fixes: ghost image upgrades and smartctl exporter

roles/node_exporter/defaults/main.yaml

@@ -0,0 +1,15 @@
+---
+node_exporter_base_flags: >-
+  --collector.systemd
+  --collector.processes
+  --collector.tcpstat
+  --no-collector.infiniband
+  --no-collector.tapestats
+  --no-collector.zfs
+
+# Disable ARP collector by default unless this is the bastion router in barbican
+node_exporter_disable_arp: "{{ not (inventory_hostname == 'bastion' and 'barbican' in group_names) }}"
+
+node_exporter_flags: >-
+  {{ node_exporter_base_flags }}
+  {% if node_exporter_disable_arp %}--no-collector.arp{% endif %}

roles/node_exporter/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Restart node_exporter
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter
+    state: restarted
+  become: true

roles/node_exporter/tasks/main.yaml

@@ -0,0 +1,59 @@
+---
+- name: Install node_exporter (Debian)
+  ansible.builtin.apt:
+    name: prometheus-node-exporter
+    state: present
+  when: ansible_facts["os_family"] == "Debian"
+  become: true
+
+- name: Install node_exporter (Arch)
+  community.general.pacman:
+    name: prometheus-node-exporter
+    state: present
+  when: ansible_facts["os_family"] == "Archlinux"
+  become: true
+
+- name: Configure node_exporter flags (Debian)
+  ansible.builtin.copy:
+    dest: /etc/default/prometheus-node-exporter
+    content: |
+      ARGS="{{ node_exporter_flags }}"
+    owner: root
+    group: root
+    mode: '0644'
+  when: ansible_facts["os_family"] == "Debian"
+  become: true
+  notify: Restart node_exporter
+
+- name: Configure node_exporter flags (Arch)
+  ansible.builtin.copy:
+    dest: /etc/conf.d/prometheus-node-exporter
+    content: |
+      NODE_EXPORTER_ARGS="{{ node_exporter_flags }}"
+    owner: root
+    group: root
+    mode: '0644'
+  when: ansible_facts["os_family"] == "Archlinux"
+  become: true
+  notify: Restart node_exporter
+
+- name: Enable and start node_exporter service
+  ansible.builtin.systemd:
+    name: prometheus-node-exporter
+    state: started
+    enabled: true
+  become: true
+
+- name: Populate service facts
+  ansible.builtin.service_facts:
+
+- name: Open port 9100 for prometheus scraping
+  ansible.posix.firewalld:
+    port: 9100/tcp
+    permanent: true
+    state: enabled
+    immediate: true
+  become: true
+  when: >
+    ansible_facts.services['firewalld.service'] is defined and
+    ansible_facts.services['firewalld.service'].state == 'running'