Add new admin panel, failover, dns fallback, providers, limiters. Update XHTTP

examples/admin_panel-manager-node/client.json

@@ -0,0 +1,47 @@
+{
+  "log": {
+    "level": "error"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "vless",
+      "tag": "vless-out",
+      "server": "0.0.0.0",
+      "server_port": 443,
+      "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937",
+      "transport": {
+        "type": "http"
+      }
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "action": "hijack-dns"
+      }
+    ],
+    "final": "vless-out",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/admin_panel-manager-node/manager.json

@@ -0,0 +1,90 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "action": "hijack-dns"
+      }
+    ],
+    "final": "direct-out"
+  },
+  "services": [
+    {
+      "type": "manager",
+      "tag": "my-manager",
+      "database": {
+        "driver": "sqlite",
+        "dsn": "file:manager.db?_pragma=foreign_keys(on)&_pragma=journal_mode(wal)&_pragma=busy_timeout(5000)" // also supported Postgresql
+      }
+    },
+    {
+      "type": "manager-api",
+      "tag": "my-manager-api",
+      "api_type": "server",
+      "protocol_type": "http",
+      "listen": "0.0.0.0",
+      "listen_port": 8080,
+      "manager": "my-manager",
+      "api_key": "change-me-secret",
+      "cors": {
+        "allowed_origins": ["*"],
+        "max_age": 600
+      },
+      // Enable TLS for production deployments:
+      // "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#inbound
+      //   "enabled": true,
+      //   "server_name": "manager.example.com",
+      //   "certificate_path": "fullchain.pem",
+      //   "key_path": "privkey.pem"
+      // }
+    },
+    {
+      "type": "node-manager-api",
+      "tag": "my-node-manager-api",
+      "api_type": "server",
+      "listen": "0.0.0.0",
+      "listen_port": 7000,
+      "manager": "my-manager",
+      "api_key": "change-me-secret",
+      // Enable TLS for production deployments (the node connects via gRPC over h2):
+      // "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#inbound
+      //   "enabled": true,
+      //   "server_name": "example.com",
+      //   "alpn": "h2", // h3 for QUIC
+      //   "certificate_path": "fullchain.pem",
+      //   "key_path": "privkey.pem"
+      // }
+    },
+    {
+      "type": "admin-panel",
+      "tag": "admin",
+      "listen": "0.0.0.0",
+      "listen_port": 8081,
+      // Enable TLS for production deployments:
+      // "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#inbound
+      //   "enabled": true,
+      //   "server_name": "panel.example.com",
+      //   "certificate_path": "fullchain.pem",
+      //   "key_path": "privkey.pem"
+      // }
+    }
+  ]
+}

examples/admin_panel-manager-node/node.json

@@ -1,6 +1,6 @@
 {
   "log": {
-    "level": "error"
+    "level": "debug"
   },
   "dns": {
     "servers": [
@@ -33,13 +33,29 @@
       "route": {
         "final": "direct-out"
       }
+    },
+     {
+      "type": "rate-limiter",
+      "tag": "rate-limiter",
+      "strategy": "manager",
+      "route": {
+        "final": "bandwidth-limiter"
+      }
     },
     {
       "type": "connection-limiter",
       "tag": "connection-limiter",
       "strategy": "manager",
       "route": {
-        "final": "bandwidth-limiter"
+        "final": "rate-limiter"
+      }
+    },
+    {
+      "type": "traffic-limiter",
+      "tag": "traffic-limiter",
+      "strategy": "manager",
+      "route": {
+        "final": "connection-limiter"
       }
     },
   ],
@@ -59,19 +75,23 @@
       "uuid": "e6eceb84-ad66-474b-8641-142499db7c6e",
       "manager": "node-manager",
       "inbounds": ["vless-in"],
-      "bandwidth_limiters": ["bandwidth-limiter"],
       "connection_limiters": ["connection-limiter"],
+      "bandwidth_limiters": ["bandwidth-limiter"],
+      "traffic_limiters": ["traffic-limiter"],
+      "rate_limiters": ["rate-limiter"]
     },
     {
-      "type": "node-manager-client",
+      "type": "node-manager-api",
       "tag": "node-manager",
+      "api_type": "client",
       "server": "example.com",
       "server_port": 7000,
-      "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#outbound
-        "enabled": true,
-        "server_name": "example.com",
-        "alpn": "h2" // h3 for QUIC
-      },
+      "api_key": "change-me-secret",
+      // "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#outbound
+      //   "enabled": true,
+      //   "server_name": "example.com",
+      //   "alpn": "h2" // h3 for QUIC
+      // }
     }
   ]
 }

