配置文件¶

GOST配置文件使用yaml或json格式，完整的配置文件的结构如下：

yaml格式json格式

services:
- name: service-0
  addr: ":8080"
  interface: eth0
  sockopts:
    mark: 1
  admission: admission-0
  bypass: bypass-0
  resolver: resolver-0
  hosts: hosts-0
  handler:
    type: http
    auth:
      username: user
      password: pass
    auther: auther-0
    chain: chain-0
    retries: 1
    metadata: 
      foo: bar
      bar: baz
  listener:
    type: tcp
    auth:
      username: user
      password: pass
    auther: auther-0
    chain: chain-0
    tls:
      certFile: cert.pem
      keyFile: key.pem
      caFile: ca.pem
    metadata:
      abc: xyz
      def: 456
  forwarder:
    nodes:
    - name: target-0
      addr: 192.168.1.1:1234
    - name: target-1
      addr: 192.168.1.2:2345
    selector:
      strategy: rand
      maxFails: 1
      failTimeout: 30s

chains:
- name: chain-0
  selector:
    strategy: round
    maxFails: 1
    failTimeout: 30s
  hops:
  - name: hop-0
    interface: 192.168.1.2
    sockopts:
      mark: 1
    selector:
      strategy: rand
      maxFails: 3
      failTimeout: 60s
    bypass: bypass-0
    nodes:
    - name: node-0
      addr: ":1080"
      interface: eth1
      sockopts:
        mark: 1
      bypass: bypass-0
      connector:
        type: socks5
        auth:
          username: user
          password: pass
        metadata:
          foo: bar
      dialer:
        type: tcp
        auth:
          username: user
          password: pass
        tls:
          caFile: "ca.pem"
          secure: true
          serverName: "example.com"
        metadata:
          bar: baz 

tls:
  certFile: "cert.pem"
  keyFile: "key.pem"
  caFile: "ca.pem"

authers:
- name: auther-0
  auths:
  - username: user1
    password: pass1
  - username: user2
    password: pass2

admissions:
- name: admission-0
  whitelist: false
  matchers:
  - 127.0.0.1
  - 192.168.0.0/16

bypasses:
- name: bypass-0
  whitelist: false
  matchers:
  - "*.example.com"
  - .example.org
  - 0.0.0.0/8

resolvers:
- name: resolver-0
  nameservers:
  - addr: udp://8.8.8.8:53
    chain: chain-0
    ttl: 60s
    prefer: ipv4
    clientIP: 1.2.3.4
    timeout: 3s
  - addr: tcp://1.1.1.1:53
  - addr: tls://1.1.1.1:853
  - addr: https://1.0.0.1/dns-query
    hostname: cloudflare-dns.com

hosts:
- name: hosts-0
  mappings:
  - ip: 127.0.0.1
    hostname: localhost
  - ip: 192.168.1.10
    hostname: foo.mydomain.org
    aliases:
    - foo
  - ip: 192.168.1.13
    hostname: bar.mydomain.org
    aliases:
    - bar
    - baz

recorders:
- name: recorder-0
  file:
    path: /path/to/recorder/file
    sep: "\n"
    rotation:
      maxSize: 100
      maxAge: 10
      maxBackups: 3
      localTime: false
      compress: false

log:
  output: stderr
  level: debug
  format: json
  rotation:
    maxSize: 100
    maxAge: 10
    maxBackups: 3
    localTime: false
    compress: false

profiling:
  addr: ":6060"

api:
  addr: ":18080"
  pathPrefix: /api
  accesslog: true
  auth:
    username: user
    password: pass
  auther: auther-0

