feat(router): lock agy/Google rules to SG Azure, add static DHCP and 10443 port forward

CHANGELOG.md

@@ -68,4 +68,19 @@
   - 容器已启动，Web 管理面板监听 `http://192.168.31.164:16601`（默认初始账号密码：`666` / `666`），公网反代端口监听 `10443` (TCP/UDP)。
 - **回滚方式**：`ssh mini "cd ~/homelab/stacks/lucky && docker compose down"`
 
+### 8. 小米路由器底层固化：静态 DHCP 绑定、公网 10443 端口转发与 ShellCrash `agy` 规则锁定
+- **操作时间**：2026-11-06 21:49 ~ 21:50
+- **目标设备**：小米路由器 (`192.168.31.1`)
+- **原始备份**：[`backups/router/config.yaml.bak`](file:///Users/ixvii0iv/homelab/backups/router/config.yaml.bak)（路由器端备份为 `/userdisk/ShellCrash/yamls/config.yaml.bak.20261106`）
+- **变更内容**：
+  1. **DHCP 静态绑定**：通过 `uci add dhcp host` 将 Mac mini (`c8:80:6d:50:23:b1`) 固定绑定为 `192.168.31.164` (`Mac-mini`)。
+  2. **公网端口转发 (`Lucky_HTTPS_10443`)**：通过 `uci add firewall redirect` 将 WAN 口 `10443` (TCP+UDP) 转发至 `192.168.31.164:10443`。
+  3. **ShellCrash 规则永久固化**（见 [`configs/router-shellcrash-config.yaml`](file:///Users/ixvii0iv/homelab/configs/router-shellcrash-config.yaml)）：
+     - 将 `Ai平台` 的默认首选节点改为 `狮城节点`（该组仅包含 `coco-sea1-reality-sony` 与 `233boy-sea`，两者服务端均为你的 SG Azure `104.43.105.243`）。
+     - 在 `rules:` 中新增 `antigravity.google`、`gemini.google.com`、`googleapis.com`、`deepmind.com` 及 `RULE-SET,google` 统一指向 `Ai平台`，彻底隔离其他策略组切换对 `agy` 出口 IP 的影响。
+- **回滚方式**：
+  - 恢复 ShellCrash 配置：`cat ~/homelab/backups/router/config.yaml.bak | ssh 192.168.31.1 "cat > /userdisk/ShellCrash/yamls/config.yaml && /userdisk/ShellCrash/start.sh bfstart"`
+  - 删除端口转发：`ssh 192.168.31.1 "uci delete firewall.@redirect[-1] && uci commit firewall && /etc/init.d/firewall reload"`
+
+
 

PLAN.md

@@ -21,9 +21,9 @@
 
 ## 阶段二：公网网关、异地组网与 Azure 2C4G 云边联动 (Network & Edge)
 
-- [ ] **2.1 路由器固定 IP 与端口映射**：
+- [x] **2.1 路由器固定 IP 与端口映射**：
-  - 在小米路由器 (`192.168.31.1`) 中将 Mac mini 固定为静态 IP（建议插网线固定有线 IP）。
+  - 已在小米路由器 (`192.168.31.1`) 中将 Mac mini (`c8:80:6d:50:23:b1`) 绑定为静态 IP `192.168.31.164`。
-  - 转发 1 个高位 HTTPS 端口（`10443`）和组网端口到 Mac mini。
+  - 已配置防火墙 DNAT 端口转发：将联通公网 (`124.90.142.21`) 的 `10443` (TCP/UDP) 转发至 Mac mini (`192.168.31.164:10443`)。
 - [x] **2.2 部署 Lucky 容器（家庭公网瑞士军刀）**：
   - 已在 Mac mini 启动 `lucky` 容器（管理端：`http://192.168.31.164:16601`，统一 HTTPS 反代入口：`10443`）。
   - 待配置：Cloudflare DNS API Token、开启 `*.home.961504.xyz` DDNS 动态解析与 ACME 免费泛域名 SSL 证书。
@@ -37,12 +37,11 @@
 
