Configuration

# /etc/honk/config.dae
# Keep API credentials in a separate include.
include {
    config.d/*.dae
}

# Host traffic, storage, checks and connection settings.
global {
    wan_interface: auto
    # For LAN clients, uncomment and replace with their gateway interface.
    # lan_interface: br-lan
    data_dir: '/var/lib/honk'
    store_subscribe: true
    log_level: info
    # Optional append-only log file, relative to data_dir.
    # log_file: 'honk.log'
    tproxy_port: 12345
    so_mark_from_dae: 0
    nfqueue_enable: true
    tcp_check_url: 'https://www.gstatic.com/generate_204'
    tcp_check_http_method: HEAD
    udp_check_dns: 'dns.google:53', '8.8.8.8', '2001:4860:4860::8888'
    check_interval: 30s
    check_tolerance: 50ms
    dial_mode: domain
    bootstrap_resolver: '1.1.1.1:53'
    tls_implementation: tls
    max_concurrent_dials: 64
    preconnect_node_count: auto
    udp_warm_node_count: 0
}

# Replace the placeholder with your provider's subscription URL.
subscription {
    harbor: 'https://subscription.example/sub'
}

# Optional static nodes; uncomment only with your real node details.
node {
    # backup: 'socks5://192.0.2.2:1080'
}

# Select from harbor's nodes by moving-average latency.
group {
    # This group is used by both the traffic rule and the DNS upstream.
    proxy {
        filter: subtag('harbor')
        policy: min_moving_avg
    }
}

# Send only the tutorial domain through the group.
routing {
    domain(full: example.com) -> proxy
    fallback: direct
}

# Resolve the tutorial domain through the same group.
dns {
    # An IP-based HTTPS endpoint avoids a bootstrap hostname dependency.
    upstream {
        remote_dns: 'https://1.1.1.1/dns-query' -> proxy
    }
    # Other DNS requests keep their original destination.
    routing {
        # Match the same full domain as the traffic rule.
        request {
            qname(full: example.com) -> remote_dns
            fallback: asis
        }
        # Keep the selected upstream's answer.
        response {
            fallback: accept
        }
    }
}

# Download defaults; these URLs alone do not load geodata assets.
assets {
    route: routing
    # Sources for updates after routing rules load the relevant assets.
    geodata {
        geosite: 'https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geosite.dat'
        geoip: 'https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/release/geoip.dat'
        route: direct
    }
    # Applies only to a separately configured Clash dashboard, not doona.
    ui {
        url: 'https://github.com/Zephyruso/zashboard/releases/latest/download/dist.zip'
        route: direct
    }
    # Individual subscription options can override these defaults.
    subscription {
        interval: 86400s
        cache: true
        # ua: 'clash.meta'
    }
}

# /etc/honk/config.d/api.dae
# Listener settings must be edited outside doona and require a restart.
experimental {
    # Password sign-in and the installed standard-edition UI.
    native_api {
        enabled: true
        listen: '192.168.1.1:9527'
        password_auth: true
        # For token sign-in, remove password_auth and set a real secret.
        # secret: 'replace-with-a-long-random-token'
        config_write: true
        ui: '/usr/share/doona-web'
        # Add these only for the actual origin and host you use.
        # allow_origins: 'https://panel.example'
        # allowed_hosts: 'panel.example'
        record_traffic: true
        record_memory: true
        record_flows: true
        record_logs: true
        record_dns_log: true
    }
    # Unset enabled retains Selector choices and delay samples.
    cache_file {
        store_dns: false
    }
}