sync: Inventory-Realabgleich + neue host_vars/roles/playbooks

Nachgezogener Arbeitsstand des Homelabs:
- neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm)
- neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy)
- diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia)

Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -48,7 +48,7 @@ ansible-playbook update.yml
 | sabnzbd     | 10.2.1.119   | arr           | SABnzbd                |
 | dockhand    | 10.4.1.116   | docker        | Dockhand               |
 | n8n         | 10.4.1.113   | auto          | n8n Automation         |
-| openclaw    | 10.4.1.100   | auto          | OpenClaw               |
+| hermes    | 10.4.1.100   | auto          | Hermes Agent               |
 | monitoring  | 10.1.1.111   | auto          | Monitoring Stack       |
 | automation  | 10.1.1.115   | auto          | Automation Stack       |
 | matrix      | 10.4.1.110   | communication | Matrix                 |
@@ -257,7 +257,7 @@ Direkte Peers (kein Hysteria2):
 | media         | emby-sascha, jellyfin, immich, emby-chris       | Media VMs                    |
 | arr           | tdarr, arrapps, sabnzbd                         | Arr-Stack                    |
 | docker        | dockhand                                        | Docker VMs                   |
-| auto          | n8n, openclaw, monitoring, automation            | Automation                   |
+| auto          | n8n, hermes, monitoring, automation            | Automation                   |
 | communication | matrix                                          | Kommunikation                |
 | hetzner       | pfannkuchen                                     | Hetzner Server               |
 | frp           | emby-sascha, emby-chris, jellyfin               | FRP Clients                  |

ansible.cfg

@@ -1,4 +1,5 @@
 [defaults]
+private_key_file = /app-config/ansible/id_ed25519
 host_key_checking = false
 vault_password_file = .vault-password
 inventory=pfannkuchen.ini

checkrr-deploy.yml

@@ -0,0 +1,87 @@
+---
+# Deploy Checkrr config to arrapps stack
+- name: Deploy Checkrr configuration
+  hosts: arrapps
+  become: true
+  gather_facts: false
+
+  tasks:
+    - name: Ensure /app-config/arr directory exists
+      ansible.builtin.file:
+        path: /app-config/arr
+        state: directory
+        mode: '0755'
+
+    - name: Create checkrr subdirectory with correct permissions
+      ansible.builtin.file:
+        path: /app-config/arr/checkrr
+        state: directory
+        mode: '0755'
+        owner: '1000'
+        group: '1000'
+
+    - name: Remove old checkrr.yaml (wrong path)
+      ansible.builtin.file:
+        path: /app-config/arr/checkrr.yaml
+        state: absent
+
+    - name: Remove old checkrr.db directory (wrong path)
+      ansible.builtin.file:
+        path: /app-config/arr/checkrr.db
+        state: absent
+
+    - name: Deploy checkrr.yaml config
+      ansible.builtin.copy:
+        dest: /app-config/arr/checkrr/checkrr.yaml
+        mode: '0644'
+        owner: '1000'
+        group: '1000'
+        content: |
+          ---
+          # Checkrr Configuration for arrapps
+          lang: "en-us"
+          checkrr:
+            checkpath:
+              - /data/UHD
+              - /data/FHD
+            database: /checkrr.db
+            runOnce: false
+            port: 8585
+            host: 0.0.0.0
+            cron: "@daily"
+            ignorehidden: true
+          
+          arr:
+            - service: radarr
+              name: radarrUHD
+              url: http://radarrUHD:7878
+              apiKey: ""
+              process: true
+            - service: radarr
+              name: radarrFHD
+              url: http://radarrFHD:7878
+              apiKey: ""
+              process: true
+            - service: sonarr
+              name: sonarrUHD
+              url: http://sonarrUHD:8989
+              apiKey: ""
+              process: true
+            - service: sonarr
+              name: sonarrFHD
+              url: http://sonarrFHD:8989
+              apiKey: ""
+              process: true
+          
+          logs:
+            stdout:
+              out: stdout
+              formatter: default
+
+    - name: Create empty checkrr.db file
+      ansible.builtin.file:
+        path: /app-config/arr/checkrr/checkrr.db
+        state: touch
+        mode: '0644'
+        owner: '1000'
+        group: '1000'

dns-doh.yml

@@ -0,0 +1,6 @@
+---
+- name: DNS over HTTPS auf allen Hosts
+  hosts: all
+  become: true
+  roles:
+    - dns_resolver

