Initialer Import der Synology Scripts

2026-08-05 08:43:57 +02:00
commit 5e32a7c411
404 changed files with 79932 additions and 0 deletions
@@ -0,0 +1,50 @@
+- name: Deploy VMs auf Proxmox
+  hosts: localhost
+  gather_facts: false
+  collections:
+    - community.proxmox
+    - community.general
+
+  vars:
+    api_host: "localhost"
+    api_user: "root@pam"
+    api_token_id: "ansible"
+    api_token_secret: "f77b7f8c-8c73-4782-a4ad-8bbf7162e7ca"
+
+    node_map:
+      fhs0: FHS0
+      fhs1: FHS1
+      fhs2: FHS2
+      hs1: HS1
+      hs2: HS2
+      hs3: HS3
+      hs4: HS4
+      ts01: TS1
+
+    vm_json: "/mnt/scripte/VM_DEPLOYMENT/vm_output.json"
+    ct_json: "/mnt/scripte/VM_DEPLOYMENT/ct_output.json"
+
+  tasks:
+
+    - name: Load VM JSON
+      set_fact:
+        vm_list: "{{ lookup('file', vm_json) | from_json }}"
+
+    - name: Create VMs
+      include_tasks: 001h_sub_create_vm.yaml
+      loop: "{{ vm_list }}"
+      loop_control:
+        loop_var: item
+
+    # -----------------------------
+    # Container
+    # -----------------------------
+    - name: Load CT JSON
+      set_fact:
+        ct_list: "{{ lookup('file', ct_json) | from_json }}"
+
+    - name: Create Containers
+      include_tasks: 002_sub_create_ct.yaml
+      loop: "{{ ct_list }}"
+      loop_control:
+        loop_var: item
@@ -0,0 +1,177 @@
+# -----------------------------
+# Reset facts for this VM
+# -----------------------------
+- name: Reset facts
+  set_fact:
+    scsi_disks: {}
+    net_config: {}
+    ide_config: {}
+    efidisk0_config: {}
+    tpmstate0_config: {}
+
+# -----------------------------
+# Check if VM exists
+# -----------------------------
+- name: Check if VM exists
+  uri:
+    url: "https://{{ hostvars[node_map[item.Node]].ansible_host }}:8006/api2/json/nodes/{{ item.Node | lower }}/qemu/{{ item['VM ID'] }}/config"
+    method: GET
+    validate_certs: false
+    headers:
+      Authorization: "PVEAPIToken=root@pam!ansible={{ api_token_secret }}"
+  register: vm_config
+  failed_when: false   # 401/404 stoppen das Playbook nicht
+  ignore_errors: yes
+
+- name: Set VM exists fact
+  set_fact:
+    vm_exists: "{{ vm_config.status == 200 }}"
+
+# -----------------------------
+# 1. Build SCSI disks map
+# -----------------------------
+- name: Build scsi disks map
+  set_fact:
+    scsi_disks: >-
+      {{
+        scsi_disks | default({}) |
+        combine({
+          ('scsi' ~ disk.Device): {
+            "storage": item['Disk Storage'].split()[0],
+            "size": disk.Size | int
+          }
+        })
+      }}
+  loop: "{{ item.Disks }}"
+  loop_control:
+    loop_var: disk
+
+# -----------------------------
+# 2. Build network config
+# -----------------------------
+- name: Build network config
+  set_fact:
+    net_config:
+      net0: "model={{ item.Model | lower | regex_replace(' .*','') }},bridge={{ item.Bridge }}"
+
+# -----------------------------
+# 3. Build IDE config
+# -----------------------------
+- name: Build IDE config
+  set_fact:
+    ide_config: >-
+      {{
+        ( {} |
+          combine(
+            { 'ide2': ((item['ISO Storage'] | default('ISO') | string).split()[0] ~ ":iso/" ~ item['ISO File'] ~ ",media=cdrom") }
+          ) |
+          combine(
+            item['Enable VirtIO'] | ternary(
+              { 'ide0': ((item['VirtIO Storage'] | default('ISO') | string).split()[0] ~ ":iso/" ~ item['VirtIO ISO'] ~ ",media=cdrom") },
+              {}
+            )
+          )
+        )
+      }}
+
+# -----------------------------
+# 4. Build EFI disk config
+# -----------------------------
+- name: Build EFI disk config
+  set_fact:
+    efidisk0_config: >-
+      {%
+        set efidisk = item['EFI STORAGE'] | ternary({
+          "storage": ((item['EFI STORAGE'] | string).split()[0]),
+          "efitype": "4m",
+          "format": "qcow2",
+          "pre_enrolled_keys": false
+        }, {}) %}
+      {{ efidisk }}
+
+# -----------------------------
+# 5. Build TPM config
+# -----------------------------
+- name: Build TPM config for Proxmox
+  set_fact:
+    tpmstate0_config: >-
+      {{
