Generated OpenClash/Mihomo profiles, routing rules, DNS integrations, and a fail-closed OpenClash Guard for region-aware AI and service traffic.
OpenClash Guard deliberately does not support remote pipe-to-shell installation or automatic upgrades. Provision the trusted release public key out-of-band first, then authenticate signed release metadata before executing any downloaded bytes.
work=/tmp/openclash-guard-install
rm -rf "$work" && mkdir -p "$work" && cd "$work"
curl -fSLo release.json https://raw.githubusercontent.com/mythic3011/rules/refs/heads/main/dist/openclash-guard.release.json
curl -fSLo release.json.sig https://raw.githubusercontent.com/mythic3011/rules/refs/heads/main/dist/openclash-guard.release.json.sig
usign -V -q -m release.json -p /etc/openclash-guard/trusted-release-key.pub -x release.json.sig
bundle_sha=$(jsonfilter -i release.json -e '@.artifacts.guardBundle.sha256')
curl -fSLo openclash-guard.sh https://raw.githubusercontent.com/mythic3011/rules/refs/heads/main/dist/openclash-guard.sh
printf '%s %s\n' "$bundle_sha" openclash-guard.sh | sha256sum -c -
/bin/sh -n openclash-guard.sh
/bin/sh ./openclash-guard.shA checksum fetched beside an artifact is not a trust anchor. The usign signature authenticates the metadata that contains the SHA-256 values; the SHA-256 then authenticates the downloaded artifact, following the same trust-chain shape used by OpenWrt package metadata and APT repository metadata.
- Interactive OpenClash Guard setup and operations
- Generated OpenClash profiles and rule providers
- AI/service region-aware routing
- DNS and AdGuard Home integration
- Gaming-safe routing controls
- Fail-closed protection for sensitive services
openclash-guard
openclash-guard status
openclash-guard doctor
openclash-guard refreshSee the OpenClash Guard guide for installation, direct-source fallback, automation, and the complete CLI reference.
The optional Profile Builder creates personalized subscription templates. Its deployment guide uses the locked pnpm workspace from a full checkout.
cfg/— OpenClash/Mihomo profiles and templatesrule/— rule providersdns/— DNS and hosts outputsdist/— standalone generated applications and build metadata
See AI profile generation and repository layout for ownership and build details.
| Topic | Guide |
|---|---|
| Installation and usage | OpenClash Guard · Getting started |
| Configuration | AI routing configuration |
| Architecture | Routing schema · Firewall proof |
| Development | Repository layout · Python tooling |
| Generated artifacts | AI profile generator |
| CI and workflows | GitHub Actions |