examples/amnezia/client.json

@@ -15,13 +15,15 @@
       "type": "wireguard",
       "tag": "wireguard-out",
       "mtu": 1408,
-      "address": null,
-      "private_key": "",
+      "address": ["10.0.0.2/32"],
+      "private_key": "QGg8AFRn6qKfTB7cT3FWH1WGx3np+OKzlNuQUrqIBmI=",
       "listen_port": 10000,
       "peers": [
         {
           "address": "example.com",
           "port": 10001,
+          "public_key": "3nk7jdnkcL95Fc/z+GCiH7jOovEKhFkLIGPT+U/uLEQ=",
+          "allowed_ips": ["0.0.0.0/0"],
           "reserved": "AAAA"
         }
       ],

examples/dns_fallback/client.json

@@ -0,0 +1,62 @@
+{
+  "log": {
+    "level": "debug"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "udp",
+        "tag": "dns-cloudflare",
+        "server": "1.2.3.4"
+      },
+      {
+        "type": "udp",
+        "tag": "dns-google",
+        "server": "1.2.3.4"
+      },
+      {
+        "type": "https",
+        "tag": "dns-quad9-doh",
+        "server": "1.1.1.1"
+      },
+      {
+        "type": "fallback",
+        "tag": "dns-fallback",
+        "servers": [
+          "dns-cloudflare",
+          "dns-google",
+          "dns-quad9-doh"
+        ],
+        // Strategies:
+        //   - "sequential" (default): query servers in order; on each error move
+        //     to the next one. Returns the first successful response, or the
+        //     last error if all servers failed.
+        //   - "parallel":             query all servers concurrently. Returns
+        //     the first successful response (cancelling the rest), or the last
+        //     error if all servers failed.
+        "strategy": "sequential"
+      }
+    ],
+    "disable_cache": true,
+    "independent_cache": true,
+    "final": "dns-fallback"
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    }
+  ],
+  "route": {
+    "final": "direct",
+    "default_domain_resolver": "dns-fallback",
+    "auto_detect_interface": true
+  }
+}

examples/failover/client.json

@@ -0,0 +1,65 @@
+{
+  "log": {
+    "level": "error"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "failover",
+      "tag": "failover-out",
+      //   - "sequential" (default): try outbounds in order; return the last error
+      //     after exhausting them all.
+      //   - "cycle":                keep retrying outbounds in round-robin forever
+      //     (useful for transient network outages on user devices).
+      "strategy": "cycle",
+      "delay": "2s", // wait between failed attempts; 0 = no delay
+      "outbounds": [
+        {
+          "type": "vless",
+          "tag": "vless-primary",
+          "server": "primary.example.com",
+          "server_port": 443,
+          "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937"
+        },
+        {
+          "type": "trojan",
+          "tag": "trojan-secondary",
+          "server": "secondary.example.com",
+          "server_port": 443,
+          "password": "trojan-password"
+        },
+        {
+          "type": "shadowsocks",
+          "tag": "ss-tertiary",
+          "server": "tertiary.example.com",
+          "server_port": 8388,
+          "method": "aes-128-gcm",
+          "password": "ss-password"
+        }
+      ]
+    }
+  ],
+  "route": {
+    "final": "failover-out",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/failover/server.json

