mixed-port: 7890
socks-port: 7891
ipv6: true
log-level: info
allow-lan: false
unified-delay: true
external-controller: 127.0.0.1:9090
external-ui: ./zashboard
external-ui-url: "https://github.com/Zephyruso/zashboard/archive/refs/heads/gh-pages.zip"
tcp-concurrent: true
disable-keep-alive: false
keep-alive-idle: 20
keep-alive-interval: 20
geo-auto-update: true
geo-update-interval: 720
geodata-mode: false # use mmdb for geoip
find-process-mode: strict
global-client-fingerprint: chrome

profile:
  store-selected: true
  store-fake-ip: true

dns:
  enable: true
  ipv6: false
  cache-algorithm: arc
  respect-rules: true
  prefer-h3: false
  listen: 127.0.0.1:1053
  use-hosts: true
  use-system-hosts: true
  enhanced-mode: fake-ip
  fake-ip-range6: 3fff:0666:0666:0666::1/64
  fake-ip-range: 6.6.0.1/16
  fake-ip-filter:
    - 'geosite:connectivity-check'
    - 'geosite:private'
  proxy-server-nameserver:
    - dhcp://en0
  default-nameserver:
    - 223.5.5.5
    - 119.29.29.29
    - 1.1.1.1
  nameserver:
    - https://dns.cloudflare.com/dns-query
    - https://dns.alidns.com/dns-query
    - https://doh.pub/dns-query
  nameserver-policy:
    "geosite:private":
      - dhcp://en0
    "geosite:connectivity-check":
      - dhcp://en0
    "geosite:cn":
      - 223.5.5.5
      - 119.29.29.29

sniffer:
  enable: true
  override-destination: false
  sniff:
    HTTP:
      ports: [80, 8080-8880]
      override-destination: true
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]
  skip-domain:
    - "+.push.apple.com"

tun:
  enable: true
  stack: system
  auto-route: true
  auto-detect-interface: true
  strict-route: false
  dns-hijack:
    - any:53
    - tcp://any:53
  mtu: 1500
  udp-timeout: 300
  route-exclude-address:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 169.254.0.0/16
    - 224.0.0.0/4
    - 255.255.255.255/32
    - ff00::/8
    - fe80::/10
    - ::1/128
    # VPS
    - 178.239.124.93/32
    - 150.136.246.56/32
    - 69.63.202.38/32
    - 2603:c020:4000:3e:0:a17a:7ee5:a701/128

proxies: 
- &reality_default
  name: jp-reality
  server: 178.239.124.93
  type: vless
  port: 443
  udp: true
  uuid: "5aeab578-46af-4a2a-8be8-3b82d4a86221"
  flow: xtls-rprx-vision
  packet-encoding: xudp
  tls: true
  servername: itunes.apple.com
  alpn:
    - h2
    - http/1.1
  client-fingerprint: chrome
  skip-cert-verify: true
  reality-opts:
    public-key: "YA4IzSYmB3RYCGvkaIdnNTdpwv01_wEnAZoraWWekHs"
    short-id: "5b92b56d2b7e5c2b"
  # encryption: ""
  network: tcp
  tfo: true
  smux: &smux_default
    enabled: true
    protocol: yamux
    max-connections: 2
    min-streams: 8
    statistic: false
    only-tcp: true
    padding: true

