feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/nginx/README.md

@@ -28,6 +28,26 @@ hostname and breaking TLS verification on other vhosts.
 
 Disable with `nginx_default_server_enabled: false`.
 
+## Prometheus exporter
+
+Optionally exposes nginx metrics (active connections, requests/sec) for
+Prometheus via `nginx-prometheus-exporter`, which scrapes a loopback-only
+`stub_status` endpoint this role deploys. Enable it:
+
+```yaml
+nginx_exporter_enabled: true
+```
+
+The exporter binds to `127.0.0.1:9113`; the `stub_status` block listens on
+`127.0.0.1:8090` and denies non-localhost clients. Pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'nginx'
+    static_configs:
+      - targets: ['127.0.0.1:9113']
+```
+
 ## Service Integration Pattern
 
 Each service role should deploy its own vhost config:

roles/nginx/defaults/main.yml

@@ -44,3 +44,10 @@ nginx_forwarder: {}
 # Let's Encrypt / Certbot configuration
 # acme_email: ""  # Required for Let's Encrypt - intentionally undefined
 # Set this variable to enable Certbot installation and certificate management
+
+# Prometheus exporter (optional, via nginx-prometheus-exporter)
+# Scrapes a loopback-only stub_status endpoint this role deploys.
+nginx_exporter_enabled: false
+nginx_exporter_listen_address: "127.0.0.1:9113"
+nginx_exporter_stub_status_listen: "127.0.0.1:8090"
+nginx_exporter_scrape_uri: "http://127.0.0.1:8090/stub_status"

roles/nginx/handlers/main.yml

@@ -8,3 +8,8 @@
   ansible.builtin.systemd:
     name: nginx
     state: restarted
+
+- name: Restart nginx exporter
+  ansible.builtin.systemd:
+    name: "{{ nginx_exporter_service }}"
+    state: restarted

roles/nginx/tasks/exporter.yml

@@ -0,0 +1,34 @@
+---
+# Prometheus nginx exporter (optional, gated by nginx_exporter_enabled).
+# Installs nginx-prometheus-exporter and exposes a loopback-only stub_status
+# endpoint that the exporter scrapes.
+
+- name: Install nginx-prometheus-exporter
+  ansible.builtin.package:
+    name: "{{ nginx_exporter_package }}"
+    state: present
+
+- name: Deploy nginx stub_status endpoint
+  ansible.builtin.template:
+    src: stub-status.conf.j2
+    dest: "{{ nginx_conf_dir }}/99-stub-status.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload nginx
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ nginx_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart nginx exporter
+
+- name: Enable and start nginx exporter
+  ansible.builtin.systemd:
+    name: "{{ nginx_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/nginx/tasks/main.yml

@@ -207,3 +207,7 @@
     name: nginx
     enabled: true
     state: started
+
+- name: Deploy Prometheus nginx exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: nginx_exporter_enabled | bool

roles/nginx/templates/exporter-env.conf.j2

@@ -0,0 +1,2 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ nginx_exporter_args_var }}="-nginx.scrape-uri={{ nginx_exporter_scrape_uri }} -web.listen-address={{ nginx_exporter_listen_address }}"

roles/nginx/templates/stub-status.conf.j2

@@ -0,0 +1,12 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+# stub_status endpoint for nginx-prometheus-exporter (loopback only)
+server {
+    listen {{ nginx_exporter_stub_status_listen }};
+    server_name localhost;
+
+    location /stub_status {
+        stub_status;
+        allow 127.0.0.1;
+        deny all;
+    }
+}

roles/nginx/vars/archlinux.yml

@@ -1,3 +1,9 @@
 ---
 nginx_user: http
 certbot_timer: certbot-renew.timer
+
+# Prometheus exporter
+nginx_exporter_package: nginx-prometheus-exporter
+nginx_exporter_service: nginx-prometheus-exporter
+nginx_exporter_args_file: /etc/conf.d/nginx-prometheus-exporter
+nginx_exporter_args_var: NGINX_EXPORTER_ARGS

