add wg prom exporter

roles/wireguard/tasks/exporter.yml

@@ -32,6 +32,15 @@
     mode: "0644"
   notify: Restart wireguard exporter
 
+- name: Allow exporter to run wg via sudo
+  ansible.builtin.copy:
+    content: "{{ wireguard_exporter_user }} ALL=(root) NOPASSWD: /usr/bin/wg\n"
+    dest: /etc/sudoers.d/wireguard_exporter
+    owner: root
+    group: root
+    mode: "0440"
+    validate: /usr/sbin/visudo -cf %s
+
 - name: Enable and start wireguard exporter
   ansible.builtin.systemd:
     name: "{{ wireguard_exporter_service }}"

roles/wireguard/templates/exporter-env.conf.j2

@@ -1,2 +1,4 @@
 # Managed by Ansible - DO NOT EDIT MANUALLY
-{{ wireguard_exporter_args_var }}="-l {{ wireguard_exporter_listen_address }} -p {{ wireguard_exporter_port }}"
+# --prepend_sudo=true: the exporter runs as the non-root wireguard_exporter
+# user (Arch service unit) and needs sudo to call `wg show` (see sudoers.d).
+{{ wireguard_exporter_args_var }}="-l {{ wireguard_exporter_listen_address }} -p {{ wireguard_exporter_port }} --prepend_sudo=true"

roles/wireguard/vars/archlinux.yml

@@ -4,3 +4,5 @@ wireguard_exporter_package: prometheus-wireguard-exporter
 wireguard_exporter_service: prometheus-wireguard-exporter
 wireguard_exporter_args_file: /etc/conf.d/prometheus-wireguard-exporter
 wireguard_exporter_args_var: WIREGUARD_EXPORTER_ARGS
+# User the Arch service unit runs as; granted sudo for `wg show` via sudoers.d.
+wireguard_exporter_user: wireguard_exporter