From 5fb6951583fbce6358d741c47b7152cddf9a1a47 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:52 +0200 Subject: [PATCH 1/6] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- roles/sysctl/defaults/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/sysctl/defaults/main.yml b/roles/sysctl/defaults/main.yml index faa4bf4..ac69319 100644 --- a/roles/sysctl/defaults/main.yml +++ b/roles/sysctl/defaults/main.yml @@ -1,5 +1,5 @@ --- -# Default-Sysctl-Werte fuer Streaming-VMs. +# Default-Sysctl-Werte fuer Streaming-VMs und den WireGuard-Medienpfad. # Pro Host/Gruppe ueberschreibbar via group_vars/host_vars (z.B. group_vars/vps). sysctl_params: - { key: net.core.rmem_default, value: "262144" } @@ -9,7 +9,9 @@ sysctl_params: - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } - { key: net.ipv4.tcp_window_scaling, value: "1" } + - { key: net.core.default_qdisc, value: "fq" } - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_no_metrics_save, value: "0" } - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - { key: net.ipv4.tcp_fastopen, value: "3" } - { key: net.core.netdev_max_backlog, value: "16384" } From 8e057b0d4d590403502bc611813cb056afaaa739 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:53 +0200 Subject: [PATCH 2/6] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- roles/sysctl/tasks/main.yml | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml index 3563613..60a17d6 100644 --- a/roles/sysctl/tasks/main.yml +++ b/roles/sysctl/tasks/main.yml @@ -10,7 +10,31 @@ dest: /etc/modules-load.d/bbr.conf mode: "0644" -- name: Sysctl Parameter setzen +- name: Legacy-Sysctl-Dateien pruefen + ansible.builtin.stat: + path: "{{ item }}" + loop: + - /etc/sysctl.conf + - /etc/sysctl.d/99-streaming.conf + register: legacy_sysctl_files + +- name: Verwaltete Werte aus Legacy sysctl.conf entfernen + ansible.builtin.lineinfile: + path: /etc/sysctl.conf + regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*=" + state: absent + loop: "{{ sysctl_params }}" + when: legacy_sysctl_files.results[0].stat.exists + +- name: Verwaltete Werte aus Legacy 99-streaming.conf entfernen + ansible.builtin.lineinfile: + path: /etc/sysctl.d/99-streaming.conf + regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*=" + state: absent + loop: "{{ sysctl_params }}" + when: legacy_sysctl_files.results[1].stat.exists + +- name: Sysctl Parameter kanonisch setzen ansible.posix.sysctl: name: "{{ item.key }}" value: "{{ item.value }}" From 1c8e2ac26cd315c751b8f0d3a704a0c5c51a533d Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:53 +0200 Subject: [PATCH 3/6] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- group_vars/vps/sysctl.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/group_vars/vps/sysctl.yml b/group_vars/vps/sysctl.yml index 1ffb606..88aea33 100644 --- a/group_vars/vps/sysctl.yml +++ b/group_vars/vps/sysctl.yml @@ -15,6 +15,7 @@ sysctl_params: - { key: net.ipv4.tcp_window_scaling, value: "1" } - { key: net.core.default_qdisc, value: "fq" } - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_no_metrics_save, value: "0" } - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - { key: net.ipv4.tcp_fastopen, value: "3" } - { key: net.core.netdev_max_backlog, value: "16384" } From 88bbc3f0ce21ad80392cf8a22925da7bc08f7897 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:54 +0200 Subject: [PATCH 4/6] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- sysctl-proxmox.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysctl-proxmox.yaml b/sysctl-proxmox.yaml index 3f9ad2d..ff391b8 100644 --- a/sysctl-proxmox.yaml +++ b/sysctl-proxmox.yaml @@ -3,4 +3,5 @@ hosts: proxmox become: yes roles: + - sysctl - sysctl_proxmox From a062d74bd0c94e82975258807b7b3cfe7f70a0fa Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:55 +0200 Subject: [PATCH 5/6] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- roles/sysctl_proxmox/tasks/main.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/roles/sysctl_proxmox/tasks/main.yml b/roles/sysctl_proxmox/tasks/main.yml index 70bf05a..6b9bbf8 100644 --- a/roles/sysctl_proxmox/tasks/main.yml +++ b/roles/sysctl_proxmox/tasks/main.yml @@ -42,14 +42,7 @@ - { key: fs.file-max, value: "9999999" } - { key: fs.inotify.max_user_watches, value: "524288" } - { key: fs.inotify.max_user_instances, value: "512" } - - { key: net.ipv4.ip_forward, value: "1" } - - { key: net.ipv6.conf.all.forwarding, value: "1" } - { key: net.bridge.bridge-nf-call-iptables, value: "0" } - { key: net.bridge.bridge-nf-call-ip6tables, value: "0" } - { key: vm.dirty_expire_centisecs, value: "3000" } - { key: vm.dirty_writeback_centisecs, value: "500" } - - { key: net.ipv4.tcp_mtu_probing, value: "1" } - - { key: net.core.rmem_max, value: "67108864" } - - { key: net.core.wmem_max, value: "67108864" } - - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } From 9fed3fe47a963fe022fdc0d0fa239afc8fe527e5 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:55 +0200 Subject: [PATCH 6/6] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- tests/test_sysctl_role.py | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 tests/test_sysctl_role.py diff --git a/tests/test_sysctl_role.py b/tests/test_sysctl_role.py new file mode 100644 index 0000000..3be0742 --- /dev/null +++ b/tests/test_sysctl_role.py @@ -0,0 +1,34 @@ +from pathlib import Path +import unittest + +ROOT = Path(__file__).parents[1] + + +class SysctlRoleContract(unittest.TestCase): + def test_canonical_streaming_profile_keeps_64mib_and_bbr_fq(self): + text = (ROOT / "roles/sysctl/defaults/main.yml").read_text() + self.assertIn("net.core.rmem_max", text) + self.assertIn('value: "67108864"', text) + self.assertIn("net.core.default_qdisc", text) + self.assertIn("net.ipv4.tcp_congestion_control", text) + self.assertIn("net.ipv4.tcp_no_metrics_save", text) + + def test_role_removes_managed_keys_from_legacy_sources(self): + text = (ROOT / "roles/sysctl/tasks/main.yml").read_text() + self.assertIn("/etc/sysctl.conf", text) + self.assertIn("/etc/sysctl.d/99-streaming.conf", text) + self.assertIn("state: absent", text) + self.assertIn("regex_escape", text) + + def test_proxmox_tuning_runs_canonical_network_role_first(self): + play = (ROOT / "sysctl-proxmox.yaml").read_text() + self.assertLess(play.index("- sysctl\n"), play.index("- sysctl_proxmox")) + + def test_proxmox_role_does_not_duplicate_canonical_network_keys(self): + text = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text() + for key in ("net.core.rmem_max", "net.core.wmem_max", "net.ipv4.tcp_rmem", "net.ipv4.tcp_wmem", "net.ipv4.tcp_mtu_probing"): + self.assertNotIn(key, text) + + +if __name__ == "__main__": + unittest.main()