group_vars/all/vault.yml

@@ -1,162 +1,178 @@
 $ANSIBLE_VAULT;1.1;AES256
-33363735653463326135306635613338363139363261663666346366616362363165626366303433
+32353937363365383536323336626630663462666532343437356361353262363063613465626465
-3065653039376539346434383066366235663239643634660a626662633936626438653063643235
+6330656638323232323131373930303030613538663062320a383135333935323165613735323365
-63343962626666643739373037626532353764323836383634373066313937366330356130646664
+32333832393637363539363936323631383362626165346664663330656434316239636261336136
-3130646436343839620a323662653634393531663139613530663635363065343630666238353037
+3164656163343039350a336364336463663936613238353734396635663238303161333464613133
-30643663346539336636366331376439653433383131353764373930326663663062663534376562
+64666333323339666231663736626334336434373662623364356230396236353335396665303135
-35656332356230633935303030313761316263663132623839386265326566663131333235333864
+34393032383132316430306231623736636234643732343338663439366135356464643165326130
-33323236663965366561366564373339646162636664366130336663383566376461356562336232
+30333737383230653031613132336362613536653531343666356533313463643930343262613864
-64626461363237363634633862363162643630353566333033313864326464326134623265633433
+32613032623430323039653962313031393033616534396263623334363635656330643232333864
-34343963306133353632323833323634653633366362613236633564366265323261323332613665
+38376336336564363030663965663366663436616133306263353236363264636236356363323138
-62663137316564353531643964336435333137373137663839653233663066303037343737326337
+37666238646461303931653931323165386164376431316234316134653765363266626262633865
-65313639363831643032646230666430303938313739316266313562613965326463643438326266
+64663932316433373238383031653937306264383666383630626362386362623234623135646562
-39353139303436653662653666663864643164326138303138386637636362373662343235636635
+66346536313165643336373663326466373337323836366437626464613361376333356664343038
-62393561376434363563643538353766646230393466653830646234333830383233316161356432
+37303632336336633264373835373735356330316535373533313265393462303332323965363338
-34323435316235396437313466363434373036613966343539303538363330356161376333343833
+36643736383132306138333432323463633164666634343633363361363337306538396636396337
-32303265353566343436313932623462333132373732343433643835386232386463663638303564
+36356137363635633231353764363332383139383262393161326463353765343334353361613963
-30353564353439353863393238386234633332396539323239393966386465313039646231323631
+34343265323837363164336632326335636563343739346263636334383666623466316430663639
-37353131396136356530353132396561623635623932333465346364343332306639326538366134
+63663162343234306666336236376163366130666131386264323730633665353238383166396263
-63366661326537393461353233616466383930343338326666646364623163663236663966643462
+36333533653537353537646661386162363034323139626431623033626134393963356137663163
-38633965636335626339613565313832343363343338353564663933636330353738656562373230
+32643762343363306631643232343532373331363464353937636636383934666566633933393234
-33346261323166346430356131356134346565383766333363303539623731376335346337666637
+62336533666163636137646661363035386364386133653166376630343264646430653236336665
-32393365636436353062653534613432373566636239316264613930366264323037353033663330
+33643966326234343766373837363736646639376330336435663832653162643231613837643435
-39616265633332366331303264656333663637316139336436303430343061646435353162313666
+35376636353530623632346239663366343362613738633431306435386462666266653138633163
-39643433633133653436393931343361613264346433306164646566383934623861363330633037
+35656335643734383164346232626338376561303232356162666432303830306262336637663761
-37353436666336386432386636353166623232636361306436326461663562666366363738353062
+37393636656632366264386237373336376239303135316534323736313437393934303561643561
-30633233396139303933363231646266383263393562383066373838336339616464663933346166
+34343362643132653730313534363466616663366530373461666336333132366664313137313239
-63376634323964623939643331626534376332633761323334643162643137623138376435363665
+39336334643939663131323932323537613030336639663261383032393235623839656464383336
-65346430656331316131656534356235356536663435636235643130396135383134313138346461
+62313931323032623530346539343536663133386633666330343437626166393539323339393932
-64376338303332633661323337313564303238353236393438656366663736313839383263313466
+62306337353433653930373662643830303335613965396433373164643437366535316165376266
-62353032636534663134633430646634353835666639653539623533326434663534653962336539
+36363264343034366139623830376530633938663038613166363462303263303465346232613663
-34393739386538663234666233353434393436626266366365316433373230666236386131313361
+65323637643162653762373261653437396130303436643766303261316362643761396536373861
-33633538616239383035336532343835333366313538306161626364343838326335336535616363
+36303761623233303161613239613863383231343865613632366339626637343465343335653738
-65323033363664633031643230653434626335643462303436326635323764663165366332636438
+36643537343131343563316334636631316665363039353639623465643661613132653739346139
-61383735663639633333343131336263663539373064303035323131303931313738373135303663
+35666332383335333363666131323332303964646134333234656632396462373062623631356463
-64323130356431316464343536613461363665366165386666663130323733623831313164383035
+30663334643134363136343039613735353964613564616435373063343235313733373765396666
-39336137613730303366386131393436316232343665623433306632373363633636373564393033
+32666130633035633936363937346266363737363762396232633033343130383131646365633732
-38633238306262666233373565396434636433346633633231663361313836343633613533613831
+36366334626233653338363963323034656435316632363264396439363633663934646363373566
-30666639666234656434666332313962333465356632626531326264663631373935386534323466
+38303662643730353462653664646265373030333837623031343432313866356363356465373330
-38323931653734626533663834646534313364386561623561303839383235643835666232383563
+33313839633939666639666165393633333366633335346536346332333134646462613433306164
-30383764373932666162623634333536646437386162666161633238343162396563316132373530
+39353361323463306338623461383939383835343261363538346166306436343132666265313364
-64356661613632333839316136636232666337633964613238356134356236656630616232323966
+36623631636261623237333336633534613430383139313465363436356631666365346662333533
-63643363326364336432306364326435323437336535626165396632336537626435663265363633
+32336363636466343639393237333530333763643966323866396366333363633636366330633536
-35306134613437306432396664633137616534633739396531636539363864326134656266613535
+63333238326230366565366430653932646532343736303735643363643631303439313936383532
-38366232646137383762636265343531333162356165663137326162663066316331313139393364
+30666338333334646334613939336632643236616137346661343366366263373733303131353065
-33326661616135313432653732653633313736383238666439626265346632663539396464653038
+31383732373432393363333162666333326131633131356431383135373634313139363032643763
-32626431373966626437666261623535323333376330363861393633316335313465363065386565
+64343537393966316664653932616161353465316232316330343836656232396637323564643932
-35313130633335343033663733393361343163376339353136646337636665633161363833326664
+37373434356366373235303430396332306430376465373365643433333431356263306234386465
-35303762393530613033343163393732633235306162636337616264366164366662336665396264
+30363037646139323566363539376463323061303131633862636535303932356131353962643935
-65366362373134396539663964343635643462306561366138313735623832636437343364303336
+34653232366363333833616462623537356666356330383538386363333631623463373764313432
-64666261386431616537373063386431643461636535626637326131363933313163373961336639
+63643132373136636437653865653435643834613263336338326236306536306261353264616166
-64633231633361613662396462323635333131363031616163393262346236303734656439353164
+31316332383733373734326336643563663133363433326137663730323364333564336131306532
-39376461353035326562653362316231623633666336656362653234393337663031353638363233
+61313965633436333836626431333834383636363336623130326636383761313139636436333334
-39323433373839663930623336623065613562633433313464656333323431306461636366303637
+34613739326163666337636634303561323764343661373961393737303139663163656138633431
-32383236626536333562363861323166313837336338653834376362643734666663656262633236
+61363163336530646561636366383665663861633231653837646564626333383031623135633065
-35663439373337336265626136656465613230626135313334363264623366323938383434656431
+37653061613437313262363639383331643034643135356634643033336164626131346634346635
-37636334376164643438353633633136616563636362643135666161343938366362336362626162
+63316364363237393165313834656130643733333636343862333664663863326161323535343335
-36303262356231303031616363656335663935353064316463613936366166623838316561623165
+66623539346433373065323236333461323937333966356165643131363331313030306135336565
-61303936363065373331613362353130656362313736336539636462653864376432356238653836
+62313762323332303937323630343733393535396434636138626131626564623966396464386564
-33393436623361616431623461656430363932636531363730666565613235393639626535366565
+64663034663438306636316139376166363266373034383338633265623861633733353663363165
-37393564353333656332303733643861653563353166623561386661356366393833643033666330
+31393132626436636231316266386631323738656161646437333331313338353263363935643765
-64613838306530383232653866356538333966643365393936316662616564353738623332316364
+34396166323035363236366237313161633033306232643632366531653962636236343930343730
-36633730636537373764643130363335643038366265623965613530623534316461653865363135
+33363439343632656234653631643339386565656466396231623265343962656336303139336163
-38663236376536356561323139666566363733356639653035393263363634396333306336623566
+38616461356661636139393863613564626461363265316435306634656436386133626463326430
-66313433366461303432373565656431336666346363633836316131343061613230653034343366
+35303130623735646662663535666265353531643364643965653630626334333232336132633031
-62633534353834396536643437363239393032663731613933646536623534396234343130666335
+34613231323739333637356633623165396539623237623763656432393864333163386363383435
-38356435613636306234333433306632343461643531383931313438616461306136363665386139
+39333063363066383231656562336238376164396465623232316334643961363663623131313934
-36363736376462336463643364626130636364643834386164636630366436366439373739386666
+62363738376265303238336465353630643837396231343264653336613366353839383037646535
-34353866633764663039326639656436353663376463303363363835336630653332376339376439
+30373232346236353830636366353764613862383666656366613531343331353461663963323666
-37346337623261333030633532616366343436653337386136303431633264666136613432383337
+33396132373838363035613564346463303237326532336131336434373737366566346330656466
-39353039373934393836636361643839626132383636663766666265316534656562633232303430
+63663339313630393866326534303932336530386538363533646166376436323835333666653835
-34353266343530333261386139636166656165366666323735373065353339363039636262373434
+65373266333039343963336630336332323137313263663331356139323465366461393362303338
-39376437333339626237636335383762613761653062636366393465376561653639623332393736
+35303066396639346435663632333138373938656330613930303034616661633737353164383430
-33313236326564616437633034333833333461643336353339626639646631306632376133306263
+35633065663166643939316565343639386634356233633133366538306635303936376163393235
-37326462643863373436656662306266633633643133663064616639303062373939346366393164
+36353035653531653038633965663837613036316136396131646537316561653264336636386434
-31303732656436383439623462633566633763356663643937343431626234656638396461363062
+35656561626236633034633037653838363439633163353062393736616330393938653038306631
-62633039663237613237663965393861343537646634623633396531383430376133633338383035
+32666664363233623965343132656561336364623334616633623135356136366638393031663135
-61353736313138656366343139316133363265386466356430656133346439636462303431393132
+65356339663266613032343536646135356433633339393538393439323136313766323665306431
-34636436366435363531653463353634376232363331656530393665376363343339623337373737
+62383862383735623232346630333439663836343261646534373437643437653065323632303930
-61316132616566643665303934396364656265316462303834393165653238656232613963336635
+31386661373632326663653064373635373134363035356637346133313636613466336431336564
-36633363373966616163643563393532303466643763666532396138383837643664303662396162
+33636666333031653165373139373438386165363732643130336164303161326663393464356233
-37323932623935373761653066343465393262373130626536613030383630323534333434656638
+37316533373866383632633439303466346462626232346337653065306330663963343864343336
-37346163376130363739636663666438373837303961313163613935666136303063616665363931
+39613032666462363432643634396232643863336262643830386365636638393263336436666130
-36306138383634333433333061393930383861346330613438663838643966613134613839336232
+61343630643362373865393530376433636236396537653363353566376331383131396666623332
-64313834316663396236393531653139336238376433623466653538343766656462613635313639
+38623765366231386338333265373730633734386232633964323765396439383166633938656566
-66336666663432663264323732333035373636633139336566656231663932393436393232373530
+63333532306233356130323264326232333462333366343962383166613535343464376135373432
