simplex-chat/scripts/store-service/store_service.ini.example

[listener]
host = 0.0.0.0
; the API and the webhooks, and the badges site when serve_webapp = on
badges_port = 8080
; the builds are read from the image's /srv/badges and /srv/names, the defaults of badges_static_dir
; and names_static_dir
; split deployment: Caddy serves the exported folders; this service is the API and webhooks only.
; Set to on for an all-in-one deployment where this service serves the sites itself, the names
; site on names_port (default 8081), which also answers the API and the webhooks.
serve_webapp = off
; the badges site is written here at boot with the publishable key injected; compose bind-mounts it
; to a host path Caddy serves. Unset it when serve_webapp = on.
badges_export_dir = /srv/badges-export
; the names site (simplex.domains), with [names] only: the folder it is exported to, which compose
; bind-mounts to ./names for Caddy
;names_export_dir = /srv/names-export
; on because Caddy proxies /api and /webhooks to this service; without it the rate limiter keys on
; Caddy's address and shares one bucket across all callers
trust_forwarded_for = on

[btcpay]
host = https://btcpay.example.org
api_key = replace-me
store_id = replace-me
webhook_secret = replace-me
expiry_minutes = 60
speed_policy = MediumSpeed
payment_tolerance = 0.5

; optional; omit the whole [stripe] section to disable card payments
[stripe]
; restricted key (rk_): Payment Intents write + Charges read — never a full secret key (sk_)
secret_key = rk_test_replace-me
publishable_key = pk_test_replace-me
; the signing secret of the /webhooks/stripe endpoint configured in the Dashboard
webhook_secret = whsec_replace-me
; minutes the service holds an unpaid card invoice open before it expires it; 1-1440
session_minutes = 60

[poll]
waiting_seconds = 3
idle_seconds = 60

; optional; without it every App Store receipt is answered provider_not_configured, which the app retries later.
; root_certificates lists, comma-separated, the roots trusted to sign receipts, each in DER and placed
; in config/. Today that is https://www.apple.com/certificateauthority/AppleRootCA-G3.cer.
; When Apple adds a root, list it beside the old one rather than in its place.
; the api_ keys, set together, verify subscriptions with the in-app purchase key App Store Connect
; issues; without them every App Store subscription is answered provider_not_configured. Place the .p8
; in config/; it must be readable by the service's user alone. api_host defaults to production, the
; only host accepted unless [dev] credit_test_purchases = on, which needs the Sandbox host instead.
;[apple]
;bundle_id = chat.simplex.app
;root_certificates = /etc/simplex-store-service/AppleRootCA-G3.cer
;api_key_id = 2X9R4HXF34
;api_issuer_id = 57246542-96fe-1a63-e053-0824d011072a
;api_private_key_file = /etc/simplex-store-service/AuthKey_2X9R4HXF34.p8
;api_host = https://api.storekit.itunes.apple.com

; optional; without it every Play receipt is answered provider_not_configured, which the app retries later.
; service_account_file is the JSON key of a service account with the Play Console permissions "View
; financial data, orders, and cancellation survey responses" and "Manage orders and subscriptions", to
; read and acknowledge purchases. Without the second, a purchase the app has not already acknowledged
; itself is answered internal until the permission is granted. Place it in config/; the file must be readable by the service's user alone.
;[google]
;package_name = chat.simplex.app
;service_account_file = /etc/simplex-store-service/play-service-account.json

; index is the one clients verify against; private_key is from `simplex-chat badge keygen`.
; To rotate, change both together, once clients trust the new index.
[issuer]
index = 1
private_key = replace-me

; Optional. When present, the service creates and manages one group on its first
; start without --run-cli, and logs its join link once, on the start that creates it.
; The link is a bearer secret that stays valid, so keep that log private. The first
; member to join is promoted to owner, so join right away.
; Moderators can /issue and /bulk codes; admins and owners can also /revoke.
; display_name must be a name the chat core accepts unchanged: one it would spell
; differently stops the whole service, payments included, from starting.
;[group]
;display_name = SimpleX Badges
;description = Welcome to the badges group

