refactor: restructure inventory, split roles and add new services

inventory/group_vars/all/locales.yml

@@ -0,0 +1,4 @@
+locales_list:
+  - en_US.UTF-8
+  - ru_RU.UTF-8
+locale_default: en_US.UTF-8

inventory/group_vars/all/main_vars.yml

@@ -1,4 +0,0 @@
-nft_managed_group: all
-dnsmasq_managed_group: all
-xray_managed_group: all
-xray_core_group: all

inventory/group_vars/all/timezone.yml

@@ -0,0 +1 @@
+timezone_name: Europe/Samara

inventory/group_vars/all/vault.yml

@@ -1,103 +1,125 @@
 $ANSIBLE_VAULT;1.1;AES256
-36306165333832633935626535303038333964363533393135303736393561653763666534626538
+64303032323732383634613632656438656637373538316134623639346132306337356632316263
-3931363931616363643366656130616236646538303737380a343234643634316632326137613535
+6536663939336664353530313331326436393335303933340a626637346333353363316531613037
-64316133356635323935623162366533313563316335376439336534323234623038373038373361
+61323139653638343331666235653136306237633464643832326164663463313135623836656236
-3933353334353939660a656163383564313632393434653435376437643538613138383764336364
+6462316234316537350a653235373462636130383235616165363730303463366234333838653361
-35356235666661303736373335333139653530346335313731343136303039396661633164383433
+37336333643961656637396434303839323065633564346635363734316165316463306364396665
-35373935633136343764356439333865303032353864373138313736623666626563343362626264
+38666463313164326461303933353765346230623164646232316463396232666435326435633863
-63613261376163326633626234376339326132303930396562356631306463316361643334643938
+31663563653733336433373836326637323061383435643831363038386638333261333934313465
-62616665346336373630393833626430386233343539636336383539383232643766386339323433
+33313930616561336436653961306262343730306638386531663564396136633232356133363566
-31313764356338643533383637303165393064303233373363656435623261653763376138333863
+34313635626333363632373530373334373335653035353734623065393034616235613663383533
-62643366303866656433376561323739393334663361653166653366303835373863633737316231
+37393362343736643630323134666166666662313333386132366165386535343635376337386665
-64383336373535343539633365616562386361353532373465386461363863393266313237626634
+34306663666261303035626539393064656234616463303130303037343738626561653732643038
-61656663373833376330316631653161373130303639313231306134323630356335383561316564
+62663339366465326639663164656239393234643763313935636131303165633765386330653263
-61343835333533633166316431323234383837393734313630643065313132396234343064343764
+31336562656530356433626664303361636230396262633435356632376637363461643035613831
-39353865633865333862666364666434386533313534306236346133663031393664353664336362
+39326566626533616538316232656336333166313833363038626338633131383230313961636634
-34616438356337303536613832386635353565653362366533386436626564613038333938646561
+36386366353639326532393362323330626336303731393661306531623065303465303963376134
-37643931653633323165303638336535366337643465376335366135373331336633356466366630
+34636261333837396364656237393033373639323063393839363732633963306262303232333935
-38356535303438626438646239303933373366363836336364613333336234343033343932346561
+37346531653730306361646562396233346161353964326534646465386364636230616231653730
-64343834353638323235616466346130353431333864386637653636346536323462623430383661
+32326664653566353030663666386162616136386436346565666464663661646463376632633230
-31336661643135303331323434653964306133376237326263333265376230353737623236656234
+66353039373536643431323533636238666533643431636165633265383733633238633237313830
-63666661633330613933366462346262363532336437653062363837366533306131383634616534
+35386438613239353539636637353366633062306562633733303666656565313366343461326236
-34323234343839306265626261323565326164633239616461363930386164373564633062323331
+30393232656264323530623031346536646235323738313462396432376333623137613138303130
-36383439313730343532373065663665396236336335646465613931323563623734656164653138
+30386461366265336230303530363564336363663262386335313366613634356230333336383936
-32646665326162666462396265663638333531336231316462393536356163626466306663643266
+33643936613266353636313234393761633363353530396333393937393261326364383032653930
-35663162313836316361316136323636613532343366653437656666343731643863653031373961
+63666137363564386566393564373263636436353838633538333133376364616434653839633662
-36383065626431643830623362303931306634316561343961623464656562323830656435646464
+66396239386537663266383462373838346137306232613637313063353664313931313362313035
-37353532666635653433363930333862626332663233646565383061646164353332646330303239
+36343463363165306635303064346531643933313564376635633231316363663931643635623061
-30663635343637633431643538346263376366306434333334623566326336396432626264396265
+31366163386536336339656637626533656639396161363136306136373262356436393839386537
-63386536333139633438353163656132626533313332376633336165373662616561373532363939
+39663439633338356136623235633430663932316561343830336634623137386161623733303465
-63303132616465363534623664343533313164353866313131653538643837353764663837393661
+61373965636262346436343431373032656131393535386537353066393935303335623639316166
-65346431376435303364633835323431663064366532343737356339303462323733303134396230
+65613266363362376631376537373764333562633336353836333132633533616161313032383536
-33303665646133663365356638653637633163313863393564343661326666663335636338613531
+61386538326335326535306430643339303936633532303865363431366537373637313335313639
-37303333316166353536633762343265383139326431383936643464363761353330353864303239
+32386434366638323433663332373233333865636233333261313038353633343661663164656237
-37633236306266636165393732656537616161613165653265366562376664313964323939333861
+32336361653039363931316232613737306264386462383332393266373665653364316530383733
-37326235613835623530353531376262383165616232613535316634646135313138393131343737
+65663335346533653534646133393139666435363036646135353933343834643064353161333033
-39346233623330643863393762393638316164303066353762623139343730656334613035336430
+62656133343930626433643434336362643035343039633831643264613739333037666338636633
-65666235346663616131383630663033646330396333303666333639636433323065663232613564
+31623963343565333538353233313537616236393864333566393932626466646534376536623430
-61313337363138353234363530613964353530383261346661336465373266356135633030363239
+61636262313035393862316430313934633262616534656433316538386664333730343165343931
-61626664633335336631383661613465613037366237643939623862653264323136623436623836
+65363532616662323262643863323631623938343433623066316231303734613533393039663035
-61366132313338313934663435626366643838313835653730366131616238313133306232346439
+62646665666634663930383362303137623532373338343764613962343532313161613765383436
-37396263653462346139353638646663383130383634626234373034366536366662643539656530
+36363432326433303363303736643733623061663663326434643162616235303461353961383462
-61363436383137306535633765636564313832303835643831666562323165623032633835636639
+35323964353036373334323464336462313435646236333266333233303933356636636637633064
-61303831393037303464623561326265336662613932316666633133653161346537303965373931
+32626135353862316265376163336637396633326265323761353765663931356461666563613163
-63323633396438383131316661353435363130346262343862373037646536376363363039613864
+66393264303133613530623164663764643163353163313232623335373231626237636165646631
-63333065626637326465353033643065313837393830376161383033383265363866323533616539
+32646363323265353336363063653334333062626462663961373463306638373437373836396566
-63303532343761643636316336313031633330366332666566386234343339663733373866646435
+63346564626134666632393132303464616233323565363734396432373339653336646139323330
-36386338303863353136373336356432386531366237393866653931363537363361313035633438
+34393761366363363132316231616536643638316138396665633262646438366539346337646266
-30393864393639326562393039323561316531396437326535663932626663313832393232373939
+65383739343931313038653230343432643863633035636538386239363962663365326265383934
-35393439336562613031366637363536333938313534663035343839363534356137303064333030
+35346263306361343932383763373737396565306438363362343733653865343162373833326338
-37353066313031326563666531383062396665643437666333623232333662373739656263633463
+36386433383935613336353833396561633030646232316463333430316535373136353966643336
-36393933393239373939346438366266623937393634633139393362613335393832303262393038
+65343431313935656630666630383664396134326666643733653463333162613034333061343035
-31323733663736626139376566363863303439386161623834363533613433373631666334396631
+62313338646639306362343533616563396531363466373231626662313136373234646430613434
-30316633623336613136643666363738633133393966303938643432626638373037643139343538
+64356430303362376531373336653836653039643165633538666661633134636165643962316437
-31303633653039663131623839643363636133646230626231353765613665326638376663613265
+30326465633761353034316434623164636561313836323163613439633364636662373163633838
-61303131663137313465353036636362316139333566316632363265656461323939666161653861
+62333565656237303464346461343534326463616264336265393835343837366335626364653264
-37336664313039353533336334306461326363323536386366376634383437633862356563366234