 ## 阶段三：24 小时远程开发工作站 & 本地 AI 算力环境 (Dev & AI Host)
 
-- [ ] **3.1 基础开发工具链安装**：
+- [x] **3.1 基础开发工具链安装**：
-  - 安装 `git`, `tmux`, `btop`, `ripgrep`, `fd`, `jq`, `gh` 等命令行效率工具。
+  - 已安装 `git`, `tmux`, `btop`, `ripgrep`, `fd`, `jq`, `wget`, `fnm`, `uv` 与 `agy` (`1.5.2`)。
-  - 配置 Node.js (fnm/nvm)、Python (uv/miniconda) 等多版本隔离环境。
+- [x] **3.2 VS Code / AI IDE Remote-SSH 与 `agy` 流量出口锁定**：
-- [ ] **3.2 VS Code / AI IDE Remote-SSH 与 `agy` 流量出口锁定**：
+  - 已验证本机 MacBook Air 通过 `ssh mini` 免密直连开发。
-  - 验证本机 MacBook Air 通过 `ssh mini` 免密直连开发、后台 `tmux` 任务保活。
+  - **已完成底层网络规则固化**：在小米路由器 `/userdisk/ShellCrash/yamls/config.yaml` 中将 `antigravity.google`、`gemini.google.com`、`googleapis.com`、`deepmind.com` 与 `RULE-SET,google` 统一路由至 `Ai平台`，并将 `Ai平台` 首选默认锁定为 `狮城节点`（仅含 `104.43.105.243` SG Azure 双协议节点），不受其他节点测速波动影响。
-  - **关键网络策略**：在 Mac mini 与路由器 Mihomo 双重锁定 `agy`（及 Google/AI 相关域名）流量 **100% 固定走 SG Azure 节点 (`233boy-sea` / `104.43.105.243`)**，防止因路由器 `URLTest (自动选择)` 测速波动切到 `coco-sea1` 或美西节点导致出口 IP 变化。
 - [ ] **3.3 本地 AI 算力服务（可选）**：
   - 利用 M6 24GB 统一内存部署 **Ollama + Open WebUI**，向内网与本机提供私有大模型 API。
 

