From b4d6852a803a65b1bd457eb016c03ae684f3c78f Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 12 Nov 2026 20:56:42 +0400
Subject: [PATCH] ansible: run Xray on asxpio-services

The VLESS Reality proxy ran from a hand-installed binary on the
temporary server. Run the upstream image instead, pinned and on the
host network, with only CAP_NET_BIND_SERVICE; its config (keys and
client id) is in the vault.

Assisted-by: Claude:opus-5-5
---
 .../group_vars/services_servers/xray.yaml        |  5 +++++
 ansible/roles/xray/tasks/main.yaml               | 11 +++++++++++
 ansible/roles/xray/templates/config.json.j2      |  1 +
 .../roles/xray/templates/docker-compose.yml.j2   | 16 ++++++++++++++++
 4 files changed, 33 insertions(+)
 create mode 100644 ansible/inventory/group_vars/services_servers/xray.yaml
 create mode 100644 ansible/roles/xray/tasks/main.yaml
 create mode 100644 ansible/roles/xray/templates/config.json.j2
 create mode 100644 ansible/roles/xray/templates/docker-compose.yml.j2

diff --git a/ansible/inventory/group_vars/services_servers/xray.yaml b/ansible/inventory/group_vars/services_servers/xray.yaml
new file mode 100644
index 0000000..2fbe0c6
--- /dev/null
+++ b/ansible/inventory/group_vars/services_servers/xray.yaml
@@ -0,0 +1,5 @@
+---
+# Xray VLESS Reality proxy on :443 (host network)
+# renovate: datasource=docker depName=ghcr.io/xtls/xray-core
+xray_version: "26.9.9"
+xray_config: "{{ vault_xray_config }}"
diff --git a/ansible/roles/xray/tasks/main.yaml b/ansible/roles/xray/tasks/main.yaml
new file mode 100644
index 0000000..5d3a80b
--- /dev/null
+++ b/ansible/roles/xray/tasks/main.yaml
@@ -0,0 +1,11 @@
+---
+- name: Deploy Xray
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: xray
+    service_base_path: "{{ services_base_path }}/xray"
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: config.json.j2, dest: config.json, mode: "0600" }
+    health_check_port: 443
diff --git a/ansible/roles/xray/templates/config.json.j2 b/ansible/roles/xray/templates/config.json.j2
new file mode 100644
index 0000000..815d3a0
--- /dev/null
+++ b/ansible/roles/xray/templates/config.json.j2
@@ -0,0 +1 @@
+{{ xray_config | to_nice_json }}
diff --git a/ansible/roles/xray/templates/docker-compose.yml.j2 b/ansible/roles/xray/templates/docker-compose.yml.j2
new file mode 100644
index 0000000..015fa6c
--- /dev/null
+++ b/ansible/roles/xray/templates/docker-compose.yml.j2
@@ -0,0 +1,16 @@
+# Managed by Ansible (role xray). Root in the container only to read the
+# 0600 config and bind :443; every other capability is dropped.
+services:
+  xray:
+    image: ghcr.io/xtls/xray-core:{{ xray_version }}
+    container_name: xray
+    command: ["run", "-c", "/etc/xray/config.json"]
+    network_mode: host
+    user: "0"
+    cap_drop: [ALL]
+    cap_add: [NET_BIND_SERVICE]
+    security_opt: ["no-new-privileges:true"]
+    read_only: true
+    volumes:
+      - ./config.json:/etc/xray/config.json:ro
+    restart: unless-stopped