-63373564353765323930356633306262333639313162333730636562373333613538656462653164
+30306261376436383032323862666538303530626266386233343339383263313761613932346531
-38626336323937333632626135333836316238313433653462356666636565666438623139626635
+30663666363630326534323865323330316538656332393635366661636139663334373438386137
-35383835613135376663643837376466363739356635343432643830396239373963353564356631
+32316239393630636431306562636131643663333866316565366532373165343234653065643963
-62333837626164643465333062626437653231653665313631303163643239393563363763653839
+34626338373265653336306163633432666132326139646363353734393461303232386637366261
-33356261616530363337313763373833623661396336303937663339616131646139333162356235
+63353034373733366234653462623935396164343166343466393565376639366236323334376631
-39653830303061626262666533643937646137653764363432666263653839363132336366643236
+65373466616165653735373030616535303765643638333135393537303834656561373437636534
-66363434343561343730343432636437396439343231613736353135366436666437646238393439
+61336139666164383465343935666437313161383738303335323033316637663165653465353062
-62643561363133316333386334393434313162613438373561373032393661656431313031356232
+62636339373332626264396261656633346638396237633830616261383235396636303366623239
-33353933393638366139323330306536333038623631393439623432383831653163626631336362
+63383639633831613062613936666434643265313435613561356137343762393435613563643465
-65313832633863643135633962626265363331623163666666373233393937646562383863343436
+64363065343331353633653339356539373731613963303963383936346231633666653433343835
-63663535346233363762316461303730623965353130616134643031396438646634663632313162
+62346461316539626232656635633738633861323238356338653463303632353136303232653735
-31336566386435666661373533393534613735633437656336303862343234316437613262353235
+61623461656330343061363061643335373939356531373861316562326364313135376633613633
-64336438353564373230663964346637363532313262666334353039633662653663633038623163
+37376130613435356636346137643336393531393936613139663230343134393737363564356232
-39633533383635366466633137396565373138303736353936613465393238633864383761316639
+64316464626436353764316262623663343631626638353730386432666161616162633135363463
-35366466366465316136313233336134363463323966636134353135306435323533303865353062
+36343631383935393433636461643663396231623233303634666261303638646430653435613237
-32383739396533353236376363306364343932303566353835646130646361376335336438643339
+39363565363665343832663337323865373962356466616162303536653361613235333762343430
-63376337626532663163323762623232666166653935633035313964356438663136353335386665
+30373036363234373838333365373535623865373437643664393036343966373330663135633434
-30613164613337326164373132616562393038613134373863643633303465336466653331633964
+64366662643039666438333239653165623132386232386537353233666133373563323833316661
-33616666623935643264313533373662373838653739386536316135323737653934386438356435
+38366261343363633664356266323264656139393336383562316333616333663963323565373363
-39646632353330303065343733626461386430363734383031386631306435383038373561373935
+37303034613137306463633565353334373037643465303265373136393530306461643430343863
-38373466303738326337376130343631333833313932353337363332643235636262393564383363
+63626131663963383864623036646666663561613733663230353266313734636433323935303134
-63356335613638663536303539643234633338346665386539656636653964303536396438313861
+30383363373937326130633233316264643266386331623965313036613531323536653837333066
-35316562383230646365656466616635313061326566373937353438316435613430313266393830
+39396638386464663034323139636465313432393535333834636637343838356366396463633034
-31306636393239363837346430666163653231333831336433373462376538656534336639313965
+36356639643735636363653965356130653336386336313835316237396466313232663038306531
-35383465326161336237333466376461323263353933646664336163353636396165383261316638
+36373935646432353930313863643033346235373236626266373839626639373463303961633465
-61303730656562393661626134356365323936323334373634383831393130383162313833653162
+33343931353932336333343239663066346363616337343933393930383463396436656663353863
-37616136666263353164333738363135313832376337336234353362656465663031663865633662
+31356533343836323736653635326565386537376262663265626630663061383736356262323234
-62663563313835633965376665333933636639326137376436343865356239356232316262393066
+65646161623861333934323536616266366539333332616466663239333634646539656335383231
-31623239616532343338333037323835383732643933396334623432643336646130336436326565
+31336436386538393130393162383361646132643839316338306466306561393534623964373964
-65303638653434366437316530633361383066356338363736343266636165306365336338323137
+66333034336436383831633164356165653866663630353634313464323438373734663662656638
-36383364393762643938643263303532386263323766376136666531633635356665613133313766
+35333838346336323439356636333932343536366334666530656235303436666633333739636664
-33366563663161653531373865636232386330303638626332623637616133376433386364323063
+36323161373830366365323164306266643139336139376435613435353061613464366333356661
-64353632303365616266343933366161613533333865373835303136363133653464656536623435
+38316133636437653036373437646661376563636264646166346137396230663234666562343936
-34393136363661383432366161326564636634376664336632326439303862383832363861306135
+34373166336665666432373665613566643661383862366133653931623462626139633164343465
-32343636383366616133343637616432383965323434626165626337643036613037326234356463
+31306666376432623861336130316463616161663034623138396562333932666338666238313362
-63653734396261373164663165323436363336363034646130316330363764396536646433356562
+30653134666661333938306633366431633166643839623532323766623438376364366666643830
-34373936393636393730336433633037623065636339653432343564376233373535633231343961
+64343661346635343566656562303661316163303766633734666330633535656164393330643064
-64613662323336386361376264646333303362656265663366306664326337326663663432333136
+36386461633935343533316662393362306262636430306136313365633564343931633736363466
-65636263636166356335343034346631386337323461336164623839653738666337383565653161
+64653939313730396430666266366437303933353337656334643761386631376635346562633364
-63326366393034353866343037393333363838616363666132353239393866613232396462343166
+34326636353765663430613539316531616235323663653530616538346536613932343237316564
-30326162343632616135346534366561353039323361333764633833646466323439373530366539
+38336630656634396531393763396266656533346136326532646532643662393563343638303938
-38323138653437623436313931663930353134613130613962643263313131353433316533613032
+31653131313162353464313635613133333931383838323433666332323537316235666261626166
-30323333363162326239326531663266326666613835363836383965316136356231313332383361
+62636635326531376335303162636631646132346133363539376661636263393239303133323638
-36663135653963326530623532666564623737326435616466656431323539313064393034616130
+66313435623531643833333131616138646434363563376264396131316239303331646630623062
-62376463306234636362616663323362393464353930383439666134383731323637643739613937
+30333034353339393033636462336138666265373333333866313535643930326437356430623037
-38643130396466623533383839623161343431323563373866386465303035366330646336326633
+35343839626334323134653063623566663965333339313338323661666161373438616262663235
-34303664613736323963663838346633613831653265316430353233363464356663323661336234
+66663965333937383262336636323163633666373538646166323533343162656463333764333766
-36316536633130643662623939333836333837643466616236316439623465323761633031623565
+34643464356634363837373835663938306561336662633635623063613462323235303161653430
-31346437323239613663356234353930343737343233393532666638346637336137323034613036
+38646330396463366365643830353832616334616331643535306365613664346339366164656231
-33363535303562366562646463653339326336326666303233316238323833313865666334356663
+35313132323530343337343938366361656165643062633836363162323130643237386162643366
-32376233393166373563363766313237616137386566353863393734323166343761353338343538
+65326635636531663934346434313365626436656632613737616362323737363066346365393336
-65633630303038303635653336376661303166623232346564313035623239656433626434323733
+35663037646434356461633764376162343937323061396461663162346162366434333733303764
-35346662633734393161303836633236376634303437366339613139656534303433353666643135
+61343538343135303438616433336230653862346330376638303463303430353836666137396361
-65643334383538306666616665386536303463323933623364633262396432346437336363346335
+36313665613631656139396230353062313038346536633430316537393764383966336336616465
-34666331623732643666313835306134653961373865373435623361363236393833383062303136
+63376432663431626265613664323838363834323363306630303361646134643435313262373536
-63353238663864613634326330363131376334353132326434393538316562666238386238353533
+35313163653135633531636138386237343831353964333261396466396364323539393932353336
-63666533303534616661623165643965613630646231323230306264306165643236613666366333
+37383564613662383738666137653335656232393833353765396637373932616238383138316134
-35653562376537636234373834613065313836636230306438633265303037306535326164633564
+30623637633038343366353063346132373136393431363538373337616430353633663063346634
-33346666366637383232613265643261623864333034643735653961613437313761383934633261
+30313138353462303138616633356233316137333865653932363439626335336630313461636439
-33313163326263646434323365316164363466316364393130333734616562353063356562373138
+39313566326134346261343861633134643765623138363630306138636362336231633132666464
-39326630626133396338366539373666303334323634343962623531393664653866323436653139
+61643562636161666262646565663063303332656435636333333430376163386664343333306537
-31326464343566383562336130616462346135343931343663373836643434346331616465353038
+61393730353762353435393433633766396539653833393265376639353732353638343064356238
-34333161373461353765336339323830356265663865626634616466313965623663663664653733
+30333436646632353437666433306431353139323161666133626439336433636361623536613865
-30323230336562303535366138356337373038363864383631313333386165383138643866636463
+31373964386661313030613865303461313331626438623031646461333937373238636131396363
-61316230396531616333373037646165653431363464393236313463343936313533363665616366
+37623735613264386137663537626531623335613735623136363965386238626130333836323933
-66353539393135306135363664346630356462313932353166313635336638363137366438353964
+61643861623334353662346363643133336136383935363862626232303361626132353834633938
-31323632326638363431356234653262656539326262313563316631343636643339326130373330
+33653039643932376564343636313462343032343266303461313964373836306337626466373831
-32326163616332623862343734326432333865626432653736346565613832616438386331323439
+65333834646538666366636438356566333739623536633438626438343738646264323466333135
-62626332366261646539646631336466396135363033373735303663366162656636663664653963
+38633065353163303532393265386165613838343962333866376664646165343661323764393639
-31363036336637626563336138336161333032336535653462316639383761386436386138373637
+65326361313736336261306466306333393366356538623066383938323135336461366338313465
-35666534336237366139393039333235326662653337626435396131363837383933653632333634
+34663837336163316162616166303935656465363633616334653731353436666633386535343262
-32663037623534373737656265633530663933356563343262356234343363343437313135306132
+30393231343361653631633531306336383661346362646633663761326166376462343732616139
-39353134373733323430313736653239653531373333343632373133363534616561343731353832
+37363631663963383731646439656331633237663862336531613234643337646230386561623232
-37353235653134346138313830336566633732346135356339333637643166643866353832306630
+30623033643165353366336232633332303931373432653030326337616366636133313265333137
-33356432326466343166373132376339313338623761326338646163383664313237346135613261
+36633662613939343330306538303461326332353930386632636531323162336534376136393065
-39393636646530343636376638666234363562356365626366666536376566643339346135623736
+65616139356465656539366265646238353239313133333262376665376463653733616436643038
-66633265303733656633623232303330333161616563393034333633613237646663
+33356364333765393033376637653031373835373534646165613361303463396165393534623662
+34333031353334303739643961663033346139393931653036613766376130383961656237353531
+65326239616663383537613835303266366637613738613862643263376132343830383636366630
+64633437626163393733313035653330633166396133393162303562663832653036666165336463
+32636330383837386139613630316430373037366236343932633661633939653138303135363264
+32616336656330383235616234653339323062646634646335356333663535373430616462383536
+64393337306438636361333937323835393036376235373261653438366634313364643236663065
+38393264613566303434313038666638333337643835643232373362316330383335333765356435
+37323831336239623130653632353330333934643161306534656465346463366236363566656537
+63616662363937633536343033366135343666356531616538623064333634643166386132383534
+65666465316236326361313737333835663266373634366435613231343835333366323737316634
+34373631396133393431396466613661663632626330663666633963313436363134303764373934
+64653633323132616439626330623965386536343639396631626464653662393138323338663732
+33623731366538346331663761363237323239323633666630623666663333356631386638303239
+36303664306666313361656634336339653035666236336239333566386137323532356336666161
+38323463663631326332316638303666356634373739343238386530376333656363343733336138
+3133