+39393338346532383132613331353839373937396538303863326637616333356161386433373230
-35663662316266373837393663643733613931326464323133313134333964626161303564383931
+38666265336361616233656633613234653232613833376131613865643832386665613236386236
-61663335343462353237396438353366396535306364363436343739393864633232623463323934
+31363638303366326165396566343566623765633133626666656132366465613432383235306233
-32353933326337616361396365323835373333333030373762386536313534396434386537623835
+38623733303932623730343638393137663665326134303462666462373639323730656637646663
-61393633616265633664636432303162333262656135343339313235656565633364383461383031
+32656335323634316432373039653463333737323732646461366565626262373332333861323838
-63333138383263646563643039306134366138383137366466316331636339653066636331643036
+66343337373437623366373464613532313665343830306465623433616330656165306166643837
-35303238626566393663663139343362363438383436316635363433303530666435323232386431
+39323335303766353364636365646266333139313530303633353764643964363466633661366335
-62663365643961356137333933353230366161313463653865356432616232373833346239646361
+31396335313435386135393232363633366239303765666435663733323532346338336562663562
-38356339313937396632633033326337353434653361303530373963343163653363363134323836
+30313836343366663564623036303334383537343435396634323130663834643364306132363838
-35323639333261636563346435623334366635316139656434356165646362613031383931393766
+36653564366463323936393035633866633431363134396361623366666231376566646562303739
-39643530303966653830636363336334326336303438386364316263303639623236613632326637
+61633831353034356431643738633862383466613466626534313962323639663562373031623339
-33313837333232613735353831393038376433336436646530663265396466333762323332383030
+61396566613134323137333039363330636663353439653964353934656532306563613536623038
-36646237653731363236663935333862336533383438646536376336333633326333383530613765
+31333065353763303062363836313037313362393132313630366362656133663936303836363366
-37373937396264643761353762383335373036313230303661353239313362363630326232323735
+37383561636437396364383037643136613066376162363864386336663731333463623563343630
-31653830663838666634643232346235353266323061636563646630636339613064306339363961
+65326238656237663634656332316230646338393436353239373663386561626162333164356363
-34343664646434326137643436333362633763363133656332666335636265363662383235316533
+31333364663463656662303134383430356235386436376438646236303966383733353738666365
-37316632373135646637393565316131396235353662396139323962363939386666323134306530
+36623839623865366637626463626164303735316439336437383231323238636561633261616138
-31363034373661626131633366313438616465306464393330303263306665646135396436313230
+39313463653030313932663733343135313736326132376161653534383131613066303438333034
-32376232613763326336326266323637626530636562653534313431343839643034333663323336
+66376264626439636131313135326163333032343635333562663761653539363833616464376465
-31303530636336366430353066316335386535616265626632376631393237633563383763333938
+62336237656139326161616636393435346663346162646237333935373263616530376135656635
-34373835326336646230636535643531326639326566376237353835643632323432393132396130
+63383862666533373639663838333930343931383137363565633264623036353462663333373733
-66323864636438346464363466346263393765633966646263363030656266356330636139316565
+64303933396337633961303064353066363161636233353165393833373861653839303333376336
-33396365336235356639343432393238343264653163316663303235343038663262326237613363
+65386133663863396634393832626436653766623537663934616463393966346233386433343664
-30663136633436663431323663653337656235313335323732373738336335646264656534666236
+63333232623764326132636637666437333636303633663430643339623530633664656130636466
-35663339663762313135313732653766363139373130366330646537663435383438656637353134
+33363536393261626461646161373234383237376564663039343065316232646130636334653763
-66396233656162316164386564366232666265303230303032323663663538373237326236396337
+37336237613361633931326639663436393033633434326239393232346166393035633034646135
-34396265653730626566336437373564636461636433393133343933626630393035343634326338
+64636365613138333534333038373932653339383761653735396430336163613565383238383166
-64656231653361306262316339613938613432353137393962383036633164616531326236366664
+30656632303130376633656536323264373661363765633162353138626530353539643463626532
-39613939356265366433653966323566396138323935303137313739373038626162623465366437
+32363933633733393736623131633339363962663864393431653232303763333735393138623936
-66313133623231666361666236316666303533383430663834666139616131366161313563353063
+33616133326261356432396264653339323030386463366434393837336530326338613461646530
-65316130396135346332343338653231646437623761623231343135666330643532643665656162
+61333430376633666461356230316464326265636634343634636664393230383266363834346234
-65636334353637376634646139313135383564363435666333363431326332333131633131623861
+66313161366262313362653662383334353763663437336565356331353230383262396236613261
-34626563376135366365316466653539306465653437376263363163663964656436303631343531
+36336431366234616263326330366239616533613036353735303533653339636161393836353139
-39353936303566303661376331323862323532356637666535326539626637393666333264663734
+32636162356536366231346631666236653935666265633637363566626235333838353936613764
-33303536613164623437613834386562616565373438663065643663316665373331633232343330
+36306361336432346463336235626666356137363438626135393065623238316661643637363762
-34343535666662396238313135326564303665373231386361383135666437636435303831316662
+64653466363165656330383134626230353034653963346532376166653735633634316366303036
-61656238336236333963363637363030313537356662633130633332636564306131623262383535
+30353561646437636263636132346235656338316466363331396539616537343137303065633638
-64326536616235623038393363323766633736333131666361623961353434623738376135353332
+63386630393533663638633935376235396133646462343762363931396638363263393236373731
-35643664356566653035326235363464633233336534646639383662333438333530373930623665
+63643135343235333830383661643539393733306333316630663262313732373235663133663531
-65306634383539323064313235656531623261626535383832356263396539636433316434323632
+65616264386264313739393161386637323336653336346436636563393561636530303632343030
-39303335346662613232626231353938336362636266303538363234646163663038313663313765
+35303234323737653965333266623539313863376362633931313838323964633137336435306666
-66313365303738303262633061346530343966653830663535363164626665366239333030343833
+37326232396362396131353561323932336530643865633831613939383763366137373734303339
-66326364376238626263336666393665346630383534313261623931343062353432366434653566
+38356663346164643665326334613839646539353261306165316162366630363765306530623730
-39616530313837633335376435306533353638333734623766343732643064653363633763373134
+35303364656436336135396365616132376433383764356363333035396661623936333865356635
-30623962333761303833393339313931633633323561303765366565323333666633313563343132
+66663234636533386532623161386632366666393730643231613135356631646636343332646261
-62346139613131626664363735336330636264666638343330336238636338386263363339383963
+32623237356264623430666330306433313165626633636137666433323566633666383938623362
-30393236623930376235353532646432616331373637303261346264623133643738623163663035
+61346439323535643766643132326261383734386337363337303435326663326537303533336266
-3666313562366662363833356165343337336264336264393261
+39363361386235306365366366323562336634643335383861623066653937336362383662356535
+39636233346331376664356334663561383963616536636537656339373332613766626337613436
+36383361646436306562323862376165356436646339643030303132663430373330663064626230
+34393561393464626531626138326161353530393964663933653238393361373766376434653464
+32656338356332626261323363396433343263623831366363346161376434666261323534383466
+30363237653439663036313035383536303566376334386262623963356366333563326236343461
+31636266393864613935633235613462313931633635366333343835656366613832633035393331
+32393633303939386138376363653934653031303362653139636238383732643834376633643830
+64653132393166346464343062613033383837643466316534646334313263386238646432333330
+32646537613762326361663863353339633631333562383231323165663338383931313961386634
+33653232353931383635366265396266663531386239373931383563393130666237316539346563
+61303563306161663065383332306563313136616265383866373139376332636363326563386539
+62323363643432303561373130623863306365363961663838613633303135623036333134623939
+62646363333335386366623264633937396232613339663165613963393463303132323933656330
+38623038303934343835353731656234626138323963393136383261306630343138303963343036
+64353664646465626331346334336636313462303366643665316163346361323363393032343336
+32623066363935346538323364356135323964393738383539373861663934653735396637333934
+64626631663264373065396436323334323638356139356465346463333231646331326130383061
+63313335333062336131623339333665356237663862393734343661613465393430626465326564
+64663838363033323665613732633334356532316665646338333333613465643637656661663634
+65326565663339316634383632386430653461663930633466303232636536303039303731396363
+66363063383832303165396261313030663636333938663134323030396139373539663833326637
+33373961646466663639

