mirror of
https://github.com/wweir/sower.git
synced 2026-10-20 00:15:34 +00:00
wweir
d0031e4106
The default 128 MiB soft memory limit sits below the ~105 MB live heap the full pexcn rule sets build, so the GC goal gets pinned to the live heap and every allocation triggers a full-heap mark: measured 39% CPU on an otherwise idle gateway with a GC cycle every 300-500 ms. Raise the default to 512 MiB, resolve the limit in a testable helper that covers GOMEMLIMIT/override/disable precedence, and declare the same value in the packaged service plus the example configs so a deployment can tune it without a rebuild.
88 lines
3.9 KiB
TOML
88 lines
3.9 KiB
TOML
# Sower configuration example (TOML format)
|
|
# This is the client configuration for the sower proxy
|
|
#
|
|
# The binary caps its Go heap with a 512 MiB soft memory limit by default; that
|
|
# limit has to stay well above the ~105MB live rule heap, because a limit at
|
|
# that level pins the GC goal to the live heap and burns CPU on every
|
|
# allocation. Override it with SOWER_MEMORY_LIMIT_MB in the service environment
|
|
# (0 disables the soft limit), not with a TOML field.
|
|
|
|
# Logging configuration
|
|
log_level = "info" # Log level: debug, info, warn, error
|
|
|
|
# Remote proxy configuration
|
|
[remote]
|
|
type = "sower" # Proxy type: sower or socks5
|
|
addr = "proxy.example.com" # Proxy server address, optional port for TLS remotes
|
|
password = "your_secure_password" # Proxy password
|
|
|
|
[remote.tls]
|
|
server_name = "" # Override upstream TLS server name (SNI)
|
|
client_hello = "" # Optional uTLS fingerprint: chrome, firefox, ios, android, edge, safari, 360, qq, randomized, randomized_alpn, randomized_no_alpn, golang
|
|
insecure_skip_verify = false # Skip upstream TLS certificate verification
|
|
|
|
# DNS configuration
|
|
[dns]
|
|
disable = false # Disable DNS proxy
|
|
serve = "127.0.0.1" # DNS server IP address
|
|
serve_6 = "" # DNS server IPv6 address (optional)
|
|
serve_iface = "" # Network interface to get IP from (optional)
|
|
upstream = "8.8.8.8" # Upstream DNS server (optional)
|
|
fallback = "223.5.5.5" # Fallback DNS server
|
|
reverse = "" # Reverse DNS for client hostnames in the console (optional, e.g. local dnsmasq)
|
|
|
|
# SOCKS5 proxy configuration
|
|
# aconfig maps Socks5 -> socks_5 for file keys.
|
|
[socks_5]
|
|
disable = false # Disable SOCKS5 proxy
|
|
addr = "127.0.0.1:1080" # SOCKS5 listen address
|
|
|
|
# Admin web server configuration
|
|
# Serves the embedded admin console for runtime rule management and traffic monitoring.
|
|
# Disabled by default; when enabled, set a password or one is generated at startup
|
|
# and printed to the log.
|
|
#
|
|
# Standalone mode (default): admin listens on its own address, e.g. 127.0.0.1:19090.
|
|
# Shared mode: set addr to the DNS HTTP proxy address (dns.serve:80) to serve the
|
|
# admin console and the HTTP proxy from one listener. Requests whose Host equals
|
|
# the listener IP are admin traffic; CONNECT, absolute-form, and other Hosts are
|
|
# proxy traffic. The HTTPS (443) and DNS (53) listeners cannot be shared.
|
|
[admin]
|
|
disable = true # Disable admin web server
|
|
addr = "127.0.0.1:19090" # Admin web server listen address
|
|
password = "your_admin_password" # Admin web server password; empty = random at startup
|
|
session_file = "/etc/sower/sessions.json" # Persist admin sessions for one sower process only
|
|
disable_session_persistence = false # Set true to disable session persistence
|
|
cookie_secure = false # Set true only when a TLS-terminating proxy protects this origin
|
|
state_file = "/etc/sower/admin-state.json" # Persist admin rule/config changes
|
|
|
|
# Router configuration
|
|
[router]
|
|
# Block list rules
|
|
[router.block]
|
|
file = "" # Block list file path (local or remote)
|
|
file_prefix = "**." # Prefix for block list rules
|
|
file_skip_rules = [] # Rules to skip when loading the block list file
|
|
rules = [] # Additional block rules
|
|
|
|
# Direct list rules
|
|
[router.direct]
|
|
file = "" # Direct list file path (local or remote)
|
|
file_prefix = "**." # Prefix for direct list rules
|
|
file_skip_rules = [] # Rules to skip when loading the direct list file
|
|
rules = [] # Additional direct rules
|
|
|
|
# Proxy list rules
|
|
[router.proxy]
|
|
file = "" # Proxy list file path (local or remote)
|
|
file_prefix = "**." # Prefix for proxy list rules
|
|
file_skip_rules = [] # Rules to skip when loading the proxy list file
|
|
rules = [] # Additional proxy rules
|
|
|
|
# Country-based routing
|
|
[router.country]
|
|
mmdb = "" # Optional MMDB file path for GeoIP; empty disables GeoIP lookup
|
|
file = "" # CIDR block list file path
|
|
file_prefix = "" # Prefix for CIDR rules
|
|
rules = [] # Additional CIDR rules
|