Shared objects
Generated by website/scripts/build-config.mjs; do not edit. It reads sail’s configuration types (its Rust source), sing-box’s field registry (sail/src/config/singbox/fields.json, sing-box v1.14.2) and the tiers the registry test measured (fields.tiers.json). Change the source comments or those files, then run npm run docs:config in website/.
- Status: each sing-box field as the registry test measured it: Supported (read and acted on; a value sail cannot take is still an error), Warned (dropped with a warning) or Error (the configuration is refused), with the reason; sail extension marks fields and types sing-box does not have.
- Type: sing-box’s JSON type for its fields; from sail’s Rust definitions for extensions.
- Default: from sail’s serde declarations; unset means the field may be left out, and the description says what applies then. Only fields sail reads have one.
- Description: sail’s source comments, in their source language; for an extension without one, the registry test’s note.
- Build: the
cfgconditions in the Rust source (Cargo features and platforms).
Validate a configuration with sail -c config.json -T. Editors check and complete it by the JSON schema: put "$schema": "https://peakpassvpn.github.io/sail/schema.json" at its top (made by the same generator; a field sail refuses is marked not allowed, one it warns of deprecated). The Clash and Surge support tables are under Compatibility.
Objects that several fields take with the same fields, types and tiers, written once. Each lists the fields it belongs to.
brutal
Section titled “brutal”Used at: inbounds[shadowsocks, trojan, vless, vmess].multiplex.brutal, outbounds[shadowsocks, trojan, vless, vmess].multiplex.brutal
Rust: MultiplexBrutal
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
up_mbps |
number | 0 |
Supported | — |
down_mbps |
number | 0 |
Supported | — |
client_subnet
Section titled “client_subnet”Used at: dns.servers[h3, https, quic, tcp, tls, udp].client_subnet, outbounds[redirect].domain_resolver.client_subnet
Rust: Prefix · sail extension
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
addr |
string | required | sail extension | — |
len |
number | required | sail extension | — |
domain_resolver — inbounds
Section titled “domain_resolver — inbounds”Used at: inbounds[http, mixed, socks].domain_resolver
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | Error: Resolving requested names with a resolver of its own: another server would answer | — |
timeout |
duration | — | Error: Resolving requested names with a resolver of its own: another server would answer | — |
strategy |
string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only |
— | Error: Resolving requested names with a resolver of its own: another server would answer | — |
disable_cache |
bool | — | Error: Resolving requested names with a resolver of its own: another server would answer | — |
disable_optimistic_cache |
bool | — | Error: Resolving requested names with a resolver of its own: another server would answer | — |
rewrite_ttl |
number | — | Error: Resolving requested names with a resolver of its own: another server would answer | — |
client_subnet |
string | — | Error: Resolving requested names with a resolver of its own: another server would answer | — |
domain_resolver — inbounds, route.rule_set
Section titled “domain_resolver — inbounds, route.rule_set”Used at: inbounds[anytls].tls.reality.handshake.domain_resolver, route.rule_set[remote].http_client.domain_resolver
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | Supported | — |
timeout |
duration | — | Supported | — |
strategy |
string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only |
— | Supported | — |
disable_cache |
bool | — | Supported | — |
disable_optimistic_cache |
bool | — | Supported | — |
rewrite_ttl |
number | — | Supported | — |
client_subnet |
string | — | Supported | — |
domain_resolver / default_domain_resolver
Section titled “domain_resolver / default_domain_resolver”Used at: http_clients[].domain_resolver, ntp.domain_resolver, dns.servers[h3, https, quic, tcp, tls, udp].domain_resolver, inbounds[http, hysteria2, trojan, tuic, vless, vmess].tls.reality.handshake.domain_resolver, inbounds[shadowtls].handshake.domain_resolver, outbounds[anytls, direct, http, hysteria2, shadowsocks, shadowtls, socks, trojan, tuic, vless, vmess].domain_resolver, endpoints[wireguard].domain_resolver, route.default_domain_resolver
Rust: DomainResolver
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | Supported | — |
timeout |
duration | unset | Supported | — |
strategy |
string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only |
unset | Supported | — |
disable_cache |
bool | false |
Supported | — |
disable_optimistic_cache |
bool | false |
Supported | — |
rewrite_ttl |
number | unset | Supported | — |
client_subnet |
string | unset | Supported | — |
domain_resolver / stun_domain_resolver
Section titled “domain_resolver / stun_domain_resolver”Used at: inbounds[hysteria2].realm.http_client.domain_resolver, inbounds[hysteria2].realm.stun_domain_resolver, outbounds[hysteria2].realm.http_client.domain_resolver
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
timeout |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
strategy |
string, one of as_is, prefer_ipv4, prefer_ipv6, ipv4_only, ipv6_only |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
disable_cache |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
disable_optimistic_cache |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
rewrite_ttl |
number | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
client_subnet |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
ech — dns.servers
Section titled “ech — dns.servers”Used at: dns.servers[h3, https, quic, tls].tls.ech
Rust: OutboundEch
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Not for a dns server | — |
config |
