Examples

Generated by website/scripts/build-config.mjs from website/examples; do not edit. Each configuration is read and built by sail without a warning (sail/tests/it/test_examples.rs) and is valid by the JSON schema. Names, keys and passwords are placeholders.

A client on a TUN

Every connection of the device through a TUN: DNS over HTTPS through the proxy, the LAN’s names by the system’s resolver, a selector over a URL test of a REALITY and a Hysteria2 server, and private addresses direct. Everything in it is sing-box’s.

client-tun.json

{
  "$schema": "https://peakpassvpn.github.io/sail/schema.json",
  "log": { "level": "info" },
  "dns": {
    "servers": [
      { "type": "https", "tag": "remote", "server": "1.1.1.1", "detour": "proxy" },
      { "type": "local", "tag": "local" }
    ],
    "rules": [
      { "domain_suffix": ["lan", "local"], "server": "local" }
    ],
    "final": "remote"
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun",
      "address": ["172.19.0.1/30", "fdfe:dcba:9876::1/126"],
      "auto_route": true,
      "strict_route": true
    }
  ],
  "outbounds": [
    { "type": "selector", "tag": "proxy", "outbounds": ["auto", "reality", "hysteria2"] },
    { "type": "urltest", "tag": "auto", "outbounds": ["reality", "hysteria2"] },
    {
      "type": "vless",
      "tag": "reality",
      "server": "server.example.com",
      "server_port": 443,
      "uuid": "1b0e0a3e-1c2d-4e5f-8a9b-0c1d2e3f4a5b",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "www.example.com",
        "utls": { "enabled": true, "fingerprint": "chrome" },
        "reality": {
          "enabled": true,
          "public_key": "ERERERERERERERERERERERERERERERERERERERERERE",
          "short_id": "0123"
        }
      }
    },
    {
      "type": "hysteria2",
      "tag": "hysteria2",
      "server": "server.example.com",
      "server_port": 8443,
      "password": "a long random password",
      "tls": { "enabled": true, "server_name": "server.example.com" }
    },
    { "type": "direct", "tag": "direct" }
  ],
  "route": {
    "rules": [
      { "inbound": "tun", "action": "sniff" },
      { "protocol": "dns", "action": "hijack-dns" },
      { "ip_is_private": true, "outbound": "direct" }
    ],
    "final": "proxy",
    "auto_detect_interface": true,
    "default_domain_resolver": "local"
  }
}

A REALITY server with limits per user

A VLESS inbound on REALITY with two users, and sail’s user_limits: a cap on connections and a rate for one, a quota and an end date for the other. The quota is kept across restarts in the cache file.

server-reality.json

{
  "$schema": "https://peakpassvpn.github.io/sail/schema.json",
  "log": { "level": "info" },
  "inbounds": [
    {
      "type": "vless",
      "tag": "reality",
      "listen": "::",
      "listen_port": 443,
      "users": [
        { "name": "alice", "uuid": "1b0e0a3e-1c2d-4e5f-8a9b-0c1d2e3f4a5b", "flow": "xtls-rprx-vision" },
        { "name": "bob", "uuid": "2c1f1b4f-2d3e-4f60-9bac-1d2e3f4a5b6c", "flow": "xtls-rprx-vision" }
      ],
      "tls": {
        "enabled": true,
        "server_name": "www.example.com",
        "reality": {
          "enabled": true,
          "handshake": { "server": "www.example.com", "server_port": 443 },
          "private_key": "IiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI",
          "short_id": ["0123"]
        }
      }
    }
  ],
  "outbounds": [{ "type": "direct", "tag": "direct" }],
  "user_limits": {
    "alice": { "max_connections": 64, "up_mbps": 50, "down_mbps": 200 },
    "bob": { "quota_bytes": 107374182400, "expire_at": "2027-01-01T00:00:00Z" }
  },
  "experimental": { "cache_file": { "enabled": true, "path": "cache.db" } }
}

Groups from a subscription

sail’s outbound_providers: a subscription downloaded every 12 hours, its outbounds joining a selector and, filtered by name, a URL test that falls back to direct while none is left.

providers.json

{
  "$schema": "https://peakpassvpn.github.io/sail/schema.json",
  "outbound_providers": [
    {
      "type": "remote",
      "tag": "subscription",
      "url": "https://provider.example.com/sub.yaml",
      "update_interval": "12h",
      "download_detour": "direct"
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "proxy",
      "outbounds": ["fastest"],
      "providers": "subscription"
    },
    {
      "type": "urltest",
      "tag": "fastest",
      "providers": "subscription",
      "filter": "(?i)hong kong|singapore",
      "exclude_filter": "(?i)expire|traffic",
      "empty_fallback": "direct"
    },
    { "type": "direct", "tag": "direct" }
  ],
  "route": { "final": "proxy" }
}

By the network the device is on

sail’s network group: direct on the home Wi-Fi, Hysteria2 on cellular, REALITY elsewhere; and a rule on the Wi-Fi’s name by regular expression, a sail extension.

network-aware.json

{
  "$schema": "https://peakpassvpn.github.io/sail/schema.json",
  "outbounds": [
    {
      "type": "network",
      "tag": "by-network",
      "branches": [
        { "wifi_ssid": "Home", "outbound": "direct" },
        { "network_type": "cellular", "outbound": "hysteria2" }
      ],
      "default": "reality"
    },
    {
      "type": "vless",
      "tag": "reality",
      "server": "server.example.com",
      "server_port": 443,
      "uuid": "1b0e0a3e-1c2d-4e5f-8a9b-0c1d2e3f4a5b",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "www.example.com",
        "utls": { "enabled": true, "fingerprint": "chrome" },
        "reality": {
          "enabled": true,
          "public_key": "ERERERERERERERERERERERERERERERERERERERERERE",
          "short_id": "0123"
        }
      }
    },
    {
      "type": "hysteria2",
      "tag": "hysteria2",
      "server": "server.example.com",
      "server_port": 8443,
      "password": "a long random password",
      "tls": { "enabled": true, "server_name": "server.example.com" }
    },
    { "type": "direct", "tag": "direct" }
  ],
  "route": {
    "rules": [
      { "wifi_ssid_regex": "^Office", "outbound": "direct" }
    ],
    "final": "by-network"
  }
}