xray

type API struct {
	Tag      string   `json:"tag"`
	Services []string `json:"services"`
}

type Balancer struct {
	Tag         string            `json:"tag"`
	Selector    []string          `json:"selector"`
	Strategy    *BalancerStrategy `json:"strategy,omitempty"`
	FallbackTag string            `json:"fallbackTag,omitempty"`
}

type BalancerStrategy struct {
	Type string `json:"type"`
}

type Certificate struct {
	CertificateFile string `json:"certificateFile,omitempty"`
	KeyFile         string `json:"keyFile,omitempty"`
}

type Config struct {
	Log         *Log         `json:"log,omitempty"`
	Stats       *Stats       `json:"stats,omitempty"`
	API         *API         `json:"api,omitempty"`
	Policy      *Policy      `json:"policy,omitempty"`
	DNS         *DNS         `json:"dns,omitempty"`
	Inbounds    []Inbound    `json:"inbounds"`
	Outbounds   []Outbound   `json:"outbounds"`
	Routing     *Routing     `json:"routing,omitempty"`
	Observatory *Observatory `json:"observatory,omitempty"`
}

type DNS struct {
	Servers []string `json:"servers,omitempty"`
}

type DokodemoSettings struct {
	Address string `json:"address"`
}

type Fallback struct {
	Path string `json:"path,omitempty"`
	Dest any    `json:"dest"`
	Xver int    `json:"xver,omitempty"`
}

type GRPCSettings struct {
	ServiceName string `json:"serviceName"`
	Authority   string `json:"authority,omitempty"`
	MultiMode   bool   `json:"multiMode,omitempty"`
}

type HTTPInboundSettings struct {
	Accounts []ProxyUser `json:"accounts,omitempty"`
}

type HTTPRequest struct {
	Version string              `json:"version,omitempty"`
	Method  string              `json:"method,omitempty"`
	Path    []string            `json:"path,omitempty"`
	Headers map[string][]string `json:"headers,omitempty"`
}

type HTTPResponse struct {
	Version string              `json:"version,omitempty"`
	Status  string              `json:"status,omitempty"`
	Reason  string              `json:"reason,omitempty"`
	Headers map[string][]string `json:"headers,omitempty"`
}

type HTTPUpgradeSettings struct {
	Path string `json:"path,omitempty"`
	Host string `json:"host,omitempty"`
	// AcceptProxyProtocol reads the real client IP from a PROXY-protocol header
	// prepended by an upstream that forwards to this inbound.
	AcceptProxyProtocol bool `json:"acceptProxyProtocol,omitempty"`
}

type HysteriaClient struct {
	Auth  string `json:"auth"`
	Email string `json:"email,omitempty"`
}

type HysteriaInboundSettings struct {
	Version int              `json:"version"` // must be 2
	Users   []HysteriaClient `json:"users"`
}

type HysteriaSettings struct {
	Version int `json:"version"` // must be 2
}

type Inbound struct {
	Tag            string          `json:"tag,omitempty"`
	Listen         string          `json:"listen,omitempty"`
	Port           int             `json:"port"`
	Protocol       string          `json:"protocol"`
	Settings       any             `json:"settings,omitempty"`
	StreamSettings *StreamSettings `json:"streamSettings,omitempty"`
	Sniffing       *Sniffing       `json:"sniffing,omitempty"`
}

type LevelPolicy struct {
	StatsUserUplink   bool `json:"statsUserUplink"`
	StatsUserDownlink bool `json:"statsUserDownlink"`
	ConnIdle          int  `json:"connIdle,omitempty"`
	BufferSize        int  `json:"bufferSize,omitempty"`
}

type Log struct {
	Loglevel string `json:"loglevel,omitempty"`
}

type Observatory struct {
	SubjectSelector   []string `json:"subjectSelector"`
	ProbeURL          string   `json:"probeUrl,omitempty"`
	ProbeInterval     string   `json:"probeInterval,omitempty"`
	EnableConcurrency bool     `json:"enableConcurrency,omitempty"`
}

type Options struct {
	// PanelDest is where the VLESS default fallback forwards non-proxy traffic
	// (the Go panel's loopback HTTP address, e.g. "127.0.0.1:8080").
	PanelDest string

