# SPDX-License-Identifier: GPL-2.0
# Copyright (c) 2026 honeok <i@honeok.com>

---
mode: rule
geox-url:
  geoip: "https://cdn.jsdelivr.net/gh/honeokX/clash-rules@release/geoip.dat"
  geosite: "https://cdn.jsdelivr.net/gh/honeokX/clash-rules@release/geosite.dat"

geodata-mode: true
geodata-loader: standard # geo 文件加载模式 standard: 标准加载器 memconservative: 专为内存受限设备优化的加载器 (默认值)
geo-auto-update: true # 是否自动更新 geodata
geo-update-interval: 24 # 更新间隔 单位: 小时

log-level: warning # 日志等级 silent/error/warning/info/debug
ipv6: true # IPv6 总开关, 关闭阻断所有 IPv6 链接和屏蔽 DNS 请求 AAAA 记录

profile:
  store-selected: false
  store-fake-ip: false

proxies:
  - name: "DIRECT-V4-PREFER"
    type: direct
    ip-version: ipv4-prefer

listeners:
  # Socks5
  - name: "Socks5-IN"
    type: socks
    port: 10808
    listen: "::"
    # proxy: proxy # 如果不为空则直接将该入站流量交由指定 proxy 处理
    udp: false # 默认值: true
    # 如果不填写users项, 则遵从全局 authentication 设置, 如果填写会忽略全局设置, 如想跳过该入站的验证可填写 users: []
    users:
      - username: "openssl rand -hex 8"
        password: "openssl rand -base64 32 | tr '/+' '_-'"

  # Shadowsocks
  # cipher 支持:
  # aes-128-gcm aes-192-gcm aes-256-gcm
  # aes-128-cfb aes-192-cfb aes-256-cfb
  # aes-128-ctr aes-192-ctr aes-256-ctr
  # rc4-md5 chacha20-ietf xchacha20
  # chacha20-ietf-poly1305 xchacha20-ietf-poly1305
  # 2022-blake3-aes-128-gcm 2022-blake3-aes-256-gcm 2022-blake3-chacha20-poly1305
  - name: "Shadowsocks-IN"
    type: shadowsocks
    port: 10813
    listen: "::"
    # proxy: proxy # 如果不为空则直接将该入站流量交由指定 proxy 处理
    password: "openssl rand -base64 32 | tr '/+' '_-'"
    cipher: chacha20-ietf-poly1305

  # VLESS + REALITY + Vision
  - name: "VLESS-REALITY-IN"
    type: vless
    port: 10817
    listen: "::"
    # proxy: proxy # 如果不为空则直接将该入站流量交由指定 proxy 处理
    users:
      - uuid: "./mihomo generate uuid"
        flow: xtls-rprx-vision
    reality-config:
      dest: www.example.com:443
      private-key: "./mihomo generate reality-keypair"
      short-id: ["openssl rand -hex 8"]
      server-names: ["www.example.com"]

  # VLESS + XHTTP + Encryption + Vision
  - name: "VLESS-XHTTP-Encryption-Vision-IN"
    type: vless
    port: 10818
    listen: "::"
    # proxy: proxy # 如果不为空则直接将该入站流量交由指定 proxy 处理
    users:
      - uuid: "./mihomo generate uuid"
        flow: xtls-rprx-vision
    # 如果不为空则开启 XHTTP 传输层
    xhttp-config:
      path: "/apis/networking.k8s.io/v1/namespaces/default/ingresses"
      host: "www.example.com"
      mode: "auto" # Available: "stream-one" "stream-up" or "packet-up"
      x-padding-obfs-mode: true
      x-padding-key: "_dc"
      x-padding-header: "X-Cache"
      x-padding-placement: "queryInHeader" # Available: queryInHeader cookie header query
      x-padding-method: "tokenish" # Available: repeat-x tokenish
    # vless encryption 服务端配置:
    # 使用 ./mihomo generate vless-x25519 生成传统 X25519 认证 或 ./mihomo generate vless-mlkem768 生成 ML-KEM-768 后量子认证
    decryption: "mlkem768x25519plus.native/xorpub/random.600s(300-600s)/0s.(padding len).(padding gap).(X25519 PrivateKey).(ML-KEM-768 Seed)..."
    # 下面两项如果填写则开启 tls, 需要同时填写
    certificate: ./certificate.crt # 证书 PEM 格式, 或证书的路径
    private-key: ./private.key # 证书对应的私钥 PEM 格式, 或私钥路径

rules:
  - GEOSITE,category-ads-all,REJECT
  - GEOSITE,meituan,REJECT
  - DOMAIN-SUFFIX,ping0.cc,REJECT
  - GEOIP,private,REJECT
  - GEOIP,CN,REJECT
  - MATCH,DIRECT-V4-PREFER