ansible-proxy-chain/docs/surge-client.conf

# Surge Client Reference Configuration
# Chained proxy setup: Relay (Shadowsocks) + Landing (Trojan)
#
# Replace placeholders:
#   RELAY_IP        - Relay server IP address
#   SS_PORT         - Shadowsocks port (default: 8388)
#   SS_PASSWORD     - Shadowsocks password
#   LANDING_DOMAIN  - Landing server domain name
#   TROJAN_PASSWORD - Trojan password

[General]
loglevel = notify

[Proxy]
# Relay server - Shadowsocks (中转机)
Relay-SS = ss, RELAY_IP, SS_PORT, encrypt-method=aes-256-gcm, password=SS_PASSWORD

# Landing server - Trojan direct (落地机直连)
Landing-Trojan = trojan, LANDING_DOMAIN, 443, password=TROJAN_PASSWORD

# Landing server - chained through relay (落地机经中转)
Landing-Chain = trojan, LANDING_DOMAIN, 443, password=TROJAN_PASSWORD, underlying-proxy=Relay-SS

[Proxy Group]
# For services needing landing server's local IP (AI, streaming)
Chain = select, Landing-Chain
# For direct access to landing server
Direct-Landing = select, Landing-Trojan

[Rule]
# =============================================
# Sukka's Rulesets (https://github.com/SukkaW/Surge)
# DOMAIN-SET and non_ip rules MUST come before ip rules
# =============================================

# --- AI Services → Chain (exit from landing IP) ---
DOMAIN-SET,https://ruleset.skk.moe/List/domainset/ai.conf,Chain
RULE-SET,https://ruleset.skk.moe/List/non_ip/ai.conf,Chain

# --- Streaming Services → Chain (exit from landing IP) ---
RULE-SET,https://ruleset.skk.moe/List/non_ip/stream_us.conf,Chain

# --- IP-based rules (must come after domain rules) ---
RULE-SET,https://ruleset.skk.moe/List/ip/stream_us.conf,Chain

# --- Default: all other traffic through relay ---
FINAL,Relay-SS