ferry/example.yaml at main · airdb/ferry · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
global:
  log_level: info
  log_backups: 2
  log_maxsize: 1073741824
  log_localtime: true
  max_idle_conns: 100
  dial_timeout: 30
  dns_cache_duration: 15m
  dns_server: https://1.1.1.1/dns-query
dialer:
  torsocks: socks5h://127.0.0.1:9050
  sshtun: ssh://phuslu:123456@phus.lu:22/?timeout=8&max_clients=4&key=/home/phuslu/.ssh/id_rsa
  proxyws: wss://phuslu:123456@www.phus.lu:443/wss/connect?h=%s&p=%d
  proxy1: https://user:passwd@proxy1.example.org:443/?user_agent=liner-1984
  proxy2: http2://foobar:123456@proxy2.example.com:443/?user_agent=liner-1984&max_clients=8
  proxy3: http3://foobar:123456@proxy3.example.com:443/?user_agent=liner-1984
https:
  - listen: [':443']
    server_name: ['example.org']
    server_config:
      example.org:
        keyfile: example_org.pem
    web:
      - location: /
        index: /var/www/example.org
  - listen: [':443']
    server_name: ['ip.example.org']
    server_config:
      example_org.pem:
        keyfile: example_org.pem
    web:
      - location: /
        index:
          headers: |
            content-type: application/json
          body: |
            {"ip":"{{host .Request.RemoteAddr}}","country":"{{country .Request.RemoteAddr}}"}
  - listen: [':443']
    server_name: ['demo.example.org']
    server_config:
      demo.example.org:
        keyfile: /path/to/demo.example.org.key
        certfile: /path/to/fullchain.cer
        prefer_chacha20: true
    forward:
      prefer_ipv6: false
      policy: |
        {{if regexMatch `^(153.3.130.101|153.3.130.102):` .Request.RemoteAddr}}
          bypass_auth
        {{else if contains " YaBrowser/" .Request.UserAgent}}
          bypass_auth
        {{else if contains "ip.phus.lu" .Request.Host}}
          allow_ip
        {{else if .Request.Header.Get "proxy-authorization"}}
          verify_auth
        {{else if all (.Request.ProtoAtLeast 2 0) (eq .Request.TLS.Version 0x0304) (greased .ClientHelloInfo)}}
          require_proxy_auth
        {{else if contains " Chrome/68.0.3440" .Request.UserAgent}}
          require_proxy_auth
        {{else}}
          proxy_pass
        {{end}}
      auth_table: authuser.csv
      dialer: |
        {{if hasSuffix ".onion" .Request.Host}}torsocks{{end}}
      deny_domains_table: deny_domains.csv
      speed_limit: 10000000
    web:
      - location: /dns-query
        proxy:
          pass: https://1.1.1.1
          set_headers: "Host: 1.1.1.1"
      - location: /china.pac
        index:
          file: /home/phuslu/liner/china.pac
      - location: /
        proxy:
          pass: 'http://127.0.0.1:80'
  - listen: [':443']
    server_name: ['fly.example.org']
    prefer_chacha20: true
    forward:
      policy: |
        {{if regexMatch `^(git|curl|node|yarn|Go-http-client|Docker-Client|Homebrew)/` .Request.UserAgent}}
            bypass_auth
        {{else}}
            proxy_pass
        {{end}}
http:
  - listen: [':123']
    server_name: ['127.0.0.1', '192.168.50.7']
    forward:
      policy: |
        {{if regexMatch `^192\.168\.` .Request.RemoteAddr}}
          bypass_auth
        {{else if regexMatch `\.google|ggpht\.com|gstatic\.com|github` .Request.Host}}
          bypass_auth
        {{else if contains " YaBrowser/" .Request.UserAgent}}
          bypass_auth
        {{else if contains "ip.phus.lu" .Request.Host}}
          allow_ip
        {{else if .Request.Header.Get "proxy-authorization"}}
          verify_auth
        {{else if hasPrefix "Mozilla/" .Request.UserAgent}}
          require_proxy_auth
        {{else}}
          bypass_auth
        {{end}}
      auth_table: authuser.csv
      dialer: |
        {{if hasPrefix "scholar.google.com" .Request.Host}}
          proxy1
        {{else if eq (geosite .Request.Host) "openai"}}
          proxy1
        {{else if ne (country .Request.Host) "CN"}}
          proxy2
        {{end}}
    web:
      - location: /
        index:
          root: 'C:/Users/phuslu/Desktop'
socks:
  - listen: [':1081']
    server_name: ['127.0.0.1']
    forward:
      policy: |
        {{if not (regexMatch `^(149\.154\.|91\.108\.)` .Request.Host)}}
          reject
        {{end}}
      auth_table: authuser.csv
      deny_domains:
        - facebook.com
        - nytimes.com
  - listen: [':1082']
    server_name: ['127.0.0.1']
    forward:
      policy: |
        {{if eq (city .Request.RemoteAddr) "Nanjing"}}
          bypass_auth
        {{else if not .Request.Host}}
          bypass_auth
        {{else if regexMatch `^(149|91)\.` .Request.Host}}
          bypass_auth
        {{else}}
          reject
        {{end}}
stream:
  - listen: [':853']
    keyfile: certs/example.org+rsa
    proxy_pass: tcp4://1.1.1.1:53
  - listen: [':2375']
    proxy_pass: unix:///var/run/docker.sock
  - listen: [':443']
    proxy_pass: github.com:443
    dialer: proxy1