add certificate download option

src/auracast/server/multicast_frontend.py

@@ -884,6 +884,22 @@ with st.expander("System control", expanded=False):
     except Exception as e:
         st.warning(f"Could not read temperatures: {e}")
 
+    st.subheader("CA Certificate")
+    st.caption("Download the CA certificate to trust this device's HTTPS connection.")
+    try:
+        cert_resp = requests.get(f"{BACKEND_URL}/cert", timeout=2)
+        if cert_resp.status_code == 200:
+            st.download_button(
+                label="Download CA Certificate",
+                data=cert_resp.content,
+                file_name="ca_cert.pem",
+                mime="application/x-pem-file",
+            )
+        else:
+            st.warning("CA certificate not available.")
+    except Exception as e:
+        st.warning(f"Could not fetch CA certificate: {e}")
+
     st.subheader("Change password")
     if is_pw_disabled():
         st.info("Frontend password protection is disabled via DISABLE_FRONTEND_PW.")

src/auracast/server/multicast_server.py

@@ -11,6 +11,7 @@ import random
 from dotenv import load_dotenv
 
 from fastapi import FastAPI, HTTPException
+from fastapi.responses import FileResponse
 from fastapi.middleware.cors import CORSMiddleware
 from auracast import multicast_control, auracast_config
 import sounddevice as sd  # type: ignore
@@ -27,6 +28,7 @@ load_dotenv()
 # Primary and secondary persisted settings files
 STREAM_SETTINGS_FILE1 = os.path.join(os.path.dirname(__file__), 'stream_settings.json')
 STREAM_SETTINGS_FILE2 = os.path.join(os.path.dirname(__file__), 'stream_settings2.json')
+CA_CERT_PATH = os.path.join(os.path.dirname(__file__), 'certs', 'ca', 'ca_cert.pem')
 # Raspberry Pi UART transports
 TRANSPORT1 = os.getenv('TRANSPORT1', 'serial:/dev/ttyAMA3,1000000,rtscts')  # transport for raspberry pi gpio header
 TRANSPORT2 = os.getenv('TRANSPORT2', 'serial:/dev/ttyAMA4,1000000,rtscts')  # transport for raspberry pi gpio header
@@ -426,6 +428,13 @@ async def send_audio(audio_data: dict[str, str]):
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
 
+@app.get("/cert")
+async def download_ca_cert():
+    """Download the CA certificate for TLS verification."""
+    if not os.path.exists(CA_CERT_PATH):
+        raise HTTPException(status_code=404, detail="CA certificate not found")
+    return FileResponse(CA_CERT_PATH, filename="ca_cert.pem", media_type="application/x-pem-file")
+
 @app.get("/status")
 async def get_status():
     """Gets current status (worker) merged with persisted settings cache."""