diff --git a/.gitignore b/.gitignore index 3dae53a..5e5a443 100644 --- a/.gitignore +++ b/.gitignore @@ -9,12 +9,6 @@ vault-password *.pfx id_rsa id_rsa.pub -id_ed25519 -id_ed25519.pub - -# ISO-Builder Output (zu gross fuers Repo) -iso-builder/output/ -*.iso # Ansible temporäre Dateien *.retry diff --git a/README.md b/README.md index 1972a53..54c9987 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,7 @@ ansible-playbook update.yml | sabnzbd | 10.2.1.119 | arr | SABnzbd | | dockhand | 10.4.1.116 | docker | Dockhand | | n8n | 10.4.1.113 | auto | n8n Automation | -| hermes | 10.4.1.100 | auto | Hermes Agent | +| openclaw | 10.4.1.100 | auto | OpenClaw | | monitoring | 10.1.1.111 | auto | Monitoring Stack | | automation | 10.1.1.115 | auto | Automation Stack | | matrix | 10.4.1.110 | communication | Matrix | @@ -257,7 +257,7 @@ Direkte Peers (kein Hysteria2): | media | emby-sascha, jellyfin, immich, emby-chris | Media VMs | | arr | tdarr, arrapps, sabnzbd | Arr-Stack | | docker | dockhand | Docker VMs | -| auto | n8n, hermes, monitoring, automation | Automation | +| auto | n8n, openclaw, monitoring, automation | Automation | | communication | matrix | Kommunikation | | hetzner | pfannkuchen | Hetzner Server | | frp | emby-sascha, emby-chris, jellyfin | FRP Clients | diff --git a/ansible.cfg b/ansible.cfg index 67f0e8b..30fa1cc 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -1,5 +1,4 @@ [defaults] -private_key_file = /app-config/ansible/id_ed25519 host_key_checking = false vault_password_file = .vault-password inventory=pfannkuchen.ini diff --git a/checkrr-deploy.yml b/checkrr-deploy.yml deleted file mode 100644 index 9780a3c..0000000 --- a/checkrr-deploy.yml +++ /dev/null @@ -1,87 +0,0 @@ ---- -# Deploy Checkrr config to arrapps stack -- name: Deploy Checkrr configuration - hosts: arrapps - become: true - gather_facts: false - - tasks: - - name: Ensure /app-config/arr directory exists - ansible.builtin.file: - path: /app-config/arr - state: directory - mode: '0755' - - - name: Create checkrr subdirectory with correct permissions - ansible.builtin.file: - path: /app-config/arr/checkrr - state: directory - mode: '0755' - owner: '1000' - group: '1000' - - - name: Remove old checkrr.yaml (wrong path) - ansible.builtin.file: - path: /app-config/arr/checkrr.yaml - state: absent - - - name: Remove old checkrr.db directory (wrong path) - ansible.builtin.file: - path: /app-config/arr/checkrr.db - state: absent - - - name: Deploy checkrr.yaml config - ansible.builtin.copy: - dest: /app-config/arr/checkrr/checkrr.yaml - mode: '0644' - owner: '1000' - group: '1000' - content: | - --- - # Checkrr Configuration for arrapps - lang: "en-us" - checkrr: - checkpath: - - /data/UHD - - /data/FHD - database: /checkrr.db - runOnce: false - port: 8585 - host: 0.0.0.0 - cron: "@daily" - ignorehidden: true - - arr: - - service: radarr - name: radarrUHD - url: http://radarrUHD:7878 - apiKey: "" - process: true - - service: radarr - name: radarrFHD - url: http://radarrFHD:7878 - apiKey: "" - process: true - - service: sonarr - name: sonarrUHD - url: http://sonarrUHD:8989 - apiKey: "" - process: true - - service: sonarr - name: sonarrFHD - url: http://sonarrFHD:8989 - apiKey: "" - process: true - - logs: - stdout: - out: stdout - formatter: default - - - name: Create empty checkrr.db file - ansible.builtin.file: - path: /app-config/arr/checkrr/checkrr.db - state: touch - mode: '0644' - owner: '1000' - group: '1000' diff --git a/dns-doh.yml b/dns-doh.yml deleted file mode 100644 index f343df2..0000000 --- a/dns-doh.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -- name: DNS over HTTPS auf allen Hosts - hosts: all - become: true - roles: - - dns_resolver diff --git a/group_vars/all/vault.yml b/group_vars/all/vault.yml index 4531c15..c1e69ad 100644 --- a/group_vars/all/vault.yml +++ b/group_vars/all/vault.yml @@ -1,178 +1,162 @@ $ANSIBLE_VAULT;1.1;AES256 -32353937363365383536323336626630663462666532343437356361353262363063613465626465 -6330656638323232323131373930303030613538663062320a383135333935323165613735323365 -32333832393637363539363936323631383362626165346664663330656434316239636261336136 -3164656163343039350a336364336463663936613238353734396635663238303161333464613133 -64666333323339666231663736626334336434373662623364356230396236353335396665303135 -34393032383132316430306231623736636234643732343338663439366135356464643165326130 -30333737383230653031613132336362613536653531343666356533313463643930343262613864 -32613032623430323039653962313031393033616534396263623334363635656330643232333864 -38376336336564363030663965663366663436616133306263353236363264636236356363323138 -37666238646461303931653931323165386164376431316234316134653765363266626262633865 -64663932316433373238383031653937306264383666383630626362386362623234623135646562 -66346536313165643336373663326466373337323836366437626464613361376333356664343038 -37303632336336633264373835373735356330316535373533313265393462303332323965363338 -36643736383132306138333432323463633164666634343633363361363337306538396636396337 -36356137363635633231353764363332383139383262393161326463353765343334353361613963 -34343265323837363164336632326335636563343739346263636334383666623466316430663639 -63663162343234306666336236376163366130666131386264323730633665353238383166396263 -36333533653537353537646661386162363034323139626431623033626134393963356137663163 -32643762343363306631643232343532373331363464353937636636383934666566633933393234 -62336533666163636137646661363035386364386133653166376630343264646430653236336665 -33643966326234343766373837363736646639376330336435663832653162643231613837643435 -35376636353530623632346239663366343362613738633431306435386462666266653138633163 -35656335643734383164346232626338376561303232356162666432303830306262336637663761 -37393636656632366264386237373336376239303135316534323736313437393934303561643561 -34343362643132653730313534363466616663366530373461666336333132366664313137313239 -39336334643939663131323932323537613030336639663261383032393235623839656464383336 -62313931323032623530346539343536663133386633666330343437626166393539323339393932 -62306337353433653930373662643830303335613965396433373164643437366535316165376266 -36363264343034366139623830376530633938663038613166363462303263303465346232613663 -65323637643162653762373261653437396130303436643766303261316362643761396536373861 -36303761623233303161613239613863383231343865613632366339626637343465343335653738 -36643537343131343563316334636631316665363039353639623465643661613132653739346139 -35666332383335333363666131323332303964646134333234656632396462373062623631356463 -30663334643134363136343039613735353964613564616435373063343235313733373765396666 -32666130633035633936363937346266363737363762396232633033343130383131646365633732 -36366334626233653338363963323034656435316632363264396439363633663934646363373566 -38303662643730353462653664646265373030333837623031343432313866356363356465373330 -33313839633939666639666165393633333366633335346536346332333134646462613433306164 -39353361323463306338623461383939383835343261363538346166306436343132666265313364 -36623631636261623237333336633534613430383139313465363436356631666365346662333533 -32336363636466343639393237333530333763643966323866396366333363633636366330633536 -63333238326230366565366430653932646532343736303735643363643631303439313936383532 -30666338333334646334613939336632643236616137346661343366366263373733303131353065 -31383732373432393363333162666333326131633131356431383135373634313139363032643763 -64343537393966316664653932616161353465316232316330343836656232396637323564643932 -37373434356366373235303430396332306430376465373365643433333431356263306234386465 -30363037646139323566363539376463323061303131633862636535303932356131353962643935 -34653232366363333833616462623537356666356330383538386363333631623463373764313432 -63643132373136636437653865653435643834613263336338326236306536306261353264616166 -31316332383733373734326336643563663133363433326137663730323364333564336131306532 -61313965633436333836626431333834383636363336623130326636383761313139636436333334 -34613739326163666337636634303561323764343661373961393737303139663163656138633431 -61363163336530646561636366383665663861633231653837646564626333383031623135633065 -37653061613437313262363639383331643034643135356634643033336164626131346634346635 -63316364363237393165313834656130643733333636343862333664663863326161323535343335 -66623539346433373065323236333461323937333966356165643131363331313030306135336565 -62313762323332303937323630343733393535396434636138626131626564623966396464386564 -64663034663438306636316139376166363266373034383338633265623861633733353663363165 -31393132626436636231316266386631323738656161646437333331313338353263363935643765 -34396166323035363236366237313161633033306232643632366531653962636236343930343730 -33363439343632656234653631643339386565656466396231623265343962656336303139336163 -38616461356661636139393863613564626461363265316435306634656436386133626463326430 -35303130623735646662663535666265353531643364643965653630626334333232336132633031 -34613231323739333637356633623165396539623237623763656432393864333163386363383435 -39333063363066383231656562336238376164396465623232316334643961363663623131313934 -62363738376265303238336465353630643837396231343264653336613366353839383037646535 -30373232346236353830636366353764613862383666656366613531343331353461663963323666 -33396132373838363035613564346463303237326532336131336434373737366566346330656466 -63663339313630393866326534303932336530386538363533646166376436323835333666653835 -65373266333039343963336630336332323137313263663331356139323465366461393362303338 -35303066396639346435663632333138373938656330613930303034616661633737353164383430 -35633065663166643939316565343639386634356233633133366538306635303936376163393235 -36353035653531653038633965663837613036316136396131646537316561653264336636386434 -35656561626236633034633037653838363439633163353062393736616330393938653038306631 -32666664363233623965343132656561336364623334616633623135356136366638393031663135 -65356339663266613032343536646135356433633339393538393439323136313766323665306431 -62383862383735623232346630333439663836343261646534373437643437653065323632303930 -31386661373632326663653064373635373134363035356637346133313636613466336431336564 -33636666333031653165373139373438386165363732643130336164303161326663393464356233 -37316533373866383632633439303466346462626232346337653065306330663963343864343336 -39613032666462363432643634396232643863336262643830386365636638393263336436666130 -61343630643362373865393530376433636236396537653363353566376331383131396666623332 -38623765366231386338333265373730633734386232633964323765396439383166633938656566 -63333532306233356130323264326232333462333366343962383166613535343464376135373432 -30306261376436383032323862666538303530626266386233343339383263313761613932346531 -30663666363630326534323865323330316538656332393635366661636139663334373438386137 -32316239393630636431306562636131643663333866316565366532373165343234653065643963 -34626338373265653336306163633432666132326139646363353734393461303232386637366261 -63353034373733366234653462623935396164343166343466393565376639366236323334376631 -65373466616165653735373030616535303765643638333135393537303834656561373437636534 -61336139666164383465343935666437313161383738303335323033316637663165653465353062 -62636339373332626264396261656633346638396237633830616261383235396636303366623239 -63383639633831613062613936666434643265313435613561356137343762393435613563643465 -64363065343331353633653339356539373731613963303963383936346231633666653433343835 -62346461316539626232656635633738633861323238356338653463303632353136303232653735 -61623461656330343061363061643335373939356531373861316562326364313135376633613633 -37376130613435356636346137643336393531393936613139663230343134393737363564356232 -64316464626436353764316262623663343631626638353730386432666161616162633135363463 -36343631383935393433636461643663396231623233303634666261303638646430653435613237 -39363565363665343832663337323865373962356466616162303536653361613235333762343430 -30373036363234373838333365373535623865373437643664393036343966373330663135633434 -64366662643039666438333239653165623132386232386537353233666133373563323833316661 -38366261343363633664356266323264656139393336383562316333616333663963323565373363 -37303034613137306463633565353334373037643465303265373136393530306461643430343863 -63626131663963383864623036646666663561613733663230353266313734636433323935303134 -30383363373937326130633233316264643266386331623965313036613531323536653837333066 -39396638386464663034323139636465313432393535333834636637343838356366396463633034 -36356639643735636363653965356130653336386336313835316237396466313232663038306531 -36373935646432353930313863643033346235373236626266373839626639373463303961633465 -33343931353932336333343239663066346363616337343933393930383463396436656663353863 -31356533343836323736653635326565386537376262663265626630663061383736356262323234 -65646161623861333934323536616266366539333332616466663239333634646539656335383231 -31336436386538393130393162383361646132643839316338306466306561393534623964373964 -66333034336436383831633164356165653866663630353634313464323438373734663662656638 -35333838346336323439356636333932343536366334666530656235303436666633333739636664 -36323161373830366365323164306266643139336139376435613435353061613464366333356661 -38316133636437653036373437646661376563636264646166346137396230663234666562343936 -34373166336665666432373665613566643661383862366133653931623462626139633164343465 -31306666376432623861336130316463616161663034623138396562333932666338666238313362 -30653134666661333938306633366431633166643839623532323766623438376364366666643830 -64343661346635343566656562303661316163303766633734666330633535656164393330643064 -36386461633935343533316662393362306262636430306136313365633564343931633736363466 -64653939313730396430666266366437303933353337656334643761386631376635346562633364 -34326636353765663430613539316531616235323663653530616538346536613932343237316564 -38336630656634396531393763396266656533346136326532646532643662393563343638303938 -31653131313162353464313635613133333931383838323433666332323537316235666261626166 -62636635326531376335303162636631646132346133363539376661636263393239303133323638 -66313435623531643833333131616138646434363563376264396131316239303331646630623062 -30333034353339393033636462336138666265373333333866313535643930326437356430623037 -35343839626334323134653063623566663965333339313338323661666161373438616262663235 -66663965333937383262336636323163633666373538646166323533343162656463333764333766 -34643464356634363837373835663938306561336662633635623063613462323235303161653430 -38646330396463366365643830353832616334616331643535306365613664346339366164656231 -35313132323530343337343938366361656165643062633836363162323130643237386162643366 -65326635636531663934346434313365626436656632613737616362323737363066346365393336 -35663037646434356461633764376162343937323061396461663162346162366434333733303764 -61343538343135303438616433336230653862346330376638303463303430353836666137396361 -36313665613631656139396230353062313038346536633430316537393764383966336336616465 -63376432663431626265613664323838363834323363306630303361646134643435313262373536 -35313163653135633531636138386237343831353964333261396466396364323539393932353336 -37383564613662383738666137653335656232393833353765396637373932616238383138316134 -30623637633038343366353063346132373136393431363538373337616430353633663063346634 -30313138353462303138616633356233316137333865653932363439626335336630313461636439 -39313566326134346261343861633134643765623138363630306138636362336231633132666464 -61643562636161666262646565663063303332656435636333333430376163386664343333306537 -61393730353762353435393433633766396539653833393265376639353732353638343064356238 -30333436646632353437666433306431353139323161666133626439336433636361623536613865 -31373964386661313030613865303461313331626438623031646461333937373238636131396363 -37623735613264386137663537626531623335613735623136363965386238626130333836323933 -61643861623334353662346363643133336136383935363862626232303361626132353834633938 -33653039643932376564343636313462343032343266303461313964373836306337626466373831 -65333834646538666366636438356566333739623536633438626438343738646264323466333135 -38633065353163303532393265386165613838343962333866376664646165343661323764393639 -65326361313736336261306466306333393366356538623066383938323135336461366338313465 -34663837336163316162616166303935656465363633616334653731353436666633386535343262 -30393231343361653631633531306336383661346362646633663761326166376462343732616139 -37363631663963383731646439656331633237663862336531613234643337646230386561623232 -30623033643165353366336232633332303931373432653030326337616366636133313265333137 -36633662613939343330306538303461326332353930386632636531323162336534376136393065 -65616139356465656539366265646238353239313133333262376665376463653733616436643038 -33356364333765393033376637653031373835373534646165613361303463396165393534623662 -34333031353334303739643961663033346139393931653036613766376130383961656237353531 -65326239616663383537613835303266366637613738613862643263376132343830383636366630 -64633437626163393733313035653330633166396133393162303562663832653036666165336463 -32636330383837386139613630316430373037366236343932633661633939653138303135363264 -32616336656330383235616234653339323062646634646335356333663535373430616462383536 -64393337306438636361333937323835393036376235373261653438366634313364643236663065 -38393264613566303434313038666638333337643835643232373362316330383335333765356435 -37323831336239623130653632353330333934643161306534656465346463366236363566656537 -63616662363937633536343033366135343666356531616538623064333634643166386132383534 -65666465316236326361313737333835663266373634366435613231343835333366323737316634 -34373631396133393431396466613661663632626330663666633963313436363134303764373934 -64653633323132616439626330623965386536343639396631626464653662393138323338663732 -33623731366538346331663761363237323239323633666630623666663333356631386638303239 -36303664306666313361656634336339653035666236336239333566386137323532356336666161 -38323463663631326332316638303666356634373739343238386530376333656363343733336138 -3133 +33363735653463326135306635613338363139363261663666346366616362363165626366303433 +3065653039376539346434383066366235663239643634660a626662633936626438653063643235 +63343962626666643739373037626532353764323836383634373066313937366330356130646664 +3130646436343839620a323662653634393531663139613530663635363065343630666238353037 +30643663346539336636366331376439653433383131353764373930326663663062663534376562 +35656332356230633935303030313761316263663132623839386265326566663131333235333864 +33323236663965366561366564373339646162636664366130336663383566376461356562336232 +64626461363237363634633862363162643630353566333033313864326464326134623265633433 +34343963306133353632323833323634653633366362613236633564366265323261323332613665 +62663137316564353531643964336435333137373137663839653233663066303037343737326337 +65313639363831643032646230666430303938313739316266313562613965326463643438326266 +39353139303436653662653666663864643164326138303138386637636362373662343235636635 +62393561376434363563643538353766646230393466653830646234333830383233316161356432 +34323435316235396437313466363434373036613966343539303538363330356161376333343833 +32303265353566343436313932623462333132373732343433643835386232386463663638303564 +30353564353439353863393238386234633332396539323239393966386465313039646231323631 +37353131396136356530353132396561623635623932333465346364343332306639326538366134 +63366661326537393461353233616466383930343338326666646364623163663236663966643462 +38633965636335626339613565313832343363343338353564663933636330353738656562373230 +33346261323166346430356131356134346565383766333363303539623731376335346337666637 +32393365636436353062653534613432373566636239316264613930366264323037353033663330 +39616265633332366331303264656333663637316139336436303430343061646435353162313666 +39643433633133653436393931343361613264346433306164646566383934623861363330633037 +37353436666336386432386636353166623232636361306436326461663562666366363738353062 +30633233396139303933363231646266383263393562383066373838336339616464663933346166 +63376634323964623939643331626534376332633761323334643162643137623138376435363665 +65346430656331316131656534356235356536663435636235643130396135383134313138346461 +64376338303332633661323337313564303238353236393438656366663736313839383263313466 +62353032636534663134633430646634353835666639653539623533326434663534653962336539 +34393739386538663234666233353434393436626266366365316433373230666236386131313361 +33633538616239383035336532343835333366313538306161626364343838326335336535616363 +65323033363664633031643230653434626335643462303436326635323764663165366332636438 +61383735663639633333343131336263663539373064303035323131303931313738373135303663 +64323130356431316464343536613461363665366165386666663130323733623831313164383035 +39336137613730303366386131393436316232343665623433306632373363633636373564393033 +38633238306262666233373565396434636433346633633231663361313836343633613533613831 +30666639666234656434666332313962333465356632626531326264663631373935386534323466 +38323931653734626533663834646534313364386561623561303839383235643835666232383563 +30383764373932666162623634333536646437386162666161633238343162396563316132373530 +64356661613632333839316136636232666337633964613238356134356236656630616232323966 +63643363326364336432306364326435323437336535626165396632336537626435663265363633 +35306134613437306432396664633137616534633739396531636539363864326134656266613535 +38366232646137383762636265343531333162356165663137326162663066316331313139393364 +33326661616135313432653732653633313736383238666439626265346632663539396464653038 +32626431373966626437666261623535323333376330363861393633316335313465363065386565 +35313130633335343033663733393361343163376339353136646337636665633161363833326664 +35303762393530613033343163393732633235306162636337616264366164366662336665396264 +65366362373134396539663964343635643462306561366138313735623832636437343364303336 +64666261386431616537373063386431643461636535626637326131363933313163373961336639 +64633231633361613662396462323635333131363031616163393262346236303734656439353164 +39376461353035326562653362316231623633666336656362653234393337663031353638363233 +39323433373839663930623336623065613562633433313464656333323431306461636366303637 +32383236626536333562363861323166313837336338653834376362643734666663656262633236 +35663439373337336265626136656465613230626135313334363264623366323938383434656431 +37636334376164643438353633633136616563636362643135666161343938366362336362626162 +36303262356231303031616363656335663935353064316463613936366166623838316561623165 +61303936363065373331613362353130656362313736336539636462653864376432356238653836 +33393436623361616431623461656430363932636531363730666565613235393639626535366565 +37393564353333656332303733643861653563353166623561386661356366393833643033666330 +64613838306530383232653866356538333966643365393936316662616564353738623332316364 +36633730636537373764643130363335643038366265623965613530623534316461653865363135 +38663236376536356561323139666566363733356639653035393263363634396333306336623566 +66313433366461303432373565656431336666346363633836316131343061613230653034343366 +62633534353834396536643437363239393032663731613933646536623534396234343130666335 +38356435613636306234333433306632343461643531383931313438616461306136363665386139 +36363736376462336463643364626130636364643834386164636630366436366439373739386666 +34353866633764663039326639656436353663376463303363363835336630653332376339376439 +37346337623261333030633532616366343436653337386136303431633264666136613432383337 +39353039373934393836636361643839626132383636663766666265316534656562633232303430 +34353266343530333261386139636166656165366666323735373065353339363039636262373434 +39376437333339626237636335383762613761653062636366393465376561653639623332393736 +33313236326564616437633034333833333461643336353339626639646631306632376133306263 +37326462643863373436656662306266633633643133663064616639303062373939346366393164 +31303732656436383439623462633566633763356663643937343431626234656638396461363062 +62633039663237613237663965393861343537646634623633396531383430376133633338383035 +61353736313138656366343139316133363265386466356430656133346439636462303431393132 +34636436366435363531653463353634376232363331656530393665376363343339623337373737 +61316132616566643665303934396364656265316462303834393165653238656232613963336635 +36633363373966616163643563393532303466643763666532396138383837643664303662396162 +37323932623935373761653066343465393262373130626536613030383630323534333434656638 +37346163376130363739636663666438373837303961313163613935666136303063616665363931 +36306138383634333433333061393930383861346330613438663838643966613134613839336232 +64313834316663396236393531653139336238376433623466653538343766656462613635313639 +66336666663432663264323732333035373636633139336566656231663932393436393232373530 +63373564353765323930356633306262333639313162333730636562373333613538656462653164 +38626336323937333632626135333836316238313433653462356666636565666438623139626635 +35383835613135376663643837376466363739356635343432643830396239373963353564356631 +62333837626164643465333062626437653231653665313631303163643239393563363763653839 +33356261616530363337313763373833623661396336303937663339616131646139333162356235 +39653830303061626262666533643937646137653764363432666263653839363132336366643236 +66363434343561343730343432636437396439343231613736353135366436666437646238393439 +62643561363133316333386334393434313162613438373561373032393661656431313031356232 +33353933393638366139323330306536333038623631393439623432383831653163626631336362 +65313832633863643135633962626265363331623163666666373233393937646562383863343436 +63663535346233363762316461303730623965353130616134643031396438646634663632313162 +31336566386435666661373533393534613735633437656336303862343234316437613262353235 +64336438353564373230663964346637363532313262666334353039633662653663633038623163 +39633533383635366466633137396565373138303736353936613465393238633864383761316639 +35366466366465316136313233336134363463323966636134353135306435323533303865353062 +32383739396533353236376363306364343932303566353835646130646361376335336438643339 +63376337626532663163323762623232666166653935633035313964356438663136353335386665 +30613164613337326164373132616562393038613134373863643633303465336466653331633964 +33616666623935643264313533373662373838653739386536316135323737653934386438356435 +39646632353330303065343733626461386430363734383031386631306435383038373561373935 +38373466303738326337376130343631333833313932353337363332643235636262393564383363 +63356335613638663536303539643234633338346665386539656636653964303536396438313861 +35316562383230646365656466616635313061326566373937353438316435613430313266393830 +31306636393239363837346430666163653231333831336433373462376538656534336639313965 +35383465326161336237333466376461323263353933646664336163353636396165383261316638 +61303730656562393661626134356365323936323334373634383831393130383162313833653162 +37616136666263353164333738363135313832376337336234353362656465663031663865633662 +62663563313835633965376665333933636639326137376436343865356239356232316262393066 +31623239616532343338333037323835383732643933396334623432643336646130336436326565 +65303638653434366437316530633361383066356338363736343266636165306365336338323137 +36383364393762643938643263303532386263323766376136666531633635356665613133313766 +33366563663161653531373865636232386330303638626332623637616133376433386364323063 +64353632303365616266343933366161613533333865373835303136363133653464656536623435 +34393136363661383432366161326564636634376664336632326439303862383832363861306135 +32343636383366616133343637616432383965323434626165626337643036613037326234356463 +63653734396261373164663165323436363336363034646130316330363764396536646433356562 +34373936393636393730336433633037623065636339653432343564376233373535633231343961 +64613662323336386361376264646333303362656265663366306664326337326663663432333136 +65636263636166356335343034346631386337323461336164623839653738666337383565653161 +63326366393034353866343037393333363838616363666132353239393866613232396462343166 +30326162343632616135346534366561353039323361333764633833646466323439373530366539 +38323138653437623436313931663930353134613130613962643263313131353433316533613032 +30323333363162326239326531663266326666613835363836383965316136356231313332383361 +36663135653963326530623532666564623737326435616466656431323539313064393034616130 +62376463306234636362616663323362393464353930383439666134383731323637643739613937 +38643130396466623533383839623161343431323563373866386465303035366330646336326633 +34303664613736323963663838346633613831653265316430353233363464356663323661336234 +36316536633130643662623939333836333837643466616236316439623465323761633031623565 +31346437323239613663356234353930343737343233393532666638346637336137323034613036 +33363535303562366562646463653339326336326666303233316238323833313865666334356663 +32376233393166373563363766313237616137386566353863393734323166343761353338343538 +65633630303038303635653336376661303166623232346564313035623239656433626434323733 +35346662633734393161303836633236376634303437366339613139656534303433353666643135 +65643334383538306666616665386536303463323933623364633262396432346437336363346335 +34666331623732643666313835306134653961373865373435623361363236393833383062303136 +63353238663864613634326330363131376334353132326434393538316562666238386238353533 +63666533303534616661623165643965613630646231323230306264306165643236613666366333 +35653562376537636234373834613065313836636230306438633265303037306535326164633564 +33346666366637383232613265643261623864333034643735653961613437313761383934633261 +33313163326263646434323365316164363466316364393130333734616562353063356562373138 +39326630626133396338366539373666303334323634343962623531393664653866323436653139 +31326464343566383562336130616462346135343931343663373836643434346331616465353038 +34333161373461353765336339323830356265663865626634616466313965623663663664653733 +30323230336562303535366138356337373038363864383631313333386165383138643866636463 +61316230396531616333373037646165653431363464393236313463343936313533363665616366 +66353539393135306135363664346630356462313932353166313635336638363137366438353964 +31323632326638363431356234653262656539326262313563316631343636643339326130373330 +32326163616332623862343734326432333865626432653736346565613832616438386331323439 +62626332366261646539646631336466396135363033373735303663366162656636663664653963 +31363036336637626563336138336161333032336535653462316639383761386436386138373637 +35666534336237366139393039333235326662653337626435396131363837383933653632333634 +32663037623534373737656265633530663933356563343262356234343363343437313135306132 +39353134373733323430313736653239653531373333343632373133363534616561343731353832 +37353235653134346138313830336566633732346135356339333637643166643866353832306630 +33356432326466343166373132376339313338623761326338646163383664313237346135613261 +39393636646530343636376638666234363562356365626366666536376566643339346135623736 +66633265303733656633623232303330333161616563393034333633613237646663 diff --git a/group_vars/vps/sysctl.yml b/group_vars/vps/sysctl.yml deleted file mode 100644 index 1ffb606..0000000 --- a/group_vars/vps/sysctl.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -# Sysctl-Override fuer netcup VPS (Reverse Proxy / WG-Hub). -# Unterschiede zum Default (roles/sysctl/defaults): -# + net.core.default_qdisc = fq (optimal fuer BBR-Pacing) -# - vm.swappiness / vm.dirty_ratio / vm.dirty_background_ratio -# (VM-I/O-spezifisch, auf Edge-VPS irrelevant; dort in 99-nc-kernel.conf gesetzt) -# Entspricht dem manuell gesetzten /etc/sysctl.d/99-net-tuning.conf (15.06.2026). -sysctl_params: - - { key: net.core.rmem_default, value: "262144" } - - { key: net.core.wmem_default, value: "262144" } - - { key: net.core.rmem_max, value: "67108864" } - - { key: net.core.wmem_max, value: "67108864" } - - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } - - { key: net.ipv4.tcp_window_scaling, value: "1" } - - { key: net.core.default_qdisc, value: "fq" } - - { key: net.ipv4.tcp_congestion_control, value: "bbr" } - - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - - { key: net.ipv4.tcp_fastopen, value: "3" } - - { key: net.core.netdev_max_backlog, value: "16384" } - - { key: net.core.somaxconn, value: "4096" } - - { key: net.ipv4.tcp_notsent_lowat, value: "16384" } - - { key: net.ipv4.tcp_fin_timeout, value: "15" } - - { key: net.ipv4.tcp_tw_reuse, value: "1" } - - { key: net.ipv4.tcp_mtu_probing, value: "1" } - - { key: net.ipv4.ip_forward, value: "1" } - - { key: net.ipv6.conf.all.forwarding, value: "1" } diff --git a/hawser.yml b/hawser.yml index 8bb93f1..155f6d9 100644 --- a/hawser.yml +++ b/hawser.yml @@ -1,6 +1,6 @@ --- - name: Hawser Setup - hosts: hawser + hosts: all become: yes roles: - hawser diff --git a/host_vars/emby-sascha/frp.yml b/host_vars/emby-sascha/frp.yml index dbf0cc0..cdf2bc3 100644 --- a/host_vars/emby-sascha/frp.yml +++ b/host_vars/emby-sascha/frp.yml @@ -4,7 +4,3 @@ frp_proxies: local_ip: "0.0.0.0" local_port: 8096 remote_port: 18096 - - name: jellyfin - local_ip: "0.0.0.0" - local_port: 9096 - remote_port: 38096 diff --git a/host_vars/gluster-n1/vars.yml b/host_vars/gluster-n1/vars.yml deleted file mode 100644 index 1f4b566..0000000 --- a/host_vars/gluster-n1/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.1.1.135 -ansible_user: sascha diff --git a/host_vars/gluster-n3/vars.yml b/host_vars/gluster-n3/vars.yml deleted file mode 100644 index e3fa4f2..0000000 --- a/host_vars/gluster-n3/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.3.1.135 -ansible_user: sascha diff --git a/host_vars/gluster-n6/vars.yml b/host_vars/gluster-n6/vars.yml deleted file mode 100644 index 767855f..0000000 --- a/host_vars/gluster-n6/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.6.1.135 -ansible_user: sascha diff --git a/host_vars/k3s-control/vars.yml b/host_vars/k3s-control/vars.yml deleted file mode 100644 index 23d6efd..0000000 --- a/host_vars/k3s-control/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.3.1.110 -ansible_user: sascha diff --git a/host_vars/k3s-worker1/vars.yml b/host_vars/k3s-worker1/vars.yml deleted file mode 100644 index d5fd92c..0000000 --- a/host_vars/k3s-worker1/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.3.1.111 -ansible_user: sascha diff --git a/host_vars/k3s-worker2/vars.yml b/host_vars/k3s-worker2/vars.yml deleted file mode 100644 index a3c637f..0000000 --- a/host_vars/k3s-worker2/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.3.1.112 -ansible_user: sascha diff --git a/host_vars/k3s-worker3/vars.yml b/host_vars/k3s-worker3/vars.yml deleted file mode 100644 index 05857a3..0000000 --- a/host_vars/k3s-worker3/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.3.1.113 -ansible_user: sascha diff --git a/host_vars/kometa/vars.yml b/host_vars/kometa/vars.yml deleted file mode 100644 index d29d13e..0000000 --- a/host_vars/kometa/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.5.1.115 -ansible_user: sascha diff --git a/host_vars/node1/wireguard.yml