AssppWeb README

The project's README from github.com/Lakr233/AssppWeb. As one markdown file: README.md.

AssppWeb

A web-based tool for acquiring and installing iOS apps outside the App Store. Authenticate with your Apple ID, search for apps, acquire licenses, and install IPAs directly to your device.

preview

Zero-Trust Architecture

AssppWeb uses a zero-trust design where the server never sees your Apple credentials. All Apple API communication happens directly in your browser via WebAssembly (libcurl.js with Mbed TLS 1.3). The server only acts as a blind TCP relay (Wisp protocol) and handles IPA compilation from public CDN downloads.

⚠️ Important Security Notice: There are no official Asspp Web instances. Use any public instance at your own risk. While the backend cannot read your encrypted traffic, a malicious host could serve a modified frontend to capture your credentials before encryption. Therefore, do not blindly trust public instances. We strongly recommend self-hosting your own instance or using one provided by a trusted partner. Always verify the SSL certificate and ensure you are connecting to a secure, authentic endpoint.

恳请所有转发项目的博主对自己的受众进行网络安全技术科普。要有哪个不拎清的大头儿子搞出事情来都够我们喝一壶的。

Quick Start

Deploy to Cloudflare

Deploy to Cloudflare

This uses Cloudflare Workers + Containers with the published image ghcr.io/lakr233/assppweb:latest.

Requirements:

If your build log fails at Deploy a container application with Unauthorized, your build token is missing required Containers/Cloudchamber permissions.

Deploy to Railway

Click to show Railway deployment instructions
  1. Go to railway.com/new/image → enter ghcr.io/lakr233/assppweb:latest
  2. In service Settings, set Healthcheck Path to /api/settings and deploy
  3. Right-click the service → Attach volume → mount path: /data
  4. In Variables, set DATA_DIR = /data and deploy
  5. In Settings → Networking, generate a public domain or add a custom domain

Notes

  • The free trial works but has limitations (volume expiry, network restrictions). Hobby plan ($5/month) or above is recommended for reliable use.
  • Enable Serverless in service settings to scale down to zero during idle periods
  • Railway auto-updates :latest images from GHCR — new releases will be deployed automatically within a few hours

⚠️ Custom domain with Cloudflare: Railway's Cloudflare integration creates DNS records with Proxy enabled (orange cloud) by default. After authorizing, go to Cloudflare DNS settings and switch the CNAME record to DNS only (gray cloud) — Railway handles TLS automatically. If you keep Cloudflare Proxy on, you must set SSL/TLS mode to Full (not Flexible or Full Strict), otherwise you'll get an infinite redirect loop. See Railway docs.

Self-Host with Docker Compose

Click to show manual Docker Compose setup instructions

Setup Docker Compose

curl -O https://raw.githubusercontent.com/Lakr233/AssppWeb/main/compose.yml
docker compose up -d

Environment Variables

Variable Default Description
PORT 8080 Server listen port
DATA_DIR ./data Directory for storing compiled IPAs
PUBLIC_BASE_URL (auto-detect) Public URL for generating install manifests (e.g. https://asspp.example.com)
UNSAFE_DANGEROUSLY_DISABLE_HTTPS_REDIRECT false Disable HTTPS redirect (see warning below)
AUTO_CLEANUP_DAYS 0 Automatically delete cached IPA files older than specified days (0 to disable)
AUTO_CLEANUP_MAX_MB 0 Automatically delete oldest cached IPA files when size exceeds this MB limit (0 to disable)
MAX_DOWNLOAD_MB 0 Reject downloads exceeding this size in MB to prevent out-of-memory errors (0 to disable)
DOWNLOAD_THREADS 8 Number of parallel threads for IPA downloads (1–32)
ACCESS_PASSWORD (none) Require a password to access the web UI and API (empty to disable)

Reverse Proxy (Required for Install Apps on iOS)

iOS requires HTTPS for itms-services:// install links. You must put AssppWeb behind a reverse proxy with a valid TLS certificate.

⚠️ Redirect loop (ERR_TOO_MANY_REDIRECTS)? Some reverse proxies (e.g. NAS built-in proxies) always send X-Forwarded-Proto: http even when the client connected via HTTPS, causing an infinite redirect loop. If you cannot configure your proxy to send the correct header, set UNSAFE_DANGEROUSLY_DISABLE_HTTPS_REDIRECT=true as a last resort. This disables the HTTP→HTTPS redirect — you must ensure your proxy enforces HTTPS externally.

