sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

update.yml

@@ -9,29 +9,50 @@
         upgrade: dist
         autoremove: yes
 
-    - name: Pruefen ob Reboot noetig ist
+    - name: Pruefen ob Reboot noetig ist (Debian)
       ansible.builtin.stat:
         path: /var/run/reboot-required
       register: reboot_required
 
-- name: NVIDIA Kernel Headers nach Upgrade sicherstellen
+- name: NVIDIA Check nach Upgrade
   hosts: nvidia
   become: yes
   tasks:
-    - name: Kernel Headers und DKMS installieren und Module bauen
+    - name: Kernel Headers fuer alle installierten Kernel sicherstellen
       ansible.builtin.shell: |
         export PATH=$PATH:/usr/sbin
-        apt-get install -y linux-headers-$(uname -r) dkms
+        # Headers fuer den laufenden UND den neuesten installierten Kernel
+        NEWEST_KERNEL=$(ls -t /boot/vmlinuz-* | head -1 | sed 's|/boot/vmlinuz-||')
+        apt-get install -y linux-headers-${NEWEST_KERNEL} linux-headers-$(uname -r) linux-headers-amd64 dkms
         dkms autoinstall
       register: headers_result
       changed_when: "'newly installed' in headers_result.stdout"
 
+    - name: NVIDIA Driver Mismatch pruefen
+      ansible.builtin.shell: nvidia-smi > /dev/null 2>&1
+      register: nvidia_check
+      changed_when: false
+      failed_when: false
+
+    - name: Reboot-Flag setzen bei NVIDIA Mismatch
+      ansible.builtin.set_fact:
+        nvidia_reboot_needed: true
+      when: nvidia_check.rc != 0
+
 - name: Reboot falls noetig
   hosts: all
   become: yes
+  serial: 3
   tasks:
     - name: Reboot durchfuehren
       ansible.builtin.reboot:
         msg: "Reboot nach Update"
         reboot_timeout: 300
-      when: hostvars[inventory_hostname].reboot_required.stat.exists
+      when: >
+        hostvars[inventory_hostname].reboot_required.stat.exists | default(false)
+        or hostvars[inventory_hostname].nvidia_reboot_needed | default(false)
+
+    - name: NVIDIA Treiber nach Reboot verifizieren
+      ansible.builtin.shell: nvidia-smi | head -3
+      when: hostvars[inventory_hostname].nvidia_reboot_needed | default(false)
+      changed_when: false