fix(monitoring): exporter auth and reload fixes

- postgres: use lib/pq conninfo DATA_SOURCE_NAME; the postgresql:// URL
  form broke on special chars in the password (net/url: invalid userinfo)
- nginx: flush handlers after deploying stub_status so nginx reloads
  before the exporter starts scraping
- valkey: drop invalid +arcount command from the exporter ACL set
  (Valkey aborted startup parsing the ACL file)

roles/nginx/tasks/exporter.yml

@@ -17,6 +17,9 @@
     mode: "0644"
   notify: Reload nginx
 
+- name: Flush handlers to reload nginx with stub_status
+  ansible.builtin.meta: flush_handlers
+
 - name: Deploy exporter environment file
   ansible.builtin.template:
     src: exporter-env.conf.j2

roles/postgres/README.md

@@ -92,7 +92,7 @@ via `postgres_exporter`. Enable it:
 
 ```yaml
 postgres_exporter_enabled: true
-postgres_exporter_password: "<min 12 chars>"  # keep URL-safe
+postgres_exporter_password: "<min 12 chars>"  # avoid spaces/single quotes
 ```
 
 The role creates a `postgres_exporter` monitoring role with the built-in

roles/postgres/templates/exporter-env.conf.j2

@@ -1,3 +1,3 @@
 # Managed by Ansible - DO NOT EDIT MANUALLY
 {{ postgres_exporter_args_var }}="--web.listen-address={{ postgres_exporter_listen_address }}"
-DATA_SOURCE_NAME="postgresql://{{ postgres_exporter_user }}:{{ postgres_exporter_password }}@{{ postgres_exporter_pg_host }}:{{ postgres_exporter_pg_port }}/{{ postgres_exporter_pg_dbname }}?sslmode=disable"
+DATA_SOURCE_NAME="user={{ postgres_exporter_user }} password={{ postgres_exporter_password }} host={{ postgres_exporter_pg_host }} port={{ postgres_exporter_pg_port }} dbname={{ postgres_exporter_pg_dbname }} sslmode=disable"

roles/valkey/defaults/main.yml

@@ -42,12 +42,9 @@ valkey_exporter_listen_address: "127.0.0.1:9121"
 valkey_exporter_redis_addr: "redis://127.0.0.1:6379"
 valkey_exporter_user: valkey_exporter
 # valkey_exporter_password: ""  # Intentionally undefined - required when enabled
-# Read-only command set recommended by redis_exporter for monitoring.
+# Read-only command set for monitoring: connection (auth/ping/client) + the
-valkey_exporter_commands: >-
+# metrics the exporter scrapes (INFO, CONFIG GET maxmemory).
-  -@all +@connection +memory -readonly +strlen +config|get +xinfo +pfcount
+valkey_exporter_commands: "-@all +@connection +info +config|get"
-  -quit +zcard +type +xlen -readwrite -command +client -wait +scard +llen
-  +hlen +arcount +get +eval +slowlog +cluster|info +cluster|slots +cluster|nodes
-  -hello -echo +info +latency +scan -reset -auth -asking
 
 # Valkey log level (debug, verbose, notice, warning)
 valkey_loglevel: notice