add nginx, sshd, ssl roles

roles/nftables/templates/router/20-sets.nft.j2

@@ -0,0 +1,15 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{%- for id, item in xray_ip_sets.items() -%}
+set {{ id }}_ip {
+    type ipv4_addr
+    flags interval
+    auto-merge
+    include "{{ xray_lists_global.output_dir }}/{{ id }}_ip.elements.nft"
+}
+{% endfor -%}
+{%- for id, item in xray_domain_sets.items() -%}
+set {{ id }}_dom {
+    type ipv4_addr
+    flags interval
+}
+{% endfor -%}

roles/nftables/templates/router/90-dstnat.nft.j2

@@ -0,0 +1,19 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{% for item in nft_managed_group | sort %}
+{% set client = hostvars[item] %}
+{% if 'nft_dst' in client and client.nft_dst is not none %}
+{% set target_ip = client.container_ip %}
+{% for client in client.nft_dst %}
+{% set ports = client.port if (client.port is iterable and client.port is not string) else [client.port] %}
+{% set protos = client.proto if (client.proto is iterable and client.proto is not string) else [client.proto] %}
+{% set ifaces = client.iface if (client.iface is iterable and client.iface is not string) else [client.iface] %}
+{% for proto in protos %}
+{% for port in ports %}
+{% for iface in ifaces %}
+iifname "{{ iface }}" {{ proto }} dport {{ port }} counter dnat ip to {{ target_ip }}:{{ port }} comment "{{ iface }} -> {{ item }}"
+{% endfor %}
+{% endfor %}
+{% endfor %}
+{% endfor %}
+{% endif %}
+{% endfor %}

roles/nftables/templates/router/90-forward.nft.j2

@@ -0,0 +1,47 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{% for item in nft_managed_group | sort %}
+{% set client = hostvars[item] %}
+{% if 'nft_to' in client and client.nft_to is not none %}
+{% set rules = client.nft_to if (client.nft_to is iterable and client.nft_to is not string) else [client.nft_to] %}
+{% for rule in rules %}
+{% set rule = rule if rule is mapping else {'to': rule} %}
+{% set dests = rule.to if (rule.to is iterable and rule.to is not string) else [rule.to] %}
+{% set protos = rule.proto if (rule.proto is iterable and rule.proto is not string) else [rule.proto | default(none)] %}
+{% set ports = rule.port if (rule.port is iterable and rule.port is not string) else [rule.port | default(none)] %}
+{% for dest in dests %}
+{% if dest.startswith('zone:') %}
+{% set oif = dest.split(':')[1] %}
+{% set daddr = none %}
+{% set dest_name = oif %}
+{% else %}
+{% set oif = hostvars[dest].zone_iface %}
+{% set daddr = hostvars[dest].container_ip %}
+{% set dest_name = dest %}
+{% endif %}
+{% for proto in protos %}
+{% for port in ports %}
+iifname "{{ client.zone_iface }}" ip saddr {{ client.container_ip }} oifname "{{ oif }}" {% if daddr %}ip daddr {{ daddr }} {% endif %}{% if proto and port %}{{ proto }} dport {{ port }} {% endif %}counter accept comment "{{ item }} -> {{ dest_name }}"
+{% endfor %}
+{% endfor %}
+{% endfor %}
+{% endfor %}
+{% endif %}
+{% endfor %}
+{% for item in nft_managed_group | sort %}
+{% set client = hostvars[item] %}
+{% if 'nft_from' in client and client.nft_from is not none %}
+{% set rules = client.nft_from if (client.nft_from is iterable and client.nft_from is not string) else [client.nft_from] %}
+{% for rule in rules %}
+{% set ifaces = rule.iface if (rule.iface is iterable and rule.iface is not string) else [rule.iface] %}
+{% set protos = rule.proto if (rule.proto is iterable and rule.proto is not string) else [rule.proto | default(none)] %}
+{% set ports = rule.port if (rule.port is iterable and rule.port is not string) else [rule.port | default(none)] %}
+{% for iface in ifaces %}
+{% for proto in protos %}
+{% for port in ports %}
+iifname "{{ iface }}" oifname "{{ client.zone_iface }}" ip daddr {{ client.container_ip }} {% if proto and port %}{{ proto }} dport {{ port }} {% endif %}counter accept comment "{{ iface }} -> {{ item }}"
+{% endfor %}
+{% endfor %}
+{% endfor %}
+{% endfor %}
+{% endif %}
+{% endfor %}

roles/nftables/templates/router/90-proxy-output.nft.j2

@@ -0,0 +1,11 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{% macro set_daddr(rule) %}
+{%- if rule in (xray_ip_sets | default([])) or rule in (xray_static_sets | default([])) -%}
+{{ rule }}_ip
+{%- elif rule in (xray_domain_sets | default([])) -%}
+{{ rule }}_dom
+{%- endif -%}
+{% endmacro %}
+{% for rule in output_rules | default([]) | sort %}
+ip daddr @{{ set_daddr(rule) }} meta mark set {{ xray_fwmark }} counter accept comment "router -> tproxy"
+{% endfor %}

roles/nftables/templates/router/90-proxy-prerouting.nft.j2

@@ -0,0 +1,28 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{% macro set_daddr(name) -%}
+{%- if name == 'all' -%}
+0.0.0.0/0
+{%- elif name in (xray_ip_sets | default([])) or name in (xray_static_sets | default([])) -%}
+@{{ name }}_ip
+{%- elif name in (xray_domain_sets | default([])) -%}
+@{{ name }}_dom
+{%- else -%}
+invalid_xray_set_{{ name }}
+{%- endif -%}
+{%- endmacro -%}
+{% for item in xray_managed_group | default([]) | sort %}
+{% set client = hostvars[item] %}
+{% if client.xray_policy is defined %}
+{% set src_ip = client.container_ip %}
+{% for rule in client.xray_policy %}
+{% set target_set = rule.bypass | default(rule.proxy) %}
+{% if rule.bypass is defined %}
+meta l4proto tcp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} counter accept comment "{{ item }} -> accept"
+meta l4proto udp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} counter accept comment "{{ item }} -> accept"
+{% elif rule.proxy is defined %}
+meta l4proto tcp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} tproxy ip to :{{ xray_tproxy_port }} meta mark set {{ xray_fwmark }} counter accept comment "{{ item }} -> trpoxy"
+meta l4proto udp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} tproxy ip to :{{ xray_tproxy_port }} meta mark set {{ xray_fwmark }} counter accept comment "{{ item }} -> tproxy"
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endfor %}

roles/nftables/templates/router/nftables.conf.j2

@@ -0,0 +1,11 @@
+#!/usr/sbin/nft -f
+flush ruleset
+table inet filter {
+    include "/etc/nftables.d/10-sets.nft"
+    include "/etc/nftables.d/20-sets.nft"
+    include "/etc/nftables.d/40-filter.nft"
+    include "/etc/nftables.d/50-proxy.nft"
+}
+table ip nat {
+    include "/etc/nftables.d/30-nat.nft"
+}