From d857b72cf8d7f75fa898df8263bc66ade8b874ee Mon Sep 17 00:00:00 2001 From: Sascha Date: Mon, 15 Jun 2026 21:23:29 +0200 Subject: [PATCH] netcup VPS: Inventory-Eintrag + sysctl-Override (BBR/fq, ohne VM-Werte) - [vps]-Gruppe mit netcup (194.13.80.132) ins Inventory, in [all:children] - sysctl-Rolle: Loop auf Variable sysctl_params umgestellt (defaults/main.yml) - group_vars/vps: VPS-Override (fq ergaenzt, swappiness/dirty_ratio weggelassen) - .gitignore: id_ed25519 (privater Key!) + iso-builder/output ergaenzt Entspricht dem live gesetzten /etc/sysctl.d/99-net-tuning.conf (15.06.2026). Dry-run gegen netcup: changed=0 (idempotent), andere Hosts unveraendert. Co-Authored-By: Claude Opus 4.8 --- .gitignore | 6 ++++ group_vars/vps/sysctl.yml | 27 ++++++++++++++++ pfannkuchen.ini | 59 ++++++++++++++++++---------------- roles/sysctl/defaults/main.yml | 25 ++++++++++++++ roles/sysctl/tasks/main.yml | 23 +------------ 5 files changed, 91 insertions(+), 49 deletions(-) create mode 100644 group_vars/vps/sysctl.yml create mode 100644 roles/sysctl/defaults/main.yml diff --git a/.gitignore b/.gitignore index 5e5a443..3dae53a 100644 --- a/.gitignore +++ b/.gitignore @@ -9,6 +9,12 @@ vault-password *.pfx id_rsa id_rsa.pub +id_ed25519 +id_ed25519.pub + +# ISO-Builder Output (zu gross fuers Repo) +iso-builder/output/ +*.iso # Ansible temporäre Dateien *.retry diff --git a/group_vars/vps/sysctl.yml b/group_vars/vps/sysctl.yml new file mode 100644 index 0000000..1ffb606 --- /dev/null +++ b/group_vars/vps/sysctl.yml @@ -0,0 +1,27 @@ +--- +# Sysctl-Override fuer netcup VPS (Reverse Proxy / WG-Hub). +# Unterschiede zum Default (roles/sysctl/defaults): +# + net.core.default_qdisc = fq (optimal fuer BBR-Pacing) +# - vm.swappiness / vm.dirty_ratio / vm.dirty_background_ratio +# (VM-I/O-spezifisch, auf Edge-VPS irrelevant; dort in 99-nc-kernel.conf gesetzt) +# Entspricht dem manuell gesetzten /etc/sysctl.d/99-net-tuning.conf (15.06.2026). +sysctl_params: + - { key: net.core.rmem_default, value: "262144" } + - { key: net.core.wmem_default, value: "262144" } + - { key: net.core.rmem_max, value: "67108864" } + - { key: net.core.wmem_max, value: "67108864" } + - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } + - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } + - { key: net.ipv4.tcp_window_scaling, value: "1" } + - { key: net.core.default_qdisc, value: "fq" } + - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } + - { key: net.ipv4.tcp_fastopen, value: "3" } + - { key: net.core.netdev_max_backlog, value: "16384" } + - { key: net.core.somaxconn, value: "4096" } + - { key: net.ipv4.tcp_notsent_lowat, value: "16384" } + - { key: net.ipv4.tcp_fin_timeout, value: "15" } + - { key: net.ipv4.tcp_tw_reuse, value: "1" } + - { key: net.ipv4.tcp_mtu_probing, value: "1" } + - { key: net.ipv4.ip_forward, value: "1" } + - { key: net.ipv6.conf.all.forwarding, value: "1" } diff --git a/pfannkuchen.ini b/pfannkuchen.ini index b5b9edc..5510bcd 100644 --- a/pfannkuchen.ini +++ b/pfannkuchen.ini @@ -10,6 +10,16 @@ node7 ansible_host=10.5.85.17 [proxmox:vars] ansible_user=root +[infrastructure] +# Infrastructure hosts (placeholder for backup:children) +node1 +node2 +node3 +node4 +node5 +node6 +node7 + [media] emby-sascha ansible_host=10.6.1.103 immich ansible_host=10.4.1.107 @@ -27,26 +37,26 @@ dockhand ansible_host=10.4.1.116 [auto] n8n ansible_host=10.4.1.113 -openclaw ansible_host=10.4.1.100 +hermes ansible_host=10.4.1.100 monitoring ansible_host=10.1.1.111 automation1 ansible_host=10.5.85.5 outline ansible_host=10.1.1.100 -funkwerk-ai ansible_host=10.1.1.10 +k3s-control ansible_host=10.3.1.110 +k3s-worker2 ansible_host=10.3.1.112 +k3s-worker3 ansible_host=10.3.1.113 +k3s-worker1 ansible_host=10.3.1.111 +satisfactory ansible_host=10.3.1.120 +wolfstack-vm ansible_host=10.1.1.110 [communication] matrix ansible_host=10.4.1.110 -[infrastructure] -pbs ansible_host=10.3.1.10 ansible_user=root - -[83] -auris-integration