#Configuration File renmori.toml

renmori protect runs without any configuration. When protection parameters need to be fixed across a team, or the same settings reused in CI, a TOML configuration file renmori.toml can be used. All keys in the configuration file are optional; keys that are not set use their default values.

#Lookup order

1. The file specified with -c, --config FILE. If the file does not exist, the command fails with exit code 2
2. renmori.toml in the build root, that is, <game-dir>/renmori.toml
3. renmori.toml in the current working directory

The first file found is used, and the path used is reported on stderr. If none of the three exists, all defaults are used.

Reading the configuration file requires Python 3.11 or later; on Python 3.9 or 3.10, tomli must be installed additionally, otherwise the command fails with exit code 2.

#Merge rules

#[protect] section

#strength

For the detailed differences, see Protection Strength and the Closed Plugin.

#lockdown

When enabled, the runtime sets config.developer and config.console to False and refuses to run the Ren'Py command-line subcommands compile, dialogue, translate, add_from and merge_strings. These subcommands can export scripts and text data to disk and should be disabled in release builds. Set it to false only when the developer console is needed in an internal test build.

#chunk_size

Each chunk is encrypted independently and carries a 16-byte authentication tag. The default of 65536 bytes corresponds to a size overhead of about 0.024%. Larger chunks favor sequential reads of large CGs and videos, while smaller chunks reduce the overhead for many small files. Under full protection the chunking parameters are determined by the plugin per build.

#exclude and keep_on_disk

Both keep matching files on disk, unencrypted; they differ in purpose: keep_on_disk declares files read by programs other than the engine, while exclude covers other cases in which files must remain plaintext. Patterns are matched against game-relative paths using Python fnmatch semantics; * can cross directory separators, and matching is case-insensitive on Windows.

[protect]
keep_on_disk = ["steam_appid.txt", "thirdparty/sdk_config.json"]
exclude = ["licenses/*"]

#platforms

Applies to the plugin only. When not set, the plugin detects the platforms from the lib/py3-* directories in the build. The available values are determined by the plugin, for example:

platforms = ["win-x64", "linux-x64", "mac-universal"]

#launcher

Applies to the plugin only. When enabled, the keys are bound to the native launcher, which is shipped with the build, and the keys are reconstructed only when the game is started through that launcher.

#[keys] section

[keys] applies to baseline protection only and specifies the sources of the container key and the script key. Under full protection the plugin derives the keys itself and ignores this section.

Rules:

• The value of the environment variable must be 64 hexadecimal characters, that is, a 32-byte key; if the format is invalid, the command fails with exit code 2
• When master_env or script_env is not set, a random key is generated for this build
• When a key name is set but the environment variable does not exist or is empty, a notice is printed to stderr and a random key is likewise generated
• The summary panel shows the key sources, for example master=env:RENMORI_MASTER_KEY · script=random

[keys]
master_env = "RENMORI_MASTER_KEY"
script_env = "RENMORI_SCRIPT_KEY"

One way to generate a key:

python -c "import os; print(os.urandom(32).hex())"

For how to store keys in CI, see CI integration.

#Complete example

# renmori.toml

[protect]
# Full protection is used when strength is not set; "auto" falls back to baseline when the plugin is unavailable
strength = "auto"

# Keep enabled for release builds
lockdown = true

# Baseline only; under full protection the plugin determines the chunking parameters
chunk_size = 65536

# Never enable in release builds
keep_plaintext = false

# Files to keep as plaintext
exclude = []
keep_on_disk = ["steam_appid.txt"]

# Plugin only
# platforms = ["win-x64", "linux-x64", "mac-universal"]
launcher = false

[keys]
# Baseline only
# master_env = "RENMORI_MASTER_KEY"
# script_env = "RENMORI_SCRIPT_KEY"

Example file in the repository: examples/renmori.toml.