@@ -0,0 +1,58 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      // The "failover" inbound wraps several listeners. If any of them
+      // panics or fails to accept, the parent supervises and restarts it
+      // automatically without affecting the rest of the box.
+      "type": "failover",
+      "inbounds": [
+        {
+          "type": "mixed",
+          "tag": "socks-in-1",
+          "listen": "0.0.0.0",
+          "listen_port": 10001
+        },
+        {
+          "type": "mixed",
+          "tag": "socks-in-2",
+          "listen": "0.0.0.0",
+          "listen_port": 10002
+        },
+        {
+          "type": "vless",
+          "tag": "vless-in",
+          "listen": "0.0.0.0",
+          "listen_port": 8443,
+          "users": [
+            {
+              "name": "user",
+              "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    }
+  ],
+  "route": {
+    "final": "direct",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/limiters/bandwidth/connection.json

@@ -40,9 +40,10 @@
       "type": "bandwidth-limiter",
       "tag": "bandwidth-limiter",
       "strategy": "connection",
-      "mode": "duplex", // download, upload
+      "mode": "bidirectional", // download, upload
       "connection_type": "hwid", // mux, ip
       "speed": "1MB", // 100KB, 1GB, etc.
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],
         "final": "direct"

examples/limiters/bandwidth/global.json

@@ -0,0 +1,43 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "socks",
+      "tag": "socks-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "bandwidth-limiter",
+      "tag": "bandwidth-limiter",
+      "strategy": "global",
+      "mode": "bidirectional", // download, upload
+      "speed": "2MB", // 100KB, 1GB, etc.
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
+      "route": { // https://sing-box.sagernet.org/configuration/route/#structure
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "final": "bandwidth-limiter",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/limiters/bandwidth/manager.json

@@ -0,0 +1,69 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-in",
+      "listen": "0.0.0.0",
+      "listen_port": 443,
+      "transport": {
+        "type": "http"
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "bandwidth-limiter",
+      "tag": "bandwidth-limiter",
+      // "manager" strategy: per-user bandwidth limits are loaded from the
+      // manager database and updated live (no need to list users in this file).
+      "strategy": "manager",
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
+      "route": {
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "action": "hijack-dns"
+      }
+    ],
+    "final": "bandwidth-limiter"
+  },
+  "services": [
+    {
+      "type": "manager",
+      "tag": "my-manager",
+      "database": {
+        "driver": "sqlite",
+        "dsn": "file:manager.db?_pragma=foreign_keys(on)&_pragma=journal_mode(wal)&_pragma=busy_timeout(5000)"
+      }
+    },
+    {
+      "type": "node",
+      "tag": "my-node",
+      "uuid": "e6eceb84-ad66-474b-8641-142499db7c6e",
+      "manager": "my-manager",
+      "inbounds": ["vless-in"],
+      "bandwidth_limiters": ["bandwidth-limiter"]
+    }
+  ]
+}

examples/limiters/bandwidth/multi.json

@@ -38,10 +38,11 @@
     },
     {
       "type": "bandwidth-limiter",
-      "tag": "duplex-bandwidth-limiter",
+      "tag": "bidirectional-bandwidth-limiter",
       "strategy": "global",
-      "mode": "duplex",
+      "mode": "bidirectional",
       "speed": "5MB",
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],
         "final": "direct"
@@ -53,9 +54,10 @@
       "strategy": "global",
       "mode": "upload",
       "speed": "3MB",
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],
-        "final": "duplex-bandwidth-limiter"
+        "final": "bidirectional-bandwidth-limiter"
       }
     },
     {
@@ -64,6 +66,7 @@
       "strategy": "global",
       "mode": "download",
       "speed": "3MB",
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],
         "final": "upload-bandwidth-limiter"

examples/limiters/bandwidth/users.json

@@ -40,21 +40,22 @@
       "type": "bandwidth-limiter",
       "tag": "bandwidth-limiter",
       "strategy": "users",
+      "flow_keys": ["user", "destination"], // values: user, destination, ip, hwid, mux
       "users": [
         {
           "name": "user1",
           "strategy": "connection", // global
-          "mode": "duplex", // download, upload
+          "mode": "bidirectional", // download, upload
           "connection_type": "hwid", // mux, ip
-          "speed": "5MB", // 100KB, 1GB, etc.
+          "speed": "5MB" // 100KB, 1GB, etc.
         },
         {
           "name": "user2",
           "strategy": "connection", // global
-          "mode": "duplex", // download, upload
+          "mode": "bidirectional", // download, upload
           "connection_type": "hwid", // mux, ip
-          "speed": "1MB", // 100KB, 1GB, etc.
-        },
+          "speed": "1MB" // 100KB, 1GB, etc.
+        }
       ],
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],

