mixed-port: 7890
allow-lan: true
bind-address: '*'
mode: rule
log-level: info
ipv6: false

external-controller: 0.0.0.0:9090

tun:
  enable: true
  stack: gvisor
  mtu: 1500
  auto-route: true
  auto-detect-interface: true
  route-exclude-address:
    - 103.119.13.48/32
  dns-hijack:
    - any:53

dns:
  enable: true
  listen: 0.0.0.0:53
  enhanced-mode: fake-ip
  fake-ip-persist: true
  fake-ip-range: 198.18.0.0/15
  fake-ip-filter:
    - '*.lan'
    - '*.local'
    - 'time.*.com'
    - 'ntp.*.com'
    - '+.pool.ntp.org'
    # Tailscale 控制面/DERP 必须解析为真实 IP，否则 fake-ip 会导致 tailscaled
    # 连不上控制服务器、tailscale up 卡住不打印登录 URL。详见 docs/public-access.md
    - '+.tailscale.com'
    - '+.tailscale.io'
    - '+.tailscale-dns.com'
  nameserver:
    - 114.114.114.114
    - 223.5.5.5
  fallback:
    - 8.8.8.8
    - 1.1.1.1
  fallback-filter:
    geoip: true
    geoip-code: CN

proxies:
  # 上游 = pangolin1（103.119.13.48，sing-box VLESS Reality :443，伪装 www.apple.com）
  # 2026-07-05 由 ec2-sg 切换而来（ec2 已于 2026-07-04 退役，EIP 已释放）
  - name: "pangolin1-us"
    type: vless
    server: 103.119.13.48
    port: 443
    uuid: <VLESS_UUID>
    network: tcp
    flow: xtls-rprx-vision
    tls: true
    udp: true
    reality-opts:
      public-key: TAPOvsNOTm9faWdqXz4vkpK_dVQJWjwWqS_PKK6ytBg
      short-id: 69ddbef9f69d07d3
    servername: www.apple.com
    client-fingerprint: chrome

proxy-groups:
  - name: "Proxy"
    type: select
    proxies:
      - pangolin1-us
      - DIRECT

rules:
  - GEOIP,private,DIRECT
  - GEOSITE,cn,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,Proxy