ansible: run Xray on asxpio-services

The VLESS Reality proxy ran from a hand-installed binary on the
temporary server. Run the upstream image instead, pinned and on the
host network, with only CAP_NET_BIND_SERVICE; its config (keys and
client id) is in the vault.

Assisted-by: Claude:opus-5-5

ansible/roles/xray/tasks/main.yaml

@@ -0,0 +1,11 @@
+---
+- name: Deploy Xray
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: xray
+    service_base_path: "{{ services_base_path }}/xray"
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: config.json.j2, dest: config.json, mode: "0600" }
+    health_check_port: 443

ansible/roles/xray/templates/config.json.j2

@@ -0,0 +1 @@
+{{ xray_config | to_nice_json }}

ansible/roles/xray/templates/docker-compose.yml.j2

@@ -0,0 +1,16 @@
+# Managed by Ansible (role xray). Root in the container only to read the
+# 0600 config and bind :443; every other capability is dropped.
+services:
+  xray:
+    image: ghcr.io/xtls/xray-core:{{ xray_version }}
+    container_name: xray
+    command: ["run", "-c", "/etc/xray/config.json"]
+    network_mode: host
+    user: "0"
+    cap_drop: [ALL]
+    cap_add: [NET_BIND_SERVICE]
+    security_opt: ["no-new-privileges:true"]
+    read_only: true
+    volumes:
+      - ./config.json:/etc/xray/config.json:ro
+    restart: unless-stopped