08. Complete UCI Configuration Schema Reference

The primary configuration for Tachyon is stored at /etc/config/tachyon (UCI format, mode 0600).

1. Section: `config settings 'settings'`

Global settings defining service behaviour, DNS resolution, watchdog parameters, Telegram integration, and AI Doctor.

Option	Type	Default	Description
`enabled`	`boolean` (`0`/`1`)	`1`	Master toggle for Tachyon service.
`log_level`	`string`	`info`	Logging verbosity: `debug`, `info`, `warn`, `error`.
`dns_mode`	`string`	`doh`	DNS routing mode: `direct`, `doh`, `dot`, `udp`, `hosts_only`.
`remote_dns_server`	`string`	`https://1.1.1.1/dns-query`	Upstream secure DNS resolver for proxied domains.
`direct_dns_server`	`string`	`77.88.8.8`	Fallback DNS resolver for direct / local domains.
`tproxy_port`	`integer`	`10080`	Local TCP/UDP transparent proxy port for sing-box.
`dns_port`	`integer`	`5353`	Local DNS listening port for sing-box DNS engine.
`clash_api_port`	`integer`	`9090`	sing-box Clash REST API controller port.
`clash_api_secret`	`string`	`""`	Secret token for sing-box Clash API.
`watchdog_interval`	`integer`	`10`	Watchdog polling interval in seconds (5–60s).
`memory_limit_mb`	`integer`	`0`	Dynamic `GOMEMLIMIT` cap in MB (`0` = auto 50% free RAM).
`enable_telegram`	`boolean`	`0`	Enable interactive Telegram management bot.
`telegram_token`	`string`	`""`	Telegram Bot API token from `@BotFather`.
`telegram_chat_id`	`string`	`""`	Allowed Admin Telegram Chat ID(s) (comma-separated).
`enable_ai_doctor`	`boolean`	`0`	Enable LLM AI Doctor diagnostic engine.
`ai_doctor_provider`	`string`	`openai`	LLM Provider: `openai`, `anthropic`, `deepseek`, `custom`.
`ai_doctor_model`	`string`	`""`	Model override (e.g. `gpt-4o-mini`, `claude-3-5-haiku`).
`ai_doctor_api_key`	`string`	`""`	API key for the chosen LLM provider.
`ai_doctor_custom_url`	`string`	`""`	Custom OpenAI-compatible endpoint URL (e.g. OpenRouter/Ollama).
`agent_api_token`	`string`	`""`	Bearer token for HTTP REST Agent API write access.

2. Section: `config server 'name'`

Defines an individual manual proxy outbound node.

Option	Type	Required	Description
`type`	`string`	Yes	Protocol: `vless`, `vmess`, `shadowsocks`, `trojan`, `hysteria2`, `wireguard`.
`server`	`string`	Yes	Remote server hostname or IPv4/IPv6 address.
`server_port`	`integer`	Yes	Remote server port (e.g. `443`, `8443`).
`uuid`	`string`	Conditional	User UUID for VLESS / VMess.
`password`	`string`	Conditional	Password for Shadowsocks / Trojan / Hysteria2.
`flow`	`string`	No	Flow control: `xtls-rprx-vision` (VLESS).
`security`	`string`	No	Security type: `reality`, `tls`, `none`.
`sni`	`string`	Conditional	Server Name Indication for TLS / Reality.
`pbk`	`string`	Conditional	Public Key for VLESS Reality.
`sid`	`string`	Conditional	Short ID for VLESS Reality (hex string).
`fingerprint`	`string`	No	TLS fingerprint: `chrome`, `firefox`, `safari`, `randomized`.
`method`	`string`	Conditional	Cipher method for Shadowsocks (e.g. `2022-blake3-aes-128-gcm`).
`routing_mode`	`string`	No	Routing mode: `rules` (default), `direct`, `section`.
`routing_section`	`string`	No	Bound routing section when `routing_mode = 'section'`.
`isolate_lan_for_users`	`boolean`	No	Restrict access to private/LAN IP addresses (`1` / `0`).
`isolated_users`	`list string`	No	Specific usernames (`auth_user`) restricted from LAN. If empty, restricts all users of the inbound.
`isolated_subnets`	`list string`	No	Optional custom subnets to block for isolated users (defaults to `ip_is_private: true`).
`custom_route_rules`	`list string`	No	Raw JSON sing-box route rule objects injected before general routing rules.