inventory/group_vars/all/xray_outbounds.yml

@@ -1,4 +0,0 @@
-xray_id: "{{ encrypted_xray_id }}"
-xray_xhttp_path: "{{ encrypted_xray_xhttp_path }}"
-xray_encryption: "{{ encrypted_xray_encryption }}"
-xray_outbounds: "{{ encrypted_xray_outbounds }}"

inventory/group_vars/static.yml

@@ -0,0 +1,4 @@
+ansible_connection: ssh
+ansible_user: root
+ansible_host: "{{ container_ip }}"
+ansible_ssh_private_key_file: "~/.ssh/id_ed25519"

inventory/host_vars/firebat/main.yml

@@ -0,0 +1 @@
+ansible_python_interpreter: /usr/bin/python3

inventory/host_vars/firebat/zfs.yml

@@ -0,0 +1,25 @@
+zfs:
+  - name: rpool/data/pgsql
+    extra_zfs_properties:
+      quota: "21474836480"
+  - name: rpool/data/vaultwarden
+    extra_zfs_properties:
+      quota: "5368709120"
+  - name: rpool/data/gitea
+    extra_zfs_properties:
+      quota: "5368709120"
+  - name: rpool/data/slskd
+    extra_zfs_properties:
+      quota: "5368709120"
+  - name: rpool/data/rtorrent
+    extra_zfs_properties:
+      quota: "1073741824"
+  - name: rpool/data/jellfin
+    extra_zfs_properties:
+      quota: "5368709120"
+  - name: rpool/data/prosody
+    extra_zfs_properties:
+      quota: "10737418240"
+  - name: rpool/data/steamcmd
+    extra_zfs_properties:
+      quota: "21474836480"

inventory/host_vars/nginx.yml

@@ -35,6 +35,9 @@ nft_to:
   - to: bylampa
     proto: tcp
     port: 80
+  - to: ps3
+    proto: tcp
+    port: 80
   - to: firebat
     proto: tcp
     port: 8006

inventory/host_vars/note13.yml

@@ -0,0 +1,4 @@
+xray_policy:
+  - bypass: private
+  - bypass: russian_whitelist
+  - proxy: all 

inventory/host_vars/oyacoi-odcm.yml

@@ -1,4 +1,7 @@
 nft_to:
+  - to: nginx
+    proto: tcp
+    port: [80,443]
   - to: nfs
     proto: [tcp,udp]
     port: [2049,111,32765,32767]
@@ -9,6 +12,22 @@ nft_to:
     proto: tcp
     port: 22
 
+nft_dst:
+  - iface: eth1
+    proto: tcp
+    port: [3783,4321,28900,29900,29901]
+  - iface: eth1
+    proto: udp
+    port: [6500,6515,13139,27900]
+
+nft_from:
+  - iface: eth1
+    proto: tcp
+    port: [3783,4321,28900,29900,29901]
+  - iface: eth1
+    proto: udp
+    port: [6500,6515,13139,27900]
+
 xray_policy:
   - bypass: private
   - bypass: russian_whitelist

inventory/host_vars/router.yml

@@ -1,6 +0,0 @@
-ansible_host: 10.1.0.1
-ansible_connection: ssh
-ansible_user: root
-ansible_ssh_private_key_file: ~/.ssh/id_ed25519
-zone_iface: eth0
-container_ip: 10.1.0.1

inventory/host_vars/router/ifupdown2.yml

@@ -0,0 +1,37 @@
+ifupdown2:
+  - iface: lo
+    method: loopback
+    routing:
+      - "post-up ip rule add fwmark 0x1 lookup 100 2>/dev/null || true"
+      - "post-up ip route add local 0.0.0.0/0 dev lo table 100 2>/dev/null || true"
+      - "pre-down ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null || true"
+      - "pre-down ip rule del fwmark 0x1 lookup 100 2>/dev/null || true"
+  - iface: eth0
+    method: static
+    address: 10.1.0.1/24
+  - iface: eth0.2
+    method: static
+    address: 10.2.0.1/24
+    vlan-raw-device: eth0
+  - iface: eth0.3
+    method: static
+    address: 10.3.0.1/24
+    vlan-raw-device: eth0
+  - iface: eth0.4
+    method: static
+    address: 10.4.0.1/24
+    vlan-raw-device: eth0
+  - iface: eth0.10
+    method: static
+    address: 10.10.0.1/24
+    vlan-raw-device: eth0
+  - iface: eth0.11
+    method: static
+    address: 10.11.0.1/24
+    vlan-raw-device: eth0
+  - iface: eth0.12
+    method: static
+    address: 10.12.0.1/24
+    vlan-raw-device: eth0
+  - iface: eth1
+    method: dhcp

inventory/host_vars/router/logrotate.yml

@@ -0,0 +1,13 @@
+logrotate:
+  - name: xray-core
+    paths:
+      - /var/log/xray-core/access.log
+      - /var/log/xray-core/error.log
+    options:
+      - daily
+      - rotate 4
+      - compress
+      - delaycompress
+      - missingok
+      - notifempty
+      - copytruncate

inventory/host_vars/router/main.yml

@@ -0,0 +1,2 @@
+zone_iface: "eth0"
+container_ip: "10.1.0.1"

inventory/host_vars/router/managed_group.yml

@@ -0,0 +1,3 @@
+nft_managed_group: "{{ groups['static'] + groups['proxmox_all_lxc'] }}"
+dnsmasq_managed_group: "{{ groups['static'] + groups['proxmox_all_lxc'] }}"
+xray_managed_group: "{{ groups['static'] + groups['proxmox_all_lxc'] }}"

inventory/host_vars/router/sysctl.yml

@@ -0,0 +1,5 @@
+sysctl:
+  net.ipv4.ip_forward: 1
+  net.ipv4.conf.lo.rp_filter: 0
+  net.ipv4.conf.all.rp_filter: 0
+  net.ipv4.conf.wg0.rp_filter: 0