+        item['Add TPM'] | ternary({
+          "storage": (item['TPM Storage'] | string).split()[0],
+          "version": (item['TPM Version'] | regex_replace('^v','')) | default('2.0'),
+        }, {})
+      }}
+
+# -----------------------------
+# 6. Show VM variables before creating VM
+# -----------------------------
+- name: Show VM variables before creating VM
+  debug:
+    msg:
+      - "VM ID: {{ item['VM ID'] }}"
+      - "Node: {{ item.Node }}"
+      - "TPM Add: {{ item['Add TPM'] }}"
+      - "TPM Config: {{ tpmstate0_config }}"
+      - "SCSI Disks: {{ scsi_disks }}"
+      - "Network Config: {{ net_config }}"
+      - "IDE Config: {{ ide_config }}"
+      - "EFI Disk Config: {{ efidisk0_config }}"
+      - "Maschine Config: {{ item.Maschine }}"
+      - "BIOS Config: {{ item.BIOS }}"
+      - "VM exists: {{ vm_exists }}"
+
+# -----------------------------
+# 7. Create VM if it does not exist
+# -----------------------------
+- name: Create VM
+  community.proxmox.proxmox_kvm:
+    api_host: "{{ hostvars[node_map[item.Node]].ansible_host }}"
+    api_user: "root@pam"
+    api_token_id: "ansible"
+    api_token_secret: "{{ api_token_secret }}"
+    validate_certs: false
+
+    node: "{{ item.Node | lower }}"
+    vmid: "{{ item['VM ID'] }}"
+    name: "{{ item.Name | lower | regex_replace('_','-') }}"
+    memory: "{{ item.Memory }}"
+    cores: "{{ item.Cores }}"
+    sockets: "{{ item.Sockets }}"
+    machine: "{{ 'q35' if 'q35' in (item.Maschine | lower) else 'pc' }}"
+    bios: "{{ 'ovmf' if 'ovmf' in item.BIOS | lower else 'seabios' }}"
+    ostype: "{{ 'win11' if item['OS Typ'] == 'Microsoft' else 'l26' }}"
+    agent: "{{ 1 if item['Qemu Agent'] else 0 }}"
+    balloon: "{{ item.Ballooning }}"
+    onboot: "{{ item['Start at boot'] }}"
+    net: "{{ net_config }}"
+    ide: "{{ ide_config }}"
+    efidisk0: "{{ efidisk0_config if efidisk0_config != {} else omit }}"
+    tpmstate0: "{{ tpmstate0_config if tpmstate0_config != {} else omit }}"
+    tags: "{{ item.Service | lower }}"
+    state: present
+    timeout: 600
+  when: not vm_exists
+
+# -----------------------------
+# 8. Create SCSI disks if not exist
+# -----------------------------
+- name: Create SCSI disks for VM
+  community.proxmox.proxmox_disk:
+    api_host: "{{ hostvars[node_map[item.Node]].ansible_host }}"
+    api_user: "root@pam"
+    api_token_id: "ansible"
+    api_token_secret: "{{ api_token_secret }}"
+    validate_certs: false
+
+    vmid: "{{ item['VM ID'] }}"
+    disk: "{{ disk.key }}"
+    storage: "{{ disk.value.storage }}"
+    size: "{{ disk.value.size }}"
+    state: present
+    iothread: 1
+
+  loop: "{{ scsi_disks | dict2items }}"
+  loop_control:
+    loop_var: disk
+
+  when: vm_exists and (disk.key not in vm_config.json.data.keys())
@@ -0,0 +1,96 @@
+# -----------------------------
+# 002_sub_create_ct.yaml
+# -----------------------------
+
+- name: Reset facts
+  set_fact:
+    net_config: ""
+    features_string: ""
+
+- name: Normalize storage names
+  set_fact:
+    template_storage_clean: "{{ item['Template Storage'].split(' ')[0] | trim }}"
+    disk_storage_clean: "{{ item['Disk Storage'].split(' ')[0] | trim }}"
+
+- name: Build ostemplate path
+  set_fact:
+    ostemplate_path: "{{ template_storage_clean }}:vztmpl/{{ item.Template }}"
+    
+- name: Build network config
+  set_fact:
+    net_config: "{{ 'name=eth0,bridge=' ~ item.Bridge ~ ',ip=' ~ (item['IPv4/CIDR'] | default('dhcp')) ~ (',gw=' ~ item['Gateway(IPv4)'] if item['Gateway(IPv4)'] else '') }}"
+
+- name: Build features string
+  set_fact:
+    features_string: "{{ ['nesting=1' if item.Nesting | default(False) else '', 'keyctl=1' if item.get('Keyctl', False) else ''] | reject('equalto','') | join(',') }}"
+
+- name: Show CT variables
+  debug:
+    msg:
+      - "CT ID: {{ item['CT ID'] }}"
+      - "Node: {{ item.Node }}"
+      - "Hostname: {{ item.Hostname }}"
+      - "Net: {{ net_config }}"
+      - "Features: {{ features_string }}"
+      - "Template Path: {{ ostemplate_path }}"
+
+- name: Cleanup strings
+  set_fact:
+    net_config: "{{ net_config | trim }}"