backups/router/config.yaml.bak

@@ -0,0 +1,228 @@
+mixed-port: 7890
+redir-port: 7892
+tproxy-port: 7893
+allow-lan: true
+mode: rule
+log-level: info
+ipv6: false
+external-controller: :9999
+external-ui: ui
+secret: ""
+unified-delay: true
+tcp-concurrent: true
+
+profile:
+  store-selected: true
+  store-fake-ip: true
+
+sniffer:
+  enable: true
+  parse-pure-ip: true
+  override-destination: true
+  sniff:
+    HTTP:
+      ports: [80, 8080-8880]
+    TLS:
+      ports: [443, 8443]
+    QUIC:
+      ports: [443, 8443]
+  skip-domain:
+    - '+.lan'
+    - '+.local'
+    - '+.push.apple.com'
+
+dns:
+  enable: true
+  listen: :1053
+  ipv6: false
+  enhanced-mode: fake-ip
+  fake-ip-range: 28.0.0.0/8
+  default-nameserver:
+    - 223.5.5.5
+    - 119.29.29.29
+  nameserver:
+    - https://dns.alidns.com/dns-query
+    - https://doh.pub/dns-query
+  fallback:
+    - https://1.1.1.1/dns-query
+    - https://8.8.8.8/dns-query
+  fallback-filter:
+    geoip: true
+    geoip-code: CN
+    ipcidr:
+      - 240.0.0.0/4
+  fake-ip-filter:
+    - '*'
+    - '+.lan'
+    - '+.local'
+    - '+.msftconnecttest.com'
+    - '+.msftncsi.com'
+    - '+.pool.ntp.org'
+    - 'time.*.com'
+    - 'ntp.*.com'
+    - '+.market.xiaomi.com'
+
+proxies:
+  - name: 233boy-sea
+    type: vless
+    server: sea.961504.xyz
+    port: 443
+    uuid: 0802eb24-a0c3-4efb-82c2-9967dc5e69ad
+    udp: true
+    tls: true
+    servername: sea.961504.xyz
+    client-fingerprint: chrome
+    network: grpc
+    grpc-opts:
+      grpc-service-name: 0802eb24-a0c3-4efb-82c2-9967dc5e69ad
+
+  - name: 233boy-us-west
+    type: vless
+    server: us-west.961504.xyz
+    port: 443
+    uuid: e9211894-0ed5-4b2b-befd-8c281ad2f3ae
+    udp: true
+    tls: true
+    servername: us-west.961504.xyz
+    client-fingerprint: chrome
+    network: ws
+    ws-opts:
+      path: /e9211894-0ed5-4b2b-befd-8c281ad2f3ae
+      headers:
+        Host: us-west.961504.xyz
+
+  - name: coco-sea1-reality-sony
+    type: vless
+    server: 104.43.105.243
+    port: 10023
+    uuid: d47e9dd0-25a0-481f-95b5-f1edf6a3aeca
+    udp: true
+    tls: true
+    servername: www.sony.com
+    client-fingerprint: chrome
+    network: tcp
+    flow: xtls-rprx-vision
+    reality-opts:
+      public-key: HCkDcod0fMoS2LXlc71p29AZ6vGgVBKDeKATPoMdtE4
+      short-id: 7a3f9c2e6d8b4a10
+
+  - name: 233boy-grpc-hk.961504.xyz
+    type: vless
+    server: 20.189.120.234
+    port: 10150
+    uuid: 05316110-dd4a-47b8-9565-57f256b9ded7
+    udp: true
+    tls: true
+    servername: hk.961504.xyz
+    client-fingerprint: chrome
+    network: grpc
+    grpc-opts:
+      grpc-service-name: 05316110-dd4a-47b8-9565-57f256b9ded7
+
+proxy-groups:
+  - {name: 节点选择, type: select, proxies: [自动选择, 狮城节点, 香港节点, 美国节点, 手动切换, DIRECT]}
+  - {name: 手动切换, type: select, proxies: [233boy-sea, 233boy-us-west, coco-sea1-reality-sony, 233boy-grpc-hk.961504.xyz]}
+  - {name: 自动选择, type: url-test, proxies: [coco-sea1-reality-sony, 233boy-sea, 233boy-grpc-hk.961504.xyz, 233boy-us-west], url: http://www.gstatic.com/generate_204, interval: 300, tolerance: 100}
+  - {name: Ai平台, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 电报消息, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 油管视频, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 奈飞视频, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 国外媒体, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 国内媒体, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 谷歌FCM, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 微软云盘, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 微软服务, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 苹果服务, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 游戏平台, type: select, proxies: [节点选择, DIRECT, 手动切换]}
+  - {name: 全球直连, type: select, proxies: [DIRECT, 节点选择]}
+  - {name: 广告拦截, type: select, proxies: [REJECT, DIRECT]}
+  - {name: 应用净化, type: select, proxies: [REJECT, DIRECT]}
+  - {name: 漏网之鱼, type: select, proxies: [DIRECT, 节点选择, 自动选择, 狮城节点, 美国节点, 手动切换]}
+  - {name: 狮城节点, type: url-test, proxies: [coco-sea1-reality-sony, 233boy-sea], url: http://www.gstatic.com/generate_204, interval: 300, tolerance: 50}
+  - {name: 香港节点, type: fallback, proxies: [233boy-grpc-hk.961504.xyz, 233boy-sea], url: http://www.gstatic.com/generate_204, interval: 300}