metrics:
  addr: :9000
  path: /metrics

{
  "services": [
    {
      "name": "service-0",
      "addr": ":8080",
      "interface": "eth0",
      "admission": "admission-0",
      "bypass": "bypass-0",
      "resolver": "resolver-0",
      "hosts": "hosts-0",
      "handler": {
        "type": "http",
        "auth": {
          "username": "gost",
          "password": "gost"
        },
        "auther": "auther-0",
        "retries": 1,
        "chain": "chain-0",
        "metadata": {
          "bar": "baz",
          "foo": "bar"
        }
      },
      "listener": {
        "type": "tcp",
        "auth": {
          "username": "user",
          "password": "pass"
        },
        "auther": "auther-0",
        "chain": "chain-0",
        "tls": {
          "certFile": "cert.pem",
          "keyFile": "key.pem",
          "caFile": "ca.pem"
        },
        "metadata": {
          "abc": "xyz",
          "def": 456
        }
      },
      "forwarder": {
        "nodes": [
          {
            "name": "target-0",
            "addr": "192.168.1.1:1234"
          },
          {
            "name": "target-1",
            "addr": "192.168.1.2:2345"
          }
        ],
        "selector": {
          "strategy": "round",
          "maxFails": 1,
          "failTimeout": 30
        }
      }
    }
  ],
  "chains": [
    {
      "name": "chain-0",
      "selector": {
        "strategy": "round",
        "maxFails": 1,
        "failTimeout": 30
      },
      "hops": [
        {
          "name": "hop-0",
          "interface": "192.168.1.2",
          "selector": {
            "strategy": "rand",
            "maxFails": 3,
            "failTimeout": 60
          },
          "bypass": "bypass-0",
          "nodes": [
            {
              "name": "node-0",
              "addr": ":1080",
              "interface": "eth1",
              "bypass": "bypass-0",
              "connector": {
                "type": "socks5",
                "auth": {
                  "username": "user",
                  "password": "pass"
                },
                "metadata": {
                  "foo": "bar"
                }
              },
              "dialer": {
                "type": "tcp",
                "auth": {
                  "username": "user",
                  "password": "pass"
                },
                "tls": {
                  "caFile": "ca.pem",
                  "secure": true,
                  "serverName": "example.com"
                },
                "metadata": {
                  "bar": "baz"
                }
              }
            }
          ]
        }
      ]
    }
  ],
  "authers": [
    {
      "name": "auther-0",
      "auths": [
        {
          "username": "user1",
          "password": "pass1"
        },
        {
          "username": "user2",
          "password": "pass2"
        }
      ]
    }
  ],
  "admissions": [
    {
      "name": "admission-0",
      "whitelist": false,
      "matchers": [
        "127.0.0.1",
        "192.168.0.0/16"
      ]
    }
  ],
  "bypasses": [
    {
      "name": "bypass-0",
      "whitelist": false,
      "matchers": [
        "*.example.com",
        ".example.org",
        "0.0.0.0/8"
      ]
    }
  ],
  "resolvers": [
    {
      "name": "resolver-0",
      "nameservers": [
        {
          "addr": "udp://8.8.8.8:53",
          "chain": "chain-0",
          "prefer": "ipv4",
          "clientIP": "1.2.3.4",
          "ttl": 60,
          "timeout": 30
        },
        {
          "addr": "tcp://1.1.1.1:53"
        },
        {
          "addr": "tls://1.1.1.1:853"
        },
        {
          "addr": "https://1.0.0.1/dns-query",
          "hostname": "cloudflare-dns.com"
        }
      ]
    }
  ],
  "hosts": [
    {
      "name": "hosts-0",
      "mappings": [
        {
          "ip": "127.0.0.1",
          "hostname": "localhost"
        },
        {
          "ip": "192.168.1.10",
          "hostname": "foo.mydomain.org",
          "aliases": [
            "foo"
          ]
        },
        {
          "ip": "192.168.1.13",
          "hostname": "bar.mydomain.org",
          "aliases": [
            "bar",
            "baz"
          ]
        }
      ]
    }
  ],
  "tls": {
    "certFile": "cert.pem",
    "keyFile": "key.pem",
    "caFile": "ca.pem"
  },
  "recorders": [
    {
      "name": "recorder-0",
      "file": {
        "path": "/path/to/recorder/file",
        "sep": "\n",
        "rotation": {
          "maxSize": 100,
          "maxAge": 10,
          "maxBackups": 3,
          "localTime": false,
          "compress": false
        }
      }
    }
  ],
  "log": {
    "output": "stderr",
    "level": "debug",
    "format": "json",
    "rotation": {
      "maxSize": 100,
      "maxAge": 10,
      "maxBackups": 3,
      "localTime": false,
      "compress": false
    }
  },
  "profiling": {
    "addr": ":6060",
    "enabled": true
  },
  "api": {
    "addr": ":18080",
    "pathPrefix": "/api",
    "accesslog": true,
    "auth": {
      "username": "user",
      "password": "password"
    },
    "auther": "auther-0"
  },
  "metrics": {
    "addr": ":9000",
    "path": "/metrics"
  }
}

