AnyTLS

listeners:
- name: anytls-in-1
  type: anytls
  port: 10818
  listen: 0.0.0.0
  # routing-mark: 0 # set routing-mark for listening socket (Linux only)
  # When "shadow-tls", "res-tls", and "jls-config" are all disabled and "allow-insecure" is not true, "certificate" and "private-key" must be filled in; do not fill them in when ShadowTLS, ResTLS, or JLS is enabled
  users:
    username1: password1
    username2: password2
  certificate: ./server.crt # certificate in PEM format, or the path to the certificate
  private-key: ./server.key # corresponding private key in PEM format, or the path to the private key
  # The following two options are for mTLS configuration. If client-auth-type is set to "verify-if-given" or "require-and-verify", client-auth-cert must not be empty
  # client-auth-type: "" # available values: "", "request", "require-any", "verify-if-given", "require-and-verify"
  # client-auth-cert: string # certificate in PEM format, or the path to the certificate
  # If filled, ECH will be enabled (can be generated by `mihomo generate ech-keypair <plaintext-domain>`)
  # ech-key: |
  #   -----BEGIN ECH KEYS-----
  #   ACATwY30o/RKgD6hgeQxwrSiApLaCgU+HKh7B6SUrAHaDwBD/g0APwAAIAAgHjzK
  #   madSJjYQIf9o1N5GXjkW4DEEeb17qMxHdwMdNnwADAABAAEAAQACAAEAAwAIdGVz
  #   dC5jb20AAA==
  #   -----END ECH KEYS-----
  # shadow-tls:
  #   enable: true
  #   version: 3 # supports v1/v2/v3
  #   # password: shadow-tls-password # v2 configuration item
  #   users: # v3 configuration item
  #     - name: shadow-tls-user
  #       password: shadow-tls-password
  #   handshake:
  #     dest: www.example.com:443
  #     # proxy: ""
  # res-tls:
  #   enable: true
  #   dest: www.example.com:443
  #   password: restls-password
  #   # restls-script: ""
  #   # min-record-len: 0
  #   # proxy: ""
  #   # rate-limit: 0 # Bidirectional forwarding rate limit for fallback, in bit/s; 0 means unlimited.
  # jls-config: # JLS replaces standard TLS; unauthenticated connections fall back to dest
  #   enable: true
  #   users:
  #     - username: jls-user
  #       password: jls-password
  #   dest: www.example.com:443
  #   # sni: www.example.com # inferred from dest if left empty
  #   # alpn: [h2, http/1.1]
  #   # proxy: ""
  #   # rate-limit: 0 # fallback forwarding rate limit, in bit/s; 0 means unlimited
  ### NOTE: For anytls listener, if "allow-insecure" is not true, at least one of "certificate and private-key" or "shadow-tls" or "res-tls" or "jls-config" must be filled in ###
  # allow-insecure: false # whether to allow disabling TLS encryption (NOTE: only used when upstreamed by nginx, caddy, etc.)
  padding-scheme: "" # https://github.com/anytls/anytls-go/blob/main/docs/protocol.md#cmdupdatepaddingscheme

General Fields

Caution

If allow-insecure is not true, at least one of certificate and private-key, shadow-tls, res-tls, or jls-config must be configured.

padding-scheme

See https://github.com/anytls/anytls-go/blob/main/docs/protocol.md#cmdupdatepaddingscheme