# Self-hosted Clash subscription — BWH LA DC6 CN2 GIA-E
# Served from clash.yifanl.com (Cloudflare-proxied, LE cert). Sole source of truth.
mixed-port: 7897
allow-lan: false
mode: rule
log-level: warning
ipv6: false
find-process-mode: strict
unified-delay: true
tcp-concurrent: true

dns:
  enable: true
  listen: :53
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter-mode: blacklist
  fake-ip-filter:
    - '*.lan'
    - '*.local'
    - '*.arpa'
    - +.bridges2.psc.edu
    - vpn.cmu.edu
  default-nameserver: [223.5.5.5, 1.1.1.1]
  proxy-server-nameserver: [https://223.5.5.5/dns-query]
  nameserver: [https://1.1.1.1/dns-query, https://8.8.8.8/dns-query]
  respect-rules: true

sniffer:
  enable: true
  force-dns-mapping: true
  parse-pure-ip: true

proxies:
  - name: "BWH LA DC6 | CN2 GIA-E | VLESS"
    type: vless
    server: 199.180.115.63
    port: 443
    uuid: 11c774c6-9683-46f4-a51d-ca9850ab9a38
    network: tcp
    udp: true
    tls: true
    flow: xtls-rprx-vision
    servername: www.microsoft.com
    reality-opts:
      public-key: RaTDHDw9P3Syxob-HL0yC4o4x4-V2uRqHJE6SyPI8gU
      short-id: da9e839f5a612200
    client-fingerprint: chrome
  - name: "BWH LA DC6 | CN2 GIA-E | Hy2"
    type: hysteria2
    server: 199.180.115.63
    port: 8443
    password: a8c33b3c13e249ef86ce42c6f52364b0
    alpn: [h3]
    skip-cert-verify: true

proxy-groups:
  - name: 主代理
    type: select
    proxies: ["BWH LA DC6 | CN2 GIA-E | VLESS", "BWH LA DC6 | CN2 GIA-E | Hy2", DIRECT]
  - name: 国内直连
    type: select
    proxies: [DIRECT, "BWH LA DC6 | CN2 GIA-E | VLESS"]

rule-providers:
  ads: {type: http, behavior: domain, format: mrs, interval: 86400, url: "https://cdn.jsdmirror.com/gh/MetaCubeX/meta-rules-dat@meta/geo/geosite/category-ads-all.mrs", path: ./ruleset/ads.mrs}
  private: {type: http, behavior: ipcidr, format: mrs, interval: 86400, url: "https://cdn.jsdmirror.com/gh/MetaCubeX/meta-rules-dat@meta/geo/geoip/private.mrs", path: ./ruleset/private.mrs}
  cn-site: {type: http, behavior: domain, format: mrs, interval: 86400, url: "https://cdn.jsdmirror.com/gh/MetaCubeX/meta-rules-dat@meta/geo/geosite/cn.mrs", path: ./ruleset/cn-site.mrs}
  cn-ip: {type: http, behavior: ipcidr, format: mrs, interval: 86400, url: "https://cdn.jsdmirror.com/gh/MetaCubeX/meta-rules-dat@meta/geo/geoip/cn.mrs", path: ./ruleset/cn-ip.mrs}
  foreign: {type: http, behavior: domain, format: mrs, interval: 86400, url: "https://cdn.jsdmirror.com/gh/MetaCubeX/meta-rules-dat@meta/geo/geosite/geolocation-!cn.mrs", path: ./ruleset/foreign.mrs}

rules:
  # --- Relay targets (CN2 GIA via BWH). These win FIRST, before geo rules. ---
  - DOMAIN-SUFFIX,vpn.cmu.edu,主代理            # CMU VPN gateway
  - DOMAIN-SUFFIX,bridges2.psc.edu,主代理        # PSC Bridges-2
  - IP-CIDR,128.182.81.0/24,主代理,no-resolve    # PSC login nodes
  - IP-CIDR,192.231.243.0/24,主代理,no-resolve   # PSC data movers
  - IP-CIDR,192.168.8.0/24,主代理,no-resolve     # Toronto home LAN (BWH->wg1-home)
  # --- Standard browsing routing ---
  - RULE-SET,private,DIRECT
  - RULE-SET,ads,REJECT
  - RULE-SET,foreign,主代理
  - RULE-SET,cn-site,国内直连
  - RULE-SET,cn-ip,国内直连
  - GEOIP,CN,国内直连
  - MATCH,主代理