listable-string | — | Error: Not for a dns server | An ECHConfigList, base64 or PEM. Looked up in DNS when not set. |
config_path |
string | — | Error: An ECH configuration from a file, or looked up under another name: the server name would go in the clear | — |
query_server_name |
string | — | Error: An ECH configuration from a file, or looked up under another name: the server name would go in the clear | — |
ech — http_clients, route.rule_set
Section titled “ech — http_clients, route.rule_set”Used at: http_clients[].tls.ech, route.rule_set[remote].http_client.tls.ech
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
config |
listable-string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
config_path |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
query_server_name |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
ech — inbounds
Section titled “ech — inbounds”Used at: inbounds[anytls, http, hysteria2, trojan, tuic, vless, vmess].tls.ech
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Encrypted Client Hello on an inbound | — |
key |
listable-string | — | Error: Encrypted Client Hello on an inbound | — |
key_path |
string | — | Error: Encrypted Client Hello on an inbound | — |
ech — inbounds, outbounds
Section titled “ech — inbounds, outbounds”Used at: inbounds[hysteria2].realm.http_client.tls.ech, outbounds[hysteria2].realm.http_client.tls.ech
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
config |
listable-string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
config_path |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
query_server_name |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
ech — outbounds
Section titled “ech — outbounds”Used at: outbounds[anytls, http, hysteria2, shadowtls, trojan, tuic, vless, vmess].tls.ech
Rust: OutboundEch
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
config |
listable-string | unset | Supported | An ECHConfigList, base64 or PEM. Looked up in DNS when not set. |
config_path |
string | — | Error: An ECH configuration from a file, or looked up under another name: the server name would go in the clear | — |
query_server_name |
string | — | Error: An ECH configuration from a file, or looked up under another name: the server name would go in the clear | — |
disable_dns_lookup |
bool | false |
sail extension | Never look the ECHConfigList up in DNS: config is then required. |
fallback / fallback_for_alpn
Section titled “fallback / fallback_for_alpn”Used at: inbounds[anytls, vless].fallback, inbounds[anytls, vless].fallback_for_alpn
Rust: FallbackServer · Build: any (feature = "inbound-anytls" , feature = "inbound-trojan" , feature = "inbound-vless" , feature = "inbound-shadowtls") · sail extension
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | sail extension | — |
server_port |
number | required | sail extension | — |
handshake — inbounds
Section titled “handshake — inbounds”Used at: inbounds[http, trojan, vless, vmess].tls.reality.handshake
Rust: RealityHandshake
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | Supported | — |
server_port |
number | required | Supported | — |
detour |
string | — | Error: A detour to the REALITY handshake server: it would be reached otherwise | The outbound to dial through, in place of a socket of its own. |
bind_interface |
string | unset | Supported | The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well. |
inet4_bind_address |
string | unset | Supported | The local address for IPv4 destinations, loopback ones aside: as bind_interface. |
inet6_bind_address |
string | unset | Supported | The local address for IPv6 destinations, loopback ones aside: as bind_interface. |
bind_address_no_port |
bool | false |
Supported | IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only. |
protect_path |
string | unset | Supported | A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only. |
routing_mark |
number|string | unset | Supported | SO_MARK, Linux only. |
reuse_addr |
bool | false |
Supported | SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets. |
netns |
string | — | Error: Linux network namespaces: sockets would leave another way | Not implemented yet. |
connect_timeout |
duration | unset | Supported | How long a TCP connect to one address may take; 5s when unset. |
tcp_fast_open |
bool | false |
Supported | TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced. |
tcp_multi_path |
bool | — | Warned: Socket tuning: connections go the same way without it | Not implemented yet. |
disable_tcp_keep_alive |
bool | false |
Supported | No TCP keepalive at all. |
tcp_keep_alive |
duration | unset | Supported | How long a TCP connection is idle before keepalive probes it; 5m when unset. |
tcp_keep_alive_interval |
duration | unset | Supported | Between keepalive probes; 75s when unset. |
udp_fragment |
bool | unset | Supported | Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default. |
domain_resolver |
string|object → object | unset | Supported | The DNS server that resolves the names dialled. |
network_strategy |
string, one of default, fallback, hybrid |
unset | Supported | Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces). |
network_type |
listable-string, one of cellular, ethernet, other, wifi |
[] |
Supported | The types of interface the strategy goes out of first. |
fallback_network_type |
listable-string, one of cellular, ethernet, other, wifi |
[] |
Supported | The types it falls back to, with fallback. |
fallback_delay |
duration | unset | Supported | How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset. |
domain_strategy |
string | unset | Supported (deprecated in sing-box) | sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before. |
skip_default_domain_resolver |
bool | false |
sail extension | A sail extension: without a domain_resolver of its own, the names dialled resolve as the DNS rules say, not as route.default_domain_resolver does; as Mihomo’s DIRECT resolves apart from the proxies’ servers. |
