ansible-proxy-chain/openspec/changes/archive/2026-04-22-china-direct-bypass/design.md

Context

The current docs/surge-client.conf routes AI/streaming through the chained landing proxy and everything else through the relay. There is no handling for China-destined traffic, which gets unnecessarily routed through the relay server, adding latency and potentially breaking access to domestic services.

Sukka's ruleset already provides comprehensive China domain and IP lists at ruleset.skk.moe.

Goals / Non-Goals

Goals:

• Route China domains and IPs to DIRECT in the reference Surge client config
• Use Sukka's maintained China rulesets (no self-maintained lists)
• Maintain correct rule ordering (domain rules before IP rules)

Non-Goals:

• Server-side changes (this is purely client-side Surge config)
• GeoIP database management (Surge handles this via Sukka's rulesets)

Decisions

1. Rule placement: China rules before FINAL, after service-specific rules

China direct rules are inserted after the AI/streaming rules but before FINAL. This way, AI/streaming traffic still goes through the chain even if the IP happens to resolve to a China range, while general China traffic goes direct.

Ordering:

1. AI domain/non_ip rules → Chain
2. Streaming domain/non_ip rules → Chain
3. China domain/non_ip rules → DIRECT (new)
4. Streaming IP rules → Chain
5. China IP rules → DIRECT (new)
6. FINAL → Relay-SS

2. Use Sukka's China rulesets

• domainset/cn.conf — China domain set
• non_ip/domestic.conf — non-IP China domestic rules
• ip/domestic.conf — China IP CIDR rules

Consistent with the existing approach of delegating all domain/IP lists to Sukka.

Risks / Trade-offs

• [China IP range overlap with CDN] → Some international services use China CDN nodes. These will go direct instead of through the proxy. This is typically desired behavior (faster access). If specific services break, they can be added as exceptions above the China rules.