ansible/roles/xray-lists/templates/90-proxy-prerouting.nft.j2

#jinja2: trim_blocks: True, lstrip_blocks: True
{% macro set_daddr(name) %}
    {%- if name == 'all' %}
0.0.0.0/0
    {%- elif name in (xray_ip_sets | default([])) or name in (xray_static_sets | default([])) %}
@{{ name }}_ip
    {%- elif name in (xray_domain_sets | default([])) %}
@{{ name }}_dom
    {%- else %}
invalid_xray_set_{{ name }}
    {% endif %}
{% endmacro %}
{% for item in xray_managed_group | default([]) | sort %}
    {% set client = hostvars[item] %}
        {% if client.xray_policy is defined %}
            {% set src_ip = client.container_ip %}
            {% for rule in client.xray_policy %}
                {% set target_set = rule.bypass | default(rule.proxy) %}
                {% if rule.bypass is defined %}
meta l4proto { tcp, udp } ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} accept
                {% elif rule.proxy is defined %}
meta l4proto { tcp, udp } ip saddr {{ src_ip }} ip daddr {{ set_daddr(target_set) }} tproxy ip to :{{ xray_tproxy_port }} meta mark set {{ xray_fwmark }} accept
            {% endif %}
        {% endfor %}
    {% endif %}
{% endfor %}