# HolyArrs secrets file: the template (every value empty).
#
# Copy it, fill in what you use, leave the rest empty (an empty value is
# skipped), then run:
#   holyarrs import-secrets -file <your copy> -dry-run
#   holyarrs import-secrets -file <your copy> -delete
# See import-secrets.md. Keep the filled copy readable by you only
# (chmod 600). HolyArrs never prints a value from it.
#
# allow_local_network: true lets that one item reach this machine or your
# home network (192.168.x.x, 10.x.x.x, a container name...). Leave it false
# for anything on the internet. It is never guessed from the address.
version: 1

tmdb:
  read_token: ""
  api_key: ""          # not used: HolyArrs uses the read token

tvdb:
  api_key: ""          # not used: show details come from TMDB and TVMaze

trakt:
  client_id: ""

opensubtitles:
  api_key: ""
  username: ""         # downloads need a sign-in
  password: ""

subdl:
  api_key: ""

addic7ed:              # an Addic7ed subtitle site (shows only); HolyArrs signs in itself
  username: ""
  password: ""

jackett:               # its key fills in indexers entries on its address that have no key
  address: ""
  api_key: ""
  allow_local_network: false

prowlarr:              # the same, and also saved for the Move tool
  address: ""
  api_key: ""
  allow_local_network: false

indexers:              # one entry per feed; each becomes a paused Source
  - name: ""
    address: ""        # the feed's full address, for example http://prowlarr:9696/1/api
    api_key: ""
    format: torznab    # torznab or newznab
    allow_local_network: false
    clear_key: false   # an empty api_key keeps a stored key; true removes it

qbittorrent:
  address: ""
  api_key: ""        # qBittorrent 5.2 or newer: Options > Web UI > API key
  username: ""       # or, without an API key, the Web UI user name
  password: ""       # and password
  allow_local_network: false

sabnzbd:
  address: ""
  api_key: ""           # full API key; the add-only NZB key is not used
  allow_local_network: false

nzbget:                # skipped: HolyArrs cannot use it yet
  address: ""
  username: ""
  password: ""
  allow_local_network: false

transmission:          # skipped: HolyArrs cannot use it yet
  address: ""
  username: ""
  password: ""
  allow_local_network: false

deluge:                # skipped: HolyArrs cannot use it yet
  address: ""
  password: ""
  allow_local_network: false

jellyfin:
  address: ""
  api_key: ""
  allow_local_network: false

emby:
  address: ""
  api_key: ""
  allow_local_network: false

plex:
  address: ""
  token: ""
  allow_local_network: false

# Old apps: saved for the Move tool (Settings > Move from other apps), used
# for one read and then forgotten.
radarr:
  address: ""
  api_key: ""
  allow_local_network: false

sonarr:
  address: ""
  api_key: ""
  allow_local_network: false

lidarr:
  address: ""
  api_key: ""
  allow_local_network: false

bazarr:
  address: ""
  api_key: ""
  allow_local_network: false

seerr:
  address: ""
  api_key: ""
  allow_local_network: false

smtp:                  # becomes the Alert "Email", off until you test it
  host: ""
  port: ""             # 587 (STARTTLS) by default; 465 uses TLS
  username: ""
  password: ""
  from: ""
  allow_local_network: false

discord:               # becomes the Alert "Discord", off until you test it
  webhook_url: ""

webhook:               # becomes the Alert "Webhook", off until you test it
  url: ""
  signing_secret: ""
  allow_local_network: false

# Only used to reach HolyArrs while it runs (an owner API key with the
# admin scope, from Settings > API > API keys). Never stored.
holyarrs:
  address: ""
  owner_api_key: ""