% set OnProxyIssue='DIRECT' if typ =="lite" else 'REJECT'
% set OnIranSites='PROXY' if typ =="all" else 'DIRECT'
% set OnNotFilteredSites='DIRECT' if typ =="lite" else 'PROXY'

mixed-port: 7890
allow-lan: false
log-level: info
secret: 
external-controller: 127.0.0.1:9090
# ipv6: false
ipv6: true
% if meta_or_normal=='meta'
global-client-fingerprint: {{hconfig(ConfigEnum.utls)}}
% endif
mode: rule
dns:
  enable: true
  use-hosts: true
  # ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  listen: 127.0.0.1:6868
  % if meta_or_normal=='meta'
  prefer-h3: true #Enable DoH support for HTTP/3,
  % endif
  fake-ip-filter:
     - '{{domain}}'
     - '{{hconfigs[ConfigEnum.telegram_fakedomain]}}'
  default-nameserver:
    - 1.1.1.1
    - 8.8.8.8
    - 1.0.0.1
  nameserver:
#    - https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/dns/dns-query
% if meta_or_normal=='meta'
    - https://8.8.8.8/dns-query#h3=true
    - https://1.1.1.1/dns-query#PROXY
    - https://8.8.8.8/dns-query#PROXY
    - https://1.0.0.1/dns-query#PROXY
    #- https://8.8.8.8/dns-query#PROXY&h3=true
    
% endif
    - 8.8.8.8
    - 1.1.1.1
profile:
  # Storing select records
  store-selected: true

proxy-groups:
  - name: PROXY
    proxies:
      #- {{"auto" if OnProxyIssue=='DIRECT' else "automatic"}}
      - load-balance     
      - automatic
      - sequential 
      % for d in  domains
      % if hconfig(ConfigEnum.tuic_enable) and d.mode !="cdn" and meta_or_normal=='meta'
      - "tuic-{{d.alias or d.domain}}"
      %endif
      - "{{d.alias or d.domain}}"
      # - "auto-{{d.alias or d.domain}}"
      # - "sequential-{{d.alias or d.domain}}"
      # - "load-balance-{{d.alias or d.domain}}"
      % endfor
    use:
      - all_proxies
    type: select


  

  



% for d in  domains
  - name: "{{d.alias or d.domain}}"
    proxies:
        - "load-balance-{{d.alias or d.domain}}"
        - "auto-{{d.alias or d.domain}}"
        - "sequential-{{d.alias or d.domain}}"
        % if hconfig(ConfigEnum.tuic_enable) and d.mode !="cdn" and meta_or_normal=='meta'
        - "tuic-{{d.alias or d.domain}}"
        %endif
    use:
      - "P{{d.alias or d.domain}}"
    type: select
%endfor

  - name: automatic
    type: fallback
    url: 'http://cp.cloudflare.com'
    interval: 300
    proxies:
        - "load-balance"
        - auto
        - sequential
        - {{OnProxyIssue}}
    lazy: true


  - name: "load-balance"
    proxies:
    % for d in  domains
      - "{{d.alias or d.domain}}"
    %endfor
    # use:
    #   - all_proxies
    type: load-balance
    url: http://cp.cloudflare.com
    interval: 300
    lazy: true    
    strategy: consistent-hashing




  - name: sequential
    type: fallback
    url: 'http://cp.cloudflare.com'
    interval: 300
    proxies:
    % for d in  domains
      - "sequential-{{d.alias or d.domain}}"
    %endfor    
    # use:
    #   - all_proxies   

  - name: auto
    proxies:
% for d in  domains
      - "auto-{{d.alias or d.domain}}"
%endfor
    # use:
    #   - all_proxies

    type: url-test
    url: http://cp.cloudflare.com
    interval: 300
    tolerance: 150
    lazy: true


% for d in domains
% if hconfig(ConfigEnum.tuic_enable) and d.mode !="cdn" and meta_or_normal=='meta'
  - name: "tuic-{{d.alias or d.domain}}"
    type: relay
    proxies:
      - internal-not-usable-tuic-{{d.alias or d.domain}}
      - internal-not-usable-tuic-ss

%endif


  - name: "auto-{{d.alias or d.domain}}"
    use:
      - "P{{d.alias or d.domain}}"
    type: url-test
    url: http://cp.cloudflare.com
    interval: 300
    tolerance: 150
    lazy: true

  - name: "load-balance-{{d.alias or d.domain}}"
    use:
      - "P{{d.alias or d.domain}}"
    type: load-balance
    url: http://cp.cloudflare.com
    interval: 300
    lazy: true    
    strategy: consistent-hashing

