Professional SOCKS5(h) & HTTP IPv6 proxy server

# ==========================================
# OxidProxy Configuration File
# Doc:     https://oxidproxy.com/downloads/Readme.txt
# Support: support@oxidproxy.com
#          https://t.me/OxidProxy_com
# ==========================================

# ------------------------------------------
# 1. General settings and licensing
# ------------------------------------------

# [!!! IMPORTANT !!!] Your license key
license_key: "PUT_YOUR_KEY_HERE"

# Additional license servers. NOT required: the regular endpoints are built
# into the server itself, across two independently registered domains.
#
# Fill this in only if support gives you a specific address, for example if
# the usual endpoints become unreachable from your network. Entries here are
# tried BEFORE the built-in ones, so a working address takes effect at once.
#
# license_servers:
#   - "backup.example.com:8000"

# Interface to accept incoming connections on (0.0.0.0 = all interfaces)
listen_ip: "0.0.0.0"

# [!!! IMPORTANT !!!] Public IPv4 address of this server.
# Used to build connection strings and API responses.
public_ip: "YOUR_EXTERNAL_IPV4"

# External network interface for kernel-level QoS (latency, jitter).
# Left commented out, the interface is detected automatically via the
# default gateway.
# ext_iface: "eth0"

# Ports and OS fingerprint profiles.
#   mode: "socks" (default), "http", or "hybrid" (SOCKS5 + HTTP on one port)
# In hybrid mode the protocol is detected from the first byte of the
# connection. All profile features (p0f, TOS, congestion control and so on)
# behave identically in every mode.
#
# CHANGING THE FINE-TUNING PARAMETERS WITHOUT UNDERSTANDING THEM CAN LEAD TO
# UNPREDICTABLE RESULTS.
listeners:
  - port: 1080
    os_preset: "linux"
    # mode: "socks" # may be omitted (this is the default)

  - port: 1081
    os_preset: "android"
    mode: "hybrid"   # accepts both SOCKS5 and HTTP CONNECT on one port
    # [Network "physics" fine-tuning]
    tcp_congestion: "bbr"
    tcp_window_size: 1048576
    latency_base_ms: 60
    jitter_ms: 30
    tos: 10

  - port: 1082
    os_preset: "windows"
    mode: "hybrid"

  - port: 1083
    os_preset: "ios"
    mode: "hybrid"
    # [Network "physics" fine-tuning]
    tcp_congestion: "cubic"
    tcp_window_size: 2097152
    latency_base_ms: 40
    jitter_ms: 20
    tos: 8

  - port: 1084
    os_preset: "macos"
    mode: "hybrid"

# MITM ports: the server terminates client TLS with its own CA and rebuilds
# the request to the target with the network fingerprint of a real browser.
# The profile is picked automatically from the client User-Agent, so a single
# port serves every OS and browser.
#
# Profiles are named <os>-<browser>:
#   windows-chrome, windows-firefox, windows-edge
#   macos-chrome,   macos-firefox,   macos-safari
#   linux-chrome,   linux-firefox
#   android-chrome, android-firefox
#   ios-safari
#
# The client must trust the server CA once (download it from GET /ca),
# otherwise the browser reports a certificate error.
#
# mitm_listeners:
#   - port: 9443
#     profiles:
#       - "windows-chrome"
#       - "windows-firefox"
#       - "macos-safari"
#       - "android-chrome"
#       - "ios-safari"
#     default: "windows-chrome"  # used when the User-Agent is not recognised
#     # strict: false            # true = refuse instead of falling back to default
#     # mode: "hybrid"           # socks / http / hybrid, as for regular listeners


# ------------------------------------------
# 2. IPv6 settings and rotation
# ------------------------------------------

# [!!! IMPORTANT !!!] IPv6 subnets used for outgoing traffic.
# weight: the higher the number, the more often the subnet is used.
ipv6_subnets:
  - cidr: "2a01:xxxx::/32"
    weight: 427
  # Example of a second subnet (remove the # to enable):
  # - cidr: "2a02:yyyy:yyyy:yyyy::/64"
  #   weight: 16

