feat(weather-mesh): wire gamma for mqtts:// mesh profiles

Design 044 §7: an mqtts:// broker in the MESH_CONFIG profile now builds
TLS firmware instead of panicking in build.rs.

- build.rs sets the mesh_tls cfg, defaults the port to 8883, and embeds
  the root CA from $MESH_CA (PEM or DER) as MQTT_CA_DER; a mqtts://
  profile without MESH_CA fails the build with instructions. Plain
  profiles and the no-profile local demo generate the same config as
  before (plus the new MQTT_BROKER_SCHEME const).
- main.rs feeds the profile credential to with_credentials() and, under
  cfg(mesh_tls), moves the TRNG into a static shared with the TLS
  handshake and passes static record buffers to with_tls().
- StackResources grows 3 → 5 (DNS + SNTP sockets).

Verified: builds clean for thumbv8m.main-none-eabihf both with a
synthetic mqtts:// profile + CA and without one; on-broker verification
happens on the bench once a mesh credential exists (WP7 acceptance).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lxsaah

examples/weather-mesh-demo/weather-station-gamma/Cargo.toml

@@ -33,8 +33,16 @@ aimdb-embassy-adapter = { path = "../../../aimdb-embassy-adapter", default-featu
     "embassy-runtime",
 ] }
 aimdb-data-contracts = { path = "../../../aimdb-data-contracts", default-features = false }
+# `embassy-tls` compiles the mqtts:// transport (design 044). The connector
+# picks plain vs TLS at runtime from the URL scheme, so the TLS code is in
+# every image (~0.7 MB text of the 2 MB flash, incl. everything else); only
+# the `mesh_tls`-gated wiring in main.rs (TRNG handoff, 21 KB of record
+# buffers) is compiled out of plain-demo builds.
+# `defmt` surfaces the DHCP → SNTP → TLS connect progress on the console.
 aimdb-mqtt-connector = { path = "../../../aimdb-mqtt-connector", default-features = false, features = [
     "embassy-runtime",
+    "embassy-tls",
+    "defmt",
 ] }
 
 # Embassy ecosystem - STM32H563ZI with Ethernet (same as embassy-mqtt-connector-demo)
@@ -98,6 +106,8 @@ rand = { version = "0.10.1", default-features = false, optional = true }
 # Parses the $MESH_CONFIG station profile (station.toml, design 042 §8.2) to
 # generate station_config.rs. Host-side only — nothing lands in the firmware.
 toml = "0.8"
+# Decodes a PEM $MESH_CA into the embedded DER root CA (design 044 §7).
+base64 = "0.22"
 
 [package.metadata.embassy]
 build = [

examples/weather-mesh-demo/weather-station-gamma/build.rs

@@ -7,6 +7,11 @@
 //! build → flash → live. With `MESH_CONFIG` unset, the generated file carries
 //! the local docker-compose demo defaults, so the tier-1 demo stays
 //! zero-setup.
+//!
+//! An `mqtts://` broker in the profile builds TLS firmware (design 044 §7):
+//! the `mesh_tls` cfg gates the TLS wiring in `main.rs`, and `MESH_CA` must
+//! point at the broker's root CA certificate (PEM or DER), embedded as
+//! `MQTT_CA_DER`.
 
 use std::env;
 use std::fs;
@@ -18,6 +23,9 @@ fn main() {
     println!("cargo:rustc-link-arg-bins=-Tdefmt.x");
 
     println!("cargo:rerun-if-env-changed=MESH_CONFIG");
+    println!("cargo:rerun-if-env-changed=MESH_CA");
+    // Set for mqtts:// profiles; gates the TLS wiring in main.rs (044 §7).
+    println!("cargo::rustc-check-cfg=cfg(mesh_tls)");
 
     let config = match env::var("MESH_CONFIG") {
         Ok(path) => {
@@ -35,7 +43,15 @@ fn main() {
 /// The topics mirror the `TempKey::Gamma`/…`::Gamma` link addresses in
 /// `weather-mesh-common`.
 fn local_demo_config() -> String {
-    station_config("192.168.1.3", 1883, None, None, "gamma", "sensors/gamma")
+    station_config(
+        false,
+        "192.168.1.3",
+        1883,
+        None,
+        None,
+        "gamma",
+        "sensors/gamma",
+    )
 }
 
