Skip to content

Trojan

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
listeners:
- name: trojan-in-1
  type: trojan
  port: 10819 # supports ports format, e.g., 200,302 or 200,204,401-429,501-503
  listen: 0.0.0.0
  # routing-mark: 0 # set routing-mark for listening socket (Linux only)
  # rule: sub-rule-name1 # uses rules by default; if sub-rule is not found, uses rules directly
  # proxy: proxy # if not empty, directly hands over inbound traffic to the specified proxy (if proxy is not empty, the proxy name here must be valid, otherwise an error will occur)
  users:
    - username: 1
      password: 9d0cb9d0-964f-4ef6-897d-6c6b3ccf9e68
  # ws-path: "/" # if not empty, enables websocket transport layer
  # grpc-service-name: "GunService" # if not empty, enables grpc transport layer
  # if the following two options are filled, enables tls (must be filled together)
  certificate: ./server.crt # certificate in PEM format, or the path to the certificate
  private-key: ./server.key # corresponding private key in PEM format, or the path to the private key
  # the following two options are for mTLS configuration. If client-auth-type is set to "verify-if-given" or "require-and-verify", client-auth-cert must not be empty
  # client-auth-type: "" # available values: "", "request", "require-any", "verify-if-given", "require-and-verify"
  # client-auth-cert: string # certificate in PEM format, or the path to the certificate
  # if filled, enables ECH (can be generated by `mihomo generate ech-keypair <plaintext-domain>`)
  # ech-key: |
  #   -----BEGIN ECH KEYS-----
  #   ACATwY30o/RKgD6hgeQxwrSiApLaCgU+HKh7B6SUrAHaDwBD/g0APwAAIAAgHjzK
  #   madSJjYQIf9o1N5GXjkW4DEEeb17qMxHdwMdNnwADAABAAEAAQACAAEAAwAIdGVz
  #   dC5jb20AAA==
  #   -----END ECH KEYS-----
  # shadow-tls:
  #   enable: true
  #   version: 3 # supports v1/v2/v3
  #   # password: shadow-tls-password # v2 configuration item
  #   users: # v3 configuration item
  #     - name: shadow-tls-user
  #       password: shadow-tls-password
  #   handshake:
  #     dest: www.example.com:443
  #     # proxy: ""
  # res-tls:
  #   enable: true
  #   dest: www.example.com:443
  #   password: restls-password
  #   # restls-script: ""
  #   # min-record-len: 0
  #   # proxy: ""
  #   # rate-limit: 0 # Bidirectional forwarding rate limit for fallback, in bit/s; 0 means unlimited.
  # jls-config: # JLS replaces standard TLS; unauthenticated connections fall back to dest
  #   enable: true
  #   users:
  #     - username: jls-user
  #       password: jls-password
  #   dest: www.example.com:443
  #   # sni: www.example.com # inferred from dest when empty
  #   # alpn: [h2, http/1.1]
  #   # proxy: ""
  #   # rate-limit: 0 # fallback forwarding rate limit in bit/s; 0 means unlimited
  # if reality-config is filled, enables reality (note: cannot be filled simultaneously with certificate and private-key)
  # reality-config:
  #   dest: test.com:443
  #   private-key: jNXHt1yRo0vDuchQlIP6Z0ZvjT3KtzVI-T4E7RoLJS0 # can be generated by `mihomo generate reality-keypair` command
  #   short-id:
  #     - 0123456789abcdef
  #   server-names:
  #     - test.com
  #   # max-time-difference: 0 # in microseconds
  #   # proxy: ""
  #   # the following two limits are optional, used to rate-limit fallback connections that fail verification, bytesPerSec defaults to 0 which means disabled
  #   # fallback rate limiting is a fingerprint feature and is not recommended; if you are a panel/one-click script developer, make sure to randomize these parameters
  #   limit-fallback-upload:
  #     after-bytes: 0 # starts rate limiting after transmitting specified bytes
  #     bytes-per-sec: 0 # baseline speed (bytes/second)
  #     burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec
  #   limit-fallback-download:
  #     after-bytes: 0 # starts rate limiting after transmitting specified bytes
  #     bytes-per-sec: 0 # baseline speed (bytes/second)
  #     burst-bytes-per-sec: 0 # burst speed (bytes/second), takes effect when greater than bytesPerSec
  # ss-option: # similar to the shadowsocks setting in trojan-go
  #   enabled: false
  #   method: aes-128-gcm # aes-128-gcm/aes-256-gcm/chacha20-ietf-poly1305
  #   password: "example"
  ### NOTE: For trojan listener, if "allow-insecure" is not true, at least one of "certificate and private-key" or "shadow-tls" or "res-tls" or "jls-config" or "reality-config" or "ss-option" must be filled in ###
  # allow-insecure: false # whether to allow disabling TLS encryption (NOTE: only used when upstreamed by nginx, caddy, etc.)
  # mux-option:
  #   padding: true
  #   brutal:
  #     enabled: true
  #     up: 1000 # default Mbps
  #     down: 1000