initial commit

roles/router/files/ifupdown2/interfaces

@@ -0,0 +1,52 @@
+auto lo
+iface lo inet loopback
+    post-up ip rule add fwmark 0x1 lookup 100 2>/dev/null || true
+    post-up ip route add local 0.0.0.0/0 dev lo table 100 2>/dev/null || true
+    pre-down ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null || true
+    pre-down ip rule del fwmark 0x1 lookup 100 2>/dev/null || true
+
+auto eth0
+iface eth0 inet manual
+    address 10.1.0.1/24
+
+auto eth0.2
+iface eth0.2 inet static
+    address 10.2.0.1/24
+    vlan-raw-device eth0
+
+auto eth0.3
+iface eth0.3 inet static
+    address 10.3.0.1/24
+    vlan-raw-device eth0
+
+auto eth0.4
+iface eth0.4 inet static
+    address 10.4.0.1/24
+    vlan-raw-device eth0
+
+auto eth0.10
+iface eth0.10 inet static
+    address 10.10.0.1/24
+    vlan-raw-device eth0
+
+auto eth0.11
+iface eth0.11 inet static
+    address 10.11.0.1/24
+    vlan-raw-device eth0
+
+auto eth0.12
+iface eth0.12 inet static
+    address 10.12.0.1/24
+    vlan-raw-device eth0
+
+auto eth1
+iface eth1 inet dhcp
+
+auto wg0
+iface wg0 inet manual
+    post-up ip route add 10.250.250.0/24 dev wg0 2>/dev/null || true
+    post-up ip rule add fwmark 0xc7 lookup 199 2>/dev/null || true
+    post-up ip route add default dev wg0 table 199 2>/dev/null || true
+    pre-down ip route del default dev wg0 table 199 2>/dev/null || true
+    pre-down ip rule del fwmark 0xc7 lookup 199 2>/dev/null || true
+    pre-down ip route del 10.250.250.0/24 dev wg0 2>/dev/null || true

roles/router/files/sysctl/01-forwarding.conf

@@ -0,0 +1 @@
+net.ipv4.ip_forward=1

roles/router/files/sysctl/02-rpfilter.conf

@@ -0,0 +1,2 @@
+net.ipv4.conf.all.rp_filter = 0
+net.ipv4.conf.wg0.rp_filter = 0

roles/router/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: reload ifupdown2
+  command: ifreload -a

roles/router/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: include network configuration
+  include_tasks: network.yml
+
+- name: include xray-lists configuration
+  include_tasks: xray_lists.yml

roles/router/tasks/network.yml

@@ -0,0 +1,9 @@
+---
+- name: deploy ifupdown config
+  copy:
+    src: ifupdown2/interfaces
+    dest: /etc/network/interfaces
+    owner: root
+    group: root
+    mode: '0644'
+  notify: reload ifupdown2

roles/router/tasks/xray_lists.yml

@@ -0,0 +1,99 @@
+---
+- name: install required system packages
+  apt:
+    name:
+      - python3-venv
+      - git
+    state: present
+    update_cache: yes
+
+- name: ensure base directories exist
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  loop:
+    - /opt/xray-lists
+    - /var/lib/xray-lists
+
+- name: clone xray-lists repository
+  git:
+    repo: 'https://gitea.oyacoi.ru/pyrschtjag/xray-lists'
+    dest: /opt/xray-lists-src
+    version: main
+    force: yes
+
+- name: check if xray-lists is installed
+  command: /opt/xray-lists/venv/bin/pip show xray-lists
+  register: pip_check
+  changed_when: false
+  failed_when: false
+
+- name: install xray-lists package into venv
+  command: /opt/xray-lists/venv/bin/pip install -e /opt/xray-lists-src[socks]
+  when: pip_check.rc != 0
+
+- name: deploy update helper script
+  copy:
+    dest: /var/lib/xray-lists/update.sh
+    owner: root
+    group: root
+    mode: '0755'
+    content: |
+      #!/bin/sh
+      set -e
+      out=$(/opt/xray-lists/venv/bin/xray-lists)
+      echo "$out"
+      
+      dns_changed=0
+      elements_changed=0
+      
+      if echo "$out" | grep -A 10 "changed:" | grep -q "nftsets.conf"; then dns_changed=1; fi
+      if echo "$out" | grep -A 10 "changed:" | grep -q "\.elements\.nft"; then elements_changed=1; fi
+      
+      if [ "$dns_changed" -eq 1 ] && [ "$elements_changed" -eq 1 ]; then exit 12;
+      elif [ "$dns_changed" -eq 1 ]; then exit 10;
+      elif [ "$elements_changed" -eq 1 ]; then exit 11;
+      fi
+      exit 0
+
+- name: deploy systemd service unit
+  copy:
+    dest: /etc/systemd/system/xray-lists.service
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      [Unit]
+      Description=Update Xray lists
+
+      [Service]
+      Type=oneshot
+      ExecStart=/bin/sh -c '\
+      /var/lib/xray-lists/update.sh; \
+      rc=$$?; \
+      case "$$rc" in \
+          10) systemctl restart dnsmasq ;; \
+          11) nft -f /etc/nftables.conf ;; \
+          12) nft -f /etc/nftables.conf && systemctl restart dnsmasq ;; \
+      esac'
+
+- name: deploy systemd timer unit
+  copy:
+    dest: /etc/systemd/system/xray-lists.timer
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      [Unit]
+      Description=Run xray-lists update daily and on boot
+
+      [Timer]
+      OnBootSec=5min
+      OnUnitActiveSec=12h
+      Persistent=true
+
+      [Install]
+      WantedBy=timers.target