roles/nginx/vars/debian.yml

@@ -1,3 +1,9 @@
 ---
 nginx_user: www-data
 certbot_timer: certbot.timer
+
+# Prometheus exporter
+nginx_exporter_package: prometheus-nginx-exporter
+nginx_exporter_service: prometheus-nginx-exporter
+nginx_exporter_args_file: /etc/default/prometheus-nginx-exporter
+nginx_exporter_args_var: ARGS

roles/postgres/README.md

@@ -85,6 +85,27 @@ sudo -u postgres psql -c "SHOW shared_buffers;"
 sudo -u postgres psql -c "SHOW effective_cache_size;"
 ```
 
+## Prometheus exporter
+
+Optionally exposes PostgreSQL metrics (connections, cache hit ratio, deadlocks)
+via `postgres_exporter`. Enable it:
+
+```yaml
+postgres_exporter_enabled: true
+postgres_exporter_password: "<min 12 chars>"  # keep URL-safe
+```
+
+The role creates a `postgres_exporter` monitoring role with the built-in
+`pg_monitor` role (no superuser). The exporter binds to `127.0.0.1:9187`;
+pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'postgres'
+    static_configs:
+      - targets: ['127.0.0.1:9187']
+```
+
 ## References
 
 - [PostgreSQL Documentation](https://www.postgresql.org/docs/current/)

roles/postgres/defaults/main.yml

@@ -49,3 +49,13 @@ postgres_log_truncate_on_rotation: "off" # Overwrite old log files with same nam
 postgres_logrotate_rotate: 14 # Keep 14 days of logs
 postgres_logrotate_frequency: daily # daily|weekly|monthly
 postgres_logrotate_compress: true # Compress rotated logs
+
+# Prometheus exporter (optional, via postgres_exporter)
+# Creates its own minimal monitoring role (pg_monitor, no superuser).
+postgres_exporter_enabled: false
+postgres_exporter_listen_address: "127.0.0.1:9187"
+postgres_exporter_user: postgres_exporter
+# postgres_exporter_password: ""  # Intentionally undefined - required when enabled
+postgres_exporter_pg_host: "127.0.0.1"
+postgres_exporter_pg_port: "{{ postgres_port }}"
+postgres_exporter_pg_dbname: postgres

roles/postgres/handlers/main.yml

@@ -8,3 +8,8 @@
   ansible.builtin.systemd:
     name: "{{ postgres_service_name }}"
     state: reloaded
+
+- name: Restart postgres exporter
+  ansible.builtin.systemd:
+    name: "{{ postgres_exporter_service }}"
+    state: restarted

roles/postgres/tasks/exporter.yml

@@ -0,0 +1,54 @@
+---
+# Prometheus postgres exporter (optional, gated by postgres_exporter_enabled).
+# Creates a minimal monitoring role (pg_monitor) and runs postgres_exporter
+# against the local instance.
+
+- name: Validate exporter password is set
+  ansible.builtin.assert:
+    that:
+      - postgres_exporter_password is defined
+      - postgres_exporter_password | length >= 12
+    fail_msg: |
+      postgres_exporter_password is required (min 12 chars) when
+      postgres_exporter_enabled is true.
+      See roles/postgres/defaults/main.yml for configuration instructions.
