platform: OpenTofu/Ansible für Proxmox, CI, Makefile, Doku-Abgleich

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 00:54:23 +02:00
parent cb5a413169
commit f22eaa8449
27 changed files with 623 additions and 6 deletions
@@ -0,0 +1,70 @@
+- name: Site-Datei laden
+  ansible.builtin.set_fact:
+    knaster_pve: "{{ lookup('ansible.builtin.file', pve_site_file) | from_yaml }}"
+  run_once: true
+  delegate_to: localhost
+
+- name: Bootloader erkennen (systemd-boot bei ZFS-Root, sonst GRUB)
+  ansible.builtin.stat:
+    path: /etc/kernel/cmdline
+  register: kernel_cmdline
+
+- name: IOMMU aktivieren (systemd-boot)
+  ansible.builtin.replace:
+    path: /etc/kernel/cmdline
+    regexp: '^((?!.*intel_iommu=on).*)$'
+    replace: '\1 {{ pve_iommu_cmdline }}'
+  when: kernel_cmdline.stat.exists
+  notify: refresh boot
+
+- name: IOMMU aktivieren (GRUB)
+  ansible.builtin.lineinfile:
+    path: /etc/default/grub
+    regexp: '^GRUB_CMDLINE_LINUX_DEFAULT="((?!.*intel_iommu=on).*)"$'
+    line: 'GRUB_CMDLINE_LINUX_DEFAULT="\1 {{ pve_iommu_cmdline }}"'
+    backrefs: true
+  when: not kernel_cmdline.stat.exists
+  notify: refresh boot
+
+- name: VFIO-Module laden
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/vfio.conf
+    content: "{{ pve_vfio_modules | join('\n') }}\n"
+    mode: "0644"
+
+- name: NVIDIA-Treiber auf dem Host sperren (GPU gehört der VM)
+  ansible.builtin.copy:
+    dest: /etc/modprobe.d/blacklist-nvidia.conf
+    content: |
+      blacklist nouveau
+      blacklist nvidia
+      blacklist nvidiafb
+    mode: "0644"
+  notify: refresh boot
+
+- name: ZFS-Pool tank vorhanden?
+  ansible.builtin.command: zpool list -H -o name tank
+  register: tank
+  changed_when: false
+  failed_when: false
+
+- name: Hinweis, falls tank fehlt (Pool wird bewusst NICHT automatisch angelegt – Datenverlustgefahr)
+  ansible.builtin.debug:
+    msg: "Auf {{ inventory_hostname }} fehlt der ZFS-Pool 'tank'. Anlegen z. B.: zpool create -o ashift=12 tank mirror /dev/disk/by-id/<ssd2> /dev/disk/by-id/<ssd3> && pvesm add zfspool tank -pool tank"
+  when: tank.rc != 0
+
+- name: Bestehende Replikationsjobs lesen
+  ansible.builtin.command: pvesr list
+  register: pvesr_jobs
+  changed_when: false
+
+- name: ZFS-Replikation für Infra-Gäste
+  ansible.builtin.command: >
+    pvesr create-local-job {{ item.value.vmid }}-0 {{ item.value.replicate_to }}
+    --schedule '{{ knaster_pve.replication_schedule }}' --comment 'knaster {{ item.key }}'
+  loop: "{{ knaster_pve.containers | dict2items }}"
+  when:
+    - item.value.node == inventory_hostname
+    - item.value.replicate_to is defined
+    - (item.value.vmid | string) + '-0' not in pvesr_jobs.stdout
+  changed_when: true