Hosts

A host is the entry point the client sees. The user imports a subscription link, the app receives a list of hosts, and it connects to the address specified in them. A host links an inbound of a config profile, nodes, and connection parameters.

Why hosts are needed

The same inbound can be served by different hosts: for example, "Finland" and "Germany" point to different sets of nodes. The client sees hosts as separate connections and switches between them.

• a host without nodes, or with disabled nodes, is useless to the user;
• a host is served only to those users whose internal squad contains the inbound of that host;
• a disabled (isDisabled) host does not make it into the subscription.

Binding to inbounds

In the host form, first select an inbound — one inbound per host:

{
  "inbound": {
    "configProfileUuid": "00000000-0000-0000-0000-000000000000",
    "configProfileInboundUuid": "11111111-1111-1111-1111-111111111111"
  },
  "nodes": ["22222222-2222-2222-2222-222222222222"]
}

The default port is inherited from the inbound, but you can override it. If the inbound is removed from the profile, the host stops being served — this is visible in the host list.

Address, port, and SNI

Field	Purpose
address	IP or domain the client connects to. A domain is preferable: when the IP changes, it is enough to update DNS
port	connection port; by default it matches the inbound port
sni	server name for TLS/REALITY. Empty — the value from the inbound is used
host	the value of the Host header or serverName where it is needed
path	path for WebSocket, gRPC, XHTTP
securityLayer	DEFAULT (as in the inbound), TLS, or NONE
alpn	h3, h2, http/1.1, or combinations of them
fingerprint	TLS client fingerprint: chrome, firefox, safari, randomized, and others
overrideSniFromAddress	substitute SNI from address
keepSniBlank	keep SNI empty
pinnedPeerCertSha256, verifyPeerCertByName	server certificate verification

The fields xhttpExtraParams, muxParams, sockoptParams, and finalMask are fine-grained transport settings; fill them in only if you know what you are doing.

Use in subscriptions

Field	Effect on the subscription
remark	the connection name the user sees
isDisabled	the host is excluded from the output
isHidden	the host is not shown in the browser view of the subscription but stays in the client configuration
shuffleHost	random host order
excludeFromSubscriptionTypes	exclude the host from specific formats, for example only from MIHOMO
xrayJsonTemplateUuid	a custom Xray JSON template for this host
serverDescription	server label for "extended" clients
mihomoX25519, mihomoIpVersion	Mihomo parameters
internalSquads.mode	restricting the host by squads: EXCLUDE or ALLOW_ONLY
mapper	mapping values from the inbound into the client config

tip

ALLOW_ONLY requires selecting at least one internal squad — otherwise the form will not save. See Squads for how this works.

warning

When you change address or sni, verify the result in the client: some apps cache the subscription and do not refresh it immediately.

What's next

• Squads — who can access which hosts.
• Templates — the form in which hosts reach the client.
• Nodes — the servers behind the hosts.
• Clients — supported apps.