+    success_msg: "Exporter password validation passed"
+
+- name: Install postgres_exporter
+  ansible.builtin.package:
+    name: "{{ postgres_exporter_package }}"
+    state: present
+
+- name: Create postgres_exporter monitoring role
+  community.postgresql.postgresql_user:
+    name: "{{ postgres_exporter_user }}"
+    password: "{{ postgres_exporter_password }}"
+    role_attr_flags: NOSUPERUSER,NOCREATEDB,NOCREATEROLE
+    state: present
+  become: false
+  become_user: "{{ postgres_admin_user }}"
+
+- name: Grant pg_monitor to postgres_exporter
+  community.postgresql.postgresql_membership:
+    group: pg_monitor
+    target_roles:
+      - "{{ postgres_exporter_user }}"
+    state: present
+  become: false
+  become_user: "{{ postgres_admin_user }}"
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ postgres_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart postgres exporter
+
+- name: Enable and start postgres exporter
+  ansible.builtin.systemd:
+    name: "{{ postgres_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/postgres/tasks/main.yml

@@ -99,3 +99,7 @@
     state: present
   become: false
   become_user: "{{ postgres_admin_user }}"
+
+- name: Deploy Prometheus postgres exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: postgres_exporter_enabled | bool

roles/postgres/templates/exporter-env.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ postgres_exporter_args_var }}="--web.listen-address={{ postgres_exporter_listen_address }}"
+DATA_SOURCE_NAME="postgresql://{{ postgres_exporter_user }}:{{ postgres_exporter_password }}@{{ postgres_exporter_pg_host }}:{{ postgres_exporter_pg_port }}/{{ postgres_exporter_pg_dbname }}?sslmode=disable"

roles/postgres/vars/archlinux.yml

@@ -11,3 +11,9 @@ postgres_service_name: postgresql
 postgres_config_path: "{{ postgres_data_dir }}/postgresql.conf"
 postgres_config_dir: "{{ postgres_data_dir }}/conf.d"
 postgres_hba_path: "{{ postgres_data_dir }}/pg_hba.conf"
+
+# Prometheus exporter
+postgres_exporter_package: prometheus-postgres-exporter
+postgres_exporter_service: prometheus-postgres-exporter
+postgres_exporter_args_file: /etc/conf.d/prometheus-postgres-exporter
+postgres_exporter_args_var: POSTGRES_EXPORTER_ARGS

roles/postgres/vars/debian.yml

@@ -8,3 +8,9 @@ postgres_service_name: postgresql
 postgres_config_path: /etc/postgresql/current/main/postgresql.conf
 postgres_config_dir: /etc/postgresql/current/main/conf.d
 postgres_hba_path: /etc/postgresql/current/main/pg_hba.conf
+
+# Prometheus exporter
+postgres_exporter_package: prometheus-postgres-exporter
+postgres_exporter_service: prometheus-postgres-exporter
+postgres_exporter_args_file: /etc/default/prometheus-postgres-exporter
+postgres_exporter_args_var: ARGS

roles/valkey/README.md

@@ -326,6 +326,26 @@ INFO memory
 INFO stats
 ```
 
+### Prometheus exporter
+
+Enable the exporter and set a password to create a dedicated read-only
+`valkey_exporter` ACL user:
+
+```yaml
+valkey_exporter_enabled: true
+valkey_exporter_password: "<min 12 chars>"
+```
+
+The role appends the user to `users.acl` and runs `redis_exporter` on
+`127.0.0.1:9121`. Pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'valkey'
+    static_configs:
+      - targets: ['127.0.0.1:9121']
+```
+
 Check connected clients:
 
 ```bash

roles/valkey/defaults/main.yml

@@ -35,6 +35,20 @@ valkey_acl_users: []
 #     keypattern: "*"      # Keys this user can access
 #     commands: "+@all -@dangerous"  # Allowed commands
 
+# Prometheus exporter (optional, via redis_exporter). Creates a dedicated
+# read-only ACL user for monitoring.
+valkey_exporter_enabled: false
+valkey_exporter_listen_address: "127.0.0.1:9121"
+valkey_exporter_redis_addr: "redis://127.0.0.1:6379"
+valkey_exporter_user: valkey_exporter
+# valkey_exporter_password: ""  # Intentionally undefined - required when enabled
+# Read-only command set recommended by redis_exporter for monitoring.
+valkey_exporter_commands: >-
+  -@all +@connection +memory -readonly +strlen +config|get +xinfo +pfcount
+  -quit +zcard +type +xlen -readwrite -command +client -wait +scard +llen
+  +hlen +arcount +get +eval +slowlog +cluster|info +cluster|slots +cluster|nodes
+  -hello -echo +info +latency +scan -reset -auth -asking
+
 # Valkey log level (debug, verbose, notice, warning)
 valkey_loglevel: notice
 

roles/valkey/handlers/main.yml

@@ -13,6 +13,11 @@
     name: "{{ valkey_service_name }}"
     state: reloaded
 
+- name: Restart valkey exporter
+  ansible.builtin.systemd:
+    name: "{{ valkey_exporter_service }}"
+    state: restarted
+
 - name: Update GRUB
   ansible.builtin.shell: |
     if command -v update-grub &> /dev/null; then

roles/valkey/tasks/exporter.yml

@@ -0,0 +1,36 @@
+---
+# Prometheus valkey exporter (optional, gated by valkey_exporter_enabled).
+# Authenticates as the read-only valkey_exporter ACL user created by the
+# users.acl template.
+
+- name: Validate exporter password is set
+  ansible.builtin.assert:
+    that:
+      - valkey_exporter_password is defined
+      - valkey_exporter_password | length >= 12
+    fail_msg: |
+      valkey_exporter_password is required (min 12 chars) when
+      valkey_exporter_enabled is true.
+      See roles/valkey/defaults/main.yml for configuration instructions.
+    success_msg: "Exporter password validation passed"
+
+- name: Install redis_exporter
+  ansible.builtin.package:
+    name: "{{ valkey_exporter_package }}"
+    state: present
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ valkey_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart valkey exporter
+
+- name: Enable and start redis_exporter
+  ansible.builtin.systemd:
+    name: "{{ valkey_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/valkey/tasks/main.yml

@@ -60,3 +60,7 @@
   delay: 2
   register: ufw_result
   until: ufw_result is succeeded
+
+- name: Deploy Prometheus valkey exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: valkey_exporter_enabled | bool

roles/valkey/templates/exporter-env.conf.j2

@@ -0,0 +1,5 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ valkey_exporter_args_var }}="--web.listen-address={{ valkey_exporter_listen_address }}"
+REDIS_ADDR="{{ valkey_exporter_redis_addr }}"
+REDIS_USER="{{ valkey_exporter_user }}"
+REDIS_PASSWORD="{{ valkey_exporter_password }}"

roles/valkey/templates/users.acl.j2

@@ -2,3 +2,6 @@ user default on >{{ valkey_admin_password }} ~* &* +@all
 {% for acl_user in valkey_acl_users %}
 user {{ acl_user.username }} on >{{ acl_user.password }} {% for pattern in acl_user.keypattern.split() %}~{{ pattern }} {% endfor %}{{ acl_user.commands | default('+@all -@dangerous') }}
 {% endfor %}
+{% if valkey_exporter_enabled | bool %}
+user {{ valkey_exporter_user }} on >{{ valkey_exporter_password }} ~* {{ valkey_exporter_commands }}
+{% endif %}

roles/valkey/vars/archlinux.yml

@@ -6,3 +6,9 @@ valkey_config_file: /etc/valkey/valkey.conf
 valkey_user: valkey
 valkey_group: valkey
 valkey_dir: /var/lib/valkey
+
+# Prometheus exporter
+valkey_exporter_package: prometheus-redis-exporter
+valkey_exporter_service: prometheus-redis-exporter
+valkey_exporter_args_file: /etc/conf.d/prometheus-redis-exporter
+valkey_exporter_args_var: REDIS_EXPORTER_ARGS

roles/valkey/vars/debian.yml

@@ -6,3 +6,9 @@ valkey_config_file: /etc/valkey/valkey.conf
 valkey_user: valkey
 valkey_group: valkey
 valkey_dir: /var/lib/valkey
+
+# Prometheus exporter
+valkey_exporter_package: prometheus-redis-exporter
+valkey_exporter_service: prometheus-redis-exporter
+valkey_exporter_args_file: /etc/default/prometheus-redis-exporter
+valkey_exporter_args_var: ARGS