# ============================================================================
# NeTube configuration file
# ============================================================================
#
# NeTube is a proxy aggregation service. It fetches nodes from subscriptions,
# automatically selects the best node according to configurable policies, and
# exposes unified SOCKS5 and Shadowsocks proxy ports.
#
# The default configuration directory is ~/.netube. The entire singbox section is
# optional, as are bin and workDir individually. Relative paths are resolved from
# the directory containing this configuration file.


# ─── Server (optional) ────────────────────────────────────────────────────────
# When omitted, defaults to host: 0.0.0.0 and apiPort: 9090 with no management password.
server:
  host: "0.0.0.0"                # API listen address (default: 0.0.0.0)
  apiPort: 9090                  # API and web UI port (default: 9090)
  # password: "my-secret"       # Web UI and API management password (optional)
                                 # Subscription URLs (/api/subscribe/*) remain public


# ─── sing-box (optional) ──────────────────────────────────────────────────────
# When bin is omitted, NeTube checks ~/.netube/sing-box and then sing-box in PATH.
# An explicitly configured bin is used as-is, without falling back to either location.
# A bin without a path separator, such as sing-box, is resolved as a command from PATH.
# workDir defaults to ~/.netube/singbox and stores generated server.json/client.json files.
singbox:
  bin: "~/.netube/sing-box"
  workDir: "~/.netube/singbox"


# Log level (optional; default: info).
# Available values: trace | debug | info | warn | error | fatal | silent.
# The LOG_LEVEL environment variable takes precedence over this setting.
logLevel: info

# ─── Endpoints ────────────────────────────────────────────────────────────────
# Public proxy ports. Each endpoint is bound to a policy, and ports must be unique.
#
# Common fields:
#   name      - Unique endpoint name
#   protocol  - mixed | socks5 | shadowsocks
#   listen    - Listen address (default: 0.0.0.0)
#   port      - Listen port
#   policy    - Policy name, or "direct" for a direct connection (see below)
#
# The endpoints lists under subscriptions.groups control which endpoints appear in subscriptions.
#
# Direct endpoints: with policy set to "direct", traffic bypasses backend nodes and
# exits directly from the machine running NeTube. This effectively uses the NeTube
# machine itself as a SOCKS5 or Shadowsocks proxy server.
endpoints:

  # Mixed proxy accepting HTTP/HTTPS CONNECT and SOCKS4/4a/5 on the same port
  - name: "local-mixed"
    protocol: mixed
    listen: "127.0.0.1"
    port: 1080
    policy: "google"

  # Publicly accessible SOCKS5 proxy with authentication
  - name: "public-socks5"
    protocol: socks5
    listen: "0.0.0.0"
    port: 1081
    auth:                        # SOCKS5 authentication (optional)
      username: "user"
      password: "pass"
    policy: "google"

  # Shadowsocks proxy for use by other devices through subscriptions
  - name: "ss-google"
    protocol: shadowsocks
    listen: "0.0.0.0"
    port: 8388
    method: "aes-256-gcm"        # Encryption method
    password: "my-secret"        # Connection password
    policy: "google"

  # Endpoint using a different policy optimized for YouTube
  - name: "ss-youtube"
    protocol: shadowsocks
    listen: "0.0.0.0"
    port: 8389
    method: "aes-256-gcm"
    password: "my-secret"
    policy: "youtube"

  # Direct endpoint using the NeTube machine as the proxy exit
  - name: "ss-direct"
    protocol: shadowsocks
    listen: "0.0.0.0"
    port: 8390
    method: "aes-256-gcm"
    password: "my-secret"
    policy: "direct"             # Traffic exits locally without a backend node


# ─── Policies (optional) ──────────────────────────────────────────────────────
# Each policy defines its subscription backends, speed-test target, and selection strategy.
# Health data is isolated per policy, so the same node can have different latency per policy.
# Without healthCheck, NeTube does not test or switch automatically. It initially uses
# the first node and preserves manual selections made through the web UI or API.
#
# healthCheck fields (optional):
#   target            - Speed-test URL
#   interval          - Automatic test interval in seconds (default: 300; minimum: 10)
#   timeout           - Timeout for one test in seconds (default: 10; minimum: 1)
#   failThreshold     - Consecutive failures before marking unhealthy (default: 3)
#   recoveryThreshold - Consecutive successes before marking healthy (default: 2)
#   strategy          - Selection strategy (default: first-available)
#
# Available strategies:
#   lowest-latency  - Select the healthy node with the lowest latency; manual choices last until the next test
#   first-available - Select the first healthy node; switch only when the current node is unavailable
#   round-robin     - Rotate through all healthy nodes
policies:

  - name: "google"
    backends:
      - "my-subscription"
    healthCheck:
      target: "https://www.google.com/generate_204"
      interval: 300
      timeout: 10
      strategy: "lowest-latency"

