From 9fc28377d76815cceae0227e6c44e9227d4dc678 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Fri, 11 Sep 2026 21:32:27 +0200
Subject: [PATCH] add wg prom exporter

---
 roles/wireguard/tasks/exporter.yml             | 9 +++++++++
 roles/wireguard/templates/exporter-env.conf.j2 | 4 +++-
 roles/wireguard/vars/archlinux.yml             | 2 ++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/roles/wireguard/tasks/exporter.yml b/roles/wireguard/tasks/exporter.yml
index 7e17cb0..a47480b 100644
--- a/roles/wireguard/tasks/exporter.yml
+++ b/roles/wireguard/tasks/exporter.yml
@@ -32,6 +32,15 @@
     mode: "0644"
   notify: Restart wireguard exporter
 
+- name: Allow exporter to run wg via sudo
+  ansible.builtin.copy:
+    content: "{{ wireguard_exporter_user }} ALL=(root) NOPASSWD: /usr/bin/wg\n"
+    dest: /etc/sudoers.d/wireguard_exporter
+    owner: root
+    group: root
+    mode: "0440"
+    validate: /usr/sbin/visudo -cf %s
+
 - name: Enable and start wireguard exporter
   ansible.builtin.systemd:
     name: "{{ wireguard_exporter_service }}"
diff --git a/roles/wireguard/templates/exporter-env.conf.j2 b/roles/wireguard/templates/exporter-env.conf.j2
index 834a411..1c9db79 100644
--- a/roles/wireguard/templates/exporter-env.conf.j2
+++ b/roles/wireguard/templates/exporter-env.conf.j2
@@ -1,2 +1,4 @@
 # Managed by Ansible - DO NOT EDIT MANUALLY
-{{ wireguard_exporter_args_var }}="-l {{ wireguard_exporter_listen_address }} -p {{ wireguard_exporter_port }}"
+# --prepend_sudo=true: the exporter runs as the non-root wireguard_exporter
+# user (Arch service unit) and needs sudo to call `wg show` (see sudoers.d).
+{{ wireguard_exporter_args_var }}="-l {{ wireguard_exporter_listen_address }} -p {{ wireguard_exporter_port }} --prepend_sudo=true"
diff --git a/roles/wireguard/vars/archlinux.yml b/roles/wireguard/vars/archlinux.yml
index e14d501..9c13522 100644
--- a/roles/wireguard/vars/archlinux.yml
+++ b/roles/wireguard/vars/archlinux.yml
@@ -4,3 +4,5 @@ wireguard_exporter_package: prometheus-wireguard-exporter
 wireguard_exporter_service: prometheus-wireguard-exporter
 wireguard_exporter_args_file: /etc/conf.d/prometheus-wireguard-exporter
 wireguard_exporter_args_var: WIREGUARD_EXPORTER_ARGS
+# User the Arch service unit runs as; granted sudo for `wg show` via sudoers.d.
+wireguard_exporter_user: wireguard_exporter