{
  "log": {
    "level": "error"
  },
  "dns": {
    "servers": [
      {
        "type": "local",
        "tag": "default"
      }
    ]
  },
  "inbounds": [
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen_port": 7897
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "masque",
      "tag": "masque-out",
      "system": false,
      "name": "masque0",
      "use_http2": false,
      // TCP-only CONNECT proxy over HTTP/3 instead of a CONNECT-IP tunnel
      "use_l4_proxy": false,
      "use_ipv6": false,
      "profile": {
        "detour": "direct",
        // For getting existing MASQUE device profile, else sing-box will create new profile
        "id": "",
        "auth_token": "",
        "license_key": ""
      },
      // Optional: override the endpoint instead of using the one returned by Cloudflare
      "address": "",
      "port": 0,
      "udp_timeout": "5m0s",
      "udp_keepalive_period": "30s",
      "udp_initial_packet_size": 0,
      "reconnect_delay": "5s",
      // Timeout for establishing a connection to the endpoint; 0 = no timeout
      "handshake_timeout": "0s",
      "congestion_controller": "bbr",
      "cwnd": 0,
      "tls": { // TLS fields for HTTP2
        "server_name": "", // SNI; empty = default "consumer-masque.cloudflareclient.com" ("consumer-masque-proxy.cloudflareclient.com" with use_l4_proxy)
        "insecure": false,
        "cipher_suites": [],
        "curve_preferences": [],
        "fragment": false,
        "fragment_fallback_delay": "500ms",
        "record_fragment": false,
        "kernel_tx": false,
        "kernel_rx": false
      }
      // Dial Fields
    }
  ],
  "route": {
    "final": "masque-out",
    "default_domain_resolver": "default",
    "auto_detect_interface": true
  }
}