diff --git a/README.md b/README.md
index f46b4e32..00599108 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,7 @@ Plugin list
 
  * [workingdir](plugin/workingdir/) 🔀: `/home`-like directory to managed upstreams routing by sshpiped.
  * [workingdirbykey](plugin/workingdirbykey/) 🔀: same as `workingdir` but uses public key to route.
+ * [yaml](plugin/yaml/) 🔀: config routing with a single yaml file.
  * [azdevicecode](plugin/azdevicecode/) 🔒: ask user to enter [azure device code](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code) before login
  * [fixed](plugin/fixed/) 🔀: fixed targetting the dummy sshd server
  * [simplemath](plugin/simplemath/) 🔒: ask for very simple math question before login, demo purpose
diff --git a/plugin/yaml/README.md b/plugin/yaml/README.md
new file mode 100644
index 00000000..b74d0912
--- /dev/null
+++ b/plugin/yaml/README.md
@@ -0,0 +1,65 @@
+# yaml plugin for sshpiperd
+
+The yaml plugin for sshpiperd is a simple plugin that allows you to use single yaml file to configure your sshpiperd.
+
+some basic idea of yaml config file:
+
+ * first matched `pipe` will be used.
+ * any `from` in `pipe` fits `downstream` authentication will be considered as the `pipe` matched.
+ * `username_regex_match` can be used to match with regex
+ * `authorized_keys`, `private_key`, `known_hosts` are `path/to/target/file`, but there are also `authorized_keys_data`, `private_key_data`, `known_hosts_data` accepting base64 inline data
+ * magic placeholders in path, example usage: `/path/to/$UPSTREAM_USER/file`
+    * `DOWNSTREAM_USER`: supported in `private_key`, `known_hosts`
+    * `UPSTREAM_USER`: supported in `authorized_keys`, `private_key`, `known_hosts`
+    * environment variables: supported in `authorized_keys`, `private_key`, `known_hosts`
+
+## Usage
+
+```
+sshpiperd yaml --config /path/to/sshpiperd.yaml
+```
+
+### options
+
+```
+   --config value   path to yaml config file [$SSHPIPERD_YAML_CONFIG]
+   --no-check-perm  disable 0400 checking (default: false) [$SSHPIPERD_YAML_NOCHECKPERM]
+```
+
+## Config example
+
+```yaml
+# yaml-language-server: $schema=https://raw.githubusercontent.com/tg123/sshpiper/master/plugin/yaml/schema.json
+version: "1.0"
+pipes:
+- from:
+    - username: "password_simple"
+  to:
+    host: host-password:2222
+    username: "user"
+    ignore_hostkey: true
+- from:
+    - username: "password_.*_regex"
+      username_regex_match: true
+  to:
+    host: host-password:2222
+    username: "user"
+    ignore_hostkey: true
+- from:
+    - username: "publickey_simple"
+      authorized_keys: /path/to/publickey_simple/authorized_keys
+  to:
+    host: host-publickey:2222
+    username: "user"
+    private_key: /path/to/host-publickey/id_rsa
+    known_hosts_data: "base64_known_hosts_data"
+- from:
+    - username: ".*" # catch all    
+      username_regex_match: true
+      authorized_keys: /path/to/catch_all/authorized_keys
+  to:
+    host: host-publickey:2222
+    username: "user"
+    ignore_hostkey: true
+    private_key: /path/to/host-publickey/id_rsa
+```
\ No newline at end of file
diff --git a/plugin/yaml/schema.json b/plugin/yaml/schema.json
new file mode 100644
index 00000000..ce5dc7c1
--- /dev/null
+++ b/plugin/yaml/schema.json
@@ -0,0 +1,95 @@
+{
+    "$schema": "http://json-schema.org/draft-06/schema#",
+    "$ref": "#/definitions/sshpiperd",
+    "definitions": {
+        "sshpiperd": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "version": {
+                    "type": "string"
+                },
+                "pipes": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/pipe"
+                    }
+                }
+            },
+            "required": [
+                "pipes",
+                "version"
+            ]
+        },
+        "pipe": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "from": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/from"
+                    }
+                },
+                "to": {
+                    "$ref": "#/definitions/to"
+                }
+            },
+            "required": [
+                "from",
+                "to"
+            ]
+        },
+        "from": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "username": {
+                    "type": "string"
+                },
+                "username_regex_match": {
+                    "type": "boolean"
+                },
+                "authorized_keys": {
+                    "type": "string"
+                },
+                "authorized_keys_data": {
+                    "type": "string"
+                }
+            },
+            "required": [
+                "username"
+            ]
+        },
+        "to": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "host": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                },
+                "ignore_hostkey": {
+                    "type": "boolean"
+                },
+                "private_key": {
+                    "type": "string"
+                },
+                "private_key_data": {
+                    "type": "string"
+                },
+                "known_hosts": {
+                    "type": "string"
+                },
+                "known_hosts_data": {
+                    "type": "string"
+                }
+            },
+            "required": [
+                "host"
+            ]
+        }
+    }
+}