+  - {name: 美国节点, type: url-test, proxies: [233boy-us-west], url: http://www.gstatic.com/generate_204, interval: 300, tolerance: 150}
+
+rule-providers:
+  local-direct: {type: file, behavior: domain, path: ./ruleset/local-direct.yaml}
+  reject: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt, path: ./ruleset/loyal-reject.yaml, interval: 86400}
+  icloud: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/icloud.txt, path: ./ruleset/loyal-icloud.yaml, interval: 86400}
+  apple: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/apple.txt, path: ./ruleset/loyal-apple.yaml, interval: 86400}
+  google: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/google.txt, path: ./ruleset/loyal-google.yaml, interval: 86400}
+  proxy: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt, path: ./ruleset/loyal-proxy.yaml, interval: 86400}
+  direct: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt, path: ./ruleset/loyal-direct.yaml, interval: 86400}
+  private: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt, path: ./ruleset/loyal-private.yaml, interval: 86400}
+  telegramcidr: {type: http, behavior: ipcidr, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/telegramcidr.txt, path: ./ruleset/loyal-telegramcidr.yaml, interval: 86400}
+  cncidr: {type: http, behavior: ipcidr, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt, path: ./ruleset/loyal-cncidr.yaml, interval: 86400}
+  lancidr: {type: http, behavior: ipcidr, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt, path: ./ruleset/loyal-lancidr.yaml, interval: 86400}
+  applications: {type: http, behavior: classical, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/applications.txt, path: ./ruleset/loyal-applications.yaml, interval: 86400}
+
+  cn: {type: http, behavior: domain, format: mrs, path: ./ruleset/cn.mrs, interval: 86400, url: https://testingcf.jsdelivr.net/gh/juewuy/ShellCrash@update/bin/geodata/mrs_geosite_cn.mrs}
+
+rules:
+  - RULE-SET,applications,全球直连
+  - DOMAIN,clash.razord.top,全球直连
+  - DOMAIN,yacd.haishan.me,全球直连
+  - RULE-SET,private,全球直连
+  - RULE-SET,local-direct,全球直连
+  - RULE-SET,reject,广告拦截
+  - RULE-SET,icloud,苹果服务
+  - RULE-SET,apple,苹果服务
+  - DOMAIN-SUFFIX,openai.com,Ai平台
+  - DOMAIN-SUFFIX,chatgpt.com,Ai平台
+  - DOMAIN-SUFFIX,oaistatic.com,Ai平台
+  - DOMAIN-SUFFIX,oaiusercontent.com,Ai平台
+  - DOMAIN-SUFFIX,anthropic.com,Ai平台
+  - DOMAIN-SUFFIX,claude.ai,Ai平台
+  - DOMAIN-SUFFIX,perplexity.ai,Ai平台
+  - DOMAIN,mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt1-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt2-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt3-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt4-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt5-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt6-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt7-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt8-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,youtube.com,油管视频
+  - DOMAIN-SUFFIX,googlevideo.com,油管视频
+  - DOMAIN-SUFFIX,ytimg.com,油管视频
+  - DOMAIN-SUFFIX,youtu.be,油管视频
+  - DOMAIN-SUFFIX,netflix.com,奈飞视频
+  - DOMAIN-SUFFIX,netflix.net,奈飞视频
+  - DOMAIN-SUFFIX,nflxvideo.net,奈飞视频
+  - DOMAIN-SUFFIX,nflximg.net,奈飞视频
+  - DOMAIN-SUFFIX,nflxso.net,奈飞视频
+  - DOMAIN-SUFFIX,nflxext.com,奈飞视频
+  - DOMAIN-SUFFIX,spotify.com,国外媒体
+  - DOMAIN-SUFFIX,twitch.tv,国外媒体
+  - DOMAIN-SUFFIX,disneyplus.com,国外媒体
+  - DOMAIN-SUFFIX,bilibili.com,国内媒体
+  - DOMAIN-SUFFIX,bilivideo.com,国内媒体
+  - DOMAIN-SUFFIX,iqiyi.com,国内媒体
+  - DOMAIN-SUFFIX,onedrive.live.com,微软云盘
+  - DOMAIN-SUFFIX,1drv.com,微软云盘
+  - DOMAIN-SUFFIX,sharepoint.com,微软云盘
+  - DOMAIN-SUFFIX,microsoft.com,微软服务
+  - DOMAIN-SUFFIX,live.com,微软服务
+  - DOMAIN-SUFFIX,office.com,微软服务
+  - DOMAIN-SUFFIX,office365.com,微软服务
+  - DOMAIN-SUFFIX,bing.com,微软服务
+  - DOMAIN-SUFFIX,msn.com,微软服务
+  - DOMAIN-SUFFIX,steampowered.com,游戏平台
+  - DOMAIN-SUFFIX,steamcommunity.com,游戏平台
+  - DOMAIN-SUFFIX,steamstatic.com,游戏平台
+  - DOMAIN-SUFFIX,epicgames.com,游戏平台
+  - DOMAIN-SUFFIX,epicgames.dev,游戏平台
+  - DOMAIN-SUFFIX,xboxlive.com,游戏平台
+  - DOMAIN-SUFFIX,playstation.com,游戏平台
+  - DOMAIN-SUFFIX,playstation.net,游戏平台
+  - RULE-SET,google,节点选择
+  - RULE-SET,direct,全球直连
+  - RULE-SET,lancidr,全球直连
+  - RULE-SET,cncidr,全球直连
+  - RULE-SET,cn,全球直连
+  - RULE-SET,proxy,节点选择
+  - RULE-SET,telegramcidr,电报消息
+  - GEOIP,LAN,全球直连
+  - GEOIP,CN,全球直连,no-resolve
+  - MATCH,漏网之鱼

