sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/net_watchdog/templates/net-watchdog.sh.j2

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Network Watchdog – generiert von Ansible
+# Scannt {{ watchdog_subnet }} auf {{ watchdog_iface }} alle {{ watchdog_cron_interval }}
+set -euo pipefail
+
+IFACE="{{ watchdog_iface }}"
+SUBNET="{{ watchdog_subnet }}"
+LOGFILE="/var/log/net-watchdog.log"
+WEBHOOK_URL="{{ watchdog_webhook_url }}"
+
+# Whitelist (generiert aus Ansible defaults/main.yml)
+declare -A KNOWN
+{% for host in watchdog_known_hosts %}
+KNOWN["{{ host.mac }}|{{ host.ip }}"]="{{ host.name }}"
+{% endfor %}
+
+QUIET="${1:-}"
+
+log() {
+  local msg="$(date '+%Y-%m-%d %H:%M:%S') $1"
+  echo "$msg" >> "$LOGFILE"
+  [ "$QUIET" != "--quiet" ] && echo "$msg"
+}
+
+SCAN=$(/usr/sbin/arp-scan --interface="$IFACE" "$SUBNET" 2>/dev/null \
+  | grep -E '^[0-9]+\.' | awk '{print $2"|"$1}')
+
+UNKNOWN=""
+ALERT_COUNT=0
+
+while IFS= read -r line; do
+  [ -z "$line" ] && continue
+  mac=$(echo "$line" | cut -d'|' -f1)
+  ip=$(echo "$line" | cut -d'|' -f2)
+  if [ -z "${KNOWN["${mac}|${ip}"]:-}" ]; then
+    UNKNOWN+="⚠️ ${ip} (MAC: ${mac})\n"
+    log "ALERT: Unbekannter Host ${ip} MAC=${mac}"
+    ((ALERT_COUNT++))
+  fi
+done <<< "$SCAN"
+
+if [ "$ALERT_COUNT" -gt 0 ]; then
+  log "SCAN: ${ALERT_COUNT} unbekannte Hosts!"
+  if [ -n "$WEBHOOK_URL" ]; then
+    curl -s -X POST "$WEBHOOK_URL" \
+      -H "Content-Type: application/json" \
+      -d "{\"event\":\"unknown_host\",\"subnet\":\"${SUBNET}\",\"count\":${ALERT_COUNT},\"details\":\"$(echo -e "$UNKNOWN" | tr '\n' ' ')\",\"timestamp\":\"$(date -Iseconds)\"}" \
+      >/dev/null 2>&1 || log "WARN: Webhook fehlgeschlagen"
+  fi
+  [ "$QUIET" != "--quiet" ] && echo -e "\n${UNKNOWN}"
+  exit 1
+else
+  log "SCAN: OK – alle $(echo "$SCAN" | wc -l) Hosts bekannt"
+  exit 0
+fi