From 5fb6951583fbce6358d741c47b7152cddf9a1a47 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:52 +0200 Subject: [PATCH 1/9] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- roles/sysctl/defaults/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/sysctl/defaults/main.yml b/roles/sysctl/defaults/main.yml index faa4bf4..ac69319 100644 --- a/roles/sysctl/defaults/main.yml +++ b/roles/sysctl/defaults/main.yml @@ -1,5 +1,5 @@ --- -# Default-Sysctl-Werte fuer Streaming-VMs. +# Default-Sysctl-Werte fuer Streaming-VMs und den WireGuard-Medienpfad. # Pro Host/Gruppe ueberschreibbar via group_vars/host_vars (z.B. group_vars/vps). sysctl_params: - { key: net.core.rmem_default, value: "262144" } @@ -9,7 +9,9 @@ sysctl_params: - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } - { key: net.ipv4.tcp_window_scaling, value: "1" } + - { key: net.core.default_qdisc, value: "fq" } - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_no_metrics_save, value: "0" } - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - { key: net.ipv4.tcp_fastopen, value: "3" } - { key: net.core.netdev_max_backlog, value: "16384" } From 8e057b0d4d590403502bc611813cb056afaaa739 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:53 +0200 Subject: [PATCH 2/9] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- roles/sysctl/tasks/main.yml | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml index 3563613..60a17d6 100644 --- a/roles/sysctl/tasks/main.yml +++ b/roles/sysctl/tasks/main.yml @@ -10,7 +10,31 @@ dest: /etc/modules-load.d/bbr.conf mode: "0644" -- name: Sysctl Parameter setzen +- name: Legacy-Sysctl-Dateien pruefen + ansible.builtin.stat: + path: "{{ item }}" + loop: + - /etc/sysctl.conf + - /etc/sysctl.d/99-streaming.conf + register: legacy_sysctl_files + +- name: Verwaltete Werte aus Legacy sysctl.conf entfernen + ansible.builtin.lineinfile: + path: /etc/sysctl.conf + regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*=" + state: absent + loop: "{{ sysctl_params }}" + when: legacy_sysctl_files.results[0].stat.exists + +- name: Verwaltete Werte aus Legacy 99-streaming.conf entfernen + ansible.builtin.lineinfile: + path: /etc/sysctl.d/99-streaming.conf + regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*=" + state: absent + loop: "{{ sysctl_params }}" + when: legacy_sysctl_files.results[1].stat.exists + +- name: Sysctl Parameter kanonisch setzen ansible.posix.sysctl: name: "{{ item.key }}" value: "{{ item.value }}" From 1c8e2ac26cd315c751b8f0d3a704a0c5c51a533d Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:53 +0200 Subject: [PATCH 3/9] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- group_vars/vps/sysctl.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/group_vars/vps/sysctl.yml b/group_vars/vps/sysctl.yml index 1ffb606..88aea33 100644 --- a/group_vars/vps/sysctl.yml +++ b/group_vars/vps/sysctl.yml @@ -15,6 +15,7 @@ sysctl_params: - { key: net.ipv4.tcp_window_scaling, value: "1" } - { key: net.core.default_qdisc, value: "fq" } - { key: net.ipv4.tcp_congestion_control, value: "bbr" } + - { key: net.ipv4.tcp_no_metrics_save, value: "0" } - { key: net.ipv4.tcp_slow_start_after_idle, value: "0" } - { key: net.ipv4.tcp_fastopen, value: "3" } - { key: net.core.netdev_max_backlog, value: "16384" } From 88bbc3f0ce21ad80392cf8a22925da7bc08f7897 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:54 +0200 Subject: [PATCH 4/9] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- sysctl-proxmox.