b/host_vars/node1/wireguard.yml index fa04ff1..998d96b 100644 --- a/host_vars/node1/wireguard.yml +++ b/host_vars/node1/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.11/24" wireguard_private_key: "{{ vault_node1_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/node2/wireguard.yml b/host_vars/node2/wireguard.yml index f48d6fc..e5b945a 100644 --- a/host_vars/node2/wireguard.yml +++ b/host_vars/node2/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.12/24" wireguard_private_key: "{{ vault_node2_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/node3/wireguard.yml b/host_vars/node3/wireguard.yml index e3db84a..cc2aa6d 100644 --- a/host_vars/node3/wireguard.yml +++ b/host_vars/node3/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.13/24" wireguard_private_key: "{{ vault_node3_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/node4/wireguard.yml b/host_vars/node4/wireguard.yml index 264831b..dec9b57 100644 --- a/host_vars/node4/wireguard.yml +++ b/host_vars/node4/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.14/24" wireguard_private_key: "{{ vault_node4_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/node5/wireguard.yml b/host_vars/node5/wireguard.yml index d512d55..67ea94d 100644 --- a/host_vars/node5/wireguard.yml +++ b/host_vars/node5/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.15/24" wireguard_private_key: "{{ vault_node5_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/node6/wireguard.yml b/host_vars/node6/wireguard.yml index 267bdf7..0a22910 100644 --- a/host_vars/node6/wireguard.yml +++ b/host_vars/node6/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.16/24" wireguard_private_key: "{{ vault_node6_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/node7/wireguard.yml b/host_vars/node7/wireguard.yml index 8bb84fc..64373e5 100644 --- a/host_vars/node7/wireguard.yml +++ b/host_vars/node7/wireguard.yml @@ -1,4 +1,4 @@ --- wireguard_address: "10.200.200.17/24" wireguard_private_key: "{{ vault_node7_wg_privkey }}" -wireguard_allowed_ips: "10.200.200.0/24, 10.10.1.0/24" +wireguard_allowed_ips: "10.200.200.0/24" diff --git a/host_vars/paperless/vars.yml b/host_vars/paperless/vars.yml deleted file mode 100644 index 84278d2..0000000 --- a/host_vars/paperless/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.5.1.120 -ansible_user: sascha diff --git a/host_vars/satisfactory/vars.yml b/host_vars/satisfactory/vars.yml deleted file mode 100644 index dedd035..0000000 --- a/host_vars/satisfactory/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.3.1.120 -ansible_user: sascha diff --git a/host_vars/thelounge/vars.yml b/host_vars/thelounge/vars.yml deleted file mode 100644 index 647507b..0000000 --- a/host_vars/thelounge/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.5.1.117 -ansible_user: sascha diff --git a/host_vars/wolfstack-vm/vars.yml b/host_vars/wolfstack-vm/vars.yml deleted file mode 100644 index e80eec1..0000000 --- a/host_vars/wolfstack-vm/vars.yml +++ /dev/null @@ -1,2 +0,0 @@ -ansible_host: 10.1.1.110 -ansible_user: sascha diff --git a/id_ed25519.pub b/id_ed25519.pub index 3653f9e..3d2b81b 100644 --- a/id_ed25519.pub +++ b/id_ed25519.pub @@ -1 +1 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026 +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPl/Zptf1zTIgIv01zekT3SqdJfDR10vfTljP1QvHwez sascha@proxy diff --git a/iso-builder/build-iso.sh b/iso-builder/build-iso.sh index b033f95..2c6cc14 100755 --- a/iso-builder/build-iso.sh +++ b/iso-builder/build-iso.sh @@ -1,5 +1,5 @@ #!/bin/bash -#set -e +set -e # ============================================================ # Debian Unattended ISO Builder @@ -20,7 +20,7 @@ DNS="1.1.1.1" HOSTNAME="debian" USER="sascha" PASSWORD="" -SSH_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026" +SSH_KEY_FILE="$HOME/.ssh/id_ed25519.pub" OUTPUT_DIR="$SCRIPT_DIR/output" NODE="" VMID="" @@ -49,6 +49,7 @@ Optional: --hostname NAME Hostname (default: debian) --user USER Username (default: sascha) --password PASS Password (will be prompted if not set) + --ssh-key FILE SSH public key file (default: ~/.ssh/id_ed25519.pub) --output DIR Output directory (default: ./output) --debian-version VER Debian version (default: 13) @@ -79,6 +80,7 @@ while [[ $# -gt 0 ]]; do --hostname) HOSTNAME="$2"; shift 2;; --user) USER="$2"; shift 2;; --password) PASSWORD="$2"; shift 2;; + --ssh-key) SSH_KEY_FILE="$2"; shift 2;; --output) OUTPUT_DIR="$2"; shift 2;; --debian-version) DEBIAN_VERSION="$2"; shift 2;; --node) NODE="$2"; shift 2;; @@ -124,7 +126,13 @@ if [[ -z "$PASSWORD" ]]; then fi PASSWORD_HASH=$(echo "$PASSWORD" | openssl passwd -6 -stdin) -echo "SSH key: pfannkuchen-20260408" +# --- SSH Key --- +if [[ -f "$SSH_KEY_FILE" ]]; then + SSH_KEY=$(cat "$SSH_KEY_FILE") +else + echo "Warning: SSH key file not found: $SSH_KEY_FILE" + SSH_KEY="" +fi # --- Download Debian ISO --- ISO_URL="https://cdimage.debian.org/debian-cd/current/${ARCH}/iso-cd/debian-${DEBIAN_VERSION}.*-${ARCH}-netinst.iso" @@ -225,7 +233,7 @@ echo "Host: $HOSTNAME" echo "IP: $IP" echo "Gateway: $GATEWAY" echo "User: $USER" -echo "SSH Key: pfannkuchen-20260408" +echo "SSH Key: $(echo $SSH_KEY | cut -c1-40)..." echo "============================================" echo "" if [[ -n "$PVE_HOST" ]]; then @@ -236,12 +244,7 @@ if [[ -n "$PVE_HOST" ]]; then if [[ "$CREATE_VM" == true ]]; then ISO_NAME="$(basename "$OUTPUT_ISO")" - # Storage Logic: PowerStore for 1,3,6,7 / LVM-Thin for 2,4,5 - if [[ "$NODE" =~ ^(1|3|6|7)$ ]]; then - STORAGE="powerstore-node${NODE}" - else - STORAGE="lvm-thin" - fi + STORAGE="powerstore-node${NODE}" PVE_NODE="node${NODE}" # Auto-assign next free VMID if not specified diff --git a/net-watchdog.yml b/net-watchdog.yml deleted file mode 100644 index 4836489..0000000 --- a/net-watchdog.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- hosts: automation1 - become: true - roles: - - net_watchdog diff --git a/patchmon-agent.yml b/patchmon-agent.yml deleted file mode 100644 index d637e29..0000000 --- a/patchmon-agent.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- -- name: PatchMon Agent (Docker-VMs) - hosts: hawser - become: yes - roles: - - patchmon-agent - -- name: PatchMon Agent (Proxmox Hosts) - hosts: proxmox - become: yes - tasks: - - name: Prüfen ob patchmon-agent bereits installiert ist - ansible.builtin.stat: - path: /usr/local/bin/patchmon-agent - register: patchmon_bin - - - name: Prüfen ob Agent bereits enrolled ist - ansible.builtin.command: /usr/local/bin/patchmon-agent ping - register: patchmon_ping - changed_when: false - failed_when: false - when: patchmon_bin.stat.exists - - - name: PatchMon Agent installieren (Auto-Enrollment) - ansible.builtin.shell: | - curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh - args: - creates: /etc/patchmon/credentials.yml - when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0) diff --git a/pfannkuchen.ini b/pfannkuchen.ini index 67a065d..b5b9edc 100644 --- a/pfannkuchen.ini +++ b/pfannkuchen.ini @@ -10,16 +10,6 @@ node7 ansible_host=10.5.85.17 [proxmox:vars] ansible_user=root -[infrastructure] -# Infrastructure hosts (placeholder for backup:children) -node1 -node2 -node3 -node4 -node5 -node6 -node7 - [media] emby-sascha ansible_host=10.6.1.103 immich ansible_host=10.4.1.107 @@ -37,30 +27,26 @@ dockhand ansible_host=10.4.1.116 [auto] n8n ansible_host=10.4.1.113 -hermes ansible_host=10.4.1.100 +openclaw ansible_host=10.4.1.100 monitoring ansible_host=10.1.1.111 automation1 ansible_host=10.5.85.5 outline ansible_host=10.1.1.100 -k3s-control ansible_host=10.3.1.110 -k3s-worker2 ansible_host=10.3.1.112 -k3s-worker3 ansible_host=10.3.1.113 -k3s-worker1 ansible_host=10.3.1.111 -satisfactory ansible_host=10.3.1.120 -wolfstack-vm ansible_host=10.1.1.110 +funkwerk-ai ansible_host=10.1.1.10 [communication] matrix ansible_host=10.4.1.110 -[ai] -# Homelab AI-Orchestrator (Pi5 Bare Metal, arm64, Cloud-LLM Tool-Layer vor dem Butler-Dienst) -butler ansible_host=10.5.85.2 +[infrastructure] +pbs ansible_host=10.3.1.10 ansible_user=root + +[83] +auris-integration ansible_host=10.5.83.151 ansible_user=fia ansible_password=kronerew ansible_become_password=kronerew base_user=fia +susi ansible_host=10.5.83.8 ansible_user=sascha ansible_password=GT500r8 ansible_become_password=GT500r8 base_user=sascha +tunnel-test ansible_host=10.6.1.99 [hetzner] -pfannkuchen ansible_host=159.69.245.190 ansible_user=root ansible_port=2505 - -[vps] -# netcup VPS (Nuernberg) - WireGuard-Hub + Caddy Reverse Proxy, seit 13.06.2026 -netcup ansible_host=194.13.80.132 ansible_user=root +test-vps ansible_host=78.46.186.211 ansible_user=root ansible_port=22 ansible_ssh_private_key_file=~/.ssh/id_ed25519 +pfannkuchen ansible_host=159.69.245.190 ansible_user=root ansible_port=2505 ansible_ssh_private_key_file=~/.ssh/id_ed25519 [nvidia] tdarr @@ -74,6 +60,10 @@ node4 node6 node7 +[frp] +emby-sascha +emby-chris + [wireguard] node1 node2 @@ -83,6 +73,14 @@ node5 node6 node7 +[hawser:children] +media +arr +docker +auto +communication +hetzner + [all:children] media arr @@ -92,8 +90,6 @@ communication infrastructure hetzner proxmox -vps -ai [backup:children] media @@ -104,17 +100,9 @@ communication proxmox hetzner infrastructure -ai # Credentials liegen in group_vars/ (nicht im INI, da kein Jinja2-Support) -[hawser:children] -media -arr -docker -auto -communication -hetzner -ai - - +[xray] +emby-sascha +emby-chris diff --git a/remove-postfix.yml b/remove-postfix.yml deleted file mode 100644 index 42eb814..0000000 --- a/remove-postfix.