feat(monitoring): add grafana, prometheus, node_exporter roles

- grafana: postgres backend, provisioning (prometheus datasource + node/NUT dashboards)
- prometheus: native service, scrape config via host_vars, localhost bind
- node_exporter: host metrics exporter (localhost:9100)

roles/node_exporter/README.md

@@ -0,0 +1,43 @@
+# node_exporter — Prometheus exporter for host metrics
+
+Exposes machine metrics (CPU, memory, disk, filesystem, network) for Prometheus.
+
+## Supported distributions
+
+- Arch Linux (package `prometheus-node-exporter`, extra repo)
+- Debian/Ubuntu (package `prometheus-node-exporter`)
+
+## Configuration
+
+See [defaults/main.yml](defaults/main.yml).
+
+Optional:
+
+```yaml
+node_exporter_listen_address: "127.0.0.1:9100"
+```
+
+Keep localhost-only — Prometheus scrapes it locally on the same host. To add
+collectors (e.g. `--collector.systemd`, `--collector.textfile.directory`), extend
+`node_exporter_listen_address` or override the args in host_vars.
+
+## Pairing with Prometheus
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'node'
+    static_configs:
+      - targets: ['localhost:9100']
+```
+
+## Operations
+
+```bash
+systemctl status prometheus-node-exporter
+curl -s http://127.0.0.1:9100/metrics | head
+journalctl -u prometheus-node-exporter -f
+```
+
+## Dependencies
+
+None. Standalone exporter.

roles/node_exporter/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# Prometheus node_exporter configuration
+
+# Address the exporter listens on. Keep localhost-only — Prometheus scrapes it
+# locally on the same host; no need to expose on the network.
+node_exporter_listen_address: "127.0.0.1:9100"

roles/node_exporter/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart node_exporter
+  ansible.builtin.systemd:
+    name: "{{ node_exporter_service }}"
+    state: restarted

roles/node_exporter/meta/main.yml

@@ -0,0 +1,2 @@
+---
+dependencies: []

roles/node_exporter/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Load OS-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "debian.yml"
+
+- name: Install node_exporter
+  ansible.builtin.package:
+    name: "{{ node_exporter_package }}"
+    state: present
+
+- name: Deploy node_exporter configuration
+  ansible.builtin.template:
+    src: env.conf.j2
+    dest: "{{ node_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart node_exporter
+
+- name: Enable and start node_exporter
+  ansible.builtin.systemd:
+    name: "{{ node_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/node_exporter/templates/env.conf.j2

@@ -0,0 +1,2 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ node_exporter_args_var }}="--web.listen-address={{ node_exporter_listen_address }}"

roles/node_exporter/vars/archlinux.yml

@@ -0,0 +1,5 @@
+---
+node_exporter_package: prometheus-node-exporter
+node_exporter_service: prometheus-node-exporter
+node_exporter_args_file: /etc/conf.d/prometheus-node-exporter
+node_exporter_args_var: NODE_EXPORTER_ARGS

roles/node_exporter/vars/debian.yml

@@ -0,0 +1,5 @@
+---
+node_exporter_package: prometheus-node-exporter
+node_exporter_service: prometheus-node-exporter
+node_exporter_args_file: /etc/default/prometheus-node-exporter
+node_exporter_args_var: ARGS