50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
---
|
|
# Prometheus WireGuard exporter (optional, gated by wireguard_exporter_enabled).
|
|
# Runs `wg show all dump` and exposes per-peer byte counters and last-handshake
|
|
# timestamps. Arch Linux only: prometheus-wireguard-exporter is packaged in
|
|
# [extra]; there is no Debian/Ubuntu package.
|
|
|
|
- name: Assert exporter is supported on this OS
|
|
ansible.builtin.assert:
|
|
that: ansible_facts['os_family'] == 'Archlinux'
|
|
fail_msg: |
|
|
wireguard_exporter is Arch Linux only (prometheus-wireguard-exporter is
|
|
not packaged for Debian/Ubuntu). Set wireguard_exporter_enabled: false.
|
|
success_msg: "Exporter OS support validated"
|
|
|
|
- name: Load OS-specific exporter variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "archlinux.yml"
|
|
|
|
- name: Install wireguard exporter
|
|
ansible.builtin.package:
|
|
name: "{{ wireguard_exporter_package }}"
|
|
state: present
|
|
|
|
- name: Deploy exporter environment file
|
|
ansible.builtin.template:
|
|
src: exporter-env.conf.j2
|
|
dest: "{{ wireguard_exporter_args_file }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart wireguard exporter
|
|
|
|
- name: Allow exporter to run wg via sudo
|
|
ansible.builtin.copy:
|
|
content: "{{ wireguard_exporter_user }} ALL=(root) NOPASSWD: /usr/bin/wg\n"
|
|
dest: /etc/sudoers.d/wireguard_exporter
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Enable and start wireguard exporter
|
|
ansible.builtin.systemd:
|
|
name: "{{ wireguard_exporter_service }}"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|