From bc765668a6411be2f4ac97bd9802c737c55cb661 Mon Sep 17 00:00:00 2001 From: Sascha Date: Mon, 15 Jun 2026 21:26:39 +0200 Subject: [PATCH] sync: Inventory-Realabgleich + neue host_vars/roles/playbooks Nachgezogener Arbeitsstand des Homelabs: - neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm) - neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy) - diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia) Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden). Co-Authored-By: Claude Opus 4.8 --- README.md | 4 +- ansible.cfg | 1 + checkrr-deploy.yml | 87 +++++ dns-doh.yml | 6 + group_vars/all/vault.yml | 338 +++++++++--------- hawser.yml | 2 +- host_vars/emby-sascha/frp.yml | 4 + host_vars/gluster-n1/vars.yml | 2 + host_vars/gluster-n3/vars.yml | 2 + host_vars/gluster-n6/vars.yml | 2 + host_vars/k3s-control/vars.yml | 2 + host_vars/k3s-worker1/vars.yml | 2 + host_vars/k3s-worker2/vars.yml | 2 + host_vars/k3s-worker3/vars.yml | 2 + host_vars/kometa/vars.yml | 2 + host_vars/node1/wireguard.yml | 2 +- host_vars/node2/wireguard.yml | 2 +- host_vars/node3/wireguard.yml | 2 +- host_vars/node4/wireguard.yml | 2 +- host_vars/node5/wireguard.yml | 2 +- host_vars/node6/wireguard.yml | 2 +- host_vars/node7/wireguard.yml | 2 +- host_vars/paperless/vars.yml | 2 + host_vars/satisfactory/vars.yml | 2 + host_vars/thelounge/vars.yml | 2 + host_vars/wolfstack-vm/vars.yml | 2 + id_ed25519.pub | 2 +- iso-builder/build-iso.sh | 23 +- net-watchdog.yml | 5 + patchmon-agent.yml | 29 ++ remove-postfix.yml | 30 ++ roles/base/tasks/main.yml | 29 +- roles/borg/templates/borgmatic.yml.j2 | 23 +- roles/dns_resolver/handlers/main.yml | 6 +- roles/dns_resolver/tasks/main.yml | 26 +- roles/frp_client/tasks/main.yml | 4 +- roles/hawser/tasks/main.yml | 34 +- roles/net_watchdog/defaults/main.yml | 23 ++ roles/net_watchdog/tasks/main.yml | 18 + .../net_watchdog/templates/net-watchdog.sh.j2 | 55 +++ roles/nvidia/tasks/main.yml | 1 + roles/patchmon-agent/handlers/main.yml | 5 + roles/patchmon-agent/tasks/main.yml | 33 ++ roles/tc_ratelimit/defaults/main.yml | 5 + roles/tc_ratelimit/handlers/main.yml | 6 + roles/tc_ratelimit/tasks/main.yml | 33 ++ .../templates/tc-ratelimit.service.j2 | 13 + .../tc_ratelimit/templates/tc-ratelimit.sh.j2 | 26 ++ rotate-ssh-key.yml | 17 + sops-age.yml | 40 +++ tc-ratelimit.yml | 5 + update.yml | 31 +- 52 files changed, 780 insertions(+), 222 deletions(-) create mode 100644 checkrr-deploy.yml create mode 100644 dns-doh.yml create mode 100644 host_vars/gluster-n1/vars.yml create mode 100644 host_vars/gluster-n3/vars.yml create mode 100644 host_vars/gluster-n6/vars.yml create mode 100644 host_vars/k3s-control/vars.yml create mode 100644 host_vars/k3s-worker1/vars.yml create mode 100644 host_vars/k3s-worker2/vars.yml create mode 100644 host_vars/k3s-worker3/vars.yml create mode 100644 host_vars/kometa/vars.yml create mode 100644 host_vars/paperless/vars.yml create mode 100644 host_vars/satisfactory/vars.yml create mode 100644 host_vars/thelounge/vars.yml create mode 100644 host_vars/wolfstack-vm/vars.yml create mode 100644 net-watchdog.yml create mode 100644 patchmon-agent.yml create mode 100644 remove-postfix.yml create mode 100644 roles/net_watchdog/defaults/main.yml create mode 100644 roles/net_watchdog/tasks/main.yml create mode 100644 roles/net_watchdog/templates/net-watchdog.sh.j2 create mode 100644 roles/patchmon-agent/handlers/main.yml create mode 100644 roles/patchmon-agent/tasks/main.yml create mode 100644 roles/tc_ratelimit/defaults/main.yml create mode 100644 roles/tc_ratelimit/handlers/main.yml create mode 100644 roles/tc_ratelimit/tasks/main.yml create mode 100644 roles/tc_ratelimit/templates/tc-ratelimit.service.j2 create mode 100644 roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 create mode 100644 rotate-ssh-key.yml create mode 100644 sops-age.yml create mode 100644 tc-ratelimit.yml diff --git a/README.md b/README.md index 54c9987..1972a53 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,7 @@ ansible-playbook update.yml | sabnzbd | 10.2.1.119 | arr | SABnzbd | | dockhand | 10.4.1.116 | docker | Dockhand | | n8n | 10.4.1.113 | auto | n8n Automation | -| openclaw | 10.4.1.100 | auto | OpenClaw | +| hermes | 10.4.1.100 | auto | Hermes Agent | | monitoring | 10.1.1.111 | auto | Monitoring Stack | | automation | 10.1.1.115 | auto | Automation Stack | | matrix | 10.4.1.110 | communication | Matrix | @@ -257,7 +257,7 @@ Direkte Peers (kein Hysteria2): | media | emby-sascha, jellyfin, immich, emby-chris | Media VMs | | arr | tdarr, arrapps, sabnzbd | Arr-Stack | | docker | dockhand | Docker VMs | -| auto | n8n, openclaw, monitoring, automation | Automation | +| auto | n8n, hermes, monitoring, automation | Automation | | communication | matrix | Kommunikation | | hetzner | pfannkuchen | Hetzner Server | | frp | emby-sascha, emby-chris, jellyfin | FRP Clients | diff --git a/ansible.cfg b/ansible.cfg index 30fa1cc..67f0e8b 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -1,4 +1,5 @@ [defaults] +private_key_file = /app-config/ansible/id_ed25519 host_key_checking = false vault_password_file = .vault-password inventory=pfannkuchen.ini diff --git a/checkrr-deploy.yml b/checkrr-deploy.yml new file mode 100644 index 0000000..9780a3c --- /dev/null +++ b/checkrr-deploy.yml @@ -0,0 +1,87 @@ +--- +# Deploy Checkrr config to arrapps stack +- name: Deploy Checkrr configuration + hosts: arrapps + become: true + gather_facts: false + + tasks: + - name: Ensure /app-config/arr directory exists + ansible.builtin.file: + path: /app-config/arr + state: directory + mode: '0755' + + - name: Create checkrr subdirectory with correct permissions + ansible.builtin.file: + path: /app-config/arr/checkrr + state: directory + mode: '0755' + owner: '1000' + group: '1000' + + - name: Remove old checkrr.yaml (wrong path) + ansible.builtin.file: + path: /app-config/arr/checkrr.yaml + state: absent + + - name: Remove old checkrr.db directory (wrong path) + ansible.builtin.file: + path: /app-config/arr/checkrr.db + state: absent + + - name: Deploy checkrr.yaml config + ansible.builtin.copy: + dest: /app-config/arr/checkrr/checkrr.yaml + mode: '0644' + owner: '1000' + group: '1000' + content: | + --- + # Checkrr Configuration for arrapps + lang: "en-us" + checkrr: + checkpath: + - /data/UHD + - /data/FHD + database: /checkrr.db + runOnce: false + port: 8585 + host: 0.0.0.0 + cron: "@daily" + ignorehidden: true + + arr: + - service: radarr + name: radarrUHD + url: http://radarrUHD:7878 + apiKey: "" + process: true + - service: radarr + name: radarrFHD + url: http://radarrFHD:7878 + apiKey: "" + process: true + - service: sonarr + name: sonarrUHD + url: http://sonarrUHD:8989 + apiKey: "" + process: true + - service: sonarr + name: sonarrFHD + url: http://sonarrFHD:8989 + apiKey: "" + process: true + + logs: + stdout: + out: stdout + formatter: default + + - name: Create empty checkrr.db file + ansible.builtin.file: + path: /app-config/arr/checkrr/checkrr.db + state: touch + mode: '0644' + owner: '1000' + group: '1000' diff --git a/dns-doh.yml b/dns-doh.yml new file mode 100644 index 0000000..f343df2 --- /dev/null +++ b/dns-doh.yml @@ -0,0 +1,6 @@ +--- +- name: DNS over HTTPS auf allen Hosts + hosts: all + become: true + roles: + - dns_resolver diff --git a/group_vars/all/vault.yml b/group_vars/all/vault.yml index c1e69ad..4531c15 100644 --- a/group_vars/all/vault.yml +++ b/group_vars/all/vault.yml @@ -1,162 +1,178 @@ $ANSIBLE_VAULT;1.1;AES256 -33363735653463326135306635613338363139363261663666346366616362363165626366303433 -3065653039376539346434383066366235663239643634660a626662633936626438653063643235 -63343962626666643739373037626532353764323836383634373066313937366330356130646664 -3130646436343839620a323662653634393531663139613530663635363065343630666238353037 -30643663346539336636366331376439653433383131353764373930326663663062663534376562 -35656332356230633935303030313761316263663132623839386265326566663131333235333864 -33323236663965366561366564373339646162636664366130336663383566376461356562336232 -64626461363237363634633862363162643630353566333033313864326464326134623265633433 -34343963306133353632323833323634653633366362613236633564366265323261323332613665 -62663137316564353531643964336435333137373137663839653233663066303037343737326337 -65313639363831643032646230666430303938313739316266313562613965326463643438326266 -39353139303436653662653666663864643164326138303138386637636362373662343235636635 -62393561376434363563643538353766646230393466653830646234333830383233316161356432 -34323435316235396437313466363434373036613966343539303538363330356161376333343833 -32303265353566343436313932623462333132373732343433643835386232386463663638303564 -30353564353439353863393238386234633332396539323239393966386465313039646231323631 -37353131396136356530353132396561623635623932333465346364343332306639326538366134 -63366661326537393461353233616466383930343338326666646364623163663236663966643462 -38633965636335626339613565313832343363343338353564663933636330353738656562373230 -33346261323166346430356131356134346565383766333363303539623731376335346337666637 -32393365636436353062653534613432373566636239316264613930366264323037353033663330 -39616265633332366331303264656333663637316139336436303430343061646435353162313666 -39643433633133653436393931343361613264346433306164646566383934623861363330633037 -37353436666336386432386636353166623232636361306436326461663562666366363738353062 -30633233396139303933363231646266383263393562383066373838336339616464663933346166 -63376634323964623939643331626534376332633761323334643162643137623138376435363665 -65346430656331316131656534356235356536663435636235643130396135383134313138346461 -64376338303332633661323337313564303238353236393438656366663736313839383263313466 -62353032636534663134633430646634353835666639653539623533326434663534653962336539 -34393739386538663234666233353434393436626266366365316433373230666236386131313361 -33633538616239383035336532343835333366313538306161626364343838326335336535616363 -65323033363664633031643230653434626335643462303436326635323764663165366332636438 -61383735663639633333343131336263663539373064303035323131303931313738373135303663 -64323130356431316464343536613461363665366165386666663130323733623831313164383035 -39336137613730303366386131393436316232343665623433306632373363633636373564393033 -38633238306262666233373565396434636433346633633231663361313836343633613533613831 -30666639666234656434666332313962333465356632626531326264663631373935386534323466 -38323931653734626533663834646534313364386561623561303839383235643835666232383563 -30383764373932666162623634333536646437386162666161633238343162396563316132373530 -64356661613632333839316136636232666337633964613238356134356236656630616232323966 -63643363326364336432306364326435323437336535626165396632336537626435663265363633 -35306134613437306432396664633137616534633739396531636539363864326134656266613535 -38366232646137383762636265343531333162356165663137326162663066316331313139393364 -33326661616135313432653732653633313736383238666439626265346632663539396464653038 -32626431373966626437666261623535323333376330363861393633316335313465363065386565 -35313130633335343033663733393361343163376339353136646337636665633161363833326664 -35303762393530613033343163393732633235306162636337616264366164366662336665396264 -65366362373134396539663964343635643462306561366138313735623832636437343364303336 -64666261386431616537373063386431643461636535626637326131363933313163373961336639 -64633231633361613662396462323635333131363031616163393262346236303734656439353164 -39376461353035326562653362316231623633666336656362653234393337663031353638363233 -39323433373839663930623336623065613562633433313464656333323431306461636366303637 -32383236626536333562363861323166313837336338653834376362643734666663656262633236 -35663439373337336265626136656465613230626135313334363264623366323938383434656431 -37636334376164643438353633633136616563636362643135666161343938366362336362626162 -36303262356231303031616363656335663935353064316463613936366166623838316561623165 -61303936363065373331613362353130656362313736336539636462653864376432356238653836 -33393436623361616431623461656430363932636531363730666565613235393639626535366565 -37393564353333656332303733643861653563353166623561386661356366393833643033666330 -64613838306530383232653866356538333966643365393936316662616564353738623332316364 -36633730636537373764643130363335643038366265623965613530623534316461653865363135 -38663236376536356561323139666566363733356639653035393263363634396333306336623566 -66313433366461303432373565656431336666346363633836316131343061613230653034343366 -62633534353834396536643437363239393032663731613933646536623534396234343130666335 -38356435613636306234333433306632343461643531383931313438616461306136363665386139 -36363736376462336463643364626130636364643834386164636630366436366439373739386666 -34353866633764663039326639656436353663376463303363363835336630653332376339376439 -37346337623261333030633532616366343436653337386136303431633264666136613432383337 -39353039373934393836636361643839626132383636663766666265316534656562633232303430 -34353266343530333261386139636166656165366666323735373065353339363039636262373434 -39376437333339626237636335383762613761653062636366393465376561653639623332393736 -33313236326564616437633034333833333461643336353339626639646631306632376133306263 -37326462643863373436656662306266633633643133663064616639303062373939346366393164 -31303732656436383439623462633566633763356663643937343431626234656638396461363062 -62633039663237613237663965393861343537646634623633396531383430376133633338383035 -61353736313138656366343139316133363265386466356430656133346439636462303431393132 -34636436366435363531653463353634376232363331656530393665376363343339623337373737 -61316132616566643665303934396364656265316462303834393165653238656232613963336635 -36633363373966616163643563393532303466643763666532396138383837643664303662396162 -37323932623935373761653066343465393262373130626536613030383630323534333434656638 -37346163376130363739636663666438373837303961313163613935666136303063616665363931 -36306138383634333433333061393930383861346330613438663838643966613134613839336232 -64313834316663396236393531653139336238376433623466653538343766656462613635313639 -66336666663432663264323732333035373636633139336566656231663932393436393232373530 -63373564353765323930356633306262333639313162333730636562373333613538656462653164 -38626336323937333632626135333836316238313433653462356666636565666438623139626635 -35383835613135376663643837376466363739356635343432643830396239373963353564356631 -62333837626164643465333062626437653231653665313631303163643239393563363763653839 -33356261616530363337313763373833623661396336303937663339616131646139333162356235 -39653830303061626262666533643937646137653764363432666263653839363132336366643236 -66363434343561343730343432636437396439343231613736353135366436666437646238393439 -62643561363133316333386334393434313162613438373561373032393661656431313031356232 -33353933393638366139323330306536333038623631393439623432383831653163626631336362 -65313832633863643135633962626265363331623163666666373233393937646562383863343436 -63663535346233363762316461303730623965353130616134643031396438646634663632313162 -31336566386435666661373533393534613735633437656336303862343234316437613262353235 -64336438353564373230663964346637363532313262666334353039633662653663633038623163 -39633533383635366466633137396565373138303736353936613465393238633864383761316639 -35366466366465316136313233336134363463323966636134353135306435323533303865353062 -32383739396533353236376363306364343932303566353835646130646361376335336438643339 -63376337626532663163323762623232666166653935633035313964356438663136353335386665 -30613164613337326164373132616562393038613134373863643633303465336466653331633964 -33616666623935643264313533373662373838653739386536316135323737653934386438356435 -39646632353330303065343733626461386430363734383031386631306435383038373561373935 -38373466303738326337376130343631333833313932353337363332643235636262393564383363 -63356335613638663536303539643234633338346665386539656636653964303536396438313861 -35316562383230646365656466616635313061326566373937353438316435613430313266393830 -31306636393239363837346430666163653231333831336433373462376538656534336639313965 -35383465326161336237333466376461323263353933646664336163353636396165383261316638 -61303730656562393661626134356365323936323334373634383831393130383162313833653162 -37616136666263353164333738363135313832376337336234353362656465663031663865633662 -62663563313835633965376665333933636639326137376436343865356239356232316262393066 -31623239616532343338333037323835383732643933396334623432643336646130336436326565 -65303638653434366437316530633361383066356338363736343266636165306365336338323137 -36383364393762643938643263303532386263323766376136666531633635356665613133313766 -33366563663161653531373865636232386330303638626332623637616133376433386364323063 -64353632303365616266343933366161613533333865373835303136363133653464656536623435 -34393136363661383432366161326564636634376664336632326439303862383832363861306135 -32343636383366616133343637616432383965323434626165626337643036613037326234356463 -63653734396261373164663165323436363336363034646130316330363764396536646433356562 -34373936393636393730336433633037623065636339653432343564376233373535633231343961 -64613662323336386361376264646333303362656265663366306664326337326663663432333136 -65636263636166356335343034346631386337323461336164623839653738666337383565653161 -63326366393034353866343037393333363838616363666132353239393866613232396462343166 -30326162343632616135346534366561353039323361333764633833646466323439373530366539 -38323138653437623436313931663930353134613130613962643263313131353433316533613032 -30323333363162326239326531663266326666613835363836383965316136356231313332383361 -36663135653963326530623532666564623737326435616466656431323539313064393034616130 -62376463306234636362616663323362393464353930383439666134383731323637643739613937 -38643130396466623533383839623161343431323563373866386465303035366330646336326633 -34303664613736323963663838346633613831653265316430353233363464356663323661336234 -36316536633130643662623939333836333837643466616236316439623465323761633031623565 -31346437323239613663356234353930343737343233393532666638346637336137323034613036 -33363535303562366562646463653339326336326666303233316238323833313865666334356663 -32376233393166373563363766313237616137386566353863393734323166343761353338343538 -65633630303038303635653336376661303166623232346564313035623239656433626434323733 -35346662633734393161303836633236376634303437366339613139656534303433353666643135 -65643334383538306666616665386536303463323933623364633262396432346437336363346335 -34666331623732643666313835306134653961373865373435623361363236393833383062303136 -63353238663864613634326330363131376334353132326434393538316562666238386238353533 -63666533303534616661623165643965613630646231323230306264306165643236613666366333 -35653562376537636234373834613065313836636230306438633265303037306535326164633564 -33346666366637383232613265643261623864333034643735653961613437313761383934633261 -33313163326263646434323365316164363466316364393130333734616562353063356562373138 -39326630626133396338366539373666303334323634343962623531393664653866323436653139 -31326464343566383562336130616462346135343931343663373836643434346331616465353038 -34333161373461353765336339323830356265663865626634616466313965623663663664653733 -30323230336562303535366138356337373038363864383631313333386165383138643866636463 -61316230396531616333373037646165653431363464393236313463343936313533363665616366 -66353539393135306135363664346630356462313932353166313635336638363137366438353964 -31323632326638363431356234653262656539326262313563316631343636643339326130373330 -32326163616332623862343734326432333865626432653736346565613832616438386331323439 -62626332366261646539646631336466396135363033373735303663366162656636663664653963 -31363036336637626563336138336161333032336535653462316639383761386436386138373637 -35666534336237366139393039333235326662653337626435396131363837383933653632333634 -32663037623534373737656265633530663933356563343262356234343363343437313135306132 -39353134373733323430313736653239653531373333343632373133363534616561343731353832 -37353235653134346138313830336566633732346135356339333637643166643866353832306630 -33356432326466343166373132376339313338623761326338646163383664313237346135613261 -39393636646530343636376638666234363562356365626366666536376566643339346135623736 -66633265303733656633623232303330333161616563393034333633613237646663 +32353937363365383536323336626630663462666532343437356361353262363063613465626465 +6330656638323232323131373930303030613538663062320a383135333935323165613735323365 +32333832393637363539363936323631383362626165346664663330656434316239636261336136 +3164656163343039350a336364336463663936613238353734396635663238303161333464613133 +64666333323339666231663736626334336434373662623364356230396236353335396665303135 +34393032383132316430306231623736636234643732343338663439366135356464643165326130 +30333737383230653031613132336362613536653531343666356533313463643930343262613864 +32613032623430323039653962313031393033616534396263623334363635656330643232333864 +38376336336564363030663965663366663436616133306263353236363264636236356363323138 +37666238646461303931653931323165386164376431316234316134653765363266626262633865 +64663932316433373238383031653937306264383666383630626362386362623234623135646562 +66346536313165643336373663326466373337323836366437626464613361376333356664343038 +37303632336336633264373835373735356330316535373533313265393462303332323965363338 +36643736383132306138333432323463633164666634343633363361363337306538396636396337 +36356137363635633231353764363332383139383262393161326463353765343334353361613963 +34343265323837363164336632326335636563343739346263636334383666623466316430663639 +63663162343234306666336236376163366130666131386264323730633665353238383166396263 +36333533653537353537646661386162363034323139626431623033626134393963356137663163 +32643762343363306631643232343532373331363464353937636636383934666566633933393234 +62336533666163636137646661363035386364386133653166376630343264646430653236336665 +33643966326234343766373837363736646639376330336435663832653162643231613837643435 +35376636353530623632346239663366343362613738633431306435386462666266653138633163 +35656335643734383164346232626338376561303232356162666432303830306262336637663761 +37393636656632366264386237373336376239303135316534323736313437393934303561643561 +34343362643132653730313534363466616663366530373461666336333132366664313137313239 +39336334643939663131323932323537613030336639663261383032393235623839656464383336 +62313931323032623530346539343536663133386633666330343437626166393539323339393932 +62306337353433653930373662643830303335613965396433373164643437366535316165376266 +36363264343034366139623830376530633938663038613166363462303263303465346232613663 +65323637643162653762373261653437396130303436643766303261316362643761396536373861 +36303761623233303161613239613863383231343865613632366339626637343465343335653738 +36643537343131343563316334636631316665363039353639623465643661613132653739346139 +35666332383335333363666131323332303964646134333234656632396462373062623631356463 +30663334643134363136343039613735353964613564616435373063343235313733373765396666 +32666130633035633936363937346266363737363762396232633033343130383131646365633732 +36366334626233653338363963323034656435316632363264396439363633663934646363373566 +38303662643730353462653664646265373030333837623031343432313866356363356465373330 +33313839633939666639666165393633333366633335346536346332333134646462613433306164 +39353361323463306338623461383939383835343261363538346166306436343132666265313364 +36623631636261623237333336633534613430383139313465363436356631666365346662333533 +32336363636466343639393237333530333763643966323866396366333363633636366330633536 +63333238326230366565366430653932646532343736303735643363643631303439313936383532 +30666338333334646334613939336632643236616137346661343366366263373733303131353065 +31383732373432393363333162666333326131633131356431383135373634313139363032643763 +64343537393966316664653932616161353465316232316330343836656232396637323564643932 +37373434356366373235303430396332306430376465373365643433333431356263306234386465 +30363037646139323566363539376463323061303131633862636535303932356131353962643935 +34653232366363333833616462623537356666356330383538386363333631623463373764313432 +63643132373136636437653865653435643834613263336338326236306536306261353264616166 +31316332383733373734326336643563663133363433326137663730323364333564336131306532 +61313965633436333836626431333834383636363336623130326636383761313139636436333334 +34613739326163666337636634303561323764343661373961393737303139663163656138633431 +61363163336530646561636366383665663861633231653837646564626333383031623135633065 +37653061613437313262363639383331643034643135356634643033336164626131346634346635 +63316364363237393165313834656130643733333636343862333664663863326161323535343335 +66623539346433373065323236333461323937333966356165643131363331313030306135336565 +62313762323332303937323630343733393535396434636138626131626564623966396464386564 +64663034663438306636316139376166363266373034383338633265623861633733353663363165 +31393132626436636231316266386631323738656161646437333331313338353263363935643765 +34396166323035363236366237313161633033306232643632366531653962636236343930343730 +33363439343632656234653631643339386565656466396231623265343962656336303139336163 +38616461356661636139393863613564626461363265316435306634656436386133626463326430 +35303130623735646662663535666265353531643364643965653630626334333232336132633031 +34613231323739333637356633623165396539623237623763656432393864333163386363383435 +39333063363066383231656562336238376164396465623232316334643961363663623131313934 +62363738376265303238336465353630643837396231343264653336613366353839383037646535 +30373232346236353830636366353764613862383666656366613531343331353461663963323666 +33396132373838363035613564346463303237326532336131336434373737366566346330656466 +63663339313630393866326534303932336530386538363533646166376436323835333666653835 +65373266333039343963336630336332323137313263663331356139323465366461393362303338 +35303066396639346435663632333138373938656330613930303034616661633737353164383430 +35633065663166643939316565343639386634356233633133366538306635303936376163393235 +36353035653531653038633965663837613036316136396131646537316561653264336636386434 +35656561626236633034633037653838363439633163353062393736616330393938653038306631 +32666664363233623965343132656561336364623334616633623135356136366638393031663135 +65356339663266613032343536646135356433633339393538393439323136313766323665306431 +62383862383735623232346630333439663836343261646534373437643437653065323632303930 +31386661373632326663653064373635373134363035356637346133313636613466336431336564 +33636666333031653165373139373438386165363732643130336164303161326663393464356233 +37316533373866383632633439303466346462626232346337653065306330663963343864343336 +39613032666462363432643634396232643863336262643830386365636638393263336436666130 +61343630643362373865393530376433636236396537653363353566376331383131396666623332 +38623765366231386338333265373730633734386232633964323765396439383166633938656566 +63333532306233356130323264326232333462333366343962383166613535343464376135373432 +30306261376436383032323862666538303530626266386233343339383263313761613932346531 +30663666363630326534323865323330316538656332393635366661636139663334373438386137 +32316239393630636431306562636131643663333866316565366532373165343234653065643963 +34626338373265653336306163633432666132326139646363353734393461303232386637366261 +63353034373733366234653462623935396164343166343466393565376639366236323334376631 +65373466616165653735373030616535303765643638333135393537303834656561373437636534 +61336139666164383465343935666437313161383738303335323033316637663165653465353062 +62636339373332626264396261656633346638396237633830616261383235396636303366623239 +63383639633831613062613936666434643265313435613561356137343762393435613563643465 +64363065343331353633653339356539373731613963303963383936346231633666653433343835 +62346461316539626232656635633738633861323238356338653463303632353136303232653735 +61623461656330343061363061643335373939356531373861316562326364313135376633613633 +37376130613435356636346137643336393531393936613139663230343134393737363564356232 +64316464626436353764316262623663343631626638353730386432666161616162633135363463 +36343631383935393433636461643663396231623233303634666261303638646430653435613237 +39363565363665343832663337323865373962356466616162303536653361613235333762343430 +30373036363234373838333365373535623865373437643664393036343966373330663135633434 +64366662643039666438333239653165623132386232386537353233666133373563323833316661 +38366261343363633664356266323264656139393336383562316333616333663963323565373363 +37303034613137306463633565353334373037643465303265373136393530306461643430343863 +63626131663963383864623036646666663561613733663230353266313734636433323935303134 +30383363373937326130633233316264643266386331623965313036613531323536653837333066 +39396638386464663034323139636465313432393535333834636637343838356366396463633034 +36356639643735636363653965356130653336386336313835316237396466313232663038306531 +36373935646432353930313863643033346235373236626266373839626639373463303961633465 +33343931353932336333343239663066346363616337343933393930383463396436656663353863 +31356533343836323736653635326565386537376262663265626630663061383736356262323234 +65646161623861333934323536616266366539333332616466663239333634646539656335383231 +31336436386538393130393162383361646132643839316338306466306561393534623964373964 +66333034336436383831633164356165653866663630353634313464323438373734663662656638 +35333838346336323439356636333932343536366334666530656235303436666633333739636664 +36323161373830366365323164306266643139336139376435613435353061613464366333356661 +38316133636437653036373437646661376563636264646166346137396230663234666562343936 +34373166336665666432373665613566643661383862366133653931623462626139633164343465 +31306666376432623861336130316463616161663034623138396562333932666338666238313362 +30653134666661333938306633366431633166643839623532323766623438376364366666643830 +64343661346635343566656562303661316163303766633734666330633535656164393330643064 +36386461633935343533316662393362306262636430306136313365633564343931633736363466 +64653939313730396430666266366437303933353337656334643761386631376635346562633364 +34326636353765663430613539316531616235323663653530616538346536613932343237316564 +38336630656634396531393763396266656533346136326532646532643662393563343638303938 +31653131313162353464313635613133333931383838323433666332323537316235666261626166 +62636635326531376335303162636631646132346133363539376661636263393239303133323638 +66313435623531643833333131616138646434363563376264396131316239303331646630623062 +30333034353339393033636462336138666265373333333866313535643930326437356430623037 +35343839626334323134653063623566663965333339313338323661666161373438616262663235 +66663965333937383262336636323163633666373538646166323533343162656463333764333766 +34643464356634363837373835663938306561336662633635623063613462323235303161653430 +38646330396463366365643830353832616334616331643535306365613664346339366164656231 +35313132323530343337343938366361656165643062633836363162323130643237386162643366 +65326635636531663934346434313365626436656632613737616362323737363066346365393336 +35663037646434356461633764376162343937323061396461663162346162366434333733303764 +61343538343135303438616433336230653862346330376638303463303430353836666137396361 +36313665613631656139396230353062313038346536633430316537393764383966336336616465 +63376432663431626265613664323838363834323363306630303361646134643435313262373536 +35313163653135633531636138386237343831353964333261396466396364323539393932353336 +37383564613662383738666137653335656232393833353765396637373932616238383138316134 +30623637633038343366353063346132373136393431363538373337616430353633663063346634 +30313138353462303138616633356233316137333865653932363439626335336630313461636439 +39313566326134346261343861633134643765623138363630306138636362336231633132666464 +61643562636161666262646565663063303332656435636333333430376163386664343333306537 +61393730353762353435393433633766396539653833393265376639353732353638343064356238 +30333436646632353437666433306431353139323161666133626439336433636361623536613865 +31373964386661313030613865303461313331626438623031646461333937373238636131396363 +37623735613264386137663537626531623335613735623136363965386238626130333836323933 +61643861623334353662346363643133336136383935363862626232303361626132353834633938 +33653039643932376564343636313462343032343266303461313964373836306337626466373831 +65333834646538666366636438356566333739623536633438626438343738646264323466333135 +38633065353163303532393265386165613838343962333866376664646165343661323764393639 +65326361313736336261306466306333393366356538623066383938323135336461366338313465 +34663837336163316162616166303935656465363633616334653731353436666633386535343262 +30393231343361653631633531306336383661346362646633663761326166376462343732616139 +37363631663963383731646439656331633237663862336531613234643337646230386561623232 +30623033643165353366336232633332303931373432653030326337616366636133313265333137 +36633662613939343330306538303461326332353930386632636531323162336534376136393065 +65616139356465656539366265646238353239313133333262376665376463653733616436643038 +33356364333765393033376637653031373835373534646165613361303463396165393534623662 +34333031353334303739643961663033346139393931653036613766376130383961656237353531 +65326239616663383537613835303266366637613738613862643263376132343830383636366630 +64633437626163393733313035653330633166396133393162303562663832653036666165336463 +32636330383837386139613630316430373037366236343932633661633939653138303135363264 +32616336656330383235616234653339323062646634646335356333663535373430616462383536 +64393337306438636361333937323835393036376235373261653438366634313364643236663065 +38393264613566303434313038666638333337643835643232373362316330383335333765356435 +37323831336239623130653632353330333934643161306534656465346463366236363566656537 +63616662363937633536343033366135343666356531616538623064333634643166386132383534 +65666465316236326361313737333835663266373634366435613231343835333366323737316634 +34373631396133393431396466613661663632626330663666633963313436363134303764373934 +64653633323132616439626330623965386536343639396631626464653662393138323338663732 +33623731366538346331663761363237323239323633666630623666663333356631386638303239 +36303664306666313361656634336339653035666236336239333566386137323532356336666161 +38323463663631326332316638303666356634373739343238386530376333656363343733336138 +3133 diff --git a/hawser.yml b/hawser.yml index 155f6d9..8bb93f1 100644 --- a/hawser.yml +++ b/hawser.yml @@ -1,6 +1,6 @@ --- - name: Hawser Setup - hosts: all + hosts: hawser become: yes roles: - hawser diff --git a/host_vars/emby-sascha/frp.yml b/host_vars/emby-sascha/frp.yml index cdf2bc3..dbf0cc0 100644 --- a/host_vars/emby-sascha/frp.yml +++ b/host_vars/emby-sascha/frp.yml @@ -4,3 +4,7 @@ frp_proxies: local_ip: "0.0.0.0" local_port: 8096 remote_port: 18096 + - name: jellyfin + local_ip: "0.0.0.0" + local_port: 9096 + remote_port: 38096 diff --git a/host_vars/gluster-n1/vars.yml b/host_vars/gluster-n1/vars.yml new file mode 100644 index 0000000..1f4b566 --- /dev/null +++ b/host_vars/gluster-n1/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.1.1.135 +ansible_user: sascha diff --git a/host_vars/gluster-n3/vars.yml b/host_vars/gluster-n3/vars.yml new file mode 100644 index 0000000..e3fa4f2 --- /dev/null +++ b/host_vars/gluster-n3/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.3.1.135 +ansible_user: sascha diff --git a/host_vars/gluster-n6/vars.yml b/host_vars/gluster-n6/vars.yml new file mode 100644 index 0000000..767855f --- /dev/null +++ b/host_vars/gluster-n6/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.6.1.135 +ansible_user: sascha diff --git a/host_vars/k3s-control/vars.yml b/host_vars/k3s-control/vars.yml new file mode 100644 index 0000000..23d6efd --- /dev/null +++ b/host_vars/k3s-control/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.3.1.110 +ansible_user: sascha diff --git a/host_vars/k3s-worker1/vars.yml b/host_vars/k3s-worker1/vars.yml new file mode 100644 index 0000000..d5fd92c --- /dev/null +++ b/host_vars/k3s-worker1/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.3.1.111 +ansible_user: sascha diff --git a/host_vars/k3s-worker2/vars.yml b/host_vars/k3s-worker2/vars.yml new file mode 100644 index 0000000..a3c637f --- /dev/null +++ b/host_vars/k3s-worker2/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.3.1.112 +ansible_user: sascha diff --git a/host_vars/k3s-worker3/vars.yml b/host_vars/k3s-worker3/vars.yml new file mode 100644 index 0000000..05857a3 --- /dev/null +++ b/host_vars/k3s-worker3/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.3.1.113 +ansible_user: sascha diff --git a/host_vars/kometa/vars.yml b/host_vars/kometa/vars.yml new file mode 100644 index 0000000..d29d13e --- /dev/null +++ b/host_vars/kometa/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.5.1.115 +ansible_user: sascha diff --git a/host_vars/node1/wireguard.yml b/host_vars/node1/wireguard.yml index 998d96b..fa04ff1 100644 --- a/host_vars/node1/wireguard.yml +++ b/host_vars/node1/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.11/24" wireguard_private_key: "{{ vault_node1_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/node2/wireguard.yml b/host_vars/node2/wireguard.yml index e5b945a..f48d6fc 100644 --- a/host_vars/node2/wireguard.yml +++ b/host_vars/node2/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.12/24" wireguard_private_key: "{{ vault_node2_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/node3/wireguard.yml b/host_vars/node3/wireguard.yml index cc2aa6d..e3db84a 100644 --- a/host_vars/node3/wireguard.yml +++ b/host_vars/node3/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.13/24" wireguard_private_key: "{{ vault_node3_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/node4/wireguard.yml b/host_vars/node4/wireguard.yml index dec9b57..264831b 100644 --- a/host_vars/node4/wireguard.yml +++ b/host_vars/node4/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.14/24" wireguard_private_key: "{{ vault_node4_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/node5/wireguard.yml b/host_vars/node5/wireguard.yml index 67ea94d..d512d55 100644 --- a/host_vars/node5/wireguard.yml +++ b/host_vars/node5/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.15/24" wireguard_private_key: "{{ vault_node5_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/node6/wireguard.yml b/host_vars/node6/wireguard.yml index 0a22910..267bdf7 100644 --- a/host_vars/node6/wireguard.yml +++ b/host_vars/node6/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.16/24" wireguard_private_key: "{{ vault_node6_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/node7/wireguard.yml b/host_vars/node7/wireguard.yml index 64373e5..8bb84fc 100644 --- a/host_vars/node7/wireguard.yml +++ b/host_vars/node7/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.17/24" wireguard_private_key: "{{ vault_node7_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24" +wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" diff --git a/host_vars/paperless/vars.yml b/host_vars/paperless/vars.yml new file mode 100644 index 0000000..84278d2 --- /dev/null +++ b/host_vars/paperless/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.5.1.120 +ansible_user: sascha diff --git a/host_vars/satisfactory/vars.yml b/host_vars/satisfactory/vars.yml new file mode 100644 index 0000000..dedd035 --- /dev/null +++ b/host_vars/satisfactory/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.3.1.120 +ansible_user: sascha diff --git a/host_vars/thelounge/vars.yml b/host_vars/thelounge/vars.yml new file mode 100644 index 0000000..647507b --- /dev/null +++ b/host_vars/thelounge/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.5.1.117 +ansible_user: sascha diff --git a/host_vars/wolfstack-vm/vars.yml b/host_vars/wolfstack-vm/vars.yml new file mode 100644 index 0000000..e80eec1 --- /dev/null +++ b/host_vars/wolfstack-vm/vars.yml @@ -0,0 +1,2 @@ +ansible_host: 10.1.1.110 +ansible_user: sascha diff --git a/id_ed25519.pub b/id_ed25519.pub index 3d2b81b..3653f9e 100644 --- a/id_ed25519.pub +++ b/id_ed25519.pub @@ -1 +1 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPl/Zptf1zTIgIv01zekT3SqdJfDR10vfTljP1QvHwez sascha@proxy +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026 diff --git a/iso-builder/build-iso.sh b/iso-builder/build-iso.sh index 2c6cc14..b033f95 100755 --- a/iso-builder/build-iso.sh +++ b/iso-builder/build-iso.sh @@ -1,5 +1,5 @@ #!