ansible/roles/xray-lists/templates/90-proxy.nft.j2

#jinja2: trim_blocks: True, lstrip_blocks: True
{%- macro set_ref(name) -%}
    {%- if name == 'all' -%}
        0.0.0.0/0
    {%- elif name in xray_ip_sets or name in (xray_static_sets | default([])) -%}
        @{{ name }}_ip
    {%- elif name in xray_domain_sets -%}
        @{{ name }}_dom
    {%- else -%}
        INVALID_XRAY_SET_{{ name }}
    {%- endif -%}
{%- endmacro -%}

{%- set rules_list = [] -%}
{%- for item in groups[xray_managed_group] | default([]) | sort -%}
    {%- set client = hostvars[item] -%}
    {%- if client.xray_policy is defined -%}
        {%- set src_ip = client.container_ip | default(client.ansible_host | default(item)) -%}
        {%- for rule in client.xray_policy -%}
            {%- if rule.bypass is defined -%}
                {%- set _ = rules_list.append("meta l4proto { tcp, udp } ip saddr " ~ src_ip ~ " ip daddr " ~ set_ref(rule.bypass) ~ " accept") -%}
            {%- elif rule.proxy is defined -%}
                {%- set _ = rules_list.append("meta l4proto { tcp, udp } ip saddr " ~ src_ip ~ " ip daddr " ~ set_ref(rule.proxy) ~ " tproxy ip to :" ~ (xray_tproxy_port | default(61219) | string) ~ " meta mark set " ~ (xray_fwmark | default('0x00000001')) ~ " accept") -%}
            {%- endif -%}
        {%- endfor -%}
    {%- endif -%}
{%- endfor -%}

{%- if rules_list | length > 0 -%}
{{- rules_list | join('\n') -}}
{%- endif -%}