Okay, hier ist irgendwas fischig 
Auch beim Bau der Karte fliegt mir Ansible um die Ohren
TASK [mapserver_interfaces : Create interfaces - batman file] ***************************************************************
fatal: [newmap]: FAILED! => {"changed": false, "msg": "AnsibleUndefinedVariable: Unable to look up a name or access an attribute in template string (# {{ ansible_managed }}\n\n{% set indexer = [0] -%}\n{% for domaene in domaenen|dictsort %}\n\n{% set group = \"gateways\" -%}\n{% if \"domaene-\"+domaene[0] in groups -%}\n{% set group = \"domaene-\"+domaene[0] -%}\n{% endif -%}\n\n# BEGIN: Domäne-{{domaene[0]}}\n{% if indexer.append(indexer.pop() + 1) %}{% endif %}{# increment indexer by 1 #}\n# BATMAN Interface für Domäne-{{domaene[0]}}\nauto bat{{domaene[0]}}\niface bat{{domaene[0]}} inet6 static\n address fe80::dcad:beff:feef:{{ '%02x' % indexer[0] }}{{'%02d' % server_id}}\n netmask 64\n pre-up modprobe batman-adv\n\tpre-up ip link add bat{{domaene[0]}} type batadv\n\tpost-up ip link set address de:ad:be:ef:{{ '%02x' % indexer[0] }}:{{server_id}} dev bat{{domaene[0]}}\n post-up ip link set dev bat{{domaene[0]}} up\n post-up batctl -m bat{{domaene[0]}} it 10000\n{% for host in groups[group] %}\n{% if group == \"gateways\" %}\n{% if domaene[0] in hostvars[host].domaenenliste %}\n\tpost-up batctl -m bat{{domaene[0]}} if add t{{domaene[0]}}-{{ host }} ||:\n{% endif %}\n{% else %}\n post-up batctl -m bat{{domaene[0]}} if add tap-{{ host }} ||:\n{% endif %}\n{% endfor %}\n post-up batctl -m bat{{domaene[0]}} mm 0\n\tpost-up ip -6 addr add {{domaene[1].ffv6_network | ipaddr(server_id) | ipaddr('address')}}/64 dev bat{{domaene[0]}}\n\tpost-up pgrep -a -x -f \"batadv-vis -i bat{{domaene[0]}}.*\" || batadv-vis -i bat{{domaene[0]}} -u /run/batadvvis.{{domaene[0]}}.sock -s >/dev/null 2>&1&\n pre-down pkill -x -f \"batadv-vis -i bat{{domaene[0]}}.*\" ||:\n\niface bat{{domaene[0]}} inet static\n address {{domaene[1].ffv4_network | ipaddr(server_id) | ipaddr('address') }}\n netmask {{domaene[1].ffv4_network | ipaddr('netmask')}}\n post-down ip link del bat{{domaene[0]}}\n\n# Tunnel-Interfaces für Domäne-{{domaene[0]}}\n{% for host in groups[group] %}\n{% if group == \"gateways\" %}\n{% if domaene[0] in hostvars[host].domaenenliste %}\n{% if indexer.append(indexer.pop() + 1) %}{% endif %}{# increment indexer by 1 #}\nauto t{{domaene[0]}}-{{ host }}\niface t{{domaene[0]}}-{{ host }} inet manual\n{% if build_tunnels_over_ipv6_if_available is defined and build_tunnels_over_ipv6_if_available and ipv6 is defined and hostvars[host].ipv6 is defined %}\n pre-up ip link add $IFACE type ip6gretap local {{ipv6}} remote {{hostvars[host].ipv6}} dev {{ansible_default_ipv6.interface}} key {{domaene[0]|int}}\n{% else %}\n pre-up ip link add $IFACE type gretap local {{ansible_default_ipv4.address}} remote {{hostvars[host].ipv4}} dev {{ansible_default_ipv4.interface}} key {{domaene[0]|int}}\n{% endif %}\n pre-up ip link set dev $IFACE address de:ad:be:ef:{{ '%02x' % indexer[0] }}:{{server_id}}\n pre-up ip link set $IFACE up\n post-up batctl -m bat{{domaene[0]}} if add $IFACE ||:\n pre-down batctl -m bat{{domaene[0]}} if del $IFACE ||:\n post-down ip link del $IFACE\n\n{% endif %}\n{% else %}\n{% if indexer.append(indexer.pop() + 1) %}{% endif %}{# increment indexer by 1 #}\nauto tap-{{ host }}\niface tap-{{ host }} inet manual\n pre-up ip link add $IFACE type gretap local {{ansible_default_ipv4.address}} remote {{hostvars[host].ansible_ssh_host}} dev {{ansible_default_ipv4.interface}} \n pre-up ip link set dev $IFACE address de:ad:be:ef:{{ '%02x' % indexer[0] }}:{{server_id}}\n pre-up ip link set $IFACE up\n post-up batctl -m bat{{domaene[0]}} if add $IFACE ||:\n pre-down batctl -m bat{{domaene[0]}} if del $IFACE ||:\n post-down ip link del $IFACE\n\n{% endif %}\n{% endfor %}\n# END: Domäne-{{domaene[0]}}\n\n{% endfor %} \n\n).\nMake sure your variable name does not contain invalid characters like '-': %d format: a number is required, not StrictUndefined"}
„AnsibleUndefinedVariable: Unable to look up a name or access an attribute in template string […] Make sure your variable name does not contain invalid characters like ‚-‘: %d format: a number is required, not StrictUndefined“ — hilfreiche Fehlermeldungen sehen anders aus Gibt’s einen Debug-/Interativ-Modus in Ansible, indem man sehen kann, was genau da fehlt (ich verstehe „StrictUndefined“ als „da fehlt einer Variable der Inhalt“)?
Ich hab’ dann mal spaßeshaber Euer Setup 1:1 auf eine neue VM zu deployen versucht — das lief über diese fragliche Stelle ganz fluffig hinweg …
TASK [mapserver_interfaces : Create interfaces - batman file] *******************************************************************
ok: [karte]
… bis es dann an die Zertifikate geht 
Lt. grep sind die partner:-Einträge (die ich weggelassen habe bei den Gateways) für Ansible nicht relevant — was übersehe ich?
Der FFRL routet IIRC bis auf /56 runter, daher würde es Sinn machen, /56er Routen aus den /64ern zu machen, die in den Meshes konfiguriert werden. 
. Ich mach’ die Tage mal 'nen PR.