handshake — inbounds (2)
Section titled “handshake — inbounds (2)”Used at: inbounds[hysteria2, tuic].tls.reality.handshake
Rust: RealityHandshake
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
server |
string | required | Supported | — |
server_port |
number | required | Supported | — |
detour |
string | — | Error: A detour to the REALITY handshake server: it would be reached otherwise | The outbound to dial through, in place of a socket of its own. |
bind_interface |
string | unset | Supported | The interface to send through, by name. Loopback destinations still go over loopback, where sing-box applies the bind to them as well. |
inet4_bind_address |
string | unset | Supported | The local address for IPv4 destinations, loopback ones aside: as bind_interface. |
inet6_bind_address |
string | unset | Supported | The local address for IPv6 destinations, loopback ones aside: as bind_interface. |
bind_address_no_port |
bool | false |
Supported | IP_BIND_ADDRESS_NO_PORT on TCP sockets bound to an address, so that the port is picked at connect: Linux only. |
protect_path |
string | unset | Supported | A Unix socket each socket’s descriptor is handed to, with SCM_RIGHTS, before it binds or connects, for the process there to protect it (from its VPN, say); it answers one byte. Besides what the host protects. Unix only. |
routing_mark |
number|string | unset | Supported | SO_MARK, Linux only. |
reuse_addr |
bool | false |
Supported | SO_REUSEADDR, and SO_REUSEPORT on Unix, on UDP sockets. |
netns |
string | — | Error: Linux network namespaces: sockets would leave another way | Not implemented yet. |
connect_timeout |
duration | unset | Supported | How long a TCP connect to one address may take; 5s when unset. |
tcp_fast_open |
bool | false |
Supported | TCP Fast Open: the first data written goes with the SYN. Its addresses are then tried one by one, not raced. |
tcp_multi_path |
bool | — | Warned: Socket tuning: connections go the same way without it | Not implemented yet. |
disable_tcp_keep_alive |
bool | false |
Supported | No TCP keepalive at all. |
tcp_keep_alive |
duration | unset | Supported | How long a TCP connection is idle before keepalive probes it; 5m when unset. |
tcp_keep_alive_interval |
duration | unset | Supported | Between keepalive probes; 75s when unset. |
udp_fragment |
bool | unset | Supported | Whether UDP datagrams may be fragmented on the way; unset, as the place says, see udp_fragment_default. |
domain_resolver |
string|object → object | unset | Supported | The DNS server that resolves the names dialled. |
network_strategy |
string, one of default, fallback, hybrid |
unset | Supported | Which of the host’s interfaces a connection goes out of, and how they race; default where only types are given. Only where the host lists its interfaces (NetworkState::interfaces). |
network_type |
listable-string, one of cellular, ethernet, other, wifi |
[] |
Supported | The types of interface the strategy goes out of first. |
fallback_network_type |
listable-string, one of cellular, ethernet, other, wifi |
[] |
Supported | The types it falls back to, with fallback. |
fallback_delay |
duration | unset | Supported | How long the addresses of one family are tried before those of the other are raced against them (Happy Eyeballs), and the first interfaces before the fallback ones; 300ms when unset. |
domain_strategy |
string | unset | Supported (deprecated in sing-box) | sing-box’s deprecated field for the families names resolve to, which a resolver’s own strategy goes before. |
http_client
Section titled “http_client”Used at: inbounds[hysteria2].realm.http_client, outbounds[hysteria2].realm.http_client
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
engine |
string, one of go, apple |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
version |
number, one of 0, 1, 2, 3 |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
disable_version_fallback |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
headers |
map | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
tls |
object → object | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
detour |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
bind_interface |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
inet4_bind_address |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
inet6_bind_address |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
bind_address_no_port |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
protect_path |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
routing_mark |
number|string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
reuse_addr |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
netns |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
connect_timeout |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
tcp_fast_open |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
tcp_multi_path |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
disable_tcp_keep_alive |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
tcp_keep_alive |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
tcp_keep_alive_interval |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
udp_fragment |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
domain_resolver |
string|object → object | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
network_strategy |
string, one of default, fallback, hybrid |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
network_type |
listable-string, one of cellular, ethernet, other, wifi |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
fallback_network_type |
listable-string, one of cellular, ethernet, other, wifi |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
fallback_delay |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
idle_timeout |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