/bin/bash -set -e +#set -e # ============================================================ # Debian Unattended ISO Builder @@ -20,7 +20,7 @@ DNS="1.1.1.1" HOSTNAME="debian" USER="sascha" PASSWORD="" -SSH_KEY_FILE="$HOME/.ssh/id_ed25519.pub" +SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026" OUTPUT_DIR="$SCRIPT_DIR/output" NODE="" VMID="" @@ -49,7 +49,6 @@ Optional: --hostname NAME Hostname (default: debian) --user USER Username (default: sascha) --password PASS Password (will be prompted if not set) - --ssh-key FILE SSH public key file (default: ~/.ssh/id_ed25519.pub) --output DIR Output directory (default: ./output) --debian-version VER Debian version (default: 13) @@ -80,7 +79,6 @@ while [[ $# -gt 0 ]]; do --hostname) HOSTNAME="$2"; shift 2;; --user) USER="$2"; shift 2;; --password) PASSWORD="$2"; shift 2;; - --ssh-key) SSH_KEY_FILE="$2"; shift 2;; --output) OUTPUT_DIR="$2"; shift 2;; --debian-version) DEBIAN_VERSION="$2"; shift 2;; --node) NODE="$2"; shift 2;; @@ -126,13 +124,7 @@ if [[ -z "$PASSWORD" ]]; then fi PASSWORD_HASH=$(echo "$PASSWORD" | openssl passwd -6 -stdin) -# --- SSH Key --- -if [[ -f "$SSH_KEY_FILE" ]]; then - SSH_KEY=$(cat "$SSH_KEY_FILE") -else - echo "Warning: SSH key file not found: $SSH_KEY_FILE" - SSH_KEY="" -fi +echo "SSH key: pfannkuchen-20260408" # --- Download Debian ISO --- ISO_URL="https://cdimage.debian.org/debian-cd/current/${ARCH}/iso-cd/debian-${DEBIAN_VERSION}.*-${ARCH}-netinst.iso" @@ -233,7 +225,7 @@ echo "Host: $HOSTNAME" echo "IP: $IP" echo "Gateway: $GATEWAY" echo "User: $USER" -echo "SSH Key: $(echo $SSH_KEY | cut -c1-40)..." +echo "SSH Key: pfannkuchen-20260408" echo "============================================" echo "" if [[ -n "$PVE_HOST" ]]; then @@ -244,7 +236,12 @@ if [[ -n "$PVE_HOST" ]]; then if [[ "$CREATE_VM" == true ]]; then ISO_NAME="$(basename "$OUTPUT_ISO")" - STORAGE="powerstore-node${NODE}" + # Storage Logic: PowerStore for 1,3,6,7 / LVM-Thin for 2,4,5 + if [[ "$NODE" =~ ^(1|3|6|7)$ ]]; then + STORAGE="powerstore-node${NODE}" + else + STORAGE="lvm-thin" + fi PVE_NODE="node${NODE}" # Auto-assign next free VMID if not specified diff --git a/net-watchdog.yml b/net-watchdog.yml new file mode 100644 index 0000000..4836489 --- /dev/null +++ b/net-watchdog.yml @@ -0,0 +1,5 @@ +--- +- hosts: automation1 + become: true + roles: + - net_watchdog diff --git a/patchmon-agent.yml b/patchmon-agent.yml new file mode 100644 index 0000000..d637e29 --- /dev/null +++ b/patchmon-agent.yml @@ -0,0 +1,29 @@ +--- +- name: PatchMon Agent (Docker-VMs) + hosts: hawser + become: yes + roles: + - patchmon-agent + +- name: PatchMon Agent (Proxmox Hosts) + hosts: proxmox + become: yes + tasks: + - name: Prüfen ob patchmon-agent bereits installiert ist + ansible.builtin.stat: + path: /usr/local/bin/patchmon-agent + register: patchmon_bin + + - name: Prüfen ob Agent bereits enrolled ist + ansible.builtin.command: /usr/local/bin/patchmon-agent ping + register: patchmon_ping + changed_when: false + failed_when: false + when: patchmon_bin.stat.exists + + - name: PatchMon Agent installieren (Auto-Enrollment) + ansible.builtin.shell: | + curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh + args: + creates: /etc/patchmon/credentials.yml + when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0) diff --git a/remove-postfix.yml b/remove-postfix.yml new file mode 100644 index 0000000..42eb814 --- /dev/null +++ b/remove-postfix.yml @@ -0,0 +1,30 @@ +--- +- name: Disable postfix on all hosts + hosts: all + tasks: + - name: Check if postfix is installed + ansible.builtin.command: which postfix + register: postfix_check + changed_when: false + failed_when: false + + - name: Stop and disable postfix + ansible.builtin.systemd: + name: postfix + state: stopped + enabled: false + when: postfix_check.rc == 0 + + - name: Set postfix to localhost-only + ansible.builtin.lineinfile: + path: /etc/postfix/main.cf + regexp: '^inet_interfaces\s*=' + line: 'inet_interfaces = loopback-only' + when: postfix_check.rc == 0 + + - name: Set relayhost to empty + ansible.builtin.lineinfile: + path: /etc/postfix/main.cf + regexp: '^relayhost\s*=' + line: 'relayhost =' + when: postfix_check.rc == 0 diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index fe4cf28..f593a64 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -9,11 +9,19 @@ regexp: '^127\.0\.1\.1' line: "127.0.1.1 {{ inventory_hostname }}.local {{ inventory_hostname }}" +- name: Prüfe ob Benutzer {{ base_user }} existiert + getent: + database: passwd + key: "{{ base_user }}" + register: base_user_check + ignore_errors: yes + - name: SSH Public Key für Benutzer {{ base_user }} hinterlegen ansible.posix.authorized_key: user: "{{ base_user }}" state: present key: "{{ vault_ssh_pubkey }}" + when: base_user_check is succeeded - name: SSH Private Key für Benutzer {{ base_user }} deployen copy: @@ -22,6 +30,7 @@ owner: "{{ base_user }}" group: "{{ base_user }}" mode: "0600" + when: base_user_check is succeeded - name: SSH Public Key Datei für Benutzer {{ base_user }} deployen copy: @@ -30,6 +39,7 @@ owner: "{{ base_user }}" group: "{{ base_user }}" mode: "0644" + when: base_user_check is succeeded - name: SSH Key auch für root hinterlegen ansible.posix.authorized_key: @@ -85,24 +95,28 @@ name: locales state: present -- name: en_US.UTF-8 Locale generieren +- name: de_DE.UTF-8 Locale generieren locale_gen: - name: en_US.UTF-8 + name: de_DE.UTF-8 state: present -- name: Systemweite Sprache auf en_US.UTF-8 setzen +- name: Systemweite Sprache auf de_DE.UTF-8 setzen debconf: name: locales question: locales/default_environment_locale - value: en_US.UTF-8 + value: de_DE.UTF-8 vtype: select - name: Locale-Datei manuell schreiben (Sicherheitsnetz) copy: dest: /etc/default/locale content: | - LANG=en_US.UTF-8 - LC_ALL=en_US.UTF-8 + LANG=de_DE.UTF-8 + LC_ALL=de_DE.UTF-8 + +- name: Zeitzone auf Europe/Berlin setzen + timezone: + name: Europe/Berlin - name: Gruppe sudo passwortloses sudo erlauben lineinfile: @@ -117,6 +131,7 @@ name: "{{ base_user }}" groups: sudo append: yes + when: base_user_check is succeeded - name: Unnötige Pakete entfernen apt: @@ -126,9 +141,11 @@ apt: name: qemu-guest-agent state: present + ignore_errors: yes - name: QEMU Guest Agent aktivieren service: name: qemu-guest-agent state: started enabled: yes + ignore_errors: yes diff --git a/roles/borg/templates/borgmatic.yml.j2 b/roles/borg/templates/borgmatic.yml.j2 index d4278fe..ef61e06 100644 --- a/roles/borg/templates/borgmatic.yml.j2 +++ b/roles/borg/templates/borgmatic.yml.j2 @@ -28,8 +28,27 @@ before_backup: after_backup: - curl -fsS -m 10 "https://status.guck.tv/api/push/borg-{{ inventory_hostname }}?status=up&msg=OK&ping=" || true - - curl -fsS -m 10 "http://10.1.1.111:9999/push?host={{ inventory_hostname }}&status=ok" || true + - >- + bash -c ' + STATS=$(borgmatic info --archive latest --json 2>/dev/null | python3 -c " + import sys,json + d=json.load(sys.stdin)[0][\"archives\"][-1] + s=d.get(\"stats\",{}) + print(json.dumps({ + \"host\":\"{{ inventory_hostname }}\", + \"status\":\"ok\", + \"duration_sec\":int(s.get(\"duration\",0)), + \"original_size\":s.get(\"original_size\",0), + \"deduplicated_size\":s.get(\"deduplicated_size\",0), + \"compressed_size\":s.get(\"compressed_size\",0), + \"nfiles_new\":s.get(\"nfiles\",0) + }))" 2>/dev/null || echo "{\"host\":\"{{ inventory_hostname }}\",\"status\":\"ok\"}"); + curl -fsS -m 10 -X POST -H "Content-Type: application/json" -d "$STATS" "http://10.1.1.111:9999/api/push" || true + ' on_error: - curl -fsS -m 10 "https://status.guck.tv/api/push/borg-{{ inventory_hostname }}?status=down&msg=FEHLER&ping=" || true - - curl -fsS -m 10 "http://10.1.1.111:9999/push?host={{ inventory_hostname }}&status=error&msg=Backup%20fehlgeschlagen" || true + - >- + curl -fsS -m 10 -X POST -H "Content-Type: application/json" + -d '{"host":"{{ inventory_hostname }}","status":"error","message":"Backup fehlgeschlagen"}' + "http://10.1.1.111:9999/api/push" || true diff --git a/roles/dns_resolver/handlers/main.yml b/roles/dns_resolver/handlers/main.yml index a7619b6..2d11faf 100644 --- a/roles/dns_resolver/handlers/main.yml +++ b/roles/dns_resolver/handlers/main.yml @@ -1,3 +1,5 @@ --- -- name: update resolvconf - command: resolvconf -u +- name: restart dnscrypt-proxy + systemd: + name: dnscrypt-proxy + state: restarted diff --git a/roles/dns_resolver/tasks/main.yml b/roles/dns_resolver/tasks/main.yml index dec629c..e9d699b 100644 --- a/roles/dns_resolver/tasks/main.yml +++ b/roles/dns_resolver/tasks/main.yml @@ -1,24 +1,16 @@ --- -- name: Set DNS resolver (resolvconf) +- name: DNS resolver auf DoH setzen (via automation1) copy: content: | nameserver 10.5.85.5 - nameserver 1.1.1.1 - dest: /etc/resolvconf/resolv.conf.d/head - mode: '0644' - when: ansible_facts.packages is defined and 'resolvconf' in ansible_facts.packages - notify: update resolvconf - -- name: Set DNS resolver (direct) - copy: - content: | - nameserver 10.5.85.5 - nameserver 1.1.1.1 dest: /etc/resolv.conf mode: '0644' - when: ansible_facts.packages is not defined or 'resolvconf' not in ansible_facts.packages + when: inventory_hostname != 'automation1' -- name: Gather package facts - package_facts: - manager: auto - when: ansible_facts.packages is not defined +- name: dnscrypt-proxy stoppen auf VMs (nicht noetig) + systemd: + name: dnscrypt-proxy + state: stopped + enabled: false + when: inventory_hostname != 'automation1' + ignore_errors: true diff --git a/roles/frp_client/tasks/main.yml b/roles/frp_client/tasks/main.yml index 19577ed..e402bdf 100644 --- a/roles/frp_client/tasks/main.yml +++ b/roles/frp_client/tasks/main.yml @@ -31,7 +31,7 @@ serverPort = {{ frp_server_port }} auth.method = "token" auth.token = "{{ frp_token }}" - transport.protocol = "quic" + transport.protocol = "tcp" transport.poolCount = 5 transport.tcpMux = true {% for proxy in frp_proxies %} @@ -43,8 +43,6 @@ localPort = {{ proxy.local_port }} remotePort = {{ proxy.remote_port }} transport.useCompression = true - transport.bandwidthLimit = "{{ proxy.bandwidth_limit | default('6MB') }}" - transport.bandwidthLimitMode = "server" {% endfor %} mode: "0600" notify: restart frpc diff --git a/roles/hawser/tasks/main.yml b/roles/hawser/tasks/main.yml index daaf7d1..4e61e5b 100644 --- a/roles/hawser/tasks/main.yml +++ b/roles/hawser/tasks/main.yml @@ -1,14 +1,44 @@ --- -- name: Hawser installieren (offizielles Install-Script) +- name: Hawser installieren ansible.builtin.shell: - cmd: curl -fsSL https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh | bash + cmd: | + ARCH=$(dpkg --print-architecture) + VERSION=0.2.39 + curl -fsSL "https://github.com/Finsys/hawser/releases/download/v${VERSION}/hawser_${VERSION}_linux_${ARCH}.tar.gz" | tar xz -C /usr/local/bin hawser + chmod +x /usr/local/bin/hawser creates: /usr/local/bin/hawser +- name: Hawser config Verzeichnis + ansible.builtin.file: + path: /etc/hawser + state: directory + - name: Hawser Token in Config setzen ansible.builtin.lineinfile: path: /etc/hawser/config regexp: '^TOKEN=' line: "TOKEN={{ vault_hawser_token }}" + create: yes + notify: restart hawser + +- name: Hawser systemd Service + ansible.builtin.copy: + dest: /etc/systemd/system/hawser.service + content: | + [Unit] + Description=Hawser Agent + After=docker.service + Requires=docker.service + + [Service] + Type=simple + EnvironmentFile=/etc/hawser/config + ExecStart=/usr/local/bin/hawser + Restart=always + RestartSec=10 + + [Install] + WantedBy=multi-user.target notify: restart hawser - name: Hawser aktivieren und starten diff --git a/roles/net_watchdog/defaults/main.yml b/roles/net_watchdog/defaults/main.yml new file mode 100644 index 0000000..1d58608 --- /dev/null +++ b/roles/net_watchdog/defaults/main.yml @@ -0,0 +1,23 @@ +--- +watchdog_iface: "ens192" +watchdog_subnet: "10.5.85.0/24" +watchdog_cron_interval: "*/5" +watchdog_webhook_url: "{{ vault_watchdog_webhook_url | default('') }}" + +# Bekannte Hosts im Management-Netz (MAC|IP|Name) +# Bei neuer VM/Host: hier eintragen + ./pfannkuchen.sh watchdog +watchdog_known_hosts: + - { mac: "c8:4f:86:fc:00:09", ip: "10.5.85.1", name: "Gateway/Switch" } + - { mac: "00:11:32:45:79:28", ip: "10.5.85.10", name: "Synology NAS" } + - { mac: "00:50:56:9a:24:35", ip: "10.5.85.5", name: "automation1" } + # Proxmox Nodes + - { mac: "e4:3d:1a:3c:62:9a", ip: "10.5.85.11", name: "node1" } + - { mac: "00:1b:21:de:10:95", ip: "10.5.85.12", name: "node2" } + - { mac: "e4:3d:1a:3c:57:6c", ip: "10.5.85.13", name: "node3" } + - { mac: "2c:ea:7f:a8:a5:9f", ip: "10.5.85.14", name: "node4" } + - { mac: "2c:ea:7f:a8:a9:3f", ip: "10.5.85.15", name: "node5" } + - { mac: "e4:3d:1a:3c:3f:a8", ip: "10.5.85.16", name: "node6" } + - { mac: "e4:3d:1a:3c:88:da", ip: "10.5.85.17", name: "node7" } + # Kubernetes VMs (shared MAC = normal bei Proxmox VMs auf gleichem Node) + - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.101", name: "kube-work1" } + - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.103", name: "kube-ctrl" } diff --git a/roles/net_watchdog/tasks/main.yml b/roles/net_watchdog/tasks/main.yml new file mode 100644 index 0000000..f55c88d --- /dev/null +++ b/roles/net_watchdog/tasks/main.yml @@ -0,0 +1,18 @@ +--- +- name: arp-scan installieren + ansible.builtin.apt: + name: arp-scan + state: present + +- name: Watchdog Script deployen + ansible.builtin.template: + src: net-watchdog.sh.j2 + dest: /usr/local/bin/net-watchdog.sh + mode: "0755" + +- name: Cronjob einrichten + ansible.builtin.cron: + name: "net-watchdog" + minute: "{{ watchdog_cron_interval }}" + job: "/usr/local/bin/net-watchdog.sh --quiet" + user: root diff --git a/roles/net_watchdog/templates/net-watchdog.sh.j2 b/roles/net_watchdog/templates/net-watchdog.sh.j2 new file mode 100644 index 0000000..62c4cc6 --- /dev/null +++ b/roles/net_watchdog/templates/net-watchdog.sh.j2 @@ -0,0 +1,55 @@ +#!/bin/bash +# Network Watchdog – generiert von Ansible +# Scannt {{ watchdog_subnet }} auf {{ watchdog_iface }} alle {{ watchdog_cron_interval }} +set -euo pipefail + +IFACE="{{ watchdog_iface }}" +SUBNET="{{ watchdog_subnet }}" +LOGFILE="/var/log/net-watchdog.log" +WEBHOOK_URL="{{ watchdog_webhook_url }}" + +# Whitelist (generiert aus Ansible defaults/main.yml) +declare -A KNOWN +{% for host in watchdog_known_hosts %} +KNOWN["{{ host.mac }}|{{ host.ip }}"]="{{ host.name }}" +{% endfor %} + +QUIET="${1:-}" + +log() { + local msg="$(date '+%Y-%m-%d %H:%M:%S') $1" + echo "$msg" >> "$LOGFILE" + [ "$QUIET" != "--quiet" ] && echo "$msg" +} + +SCAN=$(/usr/sbin/arp-scan --interface="$IFACE" "$SUBNET" 2>/dev/null \ + | grep -E '^[0-9]+\.' | awk '{print $2"|"$1}') + +UNKNOWN="" +ALERT_COUNT=0 + +while IFS= read -r line; do + [ -z "$line" ] && continue + mac=$(echo "$line" | cut -d'|' -f1) + ip=$(echo "$line" | cut -d'|' -f2) + if [ -z "${KNOWN["${mac}|${ip}"]:-}" ]; then + UNKNOWN+="⚠️ ${ip} (MAC: ${mac})\n" + log "ALERT: Unbekannter Host ${ip} MAC=${mac}" + ((ALERT_COUNT++)) + fi +done <<< "$SCAN" + +if [ "$ALERT_COUNT" -gt 0 ]; then + log "SCAN: ${ALERT_COUNT} unbekannte Hosts!" + if [ -n "$WEBHOOK_URL" ]; then + curl -s -X POST "$WEBHOOK_URL" \ + -H "Content-Type: application/json" \ + -d "{\"event\":\"unknown_host\",\"subnet\":\"${SUBNET}\",\"count\":${ALERT_COUNT},\"details\":\"$(echo -e "$UNKNOWN" | tr '\n' ' ')\",\"timestamp\":\"$(date -Iseconds)\"}" \ + >/dev/null 2>&1 || log "WARN: Webhook fehlgeschlagen" + fi + [ "$QUIET" != "--quiet" ] && echo -e "\n${UNKNOWN}" + exit 1 +else + log "SCAN: OK – alle $(echo "$SCAN" | wc -l) Hosts bekannt" + exit 0 +fi diff --git a/roles/nvidia/tasks/main.yml b/roles/nvidia/tasks/main.yml index c08b1cc..85ea387 100644 --- a/roles/nvidia/tasks/main.yml +++ b/roles/nvidia/tasks/main.yml @@ -44,6 +44,7 @@ ansible.builtin.apt: name: - linux-headers-{{ ansible_kernel }} + - linux-headers-amd64 - dkms state: present diff --git a/roles/patchmon-agent/handlers/main.yml b/roles/patchmon-agent/handlers/main.yml new file mode 100644 index 0000000..9285648 --- /dev/null +++ b/roles/patchmon-agent/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: restart patchmon-agent + ansible.builtin.systemd: + name: patchmon-agent + state: restarted diff --git a/roles/patchmon-agent/tasks/main.yml b/roles/patchmon-agent/tasks/main.yml new file mode 100644 index 0000000..f10eb5b --- /dev/null +++ b/roles/patchmon-agent/tasks/main.yml @@ -0,0 +1,33 @@ +--- +- name: Prüfen ob patchmon-agent bereits installiert ist + ansible.builtin.stat: + path: /usr/local/bin/patchmon-agent + register: