Kconfig Reference

idf.py menuconfig, menu Safi Configuration (main/Kconfig.projbuild). How these layer with sdkconfig.local and the production profile: getting started.

General

Option	Type	Default	Purpose
SAFI_WIFI_SSID	string	empty	Build-time fallback WiFi network (provisioning path 2). Put real values in sdkconfig.local, never in tracked files
SAFI_WIFI_PASSWORD	string	empty	Companion password
SAFI_MDNS_HOSTNAME	string	safi	mDNS hostname; the dashboard answers at https://<hostname>.local
SAFI_PROVISIONING_TRANSPORT	choice	SoftAP	Provisioning transport: SAFI_PROVISIONING_TRANSPORT_SOFTAP (default) or SAFI_PROVISIONING_TRANSPORT_BLE. Both work with the Espressif provisioning app; see the BLE pairing steps
SAFI_PROVISIONING_WINDOW_MIN	int	10	Minutes the provisioning window stays open before the provisioning cycle retries stored credentials (why they alternate)
SAFI_MAX_RFID_CARDS	int	50	Card database capacity; each slot costs a few dozen NVS bytes
SAFI_TIMEZONE	string	EET-2EEST,M4.5.5/0,M10.5.4/24	Default POSIX timezone before the user sets one; ships as Cairo (EET-2, EEST DST). The POSIX sign is inverted, so EET-2 means UTC+2 (sign convention warning)
SAFI_SNTP_SERVER	string	pool.ntp.org	Time source; change for networks that block public NTP
SAFI_RTC_DS3231	bool	y	Probe for the DS3231 RTC at boot; absent hardware degrades to SNTP-only
SAFI_RTC_INT_GPIO	int	10	GPIO wired to the DS3231 INT pin (open drain, active low, pull-up required); part of the deep sleep wake mask
SAFI_LCD_PANEL	choice	ST7735S	Which panel this build drives: SAFI_LCD_ST7735S (1.8 inch 128x160) or SAFI_LCD_ST7789 (1.47 inch 172x320); see panel selection
SAFI_LCD_SPI_CLOCK_MHZ	int	10 or 20	LCD SPI clock; per-panel default, drop to 10 on noisy jumper wires
SAFI_DISPLAY_BOOT_TEST_PATTERN	bool	n	Raw panel test bars at boot, for hardware bring-up only; costs boot time when on
SAFI_AUDIO_BOOT_TONE	bool	n	Plays a 1 kHz tone straight to I2S for ~1.5 s after the amplifier starts, bypassing decoder, SD and software volume to isolate the ESP32 to MAX98357A to speaker path. Bring-up only

Safi Security submenu

Option	Type	Default	Purpose
SAFI_ALLOW_INSECURE_OTA_PULL	bool	n	Permit plain-HTTP OTA pull for bench servers. Developer only; production gates refuse to build with it on
SAFI_ENFORCE_PRODUCTION_GATES	bool	n	Turns the hardening checklist into compile errors (why)
SAFI_OTA_REQUIRE_FINGERPRINT_PIN	bool	n	Pin OTA pulls to a configured server identity
SAFI_OTA_SERVER_URL_PREFIX	string	empty	Required URL prefix for OTA pull when pinning is on

Notable non-Safi options this project sets

Set in sdkconfig.defaults and worth knowing when they surprise you:

Option	Value	Why
CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC	y	TLS buffers in PSRAM (the squeeze)
CONFIG_SPIRAM_ALLOW_BSS_SEG_EXTERNAL_MEMORY	y	Enables EXT_RAM_BSS_ATTR statics
CONFIG_LV_USE_BIDI, CONFIG_LV_USE_ARABIC_PERSIAN_CHARS	y	Arabic rendering
CONFIG_LV_FONT_FMT_TXT_LARGE	y	Required by the merged Arabic fonts
LVGL examples and demos	off	They cost ~240 KB of internal RAM in static canvases
WiFi static RX/TX buffer counts	reduced	Sized for audio streaming, funding the audio stack and ring buffer (budget)
CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH	y	Post-mortems