keep_alive_period |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
stream_receive_window |
number|string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
connection_receive_window |
number|string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
max_concurrent_streams |
number | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
initial_packet_size |
number | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
disable_path_mtu_discovery |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
domain_strategy |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise (deprecated in sing-box) | — |
multiplex — inbounds
Section titled “multiplex — inbounds”Used at: inbounds[shadowsocks, trojan, vless, vmess].multiplex
Rust: InboundMultiplex
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
padding |
bool | false |
Supported | sing-mux: refuse connections that are not padded. |
brutal |
object → object | unset | Supported | sing-mux: TCP Brutal for clients that ask for it; Linux only. |
protocol |
string | unset | sail extension | amux; unset, sing-mux, which sing-box’s block has no field for: its server takes smux, yamux and h2mux alike. |
multiplex — outbounds
Section titled “multiplex — outbounds”Used at: outbounds[shadowsocks, trojan, vless, vmess].multiplex
Rust: OutboundMultiplex
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
protocol |
string, one of h2mux, smux, yamux |
unset | Supported | sing-box’s multiplex, above the protocol: h2mux, the default as in sing-box, smux or yamux. Or amux, sail’s own, below the protocol, which is to be removed. |
max_connections |
number | unset | Supported | — |
min_streams |
number | unset | Supported | — |
max_streams |
number | unset | Supported | — |
padding |
bool | false |
Supported | — |
brutal |
object → object | unset | Supported | sing-mux only: TCP Brutal, negotiated on each new connection. |
max_accepts |
number | unset | sail extension | amux only. |
concurrency |
number | unset | sail extension | With protocol: amux: the streams a session carries at once |
max_recv_bytes |
number | unset | sail extension | With protocol: amux: the bytes a session receives before it takes no more streams; 0, no limit |
max_lifetime |
number | unset | sail extension | With protocol: amux: the seconds a session takes new streams for; 0, no limit |
Used at: inbounds[hysteria2].obfs, outbounds[hysteria2].obfs
Rust: Obfs · Build: any (feature = "inbound-hysteria2" , feature = "outbound-hysteria2")
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
type |
string, one of salamander, gecko |
required | Supported | — |
obfs[gecko]
Section titled “obfs[gecko]”Used at: inbounds[hysteria2].obfs[gecko], outbounds[hysteria2].obfs[gecko]
Rust: Obfs · Build: any (feature = "inbound-hysteria2" , feature = "outbound-hysteria2")
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
password |
string | "" |
Supported | — |
min_packet_size |
number | — | Error: The packet sizes of the gecko obfuscation: the packets would look otherwise | — |
max_packet_size |
number | — | Error: The packet sizes of the gecko obfuscation: the packets would look otherwise | — |
obfs[salamander]
Section titled “obfs[salamander]”Used at: inbounds[hysteria2].obfs[salamander], outbounds[hysteria2].obfs[salamander]
Rust: Obfs · Build: any (feature = "inbound-hysteria2" , feature = "outbound-hysteria2")
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
password |
string | "" |
Supported | — |
port_mapping
Section titled “port_mapping”Used at: inbounds[hysteria2].realm.port_mapping, outbounds[hysteria2].realm.port_mapping
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
timeout |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
lifetime |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
reality — dns.servers
Section titled “reality — dns.servers”Used at: dns.servers[h3, https, quic, tls].tls.reality
Rust: OutboundReality
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
public_key |
string | — | Error: Not for a dns server | — |
short_id |
string | "" |
Supported | — |
reality — http_clients, route.rule_set
Section titled “reality — http_clients, route.rule_set”Used at: http_clients[].tls.reality, route.rule_set[remote].http_client.tls.reality
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
public_key |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
short_id |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
reality — inbounds
Section titled “reality — inbounds”Used at: inbounds[http, trojan, vless, vmess].tls.reality
Rust: InboundReality
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
handshake |
object → object | required | Supported | — |
private_key |
string | required | Supported | X25519, hex or base64url. |
short_id |
listable-string | required | Supported | — |
max_time_difference |
duration | unset | Supported | How far a client’s clock may be from ours, e.g. 1m. Unset, any time is accepted, as in sing-box. |
server_names |
array of string | [] |
sail extension | A sail extension, Xray’s serverNames and Mihomo’s server-names: more names clients may ask for, beside tls.server_name. |
reality — inbounds (2)
Section titled “reality — inbounds (2)”Used at: inbounds[hysteria2, tuic].tls.reality
Rust: InboundReality
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
handshake |
object → object | required | Supported | — |
private_key |
string | required | Supported | X25519, hex or base64url. |
short_id |
listable-string | required | Supported | — |
max_time_difference |
duration | unset | Supported | How far a client’s clock may be from ours, e.g. 1m. Unset, any time is accepted, as in sing-box. |
reality — inbounds, outbounds
Section titled “reality — inbounds, outbounds”Used at: inbounds[hysteria2].realm.http_client.tls.reality, outbounds[hysteria2].realm.http_client.tls.reality
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