 /// Configuration from the station profile at `path` (design 043 §4).
@@ -63,24 +79,27 @@ fn mesh_station_config(path: &str) -> String {
     };
 
     let broker_url = str_field("broker", "url");
-    // The Embassy MQTT client has no TLS yet (design 042 §8.1) — a profile for
-    // the public broker (mqtts://) cannot work; only a plain-TCP broker (e.g.
-    // the local demo one) is reachable until that lands.
-    let rest = broker_url.strip_prefix("mqtt://").unwrap_or_else(|| {
-        panic!(
-            "MESH_CONFIG: broker URL '{broker_url}' is not mqtt:// — the Embassy \
-             MQTT client has no TLS support yet (design 042 §8.1), so this \
-             firmware can only target a plain-TCP broker"
-        )
-    });
+    // `mqtts://` builds TLS firmware (design 044): `mesh_tls` cfg + embedded
+    // root CA from $MESH_CA. Plain `mqtt://` stays byte-identical to before.
+    let (tls, rest) = if let Some(rest) = broker_url.strip_prefix("mqtts://") {
+        (true, rest)
+    } else if let Some(rest) = broker_url.strip_prefix("mqtt://") {
+        (false, rest)
+    } else {
+        panic!("MESH_CONFIG: broker URL '{broker_url}' must be mqtt:// or mqtts://")
+    };
+    if tls {
+        println!("cargo:rustc-cfg=mesh_tls");
+        embed_ca();
+    }
     let authority = rest.split('/').next().unwrap_or(rest);
     let (host, port) = match authority.rsplit_once(':') {
         Some((host, port)) => (
             host,
             port.parse::<u16>()
                 .unwrap_or_else(|_| panic!("MESH_CONFIG: invalid broker port in '{broker_url}'")),
         ),
-        None => (authority, 1883),
+        None => (authority, if tls { 8883 } else { 1883 }),
     };
 
     let station_id = profile
@@ -101,6 +120,7 @@ fn mesh_station_config(path: &str) -> String {
     ));
 
     station_config(
+        tls,
         host,
         port,
         credentials,
@@ -110,9 +130,50 @@ fn mesh_station_config(path: &str) -> String {
     )
 }
 
+/// Embed the broker's root CA (design 044 §7): `$MESH_CA` names a file with
+/// the root CA certificate — PEM or DER — decoded to `OUT_DIR/ca.der` and
+/// surfaced as the generated `MQTT_CA_DER` const. The station profile does
+/// not carry the CA (044 §9), so for now it travels out of band.
+fn embed_ca() {
+    let path = env::var("MESH_CA").unwrap_or_else(|_| {
+        panic!(
+            "MESH_CONFIG names an mqtts:// broker, but MESH_CA is unset — point \
+             it at the broker's root CA certificate (PEM or DER), e.g. \
+             MESH_CA=isrg-root-x1.pem (design 044 §7)"
+        )
+    });
+    println!("cargo:rerun-if-changed={path}");
+    let raw = fs::read(&path).unwrap_or_else(|e| panic!("MESH_CA: cannot read '{path}': {e}"));
+    let der = if raw.starts_with(b"-----BEGIN") {
+        pem_to_der(&raw, &path)
+    } else {
+        raw
+    };
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+    fs::write(out_dir.join("ca.der"), der).unwrap();
+}
+
+/// Decode the first CERTIFICATE block of a PEM file to DER.
+fn pem_to_der(pem: &[u8], path: &str) -> Vec<u8> {
+    use base64::Engine;
+
+    let text = std::str::from_utf8(pem)
+        .unwrap_or_else(|_| panic!("MESH_CA: '{path}' is neither valid PEM nor DER"));
+    let body: String = text
+        .lines()
+        .skip_while(|line| !line.starts_with("-----BEGIN CERTIFICATE-----"))
+        .skip(1)
+        .take_while(|line| !line.starts_with("-----END"))
+        .collect();
+    base64::engine::general_purpose::STANDARD
+        .decode(body.trim())
+        .unwrap_or_else(|e| panic!("MESH_CA: '{path}' has an invalid PEM body: {e}"))
+}
+
 /// Render the generated `station_config.rs`. String values go through `{:?}`
 /// so arbitrary profile content stays a valid Rust literal.
 fn station_config(
+    tls: bool,
     host: &str,
     port: u16,
     credentials: Option<(&str, &str)>,
@@ -124,24 +185,30 @@ fn station_config(
         Some(v) => format!("Some({v:?})"),
         None => "None".to_string(),
     };
+    let scheme = if tls { "mqtts" } else { "mqtt" };
     let username = credential_const(credentials.map(|(u, _)| u));
     let password = credential_const(credentials.map(|(_, p)| p));
     let slot = match slot {
         Some(n) => format!("Some({n})"),
         None => "None".to_string(),
     };
+    let ca = if tls {
+        "/// Root CA for broker certificate verification, from $MESH_CA (044 §7).\n\
+         pub const MQTT_CA_DER: &[u8] = include_bytes!(concat!(env!(\"OUT_DIR\"), \"/ca.der\"));\n"
+    } else {
+        ""
+    };
 