服务(Service)¶

name (string, required): 服务名称
addr (string, required): 服务地址
interface (string): 网络接口名或IP地址
sockopts (object): Socket参数
admission (string, ref): admission名称，引用admissions.name
bypass (string, ref): bypass名称，引用bypasses.name
resolver (string, ref): resolver名称，引用resolvers.name
hosts (string, ref): hosts名称，对应hosts.name
handler (object, required): 处理器对象
listener (object, required): 监听器对象
forwarder (object): 转发器对象，用于端口转发

处理器(Handler)¶

type (string, required): 处理器类型
auther (string): 认证器名称，引用authers.name
auth (object): 认证信息，如果设置了auther，此字段无效。
chain (string, ref): 转发链名称，引用chains.name
retries (int, default=0): 请求处理失败后重试次数
metadata (map): 处理器实例相关参数

监听器(Listener)¶

type (string, required): 监听器类型
chain (string, ref): 转发链名称，对应chains.name
auther (string): 认证器名称，引用authers.name
auth (object): 认证信息，如果设置了auther，此字段无效。
tls (object): 监听器实例TLS配置
metadata (map): 监听器实例相关参数

转发器(Forwarder)¶

hop (string, ref): 引用 hops 中已命名的跳跃点。与 hopGroup 和内联节点互斥。
hopGroup (object): 3.3.0 — 跳跃点组，支持每个条目独立的匹配器和探活。详见跳跃点组。
hopGroup.hops (list, required): 跳跃点条目列表，每条包含 hop、matcher 和 probe 字段。
hopGroup.selector (object): 组级别负载均衡选择器，支持与节点选择器相同的策略。
nodes (objects): 转发目标节点列表
selector (object): 负载均衡策略

转发链(Chain)¶

name (string, required): 转发链名称
selector (object): 转发链层级节点选择器，用于负载均衡
hops (hop-list): 跳跃点列表

转发链组(ChainGroup)¶

3.3.0

服务监听器或处理器上的chainGroup参数通过基于匹配器的路由DSL从多个转发链中进行选择。每个链条目可以有自己的匹配器规则和健康检查探针。

chainGroup:
  chains:
  - chain: chain-primary
    matcher:
      rule: Host(`api.example.com`)
    probe:
      type: tcp
      addr: 127.0.0.1:8081
      interval: 10s
  - chain: chain-fallback
  selector:
    strategy: round
    maxFails: 1
    failTimeout: 30s

chains (list, required): 链条目列表。每个条目可以是链名称字符串或结构化对象。

链条目(Chain Entry)¶

chain (string, required): 转发链名称，引用chains.name。
matcher (object): 可选的路由规则。DSL参考节点匹配器。未设置 = 始终有资格（兜底）。匹配器会看到请求上下文中的目标主机名。
matcher.rule (string): 路由规则表达式，使用与节点匹配器相同的DSL。转发链组层级常用函数：Host()、ClientIP()。完整DSL参考请参见匹配器。
probe (object): 可选的链级别健康检查。通过Route.Dial()对整个转发链进行端到端探测。探针标记链条目自身的标记，与链内部任何节点级别的标记独立。

探针(Probe)¶

链条目的探针配置。结构与节点探针相同。

type (string): 探针类型：tcp、http 或 cmd。
addr (string): TCP/HTTP探针的目标地址。非cmd探针必填。
interval (duration): 探测间隔。默认：30s。
timeout (duration): 探测超时。默认：10s。
httpPath (string): HTTP请求路径（仅HTTP探针）。
httpHost (string): HTTP Host头（仅HTTP探针）。
httpHeaders (map): 额外的HTTP请求头（仅HTTP探针）。
expectedStatus (int): 期望的HTTP响应状态码。默认：0（任意2xx）。
command (string): 要执行的Shell命令（仅CMD探针）。退出码0 = 成功。