hawser.yml

@@ -1,6 +1,6 @@
 ---
 - name: Hawser Setup
-  hosts: all
+  hosts: hawser
   become: yes
   roles:
     - hawser

host_vars/emby-sascha/frp.yml

@@ -4,3 +4,7 @@ frp_proxies:
     local_ip: "0.0.0.0"
     local_port: 8096
     remote_port: 18096
+  - name: jellyfin
+    local_ip: "0.0.0.0"
+    local_port: 9096
+    remote_port: 38096

host_vars/gluster-n1/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.1.1.135
+ansible_user: sascha

host_vars/gluster-n3/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.3.1.135
+ansible_user: sascha

host_vars/gluster-n6/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.6.1.135
+ansible_user: sascha

host_vars/k3s-control/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.3.1.110
+ansible_user: sascha

host_vars/k3s-worker1/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.3.1.111
+ansible_user: sascha

host_vars/k3s-worker2/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.3.1.112
+ansible_user: sascha

host_vars/k3s-worker3/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.3.1.113
+ansible_user: sascha

host_vars/kometa/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.5.1.115
+ansible_user: sascha

host_vars/node1/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.11/24"
 wireguard_private_key: "{{ vault_node1_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/node2/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.12/24"
 wireguard_private_key: "{{ vault_node2_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/node3/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.13/24"
 wireguard_private_key: "{{ vault_node3_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/node4/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.14/24"
 wireguard_private_key: "{{ vault_node4_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/node5/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.15/24"
 wireguard_private_key: "{{ vault_node5_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/node6/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.16/24"
 wireguard_private_key: "{{ vault_node6_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/node7/wireguard.yml

