Enable encryption for HA API calls

Also extract configs from btproxy into API and btproxy
for reuse later.

btproxy.yaml

@@ -6,27 +6,9 @@ esphome:
     name: dasfoo.btproxy
     version: "1.0"
 
-esp32:
-  # Required for BLE.
-  framework:
-    type: esp-idf
-
 packages:
   device_base: !include templates/esp32-poe.yaml
 
-# Allow HA to use our proxy.
+  btproxy: !include templates/btproxy.yaml
-api:
+  # Allow HA to use our proxy.
-
+  api: !include templates/api.yaml
-# Disable MQTT discovery to prevent duplicate device.
-mqtt:
-  discovery: false
-
-esp32_ble_tracker:
-  scan_parameters:
-    # Recommended scan intervals for esphome.
-    interval: 1100ms
-    window: 1100ms
-    active: true
-
-bluetooth_proxy:
-  active: true

templates/api.yaml

@@ -0,0 +1,7 @@
+api:
+  encryption:
+    key: !secret api_encryption_key
+
+# Disable MQTT discovery to prevent duplicate device.
+mqtt:
+  discovery: false

templates/btproxy.yaml

@@ -0,0 +1,16 @@
+# Remember to enable HA API (api.yaml) for the proxy to be available.
+
+esp32:
+  # Required for BLE.
+  framework:
+    type: esp-idf
+
+esp32_ble_tracker:
+  scan_parameters:
+    # Recommended scan intervals for esphome.
+    interval: 1100ms
+    window: 1100ms
+    active: true
+
+bluetooth_proxy:
+  active: true

templates/secrets.yaml.sample

@@ -5,3 +5,4 @@ mqtt_password: "ttqm"
 lock_pin: 314
 wifi_ap_lookup:
 - "12:34:56:AB:CD -> Upper Floor AP"
+api_encryption_key: "K3g+SB5OYgLxKtEXhWJd1Mryfy9hGol+mAq+nq/JDsY="