add xray-lists role

roles/xray-lists/tasks/configure.yml

@@ -0,0 +1,62 @@
+---
+#- name: collect xray policy hosts
+#  ansible.builtin.set_fact:
+#    _xray_hosts_with_policy: >-
+#      {{
+        #        (_xray_hosts_with_policy | default([]))
+        #        + [{'inventory_hostname': item, 'xray_policy': hostvars[item].xray_policy}]
+        #      }}
+      #  loop: "{{ groups[xray_managed_group] }}"
+  #  when: hostvars[item].xray_policy is defined
+
+  #- name: validate xray policy sets
+  #  ansible.builtin.assert:
+  #    that:
+  #      - (item.1.bypass | default(item.1.proxy)) == 'all' or
+  #        (item.1.bypass | default(item.1.proxy)) in xray_ip_sets or
+  #        (item.1.bypass | default(item.1.proxy)) in xray_domain_sets or
+  #        (item.1.bypass | default(item.1.proxy)) in (xray_static_sets | default([]))
+  #    fail_msg: "host {{ item.0.inventory_hostname }}: unknown xray set '{{ item.1.bypass | default(item.1.proxy) }}'"
+  #    quiet: true
+  #  loop: "{{ query('ansible.builtin.subelements', _xray_hosts_with_policy | default([]), 'xray_policy', {'skip_missing': True}) }}"
+  #  loop_control:
+  #    label: "{{ item.0.inventory_hostname }} -> {{ item.1.bypass | default(item.1.proxy) }}"
+
+- name: render xray-lists config
+  ansible.builtin.template:
+    src: xray-config.yaml.j2
+    dest: /var/lib/xray-lists/config.yaml
+    mode: "0640"
+  notify: restart xray-lists timer
+
+- name: bootstrap empty config files
+  ansible.builtin.copy:
+    dest: "/etc/nftables.d/{{ item }}"
+    content: ""
+    force: false
+    mode: "0644"
+  loop:
+    - 90-sets.nft
+    - 90-proxy-prerouting.nft
+    - 90-proxy-output.nft
+
+- name: render nft sets
+  ansible.builtin.template:
+    src: 90-sets.nft.j2
+    dest: /etc/nftables.d/90-sets.nft
+    mode: "0644"
+  notify: reload nftables
+
+- name: render proxy prerouting
+  ansible.builtin.template:
+    src: 90-proxy-prerouting.nft.j2
+    dest: /etc/nftables.d/90-proxy-prerouting.nft
+    mode: "0644"
+  notify: reload nftables
+
+- name: render proxy output
+  ansible.builtin.template:
+    src: 90-proxy-output.nft.j2
+    dest: /etc/nftables.d/90-proxy-output.nft
+    mode: "0644"
+  notify: reload nftables