feat(monitoring): add smartctl, fail2ban, wireguard exporters and dashboards

- smartctl_exporter (disks), fail2ban exporter, wireguard exporter
- grafana dashboards for each exporter
- prometheus: firewall source rules, honor_labels/params scrape config
- node_exporter: zfs collector
- wireguard: nftables dep, resolvconf wrapper, reload fix
- remove superseded monitoring role

roles/fail2ban/README.md

@@ -17,6 +17,19 @@ Bans brute-force sources via UFW. Reads logs from the systemd journal (`backend
 
 See [defaults/main.yml](defaults/main.yml).
 
+## Prometheus exporter
+
+Optionally exposes fail2ban metrics (`f2b_*`) for Prometheus via
+[hectorjsmith/fail2ban-prometheus-exporter](https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter).
+
+```yaml
+fail2ban_exporter_enabled: true
+```
+
+Downloads the checksum-verified static binary to `/usr/local/bin` and runs it
+as a hardened root systemd service (required to read the root-owned socket) on
+`{{ fail2ban_exporter_listen_address }}` (default `127.0.0.1:9191`).
+
 ## Verify
 
 ```bash

roles/fail2ban/defaults/main.yml

@@ -2,3 +2,10 @@
 fail2ban_firewall: ufw
 fail2ban_backend: systemd
 fail2ban_blocktype: deny
+
+# Prometheus exporter (optional, gated by fail2ban_exporter_enabled).
+fail2ban_exporter_enabled: false
+fail2ban_exporter_version: "0.10.3"
+fail2ban_exporter_listen_address: "127.0.0.1:9191"
+fail2ban_exporter_socket: "/var/run/fail2ban/fail2ban.sock"
+fail2ban_exporter_binary_dir: "/usr/local/bin"

roles/fail2ban/handlers/main.yml

@@ -4,3 +4,9 @@
     name: fail2ban
     daemon_reload: true
     state: restarted
+
+- name: Restart fail2ban_exporter
+  ansible.builtin.systemd:
+    name: fail2ban_exporter
+    daemon_reload: true
+    state: restarted

roles/fail2ban/tasks/exporter.yml

@@ -0,0 +1,83 @@
+---
+# Prometheus fail2ban exporter (optional, gated by fail2ban_exporter_enabled).
+# Downloads the checksum-verified hectorjsmith/fail2ban-prometheus-exporter
+# static binary and runs it as a hardened root systemd service (required to
+# read the root-owned fail2ban socket).
+
+- name: Map CPU architecture to release asset
+  ansible.builtin.set_fact:
+    fail2ban_exporter_arch: >-
+      {{ {
+           'x86_64': 'amd64',
+           'aarch64': 'arm64',
+           'armv7l': 'armv7',
+           'armv6l': 'armv6',
+           'i386': '386',
+           'i686': '386'
+         }[ansible_architecture] }}
+
+- name: Set release filenames
+  ansible.builtin.set_fact:
+    fail2ban_exporter_archive: "fail2ban_exporter_{{ fail2ban_exporter_version }}_linux_{{ fail2ban_exporter_arch }}.tar.gz"
+    fail2ban_exporter_checksums: "fail2ban_exporter_{{ fail2ban_exporter_version }}_checksums.txt"
+    fail2ban_exporter_release_base: "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter/-/releases/v{{ fail2ban_exporter_version }}/downloads"
+
+- name: Download fail2ban_exporter release
+  ansible.builtin.get_url:
+    url: "{{ fail2ban_exporter_release_base }}/{{ fail2ban_exporter_archive }}"
+    dest: "/tmp/{{ fail2ban_exporter_archive }}"
+    mode: "0644"
+
+- name: Download release checksums
+  ansible.builtin.get_url:
+    url: "{{ fail2ban_exporter_release_base }}/{{ fail2ban_exporter_checksums }}"
+    dest: "/tmp/{{ fail2ban_exporter_checksums }}"
+    mode: "0644"
+
+- name: Verify release archive checksum
+  ansible.builtin.command: "sha256sum -c --ignore-missing {{ fail2ban_exporter_checksums }}"
+  args:
+    chdir: /tmp
+  changed_when: false
+
+- name: Extract fail2ban_exporter binary
+  ansible.builtin.unarchive:
+    src: "/tmp/{{ fail2ban_exporter_archive }}"
+    dest: /tmp
+    remote_src: true
+    extra_opts:
+      - fail2ban_exporter
+
+- name: Install fail2ban_exporter binary
+  ansible.builtin.copy:
+    src: /tmp/fail2ban_exporter
+    dest: "{{ fail2ban_exporter_binary_dir }}/fail2ban_exporter"
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Clean up temporary files
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - "/tmp/{{ fail2ban_exporter_archive }}"
+    - "/tmp/{{ fail2ban_exporter_checksums }}"
+    - /tmp/fail2ban_exporter
+
+- name: Deploy fail2ban_exporter systemd unit
+  ansible.builtin.template:
+    src: fail2ban_exporter.service.j2
+    dest: /etc/systemd/system/fail2ban_exporter.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart fail2ban_exporter
+
+- name: Enable and start fail2ban_exporter
+  ansible.builtin.systemd:
+    name: fail2ban_exporter
+    enabled: true
+    state: started
+    daemon_reload: true

roles/fail2ban/tasks/main.yml

@@ -70,3 +70,7 @@
     name: fail2ban
     state: started
     enabled: true
+
+- name: Deploy Prometheus fail2ban exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: fail2ban_exporter_enabled | bool

roles/fail2ban/templates/fail2ban_exporter.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Fail2Ban Prometheus Exporter
+After=network.target fail2ban.service
+
+[Service]
+ExecStart={{ fail2ban_exporter_binary_dir }}/fail2ban_exporter --collector.f2b.socket={{ fail2ban_exporter_socket }} --web.listen-address={{ fail2ban_exporter_listen_address }}
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=yes
+CapabilityBoundingSet=
+
+[Install]
+WantedBy=multi-user.target