sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/tc_ratelimit/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+tc_iface: "auto"
+tc_flow_limit: "50mbit"
+tc_total_limit: "500mbit"
+tc_burst: "1mb"

roles/tc_ratelimit/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart tc-ratelimit
+  ansible.builtin.systemd:
+    name: tc-ratelimit
+    state: restarted
+    daemon_reload: true

roles/tc_ratelimit/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Netzwerk-Interface ermitteln
+  ansible.builtin.shell:
+    cmd: "ip -o link show | awk -F': ' '!/lo/{print $2; exit}'"
+  register: detected_iface
+  changed_when: false
+  when: tc_iface == "auto"
+
+- name: Interface setzen
+  ansible.builtin.set_fact:
+    tc_iface: "{{ detected_iface.stdout | trim }}"
+  when: tc_iface == "auto"
+
+- name: tc-ratelimit Script deployen
+  ansible.builtin.template:
+    src: tc-ratelimit.sh.j2
+    dest: /usr/local/bin/tc-ratelimit.sh
+    mode: "0755"
+  notify: restart tc-ratelimit
+
+- name: Systemd Service deployen
+  ansible.builtin.template:
+    src: tc-ratelimit.service.j2
+    dest: /etc/systemd/system/tc-ratelimit.service
+    mode: "0644"
+  notify: restart tc-ratelimit
+
+- name: Service aktivieren und starten
+  ansible.builtin.systemd:
+    name: tc-ratelimit
+    enabled: true
+    state: started
+    daemon_reload: true

roles/tc_ratelimit/templates/tc-ratelimit.service.j2

@@ -0,0 +1,13 @@
+[Unit]
+Description=tc per-flow rate limit ({{ tc_flow_limit }} per connection)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/bin/tc-ratelimit.sh start
+ExecStop=/usr/local/bin/tc-ratelimit.sh stop
+
+[Install]
+WantedBy=multi-user.target

roles/tc_ratelimit/templates/tc-ratelimit.sh.j2

@@ -0,0 +1,26 @@
+#!/bin/bash
+# tc per-flow rate limit – deployed via Ansible
+# Jede TCP-Connection bekommt max {{ tc_flow_limit }}
+IFACE="{{ tc_iface }}"
+FLOW_LIMIT="{{ tc_flow_limit }}"
+TOTAL_LIMIT="{{ tc_total_limit }}"
+BURST="{{ tc_burst }}"
+
+case "${1}" in
+  start)
+    tc qdisc del dev "${IFACE}" root 2>/dev/null
+    tc qdisc add dev "${IFACE}" root handle 1: htb default 10
+    tc class add dev "${IFACE}" parent 1: classid 1:1 htb rate "${TOTAL_LIMIT}" burst "${BURST}"
+    tc class add dev "${IFACE}" parent 1:1 classid 1:10 htb rate "${TOTAL_LIMIT}" burst "${BURST}"
+    tc qdisc add dev "${IFACE}" parent 1:10 handle 10: fq maxrate "${FLOW_LIMIT}" flow_limit 200
+    echo "tc: ${FLOW_LIMIT}/flow on ${IFACE}"
+    ;;
+  stop)
+    tc qdisc del dev "${IFACE}" root 2>/dev/null
+    ;;
+  status)
+    tc -s qdisc show dev "${IFACE}"
+    tc -s class show dev "${IFACE}"
+    ;;
+  *) echo "Usage: $0 {start|stop|status}"; exit 1 ;;
+esac