From 66c5ed2e66f03a45b0046981f77904f89f4da322 Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Tue, 22 Apr 2025 13:34:27 +0800 Subject: [PATCH] feat(xray-site): add vpn-xray-client playbook and update site config and template --- .../vpn-overlay/xray/site/handlers/main.yml | 10 +- .../vpn-overlay/xray/site/tasks/main.yml | 10 +- .../xray/site/templates/client-config.json.j2 | 94 +++++++++++++++++++ .../xray/site/templates/config.json.j2 | 70 -------------- .../xray/site/templates/tproxy-config.json.j2 | 58 ------------ ...roxy.service.j2 => xray-client.service.j2} | 4 +- .../xray/site/templates/xray.service.j2 | 18 ---- ansible/playbooks/vpn-xray-client.yaml | 8 ++ 8 files changed, 109 insertions(+), 163 deletions(-) create mode 100644 ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/client-config.json.j2 delete mode 100644 ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/config.json.j2 delete mode 100644 ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/tproxy-config.json.j2 rename ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/{xray-tproxy.service.j2 => xray-client.service.j2} (76%) delete mode 100644 ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray.service.j2 create mode 100644 ansible/playbooks/vpn-xray-client.yaml diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/handlers/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/handlers/main.yml index 22b182b3..032a52c2 100644 --- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/handlers/main.yml +++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/handlers/main.yml @@ -1,12 +1,6 @@ --- -- name: Restart xray service +- name: Restart Xray-client service systemd: - name: xray.service - state: restarted - enabled: yes - -- name: Restart xray-tproxy service - systemd: - name: xray-tproxy.service + name: xray-client.service state: restarted enabled: yes diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/tasks/main.yml b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/tasks/main.yml index 02f4259e..aa62c5b2 100644 --- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/tasks/main.yml +++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/tasks/main.yml @@ -31,7 +31,6 @@ creates: /usr/local/bin/xray notify: - Restart xray service - - Restart xray-tproxy service - name: Ensure required directories exist file: @@ -48,8 +47,7 @@ dest: "{{ item.dest }}" mode: '0644' loop: - - { src: "config.json.j2", dest: "{{ xray_config_dir }}/config.json" } - - { src: "tproxy-config.json.j2", dest: "{{ xray_config_dir }}/tproxy-config.json" } + - { src: "client-config.json.j2", dest: "{{ xray_config_dir }}/client-config.json" } - name: Deploy systemd service templates template: @@ -57,8 +55,7 @@ dest: "{{ item.dest }}" mode: '0644' loop: - - { src: "xray.service.j2", dest: "/etc/systemd/system/xray.service" } - - { src: "xray-tproxy.service.j2", dest: "/etc/systemd/system/xray-tproxy.service" } + - { src: "xray-client.service.j2", dest: "/etc/systemd/system/xray-client.service" } - name: Reload systemd systemd: @@ -70,5 +67,4 @@ enabled: yes state: started loop: - - xray.service - - xray-tproxy.service + - xray-client.service diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/client-config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/client-config.json.j2 new file mode 100644 index 00000000..25a79e05 --- /dev/null +++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/client-config.json.j2 @@ -0,0 +1,94 @@ +{ + "log": { + "loglevel": "debug" + }, + "routing": { + "domainStrategy": "IPIfNonMatch", + "rules": [ + { + "type": "field", + "domain": [ + "geosite:cn", + "geosite:private" + ], + "outboundTag": "direct" + }, + { + "type": "field", + "ip": [ + "geoip:cn", + "geoip:private" + ], + "outboundTag": "direct" + } + ] + }, + "inbounds": [ + { + "listen": "127.0.0.1", + "port": 1080, + "protocol": "socks", + "settings": { + "udp": true + }, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls" + ] + } + }, + { + "listen": "127.0.0.1", + "port": 1081, + "protocol": "http", + "settings": {}, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls" + ] + } + } + ], + "outbounds": [ + { + "protocol": "vless", + "settings": { + "vnext": [ + { + "address": "{{ xray_remote_domain }}", + "port": {{ xray_main_port }}, + "users": [ + { + "id": "{{ xray_uuid }}", + "encryption": "none", + "flow": "xtls-rprx-vision" + } + ] + } + ] + }, + "streamSettings": { + "network": "tcp", + "security": "tls", + "tlsSettings": { + "serverName": "{{ xray_remote_domain }}", + "allowInsecure": false, + "fingerprint": "chrome" + } + }, + "tag": "proxy" + }, + { + "protocol": "freedom", + "tag": "direct" + }, + { + "protocol": "blackhole", + "tag": "block" + } + ] +} diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/config.json.j2 