examples/limiters/connection/connection.json

@@ -40,7 +40,7 @@
       "type": "connection-limiter",
       "tag": "connection-limiter",
       "strategy": "connection",
-      "connection_type": "hwid", // mux, ip
+      "connection_type": "hwid", // mux, source_ip
       "count": 5,
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],

examples/limiters/connection/manager.json

@@ -0,0 +1,68 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-in",
+      "listen": "0.0.0.0",
+      "listen_port": 443,
+      "transport": {
+        "type": "http"
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "connection-limiter",
+      "tag": "connection-limiter",
+      // "manager" strategy: per-user connection caps are loaded from the
+      // manager database and updated live (no need to list users in this file).
+      "strategy": "manager",
+      "route": {
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "action": "hijack-dns"
+      }
+    ],
+    "final": "connection-limiter"
+  },
+  "services": [
+    {
+      "type": "manager",
+      "tag": "my-manager",
+      "database": {
+        "driver": "sqlite",
+        "dsn": "file:manager.db?_pragma=foreign_keys(on)&_pragma=journal_mode(wal)&_pragma=busy_timeout(5000)"
+      }
+    },
+    {
+      "type": "node",
+      "tag": "my-node",
+      "uuid": "e6eceb84-ad66-474b-8641-142499db7c6e",
+      "manager": "my-manager",
+      "inbounds": ["vless-in"],
+      "connection_limiters": ["connection-limiter"]
+    }
+  ]
+}

examples/limiters/connection/users.json

@@ -44,15 +44,15 @@
         {
           "name": "user1",
           "strategy": "connection",
-          "connection_type": "hwid", // mux, ip
-          "count": 5,
+          "connection_type": "hwid", // mux, source_ip
+          "count": 5
         },
         {
           "name": "user2",
           "strategy": "connection",
-          "connection_type": "hwid", // mux, ip
-          "count": 1,
-        },
+          "connection_type": "hwid", // mux, source_ip
+          "count": 1
+        }
       ],
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],

examples/limiters/rate/connection.json

@@ -23,10 +23,6 @@
         {
           "name": "user1",
           "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937"
-        },
-        {
-          "name": "user2",
-          "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937"
         }
       ]
     }
@@ -37,11 +33,12 @@
       "tag": "direct"
     },
     {
-      "type": "bandwidth-limiter",
-      "tag": "bandwidth-limiter",
-      "strategy": "global",
-      "mode": "duplex", // download, upload
-      "speed": "1MB", // 100KB, 1GB, etc.
+      "type": "rate-limiter",
+      "tag": "rate-limiter",
+      "strategy": "token-bucket", // leaky-bucket, sliding-window, fixed-window
+      "connection_type": "hwid", // mux, source_ip
+      "count": 20, // max requests per interval per connection
+      "interval": "1s",
       "route": { // https://sing-box.sagernet.org/configuration/route/#structure
         "rules": [],
         "final": "direct"
@@ -49,7 +46,7 @@
     }
   ],
   "route": {
-    "final": "bandwidth-limiter",
+    "final": "rate-limiter",
     "default_domain_resolver": "default",
     "auto_detect_interface": true
   }

examples/limiters/rate/global.json

@@ -0,0 +1,42 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "socks",
+      "tag": "socks-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "rate-limiter",
+      "tag": "rate-limiter",
+      "strategy": "leaky-bucket", // token-bucket, sliding-window, fixed-window
+      "count": 10, // max requests per interval
+      "interval": "1s", // time window
+      "route": { // https://sing-box.sagernet.org/configuration/route/#structure
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "final": "rate-limiter",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/limiters/rate/manager.json

