initial commit

roles/xray-lists/handlers/main.yml

@@ -0,0 +1,16 @@
+---
+- name: reload nftables
+  ansible.builtin.command: nft -f /etc/nftables.conf
+  listen: reload nftables
+
+- name: restart dnsmasq
+  ansible.builtin.service:
+    name: dnsmasq
+    state: restarted
+
+- name: restart xray-lists timer
+  ansible.builtin.systemd:
+    name: xray-lists.timer
+    state: restarted
+    daemon_reload: yes
+  listen: restart xray-lists timer

roles/xray-lists/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+- name: collect xray policy hosts
+  ansible.builtin.set_fact:
+    _xray_hosts_with_policy: >-
+      {{
+        (_xray_hosts_with_policy | default([]))
+        + [{'inventory_hostname': item, 'xray_policy': hostvars[item].xray_policy}]
+      }}
+  loop: "{{ groups[xray_managed_group] }}"
+  when: hostvars[item].xray_policy is defined
+
+- name: validate xray policy sets
+  ansible.builtin.assert:
+    that: >-
+      (item.1.bypass | default(item.1.proxy)) == 'all'
+      or (item.1.bypass | default(item.1.proxy)) in xray_ip_sets
+      or (item.1.bypass | default(item.1.proxy)) in xray_domain_sets
+      or (item.1.bypass | default(item.1.proxy)) in (xray_static_sets | default([]))
+    fail_msg: >-
+      host {{ item.0.inventory_hostname }}: unknown xray set
+      '{{ item.1.bypass | default(item.1.proxy) }}' in xray_policy
+  loop: "{{ query('ansible.builtin.subelements', _xray_hosts_with_policy | default([]), 'xray_policy', {'skip_missing': True}) }}"
+  loop_control:
+    label: "{{ item.0.inventory_hostname }} -> {{ item.1 }}"
+
+- name: render xray-lists config
+  ansible.builtin.template:
+    src: xray-config.yaml.j2
+    dest: /etc/xray-lists/config.yaml
+    mode: "0640"
+  notify: restart xray-lists timer
+
+- name: bootstrap empty config files
+  ansible.builtin.copy:
+    dest: "/etc/nftables.d/{{ item }}"
+    content: ""
+    force: false
+    mode: "0644"
+  loop:
+    - 90-sets.nft
+    - 90-proxy.nft
+
+- name: render nft sets
+  ansible.builtin.template:
+    src: 90-sets.nft.j2
+    dest: /etc/nftables.d/90-sets.nft
+    mode: "0644"
+  notify: reload nftables
+
+- name: render proxy prerouting
+  ansible.builtin.template:
+    src: 90-proxy.nft.j2
+    dest: /etc/nftables.d/90-proxy.nft
+    mode: "0644"
+  notify: reload nftables

roles/xray-lists/templates/90-proxy.nft.j2

@@ -0,0 +1,31 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{%- macro set_ref(name) -%}
+    {%- if name == 'all' -%}
+        0.0.0.0/0
+    {%- elif name in xray_ip_sets or name in (xray_static_sets | default([])) -%}
+        @{{ name }}_ip
+    {%- elif name in xray_domain_sets -%}
+        @{{ name_dom }}_dom
+    {%- else -%}
+        INVALID_XRAY_SET_{{ name }}
+    {%- endif -%}
+{%- endmacro -%}
+
+{%- set rules_list = [] -%}
+{%- for item in groups[xray_managed_group] | default([]) | sort -%}
+    {%- set client = hostvars[item] -%}
+    {%- if client.xray_policy is defined -%}
+        {%- set src_ip = client.container_ip | default(client.ansible_host | default(item)) -%}
+        {%- for rule in client.xray_policy -%}
+            {%- if rule.bypass is defined -%}
+                {%- set _ = rules_list.append("meta l4proto { tcp, udp } ip saddr " ~ src_ip ~ " ip daddr " ~ set_ref(rule.bypass) ~ " accept") -%}
+            {%- elif rule.proxy is defined -%}
+                {%- set _ = rules_list.append("meta l4proto { tcp, udp } ip saddr " ~ src_ip ~ " ip daddr " ~ set_ref(rule.proxy) ~ " tproxy ip to :" ~ (xray_tproxy_port | default(61219) | string) ~ " meta mark set " ~ (xray_fwmark | default('0x00000001')) ~ " accept") -%}
+            {%- endif -%}
+        {%- endfor -%}
+    {%- endif -%}
+{%- endfor -%}
+
+{%- if rules_list | length > 0 -%}
+{{- rules_list | join('\n') -}}
+{%- endif -%}

roles/xray-lists/templates/90-sets.nft.j2

@@ -0,0 +1,15 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{%- for id, item in xray_ip_sets.items() -%}
+set {{ id }}_ip {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    include "{{ xray_lists_global.output_dir }}/{{ id }}.elements.nft"
+}
+{% endfor -%}
+{%- for id, item in xray_domain_sets.items() -%}
+set {{ id }}_dom {
+    type ipv4_addr
+    flags interval
+}
+{% endfor -%}

roles/xray-lists/templates/xray-config.yaml.j2

@@ -0,0 +1,47 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+global:
+  cache_dir: {{ xray_lists_global.cache_dir }}
+  output_dir: {{ xray_lists_global.output_dir }}
+  dnsmasq_output: {{ xray_lists_global.dnsmasq_output }}
+  {% if xray_lists_global.proxy is defined %}
+  proxy: "{{ xray_lists_global.proxy }}"
+  {% endif %}
+  {% if xray_lists_global.proxy_user is defined %}
+  proxy_user: "{{ xray_lists_global.proxy_user }}"
+  proxy_pass: "{{ xray_lists_global.proxy_pass }}"
+  {% endif %}
+  http_timeout: {{ xray_lists_global.http_timeout | default(20) }}
+ip_sets:
+  {% for id, item in xray_ip_sets.items() %}
+  - id: {{ id }}
+    output: {{ id }}_ip.elements.nft
+    {% if item.static is defined %}
+    static:
+      {% for s in item.static %}
+      - {{ s }}
+      {% endfor %}
+    {% endif %}
+    {% if item.urls is defined %}
+    urls:
+      {% for u in item.urls %}
+      - {{ u }}
+      {% endfor %}
+    {% endif %}
+  {% endfor %}
+domain_sets:
+  {% for id, item in xray_domain_sets.items() %}
+  - id: {{ id }}
+    dnsmasq_target: "4#inet#filter#{{ id }}_dom"
+    {% if item.static is defined %}
+    static:
+      {% for s in item.static %}
+      - {{ s }}
+      {% endfor %}
+    {% endif %}
+    {% if item.urls is defined %}
+    urls:
+      {% for u in item.urls %}
+      - {{ u }}
+      {% endfor %}
+    {% endif %}
+  {% endfor %}