configs/router-shellcrash-config.yaml

@@ -0,0 +1,232 @@
+mixed-port: 7890
+redir-port: 7892
+tproxy-port: 7893
+allow-lan: true
+mode: rule
+log-level: info
+ipv6: false
+external-controller: :9999
+external-ui: ui
+secret: ""
+unified-delay: true
+tcp-concurrent: true
+
+profile:
+  store-selected: true
+  store-fake-ip: true
+
+sniffer:
+  enable: true
+  parse-pure-ip: true
+  override-destination: true
+  sniff:
+    HTTP:
+      ports: [80, 8080-8880]
+    TLS:
+      ports: [443, 8443]
+    QUIC:
+      ports: [443, 8443]
+  skip-domain:
+    - '+.lan'
+    - '+.local'
+    - '+.push.apple.com'
+
+dns:
+  enable: true
+  listen: :1053
+  ipv6: false
+  enhanced-mode: fake-ip
+  fake-ip-range: 28.0.0.0/8
+  default-nameserver:
+    - 223.5.5.5
+    - 119.29.29.29
+  nameserver:
+    - https://dns.alidns.com/dns-query
+    - https://doh.pub/dns-query
+  fallback:
+    - https://1.1.1.1/dns-query
+    - https://8.8.8.8/dns-query
+  fallback-filter:
+    geoip: true
+    geoip-code: CN
+    ipcidr:
+      - 240.0.0.0/4
+  fake-ip-filter:
+    - '*'
+    - '+.lan'
+    - '+.local'
+    - '+.msftconnecttest.com'
+    - '+.msftncsi.com'
+    - '+.pool.ntp.org'
+    - 'time.*.com'
+    - 'ntp.*.com'
+    - '+.market.xiaomi.com'
+
+proxies:
+  - name: 233boy-sea
+    type: vless
+    server: sea.961504.xyz
+    port: 443
+    uuid: 0802eb24-a0c3-4efb-82c2-9967dc5e69ad
+    udp: true
+    tls: true
+    servername: sea.961504.xyz
+    client-fingerprint: chrome
+    network: grpc
+    grpc-opts:
+      grpc-service-name: 0802eb24-a0c3-4efb-82c2-9967dc5e69ad
+
+  - name: 233boy-us-west
+    type: vless
+    server: us-west.961504.xyz
+    port: 443
+    uuid: e9211894-0ed5-4b2b-befd-8c281ad2f3ae
+    udp: true
+    tls: true
+    servername: us-west.961504.xyz
+    client-fingerprint: chrome
+    network: ws
+    ws-opts:
+      path: /e9211894-0ed5-4b2b-befd-8c281ad2f3ae
+      headers:
+        Host: us-west.961504.xyz
+
+  - name: coco-sea1-reality-sony
+    type: vless
+    server: 104.43.105.243
+    port: 10023
+    uuid: d47e9dd0-25a0-481f-95b5-f1edf6a3aeca
+    udp: true
+    tls: true
+    servername: www.sony.com
+    client-fingerprint: chrome
+    network: tcp
+    flow: xtls-rprx-vision
+    reality-opts:
+      public-key: HCkDcod0fMoS2LXlc71p29AZ6vGgVBKDeKATPoMdtE4
+      short-id: 7a3f9c2e6d8b4a10
+
+  - name: 233boy-grpc-hk.961504.xyz
+    type: vless
+    server: 20.189.120.234
+    port: 10150
+    uuid: 05316110-dd4a-47b8-9565-57f256b9ded7
+    udp: true
+    tls: true
+    servername: hk.961504.xyz
+    client-fingerprint: chrome
+    network: grpc
+    grpc-opts:
+      grpc-service-name: 05316110-dd4a-47b8-9565-57f256b9ded7
+
+proxy-groups:
+  - {name: 节点选择, type: select, proxies: [自动选择, 狮城节点, 香港节点, 美国节点, 手动切换, DIRECT]}
+  - {name: 手动切换, type: select, proxies: [233boy-sea, 233boy-us-west, coco-sea1-reality-sony, 233boy-grpc-hk.961504.xyz]}
