apt_updates: the role owns the apt metrics (Debian collector off, explicit zero rows, multi-suite security detection)

apt_updates/tasks/main.yml

@@ -11,6 +11,7 @@
     src: apt-updates-metrics.j2
     dest: /usr/local/sbin/apt-updates-metrics
     mode: "0755"
+  register: apt_updates_script
 
 - name: Create the apt timers' drop-in directories
   ansible.builtin.file:
@@ -39,3 +40,41 @@
   when: apt_updates_dropins.changed
   # Check mode does not write the drop-ins.
   ignore_errors: "{{ ansible_check_mode }}"
+
+# Debian's prometheus-node-exporter-apt collector writes apt.prom with the same metric families as this role under
+# other HELP texts; node_exporter drops the rows of both files then. This role owns the apt metrics, so the
+# collector stays off and its file, also a stale leftover of a removed collector, goes away.
+- name: Look for the Debian apt metrics collector
+  ansible.builtin.stat:
+    path: /lib/systemd/system/prometheus-node-exporter-apt.timer
+  register: apt_updates_debian_collector
+
+- name: Stop and disable the Debian apt metrics collector timer
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter-apt.timer
+    enabled: false
+    state: stopped
+  when: apt_updates_debian_collector.stat.exists
+
+- name: Stop the Debian apt metrics collector service
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter-apt.service
+    state: stopped
+  when: apt_updates_debian_collector.stat.exists
+
+- name: Remove the Debian apt metrics collector output
+  ansible.builtin.file:
+    path: "{{ apt_updates_textfile_dir }}/apt.prom"
+    state: absent
+
+# The timers' drop-ins write the metrics after the next apt run; this gives a new host and a changed script
+# current metrics at once.
+- name: Look for the apt metrics file
+  ansible.builtin.stat:
+    path: "{{ apt_updates_textfile_dir }}/apt_updates.prom"
+  register: apt_updates_prom
+
+- name: Write the apt metrics
+  ansible.builtin.command: /usr/local/sbin/apt-updates-metrics
+  when: apt_updates_script.changed or not apt_updates_prom.stat.exists
+  changed_when: true