+    features_string: "{{ features_string | trim }}"
+
+# -----------------------------
+# CHECK IF CT EXISTS
+# -----------------------------
+- name: Check if CT exists
+  ansible.builtin.uri:
+    url: "https://{{ hostvars[node_map[item.Node]].ansible_host }}:8006/api2/json/nodes/{{ item.Node }}/lxc/{{ item['CT ID'] }}/status/current"
+    method: GET
+    headers:
+      Authorization: "PVEAPIToken=root@pam!ansible={{ api_token_secret }}"
+    validate_certs: false
+  register: ct_check
+  failed_when: false
+  delegate_to: localhost
+
+- name: Set CT exists fact
+  set_fact:
+    ct_exists: "{{ ct_check.status == 200 }}"
+
+# -----------------------------
+# CREATE CT
+# -----------------------------
+- name: Create LXC Container if not exists
+  community.general.proxmox:
+    api_host: "{{ hostvars[node_map[item.Node]].ansible_host }}"
+    api_user: "root@pam"
+    api_token_id: "ansible"
+    api_token_secret: "{{ api_token_secret }}"
+    validate_certs: false
+
+    node: "{{ item.Node }}"
+    vmid: "{{ item['CT ID'] }}"
+    hostname: "{{ item.Hostname }}"
+    cores: "{{ item.Cores }}"
+    memory: "{{ item.Memory }}"
+    swap: "{{ item.Swap }}"
+
+    ostemplate: "{{ ostemplate_path | trim }}"
+    disk: "{{ item.Disk | default('8') }}"
+    storage: "{{ disk_storage_clean | trim }}"
+
+    netif:
+      net0: "{{ net_config }}"
+
+    features: "{{ features_string }}"
+
+    state: present
+  when: not ct_exists
+
+# -----------------------------
+# DEBUG RESULT
+# -----------------------------
+- name: Show result
+  debug:
+    msg: "CT {{ item['CT ID'] }} created"
+  when: not ct_exists
@@ -0,0 +1,51 @@
+---
+- name: Netzwerk Ping Scan und CSV Export
+  hosts: localhost
+  gather_facts: false
+
+  vars:
+    netzwerke:
+      - "192.168.1.0/24"
+      - "9.99.0.0/24"
+      - "9.99.10.0/24"
+      - "9.99.20.0/24"
+      - "9.99.30.0/24"
+      - "9.99.40.0/24"
+      - "9.99.50.0/24"
+      - "9.99.60.0/24"
+      - "9.99.70.0/24"
+
+    csv_datei: "/mnt/scripte/NETWORK-SCAN/netzwerk_scan.csv"
+
+  tasks:
+
+    - name: Prüfen ob nmap installiert ist
+      ansible.builtin.command:
+        cmd: which nmap
+      register: nmap_check
+      failed_when: nmap_check.rc != 0
+
+    - name: Netzwerkbereiche scannen
+      ansible.builtin.command:
+        cmd: "nmap -sn {{ item }}"
+      loop: "{{ netzwerke }}"
+      register: scan_ergebnis
+
+    - name: Scan-Ergebnisse zusammenführen
+      ansible.builtin.set_fact:
+        scan_text: "{{ scan_ergebnis.results | map(attribute='stdout') | join('\n') }}"
+
+    - name: CSV Datei erzeugen
+      ansible.builtin.copy:
+        dest: "{{ csv_datei }}"
+        content: |
+          IP-Adresse,Status
+          {% for line in scan_text.split('\n') %}
+          {% if 'Nmap scan report for' in line %}
+          {{ line | regex_replace('.*for ', '') }},ONLINE
+          {% endif %}
+          {% endfor %}
+
+    - name: Ergebnis anzeigen
+      ansible.builtin.debug:
+        msg: "Scan abgeschlossen. Datei: {{ csv_datei }}"
@@ -0,0 +1,108 @@
+---
+- name: Netzwerk Scan ARP + NMAP CSV
+  hosts: localhost
+  gather_facts: false
+
+  vars:
+    dns_server: 
+      - "192.168.1.230"
+    lokales_netz:
+      - "192.168.1.0/24"
+
+    entfernte_netze:
+      - "9.99.0.0/24"
+      - "9.99.10.0/24"
+      - "9.99.20.0/24"
+      - "9.99.30.0/24"
+      - "9.99.40.0/24"
+      - "9.99.50.0/24"
+      - "9.99.60.0/24"
+      - "9.99.70.0/24"
+
+    csv_datei: "/mnt/scripte/NETWORK-SCAN/netzwerk_scan_combined.csv"
+
+
+  tasks:
+
+    ####################################################
+    # ARP Scan lokales Netzwerk
+    ####################################################
+
+    - name: ARP Scan lokales Netz
+      ansible.builtin.command:
+        cmd: "sudo arp-scan {{ item }}"
+      loop: "{{ lokales_netz }}"
+      register: arp_ergebnis
+
+
+    - name: ARP Daten sammeln
+      ansible.builtin.set_fact:
+        hosts_liste: "{{ hosts_liste | default([]) + [ {
+          'ip': item.split()[0],
+          'mac': item.split()[1],
+          'hersteller': item.split()[2:] | join(' ')