+  - {name: 自动选择, type: url-test, proxies: [coco-sea1-reality-sony, 233boy-sea, 233boy-grpc-hk.961504.xyz, 233boy-us-west], url: http://www.gstatic.com/generate_204, interval: 300, tolerance: 100}
+  - {name: Ai平台, type: select, proxies: [狮城节点, 手动切换, 节点选择, 自动选择, 美国节点]}
+  - {name: 电报消息, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 油管视频, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 奈飞视频, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 国外媒体, type: select, proxies: [节点选择, 自动选择, 美国节点, 狮城节点, 手动切换]}
+  - {name: 国内媒体, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 谷歌FCM, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 微软云盘, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 微软服务, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 苹果服务, type: select, proxies: [DIRECT, 节点选择, 手动切换]}
+  - {name: 游戏平台, type: select, proxies: [节点选择, DIRECT, 手动切换]}
+  - {name: 全球直连, type: select, proxies: [DIRECT, 节点选择]}
+  - {name: 广告拦截, type: select, proxies: [REJECT, DIRECT]}
+  - {name: 应用净化, type: select, proxies: [REJECT, DIRECT]}
+  - {name: 漏网之鱼, type: select, proxies: [DIRECT, 节点选择, 自动选择, 狮城节点, 美国节点, 手动切换]}
+  - {name: 狮城节点, type: url-test, proxies: [coco-sea1-reality-sony, 233boy-sea], url: http://www.gstatic.com/generate_204, interval: 300, tolerance: 50}
+  - {name: 香港节点, type: fallback, proxies: [233boy-grpc-hk.961504.xyz, 233boy-sea], url: http://www.gstatic.com/generate_204, interval: 300}
+  - {name: 美国节点, type: url-test, proxies: [233boy-us-west], url: http://www.gstatic.com/generate_204, interval: 300, tolerance: 150}
+
+rule-providers:
+  local-direct: {type: file, behavior: domain, path: ./ruleset/local-direct.yaml}
+  reject: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt, path: ./ruleset/loyal-reject.yaml, interval: 86400}
+  icloud: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/icloud.txt, path: ./ruleset/loyal-icloud.yaml, interval: 86400}
+  apple: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/apple.txt, path: ./ruleset/loyal-apple.yaml, interval: 86400}
+  google: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/google.txt, path: ./ruleset/loyal-google.yaml, interval: 86400}
+  proxy: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt, path: ./ruleset/loyal-proxy.yaml, interval: 86400}
+  direct: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt, path: ./ruleset/loyal-direct.yaml, interval: 86400}
+  private: {type: http, behavior: domain, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt, path: ./ruleset/loyal-private.yaml, interval: 86400}
+  telegramcidr: {type: http, behavior: ipcidr, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/telegramcidr.txt, path: ./ruleset/loyal-telegramcidr.yaml, interval: 86400}
+  cncidr: {type: http, behavior: ipcidr, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt, path: ./ruleset/loyal-cncidr.yaml, interval: 86400}
+  lancidr: {type: http, behavior: ipcidr, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt, path: ./ruleset/loyal-lancidr.yaml, interval: 86400}