	// Groups resolves the "iplist:<source>/<group>" routing entries to their
	// domains/CIDRs. Parsed from the on-disk iplist databases and cached by the
	// caller (they only change on a geo refresh). Nil or missing groups simply
	// drop those rules — see expandGroups.
	Groups geo.GroupSet

	// Custom are this server's operator-defined inbounds (already filtered to the
	// enabled ones). Each gets its own listener beside the built-in lanes; none of
	// them share :443, so nothing here can disturb the Vision inbound or the decoy.
	Custom []model.Inbound

	// ServerID is the server this config is for (LocalNodeID for the master), used to
	// resolve per-user access to the built-in lanes. Access maps a user id to what
	// they may connect to; a user absent from it is unrestricted (see model.AccessOf).
	// A nil Access means the feature is off and every user reaches every lane — the
	// historical behaviour.
	ServerID int64
	Access   map[int64]model.Access
}

type Outbound struct {
	Tag      string `json:"tag,omitempty"`
	Protocol string `json:"protocol"`
	Settings any    `json:"settings,omitempty"`
}

type Policy struct {
	Levels map[string]LevelPolicy `json:"levels,omitempty"`
	System *SystemPolicy          `json:"system,omitempty"`
}

type ProxyOutboundSettings struct {
	Servers []ProxyServer `json:"servers"`
}

type ProxyServer struct {
	Address string      `json:"address"`
	Port    int         `json:"port"`
	Users   []ProxyUser `json:"users,omitempty"`
}

type ProxyUser struct {
	User string `json:"user"`
	Pass string `json:"pass"`
}

type RealitySettings struct {
	Show        bool     `json:"show"`
	Dest        string   `json:"dest"`        // "host:port" of the borrowed site
	Xver        int      `json:"xver"`        // PROXY protocol version (0 = off)
	ServerNames []string `json:"serverNames"` // accepted SNIs (the borrowed site)
	PrivateKey  string   `json:"privateKey"`  // X25519 private (base64 raw-url)
	ShortIds    []string `json:"shortIds"`
	// MaxTimeDiff is the anti-replay window in ms: a client whose handshake clock
	// differs by more than this is rejected, so a probe can't replay a captured
	// REALITY auth later. 0 (omitted) disables the check.
	MaxTimeDiff int `json:"maxTimeDiff,omitempty"`
}

type RouteRule struct {
	Type        string   `json:"type"` // always "field"
	InboundTag  []string `json:"inboundTag,omitempty"`
	Domain      []string `json:"domain,omitempty"`
	IP          []string `json:"ip,omitempty"`
	Port        string   `json:"port,omitempty"`
	Network     string   `json:"network,omitempty"` // "tcp,udp" — catch-all matcher
	Protocol    []string `json:"protocol,omitempty"`
	OutboundTag string   `json:"outboundTag,omitempty"`
	BalancerTag string   `json:"balancerTag,omitempty"`
}

type Routing struct {
	DomainStrategy string      `json:"domainStrategy,omitempty"`
	Rules          []RouteRule `json:"rules,omitempty"`
	Balancers      []Balancer  `json:"balancers,omitempty"`
}

type Sniffing struct {
	Enabled      bool     `json:"enabled"`
	DestOverride []string `json:"destOverride,omitempty"`
}

type SocksInboundSettings struct {
	Auth     string      `json:"auth"`
	Accounts []ProxyUser `json:"accounts,omitempty"`
	UDP      bool        `json:"udp"`
}

