.env.example

# wrapper-v2 environment template.
# Copy to .env and fill in. Anything left commented uses the default.

# Public host ports that map onto the Rust supervisor inside the container.
# HTTP_PORT maps to HTTP :80. DECRYPT_PORT maps to TCP decrypt :10020.
# Override these if your host already has something bound to those ports.
# HTTP_PORT=8080
# DECRYPT_PORT=10020

# Target arch for compose/docker build (must match extract-libs + stage-system).
# x86_64 (default) or arm64-v8a. For arm64 also set BUILD_PLATFORM and RUNTIME_PLATFORM.
# TARGET_ARCH=x86_64
# BUILD_PLATFORM=linux/amd64
# RUNTIME_PLATFORM=linux/amd64

# arm64-v8a example (native arm64 Docker builder):
# TARGET_ARCH=arm64-v8a
# BUILD_PLATFORM=linux/arm64
# RUNTIME_PLATFORM=linux/arm64

# URL the CI workflow downloads the APKMirror .apkm bundle from (all splits in one file).
# Set as a GitHub Actions secret, not committed here. Local builds do not
# need this - run tools/fetch-apk.sh + tools/extract-libs.sh manually.
# APK_URL=https://example.invalid/apple-music-3.6.0-beta-1109.apkm

# ---------------------------------------------------------------------------
# Daemon runtime
# ---------------------------------------------------------------------------

# Bind address and port the public Rust supervisor listens on inside the container.
# WRAPPER_HOST=0.0.0.0
# WRAPPER_PORT=80

# Bind address and port for raw TCP FPS decrypt.
# WRAPPER_DECRYPT_HOST=0.0.0.0
# WRAPPER_DECRYPT_PORT=10020

# Timeout for one IPC request to the C++ Apple worker. On timeout, the Rust
# supervisor returns an error to the current client and restarts the worker.
# WRAPPER_WORKER_TIMEOUT_SECS=60

# Process role. Normal users should not set this. The Rust supervisor sets
# WRAPPER_MODE=ipc-worker only for the private C++ Apple worker subprocess.
# WRAPPER_MODE=ipc-worker

# Apple-lib working directory (FPS key cache, mpl_db, etc).
# Must exist inside rootfs/. The default matches upstream wrapper.
# WRAPPER_BASE_DIR=/data/data/com.apple.android.music/files

# Advanced chroot override for staged Apple/Android libraries.
# WRAPPER_LIBS_DIR=/system/lib64

# Slash-separated 9-tuple identifying the fake "Apple Music Android client"
# the daemon presents to Apple's servers. Order:
#   ClientId/VersionId/PlatformId/ProductVersion/DeviceModel/BuildVersion/
#   LocaleId/LanguageId/AndroidID
# Default is the same Galaxy-S9 fingerprint upstream wrapper uses.
# WRAPPER_DEVICE_INFO=Music/4.9/Android/10/Samsung S9/7663313/en-US/en-US/dc28071e981c439e

# Set to 0 to skip Apple lib initialization at startup. With this flag set,
# the daemon binds the HTTP server but does NOT call into libstoreservicescore
# / libmediaplatform / libandroidappmusic. Useful for /health-only smoke
# tests on builds where you have not staged the Apple libraries yet.
# WRAPPER_APPLE_INIT=1

# Set to 0 to skip startup token harvest from an existing on-disk Apple
# session. Restore is enabled by default when Apple init succeeds.
# WRAPPER_RESTORE_SESSION=1

# Optional display label for `apple_id` in GET /me after session restore.
# This does not send credentials to Apple.
# WRAPPER_APPLE_ID=you@example.com

# Set to 1 to print stage-by-stage diagnostic lines from loader.cpp
# (`loader: dlopen ... / dlsym ...`) and runtime.cpp (`runtime: trace ...`).
# Useful when the daemon SIGSEGVs during init - the last printed stage shows
# which dlopen / dlsym / Apple call was running when the fault hit.
# WRAPPER_RUNTIME_TRACE=1

# Optional: sign in at startup (after session restore) using the same
# credentials as POST /login. Secrets live in the process environment — avoid
# committing a .env that contains real values; use app-specific passwords.
# WRAPPER_USERNAME=you@example.com
# WRAPPER_PASSWORD=your-app-specific-password