Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses

2026-10-23 20:44:59 +00:00
parent 381e1b285c
commit a64d082c0c
4 changed files with 90 additions and 0 deletions
@@ -0,0 +1,69 @@
+---
+# Both exporters listen on all addresses; host_firewall limits who reaches them.
+- name: Install the node exporter
+  ansible.builtin.apt:
+    name: prometheus-node-exporter
+    state: present
+
+- name: Enable the node exporter
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter
+    enabled: true
+    state: started
+  # Check mode does not install the package.
+  ignore_errors: "{{ ansible_check_mode }}"
+
+- name: Install the smartctl exporter
+  when: host_exporters_smart
+  block:
+    - name: Look for an existing backports source
+      ansible.builtin.shell: >-
+        grep -rEqs '^[^#]*{{ ansible_distribution_release }}-backports'
+        --include='*.list' --include='*.sources' --exclude=host-exporters-backports.sources /etc/apt
+      register: host_exporters_backports
+      changed_when: false
+      failed_when: host_exporters_backports.rc > 1
+      check_mode: false
+
+    # Backports stay at priority 100, so only packages named with default_release come from there.
+    - name: Add the backports source
+      ansible.builtin.copy:
+        dest: /etc/apt/sources.list.d/host-exporters-backports.sources
+        mode: "0644"
+        content: |
+          Types: deb
+          URIs: http://deb.debian.org/debian
+          Suites: {{ ansible_distribution_release }}-backports
+          Components: main
+          Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+      register: host_exporters_source
+      when: host_exporters_backports.rc == 1
+
+    # The module rejects default_release while the release is missing from its package cache.
+    - name: Look for the backports release in the package lists
+      ansible.builtin.shell: apt-cache policy | grep -q 'n={{ ansible_distribution_release }}-backports'
+      register: host_exporters_lists
+      changed_when: false
+      failed_when: false
+      check_mode: false
+
+    - name: Refresh the package lists for the backports source
+      ansible.builtin.apt:
+        update_cache: true
+      when: host_exporters_lists.rc != 0
+
+    - name: Install the smartctl exporter from backports
+      ansible.builtin.apt:
+        name: prometheus-smartctl-exporter
+        default_release: "{{ ansible_distribution_release }}-backports"
+        state: present
+      # Check mode does not write the backports source.
+      ignore_errors: "{{ ansible_check_mode }}"
+
+    # The packaged unit runs as root, which smartctl needs for the disks.
+    - name: Enable the smartctl exporter
+      ansible.builtin.systemd:
+        name: smartctl_exporter
+        enabled: true
+        state: started
+      ignore_errors: "{{ ansible_check_mode }}"