deleted file mode 100644 index 6a68ea43..00000000 --- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/config.json.j2 +++ /dev/null @@ -1,70 +0,0 @@ -{ - "log": { - "loglevel": "error" - }, - "routing": { - "rules": [] - }, - "inbounds": [ - { - "listen": "0.0.0.0", - "port": {{ xray_main_port }}, - "protocol": "vless", - "settings": { - "clients": [ - { - "id": "{{ xray_uuid }}", - "flow": "xtls-rprx-vision" - } - ], - "decryption": "none", - "fallbacks": [ - { - "dest": 8001, - "xver": 1 - }, - { - "alpn": "h2", - "dest": 8002, - "xver": 1 - } - ] - }, - "streamSettings": { - "network": "tcp", - "security": "tls", - "tlsSettings": { - "minVersion": "1.2", - "rejectUnknownSni": true, - "certificates": [ - { - "ocspStapling": 3600, - "certificateFile": "{{ xray_cert_path }}", - "keyFile": "{{ xray_key_path }}" - } - ] - } - }, - "sniffing": { - "enabled": true, - "destOverride": [ - "http", - "tls" - ] - } - } - ], - "outbounds": [ - { - "protocol": "freedom" - } - ], - "policy": { - "levels": { - "0": { - "handshake": 2, - "connIdle": 120 - } - } - } -} diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/tproxy-config.json.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/tproxy-config.json.j2 deleted file mode 100644 index bd66f765..00000000 --- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/tproxy-config.json.j2 +++ /dev/null @@ -1,58 +0,0 @@ -{ - "log": { - "loglevel": "info" - }, - "routing": { - "rules": [] - }, - "inbounds": [ - { - "listen": "127.0.0.1", - "port": 51830, - "protocol": "dokodemo-door", - "settings": { - "address": "{{ hubs_map[inventory_hostname].xray.relay_address }}", - "port": {{ hubs_map[inventory_hostname].xray.relay_port }}, - "network": "udp" - } - } - ], - "outbounds": [ - { - "protocol": "vless", - "settings": { - "vnext": [ - { - "address": "{{ hubs_map[inventory_hostname].xray.relay_address }}", - "port": 1443, - "users": [ - { - "id": "{{ hubs_map[inventory_hostname].xray.uuid }}", - "encryption": "none", - "flow": "xtls-rprx-vision" - } - ] - } - ] - }, - "streamSettings": { - "network": "tcp", - "security": "tls", - "tlsSettings": { - "serverName": "{{ hubs_map[inventory_hostname].xray.remote_domain }}", - "allowInsecure": false, - "fingerprint": "chrome" - } - }, - "tag": "proxy" - }, - { - "protocol": "freedom", - "tag": "direct" - }, - { - "protocol": "blackhole", - "tag": "block" - } - ] -} diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-tproxy.service.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-client.service.j2 similarity index 76% rename from ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-tproxy.service.j2 rename to ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-client.service.j2 index f440158d..6046de41 100644 --- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-tproxy.service.j2 +++ b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray-client.service.j2 @@ -1,5 +1,5 @@ [Unit] -Description=Xray Tproxy Service +Description=Xray Client Service Documentation=https://github.com/xtls After=network.target nss-lookup.target @@ -8,7 +8,7 @@ User=nobody CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE NoNewPrivileges=true -ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/tproxy-config.json +ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/client-config.json Restart=on-failure RestartPreventExitStatus=23 LimitNPROC=10000 diff --git a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray.service.j2 b/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray.service.j2 deleted file mode 100644 index 978fbbdc..00000000 --- a/ansible/playbooks/roles/vhosts/vpn-overlay/xray/site/templates/xray.service.j2 +++ /dev/null @@ -1,18 +0,0 @@ -[Unit] -Description=Xray Service -Documentation=https://github.com/xtls -After=network.target nss-lookup.target - -[Service] -User=nobody -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE -NoNewPrivileges=true -ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json -Restart=on-failure -RestartPreventExitStatus=23 -LimitNPROC=10000 -LimitNOFILE=1000000 - -[Install] -WantedBy=multi-user.target diff --git a/ansible/playbooks/vpn-xray-client.yaml b/ansible/playbooks/vpn-xray-client.yaml new file mode 100644 index 00000000..5cc1b1e6 --- /dev/null +++ b/ansible/playbooks/vpn-xray-client.yaml @@ -0,0 +1,8 @@ +- name: Setup Xray for hub + hosts: all + become: true + vars: + overlay_config_path: "{{ playbook_dir }}/../../config/sit/vpn-overlay.yaml" + overlay_keys_path: "{{ playbook_dir }}/../../config/sit/vpn-keys.yaml" + roles: + - role: vhosts/vpn-overlay/xray/site