+          } ] }}"
+      loop: "{{ arp_ergebnis.results | map(attribute='stdout_lines') | flatten }}"
+      when:
+        - item.split() | length >= 2
+        - item.split()[0] is match('^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$')
+
+
+    ####################################################
+    # NMAP Scan entfernte Netzwerke
+    ####################################################
+
+    - name: NMAP Scan entfernte Netze
+      ansible.builtin.command:
+        cmd: "nmap -sn {{ item }}"
+      loop: "{{ entfernte_netze }}"
+      register: nmap_ergebnis
+
+
+    - name: NMAP IPs hinzufügen
+      ansible.builtin.set_fact:
+        hosts_liste: "{{ hosts_liste | default([]) + [ {
+          'ip': item | regex_replace('.*for ', ''),
+          'mac': 'unbekannt',
+          'hersteller': 'unbekannt'
+          } ] }}"
+      loop: >-
+        {{
+          nmap_ergebnis.results
+          | map(attribute='stdout_lines')
+          | flatten
+        }}
+      when:
+        - "'Nmap scan report for' in item"
+
+
+    ####################################################
+    # Hostnamen suchen
+    ####################################################
+
+    - name: Hostnamen über zentralen DNS abfragen
+      ansible.builtin.shell:
+        cmd: "dig @{{ dns_server }} -x {{ item.ip }} +short | sed 's/\\.$//'"
+      loop: "{{ hosts_liste }}"
+      register: hostname_ergebnis
+      changed_when: false
+      failed_when: false
+
+
+    ####################################################
+    # CSV schreiben
+    ####################################################
+
+    - name: CSV erstellen
+      ansible.builtin.copy:
+        dest: "{{ csv_datei }}"
+        content: |
+          IP : HOSTNAME : MAC ADRESSE : HERSTELLER
+          {% for host in hosts_liste %}
+          {{ host.ip }} : {{ hostname_ergebnis.results[loop.index0].stdout | trim | default('unbekannt', true) }} : {{ host.mac }} : {{ host.hersteller }}
+          {% endfor %}
+
+
+    - name: Ergebnis anzeigen
+      ansible.builtin.debug:
+        msg: "Scan fertig: {{ csv_datei }}"
@@ -0,0 +1,7 @@
+---
+- name: add non AD-GROUP
+  hosts: debian_vms
+  become: false #root berechtigung 
+  
+  tasks:
+    - name: Update apt package cache and upgrade all packages
@@ -0,0 +1,18 @@
+---
+- name: add non AD-GROUP
+  hosts: debian_vms
+  become: false #root berechtigung
+  
+  tasks:
+    - name: add local user
+      user:
+        name: ansible
+        shell: /bin/bash
+        #mkpasswd --method=sha-512
+        password: ''
+        groups: sudo
+
+    - name: Add SSH paublic Key for User to the "authorized Keys" file
+      authorized_key:
+        user: ansible
+        key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOY9BjyR9eK0/BDgwp+1E5LZjd/92fEtH5CcRRlP7lWf"
@@ -0,0 +1,6 @@
+- name: Certificate Pipeline
+  hosts: all
+  gather_facts: true
+
+  roles:
+    - certificate
@@ -0,0 +1,71 @@
+---
+- name: Ensure EJBCA VM exists on Proxmox
+  hosts: front
+  gather_facts: no
+  connection: local
+
+  vars:
+    api_user: "root@pam!ansible"
+    api_token_id: "ansible"                                      # Name des Tokens in PVE
+    api_token_secret: "f77b7f8c-8c73-4782-a4ad-8bbf7162e7ca"     # Secret aus PVE
+    api_host: "{{ ansible_host }}"
+    node: "fhs0"                                                  # exakter Node-Name in Proxmox
+    vmid: 250
+    vm_name: "ca-heim"
+    memory: 4096
+    cores: 2
+    scsi_storage: "CEPH_SSD"                                      # VM-Disk Speicher
+    scsi_size: 20
+    bridge: "DMZ"
+    iso_image: "debian-13.2.0-amd64-DVD.iso"                     # ISO auf CEPH-Share
+    start_vm: false
+
+  tasks:
+    - name: Ensure old VM is absent (idempotent)
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ api_user }}"
+        api_token_id: "{{ api_token_id }}"
+        api_token_secret: "{{ api_token_secret }}"
+        api_host: "{{ api_host }}"
+        node: "{{ node }}"
+        vmid: "{{ vmid }}"
+        state: absent
+        force: yes
+        validate_certs: false
+
+    - name: Create VM without starting