inventory/host_vars/router/xray-lists.yml

@@ -4,36 +4,29 @@ xray_ip_sets:
       - https://raw.githubusercontent.com/1andrevich/Re-filter-lists/refs/heads/main/community_ips.lst
       - https://raw.githubusercontent.com/1andrevich/Re-filter-lists/refs/heads/main/discord_ips.lst
       - https://raw.githubusercontent.com/1andrevich/Re-filter-lists/refs/heads/main/ipsum.lst
-
   cdn:
     urls:
       - https://raw.githubusercontent.com/123jjck/cdn-ip-ranges/refs/heads/main/all/all_plain_ipv4.txt
-
   telegram:
     urls:
       - https://raw.githubusercontent.com/fernvenue/telegram-cidr-list/refs/heads/master/CIDRv4.txt
-
   russian_whitelist:
     urls:
       - https://raw.githubusercontent.com/hxehex/russia-mobile-internet-whitelist/refs/heads/main/cidrwhitelist.txt
       - https://raw.githubusercontent.com/ebrasha/cidr-ip-ranges-by-country/refs/heads/master/CIDR/RU-ipv4-Hackers.Zone.txt
-
   cloudflare:
     static:
       - 1.1.1.1
       - 1.0.0.1
-
   google:
     urls:
       - https://raw.githubusercontent.com/lord-alfred/ipranges/main/google/ipv4.txt
-
 xray_domain_sets:
   v2ray:
     urls:
       - https://raw.githubusercontent.com/v2ray/domain-list-community/refs/heads/master/data/spotify
       - https://raw.githubusercontent.com/v2ray/domain-list-community/refs/heads/master/data/microsoft
       - https://raw.githubusercontent.com/v2ray/domain-list-community/refs/heads/master/data/openai
-
   torrent:
     static:
       - bt.t-ru.org
@@ -47,31 +40,23 @@ xray_domain_sets:
       - nnmclub.to
       - rutor.info
       - bigfangroup.org
-
   vps:
     static:
       - dev.oyacoi.ru
       - vector.oyacoi.ru
-
   terraform:
     static:
       - terraform.io
       - hashicorp.com
-
 output_rules:
   - cloudflare
-
 xray_static_sets:
   - private
-
 xray_lists_global:
   cache_dir: /var/lib/xray-lists/cache
   output_dir: /var/lib/xray-lists/generated
   dnsmasq_output: /var/lib/xray-lists/generated/nftsets.conf
   proxy: "socks5h://127.0.0.1:1080"
-  proxy_user: "{{ encrypted_proxy_user }}"
-  proxy_pass: "{{ encrypted_proxy_pass }}"
   http_timeout: 20
-
 xray_tproxy_port: 61219
 xray_fwmark: "0x00000001"

inventory/host_vars/router/zerotier-one.yml

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+30313538656633333565613030356534313035646337323763663565326431323437623636656365
+3139663263383363626438396133623639636565386230640a333166373634343630663566396264
+64613435643864373264323061336438396339326466663637363536663165373231333738313466
+6532343566653238620a336633376336303439656163393165323364663033663432643034396262
+61383431663836613335623761366433366364363938643935636634313631653935306230346234
+3934303233633837356437636639353563376563613237646133

inventory/host_vars/runner.yml

@@ -1,4 +1,7 @@
 nft_to:
+  - to: [zone:eth0.12]
+    proto: tcp
+    port: 22
   - to: firebat
     proto: tcp
     port: [22, 8006]

inventory/host_vars/steamcmd.yml

@@ -1,9 +0,0 @@
-nft_dst:
-  - iface: eth0
-    proto: udp
-    port: 2456
-
-nft_from:
-  - iface: [eth0,wg0]
-    proto: udp
-    port: [2456,2457]

inventory/host_vars/steamcmd/main.yml

@@ -0,0 +1,15 @@
+nft_dst:
+  - iface: eth1
+    proto: udp
+    port: [2456,2457]
+
+nft_from:
+  - iface: [eth0,wg0]
+    proto: tcp
+    port: [5000,5222,5223,5269,5270,5280]
+  - iface: [eth0,wg0]
+    proto: udp
+    port: [2302,2304,2456,2457,27016]
+  - iface: eth1
+    proto: udp
+    port: [2456,2457]

inventory/host_vars/steamcmd/user.yml

@@ -0,0 +1,6 @@
+user:
+  - name: steamcmd
+    create_home: true
+    home: /var/lib/steamcmd
+    shell: /bin/bash
+    system: true

inventory/host_vars/tanix.yml

@@ -0,0 +1,4 @@
+xray_policy:
+  - bypass: private
+  - bypass: russian_whitelist
+  - proxy: all

inventory/proxmox.yml

@@ -1,13 +1,20 @@
-plugin: community.proxmox.proxmox
+$ANSIBLE_VAULT;1.1;AES256
-url: https://10.1.0.4:8006
+37386530393166613762313561626462336132393166653364343962396164323734313165383763
-user: root@pam
+6234663630386531323464643538353865613334656264620a316630336537396363303333343637
-password: "{{ lookup('env', 'PROXMOX_PASSWORD') }}"
+38636437633264373866616366666337366362306438306430633566316234323935363237343762
-validate_certs: false
+3533393634633733330a626139316231383738626465373566303565633135646164323535326635
-want_facts: true
+38313138383063646237303634376237623661633830363531323563613131613530663730653533
-
+36643330623366636363613437313030303463613163323333663865633538343266353134386631
-filter_by_types:
+36663530376238656262346662383532613631636234323431303935323138306163323839636338
-  - lxc
+61373735366332356138313762663633393165663732653565663066613636366538376263366337
-
+31386337623562313731386563313736346139353961663231353862636138303938323235633038
-compose:
+38636562646533633261346264373466373536376530623639366262613365366437373334396665
-  zone_iface: "'eth0.' ~ proxmox_net0.tag"
+30653037366339383538313965663865636462633139616332386165663564616263666533363034
-  container_ip: "proxmox_net0.ip | default('') | regex_replace('/.*', '')"
+38643065303832666335623035326566653437393638373261343138636530373839646231643665
+33323338333231643435663336653232373732636335656238376563666632313131656432336233
+63636437643838316166666137386361386233346633316166333662323838313565653233346537
+61383966343434323539326364646230336339353337326539333031376464353732326331333864
+34303431363632386562616131306436373464393165396437613535323230353862346662346265
+33303137383033313534393438343934653037643936633361343638616461643935386430616133
+62633262306538663961646263613239313261633764663532616138313663343863643965613730
+396266656366353238353038333832336234

inventory/static.yml

@@ -13,9 +13,6 @@ all:
         firebat:
           container_ip: "10.1.0.4"
           zone_iface: "eth0"
-          ansible_host: 10.1.0.4
-          ansible_user: root
-          ansible_ssh_private_key_file: "~/.ssh/id_ed25519"
 
         ps2:
           container_ip: "10.1.0.5"

playbooks/firebat.yml

@@ -0,0 +1,11 @@
+---
+- name: configure over ssh
+  hosts: firebat
+  vars:
+    ansible_connection: ssh
+    ansible_host: "{{ container_ip }}"
+    ansible_user: root
+    ansible_ssh_private_key_file: ~/.ssh/id_ed25519
+    ansible_ssh_common_args: '-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
+  roles:
+    - zfs

playbooks/router.yml

@@ -1,9 +1,29 @@
 ---
-- hosts: router
+- name: configure over pct
-  become: yes
+  hosts: router
+  gather_facts: false
   roles:
-    - router
+    - authorized_key
+    - ifupdown2
+
+- name: configure over ssh
+  hosts: router
+  vars:
+    ansible_connection: ssh
+    ansible_host: "{{ container_ip }}"
+    ansible_user: root
+    ansible_ssh_private_key_file: ~/.ssh/id_ed25519
+    ansible_ssh_common_args: '-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
+  roles:
+    - timezone
+    - locales
+    - sysctl
+    - xray-core
+    - xray-client
+    - logrotate
+    - dnsmasq
     - xray-lists
     - unbound
-    - dnsmasq
+    - wireguard-tools
+    - zerotier-one
     - nftables

