Merge branch 'main' into vpn-overlay
This commit is contained in:
shenlan
GitHub
commit
8425229ecf
@ -0,0 +1,6 @@
|
||||
xray_main_port: 1443
|
||||
xray_tproxy_port: 51830
|
||||
xray_cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
xray_key_path: "/etc/ssl/onwalk.net.key"
|
||||
xray_bin_path: /usr/local/bin/xray
|
||||
xray_config_dir: /usr/local/etc/xray
|
||||
@ -0,0 +1,12 @@
|
||||
---
|
||||
- name: Restart xray service
|
||||
systemd:
|
||||
name: xray.service
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Restart xray-tproxy service
|
||||
systemd:
|
||||
name: xray-tproxy.service
|
||||
state: restarted
|
||||
enabled: yes
|
||||
@ -0,0 +1,60 @@
|
||||
---
|
||||
- name: Load overlay config from file
|
||||
set_fact:
|
||||
overlay_config: "{{ lookup('file', overlay_config_path) | from_yaml }}"
|
||||
|
||||
- name: Extract Xray variables for this node
|
||||
set_fact:
|
||||
xray_uuid: "{{ overlay_config.nodes[inventory_hostname].xray.uuid }}"
|
||||
xray_remote_domain: "{{ overlay_config.nodes[inventory_hostname].xray.remote_domain }}"
|
||||
xray_cert_path: "{{ overlay_config.nodes[inventory_hostname].xray.cert_path }}"
|
||||
xray_key_path: "{{ overlay_config.nodes[inventory_hostname].xray.key_path }}"
|
||||
|
||||
- name: Install Xray using official script
|
||||
shell: |
|
||||
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)"
|
||||
args:
|
||||
creates: /usr/local/bin/xray
|
||||
notify:
|
||||
- Restart xray service
|
||||
- Restart xray-tproxy service
|
||||
|
||||
- name: Ensure required directories exist
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
loop:
|
||||
- "{{ xray_bin_path | dirname }}"
|
||||
- "{{ xray_config_dir }}"
|
||||
|
||||
- name: Deploy Xray config templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0644'
|
||||
loop:
|
||||
- { src: "config.json.j2", dest: "{{ xray_config_dir }}/config.json" }
|
||||
- { src: "tproxy-config.json.j2", dest: "{{ xray_config_dir }}/tproxy-config.json" }
|
||||
|
||||
- name: Deploy systemd service templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: '0644'
|
||||
loop:
|
||||
- { src: "xray.service.j2", dest: "/etc/systemd/system/xray.service" }
|
||||
- { src: "xray-tproxy.service.j2", dest: "/etc/systemd/system/xray-tproxy.service" }
|
||||
|
||||
- name: Reload systemd
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Enable and start xray services
|
||||
systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: yes
|
||||
state: started
|
||||
loop:
|
||||
- xray.service
|
||||
- xray-tproxy.service
|
||||
@ -0,0 +1,76 @@
|
||||
{
|
||||
"log": {
|
||||
"loglevel": "error"
|
||||
},
|
||||
"routing": {
|
||||
"domainStrategy": "IPIfNonMatch",
|
||||
"rules": [
|
||||
{
|
||||
"type": "field",
|
||||
"ip": [
|
||||
"geoip:cn"
|
||||
],
|
||||
"outboundTag": "block"
|
||||
}
|
||||
]
|
||||
},
|
||||
"inbounds": [
|
||||
{
|
||||
"listen": "0.0.0.0",
|
||||
"port": {{ xray_main_port }},
|
||||
"protocol": "vless",
|
||||
"settings": {
|
||||
"clients": [
|
||||
{
|
||||
"id": "{{ xray_uuid }}",
|
||||
"flow": "xtls-rprx-vision"
|
||||
}
|
