feat(monitoring): add smartctl, fail2ban, wireguard exporters and dashboards

- smartctl_exporter (disks), fail2ban exporter, wireguard exporter
- grafana dashboards for each exporter
- prometheus: firewall source rules, honor_labels/params scrape config
- node_exporter: zfs collector
- wireguard: nftables dep, resolvconf wrapper, reload fix
- remove superseded monitoring role

roles/prometheus/defaults/main.yml

@@ -12,8 +12,14 @@ prometheus_retention_size: 0
 
 # Web interface settings
 prometheus_web_listen_address: "127.0.0.1:9090"
+prometheus_port: 9090
 prometheus_web_external_url: ""
 
+# UFW sources allowed to reach the web UI/federation endpoint. Empty means
+# localhost-only; set on VPN-server hosts so a remote Prometheus can federate
+# over the tunnel.
+prometheus_firewall_allowed_sources: []
+
 # Storage settings (uses prometheus_data_dir from vars/)
 prometheus_storage_tsdb_path: "{{ prometheus_data_dir }}"
 

roles/prometheus/tasks/main.yml

@@ -60,6 +60,21 @@
       enabled: true
       state: started
 
+- name: Setup firewall rules for Prometheus
+  community.general.ufw:
+      rule: allow
+      src: "{{ item }}"
+      port: "{{ prometheus_port }}"
+      proto: tcp
+      direction: in
+      comment: "Prometheus"
+  loop: "{{ prometheus_firewall_allowed_sources }}"
+  retries: 5
+  delay: 2
+  register: ufw_result
+  until: ufw_result is succeeded
+  when: prometheus_firewall_allowed_sources | length > 0
+
 - name: Deploy Nginx vhost configuration
   ansible.builtin.template:
       src: nginx-vhost.conf.j2

roles/prometheus/templates/prometheus.yml.j2

@@ -36,6 +36,18 @@ scrape_configs:
 {% if scrape_config.metrics_path is defined %}
     metrics_path: {{ scrape_config.metrics_path }}
 {% endif %}
+{% if scrape_config.honor_labels is defined %}
+    honor_labels: {{ scrape_config.honor_labels | bool | lower }}
+{% endif %}
+{% if scrape_config.params is defined %}
+    params:
+{% for param_key, param_values in scrape_config.params.items() %}
+      {{ param_key }}:
+{% for param_value in param_values %}
+        - {{ param_value }}
+{% endfor %}
+{% endfor %}
+{% endif %}
 {% if scrape_config.static_configs is defined %}
     static_configs:
 {% for static_config in scrape_config.static_configs %}