public_key |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
short_id |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
reality — outbounds
Section titled “reality — outbounds”Used at: outbounds[anytls, http, hysteria2, shadowtls, trojan, tuic, vless, vmess].tls.reality
Rust: OutboundReality
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
public_key |
string | required | Supported | — |
short_id |
string | "" |
Supported | — |
tls — http_clients, route.rule_set
Section titled “tls — http_clients, route.rule_set”Used at: http_clients[].tls, route.rule_set[remote].http_client.tls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
engine |
string, one of go, apple, windows |
— | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
disable_sni |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
server_name |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
insecure |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
alpn |
listable-string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
min_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
— | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
max_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
— | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
cipher_suites |
listable-string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
curve_preferences |
listable-string, one of P256, P384, P521, X25519, X25519MLKEM768 |
— | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
certificate |
listable-string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
certificate_path |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
certificate_public_key_sha256 |
listable-string|array | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
client_certificate |
listable-string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
client_certificate_path |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
client_key |
listable-string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
client_key_path |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
fragment |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
fragment_fallback_delay |
duration | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
record_fragment |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
spoof |
string | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
spoof_method |
string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp |
— | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
kernel_tx |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
kernel_rx |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
handshake_timeout |
duration | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
ech |
object → object | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
utls |
object → object | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
reality |
object → object | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
tls — inbounds
Section titled “tls — inbounds”Used at: inbounds[http, trojan, vless, vmess].tls
Rust: InboundTls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
server_name |
string | unset | Supported | The name REALITY clients must ask for, or the one a self_signed certificate is for; otherwise it is ignored with a warning, as sing-box ignores it. |
insecure |
bool | — | Warned: Only relaxes checks a server’s TLS does not make | — |
alpn |
listable-string | unset | Supported | — |
min_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
unset | Supported | The lowest TLS version to accept, 1.0 to 1.3; unset, 1.2. |
max_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
unset | Supported | The highest; unset, 1.3. |
cipher_suites |
listable-string | — | Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked | — |
curve_preferences |
listable-string, one of P256, P384, P521, X25519, X25519MLKEM768 |
— | Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked | — |
certificate |
listable-string | unset | Supported | An inline PEM certificate. |
certificate_path |
string | unset | Supported | — |
client_authentication |
string, one of no, request, require-any, verify-if-given, require-and-verify |
unset | Supported | What is asked of clients’ certificates, as sing-box takes it: no (none is asked for), request or require-any (one is taken unchecked; require-any refuses a client without), verify-if-given or require-and-verify (one is checked, by the CAs or the pins; require-and-verify refuses a client without). Unset is no, or require-and-verify with CAs set. Pins without a verifying mode, and CAs or pins with request or require-any, are errors, where sing-box checks no certificate. |
client_certificate |
listable-string | unset | Supported | The CAs clients’ certificates are verified by, inline PEM: chained to one of them, by the intermediates the client sends, valid, and for client authentication. With client_certificate_path too, the files are ignored with a warning, as sing-box ignores them. |
client_certificate_path |
listable-string | unset | Supported | The CAs, from PEM (or DER) files, as client_certificate. The files are followed as the certificate’s are: CAs written to them are taken for the connections that come next. |
client_certificate_public_key_sha256 |
listable-string|array | unset | Supported | Clients’ certificates taken by the SHA-256 of their public key (SubjectPublicKeyInfo), standard base64, in place of CAs: the leaf alone, no CA or validity period. With client_certificate_sha256, either list passing is enough. Beside CAs, ignored with a warning, as sing-box ignores them. |
key |
listable-string | unset | Supported | An inline PEM key. |
key_path |
string | unset | Supported | — |
kernel_tx |
bool | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
kernel_rx |
bool | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
handshake_timeout |
duration | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