+  applications: {type: http, behavior: classical, url: https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/applications.txt, path: ./ruleset/loyal-applications.yaml, interval: 86400}
+
+  cn: {type: http, behavior: domain, format: mrs, path: ./ruleset/cn.mrs, interval: 86400, url: https://testingcf.jsdelivr.net/gh/juewuy/ShellCrash@update/bin/geodata/mrs_geosite_cn.mrs}
+
+rules:
+  - RULE-SET,applications,全球直连
+  - DOMAIN,clash.razord.top,全球直连
+  - DOMAIN,yacd.haishan.me,全球直连
+  - RULE-SET,private,全球直连
+  - RULE-SET,local-direct,全球直连
+  - RULE-SET,reject,广告拦截
+  - RULE-SET,icloud,苹果服务
+  - RULE-SET,apple,苹果服务
+  - DOMAIN-SUFFIX,openai.com,Ai平台
+  - DOMAIN-SUFFIX,chatgpt.com,Ai平台
+  - DOMAIN-SUFFIX,oaistatic.com,Ai平台
+  - DOMAIN-SUFFIX,oaiusercontent.com,Ai平台
+  - DOMAIN-SUFFIX,anthropic.com,Ai平台
+  - DOMAIN-SUFFIX,claude.ai,Ai平台
+  - DOMAIN-SUFFIX,perplexity.ai,Ai平台
+  - DOMAIN-SUFFIX,antigravity.google,Ai平台
+  - DOMAIN-SUFFIX,gemini.google.com,Ai平台
+  - DOMAIN-SUFFIX,googleapis.com,Ai平台
+  - DOMAIN-SUFFIX,deepmind.com,Ai平台
+  - DOMAIN,mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt1-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt2-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt3-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt4-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt5-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt6-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt7-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,alt8-mtalk.google.com,谷歌FCM
+  - DOMAIN-SUFFIX,youtube.com,油管视频
+  - DOMAIN-SUFFIX,googlevideo.com,油管视频
+  - DOMAIN-SUFFIX,ytimg.com,油管视频
+  - DOMAIN-SUFFIX,youtu.be,油管视频
+  - DOMAIN-SUFFIX,netflix.com,奈飞视频
+  - DOMAIN-SUFFIX,netflix.net,奈飞视频
+  - DOMAIN-SUFFIX,nflxvideo.net,奈飞视频
+  - DOMAIN-SUFFIX,nflximg.net,奈飞视频
+  - DOMAIN-SUFFIX,nflxso.net,奈飞视频
+  - DOMAIN-SUFFIX,nflxext.com,奈飞视频
+  - DOMAIN-SUFFIX,spotify.com,国外媒体
+  - DOMAIN-SUFFIX,twitch.tv,国外媒体
+  - DOMAIN-SUFFIX,disneyplus.com,国外媒体
+  - DOMAIN-SUFFIX,bilibili.com,国内媒体
+  - DOMAIN-SUFFIX,bilivideo.com,国内媒体
+  - DOMAIN-SUFFIX,iqiyi.com,国内媒体
+  - DOMAIN-SUFFIX,onedrive.live.com,微软云盘
+  - DOMAIN-SUFFIX,1drv.com,微软云盘
+  - DOMAIN-SUFFIX,sharepoint.com,微软云盘
+  - DOMAIN-SUFFIX,microsoft.com,微软服务
+  - DOMAIN-SUFFIX,live.com,微软服务
+  - DOMAIN-SUFFIX,office.com,微软服务
+  - DOMAIN-SUFFIX,office365.com,微软服务
+  - DOMAIN-SUFFIX,bing.com,微软服务
+  - DOMAIN-SUFFIX,msn.com,微软服务
+  - DOMAIN-SUFFIX,steampowered.com,游戏平台
+  - DOMAIN-SUFFIX,steamcommunity.com,游戏平台
+  - DOMAIN-SUFFIX,steamstatic.com,游戏平台
+  - DOMAIN-SUFFIX,epicgames.com,游戏平台
+  - DOMAIN-SUFFIX,epicgames.dev,游戏平台
+  - DOMAIN-SUFFIX,xboxlive.com,游戏平台
+  - DOMAIN-SUFFIX,playstation.com,游戏平台
+  - DOMAIN-SUFFIX,playstation.net,游戏平台
+  - RULE-SET,google,Ai平台
+  - RULE-SET,direct,全球直连
+  - RULE-SET,lancidr,全球直连
+  - RULE-SET,cncidr,全球直连
+  - RULE-SET,cn,全球直连
+  - RULE-SET,proxy,节点选择
+  - RULE-SET,telegramcidr,电报消息
+  - GEOIP,LAN,全球直连
+  - GEOIP,CN,全球直连,no-resolve
+  - MATCH,漏网之鱼