1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# SplitHello configuration. Only `targets` is required; every other value shown is the
# default. `splithello start` writes this file when none exists.
# Sites that use DoH + ClientHello splitting. A plain host also covers its subdomains;
# use { host = "example.com", subdomains = false } to match one exact host.
# SplitHello will not start until at least one site is listed, for example:
# targets = ["reddit.com", "medium.com"]
= []
[]
= "127.0.0.1:8080" # browser HTTPS proxy address
= "127.0.0.1:8081" # serves http://127.0.0.1:8081/proxy.pac; pac = false disables it
= [443] # CONNECT ports to accept (443 and/or 8443)
[]
# The endpoint host must be bootstrap-reachable without resolving a selected/blocked domain.
# Prefer a literal-IP HTTPS endpoint with a certificate valid for that IP, as below, or an
# independently resolvable non-target host. HTTPS authentication is mandatory; an optional
# ca_certificate may add trusted roots but never disables certificate verification.
= "https://1.1.1.1/dns-query"
= "10s"
= "5m" # upper bound; shorter DNS answer TTLs win
= 256
# ca_certificate = "extra-roots.pem"
# max_response_bytes = 65536
# Rarely needed; durations accept units like "750ms", "10s", "5m".
# [limits]
# max_connections = 256
# connect_timeout = "10s"
# client_hello_timeout = "5s"
# idle_timeout = "5m"
# shutdown_timeout = "10s"
# max_connect_header_bytes = 16384
# max_client_hello_bytes = 262144
# `start` and `check` ask GitHub for the latest release at most once a day and say when
# a newer one exists; `splithello update` installs it. SPLITHELLO_NO_UPDATE_CHECK=1 also
# turns the check off.
# [update]
# check = true