     format!(
         "// Generated by build.rs — station configuration (design 042 §8.2).\n\
          // Source: $MESH_CONFIG station profile, or local demo defaults. Do not edit.\n\
+         pub const MQTT_BROKER_SCHEME: &str = {scheme:?};\n\
          pub const MQTT_BROKER_HOST: &str = {host:?};\n\
          pub const MQTT_BROKER_PORT: u16 = {port};\n\
-         /// Broker credential from the profile. Unused until the Embassy MQTT\n\
-         /// client supports authentication + TLS (design 042 §8.1, WP7).\n\
-         #[allow(dead_code)]\n\
+         /// Broker credential from the profile, fed to MQTT CONNECT (design 044 D8).\n\
          pub const MQTT_USERNAME: Option<&str> = {username};\n\
-         #[allow(dead_code)]\n\
          pub const MQTT_PASSWORD: Option<&str> = {password};\n\
+         {ca}\
          /// Assigned mesh slot; `None` in the local demo.\n\
          pub const STATION_SLOT: Option<u16> = {slot};\n\
          pub const STATION_NAME: &str = {name:?};\n\

examples/weather-mesh-demo/weather-station-gamma/src/main.rs

@@ -23,12 +23,14 @@
 //! cd examples/weather-mesh-demo/weather-station-gamma
 //! cargo run --release            # build → probe-rs flash → defmt logs
 //! ```
-//! - **Public mesh:** feed it the profile written by `aimdb join`:
+//! - **Public mesh:** feed it the profile written by `aimdb join`, plus the
+//!   broker's root CA for the TLS broker (design 044 §7):
 //! ```bash
-//! MESH_CONFIG=../station.toml cargo run --release
+//! MESH_CONFIG=../station.toml MESH_CA=../broker-root-ca.pem cargo run --release
 //! ```
-//!   (Reaches the public broker only once the Embassy client speaks TLS —
-//!   design 042 §8.1; until then a profile must name a plain-TCP broker.)
+//!   An `mqtts://` profile builds TLS firmware (certificate verification,
+//!   SNTP time source, broker authentication); a plain `mqtt://` profile
+//!   builds exactly what it did before.
 
 extern crate alloc;
 
@@ -37,6 +39,8 @@ use aimdb_core::AimDbBuilder;
 use aimdb_data_contracts::{RandomWalkParams, SimProfile, SimulatableRegistrarExt};
 use aimdb_embassy_adapter::{EmbassyAdapter, EmbassyBufferType, EmbassyRecordRegistrarExtCustom};
 use aimdb_mqtt_connector::embassy_client::MqttConnectorBuilder;
+#[cfg(mesh_tls)]
+use aimdb_mqtt_connector::embassy_client::TlsOptions;
 use defmt::*;
 use embassy_executor::Spawner;
 use embassy_net::StackResources;
@@ -191,6 +195,14 @@ async fn main(spawner: Spawner) {
     rng.fill_bytes(&mut seed);
     let seed = u64::from_le_bytes(seed);
 