playbooks/steamcmd.yml

@@ -0,0 +1,20 @@
+---
+- name: configure over pct
+  hosts: steamcmd
+  gather_facts: false
+  roles:
+    - authorized_key
+
+- name: configure over ssh
+  hosts: steamcmd
+  vars:
+    ansible_connection: ssh
+    ansible_host: "{{ container_ip }}"
+    ansible_user: root
+    ansible_ssh_private_key_file: ~/.ssh/id_ed25519
+    ansible_ssh_common_args: '-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
+  roles:
+    - timezone
+    - locales
+    - user
+    - steamcmd

roles/apt/tasks/apt.yml

@@ -0,0 +1,5 @@
+- name: install package
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    update_cache: true
+  loop: "{{ apt }}"

roles/apt/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: include apt install
+  ansible.builtin.include_tasks: apt.yml

roles/authorized_key/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+- name: ensure .ssh exists
+  ansible.builtin.file:
+    path: /root/.ssh
+    state: directory
+    mode: '0700'
+    owner: root
+    group: root
+
+- name: set authorized key
+  ansible.posix.authorized_key:
+    user: root
+    state: present
+    key: "{{ item }}"
+  loop: "{{ ssh_keys }}"

roles/dnsmasq/tasks/configure.yml

@@ -0,0 +1,39 @@
+---
+- name: ensure /etc/dnsmasq.d exists
+  ansible.builtin.file:
+    path: /etc/dnsmasq.d
+    state: directory
+    mode: "0755"
+
+- name: deploy dnsmasq rule
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/dnsmasq.d/{{ item }}"
+    mode: "0644"
+  loop:
+    - 10-upstream.conf
+    - 20-custom-domains.conf
+    - 20-dhcp.conf
+    - 20-dns-optimizations.conf
+  notify: restart dnsmasq
+
+- name: render local
+  ansible.builtin.template:
+    src: 90-local.conf.j2
+    dest: /etc/dnsmasq.d/90-local.conf
+    mode: "0644"
+  notify: restart dnsmasq
+
+- name: render dhcp-host
+  ansible.builtin.template:
+    src: 90-dhcp-host.conf.j2
+    dest: /etc/dnsmasq.d/90-dhcp-host.conf
+    mode: "0644"
+  notify: restart dnsmasq
+
+- name: render domain
+  ansible.builtin.template:
+    src: 90-domains.conf.j2
+    dest: /etc/dnsmasq.d/90-domains.conf
+    mode: "0644"
+  notify: restart dnsmasq

roles/dnsmasq/tasks/install.yml

@@ -0,0 +1,6 @@
+---
+- name: install dnsmasq
+  ansible.builtin.apt:
+    name: dnsmasq
+    state: latest
+    update_cache: true

roles/dnsmasq/tasks/main.yml

@@ -1,39 +1,6 @@
 ---
-- name: ensure /etc/dnsmasq.d exists
+- name: include dnsmasq install
-  ansible.builtin.file:
+  ansible.builtin.include_tasks: install.yml
-    path: /etc/dnsmasq.d
-    state: directory
-    mode: "0755"
 
-- name: deploy dnsmasq rule
+- name: include dnsmasq configurure
-  ansible.builtin.copy:
+  ansible.builtin.include_tasks: configure.yml
-    src: "{{ item }}"
-    dest: "/etc/dnsmasq.d/{{ item }}"
-    mode: "0644"
-  loop:
-    - 10-upstream.conf
-    - 20-custom-domains.conf
-    - 20-dhcp.conf
-    - 20-dns-optimizations.conf
-  notify: restart dnsmasq
-
-- name: render local
-  ansible.builtin.template:
-    src: 90-local.conf.j2
-    dest: /etc/dnsmasq.d/90-local.conf
-    mode: "0644"
-  notify: restart dnsmasq
-
-- name: render dhcp-host
-  ansible.builtin.template:
-    src: 90-dhcp-host.conf.j2
-    dest: /etc/dnsmasq.d/90-dhcp-host.conf
-    mode: "0644"
-  notify: restart dnsmasq
-
-- name: render domain
-  ansible.builtin.template:
-    src: 90-domains.conf.j2
-    dest: /etc/dnsmasq.d/90-domains.conf
-    mode: "0644"
-  notify: restart dnsmasq

roles/dnsmasq/templates/90-dhcp-host.conf.j2

@@ -1,5 +1,5 @@
 #jinja2: trim_blocks: True, lstrip_blocks: True
-{% for item in groups[dnsmasq_managed_group] | sort %}
+{% for item in dnsmasq_managed_group | sort %}
     {% set client = hostvars[item] %}
     {% set ip = client.container_ip | default(client.ansible_host | default(none)) %}
     {% if client['dhcp-host'] is defined and client['dhcp-host'] and ip %}

roles/dnsmasq/templates/90-domains.conf.j2

@@ -1,5 +1,5 @@
 #jinja2: trim_blocks: True, lstrip_blocks: True
-{% for item in groups[dnsmasq_managed_group] | sort %}
+{% for item in dnsmasq_managed_group | sort %}
     {% set client = hostvars[item] %}
     {% if 'dnsmasq' in client and client.dnsmasq %}
         {% set default_ip = client.container_ip | default(client.ansible_host | default(none)) %}

roles/dnsmasq/templates/90-local.conf.j2

@@ -1,5 +1,5 @@
 #jinja2: trim_blocks: True, lstrip_blocks: True
-{% for item in groups[dnsmasq_managed_group] | sort %}
+{% for item in dnsmasq_managed_group | sort %}
     {% set client = hostvars[item] %}
     {% set ip = client.container_ip | default(client.ansible_host | default(none)) %}
     {% if ip %}

roles/ifupdown2/tasks/network.yml

@@ -0,0 +1,13 @@
+---
+- name: deploy ifupdown interfaces config
+  ansible.builtin.template:
+    src: interfaces
+    dest: /etc/network/interfaces
+    owner: root
+    group: root
+    mode: '0644'
+  register: interfaces_conf
+
+- name: reload ifupdown2
+  command: ifreload -a
+  when: interfaces_conf.changed

roles/ifupdown2/templates/interfaces

@@ -0,0 +1,20 @@
+{% for item in ifupdown2 %}
+auto {{ item.iface }}
+iface {{ item.iface }}{% if item.method is defined %} inet {{ item.method }}
+{% endif %}
+
+{% if item.address is defined %}
+    address {{ item.address }}
+{% endif %}
+{% if item['vlan-raw-device'] is defined %}
+    vlan-raw-device {{ item['vlan-raw-device'] }}
+{% endif %}
+{% if item.routing is defined %}
+{% for route in item.routing %}
+    {{ route }}
+{% endfor %}
+{% endif %}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}

roles/locales/tasks/configure.yml

@@ -0,0 +1,22 @@
+---
+- name: set required locales
+  community.general.locale_gen:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ locales_list }}"
+
+- name: configure /etc/default/locale
+  ansible.builtin.copy:
+    dest: /etc/default/locale
+    content: LANG={{ locale_default }}
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: configure /etc/locale.conf
+  ansible.builtin.copy:
+    dest: /etc/locale.conf
+    content: LANG={{ locale_default }}
+    owner: root
+    group: root
+    mode: '0644'

roles/locales/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: include locales configure
+  ansible.builtin.include_tasks: configure.yml

roles/logrotate/tasks/configure.yml

@@ -0,0 +1,9 @@
+---
+- name: deploy logrotate config
+  ansible.builtin.template:
+    src: logrotate.conf.j2
+    dest: "/etc/logrotate.d/{{ item.name }}"
+    mode: "0644"
+  loop: "{{ logrotate }}"
+  loop_control:
+    label: "{{ item.name }}"

roles/logrotate/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: include logrotate configure
+  ansible.builtin.include_tasks: configure.yml

roles/logrotate/templates/logrotate.conf.j2

@@ -0,0 +1,5 @@
+{{ item.paths | join(' ') }} {
+{% for opt in item.options %}
+    {{ opt }}
+{% endfor %}
+}

roles/nftables/files/10-filter.nft

@@ -35,6 +35,9 @@ chain forward {
     iifname { eth0, eth0.2, eth0.3, eth0.4, eth0.10, eth0.11, eth0.12 } oifname eth1 ct state new flow add @ft
     iifname { eth0, eth0.2, eth0.3, eth0.4, eth0.10, eth0.11, eth0.12 } oifname eth1 accept
 
