ai-workspace-infra/iac_modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(xray-hub): add tproxy and systemd templates; update config rendering

Browse Source 
- Add systemd templates: xray.service.j2, xray-tproxy.service.j2
- Update config.json.j2 and tproxy-config.json.j2 for per-node xray vars
- Modify main.yml to support template rendering with become
- Extend vpn-overlay.yaml with relay_address, relay_port and remote_domain
This commit is contained in:
Haitao Pan 2025-04-14 21:50:53 +08:00
parent 381e4ea47d
commit c5514f91be
6 changed files with 82 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/tasks/main.yml
View File

@ -3,12 +3,26 @@
set_fact:
overlay_config: "{{ lookup('file', overlay_config_path) | from_yaml }}"
- name: Extract Xray variables for this node
- name: Convert overlay_config.hubs list to dict (hubs_map)
set_fact:
xray_uuid: "{{ overlay_config.nodes[inventory_hostname].xray.uuid }}"
xray_remote_domain: "{{ overlay_config.nodes[inventory_hostname].xray.remote_domain }}"
xray_cert_path: "{{ overlay_config.nodes[inventory_hostname].xray.cert_path }}"
xray_key_path: "{{ overlay_config.nodes[inventory_hostname].xray.key_path }}"
hubs_map: "{{ dict(overlay_config.hubs | map(attribute='name') | zip(overlay_config.hubs)) }}"
when: overlay_config.hubs is defined
- name: Convert overlay_config.sites list to dict (sites_map)
set_fact:
sites_map: "{{ dict(overlay_config.sites | map(attribute='name') | zip(overlay_config.sites)) }}"
when: overlay_config.sites is defined
- name: 显示主机名
debug:
var: overlay_config
when: debug | default(false)
- set_fact:
xray_uuid: "{{ hubs_map[inventory_hostname].xray.uuid }}"
xray_remote_domain: "{{ hubs_map[inventory_hostname].xray.remote_domain }}"
xray_cert_path: "{{ hubs_map[inventory_hostname].xray.cert_path }}"
xray_key_path: "{{ hubs_map[inventory_hostname].xray.key_path }}"
- name: Install Xray using official script
shell: |

18
ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/config.json.j2
View File

@ -3,16 +3,7 @@
"loglevel": "error"
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"type": "field",
"ip": [
"geoip:cn"
],
"outboundTag": "block"
}
]
"rules": []
},
"inbounds": [
{
@ -43,8 +34,8 @@
"network": "tcp",
"security": "tls",
"tlsSettings": {
"rejectUnknownSni": true,
"minVersion": "1.2",
"rejectUnknownSni": true,
"certificates": [
{
"ocspStapling": 3600,
@ -56,7 +47,10 @@
},
"sniffing": {
"enabled": true,
"destOverride": ["http", "tls"]
"destOverride": [
"http",
"tls"
]
}
}
],

15
ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/tproxy-config.json.j2
View File

@ -3,17 +3,16 @@
"loglevel": "info"
},
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": []
},
"inbounds": [
{
"listen": "127.0.0.1",
"port": {{ xray_tproxy_port }},
"port": 51830,
"protocol": "dokodemo-door",
"settings": {
"address": "{{ xray_remote_domain }}",
"port": {{ xray_main_port }},
"address": "{{ hubs_map[inventory_hostname].xray.relay_address }}",
"port": {{ hubs_map[inventory_hostname].xray.relay_port }},
"network": "udp"
}
}
@ -24,11 +23,11 @@
"settings": {
"vnext": [
{
"address": "{{ xray_remote_domain }}",
"port": {{ xray_main_port }},
"address": "{{ hubs_map[inventory_hostname].xray.relay_address }}",
"port": 1443,
"users": [
{
"id": "{{ xray_uuid }}",
"id": "{{ hubs_map[inventory_hostname].xray.uuid }}",
"encryption": "none",
"flow": "xtls-rprx-vision"
}
@ -40,7 +39,7 @@
"network": "tcp",
"security": "tls",
"tlsSettings": {
"serverName": "{{ xray_remote_domain }}",
"serverName": "{{ hubs_map[inventory_hostname].xray.remote_domain }}",
"allowInsecure": false,
"fingerprint": "chrome"
}

18
ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray-tproxy.service.j2 Normal file
View File

@ -0,0 +1,18 @@
[Unit]
Description=Xray Tproxy Service
Documentation=https://github.com/xtls
After=network.target nss-lookup.target
[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/tproxy-config.json
Restart=on-failure
RestartPreventExitStatus=23
LimitNPROC=10000
LimitNOFILE=1000000
[Install]
WantedBy=multi-user.target

18
ansible/playbooks/roles/vhosts/vpn-overlay/xray/hub/templates/xray.service.j2 Normal file
View File

@ -0,0 +1,18 @@
[Unit]
Description=Xray Service
Documentation=https://github.com/xtls
After=network.target nss-lookup.target
[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json
Restart=on-failure
RestartPreventExitStatus=23
LimitNPROC=10000
LimitNOFILE=1000000
[Install]
WantedBy=multi-user.target

19
config/sit/vpn-overlay.yaml
View File

@ -20,10 +20,13 @@ hubs:
br_ip: 10.253.253.1
local_ip: 172.30.0.1
remote_ip: 172.31.0.1
uuid: ""
remote_domain: "global-proxy.onwalk.net"
cert_path: "/etc/ssl/onwalk.net.pem"
key_path: "/etc/ssl/onwalk.net.key"
xray:
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
relay_address: "global-proxy.onwalk.net"
relay_port: '51820'
remote_domain: "global-proxy.onwalk.net"
cert_path: "/etc/ssl/onwalk.net.pem"
key_path: "/etc/ssl/onwalk.net.key"
wireguard_peer:
- master-1
- slave-1
@ -36,7 +39,13 @@ hubs:
br_ip: 10.253.253.2
local_ip: 172.31.0.1
remote_ip: 172.30.0.1
public_ip: hub2.example.com
xray:
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
cert_path: "/etc/ssl/onwalk.net.pem"
key_path: "/etc/ssl/onwalk.net.key"
relay_address: "cn-proxy.onwalk.net"
relay_port: '51820'
remote_domain: "cn-proxy.onwalk.net"
wireguard_peer:
- master-1
- slave-1