# ─────────────────────────────────────────────────────────────────────────────
# macOSAppstoreDecrypter configuration.  Copy this file to ".env" (same folder as app.py) and
# fill it in.  ".env" is git-ignored, so your credentials never get committed.
#   cp .env.example .env  &&  nano .env
# Every value is optional except MAC_PASSWORD and ONE Apple ID.
# ─────────────────────────────────────────────────────────────────────────────

# === macOS login password ===================================================
# Required. Used for `sudo` (purge, launchctl asuser) and to unlock the login
# keychain WITHOUT a GUI prompt — that's what stops the endless keychain popups.
# This stays 100% local (only in this file); it is never logged or sent anywhere.
MAC_PASSWORD=your-mac-login-password

# The macOS user the GUI session belongs to. Leave blank to auto-detect
# (SUDO_USER / USER). Only set it if auto-detect picks the wrong account.
#MAC_USER=yourusername


# === App Store account(s) ====================================================
# ipatool can only hold ONE Apple ID per config dir, so one Apple ID == one
# storefront/region. Use a THROW-AWAY Apple ID you don't mind, not your main one.
#
# --- Option A: single region (simplest) -------------------------------------
APPLE_ID_EMAIL=your-appleid@example.com
APPLE_ID_PASSWORD=your-appleid-password
# 2-letter App Store storefront to search/download from (us, vn, jp, gb, cn ...).
STORE_COUNTRY=us

# --- Option B: multiple regions ---------------------------------------------
# To offer several storefronts (a flag selector appears on the site), leave
# APPLE_ID_* blank and instead provide REGIONS_JSON (one line) OR a regions.json
# file next to app.py. Each region needs its own Apple ID and its own HOME dir
# (ipatool keeps its login under <home>/.ipatool). Example:
#
# REGIONS_JSON={"us":{"email":"a@x.com","pass":"p1","home":"~","country":"us","label":"USA"},"jp":{"email":"b@x.com","pass":"p2","home":"~/ipatool-homes/jp","country":"jp","label":"Japan"}}
#
# DEFAULT_REGION=us


# === Limits / tuning (all optional) =========================================
# Free apps a normal (non-admin) approved user may request per day (resets 00:00 GMT+7).
#DAILY_FREE_LIMIT=5
# Evict oldest cached IPAs to always keep at least this many GB free on disk.
#DISK_RESERVE_GB=20
# How long a decrypted IPA stays cached (days).
#CACHE_TTL_DAYS=7
# Extra public IPs that skip the per-IP rate limit (comma-separated). Localhost
# and private LAN ranges are always exempt.
#RATE_WHITELIST=203.0.113.7,203.0.113.8


# === Admin account (created once, on first run) =============================
# If unset, a random password is generated and printed to the log + written to
# <DATA_DIR>/ADMIN_PASSWORD.txt. Set these to choose your own.
#ADMIN_EMAIL=admin@localhost
#ADMIN_PASSWORD=change-me


# === Paths (advanced — defaults are fine) ===================================
# Where cache DB / downloaded + decrypted IPAs / session secret live.
#DATA_DIR=/var/tmp/macOSAppstoreDecrypter
# Override the bundled tool paths if you keep them elsewhere.
#IPATOOL_BIN=/usr/local/bin/ipatool
#UNFAIR_BIN=/usr/local/bin/unfair-core
#KEYCHAIN_PATH=~/Library/Keychains/login.keychain-db