32 lines
1.4 KiB
Django/Jinja
32 lines
1.4 KiB
Django/Jinja
#jinja2: trim_blocks: True, lstrip_blocks: True
|
|
{%- macro set_ref(name) -%}
|
|
{%- if name == 'all' -%}
|
|
0.0.0.0/0
|
|
{%- elif name in xray_ip_sets or name in (xray_static_sets | default([])) -%}
|
|
@{{ name }}_ip
|
|
{%- elif name in xray_domain_sets -%}
|
|
@{{ name_dom }}_dom
|
|
{%- else -%}
|
|
INVALID_XRAY_SET_{{ name }}
|
|
{%- endif -%}
|
|
{%- endmacro -%}
|
|
|
|
{%- set rules_list = [] -%}
|
|
{%- for item in groups[xray_managed_group] | default([]) | sort -%}
|
|
{%- set client = hostvars[item] -%}
|
|
{%- if client.xray_policy is defined -%}
|
|
{%- set src_ip = client.container_ip | default(client.ansible_host | default(item)) -%}
|
|
{%- for rule in client.xray_policy -%}
|
|
{%- if rule.bypass is defined -%}
|
|
{%- set _ = rules_list.append("meta l4proto { tcp, udp } ip saddr " ~ src_ip ~ " ip daddr " ~ set_ref(rule.bypass) ~ " accept") -%}
|
|
{%- elif rule.proxy is defined -%}
|
|
{%- set _ = rules_list.append("meta l4proto { tcp, udp } ip saddr " ~ src_ip ~ " ip daddr " ~ set_ref(rule.proxy) ~ " tproxy ip to :" ~ (xray_tproxy_port | default(61219) | string) ~ " meta mark set " ~ (xray_fwmark | default('0x00000001')) ~ " accept") -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
|
|
{%- if rules_list | length > 0 -%}
|
|
{{- rules_list | join('\n') -}}
|
|
{%- endif -%}
|