From 1c7e0ec61f3c4f7c486d68ce7688649ec1f69dcb Mon Sep 17 00:00:00 2001
From: sascha <sascha@sascha-lutz.de>
Date: Sat, 8 Aug 2026 23:08:20 +0200
Subject: [PATCH 1/3] fix: verbleibende Sysctl-Doppeldefinitionen entfernen

---
 roles/sysctl/tasks/main.yml | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/roles/sysctl/tasks/main.yml b/roles/sysctl/tasks/main.yml
index 60a17d6..2b95113 100644
--- a/roles/sysctl/tasks/main.yml
+++ b/roles/sysctl/tasks/main.yml
@@ -16,23 +16,19 @@
   loop:
     - /etc/sysctl.conf
     - /etc/sysctl.d/99-streaming.conf
+    - /etc/sysctl.d/99-proxmox-tuning.conf
+    - /etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf
   register: legacy_sysctl_files
 
-- name: Verwaltete Werte aus Legacy sysctl.conf entfernen
+- name: Verwaltete Werte aus konkurrierenden Sysctl-Quellen entfernen
   ansible.builtin.lineinfile:
-    path: /etc/sysctl.conf
-    regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*="
+    path: "{{ item.0.item }}"
+    regexp: "^[ \\t]*{{ item.1.key | regex_escape }}[ \\t]*="
     state: absent
-  loop: "{{ sysctl_params }}"
-  when: legacy_sysctl_files.results[0].stat.exists
-
-- name: Verwaltete Werte aus Legacy 99-streaming.conf entfernen
-  ansible.builtin.lineinfile:
-    path: /etc/sysctl.d/99-streaming.conf
-    regexp: "^[ \\t]*{{ item.key | regex_escape }}[ \\t]*="
-    state: absent
-  loop: "{{ sysctl_params }}"
-  when: legacy_sysctl_files.results[1].stat.exists
+  loop: "{{ legacy_sysctl_files.results | product(sysctl_params) | list }}"
+  loop_control:
+    label: "{{ item.0.item }}: {{ item.1.key }}"
+  when: item.0.stat.exists
 
 - name: Sysctl Parameter kanonisch setzen
   ansible.posix.sysctl:
-- 
2.49.1


From 184476e7726a38b20359aa9b3fbef5a7e421a745 Mon Sep 17 00:00:00 2001
From: sascha <sascha@sascha-lutz.de>
Date: Sat, 8 Aug 2026 23:08:21 +0200
Subject: [PATCH 2/3] fix: verbleibende Sysctl-Doppeldefinitionen entfernen

---
 roles/sysctl_proxmox/tasks/main.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/roles/sysctl_proxmox/tasks/main.yml b/roles/sysctl_proxmox/tasks/main.yml
index 6b9bbf8..89f046d 100644
--- a/roles/sysctl_proxmox/tasks/main.yml
+++ b/roles/sysctl_proxmox/tasks/main.yml
@@ -38,7 +38,6 @@
     state: present
   loop:
     - { key: vm.overcommit_memory,               value: "1" }
-    - { key: vm.swappiness,                      value: "1" }
     - { key: fs.file-max,                        value: "9999999" }
     - { key: fs.inotify.max_user_watches,        value: "524288" }
     - { key: fs.inotify.max_user_instances,       value: "512" }
-- 
2.49.1


From 11b6273f428fb661b5201faa0e8978141d5db4a7 Mon Sep 17 00:00:00 2001
From: sascha <sascha@sascha-lutz.de>
Date: Sat, 8 Aug 2026 23:08:22 +0200
Subject: [PATCH 3/3] fix: verbleibende Sysctl-Doppeldefinitionen entfernen

---
 tests/test_sysctl_role.py | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/tests/test_sysctl_role.py b/tests/test_sysctl_role.py
index 3be0742..b93a0f1 100644
--- a/tests/test_sysctl_role.py
+++ b/tests/test_sysctl_role.py
@@ -1,4 +1,5 @@
 from pathlib import Path
+import re
 import unittest
 
 ROOT = Path(__file__).parents[1]
@@ -17,6 +18,8 @@ class SysctlRoleContract(unittest.TestCase):
         text = (ROOT / "roles/sysctl/tasks/main.yml").read_text()
         self.assertIn("/etc/sysctl.conf", text)
         self.assertIn("/etc/sysctl.d/99-streaming.conf", text)
+        self.assertIn("/etc/sysctl.d/99-proxmox-tuning.conf", text)
+        self.assertIn("/etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf", text)
         self.assertIn("state: absent", text)
         self.assertIn("regex_escape", text)
 
@@ -25,9 +28,11 @@ class SysctlRoleContract(unittest.TestCase):
         self.assertLess(play.index("- sysctl\n"), play.index("- sysctl_proxmox"))
 
     def test_proxmox_role_does_not_duplicate_canonical_network_keys(self):
-        text = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text()
-        for key in ("net.core.rmem_max", "net.core.wmem_max", "net.ipv4.tcp_rmem", "net.ipv4.tcp_wmem", "net.ipv4.tcp_mtu_probing"):
-            self.assertNotIn(key, text)
+        canonical = (ROOT / "roles/sysctl/defaults/main.yml").read_text()
+        proxmox = (ROOT / "roles/sysctl_proxmox/tasks/main.yml").read_text()
+        canonical_keys = set(re.findall(r"key:\s*([a-z0-9_.-]+)", canonical))
+        proxmox_keys = set(re.findall(r"key:\s*([a-z0-9_.-]+)", proxmox))
+        self.assertEqual(canonical_keys & proxmox_keys, set())
 
 
 if __name__ == "__main__":
-- 
2.49.1