# Shadowrocket Setup with Public IP (No Tailscale VPN Needed)

## ✅ Solution: Proxy Now Accessible via Public IP

The proxy is now configured to listen on the public IP, so you can use Shadowrocket **without** Tailscale VPN!

## Setup Steps

### Step 1: Get Proxy Credentials

```bash
ssh server2 'cat ~/.clash_credentials.txt'
```

You'll see: `username:password`

### Step 2: Configure Shadowrocket on iPhone

1. **Disable Tailscale VPN** (Settings → Tailscale → toggle OFF)
   - This frees up the VPN slot for Shadowrocket

2. **Open Shadowrocket**
   - Go to **Home** tab
   - Tap **"+"** to add server

3. **Add HTTP Proxy with Authentication:**
   - **Type:** HTTP
   - **Address:** `158.101.140.85` (server2's public IP)
   - **Port:** `7890` (HTTP) or `7892` (Mixed)
   - **Username:** (from credentials file)
   - **Password:** (from credentials file)
   - **Remark:** `server2-proxy`

4. **Enable Shadowrocket:**
   - Select your proxy server
   - Toggle switch **ON**
   - VPN icon should appear in status bar

### Step 3: Test

1. Turn OFF Wi-Fi (use cellular only)
2. Open Safari
3. Visit: https://api.ipify.org
4. Should show: `158.101.140.85` (server2's IP) ✅

## Proxy Details

- **Public IP:** `158.101.140.85`
- **Ports:**
  - `7890` - HTTP
  - `7891` - SOCKS5
  - `7892` - Mixed (HTTP + SOCKS5) - **Recommended**
- **Authentication:** Required (username/password)

## Security Notes

✅ **Protected by:**
- Username/password authentication
- Firewall rules (UFW active)
- Only proxy ports exposed (not SSH or other services)

⚠️ **Considerations:**
- Proxy is accessible from public internet
- Anyone with credentials can use it
- Monitor usage: `ssh server2 'sudo journalctl -u clash-meta -f'`

## Advantages

✅ Works on **both Wi-Fi and cellular**
✅ **No Tailscale VPN needed** (can keep it off)
✅ Shadowrocket VPN mode works independently
✅ Simple setup

## Get Credentials

Run this command to get your proxy credentials:

```bash
ssh server2 'cat ~/.clash_credentials.txt'
```

Then use them in Shadowrocket when adding the proxy server.

## Troubleshooting

**Can't connect?**
1. Check server2 is online: `ssh server2 'sudo systemctl status clash-meta'`
2. Verify credentials are correct
3. Try different port: 7890, 7891, or 7892
4. Check firewall: `ssh server2 'sudo ufw status'`

**Proxy slow?**
- Normal - traffic goes: iPhone → Internet → server2 → Internet
- Depends on server2's connection speed

## Change Credentials

If you want to change the password:

```bash
ssh server2 'openssl rand -base64 12'
```

Then update `~/.config/clash-meta/config.yaml` and restart Clash.