向后兼容¶

链条目支持两种格式：

# 旧格式：纯字符串
chains:
- chain-0
- chain-1

# 新格式：结构化对象
chains:
- chain: chain-0
  matcher:
    rule: Host(`api.example.com`)
  probe:
    type: tcp

name (string, required): 跳跃点名称
interface (string): 网络接口名或IP地址
sockopts (object): Socket参数
selector (object): 跳跃点层级节点选择器，如果设置，则覆盖转发链层级选择器
bypass (string, ref): bypass名称，引用bypasses.name
nodes (node-list): 节点列表

节点(Node)¶

name (string, required): 节点名称
addr (string, required): 节点地址
interface (string): 网络接口名或IP地址，如果设置，则会覆盖hop.interface
sockopts (object): Socket参数，如果设置，则会覆盖hop.sockopts
bypass (string, ref): bypass名称，引用bypasses.name。
connector (object): 连接器对象
dialer (object): 拨号器对象

连接器(Connector)¶

type (string, required): 连接器类型
auth (object): 认证信息
metadata (map): 连接器实例相关参数

拨号器(Dialer)¶

type (string, required): 拨号器类型
auth (object): 认证信息
tls (object): TLS配置
metadata (map): 拨号器实例相关参数

节点匹配器 (Node Matcher)¶

3.3.0

rule (string): 路由规则表达式。支持布尔运算符 (&&、||、!) 和匹配函数： Method、Path、PathPrefix、PathRegexp、Host、HostRegexp、Header、HeaderRegexp、 Query、QueryRegexp、BodyRegexp、BodyJSON、ClientIP、Network、Proto、Bypass、Admission。
BodyJSON(path, regex) (since 3.3.x): 通过点分隔的JSON路径匹配JSON字段值，使用 gjson 提取字段值后与正则表达式匹配。 BodyRegexp 匹配的是原始字节流，而 BodyJSON 先解析 JSON 再匹配字段值，表达式更简洁。示例：BodyJSON(output_config.effort,^(xhigh|max)$)
bodySize (int): 用于 body matcher 匹配的 HTTP 请求体前缀最大读取字节数。默认：0（禁用）。
priority (int): 节点选择优先级。0（默认）自动将优先级设置为规则长度，更长（更具体）的规则优先级更高。负数禁用优先级排序。

matcher:
  rule: 'Method(`POST`) && Header(`Content-Type`, `application/json`) && BodyJSON(`output_config.effort`, `^(xhigh|max)$`)'
  bodySize: 65536

节点 HTTP 设置¶

http (object): 节点级 HTTP 设置：Host 覆盖、Header 注入、URL 重写和 Body 重写。
http.host (string): 覆盖 HTTP Host 头。
http.requestHeader (map): 注入额外的 HTTP 请求头。
http.responseHeader (map): 注入额外的 HTTP 响应头。
http.rewriteURL (list): URL 路径重写规则。每项包含 match（正则）和 replacement。
http.rewriteRequestBody (list): 请求 Body 重写规则。每项包含： match (string) — 正则或 json:<路径>[=<值正则>] JSON 字段匹配； replacement (string) — 替换值； rewriter (string) — 可选的外部 rewriter 插件； type (string) — 可选的 content-type 过滤。
http.rewriteResponseBody (list): 响应 Body 重写规则。结构同 rewriteRequestBody。

http:
  host: api.deepseek.com
  rewriteURL:
    - match: /v1/messages
      replacement: /anthropic/v1/messages
  requestHeader:
    Authorization: "Bearer sk-xxx"
  rewriteRequestBody:
    - match: json:model
      replacement: deepseek-v4-pro
    - match: json:output_config.effort=(xhigh|max)
      replacement: low
  rewriteResponseBody:
    - rewriter: anthropic-converter