+    iifname "zt*" oifname "eth0" accept
+    iifname "eth0" oifname "zt*" accept
+
     tcp flags syn tcp option maxseg size set rt mtu
 
     include "/etc/nftables.d/90-forward.nft"

roles/nftables/tasks/install.yml

@@ -1,5 +1,6 @@
 ---
 - name: install nftables
-  ansible.builtin.package:
+  ansible.builtin.apt:
     name: nftables
-    state: present
+    state: latest
+    update_cache: true

roles/nftables/tasks/main.yml

@@ -2,5 +2,5 @@
 - name: include nftables install
   ansible.builtin.include_tasks: install.yml
 
-- name: include nftables configurure
+- name: include nftables configure
   ansible.builtin.include_tasks: configure.yml

roles/nftables/templates/90-dstnat.nft.j2

@@ -1,5 +1,5 @@
 #jinja2: trim_blocks: True, lstrip_blocks: True
-{% for item in groups[nft_managed_group] | sort %}
+{% for item in nft_managed_group | sort %}
     {% set client = hostvars[item] %}
     {% if 'nft_dst' in client and client.nft_dst is not none %}
         {% set target_ip = client.container_ip %}

roles/nftables/templates/90-forward.nft.j2

@@ -1,5 +1,5 @@
 #jinja2: trim_blocks: True, lstrip_blocks: True
-{% for item in groups[nft_managed_group] | sort %}
+{% for item in nft_managed_group | sort %}
     {% set client = hostvars[item] %}
     {% if 'nft_to' in client and client.nft_to is not none %}
         {% set rules = client.nft_to if (client.nft_to is iterable and client.nft_to is not string) else [client.nft_to] %}
@@ -27,7 +27,7 @@ iifname "{{ client.zone_iface }}" ip saddr {{ client.container_ip }} oifname "{{
         {% endfor %}
     {% endif %}
 {% endfor %}
-{% for item in groups[nft_managed_group] | sort %}
+{% for item in nft_managed_group | sort %}
     {% set client = hostvars[item] %}
     {% if 'nft_from' in client and client.nft_from is not none %}
         {% set rules = client.nft_from if (client.nft_from is iterable and client.nft_from is not string) else [client.nft_from] %}

roles/router/files/ifupdown2/interfaces

@@ -1,52 +0,0 @@
-auto lo
-iface lo inet loopback
-    post-up ip rule add fwmark 0x1 lookup 100 2>/dev/null || true
-    post-up ip route add local 0.0.0.0/0 dev lo table 100 2>/dev/null || true
-    pre-down ip route del local 0.0.0.0/0 dev lo table 100 2>/dev/null || true
-    pre-down ip rule del fwmark 0x1 lookup 100 2>/dev/null || true
-
-auto eth0
-iface eth0 inet manual
-    address 10.1.0.1/24
-
-auto eth0.2
-iface eth0.2 inet static
-    address 10.2.0.1/24
-    vlan-raw-device eth0
-
-auto eth0.3
-iface eth0.3 inet static
-    address 10.3.0.1/24
-    vlan-raw-device eth0
-
-auto eth0.4
-iface eth0.4 inet static
-    address 10.4.0.1/24
-    vlan-raw-device eth0
-
-auto eth0.10
-iface eth0.10 inet static
-    address 10.10.0.1/24
-    vlan-raw-device eth0
-
-auto eth0.11
-iface eth0.11 inet static
-    address 10.11.0.1/24
-    vlan-raw-device eth0
-
-auto eth0.12
-iface eth0.12 inet static
-    address 10.12.0.1/24
-    vlan-raw-device eth0
-
-auto eth1
-iface eth1 inet dhcp
-
-auto wg0
-iface wg0 inet manual
-    post-up ip route add 10.250.250.0/24 dev wg0 2>/dev/null || true
-    post-up ip rule add fwmark 0xc7 lookup 199 2>/dev/null || true
-    post-up ip route add default dev wg0 table 199 2>/dev/null || true
-    pre-down ip route del default dev wg0 table 199 2>/dev/null || true
-    pre-down ip rule del fwmark 0xc7 lookup 199 2>/dev/null || true
-    pre-down ip route del 10.250.250.0/24 dev wg0 2>/dev/null || true

roles/router/files/sysctl/01-forwarding.conf

@@ -1 +0,0 @@
-net.ipv4.ip_forward=1

roles/router/files/sysctl/02-rpfilter.conf

@@ -1,3 +0,0 @@
-net.ipv4.conf.lo.rp_filter=0
-net.ipv4.conf.all.rp_filter=0
-net.ipv4.conf.wg0.rp_filter=0

roles/router/handlers/main.yml

@@ -1,3 +0,0 @@
----
-- name: reload ifupdown2
-  command: ifreload -a

roles/router/tasks/network.yml

@@ -1,9 +0,0 @@
----
-- name: deploy ifupdown config
-  copy:
-    src: ifupdown2/interfaces
-    dest: /etc/network/interfaces
-    owner: root
-    group: root
-    mode: '0644'
-  notify: reload ifupdown2

roles/steamcmd/files/dayz.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=dayz server
+Wants=network.target
+After=syslog.target network-online.target
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=10
+User=steamcmd
+WorkingDirectory=/mnt/steamcmd/dayz
+ExecStart=/mnt/steamcmd/dayz/DayZServer -config=serverDZ-custom.cfg -port=2302
+
+[Install]
+WantedBy=multi-user.target

roles/steamcmd/files/serverDZ.cfg

@@ -0,0 +1,32 @@
+hostname = "oyacoi";
+password = "ff32167";
+passwordAdmin = "";
+description = "";
+enableWhitelist = 0;
+maxPlayers = 1;
+verifySignatures = 2;
+forceSameBuild = 1;
+disableVoN = 1;
+vonCodecQuality = 0;
+shardId = "123abc";
+disable3rdPerson=1;
+disableCrosshair=1;
+disablePersonalLight = 1;
+lightingConfig = 0;
+serverTime="SystemTime";
+serverTimeAcceleration=6;
+serverNightTimeAcceleration=12;
+serverTimePersistent=0;
+guaranteedUpdates=1;
+loginQueueConcurrentPlayers=5;
+loginQueueMaxPlayers=0;
+instanceId = 1;
+storageAutoFix = 1;
+ 
+class Missions
+{
+    class DayZ
+    {
+        template="dayzOffline.sakhal";
+    };
+};

roles/steamcmd/files/start_server.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+export templdpath=$LD_LIBRARY_PATH
+export LD_LIBRARY_PATH=./linux64:$LD_LIBRARY_PATH
+export SteamAppId=892970
+
+echo "Starting server PRESS CTRL-C to exit"
+
+# Tip: Make a local copy of this script to avoid it being overwritten by steam.
+# NOTE: Minimum password length is 5 characters & Password cant be in the server name.
+# NOTE: You need to make sure the ports 2456-2458 is being forwarded to your server through your local router & firewall.
+./valheim_server.x86_64 -name "oyacoi" -port 2456 -world "world0" -password "ff32167" -public 0
+
+export LD_LIBRARY_PATH=$templdpath