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- -- name: Disable postfix on all hosts - hosts: all - tasks: - - name: Check if postfix is installed - ansible.builtin.command: which postfix - register: postfix_check - changed_when: false - failed_when: false - - - name: Stop and disable postfix - ansible.builtin.systemd: - name: postfix - state: stopped - enabled: false - when: postfix_check.rc == 0 - - - name: Set postfix to localhost-only - ansible.builtin.lineinfile: - path: /etc/postfix/main.cf - regexp: '^inet_interfaces\s*=' - line: 'inet_interfaces = loopback-only' - when: postfix_check.rc == 0 - - - name: Set relayhost to empty - ansible.builtin.lineinfile: - path: /etc/postfix/main.cf - regexp: '^relayhost\s*=' - line: 'relayhost =' - when: postfix_check.rc == 0 diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 303b12a..fe4cf28 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -1,13 +1,4 @@ --- -- name: Raspberry Pi OS erkennen (raspi-Repo vorhanden?) - stat: - path: /etc/apt/sources.list.d/raspi.sources - register: raspi_repo - -- name: Fakt is_raspberry setzen - set_fact: - is_raspberry: "{{ raspi_repo.stat.exists }}" - - name: Hostname setzen hostname: name: "{{ inventory_hostname }}" @@ -18,19 +9,11 @@ regexp: '^127\.0\.1\.1' line: "127.0.1.1 {{ inventory_hostname }}.local {{ inventory_hostname }}" -- name: Prüfe ob Benutzer {{ base_user }} existiert - getent: - database: passwd - key: "{{ base_user }}" - register: base_user_check - ignore_errors: yes - - name: SSH Public Key für Benutzer {{ base_user }} hinterlegen ansible.posix.authorized_key: user: "{{ base_user }}" state: present key: "{{ vault_ssh_pubkey }}" - when: base_user_check is succeeded - name: SSH Private Key für Benutzer {{ base_user }} deployen copy: @@ -39,7 +22,6 @@ owner: "{{ base_user }}" group: "{{ base_user }}" mode: "0600" - when: base_user_check is succeeded - name: SSH Public Key Datei für Benutzer {{ base_user }} deployen copy: @@ -48,7 +30,6 @@ owner: "{{ base_user }}" group: "{{ base_user }}" mode: "0644" - when: base_user_check is succeeded - name: SSH Key auch für root hinterlegen ansible.posix.authorized_key: @@ -64,7 +45,7 @@ group: root mode: "0600" -- name: Standard Debian Trixie Repositories setzen (nicht auf Raspberry Pi OS) +- name: Standard Debian Trixie Repositories setzen copy: dest: /etc/apt/sources.list content: | @@ -80,7 +61,6 @@ group: root mode: '0644' register: repo_status - when: not is_raspberry - name: Apt Cache aktualisieren (falls Repos geändert wurden) apt: @@ -105,28 +85,24 @@ name: locales state: present -- name: de_DE.UTF-8 Locale generieren +- name: en_US.UTF-8 Locale generieren locale_gen: - name: de_DE.UTF-8 + name: en_US.UTF-8 state: present -- name: Systemweite Sprache auf de_DE.UTF-8 setzen +- name: Systemweite Sprache auf en_US.UTF-8 setzen debconf: name: locales question: locales/default_environment_locale - value: de_DE.UTF-8 + value: en_US.UTF-8 vtype: select - name: Locale-Datei manuell schreiben (Sicherheitsnetz) copy: dest: /etc/default/locale content: | - LANG=de_DE.UTF-8 - LC_ALL=de_DE.UTF-8 - -- name: Zeitzone auf Europe/Berlin setzen - timezone: - name: Europe/Berlin + LANG=en_US.UTF-8 + LC_ALL=en_US.UTF-8 - name: Gruppe sudo passwortloses sudo erlauben lineinfile: @@ -141,23 +117,18 @@ name: "{{ base_user }}" groups: sudo append: yes - when: base_user_check is succeeded - name: Unnötige Pakete entfernen apt: autoremove: yes -- name: QEMU Guest Agent installieren (nur VMs, nicht Raspberry Pi) +- name: QEMU Guest Agent installieren apt: name: qemu-guest-agent state: present - ignore_errors: yes - when: not is_raspberry -- name: QEMU Guest Agent aktivieren (nur VMs, nicht Raspberry Pi) +- name: QEMU Guest Agent aktivieren service: name: qemu-guest-agent state: started enabled: yes - ignore_errors: yes - when: not is_raspberry diff --git a/roles/borg/templates/borgmatic.yml.j2 b/roles/borg/templates/borgmatic.yml.j2 index ef61e06..d4278fe 100644 --- a/roles/borg/templates/borgmatic.yml.j2 +++ b/roles/borg/templates/borgmatic.yml.j2 @@ -28,27 +28,8 @@ before_backup: after_backup: - curl -fsS -m 10 "https://status.guck.tv/api/push/borg-{{ inventory_hostname }}?status=up&msg=OK&ping=" || true - - >- - bash -c ' - STATS=$(borgmatic info --archive latest --json 2>/dev/null | python3 -c " - import sys,json - d=json.load(sys.stdin)[0][\"archives\"][-1] - s=d.get(\"stats\",{}) - print(json.dumps({ - \"host\":\"{{ inventory_hostname }}\", - \"status\":\"ok\", - \"duration_sec\":int(s.get(\"duration\",0)), - \"original_size\":s.get(\"original_size\",0), - \"deduplicated_size\":s.get(\"deduplicated_size\",0), - \"compressed_size\":s.get(\"compressed_size\",0), - \"nfiles_new\":s.get(\"nfiles\",0) - }))" 2>/dev/null || echo "{\"host\":\"{{ inventory_hostname }}\",\"status\":\"ok\"}"); - curl -fsS -m 10 -X POST -H "Content-Type: application/json" -d "$STATS" "http://10.1.1.111:9999/api/push" || true - ' + - curl -fsS -m 10 "http://10.1.1.111:9999/push?host={{ inventory_hostname }}&status=ok" || true on_error: - curl -fsS -m 10 "https://status.guck.tv/api/push/borg-{{ inventory_hostname }}?status=down&msg=FEHLER&ping=" || true - - >- - curl -fsS -m 10 -X POST -H "Content-Type: application/json" - -d '{"host":"{{ inventory_hostname }}","status":"error","message":"Backup fehlgeschlagen"}' - "http://10.1.1.111:9999/api/push" || true + - curl -fsS -m 10 "http://10.1.1.111:9999/push?host={{ inventory_hostname }}&status=error&msg=Backup%20fehlgeschlagen" || true diff --git a/roles/dns_resolver/handlers/main.yml b/roles/dns_resolver/handlers/main.yml index 2d11faf..a7619b6 100644 --- a/roles/dns_resolver/handlers/main.yml +++ b/roles/dns_resolver/handlers/main.yml @@ -1,5 +1,3 @@ --- -- name: restart dnscrypt-proxy - systemd: - name: dnscrypt-proxy - state: restarted +- name: update resolvconf + command: resolvconf -u diff --git a/roles/dns_resolver/tasks/main.yml b/roles/dns_resolver/tasks/main.yml index e9d699b..dec629c 100644 --- a/roles/dns_resolver/tasks/main.yml +++ b/roles/dns_resolver/tasks/main.yml @@ -1,16 +1,24 @@ --- -- name: DNS resolver auf DoH setzen (via automation1) +- name: Set DNS resolver (resolvconf) copy: content: | nameserver 10.5.85.5 + nameserver 1.1.1.1 + dest: /etc/resolvconf/resolv.conf.d/head + mode: '0644' + when: ansible_facts.packages is defined and 'resolvconf' in ansible_facts.packages + notify: update resolvconf + +- name: Set DNS resolver (direct) + copy: + content: | + nameserver 10.5.85.5 + nameserver 1.1.1.1 dest: /etc/resolv.conf mode: '0644' - when: inventory_hostname != 'automation1' + when: ansible_facts.packages is not defined or 'resolvconf' not in ansible_facts.packages -- name: dnscrypt-proxy stoppen auf VMs (nicht noetig) - systemd: - name: dnscrypt-proxy - state: stopped - enabled: false - when: inventory_hostname != 'automation1' - ignore_errors: true +- name: Gather package facts + package_facts: + manager: auto + when: ansible_facts.packages is not defined diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml index bab3c80..d5e3a04 100644 --- a/roles/docker/tasks/main.yml +++ b/roles/docker/tasks/main.yml @@ -11,16 +11,10 @@ dest: /etc/apt/keyrings/docker.asc mode: '0644' -- name: dpkg-Architektur ermitteln (amd64/arm64) - command: dpkg --print-architecture - register: dpkg_arch - changed_when: false - check_mode: false - - name: Docker Repository Datei erstellen copy: dest: /etc/apt/sources.list.d/docker.list - content: "deb [arch={{ dpkg_arch.stdout }} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian trixie stable" + content: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian trixie stable" mode: '0644' register: docker_repo diff --git a/roles/frp_client/tasks/main.yml b/roles/frp_client/tasks/main.yml index e402bdf..19577ed 100644 --- a/roles/frp_client/tasks/main.yml +++ b/roles/frp_client/tasks/main.yml @@ -31,7 +31,7 @@ serverPort = {{ frp_server_port }} auth.method = "token" auth.token = "{{ frp_token }}" - transport.protocol = "tcp" + transport.protocol = "quic" transport.poolCount = 5 transport.tcpMux = true {% for proxy in frp_proxies %} @@ -43,6 +43,8 @@ localPort = {{ proxy.local_port }} remotePort = {{ proxy.remote_port }} transport.useCompression = true + transport.bandwidthLimit = "{{ proxy.bandwidth_limit | default('6MB') }}" + transport.bandwidthLimitMode = "server" {% endfor %} mode: "0600" notify: restart frpc diff --git a/roles/hawser/tasks/main.yml b/roles/hawser/tasks/main.yml index 4e61e5b..daaf7d1 100644 --- a/roles/hawser/tasks/main.yml +++ b/roles/hawser/tasks/main.yml @@ -1,44 +1,14 @@ --- -- name: Hawser installieren +- name: Hawser installieren (offizielles Install-Script) ansible.builtin.shell: - cmd: | - ARCH=$(dpkg --print-architecture) - VERSION=0.2.39 - curl -fsSL "https://github.com/Finsys/hawser/releases/download/v${VERSION}/hawser_${VERSION}_linux_${ARCH}.tar.gz" | tar xz -C /usr/local/bin hawser - chmod +x /usr/local/bin/hawser + cmd: curl -fsSL https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh | bash creates: /usr/local/bin/hawser -- name: Hawser config Verzeichnis - ansible.builtin.file: - path: /etc/hawser - state: directory - - name: Hawser Token in Config setzen ansible.builtin.lineinfile: path: /etc/hawser/config regexp: '^TOKEN=' line: "TOKEN={{ vault_hawser_token }}" - create: yes - notify: restart hawser - -- name: Hawser systemd Service - ansible.builtin.copy: - dest: /etc/systemd/system/hawser.service - content: | - [Unit] - Description=Hawser Agent - After=docker.service - Requires=docker.service - - [Service] - Type=simple - EnvironmentFile=/etc/hawser/config - ExecStart=/usr/local/bin/hawser - Restart=always - RestartSec=10 - - [Install] - WantedBy=multi-user.target notify: restart hawser - name: Hawser aktivieren und starten diff --git a/roles/net_watchdog/defaults/main.yml b/roles/net_watchdog/defaults/main.yml deleted file mode 100644 index 1d58608..0000000 --- a/roles/net_watchdog/defaults/main.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -watchdog_iface: "ens192" -watchdog_subnet: "10.5.85.0/24" -watchdog_cron_interval: "*/5" -watchdog_webhook_url: "{{ vault_watchdog_webhook_url | default('') }}" - -# Bekannte Hosts im Management-Netz (MAC|IP|Name) -# Bei neuer VM/Host: hier eintragen + ./pfannkuchen.sh watchdog -watchdog_known_hosts: - - { mac: "c8:4f:86:fc:00:09", ip: "10.5.85.1", name: "Gateway/Switch" } - - { mac: "00:11:32:45:79:28", ip: "10.5.85.10", name: "Synology NAS" } - - { mac: "00:50:56:9a:24:35", ip: "10.5.85.5", name: "automation1" } - # Proxmox Nodes - - { mac: "e4:3d:1a:3c:62:9a", ip: "10.5.85.11", name: "node1" } - - { mac: "00:1b:21:de:10:95", ip: "10.5.85.12", name: "node2" } - - { mac: "e4:3d:1a:3c:57:6c", ip: "10.5.85.13", name: "node3" } - - { mac: "2c:ea:7f:a8:a5:9f", ip: "10.5.85.14", name: "node4" } - - { mac: "2c:ea:7f:a8:a9:3f", ip: "10.5.85.15", name: "node5" } - - { mac: "e4:3d:1a:3c:3f:a8", ip: "10.5.85.16", name: "node6" } - - { mac: "e4:3d:1a:3c:88:da", ip: "10.5.85.17", name: "node7" } - # Kubernetes VMs (shared MAC = normal bei Proxmox VMs auf gleichem Node) - - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.101", name: "kube-work1" } - - { mac: "7a:e8:f0:11:96:20", ip: "10.5.85.103", name: "kube-ctrl" } diff --git a/roles/net_watchdog/tasks/main.yml b/roles/net_watchdog/tasks/main.yml deleted file mode 100644 index f55c88d..0000000 --- a/roles/net_watchdog/tasks/main.yml +++ /dev/null @@ -1,18 +0,0 @@ ---- -- name: arp-scan installieren - ansible.builtin.apt: - name: arp-scan - state: present - -- name: Watchdog Script deployen - ansible.builtin.template: - src: net-watchdog.sh.j2 - dest: /usr/local/bin/net-watchdog.sh - mode: "0755" - -- name: Cronjob einrichten - ansible.builtin.cron: - name: "net-watchdog" - minute: "{{ watchdog_cron_interval }}" - job: "/usr/local/bin/net-watchdog.sh --quiet" - user: root diff --git a/roles/net_watchdog/templates/net-watchdog.sh.j2 b/roles/net_watchdog/templates/net-watchdog.sh.j2 deleted file mode 100644 index 62c4cc6..0000000 --- a/roles/net_watchdog/templates/net-watchdog.sh.j2 +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash -# Network Watchdog – generiert von Ansible -# Scannt {{ watchdog_subnet }} auf {{ watchdog_iface }} alle {{ watchdog_cron_interval }} -set -euo pipefail - -IFACE="{{ watchdog_iface }}" -SUBNET="{{ watchdog_subnet }}" -LOGFILE="/var/log/net-watchdog.log" -WEBHOOK_URL="{{ watchdog_webhook_url }}" - -# Whitelist (generiert aus Ansible defaults/main.yml) -declare -A KNOWN -{% for host in watchdog_known_hosts %} -KNOWN["{{ host.mac }}|{{ host.ip }}"]="{{ host.name }}" -{% endfor %} - -QUIET="${1:-}" - -log() { - local msg="$(date '+%Y-%m-%d %H:%M:%S') $1" - echo "$msg" >> "$LOGFILE" - [ "$QUIET" != "--quiet" ] && echo "$msg" -} - -SCAN=$(/usr/sbin/arp-scan --interface="$IFACE" "$SUBNET" 2>/dev/null \ - | grep -E '^[0-9]+\.' | awk '{print $2"|"$1}') - -UNKNOWN="" -ALERT_COUNT=0 - -while IFS= read -r line; do - [ -z "$line" ] && continue - mac=$(echo "$line" | cut -d'|' -f1) - ip=$(echo "$line" | cut -d'|' -f2) - if [ -z "${KNOWN["${mac}|${ip}"]:-}" ]; then - UNKNOWN+="⚠️ ${ip} (MAC: ${mac})\n" - log "ALERT: Unbekannter Host ${ip} MAC=${mac}" - ((ALERT_COUNT++)) - fi -done <<< "$SCAN" - -if [ "$ALERT_COUNT" -gt 0 ]; then - log "SCAN: ${ALERT_COUNT} unbekannte Hosts!" - if [ -n "$WEBHOOK_URL" ]; then - curl -s -X POST "$WEBHOOK_URL" \ - -H "Content-Type: application/json" \ - -d "{\"event\":\"unknown_host\",\"subnet\":\"${SUBNET}\",\"count\":${ALERT_COUNT},\"details\":\"$(echo -e "$UNKNOWN" | tr '\n' ' ')\",\"timestamp\":\"$(date -Iseconds)\"}" \ - >/dev/null 2>&1 || log "WARN: Webhook fehlgeschlagen" - fi - [ "$QUIET" != "--quiet" ] && echo -e "\n${UNKNOWN}" - exit 1 -else - log "SCAN: OK – alle $(echo "$SCAN" | wc -l) Hosts bekannt" - exit 0 -fi diff --git a/roles/nvidia/tasks/main.yml b/roles/nvidia/tasks/main.yml index 85ea387..c08b1cc 100644 --- a/roles/nvidia/tasks/main.yml +++ b/roles/nvidia/tasks/main.yml @@ -44,7 +44,6 @@ ansible.builtin.apt: name: - linux-headers-{{ ansible_kernel }} - - linux-headers-amd64 - dkms state: present diff --git a/roles/patchmon-agent/handlers/main.yml b/roles/patchmon-agent/handlers/main.yml deleted file mode 100644 index 9285648..0000000 --- a/roles/patchmon-agent/handlers/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: restart patchmon-agent - ansible.builtin.systemd: - name: patchmon-agent - state: restarted diff --git a/roles/patchmon-agent/tasks/main.yml b/roles/patchmon-agent/tasks/main.yml deleted file mode 100644 index f10eb5b..0000000 --- a/roles/patchmon-agent/tasks/main.yml +++ /dev/null @@ -1,33 +0,0 @@ ---- -- name: Prüfen ob patchmon-agent bereits installiert ist - ansible.builtin.stat: - path: /usr/local/bin/patchmon-agent - register: patchmon_bin - -- name: Prüfen ob Agent bereits enrolled ist - ansible.builtin.command: /usr/local/bin/patchmon-agent ping - register: patchmon_ping - changed_when: false - failed_when: false - when: patchmon_bin.stat.exists - -- name: PatchMon Agent installieren (Auto-Enrollment) - ansible.builtin.shell: | - curl -sk "https://patchmon.sascha-lutz.de/api/v1/auto-enrollment/script?type=direct-host&token_key={{ vault_patchmon_token_key }}&token_secret={{ vault_patchmon_token_secret }}" | sh - args: - creates: /etc/patchmon/credentials.yml - when: not patchmon_bin.stat.exists or (patchmon_ping.rc is defined and patchmon_ping.rc != 0) - -- name: Server-URL sicherstellen - ansible.builtin.lineinfile: - path: /etc/patchmon/config.yml - regexp: '^patchmon_server:' - line: 'patchmon_server: "https://patchmon.sascha-lutz.de"' - notify: restart patchmon-agent - -- name: Docker-Integration aktivieren - ansible.builtin.lineinfile: - path: /etc/patchmon/config.yml - regexp: '^\s*docker:' - line: ' docker: true' - notify: restart patchmon-agent diff --git a/roles/sysctl/defaults/main.yml b/roles/sysctl/defaults/main.yml deleted file mode 100644 index faa4bf4..0000000 --- a/roles/sysctl/defaults/main.