增加StreamSettings字段支持，并修正security 参数逻辑，改为IPIfNonMatch适应全部规则

internal/kernel/xray/config.go

@@ -94,6 +94,9 @@ func outboundConfigToXray(oc model.OutboundConfig) M {
 	}
 	if len(oc.Settings) > 0 {
 		m["settings"] = oc.Settings
+	}
+		if len(oc.StreamSettings) > 0 {
+		m["streamSettings"] = oc.StreamSettings
 	}
 	if oc.ProxyTag != "" {
 		m["proxySettings"] = M{"tag": oc.ProxyTag}
@@ -577,19 +580,21 @@ func applyStreamSettings(base M, nc *model.NodeSpec, tc kernel.TLSCert) {
 				tlsSettings["echServerKeys"] = echKeys
 			}
 		}
+
+		// 核心修改：只有当有证书时，才写入 security 和 tlsSettings
 		if tc.HasCert() {
 			tlsCert := M{
 				"certificate": []string{string(tc.CertPEM)},
 				"key":         []string{string(tc.KeyPEM)},
 			}
 			tlsSettings["certificates"] = []M{tlsCert}
-		} else {
-			// Fallback placeholder for auto-TLS environments.
-			// Xray allows empty certificates array in more cases than sing-box,
-			// but providing a placeholder helps documentation.
+			
+			// 只有在这里才设置 security 为 "tls"
+			ss["security"] = "tls"
+			ss["tlsSettings"] = tlsSettings
 		}
-		ss["security"] = "tls"
-		ss["tlsSettings"] = tlsSettings
+		// 如果没有证书，上述代码块不执行，ss["security"] 保持默认值（即 "none"）
+
 	} else if nc.TLS == 2 {
 		ss["security"] = "reality"
 		ss["realitySettings"] = buildRealitySettings(nc)
@@ -684,7 +689,7 @@ func buildRouting(rules []model.RouteRule, customRouteRules []model.CustomRouteR
 	}
 
 	return M{
-		"domainStrategy": "AsIs",
+		"domainStrategy": "IPIfNonMatch",
 		"rules":          xrayRules,
 	}
 }

internal/model/panel.go

@@ -61,6 +61,7 @@ func NodeSpecFromPanel(nc *panel.NodeConfig) *NodeSpec {
 			Tag:      outbound.Tag,
 			Protocol: outbound.Protocol,
 			Settings: cloneAnyMap(outbound.Settings),
+			StreamSettings: cloneAnyMap(outbound.StreamSettings),
 			ProxyTag: outbound.ProxyTag,
 		})
 	}
@@ -200,6 +201,7 @@ func (n *NodeSpec) ToPanel() *panel.NodeConfig {
 			Tag:      outbound.Tag,
 			Protocol: outbound.Protocol,
 			Settings: cloneAnyMap(outbound.Settings),
+			StreamSettings: cloneAnyMap(outbound.StreamSettings),
 			ProxyTag: outbound.ProxyTag,
 		})
 	}

internal/model/types.go

@@ -51,6 +51,7 @@ type OutboundConfig struct {
 	Tag      string
 	Protocol string
 	Settings map[string]any
+	StreamSettings map[string]any
 	ProxyTag string
 }
 

internal/panel/types.go

@@ -214,6 +214,7 @@ type OutboundConfig struct {
 	Tag      string         `json:"tag"`                 // Unique tag for routing
 	Protocol string         `json:"protocol"`            // vmess, vless, shadowsocks, wireguard, etc.
 	Settings map[string]any `json:"settings,omitempty"`  // Protocol-specific settings
+	StreamSettings map[string]any `json:"streamSettings,omitempty"`  // Protocol-specific settings
 	ProxyTag string         `json:"proxy_tag,omitempty"` // Chain proxy: next outbound tag
 }