  - name: "youtube"
    backends:
      - "my-subscription"
    healthCheck:
      target: "https://www.youtube.com/generate_204"
      interval: 600
      timeout: 15
      strategy: "first-available"

  # No healthCheck: disable automatic tests and switching; select nodes manually
  - name: "manual"
    backends:
      - "my-subscription"


# ─── Backends (optional) ──────────────────────────────────────────────────────
# Define subscription URLs that NeTube periodically fetches and parses.
# Supported formats: clash (YAML) and shadowrocket (Base64 URI list)
backends:

  # Remote subscription: periodically fetch a node list from a URL
  - name: "my-subscription"
    type: "clash"                # clash | shadowrocket
    url: "https://example.com/clash-subscription"
    updateInterval: 3600         # Automatic refresh interval in seconds (default: 3600; minimum: 60)

  # Manual configuration: inline Base64 content in the subscription response format
  # Use content instead of url; updateInterval is not needed
  # - name: "my-manual-nodes"
  #   type: "shadowrocket"
  #   content: "c3M6Ly9ZV1Z6..."   # Shadowrocket Base64 text


# ─── Subscription URLs (optional) ─────────────────────────────────────────────
# Control subscription URLs generated by NeTube under /api/subscribe/....
# Each subscription group defines endpoints and their formats (Clash/Shadowrocket).
# An endpoint can appear in multiple groups. Endpoints in no group are not exported.
# Each group can have its own access password, independent of the management password,
# supplied through ?password=xxx.
#
# Subscription URL formats:
#   Clash:        /api/subscribe/clash/<group-name>
#   Shadowrocket: /api/subscribe/shadowrocket/<group-name>
subscriptions:
  # host: "example.com"         # Server address in subscription URLs (optional)
                                 # Defaults to server.host; 0.0.0.0 falls back to 127.0.0.1
                                 # Set this to a public IP or domain for public deployments

  groups:

    # --- Main subscription group ---
    # Includes every public endpoint in both Clash and Shadowrocket formats
    - name: "main"
      endpoints: ["public-socks5", "ss-google", "ss-youtube", "ss-direct"]

      # Clash subscription: generate a complete Clash configuration with nodes and routing rules.
      # Routing-rule toggles can be changed in the web UI or temporarily overridden with
      # URL parameters (?cnDirect=0&adBlock=0&private=0).
      # Matching order: private → adBlock → cnDirect → MATCH (use proxy)
      clash:
        # password: "my-clash-secret"  # Subscription password (optional)
        cnDirect: true               # Direct access to Chinese domains/IPs (default: true)
        adBlock: true                # Block advertising domains (default: true)
        private: true                # Direct access to LAN/private addresses (default: true)

        # Custom rules (optional; ACL4SSR defaults are shown below)
        # Rules are grouped by toggle. Each group can contain any number of rule providers.
        # rules:
        #   private:
        #     - provider: "private"
        #       behavior: classical
        #       url: "https://cdn.jsdelivr.net/gh/ACL4SSR/ACL4SSR@master/Clash/LocalAreaNetwork.list"
        #       target: DIRECT
        #   adBlock:
        #     - provider: "ad-block"
        #       behavior: classical
        #       url: "https://cdn.jsdelivr.net/gh/ACL4SSR/ACL4SSR@master/Clash/BanAD.list"
        #       target: REJECT
        #   cnDirect:
        #     - provider: "cn-domain"
        #       behavior: classical
        #       url: "https://cdn.jsdelivr.net/gh/ACL4SSR/ACL4SSR@master/Clash/ChinaDomain.list"
        #       target: DIRECT
        #     - provider: "cn-cidr"
        #       behavior: classical
        #       url: "https://cdn.jsdelivr.net/gh/ACL4SSR/ACL4SSR@master/Clash/ChinaIp.list"
        #       target: DIRECT
        #       noResolve: true
        #     - provider: "cn-company-ip"
        #       behavior: classical
        #       url: "https://cdn.jsdelivr.net/gh/ACL4SSR/ACL4SSR@master/Clash/ChinaCompanyIp.list"
        #       target: DIRECT
        #       noResolve: true

        # Additional custom rules (optional; inserted after built-in rules and before MATCH)
        # extraRuleProviders:
        #   - name: "my-custom-rules"
        #     url: "https://example.com/my-rules.txt"
        #     behavior: "domain"        # domain | ipcidr | classical
        #     policy: "DIRECT"          # DIRECT | REJECT | NeTube

      # Shadowrocket subscription: generate a Base64-encoded list of node URIs.
      # Only node information is exported; routing rules must be configured in the client.
      shadowrocket: {}
      # To enable password protection:
      # shadowrocket:
      #   password: "my-sr-secret"

    # --- Optional additional subscription groups ---
    # Example: a group containing only video-related endpoints
    # - name: "video"
    #   endpoints: ["ss-youtube"]
    #   clash:
    #     password: "video-secret"
    #     cnDirect: false
    #     adBlock: false
    #     private: false