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ api_user }}"
+        api_token_id: "{{ api_token_id }}"
+        api_token_secret: "{{ api_token_secret }}"
+        api_host: "{{ api_host }}"
+        node: "{{ node }}"
+        vmid: "{{ vmid }}"
+        name: "{{ vm_name }}"
+        memory: "{{ memory }}"
+        cores: "{{ cores }}"
+        net0: "virtio,bridge={{ bridge }}"
+        scsi0: "{{ scsi_storage }}:vm-{{ vmid }}-disk-0,size={{ scsi_size }}G,format=qcow2,pool={{ scsi_storage }}"
+        ide2: "CEPH-Share:iso/{{ iso_image }},media=cdrom"
+        boot: "cdn"
+        ostype: l26
+        state: present
+        validate_certs: false
+
+    - name: Optionally start VM
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ api_user }}"
+        api_token_id: "{{ api_token_id }}"
+        api_token_secret: "{{ api_token_secret }}"
+        api_host: "{{ api_host }}"
+        node: "{{ node }}"
+        vmid: "{{ vmid }}"
+        state: started
+        wait: yes
+        timeout: 300
+        validate_certs: false
+      when: start_vm
+
+    - name: VM Info
+      debug:
+        msg: "VM '{{ vm_name }}' (ID {{ vmid }}) is ready. Disk on {{ scsi_storage }}, ISO on CEPH-Share"
@@ -0,0 +1,34 @@
+---
+- name: SMB Credentials auf Zielhosts erzeugen
+  hosts: all
+  become: false
+  gather_facts: false
+  ignore_unreachable: yes
+
+  vars_files:
+    - ../group_vars/all/smb_credentials.yaml
+
+  vars:
+    credentials_file: "/root/.smbcredentials2"
+
+  tasks:
+    - name: SMB Credentials Datei erzeugen
+      ansible.builtin.copy:
+        dest: "{{ credentials_file }}"
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          username={{ smb_user }}
+          password={{ smb_pass }}
+      register: cred_file
+
+    - name: Prüfen ob die Credentials Datei existiert
+      ansible.builtin.stat:
+        path: "{{ credentials_file }}"
+      register: cred_stat
+
+    - name: "Debug: Status der Credentials Datei"
+      ansible.builtin.debug:
+        msg: "SMB Credentials existieren: {{ cred_stat.stat.exists }}"
+      when: cred_stat is defined and cred_stat.stat is defined
@@ -0,0 +1,20 @@
+---
+- name: Install Tree
+  hosts: debian_vms
+  become: false #root berechtigung
+  
+  vars:
+    package_name: tree
+
+
+  tasks:
+    - name: install tree
+      package:
+        name: "{{ package_name }}"
+        state: present
+        update_cache: yes
+      register: install_output
+
+    - name: Print Package installation install_output
+      debug: 
+        var: install_output
@@ -0,0 +1,100 @@
+---
+- name: HEIMLAN NFS Mount stabil und robust
+  hosts: all
+  become: true
+  gather_facts: true
+
+  vars:
+    mount_path: /mnt/HEIMLAN
+    nfs_export: "/volume1/HEIMLAN"
+
+  tasks:
+
+    # ------------------------------------------------------------
+    # 1. NFS Client Installation
+    # ------------------------------------------------------------
+
+    - name: Debian/Ubuntu NFS Client installieren
+      apt:
+        name: nfs-common
+        state: present
+        update_cache: true
+      when: ansible_os_family == "Debian"
+
+    - name: RedHat NFS Client installieren
+      yum:
+        name: nfs-utils
+        state: present
+      when: ansible_os_family == "RedHat"
+
+    # ------------------------------------------------------------
+    # 2. NFS Server Mapping (robust, kein Fail bei unbekannten Netzen)
+    # ------------------------------------------------------------
+
+    - name: NFS Server bestimmen
+      set_fact:
+        nfs_server: >-
+          {% if ansible_default_ipv4.address.startswith('9.99') %}
+          9.99.50.20
+          {% else %}
+          192.168.1.230
+          {% endif %}
+
+    - name: Debug Mapping
+      debug:
+        msg: "Host {{ ansible_default_ipv4.address }} -> NFS Server {{ nfs_server }}"
+
+    # ------------------------------------------------------------
+    # 3. Mountpoint sicherstellen
+    # ------------------------------------------------------------
+
+    - name: Mountpoint erstellen
+      file:
+        path: "{{ mount_path }}"
+        state: directory