certificate_provider |
string|object | — | Error: A certificate from a provider or ACME: the inbound would have none | — |
ech |
object → object | — | Error: Encrypted Client Hello on an inbound | — |
reality |
object → object | unset | Supported | — |
acme |
object | — | Error: A certificate from a provider or ACME: the inbound would have none (deprecated in sing-box) | — |
client_certificate_sha256 |
string or array of string | unset | sail extension | sing-box 1.15’s, read ahead: clients’ certificates taken by the SHA-256 of the whole leaf (its DER), standard base64 or hex, looked at before client_certificate_public_key_sha256, as that is. |
self_signed |
bool | false |
sail extension | A sail extension: with no certificate or key set, a self-signed one the instance makes, for server_name if set, as Mihomo’s Hysteria2 and TUIC listeners serve one without a certificate. It is made once and kept across reloads that rebuild the inbound in place; clients take it as insecure or by a pin. With a certificate or key, or REALITY, an error. |
tls — inbounds (2)
Section titled “tls — inbounds (2)”Used at: inbounds[hysteria2, tuic].tls
Rust: InboundTls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
server_name |
string | unset | Supported | The name REALITY clients must ask for, or the one a self_signed certificate is for; otherwise it is ignored with a warning, as sing-box ignores it. |
insecure |
bool | — | Warned: Only relaxes checks a server’s TLS does not make | — |
alpn |
listable-string | unset | Supported | — |
min_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
unset | Supported | The lowest TLS version to accept, 1.0 to 1.3; unset, 1.2. |
max_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
unset | Supported | The highest; unset, 1.3. |
cipher_suites |
listable-string | — | Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked | — |
curve_preferences |
listable-string, one of P256, P384, P521, X25519, X25519MLKEM768 |
— | Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked | — |
certificate |
listable-string | unset | Supported | An inline PEM certificate. |
certificate_path |
string | unset | Supported | — |
client_authentication |
string, one of no, request, require-any, verify-if-given, require-and-verify |
unset | Supported | What is asked of clients’ certificates, as sing-box takes it: no (none is asked for), request or require-any (one is taken unchecked; require-any refuses a client without), verify-if-given or require-and-verify (one is checked, by the CAs or the pins; require-and-verify refuses a client without). Unset is no, or require-and-verify with CAs set. Pins without a verifying mode, and CAs or pins with request or require-any, are errors, where sing-box checks no certificate. |
client_certificate |
listable-string | unset | Supported | The CAs clients’ certificates are verified by, inline PEM: chained to one of them, by the intermediates the client sends, valid, and for client authentication. With client_certificate_path too, the files are ignored with a warning, as sing-box ignores them. |
client_certificate_path |
listable-string | unset | Supported | The CAs, from PEM (or DER) files, as client_certificate. The files are followed as the certificate’s are: CAs written to them are taken for the connections that come next. |
client_certificate_public_key_sha256 |
listable-string|array | unset | Supported | Clients’ certificates taken by the SHA-256 of their public key (SubjectPublicKeyInfo), standard base64, in place of CAs: the leaf alone, no CA or validity period. With client_certificate_sha256, either list passing is enough. Beside CAs, ignored with a warning, as sing-box ignores them. |
key |
listable-string | unset | Supported | An inline PEM key. |
key_path |
string | unset | Supported | — |
kernel_tx |
bool | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
kernel_rx |
bool | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
handshake_timeout |
duration | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
certificate_provider |
string|object | — | Error: A certificate from a provider or ACME: the inbound would have none | — |
ech |
object → object | — | Error: Encrypted Client Hello on an inbound | — |
reality |
object → object | unset | Supported | — |
acme |
object | — | Error: A certificate from a provider or ACME: the inbound would have none (deprecated in sing-box) | — |
client_certificate_sha256 |
string or array of string | unset | sail extension | sing-box 1.15’s, read ahead: clients’ certificates taken by the SHA-256 of the whole leaf (its DER), standard base64 or hex, looked at before client_certificate_public_key_sha256, as that is. |
self_signed |
bool | false |
sail extension | A sail extension: with no certificate or key set, a self-signed one the instance makes, for server_name if set, as Mihomo’s Hysteria2 and TUIC listeners serve one without a certificate. It is made once and kept across reloads that rebuild the inbound in place; clients take it as insecure or by a pin. With a certificate or key, or REALITY, an error. |
tls — inbounds, outbounds
Section titled “tls — inbounds, outbounds”Used at: inbounds[hysteria2].realm.http_client.tls, outbounds[hysteria2].realm.http_client.tls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
engine |
string, one of go, apple, windows |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
disable_sni |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
server_name |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
insecure |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
alpn |
listable-string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
min_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
max_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
cipher_suites |
listable-string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
curve_preferences |