roles/steamcmd/files/valheim.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=valheim server
+Wants=network.target
+After=syslog.target network-online.target
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=10
+User=steamcmd
+WorkingDirectory=/mnt/steamcmd/valheim
+ExecStart=/bin/bash /mnt/steamcmd/valheim/start_server-custom.sh
+
+[Install]
+WantedBy=multi-user.target

roles/steamcmd/handlers/main.yml

@@ -0,0 +1,14 @@
+---
+- name: restart valheim
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: valheim.service
+    state: restarted
+    enabled: true
+
+- name: restart dayz
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: dayz.service
+    state: restarted
+    enabled: true

roles/steamcmd/tasks/apt.yml

@@ -0,0 +1,4 @@
+- name: install package
+  ansible.builtin.apt:
+    name: steamcmd
+    update_cache: true

roles/steamcmd/tasks/command.yml

@@ -0,0 +1,23 @@
+- name: check steam session
+  ansible.builtin.stat:
+    path: /var/lib/steamcmd/.local/share/Steam/config/config.vdf
+  register: steam_session
+
+- name: abort if steam authorization is missing
+  ansible.builtin.fail:
+    msg: "Manual Steam authorization required. Please log in interactively."
+  when: not steam_session.stat.exists
+
+- name: install valheim server
+  ansible.builtin.command:
+    cmd: su - steamcmd -c "/usr/games/steamcmd +force_install_dir /mnt/steamcmd/valheim +login anonymous +app_update 896660 validate +exit"
+  register: valheim_result
+  changed_when: "'downloading' in valheim_result.stdout"
+  notify: restart valheim
+
+- name: install dayz server
+  ansible.builtin.command:
+    cmd: su - steamcmd -c "/usr/games/steamcmd +force_install_dir /mnt/steamcmd/dayz +login gshinzu +app_update 223350 validate +exit"
+  register: dayz_result
+  changed_when: "'downloading' in dayz_result.stdout"
+  notify: restart dayz

roles/steamcmd/tasks/copy.yml

@@ -0,0 +1,34 @@
+---
+- name: deploy start_server.sh
+  ansible.builtin.copy:
+    src: start_server.sh
+    dest: /mnt/steamcmd/valheim/start_server-custom.sh
+    owner: steamcmd
+    group: steamcmd
+    mode: '0775'
+
+- name: deploy valheim.service
+  ansible.builtin.copy:
+    src: valheim.service
+    dest: /etc/systemd/system/valheim.service
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart valheim
+
+- name: deploy serverDZ.cfg
+  ansible.builtin.copy:
+    src: serverDZ.cfg 
+    dest: /mnt/steamcmd/dayz/serverDZ-custom.cfg
+    owner: steamcmd
+    group: steamcmd
+    mode: '0755'
+
+- name: deploy dayz.service
+  ansible.builtin.copy:
+    src: dayz.service
+    dest: /etc/systemd/system/dayz.service
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart dayz

roles/steamcmd/tasks/deb822.yml

@@ -0,0 +1,14 @@
+---
+- name: configure debian-unstable.sources
+  ansible.builtin.deb822_repository:
+    name: debian-unstable
+    types: deb
+    uris: http://deb.debian.org/debian
+    suites:
+      - unstable
+    components:
+      - contrib
+      - main
+      - non-free
+    signed_by: /usr/share/keyrings/debian-archive-keyring.gpg
+    state: present

roles/steamcmd/tasks/debconf.yml

@@ -0,0 +1,6 @@
+- name: accept agreement
+  ansible.builtin.debconf:
+    name: steamcmd
+    question: steam/question
+    vtype: string
+    value: "I AGREE"

roles/steamcmd/tasks/file.yml

@@ -0,0 +1,14 @@
+---
+- name: create valheim dir
+  ansible.builtin.file:
+    path: /mnt/steamcmd/valheim
+    owner: steamcmd
+    group: steamcmd
+    state: "directory"
+
+- name: create dayz dir
+  ansible.builtin.file:
+    path: /mnt/steamcmd/dayz
+    owner: steamcmd
+    group: steamcmd
+    state: "directory"

roles/steamcmd/tasks/i386.yml

@@ -0,0 +1,10 @@
+---
+- name: check if i386 architecture
+  ansible.builtin.command: dpkg --print-foreign-architectures
+  register: check_i386
+  changed_when: false
+  failed_when: false
+
+- name: add i386 architecture
+  ansible.builtin.command: dpkg --add-architecture i386
+  when: "'i386' not in check_i386.stdout"

roles/steamcmd/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: include deb822 
+  ansible.builtin.include_tasks: deb822.yml
+
+- name: include i386 
+  ansible.builtin.include_tasks: i386.yml
+
+- name: include file
+  ansible.builtin.include_tasks: file.yml
+
+- name: include debconf
+  ansible.builtin.include_tasks: debconf.yml
+
+- name: include apt
+  ansible.builtin.include_tasks: apt.yml
+
+- name: include command
+  ansible.builtin.include_tasks: command.yml
+
+- name: include copy
+  ansible.builtin.include_tasks: copy.yml

roles/sysctl/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+- name: reload sysctl
+  ansible.builtin.command: sysctl -p /etc/sysctl.d/99-custom.conf

roles/sysctl/tasks/configure.yml

@@ -0,0 +1,8 @@
+- name: deploy sysctl config
+  ansible.builtin.template:
+    src: sysctl.conf.j2
+    dest: "/etc/sysctl.d/99-custom.conf"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: reload sysctl

roles/sysctl/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: include sysctl configure
+  ansible.builtin.include_tasks: configure.yml

roles/sysctl/templates/sysctl.conf.j2

@@ -0,0 +1,3 @@
+{% for key, value in sysctl.items() %}
+{{ key }} = {{ value }}
+{% endfor %}

roles/timezone/tasks/configure.yml

@@ -0,0 +1,4 @@
+---
+- name: set system timezone
+  community.general.timezone:
+    name: "{{ timezone_name }}"

roles/timezone/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: include timezone configure
+  ansible.builtin.include_tasks: configure.yml

roles/unbound/tasks/install.yml

@@ -1,5 +1,6 @@
 ---
 - name: install unbound
-  ansible.builtin.package:
+  ansible.builtin.apt:
     name: unbound
-    state: present
+    state: latest
+    update_cache: true

roles/user/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: add user
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    create_home: "{{ item.create_home | default(false) }}"
+    home: "{{ item.home | default(omit) }}"
+    shell: "{{ item.shell | default('/usr/sbin/nologin') }}"
+    state: "{{ item.state | default('present') }}"
+    system: "{{ item.system }}"
+  loop: "{{ user }}"

roles/wireguard-tools/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: restart wg0 systemd service unit
+  ansible.builtin.systemd_service:
+    name: wg-quick@wg0
+    daemon_reload: true
+    state: restarted
+    enabled: true

roles/wireguard-tools/tasks/configure.yml

@@ -0,0 +1,21 @@
+---
+- name: ensure /etc/wireguard exists
+  ansible.builtin.file:
+    path: /etc/wireguard
+    state: directory
+    mode: "0700"
+
+- name: deploy wireguard config
+  ansible.builtin.template:
+    src: "wg0.conf.j2"
+    dest: "/etc/wireguard/wg0.conf"
+    mode: "0644"
+  register: wg0_conf
+
+- name: restart wg0 systemd service unit
+  ansible.builtin.systemd_service:
+    name: wg-quick@wg0
+    daemon_reload: true
+    state: restarted
+    enabled: true
+  when: wg0_conf.changed