+        mode: "0755"
+
+    # ------------------------------------------------------------
+    # 4. Alte kaputte HEIMLAN Einträge entfernen
+    # ------------------------------------------------------------
+
+    - name: Alte HEIMLAN fstab Einträge entfernen
+      lineinfile:
+        path: /etc/fstab
+        state: absent
+        regexp: 'HEIMLAN'
+
+    # ------------------------------------------------------------
+    # 5. Korrekten fstab Eintrag schreiben (kein Whitespace Fehler)
+    # ------------------------------------------------------------
+
+    - name: fstab Eintrag setzen (sauber)
+      lineinfile:
+        path: /etc/fstab
+        state: present
+        create: true
+        insertafter: EOF
+        line: "{{ nfs_server | trim }}:{{ nfs_export | trim }} {{ mount_path }} nfs rw,hard,intr,noatime,_netdev,vers=4 0 0"
+        regexp: '^{{ nfs_server | trim | regex_escape() }}:{{ nfs_export | trim | regex_escape() }}'
+
+    # ------------------------------------------------------------
+    # 6. Mount ausführen
+    # ------------------------------------------------------------
+
+    - name: Mount aktivieren
+      mount:
+        path: "{{ mount_path }}"
+        state: mounted
+      register: mount_result
+      failed_when: false
+
+    # ------------------------------------------------------------
+    # 7. Ergebnis
+    # ------------------------------------------------------------
+
+    - name: Status anzeigen
+      debug:
+        msg:
+          - "Server: {{ nfs_server }}"
+          - "Mount Path: {{ mount_path }}"
+          - "Mount changed: {{ mount_result.changed | default(false) }}"
@@ -0,0 +1,13 @@
+---
+- name: Deploy new VM
+  hosts: back
+  become: true
+
+
+- tasks: 
+
+  - name: Deploy new VMs
+  - proxmox 
+  
+
+
@@ -0,0 +1,5 @@
+- name: samba
+  package:
+    name: samba
+    state: present
+    
@@ -0,0 +1,5 @@
+- name: Install Apache Webserver
+  package:
+    name: "apache2"
+    update_cache: yes
+    state: present
@@ -0,0 +1,10 @@
+# roles/SERVER_TYP_03/tasks/main.yml
+
+- name: Install Notepad++
+  import_tasks: npp.yaml
+
+- name: Install VLC
+  import_tasks: vlc.yaml
+
+- name: Ping erlauben
+  import_tasks: ping.yml
@@ -0,0 +1,16 @@
+- name: Download NPP
+  ansible.windows.win_get_url:
+    url: https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.9/npp.8.9.Installer.exe
+    dest: C:\Windows\Temp\npp.exe
+    force: yes
+
+- name: Install Notepad++ silent
+  ansible.windows.win_shell: |
+    Start-Process "C:\Windows\Temp\npp.exe" -ArgumentList "/S" -Wait
+  args:
+    creates: C:\Program Files\Notepad++\notepad++.exe
+
+- name: Delete installer
+  ansible.windows.win_file:
+    path: C:\Windows\Temp\npp.exe
+    state: absent
@@ -0,0 +1,11 @@
+- name: Allow Ping IN IPv4
+  win_firewall_rule:
+    name: "Allow Incoming ICMPv4 Echo Request (Ping)"
+    enabled: no
+    state: present
+    profiles: "domain,private,public"
+    action: allow
+    direction: in 
+    protocol: icmpv4
+    icmp_type:code:
+      - '8:*'
@@ -0,0 +1,14 @@
+- name: Download VLC
+  win_get_url:
+    url: "https://www.vlc.de/download/vlc/msi/vlc-3.0.4-win64.msi"
+    dest: "C:\\Windows\\Temp\\vlc.msi"
+
+- name: Install VLC
+  win_package:
+    path: "C:\\Windows\\Temp\\vlc.msi"
+    state: present
+
+- name: Remove VLC
+  win_file:
+    path: "C:\\Windows\\Temp\\vlc.msi"
+    state: absent
@@ -0,0 +1,67 @@
+
+- name: Skip wenn Zertifikat deaktiviert
+  meta: end_host
+  when: not (cert.enabled | default(false))
+
+- name: Prüfe Profil
+  fail:
+    msg: "Kein Zertifikatsprofil definiert auf {{ inventory_hostname }}"
+  when: cert.profile is not defined
+
+- name: Lade Profildefinition
+  set_fact:
+    cert_cfg: "{{ cert_profiles[cert.profile] }}"
+
+- name: Zielpfad setzen
+  set_fact:
+    cert_path: "{{ cert_base_path }}/{{ inventory_hostname }}"
+
+- name: Verzeichnisse erstellen
+  file:
+    path: "{{ cert_path }}/{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - KEY
+    - CSR
+    - CERT
+
+- name: Installiere cryptography Abhängigkeit
+  apt:
+    name:
+      - python3-cryptography
+      - python3-pip
