部署

docker-compose.yaml如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
services:
  sub-store:
    image: xream/sub-store
    container_name: sub-store
    restart: always
    ports:
      - "127.0.0.1:3001:3001"
    volumes:
      - /etc/sub-store:/opt/app/data
    environment:
      - SUB_STORE_CRON=55 23 * * *
      - SUB_STORE_FRONTEND_BACKEND_PATH=/xxxxxxxxxxxxxxxxxx # 随机安全路径
    network_mode: bridge

nginx反代：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
server {
    #SSL 默认访问端口号为 443
    listen 443 ssl;
    #请填写绑定证书的域名
    server_name xx.xxx;
    #请填写证书文件的相对路径或绝对路径
    ssl_certificate /etc/nginx/ssl/xxx.crt;
    #请填写私钥文件的相对路径或绝对路径
    ssl_certificate_key /etc/nginx/ssl/xxx.key;
    ssl_session_timeout 5m;
    #请按照以下协议配置
    ssl_protocols TLSv1.2 TLSv1.3;
    #请按照以下套件配置，配置加密套件，写法遵循 openssl 标准。
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;
    location / {
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

节点操作

脚本地址：rename.js

节点前加机场名：

规则

在文件管理配置

规则地址：clash-rules

模板：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
port: 7890
socks-port: 7891
redir-port: 7892
allow-lan: false
mode: Rule
log-level: info
external-controller: 127.0.0.1:9090
secret: "" # 可选，RESTful API 的认证密码

# 代理提供商配置 (Proxy Providers)
proxy-providers:
  provider:
    type: http
    url: "从聚合订阅处复制订阅地址"
    interval: 3600
    path: ./providers/provider.yaml
    health-check:
      enable: true
      interval: 300
      url: http://www.gstatic.com/generate_204


# 代理组 (Proxy Groups)
proxy-groups:
  # 主要代理组 - 用于规则中的 PROXY
  - name: PROXY
    type: select
    use:
      - provider
    proxies:
      - 🔁 自动选择
      - ⚖️ 负载均衡
      - DIRECT

  # Google 服务组
  - name: "GOOGLE"
    type: select
    use:
      - provider
    proxies:
      - 🔁 自动选择
      - ⚖️ 负载均衡

  # Telegram 服务组
  - name: "TELEGRAM"
    type: select
    use:
      - provider
    proxies:
      - 🔁 自动选择

  # Apple 服务组
  - name: "APPLE"
    type: select
    proxies:
      - DIRECT
      - PROXY

  # iCloud 服务组
  - name: "ICLOUD"
    type: select
    proxies:
      - DIRECT
      - PROXY

  # 自动选择组
  - name: "🔁 自动选择"
    type: url-test
    use:
      - provider
    url: 'http://www.gstatic.com/generate_204'
    interval: 300
    tolerance: 50

  # 负载均衡组
  - name: "⚖️ 负载均衡"
    type: load-balance
    use:
      - provider
    url: 'http://www.gstatic.com/generate_204'
    interval: 300
    strategy: consistent-hashing

# 规则
rules:
  - RULE-SET,applications,DIRECT
  - DOMAIN,clash.razord.top,DIRECT
  - DOMAIN,yacd.haishan.me,DIRECT
  - RULE-SET,private,DIRECT
  - RULE-SET,reject,REJECT
  - RULE-SET,icloud,ICLOUD
  - RULE-SET,apple,APPLE
  - RULE-SET,google,GOOGLE
  - RULE-SET,proxy,PROXY
  - RULE-SET,direct,DIRECT
  - RULE-SET,lancidr,DIRECT
  - RULE-SET,cncidr,DIRECT
  - RULE-SET,telegramcidr,TELEGRAM
  - GEOIP,LAN,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

# 规则集 (Rule Providers)
rule-providers:
  reject:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
    path: ./ruleset/reject.yaml
    interval: 86400

  icloud:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/icloud.txt"
    path: ./ruleset/icloud.yaml
    interval: 86400

  apple:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/apple.txt"
    path: ./ruleset/apple.yaml
    interval: 86400

  google:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/google.txt"
    path: ./ruleset/google.yaml
    interval: 86400

  proxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
    path: ./ruleset/proxy.yaml
    interval: 86400

  direct:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
    path: ./ruleset/direct.yaml
    interval: 86400

  private:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt"
    path: ./ruleset/private.yaml
    interval: 86400

  lancidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt"
    path: ./ruleset/lancidr.yaml
    interval: 86400

  cncidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt"
    path: ./ruleset/cncidr.yaml
    interval: 86400

  telegramcidr:
    type: http
    behavior: ipcidr
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/telegramcidr.txt"
    path: ./ruleset/telegramcidr.yaml
    interval: 86400

  applications:
    type: http
    behavior: classical
    url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/applications.txt"
    path: ./ruleset/applications.yaml
    interval: 86400