My Surge.app config file

surge.conf

# My custom Surge.app configuration
# Proxy (most) traffic via Shadowsocks

[General]
loglevel = notify
bypass-system = true
skip-proxy = 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, localhost, *.local
bypass-tun = 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12
dns-server = 208.67.222.222, 208.67.220.220

[Proxy]
// Shadowsocks using the external module.
// Should upgrade to an AEAD cipher when supported.
ProxySS = custom, 94.242.57.189, 443, aes-256-cfb, PASSWORD_GOES_HERE, https://s3.amazonaws.com/f.cl.ly/items/0S3L2T0m0v110x2I0L1w/SSEncrypt.module

[Rule]
// Block very intrusive spyware
DOMAIN-SUFFIX,crashlytics.com,REJECT
// Don't proxy Steam to avoid an hypothetical ban.
DOMAIN-SUFFIX,steampowered.com,DIRECT
DOMAIN-SUFFIX,steamstatic.com,DIRECT
DOMAIN-SUFFIX,steamcommunity.com,DIRECT
DOMAIN-SUFFIX,steamstore-a.akamaihd.net,DIRECT
DOMAIN-SUFFIX,steamcdn-a.akamaihd.net,DIRECT
DOMAIN-SUFFIX,steamcommunity-a.akamaihd.net,DIRECT

// Telegram
IP-CIDR,91.108.56.0/22,ProxySS,no-resolve
IP-CIDR,91.108.4.0/22,ProxySS,no-resolve
IP-CIDR,109.239.140.0/24,ProxySS,no-resolve
IP-CIDR,149.154.160.0/20,ProxySS,no-resolve

// LAN
IP-CIDR,192.168.0.0/16,DIRECT
IP-CIDR,10.0.0.0/8,DIRECT
IP-CIDR,172.16.0.0/12,DIRECT
IP-CIDR,127.0.0.0/8,DIRECT

FINAL,ProxySS