+    state: present
+    update_cache: true
+  become: true
+  ignore_errors: true
+
+- name: Private Key erzeugen
+  community.crypto.openssl_privatekey:
+    path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
+    size: "{{ cert_cfg.key_size }}"
+    type: RSA
+
+- name: FQDN bestimmen
+  set_fact:
+    cert_fqdn: >-
+      {{
+        ansible_facts['fqdn']
+        | default(ansible_facts['hostname'])
+        | default(inventory_hostname ~ '.local')
+      }}
+
+- name: SAN bauen (DNS + IP)
+  set_fact:
+    san_list: >-
+      {{
+        ['DNS:' ~ cert_fqdn]
+        + ([ 'IP:' ~ ansible_host ] if ansible_host is defined else [])
+      }}
+
+- name: CSR erzeugen (dynamisch)
+  community.crypto.openssl_csr:
+    path: "{{ cert_path }}/CSR/{{ inventory_hostname }}.csr"
+    privatekey_path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
+    common_name: "{{ cert_fqdn }}"
+    subject_alt_name: "{{ san_list }}"
@@ -0,0 +1,4 @@
+---
+- hosts: SERVER_TYP_03
+  roles:
+    - SERVER_TYP_03
@@ -0,0 +1,15 @@
+---
+- hosts: SERVER_TYP_01
+  become: true
+  roles:
+    - SERVER_TYP_01
+
+- hosts: SERVER_TYP_02
+  become: false
+  roles:
+    - SERVER_TYP_02
+
+- hosts: SERVER_TYP_03
+  roles:
+    - SERVER_TYP_03
+- import_playbook: certificate.yaml    
@@ -0,0 +1,59 @@
+---
+- name: SMB Freigabe einrichten und mounten
+  hosts: all
+  become: true
+  gather_facts: true
+
+  vars:
+    mount_point: "/mnt/smbshare"
+    smb_server: "//192.168.1.10/DATA"
+    credentials_file: "/root/.smbcredentials"
+
+  tasks:
+
+    - name: Stelle sicher, dass cifs-utils installiert ist
+      ansible.builtin.package:
+        name: cifs-utils
+        state: present
+
+    - name: Mountpoint erstellen
+      ansible.builtin.file:
+        path: "{{ mount_point }}"
+        state: directory
+        mode: "0755"
+
+    - name: SMB Credentials Datei erzeugen
+      ansible.builtin.copy:
+        dest: "{{ credentials_file }}"
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          username={{ smb_user }}
+          password={{ smb_pass }}
+
+    - name: Fstab-Eintrag sicherstellen
+      ansible.builtin.lineinfile:
+        path: /etc/fstab
+        line: "{{ smb_server }} {{ mount_point }} cifs credentials={{ credentials_file }},iocharset=utf8,vers=3.0 0 0"
+        state: present
+        insertafter: EOF
+        backup: yes
+
+    - name: SMB Freigabe mounten
+      ansible.builtin.mount:
+        path: "{{ mount_point }}"
+        src: "{{ smb_server }}"
+        fstype: cifs
+        opts: "credentials={{ credentials_file }},iocharset=utf8,vers=3.0"
+        state: mounted
+
+    - name: Prüfen ob SMB Freigabe gemounted wurde
+      ansible.builtin.command: mountpoint -q {{ mount_point }}
+      register: mount_check
+      changed_when: false
+      failed_when: mount_check.rc != 0
+
+    - name: Erfolgsmeldung
+      ansible.builtin.debug:
+        msg: "SMB Freigabe erfolgreich gemounted auf {{ mount_point }}"
@@ -0,0 +1,39 @@
+---
+- name: Upgrade VMs
+  hosts:
+  - debian_vms
+  - PDCs
+  - front
+  - back
+  - test
+  - pdm_hosts
+  - pbs_hosts
+  - dmz_hosts
+  - proxy_hosts
+  become: false
+
+  tasks:
+    - name: Update apt package cache and upgrade all packages
+      ansible.builtin.apt:
+        name: "*"
+        update_cache: yes
+        state: latest
+      register: apt_result
+
+    - name: Zeige aktualisierte Pakete (robust)
+      ansible.builtin.debug:
+        msg: >-
+          {{ apt_result.changed_packages
+             | default(apt_result.packages)
+             | default(apt_result.upgrade)
+             | default('Keine Paketänderungen oder kein apt_result-Feld gefunden') }}
+
+    - name: Print Package installation apt apt_result
+      debug: 
+        var: apt_result
+        
+    - name: Clean unwanted olderstuff
+      apt:
+        autoremove: yes
+        purge: yes
+        
@@ -0,0 +1,6 @@
+[defaults]
+inventory = /mnt/scripte/Ansible/inventory
+roles_path = /mnt/scripte/Ansible/Playbooks/roles
+host_key_checking = False
+stdout_callback = default
+vault_password_file = /root/.vault_pass
@@ -0,0 +1,60 @@
