# Encrypt with: sops -e -i secrets/network.yaml
# xray-endpoint: xray server IP (spliced into sing-box route rules at runtime)
# route-exclude: JSON array of CIDRs excluded from the TUN (sing-box quote=false splice)
# ssh-hosts:     ssh_config fragment, pulled in via Include /run/secrets/ssh-hosts
xray-endpoint: 203.0.113.1
route-exclude: '["203.0.113.1/32","198.51.100.7/32","10.20.0.0/24","fd69:69:69::/64"]'
ssh-hosts: |
  Host jump
    HostName 10.20.0.10
    AddressFamily inet

  Host myserver.example.com myserver
    HostName myserver.example.com
    ProxyJump jump