@@ -1,4 +1,4 @@
 ---
 wireguard_address: "10.200.200.17/24"
 wireguard_private_key: "{{ vault_node7_wg_privkey }}"
-wireguard_allowed_ips: "10.200.200.0/24"
+wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24"

host_vars/paperless/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.5.1.120
+ansible_user: sascha

host_vars/satisfactory/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.3.1.120
+ansible_user: sascha

host_vars/thelounge/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.5.1.117
+ansible_user: sascha

host_vars/wolfstack-vm/vars.yml

@@ -0,0 +1,2 @@
+ansible_host: 10.1.1.110
+ansible_user: sascha

id_ed25519.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPl/Zptf1zTIgIv01zekT3SqdJfDR10vfTljP1QvHwez sascha@proxy
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026

iso-builder/build-iso.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e
+#set -e
 
 # ============================================================
 # Debian Unattended ISO Builder
@@ -20,7 +20,7 @@ DNS="1.1.1.1"
 HOSTNAME="debian"
 USER="sascha"
 PASSWORD=""
-SSH_KEY_FILE="$HOME/.ssh/id_ed25519.pub"
+SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026"
 OUTPUT_DIR="$SCRIPT_DIR/output"
 NODE=""
 VMID=""
@@ -49,7 +49,6 @@ Optional:
   --hostname NAME      Hostname (default: debian)
   --user USER          Username (default: sascha)
   --password PASS      Password (will be prompted if not set)
-  --ssh-key FILE       SSH public key file (default: ~/.ssh/id_ed25519.pub)
   --output DIR         Output directory (default: ./output)
   --debian-version VER Debian version (default: 13)
 
@@ -80,7 +79,6 @@ while [[ $# -gt 0 ]]; do
     --hostname) HOSTNAME="$2"; shift 2;;
     --user) USER="$2"; shift 2;;
     --password) PASSWORD="$2"; shift 2;;
-    --ssh-key) SSH_KEY_FILE="$2"; shift 2;;
     --output) OUTPUT_DIR="$2"; shift 2;;
     --debian-version) DEBIAN_VERSION="$2"; shift 2;;
     --node) NODE="$2"; shift 2;;
@@ -126,13 +124,7 @@ if [[ -z "$PASSWORD" ]]; then
 fi
 PASSWORD_HASH=$(echo "$PASSWORD" | openssl passwd -6 -stdin)
 
-# --- SSH Key ---
+echo "SSH key: pfannkuchen-20260408"
-if [[ -f "$SSH_KEY_FILE" ]]; then
-  SSH_KEY=$(cat "$SSH_KEY_FILE")
-else
-  echo "Warning: SSH key file not found: $SSH_KEY_FILE"
-  SSH_KEY=""
-fi
 
 # --- Download Debian ISO ---
 ISO_URL="https://cdimage.debian.org/debian-cd/current/${ARCH}/iso-cd/debian-${DEBIAN_VERSION}.*-${ARCH}-netinst.iso"
@@ -233,7 +225,7 @@ echo "Host:     $HOSTNAME"
 echo "IP:       $IP"
 echo "Gateway:  $GATEWAY"
 echo "User:     $USER"
-echo "SSH Key:  $(echo $SSH_KEY | cut -c1-40)..."
+echo "SSH Key:  pfannkuchen-20260408"
 echo "============================================"
 echo ""
 if [[ -n "$PVE_HOST" ]]; then
@@ -244,7 +236,12 @@ if [[ -n "$PVE_HOST" ]]; then
 
   if [[ "$CREATE_VM" == true ]]; then
     ISO_NAME="$(basename "$OUTPUT_ISO")"
-    STORAGE="powerstore-node${NODE}"
+    # Storage Logic: PowerStore for 1,3,6,7 / LVM-Thin for 2,4,5
+    if [[ "$NODE" =~ ^(1|3|6|7)$ ]]; then
+      STORAGE="powerstore-node${NODE}"
+    else
+      STORAGE="lvm-thin"
+    fi
     PVE_NODE="node${NODE}"
 
     # Auto-assign next free VMID if not specified

net-watchdog.yml

@@ -0,0 +1,5 @@
+---
+- hosts: automation1
+  become: true
+  roles:
+    - net_watchdog

patchmon-agent.yml

@@ -0,0 +1,29 @@
+---
+- name: PatchMon Agent (Docker-VMs)
+  hosts: hawser
+  become: yes
+  roles:
+    - patchmon-agent
+
+- name: PatchMon Agent (Proxmox Hosts)
+  hosts: proxmox
+  become: yes
+  tasks:
+    - name: Prüfen ob patchmon-agent bereits installiert ist
+      ansible.builtin.stat:
+        path: /usr/local/bin/patchmon-agent
+      register: patchmon_bin
+
+    - name: Prüfen ob Agent bereits enrolled ist
+      ansible.builtin.command: /usr/local/bin/patchmon-agent ping
+      register: patchmon_ping
+      changed_when: false
+      failed_when: false
+      when: patchmon_bin.stat.exists
+
+    - name: PatchMon Agent installieren (Auto-Enrollment)
+      ansible.builtin.shell: |
+        curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh
+      args:
+        creates: /etc/patchmon/credentials.yml
+      when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0)

remove-postfix.yml

@@ -0,0 +1,30 @@
+---
+- name: Disable postfix on all hosts
+  hosts: all
+  tasks:
+    - name: Check if postfix is installed
+      ansible.builtin.command: which postfix
+      register: postfix_check
+      changed_when: false
+      failed_when: false
+
+    - name: Stop and disable postfix
+      ansible.builtin.systemd:
+        name: postfix
+        state: stopped
+        enabled: false
+      when: postfix_check.rc == 0
+
+    - name: Set postfix to localhost-only
+      ansible.builtin.lineinfile:
+        path: /etc/postfix/main.cf
+        regexp: '^inet_interfaces\s*='
+        line: 'inet_interfaces = loopback-only'
+      when: postfix_check.rc == 0
+
+    - name: Set relayhost to empty
+      ansible.builtin.lineinfile:
+        path: /etc/postfix/main.cf
+        regexp: '^relayhost\s*='
+        line: 'relayhost ='
+      when: postfix_check.rc == 0

roles/base/tasks/main.yml

@@ -9,11 +9,19 @@
     regexp: '^127\.0\.1\.1'
     line: "127.0.1.1  {{ inventory_hostname }}.local {{ inventory_hostname }}"
 
+- name: Prüfe ob Benutzer {{ base_user }} existiert
+  getent:
+    database: passwd
+    key: "{{ base_user }}"
+  register: base_user_check
+  ignore_errors: yes
+
 - name: SSH Public Key für Benutzer {{ base_user }} hinterlegen
   ansible.posix.authorized_key:
     user: "{{ base_user }}"
     state: present
     key: "{{ vault_ssh_pubkey }}"
+  when: base_user_check is succeeded
 
 - name: SSH Private Key für Benutzer {{ base_user }} deployen
   copy:
@@ -22,6 +30,7 @@
     owner: "{{ base_user }}"
     group: "{{ base_user }}"
     mode: "0600"
+  when: base_user_check is succeeded
 
