# frpc.toml — per-host client (Native mTLS tunnel · V7 / M1 / S1).
#
# Copy to the LOCAL host that runs the base app, fill the <PLACEHOLDERS>, chmod 600.
# TEMPLATE ONLY — NO REAL SECRETS committed. frpc dials OUT to the VPS :443; nothing is opened
# inbound on the local host.
#
#   frps ≥ v0.52 required (`disableCustomTLSFirstByte` exists ≥ v0.50) — it makes frpc send a real TLS
#   ClientHello first byte (0x16) so the VPS nginx `ssl_preread` stream can SNI-route it (PLAN M1 #6).

serverAddr = "8.138.1.192"
serverPort = 443

auth.method = "token"
auth.token = "<FRP_TOKEN>"                 # same token as frps.toml (/etc/relay/secrets.env)

# --- control-channel TLS: present THIS host's frp-client cert to frps; verify the frps server cert ---
transport.tls.enable = true
transport.tls.serverName = "frp.terminal.yaojia.wang"   # SNI the stream routes to frps :7000
transport.tls.disableCustomTLSFirstByte = true          # CRITICAL for ssl_preread (real ClientHello first)
transport.tls.certFile      = "<host-frp-client.cert.pem>"   # issued by gen-device-ca.sh --kind frp-client + issue-device-cert.sh
transport.tls.keyFile       = "<host-frp-client.key.pem>"    # (0600)
transport.tls.trustedCaFile = "<frps-ctrl-ca.cert.pem>"      # CA that signed frps-ctrl.cert.pem (V1)

loginFailExit = false                       # keep retrying if the VPS/frps is briefly down

[[proxies]]
name = "<name>"                             # unique per host; frps rejects duplicate subdomains
type = "http"
localIP = "127.0.0.1"                        # base app must bind loopback (BIND_HOST=127.0.0.1)
localPort = 3000
subdomain = "<name>"                         # reachable at https://<name>.terminal.yaojia.wang