+cert_base_path: /mnt/HEIMLAN/001-Zertifikate
+
+cert_profiles:
+
+  generic:
+    key_size: 4096
+    algo: rsa
+    validity_days: 365
+
+  docker_vm:
+    key_size: 4096
+    algo: rsa
+    validity_days: 365
+    san: true
+
+  domain_controller:
+    key_size: 4096
+    algo: rsa
+    validity_days: 825
+    eku:
+      - serverAuth
+      - clientAuth
+
+  pve_node:
+    key_size: 4096
+    algo: rsa
+    validity_days: 825
+    san: true
+
+  nextcloud:
+    key_size: 4096
+    algo: rsa
+    validity_days: 365
+    san: true
+
+  reverse_proxy:
+    key_size: 4096
+    algo: rsa
+    validity_days: 365
+    san: true
+
+  backup_server:
+    key_size: 4096
+    algo: rsa
+    validity_days: 825
+
+  datacenter_manager:
+    key_size: 4096
+    algo: rsa
+    validity_days: 825
+
+  windows:
+    key_size: 2048
+    algo: rsa
+    validity_days: 365
+
+  cert_hosts:
+    key_size: 4096
+    algo: rsa
+    alidity_days: 365
@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+61373732373163666134623133323662303864343534653335613865396362316165626133356162
+6466306461343136363565346264346437386463633765370a323461663533316531373431326631
+65653062633933346232353165386233623432643434616566333162656461363739616264343839
+3238646131333835300a363230626439346131653865633138386465626538613165363165356533
+65653739326131376536613335336564333164383665353736393166373962363766373562393936
+3537373534316337626235323363646366323432616135346233
@@ -0,0 +1,165 @@
+all:
+  children:
+
+    debian_vms:
+      hosts:
+        ANSIBLE-NOTE-01:
+          ansible_host: 192.168.1.241
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: false
+            profile: generic
+
+        ANSIBLE-NOTE-02:
+          ansible_host: 192.168.1.242
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: false
+            profile: generic
+
+        Docker:
+          ansible_host: 192.168.1.244
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: docker_vm
+
+    PDCs:
+      hosts:
+        CERT-PDC:
+          ansible_host: 9.99.20.1
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: domain_controller
+  
+        SERVICE-PDC:
+          ansible_host: 9.99.30.1
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: domain_controller
+
+    front:
+      hosts:
+        FHS0:
+          ansible_host: 192.168.1.200
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+        FHS1:
+          ansible_host: 192.168.1.201
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+        FHS2:
+          ansible_host: 192.168.1.202
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+    back:
+      hosts:
+        HS1:
+          ansible_host: 192.168.1.211
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+        HS2:
+          ansible_host: 192.168.1.212
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+        HS3:
+          ansible_host: 192.168.1.213
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+        HS4:
+          ansible_host: 192.168.1.214
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+    test:
+      hosts:
+        TS01:
+          ansible_host: 192.168.1.231
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: pve_node
+
+    dmz_hosts:
+      hosts:
+        DMZ_NC:
+          ansible_host: 9.99.60.1
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: nextcloud
+
+    proxy_hosts:
+      hosts:
+        NPM:
+          ansible_host: 9.99.70.1
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: reverse_proxy
+
+    pbs_hosts:
+      hosts:
+        PBS_Master:
+          ansible_host: 192.168.1.221
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: backup_server
+
+    pdm_hosts:
+      hosts:
+        PDM:
+          ansible_host: 192.168.1.223
+          ansible_ssh_private_key_file: /root/.ssh/ansible-cn_ed25519
+          ansible_python_interpreter: /usr/bin/python3
+          cert:
+            enabled: true
+            profile: datacenter_manager
+
+    windows:
+      hosts:
+        SRV22-Test:
+          ansible_host: 192.168.1.243
+          cert:
+            enabled: false
+            profile: windows
+