@@ -0,0 +1,68 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-in",
+      "listen": "0.0.0.0",
+      "listen_port": 443,
+      "transport": {
+        "type": "http"
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "rate-limiter",
+      "tag": "rate-limiter",
+      // "manager" strategy: per-user rate limits are loaded from the
+      // manager database and updated live (no need to list users in this file).
+      "strategy": "manager",
+      "route": {
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "action": "hijack-dns"
+      }
+    ],
+    "final": "rate-limiter"
+  },
+  "services": [
+    {
+      "type": "manager",
+      "tag": "my-manager",
+      "database": {
+        "driver": "sqlite",
+        "dsn": "file:manager.db?_pragma=foreign_keys(on)&_pragma=journal_mode(wal)&_pragma=busy_timeout(5000)"
+      }
+    },
+    {
+      "type": "node",
+      "tag": "my-node",
+      "uuid": "e6eceb84-ad66-474b-8641-142499db7c6e",
+      "manager": "my-manager",
+      "inbounds": ["vless-in"],
+      "rate_limiters": ["rate-limiter"]
+    }
+  ]
+}

examples/limiters/rate/users.json

@@ -0,0 +1,70 @@
+{
+  "log": {
+    "level": "error"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-in",
+      "listen": "0.0.0.0",
+      "listen_port": 443,
+      "transport": {
+        "type": "http"
+      },
+      "users": [
+        {
+          "name": "user1",
+          "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937"
+        },
+        {
+          "name": "user2",
+          "uuid": "6c8c7ffc-a909-4699-af34-e9d9bcb3e6d6"
+        }
+      ]
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "rate-limiter",
+      "tag": "rate-limiter",
+      "strategy": "users",
+      "users": [
+        {
+          "name": "user1",
+          "strategy": "leaky-bucket", // token-bucket, sliding-window, fixed-window
+          "connection_type": "hwid", // mux, source_ip
+          "count": 30,
+          "interval": "1s"
+        },
+        {
+          "name": "user2",
+          "strategy": "sliding-window",
+          "connection_type": "source_ip",
+          "count": 5,
+          "interval": "1s"
+        }
+      ],
+      "route": { // https://sing-box.sagernet.org/configuration/route/#structure
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "final": "rate-limiter",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/limiters/traffic/global.json

@@ -0,0 +1,42 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "socks",
+      "tag": "socks-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "traffic-limiter",
+      "tag": "traffic-limiter",
+      "strategy": "global",
+      "mode": "bidirectional", // download, upload
+      "total": "10GB", // 100MB, 1TB, etc.
+      "route": { // https://sing-box.sagernet.org/configuration/route/#structure
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "final": "traffic-limiter",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/limiters/traffic/manager.json

@@ -0,0 +1,68 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-in",
+      "listen": "0.0.0.0",
+      "listen_port": 443,
+      "transport": {
+        "type": "http"
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "traffic-limiter",
+      "tag": "traffic-limiter",
+      // "manager" strategy: per-user traffic quotas are loaded from the
+      // manager database and updated live (no need to list users in this file).
+      "strategy": "manager",
+      "route": {
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "action": "hijack-dns"
+      }
+    ],
+    "final": "traffic-limiter"
+  },
+  "services": [
+    {
+      "type": "manager",
+      "tag": "my-manager",
+      "database": {
+        "driver": "sqlite",
+        "dsn": "file:manager.db?_pragma=foreign_keys(on)&_pragma=journal_mode(wal)&_pragma=busy_timeout(5000)"
+      }
+    },
+    {
+      "type": "node",
+      "tag": "my-node",
+      "uuid": "e6eceb84-ad66-474b-8641-142499db7c6e",
+      "manager": "my-manager",
+      "inbounds": ["vless-in"],
+      "traffic_limiters": ["traffic-limiter"]
+    }
+  ]
+}

