27 lines
1.1 KiB
Django/Jinja
27 lines
1.1 KiB
Django/Jinja
|
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||
|
|
{% macro set_daddr(name) %}
|
||
|
|
{%- if name == 'all' %}
|
||
|
|
0.0.0.0/0
|
||
|
|
{%- elif name in (xray_ip_sets | default([])) or name in (xray_static_sets | default([])) %}
|
||
|
|
@{{ name }}_ip
|
||
|
|
{%- elif name in (xray_domain_sets | default([])) %}
|
||
|
|
@{{ name }}_dom
|
||
|
|
{%- else %}
|
||
|
|
invalid_xray_set_{{ name }}
|
||
|
|
{% endif %}
|
||
|
|
{% endmacro %}
|
||
|
|
{% for item in groups[xray_managed_group] | default([]) | sort %}
|
||
|
|
{% set client = hostvars[item] %}
|
||
|
|
{% if client.xray_policy is defined %}
|
||
|
|
{% set src_ip = client.container_ip %}
|
||
|
|
{% for rule in client.xray_policy %}
|
||
|
|
{% set target_set = rule.bypass | default(rule.proxy) %}
|
||
|
|
{% if rule.bypass is defined %}
|
||
|
|
meta l4proto { tcp, udp } ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} accept
|
||
|
|
{% elif rule.proxy is defined %}
|
||
|
|
meta l4proto { tcp, udp } ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} tproxy ip to :{{ xray_tproxy_port }} meta mark set {{ xray_fwmark }} accept
|
||
|
|
{% endif %}
|
||
|
|
{% endfor %}
|
||
|
|
{% endif %}
|
||
|
|
{% endfor %}
|