refactor(xray-hub)

ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/defaults/main.yml

@@ -1,5 +1,4 @@
 xray_main_port: 1443
-xray_tproxy_port: 51830
 xray_cert_path: "/etc/ssl/onwalk.net.pem"
 xray_key_path: "/etc/ssl/onwalk.net.key"
 xray_bin_path: /usr/local/bin/xray

ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/handlers/main.yml

@@ -4,9 +4,3 @@
     name: xray.service
     state: restarted
     enabled: yes
-
-- name: Restart xray-tproxy service
-  systemd:
-    name: xray-tproxy.service
-    state: restarted
-    enabled: yes

ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml

@@ -31,7 +31,6 @@
     creates: /usr/local/bin/xray
   notify:
     - Restart xray service
-    - Restart xray-tproxy service
 
 - name: Ensure required directories exist
   file:
@@ -49,7 +48,6 @@
     mode: '0644'
   loop:
     - { src: "config.json.j2", dest: "{{ xray_config_dir }}/config.json" }
-    - { src: "tproxy-config.json.j2", dest: "{{ xray_config_dir }}/tproxy-config.json" }
 
 - name: Deploy systemd service templates
   template:
@@ -58,7 +56,6 @@
     mode: '0644'
   loop:
     - { src: "xray.service.j2", dest: "/etc/systemd/system/xray.service" }
-    - { src: "xray-tproxy.service.j2", dest: "/etc/systemd/system/xray-tproxy.service" }
 
 - name: Reload systemd
   systemd:
@@ -71,4 +68,3 @@
     state: started
   loop:
     - xray.service
-    - xray-tproxy.service

ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2

@@ -1,70 +1,84 @@
 {
-  "log": {
-    "loglevel": "error"
-  },
-  "routing": {
-    "rules": []
-  },
-  "inbounds": [
-    {
-      "listen": "0.0.0.0",
-      "port": {{ xray_main_port }},
-      "protocol": "vless",
-      "settings": {
-        "clients": [
-          {
-            "id": "{{ xray_uuid }}",
-            "flow": "xtls-rprx-vision"
-          }
-        ],
-        "decryption": "none",
-        "fallbacks": [
-          {
-            "dest": 8001,
-            "xver": 1
-          },
-          {
-            "alpn": "h2",
-            "dest": 8002,
-            "xver": 1
-          }
-        ]
-      },
-      "streamSettings": {
-        "network": "tcp",
-        "security": "tls",
-        "tlsSettings": {
-          "minVersion": "1.2",
-          "rejectUnknownSni": true,
-          "certificates": [
+    "log": {
+        "loglevel": "warning"
+    },
+    "routing": {
+        "domainStrategy": "IPIfNonMatch",
+        "rules": [
             {
-              "ocspStapling": 3600,
-              "certificateFile": "{{ xray_cert_path }}",
-              "keyFile": "{{ xray_key_path }}"
+                "type": "field",
+                "ip": [
+                    "geoip:cn"
+                ],
+                "outboundTag": "block"
             }
-          ]
-        }
-      },
-      "sniffing": {
-        "enabled": true,
-        "destOverride": [
-          "http",
-          "tls"
         ]
-      }
+    },
+    "inbounds": [
+        {
+            "listen": "0.0.0.0",
+            "port": {{ xray_main_port }},
+            "protocol": "vless",
+            "settings": {
+                "clients": [
+                    {
+                        "id": "{{ xray_uuid }}",
+                        "flow": "xtls-rprx-vision"
+                    }
+                ],
+                "decryption": "none",
+                "fallbacks": [
+                    {
+                        "dest": "8001",
+                        "xver": 1
+                    },
+                    {
+                        "alpn": "h2",
+                        "dest": "8002",
+                        "xver": 1
+                    }
+                ]
+            },
+            "streamSettings": {
+                "network": "tcp",
+                "security": "tls",
+                "tlsSettings": {
+                    "rejectUnknownSni": true,
+                    "minVersion": "1.2",
+                    "certificates": [
+                        {
+                            "ocspStapling": 3600,
+                            "certificateFile": "{{ xray_cert_path }}",
+                            "keyFile": "{{ xray_key_path }}"
+                        }
+                    ]
+                }
+            },
+            "sniffing": {
+                "enabled": true,
+                "destOverride": [
+                    "http",
+                    "tls"
+                ]
+            }
+        }
+    ],
+    "outbounds": [
+        {
+            "protocol": "freedom",
+            "tag": "direct"
+        },
+        {
+            "protocol": "blackhole",
+            "tag": "block"
+        }
+    ],
+    "policy": {
+        "levels": {
+            "0": {
+                "handshake": 2,
+                "connIdle": 120
+            }
+        }
     }
-  ],
-  "outbounds": [
-    {
-      "protocol": "freedom"
-    }
-  ],
-  "policy": {
-    "levels": {
-      "0": {
-        "handshake": 2,
-        "connIdle": 120
-      }
-    }
-  }
 }