Proxy Providers ¶

proxy-providers:
  provider1:
    type: http
    url: "http://test.com"
    path: ./proxy_providers/provider1.yaml
    interval: 3600
    proxy: DIRECT
    size-limit: 0
    age-secret-key: AGE-SECRET-KEY-1ZTQLLN0A4U3ZTT3DCZKYN0CGZEZQLWX2DFTXUWMT4ZHR0N2UG6LSW9NT0N
    header:
      User-Agent:
      - "mihomo/1.18.3"
      Authorization:
      - 'token 1231231'
      # X-Age-Public-Key:
      # - 'age1xh86kh9v23vattr58yedspm3f57sxvnswu9krr6ns438amekx5gsd09uma'
    health-check:
      enable: true
      url: https://www.gstatic.com/generate_204
      interval: 300
      timeout: 5000
      lazy: true
      expected-status: 204
    override:
      tfo: false
      mptcp: false
      udp: true
      udp-over-tcp: false
      down: "50 Mbps"
      up: "10 Mbps"
      skip-cert-verify: true
      dialer-proxy: proxy
      interface-name: tailscale0
      routing-mark: 233
      ip-version: ipv4-prefer
      additional-prefix: "provider1 prefix |"
      additional-suffix: "| provider1 suffix"
      proxy-name:
      - pattern: "IPLC-(.*?)倍"
        target: "iplc x $1"
    filter: "(?i)港|hk|hongkong|hong kong"
    exclude-filter: "xxx"
    exclude-type: "ss|http"
    payload:
      - name: "ss1"
        type: ss
        server: server
        port: 443
        cipher: chacha20-ietf-poly1305
        password: "password"

Name ¶

Required, such as provider1, must be unique. It is advisable not to duplicate names with policy groups.

Type ¶

Required, provider type, options are http / file / inline.

URL ¶

If the type is http, this must be configured.

Path ¶

Optional, the file path, must be unique. If not provided, the MD5 of the URL will be used as the filename.

For security reasons, this path is restricted to only allow locations within HomeDir (configured with the -d startup parameter). If you want to store it in other locations, please specify additional safe paths by setting the SAFE_PATHS environment variable. The syntax of this environment variable is the same as the PATH environment variable parsing rules of this operating system (that is, it is separated by semicolons in Windows and by colons in other systems).

Interval ¶

The update time for the provider, measured in seconds.

Proxy ¶

Download/update through the specified proxy.

size-limit ¶

The maximum size of downloadable files is restricted, with the default being 0, which means no size limit; the unit is bytes (b)

age-secret-key ¶

If set, age-secret-key will attempt to decrypt an age armor-formatted configuration file using this secret.

Note:

For encrypted content, currently only the official ASCII "armor" format from age-encryption.org/v1 is supported.
For key formats, currently only the x25519 recipient type and the mlkem768-x25519 hybrid post-quantum recipient type from age-encryption.org/v1 are supported.
Currently, the core does not proactively send the public key to the server. Users need to manually set X-Age-Public-Key in the header or upload the public key through other means.
The core also supports loading encrypted configuration files using the command-line argument -age-secret-key or the environment variable CLASH_AGE_SECRET_KEY.

Utilities:

You can generate a valid x25519 key using mihomo age keygen.
You can generate a valid mlkem768-x25519 key using mihomo age keygen-pq.
You can export an age-public key from age-secret-key using mihomo age convert <secret_key>.
You can decrypts an encrypted file using mihomo age decrypt <secret_key> <source_file> <target_file> . <source_file> is set to - and reads from standard input; <target_file> is set to - and writes to standard output.
You can encrypt an unencrypted file using mihomo age encrypt <public_key> <source_file> <target_file>. <source_file> is set to - and reads from standard input; <target_file> is set to - and writes to standard output.