- &any_default
  name: la-any4
  type: anytls
  server: 69.63.202.38
  port: 8443
  password: "USxyigYOsII9nia02p3gMVrLhIXzG6Kw9VQnNTG9vY8="
  client-fingerprint: chrome
  udp: true
  min-idle-session: 0
  idle-session-check-interval: 30
  idle-session-timeout: 30
  alpn:
    - h2
    - http/1.1
  sni: "api.soyoy.com"
  <<: &tls_certs
    skip-cert-verify: false
    certificate: |-
      -----BEGIN CERTIFICATE-----
      MIIEMjCCAhqgAwIBAgIURpsi8JhGSi6LGHgYKIHtMudhw2QwDQYJKoZIhvcNAQEL
      BQAwIDEeMBwGA1UEAwwVYW55dGxzLW10bHMtY2xpZW50LWNhMB4XDTI1MTIyNjIx
      MzIxN1oXDTM1MTIyNDIxMzIxN1owEjEQMA4GA1UEAwwHbWFjYm9vazCCASIwDQYJ
      KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKdbZKBLVfWHvHkMier0Wh9ivBM1osqa
      DFhAzQHQQ0wC+5NP1SsIan0bAkbMhnq8JMT/3mywl3zIMk0izMSb2URiI3hm9gWL
      Rl9cD1/omjgTMe4hJ2sRUHCvpfwbjpxsY/cT5O+lPmMRtS/roIxtmi2vLW1+/90H
      9ODQtSyaDOcVkNO82UxpwlxGzW9hdQTYMGJI2NeFUBbkAJT3mqn+P23eHK9vKKr8
      ky4+4ThufPmb/QFdwg2SoNeaB0NnOx4wAJXie5JX8sdjgA/B0UI152q+pNAhHBDO
      BJAHFpthK5soA/CIFhhRMF1Xu1bPFFBCDh6fV8yYkg3iinL37UfRCLsCAwEAAaNy
      MHAwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUH
      AwIwHQYDVR0OBBYEFA8A76+NU66xZK5vsVIJK08dzrkyMB8GA1UdIwQYMBaAFIQW
      zC1cIRNn5RtjxLj7qCkroHWiMA0GCSqGSIb3DQEBCwUAA4ICAQArjOY3/tXnhacx
      LyNhq9t5VYGtXpMo5LE/KJTFytrPPTsC5EHz6zQsdEnGx6h80tP+TIbMTgVujMvV
      PkTwVMbnFYy42RCcpZMchW7C5O/fL3m5av1MIjJl4Y56sWwtZQMTJ4xwc/rpchnR
      +uY503EJ1fu70AIqVhRsuXvtkesIWlREX4ikf8szzQw2+7zPB3NH/zlEeF+H+PDe
      Kuopzm+1jfr2XbepgfT9XDMWRsRSoUPz05qPC1YZ/9s1kN5mqdVrUrivdFZQzUUC
      MhPRu2AAFPBCNQoowbTTcCwljLURNBL+hYJ4xWb+JNDSRNm6u80JCzvv5NUf/OMI
      0tAcAX/7/vR8jtkfP+yXuk8lbDP14OgTiYjBhfLuHFiUTnag7+IaKSnHknesCOmz
      9wv213yxXOAak2cfpvV0g+W7G/U+Ba97h60m/74gP+6Lla3zyskQddNWBW4xL+JE
      /VFLTi6KNBcG4OQcZcgzJ54KTqYBuGf/GsirnhV9Cn6RfFkZ2w5r9hhMG0FWRSJ2
      1SpLHsH/ImiMaM0KwLygA/YyB8a0cXIVzzmL/isrVk4m1wVT4S8jUZOHfT62xCGa
      evyQBVQB6W3O/ROV5QXEfeGUu+QbaDS+togkTVHlm6EbPrSXq9rn5lN56PaxV6OD
      +nRIblOgixbWjBVFwXy4/kp5JZsuyA==
      -----END CERTIFICATE-----
    private-key: |-
      -----BEGIN PRIVATE KEY-----
      MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCnW2SgS1X1h7x5
      DInq9FofYrwTNaLKmgxYQM0B0ENMAvuTT9UrCGp9GwJGzIZ6vCTE/95ssJd8yDJN
      IszEm9lEYiN4ZvYFi0ZfXA9f6Jo4EzHuISdrEVBwr6X8G46cbGP3E+TvpT5jEbUv
      66CMbZotry1tfv/dB/Tg0LUsmgznFZDTvNlMacJcRs1vYXUE2DBiSNjXhVAW5ACU
      95qp/j9t3hyvbyiq/JMuPuE4bnz5m/0BXcINkqDXmgdDZzseMACV4nuSV/LHY4AP
      wdFCNedqvqTQIRwQzgSQBxabYSubKAPwiBYYUTBdV7tWzxRQQg4en1fMmJIN4opy
      9+1H0Qi7AgMBAAECggEAF+EDd5eoOTNX4hG28A5TeZz15uvFQZE/Z6w/VB3qLENU
      sA05Bj3aK+WZqo5uNb74pB86FloQE17hRn5Lp1XxZz91fi16twnLTbnt+6pNruiW
      PDsAy9cZmiqFzXYFIC6bCNsO1F7IiwwwxRiivMa6tAAFxFTVny0OdLFy2F1Wr/X5
      XnwpDrsmpIbn6Ps74qJTXL5fjOaYYEdrJBJtTI3jCK0lDfRw0+24jdXcPbXfGMV1
      GalmxmApYWGEQEfTdEDV6bNRSPklIdQ8Nmb3BNcp56q9dyTs1IYpkoSVuXrpHwi/
      6xf9jn3NvjiioSyO3L7vJUTmkE95kSPGESRjyKWrgQKBgQDmdrPfZboy5fbqzxML
      a/94Ftj6TO1LUETeZXNJGW7LTOo7BK5yqm60kTc7M0zhNajXt3aD6+A2C271Z+JH
      oKy+0kc7/0LLyGXY6Ua7L6tuCRgWtR2Wxz9TA5KhxPwIEru2hlJtWVfqQx8gHHrX
      09LfyOA9Kc67SFLhqyRbDlIRQQKBgQC55p26AbpyNIm/bDtVpJzf2ijDilfsDt/e
      ORxN3o04Uo3wF4HOHGifvbvXF0dryKS2/AezF1mrHjgcdTXW7yVLmuQSJgd9Crmz
      4/NQOdlTfyUkPiehnCc78mbQ7lwWh8wDSG3fioKP08w505s5I0YXakAbnZz4yMFC
      o+VJNbSe+wKBgA7SfZkVmtchMTNC5C+s335iwcu/XNemLve6wKJn71dF+B6Zm3qm
      eX5FhK7bCsvFPrm5A/dSGVaAf79q0gPXUqTnM0upjCs9FUfRIQpy82ydSx5Swbdr
      0yfMqAade7QtOENx+iUsRNo9POg8zK3K4tofukRUxwYGjcYT0r/EeQTBAoGBAKGM
      f1S9W8ETVwE6lPV/77O4aeRDvNQuuOzsxGQHGsHvO9mBFBSBK4pl326zlCVeX4WE
      z0wa5pmF0U0prnfxqn9hQwFieu92+poRZcg5/VpKC4TLXrVadd3qcN7vxKbvq6LO
      tmykeYFzlO5LrYCh3q9KbhuRhG/OReQbeY19VlExAoGAehazCcW0M5SNFs2ft1UH
      0PR9gq0hkqCqD/LpMM3bX+2SHC7qszb0XVbtbGvrjwv8FPn1vZpNvBr+Lfx/hbvQ
      Qo+0SUE9FlemgI1GP/yx/v4w/W61fufEDtrDB5qE/bQdDhnexc8GGwwZ7XR8dCrC
      tvjyw/wlpiPgKFJPvnxNmUY=
      -----END PRIVATE KEY-----

