This is an English summary of the Chinese article. All keys, domains, and tokens below are placeholders
<...>— replace them with your own.
What problem this solves#
Holding several proxy subscriptions usually means: uneven node quality, daily manual switching between clients, and no clean way to share with family. This guide shows a “three-in-one subscription gateway”: one subscription link, imported into Clash, with automatic routing by site type.
Architecture#
Cloud sync Worker (periodically fetch upstream subs → merge → slim → store in KV)
↓
Gateway (Sub-Store on Cloudflare Pages)
├─ /api/file/full → full subscription (admin-token protected)
└─ /guest/<token> → guest subscription (for family/friends)
↓
Clash / Clash Verge imports subscription → auto-routingYou maintain only one subscription link. Upstream subscriptions are aggregated on Cloudflare.
Cloudflare resources needed#
| Resource | Type | Role |
|---|---|---|
| Gateway | Pages | Runs Sub-Store, serves the subscription |
| Sync Worker | Worker | Cron (e.g. every 6h) fetches upstream, merges, updates KV |
| KV | KV | Sub-Store data / sync results |
| Nav page | Pages | Human-facing entry (contains no secrets) |
The nav page exposes only buttons (copy subscription, jump to backend, sync status). No passwords, no token-bearing links — this isolation prevents accidental credential leaks via screenshots.
Steps#
- Aggregate subscriptions — add each upstream sub in Sub-Store, then combine them into one collection. (Note: some subs are behind Cloudflare JS Challenge; fetch locally or with a rotating
cf_clearancecookie.) - Design proxy groups — the core of auto-routing. Daily use needs zero changes; rules already route for you. Know just 4 groups: 🔓 Smart Unlock (AI/streaming), 🌐 Save-Traffic (YouTube/Google), 🎛️ Master Switch (force one node), 🏠 HK Residential (best unlock).
- Import into Clash — paste
https://<your-gateway>/<admin-token>/api/file/full. Guests usehttps://<sync-worker>/guest/<token>. - Automate sync — Cloud Worker Cron every 6h; optional local fallback script (most reliable way to fetch all nodes when upstreams block the cloud).
Security boundaries (critical for public deployment)#
- Admin token protects the full subscription.
- Nav page carries zero secrets.
- Guest tokens are isolated and revocable.
- Real credentials never reach the client.
- Config changes must stay in sync between local generator and cloud Worker.
Common troubleshooting#
| Symptom | Cause / Fix |
|---|---|
| 403 “Just a moment” on fetch | JS Challenge → refresh cookie |
| Node count drops (only no-cookie upstream) | Cookie expired → refresh |
| 429 on sync | Free Browser Rendering quota exhausted (~10 min/day) → wait for reset |
| Nav page unreachable | Check Pages project + CNAME |
Summary#
Aggregating multiple subscriptions into “one gateway + auto-routing” is essentially using Cloudflare as a merge-and-scheduler layer: upstream = multiple subs, middle = Worker sync + Sub-Store, downstream = Clash routes by rule, user-unaware. The whole setup is free (Cloudflare Free is enough for personal/small-group use); main upkeep is the weekly cookie refresh and keeping the local fallback alive.
Full Chinese version: /posts/multi-sub-gateway/