ansible_host=10.5.83.151 ansible_user=fia ansible_password=kronerew ansible_become_password=kronerew base_user=fia -susi ansible_host=10.5.83.8 ansible_user=sascha ansible_password=GT500r8 ansible_become_password=GT500r8 base_user=sascha -tunnel-test ansible_host=10.6.1.99 - [hetzner] -test-vps ansible_host=78.46.186.211 ansible_user=root ansible_port=22 ansible_ssh_private_key_file=~/.ssh/id_ed25519 -pfannkuchen ansible_host=159.69.245.190 ansible_user=root ansible_port=2505 ansible_ssh_private_key_file=~/.ssh/id_ed25519 +pfannkuchen ansible_host=159.69.245.190 ansible_user=root ansible_port=2505 + +[vps] +# netcup VPS (Nuernberg) - WireGuard-Hub + Caddy Reverse Proxy, seit 13.06.2026 +netcup ansible_host=194.13.80.132 ansible_user=root [nvidia] tdarr @@ -60,10 +70,6 @@ node4 node6 node7 -[frp] -emby-sascha -emby-chris - [wireguard] node1 node2 @@ -73,14 +79,6 @@ node5 node6 node7 -[hawser:children] -media -arr -docker -auto -communication -hetzner - [all:children] media arr @@ -90,6 +88,7 @@ communication infrastructure hetzner proxmox +vps [backup:children] media @@ -103,6 +102,12 @@ infrastructure # Credentials liegen in group_vars/ (nicht im INI, da kein Jinja2-Support) -[xray] -emby-sascha -emby-chris +[hawser:children] +media +arr +docker +auto +communication +hetzner + + diff --git a/roles/sysctl/defaults/main.yml b/roles/sysctl/defaults/main.yml new file mode 100644 index 0000000..faa4bf4 --- /dev/null +++ b/roles/sysctl/defaults/main.yml @@ -0,0 +1,25 @@ +--- +# Default-Sysctl-Werte fuer Streaming-VMs. +# Pro Host/Gruppe ueberschreibbar via group_vars/host_vars (z.B. group_vars/vps). +sysctl_params: + - { key: net.core.rmem_default, value: "262144" } + - { key: net.core.wmem_default, value: "262144" } + - { key: net.core.rmem_max, value: "67108864" } + - { key: net.core.wmem_max, value: "67108864" } + - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } + - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } + - { key: net.ipv4.tcp_window_scaling, value: "1" } + - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } + - { key: net.ipv4.tcp_fastopen, value: "3" } + - { key: net.core.netdev_max_backlog, value: "16384" } + - { key: net.core.somaxconn, value: "4096" } + - { key: net.ipv4.tcp_notsent_lowat, value: "16384" } + - { key: net.ipv4.tcp_fin_timeout, value: "15" } + - { key: net.ipv4.tcp_tw_reuse, value: "1" } + - { key: vm.swappiness, value: "1" } + - { key: vm.dirty_ratio, value: "15" } + - { key: vm.dirty_background_ratio, value: "5" } + - { key: net.ipv4.tcp_mtu_probing, value: "1" } + - { key: net.ipv4.ip_forward, value: "1" } + - { key: net.ipv6.conf.all.forwarding, value: "1" } diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml index c77063e..3563613 100644 --- a/roles/sysctl/tasks/main.yml +++ b/roles/sysctl/tasks/main.yml @@ -17,25 +17,4 @@ sysctl_file: /etc/sysctl.d/99-net-tuning.conf reload: true state: present - loop: - - { key: net.core.rmem_default, value: "262144" } - - { key: net.core.wmem_default, value: "262144" } - - { key: net.core.rmem_max, value: "67108864" } - - { key: net.core.wmem_max, value: "67108864" } - - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } - - { key: net.ipv4.tcp_window_scaling, value: "1" } - - { key: net.ipv4.tcp_congestion_control, value: "bbr" } - - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - - { key: net.ipv4.tcp_fastopen, value: "3" } - - { key: net.core.netdev_max_backlog, value: "16384" } - - { key: net.core.somaxconn, value: "4096" } - - { key: net.ipv4.tcp_notsent_lowat, value: "16384" } - - { key: net.ipv4.tcp_fin_timeout, value: "15" } - - { key: net.ipv4.tcp_tw_reuse, value: "1" } - - { key: vm.swappiness, value: "1" } - - { key: vm.dirty_ratio, value: "15" } - - { key: vm.dirty_background_ratio, value: "5" } - - { key: net.ipv4.tcp_mtu_probing, value: "1" } - - { key: net.ipv4.ip_forward, value: "1" } - - { key: net.ipv6.conf.all.forwarding, value: "1" } + loop: "{{ sysctl_params }}"