feat(monitoring): add nginx, postgres, valkey prometheus exporters

- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled,
  deploys loopback-only stub_status (8090), exporter on 9113
- postgres: postgres_exporter gated by postgres_exporter_enabled,
  creates postgres_exporter role with pg_monitor, exporter on 9187
- valkey: redis_exporter gated by valkey_exporter_enabled, adds
  read-only ACL user to users.acl, exporter on 9121

Each exporter follows the nut pattern (tasks/exporter.yml included from
main.yml, OS vars, 0600 secret env files, password asserts).

roles/valkey/README.md

@@ -326,6 +326,26 @@ INFO memory
 INFO stats
 ```
 
+### Prometheus exporter
+
+Enable the exporter and set a password to create a dedicated read-only
+`valkey_exporter` ACL user:
+
+```yaml
+valkey_exporter_enabled: true
+valkey_exporter_password: "<min 12 chars>"
+```
+
+The role appends the user to `users.acl` and runs `redis_exporter` on
+`127.0.0.1:9121`. Pair it with a scrape job:
+
+```yaml
+prometheus_scrape_configs:
+  - job_name: 'valkey'
+    static_configs:
+      - targets: ['127.0.0.1:9121']
+```
+
 Check connected clients:
 
 ```bash

roles/valkey/defaults/main.yml

@@ -35,6 +35,20 @@ valkey_acl_users: []
 #     keypattern: "*"      # Keys this user can access
 #     commands: "+@all -@dangerous"  # Allowed commands
 
+# Prometheus exporter (optional, via redis_exporter). Creates a dedicated
+# read-only ACL user for monitoring.
+valkey_exporter_enabled: false
+valkey_exporter_listen_address: "127.0.0.1:9121"
+valkey_exporter_redis_addr: "redis://127.0.0.1:6379"
+valkey_exporter_user: valkey_exporter
+# valkey_exporter_password: ""  # Intentionally undefined - required when enabled
+# Read-only command set recommended by redis_exporter for monitoring.
+valkey_exporter_commands: >-
+  -@all +@connection +memory -readonly +strlen +config|get +xinfo +pfcount
+  -quit +zcard +type +xlen -readwrite -command +client -wait +scard +llen
+  +hlen +arcount +get +eval +slowlog +cluster|info +cluster|slots +cluster|nodes
+  -hello -echo +info +latency +scan -reset -auth -asking
+
 # Valkey log level (debug, verbose, notice, warning)
 valkey_loglevel: notice
 

roles/valkey/handlers/main.yml

@@ -13,6 +13,11 @@
     name: "{{ valkey_service_name }}"
     state: reloaded
 
+- name: Restart valkey exporter
+  ansible.builtin.systemd:
+    name: "{{ valkey_exporter_service }}"
+    state: restarted
+
 - name: Update GRUB
   ansible.builtin.shell: |
     if command -v update-grub &> /dev/null; then

roles/valkey/tasks/exporter.yml

@@ -0,0 +1,36 @@
+---
+# Prometheus valkey exporter (optional, gated by valkey_exporter_enabled).
+# Authenticates as the read-only valkey_exporter ACL user created by the
+# users.acl template.
+
+- name: Validate exporter password is set
+  ansible.builtin.assert:
+    that:
+      - valkey_exporter_password is defined
+      - valkey_exporter_password | length >= 12
+    fail_msg: |
+      valkey_exporter_password is required (min 12 chars) when
+      valkey_exporter_enabled is true.
+      See roles/valkey/defaults/main.yml for configuration instructions.
+    success_msg: "Exporter password validation passed"
+
+- name: Install redis_exporter
+  ansible.builtin.package:
+    name: "{{ valkey_exporter_package }}"
+    state: present
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ valkey_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart valkey exporter
+
+- name: Enable and start redis_exporter
+  ansible.builtin.systemd:
+    name: "{{ valkey_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/valkey/tasks/main.yml

@@ -60,3 +60,7 @@
   delay: 2
   register: ufw_result
   until: ufw_result is succeeded
+
+- name: Deploy Prometheus valkey exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: valkey_exporter_enabled | bool

roles/valkey/templates/exporter-env.conf.j2

@@ -0,0 +1,5 @@
+# Managed by Ansible - DO NOT EDIT MANUALLY
+{{ valkey_exporter_args_var }}="--web.listen-address={{ valkey_exporter_listen_address }}"
+REDIS_ADDR="{{ valkey_exporter_redis_addr }}"
+REDIS_USER="{{ valkey_exporter_user }}"
+REDIS_PASSWORD="{{ valkey_exporter_password }}"

roles/valkey/templates/users.acl.j2

@@ -2,3 +2,6 @@ user default on >{{ valkey_admin_password }} ~* &* +@all
 {% for acl_user in valkey_acl_users %}
 user {{ acl_user.username }} on >{{ acl_user.password }} {% for pattern in acl_user.keypattern.split() %}~{{ pattern }} {% endfor %}{{ acl_user.commands | default('+@all -@dangerous') }}
 {% endfor %}
+{% if valkey_exporter_enabled | bool %}
+user {{ valkey_exporter_user }} on >{{ valkey_exporter_password }} ~* {{ valkey_exporter_commands }}
+{% endif %}

roles/valkey/vars/archlinux.yml

@@ -6,3 +6,9 @@ valkey_config_file: /etc/valkey/valkey.conf
 valkey_user: valkey
 valkey_group: valkey
 valkey_dir: /var/lib/valkey
+
+# Prometheus exporter
+valkey_exporter_package: prometheus-redis-exporter
+valkey_exporter_service: prometheus-redis-exporter
+valkey_exporter_args_file: /etc/conf.d/prometheus-redis-exporter
+valkey_exporter_args_var: REDIS_EXPORTER_ARGS

roles/valkey/vars/debian.yml

@@ -6,3 +6,9 @@ valkey_config_file: /etc/valkey/valkey.conf
 valkey_user: valkey
 valkey_group: valkey
 valkey_dir: /var/lib/valkey
+
+# Prometheus exporter
+valkey_exporter_package: prometheus-redis-exporter
+valkey_exporter_service: prometheus-redis-exporter
+valkey_exporter_args_file: /etc/default/prometheus-redis-exporter
+valkey_exporter_args_var: ARGS