listable-string, one of P256, P384, P521, X25519, X25519MLKEM768 |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
certificate |
listable-string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
certificate_path |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
certificate_public_key_sha256 |
listable-string|array | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
client_certificate |
listable-string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
client_certificate_path |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
client_key |
listable-string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
client_key_path |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
fragment |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
fragment_fallback_delay |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
record_fragment |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
spoof |
string | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
spoof_method |
string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
kernel_tx |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
kernel_rx |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
handshake_timeout |
duration | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
ech |
object → object | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
utls |
object → object | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
reality |
object → object | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
tls — outbounds
Section titled “tls — outbounds”Used at: outbounds[anytls, http, shadowtls, trojan, vless, vmess].tls
Rust: OutboundTls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | false |
Supported | — |
engine |
string, one of go, apple, windows |
— | Warned: The TLS stack: sail has one | — |
disable_sni |
bool | false |
Supported | Sends no SNI. The certificate is still verified against server_name, unless insecure. |
server_name |
string | unset | Supported | Defaults to the server’s address. |
insecure |
bool | false |
Supported | — |
alpn |
listable-string | unset | Supported | — |
min_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
unset | Supported | The lowest TLS version to negotiate, 1.0 to 1.3; unset, 1.2. |
max_version |
string, one of 1.0, 1.1, 1.2, 1.3 |
unset | Supported | The highest; unset, 1.3. |
cipher_suites |
listable-string | — | Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked | — |
curve_preferences |
listable-string, one of P256, P384, P521, X25519, X25519MLKEM768 |
— | Error: TLS cipher suites and key exchanges: sail’s TLS would negotiate others than asked | — |
certificate |
listable-string | unset | Supported | An inline PEM certificate to trust. |
certificate_path |
string | unset | Supported | A PEM certificate to trust, by path. |
certificate_public_key_sha256 |
listable-string|array | unset | Supported | The SHA-256 hashes, base64, of the public keys to take a server’s certificate by, in place of the certificates trusted, the name and insecure. |
client_certificate |
listable-string | unset | Supported | An inline PEM certificate, its chain after it, presented when the server asks for one; with client_key. |
client_certificate_path |
string | unset | Supported | client_certificate, by path. |
client_key |
listable-string | unset | Supported | The inline PEM key of the client certificate. |
client_key_path |
string | unset | Supported | client_key, by path. |
fragment |
bool | — | Error: Fragmenting or spoofing the TLS handshake against censorship | — |
fragment_fallback_delay |
duration | — | Error: Fragmenting or spoofing the TLS handshake against censorship | — |
record_fragment |
bool | — | Error: Fragmenting or spoofing the TLS handshake against censorship | — |
spoof |
string | — | Error: Fragmenting or spoofing the TLS handshake against censorship | — |
spoof_method |
string, one of wrong-sequence, wrong-checksum, wrong-ack, wrong-md5, wrong-timestamp |
— | Error: Fragmenting or spoofing the TLS handshake against censorship | — |
kernel_tx |
bool | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
kernel_rx |
bool | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
handshake_timeout |
duration | — | Warned: The TLS stack, kernel TLS and the handshake’s timeout: the same TLS without them | — |
ech |
object → object | unset | Supported | — |
utls |
object → object | unset | Supported | The browser the ClientHello imitates. Unset, it is Chrome’s. |
reality |
object → object | unset | Supported | — |
certificate_sha256 |
string or array of string | unset | sail extension | sing-box 1.15’s, with Mihomo’s fingerprint semantics beyond it: the SHA-256 hashes, hex or base64, of whole certificates (DER) to take a server by, in place of the certificates trusted and insecure. A hash of the server’s own certificate takes it outright: no CA and no name are checked, so that exact certificate is trusted for any server name. A hash of a certificate sent after it, an intermediate or a root, is the only CA the server’s certificate is verified by, with the server name. With certificate_public_key_sha256, either passing is enough. |
transport — inbounds
Section titled “transport — inbounds”Used at: inbounds[trojan, vless, vmess].transport
Rust: InboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
type |
string, one of http, ws, quic, grpc, httpupgrade |
required | Supported | — |
transport — outbounds
Section titled “transport — outbounds”Used at: outbounds[trojan, vless, vmess].transport
Rust: OutboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
type |
string, one of http, ws, quic, grpc, httpupgrade |
required | Supported | — |
transport[grpc] — inbounds
Section titled “transport[grpc] — inbounds”Used at: inbounds[trojan, vless, vmess].transport[grpc]
Rust: InboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
service_name |
string | "TunService" |
Supported | — |