||||
],
|
||||
"decryption": "none",
|
||||
"fallbacks": [
|
||||
{
|
||||
"dest": 8001,
|
||||
"xver": 1
|
||||
},
|
||||
{
|
||||
"alpn": "h2",
|
||||
"dest": 8002,
|
||||
"xver": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
"streamSettings": {
|
||||
"network": "tcp",
|
||||
"security": "tls",
|
||||
"tlsSettings": {
|
||||
"rejectUnknownSni": true,
|
||||
"minVersion": "1.2",
|
||||
"certificates": [
|
||||
{
|
||||
"ocspStapling": 3600,
|
||||
"certificateFile": "{{ xray_cert_path }}",
|
||||
"keyFile": "{{ xray_key_path }}"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"sniffing": {
|
||||
"enabled": true,
|
||||
"destOverride": ["http", "tls"]
|
||||
}
|
||||
}
|
||||
],
|
||||
"outbounds": [
|
||||
{
|
||||
"protocol": "freedom"
|
||||
}
|
||||
],
|
||||
"policy": {
|
||||
"levels": {
|
||||
"0": {
|
||||
"handshake": 2,
|
||||
"connIdle": 120
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,59 @@
|
||||
{
|
||||
"log": {
|
||||
"loglevel": "info"
|
||||
},
|
||||
"routing": {
|
||||
"domainStrategy": "IPIfNonMatch",
|
||||
"rules": []
|
||||
},
|
||||
"inbounds": [
|
||||
{
|
||||
"listen": "127.0.0.1",
|
||||
"port": {{ xray_tproxy_port }},
|
||||
"protocol": "dokodemo-door",
|
||||
"settings": {
|
||||
"address": "{{ xray_remote_domain }}",
|
||||
"port": {{ xray_main_port }},
|
||||
"network": "udp"
|
||||
}
|
||||
}
|
||||
],
|
||||
"outbounds": [
|
||||
{
|
||||
"protocol": "vless",
|
||||
"settings": {
|
||||
"vnext": [
|
||||
{
|
||||
"address": "{{ xray_remote_domain }}",
|
||||
"port": {{ xray_main_port }},
|
||||
"users": [
|
||||
{
|
||||
"id": "{{ xray_uuid }}",
|
||||
"encryption": "none",
|
||||
"flow": "xtls-rprx-vision"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"streamSettings": {
|
||||
"network": "tcp",
|
||||
"security": "tls",
|
||||
"tlsSettings": {
|
||||
"serverName": "{{ xray_remote_domain }}",
|
||||
"allowInsecure": false,
|
||||
"fingerprint": "chrome"
|
||||
}
|
||||
},
|
||||
"tag": "proxy"
|
||||
},
|
||||
{
|
||||
"protocol": "freedom",
|
||||
"tag": "direct"
|
||||
},
|
||||
{
|
||||
"protocol": "blackhole",
|
||||
"tag": "block"
|
||||
}
|
||||
]
|
||||
}
|
||||
8
ansible/playbooks/vpn-xray-hub.yaml
Normal file
8
ansible/playbooks/vpn-xray-hub.yaml
Normal file
@ -0,0 +1,8 @@
|
||||
- name: Setup Xray for hub
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml"
|
||||
overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml"
|
||||
roles:
|
||||
- role: vhosts/vpn-overlay/xray/hub
|
||||
@ -20,7 +20,10 @@ hubs:
|
||||
br_ip: 10.253.253.1
|
||||
local_ip: 172.30.0.1
|
||||
remote_ip: 172.31.0.1
|
||||
public_ip: global-proxy.onwalk.net
|
||||
uuid: ""
|
||||
remote_domain: "global-proxy.onwalk.net"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
wireguard_peer:
|
||||
- master-1
|
||||
- slave-1
|
||||
@ -39,6 +42,10 @@ hubs:
|
||||
- slave-1
|
||||
- agent-1
|
||||
- agent-1
|
||||
uuid: ""
|
||||
remote_domain: "global-proxy.onwalk.net"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
|
||||
# 各个站点定义
|
||||
sites:
|
||||
|
||||
Loading…
Reference in New Issue
Block a user