sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/net_watchdog/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+watchdog_iface: "ens192"
+watchdog_subnet: "10.5.85.0/24"
+watchdog_cron_interval: "*/5"
+watchdog_webhook_url: "{{ vault_watchdog_webhook_url | default('') }}"
+
+# Bekannte Hosts im Management-Netz (MAC|IP|Name)
+# Bei neuer VM/Host: hier eintragen + ./pfannkuchen.sh watchdog
+watchdog_known_hosts:
+  - { mac: "c8:4f:86:fc:00:09", ip: "10.5.85.1",   name: "Gateway/Switch" }
+  - { mac: "00:11:32:45:79:28", ip: "10.5.85.10",  name: "Synology NAS" }
+  - { mac: "00:50:56:9a:24:35", ip: "10.5.85.5",   name: "automation1" }
+  # Proxmox Nodes
+  - { mac: "e4:3d:1a:3c:62:9a", ip: "10.5.85.11",  name: "node1" }
+  - { mac: "00:1b:21:de:10:95", ip: "10.5.85.12",  name: "node2" }
+  - { mac: "e4:3d:1a:3c:57:6c", ip: "10.5.85.13",  name: "node3" }
+  - { mac: "2c:ea:7f:a8:a5:9f", ip: "10.5.85.14",  name: "node4" }
+  - { mac: "2c:ea:7f:a8:a9:3f", ip: "10.5.85.15",  name: "node5" }
+  - { mac: "e4:3d:1a:3c:3f:a8", ip: "10.5.85.16",  name: "node6" }
+  - { mac: "e4:3d:1a:3c:88:da", ip: "10.5.85.17",  name: "node7" }
+  # Kubernetes VMs (shared MAC = normal bei Proxmox VMs auf gleichem Node)
+  - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.101", name: "kube-work1" }
+  - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.103", name: "kube-ctrl" }

roles/net_watchdog/tasks/main.yml

@@ -0,0 +1,18 @@
+---
+- name: arp-scan installieren
+  ansible.builtin.apt:
+    name: arp-scan
+    state: present
+
+- name: Watchdog Script deployen
+  ansible.builtin.template:
+    src: net-watchdog.sh.j2
+    dest: /usr/local/bin/net-watchdog.sh
+    mode: "0755"
+
+- name: Cronjob einrichten
+  ansible.builtin.cron:
+    name: "net-watchdog"
+    minute: "{{ watchdog_cron_interval }}"
+    job: "/usr/local/bin/net-watchdog.sh --quiet"
+    user: root

roles/net_watchdog/templates/net-watchdog.sh.j2

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Network Watchdog – generiert von Ansible
+# Scannt {{ watchdog_subnet }} auf {{ watchdog_iface }} alle {{ watchdog_cron_interval }}
+set -euo pipefail
+
+IFACE="{{ watchdog_iface }}"
+SUBNET="{{ watchdog_subnet }}"
+LOGFILE="/var/log/net-watchdog.log"
+WEBHOOK_URL="{{ watchdog_webhook_url }}"
+
+# Whitelist (generiert aus Ansible defaults/main.yml)
+declare -A KNOWN
+{% for host in watchdog_known_hosts %}
+KNOWN["{{ host.mac }}|{{ host.ip }}"]="{{ host.name }}"
+{% endfor %}
+
+QUIET="${1:-}"
+
+log() {
+  local msg="$(date '+%Y-%m-%d %H:%M:%S') $1"
+  echo "$msg" >> "$LOGFILE"
+  [ "$QUIET" != "--quiet" ] && echo "$msg"
+}
+
+SCAN=$(/usr/sbin/arp-scan --interface="$IFACE" "$SUBNET" 2>/dev/null \
+  | grep -E '^[0-9]+\.' | awk '{print $2"|"$1}')
+
+UNKNOWN=""
+ALERT_COUNT=0
+
+while IFS= read -r line; do
+  [ -z "$line" ] && continue
+  mac=$(echo "$line" | cut -d'|' -f1)
+  ip=$(echo "$line" | cut -d'|' -f2)
+  if [ -z "${KNOWN["${mac}|${ip}"]:-}" ]; then
+    UNKNOWN+="⚠️ ${ip} (MAC: ${mac})\n"
+    log "ALERT: Unbekannter Host ${ip} MAC=${mac}"
+    ((ALERT_COUNT++))
+  fi
+done <<< "$SCAN"
+
+if [ "$ALERT_COUNT" -gt 0 ]; then
+  log "SCAN: ${ALERT_COUNT} unbekannte Hosts!"
+  if [ -n "$WEBHOOK_URL" ]; then
+    curl -s -X POST "$WEBHOOK_URL" \
+      -H "Content-Type: application/json" \
+      -d "{\"event\":\"unknown_host\",\"subnet\":\"${SUBNET}\",\"count\":${ALERT_COUNT},\"details\":\"$(echo -e "$UNKNOWN" | tr '\n' ' ')\",\"timestamp\":\"$(date -Iseconds)\"}" \
+      >/dev/null 2>&1 || log "WARN: Webhook fehlgeschlagen"
+  fi
+  [ "$QUIET" != "--quiet" ] && echo -e "\n${UNKNOWN}"
+  exit 1
+else
+  log "SCAN: OK – alle $(echo "$SCAN" | wc -l) Hosts bekannt"
+  exit 0
+fi