Sub-Store

Advanced Subscription Manager for QX, Loon, Surge, Stash, Egern and Shadowrocket

📚 文档/Doc 🆕, Wiki

sub.store Domain Safety Notice

Statement

⚠️ sub.store is only the domain used by module-script rewrite MitM rules. It is not a public domain owned by us.

Risk

If a request does not go through the rewrite, the data will be sent to the public sub.store service.

You can map sub.store to 127.0.0.1 or another local address to prevent accidental access to the public sub.store. However, ordinary users may still send requests to the public sub.store after switching or toggling configuration modules.

1. It could, in theory, redirect users to a fake frontend. This is only a possibility and does not imply that the owner of sub.store would do this. Note: The official frontend is https://sub-store.vercel.app.
2. It could receive user data from sub.store.

This creates a data leakage risk.

Plan

After listening to suggestions from the group, we will not switch to a new domain for now. Choosing a new domain is also awkward: it needs to be related, short, and unlikely to be registered by someone else, at least in the short term.

This notice is published only as an announcement. No changes will be made for now.

Example:

[Host]
sub.store = 127.0.0.1

CORS Allowlist

Sub-Store also supports a configurable browser CORS allowlist for the backend API. This does not change the module rewrite domain, but it limits which browser origins can read API responses through CORS.

• Node/server deployments use SUB_STORE_CORS_ALLOWED_ORIGINS; the default is https://sub-store.vercel.app,http://substore.stash,https://substore.stash.
• Proxy App modules use the cors module argument; the default is https://sub-store.vercel.app,http://substore.stash,https://substore.stash.
• Multiple origins can be separated by commas. Origins are matched exactly by scheme, host, and port. Set the value to * only when you accept the risk of any website reading the local backend through browser CORS.

Node push notifications

For Node deployments, SUB_STORE_PUSH_SERVICE accepts a Shoutrrr URL or an existing HTTP/HTTPS URL template. Shoutrrr URLs are sent in-process with shoutrrr-ts; a separate shoutrrr executable is no longer used or required. HTTP/HTTPS URL templates still use the existing request path and [推送标题] / [推送内容] placeholders.

The supported Shoutrrr URL families are Generic Webhook (generic://, generic+https://, generic+http://), Bark, Discord, Gotify, Google Chat (hangouts:// alias), IFTTT, Join, Mattermost, ntfy, OpsGenie, Pushover, Pushbullet, Rocket.Chat, Slack, Microsoft Teams, Telegram, and Zulip. Matrix (matrix://) and SMTP (smtp://) are not supported, and there is no fallback to the old executable. Check existing configurations before upgrading; unsupported URLs produce a notification error instead of sending. See upstream compatibility details for URL options and caveats. Upstream checks use local Go-compatibility fixtures, not verified live delivery to every provider. The backend's tested Node version is in .node-version; check the upstream package for its current Node support.

Push URLs may contain secrets: treat SUB_STORE_PUSH_SERVICE as privileged configuration. Diagnostics from the Shoutrrr path do not print the configured URL. This change does not alter the HTTP/HTTPS URL template path or its existing logging behavior.

Core functionalities:

1. Conversion among various formats.
2. Subscription formatting.
3. Collect multiple subscriptions in one URL.
4. Host and modify subscriptions/files

The following descriptions of features may not be updated in real-time. Please refer to the actual available features for accurate information.

1. Subscription Conversion

Supported Input Formats

本地节点怎么写/How To Write A Local Node

⚠️ Do not use Shadowrocket or NekoBox to export URI and then import it as input. The URIs exported in this way may not be standard URIs. However, we have already supported some very common non-standard URIs (such as VMess, VLESS).

• Proxy URI Scheme(socks5, socks5+tls, http, https(it's ok))

  example: socks5+tls://user:pass@ip:port#name

• URI(AnyTLS, SOCKS, SS, SSR, VMess, VLESS, Trojan, Hysteria, Hysteria 2, TUIC v5, WireGuard)

  Please note, HTTP(s) does not have a standard URI format, so it is not supported. Please use other formats.

• Clash Proxies YAML

• Clash Proxy JSON/JSON5/YAML(single line)

  NaiveProxy

• QX (SS, SSR, VMess, Trojan, HTTP, SOCKS5, VLESS, AnyTLS)

• Loon (SS, SSR, VMess, Trojan, HTTP, SOCKS5, SOCKS5-TLS, WireGuard, VLESS, Hysteria 2, AnyTLS)

• Surge (Direct, SS, VMess, Trojan, HTTP, HTTPS, HTTP/2 CONNECT, SOCKS5, SOCKS5-TLS, AnyTLS, TrustTunnel, TUIC, Snell, Hysteria 2, MASQUE(Surge), SSH(Password authentication only), External Proxy Program(only for macOS), WireGuard(Surge to Surge))

• mihomo(Clash.Meta) Compatible (Direct, SS, SSR, VMess, Trojan, HTTP, SOCKS5, Snell, VLESS, WireGuard, Hysteria, Hysteria 2, TUIC, SSH, mieru, sudoku, AnyTLS, MASQUE, Tailscale, GOST Relay, Shadow QUIC, ZeroTier, OpenVPN)

Deprecated(The frontend doesn't show it, but the backend still supports it, with the query parameter target=Clash):

• Clash (SS, SSR, VMess, Trojan, HTTP, SOCKS5, Snell, VLESS, WireGuard)

Supported Target Platforms

• Plain JSON
• Stash
• Clash.Meta(mihomo)
• Surfboard
• Surge
• SurgeMac(Use mihomo to support protocols that are not supported by Surge itself)
• Loon
• Egern
• Shadowrocket
• QX
• sing-box
• V2Ray
• V2Ray URI

Deprecated:

• Clash

2. Subscription Formatting

Filtering

• Regex filter
• Discard regex filter
• Region filter
• Type filter
• Useless proxies filter
• Script filter

Proxy Operations

• Set property operator: set some proxy properties such as udp,tfo, skip-cert-verify etc.
• Flag operator: add flags or remove flags for proxies.
• Sort operator: sort proxies by name.
• Regex sort operator: sort proxies by keywords (fallback to normal sort).
• Regex rename operator: replace by regex in proxy names.
• Regex delete operator: delete by regex in proxy names.
• Script operator: modify proxy by script.
• Resolve Domain Operator: resolve the domain of nodes to an IP address.

Development

Install pnpm

Go to backend directories, install node dependencies:

pnpm i

SUB_STORE_BACKEND_API_PORT=3000 pnpm esbuild:dev

or this one if you're using Termux

SUB_STORE_BACKEND_API_PORT=3000 pnpm run --parallel "/^dev:.*/"

Build

pnpm bundle:esbuild

LICENSE

This project is under the AGPL-3.0 LICENSE.

Star History

Acknowledgements

• Special thanks to @KOP-XIAO for his awesome resource-parser. Please give a star for his great work!
• Special thanks to @Orz-3 and @58xinian for their awesome icons.

Sponsors

NodeSupport sponsored this project.

致谢

感谢赞助商 ForZTN 对项目服务器的支持，感谢。