examples/limiters/traffic/users.json

@@ -0,0 +1,68 @@
+{
+  "log": {
+    "level": "error"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-in",
+      "listen": "0.0.0.0",
+      "listen_port": 443,
+      "transport": {
+        "type": "http"
+      },
+      "users": [
+        {
+          "name": "user1",
+          "uuid": "9b65b7e1-04c8-4717-8f45-2aa61fd25937"
+        },
+        {
+          "name": "user2",
+          "uuid": "6c8c7ffc-a909-4699-af34-e9d9bcb3e6d6"
+        }
+      ]
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "traffic-limiter",
+      "tag": "traffic-limiter",
+      "strategy": "users",
+      "users": [
+        {
+          "name": "user1",
+          "strategy": "global",
+          "mode": "bidirectional", // download, upload
+          "total": "100GB" // 100MB, 1TB, etc.
+        },
+        {
+          "name": "user2",
+          "strategy": "global",
+          "mode": "download",
+          "total": "10GB"
+        }
+      ],
+      "route": { // https://sing-box.sagernet.org/configuration/route/#structure
+        "rules": [],
+        "final": "direct"
+      }
+    }
+  ],
+  "route": {
+    "final": "traffic-limiter",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/manager/manager.json

@@ -1,62 +0,0 @@
-{
-  "log": {
-    "level": "error"
-  },
-  "dns": {
-    "servers": [
-      {
-        "type": "local",
-        "tag": "default"
-      }
-    ]
-  },
-  "inbounds": [],
-  "outbounds": [
-    {
-      "type": "direct",
-      "tag": "direct-out"
-    }
-  ],
-  "route": {
-    "rules": [
-      {
-        "protocol": "dns",
-        "action": "hijack-dns"
-      }
-    ],
-    "final": "direct-out"
-  },
-  "services": [
-    {
-      "type": "manager",
-      "tag": "my-manager",
-      "database": {
-        "driver": "postgresql",
-        "dsn": "postgresql://postgres:postgres@localhost:5432/manager?sslmode=disable"
-      }
-    },
-    { // http://127.0.0.1:8000
-      // Username: admin
-      // Password: admin
-      "type": "admin-panel",
-      "tag": "my-admin-panel",
-      "listen_port": 8000,
-      "manager": "my-manager",
-      "database": {
-        "driver": "postgresql",
-        "dsn": "postgresql://postgres:postgres@localhost:5432/adminpanel?sslmode=disable"
-      }
-    },
-    {
-      "type": "node-manager-server", // for connecting nodes
-      "listen_port": 7000,
-      "manager": "my-manager",
-      "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#inbound
-        "enabled": true,
-        "server_name": "example.com",
-        "certificate_path": "/path/to/fullchain.pem",
-        "key_path": "/path/to/privkey.pem"
-      },
-    }
-  ]
-}

examples/masque/client.json

@@ -37,16 +37,14 @@
       "udp_keepalive_period": "30s",
       "udp_initial_packet_size": 0,
       "reconnect_delay": "5s",
-      "tls": { // https://sing-box.sagernet.org/configuration/shared/tls/#fields
-        "insecure": false,
-        "cipher_suites": [],
-        "curve_preferences": [],
-        "fragment": false,
-        "fragment_fallback_delay": "",
-        "record_fragment": false,
-        "kernel_tx": false,
-        "kernel_rx": false,
-      }
+      // TLS fields for HTTP2
+      "insecure": false,
+      "cipher_suites": [],
+      "curve_preferences": [],
+      "fragment": false,
+      "record_fragment": false,
+      "kernel_tx": false,
+      "kernel_rx": false
       // Dial Fields
     }
   ],

examples/mieru/client.json

@@ -31,6 +31,8 @@
       "transport": "TCP",
       "username": "username",
       "password": "password",
+      // valid: MULTIPLEXING_DEFAULT / MULTIPLEXING_OFF / MULTIPLEXING_LOW
+      //        MULTIPLEXING_MIDDLE / MULTIPLEXING_HIGH
       "multiplexing": "MULTIPLEXING_LOW"
       // Dial Fields
     }