- name: oci-any4
  <<: *any_default
  server: 150.136.246.56

- name: oci-any6
  <<: *any_default
  server: "2603:c020:4000:3e:0:a17a:7ee5:a701"

- name: jp-any4
  <<: *any_default
  server: 178.239.124.93

- name: la-any4-hot
  <<: *any_default
  server: 69.63.202.38
  min-idle-session: 1   # 或者 0
  idle-session-check-interval: 30
  idle-session-timeout: 60

- name: la-any4-warp
  <<: *any_default
  server: 69.63.202.38
  port: 9443

- name: la-any6
  <<: *any_default
  server: "2605:52c0:1:f46:90d7:adff:fed4:21fe"

- name: la-reality4
  <<: *reality_default
  server: 69.63.202.38
  port: 443

- name: oci-reality
  <<: *reality_default
  server: 150.136.246.56
  port: 9443

geox-url:
  geosite: "https://soyoy.online/geosite.dat"
  mmdb: "https://soyoy.online/Country.mmdb"
  asn: "https://soyoy.online/GeoLite2-ASN.mmdb"
  # geosite: "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat"
  # mmdb: "https://cdn.jsdelivr.net/gh/Loyalsoldier/geoip@release/Country.mmdb"
  # asn: "https://cdn.jsdelivr.net/gh/Loyalsoldier/geoip@release/GeoLite2-ASN.mmdb"

proxy-groups:
  - name: social
    type: select
    proxies:
      - REJECT
      - final

  - name: final
    type: select
    proxies:  [us, DIRECT]

  - name: cn
    type: select
    proxies:  [DIRECT, jp, la]

  - name: us
    type: select
    proxies: [la, oci]

  - name: cdn
    type: select
    proxies: [la, oci, jp]

