fixes: ghost image upgrades and smartctl exporter

roles/arch_update/files/aur_diff_check.py

@@ -63,6 +63,19 @@ def extract_ver(content):
 def strip_volatile_fields(content):
     content = re.sub(r'^pkgver=.*$', '', content, flags=re.MULTILINE)
     content = re.sub(r'^pkgrel=.*$', '', content, flags=re.MULTILINE)
+    
+    source_vars = set()
+    source_matches = re.finditer(r'^source(?:_[a-zA-Z0-9_]+)?=\((.*?)\)', content, flags=re.MULTILINE | re.DOTALL)
+    for match in source_matches:
+        source_content = match.group(1)
+        vars_in_source = re.findall(r'\$(?:\{(_[a-zA-Z0-9_]+)\}|(_[a-zA-Z0-9_]+))', source_content)
+        for v1, v2 in vars_in_source:
+            if v1: source_vars.add(v1)
+            if v2: source_vars.add(v2)
+            
+    for var in source_vars:
+        content = re.sub(r'^' + re.escape(var) + r'=.*$', '', content, flags=re.MULTILINE)
+
     sum_patterns = [
         r'md5sums', r'sha1sums', r'sha224sums', r'sha256sums', 
         r'sha384sums', r'sha512sums', r'b2sums', r'cksums'

roles/docker_update/tasks/main.yaml

@@ -1,10 +1,26 @@
 ---
-- name: Pull latest images and update Docker Compose stacks
+- name: Pre-build images to ensure base images are pulled
+  become: true
+  ansible.builtin.command:
+    cmd: docker compose build --pull
+    chdir: "{{ item }}"
+  loop: "{{ docker_compose_dirs | default([]) }}"
+  changed_when: false
+  register: _build_result
+
+- name: Pull latest non-buildable service images
+  become: true
+  ansible.builtin.command:
+    cmd: docker compose pull --ignore-buildable
+    chdir: "{{ item }}"
+  loop: "{{ docker_compose_dirs | default([]) }}"
+  changed_when: false
+
+- name: Update Docker Compose stacks
   become: true
   community.docker.docker_compose_v2:
     project_src: "{{ item }}"
     state: present
-    pull: always
+    pull: never
     build: always
   loop: "{{ docker_compose_dirs | default([]) }}"
-

roles/node_exporter/defaults/main.yaml

@@ -0,0 +1,15 @@
+---
+node_exporter_base_flags: >-
+  --collector.systemd
+  --collector.processes
+  --collector.tcpstat
+  --no-collector.infiniband
+  --no-collector.tapestats
+  --no-collector.zfs
+
+# Disable ARP collector by default unless this is the bastion router in barbican
+node_exporter_disable_arp: "{{ not (inventory_hostname == 'bastion' and 'barbican' in group_names) }}"
+
+node_exporter_flags: >-
+  {{ node_exporter_base_flags }}
+  {% if node_exporter_disable_arp %}--no-collector.arp{% endif %}

roles/node_exporter/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Restart node_exporter
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter
+    state: restarted
+  become: true

roles/node_exporter/tasks/main.yaml

@@ -0,0 +1,59 @@
+---
+- name: Install node_exporter (Debian)
+  ansible.builtin.apt:
+    name: prometheus-node-exporter
+    state: present
+  when: ansible_facts["os_family"] == "Debian"
+  become: true
+
+- name: Install node_exporter (Arch)
+  community.general.pacman:
+    name: prometheus-node-exporter
+    state: present
+  when: ansible_facts["os_family"] == "Archlinux"
+  become: true
+
+- name: Configure node_exporter flags (Debian)
+  ansible.builtin.copy:
+    dest: /etc/default/prometheus-node-exporter
+    content: |
+      ARGS="{{ node_exporter_flags }}"
+    owner: root
+    group: root
+    mode: '0644'
+  when: ansible_facts["os_family"] == "Debian"
+  become: true
+  notify: Restart node_exporter
+
+- name: Configure node_exporter flags (Arch)
+  ansible.builtin.copy:
+    dest: /etc/conf.d/prometheus-node-exporter
+    content: |
+      NODE_EXPORTER_ARGS="{{ node_exporter_flags }}"
+    owner: root
+    group: root
+    mode: '0644'
+  when: ansible_facts["os_family"] == "Archlinux"
+  become: true
+  notify: Restart node_exporter
+
+- name: Enable and start node_exporter service
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter
+    state: started
+    enabled: true
+  become: true
+
+- name: Populate service facts
+  ansible.builtin.service_facts:
+
+- name: Open port 9100 for prometheus scraping
+  ansible.posix.firewalld:
+    port: 9100/tcp
+    permanent: true
+    state: enabled
+    immediate: true
+  become: true
+  when: >
+    ansible_facts.services['firewalld.service'] is defined and
+    ansible_facts.services['firewalld.service'].state == 'running'

roles/smartctl_exporter/tasks/main.yaml

@@ -3,15 +3,15 @@
   ansible.builtin.apt:
     name: prometheus-smartctl-exporter
     state: present
-  when: ansible_os_family == "Debian"
+  when: ansible_facts["os_family"] == "Debian"
   become: true
 
 - name: Install smartctl_exporter (Arch)
   aur:
-    name: prometheus-smartctl-exporter-bin
-    use: pikaur
+    name: prometheus-smartctl-exporter
+    use: "{{ aur_helper }}"
     state: present
-  when: ansible_os_family == "Archlinux"
+  when: ansible_facts["os_family"] == "Archlinux"
 
 - name: Enable and start smartctl_exporter service
   ansible.builtin.systemd: