feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/nginx/README.md

@@ -28,6 +28,26 @@ hostname and breaking TLS verification on other vhosts.
 
 Disable with `nginx_default_server_enabled: false`.
 
+## Prometheus exporter
+
+Optionally exposes nginx metrics (active connections, requests/sec) for
+Prometheus via `nginx-prometheus-exporter`, which scrapes a loopback-only
+`stub_status` endpoint this role deploys. Enable it:
+
+```yaml
+nginx_exporter_enabled: true
+```
+
+The exporter binds to `127.0.0.1:9113`; the `stub_status` block listens on
+`127.0.0.1:8090` and denies non-localhost clients. Pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'nginx'
+    static_configs:
+      - targets: ['127.0.0.1:9113']
+```
+
 ## Service Integration Pattern
 
 Each service role should deploy its own vhost config:

roles/nginx/defaults/main.yml

@@ -44,3 +44,10 @@ nginx_forwarder: {}
 # Let's Encrypt / Certbot configuration
 # acme_email: ""  # Required for Let's Encrypt - intentionally undefined
 # Set this variable to enable Certbot installation and certificate management
+
+# Prometheus exporter (optional, via nginx-prometheus-exporter)
+# Scrapes a loopback-only stub_status endpoint this role deploys.
+nginx_exporter_enabled: false
+nginx_exporter_listen_address: "127.0.0.1:9113"
+nginx_exporter_stub_status_listen: "127.0.0.1:8090"
+nginx_exporter_scrape_uri: "http://127.0.0.1:8090/stub_status"

roles/nginx/handlers/main.yml

@@ -8,3 +8,8 @@
   ansible.builtin.systemd:
     name: nginx
     state: restarted
+
+- name: Restart nginx exporter
+  ansible.builtin.systemd:
+    name: "{{ nginx_exporter_service }}"
+    state: restarted

roles/nginx/tasks/exporter.yml

@@ -0,0 +1,34 @@
+---
+# Prometheus nginx exporter (optional, gated by nginx_exporter_enabled).
+# Installs nginx-prometheus-exporter and exposes a loopback-only stub_status
+# endpoint that the exporter scrapes.
+
+- name: Install nginx-prometheus-exporter
+  ansible.builtin.package:
+    name: "{{ nginx_exporter_package }}"
+    state: present
+
+- name: Deploy nginx stub_status endpoint
+  ansible.builtin.template:
+    src: stub-status.conf.j2
+    dest: "{{ nginx_conf_dir }}/99-stub-status.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload nginx
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ nginx_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart nginx exporter
+
+- name: Enable and start nginx exporter
+  ansible.builtin.systemd:
+    name: "{{ nginx_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/nginx/tasks/main.yml

@@ -207,3 +207,7 @@
     name: nginx
     enabled: true
     state: started
+
+- name: Deploy Prometheus nginx exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: nginx_exporter_enabled | bool

roles/nginx/templates/exporter-env.conf.j2

@@ -0,0 +1,2 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ nginx_exporter_args_var }}="-nginx.scrape-uri={{ nginx_exporter_scrape_uri }} -web.listen-address={{ nginx_exporter_listen_address }}"

roles/nginx/templates/stub-status.conf.j2

@@ -0,0 +1,12 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+# stub_status endpoint for nginx-prometheus-exporter (loopback only)
+server {
+    listen {{ nginx_exporter_stub_status_listen }};
+    server_name localhost;
+
+    location /stub_status {
+        stub_status;
+        allow 127.0.0.1;
+        deny all;
+    }
+}

roles/nginx/vars/archlinux.yml

@@ -1,3 +1,9 @@
 ---
 nginx_user: http
 certbot_timer: certbot-renew.timer
+
+# Prometheus exporter
+nginx_exporter_package: nginx-prometheus-exporter
+nginx_exporter_service: nginx-prometheus-exporter
+nginx_exporter_args_file: /etc/conf.d/nginx-prometheus-exporter
+nginx_exporter_args_var: NGINX_EXPORTER_ARGS

roles/nginx/vars/debian.yml

@@ -1,3 +1,9 @@
 ---
 nginx_user: www-data
 certbot_timer: certbot.timer
+
+# Prometheus exporter
+nginx_exporter_package: prometheus-nginx-exporter
+nginx_exporter_service: prometheus-nginx-exporter
+nginx_exporter_args_file: /etc/default/prometheus-nginx-exporter
+nginx_exporter_args_var: ARGS