CONFIG_LWIP_MAX_SOCKETS=16

# HTTPS trust for the tools server: the standard public CA bundle (works
# for any normal reverse-proxy cert -- Let's Encrypt, a typical
# Cloudflare-issued edge cert, etc.) PLUS one specific root ESP-IDF's
# current bundle snapshot is missing: GlobalSign Root CA R1, which
# Cloudflare (via Google Trust Services) cross-signs its GTS Root R4
# chain with for backward compatibility with older/embedded clients --
# extremely common, not unique to this deployment. Without it, ESP-IDF's
# own chain-validation lookup (by issuer name, not a literal cert match)
# comes up empty and the handshake fails with "No matching trusted root
# certificate found", confirmed on hardware. See
# main/certs/additional_root_ca.pem and firmware/README.md's HTTPS
# section for how this was diagnosed/verified.
CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE=y
CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH="main/certs/additional_root_ca.pem"

# ESP32-C6 dev board has 8MB flash. A 2MB app partition (vs. the ~1MB
# "single app" default) gives headroom for the HTTP client, TLS, and image
# buffers still to come, without needing to fight for space on every build.
CONFIG_ESPTOOLPY_FLASHSIZE_8MB=y
CONFIG_PARTITION_TABLE_CUSTOM=y
CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="partitions.csv"
CONFIG_PARTITION_TABLE_FILENAME="partitions.csv"

# OTA rollback safety: a freshly-OTA'd image boots "pending verify" and
# must call esp_ota_mark_app_valid_cancel_rollback() (done in
# frame_client.c after one full successful fetch/display cycle -- the
# right proof of life for this device) or the bootloader reverts to the
# previous slot on the next reboot. A bad OTA can't brick a wall-mounted
# frame.
CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE=y

# The whole boot flow (provisioning, QR rendering, and eventually the HTTP
# fetch cycle) runs in the single default "main" task. The 3584-byte
# default already crashed with a stack protection fault once (a 4KB SPI
# chunk buffer that's since been moved off the stack) -- bumping this gives
# headroom for the rest of that call chain plus the upcoming HTTP client.
CONFIG_ESP_MAIN_TASK_STACK_SIZE=8192