add nginx, sshd, ssl roles

2026-09-20 22:14:56 +00:00
parent ba9e1a664f
commit c640406c10
131 changed files with 1535 additions and 780 deletions
@@ -0,0 +1,28 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+{% macro set_daddr(name) -%}
+{%- if name == 'all' -%}
+0.0.0.0/0
+{%- elif name in (xray_ip_sets | default([])) or name in (xray_static_sets | default([])) -%}
+@{{ name }}_ip
+{%- elif name in (xray_domain_sets | default([])) -%}
+@{{ name }}_dom
+{%- else -%}
+invalid_xray_set_{{ name }}
+{%- endif -%}
+{%- endmacro -%}
+{% for item in xray_managed_group | default([]) | sort %}
+{% set client = hostvars[item] %}
+{% if client.xray_policy is defined %}
+{% set src_ip = client.container_ip %}
+{% for rule in client.xray_policy %}
+{% set target_set = rule.bypass | default(rule.proxy) %}
+{% if rule.bypass is defined %}
+meta l4proto tcp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} counter accept comment "{{ item }} -> accept"
+meta l4proto udp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} counter accept comment "{{ item }} -> accept"
+{% elif rule.proxy is defined %}
+meta l4proto tcp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} tproxy ip to :{{ xray_tproxy_port }} meta mark set {{ xray_fwmark }} counter accept comment "{{ item }} -> trpoxy"
+meta l4proto udp ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} tproxy ip to :{{ xray_tproxy_port }} meta mark set {{ xray_fwmark }} counter accept comment "{{ item }} -> tproxy"
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endfor %}