# SOCKS5 上游保留在统一 Proxy 模型和策略契约内。
version: 1
security: {requireProtectionOnPublicListen: true}
gateway: {enabled: true, listen: '127.0.0.1:8080', auth: {mode: none}}
routing:
  - name: socks-upstream
    enabled: true
    purpose: gateway
    match: {hostRegex: '.*'}
    upstreams: [provider-socks]
    strategy: {type: leastConnections}
    onUnavailable: {action: reject}
upstreams:
  provider-socks:
    enabled: true
    exposure: [gateway]
    provider: {billingMode: subscription, protocols: [socks5]}
    api: {url: https://provider-socks.example/proxies, method: GET, auth: {type: none}, template: '{{.}}'}
    proxyAuth:
      type: static
      username: "${SOCKS_USER}"
      password: "${SOCKS_PASSWORD}"
    pool: {maxSize: 1000}
    capacity: {maxConcurrencyPerProxy: 20}
    refill: {reconcileInterval: 1s, minimumAvailableSlots: 25, targetAvailableSlots: 50}
    lifecycle: {ttl: 10m, allocationSafetyMargin: 60s}
    fetch: {estimatedIPsPerCall: 10, requestInterval: 5s, timeout: 5s, maxAttempts: 3, maxInFlight: 1}
    check: {interval: 30s, jitter: 20, maxInFlight: 100, timeout: 3s, maxAttempts: 2, maxConsecutiveFailures: 3}