moav-client/config.yaml.example at main · MotherofallVPNs/moav-client · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
proxy:
  socks5_port: 1080
  http_port: 8080
  api_port: 8088
  auth:
    username: ""        # empty = no SOCKS5 auth (loopback default is safe)
    password: ""

subscription:
  # Single-source legacy form. Paste a V2Ray subscription (base64 or plain)
  # in url, or point file at a local subscription.txt. For multiple MoaV
  # servers, prefer importing bundles from the dashboard (Sources → drop .zip),
  # which appends to subscription.sources.
  url: ""
  file: ""
  wireguard_files: []   # wg-quick / AmneziaWG .conf paths, one endpoint each

load_balancing:
  strategy: latency     # latency | priority | weighted
  probe_on_start: true

plugins:
  # Off by default — the only enabled rule out of the box is the Iran-direct
  # one below. Enable torrent-blocking / ad-blocking / etc. from the dashboard
  # Plugins tab (curated templates ship disabled).
  torrent_block: false
  # Kill-switch: when true, the balancer's involuntary direct fallback (used
  # when every endpoint is down) is dropped instead of dialing direct, so the
  # host never leaks an unproxied connection. Explicit `direct` routing rules
  # below are ALWAYS honored — they take priority over the kill-switch.
  block_direct: false
  # Only default-enabled rule: Iranian destinations bypass the proxy and go
  # direct, so domestic traffic keeps your real (Iranian) IP — this avoids both
  # breaking IR sites that block foreign IPs and signalling "this user is on a
  # VPN". Matches IP-literal destinations in geoip/ir.txt; hostname targets are
  # not resolved here (see geoip/README.md). Everything else is proxied.
  routing_rules:
    - match: {type: geoip, value: ir}
      action: direct

# sing-box performs the actual protocol cryptography (VLESS/Reality/Trojan/
# Shadowsocks/Hysteria2/WireGuard). It MUST be enabled or no endpoint can be
# dialed. dial_host is the docker-compose service name; set it to 127.0.0.1
# for a host-mode (non-docker) run.
singbox:
  enabled: true
  listen_host: 0.0.0.0
  dial_host: singbox
  base_port: 10800
  output_path: data/singbox.json

# Xray handles transports sing-box can't (xhttp / splithttp) plus MTProxy.
# Harmless when no such endpoints exist.
xray:
  enabled: true
  listen_host: 0.0.0.0
  dial_host: xray
  base_port: 11800
  output_path: data/xray.json

# Optional SNI-spoofing sidecar. Off by default; enable + set default_fake_sni
# to route TLS endpoints through a decoy ClientHello.
sni_spoof:
  enabled: false
  listen_host: 0.0.0.0
  dial_host: sni-spoof
  base_port: 12800
  output_path: data/sni-spoof.json
  default_fake_sni: ""
  default_utls: chrome

# Optional protocol sidecars. Each needs its own config before it can tunnel,
# so all default to off — enable via install flags (--sidecars) or the
# dashboard. Valid kinds: masterdns, amneziawg, psiphon, trusttunnel, tor.
sidecars:
  masterdns:
    enabled: false
    priority: 1
    config:
      domain: ""        # m.<your-bundle>.<tld>
      method: "5"       # 5 = AES-256-GCM
      key: ""           # encryption key (hex)
  amneziawg:
    enabled: false
    priority: 5
    config:
      source_path: ""   # path to AmneziaWG .conf
  psiphon:
    enabled: false
    priority: 5
    config:
      config_json: ""   # verbatim Psiphon config blob
  trusttunnel:
    enabled: false
    priority: 5
    config:
      source_path: ""   # path to client.toml (needs upstream binary mounted)
  tor:
    enabled: false
    priority: 5