idle_timeout |
duration | unset | Supported | Unset, no keepalive pings. A client pings this often; a server after this long with nothing received, so give a server no shorter a time than its clients’ interval. |
ping_timeout |
duration | unset | Supported | — |
permit_without_stream |
bool | — | Warned: Response headers and keepalive of a WebSocket or gRPC server: the same streams | — |
transport[grpc] — outbounds
Section titled “transport[grpc] — outbounds”Used at: outbounds[trojan, vless, vmess].transport[grpc]
Rust: OutboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
service_name |
string | "TunService" |
Supported | — |
idle_timeout |
duration | unset | Supported | Unset, no keepalive pings. A client pings this often; a server after this long with nothing received, so give a server no shorter a time than its clients’ interval. |
ping_timeout |
duration | unset | Supported | — |
permit_without_stream |
bool | false |
Supported | Whether a connection carrying no calls is pinged too. |
transport[http] — inbounds
Section titled “transport[http] — inbounds”Used at: inbounds[trojan, vless, vmess].transport[http]
Rust: InboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
host |
listable-string | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
path |
string | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
method |
string | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
headers |
map | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
idle_timeout |
duration | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
ping_timeout |
duration | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
transport[http] — outbounds
Section titled “transport[http] — outbounds”Used at: outbounds[trojan, vless, vmess].transport[http]
Rust: OutboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
host |
listable-string | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
path |
string | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
method |
string | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
headers |
map | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
idle_timeout |
duration | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
ping_timeout |
duration | — | Error: Type http (HTTP/2) is not supported, by design; grpc, ws and httpupgrade are | — |
transport[httpupgrade] — inbounds
Section titled “transport[httpupgrade] — inbounds”Used at: inbounds[trojan, vless, vmess].transport[httpupgrade]
Rust: InboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
host |
string | unset | Supported | The Host a request must carry; unset, any. |
path |
string | "/" |
Supported | — |
headers |
map | {} |
Supported | Added to the response. |
transport[httpupgrade] — outbounds
Section titled “transport[httpupgrade] — outbounds”Used at: outbounds[trojan, vless, vmess].transport[httpupgrade]
Rust: OutboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
host |
string | unset | Supported | Unset, the server’s address. |
path |
string | "/" |
Supported | — |
headers |
map | {} |
Supported | — |
transport[ws] — inbounds
Section titled “transport[ws] — inbounds”Used at: inbounds[trojan, vless, vmess].transport[ws]
Rust: InboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
path |
string | "/" |
Supported | — |
headers |
map | — | Warned: Response headers and keepalive of a WebSocket or gRPC server: the same streams | — |
max_early_data |
number | 0 |
Supported | The most early data a client may send in its upgrade request. |
early_data_header_name |
string | unset | Supported | The header it comes in; unset, it comes in the path. |
forwarded_header |
string | unset | sail extension | The header a trusted reverse proxy in front puts the client’s address in, such as X-Forwarded-For. Unset, no header is believed: anyone can send one. |
transport[ws] — outbounds
Section titled “transport[ws] — outbounds”Used at: outbounds[trojan, vless, vmess].transport[ws]
Rust: OutboundTransport
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
path |
string | "/" |
Supported | — |
headers |
map | {} |
Supported | — |
max_early_data |
number | 0 |
Supported | How many of the first bytes to carry in the upgrade request. |
early_data_header_name |
string | unset | Supported | The header they go in; unset, they go in the path. |
udp_over_tcp
Section titled “udp_over_tcp”Used at: outbounds[shadowsocks, socks].udp_over_tcp
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Supported | — |
version |
number, one of 1, 2 |
— | Supported | — |
utls — dns.servers, outbounds
Section titled “utls — dns.servers, outbounds”Used at: dns.servers[https, tls].tls.utls, outbounds[anytls, http, shadowtls, trojan, vless, vmess].tls.utls
Rust: OutboundUtls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | true |
Supported | — |
fingerprint |
string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized |
"chrome" |
Supported | — |
utls — http_clients, route.rule_set
Section titled “utls — http_clients, route.rule_set”Used at: http_clients[].tls.utls, route.rule_set[remote].http_client.tls.utls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
fingerprint |
string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized |
— | Error: TLS options of an HTTP client’s own: its downloads would be checked otherwise | — |
utls — inbounds, outbounds
Section titled “utls — inbounds, outbounds”Used at: inbounds[hysteria2].realm.http_client.tls.utls, outbounds[hysteria2].realm.http_client.tls.utls
| Field | Type | Default | Status | Description |
|---|---|---|---|---|
enabled |
bool | — | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |
fingerprint |
string, one of chrome_psk, chrome_psk_shuffle, chrome_padding_psk_shuffle, chrome_pq, chrome_pq_psk, chrome, firefox, edge, safari, 360, qq, ios, android, random, randomized |
— | Error: Meeting peers through a Hysteria realm: connections would be made otherwise | — |