feat(unbound): add prometheus exporter, dashboard, fix socket buffer sysctl

roles/unbound/tasks/exporter.yml

@@ -0,0 +1,35 @@
+---
+# Prometheus unbound exporter (optional, gated by unbound_exporter_enabled).
+# Scrapes unbound-control stats_noreset over the local control interface.
+
+- name: Assert exporter is supported (Arch Linux only)
+  ansible.builtin.assert:
+    that: ansible_facts['os_family'] == 'Archlinux'
+    fail_msg: |
+      The unbound exporter (prometheus-unbound-exporter) is only packaged for
+      Arch Linux. It is not available in Debian/Ubuntu repositories.
+    success_msg: "Unbound exporter supported"
+
+- name: Load OS-specific exporter variables
+  ansible.builtin.include_vars: archlinux.yml
+
+- name: Install prometheus-unbound-exporter
+  ansible.builtin.package:
+    name: "{{ unbound_exporter_package }}"
+    state: present
+
+- name: Deploy exporter environment file
+  ansible.builtin.template:
+    src: exporter-env.conf.j2
+    dest: "{{ unbound_exporter_args_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart unbound exporter
+
+- name: Enable and start prometheus-unbound-exporter
+  ansible.builtin.systemd:
+    name: "{{ unbound_exporter_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true

roles/unbound/tasks/main.yml

@@ -137,13 +137,20 @@
     group: root
     mode: "0644"
 
+# Match so-rcvbuf/so-sndbuf (4m) in unbound.conf. rmem_max was 1 MiB and
+# wmem_max was left at its ~208 KiB default, silently capping unbound's
+# requested 4 MiB buffers (the kernel halves SO_RCVBUF/SO_SNDBUF requests
+# against these sysctls before doubling them).
 - name: Configure sysctl for unbound socket buffers
   ansible.posix.sysctl:
-    name: net.core.rmem_max
-    value: "1048576"
+    name: "{{ item.name }}"
+    value: "{{ item.value }}"
     state: present
     sysctl_set: true
     reload: true
+  loop:
+    - { name: net.core.rmem_max, value: "4194304" }
+    - { name: net.core.wmem_max, value: "4194304" }
 
 - name: Install unbound config
   ansible.builtin.template:
@@ -184,3 +191,7 @@
   delay: 2
   register: ufw_result
   until: ufw_result is succeeded
+
+- name: Deploy Prometheus unbound exporter
+  ansible.builtin.include_tasks: exporter.yml
+  when: unbound_exporter_enabled | bool