[listener] host = 0.0.0.0 port = 8080 ; the built webapp in the image, read as the export source static_dir = /srv/web ; split deployment: Caddy serves the exported folder; this service is the API and webhooks only. ; Set to on for an all-in-one deployment where this service serves the webapp itself. serve_webapp = off ; the webapp is written here at boot with the publishable key injected; compose bind-mounts it to a ; host path Caddy serves. Unset it when serve_webapp = on. webapp_export_dir = /srv/webapp ; on because Caddy proxies /api and /webhooks to this service; without it the rate limiter keys on ; Caddy's address and shares one bucket across all callers trust_forwarded_for = on [btcpay] host = https://btcpay.example.org api_key = replace-me store_id = replace-me webhook_secret = replace-me expiry_minutes = 60 speed_policy = MediumSpeed payment_tolerance = 0.5 ; optional; omit the whole [stripe] section to disable card payments [stripe] ; restricted key (rk_): Payment Intents write + Charges read — never a full secret key (sk_) secret_key = rk_test_replace-me publishable_key = pk_test_replace-me ; the signing secret of the /webhooks/stripe endpoint configured in the Dashboard webhook_secret = whsec_replace-me ; minutes the service holds an unpaid card invoice open before it expires it; 1-1440 session_minutes = 60 [poll] waiting_seconds = 3 idle_seconds = 60 ; optional; without it every App Store receipt is answered provider_not_configured, which the app retries later. ; root_certificates lists, comma-separated, the roots trusted to sign receipts, each in DER and placed ; in config/. Today that is https://www.apple.com/certificateauthority/AppleRootCA-G3.cer. ; When Apple adds a root, list it beside the old one rather than in its place. ; the api_ keys, set together, verify subscriptions with the in-app purchase key App Store Connect ; issues; without them every App Store subscription is answered provider_not_configured. Place the .p8 ; in config/; it must be readable by the service's user alone. api_host defaults to production, the ; only host accepted unless [dev] credit_test_purchases = on, which needs the Sandbox host instead. ;[apple] ;bundle_id = chat.simplex.app ;root_certificates = /etc/simplex-badge-service/AppleRootCA-G3.cer ;api_key_id = 2X9R4HXF34 ;api_issuer_id = 57246542-96fe-1a63-e053-0824d011072a ;api_private_key_file = /etc/simplex-badge-service/AuthKey_2X9R4HXF34.p8 ; optional; without it every Play receipt is answered provider_not_configured, which the app retries later. ; service_account_file is the JSON key of a service account with the Play Console permissions "View ; financial data, orders, and cancellation survey responses" and "Manage orders and subscriptions", to ; read and acknowledge purchases. Without the second, a purchase the app has not already acknowledged ; itself is answered internal until the permission is granted. Place it in config/; the file must be readable by the service's user alone. ;[google] ;package_name = chat.simplex.app ;service_account_file = /etc/simplex-badge-service/play-service-account.json ; index is the one clients verify against; private_key is from `simplex-chat badge keygen`. ; To rotate, change both together, once clients trust the new index. [issuer] index = 1 private_key = replace-me ; Optional. When present, the service creates and manages one group on its first ; start without --run-cli, and logs its join link once, on the start that creates it. ; The link is a bearer secret that stays valid, so keep that log private. The first ; member to join is promoted to owner, so join right away. ; Moderators can /issue and /bulk codes; admins and owners can also /revoke. ; display_name must be a name the chat core accepts unchanged: one it would spell ; differently stops the whole service, payments included, from starting. ;[group] ;display_name = SimpleX Badges ;description = Welcome to the badges group ; local testing only, in both run modes: accepts any well-formed App Store or Play receipt without ; verifying it, so anyone who can reach this service can mint badges. The service refuses to start ; with this on beside an [apple] or [google] section. Its issuer key is always one released apps ; trust, so they accept every badge minted this way. ; A subscription is answered renewing and charged for its plan: the App Store product's, or the base ; plan a Play test token test.. names when it is a plan of that product, and else ; the product's monthly base plan, so a licence tester's purchase is credited too. An App Store tier ; raise is charged for the raised plan, which its renewals then charge. The plans are kept in memory, ; so a restart answers later renewals as ended, and refunds the unissued ; months of a plan still covered at its next month. Nothing is acknowledged, so Play refunds a ; licence tester's subscription once its acknowledgement window lapses. [dev] accept_unverified_store_receipts = off ; only beside accept_unverified_store_receipts or credit_test_purchases = on: every issue request for a ; subscription asks its store, while coverage runs too, and banks the months each check charges, to ; watch a renewal by hand. check_store_during_coverage = off ; local testing only, beside a real [apple] or [google]: credits a purchase the store itself calls a ; test - an App Store sandbox purchase, or a Play licence tester's - which no real buyer pays for. ; Without it such a purchase is refused as test_purchase, which is terminal, so it can never be credited. ; Beside [apple] the service starts with this on only when its api_ keys are set with ; api_host = https://api.storekit-sandbox.itunes.apple.com, since a sandbox receipt verifies like any ; other and would otherwise be credited as a real purchase. Beside [google] it is allowed: never turn it ; on beside the production app's [google], as the issuer key is one released apps trust and every ; licence tester the Play Console lists would get a badge without paying. Each test purchase or test ; subscription taken as paid is logged as a warning. credit_test_purchases = off