# iPhone Proxy Setup Guide

## Prerequisites
- ✅ Tailscale installed and connected on iPhone
- ✅ server2 proxy running at `100.70.115.1`

## Option 1: System-Wide Proxy (Limited Support)

iOS has limited system-wide proxy support. This works for some apps but not all browsers.

### Steps:
1. Open **Settings** → **Wi-Fi**
2. Tap the **ⓘ** icon next to your connected Wi-Fi network
3. Scroll down to **HTTP Proxy**
4. Select **Manual**
5. Configure:
   - **Server:** `100.70.115.1`
   - **Port:** `7890` (HTTP) or `7892` (Mixed)
   - **Authentication:** Off
6. Save

**Note:** This only works when connected to that specific Wi-Fi network. It won't work on cellular or other Wi-Fi networks.

## Option 2: Proxy App (Recommended)

**⚠️ Important: VPN Conflict Solution**

iOS only allows **one VPN connection** at a time. Since Tailscale uses VPN mode, you have two options:

### Solution A: Use Shadowrocket in Proxy Mode (Recommended)

Shadowrocket can work **WITH Tailscale** if configured correctly:

1. **Keep Tailscale ON** (for network access)
2. Install **Shadowrocket** from App Store
3. Open Shadowrocket
4. Tap **+** (Add Server)
5. Select **HTTP** (not VPN mode)
6. Configure:
   - **Type:** HTTP
   - **Address:** `100.70.115.1` (Tailscale IP)
   - **Port:** `7890`
   - **Name:** server2-proxy
7. Tap **Done**
8. **Important:** In Shadowrocket settings:
   - Go to **Settings** → **Proxy**
   - Enable **"Use Proxy"** but **DO NOT enable VPN mode**
   - Or use **"Proxy" mode** instead of **"VPN" mode**
9. Enable the proxy

**How it works:** Shadowrocket routes traffic through the proxy, but uses Tailscale's VPN connection to reach the proxy server. Both work together!

### Solution B: Use Shadowrocket VPN Mode (Disable Tailscale)

If you need Shadowrocket's VPN mode:
1. **Disable Tailscale** temporarily
2. Use Shadowrocket in VPN mode
3. Shadowrocket will handle both VPN and proxy routing

**Note:** You'll lose direct Tailscale network access, but can still reach server2 via proxy.

### Surge (Paid, ~$10)
Similar setup process - supports more advanced features.

### Potatso Lite (Free)
1. Install **Potatso Lite**
2. Add proxy with same settings

## Option 3: Safari Browser Extension

Some browsers support proxy extensions, but iOS Safari doesn't support system proxies well.

## Option 4: Clash Client for iOS

If you want to use Clash directly on iPhone:

### Clash Meta for iOS (Stash)
1. Install **Stash** from App Store (or use TestFlight)
2. Add your server2 as an HTTP proxy
3. Configure routing rules

## Quick Test

After setup, test if proxy is working:

1. Open Safari or your browser
2. Visit: https://api.ipify.org
3. It should show server2's IP: `158.101.140.85` (not your iPhone's IP)

Or visit: http://100.70.115.1:9090/ui to see Clash dashboard

## Recommended Setup

**Best Solution: Use Both Together**
- **Keep Tailscale ON** (for network connectivity)
- Use **Shadowrocket in Proxy mode** (not VPN mode)
- Configure HTTP proxy: `100.70.115.1:7890`
- Shadowrocket will route through Tailscale's connection
- Works on both Wi-Fi and cellular

**Alternative: Use Shadowrocket VPN Mode**
- Disable Tailscale when using Shadowrocket VPN mode
- Shadowrocket handles both VPN and proxy
- You'll need to manually switch between them

## Troubleshooting

### VPN Conflict?
- **If both Tailscale and Shadowrocket show VPN icons:** You can only have one active
- **Solution:** Use Shadowrocket in **Proxy mode** (not VPN mode) while Tailscale is active
- **Or:** Disable Tailscale and use Shadowrocket VPN mode

### Can't connect?
1. Verify Tailscale is connected on iPhone (needed to reach `100.70.115.1`)
2. Check Tailscale status: Open Tailscale app, verify you see "oracle-tokyo" device
3. Test connection: Open Safari, visit `http://100.70.115.1:9090/ui`
4. If dashboard loads, proxy is reachable via Tailscale

### Proxy not working?
1. Check if proxy app is enabled/running
2. Verify server2 is online: `ssh server2 'sudo systemctl status clash-meta'`
3. Try different port: 7890 (HTTP), 7891 (SOCKS5), or 7892 (Mixed)
4. Make sure Tailscale is connected (required to reach the proxy server)