TLS¶

certFile (string): 证书公钥文件
keyFile (string): 证书私钥文件
caFile (string): CA证书文件
secure (bool, default=false): 开启服务器证书和域名校验
serverName (string): 服务器域名，用于域名校验

3.3.0

rejectUnknownSNI (bool, default=false): 拒绝SNI未知或为空的TLS握手，被拒绝的连接不会返回任何证书。
serverNames (list): 允许的SNI白名单。当rejectUnknownSNI开启且此列表非空时，任何不在列表中的SNI（包括空SNI）都会被拒绝；当列表为空且rejectUnknownSNI开启时，仅拒绝缺少或为空SNI的握手。

认证器(Auther)¶

name (string, required): 名称
auths (list): 认证信息列表

认证信息(Auth)¶

username (string): 用户名
password (string): 密码

节点选择器(Selector)¶

strategy (string, default=round)

节点选择策略：

round, rr - 轮询
random, rand - 随机
fifo - 主备模式
hash - 基于特定Hash值(客户端IP或目标地址)
parallel - 竞速模式，同时向所有节点发起连接，使用最先成功的连接

maxFails (int, default=1)

节点连接最大失败次数

failTimeout (duration, default=30s)

节点失败标记超时时长

准入控制器(Admission)¶

name (string, required): admission名称
whitelist (bool, default=false): 切换为白名单
matchers (strings): 地址列表，支持IP，CIDR

分流器(Bypass)¶

name (string, required): bypass名称
whitelist (bool, default=false): 切换为白名单
matchers (strings): 地址列表，支持IP，CIDR，域名或域名通配符

域名解析器(Resolver)¶

name (string, required): 名称
nameservers (list): 域名服务列表

域名服务(Nameserver)¶

addr (string, required)

域名地址

chain (string, ref)

转发链名称，引用chains.name

prefer (string, default=ipv4)

IP地址类型优先级

ipv4 - IPv4优先
ipv6 - IPv6优先

clientIP (string)

客户端IP，设置后会开启ECS(EDNS Client Subnet)扩展功能。

ttl (duration)

DNS缓存有效期，默认使用DNS查询返回结果中的TTL。当设置为负值，则不使用缓存。

timeout (duration)

DNS请求超时时长

主机映射器(Hosts)¶

主机名-IP地址静态映射表

name (string, required): 映射表名称
mappings (list): 映射列表

映射列表项(mapping)¶

ip (string): IP地址
hostname (string): 主机名
aliases (strings): 主机别名列表

Socket参数(SockOpts)¶

mark (int): Linux Socket SO_MARK参数选项

记录器(Recorder)¶

name (string, required): 名称
file (object): 文件记录器
tcp (object): TCP记录器
http (object): HTTP记录器
redis (object): Redis记录器
plugin (object): gRPC插件记录器

参考

记录器的详细说明请参见Recorder章节。

日志(log)¶

日志配置，设置日志级别，格式和输出方式。

level (string, default=info)

日志级别，支持的选项：trace，debug，info，warn，error，fatal。

format (string, default=json)

日志格式，支持的格式：json，text。

output (string, default=stderr)

日志输出方式：

none - 丢弃日志。
stderr - 标准错误流
stdout - 标准输出流
/path/to/file - 指定的文件路径

rotation.maxSize (int, default=100)

文件存储大小，单位为MB。

rotation.maxAge (int)

备份日志文件保存天数，默认不根据时间清理旧文件。

rotation.maxBackups (int)

备份日志文件数量，默认保存所有文件。

rotation.localTime (bool, default=false)

备份文件名是否使用本地时间格式。默认使用UTC时间。

rotation.compress (bool, default=false)

备份文件是否(使用gzip)压缩。

Profiling¶

addr (string): 服务地址
enabled (bool, default=false): 是否开启

API¶

addr (string): WebAPI服务地址，设置后将开启WebAPI服务
pathPrefix (string): 设置API路径前缀
accesslog (bool, default=false): 开启API访问日志
auth (object): 认证信息，如果设置了auther，此字段无效。
auther (string): 认证器名称，引用authers.name

Metrics¶

addr (string): 服务地址
path (string, default=/metrics): 访问路径