---
  ### mrlesmithjr.ansible-manage-lvm
  lvm_groups:
   - vgname: vg_docker
     disks:
       - /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1
     create: true
     lvnames:
       - lvname: docker
         size: +100%FREE
         create: true
         filesystem: xfs
         mount: true
         mntp: /var/lib/docker
  manage_lvm: true
  pvresize_to_max: true
  ### mgrote.restic
  restic_folders_to_backup: "/ /var/lib/docker /mnt/oci-registry" # --one-file-system ist gesetzt, also werden weitere Dateisysteme nicht eingeschlossen, es sei denn sie werden hier explizit angegeben

  ### mgrote.docker-compose-inline
  compose_owner: "docker-user"
  compose_group: "docker-user"
  compose_file_permissions: "644"
  compose_dir_permissions: "755"
  compose_dest_basedir: "/docker"
  compose_src_basedir: "{{ inventory_dir }}/docker-compose"
  compose_files:
    - name: oxidized
      state: present
    - name: homer
      state: present
    - name: munin
      state: present
    - name: drone
      state: present
    - name: nextcloud
      state: present
      network: traefik
    - name: httpd
      state: present
    - name: unifi-controller
      state: present
    - name: miniflux
      state: present
      network: traefik
    - name: traefik
      state: present
      network: traefik
    - name: navidrome
      state: present
      network: traefik
    - name: watchtower
      state: present
    - name: blocky
      state: present
    - name: registry
      state: present
      network: traefik
    - name: whoami
      state: present
      network: traefik
  ### oefenweb.ufw
  ufw_rules:
    - rule: allow
      to_port: 22
      protocol: tcp
      comment: 'ssh'
      from_ip: 0.0.0.0/0
    - rule: allow
      to_port: 4949
      protocol: tcp
      comment: 'munin'
      from_ip: 0.0.0.0/0
    # docker network inspect $(docker network ls -q)|grep -E "IPv(4|6)A" | grep -v \"\" | sort -h
    - rule: allow
      from_ip: 192.168.0.0/16
      comment: 'docker networks'
    - rule: allow
      from_ip: 172.0.0.0/8
      comment: 'docker networks'

  ### geerlingguy.pip
  pip_package: python3-pip
  pip_install_packages:
    - name: docker # für munin-plugin docker_
    - name: fritzconnection # für munin fritzbox*
    - name: lxml # für munin fritzbox*
    - name: requests # für munin fritzbox*

  ### mgrote.apt_manage_packages
  apt_packages_extra:
    - libnet-dns-perl # für munin: dnsresponse_*
    - libwww-curl-perl # für munin-plugin: unifi
    - libjson-perl # für munin-plugin: unifi
    - sshpass # fur munin mt_system_*