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# Default-Sysctl-Werte fuer Streaming-VMs. -# Pro Host/Gruppe ueberschreibbar via group_vars/host_vars (z.B. group_vars/vps). -sysctl_params: - - { key: net.core.rmem_default, value: "262144" } - - { key: net.core.wmem_default, value: "262144" } - - { key: net.core.rmem_max, value: "67108864" } - - { key: net.core.wmem_max, value: "67108864" } - - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } - - { key: net.ipv4.tcp_window_scaling, value: "1" } - - { key: net.ipv4.tcp_congestion_control, value: "bbr" } - - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - - { key: net.ipv4.tcp_fastopen, value: "3" } - - { key: net.core.netdev_max_backlog, value: "16384" } - - { key: net.core.somaxconn, value: "4096" } - - { key: net.ipv4.tcp_notsent_lowat, value: "16384" } - - { key: net.ipv4.tcp_fin_timeout, value: "15" } - - { key: net.ipv4.tcp_tw_reuse, value: "1" } - - { key: vm.swappiness, value: "1" } - - { key: vm.dirty_ratio, value: "15" } - - { key: vm.dirty_background_ratio, value: "5" } - - { key: net.ipv4.tcp_mtu_probing, value: "1" } - - { key: net.ipv4.ip_forward, value: "1" } - - { key: net.ipv6.conf.all.forwarding, value: "1" } diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml index 3563613..c77063e 100644 --- a/roles/sysctl/tasks/main.yml +++ b/roles/sysctl/tasks/main.yml @@ -17,4 +17,25 @@ sysctl_file: /etc/sysctl.d/99-net-tuning.conf reload: true state: present - loop: "{{ sysctl_params }}" + loop: + - { key: net.core.rmem_default, value: "262144" } + - { key: net.core.wmem_default, value: "262144" } + - { key: net.core.rmem_max, value: "67108864" } + - { key: net.core.wmem_max, value: "67108864" } + - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } + - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } + - { key: net.ipv4.tcp_window_scaling, value: "1" } + - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } + - { key: net.ipv4.tcp_fastopen, value: "3" } + - { key: net.core.netdev_max_backlog, value: "16384" } + - { key: net.core.somaxconn, value: "4096" } + - { key: net.ipv4.tcp_notsent_lowat, value: "16384" } + - { key: net.ipv4.tcp_fin_timeout, value: "15" } + - { key: net.ipv4.tcp_tw_reuse, value: "1" } + - { key: vm.swappiness, value: "1" } + - { key: vm.dirty_ratio, value: "15" } + - { key: vm.dirty_background_ratio, value: "5" } + - { key: net.ipv4.tcp_mtu_probing, value: "1" } + - { key: net.ipv4.ip_forward, value: "1" } + - { key: net.ipv6.conf.all.forwarding, value: "1" } diff --git a/roles/tc_ratelimit/defaults/main.yml b/roles/tc_ratelimit/defaults/main.yml deleted file mode 100644 index a585004..0000000 --- a/roles/tc_ratelimit/defaults/main.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -tc_iface: "auto" -tc_flow_limit: "50mbit" -tc_total_limit: "500mbit" -tc_burst: "1mb" diff --git a/roles/tc_ratelimit/handlers/main.yml b/roles/tc_ratelimit/handlers/main.yml deleted file mode 100644 index 31d3466..0000000 --- a/roles/tc_ratelimit/handlers/main.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -- name: restart tc-ratelimit - ansible.builtin.systemd: - name: tc-ratelimit - state: restarted - daemon_reload: true diff --git a/roles/tc_ratelimit/tasks/main.yml b/roles/tc_ratelimit/tasks/main.yml deleted file mode 100644 index 30b8a70..0000000 --- a/roles/tc_ratelimit/tasks/main.yml +++ /dev/null @@ -1,33 +0,0 @@ ---- -- name: Netzwerk-Interface ermitteln - ansible.builtin.shell: - cmd: "ip -o link show | awk -F': ' '!/lo/{print $2; exit}'" - register: detected_iface - changed_when: false - when: tc_iface == "auto" - -- name: Interface setzen - ansible.builtin.set_fact: - tc_iface: "{{ detected_iface.stdout | trim }}" - when: tc_iface == "auto" - -- name: tc-ratelimit Script deployen - ansible.builtin.template: - src: tc-ratelimit.sh.j2 - dest: /usr/local/bin/tc-ratelimit.sh - mode: "0755" - notify: restart tc-ratelimit - -- name: Systemd Service deployen - ansible.builtin.template: - src: tc-ratelimit.service.j2 - dest: /etc/systemd/system/tc-ratelimit.service - mode: "0644" - notify: restart tc-ratelimit - -- name: Service aktivieren und starten - ansible.builtin.systemd: - name: tc-ratelimit - enabled: true - state: started - daemon_reload: true diff --git a/roles/tc_ratelimit/templates/tc-ratelimit.service.j2 b/roles/tc_ratelimit/templates/tc-ratelimit.service.j2 deleted file mode 100644 index a8c0a18..0000000 --- a/roles/tc_ratelimit/templates/tc-ratelimit.service.j2 +++ /dev/null @@ -1,13 +0,0 @@ -[Unit] -Description=tc per-flow rate limit ({{ tc_flow_limit }} per connection) -After=network-online.target -Wants=network-online.target - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/local/bin/tc-ratelimit.sh start -ExecStop=/usr/local/bin/tc-ratelimit.sh stop - -[Install] -WantedBy=multi-user.target diff --git a/roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 b/roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 deleted file mode 100644 index cc66939..0000000 --- a/roles/tc_ratelimit/templates/tc-ratelimit.sh.j2 +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -# tc per-flow rate limit – deployed via Ansible -# Jede TCP-Connection bekommt max {{ tc_flow_limit }} -IFACE="{{ tc_iface }}" -FLOW_LIMIT="{{ tc_flow_limit }}" -TOTAL_LIMIT="{{ tc_total_limit }}" -BURST="{{ tc_burst }}" - -case "${1}" in - start) - tc qdisc del dev "${IFACE}" root 2>/dev/null - tc qdisc add dev "${IFACE}" root handle 1: htb default 10 - tc class add dev "${IFACE}" parent 1: classid 1:1 htb rate "${TOTAL_LIMIT}" burst "${BURST}" - tc class add dev "${IFACE}" parent 1:1 classid 1:10 htb rate "${TOTAL_LIMIT}" burst "${BURST}" - tc qdisc add dev "${IFACE}" parent 1:10 handle 10: fq maxrate "${FLOW_LIMIT}" flow_limit 200 - echo "tc: ${FLOW_LIMIT}/flow on ${IFACE}" - ;; - stop) - tc qdisc del dev "${IFACE}" root 2>/dev/null - ;; - status) - tc -s qdisc show dev "${IFACE}" - tc -s class show dev "${IFACE}" - ;; - *) echo "Usage: $0 {start|stop|status}"; exit 1 ;; -esac diff --git a/rotate-ssh-key.yml b/rotate-ssh-key.yml deleted file mode 100644 index d717da7..0000000 --- a/rotate-ssh-key.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- -# Phase 1: Add new key alongside old keys -- name: Add new SSH key to all hosts - hosts: all - become: true - vars: - new_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBuZvobGuzkiukW9urE7ub2v9O2zri9QhvWUZocOVxN0 sascha@pfannkuchen-2026" - tasks: - - name: Set target user - set_fact: - target_user: "{{ base_user | default(ansible_user | default('sascha')) }}" - - - name: Add new key (keep old keys) - ansible.posix.authorized_key: - user: "{{ target_user }}" - key: "{{ new_key }}" - state: present diff --git a/sops-age.yml b/sops-age.yml deleted file mode 100644 index 8096ee0..0000000 --- a/sops-age.yml +++ /dev/null @@ -1,40 +0,0 @@ ---- -- name: SOPS + Age Key Deployment - hosts: all - become: yes - tasks: - - name: sops installieren - ansible.builtin.shell: | - if ! command -v sops &>/dev/null; then - curl -sLo /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64 - chmod +x /usr/local/bin/sops - fi - args: - creates: /usr/local/bin/sops - - - name: Age Key Verzeichnis erstellen - ansible.builtin.file: - path: /root/.config/sops/age - state: directory - mode: "0700" - - - name: Age Key deployen - ansible.builtin.copy: - content: | - # created: 2026-04-04T09:42:26+02:00 - # public key: age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr - AGE-SECRET-KEY-19RPRZ89VNDR6KECR7ULA38P8KJ7FHMXJ9N07UUJHLGSVMUW69LHS89XDD2 - dest: /root/.config/sops/age/keys.txt - mode: "0600" - - - name: sops decrypt Hook fuer Git-Repos erstellen - ansible.builtin.copy: - content: | - #!/bin/bash - # Post-merge hook: decrypt .env.enc after git pull - if [ -f .env.enc ]; then - sops -d --input-type dotenv --output-type dotenv .env.enc > .env - echo "[sops] .env decrypted" - fi - dest: /usr/local/bin/sops-decrypt-env - mode: "0755" diff --git a/tc-ratelimit.yml b/tc-ratelimit.yml deleted file mode 100644 index 8b7a486..0000000 --- a/tc-ratelimit.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- hosts: hetzner - become: true - roles: - - tc_ratelimit diff --git a/update.yml b/update.yml index 976ed5a..0c7ae87 100644 --- a/update.yml +++ b/update.yml @@ -9,50 +9,29 @@ upgrade: dist autoremove: yes - - name: Pruefen ob Reboot noetig ist (Debian) + - name: Pruefen ob Reboot noetig ist ansible.builtin.stat: path: /var/run/reboot-required register: reboot_required -- name: NVIDIA Check nach Upgrade +- name: NVIDIA Kernel Headers nach Upgrade sicherstellen hosts: nvidia become: yes tasks: - - name: Kernel Headers fuer alle installierten Kernel sicherstellen + - name: Kernel Headers und DKMS installieren und Module bauen ansible.builtin.shell: | export PATH=$PATH:/usr/sbin - # Headers fuer den laufenden UND den neuesten installierten Kernel - NEWEST_KERNEL=$(ls -t /boot/vmlinuz-* | head -1 | sed 's|/boot/vmlinuz-||') - apt-get install -y linux-headers-${NEWEST_KERNEL} linux-headers-$(uname -r) linux-headers-amd64 dkms + apt-get install -y linux-headers-$(uname -r) dkms dkms autoinstall register: headers_result changed_when: "'newly installed' in headers_result.stdout" - - name: NVIDIA Driver Mismatch pruefen - ansible.builtin.shell: nvidia-smi > /dev/null 2>&1 - register: nvidia_check - changed_when: false - failed_when: false - - - name: Reboot-Flag setzen bei NVIDIA Mismatch - ansible.builtin.set_fact: - nvidia_reboot_needed: true - when: nvidia_check.rc != 0 - - name: Reboot falls noetig hosts: all become: yes - serial: 3 tasks: - name: Reboot durchfuehren ansible.builtin.reboot: msg: "Reboot nach Update" reboot_timeout: 300 - when: > - hostvars[inventory_hostname].reboot_required.stat.exists | default(false) - or hostvars[inventory_hostname].nvidia_reboot_needed | default(false) - - - name: NVIDIA Treiber nach Reboot verifizieren - ansible.builtin.shell: nvidia-smi | head -3 - when: hostvars[inventory_hostname].nvidia_reboot_needed | default(false) - changed_when: false + when: hostvars[inventory_hostname].reboot_required.stat.exists