 - name: SSH Public Key Datei für Benutzer {{ base_user }} deployen
   copy:
@@ -30,6 +39,7 @@
     owner: "{{ base_user }}"
     group: "{{ base_user }}"
     mode: "0644"
+  when: base_user_check is succeeded
 
 - name: SSH Key auch für root hinterlegen
   ansible.posix.authorized_key:
@@ -85,24 +95,28 @@
     name: locales
     state: present
 
-- name: en_US.UTF-8 Locale generieren
+- name: de_DE.UTF-8 Locale generieren
   locale_gen:
-    name: en_US.UTF-8
+    name: de_DE.UTF-8
     state: present
 
-- name: Systemweite Sprache auf en_US.UTF-8 setzen
+- name: Systemweite Sprache auf de_DE.UTF-8 setzen
   debconf:
     name: locales
     question: locales/default_environment_locale
-    value: en_US.UTF-8
+    value: de_DE.UTF-8
     vtype: select
 
 - name: Locale-Datei manuell schreiben (Sicherheitsnetz)
   copy:
     dest: /etc/default/locale
     content: |
-      LANG=en_US.UTF-8
+      LANG=de_DE.UTF-8
-      LC_ALL=en_US.UTF-8
+      LC_ALL=de_DE.UTF-8
+
+- name: Zeitzone auf Europe/Berlin setzen
+  timezone:
+    name: Europe/Berlin
 
 - name: Gruppe sudo passwortloses sudo erlauben
   lineinfile:
@@ -117,6 +131,7 @@
     name: "{{ base_user }}"
     groups: sudo
     append: yes
+  when: base_user_check is succeeded
 
 - name: Unnötige Pakete entfernen
   apt:
@@ -126,9 +141,11 @@
   apt:
     name: qemu-guest-agent
     state: present
+  ignore_errors: yes
 
 - name: QEMU Guest Agent aktivieren
   service:
     name: qemu-guest-agent
     state: started
     enabled: yes
+  ignore_errors: yes

roles/borg/templates/borgmatic.yml.j2

@@ -28,8 +28,27 @@ before_backup:
 
 after_backup:
   - curl -fsS -m 10 "https://status.guck.tv/api/push/borg-{{ inventory_hostname }}?status=up&msg=OK&ping=" || true
-  - curl -fsS -m 10 "http://10.1.1.111:9999/push?host={{ inventory_hostname }}&status=ok" || true
+  - >-
+    bash -c '
+    STATS=$(borgmatic info --archive latest --json 2>/dev/null | python3 -c "
+    import sys,json
+    d=json.load(sys.stdin)[0][\"archives\"][-1]
+    s=d.get(\"stats\",{})
+    print(json.dumps({
+      \"host\":\"{{ inventory_hostname }}\",
+      \"status\":\"ok\",
+      \"duration_sec\":int(s.get(\"duration\",0)),
+      \"original_size\":s.get(\"original_size\",0),
+      \"deduplicated_size\":s.get(\"deduplicated_size\",0),
+      \"compressed_size\":s.get(\"compressed_size\",0),
+      \"nfiles_new\":s.get(\"nfiles\",0)
+    }))" 2>/dev/null || echo "{\"host\":\"{{ inventory_hostname }}\",\"status\":\"ok\"}");
+    curl -fsS -m 10 -X POST -H "Content-Type: application/json" -d "$STATS" "http://10.1.1.111:9999/api/push" || true
+    '
 
 on_error:
   - curl -fsS -m 10 "https://status.guck.tv/api/push/borg-{{ inventory_hostname }}?status=down&msg=FEHLER&ping=" || true
-  - curl -fsS -m 10 "http://10.1.1.111:9999/push?host={{ inventory_hostname }}&status=error&msg=Backup%20fehlgeschlagen" || true
+  - >-
+    curl -fsS -m 10 -X POST -H "Content-Type: application/json"
+    -d '{"host":"{{ inventory_hostname }}","status":"error","message":"Backup fehlgeschlagen"}'
+    "http://10.1.1.111:9999/api/push" || true

roles/dns_resolver/handlers/main.yml

@@ -1,3 +1,5 @@
 ---
-- name: update resolvconf
+- name: restart dnscrypt-proxy
-  command: resolvconf -u
+  systemd:
+    name: dnscrypt-proxy
+    state: restarted

roles/dns_resolver/tasks/main.yml

@@ -1,24 +1,16 @@
 ---
-- name: Set DNS resolver (resolvconf)
+- name: DNS resolver auf DoH setzen (via automation1)
   copy:
     content: |
       nameserver 10.5.85.5
-      nameserver 1.1.1.1
-    dest: /etc/resolvconf/resolv.conf.d/head
-    mode: '0644'
-  when: ansible_facts.packages is defined and 'resolvconf' in ansible_facts.packages
-  notify: update resolvconf
-
-- name: Set DNS resolver (direct)
-  copy:
-    content: |
-      nameserver 10.5.85.5
-      nameserver 1.1.1.1
     dest: /etc/resolv.conf
     mode: '0644'
-  when: ansible_facts.packages is not defined or 'resolvconf' not in ansible_facts.packages
+  when: inventory_hostname != 'automation1'
 
-- name: Gather package facts
+- name: dnscrypt-proxy stoppen auf VMs (nicht noetig)
-  package_facts:
+  systemd:
-    manager: auto
+    name: dnscrypt-proxy
-  when: ansible_facts.packages is not defined
+    state: stopped
+    enabled: false
+  when: inventory_hostname != 'automation1'
+  ignore_errors: true

roles/frp_client/tasks/main.yml

@@ -31,7 +31,7 @@
       serverPort = {{ frp_server_port }}
       auth.method = "token"
       auth.token = "{{ frp_token }}"
-      transport.protocol = "quic"
+      transport.protocol = "tcp"
       transport.poolCount = 5
       transport.tcpMux = true
       {% for proxy in frp_proxies %}
@@ -43,8 +43,6 @@
       localPort = {{ proxy.local_port }}
       remotePort = {{ proxy.remote_port }}
       transport.useCompression = true
-      transport.bandwidthLimit = "{{ proxy.bandwidth_limit | default('6MB') }}"
-      transport.bandwidthLimitMode = "server"
       {% endfor %}
     mode: "0600"
   notify: restart frpc

roles/hawser/tasks/main.yml

@@ -1,14 +1,44 @@
 ---
-- name: Hawser installieren (offizielles Install-Script)
+- name: Hawser installieren
   ansible.builtin.shell:
-    cmd: curl -fsSL https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh | bash
+    cmd: |
+      ARCH=$(dpkg --print-architecture)
+      VERSION=0.2.39
+      curl -fsSL "https://github.com/Finsys/hawser/releases/download/v${VERSION}/hawser_${VERSION}_linux_${ARCH}.tar.gz" | tar xz -C /usr/local/bin hawser
+      chmod +x /usr/local/bin/hawser
     creates: /usr/local/bin/hawser
 
+- name: Hawser config Verzeichnis
+  ansible.builtin.file:
+    path: /etc/hawser
+    state: directory
+
 - name: Hawser Token in Config setzen
   ansible.builtin.lineinfile:
     path: /etc/hawser/config
     regexp: '^TOKEN='
     line: "TOKEN={{ vault_hawser_token }}"
+    create: yes
+  notify: restart hawser
+
+- name: Hawser systemd Service
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/hawser.service
+    content: |
+      [Unit]
+      Description=Hawser Agent
+      After=docker.service
+      Requires=docker.service
+
+      [Service]
+      Type=simple
+      EnvironmentFile=/etc/hawser/config
+      ExecStart=/usr/local/bin/hawser
+      Restart=always
+      RestartSec=10
+
+      [Install]
+      WantedBy=multi-user.target
   notify: restart hawser
 
