# ImpTune

Build printer deploy packages (`.intunewin` for Intune, `.zip` for NinjaRMM) from Windows driver ZIPs via a web UI.

## Run

### Local development

```bash
docker compose up
```

`docker-compose.override.yml` is merged automatically: it mounts your working
copy into the container and runs uvicorn with `--reload`, so code edits are
picked up live. The override is gitignored (personal / per-machine).

### Run the published image

To run the image from the registry instead of building locally, skip the
override:

```bash
docker compose -f docker-compose.yml pull
docker compose -f docker-compose.yml up
```

Then open http://localhost:8000

## Publishing

`scripts/publish.ps1` builds the image and pushes it to the Gitea container
registry at `git.azuze.fr/kawa/imptune`.

```powershell
# build + push :<short-git-sha> and :latest (prompts for a Gitea token)
./scripts/publish.ps1

# tag an explicit version
./scripts/publish.ps1 -Tag v1.2.0
```

Use a Gitea access token (Settings → Applications, with package read/write
scope) as the password. For non-interactive runs set `GITEA_USER` /
`GITEA_TOKEN` env vars. Run `Get-Help ./scripts/publish.ps1 -Detailed` for all
parameters (`-Registry`, `-Owner`, `-Image`, `-NoBuild`, `-SkipLogin`, …).

## Environment variables

Set these under `environment:` in `docker-compose.yml`.

| Variable         | Default | Purpose                                          |
|------------------|---------|--------------------------------------------------|
| `DATA_DIR`       | `/data` | Storage root for the SQLite DB, drivers and icons. Should map to the `imptune_data` volume. |
| `PORT`           | `8000`  | Port the server listens on inside the container. |
| `COOKIE_SECURE`  | `true`  | `Secure` flag on the session cookie. Set to `false` when the app is reached over plain HTTP — see below. |

### `COOKIE_SECURE` and HTTPS

Printers, print defaults and clients belong to a session identified by an opaque
key in a cookie (there are no accounts). That cookie is `Secure` by default, so
it only travels over HTTPS.

**Behind a TLS-terminating proxy** (nginx, Traefik, Caddy — the normal setup):
leave the default. The session cookie lasts ten years, so a browser keeps its
printers indefinitely.

**Reached directly over plain HTTP** (`http://host:8000`): set
`COOKIE_SECURE=false`, otherwise the browser refuses the cookie and every
request starts a brand-new empty session — no printer you save is ever visible
again.

In that mode the app is fully usable and keeps remembering everything, but the
cookie becomes **memory-only**: the session ends when the browser closes, and
every page shows a warning saying so. This is deliberate — over plain HTTP the
key is readable on the wire, so it is not written to disk for ten years. Use
**Download my backup key** to save the key to a file; `/session/restore` takes
it back on the next browser start, or on another machine.

```yaml
services:
  imptune:
    environment:
      - DATA_DIR=/data
      - COOKIE_SECURE=false   # only when serving plain HTTP
```

For local development the same applies:

```bash
export DATA_DIR=/tmp/imptune_data
export COOKIE_SECURE=false
uvicorn imptune.main:app --reload --port 8000
```