roles/wireguard-tools/tasks/install.yml

@@ -0,0 +1,6 @@
+---
+- name: install wireguard-tools 
+  ansible.builtin.apt:
+    name: wireguard-tools
+    state: latest
+    update_cache: true

roles/wireguard-tools/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: include wireguard-tools install
+  ansible.builtin.include_tasks: install.yml
+
+- name: include wireguard-tools configurure
+  ansible.builtin.include_tasks: configure.yml

roles/wireguard-tools/templates/wg0.conf.j2

@@ -0,0 +1,17 @@
+[Interface]
+PrivateKey = {{ wg_private_key }}
+Address = {{ wg_address }}
+Table = off
+PostUp = ip route add 10.250.250.0/24 dev wg0 2>/dev/null || true
+PostUp = ip rule add fwmark 0xc7 lookup 199 2>/dev/null || true
+PostUp = ip route add default dev wg0 table 199 2>/dev/null || true
+PreDown = ip route del default dev wg0 table 199 2>/dev/null || true
+PreDown = ip rule del fwmark 0xc7 lookup 199 2>/dev/null || true
+PreDown = ip route del 10.250.250.0/24 dev wg0 2>/dev/null || true
+
+[Peer]
+PublicKey = {{ wg_public_key }}
+PresharedKey = {{ wg_presharedkey }}
+Endpoint = {{ wg_endpoint_address }}:{{ wg_endpoint_port }}
+PersistentKeepalive = 25
+AllowedIPs = 0.0.0.0/0

roles/xray-client/files/inbounds.jsonc

@@ -2,7 +2,7 @@
     "inbounds": [
         {
             "port": 61219,
-            "listen": "127.0.0.1",
+            "listen": "0.0.0.0",
             "protocol": "dokodemo-door",
             "settings": {
                 "followRedirect": true,

roles/xray-client/tasks/configure.yml

@@ -0,0 +1,43 @@
+---
+- name: ensure /opt/xray-core/config exists
+  ansible.builtin.file:
+    path: /opt/xray-core/config
+    state: directory
+    mode: 0755
+
+- name: ensure /var/log/xray-core exists
+  ansible.builtin.file:
+    path: /var/log/xray-core
+    state: directory
+    mode: 0755
+
+- name: deploy static xray-core config
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/opt/xray-core/config/{{ item }}"
+    mode: 0744
+  loop:
+    - dns.jsonc
+    - inbounds.jsonc
+    - log.jsonc
+    - policy.jsonc
+  register: xray_core_static_config
+
+- name: deploy dynamic xray-core config
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/opt/xray-core/config/{{ item }}"
+    mode: 0744
+  loop:
+    - observatory.jsonc
+    - outbounds.jsonc
+    - routing.jsonc
+  register: xray_core_dynamic_config
+
+- name: restart xray-core systemd service unit
+  ansible.builtin.systemd_service:
+    name: xray-core
+    daemon_reload: true
+    state: restarted
+    enabled: true
+  when: xray_core_static_config.changed or xray_core_dynamic_config.changed

roles/xray-client/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- name: include xray-core configurure
+  ansible.builtin.include_tasks: configure.yml

roles/xray-core/files/xray-core.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Xray-core Service
+Documentation=https://github.com/xtls/xray-core
+After=network.target network-online.target nftables.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/xray-core
+ExecStart=/opt/xray-core/xray -confdir /opt/xray-core/config
+Restart=on-failure
+RestartSec=3s
+LimitNOFILE=65535
+
+[Install]
+WantedBy=multi-user.target

roles/xray-core/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart xray-core
-  ansible.builtin.service:
-    name: xray-core
-    state: restarted
-  listen: restart xray-core

roles/xray-core/tasks/configure.yml

@@ -1,33 +0,0 @@
----
-- name: ensure /etc/xray-core exists
-  ansible.builtin.file:
-    path: /etc/xray-core/config
-    state: directory
-    mode: "0755"
-
-- name: ensure /var/log/xray-core exists
-  ansible.builtin.file:
-    path: /var/log/xray-core
-    state: directory
-    mode: "0755"
-
-- name: deploy static xray-core config
-  ansible.builtin.copy:
-    src: "{{ item }}"
-    dest: "/etc/xray-core/config/{{ item }}"
-    mode: "0744"
-  loop:
-    - dns.jsonc
-    - inbounds.jsonc
-    - log.jsonc
-    - policy.jsonc
-
-- name: deploy dynamic xray-core config
-  ansible.builtin.template:
-    src: "{{ item }}.j2"
-    dest: "/etc/xray-core/config/{{ item }}"
-    mode: "0744"
-  loop:
-    - observatory.jsonc
-    - outbounds.jsonc
-    - routing.jsonc

roles/xray-core/tasks/install.yml

@@ -1,5 +1,42 @@
 ---
-- name: install unbound
+- name: install unzip
   ansible.builtin.package:
-    name: unbound
+    name: unzip
     state: present
+
+- name: get latest xray-core release info
+  ansible.builtin.uri:
+    url: https://api.github.com/repos/XTLS/Xray-core/releases/latest
+    return_content: yes
+  register: xray_release
+  run_once: true
+
+- name: set current xray-core version
+  ansible.builtin.set_fact:
+    xray_version: "{{ xray_release.json.tag_name }}"
+    xray_asset_url: "{{ xray_release.json.assets | selectattr('name', 'equalto', 'Xray-linux-64.zip') | map(attribute='browser_download_url') | first }}"
+
+- name: check xray-core installed version
+  ansible.builtin.command: /opt/xray-core/xray version
+  register: xray_current_version
+  changed_when: false
+  failed_when: false
+
+- name: ensure xray-core directory exists
+  ansible.builtin.file:
+    path: /opt/xray-core
+    state: directory
+    mode: '0755'
+
+- name: update xray-core
+  ansible.builtin.unarchive:
+    src: "{{ xray_asset_url }}"
+    dest: /opt/xray-core
+    remote_src: yes
+  when: xray_version not in (xray_current_version.stdout | default(''))
+
+- name: deploy xray-core systemd service unit
+  ansible.builtin.copy:
+    src: xray-core.service
+    dest: /etc/systemd/system/xray-core.service
+    mode: 755

roles/xray-core/tasks/main.yml

@@ -1,6 +1,3 @@
 ---
-#- name: include unbound install
+- name: include xray-core install
-#  ansible.builtin.include_tasks: install.yml
+  ansible.builtin.include_tasks: install.yml
-
-- name: include xray-core configurure
-  ansible.builtin.include_tasks: configure.yml

roles/xray-lists/files/update.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -e
+out=$(/opt/xray-lists/venv/bin/xray-lists)
+
+echo "$out"
+
+dns_changed=0
+elements_changed=0
+
+if echo "$out" | grep -A 10 "changed:" | grep -q "nftsets.conf"; then dns_changed=1; fi
+if echo "$out" | grep -A 10 "changed:" | grep -q "\.elements\.nft"; then elements_changed=1; fi
+
+if [ "$dns_changed" -eq 1 ] && [ "$elements_changed" -eq 1 ]; then exit 12;
+elif [ "$dns_changed" -eq 1 ]; then exit 10;
+elif [ "$elements_changed" -eq 1 ]; then exit 11;
+fi
+
+exit 0

roles/xray-lists/files/xray-lists.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Update Xray lists
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c '\
+/var/lib/xray-lists/update.sh; \
+rc=$$?; \
+case "$$rc" in \
+    10) systemctl restart dnsmasq ;; \
+    11) nft -f /etc/nftables.conf ;; \
+    12) nft -f /etc/nftables.conf && systemctl restart dnsmasq ;; \
+esac'

roles/xray-lists/files/xray-lists.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run xray-lists update
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=12h
+Persistent=true
+
+[Install]
+WantedBy=timers.target