     ESP_LOGI(
         TAG,
         "Using %s serial configuration; UART service starts on 'serial start' or native USB open",
@@ -132,6 +173,7 @@ void app_main(void)
     ESP_ERROR_CHECK(session_console_register_commands());
     ESP_ERROR_CHECK(usb_console_register_commands());
     ESP_ERROR_CHECK(wifi_console_register_commands());
+    ESP_ERROR_CHECK(web_console_register_commands());
     ESP_ERROR_CHECK(network_console_register_root_commands());
     ESP_ERROR_CHECK(system_console_register_commands());
     /* Upgrade late UART terminals safely and add nested completion. */