  - name: speedtest
    type: select
    proxies:
      - final
      - la-any4
      - la-any6
      - DIRECT

  - name: la
    type: select
    proxies: [la-any4, la-reality4, la-any6]

  - name: ai
    type: select
    proxies: [DIRECT, us]

  - name: oci
    type: select
    proxies: [oci-any4]

  - name: jp
    type: select
    proxies: [jp-any4]


rule-providers:
  skk-non-ip-reject-drop:
    <<: &download
      type: http
      interval: 86400
      proxy: cdn
    url: "https://ruleset.skk.moe/Clash/non_ip/reject-drop.txt"
    behavior: classical
    format: text

  skk-non-ip-domestic:
    <<: *download
    url: "https://ruleset.skk.moe/Clash/non_ip/domestic.txt"
    behavior: classical
    format: text

  AWAvenue-Ads-Rule:
    <<: *download
    behavior: domain
    path: ./rule_providers/AWAvenue-Ads-Rule-Clash.mrs
    url: "https://gcore.jsdelivr.net/gh/TG-Twilight/AWAvenue-Ads-Rule@main/Filters/AWAvenue-Ads-Rule-Clash.mrs"
    format: mrs


rules:
  - GEOSITE,nodeseek,social
  - DOMAIN-SUFFIX,v2ex.com,social
  - DOMAIN-SUFFIX,soyoy.com,la
  - DOMAIN-SUFFIX,tradingview.com,DIRECT
  # Direct
  # Apple 推送守护进程（更稳更准）
  # LocalSend 发现/传输端口
  - DST-PORT,53317,DIRECT
  # 发现用的组播（LocalSend 常见是 224.0.0.167）
  - IP-CIDR,224.0.0.0/4,DIRECT,no-resolve

  # Wi-Fi Calling（IPsec/IKE）直连
  - DST-PORT,500,DIRECT
  - DST-PORT,4500,DIRECT
  - DOMAIN-SUFFIX,3gppnetwork.org,DIRECT
  - DOMAIN-KEYWORD,epdg,DIRECT

  - GEOSITE,connectivity-check,DIRECT
  - GEOSITE,private,DIRECT

  # ads 
  - GEOSITE,category-ads-all,REJECT
  - DOMAIN,umami.diygod.dev,REJECT-DROP
  - RULE-SET,AWAvenue-Ads-Rule,REJECT
  - RULE-SET,skk-non-ip-reject-drop,REJECT-DROP

  - PROCESS-NAME,apsd,DIRECT
  - PROCESS-NAME,aria2c,oci
  # dns
  # TCP/UDP 853 (DNS over TLS)
  - DST-PORT,853,REJECT

  # STUN 常见端口（近似替代，不如协议识别精确）
  - AND,(NETWORK,UDP),(DST-PORT,3478),REJECT
  - AND,(NETWORK,UDP),(DST-PORT,5349),REJECT

  - IN-PORT,7891,la
  # quic
  - AND,(NETWORK,UDP),(DST-PORT,443),REJECT

  ### AI

  # by services
  - GEOSITE,category-ai-!cn,ai
  - GEOSITE,google,us
  # us
  - GEOSITE,category-porn,la
  - GEOSITE,wsj,us
  - GEOSITE,bloomberg,us
  - GEOSITE,economist,us
  - GEOSITE,ft,us
  - GEOSITE,bbc,us
  - GEOSITE,reuters,us
  # cn
  - GEOSITE,category-media-cn,cn
  - DOMAIN-SUFFIX,caixin.com,cn

  # cdn
  - GEOSITE,piratebay,cdn
  - GEOSITE,imgur,cdn
  - DOMAIN-SUFFIX,1lib.sk,cdn
  - GEOSITE,category-ru,cdn
  - GEOSITE,z-library,jp

  # download
  - GEOSITE,dropbox,cdn
  - GEOSITE,cn,cn
  - GEOSITE,geolocation-cn,cn
  # - NOT,((GEOSITE,geolocation-!cn)),cn
  # cn
  - RULE-SET,skk-non-ip-domestic,cn

  # ip
  - GEOIP,private,DIRECT,no-resolve
  - GEOIP,google,us
  - GEOIP,cn,cn
  - GEOIP,jp,jp

  # - PROCESS-NAME-REGEX,mtr$,oci

  - GEOSITE,category-speedtest,speedtest
  - MATCH,final