  ### mgrote.munin-node
  munin_node_allowed_cidrs: [0.0.0.0/0] # weil der munin-server aus einem anderen subnet zugreift
  munin_node_plugins:
    - name: timesync
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/systemd/timesync_status
    - name: systemd_status
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/systemd/systemd_status
    - name: systemd_mem
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/systemd/systemd_mem
      config: |
        [systemd_mem]
        env.all_services true
    - name: lvm_
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/disk/lvm_
      config: |
        [lvm_*]
        user root
    - name: fail2ban
      src: https://git.mgrote.net/mg/munin-plugins/raw/branch/master/extern/fail2ban
      config: |
        [fail2ban]
        env.client /usr/bin/fail2ban-client
        env.config_dir /etc/fail2ban
        user root
    - name: docker_containers
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/docker/docker_
      config: |
        [docker_*]
        user root
        env.DOCKER_HOST unix://run/docker.sock
    - name: docker_cpu
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/docker/docker_
    - name: docker_memory
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/docker/docker_
    - name: docker_network
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/docker/docker_
    - name: docker_volumes
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/docker/docker_
    - name: http_response
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/http/http_response
      config: |
        [http_response]
        env.sites http://docker10.grote.lan:333 http://docker10.grote.lan:8888/nodes http://docker10.grote.lan:1234 https://nextcloud.mgrote.net http://docker10.grote.lan:3344 http://docker10.grote.lan:5000 https://miniflux.mgrote.net/ http://docker10.grote.lan:3001 http://docker10.grote.lan:8081 https://auth.mgrote.net
        env.max_time 20
        env.short_label true
        env.follow_redirect true
    - name: mt_system_hex
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/router/mikrotik_system
      config: |
        [mt_system_hex]
        user root
        env.ssh_user munin
        env.ssh_password {{ lookup('keepass', 'munin_user_hex', 'password') }}
        env.ssh_host 192.168.3.144
    - name: mt_system_crs305
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/router/mikrotik_system
      config: |
        [mt_system_crs305]
        user root
        env.ssh_user munin
        env.ssh_password {{ lookup('keepass', 'munin_user_crs305', 'password') }}
        env.ssh_host 192.168.2.225
    - name: mt_system_rb5009
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/router/mikrotik_system
      config: |
        [mt_system_rb5009]
        user root
        env.ssh_user munin
        env.ssh_password {{ lookup('keepass', 'munin_user_rb5009', 'password') }}
        env.ssh_host 192.168.2.1
    - name: unifi
      src: https://git.mgrote.net/mg/munin-plugins/raw/branch/master/extern/unifi
      config: |
        [unifi*]
        # User name to login to unifi controller API.  Default is "ubnt".  Ideally, this should
        # point to a read-only account.
        env.user munin
        # Password to login to unifi controller API. Default is "ubnt"
        env.pass {{ lookup('keepass', 'munin_user_unifi', 'password') }}
        # URL of the API, with port if needed.  No trailing slash.
        env.api_url https://docker10.grote.lan:8443
        # Verify SSL certificate name against host.
        # Note: if using a default cloudkey certificate, this will fail unless you manually add it
        # to the local keystore.
        # Default is "yes"
        env.ssl_verify_host no
        # Verify Peer's SSL vertiicate.
        # Note: if using a default cloudkey certificate, this will fail
        # Default is "yes"
        env.ssl_verify_peer no
        # The human readable name of the unifi site - used for graph titles
        env.name Unifi
        # By default, Use standard munin well know categories -
        env.force_category unifi
        #---
        # Show device CPU utilization
        env.enable_device_cpu yes
        # Show device memory usage
        env.enable_device_mem yes
        # Show device load average (switches and APs only)
        env.enable_device_load yes
        # Show device uptime
        env.enable_device_uptime yes
        # Show number of clients connected to each device
        env.enable_clients_device yes
        # Show detailed graphs for each device (per device graphs)
        env.enable_detail_clients_device yes
        # Show number of clients connected to each network type
        env.enable_clients_type yes
        # Show detailed graphs for each client type (per type graphs)
        env.enable_detail_clients_type yes
        # Show unauthorized / authorized client list
        # if you are not using the guest portal, this is useless
        env.show_authorized_clients_type yes
        # Show transfer statistics on switch ports; wirft Fehler wenn aktiv
        env.enable_xfer_port no
        # Show detailed graphs per switch port; wirft Fehler wenn aktiv
        env.enable_detail_xfer_port no
        # Hide ports that have no link (When set to no, unplugged ports will transfer 0, not be undefined); wirft Fehler wenn aktiv
        env.hide_empty_xfer_port no
        # Show transfer statistics per device; wirft Fehler wenn aktiv
        env.enable_xfer_device no
        # Show detailed graphs for each device; wirft Fehler wenn aktiv
        env.enable_detail_xfer_device yes
        # Show transfer statistics per named network; wirft Fehler wenn aktiv
        env.enable_xfer_network no
        # Show detailed graphs for each named network; wirft Fehler wenn aktiv
        env.enable_detail_xfer_network no
        # Show transfer statistics per radio; wirft Fehler wenn aktiv
        env.enable_xfer_radio no
        # Show detailed graphs for each radio; wirft Fehler wenn aktiv
        env.enable_detail_xfer_radio no
    - name: fritzbox_uptime.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_uptime.py
    - name: fritzbox_traffic.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_traffic.py
    - name: fritzbox_power.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_power_consumption.py
    - name: fritzbox_memory.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_memory_usage.py
    - name: fritzbox_helper.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_helper.py
    - name: fritzbox_cpu.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_cpu_usage.py
    - name: fritzbox_temp.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_cpu_temperature.py
    - name: fritzbox_conn_uptime.py
      src: https://git.mgrote.net/mg/mirror-frododvr-fritzbox-munin/raw/branch/master/fritzbox_connection_uptime.py
      config: |
        [fritzbox_*]
        env.fritzbox_ip 192.168.5.1
        env.fritzbox_username munin
        env.fritzbox_password {{ lookup('keepass', 'munin_user_fritzbox', 'password') }}
        env.traffic_remove_max true # if you do not want the possible max values
    - name: nextcloud_nextcloud.mgrote.net
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/nextcloud/nextcloud_
      config: |
        [nextcloud_nextcloud.mgrote.net]
        env.username munin
        env.password {{ lookup('keepass', 'munin_user_nextcloud', 'password') }}
        env.api_path /ocs/v2.php/apps/serverinfo/api/v1/info
        env.scheme https
    - name: dnsresponse_192.168.2.1
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/network/dns/dnsresponse_
    - name: dnsresponse_192.168.2.43
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/network/dns/dnsresponse_
    - name: dnsresponse_127.0.0.1
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/network/dns/dnsresponse_
      config: |
        [dnsresponse_*]
        env.site www.heise.de
        env.times 20
    - name: gitea_commit_time_diff
      src: https://git.mgrote.net/mg/mirror-munin-contrib/raw/branch/master/plugins/git/gitea_commit_time_diff
      config: |
        [gitea_commit_time_diff]
        env.url git.mgrote.net
        env.repo oxidized-configs
        env.user mg
        env.git_ref HEAD
        env.warning 1000
        env.critical 2880
        env.token {{ lookup('keepass', 'gitea_commit_time_diff_oxidized_token', 'password') }}
    - name: docker_volumesize
      src: https://git.mgrote.net/Mirror/munin-contrib/raw/branch/master/plugins/docker/docker_volumesize