  - name: "sequential-{{d.alias or d.domain}}"
    type: fallback
    url: 'http://cp.cloudflare.com'
    interval: 300
    use:
      - "P{{d.alias or d.domain}}"
  %endfor

         

{#link_maker.get_all_clash_configs(meta_or_normal,domains)#}

proxy-providers:
  all_proxies:
    type: http
    url: "https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/{{(user.uuid)}}/clash/{{meta_or_normal}}/proxies.yml?mode={{mode}}&{{hash}}"
    path: {{domain}}/{{(user.uuid)}}-{{meta_or_normal}}-proxies{{hash}}.yaml
    health-check:
      enable: true
      interval: 600
      url: http://www.gstatic.com/generate_204    
  % for d in  domains
  "P{{d.alias or d.domain}}":
    type: http
    url: "https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/{{(user.uuid)}}/clash/{{meta_or_normal}}/proxies.yml?mode={{mode}}&domain={{d.domain}}&{{hash}}"
    path: {{domain}}/{{(user.uuid)}}-{{meta_or_normal}}-{{d.domain}}-proxies{{hash}}.yaml
    health-check:
      enable: true
      interval: 600
      url: http://www.gstatic.com/generate_204    
  %endfor

% if hconfig(ConfigEnum.tuic_enable) and meta_or_normal=='meta'
proxies:
  - name: "internal-not-usable-tuic-ss"
    type: ss
    server: 127.0.0.1
    port: 3005
    cipher: chacha20-ietf-poly1305
    password: {{g.user_uuid}}
    udp_over_tcp: true  
% for d in  domains    
% if hconfig(ConfigEnum.tuic_enable) and d.mode !="cdn" and meta_or_normal=='meta'
  - name: internal-not-usable-tuic-{{d.alias or d.domain}}
    server: {{d.domain}}
    port: 3478 
    type: tuic
    token: {{hconfig(ConfigEnum.proxy_path,d.child_id)}}
    # ip: 127.0.0.1 # for overwriting the DNS lookup result of the server address set in option 'server'
    heartbeat-interval: 10000
    alpn: [h3]
    # disable-sni: true
    reduce-rtt: true
    request-timeout: 8000
    udp-relay-mode: quic # Available: "native", "quic". Default: "native"
    congestion-controller: bbr # Available: "cubic", "new_reno", "bbr". Default: "cubic"
    max-udp-relay-packet-size: 1300
    # fast-open: true
    skip-cert-verify: true
    # max-open-streams: 20 # default 100, too many open streams may hurt performance
%endif
%endfor
%endif
rule-providers:

  blocked:
    type: http
    behavior: classical
    url: "https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/clash/rules/blocked-sites.yml"
    path: ./ruleset/blocked.yaml
    interval: 432000

  tmpblocked:
    type: http
    behavior: classical
    url: "https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/clash/rules/tmp-blocked-sites.yml"
    path: ./ruleset/tmpblocked.yaml
    interval: 432000

  open:
    type: http
    behavior: classical
    url: "https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/clash/rules/open-sites.yml"
    path: ./ruleset/open.yaml
    interval: 432000    

  # ads:
  #   type: http
  #   behavior: classical
  #   url: "https://{{domain}}/{{hconfigs[ConfigEnum.proxy_path]}}/clash/rules/ads-sites.yml"
  #   path: ./ruleset/ads.yaml
  #   interval: 432000   

rules:
  - DOMAIN,{{hconfigs[ConfigEnum.telegram_fakedomain]}},DIRECT
  # - DOMAIN,{{domain}},DIRECT
  # - DOMAIN,{{direct_host}},DIRECT
  # - IP-CIDR,{{external_ip}}/32,DIRECT
  - IP-CIDR,10.10.34.0/24,PROXY
  - RULE-SET,tmpblocked,PROXY
  - RULE-SET,blocked,PROXY
  # - IP-CIDR,10.10.34.0/24,{{OnProxyIssue}}
  # - RULE-SET,tmpblocked,{{OnProxyIssue}}
  # - RULE-SET,blocked,{{OnProxyIssue}}
  - GEOIP,IR,{{OnIranSites}}
  - DOMAIN-SUFFIX,.ir,{{OnIranSites}}
  - RULE-SET,open,{{OnIranSites}}
  # - RULE-SET,ads,REJECT
  - MATCH,{{OnNotFilteredSites}}


tun:
  enable: true
  stack: system # or gvisor
  dns-hijack:
    - any:53
  auto-redir: true
  auto-route: true
  auto-detect-interface: true