patchmon_bin + +- name: Prüfen ob Agent bereits enrolled ist + ansible.builtin.command: /usr/local/bin/patchmon-agent ping + register: patchmon_ping + changed_when: false + failed_when: false + when: patchmon_bin.stat.exists + +- name: PatchMon Agent installieren (Auto-Enrollment) + ansible.builtin.shell: | + curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh + args: + creates: /etc/patchmon/credentials.yml + when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0) + +- name: Server-URL sicherstellen + ansible.builtin.lineinfile: + path: /etc/patchmon/config.yml + regexp: '^patchmon_server:' + line: 'patchmon_server: "https://patchmon.sascha-lutz.de"' + notify: restart patchmon-agent + +- name: Docker-Integration aktivieren + ansible.builtin.lineinfile: + path: /etc/patchmon/config.yml + regexp: '^\s*docker:' + line: ' docker: true' + notify: restart patchmon-agent diff --git a/roles/tc_ratelimit/defaults/main.yml b/roles/tc_ratelimit/defaults/main.yml new file mode 100644 index 0000000..a585004 --- /dev/null +++ b/roles/tc_ratelimit/defaults/main.yml @@ -0,0 +1,5 @@ +--- +tc_iface: "auto" +tc_flow_limit: "50mbit" +tc_total_limit: "500mbit" +tc_burst: "1mb" diff --git a/roles/tc_ratelimit/handlers/main.yml b/roles/tc_ratelimit/handlers/main.yml new file mode 100644 index 0000000..31d3466 --- /dev/null +++ b/roles/tc_ratelimit/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: restart tc-ratelimit + ansible.builtin.systemd: + name: tc-ratelimit + state: restarted + daemon_reload: true diff --git a/roles/tc_ratelimit/tasks/main.yml b/roles/tc_ratelimit/tasks/main.yml new file mode 100644 index 0000000..30b8a70 --- /dev/null +++ b/roles/tc_ratelimit/tasks/main.yml @@ -0,0 +1,33 @@ +--- +- name: Netzwerk-Interface ermitteln + ansible.builtin.shell: + cmd: "ip -o link show | awk -F': ' '!/lo/{print $2; exit}'" + register: detected_iface + changed_when: false + when: tc_iface == "auto" + +- name: Interface setzen + ansible.builtin.set_fact: + tc_iface: "{{ detected_iface.stdout | trim }}" + when: tc_iface == "auto" + +- name: tc-ratelimit Script deployen + ansible.builtin.template: + src: tc-ratelimit.sh.j2 + dest: /usr/local/bin/tc-ratelimit.sh + mode: "0755" + notify: restart tc-ratelimit + +- name: Systemd Service deployen + ansible.builtin.template: + src: tc-ratelimit.service.j2 + dest: /etc/systemd/system/tc-ratelimit.service + mode: "0644" + notify: restart tc-ratelimit + +- name: Service aktivieren und starten + ansible.builtin.systemd: + name: tc-ratelimit + enabled: true + state: started + daemon_reload: true diff --git a/roles/tc_ratelimit/templates/tc-ratelimit.service.j2 b/roles/tc_ratelimit/templates/tc-ratelimit.service.j2 new file mode 100644 index 0000000..a8c0a18 --- /dev/null +++ b/roles/tc_ratelimit/templates/tc-ratelimit.service.j2 @@ -0,0 +1,13 @@ +[Unit] +Description=tc per-flow rate limit ({{ tc_flow_limit }} per connection) +After=network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/local/bin/tc-ratelimit.sh start +ExecStop=/usr/local/bin/tc-ratelimit.sh stop + +[Install] +WantedBy=multi-user.target diff --git a/roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 b/roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 new file mode 100644 index 0000000..cc66939 --- /dev/null +++ b/roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 @@ -0,0 +1,26 @@ +#!/bin/bash +# tc per-flow rate limit – deployed via Ansible +# Jede TCP-Connection bekommt max {{ tc_flow_limit }} +IFACE="{{ tc_iface }}" +FLOW_LIMIT="{{ tc_flow_limit }}" +TOTAL_LIMIT="{{ tc_total_limit }}" +BURST="{{ tc_burst }}" + +case "${1}" in + start) + tc qdisc del dev "${IFACE}" root 2>/dev/null + tc qdisc add dev "${IFACE}" root handle 1: htb default 10 + tc class add dev "${IFACE}" parent 1: classid 1:1 htb rate "${TOTAL_LIMIT}" burst "${BURST}" + tc class add dev "${IFACE}" parent 1:1 classid 1:10 htb rate "${TOTAL_LIMIT}" burst "${BURST}" + tc qdisc add dev "${IFACE}" parent 1:10 handle 10: fq maxrate "${FLOW_LIMIT}" flow_limit 200 + echo "tc: ${FLOW_LIMIT}/flow on ${IFACE}" + ;; + stop) + tc qdisc del dev "${IFACE}" root 2>/dev/null + ;; + status) + tc -s qdisc show dev "${IFACE}" + tc -s class show dev "${IFACE}" + ;; + *) echo "Usage: $0 {start|stop|status}"; exit 1 ;; +esac diff --git a/rotate-ssh-key.yml b/rotate-ssh-key.yml new file mode 100644 index 0000000..d717da7 --- /dev/null +++ b/rotate-ssh-key.yml @@ -0,0 +1,17 @@ +--- +# Phase 1: Add new key alongside old keys +- name: Add new SSH key to all hosts + hosts: all + become: true + vars: + new_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026" + tasks: + - name: Set target user + set_fact: + target_user: "{{ base_user | default(ansible_user | default('sascha')) }}" + + - name: Add new key (keep old keys) + ansible.posix.authorized_key: + user: "{{ target_user }}" + key: "{{ new_key }}" + state: present diff --git a/sops-age.yml b/sops-age.yml new file mode 100644 index 0000000..8096ee0 --- /dev/null +++ b/sops-age.yml @@ -0,0 +1,40 @@ +--- +- name: SOPS + Age Key Deployment + hosts: all + become: yes + tasks: + - name: sops installieren + ansible.builtin.shell: | + if ! command -v sops &>/dev/null; then + curl -sLo /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64 + chmod +x /usr/local/bin/sops + fi + args: + creates: /usr/local/bin/sops + + - name: Age Key Verzeichnis erstellen + ansible.builtin.file: + path: /root/.config/sops/age + state: directory + mode: "0700" + + - name: Age Key deployen + ansible.builtin.copy: + content: | + # created: 2026-04-04T09:42:26+02:00 + # public key: age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr + AGE-SECRET-KEY-19RPRZ89VNDR6KECR7ULA38P8KJ7FHMXJ9N07UUJHLGSVMUW69LHS89XDD2 + dest: /root/.config/sops/age/keys.txt + mode: "0600" + + - name: sops decrypt Hook fuer Git-Repos erstellen + ansible.builtin.copy: + content: | + #!/bin/bash + # Post-merge hook: decrypt .env.enc after git pull + if [ -f .env.enc ]; then + sops -d --input-type dotenv --output-type dotenv .env.enc > .env + echo "[sops] .env decrypted" + fi + dest: /usr/local/bin/sops-decrypt-env + mode: "0755" diff --git a/tc-ratelimit.yml b/tc-ratelimit.yml new file mode 100644 index 0000000..8b7a486 --- /dev/null +++ b/tc-ratelimit.yml @@ -0,0 +1,5 @@ +--- +- hosts: hetzner + become: true + roles: + - tc_ratelimit diff --git a/update.yml b/update.yml index 0c7ae87..976ed5a 100644 --- a/update.yml +++ b/update.yml @@ -9,29 +9,50 @@ upgrade: dist autoremove: yes - - name: Pruefen ob Reboot noetig ist + - name: Pruefen ob Reboot noetig ist (Debian) ansible.builtin.stat: path: /var/run/reboot-required register: reboot_required -- name: NVIDIA Kernel Headers nach Upgrade sicherstellen +- name: NVIDIA Check nach Upgrade hosts: nvidia become: yes tasks: - - name: Kernel Headers und DKMS installieren und Module bauen + - name: Kernel Headers fuer alle installierten Kernel sicherstellen ansible.builtin.shell: | export PATH=$PATH:/usr/sbin - apt-get install -y linux-headers-$(uname -r) dkms + # Headers fuer den laufenden UND den neuesten installierten Kernel + NEWEST_KERNEL=$(ls -t /boot/vmlinuz-* | head -1 | sed 's|/boot/vmlinuz-||') + apt-get install -y linux-headers-${NEWEST_KERNEL} linux-headers-$(uname -r) linux-headers-amd64 dkms dkms autoinstall register: headers_result changed_when: "'newly installed' in headers_result.stdout" + - name: NVIDIA Driver Mismatch pruefen + ansible.builtin.shell: nvidia-smi > /dev/null 2>&1 + register: nvidia_check + changed_when: false + failed_when: false + + - name: Reboot-Flag setzen bei NVIDIA Mismatch + ansible.builtin.set_fact: + nvidia_reboot_needed: true + when: nvidia_check.rc != 0 + - name: Reboot falls noetig hosts: all become: yes + serial: 3 tasks: - name: Reboot durchfuehren ansible.builtin.reboot: msg: "Reboot nach Update" reboot_timeout: 300 - when: hostvars[inventory_hostname].reboot_required.stat.exists + when: > + hostvars[inventory_hostname].reboot_required.stat.exists | default(false) + or hostvars[inventory_hostname].nvidia_reboot_needed | default(false) + + - name: NVIDIA Treiber nach Reboot verifizieren + ansible.builtin.shell: nvidia-smi | head -3 + when: hostvars[inventory_hostname].nvidia_reboot_needed | default(false) + changed_when: false