3. Section: `config subscription 'name'`

Defines a remote subscription URL for automated batch node fetching.

Option	Type	Default	Description
`enabled`	`boolean`	`1`	Enable this subscription source.
`url`	`string`	Required	HTTPS / HTTP link to subscription (Base64, Clash, SIP002).
`update_interval`	`integer`	`86400`	Auto-update interval in seconds (default 24 hours).
`custom_user_agent`	`string`	`""`	Custom User-Agent header for subscription request.
`filter_keywords`	`list string`	`[]`	Include nodes matching regex/keywords.
`exclude_keywords`	`list string`	`[]`	Exclude nodes matching regex/keywords.

4. Section: `config rule 'name'`

Defines a selective routing policy.

Option	Type	Default	Description
`enabled`	`boolean`	`1`	Enable this routing rule.
`name`	`string`	`""`	Human-readable label for UI.
`action`	`string`	`proxy`	Route target: `proxy`, `zapret`, `zapret2`, `byedpi`, `direct`, `hosts`.
`target_server`	`string`	`""`	Bound server ID or outbound tag when `action = 'proxy'`.
`domain_pattern`	`list string`	`[]`	List of target domains or wildcards (e.g. `*.youtube.com`).
`ip_cidr`	`list string`	`[]`	List of IP subnets (e.g. `104.16.0.0/12`).
`client_group`	`string`	`""`	Restrict this rule to a specific client device group.

5. Section: `config hosts 'name'`

Configures static DNS overrides and remote blocklists ingestion.

Option	Type	Default	Description
`enabled`	`boolean`	`1`	Enable hosts mapping.
`dns_hosts`	`list string`	`[]`	Static mappings in format `domain:ip` (e.g. `example.com:1.2.3.4`).
`hosts_list_urls`	`list string`	`[]`	External URLs for blocklists (AdAway, StevenBlack).
`update_interval`	`integer`	`86400`	Auto-refresh interval in seconds.

6. Ready-to-Use Configuration Recipes

Recipe A: Zero-VPS Local DPI Bypass (YouTube + Discord)

config settings 'settings'
    option enabled '1'
    option dns_mode 'doh'

config provider 'zapret2'
    option enabled '1'
    option daemon_bin '/usr/bin/nfqws2'
    option qnum '201'
    option args_tcp '--dpi-desync=multisplit --dpi-desync-split-pos=1,midsld --dpi-desync-seqovl=1 --dpi-desync-fooling=badseq'

config rule 'youtube_discord'
    option enabled '1'
    option name 'YouTube & Discord Local Desync'
    option action 'zapret2'
    list domain_pattern 'googlevideo.com'
    list domain_pattern 'youtube.com'
    list domain_pattern 'ytimg.com'
    list domain_pattern 'discord.com'
    list domain_pattern 'discord.gg'

Recipe B: Hybrid Mode (Local Desync for Media + VLESS Reality for Blocked Sites)

config server 'my_vps'
    option type 'vless'
    option server 'vps.example.com'
    option server_port '443'
    option uuid '12345678-1234-1234-1234-123456789abc'
    option flow 'xtls-rprx-vision'
    option security 'reality'
    option sni 'yahoo.com'
    option pbk 'XYZ...PUBLIC_KEY...'
    option sid '1a2b3c4d'

config rule 'media_rule'
    option enabled '1'
    option action 'zapret2'
    list domain_pattern 'youtube.com'
    list domain_pattern 'googlevideo.com'

config rule 'blocked_rule'
    option enabled '1'
    option action 'proxy'
    option target_server 'my_vps'
    list domain_pattern 'instagram.com'
    list domain_pattern 'twitter.com'
    list domain_pattern 'x.com'

7.4 KiB Raw Blame History Unescape Escape

08. Complete UCI Configuration Schema Reference

1. Section: config settings 'settings'

2. Section: config server 'name'

3. Section: config subscription 'name'

4. Section: config rule 'name'

5. Section: config hosts 'name'