+    // The same TRNG then feeds the TLS handshake (design 044 D3), so it moves
+    // into a static — the session task outlives this function.
+    #[cfg(mesh_tls)]
+    let rng: &'static mut Rng<'static, peripherals::RNG> = {
+        static TLS_RNG: StaticCell<Rng<'static, peripherals::RNG>> = StaticCell::new();
+        TLS_RNG.init(rng)
+    };
+
     info!("🔧 Initializing Ethernet...");
 
     // MAC address for this device
@@ -219,8 +231,10 @@ async fn main(spawner: Spawner) {
     // Network configuration (using DHCP)
     let config = embassy_net::Config::dhcpv4(Default::default());
 
-    // Initialize network stack
-    static RESOURCES: StaticCell<StackResources<3>> = StaticCell::new();
+    // Initialize network stack. Socket budget: DHCP + the MQTT TCP socket +
+    // the DNS socket (created by embassy-net's `dns` feature, pulled in by
+    // the connector's `embassy-tls`) + the SNTP UDP socket, plus one spare.
+    static RESOURCES: StaticCell<StackResources<5>> = StaticCell::new();
     static STACK_CELL: StaticCell<embassy_net::Stack<'static>> = StaticCell::new();
 
     let (stack_obj, runner) =
@@ -254,14 +268,39 @@ async fn main(spawner: Spawner) {
     // Create AimDB database with Embassy adapter
     let runtime = alloc::sync::Arc::new(EmbassyAdapter::new());
 
-    // Build MQTT broker URL
+    // Build MQTT broker URL — the scheme comes from the profile (mqtts://
+    // builds the TLS transport, design 044 D9).
     use alloc::format;
-    let broker_url = format!("mqtt://{}:{}", MQTT_BROKER_HOST, MQTT_BROKER_PORT);
-
-    let mut builder = AimDbBuilder::new().runtime(runtime.clone()).with_connector(
-        MqttConnectorBuilder::new(&broker_url, stack).with_client_id("weather-station-gamma"),
+    let broker_url = format!(
+        "{}://{}:{}",
+        MQTT_BROKER_SCHEME, MQTT_BROKER_HOST, MQTT_BROKER_PORT
     );
 
+    #[allow(unused_mut)]
+    let mut mqtt_connector =
+        MqttConnectorBuilder::new(&broker_url, stack).with_client_id("weather-station-gamma");
+    if let (Some(username), Some(password)) = (MQTT_USERNAME, MQTT_PASSWORD) {
+        mqtt_connector = mqtt_connector.with_credentials(username, password);
+    }
+    // TLS materials (design 044 §4): the TRNG staticked above, the root CA
+    // from $MESH_CA, and static record buffers (16 640 read — a TLS 1.3 peer
+    // may send full-size records — and 4 096 write).
+    #[cfg(mesh_tls)]
+    let mqtt_connector = {
+        static TLS_READ_BUF: StaticCell<[u8; 16_640]> = StaticCell::new();
+        static TLS_WRITE_BUF: StaticCell<[u8; 4_096]> = StaticCell::new();
+        mqtt_connector.with_tls(TlsOptions::new(
+            rng,
+            MQTT_CA_DER,
+            TLS_READ_BUF.init([0; 16_640]),
+            TLS_WRITE_BUF.init([0; 4_096]),
+        ))
+    };
+
+    let mut builder = AimDbBuilder::new()
+        .runtime(runtime.clone())
+        .with_connector(mqtt_connector);
+
     // Configure temperature record. The record keys stay the compile-time
     // enums (they name the records in *this* db); only the MQTT topics come
     // from the generated config, so a mesh profile re-points the publishes to
@@ -389,7 +428,10 @@ async fn main(spawner: Spawner) {
     info!("   Temperature: {}", temp_topic);
     info!("   Humidity: {}", humidity_topic);
     info!("   DewPoint: {}", dew_point_topic);
-    info!("   Broker: {}:{}", MQTT_BROKER_HOST, MQTT_BROKER_PORT);
+    info!(
+        "   Broker: {}://{}:{}",
+        MQTT_BROKER_SCHEME, MQTT_BROKER_HOST, MQTT_BROKER_PORT
+    );
     info!("");
 
     static DB_CELL: StaticCell<aimdb_core::AimDb> = StaticCell::new();