refactor(setup-dnat): refactor overlay config loading and current node variable extraction

- Replaced include_vars with set_fact to load overlay_config_path using standard YAML parser
- Combined overlay_data.sites and overlay_data.hubs to search for the current node by inventory_hostname

ansible/playbooks/roles/vhosts/vpn-overlay/setup-dnat/tasks/main.yml

@@ -1,15 +1,21 @@
 ---
-- name: 加载 overlay 配置
-  include_vars:
-    file: "{{ overlay_config_path }}"
-    name: overlay
+- name: 加载 overlay 配置（标准 YAML）
+  set_fact:
+    overlay_data: "{{ lookup('file', overlay_config_path) | from_yaml }}"
+
+- name: 提取当前节点信息（作为 current_node）
+  set_fact:
+    current_node: >-
+      {{ (overlay_data.sites + overlay_data.hubs)
+         | selectattr('name', 'equalto', inventory_hostname)
+         | list | first }}
 
 - name: 设置本节点 DNAT 所需变量
   set_fact:
-    dnat_public_ip: "{{ overlay.nodes[inventory_hostname].public_ip }}"
-    dnat_internal_ip: "{{ overlay.nodes[inventory_hostname].internal_ip }}"
-    pod_cidr: "{{ overlay.nodes[inventory_hostname].pod_cidr }}"
-    wireguard_cidr: "{{ overlay.nodes[inventory_hostname].wireguard_cidr }}"
+    dnat_public_ip: "{{ current_node.public_ip }}"
+    dnat_internal_ip: "{{ current_node.wg_ip }}"
+    pod_cidr: "{{ current_node.pod_cidr }}"
+    wireguard_cidr: "{{ current_node.wireguard_cidr }}"
 
 - name: 模板渲染 DNAT 脚本
   template:

ansible/playbooks/vpn-overlay-dnat.yaml

@@ -1,8 +1,8 @@
 - name: Setup DNAT rules
-  hosts: ingress-nodes
+  hosts: all
   become: yes
   gather_facts: no
   vars:
     overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
   roles:
-    - role: setup-dnat
+    - vhosts/vpn-overlay/setup-dnat

config/sit/vpn-overlay.yaml

@@ -17,6 +17,8 @@ hubs:
   - name: cn-hub
     interface: eth0
     public_ip: 1.15.155.245
+    pod_cidr: 10.42.0.0/16
+    wireguard_cidr: 172.30.0.0/16
     wg_ip: 172.30.0.1
     br_ip: 10.253.253.1
     local_ip: 172.30.0.1
@@ -118,6 +120,8 @@ sites:
     interface: eth0
     public_ip: 47.120.61.35
     wg_ip: 172.30.0.11
+    pod_cidr: 10.42.0.0/16
+    wireguard_cidr: 172.30.0.0/16
     br_ip: 10.253.253.11
     local_ip: 172.30.0.11
     remote_ip: 172.30.0.1
@@ -134,6 +138,8 @@ sites:
   - name: icp-huawei
     interface: eth0
     public_ip: 139.9.139.22
+    pod_cidr: 10.42.0.0/16
+    wireguard_cidr: 172.30.0.0/16
     wg_ip: 172.30.0.12
     br_ip: 10.253.253.12
     local_ip: 172.30.0.12