feat(monitoring): add smartctl, fail2ban, wireguard exporters and dashboards

- smartctl_exporter (disks), fail2ban exporter, wireguard exporter
- grafana dashboards for each exporter
- prometheus: firewall source rules, honor_labels/params scrape config
- node_exporter: zfs collector
- wireguard: nftables dep, resolvconf wrapper, reload fix
- remove superseded monitoring role

roles/wireguard/defaults/main.yml

@@ -19,3 +19,12 @@ wireguard_tunnels: []
 # OS-dependent package name
 wireguard_package_name: >-
   {{ (ansible_facts['os_family'] == 'Archlinux') | ternary('wireguard-tools', 'wireguard') }}
+
+# Prometheus exporter (optional, gated by wireguard_exporter_enabled).
+# Exposes `wg show all dump` as Prometheus metrics (bytes per peer, last
+# handshake). Arch Linux only: prometheus-wireguard-exporter is packaged in
+# [extra]; no Debian/Ubuntu equivalent exists. Bind stays loopback-only:
+# the host's local Prometheus scrapes it and is federated by the central one.
+wireguard_exporter_enabled: false
+wireguard_exporter_listen_address: "127.0.0.1"
+wireguard_exporter_port: 9586

roles/wireguard/handlers/main.yml

@@ -10,8 +10,13 @@
 - name: Reload wireguard tunnel
   ansible.builtin.shell: |
     set -o pipefail
-    wg-quick strip "{{ item.interface }}" | wg syncconf "{{ item.interface }}"
+    wg syncconf "{{ item.interface }}" <(wg-quick strip "{{ item.interface }}")
   args:
     executable: /bin/bash
   loop: "{{ wireguard_tunnels }}"
   changed_when: true
+
+- name: Restart wireguard exporter
+  ansible.builtin.systemd:
+    name: "{{ wireguard_exporter_service }}"
+    state: restarted

roles/wireguard/tasks/exporter.yml

@@ -0,0 +1,40 @@
+---
+# Prometheus WireGuard exporter (optional, gated by wireguard_exporter_enabled).
+# Runs `wg show all dump` and exposes per-peer byte counters and last-handshake
+# timestamps. Arch Linux only: prometheus-wireguard-exporter is packaged in
+# [extra]; there is no Debian/Ubuntu package.
+
+- name: Assert exporter is supported on this OS
+  ansible.builtin.assert:
+    that: ansible_facts['os_family'] == 'Archlinux'
+    fail_msg: |
+      wireguard_exporter is Arch Linux only (prometheus-wireguard-exporter is
+      not packaged for Debian/Ubuntu). Set wireguard_exporter_enabled: false.
+    success_msg: "Exporter OS support validated"
+
+- name: Load OS-specific exporter variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "archlinux.yml"
+
+- name: Install wireguard exporter
+  ansible.builtin.package:
+    name: "{{ wireguard_exporter_package }}"
+    state: present
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ wireguard_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart wireguard exporter
+
+- name: Enable and start wireguard exporter
+  ansible.builtin.systemd:
+    name: "{{ wireguard_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/wireguard/tasks/main.yml

@@ -14,10 +14,20 @@
     name: "{{ wireguard_package_name }}"
     state: present
 
+- name: Install nftables (Arch server_mode PostUp dependency)
+  ansible.builtin.package:
+    name: nftables
+    state: present
+  when:
+    - ansible_facts['os_family'] == 'Archlinux'
+    - wireguard_tunnels | selectattr('server_mode', 'defined') | selectattr('server_mode', 'equalto', true) | list | length > 0
+
 # Use systemd-resolved for DNS management (modern approach on all distributions)
-# Install systemd-resolvconf to provide resolvconf compatibility wrapper
-# "systemd-resolved" is prefered over "openresolv"
-- name: Install systemd-resolvconf (Debian only, built into systemd on Arch)
+# wg-quick calls `resolvconf` (not resolvectl) to apply DNS, so the
+# systemd-resolvconf compat wrapper must be installed wherever wg-quick is
+# used to push DNS to the local host. On Arch, tunnels that need this should
+# set `dns:` and install openresolv/systemd-resolvconf explicitly.
+- name: Install systemd-resolvconf (provides resolvconf wrapper for wg-quick)
   ansible.builtin.package:
     name: systemd-resolvconf
     state: present
@@ -42,3 +52,7 @@
   loop: "{{ wireguard_tunnels }}"
   loop_control:
     loop_var: _tunnel
+
+- name: Deploy Prometheus wireguard exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: wireguard_exporter_enabled | bool

roles/wireguard/templates/exporter-env.conf.j2

@@ -0,0 +1,2 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ wireguard_exporter_args_var }}="-l {{ wireguard_exporter_listen_address }} -p {{ wireguard_exporter_port }}"

roles/wireguard/vars/archlinux.yml

@@ -0,0 +1,6 @@
+---
+# Prometheus exporter
+wireguard_exporter_package: prometheus-wireguard-exporter
+wireguard_exporter_service: prometheus-wireguard-exporter
+wireguard_exporter_args_file: /etc/conf.d/prometheus-wireguard-exporter
+wireguard_exporter_args_var: WIREGUARD_EXPORTER_ARGS