examples/mtproxy/server.json

@@ -1,6 +1,6 @@
 {
   "log": {
-    "level": "error"
+    "level": "info"
   },
   "dns": {
     "servers": [
@@ -73,10 +73,17 @@
     {
       "type": "direct",
       "tag": "direct"
+    },
+    {
+      "type": "socks",
+      "tag": "socks-out",
+      "server": "192.168.1.1",
+      "server_port": 17085,
+      "version": "5"
     }
   ],
   "route": {
-    "final": "direct",
+    "final": "socks-out",
     "default_domain_resolver": "default",
     "auto_detect_interface": true
   }

examples/provider/inline.json

@@ -0,0 +1,91 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "selector",
+      "tag": "proxy",
+      "outbounds": [
+        "direct"
+      ],
+      "providers": [
+        "my-inline"
+      ],
+      "default": "direct",
+      "interrupt_exist_connections": true
+    }
+  ],
+  "providers": [
+    {
+      "type": "inline",
+      "tag": "my-inline",
+      // Outbounds are listed in-place. They are registered with the
+      // provider on start and become available to any group that
+      // references this provider via "providers" or
+      // "use_all_providers".
+      "outbounds": [
+        {
+          "type": "shadowsocks",
+          "tag": "ss-hk",
+          "server": "hk.example.com",
+          "server_port": 8388,
+          "method": "aes-256-gcm",
+          "password": "password"
+        },
+        {
+          "type": "trojan",
+          "tag": "trojan-jp",
+          "server": "jp.example.com",
+          "server_port": 443,
+          "password": "password",
+          "tls": {
+            "enabled": true,
+            "server_name": "jp.example.com"
+          }
+        },
+        {
+          "type": "vless",
+          "tag": "vless-sg",
+          "server": "sg.example.com",
+          "server_port": 443,
+          "uuid": "00000000-0000-0000-0000-000000000000",
+          "tls": {
+            "enabled": true,
+            "server_name": "sg.example.com"
+          }
+        }
+      ],
+      "health_check": {
+        "enabled": true,
+        "url": "https://www.gstatic.com/generate_204",
+        "interval": "5m",
+        "timeout": "5s"
+      }
+    }
+  ],
+  "route": {
+    "final": "proxy",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/provider/local.json

@@ -0,0 +1,64 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    // A "selector" group that pulls all of its members from the
+    // outbound provider tagged "my-local". The provider parses the
+    // file at "path" on every change (fswatch-based hot reload).
+    {
+      "type": "selector",
+      "tag": "proxy",
+      "outbounds": [
+        "direct"
+      ],
+      "providers": [
+        "my-local"
+      ],
+      "default": "direct",
+      "interrupt_exist_connections": true
+    }
+  ],
+  "providers": [
+    {
+      "type": "local",
+      "tag": "my-local",
+      // Subscription file. Supported formats are auto-detected:
+      //   - sing-box JSON ({ "outbounds": [...] })
+      //   - Clash YAML
+      //   - SIP008 (shadowsocks)
+      //   - Raw shareable links (vless://, vmess://, ss://, trojan://, ...)
+      "path": "subscriptions/my-sub.txt",
+      "health_check": {
+        "enabled": true,
+        "url": "https://www.gstatic.com/generate_204",
+        "interval": "5m",
+        "timeout": "5s"
+      }
+    }
+  ],
+  "route": {
+    "final": "proxy",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/provider/remote.json

