# ─────────────────────────────────────────────────────────────────────────────
# macOSAppstoreDecrypter configuration.  Copy this file to ".env" (same folder as app.py) and
# fill it in.  ".env" is git-ignored, so your credentials never get committed.
#   cp .env.example .env  &&  nano .env
# Every value is optional except MAC_PASSWORD and ONE Apple ID.
# ─────────────────────────────────────────────────────────────────────────────

# === macOS login password ===================================================
# Required. Used for `sudo` (purge, launchctl asuser) and to unlock the login
# keychain WITHOUT a GUI prompt — that's what stops the endless keychain popups.
# This stays 100% local (only in this file); it is never logged or sent anywhere.
MAC_PASSWORD=your-mac-login-password

# The macOS user the GUI session belongs to. Leave blank to auto-detect
# (SUDO_USER / USER). Only set it if auto-detect picks the wrong account.
#MAC_USER=yourusername


# === App Store account(s) ====================================================
# ipatool can only hold ONE Apple ID per config dir, so one Apple ID == one
# storefront/region. Use a THROW-AWAY Apple ID you don't mind, not your main one.
#
# --- Option A: single region (simplest) -------------------------------------
APPLE_ID_EMAIL=your-appleid@example.com
APPLE_ID_PASSWORD=your-appleid-password
# 2-letter App Store storefront to search/download from (us, vn, jp, gb, cn ...).
STORE_COUNTRY=us

# --- Option B: multiple regions, one Apple ID each ---------------------------
# To offer several storefronts you can DOWNLOAD from, leave APPLE_ID_* blank and
# provide REGIONS_JSON (one line) OR a regions.json file next to app.py. Each
# region needs its own Apple ID and its own HOME dir (ipatool keeps its login
# under <home>/.ipatool). Example:
#
# REGIONS_JSON={"us":{"email":"a@x.com","pass":"p1","home":"~","country":"us"},"jp":{"email":"b@x.com","pass":"p2","home":"~/ipatool-homes/jp","country":"jp"}}

# --- Option C: extra storefronts to BROWSE with the account you already have --
# Comma-separated 2-letter codes. These appear in the site's store picker for
# search and lookup, so you can see what each country's App Store carries
# without a second Apple ID. They have no account of their own and are marked
# "browse" in the UI — a decrypt request falls back to your main account's
# library, so it downloads that account's copy, not the foreign storefront's.
#EXTRA_STORES=us,jp,gb,kr

# Which storefront the site selects on first visit. Defaults to "us" when it is
# one of the configured stores, otherwise the first one configured. Visitors who
# switch stores get their choice remembered in the browser.
#DEFAULT_REGION=us


# === Limits / tuning (all optional) =========================================
# Free apps a normal (non-admin) approved user may request per day (resets 00:00 GMT+7).
#DAILY_FREE_LIMIT=5
# Evict oldest cached IPAs to always keep at least this many GB free on disk.
#DISK_RESERVE_GB=20
# How long a decrypted IPA stays cached (days).
#CACHE_TTL_DAYS=7
# Extra public IPs that skip the per-IP rate limit (comma-separated). Localhost
# and private LAN ranges are always exempt.
#RATE_WHITELIST=203.0.113.7,203.0.113.8


# === Admin account (created once, on first run) =============================
# If unset, a random password is generated and printed to the log + written to
# <DATA_DIR>/ADMIN_PASSWORD.txt. Set these to choose your own.
#ADMIN_EMAIL=admin@localhost
#ADMIN_PASSWORD=change-me


# === Web server =============================================================
# Port the site listens on, and the address it binds to. 0.0.0.0 serves your
# whole LAN; use 127.0.0.1 to keep it on this Mac only.
#PORT=6347
#BIND_HOST=0.0.0.0


# === Paths (advanced — defaults are fine) ===================================
# Cache database, session secret and other small state.
#DATA_DIR=/var/tmp/macOSAppstoreDecrypter
# Where downloaded + decrypted IPAs live. Defaults to <DATA_DIR>/ipas; point it
# at an external disk to keep the big files off the internal SSD. "~" works.
#IPA_DIR=/Volumes/ExternalSSD/ipas
# Override the bundled tool paths if you keep them elsewhere.
#IPATOOL_BIN=/usr/local/bin/ipatool
#UNFAIR_BIN=/usr/local/bin/unfair-core
#KEYCHAIN_PATH=~/Library/Keychains/login.keychain-db