---
- name: collect xray policy hosts
  ansible.builtin.set_fact:
    _xray_hosts_with_policy: >-
      {{
        (_xray_hosts_with_policy | default([]))
        + [{'inventory_hostname': item, 'xray_policy': hostvars[item].xray_policy}]
      }}
  loop: "{{ groups[xray_managed_group] }}"
  when: hostvars[item].xray_policy is defined

- name: validate xray policy sets
  ansible.builtin.assert:
    that: >-
      (item.1.bypass | default(item.1.proxy)) == 'all'
      or (item.1.bypass | default(item.1.proxy)) in xray_ip_sets
      or (item.1.bypass | default(item.1.proxy)) in xray_domain_sets
      or (item.1.bypass | default(item.1.proxy)) in (xray_static_sets | default([]))
    fail_msg: >-
      host {{ item.0.inventory_hostname }}: unknown xray set
      '{{ item.1.bypass | default(item.1.proxy) }}' in xray_policy
  loop: "{{ query('ansible.builtin.subelements', _xray_hosts_with_policy | default([]), 'xray_policy', {'skip_missing': True}) }}"
  loop_control:
    label: "{{ item.0.inventory_hostname }} -> {{ item.1 }}"

- name: render xray-lists config
  ansible.builtin.template:
    src: xray-config.yaml.j2
    dest: /etc/xray-lists/config.yaml
    mode: "0640"
  notify: restart xray-lists timer

- name: bootstrap empty config files
  ansible.builtin.copy:
    dest: "/etc/nftables.d/{{ item }}"
    content: ""
    force: false
    mode: "0644"
  loop:
    - 90-sets.nft
    - 90-proxy.nft

- name: render nft sets
  ansible.builtin.template:
    src: 90-sets.nft.j2
    dest: /etc/nftables.d/90-sets.nft
    mode: "0644"
  notify: reload nftables

- name: render proxy prerouting
  ansible.builtin.template:
    src: 90-proxy.nft.j2
    dest: /etc/nftables.d/90-proxy.nft
    mode: "0644"
  notify: reload nftables