@@ -0,0 +1,72 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "type": "local",
+        "tag": "default"
+      }
+    ]
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen_port": 7897
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    // The "urltest" group below uses every outbound exposed by every
+    // registered provider thanks to "use_all_providers": true.
+    // The fastest member is selected based on the URL test result.
+    {
+      "type": "urltest",
+      "tag": "auto",
+      "outbounds": [
+        "direct"
+      ],
+      "use_all_providers": true,
+      "url": "https://www.gstatic.com/generate_204",
+      "interval": "10m",
+      "tolerance": 50,
+      "interrupt_exist_connections": true
+    }
+  ],
+  "providers": [
+    {
+      "type": "remote",
+      "tag": "my-remote",
+      // Subscription URL. The response body can be any auto-detected
+      // format: sing-box JSON, Clash YAML, SIP008, base64-encoded
+      // shareable links, or plain link list.
+      "url": "https://example.com/subscription.txt",
+      "user_agent": "sing-box",
+      // Fetch the subscription through this outbound instead of the
+      // default route (useful when the subscription host is blocked).
+      "download_detour": "direct",
+      // Refresh interval. Minimum is 1 minute; default is 24h.
+      "update_interval": "12h",
+      // Optional regex filters applied after parsing the subscription.
+      // "exclude" wins over "include" when both match.
+      "exclude": "(?i)expire|流量|官网",
+      "include": "(?i)hk|jp|sg|us",
+      "health_check": {
+        "enabled": true,
+        "url": "https://www.gstatic.com/generate_204",
+        "interval": "5m",
+        "timeout": "5s"
+      }
+    }
+  ],
+  "route": {
+    "final": "auto",
+    "default_domain_resolver": "default",
+    "auto_detect_interface": true
+  }
+}

examples/wireguard/client.json

@@ -15,20 +15,22 @@
       "type": "wireguard",
       "tag": "wireguard-out",
       "mtu": 1408,
-      "address": null,
-      "private_key": "",
+      "address": ["10.0.0.2/32"],
+      "private_key": "QGg8AFRn6qKfTB7cT3FWH1WGx3np+OKzlNuQUrqIBmI=",
       "listen_port": 10000,
       "peers": [
         {
           "address": "example.com",
           "port": 10001,
+          "public_key": "3nk7jdnkcL95Fc/z+GCiH7jOovEKhFkLIGPT+U/uLEQ=",
+          "allowed_ips": ["0.0.0.0/0"],
           "reserved": "AAAA"
         }
       ],
       "udp_timeout": "5m0s",
       // Extended options
       "preallocated_buffers_per_pool": 256, // Set limit for preallocated buffers (can be useful for devices with low RAM)
-      "disable_pauses": true, // Disable pauses when android device in sleep mode
+      "disable_pauses": true // Disable pauses when android device in sleep mode
     }
   ],
   "inbounds": [

examples/xhttp/client.json

@@ -35,9 +35,10 @@
       },
       "transport": {
         "type": "xhttp",
-        "mode": "stream-up",
+        "mode": "stream-up", // packet-up, stream-one
         "host": "example.com",
         "path": "/xhttp",
+        "headers": {},
         "domain_strategy": "prefer_ipv4",
         "x_padding_bytes": "100-1000",
         "no_grpc_header": false, // stream-up/one, client only
@@ -69,6 +70,7 @@
         "download": {
           "host": "example.com",
           "path": "/xhttp",
+          "headers": {},
           "domain_strategy": "prefer_ipv4",
           "x_padding_bytes": "100-1000",
           "no_grpc_header": false, // stream-up/one, client only

examples/xhttp/server.json

@@ -26,31 +26,31 @@
         "enabled": true,
         "server_name": "example.com",
         "alpn": "h2", // h3 for QUIC
-        "certificate_path": "/path/to/fullchain.pem",
-        "key_path": "/path/to/privkey.pem"
       },
       "transport": {
         "type": "xhttp",
-        "mode": "stream-up",
+        "mode": "stream-up", // packet-up, stream-one
+        "host": "",
         "path": "/xhttp",
+        "headers": {},
         "x_padding_bytes": "100-1000",
         "no_sse_header": false, // server only
         "sc_max_each_post_bytes": 1000000, // packet-up only
         "sc_max_buffered_posts": 30, // packet-up, server only
         "sc_stream_up_server_secs": "20-80", // stream-up, server only
+        "server_max_header_bytes": 8192,
+        "trusted_x_forwarded_for": [],
         "x_padding_obfs_mode": false,
         "x_padding_key": "",
         "x_padding_header": "",
         "x_padding_placement": "",
         "x_padding_method": "",
-        "uplink_http_method": "",
         "session_placement": "",
         "session_key": "",
         "seq_placement": "",
         "seq_key": "",
         "uplink_data_placement": "",
         "uplink_data_key": "",
-        "uplink_chunk_size": 0,
       }
     }
   ],