Drop x25519, use p256 only

tutorials/stm32/nucleo-h563zi/minimal/link.ld

@@ -4,7 +4,7 @@ MEMORY {
   sram(rwx) : ORIGIN = 0x20000000, LENGTH = 640k
 }
 _estack = ORIGIN(sram) + LENGTH(sram);    /* End of RAM. stack points here */
-_sstack = _estack - 4098;
+_sstack = _estack - 16384;                /* Stack limit, MSPLIM. TLS needs > 4 KB */
 
 SECTIONS {
   .vectors  : { KEEP(*(.isr_vector)) }  > flash

tutorials/stm32/nucleo-h563zi/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -80,6 +107,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-h563zi/minimal/mongoose_config.h

@@ -38,3 +38,5 @@
     mac[4] = MGUID[1] & 255;         \
     mac[5] = MGUID[2] & 255;         \
   } while (0)
+
+#define MG_ENABLE_HEALTH 1