## MODIFIED Requirements

### Requirement: shadowsocks-rust configuration is templated
The relay server's shadowsocks configuration SHALL be generated from a Jinja2 template with variables for port, password, and cipher method. The relay server SHALL have a configurable domain name (`relay_domain`) for use in client configuration generation.

#### Scenario: Configuration is generated from template
- **WHEN** the shadowsocks role runs
- **THEN** a JSON config file is rendered from template with port, password, and encryption method
- **THEN** the config file permissions are restricted (readable only by the service user)

#### Scenario: Configuration change triggers restart
- **WHEN** a variable in `group_vars/relay.yml` is changed and the playbook is re-run
- **THEN** the configuration file is updated
- **THEN** the ssserver service is restarted