 - name: Hawser aktivieren und starten

roles/net_watchdog/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+watchdog_iface: "ens192"
+watchdog_subnet: "10.5.85.0/24"
+watchdog_cron_interval: "*/5"
+watchdog_webhook_url: "{{ vault_watchdog_webhook_url | default('') }}"
+
+# Bekannte Hosts im Management-Netz (MAC|IP|Name)
+# Bei neuer VM/Host: hier eintragen + ./pfannkuchen.sh watchdog
+watchdog_known_hosts:
+  - { mac: "c8:4f:86:fc:00:09", ip: "10.5.85.1",   name: "Gateway/Switch" }
+  - { mac: "00:11:32:45:79:28", ip: "10.5.85.10",  name: "Synology NAS" }
+  - { mac: "00:50:56:9a:24:35", ip: "10.5.85.5",   name: "automation1" }
+  # Proxmox Nodes
+  - { mac: "e4:3d:1a:3c:62:9a", ip: "10.5.85.11",  name: "node1" }
+  - { mac: "00:1b:21:de:10:95", ip: "10.5.85.12",  name: "node2" }
+  - { mac: "e4:3d:1a:3c:57:6c", ip: "10.5.85.13",  name: "node3" }
+  - { mac: "2c:ea:7f:a8:a5:9f", ip: "10.5.85.14",  name: "node4" }
+  - { mac: "2c:ea:7f:a8:a9:3f", ip: "10.5.85.15",  name: "node5" }
+  - { mac: "e4:3d:1a:3c:3f:a8", ip: "10.5.85.16",  name: "node6" }
+  - { mac: "e4:3d:1a:3c:88:da", ip: "10.5.85.17",  name: "node7" }
+  # Kubernetes VMs (shared MAC = normal bei Proxmox VMs auf gleichem Node)
+  - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.101", name: "kube-work1" }
+  - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.103", name: "kube-ctrl" }

roles/net_watchdog/tasks/main.yml

@@ -0,0 +1,18 @@
+---
+- name: arp-scan installieren
+  ansible.builtin.apt:
+    name: arp-scan
+    state: present
+
+- name: Watchdog Script deployen
+  ansible.builtin.template:
+    src: net-watchdog.sh.j2
+    dest: /usr/local/bin/net-watchdog.sh
+    mode: "0755"
+
+- name: Cronjob einrichten
+  ansible.builtin.cron:
+    name: "net-watchdog"
+    minute: "{{ watchdog_cron_interval }}"
+    job: "/usr/local/bin/net-watchdog.sh --quiet"
+    user: root

roles/net_watchdog/templates/net-watchdog.sh.j2

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Network Watchdog – generiert von Ansible
+# Scannt {{ watchdog_subnet }} auf {{ watchdog_iface }} alle {{ watchdog_cron_interval }}
+set -euo pipefail
+
+IFACE="{{ watchdog_iface }}"
+SUBNET="{{ watchdog_subnet }}"
+LOGFILE="/var/log/net-watchdog.log"
+WEBHOOK_URL="{{ watchdog_webhook_url }}"
+
+# Whitelist (generiert aus Ansible defaults/main.yml)
+declare -A KNOWN
+{% for host in watchdog_known_hosts %}
+KNOWN["{{ host.mac }}|{{ host.ip }}"]="{{ host.name }}"
+{% endfor %}
+
+QUIET="${1:-}"
+
+log() {
+  local msg="$(date '+%Y-%m-%d %H:%M:%S') $1"
+  echo "$msg" >> "$LOGFILE"
+  [ "$QUIET" != "--quiet" ] && echo "$msg"
+}
+
+SCAN=$(/usr/sbin/arp-scan --interface="$IFACE" "$SUBNET" 2>/dev/null \
+  | grep -E '^[0-9]+\.' | awk '{print $2"|"$1}')
+
+UNKNOWN=""
+ALERT_COUNT=0
+
+while IFS= read -r line; do
+  [ -z "$line" ] && continue
+  mac=$(echo "$line" | cut -d'|' -f1)
+  ip=$(echo "$line" | cut -d'|' -f2)
+  if [ -z "${KNOWN["${mac}|${ip}"]:-}" ]; then
+    UNKNOWN+="⚠️ ${ip} (MAC: ${mac})\n"
+    log "ALERT: Unbekannter Host ${ip} MAC=${mac}"
+    ((ALERT_COUNT++))
+  fi
+done <<< "$SCAN"
+
+if [ "$ALERT_COUNT" -gt 0 ]; then
+  log "SCAN: ${ALERT_COUNT} unbekannte Hosts!"
+  if [ -n "$WEBHOOK_URL" ]; then
+    curl -s -X POST "$WEBHOOK_URL" \
+      -H "Content-Type: application/json" \
+      -d "{\"event\":\"unknown_host\",\"subnet\":\"${SUBNET}\",\"count\":${ALERT_COUNT},\"details\":\"$(echo -e "$UNKNOWN" | tr '\n' ' ')\",\"timestamp\":\"$(date -Iseconds)\"}" \
+      >/dev/null 2>&1 || log "WARN: Webhook fehlgeschlagen"
+  fi
+  [ "$QUIET" != "--quiet" ] && echo -e "\n${UNKNOWN}"
+  exit 1
+else
+  log "SCAN: OK – alle $(echo "$SCAN" | wc -l) Hosts bekannt"
+  exit 0
+fi

roles/nvidia/tasks/main.yml

@@ -44,6 +44,7 @@
   ansible.builtin.apt:
     name:
       - linux-headers-{{ ansible_kernel }}
+      - linux-headers-amd64
       - dkms
     state: present
 

roles/patchmon-agent/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart patchmon-agent
+  ansible.builtin.systemd:
+    name: patchmon-agent
+    state: restarted

roles/patchmon-agent/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Prüfen ob patchmon-agent bereits installiert ist
+  ansible.builtin.stat:
+    path: /usr/local/bin/patchmon-agent
+  register: patchmon_bin
+
+- name: Prüfen ob Agent bereits enrolled ist
+  ansible.builtin.command: /usr/local/bin/patchmon-agent ping
+  register: patchmon_ping
+  changed_when: false
+  failed_when: false
+  when: patchmon_bin.stat.exists
+
+- name: PatchMon Agent installieren (Auto-Enrollment)
+  ansible.builtin.shell: |
+    curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh
+  args:
+    creates: /etc/patchmon/credentials.yml
+  when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0)
+
+- name: Server-URL sicherstellen
+  ansible.builtin.lineinfile:
+    path: /etc/patchmon/config.yml
+    regexp: '^patchmon_server:'
+    line: 'patchmon_server: "https://patchmon.sascha-lutz.de"'
+  notify: restart patchmon-agent
+
+- name: Docker-Integration aktivieren
+  ansible.builtin.lineinfile:
+    path: /etc/patchmon/config.yml
+    regexp: '^\s*docker:'
+    line: '    docker: true'
+  notify: restart patchmon-agent

roles/tc_ratelimit/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+tc_iface: "auto"
+tc_flow_limit: "50mbit"
+tc_total_limit: "500mbit"
+tc_burst: "1mb"

roles/tc_ratelimit/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart tc-ratelimit
+  ansible.builtin.systemd:
+    name: tc-ratelimit
+    state: restarted
+    daemon_reload: true