type Stats struct{}

type StreamSettings struct {
	// Network is the transport: "tcp" | "ws" | "xhttp" | "grpc" | "httpupgrade" |
	// "hysteria".
	Network             string               `json:"network,omitempty"`
	Security            string               `json:"security,omitempty"` // "tls" | "reality" | "" (none)
	TLSSettings         *TLSSettings         `json:"tlsSettings,omitempty"`
	TCPSettings         *TCPSettings         `json:"tcpSettings,omitempty"`
	WSSettings          *WSSettings          `json:"wsSettings,omitempty"`
	XHTTPSettings       *XHTTPSettings       `json:"xhttpSettings,omitempty"`
	HTTPUpgradeSettings *HTTPUpgradeSettings `json:"httpupgradeSettings,omitempty"`
	HysteriaSettings    *HysteriaSettings    `json:"hysteriaSettings,omitempty"`
	RealitySettings     *RealitySettings     `json:"realitySettings,omitempty"`
	GRPCSettings        *GRPCSettings        `json:"grpcSettings,omitempty"`
	// Sockopt is the operator's socket-option block, passed through verbatim. Raw
	// rather than typed: the field set is long, entirely server-local, and validated
	// against a key whitelist before it gets here (model.SockoptKeys), so a typed
	// mirror would be twenty fields of pure transcription with nothing to check.
	Sockopt json.RawMessage `json:"sockopt,omitempty"`
}

type Supervisor struct {
	// contains filtered or unexported fields
}

type SystemPolicy struct {
	StatsInboundUplink    bool `json:"statsInboundUplink"`
	StatsInboundDownlink  bool `json:"statsInboundDownlink"`
	StatsOutboundUplink   bool `json:"statsOutboundUplink"`
	StatsOutboundDownlink bool `json:"statsOutboundDownlink"`
}

type TCPHeader struct {
	Type     string        `json:"type"`
	Request  *HTTPRequest  `json:"request,omitempty"`
	Response *HTTPResponse `json:"response,omitempty"`
}

type TCPSettings struct {
	Header *TCPHeader `json:"header,omitempty"`
}

type TLSSettings struct {
	ServerName       string        `json:"serverName,omitempty"`
	RejectUnknownSni bool          `json:"rejectUnknownSni,omitempty"`
	ALPN             []string      `json:"alpn,omitempty"`
	MinVersion       string        `json:"minVersion,omitempty"`
	Certificates     []Certificate `json:"certificates,omitempty"`

	// Extra are additional tlsSettings keys the operator supplied. Merged at
	// marshal time (see MarshalJSON) rather than stored as a sibling block, because
	// Xray reads one flat tlsSettings object — there is nowhere for a second one to
	// go. Validated against model.TLSExtraKeys before it reaches here, so it cannot
	// contain the fields above that the panel owns.
	Extra json.RawMessage `json:"-"`
}

type Traffic struct {
	Up   int64
	Down int64
}

type TrojanClient struct {
	Password string `json:"password"`
	Email    string `json:"email,omitempty"`
}

type TrojanInboundSettings struct {
	Clients []TrojanClient `json:"clients"`
}

type VLESSClient struct {
	ID    string `json:"id"`             // UUID
	Flow  string `json:"flow,omitempty"` // "xtls-rprx-vision"
	Email string `json:"email,omitempty"`
}

type VLESSInboundSettings struct {
	Clients    []VLESSClient `json:"clients"`
	Decryption string        `json:"decryption"` // always "none" for VLESS
	Fallbacks  []Fallback    `json:"fallbacks,omitempty"`
}

type WSSettings struct {
	Path string `json:"path,omitempty"`
	Host string `json:"host,omitempty"`
	// AcceptProxyProtocol reads the real client IP from a PROXY-protocol header
	// prepended by an upstream that forwards to this inbound.
	AcceptProxyProtocol bool `json:"acceptProxyProtocol,omitempty"`
}

type WireGuardPeer struct {
	PublicKey  string   `json:"publicKey"`
	Endpoint   string   `json:"endpoint"`
	AllowedIPs []string `json:"allowedIPs,omitempty"`
}

type WireGuardSettings struct {
	SecretKey string          `json:"secretKey"`
	Address   []string        `json:"address"`
	Peers     []WireGuardPeer `json:"peers"`
	Reserved  []int           `json:"reserved,omitempty"`
	MTU       int             `json:"mtu,omitempty"`
}

type XHTTPSettings struct {
	Path  string          `json:"path,omitempty"`
	Host  string          `json:"host,omitempty"`
	Mode  string          `json:"mode,omitempty"`
	Extra json.RawMessage `json:"extra,omitempty"`
}