# =====================================================================
#  Shield Guard — blok DNS untuk Clash / Mihomo (Clash Meta)
#
#  Tempel blok ini ke dalam config.yaml Anda. Nilai fallback-filter
#  persis seperti yang Anda minta, ditambah server Quad9 dan AdGuard
#  masing-masing dua untuk NameServer maupun FallBack.
#
#  Catatan penting soal "hostname di Connection log":
#  yang membuat log menampilkan nama domain dan bukan alamat IP adalah
#  enhanced-mode fake-ip. Tanpa itu, klien hanya melihat IP hasil
#  resolusi. Karena itu enhanced-mode disetel fake-ip di bawah.
# =====================================================================

# --------------------------- basis geo ---------------------------
# Mode geodata dat dipakai supaya aturan GEOSITE tersedia, bukan hanya
# GEOIP. Sumbernya meta-rules-dat, yang sudah memuat kategori global
# maupun kode negara ID untuk Indonesia. Diperbarui otomatis tiap hari.
geodata-mode: true
geodata-loader: standard
geo-auto-update: true
geo-update-interval: 24
geox-url:
  geoip: "https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.dat"
  geosite: "https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/geosite.dat"
  mmdb: "https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/country.mmdb"
  asn: "https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/GeoLite2-ASN.mmdb"

# ----------------------------- DNS -------------------------------
dns:
  enable: true
  ipv6: true
  prefer-h3: true
  listen: 0.0.0.0:1053

  # fake-ip inilah yang membuat Connection log memperlihatkan hostname
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "*.localdomain"
    - "localhost.ptlogin2.qq.com"
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"
    - "connectivitycheck.gstatic.com"
    - "captive.apple.com"
    - "time.*.com"
    - "ntp.*.com"
    - "+.pool.ntp.org"

  # Server bootstrap: dipakai hanya untuk meresolusi alamat DoH/DoT
  # di bawah. Wajib berupa IP polos, bukan nama domain.
  default-nameserver:
    - 9.9.9.9
    - 149.112.112.112
    - 94.140.14.14

  # ------------------------ NameServer ---------------------------
  # Quad9 dua entri (HTTPS dan TLS) sesuai permintaan, ditambah AdGuard
  # dua entri. AdGuard sudah menyaring iklan di lapisan DNS, Quad9
  # menyaring domain berbahaya. Keduanya dipakai bersama.
  nameserver:
    - https://dns.quad9.net/dns-query        # Quad9  · DoH
    - tls://9.9.9.9:853                      # Quad9  · DoT
    - https://dns.adguard-dns.com/dns-query  # AdGuard · DoH
    - tls://94.140.14.14:853                 # AdGuard · DoT

  # ------------------------- FallBack ----------------------------
  fallback:
    - https://dns.quad9.net/dns-query        # Quad9  · DoH
    - tls://149.112.112.112:853              # Quad9  · DoT (IP kedua)
    - https://dns.adguard-dns.com/dns-query  # AdGuard · DoH
    - tls://94.140.14.15:853                 # AdGuard · DoT (Family)

  # Domain yang selalu memakai NameServer, tidak pernah fallback.
  nameserver-policy:
    "+.id": [https://dns.quad9.net/dns-query]
    "+.co.id": [https://dns.quad9.net/dns-query]
    "+.go.id": [https://dns.quad9.net/dns-query]
    "geosite:cn": [https://dns.quad9.net/dns-query]

  # ---------------------- fallback-filter ------------------------
  # Persis seperti yang Anda kirim.
  fallback-filter:
    geoip: true
    geoip-code: ID
    ipcidr:
      - 0.0.0.0/8
      - 10.0.0.0/8
      - 100.64.0.0/10
      - 127.0.0.0/8
      - 169.254.0.0/16
      - 172.16.0.0/12
      - 192.0.0.0/24
      - 192.0.2.0/24
      - 192.88.99.0/24
      - 192.168.0.0/16
      - 198.18.0.0/15
      - 198.51.100.0/24
      - 203.0.113.0/24
      - 224.0.0.0/4
      - 240.0.0.0/4
      - 255.255.255.255/32
    domain:
      - "+.google.com"
      - "+.facebook.com"
      - "+.youtube.com"
      - "+.githubusercontent.com"
      - "+.googlevideo.com"
      - "+.msftconnecttest.com"
      - "+.msftncsi.com"
      - msftconnecttest.com
      - msftncsi.com
      - "+.*"

# ---------------------------- sniffer ----------------------------
# Membaca SNI dari TLS dan Host dari HTTP. Bersama fake-ip, inilah yang
# memastikan Connection log menampilkan hostname walau aplikasi
# menghubungi alamat IP secara langsung.
sniffer:
  enable: true
  force-dns-mapping: true
  parse-pure-ip: true
  override-destination: false
  sniff:
    HTTP:
      ports: [80, 8080-8880]
      override-destination: true
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]
  skip-domain:
    - "Mijia Cloud"
    - "+.push.apple.com"
    - "+.apple.com"
    - "+.whatsapp.net"
    - "+.whatsapp.com"

# ------------------------ contoh aturan --------------------------
# Letakkan di bagian rules. Dua baris pertama yang memblokir iklan;
# GEOIP ID menjaga trafik lokal Indonesia tetap langsung.
rules:
  - GEOSITE,category-ads-all,REJECT
  - GEOSITE,category-ads,REJECT
  - RULE-SET,turtlecute,REJECT
  - DOMAIN-SUFFIX,pistislitae.my.id,DIRECT
  - DOMAIN-SUFFIX,richadpay.biz.id,DIRECT
  - GEOSITE,private,DIRECT
  - GEOIP,private,DIRECT,no-resolve
  - GEOSITE,id,DIRECT
  - GEOIP,ID,DIRECT
  - MATCH,PROXY

# --------------------- daftar aturan tambahan --------------------
# Daftar Turtlecute dipakai sebagai rule-provider supaya ikut
# diperbarui otomatis, bukan disalin manual.
rule-providers:
  turtlecute:
    type: http
    behavior: domain
    format: text
    url: "https://adblock.turtlecute.org/d3host.adblock"
    path: ./ruleset/turtlecute.txt
    interval: 86400