roles/tc_ratelimit/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Netzwerk-Interface ermitteln
+  ansible.builtin.shell:
+    cmd: "ip -o link show | awk -F': ' '!/lo/{print $2; exit}'"
+  register: detected_iface
+  changed_when: false
+  when: tc_iface == "auto"
+
+- name: Interface setzen
+  ansible.builtin.set_fact:
+    tc_iface: "{{ detected_iface.stdout | trim }}"
+  when: tc_iface == "auto"
+
+- name: tc-ratelimit Script deployen
+  ansible.builtin.template:
+    src: tc-ratelimit.sh.j2
+    dest: /usr/local/bin/tc-ratelimit.sh
+    mode: "0755"
+  notify: restart tc-ratelimit
+
+- name: Systemd Service deployen
+  ansible.builtin.template:
+    src: tc-ratelimit.service.j2
+    dest: /etc/systemd/system/tc-ratelimit.service
+    mode: "0644"
+  notify: restart tc-ratelimit
+
+- name: Service aktivieren und starten
+  ansible.builtin.systemd:
+    name: tc-ratelimit
+    enabled: true
+    state: started
+    daemon_reload: true

roles/tc_ratelimit/templates/tc-ratelimit.service.j2

@@ -0,0 +1,13 @@
+[Unit]
+Description=tc per-flow rate limit ({{ tc_flow_limit }} per connection)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/bin/tc-ratelimit.sh start
+ExecStop=/usr/local/bin/tc-ratelimit.sh stop
+
+[Install]
+WantedBy=multi-user.target

roles/tc_ratelimit/templates/tc-ratelimit.sh.j2

@@ -0,0 +1,26 @@
+#!/bin/bash
+# tc per-flow rate limit – deployed via Ansible
+# Jede TCP-Connection bekommt max {{ tc_flow_limit }}
+IFACE="{{ tc_iface }}"
+FLOW_LIMIT="{{ tc_flow_limit }}"
+TOTAL_LIMIT="{{ tc_total_limit }}"
+BURST="{{ tc_burst }}"
+
+case "${1}" in
+  start)
+    tc qdisc del dev "${IFACE}" root 2>/dev/null
+    tc qdisc add dev "${IFACE}" root handle 1: htb default 10
+    tc class add dev "${IFACE}" parent 1: classid 1:1 htb rate "${TOTAL_LIMIT}" burst "${BURST}"
+    tc class add dev "${IFACE}" parent 1:1 classid 1:10 htb rate "${TOTAL_LIMIT}" burst "${BURST}"
+    tc qdisc add dev "${IFACE}" parent 1:10 handle 10: fq maxrate "${FLOW_LIMIT}" flow_limit 200
+    echo "tc: ${FLOW_LIMIT}/flow on ${IFACE}"
+    ;;
+  stop)
+    tc qdisc del dev "${IFACE}" root 2>/dev/null
+    ;;
+  status)
+    tc -s qdisc show dev "${IFACE}"
+    tc -s class show dev "${IFACE}"
+    ;;
+  *) echo "Usage: $0 {start|stop|status}"; exit 1 ;;
+esac

rotate-ssh-key.yml

@@ -0,0 +1,17 @@
+---
+# Phase 1: Add new key alongside old keys
+- name: Add new SSH key to all hosts
+  hosts: all
+  become: true
+  vars:
+    new_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026"
+  tasks:
+    - name: Set target user
+      set_fact:
+        target_user: "{{ base_user | default(ansible_user | default('sascha')) }}"
+
+    - name: Add new key (keep old keys)
+      ansible.posix.authorized_key:
+        user: "{{ target_user }}"
+        key: "{{ new_key }}"
+        state: present

sops-age.yml

@@ -0,0 +1,40 @@
+---
+- name: SOPS + Age Key Deployment
+  hosts: all
+  become: yes
+  tasks:
+    - name: sops installieren
+      ansible.builtin.shell: |
+        if ! command -v sops &>/dev/null; then
+          curl -sLo /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64
+          chmod +x /usr/local/bin/sops
+        fi
+      args:
+        creates: /usr/local/bin/sops
+
+    - name: Age Key Verzeichnis erstellen
+      ansible.builtin.file:
+        path: /root/.config/sops/age
+        state: directory
+        mode: "0700"
+
+    - name: Age Key deployen
+      ansible.builtin.copy:
+        content: |
+          # created: 2026-04-04T09:42:26+02:00
+          # public key: age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr
+          AGE-SECRET-KEY-19RPRZ89VNDR6KECR7ULA38P8KJ7FHMXJ9N07UUJHLGSVMUW69LHS89XDD2
+        dest: /root/.config/sops/age/keys.txt
+        mode: "0600"
+
+    - name: sops decrypt Hook fuer Git-Repos erstellen
+      ansible.builtin.copy:
+        content: |
+          #!/bin/bash
+          # Post-merge hook: decrypt .env.enc after git pull
+          if [ -f .env.enc ]; then
+            sops -d --input-type dotenv --output-type dotenv .env.enc > .env
+            echo "[sops] .env decrypted"
+          fi
+        dest: /usr/local/bin/sops-decrypt-env
+        mode: "0755"

tc-ratelimit.yml

@@ -0,0 +1,5 @@
+---
+- hosts: hetzner
+  become: true
+  roles:
+    - tc_ratelimit

update.yml

@@ -9,29 +9,50 @@
         upgrade: dist
         autoremove: yes
 
-    - name: Pruefen ob Reboot noetig ist
+    - name: Pruefen ob Reboot noetig ist (Debian)
       ansible.builtin.stat:
         path: /var/run/reboot-required
       register: reboot_required
 
-- name: NVIDIA Kernel Headers nach Upgrade sicherstellen
+- name: NVIDIA Check nach Upgrade
   hosts: nvidia
   become: yes
   tasks:
-    - name: Kernel Headers und DKMS installieren und Module bauen
+    - name: Kernel Headers fuer alle installierten Kernel sicherstellen
       ansible.builtin.shell: |
         export PATH=$PATH:/usr/sbin
-        apt-get install -y linux-headers-$(uname -r) dkms
+        # Headers fuer den laufenden UND den neuesten installierten Kernel
+        NEWEST_KERNEL=$(ls -t /boot/vmlinuz-* | head -1 | sed 's|/boot/vmlinuz-||')
+        apt-get install -y linux-headers-${NEWEST_KERNEL} linux-headers-$(uname -r) linux-headers-amd64 dkms
         dkms autoinstall
       register: headers_result
       changed_when: "'newly installed' in headers_result.stdout"
 
+    - name: NVIDIA Driver Mismatch pruefen
+      ansible.builtin.shell: nvidia-smi > /dev/null 2>&1
+      register: nvidia_check
+      changed_when: false
+      failed_when: false
+
+    - name: Reboot-Flag setzen bei NVIDIA Mismatch
+      ansible.builtin.set_fact:
+        nvidia_reboot_needed: true
+      when: nvidia_check.rc != 0
+
 - name: Reboot falls noetig
   hosts: all
   become: yes
+  serial: 3
   tasks:
     - name: Reboot durchfuehren
       ansible.builtin.reboot:
         msg: "Reboot nach Update"
         reboot_timeout: 300
-      when: hostvars[inventory_hostname].reboot_required.stat.exists
+      when: >
+        hostvars[inventory_hostname].reboot_required.stat.exists | default(false)
+        or hostvars[inventory_hostname].nvidia_reboot_needed | default(false)
+
+    - name: NVIDIA Treiber nach Reboot verifizieren
+      ansible.builtin.shell: nvidia-smi | head -3
+      when: hostvars[inventory_hostname].nvidia_reboot_needed | default(false)
+      changed_when: false