# Rotation interval, in minutes.
# 0 = disabled (the IP stays the same until restart).
# "Lazy rotation" is used: the IP changes when the user authenticates
# again, and active connections are NOT dropped.
rotation_interval: 0


# ------------------------------------------
# 3. API and user management
# ------------------------------------------

# Port for API commands (creating users, statistics)
api_port: 8080
# [RECOMMENDED] Port for the secured API (HTTPS)
api_port_https: 8443

# [!!! IMPORTANT !!!] Secret token for API access. Minimum 12 characters.
master_token: "change_me_to_secure_token"

# Maximum number of unique generated accounts
max_accounts: 100000

# Where to store generated accounts.
# The variables [port], [os] and [mode] split the output by port, OS and
# protocol. Hybrid listeners produce two files: one with socks5:// links
# and one with http:// links.
# If more than one file will be produced, ALL THREE variables are required
# or the server refuses to start.
accounts_file: "/var/lib/oxidproxy/accounts_[os]_[mode]_[port].txt"

# Seed for account generation.
# Uncomment to keep logins and passwords stable across restarts: every
# account_seed value yields its own fixed set of credentials.
# Accepts values from 0 to 2^64 - 1.
account_seed: 123456789


# ------------------------------------------
# 4. DNS resolver
# ------------------------------------------
# Supports weighted balancing and failover servers.
# RECOMMENDED: add your hosting provider's DNS as a primary server
# (weight > 0). You can usually find them in /etc/resolv.conf.

dns:
  timeout: 2        # response timeout, seconds
  cache_size: 8000  # number of cached DNS records

  # Do not log a warning when a domain has no IPv6 (AAAA) record.
  suppress_aaaa_not_found: true

  servers:
    # === Primary servers (weighted) ===
    # When weight is set, traffic is distributed between them.
    - address: "[2606:4700:4700::1111]:53" # Cloudflare IPv6
      weight: 58
    - address: "1.1.1.1:53"
      weight: 7
    # Example of a local provider DNS (recommended):
    # - address: "10.0.0.53:53"
    #   weight: 1000

    # === Failover servers ===
    # Used ONLY when the primary servers are unreachable.
    # Failover servers have no weight parameter.
    - address: "[2620:fe::fe]:53"          # Quad9 IPv6
    - address: "9.9.9.9:53"                # Quad9


# ------------------------------------------
# 5. Traffic shaping and tuning
# ------------------------------------------
# Limits the TOTAL bandwidth of the server (all users combined).

shaping:
  # Rate in bytes per second (0 = unlimited)
  # Cheat sheet:
  #   1 Mbit/s   = 125000
  #   10 Mbit/s  = 1250000
  #   100 Mbit/s = 12500000
  rate: 0

  # Burst, in bytes.
  # Allows briefly exceeding the rate limit so small files load instantly.
  # Recommended: rate * 2.
  # Ignored when rate is 0 (unlimited).
  burst: 0


# ------------------------------------------
# 6. Connection timeouts
# ------------------------------------------
timeouts:
  # How long (seconds) to wait for active connections to finish when the
  # server is stopped or restarted
  shutdown: 10
  # Maximum idle time (seconds) of a TCP/UDP session before it is closed
  idle: 300

# ------------------------------------------
# 7. Monitoring and logs
# ------------------------------------------

# File listing blocked domains and IP addresses
blocked_file: "/etc/oxidproxy/blacklist.txt"

# Service account, intended for checkers and monitoring.
# It can reach only the domain listed below.
service_account:
  enabled: true
  login: "checker"
  password: "strong_password"
  allowed_domain: "ifconfig.me"

log:
  dir: "/var/log/oxidproxy"
  level: "info" # one of: debug, info, warn, error