; the names store: omit [names] and [chain] together to turn it off.
;[names]
; testing until the .simplex TLD is deployed
;tld = testing
; the version of the name terms buyers agree to (1 to 32 letters, digits, dots, underscores or
; hyphens), and the page the order's checkbox links to; both required, read only at startup
;terms_version = 2026-10-23
;terms_url = https://simplex.chat/
; the paid years of a name; at least 2, the controller's minimum
;years = 2
; a name's term starts here; the days until then are free
;term_start = 2027-01-01T00:00:00Z
; how far an order's duration may be from the one the service computes
;term_slack_seconds = 3600
; a commitment with less than this left before its reveal deadline is not reused
;reveal_margin_seconds = 900
; how many times one order may move to another name
;max_order_moves = 3
; on: only prepaid codes register names, and every paid name order answers 403 codes_only
;codes_only = off
; the owner's link edits relayed for one name in any 365 days, each a transaction whose gas the
; service pays; 1 to 100. A request refused, never sent or reverted on chain does not count
;record_edits_per_year = 3
;
; community names, with [names] only: one line per name, `<label> = <what it is for>`, the label in
; lower case and listed once, the text 1 to 200 characters without a full stop at the end, which
; the page adds; read only at startup, see apps/simplex-store-service/README.md
;[community]
;bakers = bakers and bakeries in Portugal
;
; the chain the names are registered on. rpc_url can carry a provider's API key and service_key
; pays for every commit and register: keep both secret. Neither is ever logged.
;[chain]
; the reth node; ops/egress.sh allows it
;rpc_url = http://127.0.0.1:8545
; 1 for Ethereum mainnet
;chain_id = 1
;controller = 0x...
;sponsor = 0x...
;base_registrar = 0x...
;resolver = 0x...
; 0x and 64 hex digits: the registrar key the service sends transactions with; create, fund and
; rotate it as apps/simplex-store-service/README.md, "The gas key", says
;service_key = 0x...
; blocks after a register's receipt before a name counts as registered
;confirmations = 3
; the most gas any one transaction may use
;gas_limit_cap = 8000000
; the most wei per gas any transaction may pay (100 gwei); a transaction that needs more waits
;max_fee_per_gas = 100000000000

; local testing only, in both run modes: accepts any well-formed App Store or Play receipt without
; verifying it, so anyone who can reach this service can mint badges. The service refuses to start
; with this on beside an [apple] or [google] section. Its issuer key is always one released apps
; trust, so they accept every badge minted this way.
; A subscription is answered renewing and charged for its plan: the App Store product's, or the base
; plan a Play test token test.<basePlanId>.<uuid> names when it is a plan of that product, and else
; the product's monthly base plan, so a licence tester's purchase is credited too. An App Store tier
; raise is charged for the raised plan, which its renewals then charge. The plans are kept in memory,
; so a restart answers later renewals as ended, and refunds the unissued
; months of a plan still covered at its next month. Nothing is acknowledged, so Play refunds a
; licence tester's subscription once its acknowledgement window lapses.
[dev]
accept_unverified_store_receipts = off
; only beside accept_unverified_store_receipts or credit_test_purchases = on: every issue request for a
; subscription asks its store, while coverage runs too, and banks the months each check charges, to
; watch a renewal by hand.
check_store_during_coverage = off

; local testing only, beside a real [apple] or [google]: credits a purchase the store itself calls a
; test - an App Store sandbox purchase, or a Play licence tester's - which no real buyer pays for.
; Without it such a purchase is refused as test_purchase, which is terminal, so it can never be credited.
; Beside [apple] the service starts with this on only when its api_ keys are set with
; api_host = https://api.storekit-sandbox.itunes.apple.com, since a sandbox receipt verifies like any
; other and would otherwise be credited as a real purchase. Beside [google] it is allowed: never turn it
; on beside the production app's [google], as the issuer key is one released apps trust and every
; licence tester the Play Console lists would get a badge without paying. Each test purchase or test
; subscription taken as paid is logged as a warning.
credit_test_purchases = off