The following is an example Caddyfile configuration:

asspp.example.com { reverse_proxy 127.0.0.1:8080 }

⚠️ Make Sure WebSocket Works

AssppWeb relies on the Wisp protocol over WebSocket (/wisp/) for its zero-trust architecture. Ensure your reverse proxy or CDN (e.g., Nginx, Cloudflare) is configured to allow WebSocket connections, otherwise the app will fail to communicate with Apple servers.

Security Recommendations

DDoS Protection

IPA files can be hundreds of megabytes. If your instance is publicly accessible, put it behind a CDN like Cloudflare to absorb bandwidth and prevent abuse.

License

MIT License. See LICENSE for details.

🥰 Acknowledgments

For projects that was stolen and used heavily:

For friends who helped with testing and feedback:

Fable 5 Verified

AssppWeb (Lakr233/AssppWeb)

Searching Database…

4K ·GitHub
AssppWeb
这是什么东西?一个在浏览器里使用的工具,用来在 App Store 之外获取并安装 iOS 应用:你用 Apple ID 登录,搜索应用,获取授权,然后直接从浏览器把 IPA 安装到你的设备上。
它是装在我 iPhone 上的应用,还是要在服务器上运行的东西?这是一个自托管(blf)的网络服务,不是 iPhone 应用:你先把它部署好(Cloudflare Workers、Railway 或 Docker Compose),再用浏览器打开,由它把 IPA 安装到你的 iOS 设备上。
我怎么把它跑起来,拥有自己的实例?部署官方发布的镜像 ghcr.io/lakr233/assppweb:latest —— 可以部署到 Cloudflare Workers,也可以部署到 Railway(健康检查路径为 /api/settings,需要把卷挂载到 /data),或者用 Docker Compose 自托管。
往 iPhone 上安装应用这部分需要什么条件才能用?iOS 要求 itms-services 链接必须使用 HTTPS,所以实例必须放在配有有效 TLS 证书的反向代理后面,并且该代理还要允许 /wisp/ 上的 WebSocket 连接;另外还需要你自己的 Apple ID 来登录。
我能直接用别人架设的公共实例吗?官方没有提供任何公共实例。恶意的主机可以在前端做手脚、在加密之前截获你的登录凭据,所以建议自己部署,或者只用可信的合作伙伴提供的实例,并且务必核实 SSL 证书。
服务器会看到我的 Apple ID 密码吗?不会。零信任的设计把所有与 Apple API 的通信都放在你的浏览器内通过 WebAssembly 完成(libcurl.js,使用 Mbed TLS 1.3);服务器只充当一个不感知内容的 TCP 中继,永远看不到你的凭据。
自己跑一个实例大概要花多少钱?Cloudflare 需要 Workers 付费方案,因为免费版不提供 Containers。Railway 的免费试用能用但有限制 —— 建议至少用 Hobby 方案(每月 5 美元)或更高;直接用 Docker Compose 自托管则是免费的。
既然服务器看不到我的登录凭据,那它到底在做什么?它只作为一个不感知内容的 TCP 中继转发你的加密流量(通过 WebSocket 使用 Wisp 协议),并把从公共 CDN 下载的内容打包成 IPA 缓存文件,供你的设备安装。
我可以给我的实例设置密码保护吗?可以 —— 设置环境变量 ACCESSPASSWORD 即可要求访问网页界面和 API 时输入密码。你还可以限制下载大小(MAXDOWNLOADMB)并自动清理缓存的 IPA(AUTOCLEANUPDAYS),让公共实例保持良好状态。
为什么在某些代理后面会陷入无限重定向循环?有些 NAS 自带的代理即使在 HTTPS 下也总是发送 X-Forwarded-Proto: http,导致 ERR_TOO_MANY_REDIRECTS。请配置代理发送正确的请求头,实在不行再把 UNSAFEDANGEROUSLYDISABLEHTTPSREDIRECT 设为 true 作为最后的解决办法。
What are similar projects?wechat-article-exporter, all-set-tw, TREK, buzzkit, ios-location-spoofer, manychat-lite-cloudflare, web-check, pdfcraft
Which topics is it in?cloudflare-workers, cloudflare, apple, wasm, encryption, docker-compose, ios, web-app, privacy, security, tool, server
Creator
Lakr233
Size
1.8 MB
Stars
4K
Updated
CommitSep 03
Age
8mo
Commits · 90 Days