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/sysctl-proxmox.yaml b/sysctl-proxmox.yaml index 3f9ad2d..ff391b8 100644 --- a/sysctl-proxmox.yaml +++ b/sysctl-proxmox.yaml @@ -3,4 +3,5 @@ hosts: proxmox become: yes roles: + - sysctl - sysctl_proxmox From a062d74bd0c94e82975258807b7b3cfe7f70a0fa Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:55 +0200 Subject: [PATCH 5/9] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- roles/sysctl_proxmox/tasks/main.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/roles/sysctl_proxmox/tasks/main.yml b/roles/sysctl_proxmox/tasks/main.yml index 70bf05a..6b9bbf8 100644 --- a/roles/sysctl_proxmox/tasks/main.yml +++ b/roles/sysctl_proxmox/tasks/main.yml @@ -42,14 +42,7 @@ - { key: fs.file-max, value: "9999999" } - { key: fs.inotify.max_user_watches, value: "524288" } - { key: fs.inotify.max_user_instances, value: "512" } - - { key: net.ipv4.ip_forward, value: "1" } - - { key: net.ipv6.conf.all.forwarding, value: "1" } - { key: net.bridge.bridge-nf-call-iptables, value: "0" } - { key: net.bridge.bridge-nf-call-ip6tables, value: "0" } - { key: vm.dirty_expire_centisecs, value: "3000" } - { key: vm.dirty_writeback_centisecs, value: "500" } - - { key: net.ipv4.tcp_mtu_probing, value: "1" } - - { key: net.core.rmem_max, value: "67108864" } - - { key: net.core.wmem_max, value: "67108864" } - - { key: net.ipv4.tcp_rmem, value: "4096 87380 67108864" } - - { key: net.ipv4.tcp_wmem, value: "4096 65536 67108864" } From 9fed3fe47a963fe022fdc0d0fa239afc8fe527e5 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:42:55 +0200 Subject: [PATCH 6/9] fix: WireGuard-Medienpfad auf kanonisches sysctl-Profil bringen --- tests/test_sysctl_role.py | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 tests/test_sysctl_role.py diff --git a/tests/test_sysctl_role.py b/tests/test_sysctl_role.py new file mode 100644 index 0000000..3be0742 --- /dev/null +++ b/tests/test_sysctl_role.py @@ -0,0 +1,34 @@ +from pathlib import Path +import unittest + +ROOT = Path(__file__).parents[1] + + +class SysctlRoleContract(unittest.TestCase): + def test_canonical_streaming_profile_keeps_64mib_and_bbr_fq(self): + text = (ROOT / "roles/sysctl/defaults/main.yml").read_text() + self.assertIn("net.core.rmem_max", text) + self.assertIn('value: "67108864"', text) + self.assertIn("net.core.default_qdisc", text) + self.assertIn("net.ipv4.tcp_congestion_control", text) + self.assertIn("net.ipv4.tcp_no_metrics_save", text) + + def test_role_removes_managed_keys_from_legacy_sources(self): + text = (ROOT / "roles/sysctl/tasks/main.yml").read_text() + self.assertIn("/etc/sysctl.conf", text) + self.assertIn("/etc/sysctl.d/99-streaming.conf", text) + self.assertIn("state: absent", text) + self.assertIn("regex_escape", text) + + def test_proxmox_tuning_runs_canonical_network_role_first(self): + play = (ROOT / "sysctl-proxmox.yaml").read_text() + self.assertLess(play.index("- sysctl\n"), play.index("- sysctl_proxmox")) + + def test_proxmox_role_does_not_duplicate_canonical_network_keys(self): + text = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text() + for key in ("net.core.rmem_max", "net.core.wmem_max", "net.ipv4.tcp_rmem", "net.ipv4.tcp_wmem", "net.ipv4.tcp_mtu_probing"): + self.assertNotIn(key, text) + + +if __name__ == "__main__": + unittest.main() From 1c7e0ec61f3c4f7c486d68ce7688649ec1f69dcb Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 23:08:20 +0200 Subject: [PATCH 7/9] fix: verbleibende Sysctl-Doppeldefinitionen entfernen --- roles/sysctl/tasks/main.yml | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml index 60a17d6..2b95113 100644 --- a/roles/sysctl/tasks/main.yml +++ b/roles/sysctl/tasks/main.yml @@ -16,23 +16,19 @@ loop: - /etc/sysctl.conf - /etc/sysctl.d/99-streaming.conf + - /etc/sysctl.d/99-proxmox-tuning.conf + - /etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf register: legacy_sysctl_files -- name: Verwaltete Werte aus Legacy sysctl.conf entfernen +- name: Verwaltete Werte aus konkurrierenden Sysctl-Quellen entfernen ansible.builtin.lineinfile: - path: /etc/sysctl.conf - regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*=" + path: "{{ item.0.item }}" + regexp: "^[ \\t]*{{ item.1.key | regex_escape }}[ \\t]*=" state: absent - loop: "{{ sysctl_params }}" - when: legacy_sysctl_files.results[0].stat.exists - -- name: Verwaltete Werte aus Legacy 99-streaming.conf entfernen - ansible.builtin.lineinfile: - path: /etc/sysctl.d/99-streaming.conf - regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*=" - state: absent - loop: "{{ sysctl_params }}" - when: legacy_sysctl_files.results[1].stat.exists + loop: "{{ legacy_sysctl_files.results | product(sysctl_params) | list }}" + loop_control: + label: "{{ item.0.item }}: {{ item.1.key }}" + when: item.0.stat.exists - name: Sysctl Parameter kanonisch setzen ansible.posix.sysctl: From 184476e7726a38b20359aa9b3fbef5a7e421a745 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 23:08:21 +0200 Subject: [PATCH 8/9] fix: verbleibende Sysctl-Doppeldefinitionen entfernen --- roles/sysctl_proxmox/tasks/main.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/roles/sysctl_proxmox/tasks/main.yml b/roles/sysctl_proxmox/tasks/main.yml index 6b9bbf8..89f046d 100644 --- a/roles/sysctl_proxmox/tasks/main.yml +++ b/roles/sysctl_proxmox/tasks/main.yml @@ -38,7 +38,6 @@ state: present loop: - { key: vm.overcommit_memory, value: "1" } - - { key: vm.swappiness, value: "1" } - { key: fs.file-max, value: "9999999" } - { key: fs.inotify.max_user_watches, value: "524288" } - { key: fs.inotify.max_user_instances, value: "512" } From 11b6273f428fb661b5201faa0e8978141d5db4a7 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 23:08:22 +0200 Subject: [PATCH 9/9] fix: verbleibende Sysctl-Doppeldefinitionen entfernen --- tests/test_sysctl_role.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/tests/test_sysctl_role.py b/tests/test_sysctl_role.py index 3be0742..b93a0f1 100644 --- a/tests/test_sysctl_role.py +++ b/tests/test_sysctl_role.py @@ -1,4 +1,5 @@ from pathlib import Path +import re import unittest ROOT = Path(__file__).parents[1] @@ -17,6 +18,8 @@ class SysctlRoleContract(unittest.TestCase): text = (ROOT / "roles/sysctl/tasks/main.yml").read_text() self.assertIn("/etc/sysctl.conf", text) self.assertIn("/etc/sysctl.d/99-streaming.conf", text) + self.assertIn("/etc/sysctl.d/99-proxmox-tuning.conf", text) + self.assertIn("/etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf", text) self.assertIn("state: absent", text) self.assertIn("regex_escape", text) @@ -25,9 +28,11 @@ class SysctlRoleContract(unittest.TestCase): self.assertLess(play.index("- sysctl\n"), play.index("- sysctl_proxmox")) def test_proxmox_role_does_not_duplicate_canonical_network_keys(self): - text = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text() - for key in ("net.core.rmem_max", "net.core.wmem_max", "net.ipv4.tcp_rmem", "net.ipv4.tcp_wmem", "net.ipv4.tcp_mtu_probing"): - self.assertNotIn(key, text) + canonical = (ROOT / "roles/sysctl/defaults/main.yml").read_text() + proxmox = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text() + canonical_keys = set(re.findall(r"key:\s*([a-z0-9_.-]+)", canonical)) + proxmox_keys = set(re.findall(r"key:\s*([a-z0-9_.-]+)", proxmox)) + self.assertEqual(canonical_keys & proxmox_keys, set()) if __name__ == "__main__":